CRM

Marketing for Taraba's customers, at http://localhost:8082 (team login, see docs/WORKSPACE.md; marketing role: radu.pavel@taraba.ro). Nothing is sent to real people: email, push and SMS all land in Mailpit (tags campaign, push, sms).

Pages

URL	What
/	Contacts, consent rates per channel, messages and unsubscribes in the last 30 days
/contacts, /contacts/:id	Search by name, email, town; filter by stage and consent. Card: activity, consent history (read-only), campaigns received, automations, tags
/segments	Dynamic groups from rules (listings, purchases, money spent, days since last visit / sign-up, stage, consent, county, favourite category), all or any rule, live count
/campaigns, /campaigns/:id	Email, push or SMS; segment and exclusion; preview with personalisation; audience estimate with the reasons people are left out; test to yourself; send now or schedule
/automations	Welcome, first listing, order completed, listing expired, favourite added; pause / start; who entered, in progress, finished
/coupons	Free delivery, order credit, promotion discount; limits, expiry, segment; stop
/consent	Consent log (append-only evidence) and the suppression list
/templates	Reusable texts (email/push/SMS) with preview; a template used by an automation cannot be deleted
/analytics	Messages per channel and day, consents given/withdrawn, campaign delivery rates, coupon uses and discounts
/crm-settings	Sender, caps per person, quiet hours, legal footer (marketing role or admin)

Rules applied to every marketing message

1. Consent: only people who opted in to that channel (email / push / SMS).
2. Suppression list: listed addresses never get marketing email.
3. Phone needed for SMS; SMS text without diacritics plus "STOP la 1899".
4. Frequency caps per person: 3 emails a week, 1 push a day, 2 SMS a month (platform_settings.crm.caps).
5. Quiet hours 21:00–09:00 Romania time for push and SMS: "send now" during them schedules for the end.
6. Unsubscribe: every email has a link (and the List-Unsubscribe header) signed with APP_SECRET; using it withdraws email consent and records the evidence.
7. Personalisation: , , .

Segment rules become SQL with a fixed expression per field and bound values, so they cannot inject SQL.

Jobs

• Scheduled campaigns: every minute. Automations: every 5 minutes (each person enters an automation once).
• In development: mutations runScheduledCampaignsNow and runAutomationsNow (need DIAGNOSTICS_ENABLED=true).
• Automation triggers "checkout abandoned" and "saved search match" have no event source yet; the UI says so.

Coupons

Checked at checkout (couponCode on checkoutQuote / placeOrder) and when paying for a promotion: unknown, stopped, expired, used up, already used by this person, not in the coupon's segment, or not applicable to this kind of purchase. The use is recorded in the same transaction as the order; the last use of a limited code cannot be taken twice.

Tests: tests/e2e/crm.e2e.mjs (35 checks) and the CRM part of administration.e2e.mjs.