<?php
// Gateway webhook receiver: https://yourshop.com/callback.php
require __DIR__ . '/bootstrap.php';
try { $d = gw()->verifyWebhook(); }
catch (Throwable $e) { http_response_code(403); exit($e->getMessage()); }

$pdo = app_db(); $pdo->beginTransaction();
try {
  $st = $pdo->prepare("SELECT * FROM orders WHERE order_ref=? FOR UPDATE"); $st->execute([$d['order_id']]);
  $o = $st->fetch();
  if ($o && $o['status'] === 'pending') {
    if ($d['event'] === 'invoice.paid') {
      if ((float)$o['amount'] !== (float)$d['amount']) { $pdo->rollBack(); http_response_code(409); exit('amount mismatch'); }
      $pdo->prepare("UPDATE orders SET status='paid', txid=?, updated_at=? WHERE id=?")->execute([$d['txid'], date('Y-m-d H:i:s'), $o['id']]);
      // 👉 यहाँ अपना काम करें: wallet credit / order fulfil / mail / recharge आदि
    } elseif ($d['event'] === 'invoice.failed') {
      $pdo->prepare("UPDATE orders SET status='failed', updated_at=? WHERE id=?")->execute([date('Y-m-d H:i:s'), $o['id']]);
    }
  }
  $pdo->commit();
} catch (Throwable $e) { $pdo->rollBack(); http_response_code(500); exit('error'); }
echo 'OK';    // 2xx = delivered