@mohasinac/appkit 4.63.4 → 4.64.0

package/dist/_internal/server/features/seo/taxonomy-links.js

@@ -0,0 +1,85 @@
+/**
+ * Server-side link lists for the taxonomy hub pages.
+ *
+ * Feeds `<TaxonomyLinkIndex>`, which renders them as real `<a href>`s in the
+ * server HTML. See that component for why: measured 2026-10-24, `/categories`,
+ * `/brands` and `/parts` each emitted ZERO outbound entity links because all
+ * three filter client-side, so a crawler landing on a hub had nothing to
+ * follow and the franchise detail pages were reachable by no link at all.
+ *
+ * 🛑 Every function FAILS OPEN with `[]`. These pages are statically rendered;
+ * a Firestore hiccup at build time must degrade to "no index section" rather
+ * than fail the build or 500 the page. An empty list makes
+ * `<TaxonomyLinkIndex>` render nothing at all, which is the correct fallback —
+ * the interactive grid above it is unaffected either way.
+ *
+ * 🛑 A read here does NOT make the hub dynamic. Only `searchParams`,
+ * `cookies()` and `headers()` do (Root Cause #94); a Server Component awaiting
+ * Firestore stays static and simply bakes the result in at build/ISR time.
+ */
+import { normalizeError } from "../../../../errors/normalize.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { ROUTES } from "../../../../next/routing/route-map.js";
+import { categoriesRepository } from "../../../../features/categories/repository/categories.repository.js";
+/** Alphabetical, so the list reads as an index rather than an arbitrary dump. */
+function toLinks(rows, href) {
+    return rows
+        .filter((row) => Boolean(row.slug) && Boolean(row.name))
+        .map((row) => ({ href: href(row.slug), label: row.name }))
+        .sort((a, b) => a.label.localeCompare(b.label));
+}
+async function safeLinks(label, load) {
+    try {
+        return await load();
+    }
+    catch (err) {
+        void normalizeError(err);
+        serverLogger.error(`taxonomy link index "${label}" failed and rendered 0 links`, {
+            section: label,
+            error: err,
+        });
+        return [];
+    }
+}
+/** Every active brand — 28 of them, and none was linked from `/brands`. */
+export function brandLinks() {
+    return safeLinks("brand", async () => toLinks(await categoriesRepository.findActiveBrands(), (slug) => String(ROUTES.PUBLIC.BRAND_DETAIL(slug))));
+}
+/**
+ * Active franchises only.
+ *
+ * 7 of the 8 are deliberately `isActive: false` because an unstocked facet
+ * "renders as a card in the grid that opens an empty page" (`brand-rows.ts`
+ * trap 3), so this list is short on purpose. Linking the inactive ones would
+ * re-create exactly the empty-page problem the rest of this work removes.
+ */
+export function franchiseLinks() {
+    return safeLinks("franchise", async () => toLinks(await categoriesRepository.findActiveFranchises(), (slug) => String(ROUTES.PUBLIC.FRANCHISE_DETAIL(slug))));
+}
+/**
+ * The tier-0 category roots — the six real entry points a visitor drills down
+ * from, not the 4,698-row forest.
+ *
+ * `CategoryDetailPageView` already renders a root as a tier-grouped index of
+ * its descendants, so a root is where a crawl of the taxonomy should start.
+ * Listing every leaf here would put the 4,658 empty pages back in front of
+ * Google by another route, which is the thing being undone.
+ */
+export function categoryRootLinks() {
+    return safeLinks("category-root", async () => {
+        const roots = await categoriesRepository.getRootCategories();
+        /*
+         * 🛑 `getRootCategories()` filters only on the DEPRECATED `isBrand` flag,
+         * and brands, franchises and bundles are all tier-0 by design — they sit
+         * outside the forest's numbering and are pointed AT rather than lived
+         * under. A franchise row carries no `isBrand`, so it survives that filter
+         * and would appear in a list captioned "categories".
+         *
+         * Rejecting any row that carries a `categoryType` is the same predicate
+         * the /categories tab uses ("categoryType empty AND tier === 0"), and it
+         * is the one that stays correct when a fifth discriminator is added.
+         */
+        const plain = roots.filter((row) => !row.categoryType);
+        return toLinks(plain, (slug) => String(ROUTES.PUBLIC.CATEGORY_DETAIL(slug)));
+    });
+}

package/dist/_internal/server/features/site-settings/adapters.js

@@ -7,7 +7,7 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "contact", // user/orders/[id]/payment — contact.whatsappNumber (narrowed: no address/upiVpa)
     "payment", // CheckoutRouteClient — payment.otpCheckoutThreshold (narrowed)
     "listings", // useListingTypeFlags — narrowed to listings.listingTypes; categoryTypes has no client reader
-    "notificationChannels", // NotificationPreferencesPanel reads the per-channel toggles
+    "notificationChannels", // NARROWED: only {email,whatsapp,sms}.enabled — see the projection below
     "announcementBar", // the homepage banner (AdminSiteSettingsView edits it)
     /*
      * `support.enabled` — a REAL client reader, which is the bar this list sets:
@@ -138,7 +138,25 @@ export function toPublicSiteSettings(doc, opts) {
         listings: {
             listingTypes: doc.listings?.listingTypes,
         },
-        notificationChannels: doc.notificationChannels,
+        /*
+         * 🛑 Narrowed to the three booleans a client reads, not the group by
+         * reference. Emitted whole, this published every WhatsApp channel setting
+         * to anonymous callers — `minPriority`, and the `types[]` allow-list naming
+         * exactly which notification types each channel carries. Nothing reads
+         * those in a browser: `NotificationPreferencesPanel` wants the three
+         * `enabled` flags to label its toggles, `whatsapp.otpEnabled` is read by a
+         * SERVER action, and the admin editor reads `GET /api/admin/site`.
+         *
+         * Same reasoning as `support` below — a field added to a channel later must
+         * not be published by the act of adding it (Root Cause #70).
+         */
+        notificationChannels: doc.notificationChannels
+            ? {
+                email: { enabled: doc.notificationChannels.email?.enabled === true },
+                whatsapp: { enabled: doc.notificationChannels.whatsapp?.enabled === true },
+                sms: { enabled: doc.notificationChannels.sms?.enabled === true },
+            }
+            : undefined,
         announcementBar: doc.announcementBar,
         // Narrowed to the one boolean a client reads, not the group by reference —
         // so a field added to `support` later is not published by accident.

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -25,9 +25,9 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  * Document fields that may reach an unauthenticated client. Keep in sync with
  * the object literals below — the audit asserts both directions.
  */
-export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "allowSharedPurchase", "sharedPurchaseHandlingFee", "sharedPurchaseExtraShippingPerDestination", "createdAt"];
+export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "allowSharedPurchase", "sharedPurchaseHandlingFee", "sharedPurchaseExtraShippingPerDestination", "isVerified", "sellerTier", "standing", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["whatsappNotifySubscribed", "trustedSeller", "acceptsPoints", "searchTxt", "whatsappNotifySubscribed", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "tierLockedByAdmin", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -49,10 +49,61 @@ export const PUBLIC_STORE_FIELDS = [
     "allowSharedPurchase",
     "sharedPurchaseHandlingFee",
     "sharedPurchaseExtraShippingPerDestination",
+    /*
+     * ── Seller trust, 2026-10-24 ──────────────────────────────────────────────
+     *
+     * 🛑 `isVerified` MOVED here from PRIVATE, deliberately, and this is a
+     * reclassification rather than a drive-by.
+     *
+     * It was filed as "admin moderation state; surfaced via a separate badge
+     * feed if ever needed". That badge feed never existed, and meanwhile three
+     * things were already treating the field as public: `/sellers` filters on
+     * `isVerified == true` to offer a "verified sellers" view,
+     * `StoreCapabilitiesGuideView` told sellers in as many words that "the
+     * Verified badge appears on your store profile page and on every listing
+     * card", and the seller onboarding checklist offered "Request verified
+     * badge" as a step. All three described a public badge; the projection
+     * stripped the field, so no badge could render anywhere and the guide copy
+     * was simply false.
+     *
+     * It is a badge, not moderation state — `status` / `isPublic` /
+     * `suspensionReason` are the moderation fields and all three stay private
+     * or already are public for their own reasons. The named reader is
+     * `<SellerTierBadge>`.
+     *
+     * `sellerTier` and `standing` are public for the same reason: the tier is
+     * the whole point of the feature being visible to a buyer, and `standing`
+     * carries the METRICS behind it (counts and a mean — no buyer uids, no
+     * addresses) so a seller's own dashboard panel can render progress from the
+     * store document it already holds without a second read.
+     *
+     * 🛑 `trustedSeller` stays PRIVATE and must never be added here. It is the
+     * money-moving half of the same decision — see its entry below.
+     */
+    "isVerified",
+    "sellerTier",
+    "standing",
     "createdAt",
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_STORE_FIELDS = [
+    /*
+     * 🛑 `whatsappNotifySubscribed` — a BILLING-BEARING operational flag.
+     *
+     * It records whether this seller opted in to the platform WhatsApp number,
+     * and the gate fails CLOSED on it: absent means not subscribed, because
+     * defaulting a missing flag to true would message customers on behalf of
+     * every seller who never signed up and bill the platform per template.
+     *
+     * A buyer has no use for it — it says nothing about the goods, the price
+     * or the dispatch record. Published, it would also advertise which sellers
+     * can be reached on WhatsApp, which is a channel the platform owns rather
+     * than the seller, and an invitation to contact them off-platform.
+     *
+     * Default-private per this file's own rule: a field is private until
+     * someone can name the client that reads it.
+     */
+    "whatsappNotifySubscribed",
     /*
      * 🛑 `trustedSeller` — OUR RISK POSTURE, not a badge.
      *
@@ -94,14 +145,32 @@ export const PRIVATE_STORE_FIELDS = [
     // it has no client reader and would bloat every store payload with a few
     // hundred tokens.
     "searchTxt",
+    /*
+     * A BILLING RELATIONSHIP between the seller and the platform: whether this
+     * store pays the monthly add-on that sends its buyers WhatsApp order
+     * updates. The buyer learns about it where it is actually decided — the
+     * per-store add-on picker at checkout, which reads the pricing preview, not
+     * this projection. Publishing it here would expose which sellers pay us for
+     * what, which is commercial terms (same reason `customCommissionRate` is
+     * below), and it has no reader on any public store surface.
+     */
+    "whatsappNotifySubscribed",
     "updatedAt", // bookkeeping; no public reader
+    "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public
     // Admin decisions with actor UIDs and suspension reasons. The store OWNER
     // sees this on their own admin surfaces; an anonymous visitor to /stores has
     // no business reading who suspended whom and why.
     "statusHistory",
     "statusHistoryTruncated",
-    "isVerified", // admin moderation state; surfaced via a separate badge feed if ever needed
+    // `isVerified` moved to PUBLIC_STORE_FIELDS on 2026-10-24 — it is a badge,
+    // and three surfaces already described it as one. See the note there.
+    //
+    // `tierLockedByAdmin` is the opposite call: `sellerTier` is public because a
+    // buyer should see the badge, but HOW we administer that record — whether an
+    // admin pinned it against the monthly recompute — says nothing about the
+    // goods or the seller and is nobody's business outside the back office.
+    "tierLockedByAdmin",
     "suspensionReason", // admin moderation note
     "capabilities", // internal feature gating; server-enforced, never client-read
     "customCommissionRate", // commercial terms for this seller
@@ -212,6 +281,24 @@ export function toStoreListItem(doc, _opts) {
         allowSharedPurchase: doc.allowSharedPurchase ?? false,
         sharedPurchaseHandlingFee: doc.sharedPurchaseHandlingFee,
         sharedPurchaseExtraShippingPerDestination: doc.sharedPurchaseExtraShippingPerDestination,
+        /*
+         * 🛑 `?? false` and `?? "seller"` — the same tri-state rule as the
+         * protection flags, for a sharper reason. A badge component testing
+         * `undefined` loosely renders nothing, which is correct here, but a
+         * component testing `!== false` or `!== "seller"` would render a VERIFIED
+         * or TRUSTED badge on a store that has earned neither. Defaulting on the
+         * server means no client can make that mistake.
+         */
+        isVerified: doc.isVerified ?? false,
+        sellerTier: doc.sellerTier ?? "seller",
+        /*
+         * `standing` is passed through as `undefined` when absent, NOT defaulted
+         * to a zeroed object. "Never computed" and "computed, and you have zero
+         * delivered orders" are different facts, and the panel renders them
+         * differently — a confident "0 of 25" on a store that has simply never
+         * been measured is the regression Root Cause #72 names.
+         */
+        standing: doc.standing,
         createdAt: toIsoString(doc.createdAt),
     };
 }

package/dist/_internal/server/functions/scheduled.d.ts

@@ -7,6 +7,21 @@ export declare const couponExpiry: import("./types").ScheduledFunctionDefinition
 export declare const offerExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const reservationExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const productStatsSync: import("./types").ScheduledFunctionDefinition;
+/**
+ * Seller standing — MONTHLY, on the last day of the month.
+ *
+ * 🛑 `28-31`, never `31`. Cloud Scheduler is unix-cron with no `L` token, so
+ * `0 2 31 * *` **never fires in February, April, June, September or
+ * November** — it would silently skip 5 of 12 months and present as a tier
+ * that updates "sometimes". This fires on each candidate day and
+ * `isLastDayOfMonth` in the core keeps exactly the real one, so at most 3 of
+ * the 4 invocations are no-ops that return before reading anything.
+ *
+ * 540s because it scans a 90-day window of orders and reviews, then writes
+ * one document per store. `maxInstances: 1` because two concurrent runs would
+ * both compute a tier and race on the same store documents.
+ */
+export declare const sellerStandingRollup: import("./types").ScheduledFunctionDefinition;
 export declare const revenueRollup: import("./types").ScheduledFunctionDefinition;
 export declare const searchIndexBuild: import("./types").ScheduledFunctionDefinition;
 export declare const priceIndexRollup: import("./types").ScheduledFunctionDefinition;
@@ -100,4 +115,4 @@ export declare const prizeDrawExpiryReveal: import("./types").ScheduledFunctionD
 export declare const bundleStockSync: import("./types").ScheduledFunctionDefinition;
 export declare const emiInstallmentReminder: import("./types").ScheduledFunctionDefinition;
 export declare const catalogueImageStalenessReminder: import("./types").ScheduledFunctionDefinition;
-export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];
+export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];

package/dist/_internal/server/functions/scheduled.js

@@ -1,6 +1,6 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, boxRollupReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, reservationExpiryHandler, obligationSweepHandler, paymentReconcileHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, priceIndexRollupHandler, marketPriceRollupHandler, searchIndexBuildHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers/index.js";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, boxRollupReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, reservationExpiryHandler, obligationSweepHandler, paymentReconcileHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, sellerStandingRollupHandler, priceIndexRollupHandler, marketPriceRollupHandler, searchIndexBuildHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers/index.js";
 import { defineFunction } from "./define.js";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
@@ -152,6 +152,27 @@ export const productStatsSync = defineFunction({
     handler: productStatsSyncHandler,
     options: { region: REGION, timeoutSeconds: 540, memory: "256MiB", maxInstances: 1 },
 });
+/**
+ * Seller standing — MONTHLY, on the last day of the month.
+ *
+ * 🛑 `28-31`, never `31`. Cloud Scheduler is unix-cron with no `L` token, so
+ * `0 2 31 * *` **never fires in February, April, June, September or
+ * November** — it would silently skip 5 of 12 months and present as a tier
+ * that updates "sometimes". This fires on each candidate day and
+ * `isLastDayOfMonth` in the core keeps exactly the real one, so at most 3 of
+ * the 4 invocations are no-ops that return before reading anything.
+ *
+ * 540s because it scans a 90-day window of orders and reviews, then writes
+ * one document per store. `maxInstances: 1` because two concurrent runs would
+ * both compute a tier and race on the same store documents.
+ */
+export const sellerStandingRollup = defineFunction({
+    name: "sellerStandingRollup",
+    description: "Recompute seller standing on the last day of each month and grant/revoke the Trusted Seller tier, which also sets trustedSeller (paid at shipping). Fires on days 28-31; the handler keeps only the real month-end.",
+    trigger: { kind: "schedule", cron: "0 2 28-31 * *", timeZone: "UTC" },
+    handler: sellerStandingRollupHandler,
+    options: { region: REGION, timeoutSeconds: 540, memory: "256MiB", maxInstances: 1 },
+});
 export const revenueRollup = defineFunction({
     name: "revenueRollup",
     description: "Pre-compute total delivered-order revenue into analytics/dashboardRollup, replacing an unbounded per-request scan (daily 01:30 UTC).",
@@ -502,6 +523,7 @@ export const SCHEDULED_FUNCTIONS = [
     reservationExpiry,
     productStatsSync,
     revenueRollup,
+    sellerStandingRollup,
     priceIndexRollup,
     marketPriceRollup,
     searchIndexBuild,

package/dist/_internal/server/jobs/core/analyticsAlertEvaluate.js

@@ -299,7 +299,7 @@ function buildMetricCache(ctx, bucket, now, onSaturated) {
  * The owner's contact details, resolved once per owner.
  *
  * 🛑 This is how the seller's `notifyChannels` is HONOURED rather than
- * ignored. `sendNotification` decides email eligibility itself
+ * ignored. `sendNotification` decides email and WhatsApp eligibility itself
  * (type gate → admin allow-list → user prefs → daily budget) and takes no
  * channel list — but it cannot email an address it was not given. So omitting
  * `userEmail` when the seller did not tick email is a real narrowing through
@@ -389,6 +389,9 @@ export async function runAnalyticsAlertEvaluate(ctx) {
                 ...(alert.notifyChannels?.includes("email") && contact.email
                     ? { userEmail: contact.email }
                     : {}),
+                ...(alert.notifyChannels?.includes("whatsapp") && contact.phone
+                    ? { userPhone: contact.phone }
+                    : {}),
                 audience: b.scope === "admin" ? "admin" : "seller",
             });
         };
@@ -426,7 +429,7 @@ export async function runAnalyticsAlertEvaluate(ctx) {
                  *
                  * If the notification throws, the cooldown has still been recorded —
                  * so a persistently failing channel cannot turn into one attempt per
-                 * run forever. The inverse order would retry a broken send
+                 * run forever. The inverse order would retry a broken WhatsApp send
                  * every hour against a 100/day email allowance.
                  */
                 await ctx.db

package/dist/_internal/server/jobs/core/jobRunners.js

@@ -11,6 +11,7 @@
 import { runWeeklyPayoutEligibility } from "./weeklyPayoutEligibility.js";
 import { runHardBanCascade } from "./hardBanCascade.js";
 import { runResetOtpVerification } from "./resetOtpVerification.js";
+import { runWhatsAppNotify } from "./whatsappNotify.js";
 import { runNewsletterExport } from "./newsletterExport.js";
 import { runStoreNameBackfill } from "./storeNameBackfill.js";
 import { runCategoryTaxonomyBackfill } from "./categoryTaxonomyBackfill.js";
@@ -41,6 +42,9 @@ async function runHardBanCascadeJob(payload, ctx) {
 async function runResetOtpVerificationJob(_payload, ctx) {
     return runResetOtpVerification(ctx);
 }
+async function runWhatsAppNotifyJob(payload, ctx) {
+    return runWhatsAppNotify(payload, ctx);
+}
 async function runNewsletterExportJob(_payload, ctx) {
     return runNewsletterExport(ctx);
 }
@@ -105,6 +109,7 @@ export const JOB_RUNNERS = {
     payoutsWeekly: runPayoutsWeeklyJob,
     hardBanCascade: runHardBanCascadeJob,
     resetOtpVerification: runResetOtpVerificationJob,
+    whatsappNotify: runWhatsAppNotifyJob,
     newsletterExport: runNewsletterExportJob,
     storeNameBackfill: runStoreNameBackfillJob,
     categoryTaxonomyBackfill: runCategoryTaxonomyBackfillJob,

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,7 +1,77 @@
 import { normalizeError } from "../../../../errors/normalize.js";
 import { ORDER_PII_FIELDS, revealPii } from "../../../../security/index.js";
-import { adminNotificationsRepository } from "../../../../repositories/index.js";
-import { buildPurchaseAnnouncementMessage } from "../../../../features/orders/utils/order-announcement-message.js";
+import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories/index.js";
+import { decryptPii } from "../../../../security/index.js";
+import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server.js";
+import { resolveKeys } from "../../../../core/integration-keys.js";
+import { guardSend, logSuppressedSend } from "../../notifications/send-guard.js";
+async function sendAnnouncement(ctx, toPhone, message, phoneNumberId, accessToken, label, orderId) {
+    try {
+        const sent = await sendWhatsAppBusinessMessage({
+            toPhone,
+            message,
+            phoneNumberId,
+            accessToken,
+        });
+        if (sent) {
+            ctx.logger.info(`Announcement sent to ${label}`, {
+                orderId,
+                toPhone: `...${toPhone.slice(-4)}`,
+            });
+        }
+        else {
+            ctx.logger.error(`Announcement delivery failed for ${label} (non-fatal)`, null, { orderId });
+        }
+    }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error(`Announcement send threw for ${label} (non-fatal)`, err, { orderId });
+    }
+}
+async function notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId) {
+    try {
+        const store = await storeRepository.findBySlug(storeId);
+        if (!store?.ownerId)
+            return;
+        const owner = await userRepository.findById(store.ownerId);
+        const encryptedPhone = owner?.phoneNumber;
+        if (!encryptedPhone)
+            return;
+        const ownerPhone = decryptPii(encryptedPhone);
+        if (ownerPhone) {
+            await sendAnnouncement(ctx, ownerPhone, message, phoneNumberId, accessToken, "store-owner", orderId);
+        }
+    }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error("Store owner lookup failed (non-fatal)", err, { orderId, storeId });
+    }
+}
+/**
+ * Seeded credentials are `*_PLACEHOLDER` strings rather than empty, so an
+ * emptiness test alone would happily send with a fake token. Mirrors the guard
+ * in checkout-value-otp-actions.ts.
+ */
+function usable(value) {
+    const v = value?.trim() ?? "";
+    return v && !v.includes("PLACEHOLDER") ? v : "";
+}
+async function resolveWhatsAppCredentials(ctx, orderId) {
+    let db = {};
+    try {
+        db = await resolveKeys();
+    }
+    catch (err) {
+        void normalizeError(err);
+        // Firestore unreachable from the Functions runtime — env-only is still a
+        // valid configuration, so this is a warning, not a failure.
+        ctx.logger.warn("Credential lookup failed — falling back to env", { orderId });
+    }
+    return {
+        phoneNumberId: usable(db.whatsappPhoneNumberId) || usable(ctx.env("WHATSAPP_PHONE_NUMBER_ID")),
+        accessToken: usable(db.whatsappCloudApiToken) || usable(ctx.env("WHATSAPP_CLOUD_API_TOKEN")),
+    };
+}
 export async function handleOrderCreate(input, ctx) {
     const { orderId, order } = input;
     const items = order.items ?? [];
@@ -70,13 +140,37 @@ export async function handleOrderCreate(input, ctx) {
         ctx.logger.error("Failed to write admin order notification (non-fatal)", err, { orderId });
     }
     /*
-     * The seller is told about their own sale by the `order_placed`
-     * notification `createOrderForGroup` already sends (in-app + email). This
-     * handler used to ALSO push a WhatsApp Cloud API message here — a duplicate
-     * channel for the same event, and the only thing in this file that needed a
-     * Meta token, a registered number and a billing relationship. Removed with
-     * the rest of the WhatsApp integration on 2026-10-20; no signal was lost,
-     * because the notification path is independent and unchanged.
+     * Seller side keeps WhatsApp: it is ONE message to ONE person about their
+     * own sale, which is the case the channel is good at. Credentials resolve
+     * DB-first (Admin → Site Settings → WhatsApp) with an env fallback — this
+     * read `ctx.env()` only until 2026-08-22, so credentials saved in Site
+     * Settings never reached the announcement and it silently no-op'd.
      */
-    ctx.logger.info("Order announcement complete", { orderId, storeId: order.storeId ?? null });
+    const storeId = order.storeId;
+    if (!storeId) {
+        ctx.logger.info("Order has no storeId — nothing to announce to a seller", { orderId });
+        return;
+    }
+    const { phoneNumberId, accessToken } = await resolveWhatsAppCredentials(ctx, orderId);
+    if (!phoneNumberId || !accessToken) {
+        ctx.logger.info("WhatsApp Cloud API not configured — skipping seller announcement", { orderId });
+        return;
+    }
+    // Audience is "user": a seller receiving news of their own sale is a
+    // marketplace participant, not an operator of the site. Staff exemption is
+    // for the digest and the payout summary, and widening it to "anyone we think
+    // ought to see this" would make the kill switch mean nothing.
+    const guard = {
+        channel: "whatsapp",
+        feature: "order_placed_seller",
+        audience: "user",
+    };
+    const decision = await guardSend(guard);
+    if (!decision.allow) {
+        logSuppressedSend(guard, decision);
+        ctx.logger.info("Seller order announcement suppressed by messaging guard", { orderId, storeId });
+        return;
+    }
+    await notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId);
+    ctx.logger.info(`Order announcement complete`, { orderId, storeId });
 }

package/dist/_internal/server/jobs/core/onOrderStatusChange.d.ts

@@ -12,6 +12,8 @@ export type OrderAfter = {
      */
     paymentStatus?: string;
     invoiceNumber?: string;
+    /** The seller. Decides the WhatsApp arm via their notification subscription. */
+    storeId?: string;
 };
 export type OrderBefore = {
     status: OrderStatus;

package/dist/_internal/server/jobs/core/onOrderStatusChange.js

@@ -119,6 +119,7 @@ export async function handleOrderStatusChange(input, ctx) {
             relatedId: orderId,
             relatedType: "order",
             userEmail,
+            storeId: after.storeId,
         });
         // The RTDB mirror that used to live here has been removed. `sendNotification`
         // above is the real path (in-app + email + WhatsApp); the extra

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -30,6 +30,7 @@ export async function handleScamReportCreate(input, ctx) {
                 relatedId: scammerId,
                 relatedType: "scammer",
                 userEmail: reporterPlain?.email ?? undefined,
+                userPhone: reporterPlain?.phoneNumber ?? undefined,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/onScamReportRejected.js

@@ -28,6 +28,7 @@ export async function handleScamReportRejected(input, ctx) {
             relatedId: scammerId,
             relatedType: "scammer",
             userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/onScamReportVerified.js

@@ -28,6 +28,7 @@ export async function handleScamReportVerified(input, ctx) {
             relatedId: scammerId,
             relatedType: "scammer",
             userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/paymentWindowTimeout.js

@@ -123,6 +123,7 @@ export async function runPaymentWindowTimeout(ctx) {
                 message: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_MESSAGE(entry.data.productTitle),
                 relatedId: entry.id,
                 relatedType: "order",
+                storeId: entry.data.storeId,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/pendingOrderTimeout.js

@@ -67,6 +67,7 @@ export async function runPendingOrderTimeout(ctx) {
                 message: ORDER_MESSAGES.CANCELLED_TIMEOUT_MESSAGE(entry.data.productTitle, timeoutHours),
                 relatedId: entry.id,
                 relatedType: "order",
+                storeId: entry.data.storeId,
             });
         }
         catch (err) {