Add SMS OTP auth, discounts, customer orders, and category slugs.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/send-sms.ts

@@ -0,0 +1,53 @@
+/**
+ * Send an SMS via Meshkee (backend-only; never call from frontend).
+ *
+ * Usage:
+ *   npm run send-sms -- --to 09127004945 --message "متن پیام"
+ */
+import { config as loadEnv } from 'dotenv';
+import { resolve } from 'path';
+
+loadEnv({ path: resolve(__dirname, '../.env') });
+
+function arg(name: string, fallback?: string): string {
+  const idx = process.argv.indexOf(`--${name}`);
+  if (idx >= 0 && process.argv[idx + 1]) return process.argv[idx + 1];
+  if (fallback !== undefined) return fallback;
+  throw new Error(`Missing --${name}`);
+}
+
+async function main() {
+  const to = arg('to');
+  const message = arg('message');
+  const apiUrl =
+    process.env.MESHKEE_SMS_URL ??
+    'https://api.meshkee.com/api/v1/public/sms/send';
+  const apiKey = process.env.MESHKEE_SMS_API_KEY;
+  const domain = process.env.MESHKEE_SMS_DOMAIN ?? 'baloutpastry.com';
+
+  if (!apiKey) throw new Error('MESHKEE_SMS_API_KEY is not set in .env');
+  if (!/^09\d{9}$/.test(to)) throw new Error('to must match 09xxxxxxxxx');
+  if (!message.trim()) throw new Error('message is empty');
+
+  const response = await fetch(apiUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'X-Api-Key': apiKey,
+    },
+    body: JSON.stringify({ domain, to, message }),
+  });
+
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.success) {
+    console.error('SMS send failed', { status: response.status, body });
+    process.exit(1);
+  }
+
+  console.log('SMS sent', { to, serverId: body.serverId });
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});