@develemit/commerce-server 0.4.0 → 0.7.0

package/dist/index.js

@@ -28,6 +28,9 @@ var InvalidCursorError = class extends Error {
   }
 };
 var PG_TIMESTAMP = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(\.\d+)?[+-]\d{2}(:?\d{2})?$/;
+function isCursorTimestamp(at) {
+  return PG_TIMESTAMP.test(at) || !Number.isNaN(Date.parse(at));
+}
 function encodeCursor({ at, key }) {
   return Buffer.from(`${at}|${key}`).toString("base64url");
 }
@@ -69,13 +72,13 @@ var products = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     slug: text("slug").notNull().unique(),
-    name: text("name").notNull(),
+    name: text("name").notNull().default(""),
     description: text("description").notNull().default(""),
     materials: text("materials"),
     dimensions: text("dimensions"),
-    priceCents: integer("price_cents").notNull(),
+    priceCents: integer("price_cents"),
     currency: text("currency").notNull(),
-    category: text("category").notNull(),
+    category: text("category"),
     quantity: integer("quantity").notNull().default(1),
     status: productStatus("status").notNull().default("draft"),
     featured: boolean("featured").notNull().default(false),
@@ -335,10 +338,13 @@ import { Readable } from "stream";
 import {
   and as and2,
   asc as asc2,
+  desc,
   eq as eq2,
   gt,
   ilike,
   inArray,
+  lt,
+  ne,
   or,
   sql as sql2
 } from "drizzle-orm";
@@ -358,9 +364,12 @@ async function withImages(db, rows) {
 function escapeLike(value) {
   return value.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
+var incompleteDraft = sql2`(${products.status} = 'draft' and (${products.name} = '' or ${products.priceCents} is null or ${products.category} is null))`;
 function pageConditions(filter) {
   const parts = [];
   if (filter.status) parts.push(eq2(products.status, filter.status));
+  if (filter.excludeArchived) parts.push(ne(products.status, "archived"));
+  if (filter.incomplete) parts.push(incompleteDraft);
   if (filter.stock === "in") parts.push(gt(products.quantity, 0));
   if (filter.stock === "sold") parts.push(eq2(products.quantity, 0));
   if (filter.q) parts.push(ilike(products.name, `%${escapeLike(filter.q)}%`));
@@ -368,10 +377,10 @@ function pageConditions(filter) {
     const createdAt = sql2`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or(
-        gt(products.createdAt, createdAt),
+        lt(products.createdAt, createdAt),
         and2(
           eq2(products.createdAt, createdAt),
-          gt(products.slug, filter.after.slug)
+          lt(products.slug, filter.after.slug)
         )
       )
     );
@@ -382,7 +391,7 @@ async function selectProductPage(db, filter) {
   const selected = await db.select({
     product: products,
     createdAtKey: sql2`${products.createdAt}::text`
-  }).from(products).where(pageConditions(filter)).orderBy(asc2(products.createdAt), asc2(products.slug)).limit(filter.limit);
+  }).from(products).where(pageConditions(filter)).orderBy(desc(products.createdAt), desc(products.slug)).limit(filter.limit);
   const records = await withImages(
     db,
     selected.map((s) => s.product)
@@ -426,6 +435,17 @@ async function setImagePosition(db, id, position) {
 async function setImageAlt(db, id, alt) {
   await db.update(productImages).set({ alt }).where(eq2(productImages.id, id));
 }
+async function selectProductCounts(db) {
+  const [row] = await db.select({
+    all: sql2`count(*) filter (where ${products.status} <> 'archived')::int`,
+    live: sql2`count(*) filter (where ${products.status} = 'active')::int`,
+    draft: sql2`count(*) filter (where ${products.status} = 'draft')::int`,
+    sold: sql2`count(*) filter (where ${products.quantity} = 0)::int`,
+    archived: sql2`count(*) filter (where ${products.status} = 'archived')::int`,
+    incompleteDrafts: sql2`count(*) filter (where ${products.status} = 'draft' and (${products.name} = '' or ${products.priceCents} is null or ${products.category} is null))::int`
+  }).from(products);
+  return row;
+}
 
 // src/admin/service.ts
 import {
@@ -433,6 +453,54 @@ import {
   adminProductListQuerySchema,
   adminProductPatchSchema
 } from "@develemit/commerce-contracts";
+import { randomUUID } from "crypto";
+
+// src/admin/types.ts
+var ProductImageNotFoundError = class extends Error {
+  constructor(imageId) {
+    super(`Image not found: ${imageId}`);
+    this.imageId = imageId;
+    this.name = "ProductImageNotFoundError";
+  }
+  imageId;
+  code = "IMAGE_NOT_FOUND";
+};
+var InvalidImageOrderError = class extends Error {
+  code = "INVALID_IMAGE_ORDER";
+  constructor() {
+    super("imageIds must list every image of the product exactly once");
+    this.name = "InvalidImageOrderError";
+  }
+};
+var ProductIncompleteError = class extends Error {
+  constructor(missing) {
+    super(`Product is missing: ${missing.join(", ")}`);
+    this.missing = missing;
+    this.name = "ProductIncompleteError";
+  }
+  missing;
+  code = "PRODUCT_INCOMPLETE";
+};
+
+// src/admin/publish.ts
+function temporarySlug(id) {
+  return `draft-${id.slice(0, 8)}`;
+}
+function missingForPublish({ row, images }, patch, requirePhoto) {
+  const name = patch.name ?? row.name;
+  const priceCents = patch.priceCents ?? row.priceCents;
+  const category = patch.category ?? row.category;
+  const missing = [];
+  if (!name) missing.push("name");
+  if (priceCents === null) missing.push("priceCents");
+  if (!category) missing.push("category");
+  if (requirePhoto && images.length === 0) missing.push("images");
+  return missing;
+}
+function assertPublishable(record, patch, requirePhoto) {
+  const missing = missingForPublish(record, patch, requirePhoto);
+  if (missing.length > 0) throw new ProductIncompleteError(missing);
+}
 
 // src/admin/slug.ts
 function slugify(name) {
@@ -482,6 +550,8 @@ async function listAdminProducts(db, rawQuery = {}) {
   const query = adminProductListQuerySchema.parse(rawQuery);
   const found = await selectProductPage(db, {
     status: query.status,
+    excludeArchived: query.excludeArchived === "true",
+    incomplete: query.incomplete === "true",
     stock: query.stock,
     q: query.q,
     after: query.cursor ? decodeProductCursor(query.cursor) : void 0,
@@ -497,47 +567,48 @@ async function listAdminProducts(db, rawQuery = {}) {
 async function getAdminProduct(db, id) {
   return toAdminProduct(await requireProduct(db, id));
 }
-async function createAdminProduct(db, currency, input) {
+async function createAdminProduct(db, currency, input, { requirePhotoToPublish = true } = {}) {
   const data = adminProductInputSchema.parse(input);
-  const base = slugify(data.name);
+  if (data.status === "active" && requirePhotoToPublish) {
+    throw new ProductIncompleteError(["images"]);
+  }
+  const newId = randomUUID();
+  const base = data.name ? slugify(data.name) : temporarySlug(newId);
   const id = await db.transaction(async (tx) => {
     const slug = uniqueSlug(base, await slugsStartingWith(tx, base));
     return insertProduct(tx, {
       ...data,
+      id: newId,
       slug,
       currency: data.currency ?? currency
     });
   });
   return getAdminProduct(db, id);
 }
-async function patchAdminProduct(db, id, input) {
+async function patchAdminProduct(db, id, input, { requirePhotoToPublish = true } = {}) {
   const { sold, ...fields } = adminProductPatchSchema.parse(input);
-  await requireProduct(db, id);
-  const set = sold ? { ...fields, quantity: 0 } : fields;
-  if (Object.keys(set).length > 0) await updateProduct(db, id, set);
+  const record = await requireProduct(db, id);
+  if (fields.status === "active") {
+    const photoNeeded = requirePhotoToPublish && record.row.status !== "active";
+    assertPublishable(record, fields, photoNeeded);
+  }
+  const set = sold ? { ...fields, quantity: 0 } : { ...fields };
+  const renames = fields.name && record.row.slug === temporarySlug(id);
+  await db.transaction(async (tx) => {
+    if (renames) {
+      const base = slugify(fields.name);
+      set.slug = uniqueSlug(base, await slugsStartingWith(tx, base));
+    }
+    if (Object.keys(set).length > 0) await updateProduct(tx, id, set);
+  });
   return getAdminProduct(db, id);
 }
-
-// src/admin/types.ts
-var ProductImageNotFoundError = class extends Error {
-  constructor(imageId) {
-    super(`Image not found: ${imageId}`);
-    this.imageId = imageId;
-    this.name = "ProductImageNotFoundError";
-  }
-  imageId;
-  code = "IMAGE_NOT_FOUND";
-};
-var InvalidImageOrderError = class extends Error {
-  code = "INVALID_IMAGE_ORDER";
-  constructor() {
-    super("imageIds must list every image of the product exactly once");
-    this.name = "InvalidImageOrderError";
-  }
-};
+async function getAdminProductCounts(db) {
+  return selectProductCounts(db);
+}
 
 // src/admin/upload.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { fileTypeFromBuffer } from "file-type";
 var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
 var EXTENSIONS = {
@@ -562,7 +633,7 @@ async function detectImage(bytes) {
   return { mime: type.mime, ext };
 }
 function imageKey(productId, ext) {
-  return `products/${productId}/${randomUUID()}.${ext}`;
+  return `products/${productId}/${randomUUID2()}.${ext}`;
 }
 
 // src/admin/images.ts
@@ -622,7 +693,7 @@ async function updateProductImageAlt(db, productId, imageId, alt) {
 function isZodError(err) {
   return err instanceof Error && err.name === "ZodError";
 }
-var adminPlugin = async (app, { db, currency, authorize, storage }) => {
+var adminPlugin = async (app, { db, currency, authorize, storage, requirePhotoToPublish }) => {
   const { default: multipart } = await import("@fastify/multipart");
   await app.register(multipart, {
     limits: { fileSize: MAX_IMAGE_BYTES, files: 1 }
@@ -634,6 +705,13 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
     if (err instanceof ProductNotFoundError || err instanceof ProductImageNotFoundError) {
       return reply.code(404).send({ error: err.code, message: err.message });
     }
+    if (err instanceof ProductIncompleteError) {
+      return reply.code(422).send({
+        error: err.code,
+        message: err.message,
+        missing: err.missing
+      });
+    }
     if (err instanceof InvalidCursorError || err instanceof InvalidImageError || err instanceof InvalidImageOrderError) {
       return reply.code(400).send({ error: err.code, message: err.message });
     }
@@ -653,9 +731,12 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
       await listAdminProducts(db, req.query)
     )
   );
+  app.get("/products/counts", async () => getAdminProductCounts(db));
   app.post("/products", async (req, reply) => {
     const input = adminProductInputSchema2.parse(req.body);
-    const created = await createAdminProduct(db, currency, input);
+    const created = await createAdminProduct(db, currency, input, {
+      requirePhotoToPublish
+    });
     return reply.code(201).send(created);
   });
   app.get(
@@ -667,7 +748,8 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
     async (req) => patchAdminProduct(
       db,
       req.params.id,
-      adminProductPatchSchema2.parse(req.body)
+      adminProductPatchSchema2.parse(req.body),
+      { requirePhotoToPublish }
     )
   );
   app.post(
@@ -677,7 +759,7 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
       if (!part) throw new InvalidImageError("An image file is required");
       const bytes = await part.toBuffer();
       const fields = part.fields;
-      const alt = typeof fields.alt?.value === "string" ? fields.alt.value : void 0;
+      const alt = typeof fields.alt?.value === "string" ? productImagePatchSchema.parse({ alt: fields.alt.value }).alt : void 0;
       const product = await addProductImage(db, storage, req.params.id, {
         bytes,
         alt
@@ -755,7 +837,7 @@ function addCatalogCaching(app, { cacheControl = DEFAULT_CATALOG_CACHE_CONTROL }
 }
 
 // src/inventory/repo.ts
-import { and as and3, asc as asc3, eq as eq3, gt as gt2, inArray as inArray2, lt, sql as sql3 } from "drizzle-orm";
+import { and as and3, asc as asc3, eq as eq3, gt as gt2, inArray as inArray2, lt as lt2, sql as sql3 } from "drizzle-orm";
 async function lockProductQuantities(tx, productIds) {
   const rows = await tx.select({ id: products.id, quantity: products.quantity }).from(products).where(inArray2(products.id, productIds)).orderBy(asc3(products.id)).for("update");
   return new Map(rows.map((r) => [r.id, r.quantity]));
@@ -842,7 +924,7 @@ async function releaseExpiredHolds(db) {
   const released = await db.update(inventoryHolds).set({ status: "released" }).where(
     and3(
       eq3(inventoryHolds.status, "active"),
-      lt(inventoryHolds.expiresAt, sql3`now()`)
+      lt2(inventoryHolds.expiresAt, sql3`now()`)
     )
   ).returning({ reference: inventoryHolds.reference });
   return released.map((r) => r.reference);
@@ -947,7 +1029,12 @@ async function restock(tx, items) {
 }
 
 // src/catalog/repo.ts
-import { and as and4, asc as asc4, eq as eq4, gt as gt3, inArray as inArray3, or as or2, sql as sql4 } from "drizzle-orm";
+import { and as and4, asc as asc4, eq as eq4, gt as gt3, inArray as inArray3, isNotNull, or as or2, sql as sql4 } from "drizzle-orm";
+var isListed = and4(
+  eq4(products.status, "active"),
+  isNotNull(products.priceCents),
+  isNotNull(products.category)
+);
 async function attachImages(db, rows, firstOnly = false) {
   if (rows.length === 0) return [];
   const where = inArray3(
@@ -961,7 +1048,7 @@ async function attachImages(db, rows, firstOnly = false) {
   }));
 }
 async function listActiveProducts(db, filter) {
-  const conditions2 = [eq4(products.status, "active")];
+  const conditions2 = [isListed];
   if (filter.category) conditions2.push(eq4(products.category, filter.category));
   if (filter.featured !== void 0)
     conditions2.push(eq4(products.featured, filter.featured));
@@ -992,22 +1079,30 @@ async function listActiveProducts(db, filter) {
   }));
 }
 async function findActiveProductBySlug(db, slug) {
-  const rows = await db.select().from(products).where(and4(eq4(products.slug, slug), eq4(products.status, "active"))).limit(1);
+  const rows = await db.select().from(products).where(and4(eq4(products.slug, slug), isListed)).limit(1);
   return (await attachImages(db, rows))[0];
 }
 async function countActiveByCategory(db) {
   const rows = await db.select({
     category: products.category,
     count: sql4`count(*)::int`
-  }).from(products).where(eq4(products.status, "active")).groupBy(products.category).orderBy(asc4(products.category));
-  return rows;
+  }).from(products).where(isListed).groupBy(products.category).orderBy(asc4(products.category));
+  return rows.flatMap(
+    (r) => r.category === null ? [] : [{ category: r.category, count: r.count }]
+  );
 }
 async function findActiveProductsByIds(db, ids) {
   if (ids.length === 0) return [];
-  return db.select().from(products).where(and4(inArray3(products.id, ids), eq4(products.status, "active")));
+  return db.select().from(products).where(and4(inArray3(products.id, ids), isListed));
 }
 
 // src/catalog/service.ts
+function completeFields(row) {
+  if (row.priceCents === null || row.category === null) {
+    throw new Error(`Active product ${row.id} is missing price or category`);
+  }
+  return { priceCents: row.priceCents, category: row.category };
+}
 function availabilityOf(quantity, free) {
   if (free > 0) return "available";
   return quantity > 0 ? "reserved" : "sold";
@@ -1021,9 +1116,8 @@ function toProduct({ row, images }, free) {
     description: row.description,
     ...row.materials ? { materials: row.materials } : {},
     ...row.dimensions ? { dimensions: row.dimensions } : {},
-    priceCents: row.priceCents,
+    ...completeFields(row),
     currency: row.currency,
-    category: row.category,
     images: images.map((i) => ({ url: i.url, alt: i.alt })),
     quantity: freeQty,
     availability: availabilityOf(row.quantity, freeQty),
@@ -1076,7 +1170,7 @@ async function findPurchasable(db, ids) {
   return rows.map((row) => ({
     id: row.id,
     name: row.name,
-    priceCents: row.priceCents,
+    priceCents: completeFields(row).priceCents,
     currency: row.currency
   }));
 }
@@ -1124,7 +1218,7 @@ import {
 } from "@develemit/commerce-contracts";
 
 // src/orders/admin-repo.ts
-import { and as and5, desc, eq as eq5, ilike as ilike2, lt as lt2, or as or3, sql as sql5 } from "drizzle-orm";
+import { and as and5, desc as desc2, eq as eq5, ilike as ilike2, lt as lt3, or as or3, sql as sql5 } from "drizzle-orm";
 function escapeLike2(value) {
   return value.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
@@ -1146,11 +1240,12 @@ function conditions(filter) {
     );
   }
   if (filter.after) {
-    const { createdAt, id } = filter.after;
+    const { id } = filter.after;
+    const createdAt = sql5`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or3(
-        lt2(orders.createdAt, createdAt),
-        and5(eq5(orders.createdAt, createdAt), lt2(orders.id, id))
+        lt3(orders.createdAt, createdAt),
+        and5(eq5(orders.createdAt, createdAt), lt3(orders.id, id))
       )
     );
   }
@@ -1168,8 +1263,9 @@ async function selectOrderPage(db, filter) {
     totalCents: sql5`${orders.subtotalCents} - ${orders.discountCents} + ${orders.shippingCents}`,
     currency: orders.currency,
     itemCount,
-    createdAt: orders.createdAt
-  }).from(orders).where(conditions(filter)).orderBy(desc(orders.createdAt), desc(orders.id)).limit(filter.limit);
+    createdAt: orders.createdAt,
+    createdAtKey: sql5`${orders.createdAt}::text`
+  }).from(orders).where(conditions(filter)).orderBy(desc2(orders.createdAt), desc2(orders.id)).limit(filter.limit);
 }
 async function findOrderRefunds(db, orderId) {
   return db.select().from(orderRefunds).where(eq5(orderRefunds.orderId, orderId)).orderBy(orderRefunds.createdAt, orderRefunds.id);
@@ -1179,10 +1275,10 @@ async function findOrderRefunds(db, orderId) {
 import { and as and7, asc as asc5, eq as eq7, sql as sql7 } from "drizzle-orm";
 
 // src/orders/refund-repo.ts
-import { and as and6, eq as eq6, isNotNull, isNull, or as or4, sql as sql6 } from "drizzle-orm";
+import { and as and6, eq as eq6, isNotNull as isNotNull2, isNull, or as or4, sql as sql6 } from "drizzle-orm";
 var isRecordedRefund = or4(
   isNull(orderRefunds.idempotencyKey),
-  isNotNull(orderRefunds.gatewayRefundId)
+  isNotNull2(orderRefunds.gatewayRefundId)
 );
 async function lockOrderForRefund(tx, id) {
   const [row] = await tx.select({
@@ -1385,9 +1481,9 @@ function isOrderId(value) {
 function decodeOrderCursor(raw) {
   const { at, key } = decodeCursor(
     raw,
-    (c) => isOrderId(c.key) && !Number.isNaN(+new Date(c.at))
+    (c) => isOrderId(c.key) && isCursorTimestamp(c.at)
   );
-  return { createdAt: new Date(at), id: key };
+  return { createdAt: at, id: key };
 }
 async function listAdminOrders(db, query) {
   const rows = await selectOrderPage(db, {
@@ -1400,8 +1496,16 @@ async function listAdminOrders(db, query) {
   const page = rows.slice(0, query.limit);
   const last = page[page.length - 1];
   return {
-    items: page.map((r) => ({ ...r, createdAt: r.createdAt.toISOString() })),
-    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAt.toISOString(), key: last.id }) : null
+    items: page.map((r) => ({
+      id: r.id,
+      status: r.status,
+      email: r.email,
+      totalCents: r.totalCents,
+      currency: r.currency,
+      itemCount: r.itemCount,
+      createdAt: r.createdAt.toISOString()
+    })),
+    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAtKey, key: last.id }) : null
   };
 }
 async function getAdminOrder(db, id) {
@@ -1507,14 +1611,14 @@ function evaluateDiscount(discount, ctx) {
 // src/discounts/repo.ts
 import {
   and as and8,
-  desc as desc2,
+  desc as desc3,
   eq as eq8,
   getTableColumns,
   gt as gt4,
   ilike as ilike3,
   inArray as inArray4,
   isNull as isNull2,
-  lt as lt3,
+  lt as lt4,
   lte,
   or as or5,
   sql as sql8
@@ -1565,11 +1669,12 @@ function listConditions(filter) {
   if (filter.status) parts.push(statusCondition(filter.status, filter.now));
   if (filter.q) parts.push(ilike3(discounts.code, `${escapeLike3(filter.q)}%`));
   if (filter.after) {
-    const { createdAt, id } = filter.after;
+    const { id } = filter.after;
+    const createdAt = sql8`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or5(
-        lt3(discounts.createdAt, createdAt),
-        and8(eq8(discounts.createdAt, createdAt), lt3(discounts.id, id))
+        lt4(discounts.createdAt, createdAt),
+        and8(eq8(discounts.createdAt, createdAt), lt4(discounts.id, id))
       )
     );
   }
@@ -1589,7 +1694,10 @@ var withCounts = {
   totalRedemptions: redemptionCount()
 };
 async function selectDiscountPage(db, filter) {
-  return db.select(withCounts).from(discounts).where(listConditions(filter)).orderBy(desc2(discounts.createdAt), desc2(discounts.id)).limit(filter.limit);
+  return db.select({
+    ...withCounts,
+    createdAtKey: sql8`${discounts.createdAt}::text`
+  }).from(discounts).where(listConditions(filter)).orderBy(desc3(discounts.createdAt), desc3(discounts.id)).limit(filter.limit);
 }
 async function findDiscountById(db, id, options = {}) {
   const query = db.select(withCounts).from(discounts).where(eq8(discounts.id, id));
@@ -2178,9 +2286,9 @@ function toDiscount(row) {
 function decodeDiscountCursor(raw) {
   const { at, key } = decodeCursor(
     raw,
-    (c) => isDiscountId(c.key) && !Number.isNaN(+new Date(c.at))
+    (c) => isDiscountId(c.key) && isCursorTimestamp(c.at)
   );
-  return { createdAt: new Date(at), id: key };
+  return { createdAt: at, id: key };
 }
 async function listAdminDiscounts(db, query, now = /* @__PURE__ */ new Date()) {
   const rows = await selectDiscountPage(db, {
@@ -2194,7 +2302,7 @@ async function listAdminDiscounts(db, query, now = /* @__PURE__ */ new Date()) {
   const last = page[page.length - 1];
   return {
     items: page.map(toDiscount),
-    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAt.toISOString(), key: last.id }) : null
+    nextCursor: rows.length > query.limit && last ? encodeCursor({ at: last.createdAtKey, key: last.id }) : null
   };
 }
 async function getAdminDiscount(db, id) {
@@ -2219,9 +2327,15 @@ async function createDiscount(db, input) {
   if (!id) throw new DiscountCodeTakenError(data.code);
   return getAdminDiscount(db, id);
 }
+function sameValue(a, b) {
+  if (typeof a === "string" && typeof b === "string") {
+    return a.toUpperCase() === b.toUpperCase();
+  }
+  return a === b;
+}
 function changedLockedFields(row, patch) {
   return LOCKED_AFTER_USE.filter(
-    (field) => patch[field] !== void 0 && patch[field] !== row[field]
+    (field) => patch[field] !== void 0 && !sameValue(patch[field], row[field])
   );
 }
 function assertCoherent(row, patch) {
@@ -2333,6 +2447,56 @@ var adminDiscountsPlugin = async (app, { db, authorize }) => {
   );
 };
 
+// src/orders/dev-buyer.ts
+var DEFAULT_DEV_BUYER = {
+  email: "dev-buyer@example.com",
+  name: "Dev Buyer",
+  address: {
+    line1: "123 Example Street",
+    city: "Springfield",
+    state: "IL",
+    postalCode: "62701",
+    country: "US"
+  }
+};
+function resolveDevCompletion(setting, sessionId, firstRate) {
+  const buyer = typeof setting === "function" ? setting(sessionId) : setting;
+  const name = buyer?.name ?? DEFAULT_DEV_BUYER.name;
+  return {
+    email: buyer?.email ?? DEFAULT_DEV_BUYER.email,
+    shippingAddress: { name, ...buyer?.address ?? DEFAULT_DEV_BUYER.address },
+    shipping: firstRate && {
+      label: firstRate.label,
+      amountCents: firstRate.amountCents
+    }
+  };
+}
+
+// src/orders/dev-checkout.ts
+function assertDevCheckoutAllowed() {
+  if (process.env.NODE_ENV === "production") {
+    throw new Error("devCheckout is not allowed when NODE_ENV=production");
+  }
+}
+var devCheckoutRoutes = async (app, { db, payment, urls, hooks, buyer }) => {
+  assertDevCheckoutAllowed();
+  app.get("/checkout/dev/:sessionId/complete", async (req, reply) => {
+    const { sessionId } = req.params;
+    const session = payment.sessions.find((s) => s.id === sessionId);
+    if (!session) {
+      return reply.code(404).send({ error: "SESSION_NOT_FOUND" });
+    }
+    const expire = req.query.outcome === "expired";
+    const { rawBody, signature } = expire ? payment.expired(sessionId) : payment.completed(
+      sessionId,
+      resolveDevCompletion(buyer, sessionId, session.shippingRates[0])
+    );
+    const event = await payment.verifyWebhook(rawBody, signature);
+    await handlePaymentEvent(db, event, hooks, req.log);
+    return reply.redirect(expire ? urls.cancel : urls.success(sessionId), 302);
+  });
+};
+
 // src/orders/routes.ts
 import {
   checkoutConflictSchema,
@@ -2385,7 +2549,7 @@ async function previewDiscount(db, request, currency, now = /* @__PURE__ */ new
 }
 
 // src/orders/checkout-service.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 var HOLD_DURATION_MS = 31 * 60 * 1e3;
 var UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function mergeItems(items) {
@@ -2460,7 +2624,7 @@ async function createCheckout(db, settings, request) {
     settings.currency
   );
   const shippingRates2 = await listActiveRates(db, settings.currency);
-  const orderId = randomUUID2();
+  const orderId = randomUUID3();
   const expiresAt = new Date(Date.now() + HOLD_DURATION_MS);
   const discount = await reserveOrder(db, {
     orderId,
@@ -2597,6 +2761,119 @@ var ordersPlugin = async (app, { db, ...settings }) => {
   });
 };
 
+// src/payment/fake-gateway.ts
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+function createFakeGateway({
+  secret = "fake-webhook-secret"
+} = {}) {
+  const sessions = [];
+  const refunds = [];
+  const refundCalls = [];
+  let pendingFailure;
+  let sessionUrl;
+  let pendingRefundFailure;
+  const hmac = (body) => createHmac("sha256", secret).update(body).digest("hex");
+  function sign(event) {
+    const rawBody = Buffer.from(JSON.stringify(event));
+    return { rawBody, signature: hmac(rawBody) };
+  }
+  return {
+    kind: "fake",
+    useSessionUrl(build) {
+      sessionUrl = build;
+    },
+    sessions,
+    refunds,
+    refundCalls,
+    async createCheckoutSession(input) {
+      if (pendingFailure) {
+        const err = pendingFailure;
+        pendingFailure = void 0;
+        throw err;
+      }
+      const id = `fake_cs_${randomUUID4()}`;
+      sessions.push({ ...input, id });
+      return {
+        id,
+        url: sessionUrl?.(id) ?? input.successUrl.replace(SESSION_ID_PLACEHOLDER, id)
+      };
+    },
+    async verifyWebhook(rawBody, signature) {
+      const expected = Buffer.from(hmac(rawBody));
+      const given = Buffer.from(signature ?? "");
+      if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+        throw new WebhookSignatureError();
+      }
+      return JSON.parse(rawBody.toString("utf8"));
+    },
+    async refund(input) {
+      refundCalls.push(input);
+      if (pendingRefundFailure) {
+        const err = pendingRefundFailure;
+        pendingRefundFailure = void 0;
+        throw err;
+      }
+      const prior = refunds.find(
+        (r) => r.idempotencyKey === input.idempotencyKey
+      );
+      if (prior) return { gatewayRefundId: prior.gatewayRefundId };
+      const gatewayRefundId = `fake_re_${refunds.length + 1}_${input.sessionId}`;
+      refunds.push({ ...input, gatewayRefundId });
+      return { gatewayRefundId };
+    },
+    failNextSession(error = new Error("Fake gateway failure")) {
+      pendingFailure = error;
+    },
+    failNextRefund(error = new RefundRejectedError("Fake refund failure")) {
+      pendingRefundFailure = error;
+    },
+    failNextRefundUncertain(error = new Error("Fake refund timeout")) {
+      pendingRefundFailure = error;
+    },
+    completed(sessionId, details = {}) {
+      return sign({
+        id: `fake_evt_${randomUUID4()}`,
+        type: "checkout.completed",
+        sessionId,
+        ...details
+      });
+    },
+    asyncPaid(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID4()}`,
+        type: "checkout.async_paid",
+        sessionId
+      });
+    },
+    asyncFailed(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID4()}`,
+        type: "checkout.async_failed",
+        sessionId
+      });
+    },
+    expired(sessionId) {
+      return sign({
+        id: `fake_evt_${randomUUID4()}`,
+        type: "checkout.expired",
+        sessionId
+      });
+    },
+    refunded(sessionId, refunds2) {
+      return sign({
+        id: `fake_evt_${randomUUID4()}`,
+        type: "payment.refunded",
+        sessionId,
+        refunds: refunds2
+      });
+    },
+    sign
+  };
+}
+function isFakeGateway(gateway) {
+  return gateway.kind === "fake";
+}
+
 // src/plugin.ts
 var commercePlugin = async (app, {
   db,
@@ -2607,7 +2884,8 @@ var commercePlugin = async (app, {
   hooks,
   admin,
   categoryLabels,
-  catalogCache
+  catalogCache,
+  devCheckout
 }) => {
   app.get("/health", async () => ({ status: "ok" }));
   await app.register(catalogPlugin, {
@@ -2625,6 +2903,7 @@ var commercePlugin = async (app, {
     });
   }
   if (!payment || !urls) return;
+  await payment.preflight?.();
   await app.register(ordersPlugin, {
     db,
     currency,
@@ -2633,6 +2912,23 @@ var commercePlugin = async (app, {
     shippingCountries,
     hooks
   });
+  if (devCheckout) {
+    assertDevCheckoutAllowed();
+    if (isFakeGateway(payment)) {
+      const apiUrl = typeof devCheckout === "object" ? devCheckout.apiUrl : "";
+      payment.useSessionUrl(
+        (id) => `${apiUrl ?? ""}${app.prefix}/checkout/dev/${id}/complete`
+      );
+      const buyer = typeof devCheckout === "object" ? devCheckout.buyer : void 0;
+      await app.register(devCheckoutRoutes, {
+        db,
+        payment,
+        urls,
+        hooks,
+        buyer
+      });
+    }
+  }
   if (admin) {
     await app.register(adminOrdersPlugin, {
       db,
@@ -2649,6 +2945,19 @@ var commercePlugin = async (app, {
   }
 };
 
+// src/payment/stripe-loader.ts
+async function loadStripe(secretKey) {
+  try {
+    const { default: StripeClient } = await import("stripe");
+    return new StripeClient(secretKey);
+  } catch (cause) {
+    throw new Error(
+      '@develemit/commerce-server: STRIPE_SECRET_KEY is set but the optional peer "stripe" is not installed. Run: pnpm add stripe',
+      { cause }
+    );
+  }
+}
+
 // src/payment/stripe-gateway.ts
 var REFUND_KEY_METADATA = "commerceRefundKey";
 function rejectedRefund(err) {
@@ -2765,19 +3074,16 @@ async function refundedEvent(stripe, event) {
     refunds: refunds.filter((refund) => refund.status !== "failed").map(toRefundEvent)
   };
 }
-function createCoupon(stripe, { discount, currency }) {
+function createCoupon(stripe, { discount, currency, expiresAt }) {
   return stripe.coupons.create({
     amount_off: discount.amountCents,
     currency: currency.toLowerCase(),
     duration: "once",
     max_redemptions: 1,
+    redeem_by: Math.floor(expiresAt.getTime() / 1e3),
     name: discount.code
   });
 }
-async function loadStripe(secretKey) {
-  const { default: StripeClient } = await import("stripe");
-  return new StripeClient(secretKey);
-}
 function createStripeGateway({
   secretKey,
   webhookSecret,
@@ -2786,6 +3092,9 @@ function createStripeGateway({
   let stripe = client ? Promise.resolve(client) : void 0;
   const getStripe = () => stripe ??= loadStripe(secretKey);
   return {
+    async preflight() {
+      await getStripe();
+    },
     async createCheckoutSession(input) {
       const stripeClient = await getStripe();
       const coupon = input.discount && await createCoupon(stripeClient, input);
@@ -2868,111 +3177,6 @@ function createStripeGateway({
   };
 }
 
-// src/payment/fake-gateway.ts
-import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
-function createFakeGateway({
-  secret = "fake-webhook-secret"
-} = {}) {
-  const sessions = [];
-  const refunds = [];
-  const refundCalls = [];
-  let pendingFailure;
-  let pendingRefundFailure;
-  const hmac = (body) => createHmac("sha256", secret).update(body).digest("hex");
-  function sign(event) {
-    const rawBody = Buffer.from(JSON.stringify(event));
-    return { rawBody, signature: hmac(rawBody) };
-  }
-  return {
-    sessions,
-    refunds,
-    refundCalls,
-    async createCheckoutSession(input) {
-      if (pendingFailure) {
-        const err = pendingFailure;
-        pendingFailure = void 0;
-        throw err;
-      }
-      const id = `fake_cs_${randomUUID3()}`;
-      sessions.push({ ...input, id });
-      return {
-        id,
-        url: input.successUrl.replace(SESSION_ID_PLACEHOLDER, id)
-      };
-    },
-    async verifyWebhook(rawBody, signature) {
-      const expected = Buffer.from(hmac(rawBody));
-      const given = Buffer.from(signature ?? "");
-      if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
-        throw new WebhookSignatureError();
-      }
-      return JSON.parse(rawBody.toString("utf8"));
-    },
-    async refund(input) {
-      refundCalls.push(input);
-      if (pendingRefundFailure) {
-        const err = pendingRefundFailure;
-        pendingRefundFailure = void 0;
-        throw err;
-      }
-      const prior = refunds.find(
-        (r) => r.idempotencyKey === input.idempotencyKey
-      );
-      if (prior) return { gatewayRefundId: prior.gatewayRefundId };
-      const gatewayRefundId = `fake_re_${refunds.length + 1}_${input.sessionId}`;
-      refunds.push({ ...input, gatewayRefundId });
-      return { gatewayRefundId };
-    },
-    failNextSession(error = new Error("Fake gateway failure")) {
-      pendingFailure = error;
-    },
-    failNextRefund(error = new RefundRejectedError("Fake refund failure")) {
-      pendingRefundFailure = error;
-    },
-    failNextRefundUncertain(error = new Error("Fake refund timeout")) {
-      pendingRefundFailure = error;
-    },
-    completed(sessionId, details = {}) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.completed",
-        sessionId,
-        ...details
-      });
-    },
-    asyncPaid(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.async_paid",
-        sessionId
-      });
-    },
-    asyncFailed(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.async_failed",
-        sessionId
-      });
-    },
-    expired(sessionId) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "checkout.expired",
-        sessionId
-      });
-    },
-    refunded(sessionId, refunds2) {
-      return sign({
-        id: `fake_evt_${randomUUID3()}`,
-        type: "payment.refunded",
-        sessionId,
-        refunds: refunds2
-      });
-    },
-    sign
-  };
-}
-
 // src/hold-sweeper.ts
 async function sweepExpiredHolds(db) {
   await db.transaction(async (tx) => {
@@ -2987,6 +3191,89 @@ function startHoldSweeper(db, { intervalMs = 6e4, onError } = {}) {
   return { stop: () => clearInterval(timer) };
 }
 
+// src/emails/order-lines.ts
+var defaultLabels = {
+  subtotal: "Subtotal",
+  discount: (code) => code ? `Discount (${code})` : "Discount",
+  shipping: (label) => label ? `Shipping (${label})` : "Shipping",
+  total: "Total"
+};
+var escapes = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (c) => escapes[c]);
+}
+function addressLines(order) {
+  const a = order.shippingAddress;
+  if (!a) return void 0;
+  const lines = [
+    a.name,
+    a.line1,
+    a.line2,
+    [a.city, a.state, a.postalCode].filter(Boolean).join(" "),
+    a.country
+  ].filter((l) => Boolean(l));
+  return lines.length ? lines : void 0;
+}
+function textBlock(lines) {
+  return lines.map((l) => `${l.label}  ${l.amount}`).join("\n");
+}
+function htmlRows(lines) {
+  return lines.map(
+    (l) => `<tr><td>${escapeHtml(l.label)}</td><td align="right">${escapeHtml(l.amount)}</td></tr>`
+  ).join("");
+}
+function orderEmailLines(order, options = {}) {
+  const locale = options.locale ?? "en-US";
+  const labels = { ...defaultLabels, ...options.labels };
+  const money = (cents) => new Intl.NumberFormat(locale, {
+    style: "currency",
+    currency: order.currency
+  }).format(cents / 100);
+  const items = order.items.map((i) => ({
+    label: `${i.name} \xD7 ${i.quantity}`,
+    amount: money(i.priceCents * i.quantity)
+  }));
+  const subtotal = {
+    label: labels.subtotal,
+    amount: money(order.subtotalCents)
+  };
+  const discount = order.discountCents > 0 ? {
+    label: labels.discount(order.discountCode),
+    amount: `-${money(order.discountCents)}`
+  } : void 0;
+  const shipping = {
+    label: labels.shipping(order.shippingLabel),
+    amount: money(order.shippingCents)
+  };
+  const total = { label: labels.total, amount: money(order.totalCents) };
+  const address = addressLines(order);
+  const totals = [subtotal, ...discount ? [discount] : [], shipping, total];
+  return {
+    items,
+    subtotal,
+    discount,
+    shipping,
+    total,
+    address,
+    text: {
+      items: textBlock(items),
+      totals: textBlock(totals),
+      address: address?.join("\n") ?? ""
+    },
+    html: {
+      items: htmlRows(items),
+      totals: htmlRows(totals),
+      address: address?.map((l) => `<p>${escapeHtml(l)}</p>`).join("") ?? ""
+    }
+  };
+}
+
 // src/db/migrate.ts
 import path from "path";
 import { fileURLToPath } from "url";
@@ -3064,17 +3351,136 @@ function createMemoryStorage(baseUrl = "memory://") {
     }
   };
 }
+
+// src/storage/disk.ts
+import { createReadStream, createWriteStream } from "fs";
+import { mkdir, realpath, rm, stat } from "fs/promises";
+import path2 from "path";
+import { pipeline } from "stream/promises";
+var contentTypes = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".gif": "image/gif",
+  ".avif": "image/avif"
+};
+function hasTraversalSegment(key) {
+  return key.split(/[\\/]/).some((segment) => segment === "..");
+}
+function decodesToTraversal(key) {
+  try {
+    return hasTraversalSegment(decodeURIComponent(key));
+  } catch {
+    return true;
+  }
+}
+function isInside(root, target) {
+  return target.startsWith(root + path2.sep);
+}
+function resolveKey(dir, key) {
+  if (!key || key.includes("\0") || path2.isAbsolute(key)) return null;
+  if (hasTraversalSegment(key) || decodesToTraversal(key)) return null;
+  const root = path2.resolve(dir);
+  const target = path2.resolve(root, key);
+  return isInside(root, target) ? target : null;
+}
+async function realInside(dir, target, allowRoot = false) {
+  const [root, real] = await Promise.all([
+    realpath(dir),
+    realpath(target)
+  ]).catch(() => [null, null]);
+  if (!root || !real) return null;
+  return isInside(root, real) || allowRoot && real === root ? real : null;
+}
+function createDiskStorage(options) {
+  const { dir, publicUrl } = options;
+  const base = publicUrl.replace(/\/+$/, "");
+  return {
+    async put(key, stream) {
+      const target = resolveKey(dir, key);
+      if (!target)
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      await mkdir(path2.dirname(target), { recursive: true });
+      if (!await realInside(dir, path2.dirname(target), true).catch(() => null)) {
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      }
+      await pipeline(stream, createWriteStream(target));
+      return { key, url: `${base}/${key}` };
+    },
+    async delete(key) {
+      const target = resolveKey(dir, key);
+      if (!target)
+        throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
+      if (!await realInside(dir, path2.dirname(target), true).catch(() => null))
+        return;
+      await rm(target, { force: true });
+    }
+  };
+}
+async function openStoredFile(dir, key) {
+  const target = resolveKey(dir, key);
+  if (!target) return null;
+  const real = await realInside(dir, target);
+  if (!real) return null;
+  const info = await stat(real).catch(() => null);
+  if (!info?.isFile()) return null;
+  const contentType = contentTypes[path2.extname(real).toLowerCase()];
+  return { stream: createReadStream(real), contentType, size: info.size };
+}
+
+// src/payment/resolve.ts
+function resolvePayment(env = process.env) {
+  const secretKey = env.STRIPE_SECRET_KEY || void 0;
+  const webhookSecret = env.STRIPE_WEBHOOK_SECRET || void 0;
+  if (!secretKey !== !webhookSecret) {
+    throw new Error(
+      "Set STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET together, or neither"
+    );
+  }
+  if (env.PAYMENT_GATEWAY === "stripe" && !secretKey) {
+    throw new Error("PAYMENT_GATEWAY=stripe needs the Stripe keys");
+  }
+  if (env.PAYMENT_GATEWAY === "fake" || !secretKey) {
+    if (env.NODE_ENV === "production") {
+      throw new Error(
+        "The fake payment gateway is not allowed in production; set the Stripe keys"
+      );
+    }
+    return createFakeGateway();
+  }
+  return createStripeGateway({ secretKey, webhookSecret });
+}
+function checkoutUrls(webUrl, {
+  successPath = "/checkout/success",
+  cancelPath = "/shop"
+} = {}) {
+  const base = webUrl.replace(/\/+$/, "");
+  return {
+    success: (sessionId) => {
+      const id = sessionId === SESSION_ID_PLACEHOLDER ? sessionId : encodeURIComponent(sessionId);
+      return `${base}${successPath}?session_id=${id}`;
+    },
+    cancel: `${base}${cancelPath}`
+  };
+}
 export {
   ProductNotFoundError,
   SESSION_ID_PLACEHOLDER,
   WebhookSignatureError,
   catalogPlugin,
+  checkoutUrls,
   commercePlugin,
   commerceSchema,
+  createDiskStorage,
   createFakeGateway,
   createMemoryStorage,
   createStripeGateway,
+  isFakeGateway,
+  openStoredFile,
+  orderEmailLines,
   ordersPlugin,
+  resolvePayment,
   runCommerceMigrations,
   seedProducts,
   seedShippingRates,