@develemit/commerce-server 0.2.0 → 0.3.0

package/README.md

@@ -131,6 +131,38 @@ reference, see `apps/playground-e2e/tests/order-management.spec.ts`.
 - [Admin API](docs/admin.md): product and order management, refunds, and orders that need attention.
 - [Payment gateways](docs/payments.md): the `PaymentGateway` contract and the manual Stripe test-mode purchase.
 
+## Caching
+
+The public catalog GETs send `Cache-Control: public, max-age=30,
+stale-while-revalidate=300` and a strong `ETag`, and answer a matching
+`If-None-Match` (including `W/` and comma lists) with an empty 304. Errors get
+`Cache-Control: no-store`. Admin, checkout and order routes are untouched.
+
+Pass `catalogCache: { cacheControl: '...' }` to `commercePlugin` to change the
+header, or `cacheControl: false` to omit it (the `ETag` is still sent), for
+hosts that manage caching at a CDN.
+
+The `ETag` hashes the uncompressed body. Register `@fastify/compress` at the
+app root before `commercePlugin`, so its `onSend` runs after the catalog's.
+
+## Production checklist
+
+- **Compression:** register `@fastify/compress` at the app root before
+  `commercePlugin` (JSON shrinks 70-80%). The kit doesn't wrap your app.
+- **Catalog caching:** see [Caching](#caching); put a CDN in front of the
+  catalog GETs.
+- **Images:** serve uploads with long immutable caching and lazy-loaded
+  `<img>`s (the storefront's default); keep image types out of compression.
+- **Uploads on a CDN:** point `storage` at object storage behind a CDN rather
+  than the API process.
+- **Webhooks:** forward the Stripe events (`checkout.session.completed`,
+  expiry and async failure) to `/orders/webhooks/stripe`; see
+  [Payment gateways](docs/payments.md).
+  Webhook raw-body parsing is request-side and unaffected by compression.
+- **Retries:** refunds require an `Idempotency-Key`; reuse it when retrying so
+  a refund can't be issued twice.
+- Admin routes: see [Admin API](docs/admin.md).
+
 ## Routes
 
 Relative to the host's prefix:

package/dist/index.d.ts

@@ -1257,6 +1257,10 @@ interface AdminOptions {
     storage: FileStorage;
 }
 
+interface CatalogCacheOptions {
+    cacheControl?: string | false;
+}
+
 declare class ProductNotFoundError extends Error {
     readonly slug: string;
     readonly code = "PRODUCT_NOT_FOUND";
@@ -1395,12 +1399,14 @@ type CommercePluginOptions = {
     currency: string;
     admin?: AdminOptions;
     categoryLabels?: CategoryLabels;
+    catalogCache?: CatalogCacheOptions;
 } & (CheckoutOptions | CatalogOnlyOptions);
 declare const commercePlugin: FastifyPluginAsync<CommercePluginOptions>;
 
 interface CatalogPluginOptions {
     db: CommerceDb;
     categoryLabels?: CategoryLabels;
+    catalogCache?: CatalogCacheOptions;
 }
 declare const catalogPlugin: FastifyPluginAsync<CatalogPluginOptions>;
 
@@ -1498,4 +1504,4 @@ interface MemoryStorage extends FileStorage {
 declare function createMemoryStorage(baseUrl?: string): MemoryStorage;
 
 export { ProductNotFoundError, SESSION_ID_PLACEHOLDER, WebhookSignatureError, catalogPlugin, commercePlugin, commerceSchema, createFakeGateway, createMemoryStorage, createStripeGateway, ordersPlugin, runCommerceMigrations, seedProducts, seedShippingRates, startHoldSweeper };
-export type { AdminOptions, CatalogPluginOptions, CategoryLabels, CheckoutLine, CheckoutSession, CheckoutUrls, ChosenShipping, CommerceDb, CommercePluginOptions, CommerceSchema, CreateCheckoutSessionInput, FakeGateway, FakeGatewayOptions, FileStorage, GatewayRefund, HoldSweeper, HoldSweeperOptions, MemoryStorage, OrderHooks, OrdersPluginOptions, PaymentEvent, PaymentGateway, RefundInput, SeedProduct, SeedShippingRate, ShippingAddress, ShippingRateOption, SignedWebhook, StoredFile, StripeGatewayOptions };
+export type { AdminOptions, CatalogCacheOptions, CatalogPluginOptions, CategoryLabels, CheckoutLine, CheckoutSession, CheckoutUrls, ChosenShipping, CommerceDb, CommercePluginOptions, CommerceSchema, CreateCheckoutSessionInput, FakeGateway, FakeGatewayOptions, FileStorage, GatewayRefund, HoldSweeper, HoldSweeperOptions, MemoryStorage, OrderHooks, OrdersPluginOptions, PaymentEvent, PaymentGateway, RefundInput, SeedProduct, SeedShippingRate, ShippingAddress, ShippingRateOption, SignedWebhook, StoredFile, StripeGatewayOptions };

package/dist/index.js

@@ -2,7 +2,7 @@
 import {
   adminProductInputSchema as adminProductInputSchema2,
   adminProductPatchSchema as adminProductPatchSchema2,
-  adminProductSchema,
+  adminProductPageSchema,
   imageOrderInputSchema,
   shippingRatesInputSchema
 } from "@develemit/commerce-contracts";
@@ -18,6 +18,28 @@ var ProductNotFoundError = class extends Error {
   code = "PRODUCT_NOT_FOUND";
 };
 
+// src/shared/cursor.ts
+var InvalidCursorError = class extends Error {
+  code = "INVALID_CURSOR";
+  constructor() {
+    super("The cursor is malformed");
+    this.name = "InvalidCursorError";
+  }
+};
+var PG_TIMESTAMP = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?[+-]\d{2}(:?\d{2})?$/;
+function encodeCursor({ at, key }) {
+  return Buffer.from(`${at}|${key}`).toString("base64url");
+}
+function decodeCursor(raw, accepts) {
+  const text2 = Buffer.from(raw, "base64url").toString("utf8");
+  const split = text2.indexOf("|");
+  const cursor = { at: text2.slice(0, split), key: text2.slice(split + 1) };
+  if (split < 0 || !cursor.key || !accepts(cursor)) {
+    throw new InvalidCursorError();
+  }
+  return cursor;
+}
+
 // src/shipping/repo.ts
 import { and, asc, eq, notInArray } from "drizzle-orm";
 
@@ -242,7 +264,16 @@ async function setShippingRates(db, rates) {
 import { Readable } from "stream";
 
 // src/admin/repo.ts
-import { asc as asc2, eq as eq2, inArray, sql as sql2 } from "drizzle-orm";
+import {
+  and as and2,
+  asc as asc2,
+  eq as eq2,
+  gt,
+  ilike,
+  inArray,
+  or,
+  sql as sql2
+} from "drizzle-orm";
 async function withImages(db, rows) {
   if (rows.length === 0) return [];
   const images = await db.select().from(productImages).where(
@@ -256,9 +287,42 @@ async function withImages(db, rows) {
     images: images.filter((i) => i.productId === row.id)
   }));
 }
-async function listAllProducts(db) {
-  const rows = await db.select().from(products).orderBy(asc2(products.createdAt), asc2(products.slug));
-  return withImages(db, rows);
+function escapeLike(value) {
+  return value.replace(/[\\%_]/g, (c) => `\\${c}`);
+}
+function pageConditions(filter) {
+  const parts = [];
+  if (filter.status) parts.push(eq2(products.status, filter.status));
+  if (filter.stock === "in") parts.push(gt(products.quantity, 0));
+  if (filter.stock === "sold") parts.push(eq2(products.quantity, 0));
+  if (filter.q) parts.push(ilike(products.name, `%${escapeLike(filter.q)}%`));
+  if (filter.after) {
+    const createdAt = sql2`${filter.after.createdAt}::timestamptz`;
+    parts.push(
+      or(
+        gt(products.createdAt, createdAt),
+        and2(
+          eq2(products.createdAt, createdAt),
+          gt(products.slug, filter.after.slug)
+        )
+      )
+    );
+  }
+  return and2(...parts);
+}
+async function selectProductPage(db, filter) {
+  const selected = await db.select({
+    product: products,
+    createdAtKey: sql2`${products.createdAt}::text`
+  }).from(products).where(pageConditions(filter)).orderBy(asc2(products.createdAt), asc2(products.slug)).limit(filter.limit);
+  const records = await withImages(
+    db,
+    selected.map((s) => s.product)
+  );
+  return records.map((r, i) => ({
+    ...r,
+    createdAtKey: selected[i].createdAtKey
+  }));
 }
 async function findProductById(db, id) {
   const rows = await db.select().from(products).where(eq2(products.id, id));
@@ -295,6 +359,7 @@ async function setImagePosition(db, id, position) {
 // src/admin/service.ts
 import {
   adminProductInputSchema,
+  adminProductListQuerySchema,
   adminProductPatchSchema
 } from "@develemit/commerce-contracts";
 
@@ -338,8 +403,25 @@ async function requireProduct(db, id) {
   if (!found) throw new ProductNotFoundError(id);
   return found;
 }
-async function listAdminProducts(db) {
-  return (await listAllProducts(db)).map(toAdminProduct);
+function decodeProductCursor(raw) {
+  const { at, key } = decodeCursor(raw, ({ at: at2 }) => PG_TIMESTAMP.test(at2));
+  return { createdAt: at, slug: key };
+}
+async function listAdminProducts(db, rawQuery = {}) {
+  const query = adminProductListQuerySchema.parse(rawQuery);
+  const found = await selectProductPage(db, {
+    status: query.status,
+    stock: query.stock,
+    q: query.q,
+    after: query.cursor ? decodeProductCursor(query.cursor) : void 0,
+    limit: query.limit + 1
+  });
+  const page = found.slice(0, query.limit);
+  const last = page[page.length - 1];
+  return {
+    items: page.map(toAdminProduct),
+    nextCursor: found.length > query.limit && last ? encodeCursor({ at: last.createdAtKey, key: last.row.slug }) : null
+  };
 }
 async function getAdminProduct(db, id) {
   return toAdminProduct(await requireProduct(db, id));
@@ -473,7 +555,7 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
     if (err instanceof ProductNotFoundError || err instanceof ProductImageNotFoundError) {
       return reply.code(404).send({ error: err.code, message: err.message });
     }
-    if (err instanceof InvalidImageError || err instanceof InvalidImageOrderError) {
+    if (err instanceof InvalidCursorError || err instanceof InvalidImageError || err instanceof InvalidImageOrderError) {
       return reply.code(400).send({ error: err.code, message: err.message });
     }
     if (err.code === "FST_REQ_FILE_TOO_LARGE") {
@@ -488,7 +570,9 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
   });
   app.get(
     "/products",
-    async () => (await listAdminProducts(db)).map((p) => adminProductSchema.parse(p))
+    async (req) => adminProductPageSchema.parse(
+      await listAdminProducts(db, req.query)
+    )
   );
   app.post("/products", async (req, reply) => {
     const input = adminProductInputSchema2.parse(req.body);
@@ -544,12 +628,46 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
 // src/catalog/routes.ts
 import {
   categorySchema,
+  productCardPageSchema,
   productListQuerySchema,
   productSchema
 } from "@develemit/commerce-contracts";
 
+// src/catalog/cache-hooks.ts
+import { createHash } from "crypto";
+var DEFAULT_CATALOG_CACHE_CONTROL = "public, max-age=30, stale-while-revalidate=300";
+function etagOf(body) {
+  return `"${createHash("sha1").update(body).digest("base64url")}"`;
+}
+function matchesIfNoneMatch(header, etag) {
+  if (!header) return false;
+  if (header.trim() === "*") return true;
+  return header.split(",").map((t) => t.trim().replace(/^W\//, "")).includes(etag);
+}
+function addCatalogCaching(app, { cacheControl = DEFAULT_CATALOG_CACHE_CONTROL } = {}) {
+  app.addHook("onSend", async (req, reply, payload) => {
+    if (reply.statusCode >= 400) {
+      reply.header("cache-control", "no-store");
+      return payload;
+    }
+    if (reply.statusCode !== 200 || typeof payload !== "string") {
+      return payload;
+    }
+    const etag = etagOf(payload);
+    reply.header("etag", etag);
+    if (cacheControl !== false) reply.header("cache-control", cacheControl);
+    if (matchesIfNoneMatch(req.headers["if-none-match"], etag)) {
+      reply.code(304);
+      reply.removeHeader("content-length");
+      reply.removeHeader("content-type");
+      return "";
+    }
+    return payload;
+  });
+}
+
 // src/inventory/repo.ts
-import { and as and2, asc as asc3, eq as eq3, gt, inArray as inArray2, lt, sql as sql3 } from "drizzle-orm";
+import { and as and3, asc as asc3, eq as eq3, gt as gt2, inArray as inArray2, lt, sql as sql3 } from "drizzle-orm";
 async function lockProductQuantities(tx, productIds) {
   const rows = await tx.select({ id: products.id, quantity: products.quantity }).from(products).where(inArray2(products.id, productIds)).orderBy(asc3(products.id)).for("update");
   return new Map(rows.map((r) => [r.id, r.quantity]));
@@ -560,10 +678,10 @@ async function activeHeldQuantities(db, productIds) {
     productId: inventoryHolds.productId,
     held: sql3`sum(${inventoryHolds.quantity})::int`
   }).from(inventoryHolds).where(
-    and2(
+    and3(
       inArray2(inventoryHolds.productId, productIds),
       eq3(inventoryHolds.status, "active"),
-      gt(inventoryHolds.expiresAt, sql3`now()`)
+      gt2(inventoryHolds.expiresAt, sql3`now()`)
     )
   ).groupBy(inventoryHolds.productId);
   return new Map(rows.map((r) => [r.productId, r.held]));
@@ -585,7 +703,7 @@ async function insertHolds(tx, reference, items, expiresAt) {
 }
 async function releaseHolds(db, reference) {
   await db.update(inventoryHolds).set({ status: "released" }).where(
-    and2(
+    and3(
       eq3(inventoryHolds.reference, reference),
       eq3(inventoryHolds.status, "active")
     )
@@ -597,7 +715,7 @@ async function uncommittedHolds(tx, reference) {
     quantity: inventoryHolds.quantity,
     lapsed: sql3`(${inventoryHolds.status} = 'released' or ${inventoryHolds.expiresAt} <= now())`
   }).from(inventoryHolds).where(
-    and2(
+    and3(
       eq3(inventoryHolds.reference, reference),
       inArray2(inventoryHolds.status, ["active", "released"])
     )
@@ -605,7 +723,7 @@ async function uncommittedHolds(tx, reference) {
 }
 async function markHoldsCommitted(tx, reference) {
   await tx.update(inventoryHolds).set({ status: "committed" }).where(
-    and2(
+    and3(
       eq3(inventoryHolds.reference, reference),
       inArray2(inventoryHolds.status, ["active", "released"])
     )
@@ -613,10 +731,10 @@ async function markHoldsCommitted(tx, reference) {
 }
 async function extendActiveHolds(db, reference, expiresAt) {
   await db.update(inventoryHolds).set({ expiresAt }).where(
-    and2(
+    and3(
       eq3(inventoryHolds.reference, reference),
       eq3(inventoryHolds.status, "active"),
-      gt(inventoryHolds.expiresAt, sql3`now()`)
+      gt2(inventoryHolds.expiresAt, sql3`now()`)
     )
   );
 }
@@ -634,7 +752,7 @@ async function incrementQuantity(tx, productId, quantity) {
 }
 async function releaseExpiredHolds(db) {
   const released = await db.update(inventoryHolds).set({ status: "released" }).where(
-    and2(
+    and3(
       eq3(inventoryHolds.status, "active"),
       lt(inventoryHolds.expiresAt, sql3`now()`)
     )
@@ -741,15 +859,14 @@ async function restock(tx, items) {
 }
 
 // src/catalog/repo.ts
-import { and as and3, asc as asc4, eq as eq4, inArray as inArray3, sql as sql4 } from "drizzle-orm";
-async function attachImages(db, rows) {
+import { and as and4, asc as asc4, eq as eq4, gt as gt3, inArray as inArray3, or as or2, sql as sql4 } from "drizzle-orm";
+async function attachImages(db, rows, firstOnly = false) {
   if (rows.length === 0) return [];
-  const images = await db.select().from(productImages).where(
-    inArray3(
-      productImages.productId,
-      rows.map((r) => r.id)
-    )
-  ).orderBy(asc4(productImages.position));
+  const where = inArray3(
+    productImages.productId,
+    rows.map((r) => r.id)
+  );
+  const images = firstOnly ? await db.selectDistinctOn([productImages.productId]).from(productImages).where(where).orderBy(productImages.productId, asc4(productImages.position)) : await db.select().from(productImages).where(where).orderBy(asc4(productImages.position));
   return rows.map((row) => ({
     row,
     images: images.filter((i) => i.productId === row.id)
@@ -760,11 +877,34 @@ async function listActiveProducts(db, filter) {
   if (filter.category) conditions2.push(eq4(products.category, filter.category));
   if (filter.featured !== void 0)
     conditions2.push(eq4(products.featured, filter.featured));
-  const rows = await db.select().from(products).where(and3(...conditions2)).orderBy(asc4(products.createdAt), asc4(products.slug));
-  return attachImages(db, rows);
+  if (filter.after) {
+    const createdAt = sql4`${filter.after.createdAt}::timestamptz`;
+    conditions2.push(
+      or2(
+        gt3(products.createdAt, createdAt),
+        and4(
+          eq4(products.createdAt, createdAt),
+          gt3(products.slug, filter.after.slug)
+        )
+      )
+    );
+  }
+  const selected = await db.select({
+    product: products,
+    createdAtKey: sql4`${products.createdAt}::text`
+  }).from(products).where(and4(...conditions2)).orderBy(asc4(products.createdAt), asc4(products.slug)).limit(filter.limit + 1);
+  const withImages2 = await attachImages(
+    db,
+    selected.map((s) => s.product),
+    true
+  );
+  return withImages2.map((p, i) => ({
+    ...p,
+    createdAtKey: selected[i].createdAtKey
+  }));
 }
 async function findActiveProductBySlug(db, slug) {
-  const rows = await db.select().from(products).where(and3(eq4(products.slug, slug), eq4(products.status, "active"))).limit(1);
+  const rows = await db.select().from(products).where(and4(eq4(products.slug, slug), eq4(products.status, "active"))).limit(1);
   return (await attachImages(db, rows))[0];
 }
 async function countActiveByCategory(db) {
@@ -776,7 +916,7 @@ async function countActiveByCategory(db) {
 }
 async function findActiveProductsByIds(db, ids) {
   if (ids.length === 0) return [];
-  return db.select().from(products).where(and3(inArray3(products.id, ids), eq4(products.status, "active")));
+  return db.select().from(products).where(and4(inArray3(products.id, ids), eq4(products.status, "active")));
 }
 
 // src/catalog/service.ts
@@ -802,17 +942,34 @@ function toProduct({ row, images }, free) {
     featured: row.featured
   };
 }
+function toCard(product) {
+  const { description, materials, dimensions, ...card } = product;
+  void [description, materials, dimensions];
+  return card;
+}
 function labelFor(slug, labels) {
   const label = typeof labels === "function" ? labels(slug) : labels?.[slug];
   return label ?? slug;
 }
+function decodeProductCursor2(raw) {
+  const { at, key } = decodeCursor(raw, ({ at: at2 }) => PG_TIMESTAMP.test(at2));
+  return { createdAt: at, slug: key };
+}
 async function listProducts(db, filter) {
-  const found = await listActiveProducts(db, filter);
+  const found = await listActiveProducts(db, {
+    ...filter,
+    after: filter.cursor ? decodeProductCursor2(filter.cursor) : void 0
+  });
+  const page = found.slice(0, filter.limit);
+  const last = page[page.length - 1];
   const free = await freeQuantity(
     db,
-    found.map((p) => p.row.id)
+    page.map((p) => p.row.id)
   );
-  return found.map((p) => toProduct(p, free));
+  return {
+    items: page.map((p) => toCard(toProduct(p, free))),
+    nextCursor: found.length > filter.limit && last ? encodeCursor({ at: last.createdAtKey ?? "", key: last.row.slug }) : null
+  };
 }
 async function getProduct(db, slug) {
   const found = await findActiveProductBySlug(db, slug);
@@ -837,24 +994,29 @@ async function findPurchasable(db, ids) {
 }
 
 // src/catalog/routes.ts
-var catalogPlugin = async (app, { db, categoryLabels }) => {
+var catalogPlugin = async (app, { db, categoryLabels, catalogCache }) => {
+  addCatalogCaching(app, catalogCache);
   app.setErrorHandler((err, _req, reply) => {
     if (err instanceof ProductNotFoundError) {
       return reply.code(404).send({ error: err.code, message: err.message });
     }
+    if (err instanceof InvalidCursorError) {
+      return reply.code(400).send({ error: err.code, message: err.message });
+    }
     return reply.send(err);
   });
   app.get("/products", async (req, reply) => {
     const raw = req.query;
     const parsed = productListQuerySchema.safeParse({
       category: raw.category || void 0,
-      featured: raw.featured === void 0 ? void 0 : raw.featured === "true"
+      featured: raw.featured === void 0 ? void 0 : raw.featured === "true",
+      limit: raw.limit,
+      cursor: raw.cursor || void 0
     });
     if (!parsed.success) {
       return reply.code(400).send({ error: "INVALID_QUERY" });
     }
-    const products2 = await listProducts(db, parsed.data);
-    return products2.map((p) => productSchema.parse(p));
+    return productCardPageSchema.parse(await listProducts(db, parsed.data));
   });
   app.get("/products/:slug", async (req) => {
     return productSchema.parse(await getProduct(db, req.params.slug));
@@ -874,8 +1036,8 @@ import {
 } from "@develemit/commerce-contracts";
 
 // src/orders/admin-repo.ts
-import { and as and4, desc, eq as eq5, ilike, lt as lt2, or, sql as sql5 } from "drizzle-orm";
-function escapeLike(value) {
+import { and as and5, desc, eq as eq5, ilike as ilike2, lt as lt2, or as or3, sql as sql5 } from "drizzle-orm";
+function escapeLike2(value) {
   return value.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
 function conditions(filter) {
@@ -890,21 +1052,21 @@ function conditions(filter) {
     parts.push(filter.hasPendingRefund ? pending : sql5`not ${pending}`);
   }
   if (filter.q) {
-    const prefix = `${escapeLike(filter.q)}%`;
+    const prefix = `${escapeLike2(filter.q)}%`;
     parts.push(
-      or(ilike(orders.email, prefix), sql5`${orders.id}::text ilike ${prefix}`)
+      or3(ilike2(orders.email, prefix), sql5`${orders.id}::text ilike ${prefix}`)
     );
   }
   if (filter.after) {
     const { createdAt, id } = filter.after;
     parts.push(
-      or(
+      or3(
         lt2(orders.createdAt, createdAt),
-        and4(eq5(orders.createdAt, createdAt), lt2(orders.id, id))
+        and5(eq5(orders.createdAt, createdAt), lt2(orders.id, id))
       )
     );
   }
-  return and4(...parts);
+  return and5(...parts);
 }
 async function selectOrderPage(db, filter) {
   const itemCount = sql5`coalesce((
@@ -926,11 +1088,11 @@ async function findOrderRefunds(db, orderId) {
 }
 
 // src/orders/repo.ts
-import { and as and6, asc as asc5, eq as eq7, sql as sql7 } from "drizzle-orm";
+import { and as and7, asc as asc5, eq as eq7, sql as sql7 } from "drizzle-orm";
 
 // src/orders/refund-repo.ts
-import { and as and5, eq as eq6, isNotNull, isNull, or as or2, sql as sql6 } from "drizzle-orm";
-var isRecordedRefund = or2(
+import { and as and6, eq as eq6, isNotNull, isNull, or as or4, sql as sql6 } from "drizzle-orm";
+var isRecordedRefund = or4(
   isNull(orderRefunds.idempotencyKey),
   isNotNull(orderRefunds.gatewayRefundId)
 );
@@ -951,7 +1113,7 @@ async function sumReservedCents(tx, orderId) {
 }
 async function findRefundByKey(tx, orderId, idempotencyKey2) {
   const [row] = await tx.select().from(orderRefunds).where(
-    and5(
+    and6(
       eq6(orderRefunds.orderId, orderId),
       eq6(orderRefunds.idempotencyKey, idempotencyKey2)
     )
@@ -963,7 +1125,7 @@ async function insertPendingRefund(tx, refund) {
   return row;
 }
 async function deletePendingRefund(db, id) {
-  await db.delete(orderRefunds).where(and5(eq6(orderRefunds.id, id), isNull(orderRefunds.gatewayRefundId)));
+  await db.delete(orderRefunds).where(and6(eq6(orderRefunds.id, id), isNull(orderRefunds.gatewayRefundId)));
 }
 async function confirmRefund(tx, pending, gatewayRefundId) {
   const [existing] = await tx.select({ id: orderRefunds.id }).from(orderRefunds).where(eq6(orderRefunds.gatewayRefundId, gatewayRefundId));
@@ -972,7 +1134,7 @@ async function confirmRefund(tx, pending, gatewayRefundId) {
     return void 0;
   }
   const [updated] = await tx.update(orderRefunds).set({ gatewayRefundId }).where(
-    and5(
+    and6(
       eq6(orderRefunds.id, pending.id),
       isNull(orderRefunds.gatewayRefundId)
     )
@@ -998,7 +1160,7 @@ async function confirmPendingByKey(tx, orderId, scopedKey, gatewayRefundId) {
   const prefix = `${orderId}:`;
   if (!scopedKey.startsWith(prefix)) return void 0;
   const [updated] = await tx.update(orderRefunds).set({ gatewayRefundId }).where(
-    and5(
+    and6(
       eq6(orderRefunds.orderId, orderId),
       eq6(orderRefunds.idempotencyKey, scopedKey.slice(prefix.length)),
       isNull(orderRefunds.gatewayRefundId)
@@ -1050,7 +1212,7 @@ async function recordEvent(db, id, type) {
 async function sumRefundedCents(db, orderId) {
   const [row] = await db.select({
     total: sql7`coalesce(sum(${orderRefunds.amountCents}), 0)::int`
-  }).from(orderRefunds).where(and6(eq7(orderRefunds.orderId, orderId), isRecordedRefund));
+  }).from(orderRefunds).where(and7(eq7(orderRefunds.orderId, orderId), isRecordedRefund));
   return row.total;
 }
 
@@ -1100,13 +1262,6 @@ async function detailById(db, orderId) {
 
 // src/orders/admin-service.ts
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var InvalidCursorError = class extends Error {
-  code = "INVALID_CURSOR";
-  constructor() {
-    super("The cursor is malformed");
-    this.name = "InvalidCursorError";
-  }
-};
 var InvalidOrderIdError = class extends Error {
   code = "INVALID_ORDER_ID";
   constructor() {
@@ -1137,30 +1292,26 @@ function toOrderRefund(row) {
 function isOrderId(value) {
   return UUID.test(value);
 }
-function encodeCursor(createdAt, id) {
-  return Buffer.from(`${createdAt.toISOString()}|${id}`).toString("base64url");
-}
-function decodeCursor(cursor) {
-  const [iso, id, ...rest] = Buffer.from(cursor, "base64url").toString("utf8").split("|");
-  const createdAt = new Date(iso ?? "");
-  if (rest.length || !id || !isOrderId(id) || Number.isNaN(+createdAt)) {
-    throw new InvalidCursorError();
-  }
-  return { createdAt, id };
+function decodeOrderCursor(raw) {
+  const { at, key } = decodeCursor(
+    raw,
+    (c) => isOrderId(c.key) && !Number.isNaN(+new Date(c.at))
+  );
+  return { createdAt: new Date(at), id: key };
 }
 async function listAdminOrders(db, query) {
   const rows = await selectOrderPage(db, {
     status: query.status,
     q: query.q,
     hasPendingRefund: query.hasPendingRefund,
-    after: query.cursor ? decodeCursor(query.cursor) : void 0,
+    after: query.cursor ? decodeOrderCursor(query.cursor) : void 0,
     limit: query.limit + 1
   });
   const page = rows.slice(0, query.limit);
   const last = page[page.length - 1];
   return {
     items: page.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
-    nextCursor: rows.length > query.limit && last ? encodeCursor(last.createdAt, last.id) : null
+    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAt.toISOString(), key: last.id }) : null
   };
 }
 async function getAdminOrder(db, id) {
@@ -1838,12 +1989,14 @@ var commercePlugin = async (app, {
   shippingCountries = ["US"],
   hooks,
   admin,
-  categoryLabels
+  categoryLabels,
+  catalogCache
 }) => {
   app.get("/health", async () => ({ status: "ok" }));
   await app.register(catalogPlugin, {
     db,
     categoryLabels,
+    catalogCache,
     prefix: "/catalog"
   });
   if (admin) {