includio-cms 0.36.9 → 0.37.1

package/dist/db-postgres/schema/booking/bookings.d.ts

@@ -0,0 +1,324 @@
+import type { BookingStatus } from '../../../booking/state-machine.js';
+import type { AppliedRule, Perk } from '../../../booking/pricing.js';
+/** Computed money snapshot kept on the booking for fast list/detail reads. */
+export interface BookingTotals {
+    gross: number;
+    discount: number;
+    /** Σ active manual surcharges (minor units). */
+    surcharge: number;
+    /** Σ active manual discounts, magnitude (minor units). */
+    manualDiscount: number;
+    paid: number;
+    balance: number;
+    /** Granted non-monetary perks (staff notes; manual fulfilment). */
+    perks: Perk[];
+    /** Per-rule discount breakdown for display. */
+    appliedRules: AppliedRule[];
+}
+/**
+ * A long-lived, mutable reservation with a payment ledger. Unlike a shop order
+ * ("buy → ship → done"), a booking is edited after payment and its price is
+ * recomputed. Amounts are in minor units.
+ */
+export declare const bookingsTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
+    name: "bookings";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "id";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        number: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "number";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "status";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: BookingStatus;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: BookingStatus;
+        }>;
+        currency: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "currency";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        customer: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "customer";
+            tableName: "bookings";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        totals: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "totals";
+            tableName: "bookings";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: BookingTotals;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: BookingTotals;
+        }>;
+        pricedAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "priced_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accessToken: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "access_token";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        staffNotes: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "staff_notes";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        language: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "language";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        balanceDueAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "balance_due_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        holdExpiresAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "hold_expires_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        cancelReason: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "cancel_reason";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "deleted_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedBy: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "deleted_by";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "created_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "updated_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/db-postgres/schema/booking/bookings.js

@@ -0,0 +1,52 @@
+import { jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+/**
+ * A long-lived, mutable reservation with a payment ledger. Unlike a shop order
+ * ("buy → ship → done"), a booking is edited after payment and its price is
+ * recomputed. Amounts are in minor units.
+ */
+export const bookingsTable = pgTable('bookings', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    number: text('number').notNull().unique(),
+    status: text('status').$type().notNull().default('draft'),
+    currency: text('currency').notNull(),
+    /** Booker details (name, email, phone, "how did you hear about us", …). */
+    customer: jsonb('customer').$type().notNull().default({}),
+    /** Computed totals (gross/discount/paid/balance), refreshed on every edit. */
+    totals: jsonb('totals').$type().notNull().default({
+        gross: 0,
+        discount: 0,
+        surcharge: 0,
+        manualDiscount: 0,
+        paid: 0,
+        balance: 0,
+        perks: [],
+        appliedRules: []
+    }),
+    /**
+     * **Moment wyceny — zamrożony.** Każde przeliczenie istniejącej rezerwacji (edycja,
+     * korekta) liczy reguły zależne od czasu (early-bird) na tę datę, **nigdy na `new Date()`**.
+     *
+     * Bez tego cena bazowa była zamrożona, ale data — nie: obsługa księgowała dopłatę
+     * tydzień przed wylotem, `daysUntil(anchor, now)` spadało poniżej progu, early-bird
+     * cicho znikał i klient robił się winien pieniądze.
+     *
+     * NULL dla rezerwacji sprzed 0.37.1 ⇒ czytamy `createdAt`, czyli dokładnie to, czym
+     * było `now` w chwili ich wyceny (zero zmiany zachowania, brak migracji danych).
+     */
+    pricedAt: timestamp('priced_at', { withTimezone: true }),
+    /** Unguessable token for the self-service portal (`/rezerwacja/[token]`). */
+    accessToken: uuid('access_token').defaultRandom().notNull(),
+    staffNotes: text('staff_notes'),
+    language: text('language'),
+    /** Deadline to pay the balance; past it with balance>0 ⇒ auto-cancel + deposit forfeited. */
+    balanceDueAt: timestamp('balance_due_at', { withTimezone: true }),
+    /** TTL for an abandoned draft (deposit never paid) ⇒ auto-cancel. Cleared on deposit payment. */
+    holdExpiresAt: timestamp('hold_expires_at', { withTimezone: true }),
+    /** Why a booking was cancelled: 'abandoned' | 'balance_overdue' | 'manual'. */
+    cancelReason: text('cancel_reason'),
+    // Soft-delete (accounting/audit safety) — NULL = visible.
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+    deletedBy: text('deleted_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull()
+});

package/dist/db-postgres/schema/booking/index.d.ts

@@ -0,0 +1,7 @@
+export * from './bookings.js';
+export * from './bookingItems.js';
+export * from './bookingPersons.js';
+export * from './bookingItemPersons.js';
+export * from './bookingPayments.js';
+export * from './bookingReminders.js';
+export * from './bookingAdjustments.js';

package/dist/db-postgres/schema/booking/index.js

@@ -0,0 +1,7 @@
+export * from './bookings.js';
+export * from './bookingItems.js';
+export * from './bookingPersons.js';
+export * from './bookingItemPersons.js';
+export * from './bookingPayments.js';
+export * from './bookingReminders.js';
+export * from './bookingAdjustments.js';

package/dist/db-postgres/schema/index.d.ts

@@ -9,3 +9,4 @@ export * from './imageStyle.js';
 export * from './videoStyle.js';
 export * from './mediaJob.js';
 export * from './shop/index.js';
+export * from './booking/index.js';

package/dist/db-postgres/schema/index.js

@@ -9,3 +9,4 @@ export * from './imageStyle.js';
 export * from './videoStyle.js';
 export * from './mediaJob.js';
 export * from './shop/index.js';
+export * from './booking/index.js';

package/dist/db-postgres/schema-booking.d.ts

@@ -0,0 +1 @@
+export * from './schema/booking/index.js';

package/dist/db-postgres/schema-booking.js

@@ -0,0 +1 @@
+export * from './schema/booking/index.js';

package/dist/server/security/rate-limit-handler.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Per-handler in-memory rate limiter (fixed window). Generic infra shared by the
+ * shop and booking HTTP handlers — not shop-specific. For a single instance this
+ * needs no external store; multi-instance deployments would swap the bucket map
+ * for a shared store.
+ */
+/** A fixed-window rule: at most `limit` hits per `windowSec` seconds. */
+export interface RateLimitRule {
+    limit: number;
+    windowSec: number;
+}
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+}
+export declare function checkRateLimit(key: string, rule: RateLimitRule): RateLimitResult;
+export declare function resetRateLimit(key?: string): void;
+export declare function clientKey(req: Request, prefix: string): string;

package/dist/server/security/rate-limit-handler.js

@@ -0,0 +1,34 @@
+/**
+ * Per-handler in-memory rate limiter (fixed window). Generic infra shared by the
+ * shop and booking HTTP handlers — not shop-specific. For a single instance this
+ * needs no external store; multi-instance deployments would swap the bucket map
+ * for a shared store.
+ */
+const buckets = new Map();
+export function checkRateLimit(key, rule) {
+    const now = Date.now();
+    const windowMs = rule.windowSec * 1000;
+    const bucket = buckets.get(key);
+    if (!bucket || bucket.resetAt <= now) {
+        const fresh = { count: 1, resetAt: now + windowMs };
+        buckets.set(key, fresh);
+        return { allowed: true, remaining: rule.limit - 1, resetAt: fresh.resetAt };
+    }
+    if (bucket.count >= rule.limit) {
+        return { allowed: false, remaining: 0, resetAt: bucket.resetAt };
+    }
+    bucket.count += 1;
+    return { allowed: true, remaining: rule.limit - bucket.count, resetAt: bucket.resetAt };
+}
+export function resetRateLimit(key) {
+    if (key)
+        buckets.delete(key);
+    else
+        buckets.clear();
+}
+export function clientKey(req, prefix) {
+    const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ||
+        req.headers.get('x-real-ip') ||
+        'unknown';
+    return `${prefix}:${ip}`;
+}

package/dist/shop/adapters/payu/client.js

@@ -52,7 +52,9 @@ export class PayuClient {
         });
         // PayU returns 302 by default with a JSON body (manual redirect is used to read it).
         if (res.status !== 302 && !res.ok) {
-            throw new Error(`PayU createOrder failed: ${res.status}`);
+            // Surface PayU's error body (e.g. ERROR_ORDER_NOT_UNIQUE) — don't swallow it.
+            const detail = await res.text().catch(() => '');
+            throw new Error(`PayU createOrder failed: ${res.status}${detail ? ` — ${detail}` : ''}`);
         }
         const data = (await res.json());
         if (data.status && data.status.statusCode && data.status.statusCode !== 'SUCCESS') {

package/dist/shop/adapters/payu/index.js

@@ -19,31 +19,51 @@ export function payuAdapter(opts) {
         id,
         label: opts.label ?? DEFAULT_LABEL,
         async createPayment(order, ctx) {
-            const shop = requireShopConfig();
-            const continueTemplate = opts.continueUrl ?? shop.orderViewUrl;
-            if (!/^https?:\/\//i.test(continueTemplate)) {
-                throw new Error('payuAdapter: continueUrl (or shop.orderViewUrl) must be an absolute URL.');
+            let continueUrl;
+            const buyer = {};
+            if (ctx?.continueUrl) {
+                // Non-shop caller (e.g. booking) supplied everything — skip shop hydration.
+                if (!/^https?:\/\//i.test(ctx.continueUrl)) {
+                    throw new Error('payuAdapter: ctx.continueUrl must be an absolute URL.');
+                }
+                continueUrl = ctx.continueUrl;
+                buyer.firstName = ctx.buyer?.firstName;
+                buyer.lastName = ctx.buyer?.lastName;
+                buyer.phone = ctx.buyer?.phone;
+                buyer.language = ctx.language ?? undefined;
+            }
+            else {
+                // Shop path: hydrate buyer + continueUrl from the stored shop order.
+                const shop = requireShopConfig();
+                const continueTemplate = opts.continueUrl ?? shop.orderViewUrl;
+                if (!/^https?:\/\//i.test(continueTemplate)) {
+                    throw new Error('payuAdapter: continueUrl (or shop.orderViewUrl) must be an absolute URL.');
+                }
+                const full = await getOrderById(order.id);
+                const names = splitFullName(full?.customerName);
+                continueUrl = buildOrderViewUrl(continueTemplate, {
+                    orderNumber: order.number,
+                    orderId: order.id,
+                    accessToken: full?.accessToken ?? '',
+                    language: ctx?.language ?? full?.language ?? null
+                });
+                buyer.firstName = names.firstName;
+                buyer.lastName = names.lastName;
+                buyer.phone = full?.customerPhone ?? undefined;
+                buyer.language = ctx?.language ?? full?.language ?? undefined;
             }
-            // Hydrate buyer details from stored order (customerName/phone not on OrderRef)
-            const full = await getOrderById(order.id);
-            const names = splitFullName(full?.customerName);
-            const continueUrl = buildOrderViewUrl(continueTemplate, {
-                orderNumber: order.number,
-                orderId: order.id,
-                accessToken: full?.accessToken ?? '',
-                language: ctx?.language ?? full?.language ?? null
-            });
             const payload = buildPayuOrderPayload({
                 order,
                 posId: opts.posId,
                 notifyUrl: opts.notifyUrl,
                 continueUrl,
                 customerIp: ctx?.customerIp ?? '127.0.0.1',
+                externalId: ctx?.externalId,
                 buyer: {
-                    firstName: names.firstName,
-                    lastName: names.lastName,
-                    phone: full?.customerPhone ?? undefined,
-                    language: ctx?.language ?? full?.language ?? undefined
+                    firstName: buyer.firstName,
+                    lastName: buyer.lastName,
+                    phone: buyer.phone,
+                    language: buyer.language
                 }
             });
             const { redirectUri, orderId } = await client.createOrder(payload);

package/dist/shop/adapters/payu/payload.d.ts

@@ -32,6 +32,12 @@ export interface BuildPayuPayloadInput {
     buyer?: Omit<PayuBuyer, 'email'> & {
         email?: string;
     };
+    /**
+     * Unique `extOrderId` for this attempt. PayU requires it unique per POS, so a
+     * single order/booking paying twice (deposit + balance) must vary it. Falls
+     * back to `order.number` when omitted.
+     */
+    externalId?: string;
 }
 /**
  * Split a single "Imię Nazwisko" string into first/last name heuristically.

package/dist/shop/adapters/payu/payload.js

@@ -35,7 +35,7 @@ export function buildPayuOrderPayload(input) {
         description: input.description ?? `Order ${order.number}`,
         currencyCode: order.currency,
         totalAmount: String(order.totalGross),
-        extOrderId: order.number,
+        extOrderId: input.externalId ?? order.number,
         buyer,
         products: [
             {

package/dist/shop/adapters/stripe/index.js

@@ -63,29 +63,44 @@ export function stripeAdapter(opts) {
         id,
         label: opts.label ?? DEFAULT_LABEL,
         async createPayment(order, ctx) {
-            const shop = requireShopConfig();
-            const successTemplate = opts.successUrl ?? shop.orderViewUrl;
-            const cancelTemplate = opts.cancelUrl ?? successTemplate;
-            if (!/^https?:\/\//i.test(successTemplate)) {
-                throw new Error('stripeAdapter: successUrl (or shop.orderViewUrl) must be an absolute URL.');
+            let successUrl;
+            let cancelUrl;
+            let language;
+            if (ctx?.continueUrl) {
+                // Non-shop caller (e.g. booking) supplied a fully-resolved return URL —
+                // use it verbatim and skip any shop-order hydration (mirrors payuAdapter).
+                if (!/^https?:\/\//i.test(ctx.continueUrl)) {
+                    throw new Error('stripeAdapter: ctx.continueUrl must be an absolute URL.');
+                }
+                successUrl = ctx.continueUrl;
+                cancelUrl = ctx.continueUrl;
+                language = ctx.language ?? null;
             }
-            if (!/^https?:\/\//i.test(cancelTemplate)) {
-                throw new Error('stripeAdapter: cancelUrl must be an absolute URL.');
+            else {
+                const shop = requireShopConfig();
+                const successTemplate = opts.successUrl ?? shop.orderViewUrl;
+                const cancelTemplate = opts.cancelUrl ?? successTemplate;
+                if (!/^https?:\/\//i.test(successTemplate)) {
+                    throw new Error('stripeAdapter: successUrl (or shop.orderViewUrl) must be an absolute URL.');
+                }
+                if (!/^https?:\/\//i.test(cancelTemplate)) {
+                    throw new Error('stripeAdapter: cancelUrl must be an absolute URL.');
+                }
+                const full = await getOrderById(order.id);
+                language = ctx?.language ?? full?.language ?? null;
+                successUrl = buildOrderViewUrl(successTemplate, {
+                    orderNumber: order.number,
+                    orderId: order.id,
+                    accessToken: full?.accessToken ?? '',
+                    language
+                });
+                cancelUrl = buildOrderViewUrl(cancelTemplate, {
+                    orderNumber: order.number,
+                    orderId: order.id,
+                    accessToken: full?.accessToken ?? '',
+                    language
+                });
             }
-            const full = await getOrderById(order.id);
-            const language = ctx?.language ?? full?.language ?? null;
-            const successUrl = buildOrderViewUrl(successTemplate, {
-                orderNumber: order.number,
-                orderId: order.id,
-                accessToken: full?.accessToken ?? '',
-                language
-            });
-            const cancelUrl = buildOrderViewUrl(cancelTemplate, {
-                orderNumber: order.number,
-                orderId: order.id,
-                accessToken: full?.accessToken ?? '',
-                language
-            });
             const productNameTpl = pickI18n(opts.productName ?? DEFAULT_PRODUCT_NAME, language);
             const productName = productNameTpl.replace('{number}', order.number);
             const payload = buildStripeCheckoutPayload({

package/dist/shop/index.d.ts

@@ -1,5 +1,14 @@
-import type { ShopConfig, ResolvedShopConfig } from './types.js';
-export declare function defineShop(config: ShopConfig): ResolvedShopConfig;
+import type { ShopConfig } from './types.js';
+import type { CMSModule } from '../types/modules.js';
+/**
+ * Defines the shop module. Returns a {@link CMSModule} for
+ * `defineConfig({ modules: [defineShop({...})] })`. The resolved shop config
+ * is carried on `module.config` and reachable via `getCMS().getModuleConfig('shop')`
+ * (or the back-compat `getCMS().shopConfig`).
+ *
+ * @public
+ */
+export declare function defineShop(config: ShopConfig): CMSModule;
 export { InvalidVariantAttributesError } from './variant-attributes.js';
 export { isVariantExpired, filterUpcoming, VariantExpiredError } from './expiry.js';
 export { manualAdapter } from './adapters/manual/index.js';