@mohasinac/appkit 4.35.1 → 4.35.3

package/dist/constants/api-endpoints.d.ts

@@ -23,6 +23,16 @@ export declare const AUTH_ENDPOINTS: {
     readonly SESSION_ACTIVITY: "/api/auth/session/activity";
     readonly SESSION_VALIDATE: "/api/auth/session/validate";
     readonly EVENT_INIT: "/api/auth/event/init";
+    /**
+     * Cooldown gate the client asks BEFORE calling Firebase's own
+     * `sendPasswordResetEmail` / `sendEmailVerification`.
+     *
+     * Those go browser → Firebase with no server hop, so this is the only
+     * throttle they have — nothing else on our side ever sees them. Advisory by
+     * design: a failure here resolves to "allowed", because a user locked out of
+     * their account must not also be locked out by our infrastructure.
+     */
+    readonly MAIL_GATE: "/api/auth/mail-gate";
 };
 export declare const ACCOUNT_ENDPOINTS: {
     /** @param userId — Firestore user document id */
@@ -480,6 +490,16 @@ export declare const API_ENDPOINTS: {
         readonly SESSION_ACTIVITY: "/api/auth/session/activity";
         readonly SESSION_VALIDATE: "/api/auth/session/validate";
         readonly EVENT_INIT: "/api/auth/event/init";
+        /**
+         * Cooldown gate the client asks BEFORE calling Firebase's own
+         * `sendPasswordResetEmail` / `sendEmailVerification`.
+         *
+         * Those go browser → Firebase with no server hop, so this is the only
+         * throttle they have — nothing else on our side ever sees them. Advisory by
+         * design: a failure here resolves to "allowed", because a user locked out of
+         * their account must not also be locked out by our infrastructure.
+         */
+        readonly MAIL_GATE: "/api/auth/mail-gate";
     };
     readonly ACCOUNT: {
         /** @param userId — Firestore user document id */
@@ -939,6 +959,16 @@ export declare const API_ROUTES: {
         readonly SESSION_ACTIVITY: "/api/auth/session/activity";
         readonly SESSION_VALIDATE: "/api/auth/session/validate";
         readonly EVENT_INIT: "/api/auth/event/init";
+        /**
+         * Cooldown gate the client asks BEFORE calling Firebase's own
+         * `sendPasswordResetEmail` / `sendEmailVerification`.
+         *
+         * Those go browser → Firebase with no server hop, so this is the only
+         * throttle they have — nothing else on our side ever sees them. Advisory by
+         * design: a failure here resolves to "allowed", because a user locked out of
+         * their account must not also be locked out by our infrastructure.
+         */
+        readonly MAIL_GATE: "/api/auth/mail-gate";
     };
     readonly ACCOUNT: {
         /** @param userId — Firestore user document id */

package/dist/constants/api-endpoints.js

@@ -35,6 +35,16 @@ export const AUTH_ENDPOINTS = {
     SESSION_ACTIVITY: "/api/auth/session/activity",
     SESSION_VALIDATE: "/api/auth/session/validate",
     EVENT_INIT: "/api/auth/event/init",
+    /**
+     * Cooldown gate the client asks BEFORE calling Firebase's own
+     * `sendPasswordResetEmail` / `sendEmailVerification`.
+     *
+     * Those go browser → Firebase with no server hop, so this is the only
+     * throttle they have — nothing else on our side ever sees them. Advisory by
+     * design: a failure here resolves to "allowed", because a user locked out of
+     * their account must not also be locked out by our infrastructure.
+     */
+    MAIL_GATE: "/api/auth/mail-gate",
     /*
      * RESEND_VERIFICATION was here and is gone. The route was deleted in the
      * Firebase-native auth migration (Root Cause #54: the Admin SDK cannot send

package/dist/constants/notification-types.d.ts

@@ -29,7 +29,7 @@ import type { NotificationType } from "../features/admin/schemas/firestore";
 export { NOTIFICATION_TYPE_VALUES };
 export type { NotificationType };
 /** Alias kept for the two existing importers. */
-export declare const NOTIFICATION_TYPES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
+export declare const NOTIFICATION_TYPES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "support_ticket_update", "scam_report_update", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
 /**
  * `order_shipped` → `Order shipped`.
  *

package/dist/features/admin/actions/notification-actions.d.ts

@@ -28,6 +28,26 @@ export interface SendNotificationInput extends NotificationCreateInput {
      * the seller, `offer_responded` back to the buyer.
      */
     audience?: NotificationAudience;
+    /**
+     * Bypass `EMAIL_ELIGIBLE_TYPES` for THIS send, because a human explicitly
+     * asked for it.
+     *
+     * The only caller is the support-ticket reply route, where a staff member
+     * ticked "also email the user" on a reply. `support_ticket_update` is
+     * ineligible by default precisely so routine back-and-forth costs nothing —
+     * this is the escape hatch for the reply that genuinely has to reach an
+     * inbox.
+     *
+     * 🛑 It bypasses ELIGIBILITY ONLY. The kill switch, the daily ceiling, the
+     * channel config and the user's own opt-out all still apply — a staff tick
+     * is a request, not an override of the site's posture or of the recipient's
+     * stated preference.
+     *
+     * Deliberately a named literal rather than `boolean`: a `force: true` reads
+     * as "send harder" at the call site and invites reuse, while
+     * `"staff_requested"` states who is accountable for the send.
+     */
+    eligibilityOverride?: "staff_requested";
 }
 export interface SendNotificationResult {
     notification: NotificationDocument;

package/dist/features/admin/actions/notification-actions.js

@@ -8,6 +8,7 @@ import { enqueueJob } from "../../jobs/actions/enqueue-job";
 import { serverLogger } from "../../../monitoring";
 import { decryptPii } from "../../../security/index";
 import { resolveNotificationActionUrl, TYPE_AUDIENCE, } from "../../../_internal/shared/features/notifications/action-url";
+import { isEmailEligible } from "../../../_internal/shared/features/notifications/email-eligibility";
 import { renderNotificationEmail } from "../../email/notification-templates";
 /**
  * A notification's `actionUrl` is a site-relative path — correct for the
@@ -111,7 +112,7 @@ export async function getUnreadNotificationCount(userId) {
  *   5. The required credentials are set in siteSettings.credentials
  */
 export async function sendNotification(input) {
-    const { userEmail, userPhone, emailHtml, audience, ...notifInput } = input;
+    const { userEmail, userPhone, emailHtml, audience, eligibilityOverride, ...notifInput } = input;
     /*
      * Fill `actionUrl` when the caller did not.
      *
@@ -131,6 +132,35 @@ export async function sendNotification(input) {
         ...notifInput,
         ...(resolvedActionUrl ? { actionUrl: resolvedActionUrl } : {}),
     });
+    /*
+     * 🛑 The eligibility gate, and it is FIRST for a reason.
+     *
+     * `EMAIL_ELIGIBLE_TYPES` (see that file for the full argument) decides
+     * whether a type may leave the building at all. Checking it here — before
+     * the siteSettings read and before the user-prefs read — is what makes the
+     * expensive fan-outs free:
+     *
+     *   `auctionSettlement` sends `bid_lost` to up to 50 losing bidders in
+     *   parallel per auction. Each of those calls would otherwise pay TWO
+     *   Firestore reads (settings + user doc) to arrive at "skipped". That is
+     *   100 reads per auction to send nothing, and every expired auction settles
+     *   concurrently.
+     *
+     * Returning here costs zero reads, and it is also what lets the daily send
+     * counter stay a single unsharded document: the only remaining concurrent
+     * fan-out never reaches the counter.
+     *
+     * The bell is already filled by the write above, so nothing is lost — this
+     * suppresses the emailed/messaged COPY, not the notification.
+     *
+     * One map gates both channels deliberately. If a type is ever genuinely
+     * WhatsApp-worthy but not email-worthy, split the map then rather than
+     * loosening this early return.
+     */
+    if (!isEmailEligible(notifInput.type) &&
+        eligibilityOverride !== "staff_requested") {
+        return { notification, email: "skipped", whatsapp: "skipped" };
+    }
     // Load channel config + credentials (one Firestore read).
     let settings;
     try {
@@ -204,6 +234,18 @@ export async function sendNotification(input) {
         // "Your catalogue photos are going stale" — housekeeping about the user's
         // own account, which is what `system` covers.
         catalogue_images_stale: "system",
+        /*
+         * Both land under `system` rather than getting new preference keys.
+         *
+         * Same reasoning as the EMI note above: an eighth and ninth key would have
+         * no stored value on any existing user, so it reads as on or off purely by
+         * accident of the default — a silent migration nobody asked for. And
+         * neither is something a user would plausibly want to silence
+         * independently: a ticket update is a reply to a conversation THEY started,
+         * and a scam-report outcome is the answer to a report THEY filed.
+         */
+        support_ticket_update: "system",
+        scam_report_update: "system",
     };
     const typeKey = typeToPrefsKey[type];
     // If the user has explicitly disabled this notification type, skip all external channels.

package/dist/features/admin/components/AdminSiteSettingsView.js

@@ -306,7 +306,17 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
     // Daily ops digest — recipients are edited as one-per-line text, split on save.
     const [digestEnabled, setDigestEnabled] = React.useState(false);
     const [digestRecipients, setDigestRecipients] = React.useState("");
-    const [digestCcRecipients, setDigestCcRecipients] = React.useState("");
+    /*
+     * Outbound messaging: the kill switch and the daily ceiling.
+     *
+     * `emailEnabled` suppresses USER-facing mail only. Staff mail — the daily
+     * digest, the payout summary — keeps flowing regardless, because switching
+     * off customer email must never also blind the operator.
+     */
+    const [msgEmailEnabled, setMsgEmailEnabled] = React.useState(false);
+    const [msgWhatsappEnabled, setMsgWhatsappEnabled] = React.useState(false);
+    const [msgCeilingEmail, setMsgCeilingEmail] = React.useState(80);
+    const [msgCeilingWhatsapp, setMsgCeilingWhatsapp] = React.useState(200);
     // Snapshot of the masked placeholder strings the server returned for every
     // credentials.* field, captured once per load. A combined single-save has
     // to send the FULL credentials object on every save (not just the group the
@@ -490,7 +500,13 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
         setNotifFromName(s.emailSettings?.fromName ?? "");
         setDigestEnabled(s.emailSettings?.dailyDigest?.enabled ?? false);
         setDigestRecipients((s.emailSettings?.dailyDigest?.recipients ?? []).join("\n"));
-        setDigestCcRecipients((s.emailSettings?.dailyDigest?.ccRecipients ?? []).join("\n"));
+        // Defaults mirror MESSAGE_BUDGET_DEFAULTS — both channels OFF, so a
+        // settings document written before this feature existed reads as quiet
+        // rather than as "on and unmetered".
+        setMsgEmailEnabled(s.messaging?.emailEnabled ?? false);
+        setMsgWhatsappEnabled(s.messaging?.whatsappEnabled ?? false);
+        setMsgCeilingEmail(s.messaging?.dailyCeiling?.email ?? 80);
+        setMsgCeilingWhatsapp(s.messaging?.dailyCeiling?.whatsapp ?? 200);
         originalMaskedRef.current = {
             razorpayKeyId: s.credentialsMasked?.razorpayKeyId ?? "",
             razorpayKeySecret: s.credentialsMasked?.razorpayKeySecret ?? "",
@@ -630,7 +646,21 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
                 dailyDigest: {
                     enabled: digestEnabled,
                     recipients: splitEmailList(digestRecipients),
-                    ccRecipients: splitEmailList(digestCcRecipients),
+                    // Always empty — the CC field is gone (see the Notifications tab).
+                    // Sent explicitly rather than omitted so a save clears any CC list a
+                    // pre-existing document still carries.
+                    ccRecipients: [],
+                },
+            },
+            messaging: {
+                emailEnabled: msgEmailEnabled,
+                whatsappEnabled: msgWhatsappEnabled,
+                dailyCeiling: {
+                    email: msgCeilingEmail,
+                    whatsapp: msgCeilingWhatsapp,
+                    // No SMS sender exists; the ceiling is carried so one cannot ship
+                    // uncapped if somebody adds a provider later.
+                    sms: 50,
                 },
             },
             integrations: { googleAnalyticsId: gaMeasurementId, facebookPixelId: fbPixelId, gtmContainerId },
@@ -744,7 +774,7 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
                                                         ...bidIncrementTiers.slice(0, -1),
                                                         { upTo: 100, increment: 10 },
                                                         bidIncrementTiers[bidIncrementTiers.length - 1] ?? { upTo: null, increment: 1000 },
-                                                    ]), children: "+ Add tier" })] }), _jsx(Input, { label: "Auto-extend window (minutes before end)", value: String(autoExtendWindow), onChange: (e) => setAutoExtendWindow(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Extend auction end time if a bid arrives within this window." }), _jsx(Input, { label: "Settlement grace period (hours)", value: String(settlementGrace), onChange: (e) => setSettlementGrace(parseInt(e.target.value) || 0), type: "number", min: 1, helperText: "Time winner has to pay before the auction is re-listed." })] }) }), _jsx(TabsContent, { value: "limits", children: _jsx(SettingsTabForm, { id: "limits", label: "Limits", children: _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Max products per store", value: String(maxProductsPerStore), onChange: (e) => setMaxProductsPerStore(parseInt(e.target.value) || 0), type: "number", min: 1 }), _jsx(Input, { label: "Max custom fields per product", value: String(maxCustomFields), onChange: (e) => setMaxCustomFields(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Max custom sections per product", value: String(maxCustomSections), onChange: (e) => setMaxCustomSections(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Order cancellation window (hours)", value: String(orderCancelWindow), onChange: (e) => setOrderCancelWindow(parseInt(e.target.value) || 0), type: "number", min: 0 })] }) }) }), _jsx(TabsContent, { value: "whatsapp", children: _jsxs(SettingsTabForm, { id: "whatsapp", label: "Whatsapp", children: [_jsx(Text, { size: "xs", color: "muted", children: "Platform-level WhatsApp Business Cloud API credentials. Used for automated purchase announcements to admin numbers when orders are placed. Store owners configure their own credentials in Store \u2192 WhatsApp." }), _jsx(Input, { label: "Phone Number ID", value: waPhoneNumberId, onChange: (e) => setWaPhoneNumberId(e.target.value), placeholder: "987654321098765", helperText: "From Meta for Developers \u2192 App \u2192 WhatsApp \u2192 API Setup" }), _jsx(MaskedInput, { label: "Cloud API System User Token", value: waCloudApiToken, onChange: setWaCloudApiToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived system user access token with WhatsApp Business permissions" }), _jsx(Input, { label: "Admin Notify Numbers", value: waAdminNotifyNumbers, onChange: (e) => setWaAdminNotifyNumbers(e.target.value), placeholder: "919876543210,918765432109", helperText: "Comma-separated, digits-only, include country code. These receive a WhatsApp message when any order is placed." }), _jsx(Text, { size: "xs", color: "muted", children: "Approved Meta message templates for the buyer-facing WhatsApp order-updates addon (Fees tab). Meta rejects business-initiated free-text WhatsApp messages outside a 24h customer-service window \u2014 a real template name here is required for that notification type to actually deliver. Leave blank to skip WhatsApp for that type (in-app + email still fire)." }), _jsx(Input, { label: "Template language code", value: waTemplateLanguage, onChange: (e) => setWaTemplateLanguage(e.target.value), placeholder: "en", helperText: "BCP-47 code the templates below were approved in, e.g. en or en_US." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Order placed template name", value: waTemplateOrderPlaced, onChange: (e) => setWaTemplateOrderPlaced(e.target.value), placeholder: "order_placed_update" }), _jsx(Input, { label: "Order confirmed template name", value: waTemplateOrderConfirmed, onChange: (e) => setWaTemplateOrderConfirmed(e.target.value), placeholder: "order_confirmed_update" }), _jsx(Input, { label: "Order shipped template name", value: waTemplateOrderShipped, onChange: (e) => setWaTemplateOrderShipped(e.target.value), placeholder: "order_shipped_update" }), _jsx(Input, { label: "Order delivered template name", value: waTemplateOrderDelivered, onChange: (e) => setWaTemplateOrderDelivered(e.target.value), placeholder: "order_delivered_update" }), _jsx(Input, { label: "Order cancelled template name", value: waTemplateOrderCancelled, onChange: (e) => setWaTemplateOrderCancelled(e.target.value), placeholder: "order_cancelled_update" }), _jsx(Input, { label: "Refund initiated template name", value: waTemplateRefundInitiated, onChange: (e) => setWaTemplateRefundInitiated(e.target.value), placeholder: "refund_initiated_update" })] })] }) }), _jsx(TabsContent, { value: "notifications", children: _jsxs(SettingsTabForm, { id: "notifications", label: "Notifications", children: [_jsx(Text, { size: "xs", color: "muted", children: "In-app notifications are always on. Enable external channels below to let the platform fan out to email, WhatsApp, or SMS. Users can further restrict which types they receive." }), _jsxs(Stack, { gap: "xs", surface: "muted", rounded: "lg", border: "default", padding: "md", children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "In-app (notification bell)" }), _jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "semibold", rounded: "full", padding: "pill-xs", children: "Always on" })] }), _jsx(Text, { size: "xs", color: "muted", children: "Displayed in the notification bell and inbox. Cannot be disabled." })] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-email-notifications", children: _jsx(Toggle, { label: "Email notifications", checked: notifEmailEnabled, onChange: setNotifEmailEnabled }) }), notifEmailEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send email", options: PRIORITY_OPTIONS, value: notifEmailMinPriority, onValueChange: setNotifEmailMinPriority }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Resend API (for transactional email)" }), _jsx(MaskedInput, { label: "Resend API Key", value: resendApiKey, onChange: setResendApiKey, placeholder: "re_live_\u2026", helperText: "Get your key at resend.com \u2014 used for all transactional notifications." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "From email", value: notifFromEmail, onChange: (e) => setNotifFromEmail(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Input, { label: "From name", value: notifFromName, onChange: (e) => setNotifFromName(e.target.value), placeholder: "LetItRip" })] }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifEmailTypes, onChange: (values) => setNotifEmailTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-daily-digest", children: _jsx(Toggle, { label: "Daily status digest", checked: digestEnabled, onChange: setDigestEnabled }) }), digestEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Text, { size: "xs", color: "muted", children: "Sent every morning at 10:00 IST with the previous 24 hours of order activity. Its arrival doubles as the platform health check \u2014 if it stops landing, something needs a look." }), _jsx(Textarea, { label: "Recipients (To)", value: digestRecipients, onChange: (e) => setDigestRecipients(e.target.value), placeholder: "support@letitrip.in\nmohasin@letitrip.in", rows: 4, helperText: "One address per line." }), _jsx(Textarea, { label: "CC recipients", value: digestCcRecipients, onChange: (e) => setDigestCcRecipients(e.target.value), placeholder: "One address per line", rows: 3, helperText: "Optional \u2014 anyone else who should receive a copy." })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-whatsapp-notifications", children: _jsx(Toggle, { label: "WhatsApp notifications", checked: notifWhatsappEnabled, onChange: setNotifWhatsappEnabled }) }), notifWhatsappEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send WhatsApp", options: PRIORITY_OPTIONS, value: notifWhatsappMinPriority, onValueChange: setNotifWhatsappMinPriority }), _jsx(Toggle, { label: "Enable WhatsApp OTP (for login and verification)", checked: notifWhatsappOtpEnabled, onChange: setNotifWhatsappOtpEnabled }), _jsx(Text, { size: "xs", color: "muted", children: "WhatsApp credentials are configured in the WhatsApp tab (\u246C). OTP messages use the same phone number." }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifWhatsappTypes, onChange: (values) => setNotifWhatsappTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Toggle, { label: "SMS notifications", checked: notifSmsEnabled, onChange: setNotifSmsEnabled }), notifSmsEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send SMS", options: PRIORITY_OPTIONS, value: notifSmsMinPriority, onValueChange: setNotifSmsMinPriority }), _jsx(Text, { size: "xs", color: "muted", children: "SMS gateway credentials (e.g. Twilio, MSG91) can be configured in the Integrations tab once an SMS provider is connected." })] }))] })] }) }), _jsx(TabsContent, { value: "legal", children: _jsx(SettingsTabForm, { id: "legal", label: "Legal", children: [
+                                                    ]), children: "+ Add tier" })] }), _jsx(Input, { label: "Auto-extend window (minutes before end)", value: String(autoExtendWindow), onChange: (e) => setAutoExtendWindow(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Extend auction end time if a bid arrives within this window." }), _jsx(Input, { label: "Settlement grace period (hours)", value: String(settlementGrace), onChange: (e) => setSettlementGrace(parseInt(e.target.value) || 0), type: "number", min: 1, helperText: "Time winner has to pay before the auction is re-listed." })] }) }), _jsx(TabsContent, { value: "limits", children: _jsx(SettingsTabForm, { id: "limits", label: "Limits", children: _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Max products per store", value: String(maxProductsPerStore), onChange: (e) => setMaxProductsPerStore(parseInt(e.target.value) || 0), type: "number", min: 1 }), _jsx(Input, { label: "Max custom fields per product", value: String(maxCustomFields), onChange: (e) => setMaxCustomFields(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Max custom sections per product", value: String(maxCustomSections), onChange: (e) => setMaxCustomSections(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Order cancellation window (hours)", value: String(orderCancelWindow), onChange: (e) => setOrderCancelWindow(parseInt(e.target.value) || 0), type: "number", min: 0 })] }) }) }), _jsx(TabsContent, { value: "whatsapp", children: _jsxs(SettingsTabForm, { id: "whatsapp", label: "Whatsapp", children: [_jsx(Text, { size: "xs", color: "muted", children: "Platform-level WhatsApp Business Cloud API credentials. Used for automated purchase announcements to admin numbers when orders are placed. Store owners configure their own credentials in Store \u2192 WhatsApp." }), _jsx(Input, { label: "Phone Number ID", value: waPhoneNumberId, onChange: (e) => setWaPhoneNumberId(e.target.value), placeholder: "987654321098765", helperText: "From Meta for Developers \u2192 App \u2192 WhatsApp \u2192 API Setup" }), _jsx(MaskedInput, { label: "Cloud API System User Token", value: waCloudApiToken, onChange: setWaCloudApiToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived system user access token with WhatsApp Business permissions" }), _jsx(Input, { label: "Admin Notify Numbers", value: waAdminNotifyNumbers, onChange: (e) => setWaAdminNotifyNumbers(e.target.value), placeholder: "919876543210,918765432109", helperText: "Comma-separated, digits-only, include country code. These receive a WhatsApp message when any order is placed." }), _jsx(Text, { size: "xs", color: "muted", children: "Approved Meta message templates for the buyer-facing WhatsApp order-updates addon (Fees tab). Meta rejects business-initiated free-text WhatsApp messages outside a 24h customer-service window \u2014 a real template name here is required for that notification type to actually deliver. Leave blank to skip WhatsApp for that type (in-app + email still fire)." }), _jsx(Input, { label: "Template language code", value: waTemplateLanguage, onChange: (e) => setWaTemplateLanguage(e.target.value), placeholder: "en", helperText: "BCP-47 code the templates below were approved in, e.g. en or en_US." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Order placed template name", value: waTemplateOrderPlaced, onChange: (e) => setWaTemplateOrderPlaced(e.target.value), placeholder: "order_placed_update" }), _jsx(Input, { label: "Order confirmed template name", value: waTemplateOrderConfirmed, onChange: (e) => setWaTemplateOrderConfirmed(e.target.value), placeholder: "order_confirmed_update" }), _jsx(Input, { label: "Order shipped template name", value: waTemplateOrderShipped, onChange: (e) => setWaTemplateOrderShipped(e.target.value), placeholder: "order_shipped_update" }), _jsx(Input, { label: "Order delivered template name", value: waTemplateOrderDelivered, onChange: (e) => setWaTemplateOrderDelivered(e.target.value), placeholder: "order_delivered_update" }), _jsx(Input, { label: "Order cancelled template name", value: waTemplateOrderCancelled, onChange: (e) => setWaTemplateOrderCancelled(e.target.value), placeholder: "order_cancelled_update" }), _jsx(Input, { label: "Refund initiated template name", value: waTemplateRefundInitiated, onChange: (e) => setWaTemplateRefundInitiated(e.target.value), placeholder: "refund_initiated_update" })] })] }) }), _jsx(TabsContent, { value: "notifications", children: _jsxs(SettingsTabForm, { id: "notifications", label: "Notifications", children: [_jsx(Text, { size: "xs", color: "muted", children: "In-app notifications are always on. Enable external channels below to let the platform fan out to email, WhatsApp, or SMS. Users can further restrict which types they receive." }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Outbound messaging budget" }), _jsxs(Text, { size: "xs", color: "muted", children: ["The master switches. These suppress ", _jsx(Span, { weight: "semibold", children: "user-facing" }), " messages only \u2014 the daily status digest always reaches staff, so turning customer email off never leaves the site unwatched. Transactional messages (checkout verification codes, order receipts) also keep sending, because suppressing those breaks checkout rather than quietening it."] }), _jsx(Toggle, { label: "Send user-facing email", checked: msgEmailEnabled, onChange: setMsgEmailEnabled }), _jsx(Toggle, { label: "Send user-facing WhatsApp", checked: msgWhatsappEnabled, onChange: setMsgWhatsappEnabled }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Daily email ceiling", type: "number", value: String(msgCeilingEmail), onChange: (e) => setMsgCeilingEmail(Number(e.target.value) || 0), helperText: "Resend's free tier is 100/day. 80 leaves headroom for password-reset mail and in-flight sends." }), _jsx(Input, { label: "Daily WhatsApp ceiling", type: "number", value: String(msgCeilingWhatsapp), onChange: (e) => setMsgCeilingWhatsapp(Number(e.target.value) || 0), helperText: "A sanity bound. Meta bills per conversation, not per message." })] }), _jsx(Text, { size: "xs", color: "muted", children: "Some notification types never email regardless of these settings \u2014 losing an auction, being outbid, marketing, review activity and ticket updates are shown in the notification bell only. That is deliberate: those were the highest-volume sends and the ones most likely to exhaust the day's allowance. A support reply can still be emailed one-off from the ticket screen." })] }), _jsxs(Stack, { gap: "xs", surface: "muted", rounded: "lg", border: "default", padding: "md", children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "In-app (notification bell)" }), _jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "semibold", rounded: "full", padding: "pill-xs", children: "Always on" })] }), _jsx(Text, { size: "xs", color: "muted", children: "Displayed in the notification bell and inbox. Cannot be disabled." })] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-email-notifications", children: _jsx(Toggle, { label: "Email notifications", checked: notifEmailEnabled, onChange: setNotifEmailEnabled }) }), notifEmailEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send email", options: PRIORITY_OPTIONS, value: notifEmailMinPriority, onValueChange: setNotifEmailMinPriority }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Resend API (for transactional email)" }), _jsx(MaskedInput, { label: "Resend API Key", value: resendApiKey, onChange: setResendApiKey, placeholder: "re_live_\u2026", helperText: "Get your key at resend.com \u2014 used for all transactional notifications." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "From email", value: notifFromEmail, onChange: (e) => setNotifFromEmail(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Input, { label: "From name", value: notifFromName, onChange: (e) => setNotifFromName(e.target.value), placeholder: "LetItRip" })] }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifEmailTypes, onChange: (values) => setNotifEmailTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-daily-digest", children: _jsx(Toggle, { label: "Daily status digest", checked: digestEnabled, onChange: setDigestEnabled }) }), digestEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Text, { size: "xs", color: "muted", children: "Sent every morning at 10:00 IST with the previous 24 hours of order activity. Its arrival doubles as the platform health check \u2014 if it stops landing, something needs a look." }), _jsx(Textarea, { label: "Recipients (To)", value: digestRecipients, onChange: (e) => setDigestRecipients(e.target.value), placeholder: "mohasin@letitrip.in", rows: 3, helperText: "One address per line. Each address is billed as a separate send against the daily allowance \u2014 keep this list short." })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-whatsapp-notifications", children: _jsx(Toggle, { label: "WhatsApp notifications", checked: notifWhatsappEnabled, onChange: setNotifWhatsappEnabled }) }), notifWhatsappEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send WhatsApp", options: PRIORITY_OPTIONS, value: notifWhatsappMinPriority, onValueChange: setNotifWhatsappMinPriority }), _jsx(Toggle, { label: "Enable WhatsApp OTP (for login and verification)", checked: notifWhatsappOtpEnabled, onChange: setNotifWhatsappOtpEnabled }), _jsx(Text, { size: "xs", color: "muted", children: "WhatsApp credentials are configured in the WhatsApp tab (\u246C). OTP messages use the same phone number." }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifWhatsappTypes, onChange: (values) => setNotifWhatsappTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Toggle, { label: "SMS notifications", checked: notifSmsEnabled, onChange: setNotifSmsEnabled }), notifSmsEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send SMS", options: PRIORITY_OPTIONS, value: notifSmsMinPriority, onValueChange: setNotifSmsMinPriority }), _jsx(Text, { size: "xs", color: "muted", children: "SMS gateway credentials (e.g. Twilio, MSG91) can be configured in the Integrations tab once an SMS provider is connected." })] }))] })] }) }), _jsx(TabsContent, { value: "legal", children: _jsx(SettingsTabForm, { id: "legal", label: "Legal", children: [
                                         ["Terms of Service", termsHtml, setTermsHtml],
                                         ["Privacy Policy", privacyHtml, setPrivacyHtml],
                                         ["Refund Policy", refundHtml, setRefundHtml],

package/dist/features/admin/components/AdminSupportTicketDetailView.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { Code, useApiMutation } from "@mohasinac/appkit/client";
 import React from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { Button, Div, HorizontalRule, Input, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, Toggle, useToast } from "../../../ui";
+import { Button, Checkbox, Div, HorizontalRule, Input, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, Toggle, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS, SUPPORT_ENDPOINTS } from "../../../constants/api-endpoints";
 import { supportTicketUpdateSchema, toRelatedPartiesPayload, } from "../schemas/admin-ops-forms";
@@ -65,6 +65,12 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [replyBody, setReplyBody] = React.useState("");
+    /*
+     * Opt-in per reply, and it RESETS to false after every send (see
+     * `onSuccess`). A sticky "also email" would quietly turn the exception back
+     * into the default — which is the behaviour this whole change removed.
+     */
+    const [alsoEmail, setAlsoEmail] = React.useState(false);
     const [draft, setDraft] = React.useState(() => seedTicketDraft(currentStatus, currentPriority, internalNotes, relatedParties));
     React.useEffect(() => {
         if (open) {
@@ -102,11 +108,12 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
     const replyMutation = useApiMutation({
         errorMessage: "Failed to send reply.",
         mutationFn: async () => {
-            await apiClient.post(SUPPORT_ENDPOINTS.TICKET_MESSAGES(ticketId), { body: replyBody, newStatus: draft.status });
+            await apiClient.post(SUPPORT_ENDPOINTS.TICKET_MESSAGES(ticketId), { body: replyBody, newStatus: draft.status, sendEmail: alsoEmail });
         },
         onSuccess: () => {
-            showToast("Reply sent.", "success");
+            showToast(alsoEmail ? "Reply sent and emailed." : "Reply sent.", "success");
             setReplyBody("");
+            setAlsoEmail(false);
             invalidate();
             onClose();
         },
@@ -257,7 +264,7 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
             setOrderItemsOpen(false);
         },
     });
-    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(RecordStatusTimeline, { entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
+    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Checkbox, { checked: alsoEmail, onChange: (e) => setAlsoEmail(e.target.checked), label: "Also email the user about this reply" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(RecordStatusTimeline, { entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
                                 // SectionForm scrolls to the first erroring section and then
                                 // submits regardless, so the guard lives here.
                                 form.clearErrors();

package/dist/features/admin/schemas/firestore.d.ts

@@ -4,7 +4,7 @@
  */
 import type { AboutContentDocument } from "../../about/schemas/firestore";
 export declare const ADMIN_CHECKOUT_BYPASS_FLAG_KEY: "adminCheckoutBypass";
-export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
+export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "support_ticket_update", "scam_report_update", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
 export type NotificationType = (typeof NOTIFICATION_TYPE_VALUES)[number];
 /**
  * What a notification points AT. Drives the shared `actionUrl` resolver, so a
@@ -77,7 +77,7 @@ export type NotificationUpdateInput = Partial<Pick<NotificationDocument, "isRead
 export declare const notificationQueryHelpers: {
     readonly byUser: (userId: string) => readonly ["userId", "==", string];
     readonly unread: (userId: string) => readonly [readonly ["userId", "==", string], readonly ["isRead", "==", false]];
-    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale"];
+    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale"];
 };
 export interface TrustBarItem {
     icon: string;
@@ -447,6 +447,36 @@ export interface SiteSettingsDocument extends BaseDocument {
         instagram?: string;
         linkedin?: string;
     };
+    /**
+     * The outbound-messaging kill switch and spend ceiling.
+     *
+     * Distinct from `notificationChannels`, which decides WHICH notification
+     * types a channel carries. This decides whether the channel runs at all and
+     * how much of the day's allowance it may spend — a site-wide posture rather
+     * than a per-type routing rule.
+     *
+     * 🛑 Every field here is PRIVATE. It is triaged into
+     * `PRIVATE_SITE_SETTINGS_FIELDS` in the public projection, and must stay
+     * there: the ceiling and the remaining headroom are operational detail, and
+     * publishing "email is currently off" tells an attacker that password-reset
+     * mail is not being watched.
+     */
+    messaging?: {
+        /** User-facing email. Staff mail (daily digest, payout summary) ignores this. */
+        emailEnabled: boolean;
+        /** User-facing WhatsApp. Same exemption for staff. */
+        whatsappEnabled: boolean;
+        /**
+         * Reserved sends allowed per channel per day. Applies to staff and
+         * transactional mail too — the ceiling exists to stay inside the
+         * provider's own limit, and the provider does not exempt anyone.
+         */
+        dailyCeiling: {
+            email: number;
+            whatsapp: number;
+            sms: number;
+        };
+    };
     emailSettings: {
         fromName: string;
         fromEmail: string;

package/dist/features/admin/schemas/firestore.js

@@ -49,7 +49,27 @@ export const NOTIFICATION_TYPE_VALUES = [
     "promotion",
     "system",
     "welcome",
+    /*
+     * 🛑 `account_action` means A BAN OR AN UNBAN, and nothing else.
+     *
+     * It used to also carry support-ticket activity AND scam-report outcomes —
+     * three unrelated concerns on one value, which made them impossible to tell
+     * apart anywhere downstream. That mattered the moment email became
+     * type-gated (see `EMAIL_ELIGIBLE_TYPES`): there was no way to stop emailing
+     * "your ticket got a reply" without also silencing "you have been banned",
+     * and those two have opposite answers. A banned user has to be told outside
+     * the app, because the app is what they just lost.
+     *
+     * Split 2026-09. If you are tempted to route a fourth concern through this
+     * value because it is vaguely account-shaped, add a type instead — the
+     * `Record<NotificationType, …>` maps will tell you everywhere that needs an
+     * answer.
+     */
     "account_action",
+    /** Support ticket created, replied to, or moved status. Bell-only by default — see `EMAIL_ELIGIBLE_TYPES`; staff can opt a single reply into email. */
+    "support_ticket_update",
+    /** Scam report received, verified, or rejected. Bell-only; the admin side rides the daily digest. */
+    "scam_report_update",
     "offer_received",
     "offer_responded",
     "offer_expired",
@@ -199,6 +219,14 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         smsVerification: false,
         adminCheckoutBypass: false,
     },
+    // Mirrors MESSAGE_BUDGET_DEFAULTS — both channels start OFF. A fresh install
+    // that has made no decision should be quiet, not mailing real people from a
+    // half-configured site.
+    messaging: {
+        emailEnabled: false,
+        whatsappEnabled: false,
+        dailyCeiling: { email: 80, whatsapp: 200, sms: 50 },
+    },
     emi: {
         enabled: false,
         minOrderValue: 10000,

package/dist/features/auth/hooks/useAuth.d.ts

@@ -100,6 +100,11 @@ export declare function useResendVerification(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, void | ResendVerificationData, unknown>;
+/** Thrown when the cooldown refuses — carries the wait so the UI can say it. */
+export declare class AuthMailCooldownError extends Error {
+    readonly retryAfterSeconds: number;
+    constructor(retryAfterSeconds: number);
+}
 export declare function useForgotPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -373,9 +373,51 @@ export function useResendVerification(options) {
         onError: options?.onError,
     });
 }
+/**
+ * Ask the server whether this address may be sent an auth mail right now.
+ *
+ * Firebase's own auth mail goes browser → Firebase with no server hop, so
+ * nothing on our side can see it — including `applyRateLimit`. This gate is the
+ * only throttle these flows have, and it is deliberately advisory: a `false`
+ * from the network, a thrown request, or a missing route all resolve to
+ * "allowed", because a user locked out of their account must never be blocked
+ * from requesting a reset by our own infrastructure failing.
+ *
+ * See `src/app/api/auth/mail-gate/route.ts` for why this is an abuse guard
+ * rather than a security boundary.
+ */
+async function requestAuthMailPermission(email, purpose) {
+    try {
+        const res = await apiClient.post(AUTH_ENDPOINTS.MAIL_GATE, { email, purpose });
+        const data = (res?.data ?? res);
+        return {
+            allowed: data?.allowed !== false,
+            retryAfterSeconds: data?.retryAfterSeconds ?? 0,
+        };
+    }
+    catch (err) {
+        // Normalised then deliberately discarded: an unreachable gate is not an
+        // incident worth reporting, it is the documented fail-open path. The user
+        // still gets their reset mail; only the cooldown is skipped.
+        void normalizeError(err);
+        return { allowed: true, retryAfterSeconds: 0 };
+    }
+}
+/** Thrown when the cooldown refuses — carries the wait so the UI can say it. */
+export class AuthMailCooldownError extends Error {
+    constructor(retryAfterSeconds) {
+        const mins = Math.max(1, Math.ceil(retryAfterSeconds / 60));
+        super(`We've already sent that recently — please check your inbox, including spam. You can request another in ${mins} minute${mins === 1 ? "" : "s"}.`);
+        this.name = "AuthMailCooldownError";
+        this.retryAfterSeconds = retryAfterSeconds;
+    }
+}
 export function useForgotPassword(options) {
     return useMutation({
         mutationFn: async (data) => {
+            const gate = await requestAuthMailPermission(data.email, "password_reset");
+            if (!gate.allowed)
+                throw new AuthMailCooldownError(gate.retryAfterSeconds);
             await getClientAuthProvider().sendPasswordResetEmail(data.email);
             return { success: true };
         },

package/dist/features/checkout/actions/checkout-value-otp-actions.js

@@ -18,6 +18,7 @@ import { addressesRepository } from "../../addresses/repository/addresses.reposi
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository";
 import { sendWhatsAppBusinessMessage } from "../../whatsapp-bot/helpers/whatsapp";
 import { isChannelHealthy, withChannelRetry } from "../../../_internal/server/notifications/channel-health";
+import { guardSend, logSuppressedSend } from "../../../_internal/server/notifications/send-guard";
 import { CHECKOUT_VALUE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS, hashOtp, generateOtpCode, checkoutValueOtpRef, enforceCheckoutValueOtpRateLimit, buildCheckoutValueOtpMessage, } from "../../auth/checkout-value-otp";
 function maskEmail(userEmail) {
     const [local, domain] = userEmail.split("@");
@@ -82,6 +83,20 @@ export async function sendCheckoutValueOtp(userId, userEmail, channel = "email",
             createdAt: new Date(),
         });
         const message = buildCheckoutValueOtpMessage(code, siteName);
+        // Same guard as the email branch below, same reasoning: transactional, so
+        // the kill switch does not apply (the buyer cannot check out without the
+        // code), but the daily ceiling does.
+        const waGuard = {
+            channel: "whatsapp",
+            feature: "checkout_value_otp",
+            audience: "user",
+            transactional: true,
+        };
+        const waDecision = await guardSend(waGuard);
+        if (!waDecision.allow) {
+            logSuppressedSend(waGuard, waDecision);
+            throw new ValidationError("We couldn't send the verification code via WhatsApp — please try again, or send it by email instead.");
+        }
         try {
             const sent = await withChannelRetry("whatsapp", async () => {
                 const ok = await sendWhatsAppBusinessMessage({ toPhone: phone, message, phoneNumberId, accessToken });
@@ -126,6 +141,23 @@ export async function sendCheckoutValueOtp(userId, userEmail, channel = "email",
             <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, please ignore this email.</p>
           </div>
         `,
+            }, {
+                channel: "email",
+                feature: "checkout_value_otp",
+                audience: "user",
+                /*
+                 * The strongest case for `transactional` in the codebase: the buyer
+                 * is mid-checkout above the high-value threshold and CANNOT complete
+                 * the order without this code. Suppressing it does not quieten the
+                 * site, it breaks checkout — so it ignores the kill switch.
+                 *
+                 * It still counts against the daily ceiling, which is the honest
+                 * behaviour: if the provider is going to start rejecting, pretending
+                 * otherwise here just moves the failure somewhere less legible. The
+                 * 15-minute per-user cooldown in `checkout-value-otp.ts` already
+                 * bounds how much of the allowance one buyer can consume.
+                 */
+                transactional: true,
             });
             if (error)
                 throw new Error(String(error));