@develemit/commerce-server 0.6.0 → 0.8.0

package/dist/index.js

@@ -72,16 +72,17 @@ var products = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     slug: text("slug").notNull().unique(),
-    name: text("name").notNull(),
+    name: text("name").notNull().default(""),
     description: text("description").notNull().default(""),
     materials: text("materials"),
     dimensions: text("dimensions"),
-    priceCents: integer("price_cents").notNull(),
+    priceCents: integer("price_cents"),
     currency: text("currency").notNull(),
-    category: text("category").notNull(),
+    category: text("category"),
     quantity: integer("quantity").notNull().default(1),
     status: productStatus("status").notNull().default("draft"),
     featured: boolean("featured").notNull().default(false),
+    publishedAt: timestamp("published_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -331,17 +332,17 @@ async function setShippingRates(db, rates) {
   return listShippingRates(db);
 }
 
-// src/admin/images.ts
-import { Readable } from "stream";
-
 // src/admin/repo.ts
 import {
   and as and2,
   asc as asc2,
+  desc,
   eq as eq2,
   gt,
   ilike,
   inArray,
+  lt,
+  ne,
   or,
   sql as sql2
 } from "drizzle-orm";
@@ -361,9 +362,12 @@ async function withImages(db, rows) {
 function escapeLike(value) {
   return value.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
+var incompleteDraft = sql2`(${products.status} = 'draft' and (${products.name} = '' or ${products.priceCents} is null or ${products.category} is null))`;
 function pageConditions(filter) {
   const parts = [];
   if (filter.status) parts.push(eq2(products.status, filter.status));
+  if (filter.excludeArchived) parts.push(ne(products.status, "archived"));
+  if (filter.incomplete) parts.push(incompleteDraft);
   if (filter.stock === "in") parts.push(gt(products.quantity, 0));
   if (filter.stock === "sold") parts.push(eq2(products.quantity, 0));
   if (filter.q) parts.push(ilike(products.name, `%${escapeLike(filter.q)}%`));
@@ -371,10 +375,10 @@ function pageConditions(filter) {
     const createdAt = sql2`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or(
-        gt(products.createdAt, createdAt),
+        lt(products.createdAt, createdAt),
         and2(
           eq2(products.createdAt, createdAt),
-          gt(products.slug, filter.after.slug)
+          lt(products.slug, filter.after.slug)
         )
       )
     );
@@ -385,7 +389,7 @@ async function selectProductPage(db, filter) {
   const selected = await db.select({
     product: products,
     createdAtKey: sql2`${products.createdAt}::text`
-  }).from(products).where(pageConditions(filter)).orderBy(asc2(products.createdAt), asc2(products.slug)).limit(filter.limit);
+  }).from(products).where(pageConditions(filter)).orderBy(desc(products.createdAt), desc(products.slug)).limit(filter.limit);
   const records = await withImages(
     db,
     selected.map((s) => s.product)
@@ -429,6 +433,26 @@ async function setImagePosition(db, id, position) {
 async function setImageAlt(db, id, alt) {
   await db.update(productImages).set({ alt }).where(eq2(productImages.id, id));
 }
+async function selectProductCounts(db) {
+  const [row] = await db.select({
+    all: sql2`count(*) filter (where ${products.status} <> 'archived')::int`,
+    live: sql2`count(*) filter (where ${products.status} = 'active' and ${products.quantity} > 0)::int`,
+    draft: sql2`count(*) filter (where ${products.status} = 'draft')::int`,
+    sold: sql2`count(*) filter (where ${products.status} = 'active' and ${products.quantity} = 0)::int`,
+    archived: sql2`count(*) filter (where ${products.status} = 'archived')::int`,
+    incompleteDrafts: sql2`count(*) filter (where ${products.status} = 'draft' and (${products.name} = '' or ${products.priceCents} is null or ${products.category} is null))::int`
+  }).from(products);
+  return row;
+}
+async function productHasOrderLines(db, productId) {
+  const rows = await db.select({ id: orderItems.id }).from(orderItems).where(eq2(orderItems.productId, productId)).limit(1);
+  return rows.length > 0;
+}
+async function deleteProductRows(db, id) {
+  await db.delete(inventoryHolds).where(eq2(inventoryHolds.productId, id));
+  await db.delete(productImages).where(eq2(productImages.productId, id));
+  await db.delete(products).where(eq2(products.id, id));
+}
 
 // src/admin/service.ts
 import {
@@ -436,6 +460,65 @@ import {
   adminProductListQuerySchema,
   adminProductPatchSchema
 } from "@develemit/commerce-contracts";
+import { randomUUID } from "crypto";
+
+// src/admin/types.ts
+var ProductImageNotFoundError = class extends Error {
+  constructor(imageId) {
+    super(`Image not found: ${imageId}`);
+    this.imageId = imageId;
+    this.name = "ProductImageNotFoundError";
+  }
+  imageId;
+  code = "IMAGE_NOT_FOUND";
+};
+var InvalidImageOrderError = class extends Error {
+  code = "INVALID_IMAGE_ORDER";
+  constructor() {
+    super("imageIds must list every image of the product exactly once");
+    this.name = "InvalidImageOrderError";
+  }
+};
+var ProductIncompleteError = class extends Error {
+  constructor(missing) {
+    super(`Product is missing: ${missing.join(", ")}`);
+    this.missing = missing;
+    this.name = "ProductIncompleteError";
+  }
+  missing;
+  code = "PRODUCT_INCOMPLETE";
+};
+var ProductNotDeletableError = class extends Error {
+  constructor(reason) {
+    super(
+      reason === "published" ? "This product has been live, so it can only be archived" : "This product is on an order, so it can only be archived"
+    );
+    this.reason = reason;
+    this.name = "ProductNotDeletableError";
+  }
+  reason;
+  code = "PRODUCT_NOT_DELETABLE";
+};
+
+// src/admin/publish.ts
+function temporarySlug(id) {
+  return `draft-${id.slice(0, 8)}`;
+}
+function missingForPublish({ row, images }, patch, requirePhoto) {
+  const name = patch.name ?? row.name;
+  const priceCents = patch.priceCents ?? row.priceCents;
+  const category = patch.category ?? row.category;
+  const missing = [];
+  if (!name) missing.push("name");
+  if (priceCents === null) missing.push("priceCents");
+  if (!category) missing.push("category");
+  if (requirePhoto && images.length === 0) missing.push("images");
+  return missing;
+}
+function assertPublishable(record, patch, requirePhoto) {
+  const missing = missingForPublish(record, patch, requirePhoto);
+  if (missing.length > 0) throw new ProductIncompleteError(missing);
+}
 
 // src/admin/slug.ts
 function slugify(name) {
@@ -464,6 +547,7 @@ function toAdminProduct({ row, images }) {
     quantity: row.quantity,
     status: row.status,
     featured: row.featured,
+    everPublished: row.publishedAt !== null,
     images: images.map((i) => ({
       id: i.id,
       url: i.url,
@@ -485,6 +569,8 @@ async function listAdminProducts(db, rawQuery = {}) {
   const query = adminProductListQuerySchema.parse(rawQuery);
   const found = await selectProductPage(db, {
     status: query.status,
+    excludeArchived: query.excludeArchived === "true",
+    incomplete: query.incomplete === "true",
     stock: query.stock,
     q: query.q,
     after: query.cursor ? decodeProductCursor(query.cursor) : void 0,
@@ -500,47 +586,70 @@ async function listAdminProducts(db, rawQuery = {}) {
 async function getAdminProduct(db, id) {
   return toAdminProduct(await requireProduct(db, id));
 }
-async function createAdminProduct(db, currency, input) {
+async function createAdminProduct(db, currency, input, { requirePhotoToPublish = true } = {}) {
   const data = adminProductInputSchema.parse(input);
-  const base = slugify(data.name);
+  if (data.status === "active" && requirePhotoToPublish) {
+    throw new ProductIncompleteError(["images"]);
+  }
+  const newId = randomUUID();
+  const base = data.name ? slugify(data.name) : temporarySlug(newId);
   const id = await db.transaction(async (tx) => {
     const slug = uniqueSlug(base, await slugsStartingWith(tx, base));
     return insertProduct(tx, {
       ...data,
+      publishedAt: data.status === "active" ? /* @__PURE__ */ new Date() : void 0,
+      id: newId,
       slug,
       currency: data.currency ?? currency
     });
   });
   return getAdminProduct(db, id);
 }
-async function patchAdminProduct(db, id, input) {
+async function patchAdminProduct(db, id, input, { requirePhotoToPublish = true } = {}) {
   const { sold, ...fields } = adminProductPatchSchema.parse(input);
-  await requireProduct(db, id);
-  const set = sold ? { ...fields, quantity: 0 } : fields;
-  if (Object.keys(set).length > 0) await updateProduct(db, id, set);
+  const record = await requireProduct(db, id);
+  if (fields.status === "active") {
+    const photoNeeded = requirePhotoToPublish && record.row.status !== "active";
+    assertPublishable(record, fields, photoNeeded);
+  }
+  const set = sold ? { ...fields, quantity: 0 } : { ...fields };
+  if (fields.status === "active" && !record.row.publishedAt) {
+    set.publishedAt = /* @__PURE__ */ new Date();
+  }
+  const renames = fields.name && record.row.slug === temporarySlug(id);
+  await db.transaction(async (tx) => {
+    if (renames) {
+      const base = slugify(fields.name);
+      set.slug = uniqueSlug(base, await slugsStartingWith(tx, base));
+    }
+    if (Object.keys(set).length > 0) await updateProduct(tx, id, set);
+  });
   return getAdminProduct(db, id);
 }
+async function getAdminProductCounts(db) {
+  return selectProductCounts(db);
+}
 
-// src/admin/types.ts
-var ProductImageNotFoundError = class extends Error {
-  constructor(imageId) {
-    super(`Image not found: ${imageId}`);
-    this.imageId = imageId;
-    this.name = "ProductImageNotFoundError";
+// src/admin/delete.ts
+async function deleteAdminProduct(db, storage, id) {
+  const { row, images } = await requireProduct(db, id);
+  if (row.status !== "draft" || row.publishedAt) {
+    throw new ProductNotDeletableError("published");
   }
-  imageId;
-  code = "IMAGE_NOT_FOUND";
-};
-var InvalidImageOrderError = class extends Error {
-  code = "INVALID_IMAGE_ORDER";
-  constructor() {
-    super("imageIds must list every image of the product exactly once");
-    this.name = "InvalidImageOrderError";
+  if (await productHasOrderLines(db, id)) {
+    throw new ProductNotDeletableError("has_orders");
   }
-};
+  await db.transaction((tx) => deleteProductRows(tx, id));
+  for (const image of images) {
+    if (image.storageKey) await storage.delete(image.storageKey);
+  }
+}
+
+// src/admin/images.ts
+import { Readable } from "stream";
 
 // src/admin/upload.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { fileTypeFromBuffer } from "file-type";
 var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
 var EXTENSIONS = {
@@ -565,7 +674,7 @@ async function detectImage(bytes) {
   return { mime: type.mime, ext };
 }
 function imageKey(productId, ext) {
-  return `products/${productId}/${randomUUID()}.${ext}`;
+  return `products/${productId}/${randomUUID2()}.${ext}`;
 }
 
 // src/admin/images.ts
@@ -625,7 +734,7 @@ async function updateProductImageAlt(db, productId, imageId, alt) {
 function isZodError(err) {
   return err instanceof Error && err.name === "ZodError";
 }
-var adminPlugin = async (app, { db, currency, authorize, storage }) => {
+var adminPlugin = async (app, { db, currency, authorize, storage, requirePhotoToPublish }) => {
   const { default: multipart } = await import("@fastify/multipart");
   await app.register(multipart, {
     limits: { fileSize: MAX_IMAGE_BYTES, files: 1 }
@@ -637,6 +746,20 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
     if (err instanceof ProductNotFoundError || err instanceof ProductImageNotFoundError) {
       return reply.code(404).send({ error: err.code, message: err.message });
     }
+    if (err instanceof ProductIncompleteError) {
+      return reply.code(422).send({
+        error: err.code,
+        message: err.message,
+        missing: err.missing
+      });
+    }
+    if (err instanceof ProductNotDeletableError) {
+      return reply.code(409).send({
+        error: err.code,
+        message: err.message,
+        reason: err.reason
+      });
+    }
     if (err instanceof InvalidCursorError || err instanceof InvalidImageError || err instanceof InvalidImageOrderError) {
       return reply.code(400).send({ error: err.code, message: err.message });
     }
@@ -656,9 +779,12 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
       await listAdminProducts(db, req.query)
     )
   );
+  app.get("/products/counts", async () => getAdminProductCounts(db));
   app.post("/products", async (req, reply) => {
     const input = adminProductInputSchema2.parse(req.body);
-    const created = await createAdminProduct(db, currency, input);
+    const created = await createAdminProduct(db, currency, input, {
+      requirePhotoToPublish
+    });
     return reply.code(201).send(created);
   });
   app.get(
@@ -670,9 +796,17 @@ var adminPlugin = async (app, { db, currency, authorize, storage }) => {
     async (req) => patchAdminProduct(
       db,
       req.params.id,
-      adminProductPatchSchema2.parse(req.body)
+      adminProductPatchSchema2.parse(req.body),
+      { requirePhotoToPublish }
     )
   );
+  app.delete(
+    "/products/:id",
+    async (req, reply) => {
+      await deleteAdminProduct(db, storage, req.params.id);
+      return reply.code(204).send();
+    }
+  );
   app.post(
     "/products/:id/images",
     async (req, reply) => {
@@ -758,7 +892,7 @@ function addCatalogCaching(app, { cacheControl = DEFAULT_CATALOG_CACHE_CONTROL }
 }
 
 // src/inventory/repo.ts
-import { and as and3, asc as asc3, eq as eq3, gt as gt2, inArray as inArray2, lt, sql as sql3 } from "drizzle-orm";
+import { and as and3, asc as asc3, eq as eq3, gt as gt2, inArray as inArray2, lt as lt2, sql as sql3 } from "drizzle-orm";
 async function lockProductQuantities(tx, productIds) {
   const rows = await tx.select({ id: products.id, quantity: products.quantity }).from(products).where(inArray2(products.id, productIds)).orderBy(asc3(products.id)).for("update");
   return new Map(rows.map((r) => [r.id, r.quantity]));
@@ -845,7 +979,7 @@ async function releaseExpiredHolds(db) {
   const released = await db.update(inventoryHolds).set({ status: "released" }).where(
     and3(
       eq3(inventoryHolds.status, "active"),
-      lt(inventoryHolds.expiresAt, sql3`now()`)
+      lt2(inventoryHolds.expiresAt, sql3`now()`)
     )
   ).returning({ reference: inventoryHolds.reference });
   return released.map((r) => r.reference);
@@ -950,7 +1084,12 @@ async function restock(tx, items) {
 }
 
 // src/catalog/repo.ts
-import { and as and4, asc as asc4, eq as eq4, gt as gt3, inArray as inArray3, or as or2, sql as sql4 } from "drizzle-orm";
+import { and as and4, asc as asc4, eq as eq4, gt as gt3, inArray as inArray3, isNotNull, or as or2, sql as sql4 } from "drizzle-orm";
+var isListed = and4(
+  eq4(products.status, "active"),
+  isNotNull(products.priceCents),
+  isNotNull(products.category)
+);
 async function attachImages(db, rows, firstOnly = false) {
   if (rows.length === 0) return [];
   const where = inArray3(
@@ -964,7 +1103,7 @@ async function attachImages(db, rows, firstOnly = false) {
   }));
 }
 async function listActiveProducts(db, filter) {
-  const conditions2 = [eq4(products.status, "active")];
+  const conditions2 = [isListed];
   if (filter.category) conditions2.push(eq4(products.category, filter.category));
   if (filter.featured !== void 0)
     conditions2.push(eq4(products.featured, filter.featured));
@@ -995,22 +1134,30 @@ async function listActiveProducts(db, filter) {
   }));
 }
 async function findActiveProductBySlug(db, slug) {
-  const rows = await db.select().from(products).where(and4(eq4(products.slug, slug), eq4(products.status, "active"))).limit(1);
+  const rows = await db.select().from(products).where(and4(eq4(products.slug, slug), isListed)).limit(1);
   return (await attachImages(db, rows))[0];
 }
 async function countActiveByCategory(db) {
   const rows = await db.select({
     category: products.category,
     count: sql4`count(*)::int`
-  }).from(products).where(eq4(products.status, "active")).groupBy(products.category).orderBy(asc4(products.category));
-  return rows;
+  }).from(products).where(isListed).groupBy(products.category).orderBy(asc4(products.category));
+  return rows.flatMap(
+    (r) => r.category === null ? [] : [{ category: r.category, count: r.count }]
+  );
 }
 async function findActiveProductsByIds(db, ids) {
   if (ids.length === 0) return [];
-  return db.select().from(products).where(and4(inArray3(products.id, ids), eq4(products.status, "active")));
+  return db.select().from(products).where(and4(inArray3(products.id, ids), isListed));
 }
 
 // src/catalog/service.ts
+function completeFields(row) {
+  if (row.priceCents === null || row.category === null) {
+    throw new Error(`Active product ${row.id} is missing price or category`);
+  }
+  return { priceCents: row.priceCents, category: row.category };
+}
 function availabilityOf(quantity, free) {
   if (free > 0) return "available";
   return quantity > 0 ? "reserved" : "sold";
@@ -1024,9 +1171,8 @@ function toProduct({ row, images }, free) {
     description: row.description,
     ...row.materials ? { materials: row.materials } : {},
     ...row.dimensions ? { dimensions: row.dimensions } : {},
-    priceCents: row.priceCents,
+    ...completeFields(row),
     currency: row.currency,
-    category: row.category,
     images: images.map((i) => ({ url: i.url, alt: i.alt })),
     quantity: freeQty,
     availability: availabilityOf(row.quantity, freeQty),
@@ -1079,7 +1225,7 @@ async function findPurchasable(db, ids) {
   return rows.map((row) => ({
     id: row.id,
     name: row.name,
-    priceCents: row.priceCents,
+    priceCents: completeFields(row).priceCents,
     currency: row.currency
   }));
 }
@@ -1126,8 +1272,11 @@ import {
   shipOrderInputSchema
 } from "@develemit/commerce-contracts";
 
+// src/orders/admin-service.ts
+import { orderRefSearchTerm } from "@develemit/commerce-contracts";
+
 // src/orders/admin-repo.ts
-import { and as and5, desc, eq as eq5, ilike as ilike2, lt as lt2, or as or3, sql as sql5 } from "drizzle-orm";
+import { and as and5, desc as desc2, eq as eq5, ilike as ilike2, lt as lt3, or as or3, sql as sql5 } from "drizzle-orm";
 function escapeLike2(value) {
   return value.replace(/[\\%_]/g, (c) => `\\${c}`);
 }
@@ -1153,8 +1302,8 @@ function conditions(filter) {
     const createdAt = sql5`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or3(
-        lt2(orders.createdAt, createdAt),
-        and5(eq5(orders.createdAt, createdAt), lt2(orders.id, id))
+        lt3(orders.createdAt, createdAt),
+        and5(eq5(orders.createdAt, createdAt), lt3(orders.id, id))
       )
     );
   }
@@ -1174,7 +1323,7 @@ async function selectOrderPage(db, filter) {
     itemCount,
     createdAt: orders.createdAt,
     createdAtKey: sql5`${orders.createdAt}::text`
-  }).from(orders).where(conditions(filter)).orderBy(desc(orders.createdAt), desc(orders.id)).limit(filter.limit);
+  }).from(orders).where(conditions(filter)).orderBy(desc2(orders.createdAt), desc2(orders.id)).limit(filter.limit);
 }
 async function findOrderRefunds(db, orderId) {
   return db.select().from(orderRefunds).where(eq5(orderRefunds.orderId, orderId)).orderBy(orderRefunds.createdAt, orderRefunds.id);
@@ -1184,10 +1333,10 @@ async function findOrderRefunds(db, orderId) {
 import { and as and7, asc as asc5, eq as eq7, sql as sql7 } from "drizzle-orm";
 
 // src/orders/refund-repo.ts
-import { and as and6, eq as eq6, isNotNull, isNull, or as or4, sql as sql6 } from "drizzle-orm";
+import { and as and6, eq as eq6, isNotNull as isNotNull2, isNull, or as or4, sql as sql6 } from "drizzle-orm";
 var isRecordedRefund = or4(
   isNull(orderRefunds.idempotencyKey),
-  isNotNull(orderRefunds.gatewayRefundId)
+  isNotNull2(orderRefunds.gatewayRefundId)
 );
 async function lockOrderForRefund(tx, id) {
   const [row] = await tx.select({
@@ -1397,7 +1546,7 @@ function decodeOrderCursor(raw) {
 async function listAdminOrders(db, query) {
   const rows = await selectOrderPage(db, {
     status: query.status,
-    q: query.q,
+    q: query.q ? orderRefSearchTerm(query.q) || void 0 : void 0,
     hasPendingRefund: query.hasPendingRefund,
     after: query.cursor ? decodeOrderCursor(query.cursor) : void 0,
     limit: query.limit + 1
@@ -1520,14 +1669,14 @@ function evaluateDiscount(discount, ctx) {
 // src/discounts/repo.ts
 import {
   and as and8,
-  desc as desc2,
+  desc as desc3,
   eq as eq8,
   getTableColumns,
   gt as gt4,
   ilike as ilike3,
   inArray as inArray4,
   isNull as isNull2,
-  lt as lt3,
+  lt as lt4,
   lte,
   or as or5,
   sql as sql8
@@ -1582,8 +1731,8 @@ function listConditions(filter) {
     const createdAt = sql8`${filter.after.createdAt}::timestamptz`;
     parts.push(
       or5(
-        lt3(discounts.createdAt, createdAt),
-        and8(eq8(discounts.createdAt, createdAt), lt3(discounts.id, id))
+        lt4(discounts.createdAt, createdAt),
+        and8(eq8(discounts.createdAt, createdAt), lt4(discounts.id, id))
       )
     );
   }
@@ -1606,7 +1755,7 @@ async function selectDiscountPage(db, filter) {
   return db.select({
     ...withCounts,
     createdAtKey: sql8`${discounts.createdAt}::text`
-  }).from(discounts).where(listConditions(filter)).orderBy(desc2(discounts.createdAt), desc2(discounts.id)).limit(filter.limit);
+  }).from(discounts).where(listConditions(filter)).orderBy(desc3(discounts.createdAt), desc3(discounts.id)).limit(filter.limit);
 }
 async function findDiscountById(db, id, options = {}) {
   const query = db.select(withCounts).from(discounts).where(eq8(discounts.id, id));
@@ -2356,21 +2505,50 @@ var adminDiscountsPlugin = async (app, { db, authorize }) => {
   );
 };
 
+// src/orders/dev-buyer.ts
+var DEFAULT_DEV_BUYER = {
+  email: "dev-buyer@example.com",
+  name: "Dev Buyer",
+  address: {
+    line1: "123 Example Street",
+    city: "Springfield",
+    state: "IL",
+    postalCode: "62701",
+    country: "US"
+  }
+};
+function resolveDevCompletion(setting, sessionId, firstRate) {
+  const buyer = typeof setting === "function" ? setting(sessionId) : setting;
+  const name = buyer?.name ?? DEFAULT_DEV_BUYER.name;
+  return {
+    email: buyer?.email ?? DEFAULT_DEV_BUYER.email,
+    shippingAddress: { name, ...buyer?.address ?? DEFAULT_DEV_BUYER.address },
+    shipping: firstRate && {
+      label: firstRate.label,
+      amountCents: firstRate.amountCents
+    }
+  };
+}
+
 // src/orders/dev-checkout.ts
 function assertDevCheckoutAllowed() {
   if (process.env.NODE_ENV === "production") {
     throw new Error("devCheckout is not allowed when NODE_ENV=production");
   }
 }
-var devCheckoutRoutes = async (app, { db, payment, urls, hooks }) => {
+var devCheckoutRoutes = async (app, { db, payment, urls, hooks, buyer }) => {
   assertDevCheckoutAllowed();
   app.get("/checkout/dev/:sessionId/complete", async (req, reply) => {
     const { sessionId } = req.params;
-    if (!payment.sessions.some((s) => s.id === sessionId)) {
+    const session = payment.sessions.find((s) => s.id === sessionId);
+    if (!session) {
       return reply.code(404).send({ error: "SESSION_NOT_FOUND" });
     }
     const expire = req.query.outcome === "expired";
-    const { rawBody, signature } = expire ? payment.expired(sessionId) : payment.completed(sessionId);
+    const { rawBody, signature } = expire ? payment.expired(sessionId) : payment.completed(
+      sessionId,
+      resolveDevCompletion(buyer, sessionId, session.shippingRates[0])
+    );
     const event = await payment.verifyWebhook(rawBody, signature);
     await handlePaymentEvent(db, event, hooks, req.log);
     return reply.redirect(expire ? urls.cancel : urls.success(sessionId), 302);
@@ -2429,7 +2607,7 @@ async function previewDiscount(db, request, currency, now = /* @__PURE__ */ new
 }
 
 // src/orders/checkout-service.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 var HOLD_DURATION_MS = 31 * 60 * 1e3;
 var UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function mergeItems(items) {
@@ -2504,7 +2682,7 @@ async function createCheckout(db, settings, request) {
     settings.currency
   );
   const shippingRates2 = await listActiveRates(db, settings.currency);
-  const orderId = randomUUID2();
+  const orderId = randomUUID3();
   const expiresAt = new Date(Date.now() + HOLD_DURATION_MS);
   const discount = await reserveOrder(db, {
     orderId,
@@ -2642,7 +2820,7 @@ var ordersPlugin = async (app, { db, ...settings }) => {
 };
 
 // src/payment/fake-gateway.ts
-import { createHmac, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
 function createFakeGateway({
   secret = "fake-webhook-secret"
 } = {}) {
@@ -2671,7 +2849,7 @@ function createFakeGateway({
         pendingFailure = void 0;
         throw err;
       }
-      const id = `fake_cs_${randomUUID3()}`;
+      const id = `fake_cs_${randomUUID4()}`;
       sessions.push({ ...input, id });
       return {
         id,
@@ -2712,7 +2890,7 @@ function createFakeGateway({
     },
     completed(sessionId, details = {}) {
       return sign({
-        id: `fake_evt_${randomUUID3()}`,
+        id: `fake_evt_${randomUUID4()}`,
         type: "checkout.completed",
         sessionId,
         ...details
@@ -2720,28 +2898,28 @@ function createFakeGateway({
     },
     asyncPaid(sessionId) {
       return sign({
-        id: `fake_evt_${randomUUID3()}`,
+        id: `fake_evt_${randomUUID4()}`,
         type: "checkout.async_paid",
         sessionId
       });
     },
     asyncFailed(sessionId) {
       return sign({
-        id: `fake_evt_${randomUUID3()}`,
+        id: `fake_evt_${randomUUID4()}`,
         type: "checkout.async_failed",
         sessionId
       });
     },
     expired(sessionId) {
       return sign({
-        id: `fake_evt_${randomUUID3()}`,
+        id: `fake_evt_${randomUUID4()}`,
         type: "checkout.expired",
         sessionId
       });
     },
     refunded(sessionId, refunds2) {
       return sign({
-        id: `fake_evt_${randomUUID3()}`,
+        id: `fake_evt_${randomUUID4()}`,
         type: "payment.refunded",
         sessionId,
         refunds: refunds2
@@ -2783,6 +2961,7 @@ var commercePlugin = async (app, {
     });
   }
   if (!payment || !urls) return;
+  await payment.preflight?.();
   await app.register(ordersPlugin, {
     db,
     currency,
@@ -2798,7 +2977,14 @@ var commercePlugin = async (app, {
       payment.useSessionUrl(
         (id) => `${apiUrl ?? ""}${app.prefix}/checkout/dev/${id}/complete`
       );
-      await app.register(devCheckoutRoutes, { db, payment, urls, hooks });
+      const buyer = typeof devCheckout === "object" ? devCheckout.buyer : void 0;
+      await app.register(devCheckoutRoutes, {
+        db,
+        payment,
+        urls,
+        hooks,
+        buyer
+      });
     }
   }
   if (admin) {
@@ -2817,6 +3003,19 @@ var commercePlugin = async (app, {
   }
 };
 
+// src/payment/stripe-loader.ts
+async function loadStripe(secretKey) {
+  try {
+    const { default: StripeClient } = await import("stripe");
+    return new StripeClient(secretKey);
+  } catch (cause) {
+    throw new Error(
+      '@develemit/commerce-server: STRIPE_SECRET_KEY is set but the optional peer "stripe" is not installed. Run: pnpm add stripe',
+      { cause }
+    );
+  }
+}
+
 // src/payment/stripe-gateway.ts
 var REFUND_KEY_METADATA = "commerceRefundKey";
 function rejectedRefund(err) {
@@ -2943,10 +3142,6 @@ function createCoupon(stripe, { discount, currency, expiresAt }) {
     name: discount.code
   });
 }
-async function loadStripe(secretKey) {
-  const { default: StripeClient } = await import("stripe");
-  return new StripeClient(secretKey);
-}
 function createStripeGateway({
   secretKey,
   webhookSecret,
@@ -2955,6 +3150,9 @@ function createStripeGateway({
   let stripe = client ? Promise.resolve(client) : void 0;
   const getStripe = () => stripe ??= loadStripe(secretKey);
   return {
+    async preflight() {
+      await getStripe();
+    },
     async createCheckoutSession(input) {
       const stripeClient = await getStripe();
       const coupon = input.discount && await createCoupon(stripeClient, input);
@@ -3052,6 +3250,9 @@ function startHoldSweeper(db, { intervalMs = 6e4, onError } = {}) {
 }
 
 // src/emails/order-lines.ts
+import {
+  formatOrderRef
+} from "@develemit/commerce-contracts";
 var defaultLabels = {
   subtotal: "Subtotal",
   discount: (code) => code ? `Discount (${code})` : "Discount",
@@ -3115,6 +3316,7 @@ function orderEmailLines(order, options = {}) {
   const address = addressLines(order);
   const totals = [subtotal, ...discount ? [discount] : [], shipping, total];
   return {
+    reference: formatOrderRef(order.id),
     items,
     subtotal,
     discount,
@@ -3245,12 +3447,13 @@ function resolveKey(dir, key) {
   const target = path2.resolve(root, key);
   return isInside(root, target) ? target : null;
 }
-async function realInside(dir, target) {
+async function realInside(dir, target, allowRoot = false) {
   const [root, real] = await Promise.all([
     realpath(dir),
     realpath(target)
   ]).catch(() => [null, null]);
-  return root && real && isInside(root, real) ? real : null;
+  if (!root || !real) return null;
+  return isInside(root, real) || allowRoot && real === root ? real : null;
 }
 function createDiskStorage(options) {
   const { dir, publicUrl } = options;
@@ -3261,7 +3464,7 @@ function createDiskStorage(options) {
       if (!target)
         throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
       await mkdir(path2.dirname(target), { recursive: true });
-      if (!await realInside(dir, path2.dirname(target)).catch(() => null)) {
+      if (!await realInside(dir, path2.dirname(target), true).catch(() => null)) {
         throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
       }
       await pipeline(stream, createWriteStream(target));
@@ -3271,7 +3474,7 @@ function createDiskStorage(options) {
       const target = resolveKey(dir, key);
       if (!target)
         throw new Error(`Invalid storage key: ${JSON.stringify(key)}`);
-      if (!await realInside(dir, path2.dirname(target)).catch(() => null))
+      if (!await realInside(dir, path2.dirname(target), true).catch(() => null))
         return;
       await rm(target, { force: true });
     }
@@ -3316,7 +3519,10 @@ function checkoutUrls(webUrl, {
 } = {}) {
   const base = webUrl.replace(/\/+$/, "");
   return {
-    success: (sessionId) => `${base}${successPath}?session_id=${encodeURIComponent(sessionId)}`,
+    success: (sessionId) => {
+      const id = sessionId === SESSION_ID_PLACEHOLDER ? sessionId : encodeURIComponent(sessionId);
+      return `${base}${successPath}?session_id=${id}`;
+    },
     cancel: `${base}${cancelPath}`
   };
 }