includio-cms 0.15.0 → 0.15.2

package/dist/shop/http/checkout-handler.js

@@ -1,8 +1,10 @@
 import { json } from '@sveltejs/kit';
 import { getCMS } from '../../core/cms.js';
 import { readCartCookie, writeCartCookie } from '../cart/cookie.js';
-import { createOrderFromCart } from '../server/orders.js';
+import { writeOrderTokenCookie } from '../cart/order-token-cookie.js';
+import { createOrderFromCart, setPaymentProviderRef } from '../server/orders.js';
 import { checkRateLimit, clientKey } from '../rate-limit.js';
+import { requireShopConfig } from '../server/db.js';
 function shopEnabled() {
     try {
         return getCMS().shopConfig !== null;
@@ -41,7 +43,7 @@ function asConsents(v) {
 }
 export function createCheckoutHandler() {
     return {
-        POST: async ({ request, cookies }) => {
+        POST: async ({ request, cookies, getClientAddress }) => {
             if (!shopEnabled())
                 return json({ error: 'Shop not enabled' }, { status: 404 });
             const rule = getCMS().shopConfig?.rateLimit.checkout ?? { limit: 5, windowSec: 60 };
@@ -81,14 +83,55 @@ export function createCheckoutHandler() {
                 });
                 // Clear cart on successful order
                 writeCartCookie(cookies, []);
+                // Short-lived cookie for same-browser order view fallback
+                writeOrderTokenCookie(cookies, {
+                    number: result.order.number,
+                    token: result.order.accessToken
+                });
+                // Initiate payment (if adapter supports redirect)
+                const shop = requireShopConfig();
+                const adapter = shop.payment.find((a) => a.id === paymentMethod);
+                let paymentResult = null;
+                if (adapter) {
+                    const orderRef = {
+                        id: result.order.id,
+                        number: result.order.number,
+                        totalGross: result.order.totalGross,
+                        currency: shop.currency,
+                        customerEmail: result.order.customerEmail
+                    };
+                    let customerIp;
+                    try {
+                        customerIp = getClientAddress();
+                    }
+                    catch {
+                        customerIp = undefined;
+                    }
+                    try {
+                        paymentResult = await adapter.createPayment(orderRef, {
+                            customerIp,
+                            language: result.order.language
+                        });
+                        if (paymentResult.providerRef) {
+                            await setPaymentProviderRef(result.order.id, paymentResult.providerRef);
+                        }
+                    }
+                    catch (err) {
+                        console.error(`[shop] createPayment failed for ${result.order.number}:`, err);
+                        paymentResult = { status: 'error' };
+                    }
+                }
+                const requiresRedirect = paymentResult?.status === 'redirect';
                 return json({
                     orderId: result.order.id,
                     orderNumber: result.order.number,
+                    accessToken: result.order.accessToken,
                     status: result.order.status,
                     totalGross: result.order.totalGross,
                     currency: result.order.currency,
-                    requiresPaymentRedirect: result.requiresPaymentRedirect,
-                    redirectUrl: result.redirectUrl ?? null
+                    paymentStatus: paymentResult?.status ?? 'manual',
+                    requiresPaymentRedirect: requiresRedirect,
+                    redirectUrl: requiresRedirect ? paymentResult?.redirectUrl ?? null : null
                 });
             }
             catch (err) {

package/dist/shop/http/index.d.ts

@@ -1,3 +1,7 @@
 export { createCartHandler } from './cart-handler.js';
 export { createShippingMethodsHandler } from './shipping-handler.js';
 export { createCheckoutHandler } from './checkout-handler.js';
+export { createOrderHandler } from './order-handler.js';
+export { createPaymentWebhookHandler } from './webhook-handler.js';
+export { createRefreshPaymentHandler } from './refresh-payment-handler.js';
+export { createRetryPaymentHandler } from './retry-payment-handler.js';

package/dist/shop/http/index.js

@@ -1,3 +1,7 @@
 export { createCartHandler } from './cart-handler.js';
 export { createShippingMethodsHandler } from './shipping-handler.js';
 export { createCheckoutHandler } from './checkout-handler.js';
+export { createOrderHandler } from './order-handler.js';
+export { createPaymentWebhookHandler } from './webhook-handler.js';
+export { createRefreshPaymentHandler } from './refresh-payment-handler.js';
+export { createRetryPaymentHandler } from './retry-payment-handler.js';

package/dist/shop/http/order-handler.d.ts

@@ -0,0 +1,4 @@
+import { type RequestHandler } from '@sveltejs/kit';
+export declare function createOrderHandler(): {
+    GET: RequestHandler;
+};

package/dist/shop/http/order-handler.js

@@ -0,0 +1,85 @@
+import { json } from '@sveltejs/kit';
+import { timingSafeEqual } from 'node:crypto';
+import { getCMS } from '../../core/cms.js';
+import { getOrderByNumber, getOrderItems, getOrderStatusHistory } from '../server/orders.js';
+import { readOrderTokenCookie } from '../cart/order-token-cookie.js';
+function shopEnabled() {
+    try {
+        return getCMS().shopConfig !== null;
+    }
+    catch {
+        return false;
+    }
+}
+function tokensMatch(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+    catch {
+        return false;
+    }
+}
+export function createOrderHandler() {
+    return {
+        GET: async ({ params, url, cookies }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const number = params.number;
+            if (!number)
+                return json({ error: 'Order number required' }, { status: 400 });
+            const order = await getOrderByNumber(number);
+            if (!order)
+                return json({ error: 'Not found' }, { status: 404 });
+            const queryToken = url.searchParams.get('token') ?? '';
+            const cookieValue = readOrderTokenCookie(cookies);
+            const cookieToken = cookieValue && cookieValue.number === order.number ? cookieValue.token : '';
+            const providedToken = queryToken || cookieToken;
+            if (!providedToken || !tokensMatch(providedToken, order.accessToken)) {
+                return json({ error: 'Forbidden' }, { status: 403 });
+            }
+            const [items, history] = await Promise.all([
+                getOrderItems(order.id),
+                getOrderStatusHistory(order.id)
+            ]);
+            return json({
+                order: {
+                    id: order.id,
+                    number: order.number,
+                    status: order.status,
+                    currency: order.currency,
+                    customerEmail: order.customerEmail,
+                    customerName: order.customerName,
+                    customerPhone: order.customerPhone,
+                    shippingAddress: order.shippingAddress,
+                    totalNet: order.totalNet,
+                    totalGross: order.totalGross,
+                    vatAmount: order.vatAmount,
+                    shippingNet: order.shippingNet,
+                    shippingGross: order.shippingGross,
+                    paymentMethod: order.paymentMethod,
+                    carrierType: order.carrierType,
+                    carrierRef: order.carrierRef,
+                    language: order.language,
+                    createdAt: order.createdAt
+                },
+                items: items.map((i) => ({
+                    id: i.id,
+                    variantId: i.variantId,
+                    nameSnapshot: i.nameSnapshot,
+                    skuSnapshot: i.skuSnapshot,
+                    priceNetSnapshot: i.priceNetSnapshot,
+                    priceGrossSnapshot: i.priceGrossSnapshot,
+                    vatRate: i.vatRate,
+                    qty: i.qty
+                })),
+                statusHistory: history.map((h) => ({
+                    status: h.status,
+                    note: h.note,
+                    changedAt: h.changedAt
+                }))
+            });
+        }
+    };
+}

package/dist/shop/http/refresh-payment-handler.d.ts

@@ -0,0 +1,4 @@
+import { type RequestHandler } from '@sveltejs/kit';
+export declare function createRefreshPaymentHandler(): {
+    POST: RequestHandler;
+};

package/dist/shop/http/refresh-payment-handler.js

@@ -0,0 +1,73 @@
+import { json } from '@sveltejs/kit';
+import { timingSafeEqual } from 'node:crypto';
+import { getCMS } from '../../core/cms.js';
+import { requireShopConfig } from '../server/db.js';
+import { getOrderByNumber, updateOrderStatus } from '../server/orders.js';
+import { readOrderTokenCookie } from '../cart/order-token-cookie.js';
+import { isTerminalStatus, mapEventToStatus } from './webhook-logic.js';
+function shopEnabled() {
+    try {
+        return getCMS().shopConfig !== null;
+    }
+    catch {
+        return false;
+    }
+}
+function tokensMatch(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+    catch {
+        return false;
+    }
+}
+export function createRefreshPaymentHandler() {
+    return {
+        POST: async ({ params, url, cookies }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const number = params.number;
+            if (!number)
+                return json({ error: 'Order number required' }, { status: 400 });
+            const order = await getOrderByNumber(number);
+            if (!order)
+                return json({ error: 'Not found' }, { status: 404 });
+            const queryToken = url.searchParams.get('token') ?? '';
+            const cookieValue = readOrderTokenCookie(cookies);
+            const cookieToken = cookieValue && cookieValue.number === order.number ? cookieValue.token : '';
+            const providedToken = queryToken || cookieToken;
+            if (!providedToken || !tokensMatch(providedToken, order.accessToken)) {
+                return json({ error: 'Forbidden' }, { status: 403 });
+            }
+            if (isTerminalStatus(order.status)) {
+                return json({ status: order.status, noop: true });
+            }
+            if (!order.paymentMethod || !order.paymentProviderRef) {
+                return json({ status: order.status, noop: true });
+            }
+            const shop = requireShopConfig();
+            const adapter = shop.payment.find((a) => a.id === order.paymentMethod);
+            if (!adapter || typeof adapter.getStatus !== 'function') {
+                return json({ status: order.status, noop: true });
+            }
+            try {
+                const event = await adapter.getStatus(order.paymentProviderRef);
+                const target = mapEventToStatus(event);
+                if (target && target !== order.status) {
+                    await updateOrderStatus(order.id, target, {
+                        note: `Refresh-payment (${order.paymentMethod})`,
+                        changedBy: 'refresh-payment'
+                    });
+                    return json({ status: target, updated: true });
+                }
+                return json({ status: order.status, updated: false });
+            }
+            catch (err) {
+                console.error(`[shop] refresh-payment failed for ${order.number}:`, err);
+                return json({ error: 'Refresh failed' }, { status: 502 });
+            }
+        }
+    };
+}

package/dist/shop/http/retry-payment-handler.d.ts

@@ -0,0 +1,4 @@
+import { type RequestHandler } from '@sveltejs/kit';
+export declare function createRetryPaymentHandler(): {
+    POST: RequestHandler;
+};

package/dist/shop/http/retry-payment-handler.js

@@ -0,0 +1,99 @@
+import { json } from '@sveltejs/kit';
+import { timingSafeEqual } from 'node:crypto';
+import { getCMS } from '../../core/cms.js';
+import { requireShopConfig } from '../server/db.js';
+import { getOrderByNumber, setPaymentProviderRef, updateOrderStatus } from '../server/orders.js';
+import { readOrderTokenCookie } from '../cart/order-token-cookie.js';
+import { canRetryPayment } from './retry-payment-logic.js';
+function shopEnabled() {
+    try {
+        return getCMS().shopConfig !== null;
+    }
+    catch {
+        return false;
+    }
+}
+function tokensMatch(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+    catch {
+        return false;
+    }
+}
+export function createRetryPaymentHandler() {
+    return {
+        POST: async ({ params, url, cookies, getClientAddress }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const number = params.number;
+            if (!number)
+                return json({ error: 'Order number required' }, { status: 400 });
+            const order = await getOrderByNumber(number);
+            if (!order)
+                return json({ error: 'Not found' }, { status: 404 });
+            const queryToken = url.searchParams.get('token') ?? '';
+            const cookieValue = readOrderTokenCookie(cookies);
+            const cookieToken = cookieValue && cookieValue.number === order.number ? cookieValue.token : '';
+            const providedToken = queryToken || cookieToken;
+            if (!providedToken || !tokensMatch(providedToken, order.accessToken)) {
+                return json({ error: 'Forbidden' }, { status: 403 });
+            }
+            if (!canRetryPayment(order.status)) {
+                return json({ error: `Order status "${order.status}" does not allow retry`, status: order.status }, { status: 409 });
+            }
+            if (!order.paymentMethod) {
+                return json({ error: 'Order has no payment method' }, { status: 400 });
+            }
+            const shop = requireShopConfig();
+            const adapter = shop.payment.find((a) => a.id === order.paymentMethod);
+            if (!adapter) {
+                return json({ error: 'Payment adapter not available' }, { status: 400 });
+            }
+            const orderRef = {
+                id: order.id,
+                number: order.number,
+                totalGross: order.totalGross,
+                currency: shop.currency,
+                customerEmail: order.customerEmail
+            };
+            let customerIp;
+            try {
+                customerIp = getClientAddress();
+            }
+            catch {
+                customerIp = undefined;
+            }
+            let result;
+            try {
+                result = await adapter.createPayment(orderRef, {
+                    customerIp,
+                    language: order.language
+                });
+            }
+            catch (err) {
+                console.error(`[shop] retry-payment failed for ${order.number}:`, err);
+                return json({ error: 'Payment creation failed' }, { status: 502 });
+            }
+            if (result.providerRef) {
+                await setPaymentProviderRef(order.id, result.providerRef);
+            }
+            // If the order was paymentRejected, move it back to awaitingPayment so the
+            // new attempt can transition it via webhook/polling.
+            if (order.status === 'paymentRejected') {
+                await updateOrderStatus(order.id, 'awaitingPayment', {
+                    note: 'Retry payment',
+                    changedBy: 'retry-payment'
+                });
+            }
+            return json({
+                status: result.status === 'redirect' ? 'awaitingPayment' : order.status,
+                paymentStatus: result.status,
+                requiresPaymentRedirect: result.status === 'redirect',
+                redirectUrl: result.status === 'redirect' ? result.redirectUrl ?? null : null
+            });
+        }
+    };
+}

package/dist/shop/http/retry-payment-logic.d.ts

@@ -0,0 +1,2 @@
+import type { OrderStatus } from '../types.js';
+export declare function canRetryPayment(status: OrderStatus): boolean;

package/dist/shop/http/retry-payment-logic.js

@@ -0,0 +1,4 @@
+const RETRYABLE = new Set(['awaitingPayment', 'paymentRejected']);
+export function canRetryPayment(status) {
+    return RETRYABLE.has(status);
+}

package/dist/shop/http/shipping-handler.js

@@ -23,7 +23,8 @@ export function createShippingMethodsHandler() {
                     price: m.price,
                     vatRate: m.vatRate,
                     carrierType: m.carrierType,
-                    conditions: m.conditions
+                    conditions: m.conditions,
+                    allowedPaymentMethods: m.allowedPaymentMethods ?? null
                 }))
             });
         }

package/dist/shop/http/webhook-handler.d.ts

@@ -0,0 +1,4 @@
+import { type RequestHandler } from '@sveltejs/kit';
+export declare function createPaymentWebhookHandler(): {
+    POST: RequestHandler;
+};

package/dist/shop/http/webhook-handler.js

@@ -0,0 +1,73 @@
+import { json } from '@sveltejs/kit';
+import { getCMS } from '../../core/cms.js';
+import { requireShopConfig } from '../server/db.js';
+import { getOrderByNumber, updateOrderStatus } from '../server/orders.js';
+import { checkRateLimit, clientKey } from '../rate-limit.js';
+import { isTerminalStatus, mapEventToStatus } from './webhook-logic.js';
+function shopEnabled() {
+    try {
+        return getCMS().shopConfig !== null;
+    }
+    catch {
+        return false;
+    }
+}
+function findAdapter(provider) {
+    const shop = requireShopConfig();
+    return shop.payment.find((a) => a.id === provider) ?? null;
+}
+export function createPaymentWebhookHandler() {
+    return {
+        POST: async ({ params, request }) => {
+            if (!shopEnabled())
+                return json({ error: 'Shop not enabled' }, { status: 404 });
+            const provider = params.provider;
+            if (!provider)
+                return json({ error: 'Provider required' }, { status: 400 });
+            const rule = getCMS().shopConfig?.rateLimit.webhook ?? { limit: 60, windowSec: 60 };
+            const rl = checkRateLimit(clientKey(request, `webhook:${provider}`), rule);
+            if (!rl.allowed) {
+                return json({ error: 'Rate limit exceeded' }, { status: 429 });
+            }
+            const adapter = findAdapter(provider);
+            if (!adapter || typeof adapter.handleWebhook !== 'function') {
+                return json({ error: 'Unknown provider' }, { status: 404 });
+            }
+            let event;
+            try {
+                event = await adapter.handleWebhook(request);
+            }
+            catch (err) {
+                console.error(`[shop] Webhook parse/verify failed for ${provider}:`, err);
+                // Bad signature / malformed body → 400 (don't encourage retries with 200)
+                return json({ error: 'Invalid webhook' }, { status: 400 });
+            }
+            const order = await getOrderByNumber(event.orderNumber);
+            if (!order) {
+                // Unknown order — 200 so the provider stops retrying
+                console.warn(`[shop] Webhook for unknown order ${event.orderNumber} (${provider}) — acking.`);
+                return json({ received: true });
+            }
+            // Idempotency — terminal states are no-ops
+            if (isTerminalStatus(order.status)) {
+                return json({ received: true, idempotent: true });
+            }
+            const targetStatus = mapEventToStatus(event);
+            if (!targetStatus) {
+                return json({ received: true, noop: true });
+            }
+            try {
+                await updateOrderStatus(order.id, targetStatus, {
+                    note: `Payment webhook (${provider})`,
+                    changedBy: 'payment-webhook'
+                });
+            }
+            catch (err) {
+                console.error(`[shop] updateOrderStatus failed for ${order.number}:`, err);
+                // Return 500 — provider retry helps
+                return json({ error: 'Processing failed' }, { status: 500 });
+            }
+            return json({ received: true });
+        }
+    };
+}

package/dist/shop/http/webhook-logic.d.ts

@@ -0,0 +1,4 @@
+import type { OrderStatus, PaymentEvent } from '../types.js';
+export declare const TERMINAL_ORDER_STATUSES: ReadonlySet<OrderStatus>;
+export declare function isTerminalStatus(status: OrderStatus): boolean;
+export declare function mapEventToStatus(event: PaymentEvent): OrderStatus | null;

package/dist/shop/http/webhook-logic.js

@@ -0,0 +1,21 @@
+export const TERMINAL_ORDER_STATUSES = new Set([
+    'paid',
+    'paymentRejected',
+    'cancelled',
+    'done'
+]);
+export function isTerminalStatus(status) {
+    return TERMINAL_ORDER_STATUSES.has(status);
+}
+export function mapEventToStatus(event) {
+    switch (event.status) {
+        case 'paid':
+            return 'paid';
+        case 'paymentRejected':
+            return 'paymentRejected';
+        case 'pending':
+            return null;
+        default:
+            return null;
+    }
+}

package/dist/shop/index.d.ts

@@ -1,4 +1,6 @@
 import type { ShopConfig, ResolvedShopConfig } from './types.js';
 export declare function defineShop(config: ShopConfig): ResolvedShopConfig;
 export { manualAdapter } from './adapters/manual/index.js';
-export type { ShopConfig, ResolvedShopConfig, Currency, OrderStatus, PaymentAdapter, CarrierAdapter, ConsentConfig, ShopFeatures, PaymentCreateResult, PaymentEvent, OrderRef, I18nText } from './types.js';
+export { payuAdapter } from './adapters/payu/index.js';
+export type { PayuAdapterOptions } from './adapters/payu/index.js';
+export type { ShopConfig, ResolvedShopConfig, Currency, OrderStatus, PaymentAdapter, PaymentCreateContext, CarrierAdapter, ConsentConfig, ShopFeatures, PaymentCreateResult, PaymentEvent, OrderRef, I18nText } from './types.js';

package/dist/shop/index.js

@@ -11,7 +11,9 @@ export function defineShop(config) {
             webhook: config.rateLimit?.webhook ?? { limit: 60, windowSec: 60 }
         },
         carriers: config.carriers ?? [],
-        consents: config.consents ?? []
+        consents: config.consents ?? [],
+        orderViewUrl: config.orderViewUrl ?? '/shop/order/{orderNumber}?token={accessToken}'
     };
 }
 export { manualAdapter } from './adapters/manual/index.js';
+export { payuAdapter } from './adapters/payu/index.js';

package/dist/shop/pricing.d.ts

@@ -1,3 +1,7 @@
+export declare function netPlnFromGrossPln(grossPln: number, vatRate: number): number;
+export declare function grossPlnFromNetPln(netPln: number, vatRate: number): number;
+export declare function toCents(pln: number): number;
+export declare function fromCents(cents: number): number;
 export declare function grossFromNet(net: number, vatRate: number): number;
 export declare function netFromGross(gross: number, vatRate: number): number;
 export declare function vatAmount(net: number, vatRate: number): number;

package/dist/shop/pricing.js

@@ -1,3 +1,21 @@
+// Pricing — dwie domeny:
+//   PLN-precise (number, do 6dp) — używane dla basePrice/priceDelta/shipping.price w DB (numeric 20,6).
+//   cents (integer, grosze)       — używane w snapshotach zamówienia/faktury (KSeF).
+// Round do groszy odbywa się RAZ, na granicy PLN→cents, po kompletnym mnożeniu netto×(1+VAT).
+export function netPlnFromGrossPln(grossPln, vatRate) {
+    return grossPln / (1 + vatRate / 100);
+}
+export function grossPlnFromNetPln(netPln, vatRate) {
+    return netPln * (1 + vatRate / 100);
+}
+export function toCents(pln) {
+    return Math.round(pln * 100);
+}
+export function fromCents(cents) {
+    return cents / 100;
+}
+// Compat shims — `net`/`gross` w CENTACH. Deprecated; nie używać w nowych ścieżkach.
+// Cierpią na drift dla input-as-gross + round-trip. Zostawione dla testów i zewnętrznych konsumentów.
 export function grossFromNet(net, vatRate) {
     return Math.round(net * (1 + vatRate / 100));
 }

package/dist/shop/server/cart-hydrate.js

@@ -4,7 +4,7 @@ import { entriesTable } from '../../db-postgres/schema/entry.js';
 import { entryVersionsTable } from '../../db-postgres/schema/entryVersion.js';
 import { getCMS } from '../../core/cms.js';
 import { getShopDb, requireShopConfig } from './db.js';
-import { grossFromNet } from '../pricing.js';
+import { grossPlnFromNetPln, toCents } from '../pricing.js';
 export async function hydrateCart(items, opts = {}) {
     const shop = requireShopConfig();
     const cms = getCMS();
@@ -94,8 +94,11 @@ export async function hydrateCart(items, opts = {}) {
         const version = publishedByEntry.get(product.entryId);
         const title = readTitle(version?.data);
         const slug = readSlug(version?.data);
-        const priceNet = product.basePrice + (variant.priceDelta ?? 0);
-        const priceGross = grossFromNet(priceNet, product.vatRate);
+        // basePrice/priceDelta są numeric(20,6) → drizzle zwraca string. Konwertujemy do PLN (number).
+        const priceNetPln = Number(product.basePrice) + Number(variant.priceDelta ?? 0);
+        const priceGrossPln = grossPlnFromNetPln(priceNetPln, product.vatRate);
+        const priceNet = toCents(priceNetPln);
+        const priceGross = toCents(priceGrossPln);
         const stock = variant.stock;
         const stockEnabled = shop.features.stock;
         let effectiveQty = ref.qty;

package/dist/shop/server/email.js

@@ -2,6 +2,7 @@ import { getCMS } from '../../core/cms.js';
 import { resolveI18n } from '../pricing.js';
 import { getOrderById, getOrderItems } from './orders.js';
 import { requireShopConfig } from './db.js';
+import { buildOrderViewUrl } from './order-access-url.js';
 function formatPrice(cents, currency) {
     return new Intl.NumberFormat('pl-PL', {
         style: 'currency',
@@ -53,6 +54,10 @@ const STATUS_INTRO = {
         en: 'Payment was not received. Please contact us if you have questions.'
     }
 };
+const VIEW_LINK_LABEL = {
+    pl: 'Zobacz zamówienie',
+    en: 'View order'
+};
 function renderHtml(ctx, intro) {
     const itemsRows = ctx.items
         .map((i) => `<tr><td style="padding:6px 8px;border-bottom:1px solid #eee;">${escapeHtml(i.name)}</td><td style="padding:6px 8px;border-bottom:1px solid #eee;text-align:center;">${i.qty}</td><td style="padding:6px 8px;border-bottom:1px solid #eee;text-align:right;">${i.lineGross}</td></tr>`)
@@ -72,6 +77,9 @@ function renderHtml(ctx, intro) {
       <div style="font-size:16px;">Razem (brutto): <strong style="color:#5B4A9E;">${ctx.order.totalGross}</strong></div>
       <div style="color:#8888A0;font-size:12px;">netto ${ctx.order.totalNet} · VAT ${ctx.order.vatAmount}</div>
     </div>
+    ${ctx.viewUrl
+        ? `<div style="margin-top:24px;text-align:center;"><a href="${escapeHtml(ctx.viewUrl)}" style="display:inline-block;background:#5B4A9E;color:#fff;text-decoration:none;padding:10px 18px;border-radius:8px;font-weight:600;">${escapeHtml(ctx.viewLinkLabel)}</a></div>`
+        : ''}
   </div>
   <p style="text-align:center;color:#8888A0;font-size:12px;margin-top:16px;">AriaCMS · ${escapeHtml(ctx.order.customerEmail)}</p>
 </div>
@@ -99,7 +107,17 @@ export async function sendOrderStatusEmail(orderId, status) {
     const items = await getOrderItems(orderId);
     const lang = (order.language || cms.languages[0] || 'pl');
     const subjectKey = (lang in STATUS_SUBJECTS[status] ? lang : 'pl');
+    const viewUrl = /^https?:\/\//i.test(shop.orderViewUrl)
+        ? buildOrderViewUrl(shop.orderViewUrl, {
+            orderNumber: order.number,
+            orderId: order.id,
+            accessToken: order.accessToken,
+            language: order.language
+        })
+        : null;
     const ctx = {
+        viewUrl,
+        viewLinkLabel: VIEW_LINK_LABEL[subjectKey],
         order: {
             number: order.number,
             status: order.status,
@@ -133,6 +151,4 @@ export async function sendOrderStatusEmail(orderId, status) {
         console.error('[shop] Failed to send status email:', err);
         // Swallow — don't block status change on email failures
     }
-    // Silence unused for now
-    void shop;
 }

package/dist/shop/server/order-access-url.d.ts

@@ -0,0 +1,7 @@
+export interface OrderUrlContext {
+    orderNumber: string;
+    orderId: string;
+    accessToken: string;
+    language?: string | null;
+}
+export declare function buildOrderViewUrl(template: string, ctx: OrderUrlContext): string;

package/dist/shop/server/order-access-url.js

@@ -0,0 +1,6 @@
+export function buildOrderViewUrl(template, ctx) {
+    return template.replace(/\{(orderNumber|orderId|accessToken|language)\}/g, (_m, key) => {
+        const value = ctx[key];
+        return encodeURIComponent(value == null ? '' : String(value));
+    });
+}

package/dist/shop/server/orders.d.ts

@@ -32,6 +32,7 @@ export declare function updateOrderStatus(orderId: string, status: OrderStatus,
     note?: string;
     changedBy?: string;
 }): Promise<OrderRow>;
+export declare function setPaymentProviderRef(orderId: string, ref: string | null): Promise<void>;
 export declare function getOrderById(id: string): Promise<OrderRow | null>;
 export declare function getOrderByNumber(number: string): Promise<OrderRow | null>;
 export declare function getOrderItems(orderId: string): Promise<OrderItemRow[]>;