@mohasinac/appkit 4.63.3 → 4.63.5

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -30,6 +30,7 @@ export async function handleScamReportCreate(input, ctx) {
                 relatedId: scammerId,
                 relatedType: "scammer",
                 userEmail: reporterPlain?.email ?? undefined,
+                userPhone: reporterPlain?.phoneNumber ?? undefined,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/onScamReportRejected.js

@@ -28,6 +28,7 @@ export async function handleScamReportRejected(input, ctx) {
             relatedId: scammerId,
             relatedType: "scammer",
             userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/onScamReportVerified.js

@@ -28,6 +28,7 @@ export async function handleScamReportVerified(input, ctx) {
             relatedId: scammerId,
             relatedType: "scammer",
             userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/paymentWindowTimeout.js

@@ -123,6 +123,7 @@ export async function runPaymentWindowTimeout(ctx) {
                 message: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_MESSAGE(entry.data.productTitle),
                 relatedId: entry.id,
                 relatedType: "order",
+                storeId: entry.data.storeId,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/pendingOrderTimeout.js

@@ -67,6 +67,7 @@ export async function runPendingOrderTimeout(ctx) {
                 message: ORDER_MESSAGES.CANCELLED_TIMEOUT_MESSAGE(entry.data.productTitle, timeoutHours),
                 relatedId: entry.id,
                 relatedType: "order",
+                storeId: entry.data.storeId,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/triggerEventRaffle.js

@@ -41,6 +41,7 @@ import { EVENT_ENTRY_FIELDS, EVENT_FIELDS } from "../../../../constants/field-na
 import { EVENT_ENTRY_PII_FIELDS, maskPii } from "../../../../security/index.js";
 import { resolveEventRef } from "./_event-ref.js";
 import { EVENT_DRAW_REASON } from "./event-draw-reasons.js";
+import { rafflePrizeCouponIdsOf } from "../../../../features/events/schemas/firestore.js";
 /**
  * The winner's display name, masked for a PUBLIC announcement.
  *
@@ -158,22 +159,51 @@ export async function runTriggerEventRaffle(input, ctx) {
      * re-deriving it. Resolution is best-effort: a missing coupon must not cost
      * somebody their win.
      */
-    let rafflePrizeCouponCode;
-    if (event.rafflePrizeCouponId) {
-        const coupSnap = await ctx.db
-            .collection(COUPONS_COLLECTION)
-            .doc(event.rafflePrizeCouponId)
-            .get();
-        if (coupSnap.exists) {
-            rafflePrizeCouponCode = coupSnap.data().code;
-        }
-        else {
-            ctx.logger.warn("Raffle prize couponId does not resolve to a coupon", {
-                eventId,
-                couponId: event.rafflePrizeCouponId,
-            });
+    /*
+     * 🛑 Through `rafflePrizeCouponIdsOf`, so an event written before the
+     * widening — carrying only the deprecated scalar — still awards its prize.
+     * Reading `rafflePrizeCouponIds` alone would silently hand those winners
+     * nothing, and a raffle that draws a winner and awards no prize is a bug
+     * with no error and no second chance: the draw is irreversible.
+     */
+    const prizeCouponIds = rafflePrizeCouponIdsOf(event);
+    const rafflePrizeCouponCodes = [];
+    if (prizeCouponIds.length > 0) {
+        /*
+         * ONE `getAll` for all of them, not a loop of `.get()`. This runs inside a
+         * Cloud Function rather than a Vercel route, so it is not against Rule #6's
+         * 10s ceiling — but it sits immediately before a transaction, and holding
+         * N sequential round trips open there widens the window in which a
+         * concurrent draw can collide.
+         */
+        const refs = prizeCouponIds.map((id) => ctx.db.collection(COUPONS_COLLECTION).doc(id));
+        const snaps = await ctx.db.getAll(...refs);
+        for (const snap of snaps) {
+            if (snap.exists) {
+                const code = snap.data().code;
+                if (code)
+                    rafflePrizeCouponCodes.push(code);
+            }
+            else {
+                /*
+                 * Best-effort, per coupon: one deleted coupon must not cost the
+                 * winner the other prizes, and must not cost them the win at all.
+                 * Warned rather than thrown for exactly that reason.
+                 */
+                ctx.logger.warn("Raffle prize couponId does not resolve to a coupon", {
+                    eventId,
+                    couponId: snap.id,
+                });
+            }
         }
     }
+    /*
+     * The first code is still written to the singular `rafflePrizeCouponCode`
+     * the winner page already reads, so that page keeps working untouched while
+     * the full list lands beside it. Dropping the scalar would blank the prize
+     * on every existing winner announcement.
+     */
+    const rafflePrizeCouponCode = rafflePrizeCouponCodes[0];
     /*
      * 🛑 The one-draw invariant. Re-read the event INSIDE the transaction.
      *
@@ -209,6 +239,7 @@ export async function runTriggerEventRaffle(input, ctx) {
             [EVENT_FIELDS.RAFFLE_TRIGGERED_AT]: ctx.now,
             [EVENT_FIELDS.RAFFLE_ENTRY_COUNT]: entriesSnap.size,
             ...(rafflePrizeCouponCode ? { rafflePrizeCouponCode } : {}),
+            ...(rafflePrizeCouponCodes.length > 0 ? { rafflePrizeCouponCodes } : {}),
             [EVENT_FIELDS.RAFFLE_GITHUB_FUNCTION_URL]: `${ctx.env("PROOF_OF_FAIRNESS_BASE_URL") ?? ""}/raffles/${eventId}.json`,
             [EVENT_FIELDS.UPDATED_AT]: ctx.now,
         });

package/dist/_internal/server/jobs/core/whatsappNotify.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Core: async WhatsApp notification dispatch (`whatsappNotify` job).
+ *
+ * `sendNotification()` (appkit/src/features/admin/actions/notification-actions.ts)
+ * no longer calls the Meta Cloud API synchronously in-request — it enqueues
+ * this job instead (CLAUDE.md Rule #6 async job primitive) and returns
+ * immediately. This runner does the actual send, with a bounded retry, and
+ * writes the outcome back onto `notifications/{notificationId}` so admins
+ * have visibility beyond the `jobs/{jobId}` doc itself.
+ *
+ * Retry note: `sendWhatsAppTemplateMessage`/`sendWhatsAppBusinessMessage`
+ * return a plain boolean (not a status code), so this runner cannot cleanly
+ * distinguish a transient 5xx from a terminal 4xx (bad token, unknown
+ * template) the way a status-code-aware client could. It retries any
+ * failure up to MAX_ATTEMPTS with a short backoff — an acceptable
+ * simplification since this runs off the critical path, well inside the
+ * Firebase Function's 300s budget, and a terminal error just burns two
+ * extra fast failures before giving up.
+ */
+import type { JobContext } from "../runtime/types";
+import type { JobRunResult } from "./jobRunners";
+export interface WhatsAppNotifyPayload {
+    toPhone: string;
+    title: string;
+    message: string;
+    type: string;
+    /** Approved Meta template name for this notification type, if configured. */
+    templateName?: string;
+    /** BCP-47 language code the template was approved in. Defaults to "en". */
+    templateLanguage?: string;
+    notificationId: string;
+    phoneNumberId: string;
+    accessToken: string;
+}
+export declare function runWhatsAppNotify(payload: WhatsAppNotifyPayload, ctx: JobContext): Promise<JobRunResult>;

package/dist/_internal/server/jobs/core/whatsappNotify.js

@@ -0,0 +1,140 @@
+/**
+ * Core: async WhatsApp notification dispatch (`whatsappNotify` job).
+ *
+ * `sendNotification()` (appkit/src/features/admin/actions/notification-actions.ts)
+ * no longer calls the Meta Cloud API synchronously in-request — it enqueues
+ * this job instead (CLAUDE.md Rule #6 async job primitive) and returns
+ * immediately. This runner does the actual send, with a bounded retry, and
+ * writes the outcome back onto `notifications/{notificationId}` so admins
+ * have visibility beyond the `jobs/{jobId}` doc itself.
+ *
+ * Retry note: `sendWhatsAppTemplateMessage`/`sendWhatsAppBusinessMessage`
+ * return a plain boolean (not a status code), so this runner cannot cleanly
+ * distinguish a transient 5xx from a terminal 4xx (bad token, unknown
+ * template) the way a status-code-aware client could. It retries any
+ * failure up to MAX_ATTEMPTS with a short backoff — an acceptable
+ * simplification since this runs off the critical path, well inside the
+ * Firebase Function's 300s budget, and a terminal error just burns two
+ * extra fast failures before giving up.
+ */
+import { normalizeError } from "../../../../errors/normalize.js";
+import { notificationRepository } from "../../../../features/admin/repository/notification.repository.js";
+import { sendWhatsAppTemplateMessage, sendWhatsAppBusinessMessage, } from "../../../../features/whatsapp-bot/helpers/whatsapp.js";
+import { isChannelHealthy, recordChannelOutcome } from "../../notifications/channel-health.js";
+import { guardSend, logSuppressedSend } from "../../notifications/send-guard.js";
+const MAX_ATTEMPTS = 3;
+const RETRY_DELAY_MS = 1500;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function runWhatsAppNotify(payload, ctx) {
+    const { toPhone, title, message, type, templateName, templateLanguage, notificationId, phoneNumberId, accessToken } = payload;
+    /*
+     * The messaging guard, applied HERE rather than inside
+     * `sendWhatsAppBusinessMessage` itself.
+     *
+     * 🛑 That placement is deliberate and must not be "improved" by pushing a
+     * required guard parameter down into the sender. `features/whatsapp-bot/helpers/whatsapp.ts`
+     * is re-exported from `appkit/src/index.ts` (via `isAdminNumber`), and
+     * `guardSend` reaches `firebase-admin` through the settings and budget
+     * repositories. A static import of it from that file would put
+     * `firebase-admin` in the main entry's import graph, which is precisely the
+     * Turbopack client-bundle trap in Root Cause #6/#24 — it builds fine locally
+     * on webpack and fails every page in production.
+     *
+     * So the senders stay pure and each of the three real call sites guards
+     * itself; `scripts/audit-unguarded-send.mjs` enforces that a file calling a
+     * WhatsApp sender also calls `guardSend`.
+     *
+     * Note this job is only ever reached for an email/WhatsApp-ELIGIBLE type —
+     * `sendNotification` returns before enqueuing otherwise — so this is the
+     * ceiling and kill-switch check, not the type check.
+     */
+    const guard = {
+        channel: "whatsapp",
+        feature: type,
+        audience: "user",
+    };
+    const decision = await guardSend(guard);
+    if (!decision.allow) {
+        logSuppressedSend(guard, decision);
+        await notificationRepository
+            .update(notificationId, { whatsappStatus: "skipped" })
+            .catch((err) => {
+            void normalizeError(err);
+        });
+        return {
+            summary: { total: 1, succeeded: 0, skipped: 1, failed: 0 },
+            succeeded: [],
+            skipped: [notificationId],
+            failed: [],
+        };
+    }
+    if (!(await isChannelHealthy("whatsapp"))) {
+        ctx.logger.warn("whatsappNotify: WhatsApp channel circuit is open — skipping send", { notificationId });
+        await notificationRepository
+            .update(notificationId, { whatsappStatus: "skipped" })
+            .catch((err) => {
+            void normalizeError(err);
+        });
+        return {
+            summary: { total: 1, succeeded: 0, skipped: 1, failed: 0 },
+            succeeded: [],
+            skipped: [notificationId],
+            failed: [],
+        };
+    }
+    let sent = false;
+    let lastError;
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS && !sent; attempt++) {
+        try {
+            sent = templateName
+                ? await sendWhatsAppTemplateMessage({
+                    toPhone,
+                    phoneNumberId,
+                    accessToken,
+                    templateName,
+                    languageCode: templateLanguage ?? "en",
+                    bodyParams: [title, message],
+                })
+                : await sendWhatsAppBusinessMessage({
+                    toPhone,
+                    phoneNumberId,
+                    accessToken,
+                    message: `*${title}*\n${message}`,
+                });
+            if (!sent)
+                lastError = "Meta WhatsApp API returned a non-OK response";
+        }
+        catch (err) {
+            void normalizeError(err);
+            lastError = err instanceof Error ? err.message : String(err);
+        }
+        if (!sent && attempt < MAX_ATTEMPTS) {
+            ctx.logger.warn("whatsappNotify: send attempt failed, retrying", { notificationId, attempt, error: lastError ?? "" });
+            await delay(RETRY_DELAY_MS * attempt);
+        }
+    }
+    if (!templateName) {
+        ctx.logger.warn("whatsappNotify: no approved template configured for this notification type — sent as free-form text, which Meta rejects outside the 24h customer-service window", { notificationId });
+    }
+    await recordChannelOutcome("whatsapp", sent);
+    await notificationRepository
+        .update(notificationId, { whatsappStatus: sent ? "sent" : "failed" })
+        .catch((err) => {
+        void normalizeError(err);
+        ctx.logger.warn("whatsappNotify: failed to write back whatsappStatus onto notification doc", {
+            notificationId,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    });
+    if (!sent) {
+        throw new Error(lastError ?? "WhatsApp send failed after retries");
+    }
+    return {
+        summary: { total: 1, succeeded: 1, skipped: 0, failed: 0 },
+        succeeded: [notificationId],
+        skipped: [],
+        failed: [],
+    };
+}

package/dist/_internal/server/notifications/channel-health.d.ts

@@ -1,5 +1,5 @@
 /**
- * Circuit breaker for outbound notification channels.
+ * Circuit breaker for outbound notification channels (email, WhatsApp).
  *
  * Persisted as a singleton Firestore doc `system/channelHealth` so the
  * "is this channel currently known-bad" state survives across requests and
@@ -10,9 +10,11 @@
  * its own outcome decides whether the circuit re-closes or re-opens.
  */
 /**
- * Email is the only outbound *notification* channel with a transport.
- * "whatsapp" was the other arm until 2026-10-20, when the Cloud API
- * integration was removed.
+ * Email and WhatsApp are the outbound *notification* channels with a
+ * transport. The WhatsApp arm was removed 2026-10-20 with the Cloud API
+ * integration and restored 2026-10-23; it stays inert until
+ * `siteSettings.whatsapp.enabled` is on AND a number is registered on the
+ * Cloud API, so a breaker on it reports a channel nobody is using until then.
  *
  * ## 🛑 Phase 8 widened this to the RECONCILERS' reads — and only those
  *
@@ -36,7 +38,7 @@
  * backing off costs only freshness. Anything that moves money is not a reader
  * and does not belong in this union.
  */
-export type NotificationChannel = "email" | "razorpay_read" | "shiprocket_read";
+export type NotificationChannel = "email" | "whatsapp" | "razorpay_read" | "shiprocket_read";
 /**
  * Returns false only when the circuit is open and still within its cooldown
  * window. Any other state (closed, or open-but-cooldown-elapsed) is treated
@@ -47,7 +49,7 @@ export declare function recordChannelOutcome(channel: NotificationChannel, succe
 /**
  * Runs `fn` up to 3 times (500ms then 1.5s between attempts) and records the
  * final outcome against the channel's health state. `fn` must throw on
- * failure — for a helper that returns a boolean instead (e.g. a sender
+ * failure — for a helper that returns a boolean instead (e.g. the WhatsApp
  * Cloud API helpers), convert `false` into a thrown error at the call site
  * before passing it in.
  */

package/dist/_internal/server/notifications/channel-health.js

@@ -1,5 +1,5 @@
 /**
- * Circuit breaker for outbound notification channels.
+ * Circuit breaker for outbound notification channels (email, WhatsApp).
  *
  * Persisted as a singleton Firestore doc `system/channelHealth` so the
  * "is this channel currently known-bad" state survives across requests and
@@ -72,7 +72,7 @@ function delay(ms) {
 /**
  * Runs `fn` up to 3 times (500ms then 1.5s between attempts) and records the
  * final outcome against the channel's health state. `fn` must throw on
- * failure — for a helper that returns a boolean instead (e.g. a sender
+ * failure — for a helper that returns a boolean instead (e.g. the WhatsApp
  * Cloud API helpers), convert `false` into a thrown error at the call site
  * before passing it in.
  */

package/dist/_internal/server/notifications/send-guard.d.ts

@@ -15,7 +15,7 @@
  * message.
  *
  * The guarantee that nothing bypasses this is STRUCTURAL instead: the guard
- * argument is REQUIRED on `sendEmail`, so an
+ * argument is REQUIRED on `sendEmail` and on both WhatsApp senders, so an
  * unguarded send does not typecheck, and `scripts/audit-unguarded-send.mjs`
  * fails the build on a raw `createResendProvider().send()`. Make the wrong
  * thing unrepresentable rather than adding a second layer of defence that has

package/dist/_internal/server/notifications/send-guard.js

@@ -15,7 +15,7 @@
  * message.
  *
  * The guarantee that nothing bypasses this is STRUCTURAL instead: the guard
- * argument is REQUIRED on `sendEmail`, so an
+ * argument is REQUIRED on `sendEmail` and on both WhatsApp senders, so an
  * unguarded send does not typecheck, and `scripts/audit-unguarded-send.mjs`
  * fails the build on a raw `createResendProvider().send()`. Make the wrong
  * thing unrepresentable rather than adding a second layer of defence that has
@@ -69,7 +69,9 @@ export async function guardSend(ctx) {
     if (ctx.audience === "user" && !ctx.transactional) {
         const channelEnabled = ctx.channel === "email"
             ? (messaging?.emailEnabled ?? MESSAGE_BUDGET_DEFAULTS.emailEnabled)
-            : false; // sms has no sender; if one appears it starts disabled.
+            : ctx.channel === "whatsapp"
+                ? (messaging?.whatsappEnabled ?? MESSAGE_BUDGET_DEFAULTS.whatsappEnabled)
+                : false; // sms has no sender; if one appears it starts disabled.
         if (!channelEnabled) {
             return {
                 allow: false,

package/dist/_internal/shared/actions/action-registry.js

@@ -919,6 +919,34 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["seller", "admin"],
         },
+        // ── WhatsApp integration ────────────────────────────────────────────
+        "whatsapp-connect": {
+            iconKey: "link",
+            id: "store.whatsapp-connect",
+            label: "Save & Connect",
+            ariaLabel: "Save WhatsApp credentials and connect",
+            description: "Save WhatsApp Business credentials and establish connection.",
+            kind: "primary",
+            permissions: ["seller", "admin"],
+        },
+        "whatsapp-catalog-sync": {
+            iconKey: "retry",
+            id: "store.whatsapp-catalog-sync",
+            label: "Push to WhatsApp",
+            ariaLabel: "Sync products to WhatsApp catalog",
+            description: "Push published standard products to WhatsApp Business Catalog.",
+            kind: "secondary",
+            permissions: ["seller", "admin"],
+        },
+        "whatsapp-catalog-import": {
+            iconKey: "upload",
+            id: "store.whatsapp-catalog-import",
+            label: "Import from WhatsApp",
+            ariaLabel: "Import products from WhatsApp catalog",
+            description: "Import products from WhatsApp Catalog as drafts.",
+            kind: "secondary",
+            permissions: ["seller", "admin"],
+        },
         // ── Google Reviews integration ──────────────────────────────────────
         "google-reviews-sync": {
             iconKey: "retry",

package/dist/_internal/shared/checkout/order-math.d.ts

@@ -227,7 +227,7 @@ export interface PayableOrderLike {
  * money bug in all four payout paths (`autoPayoutEligibility`,
  * `weeklyPayoutEligibility`, and both `seller-actions` entry points). That
  * field is the GRAND TOTAL — `checkout/actions.ts` builds it as
- * `goods − coupon + shipping + codHandling + giftWrap +
+ * `goods − coupon + shipping + codHandling + whatsappNotify + giftWrap +
  * shipmentProtection + platformFee + platformFeeGst + emiSurcharge + gstAmount`
  * — so using it as the payout base did three wrong things at once:
  *

package/dist/_internal/shared/checkout/order-math.js

@@ -412,7 +412,7 @@ export function allocateAcrossMembers(total, weights) {
  * money bug in all four payout paths (`autoPayoutEligibility`,
  * `weeklyPayoutEligibility`, and both `seller-actions` entry points). That
  * field is the GRAND TOTAL — `checkout/actions.ts` builds it as
- * `goods − coupon + shipping + codHandling + giftWrap +
+ * `goods − coupon + shipping + codHandling + whatsappNotify + giftWrap +
  * shipmentProtection + platformFee + platformFeeGst + emiSurcharge + gstAmount`
  * — so using it as the payout base did three wrong things at once:
  *

package/dist/_internal/shared/features/checkout/config.d.ts

@@ -6,6 +6,8 @@ export declare const CHECKOUT_DEFAULT_COMMISSIONS: {
     readonly codDepositPercent: 10;
     readonly codHandlingFeeCap: 200;
     readonly codHandlingFeePercent: 10;
+    readonly whatsappNotifyFeeEnabled: true;
+    readonly whatsappNotifyFee: 10;
     readonly giftWrapFeeEnabled: true;
     readonly giftWrapFee: 49;
     readonly shipmentProtectionFeeEnabled: true;

package/dist/_internal/shared/features/checkout/config.js

@@ -13,6 +13,8 @@ export const CHECKOUT_DEFAULT_COMMISSIONS = {
     // Mirrors the SiteSettingsDocument defaults, which enable every add-on.
     // Consequence of the mirror: if the settings read fails, an add-on already
     // ticked on the cart document is still billed rather than silently dropped.
+    whatsappNotifyFeeEnabled: true,
+    whatsappNotifyFee: 10,
     giftWrapFeeEnabled: true,
     giftWrapFee: 49,
     shipmentProtectionFeeEnabled: true,

package/dist/_internal/shared/features/messaging/config.d.ts

@@ -16,12 +16,7 @@
  * and find the budget already covers them. A channel that is born capped
  * cannot repeat what email did.
  */
-/**
- * `whatsapp` was removed 2026-10-20 with the Cloud API integration. `sms`
- * stays declared with no sender — the ceiling exists so one cannot ship
- * uncapped — and `email` is the only channel with a live transport.
- */
-export type MessageChannel = "email" | "sms";
+export type MessageChannel = "email" | "whatsapp" | "sms";
 /**
  * Who the message is FOR — which is what the kill switch keys on.
  *
@@ -81,12 +76,13 @@ export type SendDecision = {
 /**
  * Defaults, mirrored into `DEFAULT_SITE_SETTINGS_DATA.messaging`.
  *
- * 🛑 `emailEnabled` defaults to FALSE. An install that
+ * 🛑 `emailEnabled` and `whatsappEnabled` default to FALSE. An install that
  * has not made a decision should be quiet, not loud — the opposite default is
  * how a fresh deploy mails real people from a half-configured site.
  */
 export declare const MESSAGE_BUDGET_DEFAULTS: {
     readonly emailEnabled: false;
+    readonly whatsappEnabled: false;
     readonly dailyCeiling: {
         /**
          * Resend's free tier is 100/day. 80 is not timidity — the counter is
@@ -96,6 +92,8 @@ export declare const MESSAGE_BUDGET_DEFAULTS: {
          * headroom is what stops "at the limit" from becoming "over it".
          */
         readonly email: 80;
+        /** Meta's pricing is per-conversation, not per-message; this is a sanity bound, not a tier limit. */
+        readonly whatsapp: 200;
         /** No sender exists yet. Present so one cannot ship uncapped. */
         readonly sms: 50;
     };

package/dist/_internal/shared/features/messaging/config.js

@@ -9,12 +9,13 @@
 /**
  * Defaults, mirrored into `DEFAULT_SITE_SETTINGS_DATA.messaging`.
  *
- * 🛑 `emailEnabled` defaults to FALSE. An install that
+ * 🛑 `emailEnabled` and `whatsappEnabled` default to FALSE. An install that
  * has not made a decision should be quiet, not loud — the opposite default is
  * how a fresh deploy mails real people from a half-configured site.
  */
 export const MESSAGE_BUDGET_DEFAULTS = {
     emailEnabled: false,
+    whatsappEnabled: false,
     dailyCeiling: {
         /**
          * Resend's free tier is 100/day. 80 is not timidity — the counter is
@@ -24,6 +25,8 @@ export const MESSAGE_BUDGET_DEFAULTS = {
          * headroom is what stops "at the limit" from becoming "over it".
          */
         email: 80,
+        /** Meta's pricing is per-conversation, not per-message; this is a sanity bound, not a tier limit. */
+        whatsapp: 200,
         /** No sender exists yet. Present so one cannot ship uncapped. */
         sms: 50,
     },

package/dist/_internal/shared/features/site-settings/fees.d.ts

@@ -27,6 +27,8 @@ import type { EmiSettings } from "../emi/schedule";
  * and each `compute*Fee` helper carries its own default.
  */
 export interface BuyerFacingFees {
+    whatsappNotifyFeeEnabled?: boolean;
+    whatsappNotifyFee?: number;
     giftWrapFeeEnabled?: boolean;
     giftWrapFee?: number;
     shipmentProtectionFeeEnabled?: boolean;

package/dist/_internal/shared/features/site-settings/fees.js

@@ -13,6 +13,8 @@ export function toBuyerFacingFees(commissions) {
     if (!commissions)
         return null;
     return {
+        whatsappNotifyFeeEnabled: commissions.whatsappNotifyFeeEnabled,
+        whatsappNotifyFee: commissions.whatsappNotifyFee,
         giftWrapFeeEnabled: commissions.giftWrapFeeEnabled,
         giftWrapFee: commissions.giftWrapFee,
         shipmentProtectionFeeEnabled: commissions.shipmentProtectionFeeEnabled,

package/dist/_internal/shared/features/site-settings/types.d.ts

@@ -12,8 +12,20 @@
  * `scripts/audit-public-projection-parity.mjs`. Adding a field here without a
  * proven client reader is how the endpoint drifted in the first place.
  */
-import type { NotificationChannelConfig, SiteSettingsDocument } from "../../../../features/admin/schemas/firestore";
+import type { SiteSettingsDocument } from "../../../../features/admin/schemas/firestore";
 import type { MediaVideoWatermark } from "../../../../features/media/MediaVideo";
+/** The only notification-channel facts a browser is given: is each channel on. */
+export interface PublicNotificationChannels {
+    email: {
+        enabled: boolean;
+    };
+    whatsapp: {
+        enabled: boolean;
+    };
+    sms: {
+        enabled: boolean;
+    };
+}
 export interface PublicSiteSettings {
     /** Support channels shown to buyers. Deliberately NOT the full `contact` — `address` and `upiVpa` stay server-side. */
     contact: {
@@ -64,7 +76,20 @@ export interface PublicSiteSettings {
     search?: {
         indexEnabled: boolean;
     };
-    notificationChannels?: NotificationChannelConfig;
+    /**
+     * 🛑 NARROWER than `NotificationChannelConfig` on purpose, and it must stay
+     * that way. The full config carries `minPriority` and a `types[]` allow-list
+     * naming exactly which notification types each channel carries — operational
+     * routing detail that no browser reads and that an anonymous caller has no
+     * business enumerating.
+     *
+     * `inApp` is deliberately absent too: it is always on and nothing renders a
+     * toggle for it.
+     *
+     * Widening this back to `NotificationChannelConfig` re-publishes the lot by
+     * the act of widening, which is the failure Root Cause #70 records.
+     */
+    notificationChannels?: PublicNotificationChannels;
     announcementBar?: SiteSettingsDocument["announcementBar"];
     navConfig?: SiteSettingsDocument["navConfig"];
     actionConfig?: SiteSettingsDocument["actionConfig"];

package/dist/_internal/shared/fees/calculator.d.ts

@@ -175,6 +175,14 @@ export interface CodHandlingFeeRates {
  * changes no number on its own.
  */
 export declare function computeCodHandlingFee(subtotal: number, rates: CodHandlingFeeRates): number;
+export interface WhatsAppNotifyFeeRates {
+    /** Admin master toggle — the addon isn't charged (even if the buyer selected it) unless this is true. */
+    whatsappNotifyFeeEnabled?: boolean;
+    /** Flat rupee fee charged when the buyer opts in. Falls back to ₹10. */
+    whatsappNotifyFee?: number;
+}
+/** Flat WhatsApp order-updates addon fee — charged only when the buyer opted in AND the admin has the addon enabled. */
+export declare function computeWhatsAppNotifyFee(addonSelected: boolean, rates: WhatsAppNotifyFeeRates): number;
 export interface GiftWrapFeeRates {
     /** Admin master toggle — the addon isn't charged (even if the buyer selected it) unless this is true. */
     giftWrapFeeEnabled?: boolean;

package/dist/_internal/shared/fees/calculator.js

@@ -202,6 +202,13 @@ export function computeCodHandlingFee(subtotal, rates) {
     const percentFee = roundRupees(subtotal * (percent / 100));
     return Math.min(percentFee, cap);
 }
+const DEFAULT_WHATSAPP_NOTIFY_FEE = 10;
+/** Flat WhatsApp order-updates addon fee — charged only when the buyer opted in AND the admin has the addon enabled. */
+export function computeWhatsAppNotifyFee(addonSelected, rates) {
+    if (!addonSelected || !rates.whatsappNotifyFeeEnabled)
+        return 0;
+    return rates.whatsappNotifyFee ?? DEFAULT_WHATSAPP_NOTIFY_FEE;
+}
 const DEFAULT_GIFT_WRAP_FEE = 49;
 /** Flat gift-wrap addon fee — charged only when the buyer opted in AND the admin has the addon enabled. */
 export function computeGiftWrapFee(addonSelected, rates) {

package/dist/cli/index.js

@@ -59,6 +59,7 @@ export const FEATURE_SUBPATH_MAP = {
     "before-after": "@mohasinac/appkit/features/before-after",
     collections: "@mohasinac/appkit/features/collections",
     preorders: "@mohasinac/appkit/features/pre-orders",
+    "whatsapp-bot": "@mohasinac/appkit/features/whatsapp-bot",
 };
 /**
  * Wraps a Next.js config object. With appkit, only `@mohasinac/appkit` needs to
@@ -109,6 +110,7 @@ const FEATURE_NAMESPACE_MAP = {
     corporate: "corporate",
     "before-after": "beforeAfter",
     collections: "collections",
+    "whatsapp-bot": "whatsappBot",
 };
 // Opaque dynamic import — prevents bundlers from statically analysing the path
 const _dynamicImport = new Function("modulePath", "return import(modulePath)");