eid-salami 1.0.0

package/backend/.keystone_temp/config.js

@@ -0,0 +1,369 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// keystone.ts
+var keystone_exports = {};
+__export(keystone_exports, {
+  default: () => keystone_default
+});
+module.exports = __toCommonJS(keystone_exports);
+var import_config = require("dotenv/config");
+var import_core2 = require("@keystone-6/core");
+var import_session = require("@keystone-6/core/session");
+var import_auth = require("@keystone-6/auth");
+
+// keystone/schema.ts
+var import_core = require("@keystone-6/core");
+var import_access = require("@keystone-6/core/access");
+var import_fields = require("@keystone-6/core/fields");
+var import_fields_document = require("@keystone-6/fields-document");
+var isAdmin = ({ session: session2 }) => session2?.data?.isAdmin === true;
+var lists = {
+  // ── Admin User ──────────────────────────────────────────────────────────────
+  User: (0, import_core.list)({
+    access: {
+      operation: {
+        query: isAdmin,
+        create: isAdmin,
+        update: isAdmin,
+        delete: isAdmin
+      }
+    },
+    fields: {
+      name: (0, import_fields.text)({ validation: { isRequired: true } }),
+      email: (0, import_fields.text)({ validation: { isRequired: true }, isIndexed: "unique" }),
+      password: (0, import_fields.password)({ validation: { isRequired: true } }),
+      isAdmin: (0, import_fields.checkbox)({ defaultValue: false }),
+      createdAt: (0, import_fields.timestamp)({ defaultValue: { kind: "now" } })
+    },
+    ui: {
+      listView: { initialColumns: ["name", "email", "isAdmin", "createdAt"] }
+    }
+  }),
+  // ── Salami Package ──────────────────────────────────────────────────────────
+  SalamiPackage: (0, import_core.list)({
+    access: {
+      operation: {
+        query: import_access.allowAll,
+        // public can browse
+        create: isAdmin,
+        update: isAdmin,
+        delete: isAdmin
+      }
+    },
+    fields: {
+      name: (0, import_fields.text)({ validation: { isRequired: true } }),
+      slug: (0, import_fields.text)({ validation: { isRequired: true }, isIndexed: "unique" }),
+      description: (0, import_fields_document.document)({ formatting: true, dividers: true, links: true }),
+      amount: (0, import_fields.float)({ validation: { isRequired: true }, label: "Amount (BDT)" }),
+      isActive: (0, import_fields.checkbox)({ defaultValue: true }),
+      emoji: (0, import_fields.text)({ defaultValue: "\u{1F49A}" }),
+      sortOrder: (0, import_fields.integer)({ defaultValue: 0 }),
+      createdAt: (0, import_fields.timestamp)({ defaultValue: { kind: "now" } }),
+      orders: (0, import_fields.relationship)({ ref: "Order.package", many: true })
+    },
+    ui: {
+      listView: { initialColumns: ["name", "amount", "isActive", "sortOrder"] }
+    }
+  }),
+  // ── Order ───────────────────────────────────────────────────────────────────
+  Order: (0, import_core.list)({
+    access: {
+      operation: {
+        query: isAdmin,
+        create: import_access.allowAll,
+        // anyone can place an order
+        update: isAdmin,
+        delete: isAdmin
+      }
+    },
+    fields: {
+      // Sender
+      senderName: (0, import_fields.text)({ validation: { isRequired: true } }),
+      senderPhone: (0, import_fields.text)({ validation: { isRequired: true } }),
+      senderMessage: (0, import_fields.text)({ ui: { displayMode: "textarea" } }),
+      // Recipient
+      recipientName: (0, import_fields.text)(),
+      recipientPhone: (0, import_fields.text)(),
+      // Package
+      package: (0, import_fields.relationship)({ ref: "SalamiPackage.orders", many: false }),
+      amount: (0, import_fields.float)({ validation: { isRequired: true } }),
+      // Payment — manual bKash personal flow
+      paymentStatus: (0, import_fields.select)({
+        options: [
+          { label: "\u23F3 Pending", value: "pending" },
+          { label: "\u{1F50D} Pending Verification", value: "pending_verification" },
+          { label: "\u2705 Completed", value: "completed" },
+          { label: "\u274C Failed", value: "failed" },
+          { label: "\u21A9\uFE0F  Refunded", value: "refunded" }
+        ],
+        defaultValue: "pending",
+        ui: { displayMode: "segmented-control" }
+      }),
+      // TrxID submitted by user after sending bKash — you verify manually
+      bkashTrxID: (0, import_fields.text)({ isIndexed: true, label: "bKash TrxID (user submitted)" }),
+      adminNote: (0, import_fields.text)({ label: "Admin Note", ui: { displayMode: "textarea" } }),
+      // Delivery
+      deliveryStatus: (0, import_fields.select)({
+        options: [
+          { label: "\u23F3 Waiting", value: "waiting" },
+          { label: "\u{1F4E4} Sent", value: "sent" },
+          { label: "\u2705 Delivered", value: "delivered" }
+        ],
+        defaultValue: "waiting",
+        ui: { displayMode: "segmented-control" }
+      }),
+      createdAt: (0, import_fields.timestamp)({ defaultValue: { kind: "now" } }),
+      updatedAt: (0, import_fields.timestamp)({ db: { updatedAt: true } })
+    },
+    ui: {
+      listView: {
+        initialColumns: [
+          "senderName",
+          "recipientName",
+          "amount",
+          "bkashTrxID",
+          "paymentStatus",
+          "deliveryStatus",
+          "createdAt"
+        ]
+      }
+    },
+    hooks: {
+      // Auto-fill amount from linked package
+      resolveInput: async ({ resolvedData, context }) => {
+        if (resolvedData.package?.connect?.id && !resolvedData.amount) {
+          const pkg = await context.query.SalamiPackage.findOne({
+            where: { id: resolvedData.package.connect.id },
+            query: "amount"
+          });
+          if (pkg)
+            resolvedData.amount = pkg.amount;
+        }
+        return resolvedData;
+      }
+    }
+  })
+};
+
+// keystone/routes.ts
+async function parseBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = "";
+    req.on("data", (chunk) => data += chunk);
+    req.on("end", () => {
+      try {
+        resolve(JSON.parse(data || "{}"));
+      } catch {
+        resolve({});
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function json(res, status, body) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Access-Control-Allow-Origin": process.env.FRONTEND_URL ?? "*",
+    "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type"
+  });
+  res.end(JSON.stringify(body));
+}
+function isValidTrxID(trxID) {
+  return /^[A-Z0-9]{8,12}$/.test(trxID.trim().toUpperCase());
+}
+function makeCustomRoutes(app, commonMiddleware, keystoneContext) {
+  app.use((req, res, next) => {
+    if (req.method === "OPTIONS") {
+      res.writeHead(204, {
+        "Access-Control-Allow-Origin": process.env.FRONTEND_URL ?? "*",
+        "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type"
+      });
+      res.end();
+      return;
+    }
+    next();
+  });
+  app.use("/api/orders/create", commonMiddleware, async (req, res) => {
+    if (req.method !== "POST")
+      return json(res, 405, { error: "Method not allowed" });
+    try {
+      const body = await parseBody(req);
+      const { senderName, senderPhone, senderMessage, recipientName, recipientPhone, packageId } = body;
+      if (!senderName || !senderPhone || !packageId) {
+        return json(res, 400, { error: "Missing required fields" });
+      }
+      const pkg = await keystoneContext.sudo().query.SalamiPackage.findOne({
+        where: { id: packageId },
+        query: "id name amount isActive"
+      });
+      if (!pkg || !pkg.isActive) {
+        return json(res, 404, { error: "Package not found or inactive" });
+      }
+      const order = await keystoneContext.sudo().query.Order.createOne({
+        data: {
+          senderName,
+          senderPhone,
+          senderMessage: senderMessage ?? "",
+          recipientName: recipientName ?? "",
+          recipientPhone: recipientPhone ?? "",
+          package: { connect: { id: packageId } },
+          amount: pkg.amount,
+          paymentStatus: "pending",
+          deliveryStatus: "waiting"
+        },
+        query: "id amount"
+      });
+      return json(res, 200, {
+        orderId: order.id,
+        amount: order.amount,
+        // Your personal bKash number — set in .env
+        bkashNumber: process.env.BKASH_PERSONAL_NUMBER ?? "",
+        invoiceRef: `EID-${order.id.slice(-8).toUpperCase()}`
+      });
+    } catch (err) {
+      console.error("[create-order]", err?.message ?? err);
+      return json(res, 500, { error: "Failed to create order" });
+    }
+  });
+  app.use("/api/orders/submit-trxid", commonMiddleware, async (req, res) => {
+    if (req.method !== "POST")
+      return json(res, 405, { error: "Method not allowed" });
+    try {
+      const body = await parseBody(req);
+      const { orderId, trxID } = body;
+      if (!orderId || !trxID) {
+        return json(res, 400, { error: "orderId and trxID are required" });
+      }
+      const normalizedTrxID = trxID.trim().toUpperCase();
+      if (!isValidTrxID(normalizedTrxID)) {
+        return json(res, 400, { error: "Invalid TrxID format. bKash TrxIDs are 8\u201312 uppercase letters/numbers." });
+      }
+      const existing = await keystoneContext.sudo().query.Order.findOne({
+        where: { id: orderId },
+        query: "id paymentStatus bkashTrxID"
+      });
+      if (!existing)
+        return json(res, 404, { error: "Order not found" });
+      if (existing.paymentStatus === "completed") {
+        return json(res, 409, { error: "Order already completed" });
+      }
+      if (existing.bkashTrxID) {
+        return json(res, 409, { error: "TrxID already submitted for this order" });
+      }
+      const duplicate = await keystoneContext.sudo().query.Order.findMany({
+        where: { bkashTrxID: { equals: normalizedTrxID } },
+        query: "id"
+      });
+      if (duplicate.length > 0) {
+        return json(res, 409, { error: "\u098F\u0987 TrxID \u0986\u0997\u09C7\u0987 \u09AC\u09CD\u09AF\u09AC\u09B9\u09BE\u09B0 \u0995\u09B0\u09BE \u09B9\u09AF\u09BC\u09C7\u099B\u09C7\u0964 Please check your TrxID." });
+      }
+      await keystoneContext.sudo().query.Order.updateOne({
+        where: { id: orderId },
+        data: {
+          bkashTrxID: normalizedTrxID,
+          paymentStatus: "pending_verification"
+        }
+      });
+      return json(res, 200, { success: true, message: "TrxID submitted. Awaiting admin verification." });
+    } catch (err) {
+      console.error("[submit-trxid]", err?.message ?? err);
+      return json(res, 500, { error: "Failed to submit TrxID" });
+    }
+  });
+  app.use("/api/orders", commonMiddleware, async (req, res) => {
+    const id = req.url?.replace(/^\/+|\/+$/g, "");
+    if (!id)
+      return json(res, 400, { error: "Missing order id" });
+    try {
+      const order = await keystoneContext.sudo().query.Order.findOne({
+        where: { id },
+        query: `
+          id senderName recipientName amount senderMessage
+          paymentStatus deliveryStatus bkashTrxID
+          package { name amount emoji }
+          createdAt
+        `
+      });
+      if (!order)
+        return json(res, 404, { error: "Order not found" });
+      return json(res, 200, order);
+    } catch (err) {
+      return json(res, 500, { error: err?.message });
+    }
+  });
+  app.use("/api/packages", commonMiddleware, async (_req, res) => {
+    try {
+      const packages = await keystoneContext.sudo().query.SalamiPackage.findMany({
+        where: { isActive: { equals: true } },
+        orderBy: [{ sortOrder: "asc" }, { amount: "asc" }],
+        query: "id name slug amount emoji"
+      });
+      return json(res, 200, packages);
+    } catch (err) {
+      return json(res, 500, { error: err?.message });
+    }
+  });
+}
+
+// keystone.ts
+var { withAuth } = (0, import_auth.createAuth)({
+  listKey: "User",
+  identityField: "email",
+  secretField: "password",
+  sessionData: "id email isAdmin",
+  initFirstItem: {
+    fields: ["name", "email", "password"],
+    itemData: { isAdmin: true }
+  }
+});
+var session = (0, import_session.statelessSessions)({
+  maxAge: 60 * 60 * 24 * 7,
+  secret: process.env.SESSION_SECRET ?? "CHANGE_THIS_TO_A_LONG_RANDOM_STRING_32CHARS!"
+});
+var keystone_default = withAuth(
+  (0, import_core2.config)({
+    db: {
+      provider: "postgresql",
+      url: process.env.DATABASE_URL ?? ""
+    },
+    lists,
+    session,
+    server: {
+      port: parseInt(process.env.PORT ?? "3000"),
+      cors: {
+        origin: [process.env.FRONTEND_URL ?? "http://localhost:5173"],
+        credentials: true
+      },
+      extendExpressApp: (app, context) => {
+        makeCustomRoutes(
+          app,
+          (req, res, next) => next(),
+          context
+        );
+      }
+    },
+    ui: {
+      isAccessAllowed: (context) => !!context.session?.data?.isAdmin
+    }
+  })
+);
+//# sourceMappingURL=config.js.map

package/backend/.keystone_temp/config.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../keystone.ts", "../keystone/schema.ts", "../keystone/routes.ts"],
+  "sourcesContent": ["import 'dotenv/config'\nimport { config } from '@keystone-6/core'\nimport { statelessSessions } from '@keystone-6/core/session'\nimport { createAuth } from '@keystone-6/auth'\nimport { lists } from './keystone/schema'\nimport { makeCustomRoutes } from './keystone/routes'\n\nconst { withAuth } = createAuth({\n  listKey: 'User',\n  identityField: 'email',\n  secretField: 'password',\n  sessionData: 'id email isAdmin',\n  initFirstItem: {\n    fields: ['name', 'email', 'password'],\n    itemData: { isAdmin: true },\n  },\n})\n\nconst session = statelessSessions({\n  maxAge: 60 * 60 * 24 * 7,\n  secret: process.env.SESSION_SECRET ?? 'CHANGE_THIS_TO_A_LONG_RANDOM_STRING_32CHARS!',\n})\n\nexport default withAuth(\n  config({\n    db: {\n      provider: 'postgresql',\n      url: process.env.DATABASE_URL ?? '',\n    },\n    lists,\n    session,\n    server: {\n      port: parseInt(process.env.PORT ?? '3000'),\n      cors: {\n        origin: [process.env.FRONTEND_URL ?? 'http://localhost:5173'],\n        credentials: true,\n      },\n      extendExpressApp: (app, context) => {\n        makeCustomRoutes(\n          app,\n          (req: any, res: any, next: any) => next(),\n          context\n        )\n      },\n    },\n    ui: {\n      isAccessAllowed: (context) => !!context.session?.data?.isAdmin,\n    },\n  })\n)\n", "import { list } from '@keystone-6/core'\nimport { allowAll } from '@keystone-6/core/access'\nimport {\n  text,\n  password,\n  timestamp,\n  select,\n  integer,\n  float,\n  relationship,\n  checkbox,\n} from '@keystone-6/core/fields'\nimport { document } from '@keystone-6/fields-document'\n\nconst isAdmin = ({ session }: any) => session?.data?.isAdmin === true\n\nexport const lists = {\n  // \u2500\u2500 Admin User \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  User: list({\n    access: {\n      operation: {\n        query: isAdmin,\n        create: isAdmin,\n        update: isAdmin,\n        delete: isAdmin,\n      },\n    },\n    fields: {\n      name:      text({ validation: { isRequired: true } }),\n      email:     text({ validation: { isRequired: true }, isIndexed: 'unique' }),\n      password:  password({ validation: { isRequired: true } }),\n      isAdmin:   checkbox({ defaultValue: false }),\n      createdAt: timestamp({ defaultValue: { kind: 'now' } }),\n    },\n    ui: {\n      listView: { initialColumns: ['name', 'email', 'isAdmin', 'createdAt'] },\n    },\n  }),\n\n  // \u2500\u2500 Salami Package \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SalamiPackage: list({\n    access: {\n      operation: {\n        query:  allowAll,  // public can browse\n        create: isAdmin,\n        update: isAdmin,\n        delete: isAdmin,\n      },\n    },\n    fields: {\n      name:      text({ validation: { isRequired: true } }),\n      slug:      text({ validation: { isRequired: true }, isIndexed: 'unique' }),\n      description: document({ formatting: true, dividers: true, links: true }),\n      amount:    float({ validation: { isRequired: true }, label: 'Amount (BDT)' }),\n      isActive:  checkbox({ defaultValue: true }),\n      emoji:     text({ defaultValue: '\uD83D\uDC9A' }),\n      sortOrder: integer({ defaultValue: 0 }),\n      createdAt: timestamp({ defaultValue: { kind: 'now' } }),\n      orders:    relationship({ ref: 'Order.package', many: true }),\n    },\n    ui: {\n      listView: { initialColumns: ['name', 'amount', 'isActive', 'sortOrder'] },\n    },\n  }),\n\n  // \u2500\u2500 Order \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  Order: list({\n    access: {\n      operation: {\n        query:  isAdmin,\n        create: allowAll,  // anyone can place an order\n        update: isAdmin,\n        delete: isAdmin,\n      },\n    },\n    fields: {\n      // Sender\n      senderName:    text({ validation: { isRequired: true } }),\n      senderPhone:   text({ validation: { isRequired: true } }),\n      senderMessage: text({ ui: { displayMode: 'textarea' } }),\n\n      // Recipient\n      recipientName:  text(),\n      recipientPhone: text(),\n\n      // Package\n      package: relationship({ ref: 'SalamiPackage.orders', many: false }),\n      amount:  float({ validation: { isRequired: true } }),\n\n      // Payment \u2014 manual bKash personal flow\n      paymentStatus: select({\n        options: [\n          { label: '\u23F3 Pending',              value: 'pending' },\n          { label: '\uD83D\uDD0D Pending Verification', value: 'pending_verification' },\n          { label: '\u2705 Completed',            value: 'completed' },\n          { label: '\u274C Failed',               value: 'failed' },\n          { label: '\u21A9\uFE0F  Refunded',            value: 'refunded' },\n        ],\n        defaultValue: 'pending',\n        ui: { displayMode: 'segmented-control' },\n      }),\n\n      // TrxID submitted by user after sending bKash \u2014 you verify manually\n      bkashTrxID: text({ isIndexed: true, label: 'bKash TrxID (user submitted)' }),\n      adminNote:  text({ label: 'Admin Note', ui: { displayMode: 'textarea' } }),\n\n      // Delivery\n      deliveryStatus: select({\n        options: [\n          { label: '\u23F3 Waiting',   value: 'waiting' },\n          { label: '\uD83D\uDCE4 Sent',      value: 'sent' },\n          { label: '\u2705 Delivered', value: 'delivered' },\n        ],\n        defaultValue: 'waiting',\n        ui: { displayMode: 'segmented-control' },\n      }),\n\n      createdAt: timestamp({ defaultValue: { kind: 'now' } }),\n      updatedAt: timestamp({ db: { updatedAt: true } }),\n    },\n    ui: {\n      listView: {\n        initialColumns: [\n          'senderName', 'recipientName', 'amount',\n          'bkashTrxID', 'paymentStatus', 'deliveryStatus', 'createdAt',\n        ],\n      },\n    },\n    hooks: {\n      // Auto-fill amount from linked package\n      resolveInput: async ({ resolvedData, context }) => {\n        if (resolvedData.package?.connect?.id && !resolvedData.amount) {\n          const pkg = await context.query.SalamiPackage.findOne({\n            where: { id: resolvedData.package.connect.id },\n            query: 'amount',\n          })\n          if (pkg) resolvedData.amount = pkg.amount\n        }\n        return resolvedData\n      },\n    },\n  }),\n}\n", "import { type KeystoneContext } from '@keystone-6/core/types'\nimport { type IncomingMessage, type ServerResponse } from 'http'\n\n// \u2500\u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nasync function parseBody(req: IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = ''\n    req.on('data', chunk => (data += chunk))\n    req.on('end', () => {\n      try { resolve(JSON.parse(data || '{}')) } catch { resolve({}) }\n    })\n    req.on('error', reject)\n  })\n}\n\nfunction json(res: ServerResponse, status: number, body: object) {\n  res.writeHead(status, {\n    'Content-Type': 'application/json',\n    'Access-Control-Allow-Origin': process.env.FRONTEND_URL ?? '*',\n    'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type',\n  })\n  res.end(JSON.stringify(body))\n}\n\n// Basic TrxID format validation \u2014 bKash personal TrxIDs are 10 alphanumeric chars\nfunction isValidTrxID(trxID: string): boolean {\n  return /^[A-Z0-9]{8,12}$/.test(trxID.trim().toUpperCase())\n}\n\nexport function makeCustomRoutes(\n  app: any,\n  commonMiddleware: any,\n  keystoneContext: KeystoneContext\n) {\n  // CORS preflight\n  app.use((req: IncomingMessage, res: ServerResponse, next: () => void) => {\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, {\n        'Access-Control-Allow-Origin': process.env.FRONTEND_URL ?? '*',\n        'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',\n        'Access-Control-Allow-Headers': 'Content-Type',\n      })\n      res.end()\n      return\n    }\n    next()\n  })\n\n  // \u2500\u2500 POST /api/orders/create \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // Creates a pending order. Returns orderId + your bKash number so the\n  // frontend can show \"Send \u09F3X to 017XXXXXXXX, then paste TrxID\"\n  app.use('/api/orders/create', commonMiddleware, async (req: IncomingMessage, res: ServerResponse) => {\n    if (req.method !== 'POST') return json(res, 405, { error: 'Method not allowed' })\n\n    try {\n      const body = await parseBody(req)\n      const { senderName, senderPhone, senderMessage, recipientName, recipientPhone, packageId } = body\n\n      if (!senderName || !senderPhone || !packageId) {\n        return json(res, 400, { error: 'Missing required fields' })\n      }\n\n      const pkg = await keystoneContext.sudo().query.SalamiPackage.findOne({\n        where: { id: packageId },\n        query: 'id name amount isActive',\n      })\n      if (!pkg || !pkg.isActive) {\n        return json(res, 404, { error: 'Package not found or inactive' })\n      }\n\n      const order = await keystoneContext.sudo().query.Order.createOne({\n        data: {\n          senderName,\n          senderPhone,\n          senderMessage: senderMessage ?? '',\n          recipientName: recipientName ?? '',\n          recipientPhone: recipientPhone ?? '',\n          package: { connect: { id: packageId } },\n          amount: pkg.amount,\n          paymentStatus: 'pending',\n          deliveryStatus: 'waiting',\n        },\n        query: 'id amount',\n      })\n\n      return json(res, 200, {\n        orderId: order.id,\n        amount: order.amount,\n        // Your personal bKash number \u2014 set in .env\n        bkashNumber: process.env.BKASH_PERSONAL_NUMBER ?? '',\n        invoiceRef: `EID-${order.id.slice(-8).toUpperCase()}`,\n      })\n    } catch (err: any) {\n      console.error('[create-order]', err?.message ?? err)\n      return json(res, 500, { error: 'Failed to create order' })\n    }\n  })\n\n  // \u2500\u2500 POST /api/orders/submit-trxid \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // User has sent the bKash payment and submits their TrxID.\n  // Order is marked \"pending_verification\" \u2014 you confirm from admin panel.\n  app.use('/api/orders/submit-trxid', commonMiddleware, async (req: IncomingMessage, res: ServerResponse) => {\n    if (req.method !== 'POST') return json(res, 405, { error: 'Method not allowed' })\n\n    try {\n      const body = await parseBody(req)\n      const { orderId, trxID } = body\n\n      if (!orderId || !trxID) {\n        return json(res, 400, { error: 'orderId and trxID are required' })\n      }\n\n      const normalizedTrxID = trxID.trim().toUpperCase()\n      if (!isValidTrxID(normalizedTrxID)) {\n        return json(res, 400, { error: 'Invalid TrxID format. bKash TrxIDs are 8\u201312 uppercase letters/numbers.' })\n      }\n\n      // Make sure order exists and is still pending\n      const existing = await keystoneContext.sudo().query.Order.findOne({\n        where: { id: orderId },\n        query: 'id paymentStatus bkashTrxID',\n      })\n      if (!existing) return json(res, 404, { error: 'Order not found' })\n      if (existing.paymentStatus === 'completed') {\n        return json(res, 409, { error: 'Order already completed' })\n      }\n      if (existing.bkashTrxID) {\n        return json(res, 409, { error: 'TrxID already submitted for this order' })\n      }\n\n      // Check for duplicate TrxID across all orders (prevent reuse)\n      const duplicate = await keystoneContext.sudo().query.Order.findMany({\n        where: { bkashTrxID: { equals: normalizedTrxID } },\n        query: 'id',\n      })\n      if (duplicate.length > 0) {\n        return json(res, 409, { error: '\u098F\u0987 TrxID \u0986\u0997\u09C7\u0987 \u09AC\u09CD\u09AF\u09AC\u09B9\u09BE\u09B0 \u0995\u09B0\u09BE \u09B9\u09AF\u09BC\u09C7\u099B\u09C7\u0964 Please check your TrxID.' })\n      }\n\n      await keystoneContext.sudo().query.Order.updateOne({\n        where: { id: orderId },\n        data: {\n          bkashTrxID: normalizedTrxID,\n          paymentStatus: 'pending_verification',\n        },\n      })\n\n      return json(res, 200, { success: true, message: 'TrxID submitted. Awaiting admin verification.' })\n    } catch (err: any) {\n      console.error('[submit-trxid]', err?.message ?? err)\n      return json(res, 500, { error: 'Failed to submit TrxID' })\n    }\n  })\n\n  // \u2500\u2500 GET /api/orders/:id \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  app.use('/api/orders', commonMiddleware, async (req: IncomingMessage, res: ServerResponse) => {\n    const id = req.url?.replace(/^\\/+|\\/+$/g, '')\n    if (!id) return json(res, 400, { error: 'Missing order id' })\n\n    try {\n      const order = await keystoneContext.sudo().query.Order.findOne({\n        where: { id },\n        query: `\n          id senderName recipientName amount senderMessage\n          paymentStatus deliveryStatus bkashTrxID\n          package { name amount emoji }\n          createdAt\n        `,\n      })\n      if (!order) return json(res, 404, { error: 'Order not found' })\n      return json(res, 200, order)\n    } catch (err: any) {\n      return json(res, 500, { error: err?.message })\n    }\n  })\n\n  // \u2500\u2500 GET /api/packages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  app.use('/api/packages', commonMiddleware, async (_req: IncomingMessage, res: ServerResponse) => {\n    try {\n      const packages = await keystoneContext.sudo().query.SalamiPackage.findMany({\n        where: { isActive: { equals: true } },\n        orderBy: [{ sortOrder: 'asc' }, { amount: 'asc' }],\n        query: 'id name slug amount emoji',\n      })\n      return json(res, 200, packages)\n    } catch (err: any) {\n      return json(res, 500, { error: err?.message })\n    }\n  })\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAO;AACP,IAAAA,eAAuB;AACvB,qBAAkC;AAClC,kBAA2B;;;ACH3B,kBAAqB;AACrB,oBAAyB;AACzB,oBASO;AACP,6BAAyB;AAEzB,IAAM,UAAU,CAAC,EAAE,SAAAC,SAAQ,MAAWA,UAAS,MAAM,YAAY;AAE1D,IAAM,QAAQ;AAAA;AAAA,EAEnB,UAAM,kBAAK;AAAA,IACT,QAAQ;AAAA,MACN,WAAW;AAAA,QACT,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,UAAW,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,MACpD,WAAW,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,GAAG,WAAW,SAAS,CAAC;AAAA,MACzE,cAAW,wBAAS,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,MACxD,aAAW,wBAAS,EAAE,cAAc,MAAM,CAAC;AAAA,MAC3C,eAAW,yBAAU,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;AAAA,IACxD;AAAA,IACA,IAAI;AAAA,MACF,UAAU,EAAE,gBAAgB,CAAC,QAAQ,SAAS,WAAW,WAAW,EAAE;AAAA,IACxE;AAAA,EACF,CAAC;AAAA;AAAA,EAGD,mBAAe,kBAAK;AAAA,IAClB,QAAQ;AAAA,MACN,WAAW;AAAA,QACT,OAAQ;AAAA;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,UAAW,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,MACpD,UAAW,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,GAAG,WAAW,SAAS,CAAC;AAAA,MACzE,iBAAa,iCAAS,EAAE,YAAY,MAAM,UAAU,MAAM,OAAO,KAAK,CAAC;AAAA,MACvE,YAAW,qBAAM,EAAE,YAAY,EAAE,YAAY,KAAK,GAAG,OAAO,eAAe,CAAC;AAAA,MAC5E,cAAW,wBAAS,EAAE,cAAc,KAAK,CAAC;AAAA,MAC1C,WAAW,oBAAK,EAAE,cAAc,YAAK,CAAC;AAAA,MACtC,eAAW,uBAAQ,EAAE,cAAc,EAAE,CAAC;AAAA,MACtC,eAAW,yBAAU,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;AAAA,MACtD,YAAW,4BAAa,EAAE,KAAK,iBAAiB,MAAM,KAAK,CAAC;AAAA,IAC9D;AAAA,IACA,IAAI;AAAA,MACF,UAAU,EAAE,gBAAgB,CAAC,QAAQ,UAAU,YAAY,WAAW,EAAE;AAAA,IAC1E;AAAA,EACF,CAAC;AAAA;AAAA,EAGD,WAAO,kBAAK;AAAA,IACV,QAAQ;AAAA,MACN,WAAW;AAAA,QACT,OAAQ;AAAA,QACR,QAAQ;AAAA;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,QAAQ;AAAA;AAAA,MAEN,gBAAe,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,MACxD,iBAAe,oBAAK,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA,MACxD,mBAAe,oBAAK,EAAE,IAAI,EAAE,aAAa,WAAW,EAAE,CAAC;AAAA;AAAA,MAGvD,mBAAgB,oBAAK;AAAA,MACrB,oBAAgB,oBAAK;AAAA;AAAA,MAGrB,aAAS,4BAAa,EAAE,KAAK,wBAAwB,MAAM,MAAM,CAAC;AAAA,MAClE,YAAS,qBAAM,EAAE,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC;AAAA;AAAA,MAGnD,mBAAe,sBAAO;AAAA,QACpB,SAAS;AAAA,UACP,EAAE,OAAO,kBAA0B,OAAO,UAAU;AAAA,UACpD,EAAE,OAAO,kCAA2B,OAAO,uBAAuB;AAAA,UAClE,EAAE,OAAO,oBAA0B,OAAO,YAAY;AAAA,UACtD,EAAE,OAAO,iBAA0B,OAAO,SAAS;AAAA,UACnD,EAAE,OAAO,0BAA2B,OAAO,WAAW;AAAA,QACxD;AAAA,QACA,cAAc;AAAA,QACd,IAAI,EAAE,aAAa,oBAAoB;AAAA,MACzC,CAAC;AAAA;AAAA,MAGD,gBAAY,oBAAK,EAAE,WAAW,MAAM,OAAO,+BAA+B,CAAC;AAAA,MAC3E,eAAY,oBAAK,EAAE,OAAO,cAAc,IAAI,EAAE,aAAa,WAAW,EAAE,CAAC;AAAA;AAAA,MAGzE,oBAAgB,sBAAO;AAAA,QACrB,SAAS;AAAA,UACP,EAAE,OAAO,kBAAe,OAAO,UAAU;AAAA,UACzC,EAAE,OAAO,kBAAgB,OAAO,OAAO;AAAA,UACvC,EAAE,OAAO,oBAAe,OAAO,YAAY;AAAA,QAC7C;AAAA,QACA,cAAc;AAAA,QACd,IAAI,EAAE,aAAa,oBAAoB;AAAA,MACzC,CAAC;AAAA,MAED,eAAW,yBAAU,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;AAAA,MACtD,eAAW,yBAAU,EAAE,IAAI,EAAE,WAAW,KAAK,EAAE,CAAC;AAAA,IAClD;AAAA,IACA,IAAI;AAAA,MACF,UAAU;AAAA,QACR,gBAAgB;AAAA,UACd;AAAA,UAAc;AAAA,UAAiB;AAAA,UAC/B;AAAA,UAAc;AAAA,UAAiB;AAAA,UAAkB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,MAEL,cAAc,OAAO,EAAE,cAAc,QAAQ,MAAM;AACjD,YAAI,aAAa,SAAS,SAAS,MAAM,CAAC,aAAa,QAAQ;AAC7D,gBAAM,MAAM,MAAM,QAAQ,MAAM,cAAc,QAAQ;AAAA,YACpD,OAAO,EAAE,IAAI,aAAa,QAAQ,QAAQ,GAAG;AAAA,YAC7C,OAAO;AAAA,UACT,CAAC;AACD,cAAI;AAAK,yBAAa,SAAS,IAAI;AAAA,QACrC;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF,CAAC;AACH;;;AC1IA,eAAe,UAAU,KAAoC;AAC3D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AACX,QAAI,GAAG,QAAQ,WAAU,QAAQ,KAAM;AACvC,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AAAE,gBAAQ,KAAK,MAAM,QAAQ,IAAI,CAAC;AAAA,MAAE,QAAQ;AAAE,gBAAQ,CAAC,CAAC;AAAA,MAAE;AAAA,IAChE,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,KAAK,KAAqB,QAAgB,MAAc;AAC/D,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,+BAA+B,QAAQ,IAAI,gBAAgB;AAAA,IAC3D,gCAAgC;AAAA,IAChC,gCAAgC;AAAA,EAClC,CAAC;AACD,MAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAGA,SAAS,aAAa,OAAwB;AAC5C,SAAO,mBAAmB,KAAK,MAAM,KAAK,EAAE,YAAY,CAAC;AAC3D;AAEO,SAAS,iBACd,KACA,kBACA,iBACA;AAEA,MAAI,IAAI,CAAC,KAAsB,KAAqB,SAAqB;AACvE,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK;AAAA,QACjB,+BAA+B,QAAQ,IAAI,gBAAgB;AAAA,QAC3D,gCAAgC;AAAA,QAChC,gCAAgC;AAAA,MAClC,CAAC;AACD,UAAI,IAAI;AACR;AAAA,IACF;AACA,SAAK;AAAA,EACP,CAAC;AAKD,MAAI,IAAI,sBAAsB,kBAAkB,OAAO,KAAsB,QAAwB;AACnG,QAAI,IAAI,WAAW;AAAQ,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAEhF,QAAI;AACF,YAAM,OAAO,MAAM,UAAU,GAAG;AAChC,YAAM,EAAE,YAAY,aAAa,eAAe,eAAe,gBAAgB,UAAU,IAAI;AAE7F,UAAI,CAAC,cAAc,CAAC,eAAe,CAAC,WAAW;AAC7C,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAAA,MAC5D;AAEA,YAAM,MAAM,MAAM,gBAAgB,KAAK,EAAE,MAAM,cAAc,QAAQ;AAAA,QACnE,OAAO,EAAE,IAAI,UAAU;AAAA,QACvB,OAAO;AAAA,MACT,CAAC;AACD,UAAI,CAAC,OAAO,CAAC,IAAI,UAAU;AACzB,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,gCAAgC,CAAC;AAAA,MAClE;AAEA,YAAM,QAAQ,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM,UAAU;AAAA,QAC/D,MAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA,eAAe,iBAAiB;AAAA,UAChC,eAAe,iBAAiB;AAAA,UAChC,gBAAgB,kBAAkB;AAAA,UAClC,SAAS,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE;AAAA,UACtC,QAAQ,IAAI;AAAA,UACZ,eAAe;AAAA,UACf,gBAAgB;AAAA,QAClB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAED,aAAO,KAAK,KAAK,KAAK;AAAA,QACpB,SAAS,MAAM;AAAA,QACf,QAAQ,MAAM;AAAA;AAAA,QAEd,aAAa,QAAQ,IAAI,yBAAyB;AAAA,QAClD,YAAY,OAAO,MAAM,GAAG,MAAM,EAAE,EAAE,YAAY,CAAC;AAAA,MACrD,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,cAAQ,MAAM,kBAAkB,KAAK,WAAW,GAAG;AACnD,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,4BAA4B,kBAAkB,OAAO,KAAsB,QAAwB;AACzG,QAAI,IAAI,WAAW;AAAQ,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAEhF,QAAI;AACF,YAAM,OAAO,MAAM,UAAU,GAAG;AAChC,YAAM,EAAE,SAAS,MAAM,IAAI;AAE3B,UAAI,CAAC,WAAW,CAAC,OAAO;AACtB,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAA,MACnE;AAEA,YAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,UAAI,CAAC,aAAa,eAAe,GAAG;AAClC,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,8EAAyE,CAAC;AAAA,MAC3G;AAGA,YAAM,WAAW,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM,QAAQ;AAAA,QAChE,OAAO,EAAE,IAAI,QAAQ;AAAA,QACrB,OAAO;AAAA,MACT,CAAC;AACD,UAAI,CAAC;AAAU,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;AACjE,UAAI,SAAS,kBAAkB,aAAa;AAC1C,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,0BAA0B,CAAC;AAAA,MAC5D;AACA,UAAI,SAAS,YAAY;AACvB,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,yCAAyC,CAAC;AAAA,MAC3E;AAGA,YAAM,YAAY,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM,SAAS;AAAA,QAClE,OAAO,EAAE,YAAY,EAAE,QAAQ,gBAAgB,EAAE;AAAA,QACjD,OAAO;AAAA,MACT,CAAC;AACD,UAAI,UAAU,SAAS,GAAG;AACxB,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,gLAA6D,CAAC;AAAA,MAC/F;AAEA,YAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM,UAAU;AAAA,QACjD,OAAO,EAAE,IAAI,QAAQ;AAAA,QACrB,MAAM;AAAA,UACJ,YAAY;AAAA,UACZ,eAAe;AAAA,QACjB;AAAA,MACF,CAAC;AAED,aAAO,KAAK,KAAK,KAAK,EAAE,SAAS,MAAM,SAAS,gDAAgD,CAAC;AAAA,IACnG,SAAS,KAAU;AACjB,cAAQ,MAAM,kBAAkB,KAAK,WAAW,GAAG;AACnD,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,eAAe,kBAAkB,OAAO,KAAsB,QAAwB;AAC5F,UAAM,KAAK,IAAI,KAAK,QAAQ,cAAc,EAAE;AAC5C,QAAI,CAAC;AAAI,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAE5D,QAAI;AACF,YAAM,QAAQ,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM,QAAQ;AAAA,QAC7D,OAAO,EAAE,GAAG;AAAA,QACZ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMT,CAAC;AACD,UAAI,CAAC;AAAO,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAC9D,aAAO,KAAK,KAAK,KAAK,KAAK;AAAA,IAC7B,SAAS,KAAU;AACjB,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC;AAAA,IAC/C;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,iBAAiB,kBAAkB,OAAO,MAAuB,QAAwB;AAC/F,QAAI;AACF,YAAM,WAAW,MAAM,gBAAgB,KAAK,EAAE,MAAM,cAAc,SAAS;AAAA,QACzE,OAAO,EAAE,UAAU,EAAE,QAAQ,KAAK,EAAE;AAAA,QACpC,SAAS,CAAC,EAAE,WAAW,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC;AAAA,QACjD,OAAO;AAAA,MACT,CAAC;AACD,aAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,IAChC,SAAS,KAAU;AACjB,aAAO,KAAK,KAAK,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC;AAAA,IAC/C;AAAA,EACF,CAAC;AACH;;;AFvLA,IAAM,EAAE,SAAS,QAAI,wBAAW;AAAA,EAC9B,SAAS;AAAA,EACT,eAAe;AAAA,EACf,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe;AAAA,IACb,QAAQ,CAAC,QAAQ,SAAS,UAAU;AAAA,IACpC,UAAU,EAAE,SAAS,KAAK;AAAA,EAC5B;AACF,CAAC;AAED,IAAM,cAAU,kCAAkB;AAAA,EAChC,QAAQ,KAAK,KAAK,KAAK;AAAA,EACvB,QAAQ,QAAQ,IAAI,kBAAkB;AACxC,CAAC;AAED,IAAO,mBAAQ;AAAA,MACb,qBAAO;AAAA,IACL,IAAI;AAAA,MACF,UAAU;AAAA,MACV,KAAK,QAAQ,IAAI,gBAAgB;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,MACN,MAAM,SAAS,QAAQ,IAAI,QAAQ,MAAM;AAAA,MACzC,MAAM;AAAA,QACJ,QAAQ,CAAC,QAAQ,IAAI,gBAAgB,uBAAuB;AAAA,QAC5D,aAAa;AAAA,MACf;AAAA,MACA,kBAAkB,CAAC,KAAK,YAAY;AAClC;AAAA,UACE;AAAA,UACA,CAAC,KAAU,KAAU,SAAc,KAAK;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,IAAI;AAAA,MACF,iBAAiB,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS,MAAM;AAAA,IACzD;AAAA,EACF,CAAC;AACH;",
+  "names": ["import_core", "session"]
+}

package/backend/bkash/bkash.service.ts

@@ -0,0 +1,184 @@
+import axios, { AxiosInstance } from 'axios'
+
+interface BkashConfig {
+  baseUrl: string
+  appKey: string
+  appSecret: string
+  username: string
+  password: string
+}
+
+interface BkashToken {
+  id_token: string
+  token_type: string
+  expires_in: number
+  refresh_token: string
+}
+
+interface CreatePaymentResponse {
+  paymentID: string
+  bkashURL: string
+  callbackURL: string
+  successCallbackURL: string
+  failureCallbackURL: string
+  cancelledCallbackURL: string
+  amount: string
+  intent: string
+  currency: string
+  paymentCreateTime: string
+  transactionStatus: string
+  merchantInvoiceNumber: string
+}
+
+interface ExecutePaymentResponse {
+  paymentID: string
+  trxID: string
+  transactionStatus: string
+  amount: string
+  currency: string
+  intent: string
+  paymentExecuteTime: string
+  merchantInvoiceNumber: string
+  customerMsisdn: string
+}
+
+export class BkashService {
+  private config: BkashConfig
+  private http: AxiosInstance
+  private token: string | null = null
+  private tokenExpiry: number = 0
+
+  constructor(config: BkashConfig) {
+    this.config = config
+    this.http = axios.create({
+      baseURL: config.baseUrl,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  // ── Grant Token ─────────────────────────────────────────────────────────────
+  async grantToken(): Promise<string> {
+    const now = Date.now()
+    if (this.token && now < this.tokenExpiry) return this.token
+
+    const res = await this.http.post<BkashToken>(
+      '/tokenized/checkout/token/grant',
+      {
+        app_key: this.config.appKey,
+        app_secret: this.config.appSecret,
+      },
+      {
+        headers: {
+          username: this.config.username,
+          password: this.config.password,
+        },
+      }
+    )
+
+    this.token = res.data.id_token
+    // Expire 5 minutes early to be safe
+    this.tokenExpiry = now + (res.data.expires_in - 300) * 1000
+    return this.token
+  }
+
+  // ── Create Payment ──────────────────────────────────────────────────────────
+  async createPayment(params: {
+    amount: number
+    orderId: string
+    callbackUrl: string
+    merchantInvoiceNumber?: string
+  }): Promise<CreatePaymentResponse> {
+    const token = await this.grantToken()
+
+    const res = await this.http.post<CreatePaymentResponse>(
+      '/tokenized/checkout/create',
+      {
+        mode: '0011',            // Checkout URL
+        payerReference: params.orderId,
+        callbackURL: params.callbackUrl,
+        amount: params.amount.toFixed(2),
+        currency: 'BDT',
+        intent: 'sale',
+        merchantInvoiceNumber: params.merchantInvoiceNumber ?? params.orderId,
+      },
+      {
+        headers: {
+          Authorization: token,
+          'X-APP-Key': this.config.appKey,
+        },
+      }
+    )
+    return res.data
+  }
+
+  // ── Execute Payment ─────────────────────────────────────────────────────────
+  async executePayment(paymentID: string): Promise<ExecutePaymentResponse> {
+    const token = await this.grantToken()
+
+    const res = await this.http.post<ExecutePaymentResponse>(
+      '/tokenized/checkout/execute',
+      { paymentID },
+      {
+        headers: {
+          Authorization: token,
+          'X-APP-Key': this.config.appKey,
+        },
+      }
+    )
+    return res.data
+  }
+
+  // ── Query Payment ───────────────────────────────────────────────────────────
+  async queryPayment(paymentID: string): Promise<any> {
+    const token = await this.grantToken()
+
+    const res = await this.http.post(
+      '/tokenized/checkout/payment/status',
+      { paymentID },
+      {
+        headers: {
+          Authorization: token,
+          'X-APP-Key': this.config.appKey,
+        },
+      }
+    )
+    return res.data
+  }
+
+  // ── Refund ──────────────────────────────────────────────────────────────────
+  async refund(params: {
+    paymentID: string
+    trxID: string
+    amount: number
+    reason?: string
+  }): Promise<any> {
+    const token = await this.grantToken()
+
+    const res = await this.http.post(
+      '/tokenized/checkout/payment/refund',
+      {
+        paymentID: params.paymentID,
+        trxID: params.trxID,
+        amount: params.amount.toFixed(2),
+        currency: 'BDT',
+        reason: params.reason ?? 'Customer request',
+      },
+      {
+        headers: {
+          Authorization: token,
+          'X-APP-Key': this.config.appKey,
+        },
+      }
+    )
+    return res.data
+  }
+}
+
+// Singleton
+export const bkash = new BkashService({
+  baseUrl: process.env.BKASH_BASE_URL ?? 'https://tokenized.sandbox.bka.sh/v1.2.0-beta',
+  appKey: process.env.BKASH_APP_KEY ?? '',
+  appSecret: process.env.BKASH_APP_SECRET ?? '',
+  username: process.env.BKASH_USERNAME ?? '',
+  password: process.env.BKASH_PASSWORD ?? '',
+})