@mohasinac/appkit 4.63.3 → 4.63.5

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.63.3",
-  "head": "aea6affd6821cc7b43256c25614e42422df7177c",
+  "version": "4.63.5",
+  "head": "6eff0d768f87f31fafd2ca5a5af8868622f94228",
   "branch": "main",
   "dirty": false,
-  "builtAt": "2026-10-23T10:12:11.248Z"
+  "builtAt": "2026-10-23T20:06:38.671Z"
 }

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -226,6 +226,7 @@ export interface CheckoutPricingPreviewStore {
     subtotal: number;
     shippingFee: number;
     codHandlingFee: number;
+    whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
     saleProtectionFee: number;
@@ -294,6 +295,7 @@ export interface CheckoutPricingPreview {
     subtotal: number;
     shippingFee: number;
     codHandlingFee: number;
+    whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
     saleProtectionFee: number;

package/dist/_internal/server/features/checkout/actions.js

@@ -48,7 +48,7 @@ import { countDestinations, quoteSharedPurchase, } from "../../../shared/feature
 import { resolveCouponCategorySlugs } from "../../../../features/promotions/actions/coupon-actions.js";
 import { assertCheckoutLane, assertLockedLinesStillValid, finalizeLockedLines, } from "./locked-lines.js";
 import { activeLane, defaultCheckoutItems, resolveCheckoutItems, laneOf, } from "../../../shared/checkout/lanes.js";
-import { computeCodHandlingFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, computeCheckoutFees, allocateCheckoutFees, } from "../../../shared/fees/calculator.js";
+import { computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, computeCheckoutFees, allocateCheckoutFees, } from "../../../shared/fees/calculator.js";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase/index.js";
 import { snapshotDeliveryAddress, } from "../../../shared/features/orders/delivery-snapshot.js";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore.js";
@@ -192,7 +192,7 @@ function assertLiveJurisdiction(cartItemsArg, productByIdArg, buyerState) {
  * either party. We emit the buyer + seller rows here at the create boundary.
  */
 function emitOrderPlacedNotifications(args) {
-    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid } = args;
+    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid, storeId } = args;
     const buyerNotif = sendNotification({
         userId: buyerUid,
         type: "order_placed",
@@ -202,6 +202,7 @@ function emitOrderPlacedNotifications(args) {
         relatedId: orderId,
         relatedType: "order",
         actionUrl: `/user/orders/view/${orderId}`,
+        storeId,
     }).catch((err) => serverLogger.warn("Failed to send buyer order_placed notification", {
         err: err instanceof Error ? err.message : String(err),
         orderId,
@@ -740,7 +741,7 @@ async function createOrderForGroup(group, orderType, ctx) {
     const firstItem = group[0].item;
     const firstProduct = group[0].product;
     // Add-ons are this store's choice, not the cart's — see OrderGroupContext.
-    const { giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, saleProtectionAddon = false, } = storeAddons?.[firstItem.storeId] ?? {};
+    const { whatsappNotifyAddon = false, giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, saleProtectionAddon = false, } = storeAddons?.[firstItem.storeId] ?? {};
     const { platformFee = 0, gstOnFee: platformFeeGst = 0 } = platformFeeByStore.get(firstItem.storeId) ?? {};
     const groupTotal = group.reduce((sum, { item, product }) => sum + lineTotalFor(item, product), 0);
     /*
@@ -873,6 +874,7 @@ async function createOrderForGroup(group, orderType, ctx) {
     // Handling fee charged to the buyer for choosing COD, on top of the order
     // total — not deducted from the deposit/remaining split above.
     const codHandlingFee = paymentMethod === "cod" ? computeCodHandlingFee(groupTotal, commissions) : 0;
+    const whatsappNotifyFee = computeWhatsAppNotifyFee(whatsappNotifyAddon, commissions);
     const giftWrapFee = computeGiftWrapFee(giftWrapAddon, commissions);
     /*
      * ── C5e: all three protection tiers, enforced SERVER-SIDE ────────────────
@@ -1052,7 +1054,7 @@ async function createOrderForGroup(group, orderType, ctx) {
      * compounds nine half-paisa errors instead of one, which is how a total
      * drifts from the sum of the lines shown beside it.
      */
-    roundRupees(Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (emiSchedule?.surchargeAmount ?? 0) + sharedQuote.total);
+    roundRupees(Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (emiSchedule?.surchargeAmount ?? 0) + sharedQuote.total);
     /*
      * ── D43: the COD deposit/remaining split, on the ORDER TOTAL ──────────────
      *
@@ -1263,6 +1265,8 @@ async function createOrderForGroup(group, orderType, ctx) {
          * one so a later reader does not have to reconstruct it.
          */
         platformFeeGst: !adminBypass && platformFeeGst > 0 ? platformFeeGst : undefined,
+        whatsappNotifyAddon: !adminBypass && whatsappNotifyFee > 0 ? true : undefined,
+        whatsappNotifyFee: !adminBypass && whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
         giftWrapAddon: !adminBypass && giftWrapFee > 0 ? true : undefined,
         giftWrapFee: !adminBypass && giftWrapFee > 0 ? giftWrapFee : undefined,
         giftWrapMessage: !adminBypass && giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
@@ -1405,6 +1409,7 @@ async function createOrderForGroup(group, orderType, ctx) {
         storeOwnerId,
         productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
         paid: adminBypass,
+        storeId: order.storeId,
     });
     return groupTotal;
 }
@@ -1885,6 +1890,7 @@ const EMPTY_PRICING_PREVIEW = {
     subtotal: 0,
     shippingFee: 0,
     codHandlingFee: 0,
+    whatsappNotifyFee: 0,
     giftWrapFee: 0,
     shipmentProtectionFee: 0,
     saleProtectionFee: 0,
@@ -2029,6 +2035,7 @@ export async function previewCheckoutPricing(input) {
          * rather than one number the buyer has to interpret.
          */
         const groupEmiDeferred = groupEmiPreviewQuote?.remainingBalance ?? 0;
+        const groupWhatsappFee = computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissions);
         const groupGiftWrapFee = computeGiftWrapFee(addons.giftWrapAddon ?? false, commissions);
         /*
          * C5e — the same three tiers `createOrderForGroup` enforces, so the figure
@@ -2129,6 +2136,7 @@ export async function previewCheckoutPricing(input) {
             codHandlingFee: groupCodHandlingFee,
             emiSurcharge: groupEmiSurcharge,
             emiDeferred: groupEmiDeferred,
+            whatsappNotifyFee: groupWhatsappFee,
             giftWrapFee: groupGiftWrapFee,
             shipmentProtectionFee: groupShipmentProtectionFee,
             saleProtectionFee: groupSaleProtectionFee,
@@ -2147,6 +2155,7 @@ export async function previewCheckoutPricing(input) {
                 groupShippingFee +
                 groupCodHandlingFee +
                 groupEmiSurcharge +
+                groupWhatsappFee +
                 groupGiftWrapFee +
                 groupShipmentProtectionFee +
                 groupSaleProtectionFee +
@@ -2169,6 +2178,7 @@ export async function previewCheckoutPricing(input) {
     const codHandlingFee = sum((s) => s.codHandlingFee);
     const emiSurcharge = sum((s) => s.emiSurcharge);
     const emiDeferred = sum((s) => s.emiDeferred);
+    const whatsappNotifyFeeTotal = sum((s) => s.whatsappNotifyFee);
     const giftWrapFeeTotal = sum((s) => s.giftWrapFee);
     const shipmentProtectionFeeTotal = sum((s) => s.shipmentProtectionFee);
     const saleProtectionFeeTotal = sum((s) => s.saleProtectionFee);
@@ -2216,6 +2226,7 @@ export async function previewCheckoutPricing(input) {
         shippingFee +
         codHandlingFee +
         emiSurcharge +
+        whatsappNotifyFeeTotal +
         giftWrapFeeTotal +
         shipmentProtectionFeeTotal +
         saleProtectionFeeTotal +
@@ -2271,6 +2282,7 @@ export async function previewCheckoutPricing(input) {
         codHandlingFee,
         emiSurcharge,
         emiDeferred,
+        whatsappNotifyFee: whatsappNotifyFeeTotal,
         giftWrapFee: giftWrapFeeTotal,
         shipmentProtectionFee: shipmentProtectionFeeTotal,
         saleProtectionFee: saleProtectionFeeTotal,
@@ -2513,6 +2525,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     // cart-wide fee was passed in and billed against every group.
     const commissionRates = siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS;
     const addons = storeAddons?.[firstItem.storeId] ?? {};
+    const whatsappNotifyFee = computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissionRates);
     const giftWrapFee = computeGiftWrapFee(addons.giftWrapAddon ?? false, commissionRates);
     const giftWrapMessage = addons.giftWrapMessage;
     /*
@@ -2617,7 +2630,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     });
     // D42: rounded once on the sum — see the COD/UPI path's 🛑 for why a raw
     // float sum of seven 2dp terms reached Firestore as 1011.8000000000001.
-    const orderTotal = roundRupees(Math.max(0, groupTotal - couponDiscount) + shippingFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (phonepeEmiSchedule?.surchargeAmount ?? 0) + phonepeSharedQuote.total);
+    const orderTotal = roundRupees(Math.max(0, groupTotal - couponDiscount) + shippingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (phonepeEmiSchedule?.surchargeAmount ?? 0) + phonepeSharedQuote.total);
     /*
      * ── POINTS TENDER (D46/D47) — the same STAGE as the COD/manual path ───────
      *
@@ -2767,6 +2780,8 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         // leaving the refund path to re-derive it from live percentages (D32).
         platformFeeGst: platformFeeGst > 0 ? platformFeeGst : undefined,
         shippingFee: shippingFee > 0 ? shippingFee : undefined,
+        whatsappNotifyAddon: whatsappNotifyFee > 0 ? true : undefined,
+        whatsappNotifyFee: whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
         giftWrapAddon: giftWrapFee > 0 ? true : undefined,
         giftWrapFee: giftWrapFee > 0 ? giftWrapFee : undefined,
         giftWrapMessage: giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
@@ -2864,6 +2879,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         storeOwnerId,
         productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
         paid: true,
+        storeId: order.storeId,
     });
     return orderTotal;
 }
@@ -3282,6 +3298,7 @@ export async function verifyAndPlaceGatewayOrderAction(input) {
             const addons = cart.storeAddons?.[storeId] ?? {};
             const groupSubtotal = g.items.reduce((gs, { item, product }) => gs + lineTotalFor(item, product), 0);
             return (sum +
+                computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissionRates) +
                 computeGiftWrapFee(addons.giftWrapAddon ?? false, commissionRates) +
                 computeShipmentProtectionFee(groupSubtotal, addons.shipmentProtectionAddon ?? false, commissionRates));
         }, 0);

package/dist/_internal/server/features/orders/adapters.js

@@ -185,7 +185,7 @@ export function orderDocumentToOrder(doc) {
         couponDiscount: doc.couponDiscount,
         appliedDiscounts: doc.appliedDiscounts,
         // Add-ons are operational, not decorative: the status-change notifier reads
-        // the packer needs giftWrapMessage in hand. An
+        // whatsappNotifyAddon, and the packer needs giftWrapMessage in hand. An
         // adapter that drops them makes every downstream surface render its
         // "not applicable" fallback instead (Root Cause #57).
         // EMI, so the buyer can see and pay their own schedule. Mapped with the
@@ -195,6 +195,8 @@ export function orderDocumentToOrder(doc) {
         emiEnabled: doc.emiEnabled,
         emiInstallments: doc.emiInstallments,
         emiRemainingBalance: doc.emiRemainingBalance,
+        whatsappNotifyAddon: doc.whatsappNotifyAddon,
+        whatsappNotifyFee: doc.whatsappNotifyFee,
         giftWrapAddon: doc.giftWrapAddon,
         giftWrapFee: doc.giftWrapFee,
         giftWrapMessage: doc.giftWrapMessage,

package/dist/_internal/server/features/promotions/adapters.d.ts

@@ -0,0 +1,25 @@
+import type { CouponDocument } from "../../../../features/promotions/schemas";
+import type { AttachedCoupon } from "../../../../features/promotions/constants/attached-coupons";
+/**
+ * `CouponDocument` → the public `AttachedCoupon` shape.
+ *
+ * 🛑 Built field by field. Never `{ ...doc }` with deletes — that publishes
+ * every key nobody thought to remove, including ones the interface does not
+ * declare, which is exactly how `adSettings.providerCredentials` and a
+ * decrypted WhatsApp token reached public HTML (Root Cause #70).
+ *
+ * Deliberately NOT carried across, each for its own reason:
+ *   usage.*        — `currentUsage` / `totalLimit` is redemption telemetry;
+ *                    a reader who learns a code is near its cap learns
+ *                    nothing useful and the seller loses a lever.
+ *   analytics.*    — `totalRevenue` / `totalDiscount` is seller revenue.
+ *   restrictions.* — `applicableProducts` / `excludeCategories` is the
+ *                    coupon's internal targeting; checkout enforces it and
+ *                    says so there, in context, against a real cart.
+ *   createdBy      — a uid.
+ *   scope/storeId  — not rendered; see the note in AttachedCouponsSection
+ *                    about why the card does not label a seller.
+ *   bxgy/tiers     — structured configs with no renderer; adding one is a
+ *                    feature, not a projection decision.
+ */
+export declare function toAttachedCoupon(doc: CouponDocument): AttachedCoupon;

package/dist/_internal/server/features/promotions/adapters.js

@@ -0,0 +1,43 @@
+/**
+ * `CouponDocument` → the public `AttachedCoupon` shape.
+ *
+ * 🛑 Built field by field. Never `{ ...doc }` with deletes — that publishes
+ * every key nobody thought to remove, including ones the interface does not
+ * declare, which is exactly how `adSettings.providerCredentials` and a
+ * decrypted WhatsApp token reached public HTML (Root Cause #70).
+ *
+ * Deliberately NOT carried across, each for its own reason:
+ *   usage.*        — `currentUsage` / `totalLimit` is redemption telemetry;
+ *                    a reader who learns a code is near its cap learns
+ *                    nothing useful and the seller loses a lever.
+ *   analytics.*    — `totalRevenue` / `totalDiscount` is seller revenue.
+ *   restrictions.* — `applicableProducts` / `excludeCategories` is the
+ *                    coupon's internal targeting; checkout enforces it and
+ *                    says so there, in context, against a real cart.
+ *   createdBy      — a uid.
+ *   scope/storeId  — not rendered; see the note in AttachedCouponsSection
+ *                    about why the card does not label a seller.
+ *   bxgy/tiers     — structured configs with no renderer; adding one is a
+ *                    feature, not a projection decision.
+ */
+export function toAttachedCoupon(doc) {
+    return {
+        id: doc.id,
+        code: doc.code,
+        name: doc.name,
+        description: doc.description,
+        type: doc.type,
+        discountValue: doc.discount.value,
+        maxDiscount: doc.discount.maxDiscount,
+        minPurchase: doc.discount.minPurchase,
+        /*
+         * ISO, not a `Date`. This crosses a Server → Client Component boundary and
+         * a `Date` survives that only because Next serialises it; an ISO string is
+         * the shape the renderer actually wants and removes the question.
+         *
+         * 🛑 Absent means NO END DATE, never "expired". A renderer that treats a
+         * missing `endsAt` as expired hides every open-ended coupon.
+         */
+        endsAt: doc.validity.endDate ? new Date(doc.validity.endDate).toISOString() : undefined,
+    };
+}

package/dist/_internal/server/features/promotions/data.d.ts

@@ -1 +1,27 @@
+import type { AttachedCoupon } from "../../../../features/promotions/constants/attached-coupons";
 export declare const getCouponByCode: (code: string) => Promise<import("../../../..").CouponDocument | null>;
+/**
+ * Resolve the coupons a piece of content has attached, ready to render.
+ *
+ * Shared by the event detail page and the blog post page — one implementation,
+ * because two hand-rolled copies of "read the ids, drop the dead ones, project"
+ * is how a fix lands on the route and never reaches the SSR view that
+ * duplicates it (Root Cause #59/#99).
+ *
+ * 🛑 `cache`d because the page body and `generateMetadata` may both want it.
+ * Keyed on the argument list, so callers must pass the SAME array contents —
+ * which they do, both reading `doc.couponIds`.
+ *
+ * 🛑 EXPIRED AND INACTIVE COUPONS ARE DROPPED HERE, not in the renderer.
+ * A blog post from March that still advertises a code which now errors at
+ * checkout is worse than one that advertises nothing: the reader does the
+ * work of copying it and is refused at the till. `isCouponValid` is the same
+ * predicate checkout applies (active + inside its window + under its total
+ * limit), so the page cannot promise what the till will decline.
+ *
+ * It does NOT check `perUserLimit` — that is per-reader and unknowable on a
+ * cached public page. A reader who has personally exhausted a still-valid
+ * coupon is refused at checkout with a message that can explain why; that is
+ * the correct place for it.
+ */
+export declare const getAttachedCoupons: (couponIds: readonly string[] | undefined) => Promise<AttachedCoupon[]>;

package/dist/_internal/server/features/promotions/data.js

@@ -1,5 +1,50 @@
 import { cache } from "react";
 import { couponsRepository } from "../../../../repositories/index.js";
+import { isCouponValid } from "../../../../features/promotions/schemas/index.js";
+import { toAttachedCoupon } from "./adapters.js";
+import { safeRead } from "../../../../errors/safe-read.js";
 export const getCouponByCode = cache(async (code) => {
     return (await couponsRepository.getCouponByCode(code)) ?? null;
 });
+/**
+ * Resolve the coupons a piece of content has attached, ready to render.
+ *
+ * Shared by the event detail page and the blog post page — one implementation,
+ * because two hand-rolled copies of "read the ids, drop the dead ones, project"
+ * is how a fix lands on the route and never reaches the SSR view that
+ * duplicates it (Root Cause #59/#99).
+ *
+ * 🛑 `cache`d because the page body and `generateMetadata` may both want it.
+ * Keyed on the argument list, so callers must pass the SAME array contents —
+ * which they do, both reading `doc.couponIds`.
+ *
+ * 🛑 EXPIRED AND INACTIVE COUPONS ARE DROPPED HERE, not in the renderer.
+ * A blog post from March that still advertises a code which now errors at
+ * checkout is worse than one that advertises nothing: the reader does the
+ * work of copying it and is refused at the till. `isCouponValid` is the same
+ * predicate checkout applies (active + inside its window + under its total
+ * limit), so the page cannot promise what the till will decline.
+ *
+ * It does NOT check `perUserLimit` — that is per-reader and unknowable on a
+ * cached public page. A reader who has personally exhausted a still-valid
+ * coupon is refused at checkout with a message that can explain why; that is
+ * the correct place for it.
+ */
+export const getAttachedCoupons = cache(async (couponIds) => {
+    if (!couponIds || couponIds.length === 0)
+        return [];
+    /*
+     * `safeRead`, so a Firestore hiccup (or a missing index on a cold
+     * collection) costs the page its coupon strip and not the whole render.
+     * These pages are prerendered, and an unguarded throw during the
+     * prerender ATTEMPT is fatal to the production build — see the dashboard
+     * note in § SSR Architecture. The failure is recorded as a DEGRADED_READ
+     * rather than swallowed, which is the distinction Root Cause #59 is about.
+     */
+    const docs = await safeRead(() => couponsRepository.findByIds([...couponIds]), {
+        route: "content.attachedCoupons",
+        key: "promotions.findByIds",
+        fallback: [],
+    });
+    return docs.filter(isCouponValid).map(toAttachedCoupon);
+});

package/dist/_internal/server/features/promotions/index.d.ts

@@ -1,4 +1,5 @@
-export { getCouponByCode } from "./data";
+export { getCouponByCode, getAttachedCoupons } from "./data";
+export { toAttachedCoupon } from "./adapters";
 export { validateCoupon, computeDiscount } from "./service";
 export { applyCouponAction, createCouponAction, updateCouponAction, deactivateCouponAction } from "./actions";
 export { COUPONS_PAGE_SIZE, COUPON_CODE_MAX_LENGTH } from "../../../shared/features/promotions/config";

package/dist/_internal/server/features/promotions/index.js

@@ -1,4 +1,5 @@
-export { getCouponByCode } from "./data.js";
+export { getCouponByCode, getAttachedCoupons } from "./data.js";
+export { toAttachedCoupon } from "./adapters.js";
 export { validateCoupon, computeDiscount } from "./service.js";
 export { applyCouponAction, createCouponAction, updateCouponAction, deactivateCouponAction } from "./actions.js";
 export { COUPONS_PAGE_SIZE, COUPON_CODE_MAX_LENGTH } from "../../../shared/features/promotions/config.js";

package/dist/_internal/server/features/site-settings/adapters.js

@@ -7,7 +7,7 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "contact", // user/orders/[id]/payment — contact.whatsappNumber (narrowed: no address/upiVpa)
     "payment", // CheckoutRouteClient — payment.otpCheckoutThreshold (narrowed)
     "listings", // useListingTypeFlags — narrowed to listings.listingTypes; categoryTypes has no client reader
-    "notificationChannels", // NotificationPreferencesPanel reads the per-channel toggles
+    "notificationChannels", // NARROWED: only {email,whatsapp,sms}.enabled — see the projection below
     "announcementBar", // the homepage banner (AdminSiteSettingsView edits it)
     /*
      * `support.enabled` — a REAL client reader, which is the bar this list sets:
@@ -138,7 +138,25 @@ export function toPublicSiteSettings(doc, opts) {
         listings: {
             listingTypes: doc.listings?.listingTypes,
         },
-        notificationChannels: doc.notificationChannels,
+        /*
+         * 🛑 Narrowed to the three booleans a client reads, not the group by
+         * reference. Emitted whole, this published every WhatsApp channel setting
+         * to anonymous callers — `minPriority`, and the `types[]` allow-list naming
+         * exactly which notification types each channel carries. Nothing reads
+         * those in a browser: `NotificationPreferencesPanel` wants the three
+         * `enabled` flags to label its toggles, `whatsapp.otpEnabled` is read by a
+         * SERVER action, and the admin editor reads `GET /api/admin/site`.
+         *
+         * Same reasoning as `support` below — a field added to a channel later must
+         * not be published by the act of adding it (Root Cause #70).
+         */
+        notificationChannels: doc.notificationChannels
+            ? {
+                email: { enabled: doc.notificationChannels.email?.enabled === true },
+                whatsapp: { enabled: doc.notificationChannels.whatsapp?.enabled === true },
+                sms: { enabled: doc.notificationChannels.sms?.enabled === true },
+            }
+            : undefined,
         announcementBar: doc.announcementBar,
         // Narrowed to the one boolean a client reads, not the group by reference —
         // so a field added to `support` later is not published by accident.

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "allowSharedPurchase", "sharedPurchaseHandlingFee", "sharedPurchaseExtraShippingPerDestination", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -95,6 +95,7 @@ export const PRIVATE_STORE_FIELDS = [
     // hundred tokens.
     "searchTxt",
     "updatedAt", // bookkeeping; no public reader
+    "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public
     // Admin decisions with actor UIDs and suspension reasons. The store OWNER
     // sees this on their own admin surfaces; an anonymous visitor to /stores has

package/dist/_internal/server/jobs/core/analyticsAlertEvaluate.js

@@ -299,7 +299,7 @@ function buildMetricCache(ctx, bucket, now, onSaturated) {
  * The owner's contact details, resolved once per owner.
  *
  * 🛑 This is how the seller's `notifyChannels` is HONOURED rather than
- * ignored. `sendNotification` decides email eligibility itself
+ * ignored. `sendNotification` decides email and WhatsApp eligibility itself
  * (type gate → admin allow-list → user prefs → daily budget) and takes no
  * channel list — but it cannot email an address it was not given. So omitting
  * `userEmail` when the seller did not tick email is a real narrowing through
@@ -389,6 +389,9 @@ export async function runAnalyticsAlertEvaluate(ctx) {
                 ...(alert.notifyChannels?.includes("email") && contact.email
                     ? { userEmail: contact.email }
                     : {}),
+                ...(alert.notifyChannels?.includes("whatsapp") && contact.phone
+                    ? { userPhone: contact.phone }
+                    : {}),
                 audience: b.scope === "admin" ? "admin" : "seller",
             });
         };
@@ -426,7 +429,7 @@ export async function runAnalyticsAlertEvaluate(ctx) {
                  *
                  * If the notification throws, the cooldown has still been recorded —
                  * so a persistently failing channel cannot turn into one attempt per
-                 * run forever. The inverse order would retry a broken send
+                 * run forever. The inverse order would retry a broken WhatsApp send
                  * every hour against a 100/day email allowance.
                  */
                 await ctx.db

package/dist/_internal/server/jobs/core/jobRunners.js

@@ -11,6 +11,7 @@
 import { runWeeklyPayoutEligibility } from "./weeklyPayoutEligibility.js";
 import { runHardBanCascade } from "./hardBanCascade.js";
 import { runResetOtpVerification } from "./resetOtpVerification.js";
+import { runWhatsAppNotify } from "./whatsappNotify.js";
 import { runNewsletterExport } from "./newsletterExport.js";
 import { runStoreNameBackfill } from "./storeNameBackfill.js";
 import { runCategoryTaxonomyBackfill } from "./categoryTaxonomyBackfill.js";
@@ -41,6 +42,9 @@ async function runHardBanCascadeJob(payload, ctx) {
 async function runResetOtpVerificationJob(_payload, ctx) {
     return runResetOtpVerification(ctx);
 }
+async function runWhatsAppNotifyJob(payload, ctx) {
+    return runWhatsAppNotify(payload, ctx);
+}
 async function runNewsletterExportJob(_payload, ctx) {
     return runNewsletterExport(ctx);
 }
@@ -105,6 +109,7 @@ export const JOB_RUNNERS = {
     payoutsWeekly: runPayoutsWeeklyJob,
     hardBanCascade: runHardBanCascadeJob,
     resetOtpVerification: runResetOtpVerificationJob,
+    whatsappNotify: runWhatsAppNotifyJob,
     newsletterExport: runNewsletterExportJob,
     storeNameBackfill: runStoreNameBackfillJob,
     categoryTaxonomyBackfill: runCategoryTaxonomyBackfillJob,

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,7 +1,77 @@
 import { normalizeError } from "../../../../errors/normalize.js";
 import { ORDER_PII_FIELDS, revealPii } from "../../../../security/index.js";
-import { adminNotificationsRepository } from "../../../../repositories/index.js";
-import { buildPurchaseAnnouncementMessage } from "../../../../features/orders/utils/order-announcement-message.js";
+import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories/index.js";
+import { decryptPii } from "../../../../security/index.js";
+import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server.js";
+import { resolveKeys } from "../../../../core/integration-keys.js";
+import { guardSend, logSuppressedSend } from "../../notifications/send-guard.js";
+async function sendAnnouncement(ctx, toPhone, message, phoneNumberId, accessToken, label, orderId) {
+    try {
+        const sent = await sendWhatsAppBusinessMessage({
+            toPhone,
+            message,
+            phoneNumberId,
+            accessToken,
+        });
+        if (sent) {
+            ctx.logger.info(`Announcement sent to ${label}`, {
+                orderId,
+                toPhone: `...${toPhone.slice(-4)}`,
+            });
+        }
+        else {
+            ctx.logger.error(`Announcement delivery failed for ${label} (non-fatal)`, null, { orderId });
+        }
+    }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error(`Announcement send threw for ${label} (non-fatal)`, err, { orderId });
+    }
+}
+async function notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId) {
+    try {
+        const store = await storeRepository.findBySlug(storeId);
+        if (!store?.ownerId)
+            return;
+        const owner = await userRepository.findById(store.ownerId);
+        const encryptedPhone = owner?.phoneNumber;
+        if (!encryptedPhone)
+            return;
+        const ownerPhone = decryptPii(encryptedPhone);
+        if (ownerPhone) {
+            await sendAnnouncement(ctx, ownerPhone, message, phoneNumberId, accessToken, "store-owner", orderId);
+        }
+    }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error("Store owner lookup failed (non-fatal)", err, { orderId, storeId });
+    }
+}
+/**
+ * Seeded credentials are `*_PLACEHOLDER` strings rather than empty, so an
+ * emptiness test alone would happily send with a fake token. Mirrors the guard
+ * in checkout-value-otp-actions.ts.
+ */
+function usable(value) {
+    const v = value?.trim() ?? "";
+    return v && !v.includes("PLACEHOLDER") ? v : "";
+}
+async function resolveWhatsAppCredentials(ctx, orderId) {
+    let db = {};
+    try {
+        db = await resolveKeys();
+    }
+    catch (err) {
+        void normalizeError(err);
+        // Firestore unreachable from the Functions runtime — env-only is still a
+        // valid configuration, so this is a warning, not a failure.
+        ctx.logger.warn("Credential lookup failed — falling back to env", { orderId });
+    }
+    return {
+        phoneNumberId: usable(db.whatsappPhoneNumberId) || usable(ctx.env("WHATSAPP_PHONE_NUMBER_ID")),
+        accessToken: usable(db.whatsappCloudApiToken) || usable(ctx.env("WHATSAPP_CLOUD_API_TOKEN")),
+    };
+}
 export async function handleOrderCreate(input, ctx) {
     const { orderId, order } = input;
     const items = order.items ?? [];
@@ -70,13 +140,37 @@ export async function handleOrderCreate(input, ctx) {
         ctx.logger.error("Failed to write admin order notification (non-fatal)", err, { orderId });
     }
     /*
-     * The seller is told about their own sale by the `order_placed`
-     * notification `createOrderForGroup` already sends (in-app + email). This
-     * handler used to ALSO push a WhatsApp Cloud API message here — a duplicate
-     * channel for the same event, and the only thing in this file that needed a
-     * Meta token, a registered number and a billing relationship. Removed with
-     * the rest of the WhatsApp integration on 2026-10-20; no signal was lost,
-     * because the notification path is independent and unchanged.
+     * Seller side keeps WhatsApp: it is ONE message to ONE person about their
+     * own sale, which is the case the channel is good at. Credentials resolve
+     * DB-first (Admin → Site Settings → WhatsApp) with an env fallback — this
+     * read `ctx.env()` only until 2026-08-22, so credentials saved in Site
+     * Settings never reached the announcement and it silently no-op'd.
      */
-    ctx.logger.info("Order announcement complete", { orderId, storeId: order.storeId ?? null });
+    const storeId = order.storeId;
+    if (!storeId) {
+        ctx.logger.info("Order has no storeId — nothing to announce to a seller", { orderId });
+        return;
+    }
+    const { phoneNumberId, accessToken } = await resolveWhatsAppCredentials(ctx, orderId);
+    if (!phoneNumberId || !accessToken) {
+        ctx.logger.info("WhatsApp Cloud API not configured — skipping seller announcement", { orderId });
+        return;
+    }
+    // Audience is "user": a seller receiving news of their own sale is a
+    // marketplace participant, not an operator of the site. Staff exemption is
+    // for the digest and the payout summary, and widening it to "anyone we think
+    // ought to see this" would make the kill switch mean nothing.
+    const guard = {
+        channel: "whatsapp",
+        feature: "order_placed_seller",
+        audience: "user",
+    };
+    const decision = await guardSend(guard);
+    if (!decision.allow) {
+        logSuppressedSend(guard, decision);
+        ctx.logger.info("Seller order announcement suppressed by messaging guard", { orderId, storeId });
+        return;
+    }
+    await notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId);
+    ctx.logger.info(`Order announcement complete`, { orderId, storeId });
 }

package/dist/_internal/server/jobs/core/onOrderStatusChange.d.ts

@@ -12,6 +12,8 @@ export type OrderAfter = {
      */
     paymentStatus?: string;
     invoiceNumber?: string;
+    /** The seller. Decides the WhatsApp arm via their notification subscription. */
+    storeId?: string;
 };
 export type OrderBefore = {
     status: OrderStatus;

package/dist/_internal/server/jobs/core/onOrderStatusChange.js

@@ -119,6 +119,7 @@ export async function handleOrderStatusChange(input, ctx) {
             relatedId: orderId,
             relatedType: "order",
             userEmail,
+            storeId: after.storeId,
         });
         // The RTDB mirror that used to live here has been removed. `sendNotification`
         // above is the real path (in-app + email + WhatsApp); the extra