feat: shop activation + DB commission wallets + onion display (deploy pipeline)

- src/services/commissionService.js: read commission wallets and shop_activated from site_settings (DB) with env fallback, 30s cache
- src/handlers/adminHandlers/adminWalletsHandler.js: commission wallets from CommissionService instead of static config
- src/handlers/userHandlers/userHandler.js: canUseBot blocks all users when shop not activated
- src/migrations/015_shop_activation.js: seed shop_activated + commission_wallet_* into site_settings; register in runner
- admin-next: /api/system/info (onion hosts), /api/commission-wallets GET/PUT (super admin), /api/activation GET/PUT (super admin); lib/commission-wallets.ts shared helper; onion badge in header; shop activation card in settings; wallet editor in wallets page
- test: commissionService.test.js (10 cases: DB/env fallback, caching)

admin-next/src/app/api/activation/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { getAuth, requireSuperAuth } from '@/lib/auth-middleware';
+
+export async function GET(request: NextRequest) {
+  const auth = getAuth(request);
+  if ('status' in auth) return auth;
+
+  try {
+    const row = await db.siteSetting.findUnique({ where: { key: 'shop_activated' } });
+    const activated = row ? row.value === 'true' : process.env.SHOP_ACTIVATED !== 'false';
+    return NextResponse.json({ activated });
+  } catch (error) {
+    console.error('Activation GET error:', error);
+    return NextResponse.json({ error: 'Failed to load activation status' }, { status: 500 });
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const auth = requireSuperAuth(request);
+  if ('status' in auth) return auth;
+
+  try {
+    const body = await request.json();
+    if (typeof body.activated !== 'boolean') {
+      return NextResponse.json({ error: 'activated must be a boolean' }, { status: 400 });
+    }
+    const activated = body.activated;
+    const value = activated ? 'true' : 'false';
+
+    await db.siteSetting.upsert({
+      where: { key: 'shop_activated' },
+      update: { value, updatedAt: new Date() },
+      create: { key: 'shop_activated', value },
+    });
+
+    return NextResponse.json({ ok: true, activated });
+  } catch (error) {
+    console.error('Activation PUT error:', error);
+    return NextResponse.json({ error: 'Failed to save activation status' }, { status: 500 });
+  }
+}

admin-next/src/app/api/commission-wallets/route.ts

@@ -0,0 +1,80 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { Prisma } from '@prisma/client';
+import { requireSuperAuth } from '@/lib/auth-middleware';
+import { getCommissionWallets } from '@/lib/commission-wallets';
+
+const WALLET_TYPES = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'] as const;
+
+// Базовая валидация формата адреса по типу (не исчерпывающая, но отсекает мусор)
+function isValidWalletAddress(type: string, value: string): boolean {
+  if (!value) return true; // пустое значение = очистить кошелёк
+  switch (type) {
+    case 'BTC':
+      return /^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}$/.test(value);
+    case 'LTC':
+      return /^(ltc1|[LM3])[a-zA-HJ-NP-Z0-9]{26,62}$/.test(value);
+    case 'ETH':
+      return /^0x[a-fA-F0-9]{40}$/.test(value);
+    case 'USDT':
+    case 'USDC':
+      // TRC-20 (T...) или ERC-20 (0x...)
+      return /^T[a-zA-HJ-NP-Z0-9]{33}$/.test(value) || /^0x[a-fA-F0-9]{40}$/.test(value);
+    default:
+      return false;
+  }
+}
+
+export async function GET(request: NextRequest) {
+  const auth = requireSuperAuth(request);
+  if ('status' in auth) return auth;
+
+  try {
+    const wallets = await getCommissionWallets();
+    return NextResponse.json({ wallets });
+  } catch (error) {
+    console.error('Commission wallets GET error:', error);
+    return NextResponse.json({ error: 'Failed to load commission wallets' }, { status: 500 });
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  const auth = requireSuperAuth(request);
+  if ('status' in auth) return auth;
+
+  try {
+    const body = await request.json();
+    const wallets: Record<string, string> = body.wallets || {};
+
+    // Валидация: только известные типы и корректный формат адресов
+    const operations: Prisma.PrismaPromise<unknown>[] = [];
+    for (const type of WALLET_TYPES) {
+      if (wallets[type] === undefined) continue; // не трогаем отсутствующие типы
+      const value = String(wallets[type]).trim();
+      if (!isValidWalletAddress(type, value)) {
+        return NextResponse.json(
+          { error: `Invalid ${type} wallet address format` },
+          { status: 400 },
+        );
+      }
+      const key = `commission_wallet_${type}`;
+      operations.push(
+        db.siteSetting.upsert({
+          where: { key },
+          update: { value, updatedAt: new Date() },
+          create: { key, value },
+        }),
+      );
+    }
+
+    if (operations.length === 0) {
+      return NextResponse.json({ error: 'No wallet types provided' }, { status: 400 });
+    }
+
+    await db.$transaction(operations);
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('Commission wallets PUT error:', error);
+    return NextResponse.json({ error: 'Failed to save commission wallets' }, { status: 500 });
+  }
+}

admin-next/src/app/api/system/info/route.ts

@@ -0,0 +1,26 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireSuperAuth } from '@/lib/auth-middleware';
+import fs from 'fs';
+
+export async function GET(request: NextRequest) {
+  const auth = requireSuperAuth(request);
+  if ('status' in auth) return auth;
+
+  let adminOnion = '';
+
+  try {
+    const content = fs.readFileSync('/onion-hosts/onion-hosts.txt', 'utf-8');
+    for (const line of content.split('\n')) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith('ADMIN_ONION=')) {
+        adminOnion = trimmed.slice('ADMIN_ONION='.length);
+      }
+    }
+  } catch {
+    // file may not exist — return empty string
+  }
+
+  const lanUrl = process.env.ADMIN_URL || '';
+
+  return NextResponse.json({ adminOnion, lanUrl });
+}

admin-next/src/app/api/wallets/overview/route.ts

@@ -1,17 +1,52 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
-import { getAuth } from '@/lib/auth-middleware';
+import { requireSuperAuth } from '@/lib/auth-middleware';
+import { getCommissionWallets } from '@/lib/commission-wallets';
+
+// Цены в USD (как в боте src/utils/walletUtils.js): стейблкоины = 1
+const STABLECOIN_RATE = 1;
+
+function getBaseWalletType(walletType: string): string {
+  if (walletType.includes('ERC-20')) return 'ETH';
+  if (walletType.includes('_')) return walletType.split('_')[0];
+  return walletType;
+}
+
+async function getCryptoPrices(): Promise<Record<string, number>> {
+  try {
+    const res = await fetch(
+      'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,litecoin,ethereum&vs_currencies=usd',
+      { signal: AbortSignal.timeout(5000) },
+    );
+    if (!res.ok) throw new Error(`prices HTTP ${res.status}`);
+    const data = await res.json();
+    return {
+      btc: data.bitcoin?.usd || 0,
+      ltc: data.litecoin?.usd || 0,
+      eth: data.ethereum?.usd || 0,
+      usdt: STABLECOIN_RATE,
+      usdc: STABLECOIN_RATE,
+    };
+  } catch {
+    // Fallback: стейблкоины по 1 USD, остальные — 0 (не ломаем дашборд)
+    return { btc: 0, ltc: 0, eth: 0, usdt: STABLECOIN_RATE, usdc: STABLECOIN_RATE };
+  }
+}
 
 export async function GET(request: NextRequest) {
-  const auth = getAuth(request);
+  const auth = requireSuperAuth(request);
   if ('status' in auth) return auth;
 
   try {
-    const commissionEnabled = true;
     const commissionRate = 0.05;
 
-    const [wallets, payments, walletTypeCounts] = await Promise.all([
-      db.cryptoWallet.findMany(),
+    const [wallets, paymentAgg, recentPayments, walletTypeCounts, prices] = await Promise.all([
+      db.cryptoWallet.findMany({
+        select: { id: true, userId: true, walletType: true, balance: true },
+      }),
+      db.commissionPayment.aggregate({
+        _sum: { paidAmountUsd: true },
+      }),
       db.commissionPayment.findMany({
         orderBy: { id: 'desc' },
         take: 20,
@@ -20,28 +55,33 @@ export async function GET(request: NextRequest) {
         by: ['walletType'],
         _count: true,
       }),
+      getCryptoPrices(),
     ]);
 
     const totals: Record<string, number> = { BTC: 0, LTC: 0, ETH: 0, USDT: 0, USDC: 0 };
     const walletCounts: Record<string, number> = { BTC: 0, LTC: 0, ETH: 0, USDT: 0, USDC: 0 };
     const userIdSet = new Set<number>();
 
+    let totalUsd = 0;
+    let totalWallets = 0;
+    let activeWallets = 0;
+
     for (const w of wallets) {
-      const t = w.walletType.toUpperCase();
+      const base = getBaseWalletType(w.walletType);
+      const t = base.toUpperCase();
       if (t in totals) {
         totals[t] += w.balance;
         walletCounts[t]++;
+        totalWallets++;
+        if (w.balance > 0) activeWallets++;
+        totalUsd += w.balance * (prices[t.toLowerCase()] ?? 0);
       }
       userIdSet.add(w.userId);
     }
 
-    const totalUsd = wallets.reduce((sum, w) => sum + w.balance, 0);
-    const totalWallets = wallets.length;
-    const activeWallets = wallets.filter((w) => w.balance > 0).length;
     const totalUsers = userIdSet.size;
-
     const currentCommission = totalUsd * commissionRate;
-    const lastPaidAmount = payments.reduce((sum, p) => sum + p.paidAmountUsd, 0);
+    const lastPaidAmount = paymentAgg._sum.paidAmountUsd ?? 0;
     const commissionDue = Math.max(0, currentCommission - lastPaidAmount);
 
     const walletTypeDistribution = walletTypeCounts.map((w) => ({
@@ -49,13 +89,7 @@ export async function GET(request: NextRequest) {
       count: w._count,
     }));
 
-    const commissionWallets = {
-      BTC: process.env.COMMISSION_WALLET_BTC || '',
-      LTC: process.env.COMMISSION_WALLET_LTC || '',
-      USDT: process.env.COMMISSION_WALLET_USDT || '',
-      USDC: process.env.COMMISSION_WALLET_USDC || '',
-      ETH: process.env.COMMISSION_WALLET_ETH || '',
-    };
+    const commissionWallets = await getCommissionWallets();
     const mercuryoUrl = 'https://mercuryo.io/';
 
     return NextResponse.json({
@@ -65,10 +99,10 @@ export async function GET(request: NextRequest) {
       totalWallets,
       activeWallets,
       totalUsers,
-      commissionEnabled,
+      commissionEnabled: true,
       commissionRate,
       currentCommission,
-      payments,
+      payments: recentPayments,
       lastPaidAmount,
       commissionDue,
       walletTypeDistribution,

admin-next/src/components/layout/admin-header.tsx

@@ -22,8 +22,9 @@ import {
 } from "@/components/ui/alert-dialog";
 import { Avatar, AvatarFallback } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
-import { Moon, Sun, LogOut, User, Search } from "lucide-react";
+import { Moon, Sun, LogOut, User, Search, Globe, Copy } from "lucide-react";
 import { useTheme } from "next-themes";
+import { toast } from "sonner";
 import { useAuthStore } from "@/stores/auth-store";
 import { CommandPalette, openCommandPalette } from "@/components/layout/command-palette";
 import { AppBreadcrumbs } from "@/components/layout/breadcrumbs";
@@ -79,6 +80,7 @@ export function AdminHeader() {
   const { theme, setTheme } = useTheme();
   const { role, logout } = useAuthStore();
   const [logoutOpen, setLogoutOpen] = useState(false);
+  const [onion, setOnion] = useState("");
 
   useEffect(() => {
     const update = () => setHash(window.location.hash.slice(1) || "/");
@@ -87,6 +89,35 @@ export function AdminHeader() {
     return () => window.removeEventListener("hashchange", update);
   }, []);
 
+  useEffect(() => {
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await fetch("/api/system/info");
+        if (!res.ok) throw new Error("Failed to fetch system info");
+        const data = await res.json();
+        if (cancelled) return;
+        setOnion(data.adminOnion || "");
+      } catch {
+        if (cancelled) return;
+        setOnion("");
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  const copyOnion = async () => {
+    if (!onion) return;
+    try {
+      await navigator.clipboard.writeText(onion);
+      toast.success("Onion address copied");
+    } catch {
+      toast.error("Failed to copy onion address");
+    }
+  };
+
   const title =
     pageTitles[hash] ||
     (hash.startsWith("/users/")
@@ -105,6 +136,18 @@ export function AdminHeader() {
       </h1>
       {/* 1. Clock (hidden on mobile) */}
       <RealtimeClock />
+      {/* 1b. Onion host badge (hidden on mobile) */}
+      <button
+        type="button"
+        onClick={copyOnion}
+        disabled={!onion}
+        title={onion ? "Copy onion address" : "Onion address not ready yet"}
+        className="hidden md:flex items-center gap-1.5 rounded-md border border-border bg-muted/50 px-2 py-1 text-xs font-mono text-muted-foreground hover:bg-muted transition-colors shrink-0 max-w-[220px]"
+      >
+        <Globe className="size-3.5 shrink-0" />
+        <span className="truncate">{onion || "onion: —"}</span>
+        {onion && <Copy className="size-3 shrink-0 opacity-60" />}
+      </button>
       {/* 2. Command palette search button */}
       <Button
         variant="ghost"

admin-next/src/components/settings/settings-page.tsx

@@ -7,6 +7,7 @@ import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
 import { Skeleton } from "@/components/ui/skeleton";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
 import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
 import {
@@ -22,7 +23,7 @@ import {
 } from "@/components/ui/alert-dialog";
 import { toast } from "sonner";
 import { useAuthStore } from "@/stores/auth-store";
-import { Bot, Shield, Wrench, Save, AlertTriangle, Download, Upload, Database, Info, Eye, EyeOff } from "lucide-react";
+import { Bot, Shield, Wrench, Save, AlertTriangle, Download, Upload, Database, Info, Eye, EyeOff, ShieldCheck, Power, Copy, Globe, Link2 } from "lucide-react";
 
 const MASKED_PLACEHOLDER = "\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF\u25CF";
 
@@ -88,6 +89,83 @@ export function SettingsPage() {
   const fileInputRef = useRef<HTMLInputElement>(null);
   const [revealed, setRevealed] = useState<Record<string, string>>({});
   const [revealing, setRevealing] = useState<string | null>(null);
+  const [activated, setActivated] = useState<boolean | null>(null);
+  const [activationLoading, setActivationLoading] = useState(false);
+  const [activationDialogOpen, setActivationDialogOpen] = useState(false);
+  const [onion, setOnion] = useState("");
+  const [lanUrl, setLanUrl] = useState("");
+
+  useEffect(() => {
+    if (!isSuperAdmin) return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await fetch("/api/activation");
+        if (!res.ok) throw new Error("Failed to fetch activation");
+        const data = await res.json();
+        if (!cancelled) setActivated(!!data.activated);
+      } catch {
+        if (!cancelled) setActivated(null);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [isSuperAdmin]);
+
+  useEffect(() => {
+    if (!isSuperAdmin) return;
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await fetch("/api/system/info");
+        if (!res.ok) throw new Error("Failed to fetch system info");
+        const data = await res.json();
+        if (cancelled) return;
+        setOnion(data.adminOnion || "");
+        setLanUrl(data.lanUrl || "");
+      } catch {
+        if (cancelled) return;
+        setOnion("");
+        setLanUrl("");
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [isSuperAdmin]);
+
+  const copyText = async (text: string, label: string) => {
+    if (!text) return;
+    try {
+      await navigator.clipboard.writeText(text);
+      toast.success(`${label} copied`);
+    } catch {
+      toast.error(`Failed to copy ${label}`);
+    }
+  };
+
+  const handleToggleActivation = async () => {
+    if (activated === null) return;
+    const next = !activated;
+    setActivationLoading(true);
+    try {
+      const res = await fetch("/api/activation", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ activated: next }),
+      });
+      if (!res.ok) throw new Error("Failed to update activation");
+      const data = await res.json();
+      setActivated(!!data.activated);
+      toast.success(next ? "Shop activated" : "Shop blocked");
+    } catch {
+      toast.error("Failed to update shop activation");
+    } finally {
+      setActivationLoading(false);
+      setActivationDialogOpen(false);
+    }
+  };
 
   useEffect(() => {
     fetch("/api/settings")
@@ -431,6 +509,110 @@ export function SettingsPage() {
           </div>
         </CardContent>
       </Card>
+
+      {/* Shop Activation (super admin only) */}
+      {isSuperAdmin && (
+        <Card>
+          <CardHeader>
+            <CardTitle className="flex items-center gap-2 text-base">
+              <ShieldCheck className="h-4 w-4 text-emerald-500" />
+              Shop Activation
+            </CardTitle>
+            <CardDescription>
+              Control whether the shop is active and accepting orders. Blocking the shop
+              immediately disables purchasing for all users.
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <div className="flex items-center gap-3">
+              {activated === null ? (
+                <Badge variant="secondary">Checking...</Badge>
+              ) : activated ? (
+                <Badge className="bg-emerald-500/15 text-emerald-400">Activated</Badge>
+              ) : (
+                <Badge className="bg-red-500/15 text-red-400">Blocked</Badge>
+              )}
+              <span className="text-sm text-muted-foreground">
+                {activated === null
+                  ? "Loading activation status..."
+                  : activated
+                    ? "The shop is currently active and accepting orders."
+                    : "The shop is currently blocked. Users cannot place orders."}
+              </span>
+            </div>
+
+            <div className="space-y-2">
+              <div className="flex items-center gap-2 text-sm">
+                <Globe className="h-4 w-4 text-muted-foreground" />
+                <span className="text-muted-foreground">Onion:</span>
+                <button
+                  type="button"
+                  onClick={() => copyText(onion, "Onion address")}
+                  disabled={!onion}
+                  title={onion ? "Copy onion address" : "Onion address not ready yet"}
+                  className="inline-flex items-center gap-1.5 rounded border border-border bg-muted/50 px-2 py-0.5 font-mono text-xs text-muted-foreground hover:bg-muted transition-colors disabled:opacity-50"
+                >
+                  {onion || "—"}
+                  {onion && <Copy className="h-3 w-3 opacity-60" />}
+                </button>
+              </div>
+              <div className="flex items-center gap-2 text-sm">
+                <Link2 className="h-4 w-4 text-muted-foreground" />
+                <span className="text-muted-foreground">LAN:</span>
+                <button
+                  type="button"
+                  onClick={() => copyText(lanUrl, "LAN URL")}
+                  disabled={!lanUrl}
+                  title={lanUrl ? "Copy LAN URL" : "LAN URL not ready yet"}
+                  className="inline-flex items-center gap-1.5 rounded border border-border bg-muted/50 px-2 py-0.5 font-mono text-xs text-muted-foreground hover:bg-muted transition-colors disabled:opacity-50"
+                >
+                  {lanUrl || "—"}
+                  {lanUrl && <Copy className="h-3 w-3 opacity-60" />}
+                </button>
+              </div>
+            </div>
+
+            <AlertDialog open={activationDialogOpen} onOpenChange={setActivationDialogOpen}>
+              <AlertDialogTrigger asChild>
+                <Button
+                  variant={activated ? "destructive" : "default"}
+                  className="gap-2"
+                  disabled={activated === null || activationLoading}
+                >
+                  <Power className="h-4 w-4" />
+                  {activated ? "Block Shop" : "Activate Shop"}
+                </Button>
+              </AlertDialogTrigger>
+              <AlertDialogContent>
+                <AlertDialogHeader>
+                  <AlertDialogTitle>
+                    {activated ? "Block Shop" : "Activate Shop"}
+                  </AlertDialogTitle>
+                  <AlertDialogDescription>
+                    {activated
+                      ? "Blocking the shop will immediately prevent all users from placing orders. This action can be reversed at any time."
+                      : "Activating the shop will allow users to place orders again. This action can be reversed at any time."}
+                  </AlertDialogDescription>
+                </AlertDialogHeader>
+                <AlertDialogFooter>
+                  <AlertDialogCancel>Cancel</AlertDialogCancel>
+                  <AlertDialogAction
+                    onClick={handleToggleActivation}
+                    disabled={activationLoading}
+                    className={activated ? "bg-destructive text-white hover:bg-destructive/90" : ""}
+                  >
+                    {activationLoading
+                      ? "Updating..."
+                      : activated
+                        ? "Block Shop"
+                        : "Activate Shop"}
+                  </AlertDialogAction>
+                </AlertDialogFooter>
+              </AlertDialogContent>
+            </AlertDialog>
+          </CardContent>
+        </Card>
+      )}
     </div>
   );
 }

admin-next/src/components/wallets/wallets-page.tsx

@@ -45,6 +45,7 @@ import {
   ShieldCheck,
   PieChart as PieChartIcon,
   Receipt,
+  Pencil,
 } from 'lucide-react';
 import { Skeleton } from '@/components/ui/skeleton';
 import { Pagination } from '@/components/shared/pagination';
@@ -97,7 +98,6 @@ interface OverviewData {
   totalWallets: number;
   activeWallets: number;
   totalUsers: number;
-  commissionEnabled: boolean;
   commissionRate: number;
   currentCommission: number;
   payments: {
@@ -208,6 +208,9 @@ export function WalletsPage() {
   const [paymentAmount, setPaymentAmount] = useState('');
   const [paymentNote, setPaymentNote] = useState('');
   const [paymentSubmitting, setPaymentSubmitting] = useState(false);
+  const [editingWallets, setEditingWallets] = useState(false);
+  const [walletDraft, setWalletDraft] = useState<Record<string, string>>({});
+  const [walletsSaving, setWalletsSaving] = useState(false);
 
   // Tab 4 state
   const [txData, setTxData] = useState<TransactionRow[]>([]);
@@ -304,6 +307,48 @@ export function WalletsPage() {
     fetchOverview();
   }, []);
 
+  const startEditWallets = () => {
+    const current = overview?.commissionWallets || {};
+    setWalletDraft({
+      BTC: current.BTC || '',
+      LTC: current.LTC || '',
+      USDT: current.USDT || '',
+      USDC: current.USDC || '',
+      ETH: current.ETH || '',
+    });
+    setEditingWallets(true);
+  };
+
+  const cancelEditWallets = () => {
+    setEditingWallets(false);
+    setWalletDraft({});
+  };
+
+  const handleSaveWallets = async () => {
+    setWalletsSaving(true);
+    try {
+      const res = await fetch('/api/commission-wallets', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ wallets: walletDraft }),
+      });
+      if (!res.ok) throw new Error('Failed to save wallets');
+      toast.success('Commission wallets updated');
+      setEditingWallets(false);
+      setWalletDraft({});
+      // Refetch overview
+      const overviewRes = await fetch('/api/wallets/overview');
+      if (overviewRes.ok) {
+        const data = await overviewRes.json();
+        setOverview(data);
+      }
+    } catch {
+      toast.error('Failed to save commission wallets');
+    } finally {
+      setWalletsSaving(false);
+    }
+  };
+
   const handleRecordPayment = async () => {
     const amount = parseFloat(paymentAmount);
     if (isNaN(amount) || amount <= 0) {
@@ -761,7 +806,7 @@ export function WalletsPage() {
                       <p className="text-sm text-muted-foreground">Active Wallets</p>
                       <Wallet className="h-4 w-4 text-violet-500" />
                     </div>
-                    <p className="text-2xl font-bold mt-1">{overview.totalWallets}</p>
+                    <p className="text-2xl font-bold mt-1">{overview.activeWallets ?? 0}</p>
                   </CardContent>
                 </Card>
                 <Card>
@@ -1236,42 +1281,92 @@ export function WalletsPage() {
                   {overview && overview.commissionWallets && (
                     <Card>
                       <CardHeader className="pb-3">
-                        <CardTitle className="text-lg">Pay to Commission Wallet</CardTitle>
+                        <div className="flex items-center justify-between gap-2">
+                          <CardTitle className="text-lg">Pay to Commission Wallet</CardTitle>
+                          {isSuperAdmin && !editingWallets && (
+                            <Button
+                              variant="outline"
+                              size="sm"
+                              className="gap-1.5"
+                              onClick={startEditWallets}
+                            >
+                              <Pencil className="h-3.5 w-3.5" />
+                              Edit Wallets
+                            </Button>
+                          )}
+                        </div>
                         <CardDescription>Select currency and send payment to the address below</CardDescription>
                       </CardHeader>
                       <CardContent className="space-y-4">
-                        <div className="space-y-2">
-                          <Label htmlFor="commission-wallet-type">Currency</Label>
-                          <select
-                            id="commission-wallet-type"
-                            className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
-                            value={selectedCommissionWallet}
-                            onChange={(e) => setSelectedCommissionWallet(e.target.value)}
-                          >
-                            {currencyTypes.map((t) => (
-                              <option key={t} value={t}>{t}</option>
-                            ))}
-                          </select>
-                        </div>
-                        <div className="space-y-2">
-                          <Label>Address</Label>
-                          <div className="flex items-center gap-2">
-                            <code className="flex-1 rounded bg-muted px-3 py-2 text-xs font-mono break-all">
-                              {overview.commissionWallets[selectedCommissionWallet] || 'Not configured'}
-                            </code>
-                            <Button
-                              variant="outline"
-                              size="icon"
-                              className="shrink-0"
-                              onClick={() => copyToClipboard(
-                                overview.commissionWallets[selectedCommissionWallet] || '',
-                                'Address'
-                              )}
-                            >
-                              <Copy className="h-4 w-4" />
-                            </Button>
-                          </div>
-                        </div>
+                        {editingWallets ? (
+                          <>
+                            <div className="space-y-3">
+                              {(['BTC', 'LTC', 'USDT', 'USDC', 'ETH'] as const).map((t) => (
+                                <div key={t} className="space-y-1.5">
+                                  <Label htmlFor={`wallet-${t}`} className="text-sm">{t}</Label>
+                                  <Input
+                                    id={`wallet-${t}`}
+                                    value={walletDraft[t] || ''}
+                                    onChange={(e) => setWalletDraft((prev) => ({ ...prev, [t]: e.target.value }))}
+                                    className="font-mono"
+                                    placeholder={`${t} address`}
+                                  />
+                                </div>
+                              ))}
+                            </div>
+                            <div className="flex gap-2">
+                              <Button
+                                onClick={handleSaveWallets}
+                                disabled={walletsSaving}
+                                className="gap-1.5"
+                              >
+                                {walletsSaving ? 'Saving...' : 'Save'}
+                              </Button>
+                              <Button
+                                variant="outline"
+                                onClick={cancelEditWallets}
+                                disabled={walletsSaving}
+                              >
+                                Cancel
+                              </Button>
+                            </div>
+                          </>
+                        ) : (
+                          <>
+                            <div className="space-y-2">
+                              <Label htmlFor="commission-wallet-type">Currency</Label>
+                              <select
+                                id="commission-wallet-type"
+                                className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+                                value={selectedCommissionWallet}
+                                onChange={(e) => setSelectedCommissionWallet(e.target.value)}
+                              >
+                                {currencyTypes.map((t) => (
+                                  <option key={t} value={t}>{t}</option>
+                                ))}
+                              </select>
+                            </div>
+                            <div className="space-y-2">
+                              <Label>Address</Label>
+                              <div className="flex items-center gap-2">
+                                <code className="flex-1 rounded bg-muted px-3 py-2 text-xs font-mono break-all">
+                                  {overview.commissionWallets[selectedCommissionWallet] || 'Not configured'}
+                                </code>
+                                <Button
+                                  variant="outline"
+                                  size="icon"
+                                  className="shrink-0"
+                                  onClick={() => copyToClipboard(
+                                    overview.commissionWallets[selectedCommissionWallet] || '',
+                                    'Address'
+                                  )}
+                                >
+                                  <Copy className="h-4 w-4" />
+                                </Button>
+                              </div>
+                            </div>
+                          </>
+                        )}
                       </CardContent>
                     </Card>
                   )}

admin-next/src/lib/auth.ts

@@ -1,6 +1,6 @@
 import crypto from 'crypto';
 
-const ADMIN_SECRET = process.env.ADMIN_SECRET || 'changeme';
+const ADMIN_SECRET = process.env.ADMIN_SECRET || '';
 const SUPER_ADMIN_SECRET = process.env.SUPER_ADMIN_SECRET || '';
 
 export type AdminRole = 'admin' | 'super_admin';
@@ -14,12 +14,12 @@ export interface AdminPayload {
 
 export function createToken(secret: string): string {
   const isSuper = SUPER_ADMIN_SECRET && secret === SUPER_ADMIN_SECRET;
-  const isAdmin = secret === ADMIN_SECRET;
-  
+  const isAdmin = ADMIN_SECRET && secret === ADMIN_SECRET;
+
   if (!isAdmin && !isSuper) return '';
 
-  // If no super secret set, all admins are super
-  const role: AdminRole = (!SUPER_ADMIN_SECRET || isSuper) ? 'super_admin' : 'admin';
+  // Роль: super_admin только при явном SUPER_ADMIN_SECRET и совпадении с ним
+  const role: AdminRole = isSuper ? 'super_admin' : 'admin';
 
   const payload: AdminPayload = {
     role,
@@ -63,7 +63,7 @@ export function verifyToken(token: string): AdminPayload | null {
 }
 
 export function verifyReAuth(token: string): boolean {
-  const isSuper = SUPER_ADMIN_SECRET && token === SUPER_ADMIN_SECRET;
-  const isAdmin = token === ADMIN_SECRET;
+  const isSuper = !!(SUPER_ADMIN_SECRET && token === SUPER_ADMIN_SECRET);
+  const isAdmin = !!(ADMIN_SECRET && token === ADMIN_SECRET);
   return isSuper || isAdmin;
 }

admin-next/src/lib/commission-wallets.ts

@@ -0,0 +1,27 @@
+import { db } from '@/lib/db';
+
+const WALLET_TYPES = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'] as const;
+
+const ENV_KEYS: Record<string, string> = {
+  BTC: 'COMMISSION_WALLET_BTC',
+  LTC: 'COMMISSION_WALLET_LTC',
+  USDT: 'COMMISSION_WALLET_USDT',
+  USDC: 'COMMISSION_WALLET_USDC',
+  ETH: 'COMMISSION_WALLET_ETH',
+};
+
+export async function getCommissionWallets(): Promise<Record<string, string>> {
+  const keys = WALLET_TYPES.map((t) => `commission_wallet_${t}`);
+  const rows = await db.siteSetting.findMany({
+    where: { key: { in: keys } },
+  });
+
+  const wallets: Record<string, string> = {};
+  for (const type of WALLET_TYPES) {
+    const dbKey = `commission_wallet_${type}`;
+    const row = rows.find((r) => r.key === dbKey);
+    wallets[type] = row?.value || process.env[ENV_KEYS[type]] || '';
+  }
+
+  return wallets;
+}

src/__tests__/commissionService.test.js

@@ -0,0 +1,240 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+// Mock config
+vi.mock('../config/config.js', () => ({
+    __esModule: true,
+    default: {
+        BOT_TOKEN: 'test-token',
+        ADMIN_IDS: ['123456789'],
+        SUPER_ADMIN_IDS: ['123456789'],
+        SUPPORT_LINK: 'https://t.me/support',
+        DEFAULT_LANGUAGE: 'en',
+        ENCRYPTION_KEY: 'x'.repeat(64),
+        COMMISSION_ENABLED: true,
+        COMMISSION_PERCENT: 5,
+        COMMISSION_WALLETS: {
+            BTC: 'btc-env-address',
+            LTC: 'ltc-env-address',
+            USDT: 'usdt-env-address',
+            USDC: 'usdc-env-address',
+            ETH: 'eth-env-address'
+        }
+    }
+}));
+
+// Mock logger
+vi.mock('../utils/logger.js', () => ({
+    __esModule: true,
+    default: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+        fatal: vi.fn()
+    }
+}));
+
+// Track DB calls
+const dbCalls = {
+    allAsync: [],
+    getAsync: [],
+    runAsync: []
+};
+
+// Mock database
+vi.mock('../config/database.js', () => {
+    const db = {
+        allAsync: vi.fn(async (sql, params = []) => {
+            dbCalls.allAsync.push({ sql, params });
+            return [];
+        }),
+        getAsync: vi.fn(async (sql, params = []) => {
+            dbCalls.getAsync.push({ sql, params });
+            return undefined;
+        }),
+        runAsync: vi.fn(async (sql, params = []) => {
+            dbCalls.runAsync.push({ sql, params });
+            return {};
+        })
+    };
+    return { __esModule: true, default: db };
+});
+
+// We need to import after mocks are set up
+let CommissionService;
+
+describe('CommissionService', () => {
+    beforeEach(async () => {
+        dbCalls.allAsync = [];
+        dbCalls.getAsync = [];
+        dbCalls.runAsync = [];
+        vi.clearAllMocks();
+
+        // Dynamic import to get fresh module with mocks
+        CommissionService = (await import('../services/commissionService.js')).default;
+
+        // Invalidate cache before each test
+        CommissionService.invalidateCache();
+    });
+
+    describe('getCommissionWallets', () => {
+        it('returns wallets from DB when all are set', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: 'btc-db-address' },
+                { key: 'commission_wallet_LTC', value: 'ltc-db-address' },
+                { key: 'commission_wallet_USDT', value: 'usdt-db-address' },
+                { key: 'commission_wallet_USDC', value: 'usdc-db-address' },
+                { key: 'commission_wallet_ETH', value: 'eth-db-address' }
+            ]);
+
+            const wallets = await CommissionService.getCommissionWallets();
+
+            expect(wallets).toEqual({
+                BTC: 'btc-db-address',
+                LTC: 'ltc-db-address',
+                USDT: 'usdt-db-address',
+                USDC: 'usdc-db-address',
+                ETH: 'eth-db-address'
+            });
+        });
+
+        it('falls back to env when DB value is empty string', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: '' },
+                { key: 'commission_wallet_LTC', value: 'ltc-db-address' },
+                { key: 'commission_wallet_USDT', value: '' },
+                { key: 'commission_wallet_USDC', value: 'usdc-db-address' },
+                { key: 'commission_wallet_ETH', value: '' }
+            ]);
+
+            const wallets = await CommissionService.getCommissionWallets();
+
+            expect(wallets.BTC).toBe('btc-env-address');
+            expect(wallets.LTC).toBe('ltc-db-address');
+            expect(wallets.USDT).toBe('usdt-env-address');
+            expect(wallets.USDC).toBe('usdc-db-address');
+            expect(wallets.ETH).toBe('eth-env-address');
+        });
+
+        it('falls back to env when DB key is missing', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: 'btc-db-address' }
+            ]);
+
+            const wallets = await CommissionService.getCommissionWallets();
+
+            expect(wallets.BTC).toBe('btc-db-address');
+            expect(wallets.LTC).toBe('ltc-env-address');
+            expect(wallets.USDT).toBe('usdt-env-address');
+            expect(wallets.USDC).toBe('usdc-env-address');
+            expect(wallets.ETH).toBe('eth-env-address');
+        });
+
+        it('caches result: second call does not hit DB', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: 'btc-db-address' },
+                { key: 'commission_wallet_LTC', value: 'ltc-db-address' },
+                { key: 'commission_wallet_USDT', value: 'usdt-db-address' },
+                { key: 'commission_wallet_USDC', value: 'usdc-db-address' },
+                { key: 'commission_wallet_ETH', value: 'eth-db-address' }
+            ]);
+
+            await CommissionService.getCommissionWallets();
+            const callCount = dbCalls.allAsync.length;
+
+            await CommissionService.getCommissionWallets();
+            expect(dbCalls.allAsync.length).toBe(callCount);
+        });
+    });
+
+    describe('getShopActivated', () => {
+        it('returns false when DB has "false"', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.getAsync.mockResolvedValueOnce({ key: 'shop_activated', value: 'false' });
+
+            const result = await CommissionService.getShopActivated();
+            expect(result).toBe(false);
+        });
+
+        it('returns true when DB has "true"', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.getAsync.mockResolvedValueOnce({ key: 'shop_activated', value: 'true' });
+
+            const result = await CommissionService.getShopActivated();
+            expect(result).toBe(true);
+        });
+
+        it('returns false when DB key missing and env SHOP_ACTIVATED is "false"', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.getAsync.mockResolvedValueOnce(undefined);
+
+            const original = process.env.SHOP_ACTIVATED;
+            process.env.SHOP_ACTIVATED = 'false';
+            try {
+                const result = await CommissionService.getShopActivated();
+                expect(result).toBe(false);
+            } finally {
+                process.env.SHOP_ACTIVATED = original;
+            }
+        });
+
+        it('returns true when DB key missing and env SHOP_ACTIVATED is not set', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.getAsync.mockResolvedValueOnce(undefined);
+
+            const original = process.env.SHOP_ACTIVATED;
+            delete process.env.SHOP_ACTIVATED;
+            try {
+                const result = await CommissionService.getShopActivated();
+                expect(result).toBe(true);
+            } finally {
+                if (original !== undefined) {
+                    process.env.SHOP_ACTIVATED = original;
+                }
+            }
+        });
+
+        it('caches result: second call does not hit DB', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.getAsync.mockResolvedValueOnce({ key: 'shop_activated', value: 'true' });
+
+            await CommissionService.getShopActivated();
+            const callCount = dbCalls.getAsync.length;
+
+            await CommissionService.getShopActivated();
+            expect(dbCalls.getAsync.length).toBe(callCount);
+        });
+    });
+
+    describe('invalidateCache', () => {
+        it('forces re-fetch after invalidation', async () => {
+            const { default: dbMock } = await import('../config/database.js');
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: 'btc-db-address' },
+                { key: 'commission_wallet_LTC', value: 'ltc-db-address' },
+                { key: 'commission_wallet_USDT', value: 'usdt-db-address' },
+                { key: 'commission_wallet_USDC', value: 'usdc-db-address' },
+                { key: 'commission_wallet_ETH', value: 'eth-db-address' }
+            ]);
+            dbMock.allAsync.mockResolvedValueOnce([
+                { key: 'commission_wallet_BTC', value: 'btc-db-address-v2' },
+                { key: 'commission_wallet_LTC', value: 'ltc-db-address' },
+                { key: 'commission_wallet_USDT', value: 'usdt-db-address' },
+                { key: 'commission_wallet_USDC', value: 'usdc-db-address' },
+                { key: 'commission_wallet_ETH', value: 'eth-db-address' }
+            ]);
+
+            const first = await CommissionService.getCommissionWallets();
+            expect(first.BTC).toBe('btc-db-address');
+
+            CommissionService.invalidateCache();
+
+            const second = await CommissionService.getCommissionWallets();
+            expect(second.BTC).toBe('btc-db-address-v2');
+        });
+    });
+});

src/handlers/adminHandlers/adminWalletsHandler.js

@@ -14,20 +14,11 @@ import WalletUtils from '../../utils/walletUtils.js';
 import Validators from '../../utils/validators.js';
 import logger from '../../utils/logger.js';
 import { logAudit } from '../../services/auditService.js';
+import CommissionService from '../../services/commissionService.js';
 import fs from 'fs';
 import csvWriter from 'csv-writer';
 
 export default class AdminWalletsHandler {
-    static {
-        if (config.COMMISSION_ENABLED) {
-            const requiredWallets = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'];
-            const missingWallets = requiredWallets.filter(wallet => !config.COMMISSION_WALLETS[wallet]);
-
-            if (missingWallets.length > 0) {
-                logger.warn({ missingWallets }, `Commission enabled but wallet addresses missing for: ${missingWallets.join(', ')}. Commission features will be limited.`);
-            }
-        }
-    }
 
     // Метод для проверки, является ли пользователь администратором
     // (используется общая функция из middleware/auth.js)
@@ -218,7 +209,8 @@ export default class AdminWalletsHandler {
         try {
             logger.info({ walletType, requiredAmount: requiredAmount.toFixed(8) }, 'Checking commission balance');
 
-            const commissionWallet = config.COMMISSION_WALLETS[walletType];
+            const wallets = await CommissionService.getCommissionWallets();
+            const commissionWallet = wallets[walletType];
             if (!commissionWallet) {
                 throw new Error(`Commission wallet not configured for ${walletType}`);
             }
@@ -396,8 +388,9 @@ export default class AdminWalletsHandler {
                 logger.info({ walletType, commissionBalance: commissionCheck.balance.toFixed(8) }, 'Commission wallet balance');
 
                 if (commissionCheck.difference < 0) {
+                    const commissionWallets = await CommissionService.getCommissionWallets();
                     const message = `⚠️ Insufficient balance in commission wallet!\n` +
-                        `Wallet: ${config.COMMISSION_WALLETS[walletType]}\n` +
+                        `Wallet: ${commissionWallets[walletType]}\n` +
                         `Required: ${commissionAmount.toFixed(8)} ${walletType}\n` +
                         `Current balance: ${commissionCheck.balance.toFixed(8)} ${walletType}\n` +
                         `Difference: ${Math.abs(commissionCheck.difference).toFixed(8)} ${walletType}`;
@@ -534,8 +527,9 @@ export default class AdminWalletsHandler {
             logger.info({ walletType, commissionBalance: commissionCheck.balance.toFixed(8) }, 'Commission wallet balance');
 
             if (commissionCheck.difference < 0) {
+                const commissionWallets = await CommissionService.getCommissionWallets();
                 const message = `⚠️ Insufficient balance in commission wallet!\n` +
-                    `Wallet: ${config.COMMISSION_WALLETS[walletType]}\n` +
+                    `Wallet: ${commissionWallets[walletType]}\n` +
                     `Required: ${commissionAmount.toFixed(8)} ${walletType}\n` +
                     `Current balance: ${commissionCheck.balance.toFixed(8)} ${walletType}\n` +
                     `Difference: ${Math.abs(commissionCheck.difference).toFixed(8)} ${walletType}`;

src/handlers/userHandlers/userHandler.js

@@ -8,6 +8,7 @@ import logger from "../../utils/logger.js";
 import { resetUserContext } from "../../utils/messageUtils.js";
 import userStates from "../../context/userStates.js";
 import chatbotService from "../../services/chatbotService.js";
+import CommissionService from "../../services/commissionService.js";
 import leadService from "../../services/leadService.js";
 import { tForUser, LANGUAGE_NAMES, AVAILABLE_LANGUAGES } from '../../i18n/index.js';
 
@@ -19,6 +20,11 @@ export default class UserHandler {
         const lang = user?.language || 'en';
         const t = tForUser(lang);
 
+        if (!(await CommissionService.getShopActivated())) {
+            await bot.sendMessage(telegramId, '⛔ Shop is not activated yet. Please contact support.');
+            return false;
+        }
+
         const keyboard = {
             inline_keyboard: [
                 [{text: t('bot.contact_support'), url: config.SUPPORT_LINK}]

src/migrations/015_shop_activation.js

@@ -0,0 +1,36 @@
+import logger from '../utils/logger.js';
+
+// Migration 015: shop activation flag + commission wallet addresses in site_settings
+export default async function migration015(db) {
+    await db.runAsync('BEGIN TRANSACTION');
+    try {
+        // Индекс на key — site_settings читается ботом на каждое сообщение (shop_activated, commission_wallet_*)
+        await db.runAsync(
+            'CREATE INDEX IF NOT EXISTS idx_site_settings_key ON site_settings(key)'
+        );
+
+        // Shop activation flag: default true unless SHOP_ACTIVATED='false'
+        const shopActivated = process.env.SHOP_ACTIVATED === 'false' ? 'false' : 'true';
+        await db.runAsync(
+            "INSERT OR IGNORE INTO site_settings (key, value) VALUES ('shop_activated', ?)",
+            [shopActivated]
+        );
+
+        // Commission wallet addresses: seed from env if set, otherwise empty string
+        const walletTypes = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'];
+        for (const type of walletTypes) {
+            const envKey = `COMMISSION_WALLET_${type}`;
+            const value = process.env[envKey] || '';
+            await db.runAsync(
+                "INSERT OR IGNORE INTO site_settings (key, value) VALUES (?, ?)",
+                [`commission_wallet_${type}`, value]
+            );
+        }
+
+        await db.runAsync('COMMIT');
+        logger.info('Migration 015: shop_activation and commission_wallet_* seeded into site_settings');
+    } catch (e) {
+        await db.runAsync('ROLLBACK');
+        throw e;
+    }
+}

src/migrations/runner.js

@@ -49,6 +49,7 @@ export async function runMigrations() {
     (await import('./012_fix_typos.js')).default,
     (await import('./013_ai_features.js')).default,
     (await import('./014_user_notes.js')).default,
+    (await import('./015_shop_activation.js')).default,
   ];
 
   for (let i = currentVersion; i < migrations.length; i++) {

src/services/commissionService.js

@@ -0,0 +1,102 @@
+import db from '../config/database.js';
+import config from '../config/config.js';
+import logger from '../utils/logger.js';
+
+const CACHE_TTL_MS = 30 * 1000; // 30 sec
+
+let commissionCache = null;
+let commissionCachedAt = 0;
+
+let shopActivatedCache = null;
+let shopActivatedCachedAt = 0;
+
+const WALLET_TYPES = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'];
+
+function isCacheValid(cachedAt) {
+    return Date.now() - cachedAt < CACHE_TTL_MS;
+}
+
+/**
+ * Get commission wallet addresses from site_settings with env fallback.
+ * @returns {Promise<{BTC: string, LTC: string, USDT: string, USDC: string, ETH: string}>}
+ */
+export async function getCommissionWallets() {
+    const now = Date.now();
+    if (commissionCache && isCacheValid(commissionCachedAt)) {
+        return commissionCache;
+    }
+
+    try {
+        const rows = await db.allAsync(
+            `SELECT key, value FROM site_settings WHERE key IN (${WALLET_TYPES.map(() => '?').join(',')})`,
+            WALLET_TYPES.map(t => `commission_wallet_${t}`)
+        );
+
+        const dbValues = {};
+        for (const row of rows) {
+            const type = row.key.replace('commission_wallet_', '');
+            dbValues[type] = row.value;
+        }
+
+        const wallets = {};
+        for (const type of WALLET_TYPES) {
+            const dbVal = dbValues[type];
+            wallets[type] = (dbVal && dbVal !== '') ? dbVal : (config.COMMISSION_WALLETS[type] || '');
+        }
+
+        commissionCache = wallets;
+        commissionCachedAt = now;
+        return wallets;
+    } catch (err) {
+        logger.error({ err }, 'Failed to load commission wallets from site_settings');
+        return { ...config.COMMISSION_WALLETS };
+    }
+}
+
+/**
+ * Check if the shop is activated.
+ * Reads site_settings.shop_activated; falls back to env SHOP_ACTIVATED !== 'false' (default true).
+ * @returns {Promise<boolean>}
+ */
+export async function getShopActivated() {
+    const now = Date.now();
+    if (shopActivatedCache !== null && isCacheValid(shopActivatedCachedAt)) {
+        return shopActivatedCache;
+    }
+
+    try {
+        const row = await db.getAsync(
+            "SELECT value FROM site_settings WHERE key = 'shop_activated'"
+        );
+
+        let activated;
+        if (row) {
+            activated = row.value !== 'false';
+        } else {
+            activated = process.env.SHOP_ACTIVATED !== 'false';
+        }
+
+        shopActivatedCache = activated;
+        shopActivatedCachedAt = now;
+        return activated;
+    } catch (err) {
+        logger.error({ err }, 'Failed to read shop_activated from site_settings');
+        return process.env.SHOP_ACTIVATED !== 'false';
+    }
+}
+
+/**
+ * Invalidate all caches (useful after settings update).
+ */
+export function invalidateCache() {
+    commissionCache = null;
+    commissionCachedAt = 0;
+    shopActivatedCache = null;
+    shopActivatedCachedAt = 0;
+}
+
+export default {
+    getCommissionWallets,
+    getShopActivated,
+    invalidateCache,
+};