> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tagada.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Patient support inbox

> How affiliate storefronts advertise a brand mailbox, how mail is routed through Resend, and who answers.

# Patient support inbox

In affiliate mode Tagada answers patient email for every brand. The storefront advertises a brand address; Resend receives it; the TGD Care desk (or a partner desk) replies as the brand.

Identity (what the patient sees) and handling (who answers) are independent. Changing one never changes the other.

## Addresses

| Kind                   | Example                          | DNS                                                                                                                                                     |
| ---------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Platform subdomain     | `care@primerx.tgdcare.com`       | Tagada owns `tgdcare.com`. Publish provisions the Resend domain and pushes DKIM / SPF / MX to Vercel DNS.                                               |
| Merchant custom domain | `care@help.primelabpeptides.com` | Merchant adds the records Resend returns. If the apex already has MX, we refuse it and suggest a dedicated subdomain so we never take over their inbox. |

Until receiving is verified, storefronts fall back to `care@tgdcare.com` so patients never write into the void. Storefront subdomains resolve through a wildcard `ALIAS *` in the `tgdcare.com` zone; because a wildcard stops answering for any name that gets an explicit record, `ensureDnsRecords` first pins `<slug>` with an explicit `ALIAS` copying the wildcard target before adding the receiving MX (otherwise `<slug>.tgdcare.com` silently stops resolving). That apex mailbox belongs to the TGD Care root store and is provisioned once with `supportMailbox.provisionApexMailbox` (same mechanics as a slug subdomain: Resend domain on the apex, MX/DKIM/SPF pushed to Vercel DNS). It must stay verified, otherwise the fallback itself bounces.

Publishing an Rx storefront provisions the platform mailbox automatically. The merchant can later swap the identity to their own domain from the storefront wizard — Tagada still handles the inbox.

## Who answers

| `handledBy`          | Desk                            | Surface            |
| -------------------- | ------------------------------- | ------------------ |
| `platform` (default) | TGD Care                        | CRM `/rx`          |
| `partner`            | Partner reselling the Rx module | CRM `/rx/:partner` |

A superadmin can move a mailbox from the platform desk to a partner desk without touching the address.

The desk has its own CRM namespace (`/rx`, entry **TagadaRx** in the account menu) rather than a tab of the admin backoffice: it is a support surface worked by `rx_ops` / `rx_admin`, not an admin one. The old `/admin/rx` and `/partner-admin/:partner/rx` URLs redirect.

### Roles

| Role (Clerk `tgdRoles`)  | Scope (`whitelabelOwnership`) | Sees                                                                    |
| ------------------------ | ----------------------------- | ----------------------------------------------------------------------- |
| `superadmin` / `founder` | —                             | Platform desk `/rx` and every partner desk                              |
| `rx_admin`               | `null`                        | Same as superadmin for Rx, plus every store's Rx configuration          |
| `rx_ops`                 | `null`                        | Platform desk + any partner desk — conversations only, no configuration |
| `rx_admin`               | partner slug                  | `/rx/<slug>` and the Rx configuration of that partner's stores          |
| `rx_ops`                 | partner slug                  | `/rx/<slug>` — conversations only                                       |

`partneradmin` alone does not open the desk: a white-label partner (Vera, BNP,
Kashu…) gets its own Rx desk when Tagada grants `rx_admin` to the partner owner,
who can then hand `rx_admin` / `rx_ops` to their staff from the partner IAM tab.
Moving a mailbox between desks and provisioning platform mailboxes remain
platform-only.

## Inbound path

1. Patient writes to the brand address.
2. Resend POSTs `email.received` to `/api/public/webhooks/resend/inbound` (Svix-signed).
3. Inngest `rx/support.email.received` fetches the body + attachments and stores the thread.
4. Threading: `In-Reply-To` / `References` → `[TGD-XXXXXX]` in the subject → last open conversation of the same contact on that mailbox (7 days).
5. Auto-replies, bounces and list mail are dropped.

## Outbound path

Agents reply from the desk. Resend sends from the verified brand address (`PrimeRx Care <care@primerx.tgdcare.com>`). The subject carries `[TGD-XXXXXX]` so the next patient reply threads back. The agent never appears.

## Env

| Variable                               | Role                                                                       |
| -------------------------------------- | -------------------------------------------------------------------------- |
| `RESEND_API_KEY`                       | Send + Receiving API + domain create                                       |
| `RESEND_INBOUND_WEBHOOK_SECRET`        | Svix secret of the inbound webhook (falls back to `RESEND_WEBHOOK_SECRET`) |
| `AUTH_BEARER_TOKEN` / `TEAM_ID_VERCEL` | Push DNS records on `tgdcare.com`                                          |
| `TAGADA_RX_STOREFRONT_DOMAIN`          | Apex (default `tgdcare.com`)                                               |

Create a Resend webhook on `email.received` pointing at `https://api.tagada.io/api/public/webhooks/resend/inbound`. Enable **sending + receiving** on each brand domain. Plan quota: Scale is required once you have more than 10 verified domains (one per affiliate subdomain).