diff --git a/.env.example b/.env.example
index 98c96d0..b660d27 100644
--- a/.env.example
+++ b/.env.example
@@ -6,14 +6,17 @@
 # Database (Neon, Supabase, or any Postgres)
 DATABASE_URL="postgresql://USER:PASSWORD@HOST:PORT/DB?pgbouncer=true&connection_limit=1"
 
-# App
+# App (localhost here; use the deployed HTTPS origin in hosting configuration)
 APP_URL="http://localhost:3000"
+NEXT_PUBLIC_SITE_URL="http://localhost:3000"
 
 # NextAuth (either AUTH_SECRET or NEXTAUTH_SECRET)
 NEXTAUTH_SECRET="your-nextauth-secret-here"
 NEXTAUTH_URL="http://localhost:3000"
 
-# --- Payments: Paystack (SANDBOX/TEST keys only; never live charges in dev) ---
+# --- Payments: disabled by default; enable only with valid Paystack test/live configuration ---
+PAYMENTS_ENABLED="false"
+# SANDBOX/TEST keys only in local development; never put live keys in .env.
 PAYSTACK_SECRET_KEY="sk_test_xxx"
 PAYSTACK_PUBLIC_KEY="pk_test_xxx"
 
@@ -56,18 +59,29 @@ TWILIO_FROM=""
 COMMERCE_CURRENCY="NGN"
 COMMERCE_FREE_SHIPPING_THRESHOLD_NGN="500000"
 COMMERCE_FLAT_SHIPPING_NGN="2500"
+COMMERCE_EXPRESS_SHIPPING_NGN="35000"
+COMMERCE_GIFT_WRAP_NGN="2500"
+
+# Manual bank transfer is hidden unless explicitly enabled with owner-approved details.
+BANK_TRANSFER_ENABLED="false"
+BANK_TRANSFER_ACCOUNT_NAME=""
+BANK_TRANSFER_BANK_NAME=""
+BANK_TRANSFER_ACCOUNT_NUMBER=""
 
 # --- Feature flags (comma-separated). Prefix with ! to force-disable a default-on flag. ---
 # Available: shopify_commerce, ai_concierge, concierge_v2, loyalty_rewards, referral_rewards,
 #            sample_credits, whatsapp_marketing, agentic_feed
 FEATURE_FLAGS=""
 
-# --- Durable rate limiting / cache (optional; Upstash Redis REST — serverless-friendly) ---
-# When set, rate limiting is durable across serverless instances. When absent, an in-memory
-# per-instance limiter is used (documented limitation in docs/SECURITY_REVIEW.md).
+# --- Durable rate limiting / cache (optional locally; required for production readiness) ---
+# Without these values, local development falls back to an in-memory per-instance limiter.
 UPSTASH_REDIS_REST_URL=""
 UPSTASH_REDIS_REST_TOKEN=""
 
+# Authenticates scheduler calls to internal background-job endpoints (required in production).
+# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
+CRON_SECRET=""
+
 # --- Concierge V2 limits and cost controls ---
 CONCIERGE_GUEST_QUESTIONS="1"
 CONCIERGE_AUTH_PER_MINUTE="12"
diff --git a/.github/workflows/production-readiness.yml b/.github/workflows/production-readiness.yml
new file mode 100644
index 0000000..65abb15
--- /dev/null
+++ b/.github/workflows/production-readiness.yml
@@ -0,0 +1,92 @@
+name: Production readiness
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: production-readiness-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Validate application and database
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: ninthluxe_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d ninthluxe_ci"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      CI: true
+      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/ninthluxe_ci
+      APP_URL: http://127.0.0.1:3000
+      NEXT_PUBLIC_SITE_URL: http://127.0.0.1:3000
+      NEXTAUTH_URL: http://127.0.0.1:3000
+      AUTH_SECRET: ci-only-auth-secret-at-least-32-characters
+      PAYSTACK_SECRET_KEY: sk_test_ci_placeholder
+      PAYSTACK_PUBLIC_KEY: pk_test_ci_placeholder
+      RESEND_API_KEY: re_ci_placeholder
+      NEWSLETTER_FROM_EMAIL: CI <ci@example.test>
+      CRON_SECRET: ci-only-cron-secret-at-least-32-characters
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Validate Prisma schema
+        run: npx prisma validate
+
+      - name: Apply migrations to temporary PostgreSQL
+        run: npx prisma migrate deploy
+
+      - name: Verify migration status
+        run: npx prisma migrate status
+
+      - name: Validate seed
+        run: npm run seed
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Run unit and database integration tests
+        run: npm test
+
+      - name: Build production application
+        env:
+          UPSTASH_REDIS_REST_URL: https://redis.invalid
+          UPSTASH_REDIS_REST_TOKEN: ci-placeholder
+        run: npm run build
diff --git a/app/account/orders/[id]/page.tsx b/app/account/orders/[id]/page.tsx
index bee8cad..37063f2 100644
--- a/app/account/orders/[id]/page.tsx
+++ b/app/account/orders/[id]/page.tsx
@@ -51,6 +51,15 @@ const statusColors: Record<string, string> = {
   PAID: "bg-info/15 text-info",
   SHIPPED: "bg-accent/15 text-accent",
   DELIVERED: "bg-success/15 text-success",
+  CANCELLED: "bg-destructive/15 text-destructive",
+  REFUND_PENDING: "bg-warning/15 text-warning",
+  REFUNDED: "bg-muted text-muted-foreground",
+};
+
+const exceptionalStatusDescriptions: Record<string, string> = {
+  CANCELLED: "This order was cancelled and reserved stock was released.",
+  REFUND_PENDING: "Your refund is being processed by the payment provider.",
+  REFUNDED: "The payment provider has confirmed this order's refund.",
 };
 
 function getProductImage(images: unknown): string {
@@ -178,7 +187,8 @@ export default async function OrderDetailPage({
             </ol>
           </div>
           <p className="text-sm text-muted-foreground text-center mt-6">
-            {STATUS_META[order.status as OrderStatus]?.description}
+            {STATUS_META[order.status as OrderStatus]?.description ||
+              exceptionalStatusDescriptions[order.status]}
           </p>
           <p className="text-xs text-center text-muted-foreground mt-1">
             Placed on{" "}
diff --git a/app/account/orders/page.tsx b/app/account/orders/page.tsx
index 3f3e206..7cef096 100644
--- a/app/account/orders/page.tsx
+++ b/app/account/orders/page.tsx
@@ -25,26 +25,44 @@ const statusColors: Record<string, string> = {
 
 export const dynamic = "force-dynamic";
 
-export default async function OrdersPage() {
+export default async function OrdersPage({
+  searchParams,
+}: {
+  searchParams?: Promise<{ page?: string }>;
+}) {
   // Require authentication - will redirect if not signed in
 
   const user = await requireUser();
+  const params = await searchParams;
+  const requestedPage = Number.parseInt(params?.page ?? "1", 10);
+  const page = Number.isFinite(requestedPage) && requestedPage > 0
+    ? requestedPage
+    : 1;
+  const pageSize = 10;
 
   // Fetch orders from database for the current user
 
-  const orders = await prisma.order.findMany({
-    where: { userId: user.id },
+  const [orders, totalOrders] = await Promise.all([
+    prisma.order.findMany({
+      where: { userId: user.id },
+      skip: (page - 1) * pageSize,
+      take: pageSize,
 
     include: {
       items: {
         include: {
-          product: true,
+          product: {
+            select: { id: true, name: true, images: true },
+          },
         },
       },
     },
 
-    orderBy: { createdAt: "desc" },
-  });
+      orderBy: { createdAt: "desc" },
+    }),
+    prisma.order.count({ where: { userId: user.id } }),
+  ]);
+  const totalPages = Math.max(1, Math.ceil(totalOrders / pageSize));
 
   // Helper to get first product image
   const getProductImage = (product: any): string => {
@@ -172,6 +190,25 @@ export default async function OrdersPage() {
           </CardContent>
         </Card>
       ))}
+      {totalPages > 1 && (
+        <div className="flex items-center justify-between pt-2">
+          <p className="text-sm text-muted-foreground">
+            Page {Math.min(page, totalPages)} of {totalPages}
+          </p>
+          <div className="flex gap-2">
+            {page > 1 && (
+              <Button asChild variant="outline" size="sm">
+                <Link href={`/account/orders?page=${page - 1}`}>Previous</Link>
+              </Button>
+            )}
+            {page < totalPages && (
+              <Button asChild variant="outline" size="sm">
+                <Link href={`/account/orders?page=${page + 1}`}>Next</Link>
+              </Button>
+            )}
+          </div>
+        </div>
+      )}
     </div>
   );
 }
diff --git a/app/admin/orders/[id]/page.tsx b/app/admin/orders/[id]/page.tsx
index 70c75ed..5f18b31 100644
--- a/app/admin/orders/[id]/page.tsx
+++ b/app/admin/orders/[id]/page.tsx
@@ -4,6 +4,7 @@ import { OrderStatus } from "@prisma/client";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
 import {
   Select,
   SelectContent,
@@ -23,6 +24,8 @@ import {
   getAdminOrderById,
   updateOrderStatus,
 } from "@/lib/services/order-service";
+import { requireAdmin } from "@/lib/admin";
+import { allowedAdminOrderTransitions } from "@/lib/orders/state-machine";
 
 export const dynamic = "force-dynamic";
 
@@ -35,6 +38,9 @@ const statusOptions: { label: string; value: OrderStatus }[] = [
   { label: "Paid", value: "PAID" },
   { label: "Shipped", value: "SHIPPED" },
   { label: "Delivered", value: "DELIVERED" },
+  { label: "Cancelled", value: "CANCELLED" },
+  { label: "Refund pending", value: "REFUND_PENDING" },
+  { label: "Refunded", value: "REFUNDED" },
 ];
 
 const statusClasses: Record<OrderStatus, string> = {
@@ -45,6 +51,12 @@ const statusClasses: Record<OrderStatus, string> = {
     "bg-purple-100 text-purple-800 dark:bg-purple-900 dark:text-purple-200",
   DELIVERED:
     "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200",
+  CANCELLED:
+    "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
+  REFUND_PENDING:
+    "bg-orange-100 text-orange-800 dark:bg-orange-900 dark:text-orange-200",
+  REFUNDED:
+    "bg-slate-100 text-slate-800 dark:bg-slate-800 dark:text-slate-200",
 };
 
 export default async function OrderDetailPage({
@@ -67,13 +79,31 @@ export default async function OrderDetailPage({
   async function updateStatusAction(formData: FormData) {
     "use server";
 
+    const admin = await requireAdmin();
     const { id: orderId } = await params;
-    const status = formData.get("status") as OrderStatus;
-    await updateOrderStatus(orderId, status);
+    const rawStatus = formData.get("status");
+    const reason = String(formData.get("reason") || "");
+    if (
+      typeof rawStatus !== "string" ||
+      !Object.values(OrderStatus).includes(rawStatus as OrderStatus)
+    ) {
+      throw new Error("Invalid order status");
+    }
+    await updateOrderStatus({
+      orderId,
+      status: rawStatus as OrderStatus,
+      actorId: admin.id,
+      reason,
+    });
 
     redirect(`/admin/orders/${orderId}`);
   }
 
+  const allowedTransitions = allowedAdminOrderTransitions(order.status);
+  const transitionOptions = statusOptions.filter((option) =>
+    allowedTransitions.includes(option.value),
+  );
+
   const itemsTotal = order.items.reduce(
     (total, item) => total + item.quantity,
     0,
@@ -95,9 +125,10 @@ export default async function OrderDetailPage({
             })}
           </p>
         </div>
+        {transitionOptions.length > 0 && (
         <form action={updateStatusAction} className="flex items-center gap-3">
           <span className="text-sm text-muted-foreground">Status</span>
-          <Select name="status" defaultValue={order.status}>
+          <Select name="status" defaultValue={transitionOptions[0]?.value}>
             <SelectTrigger
               className="h-9 w-[180px] text-xs"
               aria-label="Order status"
@@ -105,17 +136,26 @@ export default async function OrderDetailPage({
               <SelectValue />
             </SelectTrigger>
             <SelectContent>
-              {statusOptions.map((option) => (
+              {transitionOptions.map((option) => (
                 <SelectItem key={option.value} value={option.value}>
                   {option.label}
                 </SelectItem>
               ))}
             </SelectContent>
           </Select>
+          <Input
+            name="reason"
+            required
+            minLength={3}
+            maxLength={500}
+            placeholder="Reason or fulfilment note"
+            className="h-9 w-64"
+          />
           <Button type="submit" size="sm">
             Update
           </Button>
         </form>
+        )}
       </div>
 
       <div className="grid gap-6 lg:grid-cols-[2fr_1fr]">
@@ -202,22 +242,6 @@ export default async function OrderDetailPage({
                   <span className="font-mono">{order.coupon.code}</span>
                 </div>
               )}
-              {order.paymentMethod === "BANK_TRANSFER" &&
-                order.status === "PENDING" && (
-                  <form
-                    action={updateStatusAction}
-                    className="pt-3 border-t border-border mt-2"
-                  >
-                    <input type="hidden" name="status" value="PAID" />
-                    <Button
-                      type="submit"
-                      size="sm"
-                      className="w-full bg-success text-success-foreground hover:bg-success/90"
-                    >
-                      ✓ Mark as Paid (Bank Transfer Received)
-                    </Button>
-                  </form>
-                )}
             </CardContent>
           </Card>
 
diff --git a/app/admin/orders/page.tsx b/app/admin/orders/page.tsx
index 1ad8cab..63d8d74 100644
--- a/app/admin/orders/page.tsx
+++ b/app/admin/orders/page.tsx
@@ -20,7 +20,10 @@ import {
   TableHeader,
   TableRow,
 } from "@/components/ui/table";
-import { getAdminOrders } from "@/lib/services/order-service";
+import {
+  countAdminOrders,
+  getAdminOrders,
+} from "@/lib/services/order-service";
 import type { OrderStatus } from "@prisma/client";
 
 export const dynamic = "force-dynamic";
@@ -29,6 +32,7 @@ interface AdminOrdersPageProps {
   searchParams?: Promise<{
     q?: string;
     status?: string;
+    page?: string;
   }>;
 }
 
@@ -38,6 +42,9 @@ const statusOptions: { label: string; value: "all" | OrderStatus }[] = [
   { label: "Paid", value: "PAID" },
   { label: "Shipped", value: "SHIPPED" },
   { label: "Delivered", value: "DELIVERED" },
+  { label: "Cancelled", value: "CANCELLED" },
+  { label: "Refund pending", value: "REFUND_PENDING" },
+  { label: "Refunded", value: "REFUNDED" },
 ];
 
 const statusClasses: Record<OrderStatus, string> = {
@@ -45,6 +52,9 @@ const statusClasses: Record<OrderStatus, string> = {
   PAID: "bg-info/15 text-info",
   SHIPPED: "bg-accent/15 text-accent",
   DELIVERED: "bg-success/15 text-success",
+  CANCELLED: "bg-destructive/15 text-destructive",
+  REFUND_PENDING: "bg-warning/15 text-warning",
+  REFUNDED: "bg-muted text-muted-foreground",
 };
 
 export default async function AdminOrdersPage({
@@ -53,15 +63,29 @@ export default async function AdminOrdersPage({
   const params = await searchParams;
   const q = params?.q?.toString() ?? "";
   const statusParam = params?.status?.toString() ?? "all";
+  const requestedPage = Number.parseInt(params?.page ?? "1", 10);
+  const page = Number.isFinite(requestedPage) && requestedPage > 0
+    ? requestedPage
+    : 1;
+  const pageSize = 25;
 
   const selectedStatus =
     statusOptions.find((option) => option.value === statusParam)?.value ??
     "all";
 
-  const orders = await getAdminOrders({
-    search: q || undefined,
-    status: selectedStatus,
-  });
+  const query = { search: q || undefined, status: selectedStatus };
+  const [orders, total] = await Promise.all([
+    getAdminOrders({ ...query, page, pageSize }),
+    countAdminOrders(query),
+  ]);
+  const totalPages = Math.max(1, Math.ceil(total / pageSize));
+  const pageHref = (nextPage: number) => {
+    const search = new URLSearchParams();
+    if (q) search.set("q", q);
+    if (selectedStatus !== "all") search.set("status", selectedStatus);
+    search.set("page", String(nextPage));
+    return `/admin/orders?${search.toString()}`;
+  };
 
   const formatPrice = (amount: number) =>
     new Intl.NumberFormat("en-NG", {
@@ -204,6 +228,25 @@ export default async function AdminOrdersPage({
               </TableBody>
             </Table>
           </div>
+          {totalPages > 1 && (
+            <div className="mt-4 flex items-center justify-between">
+              <p className="text-sm text-muted-foreground">
+                Page {Math.min(page, totalPages)} of {totalPages}
+              </p>
+              <div className="flex gap-2">
+                {page > 1 && (
+                  <Button asChild variant="outline" size="sm">
+                    <Link href={pageHref(page - 1)}>Previous</Link>
+                  </Button>
+                )}
+                {page < totalPages && (
+                  <Button asChild variant="outline" size="sm">
+                    <Link href={pageHref(page + 1)}>Next</Link>
+                  </Button>
+                )}
+              </div>
+            </div>
+          )}
         </CardContent>
       </Card>
     </div>
diff --git a/app/admin/products/[id]/edit/page.tsx b/app/admin/products/[id]/edit/page.tsx
index d82c36b..9274d64 100644
--- a/app/admin/products/[id]/edit/page.tsx
+++ b/app/admin/products/[id]/edit/page.tsx
@@ -13,6 +13,7 @@ import {
   ensureScentTemplateColumn,
   isTemplateId,
 } from '@/lib/fragrance/template-store'
+import { invalidateCatalogueCache } from '@/lib/cache/catalogue'
 
 /** Empty / sentinel string -> null, for optional text columns. */
 function nn(v: FormDataEntryValue | null): string | null {
@@ -102,6 +103,7 @@ export default async function EditProductPage({ params }: { params: Promise<{ id
         ...(publishStatus ? { publishStatus } : {}),
       },
     })
+    invalidateCatalogueCache()
 
     // Persist the chosen visual template (resilient: additive column, applied on demand). Empty
     // value clears the override so the storefront uses the recommended template.
diff --git a/app/admin/users/page.tsx b/app/admin/users/page.tsx
index 39102ca..50f6675 100644
--- a/app/admin/users/page.tsx
+++ b/app/admin/users/page.tsx
@@ -1,6 +1,8 @@
 import { prisma } from '@/lib/prisma'
 import { requireAdmin } from '@/lib/admin'
 import { User, Mail, Calendar } from 'lucide-react'
+import Link from 'next/link'
+import { Button } from '@/components/ui/button'
 import { UserRoleSelect } from '@/components/admin/user-role-select'
 
 export const dynamic = 'force-dynamic'
@@ -10,27 +12,41 @@ function effectiveRole(role: string, adminRole: string | null): string {
   return adminRole ?? 'SUPER_ADMIN'
 }
 
-export default async function AdminUsersPage() {
+export default async function AdminUsersPage({
+  searchParams,
+}: {
+  searchParams?: Promise<{ page?: string }>
+}) {
   const me = await requireAdmin()
 
-  const users = await prisma.user.findMany({
-    orderBy: { createdAt: 'desc' },
-    select: {
-      id: true,
-      name: true,
-      email: true,
-      role: true,
-      adminRole: true,
-      createdAt: true,
-      _count: {
-        select: {
-          orders: true,
+  const params = await searchParams
+  const requestedPage = Number.parseInt(params?.page ?? '1', 10)
+  const page = Number.isFinite(requestedPage) && requestedPage > 0
+    ? requestedPage
+    : 1
+  const pageSize = 50
+  const [users, totalUsers] = await Promise.all([
+    prisma.user.findMany({
+      orderBy: { createdAt: 'desc' },
+      skip: (page - 1) * pageSize,
+      take: pageSize,
+      select: {
+        id: true,
+        name: true,
+        email: true,
+        role: true,
+        adminRole: true,
+        createdAt: true,
+        _count: {
+          select: {
+            orders: true,
+          },
         },
       },
-    },
-  })
-
-  const totalUsers = await prisma.user.count()
+    }),
+    prisma.user.count(),
+  ])
+  const totalPages = Math.max(1, Math.ceil(totalUsers / pageSize))
 
   return (
     <div className="space-y-6">
@@ -102,10 +118,27 @@ export default async function AdminUsersPage() {
               </tbody>
             </table>
           </div>
+          {totalPages > 1 && (
+            <div className="mt-5 flex items-center justify-between border-t border-border pt-4">
+              <p className="text-sm text-muted-foreground">
+                Page {Math.min(page, totalPages)} of {totalPages}
+              </p>
+              <div className="flex gap-2">
+                {page > 1 && (
+                  <Button asChild variant="outline" size="sm">
+                    <Link href={`/admin/users?page=${page - 1}`}>Previous</Link>
+                  </Button>
+                )}
+                {page < totalPages && (
+                  <Button asChild variant="outline" size="sm">
+                    <Link href={`/admin/users?page=${page + 1}`}>Next</Link>
+                  </Button>
+                )}
+              </div>
+            </div>
+          )}
         </div>
       )}
     </div>
   )
 }
-
-
diff --git a/app/api/account/addresses/[id]/route.ts b/app/api/account/addresses/[id]/route.ts
index 4551987..7a06355 100644
--- a/app/api/account/addresses/[id]/route.ts
+++ b/app/api/account/addresses/[id]/route.ts
@@ -3,6 +3,8 @@ import { auth } from "@/lib/auth"
 import { prisma } from "@/lib/prisma"
 import { z } from "zod"
 import { NIGERIAN_STATES } from "@/lib/constants/nigerian-states"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 
 const addressSchema = z.object({
   name: z.string().min(1, "Full name is required").max(200),
@@ -33,7 +35,6 @@ export async function GET(
     if (!user) {
       return NextResponse.json({ error: "User not found" }, { status: 401 })
     }
-
     const { id } = await params
     const address = await prisma.address.findFirst({
       where: { id, userId: user.id },
@@ -67,6 +68,9 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
     if (!email) {
@@ -80,6 +84,14 @@ export async function PATCH(
     if (!user) {
       return NextResponse.json({ error: "User not found" }, { status: 401 })
     }
+    const limit = await consumeRateLimit(
+      `account:address:${user.id}`,
+      30,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json({ error: "Too many address changes" }, { status: 429 })
+    }
 
     const { id } = await params
     const existing = await prisma.address.findFirst({
@@ -99,24 +111,28 @@ export async function PATCH(
     const { name, line1, address: addressLine, city, state, postalCode, phone, isDefault } = parsed.data
     const line1Value = line1 ?? addressLine
 
-    if (isDefault === true) {
-      await prisma.address.updateMany({
-        where: { userId: user.id },
-        data: { isDefault: false },
+    const address = await prisma.$transaction(async (tx) => {
+      if (isDefault === true) {
+        await tx.address.updateMany({
+          where: { userId: user.id },
+          data: { isDefault: false },
+        })
+      }
+      return tx.address.update({
+        where: { id },
+        data: {
+          ...(name !== undefined && { name: name || null }),
+          ...(line1Value !== undefined &&
+            line1Value !== "" && { line1: line1Value }),
+          ...(city !== undefined && { city }),
+          ...(state !== undefined && { state }),
+          ...(postalCode !== undefined && {
+            postalCode: postalCode || null,
+          }),
+          ...(phone !== undefined && { phone }),
+          ...(isDefault !== undefined && { isDefault }),
+        },
       })
-    }
-
-    const address = await prisma.address.update({
-      where: { id },
-      data: {
-        ...(name !== undefined && { name: name || null }),
-        ...(line1Value !== undefined && line1Value !== "" && { line1: line1Value }),
-        ...(city !== undefined && { city }),
-        ...(state !== undefined && { state }),
-        ...(postalCode !== undefined && { postalCode: postalCode || null }),
-        ...(phone !== undefined && { phone }),
-        ...(isDefault !== undefined && { isDefault }),
-      } as Parameters<typeof prisma.address.update>[0]["data"],
     })
 
     const a = address as typeof address & { name?: string | null; postalCode?: string | null }
@@ -140,10 +156,13 @@ export async function PATCH(
 }
 
 export async function DELETE(
-  _req: NextRequest,
+  req: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
     if (!email) {
@@ -157,6 +176,14 @@ export async function DELETE(
     if (!user) {
       return NextResponse.json({ error: "User not found" }, { status: 401 })
     }
+    const limit = await consumeRateLimit(
+      `account:address:${user.id}`,
+      30,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json({ error: "Too many address changes" }, { status: 429 })
+    }
 
     const { id } = await params
     const existing = await prisma.address.findFirst({
diff --git a/app/api/account/addresses/route.ts b/app/api/account/addresses/route.ts
index 6094143..be44500 100644
--- a/app/api/account/addresses/route.ts
+++ b/app/api/account/addresses/route.ts
@@ -3,6 +3,8 @@ import { auth } from "@/lib/auth"
 import { prisma } from "@/lib/prisma"
 import { z } from "zod"
 import { NIGERIAN_STATES } from "@/lib/constants/nigerian-states"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 
 const addressSchema = z.object({
   name: z.string().min(1, "Full name is required").max(200),
@@ -58,6 +60,9 @@ export async function GET() {
 
 export async function POST(req: NextRequest) {
   try {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
     if (!email) {
@@ -71,6 +76,17 @@ export async function POST(req: NextRequest) {
     if (!user) {
       return NextResponse.json({ error: "User not found" }, { status: 404 })
     }
+    const limit = await consumeRateLimit(
+      `account:address:${user.id}`,
+      30,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many address changes. Please try again later." },
+        { status: 429 },
+      )
+    }
 
     const body = await req.json()
     const parsed = addressSchema.safeParse(body)
@@ -82,24 +98,25 @@ export async function POST(req: NextRequest) {
     const { name, line1, address: addressLine, city, state, postalCode, phone, isDefault } = parsed.data
     const line1Value = line1 ?? addressLine ?? ""
 
-    if (isDefault) {
-      await prisma.address.updateMany({
-        where: { userId: user.id },
-        data: { isDefault: false },
+    const address = await prisma.$transaction(async (tx) => {
+      if (isDefault) {
+        await tx.address.updateMany({
+          where: { userId: user.id },
+          data: { isDefault: false },
+        })
+      }
+      return tx.address.create({
+        data: {
+          userId: user.id,
+          name: name || null,
+          line1: line1Value,
+          city,
+          state,
+          postalCode: postalCode || null,
+          phone,
+          isDefault: isDefault ?? false,
+        },
       })
-    }
-
-    const address = await prisma.address.create({
-      data: {
-        userId: user.id,
-        name: name || null,
-        line1: line1Value,
-        city,
-        state,
-        postalCode: postalCode || null,
-        phone,
-        isDefault: isDefault ?? false,
-      } as Parameters<typeof prisma.address.create>[0]["data"],
     })
 
     const a = address as typeof address & { name?: string | null; postalCode?: string | null }
diff --git a/app/api/admin/categories/route.ts b/app/api/admin/categories/route.ts
index 34a1625..80ad4d9 100644
--- a/app/api/admin/categories/route.ts
+++ b/app/api/admin/categories/route.ts
@@ -15,17 +15,20 @@ export async function GET() {
       orderBy: { name: "asc" },
     })
 
-    const results = await Promise.all(
-      categories.map(async (category) => {
-        let productCount = 0
-        if (category.enumKey) {
-          productCount = await prisma.product.count({
-            where: { category: category.enumKey },
-          })
-        }
-        return { ...category, productCount }
-      })
+    const counts = await prisma.product.groupBy({
+      by: ["category"],
+      where: { deletedAt: null },
+      _count: { _all: true },
+    })
+    const countByCategory = new Map(
+      counts.map((row) => [row.category, row._count._all]),
     )
+    const results = categories.map((category) => ({
+      ...category,
+      productCount: category.enumKey
+        ? (countByCategory.get(category.enumKey) ?? 0)
+        : 0,
+    }))
 
     return NextResponse.json({ categories: results })
   } catch (error) {
@@ -64,4 +67,3 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: "Failed to create category" }, { status: 500 })
   }
 }
-
diff --git a/app/api/admin/orders/[id]/refund/route.ts b/app/api/admin/orders/[id]/refund/route.ts
new file mode 100644
index 0000000..3f440f6
--- /dev/null
+++ b/app/api/admin/orders/[id]/refund/route.ts
@@ -0,0 +1,100 @@
+import { NextRequest, NextResponse } from "next/server"
+import { z } from "zod"
+
+import { getPayments } from "@/integrations/registry"
+import { isPaymentCollectionEnabled } from "@/integrations/payments/policy"
+import { getAdminUser } from "@/lib/admin"
+import { isValidIdempotencyKey } from "@/lib/checkout/idempotency"
+import { AppError } from "@/lib/http/errors"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { requestFullRefund } from "@/lib/refunds/service"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+import { env } from "@/lib/env"
+
+const bodySchema = z.object({
+  reason: z.string().trim().min(3).max(500),
+}).strict()
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json(
+        { error: "Request origin could not be verified" },
+        { status: 403 },
+      )
+    }
+    if (!isPaymentCollectionEnabled(env.PAYMENTS_ENABLED, env.PAYSTACK_SECRET_KEY)) {
+      return NextResponse.json(
+        { error: "Online payments are temporarily unavailable" },
+        { status: 503 },
+      )
+    }
+    const admin = await getAdminUser()
+    if (!admin) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    }
+    const limit = await consumeRateLimit(
+      `admin-refund:user:${admin.id}`,
+      5,
+      60 * 60 * 1000,
+      false,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many refund requests. Try again later." },
+        { status: 429 },
+      )
+    }
+
+    const idempotencyKey = request.headers.get("idempotency-key")
+    if (!isValidIdempotencyKey(idempotencyKey)) {
+      return NextResponse.json(
+        { error: "A valid Idempotency-Key header is required" },
+        { status: 400 },
+      )
+    }
+    const parsed = bodySchema.safeParse(await request.json())
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "A refund reason is required" },
+        { status: 400 },
+      )
+    }
+
+    const { id: orderId } = await params
+    const refund = await requestFullRefund({
+      orderId,
+      idempotencyKey,
+      reason: parsed.data.reason,
+      actorId: admin.id,
+      provider: getPayments(),
+    })
+    return NextResponse.json({
+      ok: true,
+      refund: {
+        id: refund.id,
+        status: refund.status,
+        amountNGN: refund.amountNGN,
+        currency: refund.currency,
+      },
+    })
+  } catch (error) {
+    logger.error("admin_refund_request_failed", {
+      internal: String(error),
+    })
+    if (error instanceof AppError) {
+      return NextResponse.json(
+        { error: error.safeMessage },
+        { status: error.status },
+      )
+    }
+    return NextResponse.json(
+      { error: "Unable to request refund" },
+      { status: 500 },
+    )
+  }
+}
diff --git a/app/api/auth/[...nextauth]/route.ts b/app/api/auth/[...nextauth]/route.ts
index 866b2be..ef4e3c1 100644
--- a/app/api/auth/[...nextauth]/route.ts
+++ b/app/api/auth/[...nextauth]/route.ts
@@ -1,3 +1,33 @@
+import crypto from "crypto"
+import { NextRequest, NextResponse } from "next/server"
+
 import { handlers } from "@/lib/auth"
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
+
+export const GET = handlers.GET
 
-export const { GET, POST } = handlers
+export async function POST(req: NextRequest) {
+  if (req.nextUrl.pathname.endsWith("/callback/credentials")) {
+    let emailHash = "unknown"
+    try {
+      const form = await req.clone().formData()
+      const email = String(form.get("email") ?? "").trim().toLowerCase()
+      if (email) {
+        emailHash = crypto.createHash("sha256").update(email).digest("hex")
+      }
+    } catch {
+      // NextAuth will reject malformed callback bodies.
+    }
+    const [ipLimit, emailLimit] = await Promise.all([
+      consumeRateLimit(`signin:ip:${clientIp(req)}`, 20, 15 * 60 * 1000),
+      consumeRateLimit(`signin:email:${emailHash}`, 10, 15 * 60 * 1000),
+    ])
+    if (!ipLimit.ok || !emailLimit.ok) {
+      return NextResponse.json(
+        { error: "Too many sign-in attempts. Please wait and try again." },
+        { status: 429 },
+      )
+    }
+  }
+  return handlers.POST(req)
+}
diff --git a/app/api/cart/add/route.ts b/app/api/cart/add/route.ts
index 762a697..de31a8f 100644
--- a/app/api/cart/add/route.ts
+++ b/app/api/cart/add/route.ts
@@ -1,9 +1,18 @@
 import { NextResponse } from 'next/server'
 import { addToCart } from '@/components/cartActions'
+import { clientIp, consumeRateLimit } from '@/lib/middleware/limiter'
+import { hasTrustedOrigin } from '@/lib/security/origin'
 
 export const runtime = 'nodejs'
 
 export async function POST(request: Request) {
+  if (!hasTrustedOrigin(request)) {
+    return NextResponse.json({ success: false, error: 'Forbidden' }, { status: 403 })
+  }
+  const limit = await consumeRateLimit(`cart:${clientIp(request)}`, 120, 10 * 60 * 1000)
+  if (!limit.ok) {
+    return NextResponse.json({ success: false, error: 'Too many cart updates' }, { status: 429 })
+  }
   const { productId, quantity } = await request.json()
   if (!productId) {
     return NextResponse.json({ success: false, error: 'Missing product ID' }, { status: 400 })
diff --git a/app/api/cart/clear/route.ts b/app/api/cart/clear/route.ts
index 7278e9a..bcb3a00 100644
--- a/app/api/cart/clear/route.ts
+++ b/app/api/cart/clear/route.ts
@@ -1,9 +1,18 @@
 import { NextResponse } from 'next/server'
 import { clearCart } from '@/components/cartActions'
+import { clientIp, consumeRateLimit } from '@/lib/middleware/limiter'
+import { hasTrustedOrigin } from '@/lib/security/origin'
 
 export const runtime = 'nodejs'
 
-export async function POST() {
+export async function POST(request: Request) {
+  if (!hasTrustedOrigin(request)) {
+    return NextResponse.json({ success: false, error: 'Forbidden' }, { status: 403 })
+  }
+  const limit = await consumeRateLimit(`cart:${clientIp(request)}`, 120, 10 * 60 * 1000)
+  if (!limit.ok) {
+    return NextResponse.json({ success: false, error: 'Too many cart updates' }, { status: 429 })
+  }
   await clearCart()
   return NextResponse.json({ success: true })
 }
diff --git a/app/api/cart/remove/route.ts b/app/api/cart/remove/route.ts
index f65ef9e..41fd346 100644
--- a/app/api/cart/remove/route.ts
+++ b/app/api/cart/remove/route.ts
@@ -1,9 +1,18 @@
 import { NextResponse } from 'next/server'
 import { removeFromCart } from '@/components/cartActions'
+import { clientIp, consumeRateLimit } from '@/lib/middleware/limiter'
+import { hasTrustedOrigin } from '@/lib/security/origin'
 
 export const runtime = 'nodejs'
 
 export async function POST(request: Request) {
+  if (!hasTrustedOrigin(request)) {
+    return NextResponse.json({ success: false, error: 'Forbidden' }, { status: 403 })
+  }
+  const limit = await consumeRateLimit(`cart:${clientIp(request)}`, 120, 10 * 60 * 1000)
+  if (!limit.ok) {
+    return NextResponse.json({ success: false, error: 'Too many cart updates' }, { status: 429 })
+  }
   const { productId } = await request.json()
   if (!productId) {
     return NextResponse.json({ success: false, error: 'Missing productId' }, { status: 400 })
diff --git a/app/api/cart/summary/route.ts b/app/api/cart/summary/route.ts
index da0c5c3..ca4cf07 100644
--- a/app/api/cart/summary/route.ts
+++ b/app/api/cart/summary/route.ts
@@ -15,6 +15,7 @@ export async function GET() {
     where: {
       id: { in: productIds },
       deletedAt: null, // Exclude soft-deleted products from cart
+      publishStatus: "PUBLISHED",
     },
     select: {
       id: true,
diff --git a/app/api/cart/update/route.ts b/app/api/cart/update/route.ts
index fb70d7b..1fee1f8 100644
--- a/app/api/cart/update/route.ts
+++ b/app/api/cart/update/route.ts
@@ -1,9 +1,18 @@
 import { NextResponse } from 'next/server'
 import { updateCartItem, removeFromCart } from '@/components/cartActions'
+import { clientIp, consumeRateLimit } from '@/lib/middleware/limiter'
+import { hasTrustedOrigin } from '@/lib/security/origin'
 
 export const runtime = 'nodejs'
 
 export async function POST(request: Request) {
+  if (!hasTrustedOrigin(request)) {
+    return NextResponse.json({ success: false, error: 'Forbidden' }, { status: 403 })
+  }
+  const limit = await consumeRateLimit(`cart:${clientIp(request)}`, 120, 10 * 60 * 1000)
+  if (!limit.ok) {
+    return NextResponse.json({ success: false, error: 'Too many cart updates' }, { status: 429 })
+  }
   const { productId, quantity } = await request.json()
   if (!productId) {
     return NextResponse.json({ success: false, error: 'Missing productId' }, { status: 400 })
diff --git a/app/api/checkout/create-order/route.ts b/app/api/checkout/create-order/route.ts
index b7cc283..f13f6f1 100644
--- a/app/api/checkout/create-order/route.ts
+++ b/app/api/checkout/create-order/route.ts
@@ -2,6 +2,23 @@ import { NextRequest, NextResponse } from "next/server"
 import { auth } from "@/lib/auth"
 import { prisma } from "@/lib/prisma"
 import { z } from "zod"
+import { computeCheckoutShipping } from "@/lib/config/commerce"
+import { getBankTransferConfig } from "@/lib/config/payment-methods"
+import {
+  checkoutRequestHash,
+  isValidIdempotencyKey,
+} from "@/lib/checkout/idempotency"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { validateCoupon } from "@/lib/pricing"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+import { AppError } from "@/lib/http/errors"
+import { env } from "@/lib/env"
+import { isPaymentCollectionEnabled } from "@/integrations/payments/policy"
+import {
+  aggregateInventoryLines,
+  reservationExpiry,
+  reserveInventory,
+} from "@/lib/inventory/reservations"
 
 const createOrderSchema = z.object({
   addressLine1: z.string().min(1, "Address is required"),
@@ -15,11 +32,14 @@ const createOrderSchema = z.object({
       priceNGN: z.number().int().min(0),
     })
   ).min(1, "Cart is empty"),
-  subtotalNGN: z.number().int().min(0),
-  discountNGN: z.number().int().min(0).default(0),
-  shippingNGN: z.number().int().min(0),
-  totalNGN: z.number().int().min(0),
+  // Accepted temporarily for older clients, but all monetary values are recomputed below.
+  subtotalNGN: z.number().int().min(0).optional(),
+  discountNGN: z.number().int().min(0).optional(),
+  shippingNGN: z.number().int().min(0).optional(),
+  totalNGN: z.number().int().min(0).optional(),
   couponId: z.string().optional().nullable(),
+  couponCode: z.string().trim().max(100).optional().nullable(),
+  deliveryMethod: z.enum(["standard", "express"]).default("standard"),
   isGift: z.boolean().optional().default(false),
   giftMessage: z.string().max(500).optional().nullable(),
   giftWrapping: z.boolean().optional().default(false),
@@ -28,6 +48,9 @@ const createOrderSchema = z.object({
 
 export async function POST(req: NextRequest) {
   try {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Request origin could not be verified" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
     if (!email) {
@@ -41,6 +64,17 @@ export async function POST(req: NextRequest) {
     if (!user) {
       return NextResponse.json({ error: "User not found" }, { status: 401 })
     }
+    const limit = await consumeRateLimit(
+      `checkout:create-order:${user.id}`,
+      10,
+      10 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many checkout attempts. Please wait and try again." },
+        { status: 429 },
+      )
+    }
 
     const body = await req.json()
     const parsed = createOrderSchema.safeParse(body)
@@ -49,18 +83,91 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ error: msg }, { status: 400 })
     }
 
-    const { addressLine1, city, state, phone, items, subtotalNGN: _subtotalNGN, discountNGN, shippingNGN, totalNGN, couponId, isGift, giftMessage, giftWrapping, paymentMethod } = parsed.data
+    const idempotencyKey = req.headers.get("idempotency-key")
+    if (!isValidIdempotencyKey(idempotencyKey)) {
+      return NextResponse.json(
+        { error: "A valid Idempotency-Key header is required" },
+        { status: 400 },
+      )
+    }
+
+    const {
+      addressLine1,
+      city,
+      state,
+      phone,
+      items,
+      couponCode,
+      deliveryMethod,
+      isGift,
+      giftMessage,
+      giftWrapping,
+      paymentMethod,
+    } = parsed.data
+
+    if (
+      paymentMethod === "CARD" &&
+      !isPaymentCollectionEnabled(env.PAYMENTS_ENABLED, env.PAYSTACK_SECRET_KEY)
+    ) {
+      return NextResponse.json(
+        { error: "Online payments are temporarily unavailable" },
+        { status: 503 },
+      )
+    }
+    if (paymentMethod === "BANK_TRANSFER" && !getBankTransferConfig()) {
+      return NextResponse.json(
+        { error: "Bank transfer is not currently available" },
+        { status: 400 },
+      )
+    }
+
+    const requestHash = checkoutRequestHash({
+      addressLine1,
+      city,
+      state,
+      phone,
+      items,
+      couponCode,
+      deliveryMethod,
+      isGift,
+      giftMessage,
+      giftWrapping,
+      paymentMethod,
+    })
+    const priorAttempt = await prisma.checkoutAttempt.findUnique({
+      where: {
+        userId_idempotencyKey: {
+          userId: user.id,
+          idempotencyKey,
+        },
+      },
+      select: { orderId: true, requestHash: true },
+    })
+    if (priorAttempt) {
+      if (priorAttempt.requestHash !== requestHash) {
+        return NextResponse.json(
+          { error: "That checkout key was already used for different order details" },
+          { status: 409 },
+        )
+      }
+      return NextResponse.json({ orderId: priorAttempt.orderId, reused: true })
+    }
 
     // Resolve product IDs and validate prices (use DB price for consistency)
-    const productIds = [...new Set(items.map((i) => i.productId))]
+    const inventoryLines = aggregateInventoryLines(items)
+    const productIds = inventoryLines.map((item) => item.productId)
     const products = await prisma.product.findMany({
-      where: { id: { in: productIds }, deletedAt: null },
+      where: {
+        id: { in: productIds },
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+      },
       select: { id: true, priceNGN: true, stock: true },
     })
     const productMap = new Map(products.map((p) => [p.id, p]))
 
     const orderItems: { productId: string; quantity: number; priceNGN: number }[] = []
-    for (const item of items) {
+    for (const item of inventoryLines) {
       const product = productMap.get(item.productId)
       if (!product) {
         return NextResponse.json({ error: `Product not found: ${item.productId}` }, { status: 400 })
@@ -79,44 +186,91 @@ export async function POST(req: NextRequest) {
     }
 
     const computedSubtotal = orderItems.reduce((s, i) => s + i.priceNGN * i.quantity, 0)
-    const orderTotal = computedSubtotal - discountNGN + shippingNGN
-    if (orderTotal !== totalNGN) {
-      return NextResponse.json(
-        { error: "Total mismatch. Please refresh and try again." },
-        { status: 400 }
-      )
+    let computedDiscount = 0
+    let validatedCouponId: string | null = null
+    if (couponCode) {
+      const coupon = await validateCoupon(couponCode, computedSubtotal)
+      if (!coupon.ok) {
+        return NextResponse.json({ error: coupon.message }, { status: 400 })
+      }
+      computedDiscount = coupon.discountNGN
+      validatedCouponId = coupon.couponId
     }
+    const computedShipping = computeCheckoutShipping(
+      computedSubtotal,
+      deliveryMethod,
+      giftWrapping,
+    )
+    const orderTotal = computedSubtotal - computedDiscount + computedShipping
 
-    const order = await prisma.order.create({
-      data: {
-        userId: user.id,
-        status: "PENDING",
-        subtotalNGN: computedSubtotal,
-        discountNGN,
-        shippingNGN,
-        totalNGN: orderTotal,
-        couponId: couponId || null,
-        addressLine1,
-        city,
-        state,
-        phone,
-        isGift: isGift ?? false,
-        giftMessage: giftMessage || null,
-        giftWrapping: giftWrapping ?? false,
-        paymentMethod: paymentMethod ?? "CARD",
-        items: {
-          create: orderItems.map((i) => ({
-            productId: i.productId,
-            quantity: i.quantity,
-            priceNGN: i.priceNGN,
-          })),
+    let order: { id: string }
+    try {
+      order = await prisma.$transaction(async (tx) => {
+        const created = await tx.order.create({
+          data: {
+            userId: user.id,
+            status: "PENDING",
+            subtotalNGN: computedSubtotal,
+            discountNGN: computedDiscount,
+            shippingNGN: computedShipping,
+            totalNGN: orderTotal,
+            couponId: validatedCouponId,
+            addressLine1,
+            city,
+            state,
+            phone,
+            isGift,
+            giftMessage: giftMessage || null,
+            giftWrapping,
+            paymentMethod,
+            items: {
+              create: orderItems.map((i) => ({
+                productId: i.productId,
+                quantity: i.quantity,
+                priceNGN: i.priceNGN,
+              })),
+            },
+          },
+          select: { id: true },
+        })
+        await tx.checkoutAttempt.create({
+          data: {
+            userId: user.id,
+            orderId: created.id,
+            idempotencyKey,
+            requestHash,
+            expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+          },
+        })
+        await reserveInventory(
+          tx,
+          created.id,
+          orderItems,
+          reservationExpiry(paymentMethod),
+        )
+        return created
+      })
+    } catch (error) {
+      if ((error as { code?: string })?.code !== "P2002") throw error
+      const concurrent = await prisma.checkoutAttempt.findUnique({
+        where: {
+          userId_idempotencyKey: {
+            userId: user.id,
+            idempotencyKey,
+          },
         },
-      },
-    })
+        select: { orderId: true, requestHash: true },
+      })
+      if (!concurrent || concurrent.requestHash !== requestHash) throw error
+      order = { id: concurrent.orderId }
+    }
 
     return NextResponse.json({ orderId: order.id })
-  } catch (e) {
-    console.error("Create order error:", e)
+  } catch (error) {
+    console.error("Create order error:", error)
+    if (error instanceof AppError) {
+      return NextResponse.json({ error: error.safeMessage }, { status: error.status })
+    }
     return NextResponse.json({ error: "Failed to create order" }, { status: 500 })
   }
 }
diff --git a/app/api/contact/route.ts b/app/api/contact/route.ts
index cfd8286..d81787e 100644
--- a/app/api/contact/route.ts
+++ b/app/api/contact/route.ts
@@ -1,41 +1,81 @@
+import crypto from "node:crypto"
+
 import { NextRequest, NextResponse } from "next/server"
 import { Resend } from "resend"
-import { rateLimit } from "@/lib/middleware/rate-limit"
-import { emailSchema, nameSchema, validateAndSanitize } from "@/lib/middleware/validate-input"
 import { z } from "zod"
 import { createContactSubmission } from "@/lib/forms/submissions"
 
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
+import {
+  emailSchema,
+  nameSchema,
+  validateAndSanitize,
+} from "@/lib/middleware/validate-input"
+import {
+  renderContactOwnerEmail,
+  renderContactReplyEmail,
+} from "@/lib/notifications/contact-email"
+import { logger } from "@/lib/observability/logger"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
 const contactSchema = z.object({
   name: nameSchema,
   email: emailSchema,
   subject: z.string().min(1, "Subject is required").max(200),
   message: z.string().min(10, "Message too short").max(5000),
-})
-
-function getClientId(req: NextRequest): string {
-  return req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "anonymous"
-}
+}).strict()
 
 const STORE_EMAIL = "fadeessencee@gmail.com"
-const FROM_EMAIL = process.env.NEWSLETTER_FROM_EMAIL || "Fádé Essence <onboarding@resend.dev>"
-
-function escapeHtml(value: string): string {
-  const entities: Record<string, string> = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#039;" }
-  return value.replace(/[&<>"']/g, (char) => entities[char])
-}
+const FROM_EMAIL =
+  process.env.NEWSLETTER_FROM_EMAIL ||
+  "Fade Essence <onboarding@resend.dev>"
 
 export async function POST(req: NextRequest) {
   try {
-    if (!rateLimit(getClientId(req), 5, 60 * 1000)) {
-      return NextResponse.json({ error: "Too many requests. Try again later." }, { status: 429 })
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json(
+        { error: "Request origin could not be verified" },
+        { status: 403 },
+      )
+    }
+
+    const ipLimit = await consumeRateLimit(
+      `contact:ip:${clientIp(req)}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!ipLimit.ok) {
+      return NextResponse.json(
+        { error: "Too many requests. Try again later." },
+        { status: 429 },
+      )
     }
 
-    const body = await req.json()
-    const validated = validateAndSanitize(contactSchema, body)
+    const validated = validateAndSanitize(contactSchema, await req.json())
     if (!validated.success) {
-      return NextResponse.json({ error: validated.error }, { status: 400 })
+      return NextResponse.json(
+        { error: validated.error },
+        { status: 400 },
+      )
     }
+
     const { name, email, subject, message } = validated.data
+    const normalizedEmail = email.toLowerCase().trim()
+    const emailHash = crypto
+      .createHash("sha256")
+      .update(normalizedEmail)
+      .digest("hex")
+    const emailLimit = await consumeRateLimit(
+      `contact:email:${emailHash}`,
+      3,
+      60 * 60 * 1000,
+    )
+    if (!emailLimit.ok) {
+      return NextResponse.json(
+        { error: "Too many requests. Try again later." },
+        { status: 429 },
+      )
+    }
 
     // Keep the existing email flow operational during the staged migration rollout. Once the
     // FormSubmission migration is applied, every valid contact request is durably captured here.
@@ -50,64 +90,53 @@ export async function POST(req: NextRequest) {
       }
     }
 
-    const safeName = escapeHtml(name)
-    const safeEmail = escapeHtml(email)
-    const safeSubject = escapeHtml(subject)
-    const safeMessage = escapeHtml(message)
-
     if (process.env.RESEND_API_KEY) {
       const resend = new Resend(process.env.RESEND_API_KEY)
+      await resend.emails
+        .send({
+          from: FROM_EMAIL,
+          to: STORE_EMAIL,
+          replyTo: normalizedEmail,
+          subject: `Contact Form: ${subject}`,
+          html: renderContactOwnerEmail({
+            name,
+            email: normalizedEmail,
+            subject,
+            message,
+          }),
+        })
+        .catch((error) =>
+          logger.error("contact_owner_email_failed", {
+            internal: String(error),
+          }),
+        )
 
-      // Notify store owner
-      await resend.emails.send({
-        from: FROM_EMAIL,
-        to: STORE_EMAIL,
-        replyTo: email,
-        subject: `Contact Form: ${subject}`,
-        html: `
-          <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
-            <h2 style="color: #2f3e33;">New Contact Form Submission</h2>
-            <p><strong>From:</strong> ${safeName} &lt;${safeEmail}&gt;</p>
-            <p><strong>Subject:</strong> ${safeSubject}</p>
-            <hr style="border: 1px solid #eee; margin: 20px 0;">
-            <p style="white-space: pre-wrap;">${safeMessage}</p>
-          </div>
-        `,
-      }).catch((err) => console.error("[CONTACT] Failed to send store notification:", err))
-
-      // Auto-reply to sender
-      await resend.emails.send({
-        from: FROM_EMAIL,
-        to: email,
-        subject: `We received your message · Fádé Essence`,
-        html: `
-          <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
-            <div style="background: #2f3e33; color: white; padding: 20px; text-align: center; border-radius: 8px 8px 0 0;">
-              <h1 style="margin: 0; font-family: serif;">Fádé Essence</h1>
-            </div>
-            <div style="background: #f8f9fa; padding: 30px; border-radius: 0 0 8px 8px;">
-              <h2 style="color: #2f3e33; margin-top: 0;">Thank you for reaching out, ${safeName}!</h2>
-              <p>We've received your message and will get back to you within 24–48 hours.</p>
-              <p><strong>Your message:</strong></p>
-              <blockquote style="border-left: 3px solid #2f3e33; margin: 0; padding: 10px 20px; background: white; border-radius: 0 4px 4px 0;">
-                <p style="white-space: pre-wrap; color: #555;">${safeMessage}</p>
-              </blockquote>
-              <p style="margin-top: 20px; color: #666; font-size: 14px;">
-                If you need urgent assistance, you can also reach us at ${STORE_EMAIL} or +234 8160591348.
-              </p>
-            </div>
-          </div>
-        `,
-      }).catch((err) => console.error("[CONTACT] Failed to send auto-reply:", err))
+      await resend.emails
+        .send({
+          from: FROM_EMAIL,
+          to: normalizedEmail,
+          subject: "We received your message - Fade Essence",
+          html: renderContactReplyEmail({ name, message }, STORE_EMAIL),
+        })
+        .catch((error) =>
+          logger.error("contact_reply_email_failed", {
+            internal: String(error),
+          }),
+        )
     } else {
-      console.log("[CONTACT] No RESEND_API_KEY, skipping email:", { name, email, subject })
+      logger.warn("contact_email_skipped", {
+        reason: "RESEND_API_KEY missing",
+      })
     }
 
+    return NextResponse.json({
+      message: "Thank you for contacting us! We'll get back to you soon.",
+    })
+  } catch (error) {
+    logger.error("contact_request_failed", { internal: String(error) })
     return NextResponse.json(
-      { message: "Thank you for contacting us! We'll get back to you soon." },
-      { status: 200 },
+      { error: "Failed to send message. Please try again." },
+      { status: 500 },
     )
-  } catch {
-    return NextResponse.json({ error: "Failed to send message. Please try again." }, { status: 500 })
   }
 }
diff --git a/app/api/coupons/apply/route.ts b/app/api/coupons/apply/route.ts
index 41353e4..cc8bce0 100644
--- a/app/api/coupons/apply/route.ts
+++ b/app/api/coupons/apply/route.ts
@@ -1,9 +1,22 @@
 // app/api/coupons/apply/route.ts
 import { NextRequest, NextResponse } from 'next/server'
+import { clientIp, consumeRateLimit } from '@/lib/middleware/limiter'
 import { validateCoupon } from '@/lib/pricing'
+import { hasTrustedOrigin } from '@/lib/security/origin'
 
 export async function POST(req: NextRequest) {
   try {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: 'Request origin could not be verified' }, { status: 403 })
+    }
+    const limit = await consumeRateLimit(
+      `coupon-preview:ip:${clientIp(req)}`,
+      20,
+      15 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json({ error: 'Too many requests. Try again later.' }, { status: 429 })
+    }
     const { code, subtotalNGN } = await req.json()
     if (!code || typeof subtotalNGN !== 'number') {
       return NextResponse.json({ error: 'bad_request' }, { status: 400 })
diff --git a/app/api/drops/notify/route.ts b/app/api/drops/notify/route.ts
index ba63e00..c360750 100644
--- a/app/api/drops/notify/route.ts
+++ b/app/api/drops/notify/route.ts
@@ -1,13 +1,41 @@
 import { NextRequest, NextResponse } from "next/server"
+import { z } from "zod"
+
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
 import { prisma } from "@/lib/prisma"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
+const notifySchema = z.object({
+  email: z.string().trim().email().max(254),
+  productSlug: z.string().trim().min(1).max(200).optional(),
+}).strict()
 
 export async function POST(req: NextRequest) {
   try {
-    const { email, productSlug } = await req.json()
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json(
+        { error: "Request origin could not be verified" },
+        { status: 403 },
+      )
+    }
+    const limit = await consumeRateLimit(
+      `drop-notify:ip:${clientIp(req)}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many requests. Try again later." },
+        { status: 429 },
+      )
+    }
 
-    if (!email || typeof email !== "string" || !email.includes("@")) {
+    const parsed = notifySchema.safeParse(await req.json())
+    if (!parsed.success) {
       return NextResponse.json({ error: "Valid email required" }, { status: 400 })
     }
+    const email = parsed.data.email.toLowerCase()
+    const productSlug = parsed.data.productSlug
 
     // Upsert subscriber
     await prisma.newsletterSubscriber.upsert({
@@ -19,7 +47,11 @@ export async function POST(req: NextRequest) {
     // Increment notifyCount on the product
     if (productSlug && typeof productSlug === "string") {
       await prisma.product.updateMany({
-        where: { slug: productSlug, deletedAt: null },
+        where: {
+          slug: productSlug,
+          deletedAt: null,
+          publishStatus: "PUBLISHED",
+        },
         data: { notifyCount: { increment: 1 } },
       })
     }
diff --git a/app/api/health/route.ts b/app/api/health/route.ts
index 66dfab2..425f696 100644
--- a/app/api/health/route.ts
+++ b/app/api/health/route.ts
@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server"
 import { prisma } from "@/lib/prisma"
 import { getEnvDiagnostics } from "@/lib/env-diagnostics"
+import {
+  checkJobReadiness,
+  checkRedisReadiness,
+} from "@/lib/readiness"
 
 export const runtime = "nodejs"
 export const dynamic = "force-dynamic"
@@ -8,17 +12,20 @@ export const dynamic = "force-dynamic"
 export async function GET() {
   const env = getEnvDiagnostics()
 
-  let database: "up" | "down" = "up"
-  let databaseError: string | null = null
+  const [database, redis, jobs] = await Promise.all([
+    prisma.$queryRaw`SELECT 1`
+      .then(() => "up" as const)
+      .catch(() => "down" as const),
+    checkRedisReadiness(),
+    checkJobReadiness(),
+  ])
 
-  try {
-    await prisma.$queryRaw`SELECT 1`
-  } catch (error) {
-    database = "down"
-    databaseError = error instanceof Error ? error.message : "Unknown database error"
-  }
-
-  const ok = database === "up" && env.missingCritical.length === 0
+  const redisReady = redis === "up" || redis === "not_configured"
+  const ok =
+    database === "up" &&
+    redisReady &&
+    jobs.status !== "down" &&
+    env.missingCritical.length === 0
   const status = ok ? 200 : 503
 
   return NextResponse.json(
@@ -27,10 +34,11 @@ export async function GET() {
       timestamp: new Date().toISOString(),
       checks: {
         database,
+        redis,
+        jobs: jobs.status,
         env: env.missingCritical.length === 0 ? "up" : "down",
       },
       env,
-      ...(databaseError ? { databaseError } : {}),
     },
     { status }
   )
diff --git a/app/api/internal/jobs/process-outbox/route.ts b/app/api/internal/jobs/process-outbox/route.ts
new file mode 100644
index 0000000..7f8562d
--- /dev/null
+++ b/app/api/internal/jobs/process-outbox/route.ts
@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server"
+
+import { env } from "@/lib/env"
+import { processOutboxBatch } from "@/lib/jobs/outbox"
+import { logger } from "@/lib/observability/logger"
+import { hasValidBearerSecret } from "@/lib/security/bearer"
+
+export const runtime = "nodejs"
+export const maxDuration = 30
+
+export async function POST(req: Request) {
+  if (!env.CRON_SECRET) {
+    return NextResponse.json({ error: "job_not_configured" }, { status: 503 })
+  }
+  if (!hasValidBearerSecret(req.headers.get("authorization"), env.CRON_SECRET)) {
+    return NextResponse.json({ error: "unauthorized" }, { status: 401 })
+  }
+
+  try {
+    const result = await processOutboxBatch({ limit: 20 })
+    logger.info("outbox_batch_processed", result)
+    return NextResponse.json({ ok: true, ...result })
+  } catch (error) {
+    logger.error("outbox_batch_failed", { internal: String(error) })
+    return NextResponse.json({ error: "job_failed" }, { status: 500 })
+  }
+}
+
+// Vercel Cron invokes configured routes with GET. Keep POST for external schedulers and runbooks.
+export const GET = POST
diff --git a/app/api/internal/jobs/reconcile-payments/route.ts b/app/api/internal/jobs/reconcile-payments/route.ts
new file mode 100644
index 0000000..03f4017
--- /dev/null
+++ b/app/api/internal/jobs/reconcile-payments/route.ts
@@ -0,0 +1,58 @@
+import { NextResponse } from "next/server"
+
+import { getPayments } from "@/integrations/registry"
+import { env } from "@/lib/env"
+import { logger } from "@/lib/observability/logger"
+import {
+  reconcilePendingPayments,
+  reconcilePendingRefunds,
+} from "@/lib/payments/reconciliation"
+import { hasValidBearerSecret } from "@/lib/security/bearer"
+
+export const runtime = "nodejs"
+export const maxDuration = 30
+
+export async function POST(req: Request) {
+  if (!env.CRON_SECRET) {
+    return NextResponse.json(
+      { error: "job_not_configured" },
+      { status: 503 },
+    )
+  }
+  if (
+    !hasValidBearerSecret(
+      req.headers.get("authorization"),
+      env.CRON_SECRET,
+    )
+  ) {
+    return NextResponse.json({ error: "unauthorized" }, { status: 401 })
+  }
+
+  const provider = getPayments()
+  if (provider.name !== "paystack") {
+    return NextResponse.json(
+      { error: "payment_provider_unavailable" },
+      { status: 503 },
+    )
+  }
+
+  try {
+    const [payments, refunds] = await Promise.all([
+      reconcilePendingPayments({ provider, limit: 20 }),
+      reconcilePendingRefunds({ provider, limit: 20 }),
+    ])
+    logger.info("payment_reconciliation_batch_processed", {
+      payments,
+      refunds,
+    })
+    return NextResponse.json({ ok: true, payments, refunds })
+  } catch (error) {
+    logger.error("payment_reconciliation_batch_failed", {
+      internal: String(error),
+    })
+    return NextResponse.json({ error: "job_failed" }, { status: 500 })
+  }
+}
+
+// Vercel Cron invokes configured routes with GET. Keep POST for external schedulers and runbooks.
+export const GET = POST
diff --git a/app/api/internal/jobs/release-reservations/route.ts b/app/api/internal/jobs/release-reservations/route.ts
new file mode 100644
index 0000000..7dde3a0
--- /dev/null
+++ b/app/api/internal/jobs/release-reservations/route.ts
@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server"
+
+import { env } from "@/lib/env"
+import { releaseExpiredReservations } from "@/lib/inventory/reservations"
+import { logger } from "@/lib/observability/logger"
+import { hasValidBearerSecret } from "@/lib/security/bearer"
+
+export const runtime = "nodejs"
+
+export async function POST(req: Request) {
+  if (!env.CRON_SECRET) {
+    return NextResponse.json({ error: "job_not_configured" }, { status: 503 })
+  }
+  if (!hasValidBearerSecret(req.headers.get("authorization"), env.CRON_SECRET)) {
+    return NextResponse.json({ error: "unauthorized" }, { status: 401 })
+  }
+
+  try {
+    const result = await releaseExpiredReservations()
+    logger.info("inventory_reservations_expired", result)
+    return NextResponse.json({ ok: true, ...result })
+  } catch (error) {
+    logger.error("inventory_reservation_expiry_failed", {
+      internal: String(error),
+    })
+    return NextResponse.json({ error: "job_failed" }, { status: 500 })
+  }
+}
+
+// Vercel Cron invokes configured routes with GET. Keep POST for external schedulers and runbooks.
+export const GET = POST
diff --git a/app/api/newsletter/subscribe/route.ts b/app/api/newsletter/subscribe/route.ts
index 6fb6b8b..7de1556 100644
--- a/app/api/newsletter/subscribe/route.ts
+++ b/app/api/newsletter/subscribe/route.ts
@@ -1,18 +1,26 @@
 import { NextRequest, NextResponse } from "next/server"
 import { prisma } from "@/lib/prisma"
-import { rateLimit } from "@/lib/middleware/rate-limit"
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
 import { emailSchema, validateAndSanitize } from "@/lib/middleware/validate-input"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 import { z } from "zod"
 
 const subscribeSchema = z.object({ email: emailSchema })
 
-function getClientId(req: NextRequest): string {
-  return req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "anonymous"
-}
-
 export async function POST(req: NextRequest) {
   try {
-    if (!rateLimit(getClientId(req), 5, 60 * 1000)) {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json(
+        { error: "Request origin could not be verified" },
+        { status: 403 },
+      )
+    }
+    const limit = await consumeRateLimit(
+      `newsletter-subscribe:ip:${clientIp(req)}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
       return NextResponse.json({ error: "Too many requests. Try again later." }, { status: 429 })
     }
 
@@ -48,4 +56,3 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Failed to subscribe. Please try again." }, { status: 500 })
   }
 }
-
diff --git a/app/api/paystack/initialize/route.ts b/app/api/paystack/initialize/route.ts
index b06793d..2455b40 100644
--- a/app/api/paystack/initialize/route.ts
+++ b/app/api/paystack/initialize/route.ts
@@ -1,80 +1,237 @@
-// app/api/paystack/initialize/route.ts
-import { NextResponse } from 'next/server'
+import crypto from "crypto"
+import { NextResponse } from "next/server"
+import { z } from "zod"
 
-export const runtime = 'nodejs'
+import { getPayments } from "@/integrations/registry"
+import { isPaymentCollectionEnabled } from "@/integrations/payments/policy"
+import { auth } from "@/lib/auth"
+import { isValidIdempotencyKey } from "@/lib/checkout/idempotency"
+import { getCommerceConfig } from "@/lib/config/commerce"
+import { env } from "@/lib/env"
+import { AppError } from "@/lib/http/errors"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 
-function looksLikePaystackSecretKey(v: string) {
-  return /^sk_(test|live)_/i.test(v.trim())
+export const runtime = "nodejs"
+
+const BodySchema = z.object({
+  orderId: z.string().min(1),
+}).strict()
+
+function retryResponse(attempt: {
+  orderId: string
+  authorizationUrl: string | null
+  providerReference: string
+  status: string
+  order: { user: { email: string } }
+}, orderId: string, email: string) {
+  if (
+    attempt.orderId !== orderId ||
+    attempt.order.user.email.toLowerCase() !== email.toLowerCase()
+  ) {
+    return NextResponse.json(
+      { error: "That idempotency key belongs to a different payment" },
+      { status: 409 },
+    )
+  }
+  if (attempt.status === "PENDING" && attempt.authorizationUrl) {
+    return NextResponse.json({
+      authorization_url: attempt.authorizationUrl,
+      reference: attempt.providerReference,
+    })
+  }
+  if (attempt.status === "SUCCEEDED") {
+    return NextResponse.json({ error: "This payment has already completed" }, { status: 409 })
+  }
+  if (attempt.status === "FAILED") {
+    return NextResponse.json(
+      { error: "That payment attempt failed. Please try again." },
+      { status: 409 },
+    )
+  }
+  return NextResponse.json(
+    { error: "Payment initialization is already in progress. Please retry shortly." },
+    { status: 409 },
+  )
 }
 
 export async function POST(req: Request) {
+  let attemptId: string | null = null
   try {
-    const body = await req.json()
-    const { email, amountNGN, metadata, meta } = body
-    const paystackMeta = metadata ?? meta ?? {}
-
-    const secret = (process.env.PAYSTACK_SECRET_KEY || '').trim()
-    const cleanSecret = secret.toLowerCase().includes('bearer')
-      ? secret.replace(/^bearer\s+/i, '').trim()
-      : secret
-
-    if (!cleanSecret) {
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Request origin could not be verified" }, { status: 403 })
+    }
+    if (!isPaymentCollectionEnabled(env.PAYMENTS_ENABLED, env.PAYSTACK_SECRET_KEY)) {
       return NextResponse.json(
-        { error: 'PAYSTACK_SECRET_KEY missing in .env' },
-        { status: 400 }
+        { error: "Online payments are temporarily unavailable" },
+        { status: 503 },
       )
     }
-    if (!looksLikePaystackSecretKey(cleanSecret)) {
+    const session = await auth()
+    const email = session?.user?.email
+    if (!email) {
+      return NextResponse.json({ error: "Sign in to pay for an order" }, { status: 401 })
+    }
+    const payerHash = crypto.createHash("sha256").update(email.toLowerCase()).digest("hex")
+    const limit = await consumeRateLimit(
+      `payments:initialize:${payerHash}`,
+      5,
+      5 * 60 * 1000,
+    )
+    if (!limit.ok) {
       return NextResponse.json(
-        {
-          error:
-            'PAYSTACK_SECRET_KEY is not in the expected format (should start with sk_test_ or sk_live_). Copy the Secret Key from your Paystack Dashboard -> Settings -> API Keys & Webhooks. Current key format is invalid.',
-        },
-        { status: 400 }
+        { error: "Too many payment attempts. Please wait and try again." },
+        { status: 429 },
       )
     }
 
-    if (!email || !amountNGN || Number(amountNGN) <= 0) {
+    const parsed = BodySchema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: "A valid order is required" }, { status: 400 })
+    }
+    const idempotencyKey = req.headers.get("idempotency-key")
+    if (!isValidIdempotencyKey(idempotencyKey)) {
       return NextResponse.json(
-        { error: 'Invalid email or amount' },
-        { status: 400 }
+        { error: "A valid Idempotency-Key header is required" },
+        { status: 400 },
       )
     }
 
-    const amountKobo = Math.round(Number(amountNGN) * 100)
+    const prior = await prisma.paymentAttempt.findUnique({
+      where: { idempotencyKey },
+      select: {
+        orderId: true,
+        authorizationUrl: true,
+        providerReference: true,
+        status: true,
+        order: { select: { user: { select: { email: true } } } },
+      },
+    })
+    if (prior) return retryResponse(prior, parsed.data.orderId, email)
 
-    const res = await fetch('https://api.paystack.co/transaction/initialize', {
-      method: 'POST',
-      headers: {
-        // ✅ must be "Bearer <secret>"
-        Authorization: `Bearer ${cleanSecret}`,
-        'Content-Type': 'application/json',
+    const order = await prisma.order.findFirst({
+      where: {
+        id: parsed.data.orderId,
+        status: "PENDING",
+        paymentMethod: "CARD",
+        user: { email },
+      },
+      select: {
+        id: true,
+        totalNGN: true,
+        user: { select: { email: true } },
+        inventoryReservations: {
+          select: { status: true, expiresAt: true },
+        },
       },
-      body: JSON.stringify({
-        email,
-        amount: amountKobo,
-        currency: 'NGN',
-        metadata: paystackMeta,
-      }),
     })
+    if (!order) {
+      return NextResponse.json(
+        { error: "That order is unavailable or already processed" },
+        { status: 404 },
+      )
+    }
+    if (
+      order.inventoryReservations.length > 0 &&
+      order.inventoryReservations.some(
+        (reservation) =>
+          reservation.status !== "RESERVED" || reservation.expiresAt <= new Date(),
+      )
+    ) {
+      return NextResponse.json(
+        { error: "This checkout reservation expired. Please return to your cart and try again." },
+        { status: 409 },
+      )
+    }
 
-    const data = await res.json().catch(() => ({} as any))
+    const provider = getPayments()
+    if (provider.name !== "paystack") {
+      return NextResponse.json(
+        { error: "Card payments are not configured" },
+        { status: 503 },
+      )
+    }
 
-    if (!res.ok || !data?.status || !data?.data?.authorization_url) {
-      // Paystack returns { status: false, message: '...' } on errors
-      const msg = data?.message || data?.error || 'Paystack init failed'
-      return NextResponse.json({ error: msg }, { status: 400 })
+    const reference = `fade_${crypto.randomUUID().replaceAll("-", "")}`
+    const currency = getCommerceConfig().shipping.currency
+    try {
+      const attempt = await prisma.paymentAttempt.create({
+        data: {
+          orderId: order.id,
+          provider: provider.name,
+          providerReference: reference,
+          idempotencyKey,
+          expectedAmountNGN: order.totalNGN,
+          expectedCurrency: currency,
+        },
+        select: { id: true },
+      })
+      attemptId = attempt.id
+    } catch (error) {
+      if ((error as { code?: string })?.code === "P2002") {
+        const raced = await prisma.paymentAttempt.findUnique({
+          where: { idempotencyKey },
+          select: {
+            orderId: true,
+            authorizationUrl: true,
+            providerReference: true,
+            status: true,
+            order: { select: { user: { select: { email: true } } } },
+          },
+        })
+        if (raced) return retryResponse(raced, order.id, email)
+      }
+      throw error
     }
 
+    const result = await provider.initialize({
+      orderId: order.id,
+      reference,
+      amountNGN: order.totalNGN,
+      currency,
+      email: order.user.email,
+      callbackUrl: `${env.APP_URL.replace(/\/$/, "")}/checkout/success`,
+      metadata: { orderId: order.id },
+    })
+
+    await prisma.paymentAttempt.update({
+      where: { id: attemptId },
+      data: {
+        providerReference: result.reference,
+        authorizationUrl: result.authorizationUrl,
+        status: "PENDING",
+        initializedAt: new Date(),
+      },
+    })
+
     return NextResponse.json({
-      authorization_url: data.data.authorization_url,
-      reference: data.data.reference,
-      access_code: data.data.access_code,
+      authorization_url: result.authorizationUrl,
+      reference: result.reference,
     })
-  } catch (e: any) {
-    return NextResponse.json(
-      { error: e?.message || 'Init error' },
-      { status: 500 }
-    )
+  } catch (error) {
+    if (attemptId) {
+      await prisma.paymentAttempt
+        .update({
+          where: { id: attemptId },
+          data: {
+            status: "FAILED",
+            failureCode: error instanceof AppError ? error.code : "INTERNAL_ERROR",
+          },
+        })
+        .catch((updateError) => {
+          logger.error("payment_attempt_failure_record_failed", {
+            attemptId,
+            internal: String(updateError),
+          })
+        })
+    }
+    const message =
+      error instanceof AppError
+        ? error.safeMessage
+        : "We could not start your payment. Please try again."
+    const status = error instanceof AppError ? error.status : 500
+    return NextResponse.json({ error: message }, { status })
   }
 }
diff --git a/app/api/paystack/webhook/route.ts b/app/api/paystack/webhook/route.ts
index 7cb0724..10a4854 100644
--- a/app/api/paystack/webhook/route.ts
+++ b/app/api/paystack/webhook/route.ts
@@ -1,133 +1,185 @@
-// app/api/paystack/webhook/route.ts
-import { NextRequest, NextResponse } from 'next/server'
-import crypto from 'crypto'
-import { prisma } from '@/lib/prisma'
-import { sendReceipt } from '@/emails/sendReceipt'
-import { recordWebhookOnce } from '@/lib/webhooks/idempotency'
-import { resolveLoyaltyTier } from '@/lib/config/commerce'
-import { pointsForOrder } from '@/lib/loyalty/points'
-import { reversePointsForOrder } from '@/lib/loyalty/service'
-import { qualifyReferral } from '@/lib/referrals/service'
+import { NextRequest, NextResponse } from "next/server"
 
-function verify(reqBody: string, signature?: string) {
-  const secret = process.env.PAYSTACK_SECRET_KEY || ''
-  if (!secret || !signature) return false
-  const hash = crypto.createHmac('sha512', secret).update(reqBody).digest('hex')
-  return hash === signature
-}
+import { getPayments } from "@/integrations/registry"
+import type { ProviderRefundStatus } from "@/integrations/payments/types"
+import { logger } from "@/lib/observability/logger"
+import { settleSuccessfulPayment } from "@/lib/payments/settlement"
+import { settleRefundStatus } from "@/lib/refunds/settlement"
+
+export const runtime = "nodejs"
 
 export async function POST(req: NextRequest) {
   const raw = await req.text()
-  const signature = req.headers.get('x-paystack-signature') || undefined
-  if (!verify(raw, signature)) return NextResponse.json({ error: 'invalid_signature' }, { status: 401 })
+  const signature = req.headers.get("x-paystack-signature")
+  const provider = getPayments()
+
+  if (provider.name !== "paystack") {
+    return NextResponse.json(
+      { error: "payment_provider_unavailable" },
+      { status: 503 },
+    )
+  }
+
+  const verified = provider.verifyWebhook(raw, signature)
+  if (!verified.valid) {
+    return NextResponse.json({ error: "invalid_signature" }, { status: 401 })
+  }
 
-  const evt = JSON.parse(raw)
-  if (evt?.event === 'charge.success') {
-    const ref = evt?.data?.reference as string | undefined
-    const orderId = evt?.data?.metadata?.orderId as string | undefined
+  let rawEvent: Record<string, any>
+  try {
+    rawEvent = JSON.parse(raw)
+  } catch {
+    return NextResponse.json({ error: "invalid_payload" }, { status: 400 })
+  }
 
-    // Durable replay protection: process each event id at most once.
-    const eventId = String(evt?.id ?? evt?.data?.id ?? ref ?? orderId ?? '')
-    if (eventId) {
-      const first = await recordWebhookOnce('paystack', eventId, evt.event)
-      if (!first) return NextResponse.json({ ok: true })
+  const eventId = String(
+    rawEvent?.id ??
+      rawEvent?.data?.id ??
+      verified.reference ??
+      verified.orderId ??
+      "",
+  )
+
+  if (verified.event === "charge.success") {
+    const { orderId, reference, amountNGN, currency, status } = verified
+    if (
+      !orderId ||
+      !reference ||
+      amountNGN == null ||
+      !currency ||
+      !status
+    ) {
+      logger.warn("paystack_webhook_incomplete", { eventId })
+      return NextResponse.json({ ok: true, ignored: "incomplete" })
     }
 
-    if (orderId) {
-      // Fetch order items first so we can decrement stock
-      const existingOrder = await prisma.order.findUnique({
-        where: { id: orderId },
-        select: { status: true, couponId: true, items: { select: { productId: true, quantity: true } } },
+    try {
+      const result = await settleSuccessfulPayment({
+        orderId,
+        reference,
+        amountNGN,
+        currency,
+        providerStatus: status,
+        providerTransactionId:
+          rawEvent?.data?.id == null ? null : String(rawEvent.data.id),
+        receipt: eventId
+          ? { provider: "paystack", eventId, topic: verified.event }
+          : undefined,
       })
 
-      // Guard: skip if already paid (duplicate webhook)
-      if (!existingOrder || existingOrder.status === 'PAID') {
-        return NextResponse.json({ ok: true })
-      }
-
-      // Atomically: mark PAID, decrement stock, increment coupon usage, update loyalty
-      const order = await prisma.$transaction(async (tx) => {
-        const updated = await tx.order.update({
-          where: { id: orderId },
-          data: { status: 'PAID', reference: ref ?? null },
-          include: { user: true, items: { include: { product: true } }, coupon: true },
+      if (result.outcome === "unknown") {
+        logger.warn("paystack_webhook_unknown_attempt", {
+          eventId,
+          reference,
+          orderId,
         })
-
-        // Decrement stock for each ordered product
-        await Promise.all(
-          existingOrder.items.map((item) =>
-            tx.product.update({
-              where: { id: item.productId },
-              data: { stock: { decrement: item.quantity } },
-            })
-          )
-        )
-
-        // Increment coupon usage if one was applied
-        if (existingOrder.couponId) {
-          await tx.coupon.update({
-            where: { id: existingOrder.couponId },
-            data: { usedCount: { increment: 1 } },
-          })
-        }
-
-        // Update user loyalty tier and lifetime spend (thresholds from commerce config)
-        const updatedUser = await tx.user.update({
-          where: { id: updated.userId },
-          data: { totalLifetimeSpend: { increment: updated.totalNGN } },
-          select: { totalLifetimeSpend: true },
-        })
-        await tx.user.update({
-          where: { id: updated.userId },
-          data: { loyaltyTier: resolveLoyaltyTier(updatedUser.totalLifetimeSpend) },
+        return NextResponse.json({ ok: true, ignored: "unknown_attempt" })
+      }
+      if (result.outcome === "mismatch") {
+        logger.error("paystack_webhook_payment_mismatch", {
+          eventId,
+          reference,
+          orderId: result.orderId,
+          attemptStatus: result.attemptStatus,
+          expectedAmountNGN: result.expectedAmountNGN,
+          orderAmountNGN: result.orderAmountNGN,
+          receivedAmountNGN: amountNGN,
+          expectedCurrency: result.expectedCurrency,
+          receivedCurrency: currency,
         })
-
-        // Accrue loyalty points (earning is always recorded; redemption stays flag-gated).
-        // Idempotent: the already-PAID + WebhookReceipt guards prevent double-earn.
-        const points = pointsForOrder(updated.totalNGN)
-        if (points > 0) {
-          const prior = await tx.loyaltyLedger.aggregate({
-            where: { userId: updated.userId },
-            _sum: { delta: true },
-          })
-          const balanceAfter = (prior._sum.delta ?? 0) + points
-          await tx.loyaltyLedger.create({
-            data: { userId: updated.userId, delta: points, reason: 'order_earn', balanceAfter, orderId: updated.id },
+        return NextResponse.json({ ok: true, ignored: "payment_mismatch" })
+      }
+      if (result.outcome === "duplicate") {
+        if (
+          result.paidReference &&
+          result.paidReference !== reference
+        ) {
+          logger.error("duplicate_successful_payment", {
+            orderId: result.orderId,
+            reference,
           })
         }
-
-        return updated
+        return NextResponse.json({ ok: true, duplicate: true })
+      }
+    } catch (error) {
+      logger.error("paystack_webhook_processing_failed", {
+        eventId,
+        orderId,
+        internal: String(error),
       })
-
-      // send receipt (best-effort)
-      await sendReceipt(order).catch(() => {})
-
-      // Qualify any pending referral for this customer's first paid order (best-effort, idempotent).
-      await qualifyReferral(order.userId, order.id).catch(() => {})
-
-      // Create notification for admin
-      await prisma.notification.create({
-        data: {
-          type: 'ORDER_PAID',
-          title: 'New Order Payment',
-          message: `Order #${order.reference || order.id.slice(0, 8)} has been paid. Total: ₦${order.totalNGN.toLocaleString()}`,
-          orderId: order.id,
-        }
-      }).catch(() => {}) // Don't fail if notification creation fails
+      return NextResponse.json(
+        { error: "processing_failed" },
+        { status: 500 },
+      )
     }
-  } else if (evt?.event === 'refund.processed' || evt?.event === 'charge.refunded') {
-    // Reverse loyalty points earned for the refunded order. Idempotent + replay-guarded.
-    const ref = (evt?.data?.transaction?.reference ?? evt?.data?.reference) as string | undefined
-    const eventId = String(evt?.id ?? evt?.data?.id ?? ref ?? '')
-    if (eventId) {
-      const first = await recordWebhookOnce('paystack', eventId, evt.event)
-      if (!first) return NextResponse.json({ ok: true })
+  } else if (
+    verified.event?.startsWith("refund.") ||
+    verified.event === "charge.refunded"
+  ) {
+    const refundStatus: ProviderRefundStatus =
+      verified.event === "charge.refunded"
+        ? "processed"
+        : verified.event === "refund.processed"
+          ? "processed"
+          : verified.event === "refund.failed"
+            ? "failed"
+            : verified.event === "refund.needs-attention"
+              ? "needs_attention"
+              : verified.event === "refund.processing"
+                ? "processing"
+                : "pending"
+    const data = rawEvent?.data ?? {}
+    const paymentReference =
+      data?.transaction?.reference ?? data?.reference ?? null
+    const amountNGN =
+      typeof data?.amount === "number"
+        ? Math.round(data.amount / 100)
+        : null
+    const currency = data?.currency
+    if (!eventId || !paymentReference || amountNGN == null || !currency) {
+      logger.warn("paystack_refund_webhook_incomplete", {
+        eventId,
+        topic: verified.event,
+      })
+      return NextResponse.json({ ok: true, ignored: "incomplete" })
     }
-    if (ref) {
-      const order = await prisma.order.findUnique({ where: { reference: ref }, select: { id: true, userId: true } })
-      if (order) {
-        await reversePointsForOrder(order.userId, order.id).catch(() => {})
+
+    try {
+      const result = await settleRefundStatus({
+        providerRefundId:
+          data?.id == null ? null : String(data.id),
+        paymentReference,
+        status: refundStatus,
+        amountNGN,
+        currency,
+        receipt: {
+          provider: "paystack",
+          eventId: `${eventId}:${verified.event}`,
+          topic: verified.event,
+        },
+      })
+      if (result.outcome === "mismatch" || result.outcome === "unknown") {
+        logger.error("paystack_refund_webhook_unmatched", {
+          eventId,
+          paymentReference,
+          outcome: result.outcome,
+        })
       }
+      return NextResponse.json({
+        ok: true,
+        duplicate: result.outcome === "duplicate",
+        outcome: result.outcome,
+      })
+    } catch (error) {
+      logger.error("paystack_refund_webhook_processing_failed", {
+        eventId,
+        paymentReference,
+        internal: String(error),
+      })
+      return NextResponse.json(
+        { error: "processing_failed" },
+        { status: 500 },
+      )
     }
   }
 
diff --git a/app/api/products/route.ts b/app/api/products/route.ts
index 105f0d5..df44ef8 100644
--- a/app/api/products/route.ts
+++ b/app/api/products/route.ts
@@ -18,6 +18,7 @@ export async function GET(request: NextRequest) {
     // Build where clause
     const where: any = {
       deletedAt: null, // Exclude soft-deleted products
+      publishStatus: 'PUBLISHED',
     }
     if (category) {
       where.category = category
@@ -82,4 +83,3 @@ export async function GET(request: NextRequest) {
 }
 
 
-
diff --git a/app/api/recommendations/route.ts b/app/api/recommendations/route.ts
index a285170..0337c64 100644
--- a/app/api/recommendations/route.ts
+++ b/app/api/recommendations/route.ts
@@ -16,7 +16,7 @@ export async function GET(request: NextRequest) {
 
     if (notes.length === 0) {
       const products = await prisma.product.findMany({
-        where: { deletedAt: null },
+        where: { deletedAt: null, publishStatus: "PUBLISHED" },
         orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
         take: limit,
       })
@@ -35,6 +35,7 @@ export async function GET(request: NextRequest) {
     const products = await prisma.product.findMany({
       where: {
         deletedAt: null,
+        publishStatus: "PUBLISHED",
         OR: orConditions,
       },
       orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
diff --git a/app/api/register/route.ts b/app/api/register/route.ts
index 14f839a..9b972b3 100644
--- a/app/api/register/route.ts
+++ b/app/api/register/route.ts
@@ -1,37 +1,80 @@
-import { NextRequest, NextResponse } from 'next/server'
-import { prisma } from '@/lib/prisma'
-import bcrypt from 'bcryptjs'
-import { toSafeAuthErrorMessage } from '@/lib/prisma-error'
-import { generateReferralCode } from '@/lib/referrals/code'
-import { attributeReferral } from '@/lib/referrals/service'
+import bcrypt from "bcryptjs"
+import { NextRequest, NextResponse } from "next/server"
+import { z } from "zod"
+
+import { newPasswordSchema } from "@/lib/auth/password-reset"
+import { consumeRateLimit, clientIp } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+import { toSafeAuthErrorMessage } from "@/lib/prisma-error"
+import { generateReferralCode } from "@/lib/referrals/code"
+import { attributeReferral } from "@/lib/referrals/service"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
+const RegisterSchema = z.object({
+  email: z.string().trim().email().max(254),
+  password: newPasswordSchema,
+  name: z.string().trim().max(120).optional(),
+  referredBy: z.string().trim().max(100).optional(),
+}).strict()
 
 export async function POST(req: NextRequest) {
   try {
-    const { email, password, name, referredBy } = await req.json()
-    if (!email || !password) return NextResponse.json({ error: 'Email and password required' }, { status: 400 })
-    const exists = await prisma.user.findUnique({ where: { email } })
-    if (exists) return NextResponse.json({ error: 'Email already registered' }, { status: 400 })
-    const hash = await bcrypt.hash(password, 10)
+    if (!hasTrustedOrigin(req)) {
+      return NextResponse.json({ error: "Request origin could not be verified" }, { status: 403 })
+    }
+    const limit = await consumeRateLimit(
+      `signup:ip:${clientIp(req)}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many signup attempts. Please wait and try again." },
+        { status: 429 },
+      )
+    }
+    const parsed = RegisterSchema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "Valid email and a password of at least 8 characters are required" },
+        { status: 400 },
+      )
+    }
+    const email = parsed.data.email.toLowerCase()
+    const exists = await prisma.user.findFirst({
+      where: { email: { equals: email, mode: "insensitive" } },
+      select: { id: true },
+    })
+    if (exists) {
+      return NextResponse.json({ error: "Email already registered" }, { status: 400 })
+    }
+    const hash = await bcrypt.hash(parsed.data.password, 12)
 
-    // Generate unique referral code for the new user
     let referralCode = generateReferralCode()
-    let attempts = 0
-    while (attempts < 5) {
+    for (let attempts = 0; attempts < 5; attempts += 1) {
       const existing = await prisma.user.findUnique({ where: { referralCode } })
       if (!existing) break
       referralCode = generateReferralCode()
-      attempts++
     }
 
-    const user = await prisma.user.create({ data: { email, name, passwordHash: hash, referralCode } })
-
-    // Attribute the referral (creates a Referral row + fraud guards). Best-effort: never blocks signup.
-    if (referredBy) {
-      await attributeReferral(user.id, String(referredBy)).catch(() => null)
+    const user = await prisma.user.create({
+      data: {
+        email,
+        name: parsed.data.name || null,
+        passwordHash: hash,
+        referralCode,
+      },
+    })
+    if (parsed.data.referredBy) {
+      await attributeReferral(user.id, parsed.data.referredBy).catch(() => null)
     }
     return NextResponse.json({ ok: true })
   } catch (error) {
-    console.error('Register API error:', error)
-    return NextResponse.json({ error: toSafeAuthErrorMessage(error) }, { status: 500 })
+    logger.error("registration_failed", { internal: String(error) })
+    return NextResponse.json(
+      { error: toSafeAuthErrorMessage(error) },
+      { status: 500 },
+    )
   }
 }
diff --git a/app/api/reset-password/confirm/route.ts b/app/api/reset-password/confirm/route.ts
new file mode 100644
index 0000000..6471258
--- /dev/null
+++ b/app/api/reset-password/confirm/route.ts
@@ -0,0 +1,64 @@
+import { NextResponse } from "next/server"
+import { z } from "zod"
+
+import {
+  consumePasswordResetToken,
+  newPasswordSchema,
+} from "@/lib/auth/password-reset"
+import { consumeRateLimit, clientIp } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
+export const runtime = "nodejs"
+
+const ConfirmSchema = z.object({
+  token: z.string().min(32).max(128),
+  password: newPasswordSchema,
+}).strict()
+
+export async function POST(request: Request) {
+  try {
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json({ error: "Request origin could not be verified" }, { status: 403 })
+    }
+    const limit = await consumeRateLimit(
+      `password-reset:confirm:${clientIp(request)}`,
+      10,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { error: "Too many reset attempts. Please wait and try again." },
+        { status: 429 },
+      )
+    }
+
+    const parsed = ConfirmSchema.safeParse(await request.json())
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "The reset link or password is invalid" },
+        { status: 400 },
+      )
+    }
+    const changed = await consumePasswordResetToken(
+      parsed.data.token,
+      parsed.data.password,
+    )
+
+    if (!changed) {
+      return NextResponse.json(
+        { error: "This reset link is invalid or has expired" },
+        { status: 400 },
+      )
+    }
+    return NextResponse.json({ message: "Your password has been updated" })
+  } catch (error) {
+    logger.error("password_reset_confirmation_failed", {
+      internal: String(error),
+    })
+    return NextResponse.json(
+      { error: "Failed to reset password" },
+      { status: 500 },
+    )
+  }
+}
diff --git a/app/api/reset-password/route.ts b/app/api/reset-password/route.ts
index 5475aa0..557c24f 100644
--- a/app/api/reset-password/route.ts
+++ b/app/api/reset-password/route.ts
@@ -1,87 +1,119 @@
-import { NextResponse } from 'next/server'
-import { Resend } from 'resend'
-import { prisma } from '@/lib/prisma'
-import crypto from 'crypto'
+import crypto from "crypto"
+import { NextResponse } from "next/server"
+import { Resend } from "resend"
+import { z } from "zod"
 
-const FROM_EMAIL = process.env.NEWSLETTER_FROM_EMAIL || 'Fádé Essence <onboarding@resend.dev>'
+import {
+  generatePasswordResetToken,
+  passwordResetExpiry,
+  passwordResetTokenHash,
+} from "@/lib/auth/password-reset"
+import { env } from "@/lib/env"
+import { consumeRateLimit, clientIp } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+import { escapeHtml } from "@/lib/security/html"
+
+export const runtime = "nodejs"
+
+const RequestSchema = z.object({
+  email: z.string().trim().email().max(254),
+}).strict()
+
+const GENERIC_MESSAGE =
+  "If an account exists for this email, a reset link has been sent."
 
 export async function POST(request: Request) {
   try {
-    const { email } = await request.json()
-
-    if (!email) {
-      return NextResponse.json({ error: 'Email is required' }, { status: 400 })
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json({ error: "Request origin could not be verified" }, { status: 403 })
+    }
+    const parsed = RequestSchema.safeParse(await request.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: "A valid email address is required" }, { status: 400 })
     }
 
-    const normalizedEmail = String(email).toLowerCase().trim()
+    const normalizedEmail = parsed.data.email.toLowerCase()
+    const emailHash = crypto.createHash("sha256").update(normalizedEmail).digest("hex")
+    const [ipLimit, emailLimit] = await Promise.all([
+      consumeRateLimit(`password-reset:ip:${clientIp(request)}`, 5, 60 * 60 * 1000),
+      consumeRateLimit(`password-reset:email:${emailHash}`, 3, 60 * 60 * 1000),
+    ])
+    if (!ipLimit.ok || !emailLimit.ok) {
+      return NextResponse.json({ message: GENERIC_MESSAGE })
+    }
 
-    // Check if user exists
-    const user = await prisma.user.findUnique({
-      where: { email: normalizedEmail },
-      select: { id: true, name: true },
+    const user = await prisma.user.findFirst({
+      where: { email: { equals: normalizedEmail, mode: "insensitive" } },
+      select: { id: true, email: true, name: true },
     })
-
-    // Always return success to prevent email enumeration
     if (!user) {
-      return NextResponse.json({
-        message: 'If an account exists for this email, a reset link has been sent.',
-      })
+      return NextResponse.json({ message: GENERIC_MESSAGE })
     }
 
-    // Generate reset token
-    const resetToken = crypto.randomBytes(32).toString('hex')
-    const resetTokenExpiry = new Date(Date.now() + 3600000) // 1 hour
-
-    // Store token in database (resetToken and resetTokenExpiry exist in User model)
-    await prisma.user.update({
-      where: { email: normalizedEmail },
-      data: { resetToken, resetTokenExpiry },
+    const token = generatePasswordResetToken()
+    const tokenHash = passwordResetTokenHash(token)
+    const resetRecord = await prisma.passwordResetToken.upsert({
+      where: { userId: user.id },
+      update: {
+        tokenHash,
+        expiresAt: passwordResetExpiry(),
+        usedAt: null,
+        createdAt: new Date(),
+      },
+      create: {
+        userId: user.id,
+        tokenHash,
+        expiresAt: passwordResetExpiry(),
+      },
+      select: { id: true },
     })
 
-    const base = process.env.NEXTAUTH_URL || process.env.APP_URL || 'http://localhost:3000'
-    const resetUrl = `${base}/auth/reset/${resetToken}`
-
-    if (process.env.RESEND_API_KEY) {
-      const resend = new Resend(process.env.RESEND_API_KEY)
-      await resend.emails.send({
-        from: FROM_EMAIL,
-        to: normalizedEmail,
-        subject: 'Reset your Fádé Essence password',
-        html: `
-          <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
-            <div style="background: #2f3e33; color: white; padding: 20px; text-align: center; border-radius: 8px 8px 0 0;">
-              <h1 style="margin: 0; font-family: serif;">Fádé Essence</h1>
-            </div>
-            <div style="background: #f8f9fa; padding: 30px; border-radius: 0 0 8px 8px;">
-              <h2 style="color: #2f3e33; margin-top: 0;">Password Reset Request</h2>
-              <p>Hello${user.name ? ` ${user.name}` : ''},</p>
-              <p>We received a request to reset your password. Click the button below to set a new password. This link expires in <strong>1 hour</strong>.</p>
-              <div style="text-align: center; margin: 30px 0;">
-                <a href="${resetUrl}" style="background: #2f3e33; color: white; padding: 14px 28px; text-decoration: none; border-radius: 6px; font-weight: bold; display: inline-block;">
-                  Reset Password
-                </a>
+    const resetUrl = `${env.APP_URL.replace(/\/$/, "")}/auth/reset?token=${encodeURIComponent(token)}`
+    if (env.RESEND_API_KEY) {
+      const resend = new Resend(env.RESEND_API_KEY)
+      const safeName = escapeHtml(user.name || "Customer")
+      const safeUrl = escapeHtml(resetUrl)
+      await resend.emails
+        .send(
+          {
+            from:
+              env.NEWSLETTER_FROM_EMAIL ||
+              "Fádé Essence <onboarding@resend.dev>",
+            to: user.email,
+            subject: "Reset your Fádé Essence password",
+            html: `
+              <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
+                <h2>Password reset request</h2>
+                <p>Hello ${safeName},</p>
+                <p>Use the link below to set a new password. It expires in one hour and can only be used once.</p>
+                <p><a href="${safeUrl}">Reset password</a></p>
+                <p>If you did not request this change, you can ignore this email.</p>
               </div>
-              <p style="color: #666; font-size: 13px;">If you did not request a password reset, please ignore this email. Your password will remain unchanged.</p>
-              <p style="color: #999; font-size: 12px; margin-top: 20px;">
-                Or copy this link into your browser:<br>
-                <span style="color: #2f3e33; word-break: break-all;">${resetUrl}</span>
-              </p>
-            </div>
-          </div>
-        `,
-      })
+            `,
+          },
+          { idempotencyKey: `password-reset:${resetRecord.id}` },
+        )
+        .catch((error) => {
+          logger.error("password_reset_email_failed", {
+            userId: user.id,
+            internal: String(error),
+          })
+        })
     } else {
-      // Development: log the link instead of sending email
-      console.log('[PASSWORD RESET] Reset link (no RESEND_API_KEY):', resetUrl)
+      logger.warn("password_reset_email_skipped", {
+        userId: user.id,
+        reason: "RESEND_API_KEY missing",
+      })
     }
 
-    return NextResponse.json({
-      message: 'If an account exists for this email, a reset link has been sent.',
-    })
-  } catch {
+    return NextResponse.json({ message: GENERIC_MESSAGE })
+  } catch (error) {
+    logger.error("password_reset_request_failed", { internal: String(error) })
     return NextResponse.json(
-      { error: 'Failed to process reset request' },
-      { status: 500 }
+      { error: "Failed to process reset request" },
+      { status: 500 },
     )
   }
 }
diff --git a/app/api/reviews/route.ts b/app/api/reviews/route.ts
index 2ba5a02..ee91a01 100644
--- a/app/api/reviews/route.ts
+++ b/app/api/reviews/route.ts
@@ -1,24 +1,39 @@
-import { NextRequest, NextResponse } from 'next/server'
-import type { Prisma } from '@prisma/client'
+import crypto from "node:crypto"
 
-import { auth } from '@/lib/auth'
-import { prisma } from '@/lib/prisma'
+import { NextRequest, NextResponse } from "next/server"
+import type { Prisma } from "@prisma/client"
+import { z } from "zod"
 
-export const runtime = 'nodejs'
+import { auth } from "@/lib/auth"
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+import { findVerifyingOrder } from "@/lib/reviews/verify"
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
+export const runtime = "nodejs"
+
+const reviewSchema = z.object({
+  productId: z.string().trim().min(1).max(100),
+  rating: z.coerce.number().int().min(1).max(5),
+  comment: z.string().trim().max(2000).optional(),
+  displayName: z.string().trim().max(80).optional(),
+  tag: z.string().trim().max(40).optional(),
+}).strict()
 
 export async function GET(request: NextRequest) {
-  const productId = request.nextUrl.searchParams.get('productId')
+  const productId = request.nextUrl.searchParams.get("productId")
   if (!productId) {
     return NextResponse.json({ reviews: [] })
   }
 
-  const filter = request.nextUrl.searchParams.get('filter') || 'recent'
+  const filter = request.nextUrl.searchParams.get("filter") || "recent"
   const orderBy: Prisma.ReviewOrderByWithRelationInput[] =
-    filter === 'highest'
-      ? [{ rating: 'desc' }, { createdAt: 'desc' }]
-      : filter === 'lowest'
-      ? [{ rating: 'asc' }, { createdAt: 'desc' }]
-      : [{ createdAt: 'desc' }]
+    filter === "highest"
+      ? [{ rating: "desc" }, { createdAt: "desc" }]
+      : filter === "lowest"
+        ? [{ rating: "asc" }, { createdAt: "desc" }]
+        : [{ createdAt: "desc" }]
 
   const reviews = await prisma.review.findMany({
     where: { productId, approved: true },
@@ -32,49 +47,123 @@ export async function GET(request: NextRequest) {
 
 export async function POST(request: NextRequest) {
   try {
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json(
+        { success: false, error: "Request origin could not be verified" },
+        { status: 403 },
+      )
+    }
+
     const session = await auth()
     const email = session?.user?.email
     if (!email) {
-      return NextResponse.json({ success: false, error: 'You must sign in to submit a review.' }, { status: 401 })
+      return NextResponse.json(
+        { success: false, error: "You must sign in to submit a review." },
+        { status: 401 },
+      )
+    }
+
+    const emailHash = crypto
+      .createHash("sha256")
+      .update(email.toLowerCase())
+      .digest("hex")
+    const limit = await consumeRateLimit(
+      `review-submit:user:${emailHash}:ip:${clientIp(request)}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json(
+        { success: false, error: "Too many review attempts. Try again later." },
+        { status: 429 },
+      )
+    }
+
+    const parsed = reviewSchema.safeParse(await request.json())
+    if (!parsed.success) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Product ID and rating (1-5) are required.",
+        },
+        { status: 400 },
+      )
     }
 
-    const user = await prisma.user.findUnique({ where: { email } })
+    const user = await prisma.user.findFirst({
+      where: { email: { equals: email, mode: "insensitive" } },
+      select: { id: true, name: true },
+    })
     if (!user) {
-      return NextResponse.json({ success: false, error: 'User account not found' }, { status: 404 })
+      return NextResponse.json(
+        { success: false, error: "User account not found" },
+        { status: 404 },
+      )
     }
 
-    const payload = await request.json()
-    const productId = String(payload.productId || '').trim()
-    const rating = Math.floor(Number(payload.rating) || 0)
-    const comment = typeof payload.comment === 'string' ? payload.comment.trim() : ''
-    const displayName = typeof payload.displayName === 'string' ? payload.displayName.trim() : user.name
-    const tag = typeof payload.tag === 'string' ? payload.tag.trim() : null
+    const orderId = await findVerifyingOrder(user.id, parsed.data.productId)
+    if (!orderId) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Only verified purchasers can review this product.",
+        },
+        { status: 403 },
+      )
+    }
 
-    if (!productId || rating < 1 || rating > 5) {
-      return NextResponse.json({ success: false, error: 'Product ID and rating (1-5) are required.' }, { status: 400 })
+    const existing = await prisma.review.findFirst({
+      where: {
+        userId: user.id,
+        productId: parsed.data.productId,
+      },
+      select: { id: true },
+    })
+    if (existing) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "You have already reviewed this product.",
+        },
+        { status: 409 },
+      )
     }
 
     await prisma.review.create({
       data: {
         userId: user.id,
-        productId,
-        rating,
-        comment: comment || null,
+        productId: parsed.data.productId,
+        orderId,
+        verifiedPurchase: true,
+        rating: parsed.data.rating,
+        comment: parsed.data.comment || null,
         approved: true,
-        displayName: displayName || undefined,
-        tag: tag || undefined,
+        moderationStatus: "PENDING",
+        displayName: parsed.data.displayName || user.name || undefined,
+        tag: parsed.data.tag || undefined,
       },
     })
 
     return NextResponse.json({ success: true })
   } catch (error) {
-    console.error('Create review error', error)
+    if (
+      typeof error === "object" &&
+      error !== null &&
+      "code" in error &&
+      error.code === "P2002"
+    ) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "You have already reviewed this product.",
+        },
+        { status: 409 },
+      )
+    }
+    logger.error("review_creation_failed", { internal: String(error) })
     return NextResponse.json(
-      {
-        success: false,
-        error: error instanceof Error ? error.message : 'Unable to store review',
-      },
-      { status: 500 }
+      { success: false, error: "Unable to store review" },
+      { status: 500 },
     )
   }
 }
diff --git a/app/api/search/route.ts b/app/api/search/route.ts
index 9d0020f..2cd15c8 100644
--- a/app/api/search/route.ts
+++ b/app/api/search/route.ts
@@ -8,10 +8,13 @@ export const dynamic = "force-dynamic"
 /** PostgreSQL: case-insensitive contains. */
 function searchWhere(keywords: string[]) {
   const terms = keywords.map((t) => t.trim()).filter((t) => t.length > 0)
-  if (terms.length === 0) return { deletedAt: null }
+  if (terms.length === 0) {
+    return { deletedAt: null, publishStatus: "PUBLISHED" as const }
+  }
 
   return {
     deletedAt: null,
+    publishStatus: "PUBLISHED" as const,
     OR: terms.flatMap((term) => [
       { name: { contains: term, mode: "insensitive" as const } },
       { brand: { contains: term, mode: "insensitive" as const } },
diff --git a/app/api/settings/toggle-email/route.ts b/app/api/settings/toggle-email/route.ts
index fa1a138..c8ac99f 100644
--- a/app/api/settings/toggle-email/route.ts
+++ b/app/api/settings/toggle-email/route.ts
@@ -1,21 +1,39 @@
 import { NextResponse } from "next/server"
 import { prisma } from "@/lib/prisma"
 import { auth } from "@/lib/auth"
+import crypto from "node:crypto"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 
 export async function POST(request: Request) {
   try {
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
 
     if (!email) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
+    const identity = crypto.createHash("sha256").update(email).digest("hex")
+    const limit = await consumeRateLimit(
+      `account:email-setting:${identity}`,
+      30,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json({ error: "Too many changes" }, { status: 429 })
+    }
 
     const { enabled } = await request.json()
+    if (typeof enabled !== "boolean") {
+      return NextResponse.json({ error: "Invalid preference" }, { status: 400 })
+    }
 
     await prisma.user.update({
       where: { email },
-      data: { marketingEmails: enabled } as any,
+      data: { marketingEmails: enabled },
     })
 
     return NextResponse.json({ success: true })
@@ -26,4 +44,3 @@ export async function POST(request: Request) {
 }
 
 
-
diff --git a/app/api/settings/toggle-sms/route.ts b/app/api/settings/toggle-sms/route.ts
index 36f79be..de5cbe5 100644
--- a/app/api/settings/toggle-sms/route.ts
+++ b/app/api/settings/toggle-sms/route.ts
@@ -1,21 +1,39 @@
 import { NextResponse } from "next/server"
 import { prisma } from "@/lib/prisma"
 import { auth } from "@/lib/auth"
+import crypto from "node:crypto"
+import { consumeRateLimit } from "@/lib/middleware/limiter"
+import { hasTrustedOrigin } from "@/lib/security/origin"
 
 export async function POST(request: Request) {
   try {
+    if (!hasTrustedOrigin(request)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
     const session = await auth()
     const email = session?.user?.email
 
     if (!email) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
+    const identity = crypto.createHash("sha256").update(email).digest("hex")
+    const limit = await consumeRateLimit(
+      `account:sms-setting:${identity}`,
+      30,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return NextResponse.json({ error: "Too many changes" }, { status: 429 })
+    }
 
     const { enabled } = await request.json()
+    if (typeof enabled !== "boolean") {
+      return NextResponse.json({ error: "Invalid preference" }, { status: 400 })
+    }
 
     await prisma.user.update({
       where: { email },
-      data: { smsNotifications: enabled } as any,
+      data: { smsNotifications: enabled },
     })
 
     return NextResponse.json({ success: true })
@@ -26,4 +44,3 @@ export async function POST(request: Request) {
 }
 
 
-
diff --git a/app/api/v1/admin/status/route.ts b/app/api/v1/admin/status/route.ts
index bb9db12..73cd44a 100644
--- a/app/api/v1/admin/status/route.ts
+++ b/app/api/v1/admin/status/route.ts
@@ -7,6 +7,10 @@ import { hasCapability, resolveRole } from '@/lib/authz-core'
 import { integrationStatus } from '@/lib/env'
 import { providerStatus } from '@/integrations/registry'
 import { allFlags } from '@/lib/config/feature-flags'
+import {
+  checkJobReadiness,
+  checkRedisReadiness,
+} from '@/lib/readiness'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
@@ -15,11 +19,16 @@ export const GET = route(async () => {
   const admin = await getAdminUser()
   if (!admin) raise('FORBIDDEN')
   if (!hasCapability(resolveRole(admin), 'dashboard:view')) raise('FORBIDDEN')
+  const [redis, jobs] = await Promise.all([
+    checkRedisReadiness(),
+    checkJobReadiness(),
+  ])
   return {
     data: {
       integrations: integrationStatus(),
       providers: providerStatus(),
       featureFlags: allFlags(),
+      readiness: { redis, jobs },
     },
   }
 })
diff --git a/app/api/v1/back-in-stock/route.ts b/app/api/v1/back-in-stock/route.ts
index 13b0036..f34177d 100644
--- a/app/api/v1/back-in-stock/route.ts
+++ b/app/api/v1/back-in-stock/route.ts
@@ -22,7 +22,11 @@ export const POST = route(async ({ req }) => {
   if (!email) raise('VALIDATION_ERROR', 'An email is required to notify you.')
 
   const product = await prisma.product.findFirst({
-    where: { id: body.productId, deletedAt: null },
+    where: {
+      id: body.productId,
+      deletedAt: null,
+      publishStatus: "PUBLISHED",
+    },
     select: { id: true, stock: true },
   })
   if (!product) raise('PRODUCT_NOT_FOUND')
diff --git a/app/api/v1/discovery-sets/route.ts b/app/api/v1/discovery-sets/route.ts
index 0fcee00..047dd74 100644
--- a/app/api/v1/discovery-sets/route.ts
+++ b/app/api/v1/discovery-sets/route.ts
@@ -50,7 +50,11 @@ export const POST = route(async ({ req }) => {
   // Price + stock come from the DB (never trust client prices).
   const productIds = [...new Set(body.items.map((i) => i.productId))]
   const products = await prisma.product.findMany({
-    where: { id: { in: productIds }, deletedAt: null },
+    where: {
+      id: { in: productIds },
+      deletedAt: null,
+      publishStatus: "PUBLISHED",
+    },
     select: { id: true, priceNGN: true, stock: true, variants: { select: { id: true, priceNGN: true, stock: true } } },
   })
   const pMap = new Map(products.map((p) => [p.id, p]))
diff --git a/app/api/v1/reviews/summary/route.ts b/app/api/v1/reviews/summary/route.ts
index 4075fe1..0624f59 100644
--- a/app/api/v1/reviews/summary/route.ts
+++ b/app/api/v1/reviews/summary/route.ts
@@ -16,7 +16,10 @@ export const GET = route(async ({ req }) => {
   if (!productId) raise('VALIDATION_ERROR', 'productId is required.')
 
   const [product, reviews] = await Promise.all([
-    prisma.product.findUnique({ where: { id: productId }, select: { name: true } }),
+    prisma.product.findFirst({
+      where: { id: productId, deletedAt: null, publishStatus: 'PUBLISHED' },
+      select: { name: true },
+    }),
     prisma.review.findMany({
       where: { productId, approved: true, comment: { not: null } },
       orderBy: { createdAt: 'desc' },
diff --git a/app/auth/reset/page.tsx b/app/auth/reset/page.tsx
index 2ba5884..98f4ca6 100644
--- a/app/auth/reset/page.tsx
+++ b/app/auth/reset/page.tsx
@@ -1,144 +1,17 @@
-"use client";
-import Link from "next/link";
-import { useState } from "react";
-import { Logo } from "@/components/logo";
+import type { Metadata } from "next"
 
-export default function ResetPasswordPage() {
-  const [email, setEmail] = useState("");
-  const [sent, setSent] = useState(false);
-  const [isLoading, setIsLoading] = useState(false);
-  const [error, setError] = useState("");
-  const [resetLink, setResetLink] = useState("");
+import { ResetPasswordForm } from "@/components/auth/reset-password-form"
 
-  const onSubmit = async (e: React.FormEvent) => {
-    e.preventDefault();
-    setIsLoading(true);
-    setError("");
-
-    try {
-      const response = await fetch("/api/reset-password", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email }),
-      });
-
-      const data = await response.json();
-
-      if (!response.ok) {
-        setError(data.error || "Failed to send reset email. Please try again.");
-        return;
-      }
-
-      // Store the reset link for development
-      if (data.resetLink) {
-        setResetLink(data.resetLink);
-      }
-
-      setSent(true);
-    } catch (err) {
-      setError("Failed to send reset email. Please try again.");
-    } finally {
-      setIsLoading(false);
-    }
-  };
-
-  return (
-    <div
-      data-surface="night"
-      className="veil grain relative flex min-h-screen items-center justify-center bg-background px-4 py-12 text-foreground"
-    >
-      <div className="relative z-10 w-full max-w-md space-y-8 border border-border bg-card/70 p-6 backdrop-blur-sm sm:p-9">
-        <div className="text-center">
-          <div className="mb-8 flex justify-center">
-            <Logo href="/" />
-          </div>
-          <p className="eyebrow">Account recovery</p>
-          <h1 className="mt-3 font-serif text-3xl font-light text-foreground">
-            Reset your password
-          </h1>
-          <p className="mt-2 text-sm text-muted-foreground">
-            Enter your email address and we'll send you a link to reset your
-            password.
-          </p>
-        </div>
-
-        {sent ? (
-          <div className="space-y-4">
-            <div className="rounded-xl border border-emerald-200 bg-emerald-50 p-4 text-sm text-emerald-700">
-              <p className="font-medium mb-1">Check your email</p>
-              <p>
-                If an account exists for <strong>{email}</strong>, a password
-                reset link has been sent to your inbox.
-              </p>
-            </div>
-
-            {/* Development: Show reset link */}
-            {resetLink && (
-              <div className="border border-border bg-secondary p-4 text-sm">
-                <p className="mb-2 font-medium text-foreground">
-                  Development mode reset link:
-                </p>
-                <a
-                  href={resetLink}
-                  className="break-all text-accent hover:underline"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                >
-                  {resetLink}
-                </a>
-              </div>
-            )}
-          </div>
-        ) : (
-          <form onSubmit={onSubmit} className="mt-6 space-y-6">
-            {error && (
-              <div className="rounded-xl border border-red-200 bg-red-50 p-4 text-sm text-red-700">
-                {error}
-              </div>
-            )}
-
-            <div>
-              <label
-                htmlFor="email"
-                className="block text-sm font-medium text-foreground"
-              >
-                Email address
-              </label>
-              <input
-                id="email"
-                name="email"
-                type="email"
-                autoComplete="email"
-                required
-                className="mt-2 h-12 w-full border border-input bg-background/60 px-3 text-foreground outline-none transition-colors placeholder:text-muted-foreground focus:border-accent"
-                placeholder="you@example.com"
-                value={email}
-                onChange={(e) => setEmail(e.target.value)}
-                disabled={isLoading || sent}
-              />
-            </div>
+export const metadata: Metadata = {
+  title: "Reset Password | Fádé",
+  description: "Request a secure password reset or choose a new password.",
+}
 
-            <div>
-              <button
-                type="submit"
-                disabled={isLoading || sent}
-                className="inline-flex h-12 w-full items-center justify-center bg-primary px-6 font-mono text-[11px] uppercase tracking-[0.2em] text-primary-foreground transition-opacity hover:opacity-90 disabled:opacity-50"
-              >
-                {isLoading ? "Sending..." : "Send Reset Link"}
-              </button>
-            </div>
-          </form>
-        )}
+type PageProps = {
+  searchParams: Promise<{ token?: string }>
+}
 
-        <div className="text-center">
-          <Link
-            href="/auth/signin"
-            className="font-mono text-[11px] uppercase tracking-[0.18em] text-muted-foreground transition-colors hover:text-foreground"
-          >
-            Back to sign in
-          </Link>
-        </div>
-      </div>
-    </div>
-  );
+export default async function ResetPasswordPage({ searchParams }: PageProps) {
+  const { token } = await searchParams
+  return <ResetPasswordForm token={token?.trim() || null} />
 }
diff --git a/app/auth/signup/actions.ts b/app/auth/signup/actions.ts
index 73a90fe..c5d2316 100644
--- a/app/auth/signup/actions.ts
+++ b/app/auth/signup/actions.ts
@@ -4,11 +4,14 @@ import { prisma } from "@/lib/prisma"
 import bcrypt from "bcryptjs"
 import { signIn } from "@/lib/auth"
 import { toSafeAuthErrorMessage } from "@/lib/prisma-error"
+import { headers } from "next/headers"
+import { clientIp, consumeRateLimit } from "@/lib/middleware/limiter"
+import { newPasswordSchema } from "@/lib/auth/password-reset"
 
 export async function signUpAction(formData: FormData) {
   const firstName = formData.get("firstName") as string
   const lastName = formData.get("lastName") as string
-  const email = formData.get("email") as string
+  const email = String(formData.get("email") ?? "").trim().toLowerCase()
   const password = formData.get("password") as string
 
   // Validate inputs
@@ -16,19 +19,30 @@ export async function signUpAction(formData: FormData) {
     return { error: "All fields are required" }
   }
 
-  if (password.length < 8) {
+  if (!newPasswordSchema.safeParse(password).success) {
     return { error: "Password must be at least 8 characters" }
   }
 
   try {
+    const requestHeaders = await headers()
+    const limit = await consumeRateLimit(
+      `signup:ip:${clientIp({ headers: requestHeaders })}`,
+      5,
+      60 * 60 * 1000,
+    )
+    if (!limit.ok) {
+      return { error: "Too many signup attempts. Please wait and try again." }
+    }
     // Check if user already exists
-    const exists = await prisma.user.findUnique({ where: { email } })
+    const exists = await prisma.user.findFirst({
+      where: { email: { equals: email, mode: "insensitive" } },
+    })
     if (exists) {
       return { error: "Email already registered" }
     }
 
     // Hash password and create user
-    const hash = await bcrypt.hash(password, 10)
+    const hash = await bcrypt.hash(password, 12)
     const name = `${firstName} ${lastName}`.trim()
 
     await prisma.user.create({
@@ -63,4 +77,3 @@ export async function signUpAction(formData: FormData) {
     return { error: toSafeAuthErrorMessage(error) }
   }
 }
-
diff --git a/app/checkout/page.tsx b/app/checkout/page.tsx
index 4d9dd9e..fbbea7e 100644
--- a/app/checkout/page.tsx
+++ b/app/checkout/page.tsx
@@ -3,7 +3,10 @@ import type { Metadata } from "next"
 import { MainLayout } from "@/components/layout/main-layout"
 import { CheckoutContent } from "@/components/checkout/checkout-content"
 import { getCommerceConfig } from "@/lib/config/commerce"
+import { getBankTransferConfig } from "@/lib/config/payment-methods"
 import { requireUser } from "@/lib/session"
+import { env } from "@/lib/env"
+import { isPaymentCollectionEnabled } from "@/integrations/payments/policy"
 
 export const metadata: Metadata = {
   title: "Checkout | Fádé",
@@ -16,6 +19,11 @@ export default async function CheckoutPage() {
   await requireUser("/checkout")
 
   const { shipping } = getCommerceConfig()
+  const bankTransfer = getBankTransferConfig()
+  const paymentsEnabled = isPaymentCollectionEnabled(
+    env.PAYMENTS_ENABLED,
+    env.PAYSTACK_SECRET_KEY,
+  )
 
   return (
     <MainLayout>
@@ -23,6 +31,10 @@ export default async function CheckoutPage() {
         items={[]}
         freeShippingThreshold={shipping.freeShippingThreshold}
         flatShippingFee={shipping.flatShippingFee}
+        expressShippingFee={shipping.expressShippingFee}
+        giftWrapFee={shipping.giftWrapFee}
+        bankTransfer={bankTransfer}
+        paymentsEnabled={paymentsEnabled}
       />
     </MainLayout>
   )
diff --git a/app/checkout/success/page.tsx b/app/checkout/success/page.tsx
index 2996e85..c4db993 100644
--- a/app/checkout/success/page.tsx
+++ b/app/checkout/success/page.tsx
@@ -1,156 +1,100 @@
-import { formatPrice } from "@/lib/format";
-import Link from "next/link";
-import { CheckCircle2, AlertCircle } from "lucide-react";
-import { prisma } from "@/lib/prisma";
-import { OrderStatus } from "@prisma/client";
-import { MainLayout } from "@/components/layout/main-layout";
-import { ClearCartOnSuccess } from "@/components/checkout/clear-cart-on-success";
+import Link from "next/link"
+import { CheckCircle2, Clock3, AlertCircle } from "lucide-react"
 
-export const runtime = "nodejs";
+import { MainLayout } from "@/components/layout/main-layout"
+import { ClearCartOnSuccess } from "@/components/checkout/clear-cart-on-success"
+import { auth } from "@/lib/auth"
+import { formatPrice } from "@/lib/format"
+import { prisma } from "@/lib/prisma"
 
-type PageProps = {
-  searchParams: Promise<{
-    mock?: string;
-    reference?: string;
-  }>;
-};
+export const runtime = "nodejs"
+export const dynamic = "force-dynamic"
 
-async function verifyPaystack(reference: string) {
-  const secret = process.env.PAYSTACK_SECRET_KEY?.trim();
-  if (!secret) {
-    return { ok: false, message: "PAYSTACK_SECRET_KEY missing", data: null };
-  }
-  try {
-    const res = await fetch(
-      `https://api.paystack.co/transaction/verify/${encodeURIComponent(reference)}`,
-      {
-        headers: { Authorization: `Bearer ${secret}` },
-        cache: "no-store",
-      },
-    );
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok || !data?.status) {
-      return {
-        ok: false,
-        message: data?.message || "Verification failed",
-        data: null,
-      };
-    }
-    return { ok: true, message: "Verified", data: data.data };
-  } catch (e: any) {
-    return {
-      ok: false,
-      message: e?.message || "Verification error",
-      data: null,
-    };
-  }
+type PageProps = {
+  searchParams: Promise<{ reference?: string }>
 }
 
 export default async function SuccessPage({ searchParams }: PageProps) {
-  const params = await searchParams;
-  const isMock = !!params.mock;
-  const reference = params.reference?.trim();
-
-  let statusLine = "";
-  let amountNGN: number | null = null;
-
-  if (isMock) {
-    statusLine = "Mock success (no real charge).";
-    // Cart is managed by Zustand store, no need to clear cookie
-  } else if (reference) {
-    // try to verify with Paystack
-    const res = await verifyPaystack(reference);
-    if (res.ok && res.data?.status === "success") {
-      // amount is in kobo from Paystack; convert to NGN
-      amountNGN = Math.round(Number(res.data.amount || 0) / 100);
-      statusLine = "Payment verified.";
-
-      // Cart is cleared by Zustand store after successful checkout
-      // No need to clear cookie here
-
-      // if you stored orders with a reference, mark it PAID
-      const order = await prisma.order.findFirst({ where: { reference } });
-      if (order && order.status !== OrderStatus.PAID) {
-        const updatedOrder = await prisma.order.update({
-          where: { id: order.id },
-          data: {
-            status: OrderStatus.PAID,
-            totalNGN: order.totalNGN || amountNGN || order.totalNGN,
-          },
-        });
-
-        // Create notification for admin
-        try {
-          await prisma.notification.create({
-            data: {
-              type: "ORDER_PAID",
-              title: "New Order Payment",
-              message: `Order #${updatedOrder.reference || updatedOrder.id.slice(0, 8)} has been paid. Total: ₦${updatedOrder.totalNGN.toLocaleString()}`,
-              orderId: updatedOrder.id,
+  const { reference: rawReference } = await searchParams
+  const reference = rawReference?.trim()
+  const session = await auth()
+  const email = session?.user?.email
+
+  const attempt =
+    reference && email
+      ? await prisma.paymentAttempt.findFirst({
+          where: { providerReference: reference, order: { user: { email } } },
+          select: {
+            providerReference: true,
+            order: {
+              select: { id: true, status: true, totalNGN: true },
             },
-          });
-        } catch {
-          // Don't fail if notification creation fails
-        }
-      }
-    } else {
-      statusLine = `Payment not verified: ${res.message || "unknown error"}`;
-    }
-  } else {
-    statusLine = "No payment reference provided.";
-  }
-
-  const verified = isMock || statusLine === "Payment verified.";
+          },
+        })
+      : null
+  const order = attempt?.order
+
+  const paid = order?.status === "PAID"
+  const pending = order?.status === "PENDING"
+  const title = paid
+    ? "Order confirmed"
+    : pending
+      ? "Payment is processing"
+      : "Payment status unavailable"
+  const message = paid
+    ? "Your payment is verified. A receipt is on its way to your inbox."
+    : pending
+      ? "We are waiting for confirmation from Paystack. Your order will update automatically; please do not pay twice."
+      : "We could not match this payment to one of your orders. Check your orders or contact support if payment was taken."
 
   return (
     <MainLayout>
       <section className="min-h-[60vh] bg-background py-16 text-foreground lg:py-24">
         <div className="container mx-auto max-w-xl px-4 sm:px-6">
-          {(reference || isMock) && <ClearCartOnSuccess />}
+          {paid && <ClearCartOnSuccess />}
 
           <div className="border border-border bg-card p-8 text-center sm:p-12">
             <span
               className={`mx-auto flex h-14 w-14 items-center justify-center rounded-full ${
-                verified
+                paid
                   ? "bg-primary/10 text-primary"
-                  : "bg-destructive/10 text-destructive"
+                  : pending
+                    ? "bg-warning/10 text-warning"
+                    : "bg-destructive/10 text-destructive"
               }`}
             >
-              {verified ? (
+              {paid ? (
                 <CheckCircle2 className="h-7 w-7" strokeWidth={1.5} />
+              ) : pending ? (
+                <Clock3 className="h-7 w-7" strokeWidth={1.5} />
               ) : (
                 <AlertCircle className="h-7 w-7" strokeWidth={1.5} />
               )}
             </span>
 
             <h1 className="mt-6 font-serif text-3xl font-light md:text-4xl">
-              {verified ? "Order confirmed" : "Payment status"}
+              {title}
             </h1>
-
             <p className="mt-4 text-sm leading-relaxed text-muted-foreground">
-              {isMock
-                ? "This was a mock success (no real charge). Add Paystack keys in .env to enable live payments."
-                : verified
-                  ? "Your payment is verified. A receipt is on its way to your inbox. Your fragrance follows shortly after."
-                  : statusLine}
+              {message}
             </p>
 
-            <div className="mt-8 space-y-1.5">
-              {reference && (
+            {order && (
+              <div className="mt-8 space-y-1.5">
                 <p className="font-mono text-[11px] uppercase tracking-[0.18em] text-muted-foreground">
                   Reference ·{" "}
-                  <span className="text-foreground">{reference}</span>
+                  <span className="text-foreground">
+                    {attempt.providerReference}
+                  </span>
                 </p>
-              )}
-              {typeof amountNGN === "number" && amountNGN > 0 && (
                 <p className="font-mono text-[11px] uppercase tracking-[0.18em] text-muted-foreground">
                   Amount ·{" "}
                   <span className="text-foreground">
-                    {formatPrice(amountNGN)}
+                    {formatPrice(order.totalNGN)}
                   </span>
                 </p>
-              )}
-            </div>
+              </div>
+            )}
 
             <div className="mt-10 flex flex-col items-center justify-center gap-3 sm:flex-row">
               <Link
@@ -167,16 +111,8 @@ export default async function SuccessPage({ searchParams }: PageProps) {
               </Link>
             </div>
           </div>
-
-          {!isMock && !reference && (
-            <p className="mt-6 text-center text-sm text-muted-foreground">
-              Tip: configure your Paystack <code>callback_url</code> to point
-              here with a <code>?reference=...</code> so we can auto-verify and
-              update your order.
-            </p>
-          )}
         </div>
       </section>
     </MainLayout>
-  );
+  )
 }
diff --git a/app/collections/[brand]/page.tsx b/app/collections/[brand]/page.tsx
index 7f14ef6..b5ffbce 100644
--- a/app/collections/[brand]/page.tsx
+++ b/app/collections/[brand]/page.tsx
@@ -15,7 +15,7 @@ interface BrandPageProps {
 
 async function getDbBrands(): Promise<string[]> {
   const rows = await prisma.product.findMany({
-    where: { deletedAt: null },
+    where: { deletedAt: null, publishStatus: "PUBLISHED" },
     distinct: ["brand"],
     select: { brand: true },
   })
@@ -51,7 +51,11 @@ export default async function BrandCollectionPage({ params }: BrandPageProps) {
     brandName = resolveBrandFromSlug(brand, await getDbBrands())
     if (brandName) {
       const dbProducts = await prisma.product.findMany({
-        where: { brand: brandName, deletedAt: null },
+        where: {
+          brand: brandName,
+          deletedAt: null,
+          publishStatus: "PUBLISHED",
+        },
         orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
       })
       brandProducts = dbProducts.map(mapPrismaProductToCard)
diff --git a/app/collections/featured/page.tsx b/app/collections/featured/page.tsx
index b8936c2..299bc12 100644
--- a/app/collections/featured/page.tsx
+++ b/app/collections/featured/page.tsx
@@ -20,6 +20,7 @@ export default async function FeaturedCollectionsPage() {
     dbProducts = await prisma.product.findMany({
       where: {
         deletedAt: null,
+        publishStatus: "PUBLISHED",
         OR: [
           { isBestseller: true },
           { isNew: true },
diff --git a/app/collections/page.tsx b/app/collections/page.tsx
index a0164e3..224ff8c 100644
--- a/app/collections/page.tsx
+++ b/app/collections/page.tsx
@@ -21,7 +21,7 @@ export default async function CollectionsPage() {
   let dbProducts: Awaited<ReturnType<typeof prisma.product.findMany>> = []
   try {
     dbProducts = await prisma.product.findMany({
-      where: { deletedAt: null },
+      where: { deletedAt: null, publishStatus: "PUBLISHED" },
       orderBy: [
         { isFeatured: "desc" },
         { isBestseller: "desc" },
diff --git a/app/discovery/page.tsx b/app/discovery/page.tsx
index 1038df3..d841b58 100644
--- a/app/discovery/page.tsx
+++ b/app/discovery/page.tsx
@@ -19,13 +19,18 @@ export default async function DiscoveryPage() {
   try {
     const [sampleKitProducts, byNotes] = await Promise.all([
       prisma.product.findMany({
-        where: { deletedAt: null, isFeatured: true },
+        where: {
+          deletedAt: null,
+          publishStatus: "PUBLISHED",
+          isFeatured: true,
+        },
         orderBy: [{ ratingAvg: "desc" }],
         take: 6,
       }),
       prisma.product.findMany({
         where: {
           deletedAt: null,
+          publishStatus: "PUBLISHED",
           OR: [
             { notesTop: { contains: "bergamot", mode: "insensitive" } },
             { notesHeart: { contains: "rose", mode: "insensitive" } },
diff --git a/app/drops/page.tsx b/app/drops/page.tsx
index 177764a..bbd4b6d 100644
--- a/app/drops/page.tsx
+++ b/app/drops/page.tsx
@@ -28,7 +28,11 @@ export default async function DropsPage() {
 
   try {
     const limited = await prisma.product.findMany({
-      where: { isLimited: true, deletedAt: null },
+      where: {
+        isLimited: true,
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+      },
       orderBy: { dropDate: "asc" },
     })
 
diff --git a/app/help/shipping/page.tsx b/app/help/shipping/page.tsx
index 7c79f38..3e1e982 100644
--- a/app/help/shipping/page.tsx
+++ b/app/help/shipping/page.tsx
@@ -65,7 +65,8 @@ export default async function ShippingPage() {
                     <strong>Duration:</strong> 1-2 business days
                   </p>
                   <p className="text-sm text-muted-foreground mb-2">
-                    <strong>Cost:</strong> ₦35,000
+                    <strong>Cost:</strong>{" "}
+                    {formatPrice(shipping.expressShippingFee)}
                   </p>
                   <p className="text-sm text-muted-foreground">
                     For urgent orders, choose express delivery. Available in
diff --git a/app/journal/[slug]/page.tsx b/app/journal/[slug]/page.tsx
index adb4b9b..fd3b7a4 100644
--- a/app/journal/[slug]/page.tsx
+++ b/app/journal/[slug]/page.tsx
@@ -62,7 +62,11 @@ export default async function ArticlePage({
   if (productSlugs.length) {
     try {
       relatedProducts = await prisma.product.findMany({
-        where: { slug: { in: productSlugs }, deletedAt: null },
+        where: {
+          slug: { in: productSlugs },
+          deletedAt: null,
+          publishStatus: "PUBLISHED",
+        },
       })
     } catch {
       // silently degrade
diff --git a/app/page.tsx b/app/page.tsx
index 1ca1ac0..6618b04 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -10,12 +10,11 @@ import { BrandStorySection } from "@/components/home/brand-story-section"
 
 import { ConciergeInvitation } from "@/components/home/concierge-invitation"
 
+import { getCachedHomepageProducts } from "@/lib/cache/catalogue"
 import { isFeatureEnabled } from "@/lib/config/feature-flags"
 
 import { getApprovedFusionHeroFragrance } from "@/lib/hero/fusion-config"
 
-import { prisma } from "@/lib/prisma"
-
 import { getHomepageLayout } from "@/lib/homepage/service"
 
 export const dynamic = "force-dynamic"
@@ -26,36 +25,9 @@ export default async function HomePage() {
     : null
 
   // Fetch featured products from database (best-effort; allow the page to render even if DB isn't ready).
-  let dbProducts: Awaited<ReturnType<typeof prisma.product.findMany>> = []
+  let dbProducts: Awaited<ReturnType<typeof getCachedHomepageProducts>> = []
   try {
-    dbProducts = await prisma.product.findMany({
-      where: {
-        deletedAt: null, // Exclude soft-deleted products
-        OR: [
-          { isBestseller: true },
-          { isNew: true },
-          { isLimited: true },
-          { isFeatured: true },
-        ],
-      },
-      orderBy: [
-        { isFeatured: "desc" },
-        { isBestseller: "desc" },
-        { ratingAvg: "desc" },
-        { createdAt: "desc" },
-      ],
-      take: 8,
-    })
-
-    // No flagged products yet, fall back to the latest additions so the
-    // homepage edit never renders empty.
-    if (dbProducts.length === 0) {
-      dbProducts = await prisma.product.findMany({
-        where: { deletedAt: null },
-        orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
-        take: 8,
-      })
-    }
+    dbProducts = await getCachedHomepageProducts()
   } catch (err) {
     console.error("HomePage: failed to load featured products", err)
     dbProducts = []
diff --git a/app/shop/page.tsx b/app/shop/page.tsx
index 26b0ac1..fcd8e1e 100644
--- a/app/shop/page.tsx
+++ b/app/shop/page.tsx
@@ -5,6 +5,7 @@ import { ProductCard } from '@/components/ui/product-card'
 import { mapPrismaProductToCard } from '@/lib/queries/products'
 import { ShopFiltersForm } from '@/components/shop/shop-filters-form'
 import type { Product } from '@prisma/client'
+import { getCachedPublishedBrands } from '@/lib/cache/catalogue'
 
 const CATEGORY_MAP: Record<string, Product['category']> = {
   perfumes: 'PERFUMES',
@@ -114,18 +115,15 @@ export default async function ShopPage({ searchParams }: { searchParams?: Promis
         where: {
           ...where,
           deletedAt: null,
+          publishStatus: 'PUBLISHED',
         },
         orderBy: orderBy,
         take: 24,
       }),
-      prisma.product.findMany({
-        where: { deletedAt: null },
-        distinct: ['brand'],
-        select: { brand: true },
-      }),
+      getCachedPublishedBrands(),
     ])
     products = productsResult
-    brands = brandRows.map((row) => row.brand).filter(Boolean) as string[]
+    brands = brandRows
   } catch (err) {
     console.error('Shop page data fetch failed:', err)
     fetchError = err instanceof Error ? err : new Error(String(err))
diff --git a/app/sitemap.ts b/app/sitemap.ts
index b148f7f..df6a645 100644
--- a/app/sitemap.ts
+++ b/app/sitemap.ts
@@ -13,6 +13,7 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
     products = await prisma.product.findMany({
       where: {
         deletedAt: null, // Exclude soft-deleted products
+        publishStatus: "PUBLISHED",
       },
       select: {
         slug: true,
@@ -109,4 +110,3 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
 
   return [...staticPages, ...productPages]
 }
-
diff --git a/components/auth/reset-password-form.tsx b/components/auth/reset-password-form.tsx
new file mode 100644
index 0000000..d4e7285
--- /dev/null
+++ b/components/auth/reset-password-form.tsx
@@ -0,0 +1,161 @@
+"use client"
+
+import Link from "next/link"
+import { FormEvent, useState } from "react"
+
+import { Logo } from "@/components/logo"
+
+export function ResetPasswordForm({ token }: { token: string | null }) {
+  const [email, setEmail] = useState("")
+  const [password, setPassword] = useState("")
+  const [confirmation, setConfirmation] = useState("")
+  const [complete, setComplete] = useState(false)
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState("")
+
+  const onSubmit = async (event: FormEvent) => {
+    event.preventDefault()
+    setError("")
+    if (token && password !== confirmation) {
+      setError("Passwords do not match.")
+      return
+    }
+    setIsLoading(true)
+    try {
+      const response = await fetch(
+        token ? "/api/reset-password/confirm" : "/api/reset-password",
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(token ? { token, password } : { email }),
+        },
+      )
+      const data = await response.json()
+      if (!response.ok) {
+        setError(data.error || "The request could not be completed.")
+        return
+      }
+      setComplete(true)
+    } catch {
+      setError("The request could not be completed. Please try again.")
+    } finally {
+      setIsLoading(false)
+    }
+  }
+
+  const heading = token ? "Choose a new password" : "Reset your password"
+  const description = token
+    ? "Use at least eight characters. This reset link can only be used once."
+    : "Enter your email address and we will send you a secure, single-use reset link."
+
+  return (
+    <div
+      data-surface="night"
+      className="veil grain relative flex min-h-screen items-center justify-center bg-background px-4 py-12 text-foreground"
+    >
+      <div className="relative z-10 w-full max-w-md space-y-8 border border-border bg-card/70 p-6 backdrop-blur-sm sm:p-9">
+        <div className="text-center">
+          <div className="mb-8 flex justify-center">
+            <Logo href="/" />
+          </div>
+          <p className="eyebrow">Account recovery</p>
+          <h1 className="mt-3 font-serif text-3xl font-light">{heading}</h1>
+          <p className="mt-2 text-sm text-muted-foreground">{description}</p>
+        </div>
+
+        {complete ? (
+          <div className="space-y-5">
+            <div className="border border-emerald-500/30 bg-emerald-500/10 p-4 text-sm text-emerald-700">
+              {token
+                ? "Your password has been updated. You can now sign in."
+                : "If an account exists for that email, a reset link has been sent."}
+            </div>
+            <Link
+              href="/auth/signin"
+              className="inline-flex h-12 w-full items-center justify-center bg-primary px-6 font-mono text-[11px] uppercase tracking-[0.2em] text-primary-foreground"
+            >
+              Return to sign in
+            </Link>
+          </div>
+        ) : (
+          <form onSubmit={onSubmit} className="space-y-5">
+            {error && (
+              <div className="border border-red-500/30 bg-red-500/10 p-4 text-sm text-red-700">
+                {error}
+              </div>
+            )}
+
+            {token ? (
+              <>
+                <label className="block text-sm font-medium" htmlFor="password">
+                  New password
+                </label>
+                <input
+                  id="password"
+                  type="password"
+                  autoComplete="new-password"
+                  minLength={8}
+                  maxLength={128}
+                  required
+                  value={password}
+                  onChange={(event) => setPassword(event.target.value)}
+                  className="h-12 w-full border border-input bg-background/60 px-3 outline-none focus:border-accent"
+                />
+                <label className="block text-sm font-medium" htmlFor="confirmation">
+                  Confirm new password
+                </label>
+                <input
+                  id="confirmation"
+                  type="password"
+                  autoComplete="new-password"
+                  minLength={8}
+                  maxLength={128}
+                  required
+                  value={confirmation}
+                  onChange={(event) => setConfirmation(event.target.value)}
+                  className="h-12 w-full border border-input bg-background/60 px-3 outline-none focus:border-accent"
+                />
+              </>
+            ) : (
+              <>
+                <label className="block text-sm font-medium" htmlFor="email">
+                  Email address
+                </label>
+                <input
+                  id="email"
+                  type="email"
+                  autoComplete="email"
+                  required
+                  value={email}
+                  onChange={(event) => setEmail(event.target.value)}
+                  className="h-12 w-full border border-input bg-background/60 px-3 outline-none focus:border-accent"
+                />
+              </>
+            )}
+
+            <button
+              type="submit"
+              disabled={isLoading}
+              className="inline-flex h-12 w-full items-center justify-center bg-primary px-6 font-mono text-[11px] uppercase tracking-[0.2em] text-primary-foreground disabled:opacity-50"
+            >
+              {isLoading
+                ? "Processing..."
+                : token
+                  ? "Update password"
+                  : "Send reset link"}
+            </button>
+          </form>
+        )}
+
+        <div className="text-center">
+          <Link
+            href="/auth/signin"
+            className="font-mono text-[11px] uppercase tracking-[0.18em] text-muted-foreground hover:text-foreground"
+          >
+            Back to sign in
+          </Link>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/components/cart/cart-hydrator.tsx b/components/cart/cart-hydrator.tsx
index 8b2b1b2..66a68c0 100644
--- a/components/cart/cart-hydrator.tsx
+++ b/components/cart/cart-hydrator.tsx
@@ -1,19 +1,13 @@
 "use client";
 
 import { useEffect } from "react";
-import { usePathname } from "next/navigation";
 import { useCartStore } from "@/lib/stores/cart-store";
 
 /** Hydrates cart store from server cookie (GET /api/cart/summary). Single source of truth. */
 export function CartHydrator() {
   const syncFromServer = useCartStore((s) => s.syncFromServer);
-  const pathname = usePathname();
   useEffect(() => {
-    // Category URLs immediately redirect to /shop. Avoid starting a request
-    // that WebKit will cancel (and report as a CORS error) mid-navigation.
-    if (pathname.startsWith("/category/") || pathname.startsWith("/account"))
-      return;
-    syncFromServer();
-  }, [pathname, syncFromServer]);
+    void syncFromServer();
+  }, [syncFromServer]);
   return null;
 }
diff --git a/components/cartActions.ts b/components/cartActions.ts
index 06e8fee..5d89d57 100644
--- a/components/cartActions.ts
+++ b/components/cartActions.ts
@@ -25,9 +25,13 @@ function parse(raw?: string | null): CartItem[] {
     return json
       .map((i: any) => ({
         productId: String(i?.productId || ''),
-        quantity: Math.max(1, Number.isFinite(+i?.quantity) ? +i.quantity : 1),
+        quantity: Math.min(
+          99,
+          Math.max(1, Number.isFinite(+i?.quantity) ? +i.quantity : 1),
+        ),
       }))
       .filter((i) => i.productId)
+      .slice(0, 100)
   } catch {
     return []
   }
@@ -45,9 +49,10 @@ async function writeCart(items: CartItem[]) {
   const safe = items
     .map((i) => ({
       productId: String(i.productId),
-      quantity: Math.max(1, Math.floor(i.quantity || 1)),
+      quantity: Math.min(99, Math.max(1, Math.floor(i.quantity || 1))),
     }))
     .filter((i) => i.productId)
+    .slice(0, 100)
 
   const value = encodeURIComponent(JSON.stringify(safe))
   const cookieStore = await cookies()
@@ -65,9 +70,9 @@ export async function addToCart(productId: string, qty = 1) {
   'use server'
   const cart = await getCart()
   const idx = cart.findIndex((x) => x.productId === productId)
-  const addQty = Math.max(1, Math.floor(qty || 1))
+  const addQty = Math.min(99, Math.max(1, Math.floor(qty || 1)))
 
-  if (idx >= 0) cart[idx].quantity += addQty
+  if (idx >= 0) cart[idx].quantity = Math.min(99, cart[idx].quantity + addQty)
   else cart.push({ productId, quantity: addQty })
 
   await writeCart(cart)
@@ -83,7 +88,9 @@ export async function updateCartItem(productId: string, qty: number) {
     newQty <= 0
       ? cart.filter((i) => i.productId !== productId)
       : cart.map((i) =>
-          i.productId === productId ? { ...i, quantity: Math.max(1, newQty) } : i
+          i.productId === productId
+            ? { ...i, quantity: Math.min(99, Math.max(1, newQty)) }
+            : i
         )
 
   await writeCart(next)
diff --git a/components/checkout/checkout-content.tsx b/components/checkout/checkout-content.tsx
index 7fa4adb..1a42e19 100644
--- a/components/checkout/checkout-content.tsx
+++ b/components/checkout/checkout-content.tsx
@@ -20,6 +20,8 @@ import type { Product } from "@/components/ui/product-card";
 
 import type { OrderPayload } from "./payment-form";
 
+import type { BankTransferConfig } from "@/lib/config/payment-methods";
+
 interface OrderItem {
   product: Product;
 
@@ -32,12 +34,24 @@ interface CheckoutContentProps {
   freeShippingThreshold?: number;
 
   flatShippingFee?: number;
+
+  expressShippingFee?: number;
+
+  giftWrapFee?: number;
+
+  bankTransfer?: BankTransferConfig | null;
+
+  paymentsEnabled?: boolean;
 }
 
 export function CheckoutContent({
   items: propItems = [],
   freeShippingThreshold = 500_000,
   flatShippingFee = 15000,
+  expressShippingFee = 35000,
+  giftWrapFee = 2500,
+  bankTransfer = null,
+  paymentsEnabled = false,
 }: CheckoutContentProps) {
   const router = useRouter();
 
@@ -109,10 +123,10 @@ export function CheckoutContent({
       subtotalNGN >= freeShippingThreshold
         ? 0
         : deliveryMethod === "express"
-          ? 35000
+          ? expressShippingFee
           : flatShippingFee;
 
-    const giftWrappingNGN = formData.giftWrapping ? 2500 : 0;
+    const giftWrappingNGN = formData.giftWrapping ? giftWrapFee : 0;
 
     const shippingNGN = baseShippingNGN + giftWrappingNGN;
 
@@ -137,6 +151,10 @@ export function CheckoutContent({
 
       couponId: couponId || null,
 
+      couponCode: couponCode || null,
+
+      deliveryMethod,
+
       isGift: formData.isGift,
 
       giftMessage: formData.giftMessage || undefined,
@@ -153,6 +171,9 @@ export function CheckoutContent({
     formData.giftWrapping,
     freeShippingThreshold,
     flatShippingFee,
+    expressShippingFee,
+    giftWrapFee,
+    couponCode,
   ]);
 
   // Redirect to cart only once the server cart has hydrated and is truly empty.
@@ -222,6 +243,7 @@ export function CheckoutContent({
               <ShippingForm
                 onNext={() => setCurrentStep(2)}
                 standardDeliveryFee={flatShippingFee}
+                expressDeliveryFee={expressShippingFee}
                 freeShippingThreshold={freeShippingThreshold}
                 deliveryMethod={deliveryMethod}
                 onDeliveryMethodChange={(method) => {
@@ -240,6 +262,8 @@ export function CheckoutContent({
                 onComplete={() => setCurrentStep(3)}
                 total={total}
                 orderPayload={orderPayload}
+                bankTransfer={bankTransfer}
+                paymentsEnabled={paymentsEnabled}
               />
             )}
           </div>
@@ -257,6 +281,7 @@ export function CheckoutContent({
               couponCode={couponCode}
               applyCoupon={applyCoupon}
               removeCoupon={removeCoupon}
+              giftWrapFee={giftWrapFee}
               onPaymentClick={() => {
                 const form = document.querySelector(
                   "form[data-payment-form]",
diff --git a/components/checkout/order-summary.tsx b/components/checkout/order-summary.tsx
index 4a3d0f8..efc0b47 100644
--- a/components/checkout/order-summary.tsx
+++ b/components/checkout/order-summary.tsx
@@ -58,6 +58,8 @@ interface OrderSummaryProps {
 
   removeCoupon?: () => void
 
+  giftWrapFee?: number
+
 }
 
 
@@ -84,6 +86,8 @@ export function OrderSummary({
 
   removeCoupon: propRemoveCoupon,
 
+  giftWrapFee = 2500,
+
 }: OrderSummaryProps) {
 
   const [inputCode, setInputCode] = React.useState("")
@@ -308,7 +312,9 @@ export function OrderSummary({
 
               <span className="text-sm font-medium">Luxury gift wrapping</span>
 
-              <p className="text-xs text-muted-foreground">Premium gold ribbon packaging +₦2,500</p>
+              <p className="text-xs text-muted-foreground">
+                Premium gold ribbon packaging +{formatPrice(giftWrapFee)}
+              </p>
 
             </div>
 
@@ -460,7 +466,13 @@ export function OrderSummary({
 
             <span className="text-muted-foreground">Shipping</span>
 
-            <span>{shipping === 0 ? "Free" : formatPrice(formData.giftWrapping ? shipping - 2500 : shipping)}</span>
+            <span>
+              {shipping === 0
+                ? "Free"
+                : formatPrice(
+                    formData.giftWrapping ? shipping - giftWrapFee : shipping,
+                  )}
+            </span>
 
           </div>
 
@@ -476,7 +488,7 @@ export function OrderSummary({
 
               </span>
 
-              <span>+{formatPrice(2500)}</span>
+              <span>+{formatPrice(giftWrapFee)}</span>
 
             </div>
 
diff --git a/components/checkout/payment-form.tsx b/components/checkout/payment-form.tsx
index 87c3d84..7a4b832 100644
--- a/components/checkout/payment-form.tsx
+++ b/components/checkout/payment-form.tsx
@@ -3,9 +3,21 @@
 import * as React from "react";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-import { Lock, ArrowLeft, Loader2, CreditCard } from "lucide-react";
+import {
+  Lock,
+  ArrowLeft,
+  Loader2,
+  Building2,
+  CreditCard,
+  Copy,
+  CheckCheck,
+} from "lucide-react";
 import { toast } from "sonner";
 import { useCheckoutStore } from "@/lib/stores/checkout-store";
+import { formatPrice } from "@/lib/format";
+import Link from "next/link";
+import { ClearCartOnSuccess } from "@/components/checkout/clear-cart-on-success";
+import type { BankTransferConfig } from "@/lib/config/payment-methods";
 
 export interface OrderPayload {
   items: { productId: string; quantity: number; priceNGN: number }[];
@@ -14,6 +26,8 @@ export interface OrderPayload {
   shippingNGN: number;
   totalNGN: number;
   couponId?: string | null;
+  couponCode?: string | null;
+  deliveryMethod: "standard" | "express";
   isGift?: boolean;
   giftMessage?: string;
   giftWrapping?: boolean;
@@ -24,6 +38,32 @@ interface PaymentFormProps {
   onComplete: () => void;
   total: number;
   orderPayload: OrderPayload;
+  bankTransfer?: BankTransferConfig | null;
+  paymentsEnabled?: boolean;
+}
+
+function CopyButton({ text }: { text: string }) {
+  const [copied, setCopied] = React.useState(false);
+  const handleCopy = () => {
+    navigator.clipboard.writeText(text).then(() => {
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2000);
+    });
+  };
+  return (
+    <button
+      type="button"
+      onClick={handleCopy}
+      className="ml-2 inline-flex items-center gap-1 text-xs text-primary hover:text-primary/80 transition-colors"
+    >
+      {copied ? (
+        <CheckCheck className="h-3.5 w-3.5" />
+      ) : (
+        <Copy className="h-3.5 w-3.5" />
+      )}
+      {copied ? "Copied" : "Copy"}
+    </button>
+  );
 }
 
 export function PaymentForm({
@@ -31,9 +71,19 @@ export function PaymentForm({
   onComplete: _onComplete,
   total,
   orderPayload,
+  bankTransfer = null,
+  paymentsEnabled = false,
 }: PaymentFormProps) {
   const { formData } = useCheckoutStore();
+  const checkoutIdempotencyKey = React.useRef(crypto.randomUUID());
+  const paymentIdempotencyKey = React.useRef(crypto.randomUUID());
   const [isProcessing, setIsProcessing] = React.useState(false);
+  const [paymentMethod, setPaymentMethod] = React.useState<
+    "CARD" | "BANK_TRANSFER"
+  >("CARD");
+  const [bankTransferOrder, setBankTransferOrder] = React.useState<{
+    orderId: string;
+  } | null>(null);
 
   const buildPayload = () => {
     const addressLine1 =
@@ -50,10 +100,11 @@ export function PaymentForm({
       shippingNGN: orderPayload.shippingNGN,
       totalNGN: orderPayload.totalNGN,
       couponId: orderPayload.couponId ?? null,
+      couponCode: orderPayload.couponCode ?? null,
+      deliveryMethod: orderPayload.deliveryMethod,
       isGift: orderPayload.isGift,
       giftMessage: orderPayload.giftMessage,
       giftWrapping: orderPayload.giftWrapping,
-      paymentMethod: "CARD" as const,
     };
   };
 
@@ -86,8 +137,11 @@ export function PaymentForm({
     try {
       const createRes = await fetch("/api/checkout/create-order", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(payload),
+        headers: {
+          "Content-Type": "application/json",
+          "Idempotency-Key": checkoutIdempotencyKey.current,
+        },
+        body: JSON.stringify({ ...payload, paymentMethod }),
       });
 
       const createData = await createRes.json();
@@ -97,27 +151,23 @@ export function PaymentForm({
       const orderId = createData.orderId as string;
       if (!orderId) throw new Error("No order ID returned");
 
+      if (paymentMethod === "BANK_TRANSFER") {
+        setBankTransferOrder({ orderId });
+        return;
+      }
+
       const payRes = await fetch("/api/paystack/initialize", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          email: formData.email,
-          amountNGN: total,
-          metadata: {
-            orderId,
-            firstName: formData.firstName,
-            lastName: formData.lastName,
-            phone: formData.phone,
-            address: formData.address,
-            city: formData.city,
-            state: formData.state,
-            postalCode: formData.postalCode,
-          },
-        }),
+        headers: {
+          "Content-Type": "application/json",
+          "Idempotency-Key": paymentIdempotencyKey.current,
+        },
+        body: JSON.stringify({ orderId }),
       });
 
       const payData = await payRes.json();
       if (!payRes.ok || !payData.authorization_url) {
+        paymentIdempotencyKey.current = crypto.randomUUID();
         throw new Error(payData.error || "Failed to initialize payment");
       }
 
@@ -130,23 +180,143 @@ export function PaymentForm({
     }
   };
 
+  // Bank Transfer Confirmation Screen
+  if (bankTransferOrder) {
+    return (
+      <div className="space-y-6">
+        <ClearCartOnSuccess />
+        <Card className="border-success/40 bg-success/10">
+          <CardHeader>
+            <CardTitle className="text-lg flex items-center gap-2">
+              <Building2 className="h-5 w-5 text-green-600" />
+              Transfer Details
+            </CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <p className="text-sm text-muted-foreground">
+              Please transfer the exact amount below to complete your order.
+              Your order will be confirmed once we verify the transfer.
+            </p>
+
+            <div className="rounded-xl border border-border bg-background p-4 space-y-3">
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-muted-foreground">Amount</span>
+                <span className="font-bold text-lg text-primary">
+                  {formatPrice(total)}
+                </span>
+              </div>
+              <div className="border-t border-border pt-3 space-y-2">
+                <div className="flex items-center justify-between">
+                  <span className="text-sm text-muted-foreground">Bank</span>
+                  <span className="text-sm font-medium">
+                    {bankTransfer?.bankName}
+                  </span>
+                </div>
+                <div className="flex items-center justify-between">
+                  <span className="text-sm text-muted-foreground">
+                    Account Name
+                  </span>
+                  <span className="text-sm font-medium">
+                    {bankTransfer?.accountName}
+                  </span>
+                </div>
+                <div className="flex items-center justify-between">
+                  <span className="text-sm text-muted-foreground">
+                    Account Number
+                  </span>
+                  <div className="flex items-center">
+                    <span className="font-mono font-bold text-base">
+                      {bankTransfer?.accountNumber}
+                    </span>
+                    <CopyButton text={bankTransfer?.accountNumber || ""} />
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <p className="text-xs text-muted-foreground">
+              Use your order ID as the transfer narration:{" "}
+              <span className="font-mono text-foreground">
+                {bankTransferOrder.orderId.slice(0, 12).toUpperCase()}
+              </span>
+            </p>
+          </CardContent>
+        </Card>
+
+        <div className="flex gap-3">
+          <Button asChild className="flex-1">
+            <Link href={`/account/orders/${bankTransferOrder.orderId}`}>
+              View My Order
+            </Link>
+          </Button>
+          <Button variant="outline" asChild className="flex-1 bg-transparent">
+            <Link href="/">Continue Shopping</Link>
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <form onSubmit={handleSubmit} className="space-y-6" data-payment-form>
       <Card>
         <CardHeader>
           <CardTitle className="text-lg">Payment</CardTitle>
         </CardHeader>
-        <CardContent>
-          <div className="flex items-start gap-4 rounded-xl border border-primary bg-primary/5 p-4">
-            <CreditCard className="mt-0.5 h-5 w-5 shrink-0 text-primary" />
+        <CardContent className="space-y-3">
+          {/* Card Payment */}
+          <label
+            className={`flex items-center gap-4 rounded-xl border p-4 cursor-pointer transition-colors ${
+              paymentMethod === "CARD"
+                ? "border-primary bg-primary/5"
+                : "border-border hover:border-border/80"
+              } ${!paymentsEnabled ? "cursor-not-allowed opacity-60" : ""}`}
+          >
+            <input
+              type="radio"
+              name="paymentMethod"
+              value="CARD"
+              checked={paymentMethod === "CARD"}
+              onChange={() => setPaymentMethod("CARD")}
+              disabled={!paymentsEnabled}
+              className="h-4 w-4 accent-primary"
+            />
+            <CreditCard className="h-5 w-5 text-primary shrink-0" />
             <div>
               <p className="text-sm font-medium">Pay with Paystack</p>
               <p className="text-xs text-muted-foreground">
-                Card, bank transfer, and USSD, all handled securely on
-                Paystack&apos;s checkout.
+                {paymentsEnabled
+                  ? "Pay securely via Paystack (card, USSD, bank)"
+                  : "Online payment is temporarily disabled for this preview"}
+              </p>
+            </div>
+          </label>
+
+          {/* Bank transfer remains hidden until owner-approved details are configured. */}
+          {bankTransfer && <label
+            className={`flex items-center gap-4 rounded-xl border p-4 cursor-pointer transition-colors ${
+              paymentMethod === "BANK_TRANSFER"
+                ? "border-primary bg-primary/5"
+                : "border-border hover:border-border/80"
+            }`}
+          >
+            <input
+              type="radio"
+              name="paymentMethod"
+              value="BANK_TRANSFER"
+              checked={paymentMethod === "BANK_TRANSFER"}
+              onChange={() => setPaymentMethod("BANK_TRANSFER")}
+              className="h-4 w-4 accent-primary"
+            />
+            <Building2 className="h-5 w-5 text-primary shrink-0" />
+            <div>
+              <p className="font-medium text-sm">Bank Transfer</p>
+              <p className="text-xs text-muted-foreground">
+                Transfer directly to our GTBank account. Order confirmed after
+                verification.
               </p>
             </div>
-          </div>
+          </label>}
         </CardContent>
       </Card>
 
@@ -166,7 +336,14 @@ export function PaymentForm({
           <ArrowLeft className="mr-2 h-4 w-4" />
           Back
         </Button>
-        <Button type="submit" className="flex-1" disabled={isProcessing}>
+        <Button
+          type="submit"
+          className="flex-1"
+          disabled={
+            isProcessing ||
+            (paymentMethod === "CARD" && !paymentsEnabled)
+          }
+        >
           {isProcessing ? (
             <>
               <Loader2 className="mr-2 h-4 w-4 animate-spin" />
diff --git a/components/checkout/shipping-form.tsx b/components/checkout/shipping-form.tsx
index c33e25c..c26634a 100644
--- a/components/checkout/shipping-form.tsx
+++ b/components/checkout/shipping-form.tsx
@@ -37,6 +37,8 @@ interface ShippingFormProps {
 
   standardDeliveryFee: number;
 
+  expressDeliveryFee: number;
+
   freeShippingThreshold: number;
 }
 
@@ -121,6 +123,7 @@ export function ShippingForm({
   deliveryMethod: propDeliveryMethod,
   onDeliveryMethodChange,
   standardDeliveryFee,
+  expressDeliveryFee,
   freeShippingThreshold,
 }: ShippingFormProps) {
   const { formData, updateFormData } = useCheckoutStore();
@@ -384,7 +387,9 @@ export function ShippingForm({
                     </div>
                   </div>
 
-                  <span className="font-medium">₦35,000</span>
+                  <span className="font-medium">
+                    {formatPrice(expressDeliveryFee)}
+                  </span>
                 </div>
               </Label>
             </div>
diff --git a/components/layout/header.tsx b/components/layout/header.tsx
index 99ac2f2..ab9dbea 100644
--- a/components/layout/header.tsx
+++ b/components/layout/header.tsx
@@ -72,6 +72,7 @@ export function Header({
 } = {}) {
   const pathname = usePathname();
   const [isScrolled, setIsScrolled] = React.useState(false);
+  const [hasMounted, setHasMounted] = React.useState(false);
   const cartItemCount = useCartStore((state) => state.getUniqueItemsCount());
   const chrome = useSiteChrome();
 
@@ -85,6 +86,7 @@ export function Header({
   );
 
   React.useEffect(() => {
+    setHasMounted(true);
     const handleScroll = () => setIsScrolled(window.scrollY > 10);
     handleScroll();
     window.addEventListener("scroll", handleScroll, { passive: true });
@@ -262,7 +264,7 @@ export function Header({
                     className="h-[18px] w-[18px] shrink-0"
                     strokeWidth={1.75}
                   />
-                  {cartItemCount > 0 && (
+                  {hasMounted && cartItemCount > 0 && (
                     <span className="absolute right-0.5 top-0.5 flex h-4 min-w-4 items-center justify-center rounded-full bg-accent px-1 font-mono text-[10px] text-accent-foreground">
                       {cartItemCount > 99 ? "99+" : cartItemCount}
                     </span>
diff --git a/components/pdp/compare-drawer.tsx b/components/pdp/compare-drawer.tsx
index 6973460..da0c001 100644
--- a/components/pdp/compare-drawer.tsx
+++ b/components/pdp/compare-drawer.tsx
@@ -4,7 +4,6 @@ import * as React from "react"
 import Link from "next/link"
 import Image from "next/image"
 import { GitCompareArrows, X, ArrowRight } from "lucide-react"
-import { cn } from "@/lib/utils"
 import { useCompareStore, MAX_COMPARE } from "@/lib/stores/compare-store"
 import { trackPdp } from "@/lib/analytics/pdp-events"
 
diff --git a/docs/BACKGROUND_JOBS_RUNBOOK.md b/docs/BACKGROUND_JOBS_RUNBOOK.md
new file mode 100644
index 0000000..78e1af4
--- /dev/null
+++ b/docs/BACKGROUND_JOBS_RUNBOOK.md
@@ -0,0 +1,37 @@
+# Background jobs runbook
+
+The application exposes three authenticated job endpoints. A scheduler may call them with `GET` or
+`POST` and the header `Authorization: Bearer <CRON_SECRET>`. `GET` supports Vercel Cron; `POST`
+supports external schedulers and manual operational checks.
+
+| Job | Endpoint | Recommended cadence |
+| --- | --- | --- |
+| Deliver outbox events | `/api/internal/jobs/process-outbox` | Every minute |
+| Release expired stock reservations | `/api/internal/jobs/release-reservations` | Every 5 minutes |
+| Reconcile pending Paystack payments and refunds | `/api/internal/jobs/reconcile-payments` | Every 5 minutes |
+
+`CRON_SECRET` must be a random value of at least 32 characters and must be configured in both the
+application and scheduler. Never put it in a URL, log, repository file, or browser-side variable.
+
+Each endpoint is safe to call again after scheduler timeouts:
+
+- the outbox claims events and deduplicates provider effects;
+- reservation release conditionally transitions only live reservations;
+- payment reconciliation processes only unresolved attempts and non-terminal refunds, using the same
+  idempotent settlement transactions as signed webhooks.
+
+Alert when a job returns a non-2xx response, has not succeeded within twice its expected cadence, or
+reports failed/review-required work. Payment attempts with a reconciliation failure code and refunds
+in `NEEDS_ATTENTION` require manual comparison with the Paystack dashboard before state is changed.
+The public `/api/health` endpoint reports the aggregate job state. The admin-only
+`/api/v1/admin/status` endpoint reports exact failed outbox events, stale locks, expired
+reservations, overdue payments, and refunds needing attention.
+
+After deployment, verify each job once with a staging secret and confirm its structured success log.
+Do not enable the production schedule until the Paystack test-mode purchase and missed-webhook
+reconciliation scenarios have passed.
+
+Vercel Hobby currently permits each cron only once per day, which is not frequent enough for these
+commerce jobs. On Hobby, use an external scheduler capable of the recommended cadence. On Vercel
+Pro or Enterprise, add the three paths to `vercel.json` at the cadence above. Vercel automatically
+sends `CRON_SECRET` as a bearer token and invokes cron paths with `GET`.
diff --git a/docs/OBSERVABILITY.md b/docs/OBSERVABILITY.md
index e4d29c3..e367504 100644
--- a/docs/OBSERVABILITY.md
+++ b/docs/OBSERVABILITY.md
@@ -11,9 +11,10 @@ internal error detail (server-side only).
 `x-request-id` header. Provider calls (Shopify) accept a correlation id.
 
 ## Health / readiness
-`app/api/health` exists. `lib/env.integrationStatus()` + `registry.providerStatus()` expose which
-integrations/providers are active (safe for an admin panel): database, auth, paystack, resend,
-shopify, ai provider + key presence, whatsapp, sms.
+`/api/health` checks database, Redis, required environment, and background-job readiness without
+exposing backlog counts. `/api/v1/admin/status` is admin-only and adds the exact failed/stale job
+counts needed for remediation. `lib/env.integrationStatus()` + `registry.providerStatus()` expose
+which integrations/providers are active without exposing secret values.
 
 ## Jobs / webhooks / retries
 - `JobRun` (status, attempts, lastError, timestamps) for background work + failed-job retention.
@@ -27,8 +28,11 @@ webhook reconciliation gaps, AI schema-failure/fallback/circuit-open counts + to
 counts.
 
 ## Cache invalidation
-Catalogue reads are DB-live in the local provider (no stale availability). If a cache is added later,
-invalidate on `products/update` + `inventory_levels/update` webhooks.
+Homepage product-card metadata is cached for at most 60 seconds and the shop brand facet for at most
+10 minutes. Both use the `catalogue-metadata` tag and are invalidated by product, category,
+collection, approval, and catalogue-sync mutations. Stock is deliberately excluded from these
+caches; checkout, inventory reservations, product availability, and payment decisions remain
+database-live.
 
 ## Backups & recovery
 - **DB backup:** rely on the managed Postgres provider's PITR/automated backups (Neon/Supabase).
diff --git a/docs/PAYMENT_FLOW.md b/docs/PAYMENT_FLOW.md
index 527bc64..2a0a01d 100644
--- a/docs/PAYMENT_FLOW.md
+++ b/docs/PAYMENT_FLOW.md
@@ -4,9 +4,11 @@
 signature-verified webhook. A browser returning to the success URL never marks payment.
 
 ## Provider abstraction
-`integrations/payments/types.ts` defines `PaymentProvider`. The registry picks:
+`integrations/payments/types.ts` defines `PaymentProvider`. Collection is fail-closed unless
+`PAYMENTS_ENABLED=true` and a secret key is configured. Behind that boundary, the registry picks:
 - `paystackProvider` when `PAYSTACK_SECRET_KEY` is set (test/sandbox key in this project).
-- `mockPaymentProvider` otherwise (deterministic, offline, used in dev/tests).
+- `mockPaymentProvider` otherwise (deterministic and available only to internal dev/test code;
+  public checkout remains disabled).
 
 ## Sequence
 1. **Create order (PENDING).** Server recomputes subtotal from DB prices, validates stock, and
diff --git a/docs/PERFORMANCE_RUNBOOK.md b/docs/PERFORMANCE_RUNBOOK.md
new file mode 100644
index 0000000..083d3f4
--- /dev/null
+++ b/docs/PERFORMANCE_RUNBOOK.md
@@ -0,0 +1,38 @@
+# Performance verification
+
+## Database query budget
+
+Run `npm run test:queries` against a staging database containing representative catalogue, customer,
+and order volumes. The check measures repeated bounded catalogue/admin queries and fails when any
+query exceeds the default one-second p95 budget.
+
+Optional controls:
+
+- `QUERY_PERF_ITERATIONS` (default `10`, maximum `50`);
+- `QUERY_P95_BUDGET_MS` (default `1000`).
+
+This check is read-only. A small development dataset can prove query correctness but cannot certify
+production scale; rerun it after staging has representative data.
+
+On Windows, if Prisma reports that no credentials are available in the security package, use the
+operating system CA store before running the check:
+
+```powershell
+$env:NODE_OPTIONS="--use-system-ca"
+npm.cmd run test:queries
+```
+
+## HTTP smoke load
+
+Start a production build, then run `npm run test:load`. The script requests the homepage, shop, and
+bounded products API with 10 concurrent workers and fails above a 1% error rate or a two-second p95.
+
+Optional controls:
+
+- `LOAD_TEST_BASE_URL` (default `http://localhost:3000`);
+- `LOAD_TEST_CONCURRENCY` (default `10`, maximum `50`);
+- `LOAD_TEST_REQUESTS` (default `100`, maximum `2000`);
+- `LOAD_TEST_P95_BUDGET_MS` (default `2000`).
+
+Never point a high-concurrency run at production without an approved test window. Use staging for
+capacity work and increase concurrency gradually while observing database connections and errors.
diff --git a/docs/PRODUCTION_READINESS_PLAN.md b/docs/PRODUCTION_READINESS_PLAN.md
new file mode 100644
index 0000000..a758d49
--- /dev/null
+++ b/docs/PRODUCTION_READINESS_PLAN.md
@@ -0,0 +1,789 @@
+# Production Readiness and System Architecture Plan
+
+## Executive summary
+
+The application is now a hardened staging candidate, but it is not launch-certified. The original
+payment-integrity risks around browser-supplied prices, discounts, shipping, payment amounts, and
+Paystack metadata have been addressed on this branch. The remaining launch gates are provider
+integration testing, scheduler/deployment configuration, owner-supplied production configuration,
+and staging certification.
+
+The recommended target is a **modular monolith**:
+
+- one Next.js application and deployment;
+- one PostgreSQL database;
+- clearly separated business modules inside the application;
+- Redis for distributed rate limits, short-lived cache entries, and optionally job coordination;
+- durable background processing through an outbox and worker;
+- external providers behind adapters rather than called directly from pages and route handlers.
+
+This is the appropriate architecture for the current product and team size. Microservices would add
+deployment, networking, observability, and consistency problems without solving the present trust
+and reliability issues.
+
+## Implementation status
+
+Work started on branch `codex/production-readiness`.
+
+Completed in the first hardening milestone:
+
+- public catalogue queries now require published, non-deleted products;
+- checkout recalculates product prices, coupons, shipping, gift wrapping, and totals on the server;
+- Paystack initialization requires authentication and a customer-owned pending order;
+- Paystack receives the stored order amount and a server-generated reference;
+- the Paystack webhook validates signature, reference, status, amount, currency, and payment method;
+- the paid transition and non-negative stock decrement are transactionally guarded;
+- the checkout success page is read-only and scoped to the signed-in customer;
+- placeholder bank-transfer details were removed and transfer is fail-closed until configured;
+- checkout and payment initialization use the distributed rate-limiter abstraction;
+- critical cookie-authenticated payment mutations validate request origin;
+- production readiness now requires database, authentication, Paystack, Resend, and Redis settings;
+- baseline security headers were added;
+- checkout creation now uses a customer-scoped idempotency key and request fingerprint;
+- Paystack initialization now uses a durable `PaymentAttempt` ledger, with safe retry behavior;
+- webhook processing resolves the server-created payment attempt rather than trusting provider
+  metadata as the source of truth;
+- each successful attempt is recorded before the order transition, including duplicate successful
+  payments that require operational review;
+- checkout now atomically reserves available stock and records an inventory movement;
+- card reservations expire after 30 minutes and bank-transfer reservations after 24 hours;
+- a protected, idempotent expiration job releases stock exactly once;
+- successful payment finalizes the reservation without decrementing stock twice, while legacy
+  pending orders retain a safe conditional-decrement path;
+- concurrent database tests prove only one checkout can claim the final available units;
+- the payment transaction now writes separate durable outbox events for receipts, admin
+  notifications, and referral qualification;
+- missed Paystack webhooks can now be reconciled through a protected scheduled job that verifies
+  pending attempts with the provider and reuses the webhook's idempotent settlement transaction;
+- order fulfilment now follows a conditional state machine instead of arbitrary admin updates;
+  pending cancellation atomically releases inventory and abandons unresolved payments, while every
+  admin transition requires fresh authorization, a reason, and an audit record;
+- full refund initiation now creates a durable, one-per-order refund record before calling the
+  provider, requires admin authorization, reason, rate limiting, origin validation, and an
+  idempotency key, and moves the order to refund-pending only after provider acceptance;
+- refund initiation fails to manual review when Paystack accepted the request but the local commit
+  is uncertain, preventing an automatic retry from issuing a second refund;
+- signed refund lifecycle events now update the durable refund, order, payment, lifetime-spend, tier,
+  and loyalty ledgers atomically; duplicate deliveries are harmless and the payment reconciliation
+  job also polls non-terminal refunds when webhooks are missed;
+- payment collection is disabled by default and requires an explicit environment switch plus
+  provider credentials; checkout creation, Paystack initialization, the storefront payment control,
+  and administrative refunds all fail closed while it is disabled;
+- the protected outbox worker claims work safely, recovers stale locks, retries with exponential
+  backoff, and retains exhausted events in a failed state;
+- receipt delivery uses provider idempotency, admin notifications use a database deduplication key,
+  and customer-controlled receipt fields are HTML escaped;
+- password reset now uses hashed, single-use, one-hour tokens with one active token per customer;
+- the reset request and confirmation flows validate origin, normalize email, and apply IP/email
+  rate limits without exposing whether an account exists;
+- signup and credential login now apply abuse limits, normalize email case, and share the eight
+  character minimum password policy;
+- public contact, newsletter, drop-notification, coupon-preview, and review mutations now validate
+  request origin and use the distributed rate-limiter abstraction;
+- contact emails now HTML-escape every customer-controlled field and use structured, redacted
+  failure logging;
+- the storefront review endpoint now requires a verified paid purchase, rejects duplicate reviews,
+  and relies on a database unique constraint to close concurrent duplicate-submission races;
+- pull requests and main-branch pushes now run locked dependency installation, production
+  dependency auditing, Prisma validation and migrations against temporary PostgreSQL, seed
+  validation, TypeScript, lint, the complete test suite, and a production build;
+- process-global session-duration state was removed in favor of a deterministic 24-hour session;
+- Next.js, Auth.js, Prisma, Resend, PostCSS, Sharp, and lodash were upgraded or pinned to patched
+  versions; the production dependency audit now reports zero vulnerabilities;
+- payment-matching, checkout-idempotency, publication, origin, and shipping-policy regression tests
+  were added;
+- unbounded account and admin reads are paginated, catalogue/category count N+1 queries are
+  aggregated, and cart input is bounded;
+- remaining cart, address, and messaging-preference mutations now have origin checks and
+  distributed rate limits;
+- public health reports database, Redis, environment, and background-job readiness without exposing
+  backlog details; the protected admin status endpoint includes actionable backlog counts;
+- homepage product-card metadata and the shop brand facet use a conservative tagged data cache with
+  mutation invalidation; inventory and transactional decisions remain database-live;
+- read-only query and bounded HTTP load checks are documented and available as `npm run
+  test:queries` and `npm run test:load`;
+- Prisma schema validation, TypeScript, lint, 379 unit/integration tests, and the production build
+  pass on this branch; all 15 staging migrations are applied with zero schema drift.
+
+Still required before launch:
+
+- browser/Paystack integration tests and production staging certification;
+- production Redis credentials followed by a successful `/api/health` readiness check;
+- deployment-time scheduler registration for reservation expiry, outbox delivery, and payment
+  reconciliation (the authenticated routes support both Vercel Cron `GET` and external `POST`);
+- managed Postgres backup/PITR confirmation and a staging restore drill;
+- external error monitoring is intentionally deferred by the owner; structured logging remains in
+  place, but this is still an accepted operational gap;
+- owner-supplied provider credentials, business details, brand assets, and approved policies.
+
+## Audit findings
+
+This is the original audit list. Items completed on `codex/production-readiness` are marked
+**resolved on branch**; they still require migration and staging certification before release.
+
+### Critical
+
+1. **Resolved on branch:** checkout previously accepted browser-supplied discount, shipping, coupon
+   ID, total, and payment amount.
+2. **Resolved on branch:** Paystack initialization previously accepted arbitrary client metadata and
+   was not tied to a server-owned order.
+3. **Resolved on branch:** the webhook previously trusted `metadata.orderId` without comparing the
+   paid amount and currency with the stored order and payment attempt.
+4. **Resolved on branch:** the checkout success page previously mutated payment state during a GET
+   request.
+5. **Resolved on branch:** password-reset emails pointed to a reset route that did not exist, and
+   there was no endpoint that applied a new password.
+6. Bank transfer displays the placeholder account number `0123456789`.
+7. **Resolved on branch:** the production dependency audit previously reported high, moderate, and
+   critical vulnerabilities; it now reports zero production vulnerabilities.
+
+### High priority
+
+1. **Resolved on branch:** there was no reliable stock reservation or atomic non-negative stock
+   decrement.
+2. **Resolved on branch:** public catalogue queries did not consistently require
+   `publishStatus = PUBLISHED`.
+3. **Resolved on branch:** critical commerce/authentication, exposed public-form, cart, address, and
+   messaging-preference mutations validate request origin.
+4. **Resolved in code, deployment pending:** signup, password reset, order creation, payment
+   initialization, credential login, cart, address, and preference mutations use the rate-limiter
+   abstraction; production still requires the configured Redis backend for cross-instance
+   durability.
+5. **Resolved on branch:** contact-form values are HTML escaped before email rendering.
+6. Required production configuration does not fail fast at startup.
+7. Missing favicon, PWA icons, and Open Graph image cause broken metadata assets.
+8. **Partially resolved on branch:** CI now gates unit/integration, dependency, build, seed, and
+   migration checks; the existing browser workflow still needs consolidation with account,
+   accessibility, and payment certification coverage.
+
+## Target modular-monolith design
+
+```text
+Browser
+  |
+  +-- Storefront
+  +-- Customer account
+  +-- Admin application
+  |
+  v
+Next.js delivery layer
+  |
+  +-- Authentication and authorization middleware
+  +-- Request validation, origin checks, and rate limits
+  +-- Route handlers, server actions, and server-rendered pages
+  |
+  v
+Application modules
+  |
+  +-- Identity
+  +-- Catalogue
+  +-- Cart
+  +-- Checkout
+  +-- Payments
+  +-- Inventory
+  +-- Orders
+  +-- Promotions
+  +-- Customers and loyalty
+  +-- Notifications
+  +-- Admin and audit
+  |
+  +------------------+--------------------+--------------------+
+  |                  |                    |                    |
+  v                  v                    v                    v
+PostgreSQL         Redis              Job worker         Provider adapters
+source of truth    cache/limits       outbox consumer    Paystack/Resend/etc.
+```
+
+The modules are logical boundaries within one codebase. They should communicate through explicit
+application services and domain events, not by importing arbitrary database operations from one
+another.
+
+### Suggested module layout
+
+```text
+modules/
+  identity/
+    application/
+    domain/
+    infrastructure/
+  catalogue/
+  checkout/
+  payments/
+  inventory/
+  orders/
+  promotions/
+  notifications/
+  admin/
+
+integrations/
+  paystack/
+  resend/
+  redis/
+
+app/
+  api/               Delivery layer only
+  ...                Pages and layouts
+
+lib/platform/
+  database/
+  cache/
+  jobs/
+  logging/
+  security/
+```
+
+An immediate reorganization is not required. New and repaired flows can adopt these boundaries
+incrementally, then older code can be moved as it is touched.
+
+## Where the system-design concepts belong
+
+### Caching
+
+Caching belongs primarily on read-heavy, non-authoritative data.
+
+Good cache candidates:
+
+- published product cards and collection pages;
+- category and brand lists;
+- product recommendations;
+- approved review summaries;
+- journal content;
+- expensive, non-personalized search results;
+- short-lived provider capability/status information.
+
+Data that should not be trusted from cache when making a transaction:
+
+- price used for checkout;
+- stock availability used to accept an order;
+- coupon validity and remaining uses;
+- payment status;
+- order ownership or authorization;
+- loyalty balance used for redemption;
+- user roles.
+
+Recommended policy:
+
+```text
+Read catalogue
+  -> check framework/Redis cache
+  -> query PostgreSQL on miss
+  -> cache only the public DTO
+
+Create order
+  -> always read authoritative prices, stock, coupon, and user from PostgreSQL
+  -> never trust cached transactional values
+```
+
+Use short TTLs and explicit invalidation after product publication, price changes, stock changes, and
+review moderation. Include a schema/version component in keys, for example
+`catalogue:v2:product:{slug}`. Do not cache raw Prisma models containing private fields.
+
+### Background jobs
+
+Background jobs belong after a transaction when work is important but should not delay or break the
+customer request.
+
+Suitable jobs:
+
+- order receipts and status emails;
+- admin payment notifications;
+- abandoned-checkout reminders;
+- expired inventory-reservation release;
+- payment reconciliation;
+- newsletter batches;
+- product-feed synchronization;
+- low-stock alerts;
+- search-index updates;
+- analytics aggregation;
+- image processing;
+- webhook reprocessing.
+
+Use the transactional outbox pattern:
+
+```text
+Database transaction
+  1. Mark order PAID
+  2. Finalize inventory
+  3. Insert ORDER_PAID outbox event
+  4. Commit
+
+Worker
+  1. Claim event
+  2. Send receipt
+  3. Notify admin
+  4. Retry transient failures
+  5. Mark event completed
+```
+
+This avoids the dual-write problem where the database commits but the email or queue operation is
+lost. Jobs need unique idempotency keys, bounded retries, exponential backoff with jitter, and a
+dead-letter/manual-review state.
+
+### Rate limiting
+
+Rate limiting belongs at the delivery boundary, before expensive provider calls or database writes.
+Redis-backed counters are required when the application has more than one process or serverless
+instance.
+
+Apply limits to:
+
+- sign-in attempts by IP and normalized email;
+- signup by IP and device/session;
+- password-reset requests by IP and normalized email;
+- password-reset token attempts;
+- order creation by authenticated user and IP;
+- payment initialization by order, user, and IP;
+- coupon guessing by user and IP;
+- contact and newsletter forms;
+- review creation and reporting;
+- search and AI endpoints;
+- drop and back-in-stock subscriptions;
+- admin exports and bulk operations.
+
+Rate limiting is not authorization. An allowed request must still pass authentication, ownership,
+validation, and business rules.
+
+### Idempotency
+
+Idempotency belongs anywhere a request may be repeated because of double-clicks, retries, timeouts,
+provider redelivery, or worker crashes.
+
+Required idempotency boundaries:
+
+- checkout/order creation;
+- Paystack initialization;
+- Paystack webhook handling;
+- payment reconciliation;
+- refund creation;
+- inventory finalization and release;
+- loyalty accrual and reversal;
+- coupon use increment;
+- email and notification jobs;
+- admin bulk actions;
+- external catalogue synchronization.
+
+Use database uniqueness as the final enforcement mechanism:
+
+```text
+PaymentAttempt.providerReference       UNIQUE
+WebhookReceipt(provider, eventId)      UNIQUE
+OutboxEvent.idempotencyKey             UNIQUE
+InventoryMovement(sourceType, sourceId, productId) UNIQUE
+LoyaltyLedger(reason, orderId, userId) UNIQUE where appropriate
+```
+
+For browser-initiated checkout, accept an `Idempotency-Key` generated once per checkout attempt.
+Store the key, authenticated user, request fingerprint, and resulting order. Reusing the key with a
+different payload must be rejected.
+
+### Transactions and consistency
+
+PostgreSQL transactions should protect business invariants that must succeed or fail together.
+
+The payment-confirmation transaction should include:
+
+1. lock or conditionally update the payment attempt;
+2. conditionally transition the order from a payable state to `PAID`;
+3. finalize or decrement stock without allowing it to become negative;
+4. increment coupon usage once;
+5. write loyalty movements once;
+6. record inventory movements;
+7. create outbox events;
+8. commit.
+
+External network requests should generally occur outside database transactions. Verify Paystack
+first, then open the short database transaction that records the verified result.
+
+### Inventory reservations and concurrency control
+
+The current check-now/decrement-later flow can oversell. The preferred design is:
+
+```text
+AVAILABLE -> RESERVED -> SOLD
+                     \-> RELEASED or EXPIRED
+```
+
+An `InventoryReservation` records the order, product, quantity, expiry, and state. Checkout reserves
+stock for a limited period. Successful payment converts the reservation to sold; a scheduled job
+releases expired reservations.
+
+For an initial simpler implementation, use an atomic conditional decrement and verify that the
+number of affected rows is correct. Never read stock and later write a decrement without a database
+condition or lock.
+
+### Retries, timeouts, and circuit breakers
+
+Every external call needs an explicit timeout. Retry only transient failures and only when the
+operation is idempotent.
+
+- Paystack verification: short timeout, bounded retries, reconciliation fallback.
+- Paystack initialization: idempotency key and bounded retry.
+- Resend: background retry, not request blocking.
+- Shopify/catalogue synchronization: cursor checkpointing and bounded retry.
+- AI/search providers: strict timeout, budget, and graceful fallback.
+
+A simple in-process circuit breaker or shared provider-health state may be added once provider
+failures become operationally significant. It is less urgent than correct timeouts and idempotency.
+
+### Event-driven design inside the monolith
+
+The system can use domain events without becoming microservices. Events should describe completed
+facts, such as:
+
+- `OrderCreated`
+- `PaymentConfirmed`
+- `OrderPaid`
+- `InventoryLow`
+- `OrderShipped`
+- `RefundCompleted`
+- `ProductPublished`
+
+Durable events go through the outbox. Purely local, non-critical reactions can use in-process
+handlers. Business-critical effects must not rely only on an in-memory event emitter.
+
+### Observability
+
+Observability cuts across every module.
+
+Required signals:
+
+- structured logs with request and correlation IDs;
+- errors grouped by route, module, and provider;
+- request latency and error rate;
+- Paystack initialization and webhook success rates;
+- payment amount/currency mismatch alerts;
+- payment reconciliation backlog;
+- job queue depth, age, retries, and dead letters;
+- inventory reservation expiry and negative-stock alerts;
+- authentication and rate-limit anomalies;
+- database pool and query health;
+- email delivery failures;
+- deployment and migration markers.
+
+Logs must redact tokens, passwords, secrets, addresses, full webhook payloads, and unnecessary
+personal information.
+
+### Audit logging
+
+Audit logging is different from diagnostic logging. It records who changed business state, what was
+changed, and why.
+
+Audit:
+
+- refunds and payment overrides;
+- order-status changes;
+- manual bank-transfer confirmation;
+- inventory adjustments;
+- price and publication changes;
+- coupon changes;
+- admin role changes;
+- customer-data exports;
+- newsletter sends.
+
+Audit records should be append-only from the application and contain actor, action, resource,
+before/after summary, timestamp, request ID, and optional reason.
+
+### Security boundaries
+
+Each request should pass through these layers:
+
+```text
+TLS
+ -> security headers
+ -> request size limit
+ -> origin/CSRF validation
+ -> rate limit
+ -> authentication
+ -> authorization and ownership
+ -> schema validation
+ -> application service
+ -> transaction/business invariants
+ -> redacted response and logging
+```
+
+Admin UI protection is not sufficient; every admin route handler and server action must authorize
+independently.
+
+### Health, readiness, and graceful degradation
+
+Use separate endpoints:
+
+- liveness: process is running;
+- readiness: required database/configuration is available;
+- dependency status: provider and worker health for admin/monitoring use.
+
+Missing `DATABASE_URL`, authentication secrets, production URL, or required payment configuration
+must prevent a production deployment from becoming ready. Optional services may degrade gracefully,
+but checkout should fail closed when payment or transactional storage is unavailable.
+
+### Backups and disaster recovery
+
+Production readiness includes:
+
+- automated PostgreSQL backups and point-in-time recovery;
+- documented retention;
+- a restore test, not just backup creation;
+- migration rollback/forward-fix procedure;
+- secret rotation procedure;
+- defined recovery time and recovery point objectives;
+- reconciliation after recovery so payment and order state can be compared with Paystack.
+
+## Payment system design
+
+### Correct request flow
+
+```text
+1. Browser submits product IDs, quantities, address, delivery method, coupon code, and gift choices.
+2. Server authenticates the customer.
+3. Server loads published products and authoritative prices from PostgreSQL.
+4. Server validates coupon, shipping, gift cost, stock, and order limits.
+5. Server creates Order, OrderItems, reservations, and PaymentAttempt in a transaction.
+6. Server initializes Paystack with the stored amount, currency, and server reference.
+7. Browser redirects to the Paystack authorization URL.
+8. Paystack sends a signed webhook.
+9. Server verifies signature, reference, status, amount, and currency.
+10. Server atomically marks payment/order paid, finalizes stock, and writes outbox events.
+11. Worker sends receipt and admin notification.
+12. Success page reads customer-owned order status and never mutates it.
+13. Scheduled reconciliation checks unresolved payment attempts against Paystack.
+```
+
+### Recommended data model additions
+
+```text
+PaymentAttempt
+- id
+- orderId
+- provider
+- providerReference UNIQUE
+- idempotencyKey UNIQUE
+- expectedAmount
+- expectedCurrency
+- status
+- providerTransactionId
+- initializedAt
+- verifiedAt
+- failureCode
+
+InventoryReservation
+- id
+- orderId
+- productId
+- quantity
+- status
+- expiresAt
+- createdAt
+
+InventoryMovement
+- id
+- productId
+- delta
+- reason
+- sourceType
+- sourceId
+- createdAt
+
+OutboxEvent
+- id
+- type
+- aggregateType
+- aggregateId
+- payload
+- idempotencyKey UNIQUE
+- status
+- attempts
+- availableAt
+- processedAt
+- lastErrorRedacted
+
+PasswordResetToken
+- id
+- userId
+- tokenHash UNIQUE
+- expiresAt
+- usedAt
+- createdAt
+```
+
+Recommended order states:
+
+```text
+PENDING_PAYMENT
+PAYMENT_REVIEW
+PAID
+PROCESSING
+SHIPPED
+DELIVERED
+CANCELLED
+PAYMENT_FAILED
+REFUND_PENDING
+REFUNDED
+```
+
+State transitions must be validated centrally rather than allowing arbitrary status updates.
+
+## Implementation roadmap: easiest to hardest
+
+### Phase 0: Release lockdown and configuration
+
+Difficulty: easy  
+Estimated engineering time: 0.5 to 1 day
+
+- disable unsafe card payment until the redesigned flow is complete;
+- disable bank transfer until genuine details and verification procedures are approved;
+- add missing favicon, PWA icons, and Open Graph image;
+- enforce required production environment variables;
+- prevent localhost production metadata;
+- self-host fonts;
+- remove development mock behaviour from production.
+
+### Phase 1: Catalogue, SEO, and baseline security
+
+Difficulty: easy to medium  
+Estimated engineering time: 2 to 4 days
+
+- enforce published-product filtering everywhere;
+- remove transactional pages from the sitemap;
+- add security headers and origin checks;
+- add request-size limits and common error handling;
+- escape HTML email values;
+- upgrade vulnerable production dependencies;
+- establish Redis-backed rate limiting;
+- add readiness checks.
+
+### Phase 2: Identity and account recovery
+
+Difficulty: medium  
+Estimated engineering time: 2 to 4 days
+
+- implement complete password reset;
+- store reset-token hashes;
+- normalize email consistently;
+- align signup and login password policies;
+- add login, signup, and reset abuse protection;
+- remove process-global session-duration state;
+- add security-event logging and session invalidation.
+
+### Phase 3: Payment and checkout redesign
+
+Difficulty: hard  
+Estimated engineering time: 5 to 8 days
+
+- make prices, coupons, shipping, and totals server-owned;
+- add `PaymentAttempt` and checkout idempotency;
+- initialize Paystack only from the stored order;
+- validate webhook amount, currency, status, and reference;
+- use constant-time signature comparison;
+- make the success page read-only;
+- add refund flows;
+- add real Paystack test-mode integration tests.
+
+### Phase 4: Inventory and order reliability
+
+Difficulty: hard  
+Estimated engineering time: 3 to 6 days
+
+- add reservations or atomic conditional stock updates;
+- add inventory movements;
+- centralize order-state transitions;
+- add expiry/release jobs;
+- make coupon, loyalty, and stock effects idempotent;
+- enforce cancelled, refund-pending, and refunded state transitions;
+- implement provider-driven refund initiation and completion on top of the new refund states.
+
+### Phase 5: Durable background work and operations
+
+Difficulty: medium to hard  
+Estimated engineering time: 3 to 6 days
+
+- add outbox events and worker execution;
+- move email and non-critical notifications out of webhooks;
+- add retry and dead-letter handling;
+- add audit logging;
+- add provider timeouts and bounded retries;
+- add operational dashboards and alerts;
+- document payment, outage, oversell, and rollback runbooks.
+
+### Phase 6: CI/CD and release certification
+
+Difficulty: hard  
+Estimated engineering time: 4 to 7 days
+
+Require on every pull request:
+
+- clean dependency installation;
+- Prisma validation and migrations against temporary PostgreSQL;
+- seed validation;
+- TypeScript and ESLint;
+- unit and integration tests;
+- payment security regression tests;
+- production build;
+- Playwright storefront and account flows;
+- accessibility audit;
+- production dependency audit.
+
+Then certify staging with Paystack test mode before enabling production credentials.
+
+### Phase 7: Business and compliance readiness
+
+Difficulty: primarily owner/legal/operations work  
+Estimated elapsed time: 3 to 10 days in parallel
+
+- legal identity and business address;
+- real bank details and manual verification procedure;
+- Paystack merchant approval;
+- verified email domain with SPF, DKIM, and DMARC;
+- support contacts and service hours;
+- approved shipping, returns, cancellation, and refund policies;
+- privacy, cookies, analytics, retention, and customer-rights review;
+- product-authenticity claims and inventory source of truth;
+- tax and invoice requirements.
+
+## Architecture decisions
+
+### Remain a modular monolith
+
+Keep the modular monolith while:
+
+- one team owns most of the system;
+- the catalogue and transaction load fit a shared PostgreSQL deployment;
+- modules can be deployed together;
+- independent scaling is not an established bottleneck;
+- operational simplicity is more valuable than independent services.
+
+### Consider extracting a service only when evidence exists
+
+A module becomes a service candidate when it has several of these properties:
+
+- a separate team and release cadence;
+- materially different scaling needs;
+- strong isolation or compliance requirements;
+- a stable, explicit API boundary;
+- repeated deployment contention in the monolith;
+- operational maturity for distributed tracing, service authentication, and failure handling.
+
+Likely future candidates are notifications/workers, search, or AI workloads. Payments and orders
+should not be separated merely for architectural fashion; their consistency is easier to preserve
+inside the monolith and shared transaction boundary.
+
+## Production definition of done
+
+The store is ready for a controlled production launch only when:
+
+- the browser cannot control transactional prices or payment identity;
+- payment amount, currency, status, and reference are verified server-side;
+- webhook and job replays cannot duplicate business effects;
+- stock cannot become negative through concurrent checkout;
+- password reset works end to end;
+- drafts and private product fields cannot reach public surfaces;
+- required rate limits and authorization checks use production infrastructure;
+- required configuration fails closed;
+- production dependencies have no unaccepted high-severity findings;
+- migrations, backups, restore, monitoring, and rollback have been tested;
+- staging has completed a real Paystack test-mode purchase and refund;
+- CI blocks regression of the critical invariants;
+- the owner has approved all customer-facing commercial and legal information.
+
+The expected total for one experienced engineer is approximately four to seven weeks, excluding
+external approvals and business/legal content. The safest launch is a small controlled release after
+staging certification, followed by close monitoring and daily payment reconciliation.
diff --git a/emails/sendOrderStatusUpdate.ts b/emails/sendOrderStatusUpdate.ts
index a360909..21ad701 100644
--- a/emails/sendOrderStatusUpdate.ts
+++ b/emails/sendOrderStatusUpdate.ts
@@ -159,11 +159,48 @@ const statusContent: Record<OrderStatus, (order: OrderLike, orderRef: string) =>
       `),
     }
   },
+
+  CANCELLED: (order, orderRef) => ({
+    subject: `Order Cancelled: #${orderRef}`,
+    html: baseLayout(`
+      <h2 style="margin: 0 0 16px; font-size: 22px; font-weight: 600; color: ${BRAND_COLOR};">Order Cancelled</h2>
+      <p style="margin: 0 0 12px; color: #555;">Hello ${order.user.name || "there"},</p>
+      <p style="color: #555;">Your order has been cancelled. No fulfilment will take place for this order.</p>
+      ${orderBox(orderRef, order.totalNGN)}
+      ${ctaButton("View Order", `${siteUrl}/account/orders/${order.id}`)}
+    `),
+  }),
+
+  REFUND_PENDING: (order, orderRef) => ({
+    subject: `Refund Processing: #${orderRef}`,
+    html: baseLayout(`
+      <h2 style="margin: 0 0 16px; font-size: 22px; font-weight: 600; color: ${BRAND_COLOR};">Refund Processing</h2>
+      <p style="margin: 0 0 12px; color: #555;">Hello ${order.user.name || "there"},</p>
+      <p style="color: #555;">A refund for this order is being processed. We will update you when the payment provider confirms completion.</p>
+      ${orderBox(orderRef, order.totalNGN)}
+    `),
+  }),
+
+  REFUNDED: (order, orderRef) => ({
+    subject: `Refund Completed: #${orderRef}`,
+    html: baseLayout(`
+      <h2 style="margin: 0 0 16px; font-size: 22px; font-weight: 600; color: ${BRAND_COLOR};">Refund Completed</h2>
+      <p style="margin: 0 0 12px; color: #555;">Hello ${order.user.name || "there"},</p>
+      <p style="color: #555;">The payment provider has confirmed your refund. Your bank may take additional time to display the funds.</p>
+      ${orderBox(orderRef, order.totalNGN)}
+    `),
+  }),
 }
 
 export async function sendOrderStatusUpdate(order: OrderLike, newStatus: OrderStatus) {
   const orderRef = order.reference || order.id.slice(0, 8).toUpperCase()
 
+  if (
+    process.env.NODE_ENV === "test" &&
+    process.env.ALLOW_TEST_EMAIL_DELIVERY !== "true"
+  ) {
+    return
+  }
   const resendKey = process.env.RESEND_API_KEY
   if (!resendKey) {
     console.log("[EMAIL] Order status update (no API key):", {
@@ -179,12 +216,15 @@ export async function sendOrderStatusUpdate(order: OrderLike, newStatus: OrderSt
   const resolved = await resolveEmailTemplate(`order_status_${newStatus}`, { customerName: order.user.name || "Customer", orderRef, total: `₦${order.totalNGN.toLocaleString()}` }, fallback.subject, fallback.html)
 
   try {
-    await resend.emails.send({
+    const result = await resend.emails.send({
       from: process.env.NEWSLETTER_FROM_EMAIL || "Fádé Essence <onboarding@resend.dev>",
       to: order.user.email,
       subject: resolved.subject,
       html: resolved.html,
     })
+    if (result.error) {
+      throw new Error(`Resend rejected status delivery: ${result.error.name}`)
+    }
     console.log("[EMAIL] Order status update sent:", order.user.email, newStatus)
   } catch (error) {
     console.error("[EMAIL] Failed to send order status update:", error)
diff --git a/emails/sendReceipt.ts b/emails/sendReceipt.ts
index 0957ddf..cfc217b 100644
--- a/emails/sendReceipt.ts
+++ b/emails/sendReceipt.ts
@@ -1,5 +1,7 @@
 // emails/sendReceipt.ts
 import { Resend } from "resend"
+import { escapeHtml } from "@/lib/security/html"
+import { logger } from "@/lib/observability/logger"
 import { resolveEmailTemplate } from "@/lib/email-templates/service"
 
 type OrderLike = {
@@ -14,29 +16,36 @@ type OrderLike = {
   coupon?: { code: string } | null
 }
 
-export async function sendReceipt(order: OrderLike) {
+export async function sendReceipt(order: OrderLike, idempotencyKey?: string) {
+  if (
+    process.env.NODE_ENV === "test" &&
+    process.env.ALLOW_TEST_EMAIL_DELIVERY !== "true"
+  ) {
+    logger.warn("receipt_email_skipped", {
+      orderId: order.id,
+      reason: "email delivery disabled in tests",
+    })
+    return
+  }
   const resendKey = process.env.RESEND_API_KEY
   if (!resendKey) {
-    console.log('[EMAIL] Receipt (no API key):', {
-      to: order.user.email,
-      subject: `Fádé Order #${order.reference || order.id.slice(-6)} receipt`,
-      summary: {
-        subtotal: order.subtotalNGN,
-        discount: order.discountNGN,
-        total: order.totalNGN,
-        items: order.items.map(i => `${i.quantity} × ${i.product.name}`)
-      }
+    logger.warn("receipt_email_skipped", {
+      orderId: order.id,
+      reason: "RESEND_API_KEY missing",
     })
     return
   }
   const resend = new Resend(resendKey)
 
   const orderRef = order.reference || order.id.slice(0, 8)
+  const safeOrderRef = escapeHtml(orderRef)
+  const safeCustomerName = escapeHtml(order.user.name || "Customer")
+  const safeCouponCode = order.coupon ? escapeHtml(order.coupon.code) : null
   const itemsHtml = order.items
     .map(
       (item) => `
       <tr>
-        <td style="padding: 10px; border-bottom: 1px solid #eee;">${item.quantity} × ${item.product.name}</td>
+        <td style="padding: 10px; border-bottom: 1px solid #eee;">${item.quantity} × ${escapeHtml(item.product.name)}</td>
         <td style="padding: 10px; border-bottom: 1px solid #eee; text-align: right;">₦${item.product.priceNGN.toLocaleString()}</td>
         <td style="padding: 10px; border-bottom: 1px solid #eee; text-align: right;">₦${(item.quantity * item.product.priceNGN).toLocaleString()}</td>
       </tr>
@@ -57,11 +66,11 @@ export async function sendReceipt(order: OrderLike) {
         </div>
         <div style="background: #f8f9fa; padding: 30px; border-radius: 0 0 8px 8px;">
           <h2 style="color: #2f3e33; margin-top: 0;">Order Confirmation</h2>
-          <p>Hello ${order.user.name || "Customer"},</p>
+          <p>Hello ${safeCustomerName},</p>
           <p>Thank you for your order! We've received your payment and your order is being processed.</p>
           
           <div style="background: white; padding: 20px; border-radius: 8px; margin: 20px 0;">
-            <p style="margin: 0 0 10px 0;"><strong>Order Reference:</strong> ${orderRef}</p>
+            <p style="margin: 0 0 10px 0;"><strong>Order Reference:</strong> ${safeOrderRef}</p>
             <p style="margin: 0 0 10px 0;"><strong>Order Date:</strong> ${order.createdAt.toLocaleDateString()}</p>
             
             <table style="width: 100%; margin-top: 20px; border-collapse: collapse;">
@@ -84,7 +93,7 @@ export async function sendReceipt(order: OrderLike) {
               </div>
               ${order.discountNGN > 0 ? `
               <div style="display: flex; justify-content: space-between; margin-bottom: 10px; color: #28a745;">
-                <span>Discount${order.coupon ? ` (${order.coupon.code})` : ""}:</span>
+                <span>Discount${safeCouponCode ? ` (${safeCouponCode})` : ""}:</span>
                 <span>-₦${order.discountNGN.toLocaleString()}</span>
               </div>
               ` : ""}
@@ -108,15 +117,21 @@ export async function sendReceipt(order: OrderLike) {
 
   const resolved = await resolveEmailTemplate("order_receipt", { customerName: order.user.name || "Customer", orderRef, total: `₦${order.totalNGN.toLocaleString()}` }, `Order Confirmation - Order #${orderRef}`, html)
   try {
-    await resend.emails.send({
+    const result = await resend.emails.send({
       from: process.env.NEWSLETTER_FROM_EMAIL || "Fádé Essence <onboarding@resend.dev>",
       to: order.user.email,
       subject: resolved.subject,
       html: resolved.html,
-    })
-    console.log("[EMAIL] Receipt sent:", order.user.email)
+    }, idempotencyKey ? { idempotencyKey } : undefined)
+    if (result.error) {
+      throw new Error(`Resend rejected receipt delivery: ${result.error.name}`)
+    }
+    logger.info("receipt_email_sent", { orderId: order.id })
   } catch (error) {
-    console.error("[EMAIL] Failed to send receipt:", error)
+    logger.error("receipt_email_failed", {
+      orderId: order.id,
+      internal: String(error),
+    })
     throw error
   }
 }
diff --git a/integrations/commerce/local/index.ts b/integrations/commerce/local/index.ts
index 78be9af..28b0299 100644
--- a/integrations/commerce/local/index.ts
+++ b/integrations/commerce/local/index.ts
@@ -73,7 +73,11 @@ async function reprice(cartId: string): Promise<CommerceCart> {
   const productIds = [...new Set(lines.map((l) => l.productId))]
   const products = productIds.length
     ? await prisma.product.findMany({
-        where: { id: { in: productIds }, deletedAt: null },
+        where: {
+          id: { in: productIds },
+          deletedAt: null,
+          publishStatus: 'PUBLISHED',
+        },
         select: { id: true, name: true, priceNGN: true, stock: true },
       })
     : []
@@ -112,7 +116,10 @@ export const localCommerce: CommerceProvider = {
   catalog: {
     async listProducts(query: CatalogQuery): Promise<Page<CommerceProduct>> {
       const limit = Math.min(Math.max(query.limit ?? 24, 1), 60)
-      const and: any[] = [{ deletedAt: null }]
+      const and: any[] = [
+        { deletedAt: null },
+        { publishStatus: 'PUBLISHED' },
+      ]
       if (query.brand) and.push({ brand: { equals: query.brand, mode: 'insensitive' } })
       if (query.family) and.push({ fragranceFamily: { equals: query.family, mode: 'insensitive' } })
       if (query.occasion) and.push({ occasion: { contains: query.occasion, mode: 'insensitive' } })
@@ -149,11 +156,15 @@ export const localCommerce: CommerceProvider = {
       return { items, nextCursor: hasMore ? rows[limit - 1].id : null }
     },
     async getProductBySlug(slug: string): Promise<CommerceProduct | null> {
-      const p = await prisma.product.findFirst({ where: { slug, deletedAt: null } })
+      const p = await prisma.product.findFirst({
+        where: { slug, deletedAt: null, publishStatus: 'PUBLISHED' },
+      })
       return p ? toProduct(p) : null
     },
     async getProductById(id: string): Promise<CommerceProduct | null> {
-      const p = await prisma.product.findFirst({ where: { id, deletedAt: null } })
+      const p = await prisma.product.findFirst({
+        where: { id, deletedAt: null, publishStatus: 'PUBLISHED' },
+      })
       return p ? toProduct(p) : null
     },
     async listCollections() {
@@ -260,7 +271,11 @@ export const localCommerce: CommerceProvider = {
     async revalidate(lines: CartLineInput[]) {
       const ids = [...new Set(lines.map((l) => l.productId))]
       const products = await prisma.product.findMany({
-        where: { id: { in: ids }, deletedAt: null },
+        where: {
+          id: { in: ids },
+          deletedAt: null,
+          publishStatus: 'PUBLISHED',
+        },
         select: { id: true, stock: true },
       })
       const map = new Map(products.map((p) => [p.id, p.stock]))
diff --git a/integrations/payments/mock/index.ts b/integrations/payments/mock/index.ts
index 1d918ee..635bf50 100644
--- a/integrations/payments/mock/index.ts
+++ b/integrations/payments/mock/index.ts
@@ -42,6 +42,32 @@ export const mockPaymentProvider: PaymentProvider = {
     }
   },
 
+  async refund(input) {
+    if (!isSupportedCurrency(input.currency)) {
+      throw new AppError('CURRENCY_INVALID')
+    }
+    if (!Number.isInteger(input.amountNGN) || input.amountNGN <= 0) {
+      throw new AppError('VALIDATION_ERROR', {
+        message: 'Invalid refund amount.',
+      })
+    }
+    return {
+      providerRefundId: `mock_refund_${input.reference}`,
+      status: 'processing',
+      amountNGN: input.amountNGN,
+      currency: input.currency,
+    }
+  },
+
+  async verifyRefund(providerRefundId, expected) {
+    return {
+      providerRefundId,
+      status: 'processing',
+      amountNGN: expected.amountNGN,
+      currency: expected.currency,
+    }
+  },
+
   verifyWebhook(rawBody: string, signature: string | null): WebhookVerification {
     if (!signature) return { valid: false }
     const computed = crypto.createHmac('sha512', MOCK_SECRET).update(rawBody).digest('hex')
diff --git a/integrations/payments/paystack/index.ts b/integrations/payments/paystack/index.ts
index 527b2e6..490b9e1 100644
--- a/integrations/payments/paystack/index.ts
+++ b/integrations/payments/paystack/index.ts
@@ -11,6 +11,7 @@ import type {
   VerifyPaymentResult,
   WebhookVerification,
   PaymentStatus,
+  ProviderRefundStatus,
 } from '../types'
 
 const PAYSTACK_BASE = 'https://api.paystack.co'
@@ -64,6 +65,23 @@ function statusFromPaystack(s: string | undefined): PaymentStatus {
   }
 }
 
+function refundStatusFromPaystack(
+  status: string | undefined,
+): ProviderRefundStatus {
+  switch (status) {
+    case 'processing':
+      return 'processing'
+    case 'needs-attention':
+      return 'needs_attention'
+    case 'processed':
+      return 'processed'
+    case 'failed':
+      return 'failed'
+    default:
+      return 'pending'
+  }
+}
+
 export const paystackProvider: PaymentProvider = {
   name: 'paystack',
 
@@ -113,6 +131,61 @@ export const paystackProvider: PaymentProvider = {
     }
   },
 
+  async refund(input) {
+    if (!isSupportedCurrency(input.currency)) {
+      throw new AppError('CURRENCY_INVALID')
+    }
+    if (!Number.isInteger(input.amountNGN) || input.amountNGN <= 0) {
+      throw new AppError('VALIDATION_ERROR', {
+        message: 'Invalid refund amount.',
+      })
+    }
+    const body = await paystackFetch('/refund', {
+      method: 'POST',
+      body: JSON.stringify({
+        transaction: input.reference,
+        amount: input.amountNGN * 100,
+        currency: input.currency,
+        customer_note: input.customerNote,
+        merchant_note: input.merchantNote,
+      }),
+    })
+    const data = body?.data
+    if (data?.id == null) {
+      throw new AppError('PROVIDER_ERROR', {
+        internal: 'Paystack refund response missing id',
+      })
+    }
+    return {
+      providerRefundId: String(data.id),
+      status: refundStatusFromPaystack(data.status),
+      amountNGN:
+        typeof data.amount === 'number'
+          ? Math.round(data.amount / 100)
+          : input.amountNGN,
+      currency: data.currency ?? input.currency,
+    }
+  },
+
+  async verifyRefund(providerRefundId) {
+    const body = await paystackFetch(
+      `/refund/${encodeURIComponent(providerRefundId)}`,
+      { method: 'GET' },
+    )
+    const data = body?.data
+    if (data?.id == null || typeof data.amount !== 'number' || !data.currency) {
+      throw new AppError('PROVIDER_ERROR', {
+        internal: 'Paystack refund verification response incomplete',
+      })
+    }
+    return {
+      providerRefundId: String(data.id),
+      status: refundStatusFromPaystack(data.status),
+      amountNGN: Math.round(data.amount / 100),
+      currency: data.currency,
+    }
+  },
+
   verifyWebhook(rawBody: string, signature: string | null): WebhookVerification {
     if (!signature) return { valid: false }
     let computed: string
diff --git a/integrations/payments/policy.ts b/integrations/payments/policy.ts
new file mode 100644
index 0000000..b7dfa77
--- /dev/null
+++ b/integrations/payments/policy.ts
@@ -0,0 +1,23 @@
+export type PaymentProviderMode = "mock" | "paystack"
+
+export function isPaymentCollectionEnabled(
+  enabled: boolean,
+  secretKey: string | undefined,
+): boolean {
+  return enabled && Boolean(secretKey)
+}
+
+/**
+ * Never let a local/test process contact Paystack with a live secret.
+ * Test keys remain usable in production-mode staging builds.
+ */
+export function selectPaymentProviderMode(
+  secretKey: string | undefined,
+  nodeEnv: string,
+): PaymentProviderMode {
+  if (!secretKey) return "mock"
+  if (secretKey.startsWith("sk_live_") && nodeEnv !== "production") {
+    return "mock"
+  }
+  return "paystack"
+}
diff --git a/integrations/payments/types.ts b/integrations/payments/types.ts
index 7570d46..867606a 100644
--- a/integrations/payments/types.ts
+++ b/integrations/payments/types.ts
@@ -38,6 +38,30 @@ export interface VerifyPaymentResult {
   amountMatches: boolean
 }
 
+export type ProviderRefundStatus =
+  | 'pending'
+  | 'processing'
+  | 'needs_attention'
+  | 'processed'
+  | 'failed'
+
+export interface RefundPaymentInput {
+  reference: string
+  amountNGN: number
+  currency: string
+  customerNote: string
+  merchantNote: string
+}
+
+export interface RefundPaymentResult {
+  providerRefundId: string
+  status: ProviderRefundStatus
+  amountNGN: number
+  currency: string
+}
+
+export type VerifyRefundResult = RefundPaymentResult
+
 export interface WebhookVerification {
   valid: boolean
   event?: string
@@ -54,6 +78,13 @@ export interface PaymentProvider {
   initialize(input: InitPaymentInput): Promise<InitPaymentResult>
   /** Server-side verification. The ONLY authoritative source of 'paid'. */
   verify(reference: string, expected: { amountNGN: number; currency: string }): Promise<VerifyPaymentResult>
+  /** Initiate a full or partial provider refund. Amount is whole naira at this boundary. */
+  refund(input: RefundPaymentInput): Promise<RefundPaymentResult>
+  /** Fetch the provider's authoritative refund status. */
+  verifyRefund(
+    providerRefundId: string,
+    expected: { amountNGN: number; currency: string },
+  ): Promise<VerifyRefundResult>
   /** Verify a raw webhook body + signature and normalize it. Constant-time comparison. */
   verifyWebhook(rawBody: string, signature: string | null): WebhookVerification
 }
diff --git a/integrations/registry.ts b/integrations/registry.ts
index 1fca2a3..1176def 100644
--- a/integrations/registry.ts
+++ b/integrations/registry.ts
@@ -9,6 +9,10 @@ import { shopifyCommerce } from './commerce/shopify'
 import type { PaymentProvider } from './payments/types'
 import { paystackProvider } from './payments/paystack'
 import { mockPaymentProvider } from './payments/mock'
+import {
+  isPaymentCollectionEnabled,
+  selectPaymentProviderMode,
+} from './payments/policy'
 import type { SearchProvider } from './search/types'
 import { postgresSearch } from './search/postgres'
 import { aiServices } from './ai'
@@ -22,8 +26,8 @@ export function getCommerce(): CommerceProvider {
 }
 
 export function getPayments(): PaymentProvider {
-  // Live Paystack only when a secret key is present; otherwise the deterministic mock (dev/test).
-  return env.PAYSTACK_SECRET_KEY ? paystackProvider : mockPaymentProvider
+  const mode = selectPaymentProviderMode(env.PAYSTACK_SECRET_KEY, env.NODE_ENV)
+  return mode === 'paystack' ? paystackProvider : mockPaymentProvider
 }
 
 export function getSearch(): SearchProvider {
@@ -38,7 +42,12 @@ export function getAi(): AiServices {
 export function providerStatus() {
   return {
     commerce: getCommerce().name,
-    payments: getPayments().name,
+    payments: isPaymentCollectionEnabled(
+      env.PAYMENTS_ENABLED,
+      env.PAYSTACK_SECRET_KEY,
+    )
+      ? getPayments().name
+      : 'disabled',
     search: getSearch().name,
     ai: env.AI_PROVIDER,
     conciergeAi: conciergeProviderStatus(),
diff --git a/integrations/search/postgres.ts b/integrations/search/postgres.ts
index cc7bef4..8fc866c 100644
--- a/integrations/search/postgres.ts
+++ b/integrations/search/postgres.ts
@@ -16,7 +16,10 @@ export const postgresSearch: SearchProvider = {
     const f = query.filters ?? {}
     const q = query.q?.trim()
 
-    const and: any[] = [{ deletedAt: null }]
+    const and: any[] = [
+      { deletedAt: null },
+      { publishStatus: 'PUBLISHED' },
+    ]
     if (f.brand) and.push({ brand: { equals: f.brand, mode: 'insensitive' } })
     if (f.family) and.push({ fragranceFamily: { equals: f.family, mode: 'insensitive' } })
     if (f.occasion) and.push({ occasion: { contains: f.occasion, mode: 'insensitive' } })
diff --git a/lib/approvals/service.ts b/lib/approvals/service.ts
index fa05332..79e3684 100644
--- a/lib/approvals/service.ts
+++ b/lib/approvals/service.ts
@@ -5,6 +5,7 @@ import { prisma } from '@/lib/prisma'
 import { AppError } from '@/lib/http/errors'
 import { writeAudit } from '@/lib/audit'
 import type { ApprovalStatus } from '@prisma/client'
+import { invalidateCatalogueCache } from '@/lib/cache/catalogue'
 
 export type ApprovalAction =
   | 'refund'
@@ -43,6 +44,7 @@ const EXECUTORS: Partial<Record<ApprovalAction, Executor>> = {
     const productId = String(payload.productId ?? '')
     if (!productId) throw new AppError('VALIDATION_ERROR', { message: 'publish requires payload.productId' })
     await prisma.product.update({ where: { id: productId }, data: { publishStatus: 'PUBLISHED' } })
+    invalidateCatalogueCache()
   },
   stock_adjust: async (payload) => {
     const productId = String(payload.productId ?? '')
@@ -55,6 +57,7 @@ const EXECUTORS: Partial<Record<ApprovalAction, Executor>> = {
     const priceNGN = Number(payload.priceNGN ?? -1)
     if (!productId || !Number.isInteger(priceNGN) || priceNGN < 0) throw new AppError('VALIDATION_ERROR', { message: 'price_change requires productId + non-negative integer priceNGN' })
     await prisma.product.update({ where: { id: productId }, data: { priceNGN } })
+    invalidateCatalogueCache()
   },
 }
 
diff --git a/lib/auth.ts b/lib/auth.ts
index 9896f61..8b609a1 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -7,19 +7,14 @@ import { z } from 'zod'
 
 const credsSchema = z.object({
   email: z.string().email(),
-  password: z.string().min(6),
+  password: z.string().min(1).max(128),
   rememberMe: z.string().optional(),
 })
 
-// Dynamic session maxAge: set in authorize, read by session config (remember me = 30 days, else 24h)
-let dynamicSessionMaxAge = 30 * 24 * 60 * 60 // default 30 days
-
 export const { auth, handlers, signIn, signOut } = NextAuth({
   session: {
     strategy: 'jwt',
-    get maxAge() {
-      return dynamicSessionMaxAge
-    },
+    maxAge: 24 * 60 * 60,
   },
   trustHost: true,
   debug: process.env.NODE_ENV !== 'production',
@@ -35,13 +30,11 @@ export const { auth, handlers, signIn, signOut } = NextAuth({
       async authorize(credentials) {
         const parsed = credsSchema.safeParse(credentials)
         if (!parsed.success) return null
-        const { email, password, rememberMe } = parsed.data
-
-        // Set session duration before returning (used by session.maxAge getter)
-        dynamicSessionMaxAge =
-          rememberMe === 'true' ? 30 * 24 * 60 * 60 : 24 * 60 * 60 // 30 days vs 24 hours
-
-        const user = await prisma.user.findUnique({ where: { email } })
+        const { password } = parsed.data
+        const email = parsed.data.email.toLowerCase().trim()
+        const user = await prisma.user.findFirst({
+          where: { email: { equals: email, mode: 'insensitive' } },
+        })
         if (!user || !user.passwordHash) return null
 
         const ok = await bcrypt.compare(password, user.passwordHash)
diff --git a/lib/auth/password-reset.ts b/lib/auth/password-reset.ts
new file mode 100644
index 0000000..f687ea2
--- /dev/null
+++ b/lib/auth/password-reset.ts
@@ -0,0 +1,51 @@
+import crypto from "crypto"
+import bcrypt from "bcryptjs"
+import { z } from "zod"
+
+import { prisma } from "@/lib/prisma"
+
+export const PASSWORD_RESET_TTL_MS = 60 * 60 * 1000
+
+export const newPasswordSchema = z.string().min(8).max(128)
+
+export function generatePasswordResetToken(): string {
+  return crypto.randomBytes(32).toString("base64url")
+}
+
+export function passwordResetTokenHash(token: string): string {
+  return crypto.createHash("sha256").update(token).digest("hex")
+}
+
+export function passwordResetExpiry(now = new Date()): Date {
+  return new Date(now.getTime() + PASSWORD_RESET_TTL_MS)
+}
+
+export async function consumePasswordResetToken(
+  token: string,
+  newPassword: string,
+  now = new Date(),
+): Promise<boolean> {
+  const tokenHash = passwordResetTokenHash(token)
+  const passwordHash = await bcrypt.hash(newPassword, 12)
+
+  return prisma.$transaction(async (tx) => {
+    const resetToken = await tx.passwordResetToken.findUnique({
+      where: { tokenHash },
+      select: { id: true, userId: true, expiresAt: true, usedAt: true },
+    })
+    if (!resetToken || resetToken.usedAt || resetToken.expiresAt <= now) return false
+
+    const consumed = await tx.passwordResetToken.updateMany({
+      where: { id: resetToken.id, usedAt: null, expiresAt: { gt: now } },
+      data: { usedAt: now },
+    })
+    if (consumed.count !== 1) return false
+
+    await tx.user.update({
+      where: { id: resetToken.userId },
+      data: { passwordHash },
+    })
+    await tx.session.deleteMany({ where: { userId: resetToken.userId } })
+    return true
+  })
+}
diff --git a/lib/cache/catalogue.ts b/lib/cache/catalogue.ts
new file mode 100644
index 0000000..a29c307
--- /dev/null
+++ b/lib/cache/catalogue.ts
@@ -0,0 +1,84 @@
+import { revalidateTag, unstable_cache } from "next/cache"
+
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+
+export const CATALOGUE_CACHE_TAG = "catalogue-metadata"
+
+export const getCachedHomepageProducts = unstable_cache(
+  async () => {
+    const select = {
+      id: true,
+      name: true,
+      slug: true,
+      brand: true,
+      priceNGN: true,
+      oldPriceNGN: true,
+      images: true,
+      ratingAvg: true,
+      ratingCount: true,
+      isBestseller: true,
+      isNew: true,
+      isLimited: true,
+    } as const
+    const featured = await prisma.product.findMany({
+      where: {
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+        OR: [
+          { isBestseller: true },
+          { isNew: true },
+          { isLimited: true },
+          { isFeatured: true },
+        ],
+      },
+      orderBy: [
+        { isFeatured: "desc" },
+        { isBestseller: "desc" },
+        { ratingAvg: "desc" },
+        { createdAt: "desc" },
+      ],
+      take: 8,
+      select,
+    })
+    if (featured.length > 0) return featured
+    return prisma.product.findMany({
+      where: { deletedAt: null, publishStatus: "PUBLISHED" },
+      orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
+      take: 8,
+      select,
+    })
+  },
+  ["homepage-products-v1"],
+  { revalidate: 60, tags: [CATALOGUE_CACHE_TAG] },
+)
+
+export const getCachedPublishedBrands = unstable_cache(
+  async () => {
+    const rows = await prisma.product.findMany({
+      where: {
+        brand: { not: null },
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+      },
+      distinct: ["brand"],
+      select: { brand: true },
+      orderBy: { brand: "asc" },
+    })
+    return rows.map((row) => row.brand).filter((brand): brand is string => !!brand)
+  },
+  ["published-brands-v1"],
+  { revalidate: 600, tags: [CATALOGUE_CACHE_TAG] },
+)
+
+export function invalidateCatalogueCache() {
+  try {
+    revalidateTag(CATALOGUE_CACHE_TAG, "max")
+  } catch (error) {
+    // The database mutation has already succeeded. Let the short TTL recover
+    // rather than converting a successful write into a misleading 500 response.
+    logger.warn("catalogue_cache_invalidation_failed", {
+      internal: String(error),
+    })
+  }
+}
diff --git a/lib/catalogue/public-product.ts b/lib/catalogue/public-product.ts
new file mode 100644
index 0000000..c99dd73
--- /dev/null
+++ b/lib/catalogue/public-product.ts
@@ -0,0 +1,21 @@
+import type { Prisma } from "@prisma/client"
+
+/**
+ * The minimum visibility boundary for every customer-facing product query.
+ *
+ * Keep this separate from availability: published products may remain visible
+ * while out of stock, but drafts, archived products, and soft-deleted products
+ * must never appear on public surfaces or enter a transactional cart.
+ */
+export const PUBLIC_PRODUCT_FILTER = {
+  deletedAt: null,
+  publishStatus: "PUBLISHED",
+} satisfies Prisma.ProductWhereInput
+
+export function publicProductWhere(
+  conditions: Prisma.ProductWhereInput = {},
+): Prisma.ProductWhereInput {
+  return {
+    AND: [PUBLIC_PRODUCT_FILTER, conditions],
+  }
+}
diff --git a/lib/catalogue/sync.ts b/lib/catalogue/sync.ts
index 8c31374..e3aa22d 100644
--- a/lib/catalogue/sync.ts
+++ b/lib/catalogue/sync.ts
@@ -9,6 +9,7 @@ import { getCommerce } from '@/integrations/registry'
 import { writeAudit } from '@/lib/audit'
 import { logger } from '@/lib/observability/logger'
 import type { CommerceProduct } from '@/integrations/commerce/types'
+import { invalidateCatalogueCache } from '@/lib/cache/catalogue'
 
 export interface SyncIssue {
   slug: string
@@ -50,6 +51,9 @@ export async function syncCatalog(opts: { apply?: boolean; limit?: number } = {}
 
   if (apply) {
     await writeAudit({ actorRole: 'ADMIN', action: 'catalogue.sync', targetType: 'Catalogue', metadata: { ...report, issues: report.issues.length } })
+    if (report.created > 0 || report.updated > 0) {
+      invalidateCatalogueCache()
+    }
   }
   logger.info('catalogue_sync', { ...report, issues: report.issues.length })
   return report
diff --git a/lib/checkout/idempotency.ts b/lib/checkout/idempotency.ts
new file mode 100644
index 0000000..b6e579a
--- /dev/null
+++ b/lib/checkout/idempotency.ts
@@ -0,0 +1,42 @@
+import crypto from "crypto"
+
+export interface CheckoutFingerprintInput {
+  addressLine1: string
+  city: string
+  state: string
+  phone: string
+  items: Array<{ productId: string; quantity: number }>
+  couponCode?: string | null
+  deliveryMethod: "standard" | "express"
+  isGift: boolean
+  giftMessage?: string | null
+  giftWrapping: boolean
+  paymentMethod: "CARD" | "BANK_TRANSFER"
+}
+
+export function isValidIdempotencyKey(value: string | null): value is string {
+  return Boolean(value && /^[A-Za-z0-9_-]{16,128}$/.test(value))
+}
+
+/** Hash only fields that affect the resulting order; browser-supplied display totals are excluded. */
+export function checkoutRequestHash(input: CheckoutFingerprintInput): string {
+  const canonical = {
+    addressLine1: input.addressLine1.trim(),
+    city: input.city.trim(),
+    state: input.state.trim(),
+    phone: input.phone.trim(),
+    items: input.items
+      .map((item) => ({
+        productId: item.productId,
+        quantity: item.quantity,
+      }))
+      .sort((a, b) => a.productId.localeCompare(b.productId)),
+    couponCode: input.couponCode?.trim().toUpperCase() || null,
+    deliveryMethod: input.deliveryMethod,
+    isGift: input.isGift,
+    giftMessage: input.giftMessage?.trim() || null,
+    giftWrapping: input.giftWrapping,
+    paymentMethod: input.paymentMethod,
+  }
+  return crypto.createHash("sha256").update(JSON.stringify(canonical)).digest("hex")
+}
diff --git a/lib/config/commerce.ts b/lib/config/commerce.ts
index ad340f3..2272597 100644
--- a/lib/config/commerce.ts
+++ b/lib/config/commerce.ts
@@ -8,6 +8,8 @@ export interface ShippingPolicy {
   currency: string
   freeShippingThreshold: number // in minor-unit-free NGN (whole naira), as used across the app
   flatShippingFee: number
+  expressShippingFee: number
+  giftWrapFee: number
 }
 
 export interface LoyaltyTier {
@@ -34,6 +36,8 @@ export function getCommerceConfig(): CommerceConfig {
       currency: env.COMMERCE_CURRENCY,
       freeShippingThreshold: env.COMMERCE_FREE_SHIPPING_THRESHOLD_NGN,
       flatShippingFee: env.COMMERCE_FLAT_SHIPPING_NGN,
+      expressShippingFee: env.COMMERCE_EXPRESS_SHIPPING_NGN,
+      giftWrapFee: env.COMMERCE_GIFT_WRAP_NGN,
     },
     // Preserves the thresholds already present in the Paystack webhook, now as config.
     loyaltyTiers: [
@@ -54,6 +58,21 @@ export function computeShipping(subtotalNGN: number): number {
   return shipping.flatShippingFee
 }
 
+export function computeCheckoutShipping(
+  subtotalNGN: number,
+  deliveryMethod: 'standard' | 'express',
+  giftWrapping: boolean,
+): number {
+  const { shipping } = getCommerceConfig()
+  const delivery =
+    subtotalNGN >= shipping.freeShippingThreshold
+      ? 0
+      : deliveryMethod === 'express'
+        ? shipping.expressShippingFee
+        : shipping.flatShippingFee
+  return delivery + (giftWrapping ? shipping.giftWrapFee : 0)
+}
+
 /** Resolve loyalty tier for a lifetime spend using configured thresholds. */
 export function resolveLoyaltyTier(lifetimeSpendNGN: number): LoyaltyTier['key'] {
   const tiers = getCommerceConfig().loyaltyTiers
diff --git a/lib/config/payment-methods.ts b/lib/config/payment-methods.ts
new file mode 100644
index 0000000..ea6d1eb
--- /dev/null
+++ b/lib/config/payment-methods.ts
@@ -0,0 +1,19 @@
+import { env } from "@/lib/env"
+
+export interface BankTransferConfig {
+  accountName: string
+  bankName: string
+  accountNumber: string
+}
+
+/** Manual transfer is hidden and rejected unless every owner-approved field is present. */
+export function getBankTransferConfig(): BankTransferConfig | null {
+  if (!env.BANK_TRANSFER_ENABLED) return null
+
+  const accountName = env.BANK_TRANSFER_ACCOUNT_NAME?.trim()
+  const bankName = env.BANK_TRANSFER_BANK_NAME?.trim()
+  const accountNumber = env.BANK_TRANSFER_ACCOUNT_NUMBER?.trim()
+
+  if (!accountName || !bankName || !accountNumber) return null
+  return { accountName, bankName, accountNumber }
+}
diff --git a/lib/env-diagnostics.ts b/lib/env-diagnostics.ts
index f57ba6d..79db0b0 100644
--- a/lib/env-diagnostics.ts
+++ b/lib/env-diagnostics.ts
@@ -1,5 +1,14 @@
 const STRICT_CRITICAL_ENV_KEYS = ["DATABASE_URL", "NEXTAUTH_URL"] as const
 
+const PRODUCTION_CRITICAL_ENV_KEYS = [
+  "APP_URL",
+  "RESEND_API_KEY",
+  "NEWSLETTER_FROM_EMAIL",
+  "UPSTASH_REDIS_REST_URL",
+  "UPSTASH_REDIS_REST_TOKEN",
+  "CRON_SECRET",
+] as const
+
 const OPTIONAL_ENV_KEYS = [
   "NEXTAUTH_SECRET",
   "APP_URL",
@@ -18,6 +27,16 @@ export function getEnvDiagnostics() {
   const missingCritical: string[] = STRICT_CRITICAL_ENV_KEYS.filter(
     (key) => !hasValue(process.env[key])
   )
+  if (process.env.NODE_ENV === "production") {
+    missingCritical.push(
+      ...PRODUCTION_CRITICAL_ENV_KEYS.filter((key) => !hasValue(process.env[key])),
+    )
+    if (process.env.PAYMENTS_ENABLED === "true") {
+      for (const key of ["PAYSTACK_SECRET_KEY", "PAYSTACK_PUBLIC_KEY"]) {
+        if (!hasValue(process.env[key])) missingCritical.push(key)
+      }
+    }
+  }
 
   const hasAuthSecret = hasValue(process.env.AUTH_SECRET) || hasValue(process.env.NEXTAUTH_SECRET)
   if (!hasAuthSecret) {
diff --git a/lib/env.ts b/lib/env.ts
index 7f09998..61b5ea8 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -21,6 +21,7 @@ const schema = z.object({
   NEXTAUTH_URL: z.string().url().optional(),
 
   // Payments (Paystack): sandbox/test only in this project
+  PAYMENTS_ENABLED: z.enum(['true', 'false']).transform((value) => value === 'true').default('false'),
   PAYSTACK_SECRET_KEY: z.string().optional(),
   PAYSTACK_PUBLIC_KEY: z.string().optional(),
 
@@ -60,6 +61,14 @@ const schema = z.object({
   COMMERCE_CURRENCY: z.string().default('NGN'),
   COMMERCE_FREE_SHIPPING_THRESHOLD_NGN: z.coerce.number().int().nonnegative().default(500_000),
   COMMERCE_FLAT_SHIPPING_NGN: z.coerce.number().int().nonnegative().default(2_500),
+  COMMERCE_EXPRESS_SHIPPING_NGN: z.coerce.number().int().nonnegative().default(35_000),
+  COMMERCE_GIFT_WRAP_NGN: z.coerce.number().int().nonnegative().default(2_500),
+
+  // Manual bank transfer is fail-closed until owner-approved details are configured.
+  BANK_TRANSFER_ENABLED: z.enum(['true', 'false']).transform((value) => value === 'true').default('false'),
+  BANK_TRANSFER_ACCOUNT_NAME: z.string().optional(),
+  BANK_TRANSFER_BANK_NAME: z.string().optional(),
+  BANK_TRANSFER_ACCOUNT_NUMBER: z.string().optional(),
 
   // Feature flags (comma-separated list of enabled flags)
   FEATURE_FLAGS: z.string().default(''),
@@ -68,6 +77,7 @@ const schema = z.object({
   // When absent, rate limiting degrades to an in-memory per-instance limiter (documented limitation).
   UPSTASH_REDIS_REST_URL: z.string().url().optional(),
   UPSTASH_REDIS_REST_TOKEN: z.string().optional(),
+  CRON_SECRET: z.string().min(32).optional(),
   CONCIERGE_GUEST_QUESTIONS: z.coerce.number().int().min(0).max(10).default(1),
   CONCIERGE_AUTH_PER_MINUTE: z.coerce.number().int().positive().default(12),
   CONCIERGE_AUTH_DAILY: z.coerce.number().int().positive().default(100),
@@ -121,6 +131,7 @@ export function integrationStatus() {
   return {
     database: Boolean(e.DATABASE_URL),
     auth: Boolean(e.AUTH_SECRET || e.NEXTAUTH_SECRET),
+    paymentsEnabled: e.PAYMENTS_ENABLED,
     paystack: Boolean(e.PAYSTACK_SECRET_KEY),
     resend: Boolean(e.RESEND_API_KEY),
     shopify: Boolean(e.SHOPIFY_STORE_DOMAIN && e.SHOPIFY_STOREFRONT_API_TOKEN),
diff --git a/lib/inventory/reservations.ts b/lib/inventory/reservations.ts
new file mode 100644
index 0000000..917707a
--- /dev/null
+++ b/lib/inventory/reservations.ts
@@ -0,0 +1,220 @@
+import type { Prisma } from "@prisma/client"
+
+import { AppError } from "@/lib/http/errors"
+import { prisma } from "@/lib/prisma"
+
+export const CARD_RESERVATION_MINUTES = 30
+export const BANK_TRANSFER_RESERVATION_HOURS = 24
+
+export interface InventoryLine {
+  productId: string
+  quantity: number
+}
+
+export function aggregateInventoryLines(items: InventoryLine[]): InventoryLine[] {
+  const quantities = new Map<string, number>()
+  for (const item of items) {
+    quantities.set(item.productId, (quantities.get(item.productId) ?? 0) + item.quantity)
+  }
+  return [...quantities.entries()]
+    .map(([productId, quantity]) => ({ productId, quantity }))
+    .sort((a, b) => a.productId.localeCompare(b.productId))
+}
+
+export function reservationExpiry(
+  paymentMethod: "CARD" | "BANK_TRANSFER",
+  now = new Date(),
+): Date {
+  const durationMs =
+    paymentMethod === "BANK_TRANSFER"
+      ? BANK_TRANSFER_RESERVATION_HOURS * 60 * 60 * 1000
+      : CARD_RESERVATION_MINUTES * 60 * 1000
+  return new Date(now.getTime() + durationMs)
+}
+
+export async function reserveInventory(
+  tx: Prisma.TransactionClient,
+  orderId: string,
+  rawItems: InventoryLine[],
+  expiresAt: Date,
+) {
+  const items = aggregateInventoryLines(rawItems)
+  for (const item of items) {
+    const claimed = await tx.product.updateMany({
+      where: {
+        id: item.productId,
+        stock: { gte: item.quantity },
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+      },
+      data: { stock: { decrement: item.quantity } },
+    })
+    if (claimed.count !== 1) {
+      throw new AppError("INSUFFICIENT_STOCK", {
+        internal: { orderId, productId: item.productId, quantity: item.quantity },
+      })
+    }
+
+    await tx.inventoryReservation.create({
+      data: {
+        orderId,
+        productId: item.productId,
+        quantity: item.quantity,
+        expiresAt,
+      },
+    })
+    await tx.inventoryMovement.create({
+      data: {
+        productId: item.productId,
+        delta: -item.quantity,
+        reason: "RESERVATION_CREATED",
+        sourceType: "ORDER",
+        sourceId: orderId,
+      },
+    })
+  }
+}
+
+export async function finalizeInventoryForOrder(
+  tx: Prisma.TransactionClient,
+  orderId: string,
+  rawItems: InventoryLine[],
+) {
+  const items = aggregateInventoryLines(rawItems)
+  const reservations = await tx.inventoryReservation.findMany({
+    where: { orderId },
+  })
+
+  // Backward compatibility for pending orders created before reservations were introduced.
+  if (reservations.length === 0) {
+    for (const item of items) {
+      const sold = await tx.product.updateMany({
+        where: { id: item.productId, stock: { gte: item.quantity } },
+        data: { stock: { decrement: item.quantity } },
+      })
+      if (sold.count !== 1) {
+        throw new AppError("INSUFFICIENT_STOCK", {
+          internal: { orderId, productId: item.productId, quantity: item.quantity },
+        })
+      }
+      await tx.inventoryMovement.create({
+        data: {
+          productId: item.productId,
+          delta: -item.quantity,
+          reason: "LEGACY_SALE",
+          sourceType: "ORDER",
+          sourceId: orderId,
+        },
+      })
+    }
+    return
+  }
+
+  const byProduct = new Map(reservations.map((reservation) => [
+    reservation.productId,
+    reservation,
+  ]))
+  for (const item of items) {
+    const reservation = byProduct.get(item.productId)
+    if (!reservation || reservation.quantity !== item.quantity) {
+      throw new AppError("INTERNAL_ERROR", {
+        internal: {
+          reason: "inventory_reservation_mismatch",
+          orderId,
+          productId: item.productId,
+        },
+      })
+    }
+
+    if (reservation.status === "SOLD") continue
+    if (reservation.status === "RESERVED") {
+      const finalized = await tx.inventoryReservation.updateMany({
+        where: { id: reservation.id, status: "RESERVED" },
+        data: { status: "SOLD", finalizedAt: new Date() },
+      })
+      if (finalized.count === 1) continue
+    }
+
+    const reacquired = await tx.product.updateMany({
+      where: { id: item.productId, stock: { gte: item.quantity } },
+      data: { stock: { decrement: item.quantity } },
+    })
+    if (reacquired.count !== 1) {
+      throw new AppError("INSUFFICIENT_STOCK", {
+        internal: {
+          reason: "paid_after_reservation_expired",
+          orderId,
+          productId: item.productId,
+          quantity: item.quantity,
+        },
+      })
+    }
+    const finalized = await tx.inventoryReservation.updateMany({
+      where: {
+        id: reservation.id,
+        status: { in: ["EXPIRED", "RELEASED"] },
+      },
+      data: { status: "SOLD", finalizedAt: new Date() },
+    })
+    if (finalized.count !== 1) {
+      throw new AppError("INTERNAL_ERROR", {
+        internal: {
+          reason: "inventory_reservation_transition_race",
+          orderId,
+          reservationId: reservation.id,
+        },
+      })
+    }
+    await tx.inventoryMovement.create({
+      data: {
+        productId: item.productId,
+        delta: -item.quantity,
+        reason: "SALE_AFTER_EXPIRY",
+        sourceType: "ORDER",
+        sourceId: orderId,
+      },
+    })
+  }
+}
+
+export async function releaseExpiredReservations(
+  options: { now?: Date; limit?: number } = {},
+) {
+  const now = options.now ?? new Date()
+  const limit = Math.min(Math.max(options.limit ?? 100, 1), 500)
+  const candidates = await prisma.inventoryReservation.findMany({
+    where: { status: "RESERVED", expiresAt: { lte: now } },
+    orderBy: { expiresAt: "asc" },
+    take: limit,
+    select: { id: true, orderId: true, productId: true, quantity: true },
+  })
+
+  let released = 0
+  for (const candidate of candidates) {
+    const didRelease = await prisma.$transaction(async (tx) => {
+      const transitioned = await tx.inventoryReservation.updateMany({
+        where: { id: candidate.id, status: "RESERVED", expiresAt: { lte: now } },
+        data: { status: "EXPIRED", releasedAt: now },
+      })
+      if (transitioned.count !== 1) return false
+
+      await tx.product.update({
+        where: { id: candidate.productId },
+        data: { stock: { increment: candidate.quantity } },
+      })
+      await tx.inventoryMovement.create({
+        data: {
+          productId: candidate.productId,
+          delta: candidate.quantity,
+          reason: "RESERVATION_EXPIRED",
+          sourceType: "ORDER",
+          sourceId: candidate.orderId,
+        },
+      })
+      return true
+    })
+    if (didRelease) released += 1
+  }
+
+  return { examined: candidates.length, released }
+}
diff --git a/lib/jobs/outbox.ts b/lib/jobs/outbox.ts
new file mode 100644
index 0000000..8e6d0b3
--- /dev/null
+++ b/lib/jobs/outbox.ts
@@ -0,0 +1,231 @@
+import crypto from "crypto"
+import type { OutboxEvent, Prisma } from "@prisma/client"
+
+import { sendReceipt } from "@/emails/sendReceipt"
+import { AppError } from "@/lib/http/errors"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+import { qualifyReferral } from "@/lib/referrals/service"
+
+export const OUTBOX_TYPES = {
+  ORDER_RECEIPT: "ORDER_RECEIPT",
+  ADMIN_ORDER_PAID_NOTIFICATION: "ADMIN_ORDER_PAID_NOTIFICATION",
+  REFERRAL_QUALIFICATION: "REFERRAL_QUALIFICATION",
+} as const
+
+export function outboxRetryDelayMs(attempts: number): number {
+  const exponent = Math.max(0, Math.min(attempts - 1, 8))
+  return Math.min(2 ** exponent * 30_000, 60 * 60 * 1000)
+}
+
+export async function enqueueOrderPaidEvents(
+  tx: Prisma.TransactionClient,
+  orderId: string,
+) {
+  await tx.outboxEvent.createMany({
+    data: [
+      {
+        type: OUTBOX_TYPES.ORDER_RECEIPT,
+        aggregateType: "Order",
+        aggregateId: orderId,
+        idempotencyKey: `order-receipt:${orderId}`,
+      },
+      {
+        type: OUTBOX_TYPES.ADMIN_ORDER_PAID_NOTIFICATION,
+        aggregateType: "Order",
+        aggregateId: orderId,
+        idempotencyKey: `admin-order-paid:${orderId}`,
+      },
+      {
+        type: OUTBOX_TYPES.REFERRAL_QUALIFICATION,
+        aggregateType: "Order",
+        aggregateId: orderId,
+        idempotencyKey: `referral-qualification:${orderId}`,
+      },
+    ],
+    skipDuplicates: true,
+  })
+}
+
+async function loadPaidOrder(orderId: string) {
+  return prisma.order.findFirst({
+    where: { id: orderId, status: { in: ["PAID", "SHIPPED", "DELIVERED"] } },
+    include: {
+      user: true,
+      items: { include: { product: true } },
+      coupon: true,
+    },
+  })
+}
+
+export async function handleOutboxEvent(event: OutboxEvent) {
+  if (event.aggregateType !== "Order") {
+    throw new AppError("INTERNAL_ERROR", {
+      internal: { reason: "unsupported_outbox_aggregate", eventId: event.id },
+    })
+  }
+  const order = await loadPaidOrder(event.aggregateId)
+  if (!order) {
+    throw new AppError("NOT_FOUND", {
+      internal: { reason: "outbox_order_not_found_or_unpaid", eventId: event.id },
+    })
+  }
+
+  switch (event.type) {
+    case OUTBOX_TYPES.ORDER_RECEIPT:
+      await sendReceipt(order, event.idempotencyKey)
+      return
+    case OUTBOX_TYPES.ADMIN_ORDER_PAID_NOTIFICATION:
+      await prisma.notification.upsert({
+        where: { dedupeKey: event.idempotencyKey },
+        update: {},
+        create: {
+          type: "ORDER_PAID",
+          title: "New Order Payment",
+          message: `Order #${order.reference || order.id.slice(0, 8)} has been paid. Total: NGN ${order.totalNGN.toLocaleString()}`,
+          orderId: order.id,
+          dedupeKey: event.idempotencyKey,
+        },
+      })
+      return
+    case OUTBOX_TYPES.REFERRAL_QUALIFICATION:
+      await qualifyReferral(order.userId, order.id)
+      return
+    default:
+      throw new AppError("INTERNAL_ERROR", {
+        internal: {
+          reason: "unsupported_outbox_event_type",
+          eventId: event.id,
+          eventType: event.type,
+        },
+      })
+  }
+}
+
+async function recoverStaleClaims(now: Date) {
+  const staleBefore = new Date(now.getTime() - 5 * 60 * 1000)
+  return prisma.outboxEvent.updateMany({
+    where: { status: "RUNNING", lockedAt: { lte: staleBefore } },
+    data: {
+      status: "PENDING",
+      lockedAt: null,
+      lockedBy: null,
+      availableAt: now,
+    },
+  })
+}
+
+async function claimNextEvent(
+  workerId: string,
+  now: Date,
+  aggregateId?: string,
+) {
+  for (let collision = 0; collision < 5; collision += 1) {
+    const candidate = await prisma.outboxEvent.findFirst({
+      where: {
+        status: "PENDING",
+        availableAt: { lte: now },
+        ...(aggregateId ? { aggregateId } : {}),
+      },
+      orderBy: [{ availableAt: "asc" }, { createdAt: "asc" }],
+    })
+    if (!candidate) return null
+
+    const claimed = await prisma.outboxEvent.updateMany({
+      where: { id: candidate.id, status: "PENDING", lockedAt: null },
+      data: {
+        status: "RUNNING",
+        attempts: { increment: 1 },
+        lockedAt: now,
+        lockedBy: workerId,
+      },
+    })
+    if (claimed.count === 1) {
+      return prisma.outboxEvent.findUniqueOrThrow({ where: { id: candidate.id } })
+    }
+  }
+  return null
+}
+
+function safeFailureCode(error: unknown): string {
+  if (error instanceof AppError) return error.code
+  if (error instanceof Error && error.name) return error.name.slice(0, 100)
+  return "UNKNOWN_ERROR"
+}
+
+export async function processOutboxBatch(
+  options: {
+    limit?: number
+    workerId?: string
+    now?: Date
+    /** Test/repair scope. Production workers omit this and scan the global queue. */
+    aggregateId?: string
+  } = {},
+) {
+  const limit = Math.min(Math.max(options.limit ?? 10, 1), 50)
+  const workerId = options.workerId ?? `worker_${crypto.randomUUID()}`
+  const startedAt = options.now ?? new Date()
+  const recovered = await recoverStaleClaims(startedAt)
+  let processed = 0
+  let retried = 0
+  let failed = 0
+
+  for (let index = 0; index < limit; index += 1) {
+    const event = await claimNextEvent(
+      workerId,
+      new Date(),
+      options.aggregateId,
+    )
+    if (!event) break
+    try {
+      await handleOutboxEvent(event)
+      await prisma.outboxEvent.updateMany({
+        where: { id: event.id, status: "RUNNING", lockedBy: workerId },
+        data: {
+          status: "SUCCEEDED",
+          processedAt: new Date(),
+          lockedAt: null,
+          lockedBy: null,
+          lastError: null,
+        },
+      })
+      processed += 1
+    } catch (error) {
+      const terminal = event.attempts >= event.maxAttempts
+      const now = new Date()
+      await prisma.outboxEvent.updateMany({
+        where: { id: event.id, status: "RUNNING", lockedBy: workerId },
+        data: terminal
+          ? {
+              status: "FAILED",
+              lockedAt: null,
+              lockedBy: null,
+              lastError: safeFailureCode(error),
+            }
+          : {
+              status: "PENDING",
+              lockedAt: null,
+              lockedBy: null,
+              availableAt: new Date(now.getTime() + outboxRetryDelayMs(event.attempts)),
+              lastError: safeFailureCode(error),
+            },
+      })
+      logger.error("outbox_event_failed", {
+        eventId: event.id,
+        eventType: event.type,
+        attempts: event.attempts,
+        terminal,
+        internal: String(error),
+      })
+      if (terminal) failed += 1
+      else retried += 1
+    }
+  }
+
+  return {
+    processed,
+    retried,
+    failed,
+    recovered: recovered.count,
+  }
+}
diff --git a/lib/notifications/contact-email.ts b/lib/notifications/contact-email.ts
new file mode 100644
index 0000000..7f97e80
--- /dev/null
+++ b/lib/notifications/contact-email.ts
@@ -0,0 +1,53 @@
+import { escapeHtml } from "@/lib/security/html"
+
+interface ContactEmailInput {
+  name: string
+  email: string
+  subject: string
+  message: string
+}
+
+export function renderContactOwnerEmail(input: ContactEmailInput): string {
+  const name = escapeHtml(input.name)
+  const email = escapeHtml(input.email)
+  const subject = escapeHtml(input.subject)
+  const message = escapeHtml(input.message)
+
+  return `
+    <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
+      <h2 style="color: #2f3e33;">New Contact Form Submission</h2>
+      <p><strong>From:</strong> ${name} &lt;${email}&gt;</p>
+      <p><strong>Subject:</strong> ${subject}</p>
+      <hr style="border: 1px solid #eee; margin: 20px 0;">
+      <p style="white-space: pre-wrap;">${message}</p>
+    </div>
+  `
+}
+
+export function renderContactReplyEmail(
+  input: Pick<ContactEmailInput, "name" | "message">,
+  storeEmail: string,
+): string {
+  const name = escapeHtml(input.name)
+  const message = escapeHtml(input.message)
+  const safeStoreEmail = escapeHtml(storeEmail)
+
+  return `
+    <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
+      <div style="background: #2f3e33; color: white; padding: 20px; text-align: center; border-radius: 8px 8px 0 0;">
+        <h1 style="margin: 0; font-family: serif;">Fade Essence</h1>
+      </div>
+      <div style="background: #f8f9fa; padding: 30px; border-radius: 0 0 8px 8px;">
+        <h2 style="color: #2f3e33; margin-top: 0;">Thank you for reaching out, ${name}!</h2>
+        <p>We've received your message and will get back to you within 24-48 hours.</p>
+        <p><strong>Your message:</strong></p>
+        <blockquote style="border-left: 3px solid #2f3e33; margin: 0; padding: 10px 20px; background: white; border-radius: 0 4px 4px 0;">
+          <p style="white-space: pre-wrap; color: #555;">${message}</p>
+        </blockquote>
+        <p style="margin-top: 20px; color: #666; font-size: 14px;">
+          If you need urgent assistance, you can also reach us at ${safeStoreEmail} or +234 8160591348.
+        </p>
+      </div>
+    </div>
+  `
+}
diff --git a/lib/orders/state-machine.ts b/lib/orders/state-machine.ts
new file mode 100644
index 0000000..0abee3b
--- /dev/null
+++ b/lib/orders/state-machine.ts
@@ -0,0 +1,24 @@
+import type { OrderStatus } from "@prisma/client"
+
+const ADMIN_TRANSITIONS: Record<OrderStatus, readonly OrderStatus[]> = {
+  PENDING: ["CANCELLED"],
+  PAID: ["SHIPPED"],
+  SHIPPED: ["DELIVERED"],
+  DELIVERED: [],
+  CANCELLED: [],
+  REFUND_PENDING: [],
+  REFUNDED: [],
+}
+
+export function allowedAdminOrderTransitions(
+  current: OrderStatus,
+): readonly OrderStatus[] {
+  return ADMIN_TRANSITIONS[current]
+}
+
+export function canAdminTransitionOrder(
+  current: OrderStatus,
+  next: OrderStatus,
+): boolean {
+  return ADMIN_TRANSITIONS[current].includes(next)
+}
diff --git a/lib/payments/match.ts b/lib/payments/match.ts
new file mode 100644
index 0000000..1f85429
--- /dev/null
+++ b/lib/payments/match.ts
@@ -0,0 +1,21 @@
+export interface PaymentMatchInput {
+  expectedReference: string | null
+  receivedReference: string
+  expectedAmountNGN: number
+  receivedAmountNGN: number
+  expectedCurrency: string
+  receivedCurrency: string
+  providerStatus: string | undefined
+  paymentMethod: string
+}
+
+/** Pure payment invariant shared by webhook handling and security regression tests. */
+export function matchesExpectedPayment(input: PaymentMatchInput): boolean {
+  return (
+    input.providerStatus === "success" &&
+    input.paymentMethod === "CARD" &&
+    input.expectedReference === input.receivedReference &&
+    input.expectedAmountNGN === input.receivedAmountNGN &&
+    input.expectedCurrency.toUpperCase() === input.receivedCurrency.toUpperCase()
+  )
+}
diff --git a/lib/payments/reconciliation.ts b/lib/payments/reconciliation.ts
new file mode 100644
index 0000000..01a305a
--- /dev/null
+++ b/lib/payments/reconciliation.ts
@@ -0,0 +1,211 @@
+import type { PaymentProvider } from "@/integrations/payments/types"
+import { logger } from "@/lib/observability/logger"
+import { settleSuccessfulPayment } from "@/lib/payments/settlement"
+import { prisma } from "@/lib/prisma"
+import { settleRefundStatus } from "@/lib/refunds/settlement"
+
+export type ReconciliationOutcome =
+  | "settled"
+  | "duplicate"
+  | "pending"
+  | "failed"
+  | "abandoned"
+  | "review_required"
+  | "skipped"
+
+export async function reconcilePaymentAttempt(
+  attemptId: string,
+  provider: PaymentProvider,
+): Promise<ReconciliationOutcome> {
+  const attempt = await prisma.paymentAttempt.findFirst({
+    where: {
+      id: attemptId,
+      provider: provider.name,
+      status: "PENDING",
+      failureCode: null,
+    },
+    select: {
+      id: true,
+      orderId: true,
+      providerReference: true,
+      expectedAmountNGN: true,
+      expectedCurrency: true,
+    },
+  })
+  if (!attempt) return "skipped"
+
+  const verified = await provider.verify(attempt.providerReference, {
+    amountNGN: attempt.expectedAmountNGN,
+    currency: attempt.expectedCurrency,
+  })
+
+  if (verified.status === "pending") return "pending"
+
+  if (
+    verified.status === "failed" ||
+    verified.status === "abandoned"
+  ) {
+    await prisma.paymentAttempt.updateMany({
+      where: { id: attempt.id, status: "PENDING" },
+      data: {
+        status:
+          verified.status === "failed" ? "FAILED" : "ABANDONED",
+        failureCode: `RECONCILED_${verified.status.toUpperCase()}`,
+        verifiedAt: new Date(),
+      },
+    })
+    return verified.status
+  }
+
+  const result = await settleSuccessfulPayment({
+    orderId: attempt.orderId,
+    reference: verified.reference,
+    amountNGN: verified.amountNGN,
+    currency: verified.currency,
+    providerStatus: verified.status,
+  })
+
+  if (result.outcome === "settled" || result.outcome === "duplicate") {
+    return result.outcome
+  }
+
+  await prisma.paymentAttempt.updateMany({
+    where: { id: attempt.id, status: "PENDING" },
+    data: {
+      failureCode:
+        result.outcome === "mismatch"
+          ? "RECONCILIATION_MISMATCH"
+          : "RECONCILIATION_UNKNOWN_ATTEMPT",
+      verifiedAt: new Date(),
+    },
+  })
+  return "review_required"
+}
+
+export async function reconcilePendingPayments(options: {
+  provider: PaymentProvider
+  now?: Date
+  minimumAgeMs?: number
+  limit?: number
+}) {
+  const now = options.now ?? new Date()
+  const minimumAgeMs = Math.max(options.minimumAgeMs ?? 2 * 60 * 1000, 0)
+  const limit = Math.min(Math.max(options.limit ?? 20, 1), 100)
+  const candidates = await prisma.paymentAttempt.findMany({
+    where: {
+      provider: options.provider.name,
+      status: "PENDING",
+      failureCode: null,
+      initializedAt: { lte: new Date(now.getTime() - minimumAgeMs) },
+    },
+    orderBy: { initializedAt: "asc" },
+    take: limit,
+    select: { id: true },
+  })
+
+  const counts: Record<ReconciliationOutcome | "errors", number> = {
+    settled: 0,
+    duplicate: 0,
+    pending: 0,
+    failed: 0,
+    abandoned: 0,
+    review_required: 0,
+    skipped: 0,
+    errors: 0,
+  }
+
+  for (const candidate of candidates) {
+    try {
+      const outcome = await reconcilePaymentAttempt(
+        candidate.id,
+        options.provider,
+      )
+      counts[outcome] += 1
+    } catch (error) {
+      counts.errors += 1
+      logger.error("payment_reconciliation_attempt_failed", {
+        paymentAttemptId: candidate.id,
+        internal: String(error),
+      })
+    }
+  }
+
+  return { examined: candidates.length, ...counts }
+}
+
+export async function reconcilePendingRefunds(options: {
+  provider: PaymentProvider
+  now?: Date
+  minimumAgeMs?: number
+  limit?: number
+}) {
+  const now = options.now ?? new Date()
+  const minimumAgeMs = Math.max(options.minimumAgeMs ?? 5 * 60 * 1000, 0)
+  const limit = Math.min(Math.max(options.limit ?? 20, 1), 100)
+  const candidates = await prisma.refund.findMany({
+    where: {
+      provider: options.provider.name,
+      providerRefundId: { not: null },
+      status: { in: ["PENDING", "PROCESSING", "NEEDS_ATTENTION"] },
+      updatedAt: { lte: new Date(now.getTime() - minimumAgeMs) },
+    },
+    orderBy: { updatedAt: "asc" },
+    take: limit,
+    select: { id: true },
+  })
+
+  const counts = {
+    updated: 0,
+    duplicate: 0,
+    unknown: 0,
+    mismatch: 0,
+    errors: 0,
+  }
+  for (const refund of candidates) {
+    try {
+      const result = await reconcileRefund(refund.id, options.provider)
+      counts[result.outcome] += 1
+    } catch (error) {
+      counts.errors += 1
+      logger.error("refund_reconciliation_attempt_failed", {
+        refundId: refund.id,
+        internal: String(error),
+      })
+    }
+  }
+  return { examined: candidates.length, ...counts }
+}
+
+export async function reconcileRefund(
+  refundId: string,
+  provider: PaymentProvider,
+) {
+  const refund = await prisma.refund.findFirst({
+    where: {
+      id: refundId,
+      provider: provider.name,
+      providerRefundId: { not: null },
+      status: { in: ["PENDING", "PROCESSING", "NEEDS_ATTENTION"] },
+    },
+    select: {
+      providerRefundId: true,
+      amountNGN: true,
+      currency: true,
+      paymentAttempt: { select: { providerReference: true } },
+    },
+  })
+  if (!refund?.providerRefundId) {
+    return { outcome: "duplicate" as const }
+  }
+  const verified = await provider.verifyRefund(refund.providerRefundId, {
+    amountNGN: refund.amountNGN,
+    currency: refund.currency,
+  })
+  return settleRefundStatus({
+    providerRefundId: verified.providerRefundId,
+    paymentReference: refund.paymentAttempt.providerReference,
+    status: verified.status,
+    amountNGN: verified.amountNGN,
+    currency: verified.currency,
+  })
+}
diff --git a/lib/payments/settlement.ts b/lib/payments/settlement.ts
new file mode 100644
index 0000000..a96f316
--- /dev/null
+++ b/lib/payments/settlement.ts
@@ -0,0 +1,201 @@
+import { resolveLoyaltyTier } from "@/lib/config/commerce"
+import { finalizeInventoryForOrder } from "@/lib/inventory/reservations"
+import { enqueueOrderPaidEvents } from "@/lib/jobs/outbox"
+import { pointsForOrder } from "@/lib/loyalty/points"
+import { matchesExpectedPayment } from "@/lib/payments/match"
+import { prisma } from "@/lib/prisma"
+
+interface PaymentReceipt {
+  provider: string
+  eventId: string
+  topic: string
+}
+
+export interface SettlePaymentInput {
+  reference: string
+  orderId?: string
+  amountNGN: number
+  currency: string
+  providerStatus: string
+  providerTransactionId?: string | null
+  receipt?: PaymentReceipt
+}
+
+export type SettlePaymentResult =
+  | { outcome: "settled"; orderId: string }
+  | {
+      outcome: "duplicate"
+      orderId: string
+      paidReference: string | null
+    }
+  | { outcome: "unknown" }
+  | {
+      outcome: "mismatch"
+      orderId: string
+      attemptId: string
+      attemptStatus: string
+      expectedAmountNGN: number
+      orderAmountNGN: number
+      expectedCurrency: string
+    }
+
+export async function settleSuccessfulPayment(
+  input: SettlePaymentInput,
+): Promise<SettlePaymentResult> {
+  const attempt = await prisma.paymentAttempt.findUnique({
+    where: { providerReference: input.reference },
+    include: {
+      order: {
+        select: {
+          id: true,
+          status: true,
+          reference: true,
+          totalNGN: true,
+          paymentMethod: true,
+          couponId: true,
+          items: { select: { productId: true, quantity: true } },
+        },
+      },
+    },
+  })
+
+  if (!attempt || (input.orderId && attempt.orderId !== input.orderId)) {
+    return { outcome: "unknown" }
+  }
+
+  const matches = matchesExpectedPayment({
+    expectedReference: attempt.providerReference,
+    receivedReference: input.reference,
+    expectedAmountNGN: attempt.expectedAmountNGN,
+    receivedAmountNGN: input.amountNGN,
+    expectedCurrency: attempt.expectedCurrency,
+    receivedCurrency: input.currency,
+    providerStatus: input.providerStatus,
+    paymentMethod: attempt.order.paymentMethod,
+  })
+
+  if (
+    !matches ||
+    attempt.expectedAmountNGN !== attempt.order.totalNGN ||
+    attempt.status === "FAILED" ||
+    attempt.status === "ABANDONED" ||
+    attempt.status === "REFUNDED"
+  ) {
+    return {
+      outcome: "mismatch",
+      orderId: attempt.orderId,
+      attemptId: attempt.id,
+      attemptStatus: attempt.status,
+      expectedAmountNGN: attempt.expectedAmountNGN,
+      orderAmountNGN: attempt.order.totalNGN,
+      expectedCurrency: attempt.expectedCurrency,
+    }
+  }
+
+  try {
+    return await prisma.$transaction(async (tx) => {
+      if (input.receipt) {
+        await tx.webhookReceipt.create({ data: input.receipt })
+      }
+
+      await tx.paymentAttempt.updateMany({
+        where: {
+          id: attempt.id,
+          status: { in: ["INITIALIZED", "PENDING"] },
+        },
+        data: {
+          status: "SUCCEEDED",
+          providerTransactionId: input.providerTransactionId ?? null,
+          verifiedAt: new Date(),
+          failureCode: null,
+        },
+      })
+
+      const transitioned = await tx.order.updateMany({
+        where: {
+          id: attempt.orderId,
+          status: "PENDING",
+          paymentMethod: "CARD",
+        },
+        data: {
+          status: "PAID",
+          reference: input.reference,
+        },
+      })
+      if (transitioned.count !== 1) {
+        const currentOrder = await tx.order.findUnique({
+          where: { id: attempt.orderId },
+          select: { status: true, reference: true },
+        })
+        return {
+          outcome: "duplicate" as const,
+          orderId: attempt.orderId,
+          paidReference: currentOrder?.reference ?? null,
+        }
+      }
+
+      await finalizeInventoryForOrder(
+        tx,
+        attempt.orderId,
+        attempt.order.items,
+      )
+
+      if (attempt.order.couponId) {
+        await tx.coupon.update({
+          where: { id: attempt.order.couponId },
+          data: { usedCount: { increment: 1 } },
+        })
+      }
+
+      const paidOrder = await tx.order.findUniqueOrThrow({
+        where: { id: attempt.orderId },
+        include: {
+          user: true,
+          items: { include: { product: true } },
+          coupon: true,
+        },
+      })
+
+      const updatedUser = await tx.user.update({
+        where: { id: paidOrder.userId },
+        data: { totalLifetimeSpend: { increment: paidOrder.totalNGN } },
+        select: { totalLifetimeSpend: true },
+      })
+      await tx.user.update({
+        where: { id: paidOrder.userId },
+        data: {
+          loyaltyTier: resolveLoyaltyTier(updatedUser.totalLifetimeSpend),
+        },
+      })
+
+      const points = pointsForOrder(paidOrder.totalNGN)
+      if (points > 0) {
+        const prior = await tx.loyaltyLedger.aggregate({
+          where: { userId: paidOrder.userId },
+          _sum: { delta: true },
+        })
+        await tx.loyaltyLedger.create({
+          data: {
+            userId: paidOrder.userId,
+            delta: points,
+            reason: "order_earn",
+            balanceAfter: (prior._sum.delta ?? 0) + points,
+            orderId: paidOrder.id,
+          },
+        })
+      }
+
+      await enqueueOrderPaidEvents(tx, paidOrder.id)
+      return { outcome: "settled" as const, orderId: paidOrder.id }
+    })
+  } catch (error) {
+    if ((error as { code?: string })?.code === "P2002") {
+      return {
+        outcome: "duplicate",
+        orderId: attempt.orderId,
+        paidReference: attempt.order.reference,
+      }
+    }
+    throw error
+  }
+}
diff --git a/lib/pdp/loader.ts b/lib/pdp/loader.ts
index 697d839..ad3d99d 100644
--- a/lib/pdp/loader.ts
+++ b/lib/pdp/loader.ts
@@ -270,7 +270,7 @@ function buildPerformance(summary: PdpReviewSummary | null): PdpPerformanceMetri
 
 export async function loadPdpData(slug: string): Promise<PdpData | null> {
   const p = await prisma.product.findFirst({
-    where: { slug, deletedAt: null },
+    where: { slug, deletedAt: null, publishStatus: "PUBLISHED" },
     include: { variants: true, media: true },
   })
   if (!p) return null
diff --git a/lib/queries/orders.ts b/lib/queries/orders.ts
index 10a9738..d2db37e 100644
--- a/lib/queries/orders.ts
+++ b/lib/queries/orders.ts
@@ -4,6 +4,7 @@ export async function getOrdersByUserId(userId: string) {
   const orders = await prisma.order.findMany({
     where: { userId },
     orderBy: { createdAt: "desc" },
+    take: 100,
     include: {
       items: {
         include: {
@@ -27,6 +28,7 @@ export async function getOrdersByUserId(userId: string) {
 export async function getAllOrders() {
   const orders = await prisma.order.findMany({
     orderBy: { createdAt: "desc" },
+    take: 100,
     include: {
       user: {
         select: {
@@ -41,4 +43,3 @@ export async function getAllOrders() {
 
   return orders
 }
-
diff --git a/lib/queries/products.ts b/lib/queries/products.ts
index 1792d92..d184145 100644
--- a/lib/queries/products.ts
+++ b/lib/queries/products.ts
@@ -53,7 +53,11 @@ export async function getProductsByCategory(categorySlug: string) {
   if (!category) return []
 
   const products = await prisma.product.findMany({
-    where: { category },
+    where: {
+      category,
+      deletedAt: null,
+      publishStatus: "PUBLISHED",
+    },
     orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
   })
 
@@ -61,8 +65,8 @@ export async function getProductsByCategory(categorySlug: string) {
 }
 
 export async function getProductBySlug(slug: string) {
-  const product = await prisma.product.findUnique({
-    where: { slug },
+  const product = await prisma.product.findFirst({
+    where: { slug, deletedAt: null, publishStatus: "PUBLISHED" },
     include: {
       reviews: {
         where: { approved: true },
@@ -94,6 +98,8 @@ export async function getRelatedProducts(
     where: {
       id: { not: productId },
       category,
+      deletedAt: null,
+      publishStatus: "PUBLISHED",
       ...(brand ? { brand } : {}),
     },
     orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
@@ -105,6 +111,8 @@ export async function getRelatedProducts(
       where: {
         id: { notIn: [productId, ...products.map((p) => p.id)] },
         category,
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
       },
       orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
       take: limit - products.length,
@@ -118,10 +126,10 @@ export async function getRelatedProducts(
 
 export async function getFeaturedProducts(limit = 8) {
   const products = await prisma.product.findMany({
+    where: { deletedAt: null, publishStatus: "PUBLISHED" },
     orderBy: [{ ratingAvg: "desc" }, { createdAt: "desc" }],
     take: limit,
   })
 
   return products.map(mapPrismaProductToCard)
 }
-
diff --git a/lib/queries/users.ts b/lib/queries/users.ts
index 9b7f006..3b70c0d 100644
--- a/lib/queries/users.ts
+++ b/lib/queries/users.ts
@@ -25,6 +25,7 @@ export async function getUserById(userId: string) {
 export async function getAllUsers() {
   const users = await prisma.user.findMany({
     orderBy: { createdAt: "desc" },
+    take: 100,
     include: {
       orders: {
         select: {
@@ -46,4 +47,3 @@ export async function getAllUsers() {
     }
   })
 }
-
diff --git a/lib/readiness.ts b/lib/readiness.ts
new file mode 100644
index 0000000..bb1d305
--- /dev/null
+++ b/lib/readiness.ts
@@ -0,0 +1,90 @@
+import { env } from "@/lib/env"
+import { logger } from "@/lib/observability/logger"
+import { prisma } from "@/lib/prisma"
+
+export interface JobBacklog {
+  failedOutbox: number
+  staleRunningOutbox: number
+  overdueReservations: number
+  overduePayments: number
+  refundsNeedingAttention: number
+}
+
+export function classifyJobReadiness(backlog: JobBacklog) {
+  return Object.values(backlog).some((count) => count > 0)
+    ? "degraded" as const
+    : "up" as const
+}
+
+export async function checkRedisReadiness() {
+  if (!env.UPSTASH_REDIS_REST_URL || !env.UPSTASH_REDIS_REST_TOKEN) {
+    return process.env.NODE_ENV === "production"
+      ? "down" as const
+      : "not_configured" as const
+  }
+  try {
+    const response = await fetch(
+      `${env.UPSTASH_REDIS_REST_URL.replace(/\/$/, "")}/ping`,
+      {
+        headers: {
+          Authorization: `Bearer ${env.UPSTASH_REDIS_REST_TOKEN}`,
+        },
+        cache: "no-store",
+        signal: AbortSignal.timeout(2_000),
+      },
+    )
+    if (!response.ok) return "down" as const
+    const payload = await response.json() as { result?: string }
+    return payload.result === "PONG" ? "up" as const : "down" as const
+  } catch (error) {
+    logger.warn("redis_readiness_failed", { internal: String(error) })
+    return "down" as const
+  }
+}
+
+export async function checkJobReadiness(now = new Date()) {
+  const fiveMinutesAgo = new Date(now.getTime() - 5 * 60 * 1000)
+  const fifteenMinutesAgo = new Date(now.getTime() - 15 * 60 * 1000)
+  try {
+    const [
+      failedOutbox,
+      staleRunningOutbox,
+      overdueReservations,
+      overduePayments,
+      refundsNeedingAttention,
+    ] = await Promise.all([
+      prisma.outboxEvent.count({ where: { status: "FAILED" } }),
+      prisma.outboxEvent.count({
+        where: { status: "RUNNING", lockedAt: { lte: fiveMinutesAgo } },
+      }),
+      prisma.inventoryReservation.count({
+        where: { status: "RESERVED", expiresAt: { lte: now } },
+      }),
+      prisma.paymentAttempt.count({
+        where: {
+          status: "PENDING",
+          failureCode: null,
+          initializedAt: { lte: fifteenMinutesAgo },
+        },
+      }),
+      prisma.refund.count({
+        where: { status: "NEEDS_ATTENTION" },
+      }),
+    ])
+    const backlog = {
+      failedOutbox,
+      staleRunningOutbox,
+      overdueReservations,
+      overduePayments,
+      refundsNeedingAttention,
+    }
+    const status = classifyJobReadiness(backlog)
+    if (status === "degraded") {
+      logger.warn("job_readiness_degraded", backlog)
+    }
+    return { status, backlog }
+  } catch (error) {
+    logger.error("job_readiness_failed", { internal: String(error) })
+    return { status: "down" as const, backlog: null }
+  }
+}
diff --git a/lib/refunds/service.ts b/lib/refunds/service.ts
new file mode 100644
index 0000000..dfc4ba3
--- /dev/null
+++ b/lib/refunds/service.ts
@@ -0,0 +1,210 @@
+import type {
+  PaymentProvider,
+  ProviderRefundStatus,
+} from "@/integrations/payments/types"
+import type { Refund } from "@prisma/client"
+import { writeAudit } from "@/lib/audit"
+import { AppError } from "@/lib/http/errors"
+import { prisma } from "@/lib/prisma"
+
+function databaseRefundStatus(status: ProviderRefundStatus) {
+  switch (status) {
+    case "processing":
+      return "PROCESSING" as const
+    case "needs_attention":
+      return "NEEDS_ATTENTION" as const
+    case "processed":
+      return "PROCESSED" as const
+    case "failed":
+      return "FAILED" as const
+    default:
+      return "PENDING" as const
+  }
+}
+
+export async function requestFullRefund(input: {
+  orderId: string
+  idempotencyKey: string
+  reason: string
+  actorId: string
+  provider: PaymentProvider
+}) {
+  const reason = input.reason.trim()
+  if (reason.length < 3 || reason.length > 500) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: "A refund reason between 3 and 500 characters is required.",
+    })
+  }
+
+  const prior = await prisma.refund.findUnique({
+    where: { idempotencyKey: input.idempotencyKey },
+  })
+  if (prior) {
+    if (prior.orderId !== input.orderId) {
+      throw new AppError("VALIDATION_ERROR", {
+        message: "That idempotency key belongs to another refund.",
+      })
+    }
+    return prior
+  }
+
+  const order = await prisma.order.findFirst({
+    where: {
+      id: input.orderId,
+      status: { in: ["PAID", "SHIPPED", "DELIVERED"] },
+      paymentMethod: "CARD",
+    },
+    include: {
+      refund: { select: { id: true } },
+      paymentAttempts: {
+        where: { status: "SUCCEEDED" },
+        orderBy: { verifiedAt: "desc" },
+        take: 1,
+      },
+    },
+  })
+  if (!order) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: "Only paid card orders can be refunded.",
+    })
+  }
+  if (order.refund) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: "A refund already exists for this order.",
+    })
+  }
+  const attempt = order.paymentAttempts[0]
+  if (!attempt) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: "No successful payment attempt exists for this order.",
+    })
+  }
+
+  let refund: Refund
+  try {
+    refund = await prisma.refund.create({
+      data: {
+        orderId: order.id,
+        paymentAttemptId: attempt.id,
+        provider: input.provider.name,
+        idempotencyKey: input.idempotencyKey,
+        amountNGN: order.totalNGN,
+        currency: attempt.expectedCurrency,
+        reason,
+        previousOrderStatus: order.status,
+        initiatedBy: input.actorId,
+        restock: false,
+      },
+    })
+  } catch (error) {
+    if ((error as { code?: string })?.code === "P2002") {
+      const raced = await prisma.refund.findUnique({
+        where: { orderId: order.id },
+      })
+      if (raced) return raced
+    }
+    throw error
+  }
+
+  let providerAccepted = false
+  let acceptedProviderRefundId: string | null = null
+  try {
+    const providerResult = await input.provider.refund({
+      reference: attempt.providerReference,
+      amountNGN: order.totalNGN,
+      currency: attempt.expectedCurrency,
+      customerNote: reason,
+      merchantNote: `Full refund requested by administrator ${input.actorId}`,
+    })
+    providerAccepted = true
+    acceptedProviderRefundId = providerResult.providerRefundId
+
+    if (
+      providerResult.amountNGN !== order.totalNGN ||
+      providerResult.currency !== attempt.expectedCurrency
+    ) {
+      await prisma.refund.update({
+        where: { id: refund.id },
+        data: {
+          status: "NEEDS_ATTENTION",
+          providerRefundId: providerResult.providerRefundId,
+          failureCode: "PROVIDER_REFUND_MISMATCH",
+        },
+      })
+      throw new AppError("PROVIDER_ERROR", {
+        internal: {
+          reason: "provider_refund_mismatch",
+          refundId: refund.id,
+        },
+      })
+    }
+    if (providerResult.status === "failed") {
+      await prisma.refund.update({
+        where: { id: refund.id },
+        data: {
+          status: "FAILED",
+          providerRefundId: providerResult.providerRefundId,
+          failureCode: "PROVIDER_REFUND_FAILED",
+        },
+      })
+      throw new AppError("PROVIDER_ERROR", {
+        internal: {
+          reason: "provider_refund_failed",
+          refundId: refund.id,
+        },
+      })
+    }
+
+    refund = await prisma.$transaction(async (tx) => {
+      const transitioned = await tx.order.updateMany({
+        where: { id: order.id, status: order.status },
+        data: { status: "REFUND_PENDING" },
+      })
+      if (transitioned.count !== 1) {
+        throw new AppError("VALIDATION_ERROR", {
+          message: "The order changed while the refund was being initiated.",
+        })
+      }
+      return tx.refund.update({
+        where: { id: refund.id },
+        data: {
+          providerRefundId: providerResult.providerRefundId,
+          status: databaseRefundStatus(providerResult.status),
+          failureCode: null,
+        },
+      })
+    })
+  } catch (error) {
+    await prisma.refund
+      .updateMany({
+        where: { id: refund.id, status: "REQUESTED" },
+        data: {
+          status: providerAccepted ? "NEEDS_ATTENTION" : "FAILED",
+          providerRefundId: acceptedProviderRefundId,
+          failureCode:
+            providerAccepted
+              ? "LOCAL_COMMIT_AFTER_PROVIDER_REFUND"
+              : error instanceof AppError
+                ? error.code
+                : "PROVIDER_ERROR",
+        },
+      })
+      .catch(() => {})
+    throw error
+  }
+
+  await writeAudit({
+    actorId: input.actorId,
+    actorRole: "ADMIN",
+    action: "refund.request",
+    targetType: "Refund",
+    targetId: refund.id,
+    metadata: {
+      orderId: order.id,
+      amountNGN: refund.amountNGN,
+      currency: refund.currency,
+      reason,
+    },
+  })
+  return refund
+}
diff --git a/lib/refunds/settlement.ts b/lib/refunds/settlement.ts
new file mode 100644
index 0000000..eee5e3c
--- /dev/null
+++ b/lib/refunds/settlement.ts
@@ -0,0 +1,200 @@
+import type { ProviderRefundStatus } from "@/integrations/payments/types"
+import { resolveLoyaltyTier } from "@/lib/config/commerce"
+import { prisma } from "@/lib/prisma"
+
+interface RefundReceipt {
+  provider: string
+  eventId: string
+  topic: string
+}
+
+export type SettleRefundResult =
+  | { outcome: "updated"; refundId: string; status: string }
+  | { outcome: "duplicate"; refundId?: string; status?: string }
+  | { outcome: "unknown" }
+  | { outcome: "mismatch"; refundId: string }
+
+function databaseStatus(status: ProviderRefundStatus) {
+  switch (status) {
+    case "processing":
+      return "PROCESSING" as const
+    case "needs_attention":
+      return "NEEDS_ATTENTION" as const
+    case "processed":
+      return "PROCESSED" as const
+    case "failed":
+      return "FAILED" as const
+    default:
+      return "PENDING" as const
+  }
+}
+
+export async function settleRefundStatus(input: {
+  providerRefundId?: string | null
+  paymentReference?: string | null
+  status: ProviderRefundStatus
+  amountNGN: number
+  currency: string
+  receipt?: RefundReceipt
+}): Promise<SettleRefundResult> {
+  const result = await prisma.$transaction(async (tx) => {
+    if (input.receipt) {
+      const receipt = await tx.webhookReceipt.createMany({
+        data: [{ ...input.receipt, processedAt: new Date() }],
+        skipDuplicates: true,
+      })
+      if (receipt.count === 0) {
+        return { outcome: "duplicate" as const }
+      }
+    }
+
+    const refund = await tx.refund.findFirst({
+      where: {
+        OR: [
+          ...(input.providerRefundId
+            ? [{ providerRefundId: input.providerRefundId }]
+            : []),
+          ...(input.paymentReference
+            ? [
+                {
+                  paymentAttempt: {
+                    providerReference: input.paymentReference,
+                  },
+                },
+              ]
+            : []),
+        ],
+      },
+      include: {
+        order: { select: { id: true, userId: true, status: true } },
+      },
+    })
+    if (!refund) return { outcome: "unknown" as const }
+
+    if (
+      refund.amountNGN !== input.amountNGN ||
+      refund.currency !== input.currency
+    ) {
+      await tx.refund.update({
+        where: { id: refund.id },
+        data: {
+          status: "NEEDS_ATTENTION",
+          failureCode: "REFUND_STATUS_MISMATCH",
+        },
+      })
+      return { outcome: "mismatch" as const, refundId: refund.id }
+    }
+
+    if (refund.status === "PROCESSED") {
+      return {
+        outcome: "duplicate" as const,
+        refundId: refund.id,
+        status: refund.status,
+      }
+    }
+
+    const nextStatus = databaseStatus(input.status)
+    const refundUpdate = {
+      providerRefundId: input.providerRefundId ?? refund.providerRefundId,
+      status: nextStatus,
+      failureCode:
+        nextStatus === "FAILED"
+          ? "PROVIDER_REFUND_FAILED"
+          : nextStatus === "NEEDS_ATTENTION"
+            ? "PROVIDER_NEEDS_ATTENTION"
+            : null,
+      processedAt: nextStatus === "PROCESSED" ? new Date() : null,
+    }
+    if (nextStatus === "PROCESSED") {
+      const claimed = await tx.refund.updateMany({
+        where: { id: refund.id, status: { not: "PROCESSED" } },
+        data: refundUpdate,
+      })
+      if (claimed.count !== 1) {
+        return {
+          outcome: "duplicate" as const,
+          refundId: refund.id,
+          status: "PROCESSED",
+        }
+      }
+    } else {
+      await tx.refund.update({
+        where: { id: refund.id },
+        data: refundUpdate,
+      })
+    }
+
+    if (nextStatus === "FAILED") {
+      await tx.order.updateMany({
+        where: { id: refund.orderId, status: "REFUND_PENDING" },
+        data: { status: refund.previousOrderStatus },
+      })
+    } else if (nextStatus === "PROCESSED") {
+      await tx.order.updateMany({
+        where: { id: refund.orderId, status: "REFUND_PENDING" },
+        data: { status: "REFUNDED" },
+      })
+      await tx.paymentAttempt.update({
+        where: { id: refund.paymentAttemptId },
+        data: { status: "REFUNDED" },
+      })
+      const updatedUser = await tx.user.update({
+        where: { id: refund.order.userId },
+        data: {
+          totalLifetimeSpend: { decrement: refund.amountNGN },
+        },
+        select: { totalLifetimeSpend: true },
+      })
+      const totalLifetimeSpend = Math.max(0, updatedUser.totalLifetimeSpend)
+      await tx.user.update({
+        where: { id: refund.order.userId },
+        data: {
+          totalLifetimeSpend,
+          loyaltyTier: resolveLoyaltyTier(totalLifetimeSpend),
+        },
+      })
+      const existingReversal = await tx.loyaltyLedger.findFirst({
+        where: {
+          userId: refund.order.userId,
+          orderId: refund.order.id,
+          reason: "order_reversal",
+        },
+      })
+      if (!existingReversal) {
+        const earned = await tx.loyaltyLedger.aggregate({
+          where: {
+            userId: refund.order.userId,
+            orderId: refund.order.id,
+            reason: "order_earn",
+          },
+          _sum: { delta: true },
+        })
+        const earnedPoints = earned._sum.delta ?? 0
+        if (earnedPoints > 0) {
+          const balance = await tx.loyaltyLedger.aggregate({
+            where: { userId: refund.order.userId },
+            _sum: { delta: true },
+          })
+          const currentBalance = Math.max(0, balance._sum.delta ?? 0)
+          const reversal = Math.min(earnedPoints, currentBalance)
+          await tx.loyaltyLedger.create({
+            data: {
+              userId: refund.order.userId,
+              orderId: refund.order.id,
+              delta: -reversal,
+              balanceAfter: currentBalance - reversal,
+              reason: "order_reversal",
+            },
+          })
+        }
+      }
+    }
+
+    return {
+      outcome: "updated" as const,
+      refundId: refund.id,
+      status: nextStatus,
+    }
+  })
+  return result
+}
diff --git a/lib/security/bearer.ts b/lib/security/bearer.ts
new file mode 100644
index 0000000..01d4a44
--- /dev/null
+++ b/lib/security/bearer.ts
@@ -0,0 +1,12 @@
+import crypto from "crypto"
+
+export function hasValidBearerSecret(
+  authorization: string | null,
+  expectedSecret: string | undefined,
+): boolean {
+  if (!authorization?.startsWith("Bearer ") || !expectedSecret) return false
+  const received = authorization.slice("Bearer ".length)
+  const expected = Buffer.from(expectedSecret)
+  const actual = Buffer.from(received)
+  return expected.length === actual.length && crypto.timingSafeEqual(expected, actual)
+}
diff --git a/lib/security/html.ts b/lib/security/html.ts
new file mode 100644
index 0000000..90e332d
--- /dev/null
+++ b/lib/security/html.ts
@@ -0,0 +1,11 @@
+const HTML_ENTITIES: Record<string, string> = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;",
+}
+
+export function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (character) => HTML_ENTITIES[character])
+}
diff --git a/lib/security/origin.ts b/lib/security/origin.ts
new file mode 100644
index 0000000..47cc4c9
--- /dev/null
+++ b/lib/security/origin.ts
@@ -0,0 +1,19 @@
+import { env } from "@/lib/env"
+
+/**
+ * Protect cookie-authenticated JSON mutations from cross-site requests.
+ * Production fails closed when Origin is absent; development permits tooling
+ * that does not emulate a browser Origin header.
+ */
+export function hasTrustedOrigin(request: Request): boolean {
+  const origin = request.headers.get("origin")
+  if (!origin) return process.env.NODE_ENV !== "production"
+
+  try {
+    const configured = new URL(env.APP_URL).origin
+    const requestOrigin = new URL(request.url).origin
+    return origin === configured || origin === requestOrigin
+  } catch {
+    return false
+  }
+}
diff --git a/lib/services/category-service.ts b/lib/services/category-service.ts
index cf6158b..fa8e181 100644
--- a/lib/services/category-service.ts
+++ b/lib/services/category-service.ts
@@ -1,6 +1,7 @@
 import { prisma } from "@/lib/prisma"
 import { Prisma, ProductCategory } from "@prisma/client"
 import { z } from "zod"
+import { invalidateCatalogueCache } from "@/lib/cache/catalogue"
 
 export const categoryInputSchema = z.object({
   name: z.string().min(1, "Name is required"),
@@ -20,26 +21,26 @@ export async function getCategoriesWithCounts(): Promise<AdminCategory[]> {
     orderBy: { name: "asc" },
   })
 
-  const results: AdminCategory[] = []
-
-  for (const category of categories) {
-    let productCount = 0
-    if (category.enumKey) {
-      productCount = await prisma.product.count({
-        where: { category: category.enumKey },
-      })
-    }
-
-    results.push({ ...category, productCount })
-  }
-
-  return results
+  const counts = await prisma.product.groupBy({
+    by: ["category"],
+    where: { deletedAt: null },
+    _count: { _all: true },
+  })
+  const countByCategory = new Map(
+    counts.map((row) => [row.category, row._count._all]),
+  )
+  return categories.map((category) => ({
+    ...category,
+    productCount: category.enumKey
+      ? (countByCategory.get(category.enumKey) ?? 0)
+      : 0,
+  }))
 }
 
 export async function createCategory(input: CategoryInput) {
   const data = categoryInputSchema.parse(input)
 
-  return prisma.category.create({
+  const category = await prisma.category.create({
     data: {
       name: data.name,
       slug: data.slug,
@@ -47,12 +48,14 @@ export async function createCategory(input: CategoryInput) {
       enumKey: data.enumKey ?? null,
     },
   })
+  invalidateCatalogueCache()
+  return category
 }
 
 export async function updateCategory(id: string, input: CategoryInput) {
   const data = categoryInputSchema.parse(input)
 
-  return prisma.category.update({
+  const category = await prisma.category.update({
     where: { id },
     data: {
       name: data.name,
@@ -61,6 +64,8 @@ export async function updateCategory(id: string, input: CategoryInput) {
       enumKey: data.enumKey ?? null,
     },
   })
+  invalidateCatalogueCache()
+  return category
 }
 
 export class CategoryInUseError extends Error {
@@ -92,4 +97,5 @@ export async function deleteCategory(id: string) {
   await prisma.category.delete({
     where: { id },
   })
+  invalidateCatalogueCache()
 }
diff --git a/lib/services/collection-service.ts b/lib/services/collection-service.ts
index 968dabc..80aea99 100644
--- a/lib/services/collection-service.ts
+++ b/lib/services/collection-service.ts
@@ -1,6 +1,7 @@
 import { prisma } from "@/lib/prisma"
 import { Prisma } from "@prisma/client"
 import { z } from "zod"
+import { invalidateCatalogueCache } from "@/lib/cache/catalogue"
 
 export const collectionInputSchema = z.object({
   name: z.string().min(1, "Name is required"),
@@ -30,7 +31,7 @@ export async function getCollectionsWithCounts(): Promise<AdminCollection[]> {
 export async function createCollection(input: CollectionInput) {
   const data = collectionInputSchema.parse(input)
 
-  return prisma.collection.create({
+  const collection = await prisma.collection.create({
     data: {
       name: data.name,
       slug: data.slug,
@@ -39,12 +40,14 @@ export async function createCollection(input: CollectionInput) {
       seoDescription: data.seoDescription,
     },
   })
+  invalidateCatalogueCache()
+  return collection
 }
 
 export async function updateCollection(id: string, input: CollectionInput) {
   const data = collectionInputSchema.parse(input)
 
-  return prisma.collection.update({
+  const collection = await prisma.collection.update({
     where: { id },
     data: {
       name: data.name,
@@ -54,6 +57,8 @@ export async function updateCollection(id: string, input: CollectionInput) {
       seoDescription: data.seoDescription,
     },
   })
+  invalidateCatalogueCache()
+  return collection
 }
 
 export class CollectionInUseError extends Error {
@@ -84,4 +89,5 @@ export async function deleteCollection(id: string) {
   await prisma.collection.delete({
     where: { id },
   })
+  invalidateCatalogueCache()
 }
diff --git a/lib/services/order-service.ts b/lib/services/order-service.ts
index 443e361..054dcc1 100644
--- a/lib/services/order-service.ts
+++ b/lib/services/order-service.ts
@@ -1,5 +1,8 @@
 import { prisma } from "@/lib/prisma"
 import { OrderStatus, Prisma } from "@prisma/client"
+import { writeAudit } from "@/lib/audit"
+import { AppError } from "@/lib/http/errors"
+import { canAdminTransitionOrder } from "@/lib/orders/state-machine"
 
 export type AdminOrder = Prisma.OrderGetPayload<{
   include: {
@@ -34,8 +37,12 @@ export type AdminOrder = Prisma.OrderGetPayload<{
 export async function getAdminOrders(params: {
   search?: string
   status?: OrderStatus | "all"
+  page?: number
+  pageSize?: number
 } = {}): Promise<AdminOrder[]> {
   const { search, status } = params
+  const page = Math.max(params.page ?? 1, 1)
+  const pageSize = Math.min(Math.max(params.pageSize ?? 50, 1), 100)
 
   const where: Prisma.OrderWhereInput = {
     AND: [
@@ -54,6 +61,8 @@ export async function getAdminOrders(params: {
   return prisma.order.findMany({
     where,
     orderBy: { createdAt: "desc" },
+    skip: (page - 1) * pageSize,
+    take: pageSize,
     include: {
       user: {
         select: { id: true, name: true, email: true },
@@ -72,6 +81,28 @@ export async function getAdminOrders(params: {
   })
 }
 
+export async function countAdminOrders(params: {
+  search?: string
+  status?: OrderStatus | "all"
+} = {}) {
+  const { search, status } = params
+  return prisma.order.count({
+    where: {
+      AND: [
+        status && status !== "all" ? { status } : {},
+        search
+          ? {
+              OR: [
+                { reference: { contains: search } },
+                { user: { email: { contains: search } } },
+              ],
+            }
+          : {},
+      ],
+    },
+  })
+}
+
 export async function getAdminOrderById(id: string): Promise<AdminOrder | null> {
   if (!id) {
     return null
@@ -97,45 +128,130 @@ export async function getAdminOrderById(id: string): Promise<AdminOrder | null>
   })
 }
 
-export async function updateOrderStatus(id: string, status: OrderStatus) {
-  const order = await prisma.order.update({
-    where: { id },
-    data: { status },
-    include: {
-      user: {
-        select: { email: true, name: true },
+export async function updateOrderStatus(input: {
+  orderId: string
+  status: OrderStatus
+  actorId: string
+  reason: string
+}) {
+  const reason = input.reason.trim()
+  if (reason.length < 3 || reason.length > 500) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: "A reason between 3 and 500 characters is required.",
+    })
+  }
+
+  const existing = await prisma.order.findUnique({
+    where: { id: input.orderId },
+    select: { status: true },
+  })
+  if (!existing) throw new AppError("NOT_FOUND")
+  if (!canAdminTransitionOrder(existing.status, input.status)) {
+    throw new AppError("VALIDATION_ERROR", {
+      message: `Order cannot move from ${existing.status} to ${input.status}.`,
+    })
+  }
+
+  const order = await prisma.$transaction(async (tx) => {
+    const transitioned = await tx.order.updateMany({
+      where: { id: input.orderId, status: existing.status },
+      data: { status: input.status },
+    })
+    if (transitioned.count !== 1) {
+      throw new AppError("VALIDATION_ERROR", {
+        message: "The order changed while this update was being processed.",
+      })
+    }
+
+    if (existing.status === "PENDING" && input.status === "CANCELLED") {
+      const reservations = await tx.inventoryReservation.findMany({
+        where: { orderId: input.orderId, status: "RESERVED" },
+        select: { id: true, productId: true, quantity: true },
+      })
+      for (const reservation of reservations) {
+        const released = await tx.inventoryReservation.updateMany({
+          where: { id: reservation.id, status: "RESERVED" },
+          data: {
+            status: "RELEASED",
+            releasedAt: new Date(),
+          },
+        })
+        if (released.count !== 1) {
+          throw new AppError("VALIDATION_ERROR", {
+            message: "Inventory changed while cancellation was processing.",
+          })
+        }
+        await tx.product.update({
+          where: { id: reservation.productId },
+          data: { stock: { increment: reservation.quantity } },
+        })
+        await tx.inventoryMovement.create({
+          data: {
+            productId: reservation.productId,
+            delta: reservation.quantity,
+            reason: "RESERVATION_CANCELLED",
+            sourceType: "ORDER",
+            sourceId: input.orderId,
+          },
+        })
+      }
+      await tx.paymentAttempt.updateMany({
+        where: {
+          orderId: input.orderId,
+          status: { in: ["INITIALIZED", "PENDING"] },
+        },
+        data: {
+          status: "ABANDONED",
+          failureCode: "ORDER_CANCELLED",
+        },
+      })
+    }
+
+    await tx.notification.create({
+      data: {
+        type: `ORDER_${input.status}`,
+        title: `Order ${input.status.toLowerCase()}`,
+        message: `Order status changed from ${existing.status.toLowerCase()} to ${input.status.toLowerCase()}`,
+        orderId: input.orderId,
+        dedupeKey: `order-status:${input.orderId}:${existing.status}:${input.status}`,
       },
-      items: {
-        include: {
-          product: {
-            select: { name: true, priceNGN: true },
+    })
+
+    return tx.order.findUniqueOrThrow({
+      where: { id: input.orderId },
+      include: {
+        user: { select: { email: true, name: true } },
+        items: {
+          include: {
+            product: {
+              select: { name: true, priceNGN: true, slug: true },
+            },
           },
         },
       },
+    })
+  })
+
+  await writeAudit({
+    actorId: input.actorId,
+    actorRole: "ADMIN",
+    action: "order.status.transition",
+    targetType: "Order",
+    targetId: input.orderId,
+    metadata: {
+      from: existing.status,
+      to: input.status,
+      reason,
     },
   })
 
   // Send email notification (best-effort, don't fail if email fails)
   try {
     const { sendOrderStatusUpdate } = await import("@/emails/sendOrderStatusUpdate")
-    await sendOrderStatusUpdate(order, status)
+    await sendOrderStatusUpdate(order, input.status)
   } catch (error) {
     console.error("Failed to send order status update email:", error)
   }
 
-  // Create admin notification for status changes
-  try {
-    await prisma.notification.create({
-      data: {
-        type: `ORDER_${status}`,
-        title: `Order ${status.toLowerCase()}`,
-        message: `Order #${order.reference || order.id.slice(0, 8)} is now ${status.toLowerCase()}`,
-        orderId: order.id,
-      },
-    })
-  } catch (error) {
-    console.error("Failed to create notification:", error)
-  }
-
   return order
 }
diff --git a/lib/services/product-service.ts b/lib/services/product-service.ts
index 11f99ee..75437ba 100644
--- a/lib/services/product-service.ts
+++ b/lib/services/product-service.ts
@@ -1,4 +1,5 @@
 import { prisma } from "@/lib/prisma"
+import { invalidateCatalogueCache } from "@/lib/cache/catalogue"
 import { Prisma, ProductCategory } from "@prisma/client"
 import { z } from "zod"
 
@@ -136,7 +137,7 @@ export async function getAdminProductById(id: string): Promise<AdminProduct | nu
 
 export async function getProductBySlug(slug: string) {
   return prisma.product.findFirst({
-    where: { slug, deletedAt: null },
+    where: { slug, deletedAt: null, publishStatus: "PUBLISHED" },
   })
 }
 
@@ -152,6 +153,7 @@ export async function getProducts(params: {
 
   const where: Prisma.ProductWhereInput = {
     deletedAt: null, // Exclude soft-deleted products
+    publishStatus: "PUBLISHED",
   }
 
   if (category) where.category = category
@@ -172,6 +174,7 @@ export async function getProductsForSearch(query: string) {
     where: {
       OR: [{ name: { contains: query } }, { brand: { contains: query } }],
       deletedAt: null, // Exclude soft-deleted products
+      publishStatus: "PUBLISHED",
     },
     take: 10,
     orderBy: { createdAt: "desc" },
@@ -185,12 +188,13 @@ export async function getCartProducts(productIds: string[]) {
     where: {
       id: { in: productIds },
       deletedAt: null, // Exclude soft-deleted products
+      publishStatus: "PUBLISHED",
     },
   })
 }
 
 export async function createProduct(input: ProductInput) {
-  return prisma.product.create({
+  const product = await prisma.product.create({
     data: {
       name: input.name,
       slug: input.slug,
@@ -213,10 +217,12 @@ export async function createProduct(input: ProductInput) {
       sku: input.sku, barcode: input.barcode, launchYear: input.launchYear, perfumer: input.perfumer, countryOfOrigin: input.countryOfOrigin, concentration: input.concentration, longevity: input.longevity, sillage: input.sillage, intensity: input.intensity, sprayGuidance: input.sprayGuidance, climate: input.climate, season: input.season, timeOfDay: input.timeOfDay, occasion: input.occasion, weightGrams: input.weightGrams, shippingClass: input.shippingClass, reorderPoint: input.reorderPoint, dropDate: input.dropDate ? new Date(input.dropDate) : null, seoTitle: input.seoTitle, seoDescription: input.seoDescription, publishStatus: input.publishStatus, beginnerFriendly: input.beginnerFriendly, returnEligible: input.returnEligible, isPreorder: input.isPreorder, isWaitlist: input.isWaitlist,
     },
   })
+  invalidateCatalogueCache()
+  return product
 }
 
 export async function updateProduct(id: string, input: ProductInput) {
-  return prisma.product.update({
+  const product = await prisma.product.update({
     where: { id },
     data: {
       name: input.name,
@@ -240,6 +246,8 @@ export async function updateProduct(id: string, input: ProductInput) {
       sku: input.sku, barcode: input.barcode, launchYear: input.launchYear, perfumer: input.perfumer, countryOfOrigin: input.countryOfOrigin, concentration: input.concentration, longevity: input.longevity, sillage: input.sillage, intensity: input.intensity, sprayGuidance: input.sprayGuidance, climate: input.climate, season: input.season, timeOfDay: input.timeOfDay, occasion: input.occasion, weightGrams: input.weightGrams, shippingClass: input.shippingClass, reorderPoint: input.reorderPoint, dropDate: input.dropDate ? new Date(input.dropDate) : null, seoTitle: input.seoTitle, seoDescription: input.seoDescription, publishStatus: input.publishStatus, beginnerFriendly: input.beginnerFriendly, returnEligible: input.returnEligible, isPreorder: input.isPreorder, isWaitlist: input.isWaitlist,
     },
   })
+  invalidateCatalogueCache()
+  return product
 }
 
 export class ProductInUseError extends Error {
@@ -286,6 +294,7 @@ export async function deleteProduct(id: string): Promise<void> {
       where: { id },
       data: { deletedAt: new Date() },
     })
+    invalidateCatalogueCache()
     throw new ProductInUseError(
       `Cannot delete "${product.name}": it is referenced by ${orderItemsCount} order item(s). The product has been soft-deleted (hidden from listings).`
     )
@@ -295,6 +304,7 @@ export async function deleteProduct(id: string): Promise<void> {
   await prisma.product.delete({
     where: { id },
   })
+  invalidateCatalogueCache()
 }
 
 export async function getProductStats() {
diff --git a/next.config.js b/next.config.js
index 285c396..53c44ab 100644
--- a/next.config.js
+++ b/next.config.js
@@ -1,10 +1,44 @@
 /** @type {import('next').NextConfig} */
+const isProduction = process.env.NODE_ENV === "production";
+
+const contentSecurityPolicy = [
+  "default-src 'self'",
+  `script-src 'self' 'unsafe-inline'${isProduction ? "" : " 'unsafe-eval'"} https://va.vercel-scripts.com`,
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https:",
+  "font-src 'self' data: https://fonts.gstatic.com",
+  "connect-src 'self' https://api.paystack.co https://vitals.vercel-insights.com",
+  "frame-ancestors 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  ...(isProduction ? ["upgrade-insecure-requests"] : []),
+].join("; ");
+
+const securityHeaders = [
+  { key: "Content-Security-Policy", value: contentSecurityPolicy },
+  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+  { key: "X-Content-Type-Options", value: "nosniff" },
+  { key: "X-Frame-Options", value: "DENY" },
+  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=()" },
+  ...(isProduction
+    ? [{ key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" }]
+    : []),
+];
+
 const nextConfig = {
   devIndicators: false,
   turbopack: {
     // Avoid accidentally picking up lockfiles outside this repo (monorepo/root inference).
     root: __dirname,
   },
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: securityHeaders,
+      },
+    ];
+  },
 };
 
 module.exports = nextConfig;
diff --git a/package-lock.json b/package-lock.json
index 9e2520d..883ad79 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "hasInstallScript": true,
       "dependencies": {
         "@hookform/resolvers": "^3.10.0",
-        "@prisma/client": "^6.19.2",
+        "@prisma/client": "6.19.3",
         "@radix-ui/react-accordion": "1.2.2",
         "@radix-ui/react-alert-dialog": "1.1.4",
         "@radix-ui/react-aspect-ratio": "1.1.1",
@@ -51,8 +51,8 @@
         "input-otp": "1.4.1",
         "lucide-react": "^0.454.0",
         "motion": "^12.42.2",
-        "next": "16.0.7",
-        "next-auth": "^5.0.0-beta.30",
+        "next": "16.2.11",
+        "next-auth": "5.0.0-beta.32",
         "next-themes": "^0.4.6",
         "react": "19.2.0",
         "react-day-picker": "9.8.0",
@@ -61,7 +61,7 @@
         "react-icons": "^5.5.0",
         "react-resizable-panels": "^2.1.7",
         "recharts": "2.15.4",
-        "resend": "^6.5.2",
+        "resend": "6.18.0",
         "sonner": "^1.7.4",
         "tailwind-merge": "^3.3.1",
         "tailwindcss-animate": "^1.0.7",
@@ -80,9 +80,10 @@
         "@typescript-eslint/parser": "^8.56.1",
         "eslint": "^9.39.3",
         "eslint-config-next": "^16.1.6",
-        "postcss": "^8.5",
-        "prisma": "^6.19.2",
+        "postcss": "8.5.22",
+        "prisma": "6.19.3",
         "tailwindcss": "^4.1.9",
+        "tsx": "^4.23.1",
         "tw-animate-css": "1.3.3",
         "typescript": "^5",
         "vite-tsconfig-paths": "^5.1.4",
@@ -106,9 +107,9 @@
       }
     },
     "node_modules/@auth/core": {
-      "version": "0.41.0",
-      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.0.tgz",
-      "integrity": "sha512-Wd7mHPQ/8zy6Qj7f4T46vg3aoor8fskJm6g2Zyj064oQ3+p0xNZXAV60ww0hY+MbTesfu29kK14Zk5d5JTazXQ==",
+      "version": "0.41.3",
+      "resolved": "https://registry.npmjs.org/@auth/core/-/core-0.41.3.tgz",
+      "integrity": "sha512-sJ3JMHHkXMD3aOjopv7mOBTO1Ocw4b0fAEXJBz6k7YHLpYQI6C40jCUPc5fNvUKxXRXNE1/sRISA15UrwWJBTw==",
       "license": "ISC",
       "dependencies": {
         "@panva/hkdf": "^1.2.1",
@@ -120,7 +121,7 @@
       "peerDependencies": {
         "@simplewebauthn/browser": "^9.0.1",
         "@simplewebauthn/server": "^9.0.2",
-        "nodemailer": "^6.8.0"
+        "nodemailer": "^7.0.7 || ^8.0.5"
       },
       "peerDependenciesMeta": {
         "@simplewebauthn/browser": {
@@ -435,9 +436,9 @@
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.7.1.tgz",
-      "integrity": "sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==",
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -744,6 +745,23 @@
         "node": ">=12"
       }
     },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/netbsd-x64": {
       "version": "0.21.5",
       "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz",
@@ -761,6 +779,23 @@
         "node": ">=12"
       }
     },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/openbsd-x64": {
       "version": "0.21.5",
       "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz",
@@ -778,6 +813,23 @@
         "node": ">=12"
       }
     },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@esbuild/sunos-x64": {
       "version": "0.21.5",
       "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz",
@@ -1162,9 +1214,9 @@
       }
     },
     "node_modules/@img/colour": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.0.0.tgz",
-      "integrity": "sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -1172,9 +1224,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz",
-      "integrity": "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.3.tgz",
+      "integrity": "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==",
       "cpu": [
         "arm64"
       ],
@@ -1184,19 +1236,19 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.2.4"
+        "@img/sharp-libvips-darwin-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz",
-      "integrity": "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.3.tgz",
+      "integrity": "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==",
       "cpu": [
         "x64"
       ],
@@ -1206,19 +1258,38 @@
         "darwin"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.2.4"
+        "@img/sharp-libvips-darwin-x64": "1.3.2"
+      }
+    },
+    "node_modules/@img/sharp-freebsd-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.3.tgz",
+      "integrity": "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "dependencies": {
+        "@img/sharp-wasm32": "0.35.3"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz",
-      "integrity": "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.2.tgz",
+      "integrity": "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==",
       "cpu": [
         "arm64"
       ],
@@ -1232,9 +1303,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz",
-      "integrity": "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.2.tgz",
+      "integrity": "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==",
       "cpu": [
         "x64"
       ],
@@ -1248,9 +1319,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz",
-      "integrity": "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.2.tgz",
+      "integrity": "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==",
       "cpu": [
         "arm"
       ],
@@ -1264,9 +1335,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz",
-      "integrity": "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.2.tgz",
+      "integrity": "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==",
       "cpu": [
         "arm64"
       ],
@@ -1280,9 +1351,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz",
-      "integrity": "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.2.tgz",
+      "integrity": "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==",
       "cpu": [
         "ppc64"
       ],
@@ -1296,9 +1367,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz",
-      "integrity": "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.2.tgz",
+      "integrity": "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==",
       "cpu": [
         "riscv64"
       ],
@@ -1312,9 +1383,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz",
-      "integrity": "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.2.tgz",
+      "integrity": "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==",
       "cpu": [
         "s390x"
       ],
@@ -1328,9 +1399,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz",
-      "integrity": "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.2.tgz",
+      "integrity": "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==",
       "cpu": [
         "x64"
       ],
@@ -1344,9 +1415,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz",
-      "integrity": "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.2.tgz",
+      "integrity": "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==",
       "cpu": [
         "arm64"
       ],
@@ -1360,9 +1431,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz",
-      "integrity": "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.2.tgz",
+      "integrity": "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==",
       "cpu": [
         "x64"
       ],
@@ -1376,9 +1447,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz",
-      "integrity": "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.3.tgz",
+      "integrity": "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==",
       "cpu": [
         "arm"
       ],
@@ -1388,19 +1459,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.2.4"
+        "@img/sharp-libvips-linux-arm": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz",
-      "integrity": "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.3.tgz",
+      "integrity": "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==",
       "cpu": [
         "arm64"
       ],
@@ -1410,19 +1481,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.2.4"
+        "@img/sharp-libvips-linux-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz",
-      "integrity": "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.3.tgz",
+      "integrity": "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==",
       "cpu": [
         "ppc64"
       ],
@@ -1432,19 +1503,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.2.4"
+        "@img/sharp-libvips-linux-ppc64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz",
-      "integrity": "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.3.tgz",
+      "integrity": "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1454,19 +1525,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.2.4"
+        "@img/sharp-libvips-linux-riscv64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz",
-      "integrity": "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.3.tgz",
+      "integrity": "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==",
       "cpu": [
         "s390x"
       ],
@@ -1476,19 +1547,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.2.4"
+        "@img/sharp-libvips-linux-s390x": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz",
-      "integrity": "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.3.tgz",
+      "integrity": "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==",
       "cpu": [
         "x64"
       ],
@@ -1498,19 +1569,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.2.4"
+        "@img/sharp-libvips-linux-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz",
-      "integrity": "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.3.tgz",
+      "integrity": "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==",
       "cpu": [
         "arm64"
       ],
@@ -1520,19 +1591,19 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz",
-      "integrity": "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.3.tgz",
+      "integrity": "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==",
       "cpu": [
         "x64"
       ],
@@ -1542,38 +1613,54 @@
         "linux"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz",
-      "integrity": "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.3.tgz",
+      "integrity": "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==",
+      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/runtime": "^1.11.1"
+      },
+      "engines": {
+        "node": ">=20.9.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-webcontainers-wasm32": {
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.3.tgz",
+      "integrity": "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==",
       "cpu": [
         "wasm32"
       ],
-      "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
+      "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@emnapi/runtime": "^1.7.0"
+        "@img/sharp-wasm32": "0.35.3"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz",
-      "integrity": "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.3.tgz",
+      "integrity": "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==",
       "cpu": [
         "arm64"
       ],
@@ -1583,16 +1670,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz",
-      "integrity": "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.3.tgz",
+      "integrity": "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==",
       "cpu": [
         "ia32"
       ],
@@ -1602,16 +1689,16 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": "^20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz",
-      "integrity": "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==",
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.3.tgz",
+      "integrity": "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==",
       "cpu": [
         "x64"
       ],
@@ -1621,7 +1708,7 @@
         "win32"
       ],
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
@@ -1691,9 +1778,9 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.0.7.tgz",
-      "integrity": "sha512-gpaNgUh5nftFKRkRQGnVi5dpcYSKGcZZkQffZ172OrG/XkrnS7UBTQ648YY+8ME92cC4IojpI2LqTC8sTDhAaw==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.11.tgz",
+      "integrity": "sha512-0do5A3BJ2gxWr0ZCMcD6BhW+e595jyxdTl3rXTS6lOtD8ektMiW6CO+EPwt1Eca1DBnm90r/7GdiKWBKxH++DA==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
@@ -1707,9 +1794,9 @@
       }
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.0.7.tgz",
-      "integrity": "sha512-LlDtCYOEj/rfSnEn/Idi+j1QKHxY9BJFmxx7108A6D8K0SB+bNgfYQATPk/4LqOl4C0Wo3LACg2ie6s7xqMpJg==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.11.tgz",
+      "integrity": "sha512-wryL4pjKmDwGv2ox6+GZDFxvmtSRLqApBR8kL1j4+vhB7Z5vJC/zAnXpiR9Xkfzl0AS8WLMnsuGV/UKI67/rrw==",
       "cpu": [
         "arm64"
       ],
@@ -1723,9 +1810,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.0.7.tgz",
-      "integrity": "sha512-rtZ7BhnVvO1ICf3QzfW9H3aPz7GhBrnSIMZyr4Qy6boXF0b5E3QLs+cvJmg3PsTCG2M1PBoC+DANUi4wCOKXpA==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.11.tgz",
+      "integrity": "sha512-aZl2j4f/fLyjQvOhv0Oe9UaMAQHolYpKhctsoYzplSumKJKPUmgjcf6545aBtysLTcu994TREd0+pSgNE4ohmg==",
       "cpu": [
         "x64"
       ],
@@ -1739,9 +1826,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.0.7.tgz",
-      "integrity": "sha512-mloD5WcPIeIeeZqAIP5c2kdaTa6StwP4/2EGy1mUw8HiexSHGK/jcM7lFuS3u3i2zn+xH9+wXJs6njO7VrAqww==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.11.tgz",
+      "integrity": "sha512-5jEriyEnH/LWFy27L2ZG0XaLlyEJIjhsImEsiS9P563PKEVp2BVups/xfOucIrsvVntp11oNcZwjHvaDPYVB5g==",
       "cpu": [
         "arm64"
       ],
@@ -1755,9 +1842,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.0.7.tgz",
-      "integrity": "sha512-+ksWNrZrthisXuo9gd1XnjHRowCbMtl/YgMpbRvFeDEqEBd523YHPWpBuDjomod88U8Xliw5DHhekBC3EOOd9g==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.11.tgz",
+      "integrity": "sha512-eIjcpx2fnnFSSkZDbTxy74KnokUXDjfoLClpWelfgHLf621aTqswhwXQ7GkD5K5rplrS6LZ/Bj+mVuvzluBOEg==",
       "cpu": [
         "arm64"
       ],
@@ -1771,9 +1858,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.0.7.tgz",
-      "integrity": "sha512-4WtJU5cRDxpEE44Ana2Xro1284hnyVpBb62lIpU5k85D8xXxatT+rXxBgPkc7C1XwkZMWpK5rXLXTh9PFipWsA==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.11.tgz",
+      "integrity": "sha512-8WgzpaWMs46qJT9kiV47cje86L0x/Mu9t8/Gwj+pnbgW3rETVfCnaScPjlYUwNScpOozdcIMHWmAvuZJUonR2w==",
       "cpu": [
         "x64"
       ],
@@ -1787,9 +1874,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.0.7.tgz",
-      "integrity": "sha512-HYlhqIP6kBPXalW2dbMTSuB4+8fe+j9juyxwfMwCe9kQPPeiyFn7NMjNfoFOfJ2eXkeQsoUGXg+O2SE3m4Qg2w==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.11.tgz",
+      "integrity": "sha512-I3UgPds7G4ZYnTb/H+5GBGuUT2DhAk6j0mL6A4s63RjFs74wB2hOWP0vaxsK+3NJraExt3eYEPQ/UtT0x/64Nw==",
       "cpu": [
         "x64"
       ],
@@ -1803,9 +1890,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.0.7.tgz",
-      "integrity": "sha512-EviG+43iOoBRZg9deGauXExjRphhuYmIOJ12b9sAPy0eQ6iwcPxfED2asb/s2/yiLYOdm37kPaiZu8uXSYPs0Q==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.11.tgz",
+      "integrity": "sha512-n89CjtcThnjrwgJMAiI5xbqwLY51zvwC9tSlArmVndAJLYVl9T9UAdlkXTmZvE++idoXe8KdglQlhNRdUp1c6g==",
       "cpu": [
         "arm64"
       ],
@@ -1819,9 +1906,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.0.7.tgz",
-      "integrity": "sha512-gniPjy55zp5Eg0896qSrf3yB1dw4F/3s8VK1ephdsZZ129j2n6e1WqCbE2YgcKhW9hPB9TVZENugquWJD5x0ug==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.11.tgz",
+      "integrity": "sha512-md8CLNggS1Dx9pUgApzps5uAf+N8GN9xywzmNx9vHAWo94HtBwCCqkSnhIrdfQe83Dhz8Lfo/20Nb1Zxal092w==",
       "cpu": [
         "x64"
       ],
@@ -1908,9 +1995,9 @@
       }
     },
     "node_modules/@prisma/client": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-6.19.2.tgz",
-      "integrity": "sha512-gR2EMvfK/aTxsuooaDA32D8v+us/8AAet+C3J1cc04SW35FPdZYgLF+iN4NDLUgAaUGTKdAB0CYenu1TAgGdMg==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-6.19.3.tgz",
+      "integrity": "sha512-mKq3jQFhjvko5LTJFHGilsuQs+W+T3Gm451NzuTDGQxwCzwXHYnIu2zGkRoW+Exq3Rob7yp2MfzSrdIiZVhrBg==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "engines": {
@@ -1930,37 +2017,37 @@
       }
     },
     "node_modules/@prisma/config": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-6.19.2.tgz",
-      "integrity": "sha512-kadBGDl+aUswv/zZMk9Mx0C8UZs1kjao8H9/JpI4Wh4SHZaM7zkTwiKn/iFLfRg+XtOAo/Z/c6pAYhijKl0nzQ==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-6.19.3.tgz",
+      "integrity": "sha512-CBPT44BjlQxEt8kiMEauji2WHTDoVBOKl7UlewXmUgBPnr/oPRZC3psci5chJnYmH0ivEIog2OU9PGWoki3DLQ==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "c12": "3.1.0",
         "deepmerge-ts": "7.1.5",
-        "effect": "3.18.4",
+        "effect": "3.21.0",
         "empathic": "2.0.0"
       }
     },
     "node_modules/@prisma/debug": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-6.19.2.tgz",
-      "integrity": "sha512-lFnEZsLdFLmEVCVNdskLDCL8Uup41GDfU0LUfquw+ercJC8ODTuL0WNKgOKmYxCJVvFwf0OuZBzW99DuWmoH2A==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-6.19.3.tgz",
+      "integrity": "sha512-ljkJ+SgpXNktLG0Q/n4JGYCkKf0f8oYLyjImS2I8e2q2WCfdRRtWER062ZV/ixaNP2M2VKlWXVJiGzZaUgbKZw==",
       "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/engines": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-6.19.2.tgz",
-      "integrity": "sha512-TTkJ8r+uk/uqczX40wb+ODG0E0icVsMgwCTyTHXehaEfb0uo80M9g1aW1tEJrxmFHeOZFXdI2sTA1j1AgcHi4A==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-6.19.3.tgz",
+      "integrity": "sha512-RSYxtlYFl5pJ8ZePgMv0lZ9IzVCOdTPOegrs2qcbAEFrBI1G33h6wyC9kjQvo0DnYEhEVY0X4LsuFHXLKQk88g==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "6.19.2",
+        "@prisma/debug": "6.19.3",
         "@prisma/engines-version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
-        "@prisma/fetch-engine": "6.19.2",
-        "@prisma/get-platform": "6.19.2"
+        "@prisma/fetch-engine": "6.19.3",
+        "@prisma/get-platform": "6.19.3"
       }
     },
     "node_modules/@prisma/engines-version": {
@@ -1971,25 +2058,25 @@
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/fetch-engine": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-6.19.2.tgz",
-      "integrity": "sha512-h4Ff4Pho+SR1S8XerMCC12X//oY2bG3Iug/fUnudfcXEUnIeRiBdXHFdGlGOgQ3HqKgosTEhkZMvGM9tWtYC+Q==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-6.19.3.tgz",
+      "integrity": "sha512-tKtl/qco9Nt7LU5iKhpultD8O4vMCZcU2CHjNTnRrL1QvSUr5W/GcyFPjNL87GtRrwBc7ubXXD9xy4EvLvt8JA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "6.19.2",
+        "@prisma/debug": "6.19.3",
         "@prisma/engines-version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
-        "@prisma/get-platform": "6.19.2"
+        "@prisma/get-platform": "6.19.3"
       }
     },
     "node_modules/@prisma/get-platform": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-6.19.2.tgz",
-      "integrity": "sha512-PGLr06JUSTqIvztJtAzIxOwtWKtJm5WwOG6xpsgD37Rc84FpfUBGLKz65YpJBGtkRQGXTYEFie7pYALocC3MtA==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-6.19.3.tgz",
+      "integrity": "sha512-xFj1VcJ1N3MKooOQAGO0W5tsd0W2QzIvW7DD7c/8H14Zmp4jseeWAITm+w2LLoLrlhoHdPPh0NMZ8mfL6puoHA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/debug": "6.19.2"
+        "@prisma/debug": "6.19.3"
       }
     },
     "node_modules/@radix-ui/number": {
@@ -4205,7 +4292,9 @@
       "version": "22.19.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
       "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -5316,12 +5405,15 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.4",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.4.tgz",
-      "integrity": "sha512-ZCQ9GEWl73BVm8bu5Fts8nt7MHdbt5vY9bP6WGnUh+r3l8M7CgfyTlwsgCbMC66BNxPr6Xoce3j66Ms5YUQTNA==",
+      "version": "2.11.1",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.1.tgz",
+      "integrity": "sha512-HYXq73DDpCtNzOmrFsm9eSwCvWCql0RzqjpDzXN9EadiLJ4DNat0nsZ/Bzmy+Ud12mb4/zKDY0cQ805ZzN+i0A==",
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/bcryptjs": {
@@ -5981,9 +6073,9 @@
       }
     },
     "node_modules/defu": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
-      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -6062,9 +6154,9 @@
       }
     },
     "node_modules/effect": {
-      "version": "3.18.4",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.18.4.tgz",
-      "integrity": "sha512-b1LXQJLe9D11wfnOKAk3PKxuqYshQ0Heez+y5pnkd3jLj1yx9QhM72zZ9uUrOQyNvrs2GZZd/3maL0ZV18YuDA==",
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.0.tgz",
+      "integrity": "sha512-PPN80qRokCd1f015IANNhrwOnLO7GrrMQfk4/lnZRE/8j7UPWrNNjPV0uBrZutI/nHzernbW+J0hdqQysHiSnQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -6321,12 +6413,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/es6-promise": {
-      "version": "4.2.8",
-      "resolved": "https://registry.npmjs.org/es6-promise/-/es6-promise-4.2.8.tgz",
-      "integrity": "sha512-HJDGx5daxeIvxdBxvG2cb9g4tEvwIk3i8+nhX0yGrYmZUzbkdg8QbDevheDB8gd0//uPj4c1EQua8Q+MViT0/w==",
-      "license": "MIT"
-    },
     "node_modules/esbuild": {
       "version": "0.21.5",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz",
@@ -7035,9 +7121,9 @@
       }
     },
     "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
+      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -8191,9 +8277,9 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
-      "integrity": "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ==",
+      "version": "6.2.4",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.4.tgz",
+      "integrity": "sha512-N8acGzVsQy6M/fjFcxtysNc4Q379TcM5dM/qKkNtsHFji88yANnXTr7BLeP75iPnFwBfQzM/jg2BZ9+HZrHCZA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -8603,9 +8689,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash.merge": {
@@ -8787,9 +8873,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "funding": [
         {
           "type": "github",
@@ -8828,13 +8914,14 @@
       "license": "MIT"
     },
     "node_modules/next": {
-      "version": "16.0.7",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.0.7.tgz",
-      "integrity": "sha512-3mBRJyPxT4LOxAJI6IsXeFtKfiJUbjCLgvXO02fV8Wy/lIhPvP94Fe7dGhUgHXcQy4sSuYwQNcOLhIfOm0rL0A==",
+      "version": "16.2.11",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.11.tgz",
+      "integrity": "sha512-B339zaqbyK8cmxhoAvLrcwoabwCP1wz21zSzfqxqXAemTu2BXnH7tQnfcglKv1vnMUIDBc+Hth7XODQriTZiRQ==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.0.7",
+        "@next/env": "16.2.11",
         "@swc/helpers": "0.5.15",
+        "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
         "postcss": "8.4.31",
         "styled-jsx": "5.1.6"
@@ -8846,15 +8933,15 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.0.7",
-        "@next/swc-darwin-x64": "16.0.7",
-        "@next/swc-linux-arm64-gnu": "16.0.7",
-        "@next/swc-linux-arm64-musl": "16.0.7",
-        "@next/swc-linux-x64-gnu": "16.0.7",
-        "@next/swc-linux-x64-musl": "16.0.7",
-        "@next/swc-win32-arm64-msvc": "16.0.7",
-        "@next/swc-win32-x64-msvc": "16.0.7",
-        "sharp": "^0.34.4"
+        "@next/swc-darwin-arm64": "16.2.11",
+        "@next/swc-darwin-x64": "16.2.11",
+        "@next/swc-linux-arm64-gnu": "16.2.11",
+        "@next/swc-linux-arm64-musl": "16.2.11",
+        "@next/swc-linux-x64-gnu": "16.2.11",
+        "@next/swc-linux-x64-musl": "16.2.11",
+        "@next/swc-win32-arm64-msvc": "16.2.11",
+        "@next/swc-win32-x64-msvc": "16.2.11",
+        "sharp": "^0.34.5"
       },
       "peerDependencies": {
         "@opentelemetry/api": "^1.1.0",
@@ -8880,18 +8967,18 @@
       }
     },
     "node_modules/next-auth": {
-      "version": "5.0.0-beta.30",
-      "resolved": "https://registry.npmjs.org/next-auth/-/next-auth-5.0.0-beta.30.tgz",
-      "integrity": "sha512-+c51gquM3F6nMVmoAusRJ7RIoY0K4Ts9HCCwyy/BRoe4mp3msZpOzYMyb5LAYc1wSo74PMQkGDcaghIO7W6Xjg==",
+      "version": "5.0.0-beta.32",
+      "resolved": "https://registry.npmjs.org/next-auth/-/next-auth-5.0.0-beta.32.tgz",
+      "integrity": "sha512-CGlChIEWZ6LltNVxrE5yiySMID+Idpmry47JYA5lLwgD8Sx02a8M65VL0TWVz9nbnOioS/tCW/rP/0+mE7Qp4Q==",
       "license": "ISC",
       "dependencies": {
-        "@auth/core": "0.41.0"
+        "@auth/core": "0.41.3"
       },
       "peerDependencies": {
         "@simplewebauthn/browser": "^9.0.1",
         "@simplewebauthn/server": "^9.0.2",
         "next": "^14.0.0-0 || ^15.0.0 || ^16.0.0",
-        "nodemailer": "^7.0.7",
+        "nodemailer": "^7.0.7 || ^8.0.5",
         "react": "^18.2.0 || ^19.0.0"
       },
       "peerDependenciesMeta": {
@@ -8916,34 +9003,6 @@
         "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc"
       }
     },
-    "node_modules/next/node_modules/postcss": {
-      "version": "8.4.31",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
-      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
     "node_modules/node-exports-info": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.0.tgz",
@@ -9008,15 +9067,15 @@
       }
     },
     "node_modules/nypm": {
-      "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.5.tgz",
-      "integrity": "sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==",
+      "version": "0.6.8",
+      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.8.tgz",
+      "integrity": "sha512-Q9K4Diu6l5u6xJQogeFSs/zKtyMSgFKFtRQV+tHP4kL7KPm2grpBU0dFIwFaXwNxN0MtfKWc43VpCugAa+LPsw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "citty": "^0.2.0",
+        "citty": "^0.2.2",
         "pathe": "^2.0.3",
-        "tinyexec": "^1.0.2"
+        "tinyexec": "^1.2.4"
       },
       "bin": {
         "nypm": "dist/cli.mjs"
@@ -9026,16 +9085,16 @@
       }
     },
     "node_modules/nypm/node_modules/citty": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.0.tgz",
-      "integrity": "sha512-8csy5IBFI2ex2hTVpaHN2j+LNE199AgiI7y4dMintrr8i0lQiFn+0AWMZrWdHKIgMOer65f8IThysYhoReqjWA==",
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
+      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/oauth4webapi": {
-      "version": "3.8.3",
-      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.3.tgz",
-      "integrity": "sha512-pQ5BsX3QRTgnt5HxgHwgunIRaDXBdkT23tf8dfzmtTIL2LTpdmxgbpbBm0VgFWAIDlezQvQCTgnVIUmHupXHxw==",
+      "version": "3.8.6",
+      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.6.tgz",
+      "integrity": "sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -9345,14 +9404,14 @@
       }
     },
     "node_modules/pkg-types": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.0.tgz",
-      "integrity": "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
+      "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "confbox": "^0.2.2",
-        "exsolve": "^1.0.7",
+        "confbox": "^0.2.4",
+        "exsolve": "^1.0.8",
         "pathe": "^2.0.3"
       }
     },
@@ -9413,10 +9472,16 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/postal-mime": {
+      "version": "2.7.5",
+      "resolved": "https://registry.npmjs.org/postal-mime/-/postal-mime-2.7.5.tgz",
+      "integrity": "sha512-GNEXKvWFQnbgO5NlrGzVa0FmWzBZ24PersAWErttSg1Hjpf0ATxTwS5DOMGaOpTG6bUh5cTr7xi0jAD942wCJA==",
+      "license": "MIT-0"
+    },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.22",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.22.tgz",
+      "integrity": "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -9433,7 +9498,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -9477,15 +9542,15 @@
       }
     },
     "node_modules/prisma": {
-      "version": "6.19.2",
-      "resolved": "https://registry.npmjs.org/prisma/-/prisma-6.19.2.tgz",
-      "integrity": "sha512-XTKeKxtQElcq3U9/jHyxSPgiRgeYDKxWTPOf6NkXA0dNj5j40MfEsZkMbyNpwDWCUv7YBFUl7I2VK/6ALbmhEg==",
+      "version": "6.19.3",
+      "resolved": "https://registry.npmjs.org/prisma/-/prisma-6.19.3.tgz",
+      "integrity": "sha512-++ZJ0ijLrDJF6hNB4t4uxg2br3fC4H9Yc9tcbjr2fcNFP3rh/SBNrAgjhsqBU4Ght8JPrVofG/ZkXfnSfnYsFg==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@prisma/config": "6.19.2",
-        "@prisma/engines": "6.19.2"
+        "@prisma/config": "6.19.3",
+        "@prisma/engines": "6.19.3"
       },
       "bin": {
         "prisma": "build/index.js"
@@ -9546,12 +9611,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/querystringify": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
-      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
-      "license": "MIT"
-    },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -9857,19 +9916,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/requires-port": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
-      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
-      "license": "MIT"
-    },
     "node_modules/resend": {
-      "version": "6.5.2",
-      "resolved": "https://registry.npmjs.org/resend/-/resend-6.5.2.tgz",
-      "integrity": "sha512-Yl83UvS8sYsjgmF8dVbNPzlfpmb3DkLUk3VwsAbkaEFo9UMswpNuPGryHBXGk+Ta4uYMv5HmjVk3j9jmNkcEDg==",
+      "version": "6.18.0",
+      "resolved": "https://registry.npmjs.org/resend/-/resend-6.18.0.tgz",
+      "integrity": "sha512-EjxZ9AVzywJgOlUoIJe9ytBWVrfbUtJbjeoLnRSvpU1sv97Hh9DSwhw+k8kiujrG4Rg4bzTBsjlmwWWuoOxSug==",
       "license": "MIT",
       "dependencies": {
-        "svix": "1.76.1"
+        "postal-mime": "2.7.5",
+        "standardwebhooks": "1.0.0"
       },
       "engines": {
         "node": ">=20"
@@ -10075,9 +10129,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "devOptional": true,
       "license": "ISC",
       "bin": {
@@ -10143,48 +10197,53 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.34.5",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.34.5.tgz",
-      "integrity": "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==",
-      "hasInstallScript": true,
+      "version": "0.35.3",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
+      "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/colour": "^1.0.0",
+        "@img/colour": "^1.1.0",
         "detect-libc": "^2.1.2",
-        "semver": "^7.7.3"
+        "semver": "^7.8.5"
       },
       "engines": {
-        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+        "node": ">=20.9.0"
       },
       "funding": {
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.34.5",
-        "@img/sharp-darwin-x64": "0.34.5",
-        "@img/sharp-libvips-darwin-arm64": "1.2.4",
-        "@img/sharp-libvips-darwin-x64": "1.2.4",
-        "@img/sharp-libvips-linux-arm": "1.2.4",
-        "@img/sharp-libvips-linux-arm64": "1.2.4",
-        "@img/sharp-libvips-linux-ppc64": "1.2.4",
-        "@img/sharp-libvips-linux-riscv64": "1.2.4",
-        "@img/sharp-libvips-linux-s390x": "1.2.4",
-        "@img/sharp-libvips-linux-x64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
-        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
-        "@img/sharp-linux-arm": "0.34.5",
-        "@img/sharp-linux-arm64": "0.34.5",
-        "@img/sharp-linux-ppc64": "0.34.5",
-        "@img/sharp-linux-riscv64": "0.34.5",
-        "@img/sharp-linux-s390x": "0.34.5",
-        "@img/sharp-linux-x64": "0.34.5",
-        "@img/sharp-linuxmusl-arm64": "0.34.5",
-        "@img/sharp-linuxmusl-x64": "0.34.5",
-        "@img/sharp-wasm32": "0.34.5",
-        "@img/sharp-win32-arm64": "0.34.5",
-        "@img/sharp-win32-ia32": "0.34.5",
-        "@img/sharp-win32-x64": "0.34.5"
+        "@img/sharp-darwin-arm64": "0.35.3",
+        "@img/sharp-darwin-x64": "0.35.3",
+        "@img/sharp-freebsd-wasm32": "0.35.3",
+        "@img/sharp-libvips-darwin-arm64": "1.3.2",
+        "@img/sharp-libvips-darwin-x64": "1.3.2",
+        "@img/sharp-libvips-linux-arm": "1.3.2",
+        "@img/sharp-libvips-linux-arm64": "1.3.2",
+        "@img/sharp-libvips-linux-ppc64": "1.3.2",
+        "@img/sharp-libvips-linux-riscv64": "1.3.2",
+        "@img/sharp-libvips-linux-s390x": "1.3.2",
+        "@img/sharp-libvips-linux-x64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.2",
+        "@img/sharp-linux-arm": "0.35.3",
+        "@img/sharp-linux-arm64": "0.35.3",
+        "@img/sharp-linux-ppc64": "0.35.3",
+        "@img/sharp-linux-riscv64": "0.35.3",
+        "@img/sharp-linux-s390x": "0.35.3",
+        "@img/sharp-linux-x64": "0.35.3",
+        "@img/sharp-linuxmusl-arm64": "0.35.3",
+        "@img/sharp-linuxmusl-x64": "0.35.3",
+        "@img/sharp-webcontainers-wasm32": "0.35.3",
+        "@img/sharp-win32-arm64": "0.35.3",
+        "@img/sharp-win32-ia32": "0.35.3",
+        "@img/sharp-win32-x64": "0.35.3"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
       }
     },
     "node_modules/shebang-command": {
@@ -10330,6 +10389,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/standardwebhooks": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
+      "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
+      "license": "MIT",
+      "dependencies": {
+        "@stablelib/base64": "^1.0.0",
+        "fast-sha256": "^1.3.0"
+      }
+    },
     "node_modules/std-env": {
       "version": "3.10.0",
       "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
@@ -10545,20 +10614,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/svix": {
-      "version": "1.76.1",
-      "resolved": "https://registry.npmjs.org/svix/-/svix-1.76.1.tgz",
-      "integrity": "sha512-CRuDWBTgYfDnBLRaZdKp9VuoPcNUq9An14c/k+4YJ15Qc5Grvf66vp0jvTltd4t7OIRj+8lM1DAgvSgvf7hdLw==",
-      "license": "MIT",
-      "dependencies": {
-        "@stablelib/base64": "^1.0.0",
-        "@types/node": "^22.7.5",
-        "es6-promise": "^4.2.8",
-        "fast-sha256": "^1.3.0",
-        "url-parse": "^1.5.10",
-        "uuid": "^10.0.0"
-      }
-    },
     "node_modules/tailwind-merge": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.4.0.tgz",
@@ -10624,9 +10679,9 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -10791,6 +10846,458 @@
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
+    "node_modules/tsx": {
+      "version": "4.23.1",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz",
+      "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.28.0"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/android-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/android-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/android-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-arm": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/linux-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/win32-x64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/esbuild": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
+      }
+    },
     "node_modules/tw-animate-css": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/tw-animate-css/-/tw-animate-css-1.3.3.tgz",
@@ -10962,6 +11469,7 @@
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/unrs-resolver": {
@@ -11039,16 +11547,6 @@
         "punycode": "^2.1.0"
       }
     },
-    "node_modules/url-parse": {
-      "version": "1.5.10",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
-      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
-      "license": "MIT",
-      "dependencies": {
-        "querystringify": "^2.1.1",
-        "requires-port": "^1.0.0"
-      }
-    },
     "node_modules/use-callback-ref": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
@@ -11101,19 +11599,6 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/vaul": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vaul/-/vaul-1.1.2.tgz",
diff --git a/package.json b/package.json
index 36d351f..59d2e9d 100644
--- a/package.json
+++ b/package.json
@@ -20,15 +20,22 @@
     "test:a11y": "playwright test tests/e2e/accessibility.spec.ts --project=desktop-chromium",
     "test:theme": "playwright test tests/e2e/theme.spec.ts --project=desktop-chromium",
     "test:browser": "playwright test",
+    "test:queries": "node scripts/check-query-performance.mjs",
+    "test:load": "node scripts/smoke-load.mjs",
     "test:watch": "vitest",
     "seed": "prisma db seed"
   },
   "prisma": {
     "seed": "npx tsx prisma/seed.ts"
   },
+  "overrides": {
+    "lodash": "4.18.1",
+    "postcss": "8.5.22",
+    "sharp": "0.35.3"
+  },
   "dependencies": {
     "@hookform/resolvers": "^3.10.0",
-    "@prisma/client": "^6.19.2",
+    "@prisma/client": "6.19.3",
     "@radix-ui/react-accordion": "1.2.2",
     "@radix-ui/react-alert-dialog": "1.1.4",
     "@radix-ui/react-aspect-ratio": "1.1.1",
@@ -69,8 +76,8 @@
     "input-otp": "1.4.1",
     "lucide-react": "^0.454.0",
     "motion": "^12.42.2",
-    "next": "16.0.7",
-    "next-auth": "^5.0.0-beta.30",
+    "next": "16.2.11",
+    "next-auth": "5.0.0-beta.32",
     "next-themes": "^0.4.6",
     "react": "19.2.0",
     "react-day-picker": "9.8.0",
@@ -79,7 +86,7 @@
     "react-icons": "^5.5.0",
     "react-resizable-panels": "^2.1.7",
     "recharts": "2.15.4",
-    "resend": "^6.5.2",
+    "resend": "6.18.0",
     "sonner": "^1.7.4",
     "tailwind-merge": "^3.3.1",
     "tailwindcss-animate": "^1.0.7",
@@ -98,9 +105,10 @@
     "@typescript-eslint/parser": "^8.56.1",
     "eslint": "^9.39.3",
     "eslint-config-next": "^16.1.6",
-    "postcss": "^8.5",
-    "prisma": "^6.19.2",
+    "postcss": "8.5.22",
+    "prisma": "6.19.3",
     "tailwindcss": "^4.1.9",
+    "tsx": "^4.23.1",
     "tw-animate-css": "1.3.3",
     "typescript": "^5",
     "vite-tsconfig-paths": "^5.1.4",
diff --git a/prisma/migrations/20260723150000_payment_attempts_idempotency/migration.sql b/prisma/migrations/20260723150000_payment_attempts_idempotency/migration.sql
new file mode 100644
index 0000000..f7a7c5a
--- /dev/null
+++ b/prisma/migrations/20260723150000_payment_attempts_idempotency/migration.sql
@@ -0,0 +1,67 @@
+CREATE TYPE "PaymentAttemptStatus" AS ENUM (
+  'INITIALIZED',
+  'PENDING',
+  'SUCCEEDED',
+  'FAILED',
+  'ABANDONED',
+  'REFUNDED'
+);
+
+CREATE TABLE "CheckoutAttempt" (
+  "id" TEXT NOT NULL,
+  "userId" TEXT NOT NULL,
+  "orderId" TEXT NOT NULL,
+  "idempotencyKey" TEXT NOT NULL,
+  "requestHash" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "expiresAt" TIMESTAMP(3) NOT NULL,
+  CONSTRAINT "CheckoutAttempt_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "PaymentAttempt" (
+  "id" TEXT NOT NULL,
+  "orderId" TEXT NOT NULL,
+  "provider" TEXT NOT NULL DEFAULT 'paystack',
+  "providerReference" TEXT NOT NULL,
+  "idempotencyKey" TEXT NOT NULL,
+  "expectedAmountNGN" INTEGER NOT NULL,
+  "expectedCurrency" TEXT NOT NULL,
+  "status" "PaymentAttemptStatus" NOT NULL DEFAULT 'INITIALIZED',
+  "authorizationUrl" TEXT,
+  "providerTransactionId" TEXT,
+  "failureCode" TEXT,
+  "initializedAt" TIMESTAMP(3),
+  "verifiedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+  CONSTRAINT "PaymentAttempt_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "CheckoutAttempt_orderId_key" ON "CheckoutAttempt"("orderId");
+CREATE UNIQUE INDEX "CheckoutAttempt_userId_idempotencyKey_key"
+  ON "CheckoutAttempt"("userId", "idempotencyKey");
+CREATE INDEX "CheckoutAttempt_expiresAt_idx" ON "CheckoutAttempt"("expiresAt");
+
+CREATE UNIQUE INDEX "PaymentAttempt_providerReference_key"
+  ON "PaymentAttempt"("providerReference");
+CREATE UNIQUE INDEX "PaymentAttempt_idempotencyKey_key"
+  ON "PaymentAttempt"("idempotencyKey");
+CREATE INDEX "PaymentAttempt_orderId_status_idx"
+  ON "PaymentAttempt"("orderId", "status");
+CREATE INDEX "PaymentAttempt_status_createdAt_idx"
+  ON "PaymentAttempt"("status", "createdAt");
+
+ALTER TABLE "CheckoutAttempt"
+  ADD CONSTRAINT "CheckoutAttempt_userId_fkey"
+  FOREIGN KEY ("userId") REFERENCES "User"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;
+
+ALTER TABLE "CheckoutAttempt"
+  ADD CONSTRAINT "CheckoutAttempt_orderId_fkey"
+  FOREIGN KEY ("orderId") REFERENCES "Order"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;
+
+ALTER TABLE "PaymentAttempt"
+  ADD CONSTRAINT "PaymentAttempt_orderId_fkey"
+  FOREIGN KEY ("orderId") REFERENCES "Order"("id")
+  ON DELETE RESTRICT ON UPDATE CASCADE;
diff --git a/prisma/migrations/20260723163500_schema_alignment/migration.sql b/prisma/migrations/20260723163500_schema_alignment/migration.sql
new file mode 100644
index 0000000..528dd7b
--- /dev/null
+++ b/prisma/migrations/20260723163500_schema_alignment/migration.sql
@@ -0,0 +1,22 @@
+-- Align columns that were added to the Prisma schema without a corresponding migration.
+ALTER TABLE "Order"
+ADD COLUMN "giftMessage" TEXT,
+ADD COLUMN "giftWrapping" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "isGift" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "paymentMethod" TEXT NOT NULL DEFAULT 'CARD',
+ADD COLUMN "shippingNGN" INTEGER NOT NULL DEFAULT 0;
+
+ALTER TABLE "Product"
+ALTER COLUMN "category" DROP DEFAULT;
+
+ALTER TABLE "User"
+ADD COLUMN "loyaltyTier" TEXT NOT NULL DEFAULT 'STANDARD',
+ADD COLUMN "referralCode" TEXT,
+ADD COLUMN "referredBy" TEXT,
+ADD COLUMN "totalLifetimeSpend" INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX "Order_userId_createdAt_idx"
+ON "Order"("userId", "createdAt");
+
+CREATE UNIQUE INDEX "User_referralCode_key"
+ON "User"("referralCode");
diff --git a/prisma/migrations/20260723170000_inventory_reservations/migration.sql b/prisma/migrations/20260723170000_inventory_reservations/migration.sql
new file mode 100644
index 0000000..3acd10c
--- /dev/null
+++ b/prisma/migrations/20260723170000_inventory_reservations/migration.sql
@@ -0,0 +1,76 @@
+CREATE TYPE "InventoryReservationStatus" AS ENUM (
+  'RESERVED',
+  'SOLD',
+  'RELEASED',
+  'EXPIRED'
+);
+
+CREATE TYPE "InventoryMovementReason" AS ENUM (
+  'RESERVATION_CREATED',
+  'RESERVATION_EXPIRED',
+  'SALE_AFTER_EXPIRY',
+  'LEGACY_SALE',
+  'RETURN',
+  'ADJUSTMENT'
+);
+
+CREATE TABLE "InventoryReservation" (
+  "id" TEXT NOT NULL,
+  "orderId" TEXT NOT NULL,
+  "productId" TEXT NOT NULL,
+  "quantity" INTEGER NOT NULL,
+  "status" "InventoryReservationStatus" NOT NULL DEFAULT 'RESERVED',
+  "expiresAt" TIMESTAMP(3) NOT NULL,
+  "reservedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "finalizedAt" TIMESTAMP(3),
+  "releasedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "InventoryReservation_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "InventoryMovement" (
+  "id" TEXT NOT NULL,
+  "productId" TEXT NOT NULL,
+  "delta" INTEGER NOT NULL,
+  "reason" "InventoryMovementReason" NOT NULL,
+  "sourceType" TEXT NOT NULL,
+  "sourceId" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "InventoryMovement_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "InventoryReservation_orderId_productId_key"
+ON "InventoryReservation"("orderId", "productId");
+
+CREATE INDEX "InventoryReservation_status_expiresAt_idx"
+ON "InventoryReservation"("status", "expiresAt");
+
+CREATE INDEX "InventoryReservation_productId_status_idx"
+ON "InventoryReservation"("productId", "status");
+
+CREATE UNIQUE INDEX "InventoryMovement_productId_reason_sourceType_sourceId_key"
+ON "InventoryMovement"("productId", "reason", "sourceType", "sourceId");
+
+CREATE INDEX "InventoryMovement_productId_createdAt_idx"
+ON "InventoryMovement"("productId", "createdAt");
+
+CREATE INDEX "InventoryMovement_sourceType_sourceId_idx"
+ON "InventoryMovement"("sourceType", "sourceId");
+
+ALTER TABLE "InventoryReservation"
+ADD CONSTRAINT "InventoryReservation_orderId_fkey"
+FOREIGN KEY ("orderId") REFERENCES "Order"("id")
+ON DELETE RESTRICT ON UPDATE CASCADE;
+
+ALTER TABLE "InventoryReservation"
+ADD CONSTRAINT "InventoryReservation_productId_fkey"
+FOREIGN KEY ("productId") REFERENCES "Product"("id")
+ON DELETE RESTRICT ON UPDATE CASCADE;
+
+ALTER TABLE "InventoryMovement"
+ADD CONSTRAINT "InventoryMovement_productId_fkey"
+FOREIGN KEY ("productId") REFERENCES "Product"("id")
+ON DELETE RESTRICT ON UPDATE CASCADE;
diff --git a/prisma/migrations/20260723174500_transactional_outbox/migration.sql b/prisma/migrations/20260723174500_transactional_outbox/migration.sql
new file mode 100644
index 0000000..9096d93
--- /dev/null
+++ b/prisma/migrations/20260723174500_transactional_outbox/migration.sql
@@ -0,0 +1,38 @@
+ALTER TABLE "Notification"
+ADD COLUMN "dedupeKey" TEXT;
+
+CREATE UNIQUE INDEX "Notification_dedupeKey_key"
+ON "Notification"("dedupeKey");
+
+CREATE TABLE "OutboxEvent" (
+  "id" TEXT NOT NULL,
+  "type" TEXT NOT NULL,
+  "aggregateType" TEXT NOT NULL,
+  "aggregateId" TEXT NOT NULL,
+  "payload" JSONB,
+  "idempotencyKey" TEXT NOT NULL,
+  "status" "JobStatus" NOT NULL DEFAULT 'PENDING',
+  "attempts" INTEGER NOT NULL DEFAULT 0,
+  "maxAttempts" INTEGER NOT NULL DEFAULT 8,
+  "availableAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "lockedAt" TIMESTAMP(3),
+  "lockedBy" TEXT,
+  "processedAt" TIMESTAMP(3),
+  "lastError" TEXT,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "OutboxEvent_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "OutboxEvent_idempotencyKey_key"
+ON "OutboxEvent"("idempotencyKey");
+
+CREATE INDEX "OutboxEvent_status_availableAt_idx"
+ON "OutboxEvent"("status", "availableAt");
+
+CREATE INDEX "OutboxEvent_aggregateType_aggregateId_idx"
+ON "OutboxEvent"("aggregateType", "aggregateId");
+
+CREATE INDEX "OutboxEvent_lockedAt_idx"
+ON "OutboxEvent"("lockedAt");
diff --git a/prisma/migrations/20260723183000_secure_password_reset/migration.sql b/prisma/migrations/20260723183000_secure_password_reset/migration.sql
new file mode 100644
index 0000000..0d5cff3
--- /dev/null
+++ b/prisma/migrations/20260723183000_secure_password_reset/migration.sql
@@ -0,0 +1,29 @@
+-- Existing raw reset tokens are intentionally invalidated during the secure-token migration.
+ALTER TABLE "User"
+DROP COLUMN "resetToken",
+DROP COLUMN "resetTokenExpiry";
+
+CREATE TABLE "PasswordResetToken" (
+  "id" TEXT NOT NULL,
+  "userId" TEXT NOT NULL,
+  "tokenHash" TEXT NOT NULL,
+  "expiresAt" TIMESTAMP(3) NOT NULL,
+  "usedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "PasswordResetToken_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "PasswordResetToken_tokenHash_key"
+ON "PasswordResetToken"("tokenHash");
+
+CREATE INDEX "PasswordResetToken_userId_expiresAt_idx"
+ON "PasswordResetToken"("userId", "expiresAt");
+
+CREATE INDEX "PasswordResetToken_expiresAt_usedAt_idx"
+ON "PasswordResetToken"("expiresAt", "usedAt");
+
+ALTER TABLE "PasswordResetToken"
+ADD CONSTRAINT "PasswordResetToken_userId_fkey"
+FOREIGN KEY ("userId") REFERENCES "User"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/prisma/migrations/20260723184500_single_active_password_reset/migration.sql b/prisma/migrations/20260723184500_single_active_password_reset/migration.sql
new file mode 100644
index 0000000..d83e21b
--- /dev/null
+++ b/prisma/migrations/20260723184500_single_active_password_reset/migration.sql
@@ -0,0 +1,4 @@
+CREATE UNIQUE INDEX "PasswordResetToken_userId_key"
+ON "PasswordResetToken"("userId");
+
+DROP INDEX "PasswordResetToken_userId_expiresAt_idx";
diff --git a/prisma/migrations/20260723193000_unique_review_per_product/migration.sql b/prisma/migrations/20260723193000_unique_review_per_product/migration.sql
new file mode 100644
index 0000000..054278c
--- /dev/null
+++ b/prisma/migrations/20260723193000_unique_review_per_product/migration.sql
@@ -0,0 +1,2 @@
+CREATE UNIQUE INDEX "Review_userId_productId_key"
+ON "Review"("userId", "productId");
diff --git a/prisma/migrations/20260723201500_order_refund_states/migration.sql b/prisma/migrations/20260723201500_order_refund_states/migration.sql
new file mode 100644
index 0000000..38d2ada
--- /dev/null
+++ b/prisma/migrations/20260723201500_order_refund_states/migration.sql
@@ -0,0 +1,6 @@
+ALTER TYPE "OrderStatus" ADD VALUE IF NOT EXISTS 'CANCELLED';
+ALTER TYPE "OrderStatus" ADD VALUE IF NOT EXISTS 'REFUND_PENDING';
+ALTER TYPE "OrderStatus" ADD VALUE IF NOT EXISTS 'REFUNDED';
+
+ALTER TYPE "InventoryMovementReason"
+ADD VALUE IF NOT EXISTS 'RESERVATION_CANCELLED';
diff --git a/prisma/migrations/20260723203500_durable_refunds/migration.sql b/prisma/migrations/20260723203500_durable_refunds/migration.sql
new file mode 100644
index 0000000..6dfd229
--- /dev/null
+++ b/prisma/migrations/20260723203500_durable_refunds/migration.sql
@@ -0,0 +1,47 @@
+CREATE TYPE "RefundStatus" AS ENUM (
+  'REQUESTED',
+  'PENDING',
+  'PROCESSING',
+  'NEEDS_ATTENTION',
+  'PROCESSED',
+  'FAILED'
+);
+
+CREATE TABLE "Refund" (
+  "id" TEXT NOT NULL,
+  "orderId" TEXT NOT NULL,
+  "paymentAttemptId" TEXT NOT NULL,
+  "provider" TEXT NOT NULL DEFAULT 'paystack',
+  "providerRefundId" TEXT,
+  "idempotencyKey" TEXT NOT NULL,
+  "amountNGN" INTEGER NOT NULL,
+  "currency" TEXT NOT NULL,
+  "reason" TEXT NOT NULL,
+  "previousOrderStatus" "OrderStatus" NOT NULL,
+  "restock" BOOLEAN NOT NULL DEFAULT false,
+  "status" "RefundStatus" NOT NULL DEFAULT 'REQUESTED',
+  "initiatedBy" TEXT,
+  "failureCode" TEXT,
+  "requestedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "processedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "Refund_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "Refund_orderId_key" ON "Refund"("orderId");
+CREATE UNIQUE INDEX "Refund_paymentAttemptId_key" ON "Refund"("paymentAttemptId");
+CREATE UNIQUE INDEX "Refund_providerRefundId_key" ON "Refund"("providerRefundId");
+CREATE UNIQUE INDEX "Refund_idempotencyKey_key" ON "Refund"("idempotencyKey");
+CREATE INDEX "Refund_status_createdAt_idx" ON "Refund"("status", "createdAt");
+
+ALTER TABLE "Refund"
+ADD CONSTRAINT "Refund_orderId_fkey"
+FOREIGN KEY ("orderId") REFERENCES "Order"("id")
+ON DELETE RESTRICT ON UPDATE CASCADE;
+
+ALTER TABLE "Refund"
+ADD CONSTRAINT "Refund_paymentAttemptId_fkey"
+FOREIGN KEY ("paymentAttemptId") REFERENCES "PaymentAttempt"("id")
+ON DELETE RESTRICT ON UPDATE CASCADE;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 3f62f2c..86fcc98 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -18,27 +18,63 @@ enum OrderStatus {
   PAID
   SHIPPED
   DELIVERED
+  CANCELLED
+  REFUND_PENDING
+  REFUNDED
+}
+
+enum PaymentAttemptStatus {
+  INITIALIZED
+  PENDING
+  SUCCEEDED
+  FAILED
+  ABANDONED
+  REFUNDED
+}
+
+enum RefundStatus {
+  REQUESTED
+  PENDING
+  PROCESSING
+  NEEDS_ATTENTION
+  PROCESSED
+  FAILED
+}
+
+enum InventoryReservationStatus {
+  RESERVED
+  SOLD
+  RELEASED
+  EXPIRED
+}
+
+enum InventoryMovementReason {
+  RESERVATION_CREATED
+  RESERVATION_EXPIRED
+  RESERVATION_CANCELLED
+  SALE_AFTER_EXPIRY
+  LEGACY_SALE
+  RETURN
+  ADJUSTMENT
 }
 
 model User {
-  id               String    @id @default(cuid())
+  id               String     @id @default(cuid())
   name             String?
-  email            String    @unique
+  email            String     @unique
   passwordHash     String
-  role             Role      @default(USER)
+  role             Role       @default(USER)
   adminRole        AdminRole? // scopes admin capabilities; NULL + role=ADMIN ⇒ SUPER_ADMIN
-  marketingEmails  Boolean   @default(true)
-  smsNotifications Boolean   @default(false)
-  orderUpdates     Boolean   @default(true)
-  wishlistAlerts   Boolean   @default(false)
+  marketingEmails  Boolean    @default(true)
+  smsNotifications Boolean    @default(false)
+  orderUpdates     Boolean    @default(true)
+  wishlistAlerts   Boolean    @default(false)
   customerTags     String?
   customerNotes    String?
   customerSegment  String?
-  customerStatus   String    @default("ACTIVE")
-  resetToken       String?
-  resetTokenExpiry DateTime?
-  createdAt        DateTime  @default(now())
-  updatedAt        DateTime  @updatedAt
+  customerStatus   String     @default("ACTIVE")
+  createdAt        DateTime   @default(now())
+  updatedAt        DateTime   @updatedAt
 
   // Loyalty & referral
   loyaltyTier        String  @default("STANDARD") // STANDARD | OBSIDIAN | GOLD | PLATINUM
@@ -64,7 +100,9 @@ model User {
   backInStockSubs        BackInStockSubscription[]
   conciergeConversations ConciergeConversation[]
   conciergeUsage         ConciergeUsageEvent[]
+  passwordResetTokens    PasswordResetToken[]
   conciergeFeedback      ConciergeFeedback[]
+  checkoutAttempts       CheckoutAttempt[]
 }
 
 model Category {
@@ -78,24 +116,24 @@ model Category {
 }
 
 model Product {
-  id          String          @id @default(cuid())
-  name        String
-  slug        String          @unique
-  description String
-  seoTitle    String?
+  id             String          @id @default(cuid())
+  name           String
+  slug           String          @unique
+  description    String
+  seoTitle       String?
   seoDescription String?
-  images      Json // store image array as JSON
-  priceNGN    Int
-  oldPriceNGN Int?
-  currency    String          @default("NGN")
-  category    ProductCategory
-  brand       String?
-  productType String? // perfume
-  notesTop    String?
-  notesHeart  String?
-  notesBase   String?
-  longevity   String?
-  occasion    String?
+  images         Json // store image array as JSON
+  priceNGN       Int
+  oldPriceNGN    Int?
+  currency       String          @default("NGN")
+  category       ProductCategory
+  brand          String?
+  productType    String? // perfume
+  notesTop       String?
+  notesHeart     String?
+  notesBase      String?
+  longevity      String?
+  occasion       String?
 
   // --- Perfume identity ---
   shopifyId       String?       @unique
@@ -157,18 +195,20 @@ model Product {
   ratingCount Int   @default(0)
 
   // relations
-  collectionId    String?
-  collection      Collection?               @relation(fields: [collectionId], references: [id])
-  orderItems      OrderItem[]
-  wishlists       Wishlist[]
-  reviews         Review[]
-  variants        ProductVariant[]
-  media           ProductMedia[]
-  backInStockSubs BackInStockSubscription[]
-  storyLinks      StoryProduct[]
-  campaignLinks   CampaignProduct[]
-  relatedFrom     ProductRelation[] @relation("RelatedFrom")
-  relatedTo       ProductRelation[] @relation("RelatedTo")
+  collectionId          String?
+  collection            Collection?               @relation(fields: [collectionId], references: [id])
+  orderItems            OrderItem[]
+  wishlists             Wishlist[]
+  reviews               Review[]
+  variants              ProductVariant[]
+  media                 ProductMedia[]
+  backInStockSubs       BackInStockSubscription[]
+  inventoryReservations InventoryReservation[]
+  inventoryMovements    InventoryMovement[]
+  storyLinks            StoryProduct[]
+  campaignLinks         CampaignProduct[]
+  relatedFrom           ProductRelation[]         @relation("RelatedFrom")
+  relatedTo             ProductRelation[]         @relation("RelatedTo")
 
   @@index([name])
   @@index([category])
@@ -209,6 +249,7 @@ model Review {
   user    User    @relation(fields: [userId], references: [id])
   product Product @relation(fields: [productId], references: [id])
 
+  @@unique([userId, productId])
   @@index([productId, createdAt])
   @@index([userId])
   @@index([moderationStatus])
@@ -228,7 +269,7 @@ model Coupon {
   createdAt   DateTime @default(now())
   updatedAt   DateTime @updatedAt
 
-  orders Order[]
+  orders    Order[]
   campaigns Campaign[]
 }
 
@@ -263,6 +304,7 @@ model Notification {
   title     String
   message   String
   orderId   String?
+  dedupeKey String?   @unique
   read      Boolean   @default(false)
   createdAt DateTime  @default(now())
   readAt    DateTime?
@@ -308,8 +350,12 @@ model Order {
   // Payment method
   paymentMethod String @default("CARD") // CARD | BANK_TRANSFER
 
-  reference String?     @unique
-  items     OrderItem[]
+  reference             String?                @unique
+  items                 OrderItem[]
+  paymentAttempts       PaymentAttempt[]
+  checkoutAttempt       CheckoutAttempt?
+  inventoryReservations InventoryReservation[]
+  refund                Refund?
 
   // Shipping/contact snapshot
   addressLine1 String
@@ -328,6 +374,109 @@ model Order {
   @@index([status, createdAt])
 }
 
+model CheckoutAttempt {
+  id             String   @id @default(cuid())
+  userId         String
+  orderId        String   @unique
+  idempotencyKey String
+  requestHash    String
+  createdAt      DateTime @default(now())
+  expiresAt      DateTime
+
+  user  User  @relation(fields: [userId], references: [id])
+  order Order @relation(fields: [orderId], references: [id])
+
+  @@unique([userId, idempotencyKey])
+  @@index([expiresAt])
+}
+
+model PaymentAttempt {
+  id                    String               @id @default(cuid())
+  orderId               String
+  provider              String               @default("paystack")
+  providerReference     String               @unique
+  idempotencyKey        String               @unique
+  expectedAmountNGN     Int
+  expectedCurrency      String
+  status                PaymentAttemptStatus @default(INITIALIZED)
+  authorizationUrl      String?
+  providerTransactionId String?
+  failureCode           String?
+  initializedAt         DateTime?
+  verifiedAt            DateTime?
+  createdAt             DateTime             @default(now())
+  updatedAt             DateTime             @updatedAt
+
+  order  Order   @relation(fields: [orderId], references: [id])
+  refund Refund?
+
+  @@index([orderId, status])
+  @@index([status, createdAt])
+}
+
+model Refund {
+  id                  String       @id @default(cuid())
+  orderId             String       @unique
+  paymentAttemptId    String       @unique
+  provider            String       @default("paystack")
+  providerRefundId    String?      @unique
+  idempotencyKey      String       @unique
+  amountNGN           Int
+  currency            String
+  reason              String
+  previousOrderStatus OrderStatus
+  restock             Boolean      @default(false)
+  status              RefundStatus @default(REQUESTED)
+  initiatedBy         String?
+  failureCode         String?
+  requestedAt         DateTime     @default(now())
+  processedAt         DateTime?
+  createdAt           DateTime     @default(now())
+  updatedAt           DateTime     @updatedAt
+
+  order          Order          @relation(fields: [orderId], references: [id])
+  paymentAttempt PaymentAttempt @relation(fields: [paymentAttemptId], references: [id])
+
+  @@index([status, createdAt])
+}
+
+model InventoryReservation {
+  id          String                     @id @default(cuid())
+  orderId     String
+  productId   String
+  quantity    Int
+  status      InventoryReservationStatus @default(RESERVED)
+  expiresAt   DateTime
+  reservedAt  DateTime                   @default(now())
+  finalizedAt DateTime?
+  releasedAt  DateTime?
+  createdAt   DateTime                   @default(now())
+  updatedAt   DateTime                   @updatedAt
+
+  order   Order   @relation(fields: [orderId], references: [id])
+  product Product @relation(fields: [productId], references: [id])
+
+  @@unique([orderId, productId])
+  @@index([status, expiresAt])
+  @@index([productId, status])
+}
+
+model InventoryMovement {
+  id         String                  @id @default(cuid())
+  productId  String
+  delta      Int
+  reason     InventoryMovementReason
+  sourceType String
+  sourceId   String
+  createdAt  DateTime                @default(now())
+
+  product Product @relation(fields: [productId], references: [id])
+
+  @@unique([productId, reason, sourceType, sourceId])
+  @@index([productId, createdAt])
+  @@index([sourceType, sourceId])
+}
+
 model OrderItem {
   id        String  @id @default(cuid())
   orderId   String
@@ -342,14 +491,14 @@ model OrderItem {
 }
 
 model Collection {
-  id          String   @id @default(cuid())
-  name        String
-  slug        String   @unique
-  description String?
-  seoTitle    String?
+  id             String   @id @default(cuid())
+  name           String
+  slug           String   @unique
+  description    String?
+  seoTitle       String?
   seoDescription String?
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
 
   products Product[]
 }
@@ -402,6 +551,19 @@ model VerificationToken {
   @@unique([identifier, token])
 }
 
+model PasswordResetToken {
+  id        String    @id @default(cuid())
+  userId    String    @unique
+  tokenHash String    @unique
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([expiresAt, usedAt])
+}
+
 enum Role {
   USER
   ADMIN
@@ -763,6 +925,29 @@ model JobRun {
   @@index([status, createdAt])
 }
 
+model OutboxEvent {
+  id             String    @id @default(cuid())
+  type           String
+  aggregateType  String
+  aggregateId    String
+  payload        Json?
+  idempotencyKey String    @unique
+  status         JobStatus @default(PENDING)
+  attempts       Int       @default(0)
+  maxAttempts    Int       @default(8)
+  availableAt    DateTime  @default(now())
+  lockedAt       DateTime?
+  lockedBy       String?
+  processedAt    DateTime?
+  lastError      String?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  @@index([status, availableAt])
+  @@index([aggregateType, aggregateId])
+  @@index([lockedAt])
+}
+
 model FeatureFlag {
   id          String   @id @default(cuid())
   key         String   @unique
@@ -881,15 +1066,15 @@ model PerfumeKnowledgeEntry {
 // ------------------------------------------------------------------
 
 model Story {
-  id             String        @id @default(cuid())
-  slug           String        @unique
-  title          String
-  subtitle       String?
-  excerpt        String?
-  category       String? // e.g. "Fragrance Guide", "How To", "Seasonal"
-  readTime       String? // e.g. "5 min read"
-  author         String?
-  tags           String? // comma-separated
+  id       String  @id @default(cuid())
+  slug     String  @unique
+  title    String
+  subtitle String?
+  excerpt  String?
+  category String? // e.g. "Fragrance Guide", "How To", "Seasonal"
+  readTime String? // e.g. "5 min read"
+  author   String?
+  tags     String? // comma-separated
 
   coverImageUrl  String?
   mobileCoverUrl String?
@@ -898,9 +1083,9 @@ model Story {
   seoTitle       String?
   seoDescription String?
 
-  status       PublishStatus @default(DRAFT)
-  featured     Boolean       @default(false)
-  position     Int           @default(0) // manual ordering (lower = earlier)
+  status   PublishStatus @default(DRAFT)
+  featured Boolean       @default(false)
+  position Int           @default(0) // manual ordering (lower = earlier)
 
   publishedAt  DateTime?
   scheduledFor DateTime? // scheduled publish time
@@ -979,18 +1164,18 @@ model PageBlock {
 // Durable inbox for public forms. The initial source is the contact form; source stays explicit
 // so product enquiries and other forms can join without another table.
 model FormSubmission {
-  id          String               @id @default(cuid())
-  source      String               @default("contact")
-  name        String?
-  email       String
-  subject     String?
-  message     String
-  status      FormSubmissionStatus @default(NEW)
-  notes       String?
-  metadata    Json?
-  createdAt   DateTime             @default(now())
-  updatedAt   DateTime             @updatedAt
-  resolvedAt  DateTime?
+  id         String               @id @default(cuid())
+  source     String               @default("contact")
+  name       String?
+  email      String
+  subject    String?
+  message    String
+  status     FormSubmissionStatus @default(NEW)
+  notes      String?
+  metadata   Json?
+  createdAt  DateTime             @default(now())
+  updatedAt  DateTime             @updatedAt
+  resolvedAt DateTime?
 
   @@index([status, createdAt])
   @@index([source, createdAt])
@@ -1072,23 +1257,23 @@ model MediaAsset {
 }
 
 model Campaign {
-  id             String        @id @default(cuid())
-  slug           String        @unique
-  title          String
-  description    String?
-  desktopImage   String?
-  mobileImage    String?
-  ctaLabel       String?
-  ctaHref        String?
-  status         PublishStatus @default(DRAFT)
-  startsAt       DateTime?
-  endsAt         DateTime?
-  couponId       String?
-  coupon         Coupon?       @relation(fields: [couponId], references: [id])
-  createdBy      String?
-  createdAt      DateTime      @default(now())
-  updatedAt      DateTime      @updatedAt
-  products       CampaignProduct[]
+  id           String            @id @default(cuid())
+  slug         String            @unique
+  title        String
+  description  String?
+  desktopImage String?
+  mobileImage  String?
+  ctaLabel     String?
+  ctaHref      String?
+  status       PublishStatus     @default(DRAFT)
+  startsAt     DateTime?
+  endsAt       DateTime?
+  couponId     String?
+  coupon       Coupon?           @relation(fields: [couponId], references: [id])
+  createdBy    String?
+  createdAt    DateTime          @default(now())
+  updatedAt    DateTime          @updatedAt
+  products     CampaignProduct[]
 
   @@index([status, startsAt, endsAt])
 }
@@ -1140,13 +1325,13 @@ model ProductRelation {
 }
 
 model EmailTemplate {
-  id          String   @id @default(cuid())
-  key         String   @unique
-  name        String
-  subject     String
-  bodyText    String
-  enabled     Boolean  @default(false)
-  updatedBy   String?
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id        String   @id @default(cuid())
+  key       String   @unique
+  name      String
+  subject   String
+  bodyText  String
+  enabled   Boolean  @default(false)
+  updatedBy String?
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 }
diff --git a/scripts/check-query-performance.mjs b/scripts/check-query-performance.mjs
new file mode 100644
index 0000000..f210ff6
--- /dev/null
+++ b/scripts/check-query-performance.mjs
@@ -0,0 +1,82 @@
+import { PrismaClient } from "@prisma/client"
+
+const prisma = new PrismaClient()
+const iterations = Math.min(
+  Math.max(Number.parseInt(process.env.QUERY_PERF_ITERATIONS ?? "10", 10), 3),
+  50,
+)
+const budgetMs = Math.max(
+  Number.parseInt(process.env.QUERY_P95_BUDGET_MS ?? "1000", 10),
+  50,
+)
+
+const queries = {
+  publishedProducts: () =>
+    prisma.product.findMany({
+      where: { deletedAt: null, publishStatus: "PUBLISHED" },
+      orderBy: { createdAt: "desc" },
+      take: 24,
+      select: { id: true, slug: true, name: true, priceNGN: true },
+    }),
+  publishedBrands: () =>
+    prisma.product.findMany({
+      where: {
+        deletedAt: null,
+        publishStatus: "PUBLISHED",
+        brand: { not: null },
+      },
+      distinct: ["brand"],
+      orderBy: { brand: "asc" },
+      select: { brand: true },
+    }),
+  recentOrders: () =>
+    prisma.order.findMany({
+      orderBy: { createdAt: "desc" },
+      take: 25,
+      select: { id: true, status: true, totalNGN: true, createdAt: true },
+    }),
+  recentUsers: () =>
+    prisma.user.findMany({
+      orderBy: { createdAt: "desc" },
+      take: 50,
+      select: { id: true, createdAt: true },
+    }),
+}
+
+function percentile(values, fraction) {
+  const sorted = [...values].sort((a, b) => a - b)
+  return sorted[Math.min(Math.ceil(sorted.length * fraction) - 1, sorted.length - 1)]
+}
+
+let failed = false
+try {
+  const report = {}
+  for (const [name, query] of Object.entries(queries)) {
+    // Establish the database connection and warm the query plan before measuring.
+    // Otherwise the first sample mostly measures TLS/network startup.
+    await query()
+    const samples = []
+    for (let index = 0; index < iterations; index += 1) {
+      const started = performance.now()
+      await query()
+      samples.push(performance.now() - started)
+    }
+    const p95Ms = percentile(samples, 0.95)
+    report[name] = {
+      iterations,
+      averageMs: Number(
+        (samples.reduce((sum, value) => sum + value, 0) / samples.length).toFixed(1),
+      ),
+      p95Ms: Number(p95Ms.toFixed(1)),
+      maxMs: Number(Math.max(...samples).toFixed(1)),
+      budgetMs,
+      ok: p95Ms <= budgetMs,
+    }
+    if (p95Ms > budgetMs) failed = true
+  }
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`)
+} finally {
+  await prisma.$disconnect()
+}
+
+if (failed) process.exitCode = 1
diff --git a/scripts/smoke-load.mjs b/scripts/smoke-load.mjs
new file mode 100644
index 0000000..3be55df
--- /dev/null
+++ b/scripts/smoke-load.mjs
@@ -0,0 +1,59 @@
+const baseUrl = (process.env.LOAD_TEST_BASE_URL ?? "http://localhost:3000")
+  .replace(/\/$/, "")
+const concurrency = Math.min(
+  Math.max(Number.parseInt(process.env.LOAD_TEST_CONCURRENCY ?? "10", 10), 1),
+  50,
+)
+const requests = Math.min(
+  Math.max(Number.parseInt(process.env.LOAD_TEST_REQUESTS ?? "100", 10), 10),
+  2_000,
+)
+const budgetMs = Math.max(
+  Number.parseInt(process.env.LOAD_TEST_P95_BUDGET_MS ?? "2000", 10),
+  100,
+)
+const paths = ["/", "/shop", "/api/products?page=1&pageSize=24"]
+
+let cursor = 0
+const samples = []
+let failures = 0
+
+async function worker() {
+  while (cursor < requests) {
+    const index = cursor
+    cursor += 1
+    const path = paths[index % paths.length]
+    const started = performance.now()
+    try {
+      const response = await fetch(`${baseUrl}${path}`, {
+        headers: { "user-agent": "9thluxe-readiness-load-check/1.0" },
+      })
+      if (!response.ok) failures += 1
+      await response.arrayBuffer()
+    } catch {
+      failures += 1
+    } finally {
+      samples.push(performance.now() - started)
+    }
+  }
+}
+
+await Promise.all(Array.from({ length: concurrency }, () => worker()))
+const sorted = [...samples].sort((a, b) => a - b)
+const p95Ms = sorted[Math.min(Math.ceil(sorted.length * 0.95) - 1, sorted.length - 1)]
+const failureRate = failures / requests
+const report = {
+  baseUrl,
+  requests,
+  concurrency,
+  failures,
+  failureRate,
+  averageMs: Number(
+    (samples.reduce((sum, value) => sum + value, 0) / samples.length).toFixed(1),
+  ),
+  p95Ms: Number(p95Ms.toFixed(1)),
+  budgetMs,
+  ok: failureRate <= 0.01 && p95Ms <= budgetMs,
+}
+process.stdout.write(`${JSON.stringify(report, null, 2)}\n`)
+if (!report.ok) process.exitCode = 1
diff --git a/tests/auth/password-reset.test.ts b/tests/auth/password-reset.test.ts
new file mode 100644
index 0000000..376cb6c
--- /dev/null
+++ b/tests/auth/password-reset.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  generatePasswordResetToken,
+  newPasswordSchema,
+  PASSWORD_RESET_TTL_MS,
+  passwordResetExpiry,
+  passwordResetTokenHash,
+} from "@/lib/auth/password-reset"
+
+describe("password reset primitives", () => {
+  it("generates opaque tokens and stores only a deterministic hash", () => {
+    const token = generatePasswordResetToken()
+    const second = generatePasswordResetToken()
+    expect(token).not.toBe(second)
+    expect(token.length).toBeGreaterThanOrEqual(40)
+    expect(passwordResetTokenHash(token)).toMatch(/^[a-f0-9]{64}$/)
+    expect(passwordResetTokenHash(token)).not.toContain(token)
+  })
+
+  it("expires tokens after one hour", () => {
+    const now = new Date("2026-07-23T12:00:00.000Z")
+    expect(passwordResetExpiry(now).getTime() - now.getTime()).toBe(
+      PASSWORD_RESET_TTL_MS,
+    )
+  })
+
+  it("enforces the shared password length policy", () => {
+    expect(newPasswordSchema.safeParse("short").success).toBe(false)
+    expect(newPasswordSchema.safeParse("long-enough").success).toBe(true)
+    expect(newPasswordSchema.safeParse("x".repeat(129)).success).toBe(false)
+  })
+})
diff --git a/tests/catalogue/public-product.test.ts b/tests/catalogue/public-product.test.ts
new file mode 100644
index 0000000..63ee0c1
--- /dev/null
+++ b/tests/catalogue/public-product.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  PUBLIC_PRODUCT_FILTER,
+  publicProductWhere,
+} from "@/lib/catalogue/public-product"
+
+describe("public product visibility", () => {
+  it("requires products to be both published and not soft-deleted", () => {
+    expect(PUBLIC_PRODUCT_FILTER).toEqual({
+      deletedAt: null,
+      publishStatus: "PUBLISHED",
+    })
+  })
+
+  it("combines visibility with caller-owned query conditions", () => {
+    expect(publicProductWhere({ brand: "Fádé", stock: { gt: 0 } })).toEqual({
+      AND: [
+        PUBLIC_PRODUCT_FILTER,
+        { brand: "Fádé", stock: { gt: 0 } },
+      ],
+    })
+  })
+})
diff --git a/tests/checkout/idempotency.test.ts b/tests/checkout/idempotency.test.ts
new file mode 100644
index 0000000..6b7d3d4
--- /dev/null
+++ b/tests/checkout/idempotency.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  checkoutRequestHash,
+  isValidIdempotencyKey,
+} from "@/lib/checkout/idempotency"
+
+const checkout = {
+  addressLine1: "1 Example Road",
+  city: "Lagos",
+  state: "Lagos",
+  phone: "+2348000000000",
+  items: [
+    { productId: "product-b", quantity: 1 },
+    { productId: "product-a", quantity: 2 },
+  ],
+  couponCode: " fade10 ",
+  deliveryMethod: "standard" as const,
+  isGift: false,
+  giftMessage: null,
+  giftWrapping: false,
+  paymentMethod: "CARD" as const,
+}
+
+describe("checkout idempotency", () => {
+  it("accepts opaque browser-generated keys and rejects weak keys", () => {
+    expect(isValidIdempotencyKey("d6a7ca3f-184c-4c40-b73e-a5e2a6df3501")).toBe(true)
+    expect(isValidIdempotencyKey("short")).toBe(false)
+    expect(isValidIdempotencyKey(null)).toBe(false)
+  })
+
+  it("produces the same hash regardless of item order and coupon casing", () => {
+    const reordered = {
+      ...checkout,
+      couponCode: "FADE10",
+      items: [...checkout.items].reverse(),
+    }
+    expect(checkoutRequestHash(reordered)).toBe(checkoutRequestHash(checkout))
+  })
+
+  it("changes when an order-affecting field changes", () => {
+    expect(
+      checkoutRequestHash({ ...checkout, deliveryMethod: "express" }),
+    ).not.toBe(checkoutRequestHash(checkout))
+  })
+})
diff --git a/tests/config/commerce.test.ts b/tests/config/commerce.test.ts
index 318c060..7b0ecc6 100644
--- a/tests/config/commerce.test.ts
+++ b/tests/config/commerce.test.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest'
-import { computeShipping, resolveLoyaltyTier, isSupportedCurrency } from '@/lib/config/commerce'
+import {
+  computeCheckoutShipping,
+  computeShipping,
+  resolveLoyaltyTier,
+  isSupportedCurrency,
+} from '@/lib/config/commerce'
 
 describe('shipping policy (config-driven, no hard-coded threshold)', () => {
   it('is free at or above the configured threshold (default 500,000)', () => {
@@ -10,6 +15,12 @@ describe('shipping policy (config-driven, no hard-coded threshold)', () => {
     expect(computeShipping(499_999)).toBe(2_500)
     expect(computeShipping(0)).toBe(2_500)
   })
+  it('calculates delivery and gift wrapping entirely from server policy', () => {
+    expect(computeCheckoutShipping(100_000, 'standard', false)).toBe(2_500)
+    expect(computeCheckoutShipping(100_000, 'express', false)).toBe(35_000)
+    expect(computeCheckoutShipping(100_000, 'express', true)).toBe(37_500)
+    expect(computeCheckoutShipping(500_000, 'express', true)).toBe(2_500)
+  })
 })
 
 describe('loyalty tiers (config-driven)', () => {
diff --git a/tests/config/env-diagnostics.test.ts b/tests/config/env-diagnostics.test.ts
new file mode 100644
index 0000000..7139783
--- /dev/null
+++ b/tests/config/env-diagnostics.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it } from "vitest"
+
+import { getEnvDiagnostics } from "@/lib/env-diagnostics"
+
+const keys = [
+  "NODE_ENV",
+  "PAYMENTS_ENABLED",
+  "PAYSTACK_SECRET_KEY",
+  "PAYSTACK_PUBLIC_KEY",
+] as const
+const mutableEnv = process.env as Record<string, string | undefined>
+const original = Object.fromEntries(keys.map((key) => [key, process.env[key]]))
+
+afterEach(() => {
+  for (const key of keys) {
+    const value = original[key]
+    if (value === undefined) delete process.env[key]
+    else mutableEnv[key] = value
+  }
+})
+
+describe("production payment environment diagnostics", () => {
+  it("does not require Paystack credentials while collection is disabled", () => {
+    mutableEnv.NODE_ENV = "production"
+    process.env.PAYMENTS_ENABLED = "false"
+    delete process.env.PAYSTACK_SECRET_KEY
+    delete process.env.PAYSTACK_PUBLIC_KEY
+
+    const result = getEnvDiagnostics()
+    expect(result.missingCritical).not.toContain("PAYSTACK_SECRET_KEY")
+    expect(result.missingCritical).not.toContain("PAYSTACK_PUBLIC_KEY")
+  })
+
+  it("requires both Paystack credentials when collection is enabled", () => {
+    mutableEnv.NODE_ENV = "production"
+    process.env.PAYMENTS_ENABLED = "true"
+    delete process.env.PAYSTACK_SECRET_KEY
+    delete process.env.PAYSTACK_PUBLIC_KEY
+
+    const result = getEnvDiagnostics()
+    expect(result.missingCritical).toContain("PAYSTACK_SECRET_KEY")
+    expect(result.missingCritical).toContain("PAYSTACK_PUBLIC_KEY")
+  })
+})
diff --git a/tests/config/readiness.test.ts b/tests/config/readiness.test.ts
new file mode 100644
index 0000000..5f91f99
--- /dev/null
+++ b/tests/config/readiness.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest"
+
+import { classifyJobReadiness } from "@/lib/readiness"
+
+describe("job readiness classification", () => {
+  it("is up only when every durable workload is clear", () => {
+    expect(
+      classifyJobReadiness({
+        failedOutbox: 0,
+        staleRunningOutbox: 0,
+        overdueReservations: 0,
+        overduePayments: 0,
+        refundsNeedingAttention: 0,
+      }),
+    ).toBe("up")
+  })
+
+  it("is degraded when any workload needs operational attention", () => {
+    expect(
+      classifyJobReadiness({
+        failedOutbox: 0,
+        staleRunningOutbox: 0,
+        overdueReservations: 1,
+        overduePayments: 0,
+        refundsNeedingAttention: 0,
+      }),
+    ).toBe("degraded")
+  })
+})
diff --git a/tests/contract/contract.test.ts b/tests/contract/contract.test.ts
index 21a8b98..f995fb5 100644
--- a/tests/contract/contract.test.ts
+++ b/tests/contract/contract.test.ts
@@ -38,3 +38,57 @@ describe('contract: OpenAPI exposes the core storefront surface + envelope', ()
     },
   )
 })
+
+describe('contract: background jobs support authenticated schedulers', () => {
+  it.each([
+    'app/api/internal/jobs/process-outbox/route.ts',
+    'app/api/internal/jobs/release-reservations/route.ts',
+    'app/api/internal/jobs/reconcile-payments/route.ts',
+  ])('supports Vercel GET and external-scheduler POST in %s', (path) => {
+    const route = read(path)
+    expect(route).toContain('hasValidBearerSecret')
+    expect(route).toContain('export async function POST')
+    expect(route).toContain('export const GET = POST')
+  })
+})
+
+describe('contract: payment collection fails closed', () => {
+  it.each([
+    'app/api/checkout/create-order/route.ts',
+    'app/api/paystack/initialize/route.ts',
+    'app/api/admin/orders/[id]/refund/route.ts',
+  ])('guards provider mutations in %s', (path) => {
+    expect(read(path)).toContain('isPaymentCollectionEnabled')
+  })
+})
+
+describe('contract: high-churn account mutations are abuse controlled', () => {
+  it.each([
+    'app/api/cart/add/route.ts',
+    'app/api/cart/update/route.ts',
+    'app/api/cart/remove/route.ts',
+    'app/api/cart/clear/route.ts',
+    'app/api/account/addresses/route.ts',
+    'app/api/account/addresses/[id]/route.ts',
+    'app/api/settings/toggle-email/route.ts',
+    'app/api/settings/toggle-sms/route.ts',
+  ])('checks origin and rate limits in %s', (path) => {
+    const route = read(path)
+    expect(route).toContain('hasTrustedOrigin')
+    expect(route).toContain('consumeRateLimit')
+  })
+})
+
+describe('contract: growing account and admin lists stay bounded', () => {
+  it.each([
+    'app/admin/orders/page.tsx',
+    'app/admin/users/page.tsx',
+    'app/account/orders/page.tsx',
+  ])('paginates %s', (path) => {
+    const page = read(path)
+    expect(page).toContain('pageSize')
+  })
+  it('bounds the shared admin order query', () => {
+    expect(read('lib/services/order-service.ts')).toContain('take: pageSize')
+  })
+})
diff --git a/tests/e2e/cinematic-hero-flag.spec.ts b/tests/e2e/cinematic-hero-flag.spec.ts
index 877dfb4..aa9ec8e 100644
--- a/tests/e2e/cinematic-hero-flag.spec.ts
+++ b/tests/e2e/cinematic-hero-flag.spec.ts
@@ -25,4 +25,3 @@ test.describe("feature-flagged cinematic hero", () => {
     await expect(page.locator('[data-perfume-zone="oud-wood"]')).toBeVisible()
   })
 })
-
diff --git a/tests/e2e/theme.spec.ts b/tests/e2e/theme.spec.ts
index 9f84f9e..11cedd9 100644
--- a/tests/e2e/theme.spec.ts
+++ b/tests/e2e/theme.spec.ts
@@ -194,6 +194,14 @@ test.describe("theme behavior", () => {
   });
 
   test("theme switching preserves the active cart", async ({ page }) => {
+    const runtimeErrors: string[] = [];
+    page.on("pageerror", (error) => runtimeErrors.push(error.message));
+    page.on("console", (message) => {
+      if (/hydration|did not match/i.test(message.text())) {
+        runtimeErrors.push(message.text());
+      }
+    });
+
     await page.goto("/product/nocturne-eau-de-parfum", {
       waitUntil: "domcontentloaded",
     });
@@ -215,9 +223,11 @@ test.describe("theme behavior", () => {
       const response = await fetch("/api/cart/summary");
       return response.json();
     });
+    await page.goto("/shop", { waitUntil: "networkidle" });
 
     expect(before.items.length).toBeGreaterThan(0);
     expect(after.items).toEqual(before.items);
+    expect(runtimeErrors).toEqual([]);
   });
 
   test("semantic section hierarchy reverses and product media is never inverted", async ({
diff --git a/tests/hero/cinematic.test.ts b/tests/hero/cinematic.test.ts
index 678653b..13aef5b 100644
--- a/tests/hero/cinematic.test.ts
+++ b/tests/hero/cinematic.test.ts
@@ -13,4 +13,3 @@ describe("CinematicHeroScene", () => {
     expect(markup).toContain("tom-ford-oud-wood-bottle.webp")
   })
 })
-
diff --git a/tests/integration/inventory-reservation.int.test.ts b/tests/integration/inventory-reservation.int.test.ts
new file mode 100644
index 0000000..4d99ae8
--- /dev/null
+++ b/tests/integration/inventory-reservation.int.test.ts
@@ -0,0 +1,155 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest"
+
+import {
+  finalizeInventoryForOrder,
+  releaseExpiredReservations,
+  reserveInventory,
+} from "@/lib/inventory/reservations"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `inventory_itest_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
+
+describe.skipIf(!hasDb)("inventory reservation lifecycle (DB)", () => {
+  let userId = ""
+  let productId = ""
+  const orderIds: string[] = []
+
+  beforeAll(async () => {
+    const user = await prisma.user.create({
+      data: {
+        email: `${tag}@example.test`,
+        passwordHash: "x",
+        name: "Inventory Integration Test",
+      },
+      select: { id: true },
+    })
+    userId = user.id
+    const product = await prisma.product.create({
+      data: {
+        name: `${tag} Perfume`,
+        slug: `${tag}-perfume`,
+        description: "test",
+        images: ["/placeholder.png"],
+        priceNGN: 50_000,
+        category: "PERFUMES",
+        publishStatus: "PUBLISHED",
+        stock: 5,
+      },
+      select: { id: true },
+    })
+    productId = product.id
+  })
+
+  beforeEach(async () => {
+    await prisma.inventoryMovement.deleteMany({ where: { productId } })
+    await prisma.inventoryReservation.deleteMany({ where: { productId } })
+    await prisma.product.update({ where: { id: productId }, data: { stock: 5 } })
+  })
+
+  afterAll(async () => {
+    await prisma.inventoryMovement.deleteMany({ where: { productId } }).catch(() => {})
+    await prisma.inventoryReservation.deleteMany({ where: { productId } }).catch(() => {})
+    await prisma.orderItem.deleteMany({ where: { orderId: { in: orderIds } } }).catch(() => {})
+    await prisma.order.deleteMany({ where: { id: { in: orderIds } } }).catch(() => {})
+    await prisma.product.deleteMany({ where: { id: productId } }).catch(() => {})
+    await prisma.user.deleteMany({ where: { id: userId } }).catch(() => {})
+  })
+
+  async function createOrder(quantity: number) {
+    const order = await prisma.order.create({
+      data: {
+        userId,
+        totalNGN: quantity * 50_000,
+        subtotalNGN: quantity * 50_000,
+        addressLine1: "1 Test St",
+        city: "Lagos",
+        state: "Lagos",
+        phone: "08000000000",
+        items: { create: [{ productId, quantity, priceNGN: 50_000 }] },
+      },
+      select: { id: true },
+    })
+    orderIds.push(order.id)
+    return order.id
+  }
+
+  it("returns expired reserved stock exactly once", async () => {
+    const orderId = await createOrder(2)
+    const expiredAt = new Date(Date.now() - 60_000)
+    await prisma.$transaction((tx) =>
+      reserveInventory(tx, orderId, [{ productId, quantity: 2 }], expiredAt),
+    )
+
+    expect((await prisma.product.findUniqueOrThrow({
+      where: { id: productId },
+      select: { stock: true },
+    })).stock).toBe(3)
+
+    expect((await releaseExpiredReservations({ now: new Date(), limit: 100 })).released).toBe(1)
+    expect((await releaseExpiredReservations({ now: new Date(), limit: 100 })).released).toBe(0)
+
+    const reservation = await prisma.inventoryReservation.findUniqueOrThrow({
+      where: { orderId_productId: { orderId, productId } },
+      select: { status: true },
+    })
+    const product = await prisma.product.findUniqueOrThrow({
+      where: { id: productId },
+      select: { stock: true },
+    })
+    expect(reservation.status).toBe("EXPIRED")
+    expect(product.stock).toBe(5)
+  })
+
+  it("finalizes a live reservation without decrementing stock twice", async () => {
+    const orderId = await createOrder(3)
+    await prisma.$transaction((tx) =>
+      reserveInventory(
+        tx,
+        orderId,
+        [{ productId, quantity: 3 }],
+        new Date(Date.now() + 30 * 60_000),
+      ),
+    )
+    await prisma.$transaction((tx) =>
+      finalizeInventoryForOrder(tx, orderId, [{ productId, quantity: 3 }]),
+    )
+
+    const reservation = await prisma.inventoryReservation.findUniqueOrThrow({
+      where: { orderId_productId: { orderId, productId } },
+      select: { status: true },
+    })
+    const product = await prisma.product.findUniqueOrThrow({
+      where: { id: productId },
+      select: { stock: true },
+    })
+    expect(reservation.status).toBe("SOLD")
+    expect(product.stock).toBe(2)
+  })
+
+  it("allows only one concurrent checkout to claim the final stock", async () => {
+    await prisma.product.update({ where: { id: productId }, data: { stock: 2 } })
+    const firstOrderId = await createOrder(2)
+    const secondOrderId = await createOrder(2)
+    const expiresAt = new Date(Date.now() + 30 * 60_000)
+
+    const outcomes = await Promise.allSettled([
+      prisma.$transaction((tx) =>
+        reserveInventory(tx, firstOrderId, [{ productId, quantity: 2 }], expiresAt),
+      ),
+      prisma.$transaction((tx) =>
+        reserveInventory(tx, secondOrderId, [{ productId, quantity: 2 }], expiresAt),
+      ),
+    ])
+
+    expect(outcomes.filter((outcome) => outcome.status === "fulfilled")).toHaveLength(1)
+    expect(outcomes.filter((outcome) => outcome.status === "rejected")).toHaveLength(1)
+    expect((await prisma.product.findUniqueOrThrow({
+      where: { id: productId },
+      select: { stock: true },
+    })).stock).toBe(0)
+    expect(await prisma.inventoryReservation.count({
+      where: { orderId: { in: [firstOrderId, secondOrderId] } },
+    })).toBe(1)
+  })
+})
diff --git a/tests/integration/order-state.int.test.ts b/tests/integration/order-state.int.test.ts
new file mode 100644
index 0000000..36b0d5c
--- /dev/null
+++ b/tests/integration/order-state.int.test.ts
@@ -0,0 +1,161 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+
+import { reserveInventory } from "@/lib/inventory/reservations"
+import { updateOrderStatus } from "@/lib/services/order-service"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `order_state_itest_${Date.now()}_${Math.random()
+  .toString(36)
+  .slice(2, 8)}`
+
+describe.skipIf(!hasDb)("order state transitions (DB)", () => {
+  let adminId = ""
+  let customerId = ""
+  let productId = ""
+  let orderId = ""
+  let attemptId = ""
+
+  beforeAll(async () => {
+    const [admin, customer] = await Promise.all([
+      prisma.user.create({
+        data: {
+          email: `${tag}_admin@example.test`,
+          passwordHash: "x",
+          role: "ADMIN",
+        },
+        select: { id: true },
+      }),
+      prisma.user.create({
+        data: {
+          email: `${tag}_customer@example.test`,
+          passwordHash: "x",
+        },
+        select: { id: true },
+      }),
+    ])
+    adminId = admin.id
+    customerId = customer.id
+
+    const product = await prisma.product.create({
+      data: {
+        name: `${tag} Product`,
+        slug: `${tag}-product`,
+        description: "test",
+        images: ["/placeholder.png"],
+        priceNGN: 50_000,
+        category: "PERFUMES",
+        publishStatus: "PUBLISHED",
+        stock: 2,
+      },
+      select: { id: true },
+    })
+    productId = product.id
+
+    const order = await prisma.order.create({
+      data: {
+        userId: customerId,
+        status: "PENDING",
+        paymentMethod: "CARD",
+        subtotalNGN: 50_000,
+        totalNGN: 50_000,
+        addressLine1: "1 Test St",
+        city: "Lagos",
+        state: "Lagos",
+        phone: "08000000000",
+        items: {
+          create: [{ productId, quantity: 1, priceNGN: 50_000 }],
+        },
+      },
+      select: { id: true },
+    })
+    orderId = order.id
+
+    await prisma.$transaction((tx) =>
+      reserveInventory(
+        tx,
+        orderId,
+        [{ productId, quantity: 1 }],
+        new Date(Date.now() + 30 * 60 * 1000),
+      ),
+    )
+
+    const attempt = await prisma.paymentAttempt.create({
+      data: {
+        orderId,
+        providerReference: `cancel_${tag}`,
+        idempotencyKey: `cancel-${tag}`,
+        expectedAmountNGN: 50_000,
+        expectedCurrency: "NGN",
+        status: "PENDING",
+      },
+      select: { id: true },
+    })
+    attemptId = attempt.id
+  })
+
+  afterAll(async () => {
+    await prisma.auditLog.deleteMany({ where: { targetId: orderId } }).catch(() => {})
+    await prisma.notification.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.paymentAttempt.deleteMany({ where: { id: attemptId } }).catch(() => {})
+    await prisma.inventoryMovement.deleteMany({ where: { sourceId: orderId } }).catch(() => {})
+    await prisma.inventoryReservation.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.orderItem.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.order.deleteMany({ where: { id: orderId } }).catch(() => {})
+    await prisma.product.deleteMany({ where: { id: productId } }).catch(() => {})
+    await prisma.user.deleteMany({
+      where: { id: { in: [adminId, customerId] } },
+    }).catch(() => {})
+  })
+
+  it("cancels a pending order and releases stock exactly once", async () => {
+    await updateOrderStatus({
+      orderId,
+      status: "CANCELLED",
+      actorId: adminId,
+      reason: "Customer requested cancellation",
+    })
+
+    const [order, reservation, product, attempt, movement, audit] =
+      await Promise.all([
+        prisma.order.findUniqueOrThrow({ where: { id: orderId } }),
+        prisma.inventoryReservation.findUniqueOrThrow({
+          where: { orderId_productId: { orderId, productId } },
+        }),
+        prisma.product.findUniqueOrThrow({ where: { id: productId } }),
+        prisma.paymentAttempt.findUniqueOrThrow({ where: { id: attemptId } }),
+        prisma.inventoryMovement.findFirst({
+          where: {
+            sourceId: orderId,
+            reason: "RESERVATION_CANCELLED",
+          },
+        }),
+        prisma.auditLog.findFirst({
+          where: {
+            targetId: orderId,
+            action: "order.status.transition",
+          },
+        }),
+      ])
+
+    expect(order.status).toBe("CANCELLED")
+    expect(reservation.status).toBe("RELEASED")
+    expect(product.stock).toBe(2)
+    expect(attempt.status).toBe("ABANDONED")
+    expect(movement?.delta).toBe(1)
+    expect(audit?.actorId).toBe(adminId)
+
+    await expect(
+      updateOrderStatus({
+        orderId,
+        status: "CANCELLED",
+        actorId: adminId,
+        reason: "Duplicate submission",
+      }),
+    ).rejects.toMatchObject({ code: "VALIDATION_ERROR" })
+    expect(
+      (await prisma.product.findUniqueOrThrow({ where: { id: productId } }))
+        .stock,
+    ).toBe(2)
+  })
+})
diff --git a/tests/integration/outbox.int.test.ts b/tests/integration/outbox.int.test.ts
new file mode 100644
index 0000000..31ab887
--- /dev/null
+++ b/tests/integration/outbox.int.test.ts
@@ -0,0 +1,134 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+
+import {
+  enqueueOrderPaidEvents,
+  OUTBOX_TYPES,
+  processOutboxBatch,
+} from "@/lib/jobs/outbox"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `outbox_itest_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
+
+describe.skipIf(!hasDb)("transactional outbox (DB)", () => {
+  let userId = ""
+  let productId = ""
+  let orderId = ""
+
+  beforeAll(async () => {
+    const user = await prisma.user.create({
+      data: {
+        email: `${tag}@example.test`,
+        passwordHash: "x",
+        name: "Outbox <Test>",
+      },
+      select: { id: true },
+    })
+    userId = user.id
+    const product = await prisma.product.create({
+      data: {
+        name: `${tag} Product`,
+        slug: `${tag}-product`,
+        description: "test",
+        images: ["/placeholder.png"],
+        priceNGN: 50_000,
+        category: "PERFUMES",
+        publishStatus: "PUBLISHED",
+        stock: 5,
+      },
+      select: { id: true },
+    })
+    productId = product.id
+    const order = await prisma.order.create({
+      data: {
+        userId,
+        status: "PAID",
+        reference: `ref_${tag}`,
+        subtotalNGN: 50_000,
+        totalNGN: 50_000,
+        addressLine1: "1 Test St",
+        city: "Lagos",
+        state: "Lagos",
+        phone: "08000000000",
+        items: { create: [{ productId, quantity: 1, priceNGN: 50_000 }] },
+      },
+      select: { id: true },
+    })
+    orderId = order.id
+  })
+
+  afterAll(async () => {
+    await prisma.notification.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.outboxEvent.deleteMany({
+      where: { aggregateType: "Order", aggregateId: orderId },
+    }).catch(() => {})
+    await prisma.orderItem.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.order.deleteMany({ where: { id: orderId } }).catch(() => {})
+    await prisma.product.deleteMany({ where: { id: productId } }).catch(() => {})
+    await prisma.user.deleteMany({ where: { id: userId } }).catch(() => {})
+  })
+
+  it("processes order effects and deduplicates an event replay", async () => {
+    await prisma.$transaction((tx) => enqueueOrderPaidEvents(tx, orderId))
+    const first = await processOutboxBatch({
+      limit: 10,
+      workerId: `${tag}_worker`,
+      aggregateId: orderId,
+    })
+    expect(first.processed).toBe(3)
+
+    const events = await prisma.outboxEvent.findMany({
+      where: { aggregateType: "Order", aggregateId: orderId },
+      select: { type: true, status: true },
+    })
+    expect(events).toHaveLength(3)
+    expect(events.every((event) => event.status === "SUCCEEDED")).toBe(true)
+    expect(await prisma.notification.count({ where: { orderId } })).toBe(1)
+
+    await prisma.outboxEvent.update({
+      where: { idempotencyKey: `admin-order-paid:${orderId}` },
+      data: {
+        status: "PENDING",
+        availableAt: new Date(),
+        processedAt: null,
+      },
+    })
+    const replay = await processOutboxBatch({
+      limit: 1,
+      workerId: `${tag}_replay`,
+      aggregateId: orderId,
+    })
+    expect(replay.processed).toBe(1)
+    expect(await prisma.notification.count({ where: { orderId } })).toBe(1)
+  }, 15_000)
+
+  it("moves an exhausted unsupported event to the failed state", async () => {
+    const event = await prisma.outboxEvent.create({
+      data: {
+        type: "UNSUPPORTED_TEST_EVENT",
+        aggregateType: "Order",
+        aggregateId: orderId,
+        idempotencyKey: `unsupported:${orderId}`,
+        maxAttempts: 1,
+      },
+    })
+    const result = await processOutboxBatch({
+      limit: 1,
+      workerId: `${tag}_failure`,
+      aggregateId: orderId,
+    })
+    expect(result.failed).toBe(1)
+    expect((await prisma.outboxEvent.findUniqueOrThrow({
+      where: { id: event.id },
+      select: { status: true, lastError: true },
+    }))).toEqual({ status: "FAILED", lastError: "INTERNAL_ERROR" })
+  })
+
+  it("uses distinct durable effects for each order-paid consequence", () => {
+    expect(Object.values(OUTBOX_TYPES)).toEqual([
+      "ORDER_RECEIPT",
+      "ADMIN_ORDER_PAID_NOTIFICATION",
+      "REFERRAL_QUALIFICATION",
+    ])
+  })
+})
diff --git a/tests/integration/password-reset.int.test.ts b/tests/integration/password-reset.int.test.ts
new file mode 100644
index 0000000..d6dddf0
--- /dev/null
+++ b/tests/integration/password-reset.int.test.ts
@@ -0,0 +1,70 @@
+import bcrypt from "bcryptjs"
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+
+import {
+  consumePasswordResetToken,
+  passwordResetTokenHash,
+} from "@/lib/auth/password-reset"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `password_reset_itest_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`
+
+describe.skipIf(!hasDb)("password reset token lifecycle (DB)", () => {
+  let userId = ""
+
+  beforeAll(async () => {
+    const user = await prisma.user.create({
+      data: {
+        email: `${tag}@example.test`,
+        passwordHash: await bcrypt.hash("old-password", 4),
+      },
+      select: { id: true },
+    })
+    userId = user.id
+  })
+
+  afterAll(async () => {
+    await prisma.passwordResetToken.deleteMany({ where: { userId } }).catch(() => {})
+    await prisma.user.deleteMany({ where: { id: userId } }).catch(() => {})
+  })
+
+  it("changes the password once and rejects replay", async () => {
+    const token = `token_${tag}`
+    await prisma.passwordResetToken.create({
+      data: {
+        userId,
+        tokenHash: passwordResetTokenHash(token),
+        expiresAt: new Date(Date.now() + 60_000),
+      },
+    })
+
+    expect(await consumePasswordResetToken(token, "new-password")).toBe(true)
+    expect(await consumePasswordResetToken(token, "other-password")).toBe(false)
+
+    const user = await prisma.user.findUniqueOrThrow({
+      where: { id: userId },
+      select: { passwordHash: true },
+    })
+    expect(await bcrypt.compare("new-password", user.passwordHash)).toBe(true)
+    expect(await bcrypt.compare("other-password", user.passwordHash)).toBe(false)
+  })
+
+  it("rejects expired tokens without changing the password", async () => {
+    const token = `expired_${tag}`
+    await prisma.passwordResetToken.update({
+      where: { userId },
+      data: {
+        tokenHash: passwordResetTokenHash(token),
+        expiresAt: new Date(Date.now() - 60_000),
+        usedAt: null,
+      },
+    })
+    expect(await consumePasswordResetToken(token, "expired-password")).toBe(false)
+    const user = await prisma.user.findUniqueOrThrow({
+      where: { id: userId },
+      select: { passwordHash: true },
+    })
+    expect(await bcrypt.compare("new-password", user.passwordHash)).toBe(true)
+  })
+})
diff --git a/tests/integration/payment-reconciliation.int.test.ts b/tests/integration/payment-reconciliation.int.test.ts
new file mode 100644
index 0000000..8827407
--- /dev/null
+++ b/tests/integration/payment-reconciliation.int.test.ts
@@ -0,0 +1,173 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+
+import type {
+  InitPaymentInput,
+  PaymentProvider,
+} from "@/integrations/payments/types"
+import { reserveInventory } from "@/lib/inventory/reservations"
+import { reconcilePaymentAttempt } from "@/lib/payments/reconciliation"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `reconciliation_itest_${Date.now()}_${Math.random()
+  .toString(36)
+  .slice(2, 8)}`
+
+describe.skipIf(!hasDb)("payment reconciliation settlement (DB)", () => {
+  let userId = ""
+  let productId = ""
+  let orderId = ""
+  let attemptId = ""
+  const reference = `paystack_${tag}`
+
+  const provider: PaymentProvider = {
+    name: "paystack",
+    async initialize(input: InitPaymentInput) {
+      return {
+        reference: input.reference,
+        authorizationUrl: "https://example.test/pay",
+      }
+    },
+    async verify(receivedReference, expected) {
+      return {
+        reference: receivedReference,
+        status: "success",
+        amountNGN: expected.amountNGN,
+        currency: expected.currency,
+        amountMatches: true,
+        paidAt: new Date().toISOString(),
+      }
+    },
+    async refund(input) {
+      return {
+        providerRefundId: `refund_${input.reference}`,
+        status: "processing",
+        amountNGN: input.amountNGN,
+        currency: input.currency,
+      }
+    },
+    async verifyRefund(providerRefundId, expected) {
+      return {
+        providerRefundId,
+        status: "processing",
+        amountNGN: expected.amountNGN,
+        currency: expected.currency,
+      }
+    },
+    verifyWebhook() {
+      return { valid: false }
+    },
+  }
+
+  beforeAll(async () => {
+    const user = await prisma.user.create({
+      data: {
+        email: `${tag}@example.test`,
+        passwordHash: "x",
+        name: "Reconciliation Test",
+      },
+      select: { id: true },
+    })
+    userId = user.id
+
+    const product = await prisma.product.create({
+      data: {
+        name: `${tag} Product`,
+        slug: `${tag}-product`,
+        description: "test",
+        images: ["/placeholder.png"],
+        priceNGN: 50_000,
+        category: "PERFUMES",
+        publishStatus: "PUBLISHED",
+        stock: 3,
+      },
+      select: { id: true },
+    })
+    productId = product.id
+
+    const order = await prisma.order.create({
+      data: {
+        userId,
+        status: "PENDING",
+        paymentMethod: "CARD",
+        totalNGN: 50_000,
+        subtotalNGN: 50_000,
+        addressLine1: "1 Test St",
+        city: "Lagos",
+        state: "Lagos",
+        phone: "08000000000",
+        items: {
+          create: [{ productId, quantity: 1, priceNGN: 50_000 }],
+        },
+      },
+      select: { id: true },
+    })
+    orderId = order.id
+
+    await prisma.$transaction((tx) =>
+      reserveInventory(
+        tx,
+        orderId,
+        [{ productId, quantity: 1 }],
+        new Date(Date.now() + 30 * 60 * 1000),
+      ),
+    )
+
+    const attempt = await prisma.paymentAttempt.create({
+      data: {
+        orderId,
+        provider: "paystack",
+        providerReference: reference,
+        idempotencyKey: `reconcile-${tag}`,
+        expectedAmountNGN: 50_000,
+        expectedCurrency: "NGN",
+        status: "PENDING",
+        initializedAt: new Date(),
+      },
+      select: { id: true },
+    })
+    attemptId = attempt.id
+  })
+
+  afterAll(async () => {
+    await prisma.outboxEvent.deleteMany({
+      where: { aggregateId: orderId },
+    }).catch(() => {})
+    await prisma.loyaltyLedger.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.paymentAttempt.deleteMany({ where: { id: attemptId } }).catch(() => {})
+    await prisma.inventoryMovement.deleteMany({
+      where: { sourceId: orderId },
+    }).catch(() => {})
+    await prisma.inventoryReservation.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.orderItem.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.order.deleteMany({ where: { id: orderId } }).catch(() => {})
+    await prisma.product.deleteMany({ where: { id: productId } }).catch(() => {})
+    await prisma.user.deleteMany({ where: { id: userId } }).catch(() => {})
+  })
+
+  it("settles a missed webhook exactly once", async () => {
+    expect(await reconcilePaymentAttempt(attemptId, provider)).toBe("settled")
+
+    const [attempt, order, reservation, product, events] = await Promise.all([
+      prisma.paymentAttempt.findUniqueOrThrow({ where: { id: attemptId } }),
+      prisma.order.findUniqueOrThrow({ where: { id: orderId } }),
+      prisma.inventoryReservation.findUniqueOrThrow({
+        where: { orderId_productId: { orderId, productId } },
+      }),
+      prisma.product.findUniqueOrThrow({ where: { id: productId } }),
+      prisma.outboxEvent.count({ where: { aggregateId: orderId } }),
+    ])
+
+    expect(attempt.status).toBe("SUCCEEDED")
+    expect(order.status).toBe("PAID")
+    expect(order.reference).toBe(reference)
+    expect(reservation.status).toBe("SOLD")
+    expect(product.stock).toBe(2)
+    expect(events).toBe(3)
+
+    expect(await reconcilePaymentAttempt(attemptId, provider)).toBe("skipped")
+    expect(
+      await prisma.outboxEvent.count({ where: { aggregateId: orderId } }),
+    ).toBe(3)
+  })
+})
diff --git a/tests/integration/refund-request.int.test.ts b/tests/integration/refund-request.int.test.ts
new file mode 100644
index 0000000..05e359b
--- /dev/null
+++ b/tests/integration/refund-request.int.test.ts
@@ -0,0 +1,254 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+
+import type {
+  PaymentProvider,
+  ProviderRefundStatus,
+} from "@/integrations/payments/types"
+import { reconcileRefund } from "@/lib/payments/reconciliation"
+import { requestFullRefund } from "@/lib/refunds/service"
+import { settleRefundStatus } from "@/lib/refunds/settlement"
+import { prisma } from "@/lib/prisma"
+
+const hasDb = Boolean(process.env.DATABASE_URL)
+const tag = `refund_request_itest_${Date.now()}_${Math.random()
+  .toString(36)
+  .slice(2, 8)}`
+
+describe.skipIf(!hasDb)("durable refund request (DB)", () => {
+  let adminId = ""
+  let customerId = ""
+  let productId = ""
+  let orderId = ""
+  let attemptId = ""
+  let providerCalls = 0
+  let verifiedRefundStatus: ProviderRefundStatus = "processing"
+  const paymentReference = `paid_${tag}`
+
+  const provider: PaymentProvider = {
+    name: "paystack",
+    async initialize(input) {
+      return {
+        reference: input.reference,
+        authorizationUrl: "https://example.test/pay",
+      }
+    },
+    async verify(reference, expected) {
+      return {
+        reference,
+        status: "success",
+        amountNGN: expected.amountNGN,
+        currency: expected.currency,
+        amountMatches: true,
+        paidAt: new Date().toISOString(),
+      }
+    },
+    async refund(input) {
+      providerCalls += 1
+      return {
+        providerRefundId: `provider_refund_${tag}`,
+        status: "processing",
+        amountNGN: input.amountNGN,
+        currency: input.currency,
+      }
+    },
+    async verifyRefund(providerRefundId, expected) {
+      return {
+        providerRefundId,
+        status: verifiedRefundStatus,
+        amountNGN: expected.amountNGN,
+        currency: expected.currency,
+      }
+    },
+    verifyWebhook() {
+      return { valid: false }
+    },
+  }
+
+  beforeAll(async () => {
+    const [admin, customer] = await Promise.all([
+      prisma.user.create({
+        data: {
+          email: `${tag}_admin@example.test`,
+          passwordHash: "x",
+          role: "ADMIN",
+        },
+        select: { id: true },
+      }),
+      prisma.user.create({
+        data: {
+          email: `${tag}_customer@example.test`,
+          passwordHash: "x",
+          totalLifetimeSpend: 225_000,
+          loyaltyTier: "OBSIDIAN",
+        },
+        select: { id: true },
+      }),
+    ])
+    adminId = admin.id
+    customerId = customer.id
+
+    const product = await prisma.product.create({
+      data: {
+        name: `${tag} Product`,
+        slug: `${tag}-product`,
+        description: "test",
+        images: ["/placeholder.png"],
+        priceNGN: 75_000,
+        category: "PERFUMES",
+        publishStatus: "PUBLISHED",
+        stock: 2,
+      },
+      select: { id: true },
+    })
+    productId = product.id
+
+    const order = await prisma.order.create({
+      data: {
+        userId: customerId,
+        status: "PAID",
+        paymentMethod: "CARD",
+        subtotalNGN: 75_000,
+        totalNGN: 75_000,
+        reference: paymentReference,
+        addressLine1: "1 Test St",
+        city: "Lagos",
+        state: "Lagos",
+        phone: "08000000000",
+        items: {
+          create: [{ productId, quantity: 1, priceNGN: 75_000 }],
+        },
+      },
+      select: { id: true },
+    })
+    orderId = order.id
+
+    const attempt = await prisma.paymentAttempt.create({
+      data: {
+        orderId,
+        provider: "paystack",
+        providerReference: paymentReference,
+        idempotencyKey: `payment-${tag}`,
+        expectedAmountNGN: 75_000,
+        expectedCurrency: "NGN",
+        status: "SUCCEEDED",
+        verifiedAt: new Date(),
+      },
+      select: { id: true },
+    })
+    attemptId = attempt.id
+    await prisma.loyaltyLedger.create({
+      data: {
+        userId: customerId,
+        orderId,
+        delta: 100,
+        balanceAfter: 100,
+        reason: "order_earn",
+      },
+    })
+  })
+
+  afterAll(async () => {
+    await prisma.webhookReceipt.deleteMany({
+      where: { eventId: `refund-event-${tag}` },
+    }).catch(() => {})
+    await prisma.auditLog.deleteMany({
+      where: { targetType: "Refund", actorId: adminId },
+    }).catch(() => {})
+    await prisma.loyaltyLedger.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.refund.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.paymentAttempt.deleteMany({ where: { id: attemptId } }).catch(() => {})
+    await prisma.orderItem.deleteMany({ where: { orderId } }).catch(() => {})
+    await prisma.order.deleteMany({ where: { id: orderId } }).catch(() => {})
+    await prisma.product.deleteMany({ where: { id: productId } }).catch(() => {})
+    await prisma.user.deleteMany({
+      where: { id: { in: [adminId, customerId] } },
+    }).catch(() => {})
+  })
+
+  it("calls the provider once and returns the durable result on replay", async () => {
+    const idempotencyKey = `refund-${tag}`
+    const first = await requestFullRefund({
+      orderId,
+      idempotencyKey,
+      reason: "Customer approved full refund",
+      actorId: adminId,
+      provider,
+    })
+    const replay = await requestFullRefund({
+      orderId,
+      idempotencyKey,
+      reason: "Customer approved full refund",
+      actorId: adminId,
+      provider,
+    })
+
+    expect(providerCalls).toBe(1)
+    expect(replay.id).toBe(first.id)
+    expect(first.status).toBe("PROCESSING")
+    expect(first.amountNGN).toBe(75_000)
+    expect(
+      (await prisma.order.findUniqueOrThrow({ where: { id: orderId } }))
+        .status,
+    ).toBe("REFUND_PENDING")
+    expect(
+      await prisma.auditLog.count({
+        where: {
+          targetType: "Refund",
+          targetId: first.id,
+          action: "refund.request",
+        },
+      }),
+    ).toBe(1)
+
+    verifiedRefundStatus = "processed"
+    const reconciliation = await reconcileRefund(first.id, provider)
+    expect(reconciliation.outcome).toBe("updated")
+
+    const receipt = {
+      provider: "paystack",
+      eventId: `refund-event-${tag}`,
+      topic: "refund.processed",
+    }
+    const webhookReplay = await settleRefundStatus({
+      providerRefundId: `provider_refund_${tag}`,
+      paymentReference,
+      status: "processed",
+      amountNGN: 75_000,
+      currency: "NGN",
+      receipt,
+    })
+    const duplicate = await settleRefundStatus({
+      providerRefundId: `provider_refund_${tag}`,
+      paymentReference,
+      status: "processed",
+      amountNGN: 75_000,
+      currency: "NGN",
+      receipt,
+    })
+
+    expect(webhookReplay.outcome).toBe("duplicate")
+    expect(duplicate.outcome).toBe("duplicate")
+    expect(
+      await prisma.refund.findUniqueOrThrow({ where: { id: first.id } }),
+    ).toMatchObject({ status: "PROCESSED" })
+    expect(
+      await prisma.order.findUniqueOrThrow({ where: { id: orderId } }),
+    ).toMatchObject({ status: "REFUNDED" })
+    expect(
+      await prisma.paymentAttempt.findUniqueOrThrow({
+        where: { id: attemptId },
+      }),
+    ).toMatchObject({ status: "REFUNDED" })
+    expect(
+      await prisma.user.findUniqueOrThrow({ where: { id: customerId } }),
+    ).toMatchObject({
+      totalLifetimeSpend: 150_000,
+      loyaltyTier: "STANDARD",
+    })
+    expect(
+      await prisma.loyaltyLedger.count({
+        where: { orderId, reason: "order_reversal" },
+      }),
+    ).toBe(1)
+  })
+})
diff --git a/tests/integration/verified-review.int.test.ts b/tests/integration/verified-review.int.test.ts
index 3134165..7b85c31 100644
--- a/tests/integration/verified-review.int.test.ts
+++ b/tests/integration/verified-review.int.test.ts
@@ -51,11 +51,11 @@ describe.skipIf(!hasDb)('verified-purchase review path (DB)', () => {
 
   afterAll(async () => {
     // Delete children first to satisfy FKs.
+    await prisma.review.deleteMany({ where: { userId } }).catch(() => {})
     await prisma.orderItem.deleteMany({ where: { orderId } }).catch(() => {})
     await prisma.order.deleteMany({ where: { id: orderId } }).catch(() => {})
     await prisma.product.deleteMany({ where: { id: { in: [productId, otherProductId] } } }).catch(() => {})
     await prisma.user.deleteMany({ where: { id: userId } }).catch(() => {})
-    await prisma.$disconnect().catch(() => {})
   })
 
   it('recognizes a purchased product as a verified purchase', async () => {
@@ -67,4 +67,28 @@ describe.skipIf(!hasDb)('verified-purchase review path (DB)', () => {
     expect(await isVerifiedPurchase(userId, otherProductId)).toBe(false)
     expect(await findVerifyingOrder(userId, otherProductId)).toBeNull()
   })
+
+  it('enforces one review per user and product at the database boundary', async () => {
+    await prisma.review.create({
+      data: {
+        userId,
+        productId,
+        orderId,
+        rating: 5,
+        verifiedPurchase: true,
+      },
+    })
+
+    await expect(
+      prisma.review.create({
+        data: {
+          userId,
+          productId,
+          orderId,
+          rating: 4,
+          verifiedPurchase: true,
+        },
+      }),
+    ).rejects.toMatchObject({ code: 'P2002' })
+  })
 })
diff --git a/tests/inventory/reservations.test.ts b/tests/inventory/reservations.test.ts
new file mode 100644
index 0000000..b45a775
--- /dev/null
+++ b/tests/inventory/reservations.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  aggregateInventoryLines,
+  BANK_TRANSFER_RESERVATION_HOURS,
+  CARD_RESERVATION_MINUTES,
+  reservationExpiry,
+} from "@/lib/inventory/reservations"
+
+describe("inventory reservation policy", () => {
+  it("aggregates duplicate product lines before checking or reserving stock", () => {
+    expect(aggregateInventoryLines([
+      { productId: "b", quantity: 1 },
+      { productId: "a", quantity: 2 },
+      { productId: "a", quantity: 3 },
+    ])).toEqual([
+      { productId: "a", quantity: 5 },
+      { productId: "b", quantity: 1 },
+    ])
+  })
+
+  it("uses a short card reservation window", () => {
+    const now = new Date("2026-07-23T12:00:00.000Z")
+    expect(reservationExpiry("CARD", now).getTime() - now.getTime()).toBe(
+      CARD_RESERVATION_MINUTES * 60 * 1000,
+    )
+  })
+
+  it("allows a longer manual bank-transfer reservation window", () => {
+    const now = new Date("2026-07-23T12:00:00.000Z")
+    expect(reservationExpiry("BANK_TRANSFER", now).getTime() - now.getTime()).toBe(
+      BANK_TRANSFER_RESERVATION_HOURS * 60 * 60 * 1000,
+    )
+  })
+})
diff --git a/tests/jobs/outbox.test.ts b/tests/jobs/outbox.test.ts
new file mode 100644
index 0000000..7469994
--- /dev/null
+++ b/tests/jobs/outbox.test.ts
@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vitest"
+
+import { outboxRetryDelayMs } from "@/lib/jobs/outbox"
+
+describe("outbox retry policy", () => {
+  it("uses bounded exponential backoff", () => {
+    expect(outboxRetryDelayMs(1)).toBe(30_000)
+    expect(outboxRetryDelayMs(2)).toBe(60_000)
+    expect(outboxRetryDelayMs(3)).toBe(120_000)
+    expect(outboxRetryDelayMs(99)).toBe(60 * 60 * 1000)
+  })
+})
diff --git a/tests/notifications/contact-email.test.ts b/tests/notifications/contact-email.test.ts
new file mode 100644
index 0000000..4cac432
--- /dev/null
+++ b/tests/notifications/contact-email.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  renderContactOwnerEmail,
+  renderContactReplyEmail,
+} from "@/lib/notifications/contact-email"
+
+describe("contact email rendering", () => {
+  it("escapes every customer-controlled value in the owner email", () => {
+    const html = renderContactOwnerEmail({
+      name: "<img src=x onerror=alert(1)>",
+      email: "person@example.test",
+      subject: "<script>alert(1)</script>",
+      message: "\"quoted\" & <b>unsafe</b>",
+    })
+
+    expect(html).not.toContain("<script>")
+    expect(html).not.toContain("<img")
+    expect(html).not.toContain("<b>unsafe</b>")
+    expect(html).toContain("&lt;script&gt;")
+    expect(html).toContain("&amp;")
+    expect(html).toContain("&quot;quoted&quot;")
+  })
+
+  it("escapes customer content in the auto-reply", () => {
+    const html = renderContactReplyEmail(
+      {
+        name: "<Admin>",
+        message: "<a href=\"https://attacker.test\">click</a>",
+      },
+      "store@example.test",
+    )
+
+    expect(html).not.toContain("<Admin>")
+    expect(html).not.toContain("<a href=")
+    expect(html).toContain("&lt;Admin&gt;")
+    expect(html).toContain("&lt;a href=&quot;")
+  })
+})
diff --git a/tests/orders/state-machine.test.ts b/tests/orders/state-machine.test.ts
new file mode 100644
index 0000000..5510262
--- /dev/null
+++ b/tests/orders/state-machine.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  allowedAdminOrderTransitions,
+  canAdminTransitionOrder,
+} from "@/lib/orders/state-machine"
+
+describe("admin order state machine", () => {
+  it("allows only forward fulfilment transitions", () => {
+    expect(allowedAdminOrderTransitions("PAID")).toEqual(["SHIPPED"])
+    expect(allowedAdminOrderTransitions("SHIPPED")).toEqual(["DELIVERED"])
+  })
+
+  it("allows pending orders to be cancelled but not manually paid", () => {
+    expect(canAdminTransitionOrder("PENDING", "CANCELLED")).toBe(true)
+    expect(canAdminTransitionOrder("PENDING", "PAID")).toBe(false)
+  })
+
+  it("makes terminal and refund-managed states immutable to generic admin updates", () => {
+    for (const status of [
+      "DELIVERED",
+      "CANCELLED",
+      "REFUND_PENDING",
+      "REFUNDED",
+    ] as const) {
+      expect(allowedAdminOrderTransitions(status)).toEqual([])
+    }
+  })
+
+  it("rejects backward and skipped transitions", () => {
+    expect(canAdminTransitionOrder("DELIVERED", "PAID")).toBe(false)
+    expect(canAdminTransitionOrder("PAID", "DELIVERED")).toBe(false)
+    expect(canAdminTransitionOrder("SHIPPED", "PAID")).toBe(false)
+  })
+})
diff --git a/tests/payments/match.test.ts b/tests/payments/match.test.ts
new file mode 100644
index 0000000..37e3d1e
--- /dev/null
+++ b/tests/payments/match.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest"
+
+import { matchesExpectedPayment } from "@/lib/payments/match"
+
+const valid = {
+  expectedReference: "fade_order_123",
+  receivedReference: "fade_order_123",
+  expectedAmountNGN: 125_000,
+  receivedAmountNGN: 125_000,
+  expectedCurrency: "NGN",
+  receivedCurrency: "ngn",
+  providerStatus: "success",
+  paymentMethod: "CARD",
+}
+
+describe("payment matching invariant", () => {
+  it("accepts only a successful payment matching the stored order", () => {
+    expect(matchesExpectedPayment(valid)).toBe(true)
+  })
+
+  it.each([
+    ["reference", { receivedReference: "another_order" }],
+    ["amount", { receivedAmountNGN: 100 }],
+    ["currency", { receivedCurrency: "USD" }],
+    ["status", { providerStatus: "pending" }],
+    ["method", { paymentMethod: "BANK_TRANSFER" }],
+  ])("rejects a mismatched %s", (_field, override) => {
+    expect(matchesExpectedPayment({ ...valid, ...override })).toBe(false)
+  })
+})
diff --git a/tests/payments/provider-policy.test.ts b/tests/payments/provider-policy.test.ts
new file mode 100644
index 0000000..baaaee1
--- /dev/null
+++ b/tests/payments/provider-policy.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest"
+
+import {
+  isPaymentCollectionEnabled,
+  selectPaymentProviderMode,
+} from "@/integrations/payments/policy"
+
+describe("payment provider environment policy", () => {
+  it("uses the mock provider when no Paystack secret is configured", () => {
+    expect(selectPaymentProviderMode(undefined, "development")).toBe("mock")
+  })
+
+  it("allows genuine test keys during local development", () => {
+    expect(
+      selectPaymentProviderMode("sk_test_example", "development"),
+    ).toBe("paystack")
+  })
+
+  it("blocks live Paystack keys outside production", () => {
+    expect(
+      selectPaymentProviderMode("sk_live_example", "development"),
+    ).toBe("mock")
+    expect(selectPaymentProviderMode("sk_live_example", "test")).toBe("mock")
+  })
+
+  it("allows test-mode staging and live production credentials", () => {
+    expect(selectPaymentProviderMode("sk_test_example", "production")).toBe(
+      "paystack",
+    )
+    expect(selectPaymentProviderMode("sk_live_example", "production")).toBe(
+      "paystack",
+    )
+  })
+
+  it("collects payments only after an explicit enable and a secret", () => {
+    expect(isPaymentCollectionEnabled(false, "sk_live_example")).toBe(false)
+    expect(isPaymentCollectionEnabled(true, undefined)).toBe(false)
+    expect(isPaymentCollectionEnabled(true, "sk_test_example")).toBe(true)
+  })
+})
diff --git a/tests/security/bearer.test.ts b/tests/security/bearer.test.ts
new file mode 100644
index 0000000..76886fc
--- /dev/null
+++ b/tests/security/bearer.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest"
+
+import { hasValidBearerSecret } from "@/lib/security/bearer"
+
+describe("internal job bearer authentication", () => {
+  const secret = "a".repeat(32)
+
+  it("accepts the exact bearer secret", () => {
+    expect(hasValidBearerSecret(`Bearer ${secret}`, secret)).toBe(true)
+  })
+
+  it("rejects missing, malformed, or different credentials", () => {
+    expect(hasValidBearerSecret(null, secret)).toBe(false)
+    expect(hasValidBearerSecret(secret, secret)).toBe(false)
+    expect(hasValidBearerSecret(`Bearer ${"b".repeat(32)}`, secret)).toBe(false)
+    expect(hasValidBearerSecret(`Bearer ${secret}`, undefined)).toBe(false)
+  })
+})
diff --git a/tests/security/html.test.ts b/tests/security/html.test.ts
new file mode 100644
index 0000000..891a9bc
--- /dev/null
+++ b/tests/security/html.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest"
+
+import { escapeHtml } from "@/lib/security/html"
+
+describe("HTML escaping", () => {
+  it("escapes all characters that can introduce markup or attributes", () => {
+    expect(escapeHtml(`<img src=x onerror="alert('x')">&`)).toBe(
+      "&lt;img src=x onerror=&quot;alert(&#39;x&#39;)&quot;&gt;&amp;",
+    )
+  })
+
+  it("leaves ordinary customer text unchanged", () => {
+    expect(escapeHtml("Amina Okafor")).toBe("Amina Okafor")
+  })
+})
diff --git a/tests/security/origin.test.ts b/tests/security/origin.test.ts
new file mode 100644
index 0000000..9b97b92
--- /dev/null
+++ b/tests/security/origin.test.ts
@@ -0,0 +1,34 @@
+import { afterEach, describe, expect, it } from "vitest"
+
+import { hasTrustedOrigin } from "@/lib/security/origin"
+
+const previousNodeEnv = process.env.NODE_ENV
+const mutableEnv = process.env as Record<string, string | undefined>
+
+afterEach(() => {
+  if (previousNodeEnv === undefined) delete mutableEnv.NODE_ENV
+  else mutableEnv.NODE_ENV = previousNodeEnv
+})
+
+describe("state-changing request origin", () => {
+  it("accepts the request host", () => {
+    const request = new Request("http://localhost:3000/api/checkout", {
+      headers: { origin: "http://localhost:3000" },
+    })
+    expect(hasTrustedOrigin(request)).toBe(true)
+  })
+
+  it("rejects a cross-site origin", () => {
+    const request = new Request("http://localhost:3000/api/checkout", {
+      headers: { origin: "https://attacker.example" },
+    })
+    expect(hasTrustedOrigin(request)).toBe(false)
+  })
+
+  it("fails closed without Origin in production", () => {
+    mutableEnv.NODE_ENV = "production"
+    expect(
+      hasTrustedOrigin(new Request("https://shop.example/api/checkout")),
+    ).toBe(false)
+  })
+})