@develemit/commerce-server 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,2291 @@
+// src/admin/routes.ts
+import {
+  adminProductInputSchema as adminProductInputSchema2,
+  adminProductPatchSchema as adminProductPatchSchema2,
+  adminProductSchema,
+  imageOrderInputSchema,
+  shippingRatesInputSchema
+} from "@develemit/commerce-contracts";
+
+// src/catalog/types.ts
+var ProductNotFoundError = class extends Error {
+  constructor(slug) {
+    super(`Product not found: ${slug}`);
+    this.slug = slug;
+    this.name = "ProductNotFoundError";
+  }
+  slug;
+  code = "PRODUCT_NOT_FOUND";
+};
+
+// src/shipping/repo.ts
+import { and, asc, eq, notInArray } from "drizzle-orm";
+
+// src/db/schema.ts
+import { sql } from "drizzle-orm";
+import {
+  boolean,
+  check,
+  index,
+  integer,
+  jsonb,
+  pgEnum,
+  pgTable,
+  text,
+  unique,
+  timestamp,
+  uuid
+} from "drizzle-orm/pg-core";
+var productStatus = pgEnum("commerce_product_status", [
+  "draft",
+  "active",
+  "archived"
+]);
+var products = pgTable(
+  "commerce_products",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    slug: text("slug").notNull().unique(),
+    name: text("name").notNull(),
+    description: text("description").notNull().default(""),
+    materials: text("materials"),
+    dimensions: text("dimensions"),
+    priceCents: integer("price_cents").notNull(),
+    currency: text("currency").notNull(),
+    category: text("category").notNull(),
+    quantity: integer("quantity").notNull().default(1),
+    status: productStatus("status").notNull().default("draft"),
+    featured: boolean("featured").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (t) => [check("commerce_products_quantity_check", sql`${t.quantity} >= 0`)]
+);
+var productImages = pgTable("commerce_product_images", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  productId: uuid("product_id").notNull().references(() => products.id, { onDelete: "cascade" }),
+  url: text("url").notNull(),
+  alt: text("alt").notNull().default(""),
+  storageKey: text("storage_key"),
+  position: integer("position").notNull().default(0)
+});
+var holdStatus = pgEnum("commerce_hold_status", [
+  "active",
+  "released",
+  "committed"
+]);
+var inventoryHolds = pgTable(
+  "commerce_inventory_holds",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    productId: uuid("product_id").notNull().references(() => products.id, { onDelete: "cascade" }),
+    quantity: integer("quantity").notNull(),
+    reference: text("reference").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    status: holdStatus("status").notNull().default("active"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (t) => [
+    check("commerce_inventory_holds_quantity_check", sql`${t.quantity} > 0`),
+    index("commerce_inventory_holds_reference_idx").on(t.reference),
+    index("commerce_inventory_holds_product_status_idx").on(
+      t.productId,
+      t.status
+    )
+  ]
+);
+var orderStatus = pgEnum("commerce_order_status", [
+  "pending",
+  "paid",
+  "shipped",
+  "cancelled",
+  "expired",
+  "needs_attention",
+  "refunded"
+]);
+var orders = pgTable("commerce_orders", {
+  id: uuid("id").primaryKey(),
+  status: orderStatus("status").notNull().default("pending"),
+  email: text("email"),
+  subtotalCents: integer("subtotal_cents").notNull(),
+  shippingCents: integer("shipping_cents").notNull().default(0),
+  shippingLabel: text("shipping_label"),
+  currency: text("currency").notNull(),
+  checkoutSessionId: text("checkout_session_id").unique(),
+  shippingAddress: jsonb("shipping_address"),
+  fulfillmentCarrier: text("fulfillment_carrier"),
+  fulfillmentTrackingNumber: text("fulfillment_tracking_number"),
+  fulfillmentTrackingUrl: text("fulfillment_tracking_url"),
+  shippedAt: timestamp("shipped_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var orderItems = pgTable("commerce_order_items", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  orderId: uuid("order_id").notNull().references(() => orders.id, { onDelete: "cascade" }),
+  productId: uuid("product_id").notNull(),
+  name: text("name").notNull(),
+  priceCents: integer("price_cents").notNull(),
+  quantity: integer("quantity").notNull()
+});
+var orderRefunds = pgTable(
+  "commerce_order_refunds",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    orderId: uuid("order_id").notNull().references(() => orders.id, { onDelete: "cascade" }),
+    amountCents: integer("amount_cents").notNull(),
+    currency: text("currency").notNull(),
+    reason: text("reason"),
+    restocked: boolean("restocked").notNull().default(false),
+    source: text("source", { enum: ["admin", "gateway"] }).notNull(),
+    gatewayRefundId: text("gateway_refund_id").unique(),
+    idempotencyKey: text("idempotency_key"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (t) => [
+    check("commerce_order_refunds_amount_check", sql`${t.amountCents} > 0`),
+    index("commerce_order_refunds_order_idx").on(t.orderId),
+    unique("commerce_order_refunds_idempotency_unique").on(
+      t.orderId,
+      t.idempotencyKey
+    )
+  ]
+);
+var stripeEvents = pgTable("commerce_stripe_events", {
+  id: text("id").primaryKey(),
+  type: text("type").notNull(),
+  processedAt: timestamp("processed_at", { withTimezone: true }).notNull().defaultNow()
+});
+var shippingRates = pgTable(
+  "commerce_shipping_rates",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    label: text("label").notNull().unique(),
+    amountCents: integer("amount_cents").notNull(),
+    currency: text("currency").notNull(),
+    minDays: integer("min_days"),
+    maxDays: integer("max_days"),
+    active: boolean("active").notNull().default(true),
+    sort: integer("sort").notNull().default(0)
+  },
+  (t) => [
+    check("commerce_shipping_rates_amount_check", sql`${t.amountCents} >= 0`)
+  ]
+);
+var commerceSchema = {
+  products,
+  productImages,
+  productStatus,
+  inventoryHolds,
+  holdStatus,
+  orders,
+  orderItems,
+  orderStatus,
+  orderRefunds,
+  stripeEvents,
+  shippingRates
+};
+
+// src/shipping/repo.ts
+async function listActiveRates(db, currency) {
+  const rows = await db.select().from(shippingRates).where(
+    and(eq(shippingRates.active, true), eq(shippingRates.currency, currency))
+  ).orderBy(asc(shippingRates.sort), asc(shippingRates.amountCents));
+  return rows.map((r) => ({
+    label: r.label,
+    amountCents: r.amountCents,
+    ...r.minDays !== null && { minDays: r.minDays },
+    ...r.maxDays !== null && { maxDays: r.maxDays }
+  }));
+}
+async function listAllRates(db) {
+  return db.select().from(shippingRates).orderBy(asc(shippingRates.sort), asc(shippingRates.label));
+}
+async function replaceRates(tx, rates) {
+  const labels = rates.map((r) => r.label);
+  await tx.delete(shippingRates).where(
+    labels.length > 0 ? notInArray(shippingRates.label, labels) : void 0
+  );
+  for (const rate of rates) {
+    await tx.insert(shippingRates).values(rate).onConflictDoUpdate({
+      target: shippingRates.label,
+      set: {
+        amountCents: rate.amountCents,
+        currency: rate.currency,
+        minDays: rate.minDays ?? null,
+        maxDays: rate.maxDays ?? null,
+        active: rate.active ?? true,
+        sort: rate.sort ?? 0
+      }
+    });
+  }
+}
+
+// src/shipping/service.ts
+async function listShippingRates(db) {
+  return (await listAllRates(db)).map((r) => ({
+    label: r.label,
+    amountCents: r.amountCents,
+    currency: r.currency,
+    minDays: r.minDays,
+    maxDays: r.maxDays,
+    active: r.active,
+    sort: r.sort
+  }));
+}
+async function setShippingRates(db, rates) {
+  await db.transaction((tx) => replaceRates(tx, rates));
+  return listShippingRates(db);
+}
+
+// src/admin/images.ts
+import { Readable } from "stream";
+
+// src/admin/repo.ts
+import { asc as asc2, eq as eq2, inArray, sql as sql2 } from "drizzle-orm";
+async function withImages(db, rows) {
+  if (rows.length === 0) return [];
+  const images = await db.select().from(productImages).where(
+    inArray(
+      productImages.productId,
+      rows.map((r) => r.id)
+    )
+  ).orderBy(asc2(productImages.position), asc2(productImages.id));
+  return rows.map((row) => ({
+    row,
+    images: images.filter((i) => i.productId === row.id)
+  }));
+}
+async function listAllProducts(db) {
+  const rows = await db.select().from(products).orderBy(asc2(products.createdAt), asc2(products.slug));
+  return withImages(db, rows);
+}
+async function findProductById(db, id) {
+  const rows = await db.select().from(products).where(eq2(products.id, id));
+  return (await withImages(db, rows))[0];
+}
+async function slugsStartingWith(db, base) {
+  const rows = await db.select({ slug: products.slug }).from(products).where(sql2`${products.slug} like ${`${base}%`}`);
+  return new Set(rows.map((r) => r.slug));
+}
+async function insertProduct(db, values) {
+  const [row] = await db.insert(products).values(values).returning({ id: products.id });
+  return row.id;
+}
+async function updateProduct(db, id, set) {
+  await db.update(products).set({ ...set, updatedAt: sql2`now()` }).where(eq2(products.id, id));
+}
+async function nextImagePosition(db, productId) {
+  const [row] = await db.select({
+    next: sql2`coalesce(max(${productImages.position}) + 1, 0)::int`
+  }).from(productImages).where(eq2(productImages.productId, productId));
+  return row.next;
+}
+async function insertImage(db, values) {
+  const [row] = await db.insert(productImages).values(values).returning();
+  return row;
+}
+async function deleteImageRow(db, id) {
+  await db.delete(productImages).where(eq2(productImages.id, id));
+}
+async function setImagePosition(db, id, position) {
+  await db.update(productImages).set({ position }).where(eq2(productImages.id, id));
+}
+
+// src/admin/service.ts
+import {
+  adminProductInputSchema,
+  adminProductPatchSchema
+} from "@develemit/commerce-contracts";
+
+// src/admin/slug.ts
+function slugify(name) {
+  const slug = name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "product";
+}
+function uniqueSlug(base, taken) {
+  if (!taken.has(base)) return base;
+  let n = 2;
+  while (taken.has(`${base}-${n}`)) n += 1;
+  return `${base}-${n}`;
+}
+
+// src/admin/service.ts
+function toAdminProduct({ row, images }) {
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    description: row.description,
+    materials: row.materials,
+    dimensions: row.dimensions,
+    priceCents: row.priceCents,
+    currency: row.currency,
+    category: row.category,
+    quantity: row.quantity,
+    status: row.status,
+    featured: row.featured,
+    images: images.map((i) => ({
+      id: i.id,
+      url: i.url,
+      alt: i.alt,
+      position: i.position
+    }))
+  };
+}
+async function requireProduct(db, id) {
+  const found = await findProductById(db, id);
+  if (!found) throw new ProductNotFoundError(id);
+  return found;
+}
+async function listAdminProducts(db) {
+  return (await listAllProducts(db)).map(toAdminProduct);
+}
+async function getAdminProduct(db, id) {
+  return toAdminProduct(await requireProduct(db, id));
+}
+async function createAdminProduct(db, currency, input) {
+  const data = adminProductInputSchema.parse(input);
+  const base = slugify(data.name);
+  const id = await db.transaction(async (tx) => {
+    const slug = uniqueSlug(base, await slugsStartingWith(tx, base));
+    return insertProduct(tx, {
+      ...data,
+      slug,
+      currency: data.currency ?? currency
+    });
+  });
+  return getAdminProduct(db, id);
+}
+async function patchAdminProduct(db, id, input) {
+  const { sold, ...fields } = adminProductPatchSchema.parse(input);
+  await requireProduct(db, id);
+  const set = sold ? { ...fields, quantity: 0 } : fields;
+  if (Object.keys(set).length > 0) await updateProduct(db, id, set);
+  return getAdminProduct(db, id);
+}
+
+// src/admin/types.ts
+var ProductImageNotFoundError = class extends Error {
+  constructor(imageId) {
+    super(`Image not found: ${imageId}`);
+    this.imageId = imageId;
+    this.name = "ProductImageNotFoundError";
+  }
+  imageId;
+  code = "IMAGE_NOT_FOUND";
+};
+var InvalidImageOrderError = class extends Error {
+  code = "INVALID_IMAGE_ORDER";
+  constructor() {
+    super("imageIds must list every image of the product exactly once");
+    this.name = "InvalidImageOrderError";
+  }
+};
+
+// src/admin/upload.ts
+import { randomUUID } from "crypto";
+import { fileTypeFromBuffer } from "file-type";
+var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+var EXTENSIONS = {
+  "image/jpeg": "jpg",
+  "image/png": "png",
+  "image/webp": "webp",
+  "image/heic": "heic"
+};
+var InvalidImageError = class extends Error {
+  code = "INVALID_IMAGE";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidImageError";
+  }
+};
+async function detectImage(bytes) {
+  const type = await fileTypeFromBuffer(bytes);
+  const ext = type && EXTENSIONS[type.mime];
+  if (!type || !ext) {
+    throw new InvalidImageError("File must be a jpeg, png, webp or heic image");
+  }
+  return { mime: type.mime, ext };
+}
+function imageKey(productId, ext) {
+  return `products/${productId}/${randomUUID()}.${ext}`;
+}
+
+// src/admin/images.ts
+async function addProductImage(db, storage, productId, file) {
+  await requireProduct(db, productId);
+  const { mime, ext } = await detectImage(file.bytes);
+  const stored = await storage.put(
+    imageKey(productId, ext),
+    Readable.from(file.bytes),
+    mime
+  );
+  try {
+    await insertImage(db, {
+      productId,
+      url: stored.url,
+      alt: file.alt ?? "",
+      storageKey: stored.key,
+      position: await nextImagePosition(db, productId)
+    });
+  } catch (err) {
+    await storage.delete(stored.key);
+    throw err;
+  }
+  return getAdminProduct(db, productId);
+}
+async function reorderProductImages(db, productId, imageIds) {
+  const { images } = await requireProduct(db, productId);
+  const existing = new Set(images.map((i) => i.id));
+  if (imageIds.length !== existing.size || new Set(imageIds).size !== imageIds.length || !imageIds.every((id) => existing.has(id))) {
+    throw new InvalidImageOrderError();
+  }
+  await db.transaction(async (tx) => {
+    for (const [position, id] of imageIds.entries()) {
+      await setImagePosition(tx, id, position);
+    }
+  });
+  return getAdminProduct(db, productId);
+}
+async function removeProductImage(db, storage, productId, imageId) {
+  const { images } = await requireProduct(db, productId);
+  const image = images.find((i) => i.id === imageId);
+  if (!image) throw new ProductImageNotFoundError(imageId);
+  await deleteImageRow(db, imageId);
+  if (image.storageKey) await storage.delete(image.storageKey);
+  return getAdminProduct(db, productId);
+}
+
+// src/admin/routes.ts
+function isZodError(err) {
+  return err instanceof Error && err.name === "ZodError";
+}
+var adminPlugin = async (app, { db, currency, authorize, storage }) => {
+  const { default: multipart } = await import("@fastify/multipart");
+  await app.register(multipart, {
+    limits: { fileSize: MAX_IMAGE_BYTES, files: 1 }
+  });
+  app.setErrorHandler((err, _req, reply) => {
+    if (isZodError(err)) {
+      return reply.code(400).send({ error: "INVALID_INPUT", issues: err.issues });
+    }
+    if (err instanceof ProductNotFoundError || err instanceof ProductImageNotFoundError) {
+      return reply.code(404).send({ error: err.code, message: err.message });
+    }
+    if (err instanceof InvalidImageError || err instanceof InvalidImageOrderError) {
+      return reply.code(400).send({ error: err.code, message: err.message });
+    }
+    if (err.code === "FST_REQ_FILE_TOO_LARGE") {
+      return reply.code(413).send({ error: "IMAGE_TOO_LARGE" });
+    }
+    return reply.send(err);
+  });
+  app.addHook("preHandler", async (req, reply) => {
+    if (!await authorize(req)) {
+      return reply.code(401).send({ error: "UNAUTHORIZED" });
+    }
+  });
+  app.get(
+    "/products",
+    async () => (await listAdminProducts(db)).map((p) => adminProductSchema.parse(p))
+  );
+  app.post("/products", async (req, reply) => {
+    const input = adminProductInputSchema2.parse(req.body);
+    const created = await createAdminProduct(db, currency, input);
+    return reply.code(201).send(created);
+  });
+  app.get(
+    "/products/:id",
+    async (req) => getAdminProduct(db, req.params.id)
+  );
+  app.patch(
+    "/products/:id",
+    async (req) => patchAdminProduct(
+      db,
+      req.params.id,
+      adminProductPatchSchema2.parse(req.body)
+    )
+  );
+  app.post(
+    "/products/:id/images",
+    async (req, reply) => {
+      const part = await req.file();
+      if (!part) throw new InvalidImageError("An image file is required");
+      const bytes = await part.toBuffer();
+      const fields = part.fields;
+      const alt = typeof fields.alt?.value === "string" ? fields.alt.value : void 0;
+      const product = await addProductImage(db, storage, req.params.id, {
+        bytes,
+        alt
+      });
+      return reply.code(201).send(product);
+    }
+  );
+  app.patch(
+    "/products/:id/images/order",
+    async (req) => reorderProductImages(
+      db,
+      req.params.id,
+      imageOrderInputSchema.parse(req.body).imageIds
+    )
+  );
+  app.delete(
+    "/products/:id/images/:imageId",
+    async (req) => removeProductImage(db, storage, req.params.id, req.params.imageId)
+  );
+  app.get("/shipping-rates", async () => listShippingRates(db));
+  app.put(
+    "/shipping-rates",
+    async (req) => setShippingRates(db, shippingRatesInputSchema.parse(req.body))
+  );
+};
+
+// src/catalog/routes.ts
+import {
+  categorySchema,
+  productListQuerySchema,
+  productSchema
+} from "@develemit/commerce-contracts";
+
+// src/inventory/repo.ts
+import { and as and2, asc as asc3, eq as eq3, gt, inArray as inArray2, lt, sql as sql3 } from "drizzle-orm";
+async function lockProductQuantities(tx, productIds) {
+  const rows = await tx.select({ id: products.id, quantity: products.quantity }).from(products).where(inArray2(products.id, productIds)).orderBy(asc3(products.id)).for("update");
+  return new Map(rows.map((r) => [r.id, r.quantity]));
+}
+async function activeHeldQuantities(db, productIds) {
+  if (productIds.length === 0) return /* @__PURE__ */ new Map();
+  const rows = await db.select({
+    productId: inventoryHolds.productId,
+    held: sql3`sum(${inventoryHolds.quantity})::int`
+  }).from(inventoryHolds).where(
+    and2(
+      inArray2(inventoryHolds.productId, productIds),
+      eq3(inventoryHolds.status, "active"),
+      gt(inventoryHolds.expiresAt, sql3`now()`)
+    )
+  ).groupBy(inventoryHolds.productId);
+  return new Map(rows.map((r) => [r.productId, r.held]));
+}
+async function productQuantities(db, productIds) {
+  if (productIds.length === 0) return /* @__PURE__ */ new Map();
+  const rows = await db.select({ id: products.id, quantity: products.quantity }).from(products).where(inArray2(products.id, productIds));
+  return new Map(rows.map((r) => [r.id, r.quantity]));
+}
+async function insertHolds(tx, reference, items, expiresAt) {
+  await tx.insert(inventoryHolds).values(
+    items.map((item) => ({
+      productId: item.productId,
+      quantity: item.quantity,
+      reference,
+      expiresAt
+    }))
+  );
+}
+async function releaseHolds(db, reference) {
+  await db.update(inventoryHolds).set({ status: "released" }).where(
+    and2(
+      eq3(inventoryHolds.reference, reference),
+      eq3(inventoryHolds.status, "active")
+    )
+  );
+}
+async function uncommittedHolds(tx, reference) {
+  return tx.select({
+    productId: inventoryHolds.productId,
+    quantity: inventoryHolds.quantity,
+    lapsed: sql3`(${inventoryHolds.status} = 'released' or ${inventoryHolds.expiresAt} <= now())`
+  }).from(inventoryHolds).where(
+    and2(
+      eq3(inventoryHolds.reference, reference),
+      inArray2(inventoryHolds.status, ["active", "released"])
+    )
+  );
+}
+async function markHoldsCommitted(tx, reference) {
+  await tx.update(inventoryHolds).set({ status: "committed" }).where(
+    and2(
+      eq3(inventoryHolds.reference, reference),
+      inArray2(inventoryHolds.status, ["active", "released"])
+    )
+  );
+}
+async function extendActiveHolds(db, reference, expiresAt) {
+  await db.update(inventoryHolds).set({ expiresAt }).where(
+    and2(
+      eq3(inventoryHolds.reference, reference),
+      eq3(inventoryHolds.status, "active"),
+      gt(inventoryHolds.expiresAt, sql3`now()`)
+    )
+  );
+}
+async function decrementQuantity(tx, productId, quantity) {
+  await tx.update(products).set({
+    quantity: sql3`greatest(${products.quantity} - ${quantity}, 0)`,
+    updatedAt: sql3`now()`
+  }).where(eq3(products.id, productId));
+}
+async function incrementQuantity(tx, productId, quantity) {
+  await tx.update(products).set({
+    quantity: sql3`${products.quantity} + ${quantity}`,
+    updatedAt: sql3`now()`
+  }).where(eq3(products.id, productId));
+}
+async function releaseExpiredHolds(db) {
+  const released = await db.update(inventoryHolds).set({ status: "released" }).where(
+    and2(
+      eq3(inventoryHolds.status, "active"),
+      lt(inventoryHolds.expiresAt, sql3`now()`)
+    )
+  ).returning({ id: inventoryHolds.id });
+  return released.length;
+}
+
+// src/inventory/types.ts
+var InsufficientStockError = class extends Error {
+  constructor(productIds) {
+    super(`Not enough stock for: ${productIds.join(", ")}`);
+    this.productIds = productIds;
+    this.name = "InsufficientStockError";
+  }
+  productIds;
+  code = "INSUFFICIENT_STOCK";
+};
+
+// src/inventory/service.ts
+function mergeRequests(items) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    merged.set(
+      item.productId,
+      (merged.get(item.productId) ?? 0) + item.quantity
+    );
+  }
+  return [...merged].map(([productId, quantity]) => ({ productId, quantity }));
+}
+function freeOf(quantity, held) {
+  return Math.max(quantity - held, 0);
+}
+async function freeQuantity(db, productIds) {
+  const [quantities, held] = await Promise.all([
+    productQuantities(db, productIds),
+    activeHeldQuantities(db, productIds)
+  ]);
+  return new Map(
+    [...quantities].map(([id, qty]) => [id, freeOf(qty, held.get(id) ?? 0)])
+  );
+}
+async function reserve(db, { reference, items, expiresAt }) {
+  const requests = mergeRequests(items);
+  const ids = requests.map((r) => r.productId);
+  await db.transaction(async (tx) => {
+    const quantities = await lockProductQuantities(tx, ids);
+    const held = await activeHeldQuantities(tx, ids);
+    const short = requests.filter((r) => {
+      const qty = quantities.get(r.productId);
+      if (qty === void 0) return true;
+      return freeOf(qty, held.get(r.productId) ?? 0) < r.quantity;
+    }).map((r) => r.productId);
+    if (short.length > 0) throw new InsufficientStockError(short);
+    await insertHolds(tx, reference, requests, expiresAt);
+  });
+}
+async function release(db, reference) {
+  await releaseHolds(db, reference);
+}
+async function releaseExpired(db) {
+  return releaseExpiredHolds(db);
+}
+async function commitWithin(tx, reference) {
+  const holds = await uncommittedHolds(tx, reference);
+  if (holds.length === 0) return { result: "committed" };
+  const quantities = await lockProductQuantities(
+    tx,
+    holds.map((h) => h.productId)
+  );
+  const lapsed = holds.filter((h) => h.lapsed);
+  const held = await activeHeldQuantities(
+    tx,
+    lapsed.map((h) => h.productId)
+  );
+  const shortProductIds = lapsed.filter(
+    (h) => freeOf(quantities.get(h.productId) ?? 0, held.get(h.productId) ?? 0) < h.quantity
+  ).map((h) => h.productId);
+  if (shortProductIds.length > 0) {
+    await releaseHolds(tx, reference);
+    return { result: "unavailable", shortProductIds };
+  }
+  for (const hold of holds) {
+    await decrementQuantity(tx, hold.productId, hold.quantity);
+  }
+  await markHoldsCommitted(tx, reference);
+  return { result: "committed" };
+}
+async function commit(db, reference) {
+  return (await db.transaction((tx) => commitWithin(tx, reference))).result;
+}
+async function extendHolds(db, reference, expiresAt) {
+  await extendActiveHolds(db, reference, expiresAt);
+}
+async function restock(tx, items) {
+  const requests = mergeRequests(items);
+  if (requests.length === 0) return;
+  await lockProductQuantities(
+    tx,
+    requests.map((r) => r.productId)
+  );
+  for (const r of requests) {
+    await incrementQuantity(tx, r.productId, r.quantity);
+  }
+}
+
+// src/catalog/repo.ts
+import { and as and3, asc as asc4, eq as eq4, inArray as inArray3, sql as sql4 } from "drizzle-orm";
+async function attachImages(db, rows) {
+  if (rows.length === 0) return [];
+  const images = await db.select().from(productImages).where(
+    inArray3(
+      productImages.productId,
+      rows.map((r) => r.id)
+    )
+  ).orderBy(asc4(productImages.position));
+  return rows.map((row) => ({
+    row,
+    images: images.filter((i) => i.productId === row.id)
+  }));
+}
+async function listActiveProducts(db, filter) {
+  const conditions2 = [eq4(products.status, "active")];
+  if (filter.category) conditions2.push(eq4(products.category, filter.category));
+  if (filter.featured !== void 0)
+    conditions2.push(eq4(products.featured, filter.featured));
+  const rows = await db.select().from(products).where(and3(...conditions2)).orderBy(asc4(products.createdAt), asc4(products.slug));
+  return attachImages(db, rows);
+}
+async function findActiveProductBySlug(db, slug) {
+  const rows = await db.select().from(products).where(and3(eq4(products.slug, slug), eq4(products.status, "active"))).limit(1);
+  return (await attachImages(db, rows))[0];
+}
+async function countActiveByCategory(db) {
+  const rows = await db.select({
+    category: products.category,
+    count: sql4`count(*)::int`
+  }).from(products).where(eq4(products.status, "active")).groupBy(products.category).orderBy(asc4(products.category));
+  return rows;
+}
+async function findActiveProductsByIds(db, ids) {
+  if (ids.length === 0) return [];
+  return db.select().from(products).where(and3(inArray3(products.id, ids), eq4(products.status, "active")));
+}
+
+// src/catalog/service.ts
+function availabilityOf(quantity, free) {
+  if (free > 0) return "available";
+  return quantity > 0 ? "reserved" : "sold";
+}
+function toProduct({ row, images }, free) {
+  const freeQty = free.get(row.id) ?? row.quantity;
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    description: row.description,
+    ...row.materials ? { materials: row.materials } : {},
+    ...row.dimensions ? { dimensions: row.dimensions } : {},
+    priceCents: row.priceCents,
+    currency: row.currency,
+    category: row.category,
+    images: images.map((i) => ({ url: i.url, alt: i.alt })),
+    quantity: freeQty,
+    availability: availabilityOf(row.quantity, freeQty),
+    featured: row.featured
+  };
+}
+function labelFor(slug, labels) {
+  const label = typeof labels === "function" ? labels(slug) : labels?.[slug];
+  return label ?? slug;
+}
+async function listProducts(db, filter) {
+  const found = await listActiveProducts(db, filter);
+  const free = await freeQuantity(
+    db,
+    found.map((p) => p.row.id)
+  );
+  return found.map((p) => toProduct(p, free));
+}
+async function getProduct(db, slug) {
+  const found = await findActiveProductBySlug(db, slug);
+  if (!found) throw new ProductNotFoundError(slug);
+  return toProduct(found, await freeQuantity(db, [found.row.id]));
+}
+async function listCategories(db, labels) {
+  return (await countActiveByCategory(db)).map((c) => ({
+    slug: c.category,
+    label: labelFor(c.category, labels),
+    count: c.count
+  }));
+}
+async function findPurchasable(db, ids) {
+  const rows = await findActiveProductsByIds(db, ids);
+  return rows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    priceCents: row.priceCents,
+    currency: row.currency
+  }));
+}
+
+// src/catalog/routes.ts
+var catalogPlugin = async (app, { db, categoryLabels }) => {
+  app.setErrorHandler((err, _req, reply) => {
+    if (err instanceof ProductNotFoundError) {
+      return reply.code(404).send({ error: err.code, message: err.message });
+    }
+    return reply.send(err);
+  });
+  app.get("/products", async (req, reply) => {
+    const raw = req.query;
+    const parsed = productListQuerySchema.safeParse({
+      category: raw.category || void 0,
+      featured: raw.featured === void 0 ? void 0 : raw.featured === "true"
+    });
+    if (!parsed.success) {
+      return reply.code(400).send({ error: "INVALID_QUERY" });
+    }
+    const products2 = await listProducts(db, parsed.data);
+    return products2.map((p) => productSchema.parse(p));
+  });
+  app.get("/products/:slug", async (req) => {
+    return productSchema.parse(await getProduct(db, req.params.slug));
+  });
+  app.get("/categories", async () => {
+    const categories = await listCategories(db, categoryLabels);
+    return categories.map((c) => categorySchema.parse(c));
+  });
+};
+
+// src/orders/admin-routes.ts
+import {
+  adminOrderListQuerySchema,
+  adminOrderPageSchema,
+  refundOrderInputSchema,
+  shipOrderInputSchema
+} from "@develemit/commerce-contracts";
+
+// src/orders/admin-repo.ts
+import { and as and4, desc, eq as eq5, ilike, lt as lt2, or, sql as sql5 } from "drizzle-orm";
+function escapeLike(value) {
+  return value.replace(/[\\%_]/g, (c) => `\\${c}`);
+}
+function conditions(filter) {
+  const parts = [];
+  if (filter.status) parts.push(eq5(orders.status, filter.status));
+  if (filter.hasPendingRefund !== void 0) {
+    const pending = sql5`exists (
+      select 1 from commerce_order_refunds r
+      where r.order_id = commerce_orders.id and r.idempotency_key is not null
+        and r.gateway_refund_id is null
+    )`;
+    parts.push(filter.hasPendingRefund ? pending : sql5`not ${pending}`);
+  }
+  if (filter.q) {
+    const prefix = `${escapeLike(filter.q)}%`;
+    parts.push(
+      or(ilike(orders.email, prefix), sql5`${orders.id}::text ilike ${prefix}`)
+    );
+  }
+  if (filter.after) {
+    const { createdAt, id } = filter.after;
+    parts.push(
+      or(
+        lt2(orders.createdAt, createdAt),
+        and4(eq5(orders.createdAt, createdAt), lt2(orders.id, id))
+      )
+    );
+  }
+  return and4(...parts);
+}
+async function selectOrderPage(db, filter) {
+  const itemCount = sql5`coalesce((
+    select sum(i.quantity) from commerce_order_items i
+    where i.order_id = commerce_orders.id
+  ), 0)::int`;
+  return db.select({
+    id: orders.id,
+    status: orders.status,
+    email: orders.email,
+    totalCents: sql5`${orders.subtotalCents} + ${orders.shippingCents}`,
+    currency: orders.currency,
+    itemCount,
+    createdAt: orders.createdAt
+  }).from(orders).where(conditions(filter)).orderBy(desc(orders.createdAt), desc(orders.id)).limit(filter.limit);
+}
+async function findOrderRefunds(db, orderId) {
+  return db.select().from(orderRefunds).where(eq5(orderRefunds.orderId, orderId)).orderBy(orderRefunds.createdAt, orderRefunds.id);
+}
+
+// src/orders/repo.ts
+import { and as and6, asc as asc5, eq as eq7, sql as sql7 } from "drizzle-orm";
+
+// src/orders/refund-repo.ts
+import { and as and5, eq as eq6, isNotNull, isNull, or as or2, sql as sql6 } from "drizzle-orm";
+var isRecordedRefund = or2(
+  isNull(orderRefunds.idempotencyKey),
+  isNotNull(orderRefunds.gatewayRefundId)
+);
+async function lockOrderForRefund(tx, id) {
+  const [row] = await tx.select({
+    status: orders.status,
+    totalCents: sql6`${orders.subtotalCents} + ${orders.shippingCents}`,
+    currency: orders.currency,
+    checkoutSessionId: orders.checkoutSessionId
+  }).from(orders).where(eq6(orders.id, id)).for("update");
+  return row;
+}
+async function sumReservedCents(tx, orderId) {
+  const [row] = await tx.select({
+    total: sql6`coalesce(sum(${orderRefunds.amountCents}), 0)::int`
+  }).from(orderRefunds).where(eq6(orderRefunds.orderId, orderId));
+  return row.total;
+}
+async function findRefundByKey(tx, orderId, idempotencyKey2) {
+  const [row] = await tx.select().from(orderRefunds).where(
+    and5(
+      eq6(orderRefunds.orderId, orderId),
+      eq6(orderRefunds.idempotencyKey, idempotencyKey2)
+    )
+  );
+  return row;
+}
+async function insertPendingRefund(tx, refund) {
+  const [row] = await tx.insert(orderRefunds).values(refund).returning();
+  return row;
+}
+async function deletePendingRefund(db, id) {
+  await db.delete(orderRefunds).where(and5(eq6(orderRefunds.id, id), isNull(orderRefunds.gatewayRefundId)));
+}
+async function confirmRefund(tx, pending, gatewayRefundId) {
+  const [existing] = await tx.select({ id: orderRefunds.id }).from(orderRefunds).where(eq6(orderRefunds.gatewayRefundId, gatewayRefundId));
+  if (existing) {
+    await deletePendingRefund(tx, pending.id);
+    return void 0;
+  }
+  const [updated] = await tx.update(orderRefunds).set({ gatewayRefundId }).where(
+    and5(
+      eq6(orderRefunds.id, pending.id),
+      isNull(orderRefunds.gatewayRefundId)
+    )
+  ).returning();
+  if (updated) return updated;
+  const [inserted] = await tx.insert(orderRefunds).values({
+    orderId: pending.orderId,
+    amountCents: pending.amountCents,
+    currency: pending.currency,
+    reason: pending.reason,
+    restocked: pending.restocked,
+    source: pending.source,
+    idempotencyKey: pending.idempotencyKey,
+    gatewayRefundId
+  }).onConflictDoNothing().returning();
+  return inserted;
+}
+async function findRefundByGatewayId(tx, gatewayRefundId) {
+  const [row] = await tx.select().from(orderRefunds).where(eq6(orderRefunds.gatewayRefundId, gatewayRefundId));
+  return row;
+}
+async function confirmPendingByKey(tx, orderId, scopedKey, gatewayRefundId) {
+  const prefix = `${orderId}:`;
+  if (!scopedKey.startsWith(prefix)) return void 0;
+  const [updated] = await tx.update(orderRefunds).set({ gatewayRefundId }).where(
+    and5(
+      eq6(orderRefunds.orderId, orderId),
+      eq6(orderRefunds.idempotencyKey, scopedKey.slice(prefix.length)),
+      isNull(orderRefunds.gatewayRefundId)
+    )
+  ).returning();
+  return updated;
+}
+async function insertGatewayRefund(tx, refund) {
+  const [row] = await tx.insert(orderRefunds).values({ ...refund, source: "gateway", restocked: false }).onConflictDoNothing().returning();
+  return row;
+}
+
+// src/orders/repo.ts
+async function insertOrder(db, order, items) {
+  await db.insert(orders).values(order);
+  await db.insert(orderItems).values(items.map((item) => ({ ...item, orderId: order.id })));
+}
+async function setCheckoutSession(db, orderId, sessionId) {
+  await db.update(orders).set({ checkoutSessionId: sessionId, updatedAt: sql7`now()` }).where(eq7(orders.id, orderId));
+}
+async function setOrderStatus(db, orderId, status) {
+  await db.update(orders).set({ status, updatedAt: sql7`now()` }).where(eq7(orders.id, orderId));
+}
+async function saveOrderDetails(db, orderId, details, status) {
+  await db.update(orders).set({
+    ...status && { status },
+    email: details.email ?? null,
+    shippingAddress: details.shippingAddress ?? null,
+    shippingCents: details.shipping?.amountCents ?? 0,
+    shippingLabel: details.shipping?.label ?? null,
+    updatedAt: sql7`now()`
+  }).where(eq7(orders.id, orderId));
+}
+async function findOrderBySession(db, sessionId) {
+  const [row] = await db.select().from(orders).where(eq7(orders.checkoutSessionId, sessionId)).limit(1);
+  return row;
+}
+async function findOrderById(db, orderId) {
+  const [row] = await db.select().from(orders).where(eq7(orders.id, orderId)).limit(1);
+  return row;
+}
+async function findOrderItems(db, orderId) {
+  return db.select().from(orderItems).where(eq7(orderItems.orderId, orderId)).orderBy(asc5(orderItems.name));
+}
+async function recordEvent(db, id, type) {
+  const inserted = await db.insert(stripeEvents).values({ id, type }).onConflictDoNothing().returning({ id: stripeEvents.id });
+  return inserted.length > 0;
+}
+async function sumRefundedCents(db, orderId) {
+  const [row] = await db.select({
+    total: sql7`coalesce(sum(${orderRefunds.amountCents}), 0)::int`
+  }).from(orderRefunds).where(and6(eq7(orderRefunds.orderId, orderId), isRecordedRefund));
+  return row.total;
+}
+
+// src/orders/order-detail.ts
+function toFulfillment(order) {
+  if (!order.shippedAt) return null;
+  return {
+    carrier: order.fulfillmentCarrier,
+    trackingNumber: order.fulfillmentTrackingNumber,
+    trackingUrl: order.fulfillmentTrackingUrl,
+    shippedAt: order.shippedAt.toISOString()
+  };
+}
+async function toSummary(db, order) {
+  const items = await findOrderItems(db, order.id);
+  return {
+    id: order.id,
+    status: order.status,
+    subtotalCents: order.subtotalCents,
+    shippingCents: order.shippingCents,
+    shippingLabel: order.shippingLabel,
+    totalCents: order.subtotalCents + order.shippingCents,
+    currency: order.currency,
+    items: items.map((i) => ({
+      productId: i.productId,
+      name: i.name,
+      priceCents: i.priceCents,
+      quantity: i.quantity
+    })),
+    fulfillment: toFulfillment(order),
+    createdAt: order.createdAt.toISOString()
+  };
+}
+async function summaryBySession(db, sessionId) {
+  const order = await findOrderBySession(db, sessionId);
+  return order && toSummary(db, order);
+}
+async function detailById(db, orderId) {
+  const order = await findOrderById(db, orderId);
+  if (!order) return void 0;
+  return {
+    ...await toSummary(db, order),
+    email: order.email,
+    shippingAddress: order.shippingAddress ?? null
+  };
+}
+
+// src/orders/admin-service.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var InvalidCursorError = class extends Error {
+  code = "INVALID_CURSOR";
+  constructor() {
+    super("The cursor is malformed");
+    this.name = "InvalidCursorError";
+  }
+};
+var InvalidOrderIdError = class extends Error {
+  code = "INVALID_ORDER_ID";
+  constructor() {
+    super("The order id is malformed");
+    this.name = "InvalidOrderIdError";
+  }
+};
+var AdminOrderNotFoundError = class extends Error {
+  constructor(orderId) {
+    super(`No order: ${orderId}`);
+    this.orderId = orderId;
+    this.name = "AdminOrderNotFoundError";
+  }
+  orderId;
+  code = "ORDER_NOT_FOUND";
+};
+function toOrderRefund(row) {
+  return {
+    id: row.id,
+    amountCents: row.amountCents,
+    reason: row.reason,
+    restocked: row.restocked,
+    source: row.source,
+    status: row.idempotencyKey && !row.gatewayRefundId ? "pending" : "succeeded",
+    createdAt: row.createdAt.toISOString()
+  };
+}
+function isOrderId(value) {
+  return UUID.test(value);
+}
+function encodeCursor(createdAt, id) {
+  return Buffer.from(`${createdAt.toISOString()}|${id}`).toString("base64url");
+}
+function decodeCursor(cursor) {
+  const [iso, id, ...rest] = Buffer.from(cursor, "base64url").toString("utf8").split("|");
+  const createdAt = new Date(iso ?? "");
+  if (rest.length || !id || !isOrderId(id) || Number.isNaN(+createdAt)) {
+    throw new InvalidCursorError();
+  }
+  return { createdAt, id };
+}
+async function listAdminOrders(db, query) {
+  const rows = await selectOrderPage(db, {
+    status: query.status,
+    q: query.q,
+    hasPendingRefund: query.hasPendingRefund,
+    after: query.cursor ? decodeCursor(query.cursor) : void 0,
+    limit: query.limit + 1
+  });
+  const page = rows.slice(0, query.limit);
+  const last = page[page.length - 1];
+  return {
+    items: page.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
+    nextCursor: rows.length > query.limit && last ? encodeCursor(last.createdAt, last.id) : null
+  };
+}
+async function getAdminOrder(db, id) {
+  const detail = await detailById(db, id);
+  const row = await findOrderById(db, id);
+  if (!detail || !row) throw new AdminOrderNotFoundError(id);
+  const [refunds, refundedCents] = await Promise.all([
+    findOrderRefunds(db, id),
+    sumRefundedCents(db, id)
+  ]);
+  return {
+    ...detail,
+    refunds: refunds.map(toOrderRefund),
+    refundedCents,
+    checkoutSessionId: row.checkoutSessionId,
+    updatedAt: row.updatedAt.toISOString()
+  };
+}
+
+// src/orders/refund-errors.ts
+var IdempotencyKeyRequiredError = class extends Error {
+  code = "IDEMPOTENCY_KEY_REQUIRED";
+  constructor() {
+    super("An Idempotency-Key header of 1-255 characters is required");
+    this.name = "IdempotencyKeyRequiredError";
+  }
+};
+var RefundExceedsBalanceError = class extends Error {
+  constructor(balanceCents) {
+    super(`The refundable balance is ${balanceCents} cents`);
+    this.balanceCents = balanceCents;
+    this.name = "RefundExceedsBalanceError";
+  }
+  balanceCents;
+  code = "REFUND_EXCEEDS_BALANCE";
+};
+var RestockRequiresFullRefundError = class extends Error {
+  code = "RESTOCK_REQUIRES_FULL_REFUND";
+  constructor() {
+    super("Restock is only allowed when refunding the remaining balance");
+    this.name = "RestockRequiresFullRefundError";
+  }
+};
+var RestockNotApplicableError = class extends Error {
+  code = "RESTOCK_NOT_APPLICABLE";
+  constructor() {
+    super("This order never took stock, so there is nothing to restock");
+    this.name = "RestockNotApplicableError";
+  }
+};
+var RefundGatewayError = class extends Error {
+  code = "REFUND_GATEWAY_ERROR";
+  constructor(cause) {
+    super("The payment gateway could not create the refund", { cause });
+    this.name = "RefundGatewayError";
+  }
+};
+var RefundOutcomeUnknownError = class extends Error {
+  code = "REFUND_OUTCOME_UNKNOWN";
+  constructor(cause) {
+    super(
+      "The payment gateway did not confirm the refund and it may still have happened. Retry with the same Idempotency-Key or wait for the charge.refunded webhook",
+      { cause }
+    );
+    this.name = "RefundOutcomeUnknownError";
+  }
+};
+
+// src/payment/gateway.ts
+var RefundRejectedError = class extends Error {
+  definitelyFailed = true;
+  constructor(message, options) {
+    super(message, options);
+    this.name = "RefundRejectedError";
+  }
+};
+function isDefiniteRefundFailure(err) {
+  return err instanceof RefundRejectedError;
+}
+var SESSION_ID_PLACEHOLDER = "{CHECKOUT_SESSION_ID}";
+var WebhookSignatureError = class extends Error {
+  code = "INVALID_WEBHOOK_SIGNATURE";
+  constructor(message = "Webhook signature verification failed") {
+    super(message);
+    this.name = "WebhookSignatureError";
+  }
+};
+
+// src/orders/gateway-refunds.ts
+var ACCEPTS_REFUNDS = /* @__PURE__ */ new Set([
+  "paid",
+  "shipped",
+  "needs_attention",
+  "refunded"
+]);
+var SETTLES_AS_REFUNDED = /* @__PURE__ */ new Set(["paid", "shipped", "needs_attention"]);
+async function recordRefund(tx, order, refund) {
+  if (await findRefundByGatewayId(tx, refund.gatewayRefundId)) return void 0;
+  const confirmed = refund.idempotencyKey && await confirmPendingByKey(
+    tx,
+    order.id,
+    refund.idempotencyKey,
+    refund.gatewayRefundId
+  );
+  if (confirmed) {
+    if (confirmed.restocked) {
+      await restock(tx, await findOrderItems(tx, order.id));
+    }
+    return confirmed;
+  }
+  return insertGatewayRefund(tx, {
+    orderId: order.id,
+    amountCents: refund.amountCents,
+    currency: order.currency,
+    gatewayRefundId: refund.gatewayRefundId
+  });
+}
+async function applyGatewayRefunds(tx, order, refunds) {
+  const locked = await lockOrderForRefund(tx, order.id);
+  if (!locked || !ACCEPTS_REFUNDS.has(locked.status)) {
+    return { outcome: "ignored" };
+  }
+  const hooks = [];
+  for (const refund of refunds) {
+    const recorded = await recordRefund(tx, order, refund);
+    if (recorded) {
+      hooks.push(["onOrderRefunded", order.id, toOrderRefund(recorded)]);
+    }
+  }
+  if (SETTLES_AS_REFUNDED.has(locked.status) && await sumRefundedCents(tx, order.id) >= locked.totalCents) {
+    await setOrderStatus(tx, order.id, "refunded");
+  }
+  return { outcome: "processed", hooks };
+}
+
+// src/orders/apply-event.ts
+var ignored = { outcome: "ignored" };
+var ASYNC_PAYMENT_HOLD_MS = 14 * 24 * 60 * 60 * 1e3;
+async function settle(tx, order) {
+  if (await commit(tx, order.id) === "unavailable") {
+    await setOrderStatus(tx, order.id, "needs_attention");
+    return {
+      outcome: "processed",
+      hooks: [["onOrderNeedsAttention", order.id]]
+    };
+  }
+  await setOrderStatus(tx, order.id, "paid");
+  return { outcome: "processed", hooks: [["onOrderPaid", order.id]] };
+}
+async function completed(tx, order, event) {
+  if (["paid", "shipped", "needs_attention"].includes(order.status)) {
+    return ignored;
+  }
+  await saveOrderDetails(tx, order.id, event);
+  if (event.paymentPending) {
+    await extendHolds(
+      tx,
+      order.id,
+      new Date(Date.now() + ASYNC_PAYMENT_HOLD_MS)
+    );
+    return { outcome: "processed" };
+  }
+  return settle(tx, order);
+}
+async function applyToOrder(tx, order, event) {
+  switch (event.type) {
+    case "checkout.completed":
+      return completed(tx, order, event);
+    case "checkout.async_paid":
+      return order.status === "pending" ? settle(tx, order) : ignored;
+    case "checkout.async_failed":
+      if (order.status !== "pending") return ignored;
+      await setOrderStatus(tx, order.id, "cancelled");
+      await release(tx, order.id);
+      return {
+        outcome: "processed",
+        hooks: [["onOrderPaymentFailed", order.id]]
+      };
+    case "checkout.expired":
+      if (order.status !== "pending") return ignored;
+      await setOrderStatus(tx, order.id, "expired");
+      await release(tx, order.id);
+      return { outcome: "processed", hooks: [["onOrderExpired", order.id]] };
+    case "payment.refunded":
+      return applyGatewayRefunds(tx, order, event.refunds);
+  }
+}
+
+// src/orders/types.ts
+var CheckoutConflictError = class extends Error {
+  constructor(productIds) {
+    super(`Unavailable products: ${productIds.join(", ")}`);
+    this.productIds = productIds;
+    this.name = "CheckoutConflictError";
+  }
+  productIds;
+  code = "CHECKOUT_CONFLICT";
+};
+var PaymentGatewayError = class extends Error {
+  code = "PAYMENT_GATEWAY_ERROR";
+  constructor(cause) {
+    super("The payment gateway could not create a checkout session", {
+      cause
+    });
+    this.name = "PaymentGatewayError";
+  }
+};
+var OrderNotFoundError = class extends Error {
+  constructor(sessionId) {
+    super(`No order for checkout session: ${sessionId}`);
+    this.sessionId = sessionId;
+    this.name = "OrderNotFoundError";
+  }
+  sessionId;
+  code = "ORDER_NOT_FOUND";
+};
+
+// src/orders/order-service.ts
+async function getOrderSummary(db, sessionId) {
+  const summary = await summaryBySession(db, sessionId);
+  if (!summary) throw new OrderNotFoundError(sessionId);
+  return summary;
+}
+async function applyEvent(db, event) {
+  return db.transaction(async (tx) => {
+    const type = event.type === "ignored" ? event.sourceType : event.type;
+    if (!await recordEvent(tx, event.id, type)) {
+      return { outcome: "duplicate" };
+    }
+    if (event.type === "ignored") return { outcome: "ignored" };
+    const order = await findOrderBySession(tx, event.sessionId);
+    if (!order) return { outcome: "ignored" };
+    return applyToOrder(tx, order, event);
+  });
+}
+async function runHook(db, hooks, [name, orderId], log, ...args) {
+  const hook = hooks[name];
+  if (!hook) return;
+  try {
+    const order = await detailById(db, orderId);
+    if (order) await hook.call(hooks, order, ...args);
+  } catch (err) {
+    log?.error({ err }, `${name} hook failed for order ${orderId}`);
+  }
+}
+async function handlePaymentEvent(db, event, hooks = {}, log) {
+  const { outcome, hooks: calls = [] } = await applyEvent(db, event);
+  for (const [name, orderId, ...args] of calls) {
+    await runHook(db, hooks, [name, orderId], log, ...args);
+  }
+  if (outcome === "ignored" && event.type === "payment.refunded") {
+    log?.warn?.(
+      { sessionId: event.sessionId },
+      "refund event for an unknown or unrefundable order"
+    );
+  }
+  return outcome;
+}
+
+// src/orders/ship-service.ts
+import { eq as eq8, sql as sql8 } from "drizzle-orm";
+var InvalidOrderStateError = class extends Error {
+  constructor(status) {
+    super(`The order is ${status}`);
+    this.status = status;
+    this.name = "InvalidOrderStateError";
+  }
+  status;
+  code = "INVALID_ORDER_STATE";
+};
+async function applyShipment(db, id, input) {
+  return db.transaction(async (tx) => {
+    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq8(orders.id, id)).for("update");
+    if (!row) throw new AdminOrderNotFoundError(id);
+    if (row.status !== "paid" && row.status !== "shipped") {
+      throw new InvalidOrderStateError(row.status);
+    }
+    const first = row.status === "paid";
+    await tx.update(orders).set({
+      fulfillmentCarrier: input.carrier ?? null,
+      fulfillmentTrackingNumber: input.trackingNumber ?? null,
+      fulfillmentTrackingUrl: input.trackingUrl ?? null,
+      ...first && { status: "shipped", shippedAt: sql8`now()` },
+      updatedAt: sql8`now()`
+    }).where(eq8(orders.id, id));
+    return first;
+  });
+}
+async function shipOrder(db, id, input, hooks = {}, log) {
+  const first = await applyShipment(db, id, input);
+  if (first) await runHook(db, hooks, ["onOrderShipped", id], log);
+  return getAdminOrder(db, id);
+}
+
+// src/orders/refund-service.ts
+var REFUNDABLE = /* @__PURE__ */ new Set(["paid", "shipped", "needs_attention"]);
+async function reserveRefund(db, orderId, input, idempotencyKey2) {
+  return db.transaction(async (tx) => {
+    const order = await lockOrderForRefund(tx, orderId);
+    if (!order) throw new AdminOrderNotFoundError(orderId);
+    const existing = await findRefundByKey(tx, orderId, idempotencyKey2);
+    if (existing?.gatewayRefundId) return { kind: "done" };
+    if (!REFUNDABLE.has(order.status) || !order.checkoutSessionId) {
+      throw new InvalidOrderStateError(order.status);
+    }
+    const sessionId = order.checkoutSessionId;
+    if (existing) return { kind: "pending", refund: existing, sessionId };
+    const balance = order.totalCents - await sumReservedCents(tx, orderId);
+    const amountCents = input.amountCents ?? balance;
+    if (amountCents <= 0 || amountCents > balance) {
+      throw new RefundExceedsBalanceError(balance);
+    }
+    if (input.restock && amountCents !== balance) {
+      throw new RestockRequiresFullRefundError();
+    }
+    if (input.restock && order.status === "needs_attention") {
+      throw new RestockNotApplicableError();
+    }
+    const refund = await insertPendingRefund(tx, {
+      orderId,
+      amountCents,
+      currency: order.currency,
+      reason: input.reason ?? null,
+      restocked: input.restock,
+      source: "admin",
+      idempotencyKey: idempotencyKey2
+    });
+    return { kind: "pending", refund, sessionId };
+  });
+}
+async function recordRefund2(db, pending, gatewayRefundId) {
+  return db.transaction(async (tx) => {
+    const order = await lockOrderForRefund(tx, pending.orderId);
+    const refund = await confirmRefund(tx, pending, gatewayRefundId);
+    if (!order || !refund) return void 0;
+    if (refund.restocked) {
+      const items = await findOrderItems(tx, refund.orderId);
+      await restock(tx, items);
+    }
+    if (await sumRefundedCents(tx, refund.orderId) >= order.totalCents) {
+      await setOrderStatus(tx, refund.orderId, "refunded");
+    }
+    return refund;
+  });
+}
+async function refundOrder(db, gateway, orderId, input, idempotencyKey2, hooks = {}, log) {
+  const reservation = await reserveRefund(db, orderId, input, idempotencyKey2);
+  if (reservation.kind === "done") return getAdminOrder(db, orderId);
+  const { refund: pending, sessionId } = reservation;
+  let gatewayRefundId;
+  try {
+    ({ gatewayRefundId } = await gateway.refund({
+      sessionId,
+      amountCents: pending.amountCents,
+      idempotencyKey: `${orderId}:${idempotencyKey2}`
+    }));
+  } catch (err) {
+    if (!isDefiniteRefundFailure(err)) throw new RefundOutcomeUnknownError(err);
+    await deletePendingRefund(db, pending.id);
+    throw new RefundGatewayError(err);
+  }
+  const recorded = await recordRefund2(db, pending, gatewayRefundId);
+  if (recorded) {
+    await runHook(
+      db,
+      hooks,
+      ["onOrderRefunded", orderId],
+      log,
+      toOrderRefund(recorded)
+    );
+  }
+  return getAdminOrder(db, orderId);
+}
+
+// src/orders/resolve-service.ts
+import { eq as eq9, sql as sql9 } from "drizzle-orm";
+async function applyResolution(db, id) {
+  await db.transaction(async (tx) => {
+    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq9(orders.id, id)).for("update");
+    if (!row) throw new AdminOrderNotFoundError(id);
+    if (row.status !== "needs_attention") {
+      throw new InvalidOrderStateError(row.status);
+    }
+    const outcome = await commitWithin(tx, id);
+    if (outcome.result === "unavailable") {
+      throw new InsufficientStockError(outcome.shortProductIds);
+    }
+    await tx.update(orders).set({ status: "paid", updatedAt: sql9`now()` }).where(eq9(orders.id, id));
+  });
+}
+async function resolveOrder(db, id, hooks = {}, log) {
+  await applyResolution(db, id);
+  await runHook(db, hooks, ["onOrderPaid", id], log);
+  return getAdminOrder(db, id);
+}
+
+// src/orders/admin-routes.ts
+function idempotencyKey(req) {
+  const key = req.headers["idempotency-key"];
+  if (typeof key !== "string" || key.length === 0 || key.length > 255) {
+    throw new IdempotencyKeyRequiredError();
+  }
+  return key;
+}
+var BAD_REQUEST = [
+  InvalidCursorError,
+  InvalidOrderIdError,
+  IdempotencyKeyRequiredError,
+  RestockRequiresFullRefundError,
+  RestockNotApplicableError
+];
+function isZodError2(err) {
+  return err instanceof Error && err.name === "ZodError";
+}
+var adminOrdersPlugin = async (app, { db, authorize, payment, hooks }) => {
+  app.setErrorHandler((err, _req, reply) => {
+    if (isZodError2(err)) {
+      return reply.code(400).send({ error: "INVALID_INPUT", issues: err.issues });
+    }
+    if (BAD_REQUEST.some((type) => err instanceof type)) {
+      const { code, message } = err;
+      return reply.code(400).send({ error: code, message });
+    }
+    if (err instanceof RefundExceedsBalanceError) {
+      return reply.code(400).send({
+        error: err.code,
+        message: err.message,
+        balanceCents: err.balanceCents
+      });
+    }
+    if (err instanceof RefundGatewayError || err instanceof RefundOutcomeUnknownError) {
+      return reply.code(502).send({ error: err.code, message: err.message });
+    }
+    if (err instanceof InvalidOrderStateError) {
+      return reply.code(409).send({ error: err.code, message: err.message, status: err.status });
+    }
+    if (err instanceof InsufficientStockError) {
+      return reply.code(409).send({
+        error: "INSUFFICIENT_STOCK",
+        message: err.message,
+        productIds: err.productIds
+      });
+    }
+    if (err instanceof AdminOrderNotFoundError) {
+      return reply.code(404).send({ error: err.code, message: err.message });
+    }
+    return reply.send(err);
+  });
+  app.addHook("preHandler", async (req, reply) => {
+    if (!await authorize(req)) {
+      return reply.code(401).send({ error: "UNAUTHORIZED" });
+    }
+  });
+  app.get(
+    "/",
+    async (req) => adminOrderPageSchema.parse(
+      await listAdminOrders(db, adminOrderListQuerySchema.parse(req.query))
+    )
+  );
+  app.get("/:id", async (req) => {
+    if (!isOrderId(req.params.id)) throw new InvalidOrderIdError();
+    return getAdminOrder(db, req.params.id);
+  });
+  app.post("/:id/ship", async (req) => {
+    if (!isOrderId(req.params.id)) throw new InvalidOrderIdError();
+    const log = req.log;
+    return shipOrder(
+      db,
+      req.params.id,
+      shipOrderInputSchema.parse(req.body ?? {}),
+      hooks,
+      log
+    );
+  });
+  app.post("/:id/resolve", async (req) => {
+    if (!isOrderId(req.params.id)) throw new InvalidOrderIdError();
+    const log = req.log;
+    return resolveOrder(db, req.params.id, hooks, log);
+  });
+  app.post("/:id/refunds", async (req) => {
+    if (!isOrderId(req.params.id)) throw new InvalidOrderIdError();
+    const key = idempotencyKey(req);
+    const log = req.log;
+    return refundOrder(
+      db,
+      payment,
+      req.params.id,
+      refundOrderInputSchema.parse(req.body ?? {}),
+      key,
+      hooks,
+      log
+    );
+  });
+};
+
+// src/orders/routes.ts
+import {
+  checkoutConflictSchema,
+  checkoutRequestSchema,
+  checkoutResponseSchema,
+  orderSummarySchema
+} from "@develemit/commerce-contracts";
+
+// src/orders/checkout-service.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var HOLD_DURATION_MS = 31 * 60 * 1e3;
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function mergeItems(items) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const { productId, quantity } of items) {
+    merged.set(productId, (merged.get(productId) ?? 0) + quantity);
+  }
+  return [...merged].map(([productId, quantity]) => ({ productId, quantity }));
+}
+async function priceLines(db, requests, currency) {
+  const ids = requests.map((r) => r.productId);
+  const found = await findPurchasable(
+    db,
+    ids.filter((id) => UUID2.test(id))
+  );
+  const byId = new Map(found.map((p) => [p.id, p]));
+  const unavailable = ids.filter((id) => byId.get(id)?.currency !== currency);
+  if (unavailable.length > 0) throw new CheckoutConflictError(unavailable);
+  return requests.map(({ productId, quantity }) => {
+    const product = byId.get(productId);
+    return {
+      productId,
+      name: product.name,
+      unitAmountCents: product.priceCents,
+      quantity
+    };
+  });
+}
+async function reserveOrder(db, orderId, lines, currency, expiresAt) {
+  try {
+    await db.transaction(async (tx) => {
+      await reserve(tx, { reference: orderId, items: lines, expiresAt });
+      await insertOrder(
+        tx,
+        {
+          id: orderId,
+          currency,
+          subtotalCents: lines.reduce(
+            (sum, l) => sum + l.unitAmountCents * l.quantity,
+            0
+          )
+        },
+        lines.map((l) => ({
+          productId: l.productId,
+          name: l.name,
+          priceCents: l.unitAmountCents,
+          quantity: l.quantity
+        }))
+      );
+    });
+  } catch (err) {
+    if (err instanceof InsufficientStockError) {
+      throw new CheckoutConflictError(err.productIds);
+    }
+    throw err;
+  }
+}
+async function createCheckout(db, settings, request) {
+  const lines = await priceLines(
+    db,
+    mergeItems(request.items),
+    settings.currency
+  );
+  const shippingRates2 = await listActiveRates(db, settings.currency);
+  const orderId = randomUUID2();
+  const expiresAt = new Date(Date.now() + HOLD_DURATION_MS);
+  await reserveOrder(db, orderId, lines, settings.currency, expiresAt);
+  let session;
+  try {
+    session = await settings.payment.createCheckoutSession({
+      reference: orderId,
+      currency: settings.currency,
+      lines,
+      successUrl: settings.urls.success(SESSION_ID_PLACEHOLDER),
+      cancelUrl: settings.urls.cancel,
+      shippingCountries: settings.shippingCountries,
+      shippingRates: shippingRates2,
+      expiresAt
+    });
+  } catch (err) {
+    await release(db, orderId);
+    await setOrderStatus(db, orderId, "cancelled");
+    throw new PaymentGatewayError(err);
+  }
+  await setCheckoutSession(db, orderId, session.id);
+  return { url: session.url };
+}
+
+// src/orders/webhook-routes.ts
+var webhookRoutes = async (app, { db, payment, hooks }) => {
+  app.removeAllContentTypeParsers();
+  app.addContentTypeParser(
+    "*",
+    { parseAs: "buffer" },
+    (_req, body, done) => done(null, body)
+  );
+  app.post("/stripe", async (req, reply) => {
+    const header = req.headers["stripe-signature"];
+    const signature = typeof header === "string" ? header : void 0;
+    const rawBody = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+    let event;
+    try {
+      event = await payment.verifyWebhook(rawBody, signature);
+    } catch (err) {
+      if (err instanceof WebhookSignatureError) {
+        return reply.code(400).send({ error: err.code });
+      }
+      throw err;
+    }
+    const outcome = await handlePaymentEvent(db, event, hooks, req.log);
+    return { received: true, outcome };
+  });
+};
+
+// src/orders/routes.ts
+var ordersPlugin = async (app, { db, ...settings }) => {
+  app.post("/checkout", async (req, reply) => {
+    const parsed = checkoutRequestSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: "INVALID_CHECKOUT_REQUEST" });
+    }
+    try {
+      return checkoutResponseSchema.parse(
+        await createCheckout(db, settings, parsed.data)
+      );
+    } catch (err) {
+      if (err instanceof CheckoutConflictError) {
+        return reply.code(409).send(
+          checkoutConflictSchema.parse({
+            unavailableProductIds: err.productIds
+          })
+        );
+      }
+      if (err instanceof PaymentGatewayError) {
+        req.log.error({ err: err.cause }, err.message);
+        return reply.code(502).send({ error: err.code });
+      }
+      throw err;
+    }
+  });
+  app.get(
+    "/orders/session/:sessionId",
+    async (req, reply) => {
+      try {
+        return orderSummarySchema.parse(
+          await getOrderSummary(db, req.params.sessionId)
+        );
+      } catch (err) {
+        if (err instanceof OrderNotFoundError) {
+          return reply.code(404).send({ error: err.code });
+        }
+        throw err;
+      }
+    }
+  );
+  await app.register(webhookRoutes, {
+    db,
+    payment: settings.payment,
+    hooks: settings.hooks,
+    prefix: "/orders/webhooks"
+  });
+};
+
+// src/plugin.ts
+var commercePlugin = async (app, {
+  db,
+  currency,
+  payment,
+  urls,
+  shippingCountries = ["US"],
+  hooks,
+  admin,
+  categoryLabels
+}) => {
+  app.get("/health", async () => ({ status: "ok" }));
+  await app.register(catalogPlugin, {
+    db,
+    categoryLabels,
+    prefix: "/catalog"
+  });
+  if (admin) {
+    await app.register(adminPlugin, {
+      db,
+      currency,
+      ...admin,
+      prefix: "/admin"
+    });
+  }
+  if (!payment || !urls) return;
+  await app.register(ordersPlugin, {
+    db,
+    currency,
+    payment,
+    urls,
+    shippingCountries,
+    hooks
+  });
+  if (admin) {
+    await app.register(adminOrdersPlugin, {
+      db,
+      authorize: admin.authorize,
+      payment,
+      hooks,
+      prefix: "/admin/orders"
+    });
+  }
+};
+
+// src/payment/stripe-gateway.ts
+var REFUND_KEY_METADATA = "commerceRefundKey";
+function rejectedRefund(err) {
+  if (err instanceof RefundRejectedError) return err;
+  const status = err?.statusCode;
+  if (typeof status === "number" && status >= 400 && status < 500) {
+    return new RefundRejectedError(err.message, { cause: err });
+  }
+  return err;
+}
+function toShippingAddress(name, address) {
+  if (!address) return void 0;
+  const fields = {
+    name: name ?? void 0,
+    line1: address.line1 ?? void 0,
+    line2: address.line2 ?? void 0,
+    city: address.city ?? void 0,
+    state: address.state ?? void 0,
+    postalCode: address.postal_code ?? void 0,
+    country: address.country ?? void 0
+  };
+  return Object.fromEntries(
+    Object.entries(fields).filter(([, v]) => v !== void 0)
+  );
+}
+function toShippingOption(rate, currency) {
+  const days = (value) => ({ unit: "business_day", value });
+  return {
+    shipping_rate_data: {
+      type: "fixed_amount",
+      display_name: rate.label,
+      fixed_amount: { amount: rate.amountCents, currency },
+      ...rate.minDays !== void 0 && rate.maxDays !== void 0 && {
+        delivery_estimate: {
+          minimum: days(rate.minDays),
+          maximum: days(rate.maxDays)
+        }
+      }
+    }
+  };
+}
+function toChosenShipping(session) {
+  const cost = session.shipping_cost;
+  const rate = cost?.shipping_rate;
+  if (!cost || !rate || typeof rate === "string") return void 0;
+  return {
+    label: rate.display_name ?? "Shipping",
+    amountCents: cost.amount_total
+  };
+}
+function toPaymentEvent(event, expanded) {
+  if (event.type === "checkout.session.completed") {
+    const session = event.data.object;
+    const shipping = session.collected_information?.shipping_details;
+    return {
+      id: event.id,
+      type: "checkout.completed",
+      sessionId: session.id,
+      email: session.customer_details?.email ?? void 0,
+      shippingAddress: toShippingAddress(shipping?.name, shipping?.address),
+      shipping: expanded && toChosenShipping(expanded),
+      paymentPending: session.payment_status === "unpaid"
+    };
+  }
+  if (event.type === "checkout.session.async_payment_succeeded") {
+    return {
+      id: event.id,
+      type: "checkout.async_paid",
+      sessionId: event.data.object.id
+    };
+  }
+  if (event.type === "checkout.session.async_payment_failed") {
+    return {
+      id: event.id,
+      type: "checkout.async_failed",
+      sessionId: event.data.object.id
+    };
+  }
+  if (event.type === "checkout.session.expired") {
+    return {
+      id: event.id,
+      type: "checkout.expired",
+      sessionId: event.data.object.id
+    };
+  }
+  return { id: event.id, type: "ignored", sourceType: event.type };
+}
+function toRefundEvent(refund) {
+  return {
+    gatewayRefundId: refund.id,
+    amountCents: refund.amount,
+    idempotencyKey: refund.metadata?.[REFUND_KEY_METADATA] || void 0
+  };
+}
+async function refundedEvent(stripe, event) {
+  const charge = event.data.object;
+  const intent = charge.payment_intent;
+  const ignored2 = {
+    id: event.id,
+    type: "ignored",
+    sourceType: event.type
+  };
+  if (!intent) return ignored2;
+  const { data: sessions } = await stripe.checkout.sessions.list({
+    payment_intent: typeof intent === "string" ? intent : intent.id,
+    limit: 1
+  });
+  if (sessions.length === 0) return ignored2;
+  const refunds = charge.refunds?.data ?? (await stripe.refunds.list({ charge: charge.id, limit: 100 })).data;
+  return {
+    id: event.id,
+    type: "payment.refunded",
+    sessionId: sessions[0].id,
+    refunds: refunds.filter((refund) => refund.status !== "failed").map(toRefundEvent)
+  };
+}
+async function loadStripe(secretKey) {
+  const { default: StripeClient } = await import("stripe");
+  return new StripeClient(secretKey);
+}
+function createStripeGateway({
+  secretKey,
+  webhookSecret,
+  client
+}) {
+  let stripe = client ? Promise.resolve(client) : void 0;
+  const getStripe = () => stripe ??= loadStripe(secretKey);
+  return {
+    async createCheckoutSession(input) {
+      const session = await (await getStripe()).checkout.sessions.create({
+        mode: "payment",
+        client_reference_id: input.reference,
+        metadata: { reference: input.reference },
+        line_items: input.lines.map((line) => ({
+          quantity: line.quantity,
+          price_data: {
+            currency: input.currency.toLowerCase(),
+            unit_amount: line.unitAmountCents,
+            product_data: {
+              name: line.name,
+              metadata: { productId: line.productId }
+            }
+          }
+        })),
+        success_url: input.successUrl,
+        cancel_url: input.cancelUrl,
+        expires_at: Math.floor(input.expiresAt.getTime() / 1e3),
+        ...input.shippingRates.length > 0 && {
+          shipping_options: input.shippingRates.map(
+            (rate) => toShippingOption(rate, input.currency.toLowerCase())
+          )
+        },
+        shipping_address_collection: {
+          allowed_countries: input.shippingCountries
+        }
+      });
+      if (!session.url) throw new Error("Stripe returned no checkout URL");
+      return { id: session.id, url: session.url };
+    },
+    async verifyWebhook(rawBody, signature) {
+      const stripeClient = await getStripe();
+      let event;
+      try {
+        event = stripeClient.webhooks.constructEvent(
+          rawBody,
+          signature ?? "",
+          webhookSecret
+        );
+      } catch (err) {
+        throw new WebhookSignatureError(err.message);
+      }
+      if (event.type === "charge.refunded") {
+        return refundedEvent(stripeClient, event);
+      }
+      if (event.type !== "checkout.session.completed") {
+        return toPaymentEvent(event);
+      }
+      const session = await stripeClient.checkout.sessions.retrieve(
+        event.data.object.id,
+        { expand: ["shipping_cost.shipping_rate"] }
+      );
+      return toPaymentEvent(event, session);
+    },
+    async refund({ sessionId, amountCents, idempotencyKey: idempotencyKey2 }) {
+      try {
+        const stripeClient = await getStripe();
+        const session = await stripeClient.checkout.sessions.retrieve(sessionId);
+        const intent = session.payment_intent;
+        if (!intent) {
+          throw new RefundRejectedError(`Session ${sessionId} has no payment`);
+        }
+        const refund = await stripeClient.refunds.create(
+          {
+            payment_intent: typeof intent === "string" ? intent : intent.id,
+            amount: amountCents,
+            metadata: { [REFUND_KEY_METADATA]: idempotencyKey2 }
+          },
+          { idempotencyKey: idempotencyKey2 }
+        );
+        return { gatewayRefundId: refund.id };
+      } catch (err) {
+        throw rejectedRefund(err);
+      }
+    }
+  };
+}
+
+// src/payment/fake-gateway.ts
+import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+function createFakeGateway({
+  secret = "fake-webhook-secret"
+} = {}) {
+  const sessions = [];
+  const refunds = [];
+  const refundCalls = [];
+  let pendingFailure;
+  let pendingRefundFailure;
+  const hmac = (body) => createHmac("sha256", secret).update(body).digest("hex");
+  function sign(event) {
+    const rawBody = Buffer.from(JSON.stringify(event));
+    return { rawBody, signature: hmac(rawBody) };
+  }
+  return {
+    sessions,
+    refunds,
+    refundCalls,
+    async createCheckoutSession(input) {
+      if (pendingFailure) {
+        const err = pendingFailure;
+        pendingFailure = void 0;
+        throw err;
+      }
+      const id = `fake_cs_${randomUUID3()}`;
+      sessions.push({ ...input, id });
+      return {
+        id,
+        url: input.successUrl.replace(SESSION_ID_PLACEHOLDER, id)
+      };
+    },
+    async verifyWebhook(rawBody, signature) {
+      const expected = Buffer.from(hmac(rawBody));
+      const given = Buffer.from(signature ?? "");
+      if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+        throw new WebhookSignatureError();
+      }
+      return JSON.parse(rawBody.toString("utf8"));
+    },
+    async refund(input) {
+      refundCalls.push(input);
+      if (pendingRefundFailure) {
+        const err = pendingRefundFailure;
+        pendingRefundFailure = void 0;
+        throw err;
+      }
+      const prior = refunds.find(
+        (r) => r.idempotencyKey === input.idempotencyKey
+      );
+      if (prior) return { gatewayRefundId: prior.gatewayRefundId };
+      const gatewayRefundId = `fake_re_${refunds.length + 1}_${input.sessionId}`;
+      refunds.push({ ...input, gatewayRefundId });
+      return { gatewayRefundId };
+    },
+    failNextSession(error = new Error("Fake gateway failure")) {
+      pendingFailure = error;
+    },
+    failNextRefund(error = new RefundRejectedError("Fake refund failure")) {
+      pendingRefundFailure = error;
+    },
+    failNextRefundUncertain(error = new Error("Fake refund timeout")) {
+      pendingRefundFailure = error;
+    },
+    completed(sessionId, details = {}) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.completed",
+        sessionId,
+        ...details
+      });
+    },
+    asyncPaid(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.async_paid",
+        sessionId
+      });
+    },
+    asyncFailed(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.async_failed",
+        sessionId
+      });
+    },
+    expired(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.expired",
+        sessionId
+      });
+    },
+    refunded(sessionId, refunds2) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "payment.refunded",
+        sessionId,
+        refunds: refunds2
+      });
+    },
+    sign
+  };
+}
+
+// src/hold-sweeper.ts
+function startHoldSweeper(db, { intervalMs = 6e4, onError } = {}) {
+  const timer = setInterval(() => {
+    releaseExpired(db).catch((err) => onError?.(err));
+  }, intervalMs);
+  timer.unref();
+  return { stop: () => clearInterval(timer) };
+}
+
+// src/db/migrate.ts
+import path from "path";
+import { fileURLToPath } from "url";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+var here = path.dirname(fileURLToPath(import.meta.url));
+function resolveMigrationsFolder() {
+  const fromSrc = path.resolve(here, "../../migrations");
+  const fromDist = path.resolve(here, "../migrations");
+  return here.endsWith(path.join("src", "db")) ? fromSrc : fromDist;
+}
+async function runCommerceMigrations(db) {
+  await migrate(db, {
+    migrationsFolder: resolveMigrationsFolder(),
+    migrationsTable: "__commerce_migrations"
+  });
+}
+
+// src/seed.ts
+import { eq as eq10, sql as sql10 } from "drizzle-orm";
+async function seedProducts(db, items) {
+  await db.transaction(async (tx) => {
+    for (const { images = [], ...item } of items) {
+      const values = { status: "active", ...item };
+      const [row] = await tx.insert(products).values(values).onConflictDoUpdate({
+        target: products.slug,
+        set: { ...values, updatedAt: sql10`now()` }
+      }).returning({ id: products.id });
+      await tx.delete(productImages).where(eq10(productImages.productId, row.id));
+      if (images.length > 0) {
+        await tx.insert(productImages).values(
+          images.map((img, position) => ({
+            productId: row.id,
+            url: img.url,
+            alt: img.alt ?? "",
+            position
+          }))
+        );
+      }
+    }
+  });
+}
+
+// src/shipping/seed.ts
+async function seedShippingRates(db, rates) {
+  await db.transaction(async (tx) => {
+    for (const rate of rates) {
+      await tx.insert(shippingRates).values(rate).onConflictDoUpdate({
+        target: shippingRates.label,
+        set: {
+          amountCents: rate.amountCents,
+          currency: rate.currency,
+          minDays: rate.minDays ?? null,
+          maxDays: rate.maxDays ?? null,
+          active: rate.active ?? true,
+          sort: rate.sort ?? 0
+        }
+      });
+    }
+  });
+}
+
+// src/storage/memory.ts
+function createMemoryStorage(baseUrl = "memory://") {
+  const files = /* @__PURE__ */ new Map();
+  return {
+    files,
+    async put(key, stream, contentType) {
+      const chunks = [];
+      for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+      files.set(key, { body: Buffer.concat(chunks), contentType });
+      return { key, url: `${baseUrl}${key}` };
+    },
+    async delete(key) {
+      files.delete(key);
+    }
+  };
+}
+export {
+  ProductNotFoundError,
+  SESSION_ID_PLACEHOLDER,
+  WebhookSignatureError,
+  catalogPlugin,
+  commercePlugin,
+  commerceSchema,
+  createFakeGateway,
+  createMemoryStorage,
+  createStripeGateway,
+  ordersPlugin,
+  runCommerceMigrations,
+  seedProducts,
+  seedShippingRates,
+  startHoldSweeper
+};
+//# sourceMappingURL=index.js.map