@mohasinac/appkit 4.53.2 → 4.54.1

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.53.2",
-  "head": "94f4715428f35ab362a11a468072ef933ca8a46d",
+  "version": "4.54.1",
+  "head": "3fe89608007f66f86562b403eb02772873cdffe2",
   "branch": "main",
   "dirty": false,
-  "builtAt": "2026-10-19T22:24:09.397Z"
+  "builtAt": "2026-10-20T06:16:45.850Z"
 }

package/dist/_internal/server/features/auth/capabilities.js

@@ -5,7 +5,7 @@
  * Call this server-side only — never trust client-provided capability arrays.
  */
 import { storeRepository } from "../../../../repositories/index.js";
-import { DEFAULT_STORE_CAPABILITIES, } from "../../../../features/auth/permissions/constants.js";
+import { DEFAULT_STORE_CAPABILITIES, resolveStoreCapabilities, } from "../../../../features/auth/permissions/constants.js";
 /**
  * Return the resolved capability set for a store.
  * Falls back to DEFAULT_STORE_CAPABILITIES when the store has no capabilities field.
@@ -16,10 +16,12 @@ export async function getStoreCapabilities(storeId) {
     const store = await storeRepository.findById(storeId);
     if (!store)
         return [...DEFAULT_STORE_CAPABILITIES];
-    const raw = store.capabilities;
-    if (Array.isArray(raw) && raw.length > 0)
-        return raw;
-    return [...DEFAULT_STORE_CAPABILITIES];
+    /*
+     * The merge itself lives in `resolveStoreCapabilities` so a caller holding
+     * the store document already can run the same rule without a second read.
+     * This function is now just "fetch, then resolve".
+     */
+    return resolveStoreCapabilities(store.capabilities);
 }
 /**
  * Check whether a store has a specific capability.

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -113,7 +113,6 @@ export interface CheckoutPricingPreviewStore {
     subtotal: number;
     shippingFee: number;
     codHandlingFee: number;
-    whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
     saleProtectionFee: number;
@@ -145,7 +144,6 @@ export interface CheckoutPricingPreview {
     subtotal: number;
     shippingFee: number;
     codHandlingFee: number;
-    whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
     saleProtectionFee: number;
@@ -168,7 +166,7 @@ export interface CheckoutPricingPreview {
 /**
  * Read-only "what will I actually be charged" preview for the checkout
  * Order Summary. Reuses the exact same building blocks
- * createCheckoutOrderAction / verifyAndPlacePhonePeOrderAction use when an
+ * createCheckoutOrderAction / verifyAndPlaceGatewayOrderAction use when an
  * order is actually placed — resolveShippingCost, the compute*Fee helpers,
  * computeGroupCouponDiscount, and the GST calc — so the number shown to the
  * buyer can never diverge from what gets charged/recorded. Never decrements
@@ -184,9 +182,27 @@ export declare function attachPaymentAction(input: {
     paymentId: string;
     paidAmount: number;
 }): Promise<void>;
-export interface VerifyAndPlacePhonePeOrderInput {
-    /** PhonePe's merchantOrderId — our own id, generated in PhonePeProvider.createOrder(). */
+export interface VerifyAndPlaceGatewayOrderInput {
+    /**
+     * The gateway order id every lookup for this payment is keyed on, and what
+     * gets stored as `order.paymentId`: PhonePe's own `merchantOrderId`
+     * (generated in `PhonePeProvider.createOrder()`), or Razorpay's `order_…`.
+     */
     merchantOrderId: string;
+    /**
+     * Razorpay's client callback, when the buyer-present path has it. Omit on
+     * the webhook path and for PhonePe, which has no such callback.
+     *
+     * Verified IN ADDITION to the server-side order fetch, never instead of it
+     * — see the block comment above. A present-but-invalid signature is a hard
+     * failure: it means the browser's callback was forged or tampered with,
+     * even if the order did turn out to be paid.
+     */
+    razorpaySignature?: {
+        razorpay_order_id: string;
+        razorpay_payment_id: string;
+        razorpay_signature: string;
+    };
     /**
      * Buyer identity. Omit on the webhook path — no session exists there, so
      * it's resolved from `uid` packed into PhonePe's `metaInfo` at
@@ -205,4 +221,4 @@ export interface VerifyAndPlacePhonePeOrderInput {
      */
     outOfStockPolicy?: OutOfStockPolicy;
 }
-export declare function verifyAndPlacePhonePeOrderAction(input: VerifyAndPlacePhonePeOrderInput): Promise<CheckoutOrderResult>;
+export declare function verifyAndPlaceGatewayOrderAction(input: VerifyAndPlaceGatewayOrderInput): Promise<CheckoutOrderResult>;

package/dist/_internal/server/features/checkout/actions.js

@@ -23,7 +23,7 @@ import { computeProtectionFees } from "../../../shared/features/shipping/protect
 import { resolveCouponCategorySlugs } from "../../../../features/promotions/actions/coupon-actions.js";
 import { assertCheckoutLane, assertLockedLinesStillValid, finalizeLockedLines, } from "./locked-lines.js";
 import { activeLane, defaultCheckoutItems, laneOf, } from "../../../shared/checkout/lanes.js";
-import { computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, computeCheckoutFees, allocateCheckoutFees, } from "../../../shared/fees/calculator.js";
+import { computeCodHandlingFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, computeCheckoutFees, allocateCheckoutFees, } from "../../../shared/fees/calculator.js";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase/index.js";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore.js";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index.js";
@@ -33,6 +33,13 @@ import { expandCartLineToOrderRows } from "./expand-order-items.js";
 import { OrderStatusValues, PaymentStatusValues, PaymentMethodValues, OutOfStockPolicyValues, } from "../../../../features/orders/schemas/index.js";
 import { getDefaultCurrency } from "../../../../core/index.js";
 import { getProviders } from "../../../../contracts/index.js";
+/*
+ * The SDK-free signature module, NOT the provider's `index.ts`. Importing the
+ * index would pull a static `import Razorpay from "razorpay"` into this
+ * action's import graph for one HMAC comparison — see that file's header.
+ */
+import { verifyPaymentSignature as verifyRazorpayPaymentSignature } from "../../../../providers/payment-razorpay/signature.js";
+import { resolveKeys } from "../../../../core/integration-keys.js";
 import { paiseToRupees } from "../../../../core/money.js";
 import { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_DEFAULT_EMI_SETTINGS } from "../../../shared/features/checkout/config.js";
 import { checkEmiEligibility, computeEmiSchedule } from "../../../shared/features/emi/schedule.js";
@@ -137,7 +144,7 @@ function assertLiveJurisdiction(cartItemsArg, productByIdArg, buyerState) {
  * either party. We emit the buyer + seller rows here at the create boundary.
  */
 function emitOrderPlacedNotifications(args) {
-    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid, whatsappNotifyAddon } = args;
+    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid } = args;
     const buyerNotif = sendNotification({
         userId: buyerUid,
         type: "order_placed",
@@ -147,7 +154,6 @@ function emitOrderPlacedNotifications(args) {
         relatedId: orderId,
         relatedType: "order",
         actionUrl: `/user/orders/view/${orderId}`,
-        orderWhatsappAddonPaid: whatsappNotifyAddon,
     }).catch((err) => serverLogger.warn("Failed to send buyer order_placed notification", {
         err: err instanceof Error ? err.message : String(err),
         orderId,
@@ -486,7 +492,7 @@ async function createOrderForGroup(group, orderType, ctx) {
     const firstItem = group[0].item;
     const firstProduct = group[0].product;
     // Add-ons are this store's choice, not the cart's — see OrderGroupContext.
-    const { whatsappNotifyAddon = false, giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, saleProtectionAddon = false, } = storeAddons?.[firstItem.storeId] ?? {};
+    const { giftWrapAddon = false, giftWrapMessage, shipmentProtectionAddon = false, saleProtectionAddon = false, } = storeAddons?.[firstItem.storeId] ?? {};
     const { platformFee = 0, gstOnFee: platformFeeGst = 0 } = platformFeeByStore.get(firstItem.storeId) ?? {};
     const groupTotal = group.reduce((sum, { item, product }) => sum + lineTotalFor(item, product), 0);
     // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
@@ -569,7 +575,6 @@ async function createOrderForGroup(group, orderType, ctx) {
     // Handling fee charged to the buyer for choosing COD, on top of the order
     // total — not deducted from the deposit/remaining split above.
     const codHandlingFee = paymentMethod === "cod" ? computeCodHandlingFee(groupTotal, commissions) : 0;
-    const whatsappNotifyFee = computeWhatsAppNotifyFee(whatsappNotifyAddon, commissions);
     const giftWrapFee = computeGiftWrapFee(giftWrapAddon, commissions);
     /*
      * ── C5e: all three protection tiers, enforced SERVER-SIDE ────────────────
@@ -622,7 +627,7 @@ async function createOrderForGroup(group, orderType, ctx) {
      * OUR service fee to the seller, charged to the buyer on top of the fee —
      * not tax on the goods.
      */
-    Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (emiSchedule?.surchargeAmount ?? 0);
+    Math.max(0, groupTotal - couponDiscount) + shippingFee + codHandlingFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst + (emiSchedule?.surchargeAmount ?? 0);
     const imageUrls = [
         ...new Set(group
             .map(({ product }) => product.mainImage)
@@ -691,8 +696,6 @@ async function createOrderForGroup(group, orderType, ctx) {
         // This group's pro-rata share of the checkout's single capped commission —
         // the shares across a multi-store checkout sum to exactly what was charged.
         platformFee: !adminBypass && platformFee > 0 ? platformFee : undefined,
-        whatsappNotifyAddon: !adminBypass && whatsappNotifyFee > 0 ? true : undefined,
-        whatsappNotifyFee: !adminBypass && whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
         giftWrapAddon: !adminBypass && giftWrapFee > 0 ? true : undefined,
         giftWrapFee: !adminBypass && giftWrapFee > 0 ? giftWrapFee : undefined,
         giftWrapMessage: !adminBypass && giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
@@ -800,7 +803,6 @@ async function createOrderForGroup(group, orderType, ctx) {
         storeOwnerId,
         productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
         paid: adminBypass,
-        whatsappNotifyAddon: !adminBypass && whatsappNotifyFee > 0,
     });
     return groupTotal;
 }
@@ -1132,7 +1134,6 @@ const EMPTY_PRICING_PREVIEW = {
     subtotal: 0,
     shippingFee: 0,
     codHandlingFee: 0,
-    whatsappNotifyFee: 0,
     giftWrapFee: 0,
     shipmentProtectionFee: 0,
     saleProtectionFee: 0,
@@ -1146,7 +1147,7 @@ const EMPTY_PRICING_PREVIEW = {
 /**
  * Read-only "what will I actually be charged" preview for the checkout
  * Order Summary. Reuses the exact same building blocks
- * createCheckoutOrderAction / verifyAndPlacePhonePeOrderAction use when an
+ * createCheckoutOrderAction / verifyAndPlaceGatewayOrderAction use when an
  * order is actually placed — resolveShippingCost, the compute*Fee helpers,
  * computeGroupCouponDiscount, and the GST calc — so the number shown to the
  * buyer can never diverge from what gets charged/recorded. Never decrements
@@ -1214,7 +1215,6 @@ export async function previewCheckoutPricing(input) {
         // ever charged for literal "cod" (pay the courier), never upi_manual or
         // cash (both pre-paid via UPI/bank transfer before dispatch).
         const groupCodHandlingFee = paymentMethod === "cod" ? computeCodHandlingFee(groupTotal, commissions) : 0;
-        const groupWhatsappFee = computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissions);
         const groupGiftWrapFee = computeGiftWrapFee(addons.giftWrapAddon ?? false, commissions);
         /*
          * C5e — the same three tiers `createOrderForGroup` enforces, so the figure
@@ -1267,7 +1267,6 @@ export async function previewCheckoutPricing(input) {
             subtotal: groupTotal,
             shippingFee: groupShippingFee,
             codHandlingFee: groupCodHandlingFee,
-            whatsappNotifyFee: groupWhatsappFee,
             giftWrapFee: groupGiftWrapFee,
             shipmentProtectionFee: groupShipmentProtectionFee,
             saleProtectionFee: groupSaleProtectionFee,
@@ -1285,7 +1284,6 @@ export async function previewCheckoutPricing(input) {
             total: Math.max(0, groupTotal - groupCouponDiscount) +
                 groupShippingFee +
                 groupCodHandlingFee +
-                groupWhatsappFee +
                 groupGiftWrapFee +
                 groupShipmentProtectionFee +
                 groupSaleProtectionFee,
@@ -1297,7 +1295,6 @@ export async function previewCheckoutPricing(input) {
     const sum = (pick) => stores.reduce((acc, s) => acc + pick(s), 0);
     const shippingFee = sum((s) => s.shippingFee);
     const codHandlingFee = sum((s) => s.codHandlingFee);
-    const whatsappNotifyFeeTotal = sum((s) => s.whatsappNotifyFee);
     const giftWrapFeeTotal = sum((s) => s.giftWrapFee);
     const shipmentProtectionFeeTotal = sum((s) => s.shipmentProtectionFee);
     const saleProtectionFeeTotal = sum((s) => s.saleProtectionFee);
@@ -1309,7 +1306,6 @@ export async function previewCheckoutPricing(input) {
     const total = Math.max(0, cartSubtotal - couponDiscount) +
         shippingFee +
         codHandlingFee +
-        whatsappNotifyFeeTotal +
         giftWrapFeeTotal +
         shipmentProtectionFeeTotal +
         saleProtectionFeeTotal +
@@ -1320,7 +1316,6 @@ export async function previewCheckoutPricing(input) {
         subtotal: cartSubtotal,
         shippingFee,
         codHandlingFee,
-        whatsappNotifyFee: whatsappNotifyFeeTotal,
         giftWrapFee: giftWrapFeeTotal,
         shipmentProtectionFee: shipmentProtectionFeeTotal,
         saleProtectionFee: saleProtectionFeeTotal,
@@ -1367,7 +1362,7 @@ export async function attachPaymentAction(input) {
  * Auto-refund the value of items dropped from a PhonePe checkout under the
  * "skip_items" out-of-stock policy. PhonePe captures payment for the FULL
  * cart before the stock check runs, so anything not placed as an order must
- * be given back. Extracted from `verifyAndPlacePhonePeOrderAction` — same
+ * be given back. Extracted from `verifyAndPlaceGatewayOrderAction` — same
  * behavior, kept as a named step so the parent function stays readable.
  *
  * Awaited by the caller (this moves money, never fire-and-forget). On
@@ -1418,7 +1413,7 @@ async function refundDroppedItemsForPhonePeCheckout(input) {
     }
     catch (refundErr) {
         void normalizeError(refundErr);
-        serverLogger.warn("verifyAndPlacePhonePeOrderAction: automatic partial refund for dropped items failed — flagging for manual follow-up", {
+        serverLogger.warn("verifyAndPlaceGatewayOrderAction: automatic partial refund for dropped items failed — flagging for manual follow-up", {
             orderId: primaryOrderId,
             droppedValue,
             err: refundErr instanceof Error ? refundErr.message : String(refundErr),
@@ -1427,7 +1422,7 @@ async function refundDroppedItemsForPhonePeCheckout(input) {
             .update(primaryOrderId, { refundPending: true })
             .catch((updErr) => {
             void normalizeError(updErr);
-            serverLogger.error("verifyAndPlacePhonePeOrderAction: failed to flag refundPending after auto-refund failure", { orderId: primaryOrderId, err: updErr instanceof Error ? updErr.message : String(updErr) });
+            serverLogger.error("verifyAndPlaceGatewayOrderAction: failed to flag refundPending after auto-refund failure", { orderId: primaryOrderId, err: updErr instanceof Error ? updErr.message : String(updErr) });
         });
         /*
          * One admin-inbox row, not one notification per admin.
@@ -1455,12 +1450,12 @@ async function refundDroppedItemsForPhonePeCheckout(input) {
         })
             .catch((notifyErr) => {
             void normalizeError(notifyErr);
-            serverLogger.error("verifyAndPlacePhonePeOrderAction: failed to write admin notification for failed auto-refund", { orderId: primaryOrderId });
+            serverLogger.error("verifyAndPlaceGatewayOrderAction: failed to write admin notification for failed auto-refund", { orderId: primaryOrderId });
         });
     }
 }
 /**
- * Places one order for one seller-group within `verifyAndPlacePhonePeOrderAction`
+ * Places one order for one seller-group within `verifyAndPlaceGatewayOrderAction`
  * — mirrors `createOrderForGroup`'s role on the COD/cash/EMI path (same
  * per-group fee/coupon/order-doc/notification shape), extracted into its own
  * function purely to keep the parent function under the LARGE_COMPONENT
@@ -1469,6 +1464,14 @@ async function refundDroppedItemsForPhonePeCheckout(input) {
  */
 async function createPhonePeGroupOrder(group, orderType, ctx) {
     const { appliedCoupons, cartSubtotal, storeAddons, platformFeeByStore, siteSettings, uid, userName, userEmail, merchantOrderId, phonepeOrderId, transactionId, shippingAddress, notes, outOfStockPolicy, unavailablePaid, orderIds, emailsToSend, couponUsageAccumulator, productById: phonepeProductById, buyerState, } = ctx;
+    /*
+     * Which online gateway actually took the money, read off the registered
+     * provider rather than passed in — exactly one is registered per process
+     * (`providers.config.ts`), so there is no caller-supplied value that could
+     * disagree with reality. Recorded on the order so a refund months later
+     * knows which API the stored `paymentId` belongs to.
+     */
+    const gatewayName = getProviders().payment?.name ?? "phonepe";
     const firstItem = group[0].item;
     const groupTotal = group.reduce((sum, { item, product }) => sum + lineTotalFor(item, product), 0);
     // Reuses the same store/seller lookup as the COD/UPI path above instead
@@ -1508,7 +1511,6 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     // cart-wide fee was passed in and billed against every group.
     const commissionRates = siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS;
     const addons = storeAddons?.[firstItem.storeId] ?? {};
-    const whatsappNotifyFee = computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissionRates);
     const giftWrapFee = computeGiftWrapFee(addons.giftWrapAddon ?? false, commissionRates);
     const giftWrapMessage = addons.giftWrapMessage;
     const shipmentProtectionFee = computeShipmentProtectionFee(groupTotal, addons.shipmentProtectionAddon ?? false, commissionRates);
@@ -1544,7 +1546,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     /* Product GST is not a term — prices are tax-inclusive, so it is already
      * inside `groupTotal`. Matches the COD/UPI path exactly; `platformFeeGst`
      * stays because that is GST on our fee, charged on top. */
-    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + whatsappNotifyFee + giftWrapFee + shipmentProtectionFee + platformFee + platformFeeGst;
+    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + giftWrapFee + shipmentProtectionFee + platformFee + platformFeeGst;
     // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
     // Same expansion as the COD/UPI path. This was a THIRD hand-rolled copy of
     // the price rule (`isBundle ? item.price : product.price`) that — like the
@@ -1598,19 +1600,29 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         status: OrderStatusValues.CONFIRMED,
         paymentStatus: PaymentStatusValues.PAID,
         paymentMethod: PaymentMethodValues.ONLINE,
-        // Our own generated id, not PhonePe's — this is what refunds/lookups key
-        // on (PhonePe's refund API is `originalMerchantOrderId`-keyed anyway).
+        /*
+         * The id every refund and lookup keys on, whichever gateway is live:
+         * PhonePe's own `merchantOrderId` (its refund API is
+         * `originalMerchantOrderId`-keyed), or Razorpay's `order_…`.
+         *
+         * 🛑 Razorpay's refund API is PAYMENT-keyed, not order-keyed — storing an
+         * order id here works only because `RazorpayProvider.refund()` resolves
+         * the order's captured payment itself. Keep that behaviour if this field
+         * ever changes; the alternative is tracking a second id at ~6 call sites.
+         */
         paymentId: merchantOrderId,
         paymentRecord: {
-            method: "phonepe",
+            method: gatewayName === "razorpay" ? "razorpay" : "phonepe",
             transactionId: transactionId ?? merchantOrderId,
             amount: orderTotal,
             paidAt: new Date(),
-            verifiedBy: "phonepe-order-status",
+            verifiedBy: `${gatewayName}-order-status`,
             verificationMethod: "order-status",
             gatewayRef: {
                 merchantOrderId,
-                phonepeOrderId,
+                ...(gatewayName === "razorpay"
+                    ? { razorpayOrderId: merchantOrderId, razorpayPaymentId: transactionId }
+                    : { phonepeOrderId }),
                 transactionId,
             },
         },
@@ -1618,8 +1630,6 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         notes,
         platformFee,
         shippingFee: shippingFee > 0 ? shippingFee : undefined,
-        whatsappNotifyAddon: whatsappNotifyFee > 0 ? true : undefined,
-        whatsappNotifyFee: whatsappNotifyFee > 0 ? whatsappNotifyFee : undefined,
         giftWrapAddon: giftWrapFee > 0 ? true : undefined,
         giftWrapFee: giftWrapFee > 0 ? giftWrapFee : undefined,
         giftWrapMessage: giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
@@ -1694,19 +1704,44 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         storeOwnerId,
         productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
         paid: true,
-        whatsappNotifyAddon: whatsappNotifyFee > 0,
     });
     return orderTotal;
 }
-export async function verifyAndPlacePhonePeOrderAction(input) {
+export async function verifyAndPlaceGatewayOrderAction(input) {
     const { merchantOrderId } = input;
+    /*
+     * Razorpay's signed client callback, checked BEFORE the claim doc is
+     * created. Order matters: a forged callback that claimed first would make
+     * the real confirmation (webhook or retry) return "in progress" forever,
+     * turning a rejected request into a stuck order. Verify, then claim.
+     *
+     * The key secret is resolved here rather than passed in because the route
+     * has no business holding it. A missing secret cannot verify anything, so
+     * it fails closed — the same direction as `verifyWebhook()`.
+     */
+    if (input.razorpaySignature) {
+        const { razorpayKeySecret } = await resolveKeys();
+        const signatureValid = !!razorpayKeySecret &&
+            verifyRazorpayPaymentSignature(input.razorpaySignature, razorpayKeySecret);
+        if (!signatureValid) {
+            serverLogger.warn(`Razorpay signature rejected: order=${input.razorpaySignature.razorpay_order_id} payment=${input.razorpaySignature.razorpay_payment_id}`);
+            failedCheckoutRepository
+                .logPayment(input.userId ?? "unknown", "signature_mismatch", "Razorpay client signature invalid", {
+                gatewayOrderId: input.razorpaySignature.razorpay_order_id,
+                gatewayPaymentId: input.razorpaySignature.razorpay_payment_id,
+                addressId: input.addressId,
+            })
+                .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
+            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
+        }
+    }
     // Idempotency: the buyer's /verify call and the async webhook can both
     // race to confirm+place for the same PhonePe payment (see the module
     // comment above). `.create()` throws on conflict, so whichever caller
     // creates this claim doc first is the sole placer; the loser returns
     // whatever the winner already placed, or a retryable "in progress" error
     // if the winner genuinely hasn't finished yet.
-    const claimRef = getAdminDb().collection("phonepeOrderClaims").doc(merchantOrderId);
+    const claimRef = getAdminDb().collection("gatewayOrderClaims").doc(merchantOrderId);
     try {
         await claimRef.create({ claimedAt: new Date() });
     }
@@ -1722,14 +1757,23 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
         }
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.ORDER_PLACEMENT_IN_PROGRESS);
     }
-    // Order Status confirmation — PhonePe never hands the browser a
-    // verifiable proof of payment, so this call IS the "signature check".
-    const phonepeOrder = await getProviders().payment.getOrder(merchantOrderId);
-    if (phonepeOrder.status !== "paid") {
-        serverLogger.warn(`PhonePe order not completed: merchantOrderId=${merchantOrderId} state=${phonepeOrder.status}`);
+    /*
+     * THE authoritative check, for either gateway: re-fetch the order from the
+     * gateway and require it to be paid. For PhonePe this is the only possible
+     * proof (the browser never receives a verifiable one); for Razorpay it is
+     * what the client signature above cannot establish on its own.
+     *
+     * 🛑 `RazorpayProvider.getOrder()` must map the gateway's real status for
+     * this to mean anything — the pre-2026 implementation hardcoded "created",
+     * which here would reject every successful Razorpay payment AFTER the buyer
+     * was debited. See that provider's class comment, point 1.
+     */
+    const gatewayOrder = await getProviders().payment.getOrder(merchantOrderId);
+    if (gatewayOrder.status !== "paid") {
+        serverLogger.warn(`Gateway order not paid: merchantOrderId=${merchantOrderId} state=${gatewayOrder.status}`);
         failedCheckoutRepository
-            .logPayment(input.userId ?? "unknown", "signature_mismatch", "PhonePe order not COMPLETED", {
-            gatewayOrderId: phonepeOrder.gatewayOrderId,
+            .logPayment(input.userId ?? "unknown", "signature_mismatch", "Gateway order not paid", {
+            gatewayOrderId: gatewayOrder.gatewayOrderId,
             gatewayPaymentId: merchantOrderId,
             addressId: input.addressId,
         })
@@ -1737,9 +1781,11 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
     }
     // The buyer-present /verify call always supplies these; the webhook path
-    // (no session) reconstructs them from PhonePe's metaInfo, packed at
-    // create-order time — see `PhonePeCheckoutIntent`.
-    const intent = phonepeOrder.metadata;
+    // (no session) reconstructs them from the gateway's own passthrough channel
+    // — PhonePe's `metaInfo`, Razorpay's `notes` — both packed at create-order
+    // time and both surfaced as `PaymentOrder.metadata`. See
+    // `PhonePeCheckoutIntent`, which is the shape either one carries.
+    const intent = gatewayOrder.metadata;
     const uid = input.userId ?? intent?.uid;
     if (!uid) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
@@ -1853,7 +1899,7 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
                 .logPayment(uid, reason, exists
                 ? `Product ${u.productId} has ${u.availableQty} left, requested ${u.requestedQty}`
                 : `Product ${u.productId} not published`, {
-                gatewayOrderId: phonepeOrder.gatewayOrderId,
+                gatewayOrderId: gatewayOrder.gatewayOrderId,
                 gatewayPaymentId: merchantOrderId,
                 addressId,
             })
@@ -1900,7 +1946,6 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
             const addons = cart.storeAddons?.[storeId] ?? {};
             const groupSubtotal = g.items.reduce((gs, { item, product }) => gs + lineTotalFor(item, product), 0);
             return (sum +
-                computeWhatsAppNotifyFee(addons.whatsappNotifyAddon ?? false, commissionRates) +
                 computeGiftWrapFee(addons.giftWrapAddon ?? false, commissionRates) +
                 computeShipmentProtectionFee(groupSubtotal, addons.shipmentProtectionAddon ?? false, commissionRates));
         }, 0);
@@ -1936,12 +1981,12 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
         const expectedPaymentAmountRs = cartSubtotalRs + expectedPlatformFee + expectedGstOnFee + expectedAddonFees + expectedShippingFee;
         // Reuses the order already fetched above to confirm COMPLETED — PhonePe's
         // own amount is in its wire-format smallest unit. // audit-money-units-ok: describes the PhonePe boundary conversion this line performs, not our storage convention
-        const paidAmountRs = paiseToRupees(phonepeOrder.amount);
+        const paidAmountRs = paiseToRupees(gatewayOrder.amount);
         if (paidAmountRs < expectedPaymentAmountRs - 1) {
             serverLogger.warn(`Payment amount mismatch for user ${uid}: paid ₹${paidAmountRs}, expected ≥ ₹${expectedPaymentAmountRs}`);
             failedCheckoutRepository
                 .logPayment(uid, "amount_mismatch", `Paid ₹${paidAmountRs}, expected ≥ ₹${expectedPaymentAmountRs}`, {
-                gatewayOrderId: phonepeOrder.gatewayOrderId,
+                gatewayOrderId: gatewayOrder.gatewayOrderId,
                 gatewayPaymentId: merchantOrderId,
                 amountRs: paidAmountRs,
                 addressId,
@@ -1978,8 +2023,8 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
             userName,
             userEmail,
             merchantOrderId,
-            phonepeOrderId: phonepeOrder.gatewayOrderId,
-            transactionId: phonepeOrder.transactionId,
+            phonepeOrderId: gatewayOrder.gatewayOrderId,
+            transactionId: gatewayOrder.transactionId,
             shippingAddress,
             // For the CGST/SGST vs IGST split. The TOTAL does not depend on it
             // (see createPhonePeGroupOrder), which is what let the pre-payment
@@ -2033,7 +2078,7 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
     if (emailsToSend.length > 0) {
         Promise.all(emailsToSend.map((e) => sendOrderConfirmationEmail(e))).catch((err) => serverLogger.error("Order confirmation email error:", err));
     }
-    serverLogger.info(`verifyAndPlacePhonePeOrderAction: ${orderIds.length} order(s) placed for uid=${uid} — payment ${merchantOrderId}`);
+    serverLogger.info(`verifyAndPlaceGatewayOrderAction: ${orderIds.length} order(s) placed for uid=${uid} — payment ${merchantOrderId}`);
     getAdminRealtimeDb()
         .ref(`${RTDB_PATHS.PAYMENT_EVENTS}/${merchantOrderId}`)
         .update({ status: "success", orderIds, updatedAt: Date.now() })

package/dist/_internal/server/features/checkout/index.d.ts

@@ -1,3 +1,3 @@
-export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlacePhonePeOrderAction, previewCheckoutPricing, resolveShippingCost, type CreateCheckoutOrderInput, type VerifyAndPlacePhonePeOrderInput, type CheckoutPricingPreviewInput, type CheckoutPricingPreview, } from "./actions";
+export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceGatewayOrderAction, previewCheckoutPricing, resolveShippingCost, type CreateCheckoutOrderInput, type VerifyAndPlaceGatewayOrderInput, type CheckoutPricingPreviewInput, type CheckoutPricingPreview, } from "./actions";
 export { formatShippingAddress, type CheckoutOrderResult, } from "./data";
 export { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, type CheckoutPaymentMethod, } from "../../../shared/features/checkout/config";

package/dist/_internal/server/features/checkout/index.js

@@ -1,3 +1,3 @@
-export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlacePhonePeOrderAction, previewCheckoutPricing, resolveShippingCost, } from "./actions.js";
+export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceGatewayOrderAction, previewCheckoutPricing, resolveShippingCost, } from "./actions.js";
 export { formatShippingAddress, } from "./data.js";
 export { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, } from "../../../shared/features/checkout/config.js";

package/dist/_internal/server/features/checkout/supplier-identity.js

@@ -29,6 +29,7 @@
  * registration as it stood at the moment of supply" — an admin correcting a
  * typo in the GSTIN must not silently reissue every invoice ever produced.
  */
+import { getPlatformSupplier } from "../../../shared/features/site-settings/supplier-of-record.js";
 const trimmed = (v) => {
     const s = (v ?? "").trim();
     return s.length > 0 ? s : undefined;
@@ -61,18 +62,39 @@ export function resolveSupplierIdentity(store, settings) {
         };
     }
     /*
-     * Platform branch. Gated on `gst.enabled`, matching what the checkout
-     * already did before sellers could have a GSTIN at all — disabling GST must
-     * continue to produce plain invoices rather than tax invoices.
+     * Platform branch. Still gated on `gst.enabled` — disabling GST must
+     * continue to produce plain invoices rather than tax invoices, and
+     * `source: "none"` must stay reachable.
+     *
+     * 🛑 But the IDENTITY now comes from `appkit.config.js → business`, not from
+     * `siteSettings.gst.*`.
+     *
+     * That block documents itself as "THE one owner of the business's statutory
+     * identity", and records that before it existed the legal name, address,
+     * GSTIN and support channels lived in five places that already disagreed —
+     * four different support addresses published, the registered address saying
+     * Solapur while the warehouse said Hyderabad. Reading the GSTIN from site
+     * settings here made this invoice path a SIXTH owner, and the one that
+     * decides what a tax invoice says.
+     *
+     * `siteSettings.gst.enabled` stays the switch because whether to charge GST
+     * at all is an operational decision an admin makes. WHO the supplier is, is
+     * not: it is a fact about the registered entity, it is legally required to be
+     * published, and it belongs in a committed, code-reviewed file.
+     *
+     * The snapshot contract is unchanged — the caller writes the result onto the
+     * order at creation and never recomputes it, so correcting a typo in the
+     * business block does not reissue historical invoices.
      */
     const gst = settings?.gst;
     if (gst?.enabled) {
-        const platformGstin = trimmed(gst.gstin);
+        const platform = getPlatformSupplier();
+        const platformGstin = trimmed(platform.gstin);
         if (platformGstin) {
             return {
                 gstin: platformGstin,
-                legalName: trimmed(gst.legalName),
-                address: trimmed(gst.address),
+                legalName: trimmed(platform.legalName),
+                address: trimmed(platform.address),
                 source: "platform",
             };
         }

package/dist/_internal/server/features/orders/adapters.js

@@ -167,11 +167,9 @@ export function orderDocumentToOrder(doc) {
         couponDiscount: doc.couponDiscount,
         appliedDiscounts: doc.appliedDiscounts,
         // Add-ons are operational, not decorative: the status-change notifier reads
-        // whatsappNotifyAddon, and the packer needs giftWrapMessage in hand. An
+        // the packer needs giftWrapMessage in hand. An
         // adapter that drops them makes every downstream surface render its
         // "not applicable" fallback instead (Root Cause #57).
-        whatsappNotifyAddon: doc.whatsappNotifyAddon,
-        whatsappNotifyFee: doc.whatsappNotifyFee,
         giftWrapAddon: doc.giftWrapAddon,
         giftWrapFee: doc.giftWrapFee,
         giftWrapMessage: doc.giftWrapMessage,