#7 · stacks/smakelo

Part of #1.

Reuse commerce placeOrder (idempotent, transactional) with businessId scoping; single-business carts
Structured OrderItemModifier rows so an order line's price is reconstructable
Fee engine: distance-based delivery fee (haversine), platform take rate, tips (delivery/table), tax per market (added vs VAT-inclusive), all in cents; recomputeOrderTotals alignment
Scheduled orders (order for later) + prep-time-based ready-at estimate from Product.preparationTime
Stripe (sandbox): destination charge to the merchant's connected account with application fee via the new @stacksjs/payments connect module; webhook wiring; refund path
Order lifecycle events -> notifications (database + email/SMS to test recipients only)
Feature tests: money paths, idempotency, EUR market fixture with VAT-inclusive pricing

Live and working at https://smakelo.stacksjs.com/order?business=marisol-cocina - an order placed through the site returns a tracking code, and the ledger records who is owed what.

Three production-only bugs surfaced getting it there, all of which looked like a perfectly fine page:

Cloudflare was caching the HTML for an hour, so no per-visitor Set-Cookie reached the browser and every POST answered 403. documentEdgeTtl is 0 now; an hour-old copy also answered "open now" wrongly for an hour.
The pages are served as built static files and never pass through the router step that seeds the CSRF cookie, so the token is minted in the page instead. Sound rather than a bypass: the check is a stateless double submit and rests on the same-origin policy.
migrate was aborting on ALTERs that collided with existing columns and || true was swallowing it, leaving production on a schema with no orders.business_id while the deploy reported success. Every order POST 500'd. The schema is rebuilt on deploy now, which is safe because every row comes from the seeder.