@develemit/commerce-server 0.3.0 → 0.6.0

package/dist/index.js

@@ -4,6 +4,7 @@ import {
   adminProductPatchSchema as adminProductPatchSchema2,
   adminProductPageSchema,
   imageOrderInputSchema,
+  productImagePatchSchema,
   shippingRatesInputSchema
 } from "@develemit/commerce-contracts";
 
@@ -27,6 +28,9 @@ var InvalidCursorError = class extends Error {
   }
 };
 var PG_TIMESTAMP = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?[+-]\d{2}(:?\d{2})?$/;
+function isCursorTimestamp(at) {
+  return PG_TIMESTAMP.test(at) || !Number.isNaN(Date.parse(at));
+}
 function encodeCursor({ at, key }) {
   return Buffer.from(`${at}|${key}`).toString("base64url");
 }
@@ -130,6 +134,8 @@ var orders = pgTable("commerce_orders", {
   status: orderStatus("status").notNull().default("pending"),
   email: text("email"),
   subtotalCents: integer("subtotal_cents").notNull(),
+  discountCents: integer("discount_cents").notNull().default(0),
+  discountCode: text("discount_code"),
   shippingCents: integer("shipping_cents").notNull().default(0),
   shippingLabel: text("shipping_label"),
   currency: text("currency").notNull(),
@@ -194,6 +200,69 @@ var shippingRates = pgTable(
     check("commerce_shipping_rates_amount_check", sql`${t.amountCents} >= 0`)
   ]
 );
+var discounts = pgTable(
+  "commerce_discounts",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    code: text("code").notNull().unique(),
+    type: text("type", { enum: ["percent", "fixed"] }).notNull(),
+    percentOff: integer("percent_off"),
+    amountOffCents: integer("amount_off_cents"),
+    currency: text("currency"),
+    minSubtotalCents: integer("min_subtotal_cents"),
+    startsAt: timestamp("starts_at", { withTimezone: true }),
+    endsAt: timestamp("ends_at", { withTimezone: true }),
+    maxRedemptions: integer("max_redemptions"),
+    active: boolean("active").notNull().default(true),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (t) => [
+    check("commerce_discounts_code_check", sql`${t.code} = upper(${t.code})`),
+    check(
+      "commerce_discounts_percent_check",
+      sql`${t.percentOff} is null or (${t.percentOff} between 1 and 100)`
+    ),
+    check(
+      "commerce_discounts_amount_check",
+      sql`${t.amountOffCents} is null or ${t.amountOffCents} > 0`
+    ),
+    check(
+      "commerce_discounts_max_redemptions_check",
+      sql`${t.maxRedemptions} is null or ${t.maxRedemptions} > 0`
+    ),
+    check(
+      "commerce_discounts_type_fields_check",
+      sql`(${t.type} = 'percent' and ${t.percentOff} is not null and ${t.amountOffCents} is null and ${t.currency} is null) or (${t.type} = 'fixed' and ${t.percentOff} is null and ${t.amountOffCents} is not null and ${t.currency} is not null)`
+    )
+  ]
+);
+var discountRedemptions = pgTable(
+  "commerce_discount_redemptions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    discountId: uuid("discount_id").notNull().references(() => discounts.id, { onDelete: "cascade" }),
+    orderId: uuid("order_id").notNull().unique().references(() => orders.id, { onDelete: "cascade" }),
+    status: text("status", { enum: ["reserved", "committed", "released"] }).notNull().default("reserved"),
+    amountCents: integer("amount_cents").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (t) => [
+    check(
+      "commerce_discount_redemptions_amount_check",
+      sql`${t.amountCents} > 0`
+    ),
+    check(
+      "commerce_discount_redemptions_status_check",
+      sql`${t.status} in ('reserved', 'committed', 'released')`
+    ),
+    index("commerce_discount_redemptions_discount_status_idx").on(
+      t.discountId,
+      t.status
+    )
+  ]
+);
 var commerceSchema = {
   products,
   productImages,
@@ -205,7 +274,9 @@ var commerceSchema = {
   orderStatus,
   orderRefunds,
   stripeEvents,
-  shippingRates
+  shippingRates,
+  discounts,
+  discountRedemptions
 };
 
 // src/shipping/repo.ts
@@ -355,6 +426,9 @@ async function deleteImageRow(db, id) {
 async function setImagePosition(db, id, position) {
   await db.update(productImages).set({ position }).where(eq2(productImages.id, id));
 }
+async function setImageAlt(db, id, alt) {
+  await db.update(productImages).set({ alt }).where(eq2(productImages.id, id));
+}
 
 // src/admin/service.ts
 import {
@@ -538,6 +612,14 @@ async function removeProductImage(db, storage, productId, imageId) {
   if (image.storageKey) await storage.delete(image.storageKey);
   return getAdminProduct(db, productId);
 }
+async function updateProductImageAlt(db, productId, imageId, alt) {
+  const { images } = await requireProduct(db, productId);
+  if (!images.some((i) => i.id === imageId)) {
+    throw new ProductImageNotFoundError(imageId);
+  }
+  await setImageAlt(db, imageId, alt);
+  return getAdminProduct(db, productId);
+}
 
 // src/admin/routes.ts
 function isZodError(err) {
@@ -598,7 +680,7 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
       if (!part) throw new InvalidImageError("An image file is required");
       const bytes = await part.toBuffer();
       const fields = part.fields;
-      const alt = typeof fields.alt?.value === "string" ? fields.alt.value : void 0;
+      const alt = typeof fields.alt?.value === "string" ? productImagePatchSchema.parse({ alt: fields.alt.value }).alt : void 0;
       const product = await addProductImage(db, storage, req.params.id, {
         bytes,
         alt
@@ -614,6 +696,15 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
       imageOrderInputSchema.parse(req.body).imageIds
     )
   );
+  app.patch(
+    "/products/:id/images/:imageId",
+    async (req) => updateProductImageAlt(
+      db,
+      req.params.id,
+      req.params.imageId,
+      productImagePatchSchema.parse(req.body).alt
+    )
+  );
   app.delete(
     "/products/:id/images/:imageId",
     async (req) => removeProductImage(db, storage, req.params.id, req.params.imageId)
@@ -756,8 +847,8 @@ async function releaseExpiredHolds(db) {
       eq3(inventoryHolds.status, "active"),
       lt(inventoryHolds.expiresAt, sql3`now()`)
     )
-  ).returning({ id: inventoryHolds.id });
-  return released.length;
+  ).returning({ reference: inventoryHolds.reference });
+  return released.map((r) => r.reference);
 }
 
 // src/inventory/types.ts
@@ -812,8 +903,8 @@ async function reserve(db, { reference, items, expiresAt }) {
 async function release(db, reference) {
   await releaseHolds(db, reference);
 }
-async function releaseExpired(db) {
-  return releaseExpiredHolds(db);
+async function releaseExpiredReferences(db) {
+  return [...new Set(await releaseExpiredHolds(db))];
 }
 async function commitWithin(tx, reference) {
   const holds = await uncommittedHolds(tx, reference);
@@ -1058,7 +1149,8 @@ function conditions(filter) {
     );
   }
   if (filter.after) {
-    const { createdAt, id } = filter.after;
+    const { id } = filter.after;
+    const createdAt = sql5`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or3(
         lt2(orders.createdAt, createdAt),
@@ -1077,10 +1169,11 @@ async function selectOrderPage(db, filter) {
     id: orders.id,
     status: orders.status,
     email: orders.email,
-    totalCents: sql5`${orders.subtotalCents} + ${orders.shippingCents}`,
+    totalCents: sql5`${orders.subtotalCents} - ${orders.discountCents} + ${orders.shippingCents}`,
     currency: orders.currency,
     itemCount,
-    createdAt: orders.createdAt
+    createdAt: orders.createdAt,
+    createdAtKey: sql5`${orders.createdAt}::text`
   }).from(orders).where(conditions(filter)).orderBy(desc(orders.createdAt), desc(orders.id)).limit(filter.limit);
 }
 async function findOrderRefunds(db, orderId) {
@@ -1099,7 +1192,7 @@ var isRecordedRefund = or4(
 async function lockOrderForRefund(tx, id) {
   const [row] = await tx.select({
     status: orders.status,
-    totalCents: sql6`${orders.subtotalCents} + ${orders.shippingCents}`,
+    totalCents: sql6`${orders.subtotalCents} - ${orders.discountCents} + ${orders.shippingCents}`,
     currency: orders.currency,
     checkoutSessionId: orders.checkoutSessionId
   }).from(orders).where(eq6(orders.id, id)).for("update");
@@ -1232,9 +1325,11 @@ async function toSummary(db, order) {
     id: order.id,
     status: order.status,
     subtotalCents: order.subtotalCents,
+    discountCents: order.discountCents,
+    discountCode: order.discountCode,
     shippingCents: order.shippingCents,
     shippingLabel: order.shippingLabel,
-    totalCents: order.subtotalCents + order.shippingCents,
+    totalCents: order.subtotalCents - order.discountCents + order.shippingCents,
     currency: order.currency,
     items: items.map((i) => ({
       productId: i.productId,
@@ -1295,9 +1390,9 @@ function isOrderId(value) {
 function decodeOrderCursor(raw) {
   const { at, key } = decodeCursor(
     raw,
-    (c) => isOrderId(c.key) && !Number.isNaN(+new Date(c.at))
+    (c) => isOrderId(c.key) && isCursorTimestamp(c.at)
   );
-  return { createdAt: new Date(at), id: key };
+  return { createdAt: at, id: key };
 }
 async function listAdminOrders(db, query) {
   const rows = await selectOrderPage(db, {
@@ -1310,8 +1405,16 @@ async function listAdminOrders(db, query) {
   const page = rows.slice(0, query.limit);
   const last = page[page.length - 1];
   return {
-    items: page.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
-    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAt.toISOString(), key: last.id }) : null
+    items: page.map((r) => ({
+      id: r.id,
+      status: r.status,
+      email: r.email,
+      totalCents: r.totalCents,
+      currency: r.currency,
+      itemCount: r.itemCount,
+      createdAt: r.createdAt.toISOString()
+    })),
+    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAtKey, key: last.id }) : null
   };
 }
 async function getAdminOrder(db, id) {
@@ -1380,6 +1483,193 @@ var RefundOutcomeUnknownError = class extends Error {
   }
 };
 
+// src/discounts/evaluate.ts
+function rejection(reason) {
+  return { ok: false, reason };
+}
+function discountAmount(discount, subtotalCents) {
+  if (discount.type === "percent") {
+    return Math.floor(subtotalCents * (discount.percentOff ?? 0) / 100);
+  }
+  return Math.min(discount.amountOffCents ?? 0, subtotalCents);
+}
+function evaluateDiscount(discount, ctx) {
+  if (!discount) return rejection("not_found");
+  if (!discount.active) return rejection("inactive");
+  if (discount.startsAt && ctx.now < discount.startsAt) {
+    return rejection("not_started");
+  }
+  if (discount.endsAt && ctx.now >= discount.endsAt) {
+    return rejection("expired");
+  }
+  if (discount.type === "fixed" && discount.currency !== ctx.currency) {
+    return rejection("currency");
+  }
+  if (discount.minSubtotalCents !== null && ctx.subtotalCents < discount.minSubtotalCents) {
+    return rejection("min_subtotal");
+  }
+  if (discount.maxRedemptions !== null && ctx.activeRedemptions >= discount.maxRedemptions) {
+    return rejection("exhausted");
+  }
+  return {
+    ok: true,
+    discountCents: discountAmount(discount, ctx.subtotalCents)
+  };
+}
+
+// src/discounts/repo.ts
+import {
+  and as and8,
+  desc as desc2,
+  eq as eq8,
+  getTableColumns,
+  gt as gt4,
+  ilike as ilike3,
+  inArray as inArray4,
+  isNull as isNull2,
+  lt as lt3,
+  lte,
+  or as or5,
+  sql as sql8
+} from "drizzle-orm";
+async function findDiscountByCode(db, code, options = {}) {
+  const query = db.select().from(discounts).where(eq8(discounts.code, code));
+  const [row] = await (options.forUpdate ? query.for("update") : query);
+  return row;
+}
+async function countActiveRedemptions(db, discountId2) {
+  const [row] = await db.select({ n: sql8`count(*)::int` }).from(discountRedemptions).where(
+    and8(
+      eq8(discountRedemptions.discountId, discountId2),
+      inArray4(discountRedemptions.status, ["reserved", "committed"])
+    )
+  );
+  return row.n;
+}
+async function insertRedemption(db, redemption) {
+  await db.insert(discountRedemptions).values(redemption);
+}
+async function transitionRedemptions(db, orderIds, from, to) {
+  if (orderIds.length === 0) return;
+  await db.update(discountRedemptions).set({ status: to, updatedAt: sql8`now()` }).where(
+    and8(
+      inArray4(discountRedemptions.orderId, orderIds),
+      inArray4(discountRedemptions.status, from)
+    )
+  );
+}
+function escapeLike3(value) {
+  return value.replace(/[\\%_]/g, (c) => `\\${c}`);
+}
+function statusCondition(status, now) {
+  const started = or5(isNull2(discounts.startsAt), lte(discounts.startsAt, now));
+  const open = or5(isNull2(discounts.endsAt), gt4(discounts.endsAt, now));
+  if (status === "inactive") return eq8(discounts.active, false);
+  if (status === "scheduled") {
+    return and8(eq8(discounts.active, true), gt4(discounts.startsAt, now));
+  }
+  if (status === "expired") {
+    return and8(eq8(discounts.active, true), lte(discounts.endsAt, now));
+  }
+  return and8(eq8(discounts.active, true), started, open);
+}
+function listConditions(filter) {
+  const parts = [];
+  if (filter.status) parts.push(statusCondition(filter.status, filter.now));
+  if (filter.q) parts.push(ilike3(discounts.code, `${escapeLike3(filter.q)}%`));
+  if (filter.after) {
+    const { id } = filter.after;
+    const createdAt = sql8`${filter.after.createdAt}::timestamptz`;
+    parts.push(
+      or5(
+        lt3(discounts.createdAt, createdAt),
+        and8(eq8(discounts.createdAt, createdAt), lt3(discounts.id, id))
+      )
+    );
+  }
+  return and8(...parts);
+}
+function redemptionCount(status) {
+  const filter = status ? sql8`and r.status = ${status}` : sql8``;
+  return sql8`(
+    select count(*) from commerce_discount_redemptions r
+    where r.discount_id = commerce_discounts.id ${filter}
+  )::int`;
+}
+var withCounts = {
+  ...getTableColumns(discounts),
+  redeemedCount: redemptionCount("committed"),
+  reservedCount: redemptionCount("reserved"),
+  totalRedemptions: redemptionCount()
+};
+async function selectDiscountPage(db, filter) {
+  return db.select({
+    ...withCounts,
+    createdAtKey: sql8`${discounts.createdAt}::text`
+  }).from(discounts).where(listConditions(filter)).orderBy(desc2(discounts.createdAt), desc2(discounts.id)).limit(filter.limit);
+}
+async function findDiscountById(db, id, options = {}) {
+  const query = db.select(withCounts).from(discounts).where(eq8(discounts.id, id));
+  const [row] = await (options.forUpdate ? query.for("update") : query);
+  return row;
+}
+async function insertDiscount(db, values) {
+  const [row] = await db.insert(discounts).values(values).onConflictDoNothing({ target: discounts.code }).returning({ id: discounts.id });
+  return row?.id;
+}
+async function updateDiscount(db, id, values) {
+  await db.update(discounts).set({ ...values, updatedAt: sql8`now()` }).where(eq8(discounts.id, id));
+}
+
+// src/discounts/redemptions.ts
+var DiscountRejectedError = class extends Error {
+  constructor(reason) {
+    super(`Discount rejected: ${reason}`);
+    this.reason = reason;
+    this.name = "DiscountRejectedError";
+  }
+  reason;
+  code = "DISCOUNT_INVALID";
+};
+async function evaluateForCheckout(tx, { code, subtotalCents, currency, now = /* @__PURE__ */ new Date() }) {
+  const discount = await findDiscountByCode(tx, code, { forUpdate: true });
+  const result = evaluateDiscount(discount, {
+    subtotalCents,
+    currency,
+    now,
+    activeRedemptions: discount ? await countActiveRedemptions(tx, discount.id) : 0
+  });
+  if (!result.ok) {
+    throw new DiscountRejectedError(
+      result.reason === "inactive" ? "not_found" : result.reason
+    );
+  }
+  return {
+    code,
+    discountCents: result.discountCents,
+    discountId: discount.id
+  };
+}
+async function reserveRedemption(tx, orderId, applied) {
+  if (applied.discountCents === 0) return;
+  await insertRedemption(tx, {
+    discountId: applied.discountId,
+    orderId,
+    amountCents: applied.discountCents
+  });
+}
+async function commitRedemption(db, orderId) {
+  await transitionRedemptions(
+    db,
+    [orderId],
+    ["reserved", "released"],
+    "committed"
+  );
+}
+async function releaseRedemptions(db, orderIds) {
+  await transitionRedemptions(db, orderIds, ["reserved"], "released");
+}
+
 // src/payment/gateway.ts
 var RefundRejectedError = class extends Error {
   definitelyFailed = true;
@@ -1443,6 +1733,7 @@ async function applyGatewayRefunds(tx, order, refunds) {
   }
   if (SETTLES_AS_REFUNDED.has(locked.status) && await sumRefundedCents(tx, order.id) >= locked.totalCents) {
     await setOrderStatus(tx, order.id, "refunded");
+    await releaseRedemptions(tx, [order.id]);
   }
   return { outcome: "processed", hooks };
 }
@@ -1459,6 +1750,7 @@ async function settle(tx, order) {
     };
   }
   await setOrderStatus(tx, order.id, "paid");
+  await commitRedemption(tx, order.id);
   return { outcome: "processed", hooks: [["onOrderPaid", order.id]] };
 }
 async function completed(tx, order, event) {
@@ -1486,6 +1778,7 @@ async function applyToOrder(tx, order, event) {
       if (order.status !== "pending") return ignored;
       await setOrderStatus(tx, order.id, "cancelled");
       await release(tx, order.id);
+      await releaseRedemptions(tx, [order.id]);
       return {
         outcome: "processed",
         hooks: [["onOrderPaymentFailed", order.id]]
@@ -1494,6 +1787,7 @@ async function applyToOrder(tx, order, event) {
       if (order.status !== "pending") return ignored;
       await setOrderStatus(tx, order.id, "expired");
       await release(tx, order.id);
+      await releaseRedemptions(tx, [order.id]);
       return { outcome: "processed", hooks: [["onOrderExpired", order.id]] };
     case "payment.refunded":
       return applyGatewayRefunds(tx, order, event.refunds);
@@ -1572,7 +1866,7 @@ async function handlePaymentEvent(db, event, hooks = {}, log) {
 }
 
 // src/orders/ship-service.ts
-import { eq as eq8, sql as sql8 } from "drizzle-orm";
+import { eq as eq9, sql as sql9 } from "drizzle-orm";
 var InvalidOrderStateError = class extends Error {
   constructor(status) {
     super(`The order is ${status}`);
@@ -1584,7 +1878,7 @@ var InvalidOrderStateError = class extends Error {
 };
 async function applyShipment(db, id, input) {
   return db.transaction(async (tx) => {
-    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq8(orders.id, id)).for("update");
+    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq9(orders.id, id)).for("update");
     if (!row) throw new AdminOrderNotFoundError(id);
     if (row.status !== "paid" && row.status !== "shipped") {
       throw new InvalidOrderStateError(row.status);
@@ -1594,9 +1888,9 @@ async function applyShipment(db, id, input) {
       fulfillmentCarrier: input.carrier ?? null,
       fulfillmentTrackingNumber: input.trackingNumber ?? null,
       fulfillmentTrackingUrl: input.trackingUrl ?? null,
-      ...first && { status: "shipped", shippedAt: sql8`now()` },
-      updatedAt: sql8`now()`
-    }).where(eq8(orders.id, id));
+      ...first && { status: "shipped", shippedAt: sql9`now()` },
+      updatedAt: sql9`now()`
+    }).where(eq9(orders.id, id));
     return first;
   });
 }
@@ -1653,6 +1947,7 @@ async function recordRefund2(db, pending, gatewayRefundId) {
     }
     if (await sumRefundedCents(tx, refund.orderId) >= order.totalCents) {
       await setOrderStatus(tx, refund.orderId, "refunded");
+      await releaseRedemptions(tx, [refund.orderId]);
     }
     return refund;
   });
@@ -1687,10 +1982,10 @@ async function refundOrder(db, gateway, orderId, input, idempotencyKey2, hooks =
 }
 
 // src/orders/resolve-service.ts
-import { eq as eq9, sql as sql9 } from "drizzle-orm";
+import { eq as eq10, sql as sql10 } from "drizzle-orm";
 async function applyResolution(db, id) {
   await db.transaction(async (tx) => {
-    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq9(orders.id, id)).for("update");
+    const [row] = await tx.select({ status: orders.status }).from(orders).where(eq10(orders.id, id)).for("update");
     if (!row) throw new AdminOrderNotFoundError(id);
     if (row.status !== "needs_attention") {
       throw new InvalidOrderStateError(row.status);
@@ -1699,7 +1994,8 @@ async function applyResolution(db, id) {
     if (outcome.result === "unavailable") {
       throw new InsufficientStockError(outcome.shortProductIds);
     }
-    await tx.update(orders).set({ status: "paid", updatedAt: sql9`now()` }).where(eq9(orders.id, id));
+    await tx.update(orders).set({ status: "paid", updatedAt: sql10`now()` }).where(eq10(orders.id, id));
+    await commitRedemption(tx, id);
   });
 }
 async function resolveOrder(db, id, hooks = {}, log) {
@@ -1807,18 +2103,335 @@ var adminOrdersPlugin = async (app, { db, authorize, payment, hooks }) => {
   });
 };
 
+// src/discounts/admin-routes.ts
+import { adminDiscountListQuerySchema } from "@develemit/commerce-contracts";
+
+// src/discounts/admin-service.ts
+import {
+  discountInputSchema,
+  discountPatchSchema
+} from "@develemit/commerce-contracts";
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var LOCKED_AFTER_USE = [
+  "code",
+  "type",
+  "percentOff",
+  "amountOffCents",
+  "currency"
+];
+var DiscountNotFoundError = class extends Error {
+  code = "DISCOUNT_NOT_FOUND";
+  constructor(id) {
+    super(`No discount: ${id}`);
+    this.name = "DiscountNotFoundError";
+  }
+};
+var InvalidDiscountIdError = class extends Error {
+  code = "INVALID_DISCOUNT_ID";
+  constructor() {
+    super("The discount id is malformed");
+    this.name = "InvalidDiscountIdError";
+  }
+};
+var DiscountCodeTakenError = class extends Error {
+  code = "DISCOUNT_CODE_TAKEN";
+  constructor(code) {
+    super(`The code ${code} already exists`);
+    this.name = "DiscountCodeTakenError";
+  }
+};
+var DiscountInUseError = class extends Error {
+  constructor(fields) {
+    super(`A redeemed discount cannot change ${fields.join(", ")}`);
+    this.fields = fields;
+    this.name = "DiscountInUseError";
+  }
+  fields;
+  code = "DISCOUNT_IN_USE";
+};
+var MaxRedemptionsBelowUsageError = class extends Error {
+  constructor(usage) {
+    super(`maxRedemptions cannot be below the ${usage} already in use`);
+    this.usage = usage;
+    this.name = "MaxRedemptionsBelowUsageError";
+  }
+  usage;
+  code = "MAX_REDEMPTIONS_BELOW_USAGE";
+};
+var InvalidDiscountError = class extends Error {
+  code = "INVALID_INPUT";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidDiscountError";
+  }
+};
+function isDiscountId(value) {
+  return UUID2.test(value);
+}
+function parseDate(value) {
+  if (value === void 0 || value === null) return value;
+  const date = new Date(value);
+  if (Number.isNaN(+date)) throw new InvalidDiscountError("Invalid date");
+  return date;
+}
+function toDiscount(row) {
+  return {
+    id: row.id,
+    code: row.code,
+    type: row.type,
+    percentOff: row.percentOff,
+    amountOffCents: row.amountOffCents,
+    currency: row.currency,
+    minSubtotalCents: row.minSubtotalCents,
+    startsAt: row.startsAt?.toISOString() ?? null,
+    endsAt: row.endsAt?.toISOString() ?? null,
+    maxRedemptions: row.maxRedemptions,
+    active: row.active,
+    redeemedCount: row.redeemedCount,
+    reservedCount: row.reservedCount,
+    createdAt: row.createdAt.toISOString()
+  };
+}
+function decodeDiscountCursor(raw) {
+  const { at, key } = decodeCursor(
+    raw,
+    (c) => isDiscountId(c.key) && isCursorTimestamp(c.at)
+  );
+  return { createdAt: at, id: key };
+}
+async function listAdminDiscounts(db, query, now = /* @__PURE__ */ new Date()) {
+  const rows = await selectDiscountPage(db, {
+    status: query.status,
+    q: query.q,
+    now,
+    after: query.cursor ? decodeDiscountCursor(query.cursor) : void 0,
+    limit: query.limit + 1
+  });
+  const page = rows.slice(0, query.limit);
+  const last = page[page.length - 1];
+  return {
+    items: page.map(toDiscount),
+    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAtKey, key: last.id }) : null
+  };
+}
+async function getAdminDiscount(db, id) {
+  const row = await findDiscountById(db, id);
+  if (!row) throw new DiscountNotFoundError(id);
+  return toDiscount(row);
+}
+async function createDiscount(db, input) {
+  const data = discountInputSchema.parse(input);
+  const id = await insertDiscount(db, {
+    code: data.code,
+    type: data.type,
+    percentOff: data.percentOff ?? null,
+    amountOffCents: data.amountOffCents ?? null,
+    currency: data.currency ?? null,
+    minSubtotalCents: data.minSubtotalCents ?? null,
+    startsAt: parseDate(data.startsAt) ?? null,
+    endsAt: parseDate(data.endsAt) ?? null,
+    maxRedemptions: data.maxRedemptions ?? null,
+    active: data.active
+  });
+  if (!id) throw new DiscountCodeTakenError(data.code);
+  return getAdminDiscount(db, id);
+}
+function sameValue(a, b) {
+  if (typeof a === "string" && typeof b === "string") {
+    return a.toUpperCase() === b.toUpperCase();
+  }
+  return a === b;
+}
+function changedLockedFields(row, patch) {
+  return LOCKED_AFTER_USE.filter(
+    (field) => patch[field] !== void 0 && !sameValue(patch[field], row[field])
+  );
+}
+function assertCoherent(row, patch) {
+  const merged = discountInputSchema.safeParse({
+    code: row.code,
+    type: row.type,
+    percentOff: row.percentOff,
+    amountOffCents: row.amountOffCents,
+    currency: row.currency,
+    ...patch
+  });
+  if (!merged.success) {
+    throw new InvalidDiscountError(
+      merged.error.issues[0]?.message ?? "Invalid"
+    );
+  }
+}
+async function patchDiscount(db, id, rawPatch) {
+  const patch = discountPatchSchema.parse(rawPatch);
+  return db.transaction(async (tx) => {
+    const row = await findDiscountById(tx, id, { forUpdate: true });
+    if (!row) throw new DiscountNotFoundError(id);
+    const usage = row.redeemedCount + row.reservedCount;
+    const locked = changedLockedFields(row, patch);
+    if (row.totalRedemptions > 0 && locked.length > 0)
+      throw new DiscountInUseError(locked);
+    if (typeof patch.maxRedemptions === "number" && patch.maxRedemptions < usage) {
+      throw new MaxRedemptionsBelowUsageError(usage);
+    }
+    assertCoherent(row, patch);
+    try {
+      await updateDiscount(tx, id, {
+        code: patch.code,
+        type: patch.type,
+        percentOff: patch.percentOff,
+        amountOffCents: patch.amountOffCents,
+        currency: patch.currency,
+        minSubtotalCents: patch.minSubtotalCents,
+        startsAt: parseDate(patch.startsAt),
+        endsAt: parseDate(patch.endsAt),
+        maxRedemptions: patch.maxRedemptions,
+        active: patch.active
+      });
+    } catch (err) {
+      const cause = err.cause;
+      if ((cause ?? err).code === "23505") {
+        throw new DiscountCodeTakenError(patch.code ?? row.code);
+      }
+      throw err;
+    }
+    const updated = await findDiscountById(tx, id);
+    return toDiscount(updated);
+  });
+}
+
+// src/discounts/admin-routes.ts
+var BAD_REQUEST2 = [
+  InvalidCursorError,
+  InvalidDiscountIdError,
+  InvalidDiscountError,
+  MaxRedemptionsBelowUsageError
+];
+var CONFLICT = [DiscountCodeTakenError, DiscountInUseError];
+function isZodError3(err) {
+  return err instanceof Error && err.name === "ZodError";
+}
+function discountId(req) {
+  if (!isDiscountId(req.params.id)) throw new InvalidDiscountIdError();
+  return req.params.id;
+}
+var adminDiscountsPlugin = async (app, { db, authorize }) => {
+  app.setErrorHandler((err, _req, reply) => {
+    if (isZodError3(err)) {
+      return reply.code(400).send({ error: "INVALID_INPUT", issues: err.issues });
+    }
+    if (BAD_REQUEST2.some((type) => err instanceof type)) {
+      const { code, message } = err;
+      return reply.code(400).send({ error: code, message });
+    }
+    if (CONFLICT.some((type) => err instanceof type)) {
+      const { code, message } = err;
+      return reply.code(409).send({ error: code, message });
+    }
+    if (err instanceof DiscountNotFoundError) {
+      return reply.code(404).send({ error: err.code, message: err.message });
+    }
+    return reply.send(err);
+  });
+  app.addHook("preHandler", async (req, reply) => {
+    if (!await authorize(req)) {
+      return reply.code(401).send({ error: "UNAUTHORIZED" });
+    }
+  });
+  app.get(
+    "/",
+    async (req) => listAdminDiscounts(db, adminDiscountListQuerySchema.parse(req.query))
+  );
+  app.post("/", async (req, reply) => {
+    const created = await createDiscount(db, req.body ?? {});
+    return reply.code(201).send(created);
+  });
+  app.get(
+    "/:id",
+    async (req) => getAdminDiscount(db, discountId(req))
+  );
+  app.patch(
+    "/:id",
+    async (req) => patchDiscount(db, discountId(req), req.body ?? {})
+  );
+};
+
+// src/orders/dev-checkout.ts
+function assertDevCheckoutAllowed() {
+  if (process.env.NODE_ENV === "production") {
+    throw new Error("devCheckout is not allowed when NODE_ENV=production");
+  }
+}
+var devCheckoutRoutes = async (app, { db, payment, urls, hooks }) => {
+  assertDevCheckoutAllowed();
+  app.get("/checkout/dev/:sessionId/complete", async (req, reply) => {
+    const { sessionId } = req.params;
+    if (!payment.sessions.some((s) => s.id === sessionId)) {
+      return reply.code(404).send({ error: "SESSION_NOT_FOUND" });
+    }
+    const expire = req.query.outcome === "expired";
+    const { rawBody, signature } = expire ? payment.expired(sessionId) : payment.completed(sessionId);
+    const event = await payment.verifyWebhook(rawBody, signature);
+    await handlePaymentEvent(db, event, hooks, req.log);
+    return reply.redirect(expire ? urls.cancel : urls.success(sessionId), 302);
+  });
+};
+
 // src/orders/routes.ts
 import {
   checkoutConflictSchema,
+  discountPreviewRequestSchema,
+  discountPreviewSchema,
+  discountRejectionSchema,
   checkoutRequestSchema,
   checkoutResponseSchema,
   orderSummarySchema
 } from "@develemit/commerce-contracts";
 
+// src/discounts/service.ts
+var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function availableSubtotal(db, items, currency) {
+  const quantities = /* @__PURE__ */ new Map();
+  for (const { productId, quantity } of items) {
+    quantities.set(productId, (quantities.get(productId) ?? 0) + quantity);
+  }
+  const found = await findPurchasable(
+    db,
+    [...quantities.keys()].filter((id) => UUID3.test(id))
+  );
+  return found.filter((p) => p.currency === currency).reduce((sum, p) => sum + p.priceCents * quantities.get(p.id), 0);
+}
+async function previewDiscount(db, request, currency, now = /* @__PURE__ */ new Date()) {
+  const code = request.code.trim().toUpperCase();
+  const discount = await findDiscountByCode(db, code);
+  const subtotalCents = await availableSubtotal(db, request.items, currency);
+  const result = evaluateDiscount(discount, {
+    subtotalCents,
+    currency,
+    now,
+    activeRedemptions: discount ? await countActiveRedemptions(db, discount.id) : 0
+  });
+  if (!result.ok) {
+    return {
+      ok: false,
+      reason: result.reason === "inactive" ? "not_found" : result.reason
+    };
+  }
+  return {
+    ok: true,
+    preview: {
+      code,
+      discountCents: result.discountCents,
+      subtotalCents,
+      currency
+    }
+  };
+}
+
 // src/orders/checkout-service.ts
 import { randomUUID as randomUUID2 } from "crypto";
 var HOLD_DURATION_MS = 31 * 60 * 1e3;
-var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function mergeItems(items) {
   const merged = /* @__PURE__ */ new Map();
   for (const { productId, quantity } of items) {
@@ -1830,7 +2443,7 @@ async function priceLines(db, requests, currency) {
   const ids = requests.map((r) => r.productId);
   const found = await findPurchasable(
     db,
-    ids.filter((id) => UUID2.test(id))
+    ids.filter((id) => UUID4.test(id))
   );
   const byId = new Map(found.map((p) => [p.id, p]));
   const unavailable = ids.filter((id) => byId.get(id)?.currency !== currency);
@@ -1845,19 +2458,27 @@ async function priceLines(db, requests, currency) {
     };
   });
 }
-async function reserveOrder(db, orderId, lines, currency, expiresAt) {
+async function reserveOrder(db, { orderId, lines, currency, expiresAt, discountCode }) {
+  const subtotalCents = lines.reduce(
+    (sum, l) => sum + l.unitAmountCents * l.quantity,
+    0
+  );
   try {
-    await db.transaction(async (tx) => {
+    return await db.transaction(async (tx) => {
       await reserve(tx, { reference: orderId, items: lines, expiresAt });
+      const discount = discountCode === void 0 ? void 0 : await evaluateForCheckout(tx, {
+        code: discountCode,
+        subtotalCents,
+        currency
+      });
       await insertOrder(
         tx,
         {
           id: orderId,
           currency,
-          subtotalCents: lines.reduce(
-            (sum, l) => sum + l.unitAmountCents * l.quantity,
-            0
-          )
+          subtotalCents,
+          discountCents: discount?.discountCents ?? 0,
+          discountCode: discount?.code ?? null
         },
         lines.map((l) => ({
           productId: l.productId,
@@ -1866,6 +2487,8 @@ async function reserveOrder(db, orderId, lines, currency, expiresAt) {
           quantity: l.quantity
         }))
       );
+      if (discount) await reserveRedemption(tx, orderId, discount);
+      return discount;
     });
   } catch (err) {
     if (err instanceof InsufficientStockError) {
@@ -1883,7 +2506,13 @@ async function createCheckout(db, settings, request) {
   const shippingRates2 = await listActiveRates(db, settings.currency);
   const orderId = randomUUID2();
   const expiresAt = new Date(Date.now() + HOLD_DURATION_MS);
-  await reserveOrder(db, orderId, lines, settings.currency, expiresAt);
+  const discount = await reserveOrder(db, {
+    orderId,
+    lines,
+    currency: settings.currency,
+    expiresAt,
+    discountCode: request.discountCode
+  });
   let session;
   try {
     session = await settings.payment.createCheckoutSession({
@@ -1894,10 +2523,17 @@ async function createCheckout(db, settings, request) {
       cancelUrl: settings.urls.cancel,
       shippingCountries: settings.shippingCountries,
       shippingRates: shippingRates2,
-      expiresAt
+      expiresAt,
+      ...discount && discount.discountCents > 0 && {
+        discount: {
+          code: discount.code,
+          amountCents: discount.discountCents
+        }
+      }
     });
   } catch (err) {
     await release(db, orderId);
+    await releaseRedemptions(db, [orderId]);
     await setOrderStatus(db, orderId, "cancelled");
     throw new PaymentGatewayError(err);
   }
@@ -1950,6 +2586,14 @@ var ordersPlugin = async (app, { db, ...settings }) => {
           })
         );
       }
+      if (err instanceof DiscountRejectedError) {
+        return reply.code(422).send(
+          discountRejectionSchema.parse({
+            error: err.code,
+            reason: err.reason
+          })
+        );
+      }
       if (err instanceof PaymentGatewayError) {
         req.log.error({ err: err.cause }, err.message);
         return reply.code(502).send({ error: err.code });
@@ -1957,6 +2601,23 @@ var ordersPlugin = async (app, { db, ...settings }) => {
       throw err;
     }
   });
+  app.post("/checkout/discount/preview", async (req, reply) => {
+    const parsed = discountPreviewRequestSchema.safeParse(req.body);
+    if (!parsed.success) {
+      return reply.code(400).send({ error: "INVALID_DISCOUNT_REQUEST" });
+    }
+    reply.header("Cache-Control", "no-store");
+    const result = await previewDiscount(db, parsed.data, settings.currency);
+    if (!result.ok) {
+      return reply.code(422).send(
+        discountRejectionSchema.parse({
+          error: "DISCOUNT_INVALID",
+          reason: result.reason
+        })
+      );
+    }
+    return discountPreviewSchema.parse(result.preview);
+  });
   app.get(
     "/orders/session/:sessionId",
     async (req, reply) => {
@@ -1980,6 +2641,119 @@ var ordersPlugin = async (app, { db, ...settings }) => {
   });
 };
 
+// src/payment/fake-gateway.ts
+import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+function createFakeGateway({
+  secret = "fake-webhook-secret"
+} = {}) {
+  const sessions = [];
+  const refunds = [];
+  const refundCalls = [];
+  let pendingFailure;
+  let sessionUrl;
+  let pendingRefundFailure;
+  const hmac = (body) => createHmac("sha256", secret).update(body).digest("hex");
+  function sign(event) {
+    const rawBody = Buffer.from(JSON.stringify(event));
+    return { rawBody, signature: hmac(rawBody) };
+  }
+  return {
+    kind: "fake",
+    useSessionUrl(build) {
+      sessionUrl = build;
+    },
+    sessions,
+    refunds,
+    refundCalls,
+    async createCheckoutSession(input) {
+      if (pendingFailure) {
+        const err = pendingFailure;
+        pendingFailure = void 0;
+        throw err;
+      }
+      const id = `fake_cs_${randomUUID3()}`;
+      sessions.push({ ...input, id });
+      return {
+        id,
+        url: sessionUrl?.(id) ?? input.successUrl.replace(SESSION_ID_PLACEHOLDER, id)
+      };
+    },
+    async verifyWebhook(rawBody, signature) {
+      const expected = Buffer.from(hmac(rawBody));
+      const given = Buffer.from(signature ?? "");
+      if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+        throw new WebhookSignatureError();
+      }
+      return JSON.parse(rawBody.toString("utf8"));
+    },
+    async refund(input) {
+      refundCalls.push(input);
+      if (pendingRefundFailure) {
+        const err = pendingRefundFailure;
+        pendingRefundFailure = void 0;
+        throw err;
+      }
+      const prior = refunds.find(
+        (r) => r.idempotencyKey === input.idempotencyKey
+      );
+      if (prior) return { gatewayRefundId: prior.gatewayRefundId };
+      const gatewayRefundId = `fake_re_${refunds.length + 1}_${input.sessionId}`;
+      refunds.push({ ...input, gatewayRefundId });
+      return { gatewayRefundId };
+    },
+    failNextSession(error = new Error("Fake gateway failure")) {
+      pendingFailure = error;
+    },
+    failNextRefund(error = new RefundRejectedError("Fake refund failure")) {
+      pendingRefundFailure = error;
+    },
+    failNextRefundUncertain(error = new Error("Fake refund timeout")) {
+      pendingRefundFailure = error;
+    },
+    completed(sessionId, details = {}) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.completed",
+        sessionId,
+        ...details
+      });
+    },
+    asyncPaid(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.async_paid",
+        sessionId
+      });
+    },
+    asyncFailed(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.async_failed",
+        sessionId
+      });
+    },
+    expired(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "checkout.expired",
+        sessionId
+      });
+    },
+    refunded(sessionId, refunds2) {
+      return sign({
+        id: `fake_evt_${randomUUID3()}`,
+        type: "payment.refunded",
+        sessionId,
+        refunds: refunds2
+      });
+    },
+    sign
+  };
+}
+function isFakeGateway(gateway) {
+  return gateway.kind === "fake";
+}
+
 // src/plugin.ts
 var commercePlugin = async (app, {
   db,
@@ -1990,7 +2764,8 @@ var commercePlugin = async (app, {
   hooks,
   admin,
   categoryLabels,
-  catalogCache
+  catalogCache,
+  devCheckout
 }) => {
   app.get("/health", async () => ({ status: "ok" }));
   await app.register(catalogPlugin, {
@@ -2016,6 +2791,16 @@ var commercePlugin = async (app, {
     shippingCountries,
     hooks
   });
+  if (devCheckout) {
+    assertDevCheckoutAllowed();
+    if (isFakeGateway(payment)) {
+      const apiUrl = typeof devCheckout === "object" ? devCheckout.apiUrl : "";
+      payment.useSessionUrl(
+        (id) => `${apiUrl ?? ""}${app.prefix}/checkout/dev/${id}/complete`
+      );
+      await app.register(devCheckoutRoutes, { db, payment, urls, hooks });
+    }
+  }
   if (admin) {
     await app.register(adminOrdersPlugin, {
       db,
@@ -2024,6 +2809,11 @@ var commercePlugin = async (app, {
       hooks,
       prefix: "/admin/orders"
     });
+    await app.register(adminDiscountsPlugin, {
+      db,
+      authorize: admin.authorize,
+      prefix: "/admin/discounts"
+    });
   }
 };
 
@@ -2143,6 +2933,16 @@ async function refundedEvent(stripe, event) {
     refunds: refunds.filter((refund) => refund.status !== "failed").map(toRefundEvent)
   };
 }
+function createCoupon(stripe, { discount, currency, expiresAt }) {
+  return stripe.coupons.create({
+    amount_off: discount.amountCents,
+    currency: currency.toLowerCase(),
+    duration: "once",
+    max_redemptions: 1,
+    redeem_by: Math.floor(expiresAt.getTime() / 1e3),
+    name: discount.code
+  });
+}
 async function loadStripe(secretKey) {
   const { default: StripeClient } = await import("stripe");
   return new StripeClient(secretKey);
@@ -2156,7 +2956,9 @@ function createStripeGateway({
   const getStripe = () => stripe ??= loadStripe(secretKey);
   return {
     async createCheckoutSession(input) {
-      const session = await (await getStripe()).checkout.sessions.create({
+      const stripeClient = await getStripe();
+      const coupon = input.discount && await createCoupon(stripeClient, input);
+      const session = await stripeClient.checkout.sessions.create({
         mode: "payment",
         client_reference_id: input.reference,
         metadata: { reference: input.reference },
@@ -2171,6 +2973,7 @@ function createStripeGateway({
             }
           }
         })),
+        ...coupon && { discounts: [{ coupon: coupon.id }] },
         success_url: input.successUrl,
         cancel_url: input.cancelUrl,
         expires_at: Math.floor(input.expiresAt.getTime() / 1e3),
@@ -2234,120 +3037,103 @@ function createStripeGateway({
   };
 }
 
-// src/payment/fake-gateway.ts
-import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
-function createFakeGateway({
-  secret = "fake-webhook-secret"
-} = {}) {
-  const sessions = [];
-  const refunds = [];
-  const refundCalls = [];
-  let pendingFailure;
-  let pendingRefundFailure;
-  const hmac = (body) => createHmac("sha256", secret).update(body).digest("hex");
-  function sign(event) {
-    const rawBody = Buffer.from(JSON.stringify(event));
-    return { rawBody, signature: hmac(rawBody) };
-  }
-  return {
-    sessions,
-    refunds,
-    refundCalls,
-    async createCheckoutSession(input) {
-      if (pendingFailure) {
-        const err = pendingFailure;
-        pendingFailure = void 0;
-        throw err;
-      }
-      const id = `fake_cs_${randomUUID3()}`;
-      sessions.push({ ...input, id });
-      return {
-        id,
-        url: input.successUrl.replace(SESSION_ID_PLACEHOLDER, id)
-      };
-    },
-    async verifyWebhook(rawBody, signature) {
-      const expected = Buffer.from(hmac(rawBody));
-      const given = Buffer.from(signature ?? "");
-      if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
-        throw new WebhookSignatureError();
-      }
-      return JSON.parse(rawBody.toString("utf8"));
-    },
-    async refund(input) {
-      refundCalls.push(input);
-      if (pendingRefundFailure) {
-        const err = pendingRefundFailure;
-        pendingRefundFailure = void 0;
-        throw err;
-      }
-      const prior = refunds.find(
-        (r) => r.idempotencyKey === input.idempotencyKey
-      );
-      if (prior) return { gatewayRefundId: prior.gatewayRefundId };
-      const gatewayRefundId = `fake_re_${refunds.length + 1}_${input.sessionId}`;
-      refunds.push({ ...input, gatewayRefundId });
-      return { gatewayRefundId };
-    },
-    failNextSession(error = new Error("Fake gateway failure")) {
-      pendingFailure = error;
-    },
-    failNextRefund(error = new RefundRejectedError("Fake refund failure")) {
-      pendingRefundFailure = error;
-    },
-    failNextRefundUncertain(error = new Error("Fake refund timeout")) {
-      pendingRefundFailure = error;
-    },
-    completed(sessionId, details = {}) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.completed",
-        sessionId,
-        ...details
-      });
-    },
-    asyncPaid(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.async_paid",
-        sessionId
-      });
-    },
-    asyncFailed(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.async_failed",
-        sessionId
-      });
-    },
-    expired(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.expired",
-        sessionId
-      });
-    },
-    refunded(sessionId, refunds2) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "payment.refunded",
-        sessionId,
-        refunds: refunds2
-      });
-    },
-    sign
-  };
-}
-
 // src/hold-sweeper.ts
+async function sweepExpiredHolds(db) {
+  await db.transaction(async (tx) => {
+    await releaseRedemptions(tx, await releaseExpiredReferences(tx));
+  });
+}
 function startHoldSweeper(db, { intervalMs = 6e4, onError } = {}) {
   const timer = setInterval(() => {
-    releaseExpired(db).catch((err) => onError?.(err));
+    sweepExpiredHolds(db).catch((err) => onError?.(err));
   }, intervalMs);
   timer.unref();
   return { stop: () => clearInterval(timer) };
 }
 
+// src/emails/order-lines.ts
+var defaultLabels = {
+  subtotal: "Subtotal",
+  discount: (code) => code ? `Discount (${code})` : "Discount",
+  shipping: (label) => label ? `Shipping (${label})` : "Shipping",
+  total: "Total"
+};
+var escapes = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (c) => escapes[c]);
+}
+function addressLines(order) {
+  const a = order.shippingAddress;
+  if (!a) return void 0;
+  const lines = [
+    a.name,
+    a.line1,
+    a.line2,
+    [a.city, a.state, a.postalCode].filter(Boolean).join(" "),
+    a.country
+  ].filter((l) => Boolean(l));
+  return lines.length ? lines : void 0;
+}
+function textBlock(lines) {
+  return lines.map((l) => `${l.label}  ${l.amount}`).join("\n");
+}
+function htmlRows(lines) {
+  return lines.map(
+    (l) => `<tr><td>${escapeHtml(l.label)}</td><td align="right">${escapeHtml(l.amount)}</td></tr>`
+  ).join("");
+}
+function orderEmailLines(order, options = {}) {
+  const locale = options.locale ?? "en-US";
+  const labels = { ...defaultLabels, ...options.labels };
+  const money = (cents) => new Intl.NumberFormat(locale, {
+    style: "currency",
+    currency: order.currency
+  }).format(cents / 100);
+  const items = order.items.map((i) => ({
+    label: `${i.name} \xD7 ${i.quantity}`,
+    amount: money(i.priceCents * i.quantity)
+  }));
+  const subtotal = {
+    label: labels.subtotal,
+    amount: money(order.subtotalCents)
+  };
+  const discount = order.discountCents > 0 ? {
+    label: labels.discount(order.discountCode),
+    amount: `-${money(order.discountCents)}`
+  } : void 0;
+  const shipping = {
+    label: labels.shipping(order.shippingLabel),
+    amount: money(order.shippingCents)
+  };
+  const total = { label: labels.total, amount: money(order.totalCents) };
+  const address = addressLines(order);
+  const totals = [subtotal, ...discount ? [discount] : [], shipping, total];
+  return {
+    items,
+    subtotal,
+    discount,
+    shipping,
+    total,
+    address,
+    text: {
+      items: textBlock(items),
+      totals: textBlock(totals),
+      address: address?.join("\n") ?? ""
+    },
+    html: {
+      items: htmlRows(items),
+      totals: htmlRows(totals),
+      address: address?.map((l) => `<p>${escapeHtml(l)}</p>`).join("") ?? ""
+    }
+  };
+}
+
 // src/db/migrate.ts
 import path from "path";
 import { fileURLToPath } from "url";
@@ -2366,16 +3152,16 @@ async function runCommerceMigrations(db) {
 }
 
 // src/seed.ts
-import { eq as eq10, sql as sql10 } from "drizzle-orm";
+import { eq as eq11, sql as sql11 } from "drizzle-orm";
 async function seedProducts(db, items) {
   await db.transaction(async (tx) => {
     for (const { images = [], ...item } of items) {
       const values = { status: "active", ...item };
       const [row] = await tx.insert(products).values(values).onConflictDoUpdate({
         target: products.slug,
-        set: { ...values, updatedAt: sql10`now()` }
+        set: { ...values, updatedAt: sql11`now()` }
       }).returning({ id: products.id });
-      await tx.delete(productImages).where(eq10(productImages.productId, row.id));
+      await tx.delete(productImages).where(eq11(productImages.productId, row.id));
       if (images.length > 0) {
         await tx.insert(productImages).values(
           images.map((img, position) => ({
@@ -2425,17 +3211,132 @@ function createMemoryStorage(baseUrl = "memory://") {
     }
   };
 }
+
+// src/storage/disk.ts
+import { createReadStream, createWriteStream } from "fs";
+import { mkdir, realpath, rm, stat } from "fs/promises";
+import path2 from "path";
+import { pipeline } from "stream/promises";
+var contentTypes = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".avif": "image/avif"
+};
+function hasTraversalSegment(key) {
+  return key.split(/[\\/]/).some((segment) => segment === "..");
+}
+function decodesToTraversal(key) {
+  try {
+    return hasTraversalSegment(decodeURIComponent(key));
+  } catch {
+    return true;
+  }
+}
+function isInside(root, target) {
+  return target.startsWith(root + path2.sep);
+}
+function resolveKey(dir, key) {
+  if (!key || key.includes("\0") || path2.isAbsolute(key)) return null;
+  if (hasTraversalSegment(key) || decodesToTraversal(key)) return null;
+  const root = path2.resolve(dir);
+  const target = path2.resolve(root, key);
+  return isInside(root, target) ? target : null;
+}
+async function realInside(dir, target) {
+  const [root, real] = await Promise.all([
+    realpath(dir),
+    realpath(target)
+  ]).catch(() => [null, null]);
+  return root && real && isInside(root, real) ? real : null;
+}
+function createDiskStorage(options) {
+  const { dir, publicUrl } = options;
+  const base = publicUrl.replace(/\/+$/, "");
+  return {
+    async put(key, stream) {
+      const target = resolveKey(dir, key);
+      if (!target)
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      await mkdir(path2.dirname(target), { recursive: true });
+      if (!await realInside(dir, path2.dirname(target)).catch(() => null)) {
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      }
+      await pipeline(stream, createWriteStream(target));
+      return { key, url: `${base}/${key}` };
+    },
+    async delete(key) {
+      const target = resolveKey(dir, key);
+      if (!target)
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      if (!await realInside(dir, path2.dirname(target)).catch(() => null))
+        return;
+      await rm(target, { force: true });
+    }
+  };
+}
+async function openStoredFile(dir, key) {
+  const target = resolveKey(dir, key);
+  if (!target) return null;
+  const real = await realInside(dir, target);
+  if (!real) return null;
+  const info = await stat(real).catch(() => null);
+  if (!info?.isFile()) return null;
+  const contentType = contentTypes[path2.extname(real).toLowerCase()];
+  return { stream: createReadStream(real), contentType, size: info.size };
+}
+
+// src/payment/resolve.ts
+function resolvePayment(env = process.env) {
+  const secretKey = env.STRIPE_SECRET_KEY || void 0;
+  const webhookSecret = env.STRIPE_WEBHOOK_SECRET || void 0;
+  if (!secretKey !== !webhookSecret) {
+    throw new Error(
+      "Set STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET together, or neither"
+    );
+  }
+  if (env.PAYMENT_GATEWAY === "stripe" && !secretKey) {
+    throw new Error("PAYMENT_GATEWAY=stripe needs the Stripe keys");
+  }
+  if (env.PAYMENT_GATEWAY === "fake" || !secretKey) {
+    if (env.NODE_ENV === "production") {
+      throw new Error(
+        "The fake payment gateway is not allowed in production; set the Stripe keys"
+      );
+    }
+    return createFakeGateway();
+  }
+  return createStripeGateway({ secretKey, webhookSecret });
+}
+function checkoutUrls(webUrl, {
+  successPath = "/checkout/success",
+  cancelPath = "/shop"
+} = {}) {
+  const base = webUrl.replace(/\/+$/, "");
+  return {
+    success: (sessionId) => `${base}${successPath}?session_id=${encodeURIComponent(sessionId)}`,
+    cancel: `${base}${cancelPath}`
+  };
+}
 export {
   ProductNotFoundError,
   SESSION_ID_PLACEHOLDER,
   WebhookSignatureError,
   catalogPlugin,
+  checkoutUrls,
   commercePlugin,
   commerceSchema,
+  createDiskStorage,
   createFakeGateway,
   createMemoryStorage,
   createStripeGateway,
+  isFakeGateway,
+  openStoredFile,
+  orderEmailLines,
   ordersPlugin,
+  resolvePayment,
   runCommerceMigrations,
   seedProducts,
   seedShippingRates,