@mohasinac/appkit 4.1.3 → 4.3.0

package/dist/_internal/server/features/checkout/actions.js

@@ -1,5 +1,4 @@
 import { normalizeError } from "../../../../errors/normalize";
-import { safeFireAndForget } from "../../../../utils/safe-fire-forget";
 import { roundRupees } from "../../../../utils/number.formatter";
 /**
  * Checkout server actions (appkit).
@@ -12,27 +11,25 @@ import { roundRupees } from "../../../../utils/number.formatter";
 import { ApiError, ValidationError, NotFoundError, ERROR_MESSAGES } from "../../../../errors";
 import { ORDER_FIELDS } from "../../../../constants/field-names";
 import { serverLogger } from "../../../../monitoring";
-import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, notificationRepository, claimedCouponsRepository, addressesRepository, } from "../../../../repositories";
+import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, claimedCouponsRepository, addressesRepository, } from "../../../../repositories";
 import { calculateGst } from "../../../shared/fees/calculator";
 import { computePreOrderDepositAmount } from "../../../shared/checkout/order-math";
 import { failedCheckoutRepository } from "../../../../features/checkout/repository/failed-checkout.repository";
 import { sendOrderConfirmationEmail } from "../../../../features/contact/server";
 import { splitCartIntoOrderGroups } from "../../../../features/orders/index";
-import { resolveDate } from "../../../../utils";
-import { computeCodHandlingFee } from "../../../shared/fees/calculator";
+import { computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, } from "../../../shared/fees/calculator";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index";
 // S-SBUNI-RULES 2026-05-13 — bundle cart-line stock fan-out helpers.
 import { getCartItemMemberIds, getExpandedDecrements, bucketCartItemsByStock, } from "./bundle-expansion";
-import { consentOtpRef, consentOtpRateLimitRef, CONSENT_OTP_MAX_BYPASS_CREDITS, } from "../../../../features/auth/server";
 import { OrderStatusValues, PaymentStatusValues, PaymentMethodValues, OutOfStockPolicyValues, } from "../../../../features/orders/schemas/index";
 import { getDefaultCurrency } from "../../../../core/index";
 import { verifyPaymentSignatureWithKeys, fetchRazorpayOrder, paiseToRupees, } from "../../../../providers/payment-razorpay/index";
 import { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_DEFAULT_EMI_SETTINGS } from "../../../shared/features/checkout/config";
 import { checkEmiEligibility, computeEmiSchedule } from "../../../shared/features/emi/schedule";
 import { formatShippingAddress } from "./data";
-import { enforceMaxPerUserForCart, computePrizeRevealDeadline, } from "./prize-bundle-gates";
+import { enforceMaxPerUserForCart } from "./prize-bundle-gates";
 import { getListingRule, runSyncPreflight, } from "../../../shared/checkout/rules";
 import { cartIsDigitalOnly } from "../../../shared/listing-types/cart-shipping";
 import { processRefundAction } from "../refunds/actions";
@@ -112,9 +109,8 @@ function assertLiveJurisdiction(cartItemsArg, productByIdArg, buyerState) {
  * either party. We emit the buyer + seller rows here at the create boundary.
  */
 function emitOrderPlacedNotifications(args) {
-    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid } = args;
-    const buyerNotif = notificationRepository
-        .create({
+    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid, whatsappNotifyAddon } = args;
+    const buyerNotif = sendNotification({
         userId: buyerUid,
         type: "order_placed",
         priority: "normal",
@@ -123,14 +119,13 @@ function emitOrderPlacedNotifications(args) {
         relatedId: orderId,
         relatedType: "order",
         actionUrl: `/user/orders/view/${orderId}`,
-    })
-        .catch((err) => serverLogger.warn("Failed to create buyer order_placed notification", {
+        orderWhatsappAddonPaid: whatsappNotifyAddon,
+    }).catch((err) => serverLogger.warn("Failed to send buyer order_placed notification", {
         err: err instanceof Error ? err.message : String(err),
         orderId,
     }));
     const sellerNotif = storeOwnerId
-        ? notificationRepository
-            .create({
+        ? sendNotification({
             userId: storeOwnerId,
             type: "order_placed",
             priority: "high",
@@ -139,8 +134,7 @@ function emitOrderPlacedNotifications(args) {
             relatedId: orderId,
             relatedType: "order",
             actionUrl: `/store/orders/${orderId}/view`,
-        })
-            .catch((err) => serverLogger.warn("Failed to create seller order_placed notification", {
+        }).catch((err) => serverLogger.warn("Failed to send seller order_placed notification", {
             err: err instanceof Error ? err.message : String(err),
             orderId,
         }))
@@ -218,18 +212,6 @@ async function flushCouponUsageAccumulator(accumulator, uid) {
         serverLogger.error("Failed to record coupon usage:", { err: err instanceof Error ? err.message : String(err) });
     }
 }
-function grantConsentOtpBypassCredit(db, uid, emailOtpUsed, unavailableCount) {
-    if (!emailOtpUsed || unavailableCount === 0)
-        return;
-    const metaRef = consentOtpRateLimitRef(db, uid);
-    metaRef
-        .get()
-        .then((snap) => {
-        const cur = snap.exists ? (snap.data()?.bypassCredits ?? 0) : 0;
-        return metaRef.set({ bypassCredits: Math.min(cur + 1, CONSENT_OTP_MAX_BYPASS_CREDITS) }, { merge: true });
-    })
-        .catch((err) => serverLogger.warn("Failed to grant consent OTP bypass credit", { err }));
-}
 function dispatchOrderConfirmationEmails(emailsToSend) {
     if (emailsToSend.length === 0)
         return;
@@ -251,7 +233,7 @@ function unitPriceFor(item, product) {
  * so the caller can accumulate the checkout-wide `total`.
  */
 async function createOrderForGroup(group, orderType, ctx) {
-    const { paymentMethod, emiTenureMonths, emiSettings, commissions, appliedCoupons, cartSubtotal, couponUsageAccumulator, uid, userName, userEmail, shippingAddress, notes, adminBypass, adminBypassBy, adminBatchId, orderIds, emailsToSend, outOfStockPolicy, droppedItems, buyerState, gstSettings, siteContactUpiVpa, } = ctx;
+    const { paymentMethod, emiTenureMonths, emiSettings, commissions, appliedCoupons, cartSubtotal, couponUsageAccumulator, uid, userName, userEmail, shippingAddress, notes, adminBypass, adminBypassBy, adminBatchId, orderIds, emailsToSend, outOfStockPolicy, droppedItems, buyerState, gstSettings, siteContactUpiVpa, whatsappNotifyAddon, giftWrapAddon, giftWrapMessage, shipmentProtectionAddon, } = ctx;
     const firstItem = group[0].item;
     const firstProduct = group[0].product;
     const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
@@ -327,6 +309,9 @@ async function createOrderForGroup(group, orderType, ctx) {
     // Handling fee charged to the buyer for choosing COD, on top of the order
     // total — not deducted from the deposit/remaining split above.
     const codHandlingFee = paymentMethod === "cod" ? computeCodHandlingFee(groupTotal, commissions) : 0;
+    const whatsappNotifyFee = computeWhatsAppNotifyFee(whatsappNotifyAddon, commissions);
+    const giftWrapFee = computeGiftWrapFee(giftWrapAddon, commissions);
+    const shipmentProtectionFee = computeShipmentProtectionFee(groupTotal, shipmentProtectionAddon, commissions);
     let couponDiscount = 0;
     const appliedDiscounts = [];
     const groupCouponCodes = new Set();
@@ -371,7 +356,7 @@ async function createOrderForGroup(group, orderType, ctx) {
         }
     }
     couponDiscount = Math.min(couponDiscount, groupTotal);
-    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + (emiSchedule?.surchargeAmount ?? 0) + (gstBreakdown?.gstAmount ?? 0);
+    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee + (emiSchedule?.surchargeAmount ?? 0) + (gstBreakdown?.gstAmount ?? 0);
     const imageUrls = [
         ...new Set(group
             .map(({ product }) => product.mainImage)
@@ -382,9 +367,6 @@ async function createOrderForGroup(group, orderType, ctx) {
     const groupRule = getListingRule(lt0);
     const extraOrderFields = {
         ...groupRule.decorateOrderDoc(group[0].item, group[0].product),
-        ...(orderType === "prize-draw"
-            ? { prizeRevealDeadline: computePrizeRevealDeadline(group[0].product) }
-            : {}),
     };
     // ── 15-minute payment window + seller UPI resolution (Tier PP) ──────────
     // Deadline + displayed UPI apply only to methods with a buyer-uploaded
@@ -428,6 +410,13 @@ async function createOrderForGroup(group, orderType, ctx) {
         depositAmount: adminBypass ? undefined : depositAmount,
         codRemainingAmount: adminBypass ? undefined : codRemainingAmount,
         codHandlingFee: !adminBypass && codHandlingFee > 0 ? codHandlingFee : undefined,
+        whatsappNotifyAddon: !adminBypass && whatsappNotifyFee > 0 ? true : undefined,
+        whatsappNotifyFee: !adminBypass && whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
+        giftWrapAddon: !adminBypass && giftWrapFee > 0 ? true : undefined,
+        giftWrapFee: !adminBypass && giftWrapFee > 0 ? giftWrapFee : undefined,
+        giftWrapMessage: !adminBypass && giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
+        shipmentProtectionAddon: !adminBypass && shipmentProtectionFee > 0 ? true : undefined,
+        shipmentProtectionFee: !adminBypass && shipmentProtectionFee > 0 ? shipmentProtectionFee : undefined,
         taxableAmount: gstBreakdown?.taxableAmount,
         gstAmount: gstBreakdown?.gstAmount,
         cgst: gstBreakdown?.cgst || undefined,
@@ -486,6 +475,7 @@ async function createOrderForGroup(group, orderType, ctx) {
         storeOwnerId,
         productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
         paid: adminBypass,
+        whatsappNotifyAddon: !adminBypass && whatsappNotifyFee > 0,
     });
     return groupTotal;
 }
@@ -496,7 +486,7 @@ async function createOrderForGroup(group, orderType, ctx) {
  * auth + rate-limiting before calling this and supply the resolved user fields.
  */
 export async function createCheckoutOrderAction(input) {
-    const { userId: uid, userName, userEmail, addressId, paymentMethod, emiTenureMonths, notes, excludedProductIds = [], adminBypass = false, adminBypassBy, outOfStockPolicy = OutOfStockPolicyValues.SKIP_ITEMS, } = input;
+    const { userId: uid, userName, userEmail, addressId, paymentMethod, emiTenureMonths, notes, excludedProductIds = [], adminBypass = false, adminBypassBy, outOfStockPolicy = OutOfStockPolicyValues.SKIP_ITEMS, whatsappNotifyAddon = false, giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, } = input;
     const siteSettings = await siteSettingsRepository.getSingleton();
     const commissions = siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS;
     const emiSettings = siteSettings?.emi ?? CHECKOUT_DEFAULT_EMI_SETTINGS;
@@ -569,7 +559,6 @@ export async function createCheckoutOrderAction(input) {
         shippingAddress = formatShippingAddress(resolvedAddress);
     }
     const db = getAdminDb();
-    const otpRef = isDigitalCart ? null : consentOtpRef(db, uid, addressId);
     // SB6-C — pre-tx fetch products so we can run the maxPerUser cap check
     // (count queries can't run inside a Firestore transaction). The same
     // product docs are re-read inside the transaction below for stock + prize
@@ -605,21 +594,6 @@ export async function createCheckoutOrderAction(input) {
     let stockResult;
     try {
         stockResult = await db.runTransaction(async (tx) => {
-            let emailOtpUsed = false;
-            if (!isDigitalCart && otpRef) {
-                const otpSnap = await tx.get(otpRef);
-                const otpData = otpSnap.exists
-                    ? otpSnap.data()
-                    : null;
-                const isConsentValid = otpData?.verified === true &&
-                    otpData.expiresAt &&
-                    (resolveDate(otpData.expiresAt)?.getTime() ?? 0) > Date.now();
-                if (!isConsentValid) {
-                    const reason = !otpData ? "otp_not_verified" : "consent_expired";
-                    throw Object.assign(new ApiError(403, "Order verification required. Please complete OTP verification before placing this order."), { _failReason: reason });
-                }
-                emailOtpUsed = otpData.verifiedVia !== "sms" && otpData.verifiedVia !== "admin_bypass";
-            }
             // SB-UNI-5 2026-05-13 — bundle-aware stock fan-out. Build the unique
             // product-id set across the whole cart (regular items + each bundle's
             // members) and fetch each one ONCE. Validation walks per cart-line and
@@ -654,7 +628,7 @@ export async function createCheckoutOrderAction(input) {
                 // S-SBUNI-RULES 2026-05-13 — sync preflight (prize-pool cap, pre-order
                 // quota) via rule registry. Bundles skip — they bypass the cart path.
                 if (!item.bundleProductIds?.length) {
-                    runSyncPreflight([{ item, product }]);
+                    runSyncPreflight([{ item, product }], paymentMethod);
                 }
                 availableItems.push({ item, product });
             }
@@ -679,29 +653,21 @@ export async function createCheckoutOrderAction(input) {
                     selectedItemIds: null,
                     updatedAt: new Date(),
                 }, { merge: true });
-                if (otpRef) {
-                    tx.delete(otpRef);
-                }
             }
-            return { available: availableItems, unavailable: unavailableItems, emailOtpUsed };
+            return { available: availableItems, unavailable: unavailableItems };
         });
     }
     catch (err) {
         void normalizeError(err);
-        const reason = err?._failReason === "consent_expired"
-            ? "consent_expired"
-            : err?._failReason === "otp_not_verified"
-                ? "otp_not_verified"
-                : "unknown";
         failedCheckoutRepository
-            .logCheckout(uid, reason, err instanceof Error ? err.message : String(err), {
+            .logCheckout(uid, "unknown", err instanceof Error ? err.message : String(err), {
             addressId,
             paymentMethod,
         })
             .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
         throw err;
     }
-    const { available, unavailable, emailOtpUsed } = stockResult;
+    const { available, unavailable } = stockResult;
     if (available.length === 0) {
         failedCheckoutRepository
             .logCheckout(uid, "stock_failed", "All items out of stock", {
@@ -747,12 +713,15 @@ export async function createCheckoutOrderAction(input) {
         buyerState: resolvedAddress?.state,
         gstSettings: siteSettings?.gst,
         siteContactUpiVpa: siteSettings?.contact?.upiVpa,
+        whatsappNotifyAddon,
+        giftWrapAddon,
+        giftWrapMessage,
+        shipmentProtectionAddon,
     };
     for (const { items: group, orderType } of orderGroups) {
         total += await createOrderForGroup(group, orderType, groupCtx);
     }
     await flushCouponUsageAccumulator(couponUsageAccumulator, uid);
-    grantConsentOtpBypassCredit(db, uid, emailOtpUsed, unavailable.length);
     dispatchOrderConfirmationEmails(emailsToSend);
     serverLogger.info(`createCheckoutOrderAction: ${orderIds.length} order(s) placed for uid=${uid}` +
         (unavailable.length > 0 ? ` (${unavailable.length} item(s) unavailable)` : ""));
@@ -872,11 +841,209 @@ async function refundDroppedItemsForRazorpayCheckout(input) {
         }
     }
 }
+/**
+ * Places one order for one seller-group within `verifyAndPlaceRazorpayOrderAction`
+ * — mirrors `createOrderForGroup`'s role on the COD/cash/EMI path (same
+ * per-group fee/coupon/order-doc/notification shape), extracted into its own
+ * function purely to keep the parent function under the LARGE_COMPONENT
+ * audit threshold (`scripts/audit-code-quality.mjs`). No behavior change
+ * from the inline version this replaced.
+ */
+async function createRazorpayGroupOrder(group, orderType, ctx) {
+    const { appliedCoupons, cartSubtotal, platformFeePercent, gstPercent, whatsappNotifyFee, giftWrapFee, giftWrapMessage, shipmentProtectionAddon, siteSettings, uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, shippingAddress, notes, outOfStockPolicy, unavailablePaid, orderIds, emailsToSend, } = ctx;
+    // SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked bundle
+    // price); regular lines use product.price. The helper keeps the math
+    // local to this block.
+    const unitPriceFor = (item, product) => item.bundleCategorySlug && item.bundleProductIds?.length
+        ? item.price
+        : product.price;
+    const firstItem = group[0].item;
+    const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
+    // Reuses the same store/seller lookup as the COD/UPI path above instead
+    // of re-implementing it inline — was two sequential findById calls per
+    // seller group here, duplicated from resolveShippingCost.
+    const { shippingFee, storeOwnerId } = await resolveShippingCost(firstItem.storeId);
+    let couponDiscount = 0;
+    const appliedDiscounts = [];
+    for (const coupon of appliedCoupons) {
+        let couponGroupDiscount = 0;
+        const isSellerScoped = coupon.scope === "seller" && coupon.storeId;
+        if (isSellerScoped) {
+            if (coupon.storeId !== firstItem.storeId)
+                continue;
+            if (coupon.applicableItemIds?.length) {
+                const eligibleTotal = group
+                    .filter(({ item }) => coupon.applicableItemIds.includes(item.itemId))
+                    .reduce((s, { item, product }) => s + unitPriceFor(item, product) * item.quantity, 0);
+                couponGroupDiscount =
+                    eligibleTotal > 0
+                        ? Math.min(roundRupees((eligibleTotal / groupTotal) * coupon.discountAmount), eligibleTotal)
+                        : 0;
+            }
+            else {
+                couponGroupDiscount = Math.min(coupon.discountAmount, groupTotal);
+            }
+        }
+        else if (cartSubtotal > 0) {
+            couponGroupDiscount = Math.min(roundRupees((groupTotal / cartSubtotal) * coupon.discountAmount), groupTotal);
+        }
+        if (couponGroupDiscount > 0) {
+            couponDiscount += couponGroupDiscount;
+            appliedDiscounts.push({
+                code: coupon.code,
+                couponId: coupon.couponId,
+                type: "coupon",
+                discountAmount: couponGroupDiscount,
+                scope: coupon.scope,
+                storeId: coupon.storeId,
+            });
+        }
+    }
+    couponDiscount = Math.min(couponDiscount, groupTotal);
+    const rawPlatformFee = roundRupees(groupTotal * (platformFeePercent / 100));
+    const gstOnFee = roundRupees(rawPlatformFee * (gstPercent / 100));
+    const platformFee = rawPlatformFee + gstOnFee;
+    const shipmentProtectionFee = computeShipmentProtectionFee(groupTotal, shipmentProtectionAddon, siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS);
+    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee;
+    // P-8 GST — deliberately NOT wired into this Razorpay-verify path. The
+    // amount-mismatch check above (expectedPaymentAmountRs) compares against
+    // what the buyer already paid via the Razorpay order created earlier in
+    // the flow; adding product GST here without also adding it to that
+    // upstream pre-payment amount calculation would either fail the mismatch
+    // check or silently under/over-charge. Wiring GST through the full
+    // Razorpay create→verify round-trip is separate follow-up work, tracked
+    // alongside P-13 (Razorpay is disabled by default today, so this order
+    // type doesn't currently carry a GST breakdown).
+    // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
+    const orderItems = group.map(({ item, product }) => {
+        const lt = (product?.listingType ?? "standard");
+        const itemRule = getListingRule(lt);
+        // SB-UNI-5 2026-05-13 — bundle cart-lines surface the locked
+        // bundlePrice (item.price), not the representative member's
+        // product.price. Stock decrement still runs per member elsewhere.
+        const isBundle = Boolean(item.bundleCategorySlug && item.bundleProductIds?.length);
+        const unitPrice = isBundle ? item.price : product.price;
+        const bundleFields = isBundle
+            ? {
+                bundleCategorySlug: item.bundleCategorySlug,
+                bundleProductIds: item.bundleProductIds,
+            }
+            : {};
+        const baseLine = {
+            productId: item.productId,
+            productTitle: item.productTitle,
+            quantity: item.quantity,
+            unitPrice,
+            totalPrice: unitPrice * item.quantity,
+            ...bundleFields,
+        };
+        return itemRule.decorateOrderItem(baseLine, product);
+    });
+    const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
+    const imageUrls = [
+        ...new Set(group
+            .map(({ product }) => product?.mainImage)
+            .filter((url) => typeof url === "string" && url.length > 0)),
+    ];
+    // S-SBUNI-RULES 2026-05-13 — order-doc decoration via rule registry.
+    const lt0Rzp = (group[0].product?.listingType ?? "standard");
+    const groupRuleRzp = getListingRule(lt0Rzp);
+    const extraOrderFields = {
+        ...groupRuleRzp.decorateOrderDoc(group[0].item, group[0].product),
+    };
+    const order = await unitOfWork.orders.create({
+        productId: firstItem.productId,
+        productTitle: firstItem.productTitle,
+        userId: uid,
+        userName,
+        userEmail,
+        quantity: totalQuantity,
+        unitPrice: group[0].product.price,
+        totalPrice: orderTotal,
+        currency: firstItem.currency ?? getDefaultCurrency(),
+        storeId: firstItem.storeId || undefined,
+        storeName: firstItem.storeName || undefined,
+        items: orderItems,
+        orderType,
+        offerId: firstItem.offerId ?? undefined,
+        status: OrderStatusValues.CONFIRMED,
+        paymentStatus: PaymentStatusValues.PAID,
+        paymentMethod: PaymentMethodValues.ONLINE,
+        paymentId: razorpay_payment_id,
+        paymentRecord: {
+            method: "razorpay",
+            transactionId: razorpay_payment_id,
+            amount: orderTotal,
+            paidAt: new Date(),
+            verifiedBy: "razorpay-webhook",
+            verificationMethod: "webhook",
+            gatewayRef: {
+                orderId: razorpay_order_id,
+                paymentId: razorpay_payment_id,
+                signature: razorpay_signature,
+            },
+        },
+        shippingAddress,
+        notes,
+        platformFee,
+        shippingFee: shippingFee > 0 ? shippingFee : undefined,
+        whatsappNotifyAddon: whatsappNotifyFee > 0 ? true : undefined,
+        whatsappNotifyFee: whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
+        giftWrapAddon: giftWrapFee > 0 ? true : undefined,
+        giftWrapFee: giftWrapFee > 0 ? giftWrapFee : undefined,
+        giftWrapMessage: giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
+        shipmentProtectionAddon: shipmentProtectionFee > 0 ? true : undefined,
+        shipmentProtectionFee: shipmentProtectionFee > 0 ? shipmentProtectionFee : undefined,
+        couponCode: appliedDiscounts[0]?.code,
+        couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
+        appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
+        imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
+        outOfStockPolicy,
+        droppedItems: unavailablePaid.length > 0 ? unavailablePaid : undefined,
+        ...extraOrderFields,
+    });
+    orderIds.push(order.id);
+    // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
+    // order is already persisted so a claim failure is logged, not thrown).
+    if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
+        claimDigitalCodeForOrder(getAdminDb(), firstItem.productId, order.id, uid, {
+            userEmail: userEmail || undefined,
+            userName,
+            productTitle: firstItem.productTitle,
+        }).catch((e) => serverLogger.error("claimDigitalCode", e));
+    }
+    if (userEmail) {
+        emailsToSend.push({
+            to: userEmail,
+            userName,
+            orderId: order.id,
+            productTitle: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
+            quantity: totalQuantity,
+            totalPrice: orderTotal,
+            currency: firstItem.currency ?? getDefaultCurrency(),
+            shippingAddress,
+            paymentMethod: PaymentMethodValues.ONLINE,
+            items: orderItems,
+        });
+    }
+    emitOrderPlacedNotifications({
+        orderId: order.id,
+        buyerUid: uid,
+        buyerName: userName,
+        storeOwnerId,
+        productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
+        paid: true,
+        whatsappNotifyAddon: whatsappNotifyFee > 0,
+    });
+    return orderTotal;
+}
 export async function verifyAndPlaceRazorpayOrderAction(input) {
-    const { userId: uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, addressId, notes, outOfStockPolicy = OutOfStockPolicyValues.CANCEL_ORDER, } = input;
+    const { userId: uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, addressId, notes, outOfStockPolicy = OutOfStockPolicyValues.CANCEL_ORDER, whatsappNotifyAddon = false, giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, } = input;
     const siteSettings = await siteSettingsRepository.getSingleton();
     const platformFeePercent = siteSettings?.commissions?.platformFeePercent ?? 5;
     const gstPercent = siteSettings?.commissions?.gstPercent ?? 18;
+    const whatsappNotifyFee = computeWhatsAppNotifyFee(whatsappNotifyAddon, siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS);
+    const giftWrapFee = computeGiftWrapFee(giftWrapAddon, siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS);
     const isValid = await verifyPaymentSignatureWithKeys({
         razorpay_order_id,
         razorpay_payment_id,
@@ -914,28 +1081,6 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
         }
         shippingAddress = formatShippingAddress(resolvedAddressRzp);
     }
-    const db = getAdminDb();
-    if (!isDigitalCartRazorpay && addressId) {
-        const otpRef = consentOtpRef(db, uid, addressId);
-        const otpSnap = await otpRef.get();
-        const otpData = otpSnap.exists
-            ? otpSnap.data()
-            : null;
-        const isConsentValid = otpData?.verified === true &&
-            otpData.expiresAt &&
-            (resolveDate(otpData.expiresAt)?.getTime() ?? 0) > Date.now();
-        if (!isConsentValid) {
-            const reason = !otpData ? "otp_not_verified" : "consent_expired";
-            failedCheckoutRepository
-                .logPayment(uid, reason, "Consent OTP missing or expired at payment verify time", {
-                gatewayOrderId: razorpay_order_id,
-                gatewayPaymentId: razorpay_payment_id,
-                addressId,
-            })
-                .catch((err) => { void normalizeError(err); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: err instanceof Error ? err.message : String(err) }); });
-            throw new ApiError(403, "Order verification required. Please complete OTP verification and retry.");
-        }
-    }
     // SB-UNI-5 2026-05-13 — bundle-aware product fetch + validation. Each
     // cart line gets paired with a "representative" product (first member id
     // for bundles, productId for regular items). The full bundle-member
@@ -966,7 +1111,8 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     // S-SBUNI-RULES 2026-05-13 — sync preflight via rule registry.
     // Bundle items bypass the cart flow so skip the prize-pool cap.
     const preflightPairs = productChecks.filter((p) => p.product !== null && p.product !== undefined && !p.item.bundleProductIds?.length);
-    runSyncPreflight(preflightPairs);
+    // This whole action is the Razorpay path — paymentMethod is always "online".
+    runSyncPreflight(preflightPairs, "online");
     // SB-UNI-O 2026-05-15 — Live-item jurisdiction guard.
     if (!isDigitalCartRazorpay && resolvedAddressRzp) {
         assertLiveJurisdiction(cart.items, productByIdPaid, resolvedAddressRzp.state);
@@ -1051,178 +1197,28 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     const cartSubtotal = orderGroups.reduce((s, { items: g }) => s +
         g.reduce((gs, { item, product }) => gs + unitPriceFor(item, product) * item.quantity, 0), 0);
     for (const { items: group, orderType } of orderGroups) {
-        const firstItem = group[0].item;
-        const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
-        // Reuses the same store/seller lookup as the COD/UPI path above instead
-        // of re-implementing it inline — was two sequential findById calls per
-        // seller group here, duplicated from resolveShippingCost.
-        const { shippingFee, storeOwnerId } = await resolveShippingCost(firstItem.storeId);
-        let couponDiscount = 0;
-        const appliedDiscounts = [];
-        for (const coupon of appliedCoupons) {
-            let couponGroupDiscount = 0;
-            const isSellerScoped = coupon.scope === "seller" && coupon.storeId;
-            if (isSellerScoped) {
-                if (coupon.storeId !== firstItem.storeId)
-                    continue;
-                if (coupon.applicableItemIds?.length) {
-                    const eligibleTotal = group
-                        .filter(({ item }) => coupon.applicableItemIds.includes(item.itemId))
-                        .reduce((s, { item, product }) => s + unitPriceFor(item, product) * item.quantity, 0);
-                    couponGroupDiscount =
-                        eligibleTotal > 0
-                            ? Math.min(roundRupees((eligibleTotal / groupTotal) * coupon.discountAmount), eligibleTotal)
-                            : 0;
-                }
-                else {
-                    couponGroupDiscount = Math.min(coupon.discountAmount, groupTotal);
-                }
-            }
-            else if (cartSubtotal > 0) {
-                couponGroupDiscount = Math.min(roundRupees((groupTotal / cartSubtotal) * coupon.discountAmount), groupTotal);
-            }
-            if (couponGroupDiscount > 0) {
-                couponDiscount += couponGroupDiscount;
-                appliedDiscounts.push({
-                    code: coupon.code,
-                    couponId: coupon.couponId,
-                    type: "coupon",
-                    discountAmount: couponGroupDiscount,
-                    scope: coupon.scope,
-                    storeId: coupon.storeId,
-                });
-            }
-        }
-        couponDiscount = Math.min(couponDiscount, groupTotal);
-        const rawPlatformFee = roundRupees(groupTotal * (platformFeePercent / 100));
-        const gstOnFee = roundRupees(rawPlatformFee * (gstPercent / 100));
-        const platformFee = rawPlatformFee + gstOnFee;
-        const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee;
-        total += orderTotal;
-        // P-8 GST — deliberately NOT wired into this Razorpay-verify path. The
-        // amount-mismatch check above (expectedPaymentAmountRs) compares against
-        // what the buyer already paid via the Razorpay order created earlier in
-        // the flow; adding product GST here without also adding it to that
-        // upstream pre-payment amount calculation would either fail the mismatch
-        // check or silently under/over-charge. Wiring GST through the full
-        // Razorpay create→verify round-trip is separate follow-up work, tracked
-        // alongside P-13 (Razorpay is disabled by default today, so this order
-        // type doesn't currently carry a GST breakdown).
-        // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
-        const orderItems = group.map(({ item, product }) => {
-            const lt = (product?.listingType ?? "standard");
-            const itemRule = getListingRule(lt);
-            // SB-UNI-5 2026-05-13 — bundle cart-lines surface the locked
-            // bundlePrice (item.price), not the representative member's
-            // product.price. Stock decrement still runs per member elsewhere.
-            const isBundle = Boolean(item.bundleCategorySlug && item.bundleProductIds?.length);
-            const unitPrice = isBundle ? item.price : product.price;
-            const bundleFields = isBundle
-                ? {
-                    bundleCategorySlug: item.bundleCategorySlug,
-                    bundleProductIds: item.bundleProductIds,
-                }
-                : {};
-            const baseLine = {
-                productId: item.productId,
-                productTitle: item.productTitle,
-                quantity: item.quantity,
-                unitPrice,
-                totalPrice: unitPrice * item.quantity,
-                ...bundleFields,
-            };
-            return itemRule.decorateOrderItem(baseLine, product);
-        });
-        const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
-        const imageUrls = [
-            ...new Set(group
-                .map(({ product }) => product?.mainImage)
-                .filter((url) => typeof url === "string" && url.length > 0)),
-        ];
-        // S-SBUNI-RULES 2026-05-13 — order-doc decoration via rule registry.
-        const lt0Rzp = (group[0].product?.listingType ?? "standard");
-        const groupRuleRzp = getListingRule(lt0Rzp);
-        const extraOrderFields = {
-            ...groupRuleRzp.decorateOrderDoc(group[0].item, group[0].product),
-            ...(orderType === "prize-draw" && group[0].product
-                ? { prizeRevealDeadline: computePrizeRevealDeadline(group[0].product) }
-                : {}),
-        };
-        const order = await unitOfWork.orders.create({
-            productId: firstItem.productId,
-            productTitle: firstItem.productTitle,
-            userId: uid,
+        total += await createRazorpayGroupOrder(group, orderType, {
+            appliedCoupons,
+            cartSubtotal,
+            platformFeePercent,
+            gstPercent,
+            whatsappNotifyFee,
+            giftWrapFee,
+            giftWrapMessage,
+            shipmentProtectionAddon,
+            siteSettings,
+            uid,
             userName,
             userEmail,
-            quantity: totalQuantity,
-            unitPrice: group[0].product.price,
-            totalPrice: orderTotal,
-            currency: firstItem.currency ?? getDefaultCurrency(),
-            storeId: firstItem.storeId || undefined,
-            storeName: firstItem.storeName || undefined,
-            items: orderItems,
-            orderType,
-            offerId: firstItem.offerId ?? undefined,
-            status: OrderStatusValues.CONFIRMED,
-            paymentStatus: PaymentStatusValues.PAID,
-            paymentMethod: PaymentMethodValues.ONLINE,
-            paymentId: razorpay_payment_id,
-            paymentRecord: {
-                method: "razorpay",
-                transactionId: razorpay_payment_id,
-                amount: orderTotal,
-                paidAt: new Date(),
-                verifiedBy: "razorpay-webhook",
-                verificationMethod: "webhook",
-                gatewayRef: {
-                    orderId: razorpay_order_id,
-                    paymentId: razorpay_payment_id,
-                    signature: razorpay_signature,
-                },
-            },
+            razorpay_order_id,
+            razorpay_payment_id,
+            razorpay_signature,
             shippingAddress,
             notes,
-            platformFee,
-            shippingFee: shippingFee > 0 ? shippingFee : undefined,
-            couponCode: appliedDiscounts[0]?.code,
-            couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
-            appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
-            imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
             outOfStockPolicy,
-            droppedItems: unavailablePaid.length > 0 ? unavailablePaid : undefined,
-            ...extraOrderFields,
-        });
-        orderIds.push(order.id);
-        // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
-        // order is already persisted so a claim failure is logged, not thrown).
-        if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
-            claimDigitalCodeForOrder(getAdminDb(), firstItem.productId, order.id, uid, {
-                userEmail: userEmail || undefined,
-                userName,
-                productTitle: firstItem.productTitle,
-            }).catch((e) => serverLogger.error("claimDigitalCode", e));
-        }
-        if (userEmail) {
-            emailsToSend.push({
-                to: userEmail,
-                userName,
-                orderId: order.id,
-                productTitle: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
-                quantity: totalQuantity,
-                totalPrice: orderTotal,
-                currency: firstItem.currency ?? getDefaultCurrency(),
-                shippingAddress,
-                paymentMethod: PaymentMethodValues.ONLINE,
-                items: orderItems,
-            });
-        }
-        emitOrderPlacedNotifications({
-            orderId: order.id,
-            buyerUid: uid,
-            buyerName: userName,
-            storeOwnerId,
-            productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
-            paid: true,
+            unavailablePaid,
+            orderIds,
+            emailsToSend,
         });
     }
     // SB-UNI-5 2026-05-13 — bundle-aware batch decrement. We iterate the
@@ -1247,10 +1243,6 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             selectedItemIds: null,
         });
     });
-    if (!isDigitalCartRazorpay && addressId) {
-        const otpRefForDelete = consentOtpRef(db, uid, addressId);
-        safeFireAndForget(otpRefForDelete.delete(), "checkout: delete OTP consent ref after Razorpay payment");
-    }
     // outOfStockPolicy: "skip_items" — auto-refund the dropped items' value.
     // Razorpay already captured payment for the FULL cart before this stock
     // check ran, so anything not placed as an order must be given back.