@blamejs/blamejs-shop 0.3.67 → 0.3.69

package/lib/storefront.js

@@ -2083,6 +2083,55 @@ function _pdpShippingNote(availability) {
          "See our <a href=\"/terms\">shipping &amp; returns policy</a>.</p>";
 }
 
+// "Get it by <date>" delivery-estimate line for the PDP + cart. Renders the
+// SHARED markup the dual-render parity gate pins — kept byte-for-byte in sync
+// with worker/render/product.js#_buildDeliveryEstimate (and the cart twin) so
+// the PDP/cart land identical across substrates.
+//
+// THE DESIGN RULE: the edge ALWAYS passes estimate=null. The arrival date is
+// destination-specific (it's derived from the signed-in customer's shipping
+// address) and edge pages are shared-cacheable across anonymous visitors, so
+// baking a date would serve one visitor's ZIP date to everyone — and a
+// computed date also goes stale in the cache. So estimate=null renders EMPTY
+// (the builder returns ""), keeping the edge output byte-stable; the real date
+// renders container-only when the route resolves a per-customer estimate.
+//
+// `estimate` (when present) is the resolved display shape the route builds:
+//   { deliver_by, latest_by?, service_label }
+// where deliver_by / latest_by are YYYY-MM-DD strings (origin-timezone) and
+// service_label is the carrier service the date is for. The date is formatted
+// here with a self-contained deterministic formatter (no toLocaleDateString —
+// its output is locale/runtime-dependent and would break the byte-parity gate)
+// so the same YYYY-MM-DD always yields the same "Thu, Jun 12" wherever it runs.
+function _formatDeliveryDate(ymd) {
+  // ymd is YYYY-MM-DD; format as "Thu, Jun 12" deterministically. Date.UTC
+  // gives a runtime-stable weekday (Sun=0..Sat=6) with no timezone drift.
+  var DOW = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+  var MON = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+  var y = Number(ymd.slice(0, 4));
+  var m = Number(ymd.slice(5, 7));
+  var d = Number(ymd.slice(8, 10));
+  var wd = new Date(Date.UTC(y, m - 1, d)).getUTCDay();
+  return DOW[wd] + ", " + MON[m - 1] + " " + d;
+}
+function _buildDeliveryEstimate(estimate, esc) {
+  if (!estimate || typeof estimate !== "object" || !estimate.deliver_by) return "";
+  var by = _formatDeliveryDate(estimate.deliver_by);
+  // A range when the slowest service lands later than the fastest — "by Thu,
+  // Jun 12" becomes "Tue, Jun 10 – Thu, Jun 12" so the shopper sees the window,
+  // not just the optimistic edge.
+  var dateText = (estimate.latest_by && estimate.latest_by !== estimate.deliver_by)
+    ? _formatDeliveryDate(estimate.deliver_by) + " – " + _formatDeliveryDate(estimate.latest_by)
+    : "by " + by;
+  var svc = estimate.service_label
+    ? " <span class=\"delivery-est__svc\">via " + esc(estimate.service_label) + "</span>"
+    : "";
+  return "<p class=\"delivery-est\" role=\"status\">" +
+           "<span class=\"delivery-est__icon\" aria-hidden=\"true\">🚚</span> " +
+           "<span class=\"delivery-est__label\">Get it " + esc(dateText) + "</span>" + svc +
+         "</p>";
+}
+
 // Pre-order CTA — replaces the add-to-cart buy box on a PDP whose lead SKU
 // has an OPEN pre-order campaign (a SKU that isn't released yet, so it's not
 // normally purchasable). `preorder` is the resolved shape the route loads:
@@ -2271,6 +2320,7 @@ var PRODUCT_PAGE =
   "      RAW_AVAILABILITY_PLACEHOLDER\n" +
   "      RAW_BUYBOX_PLACEHOLDER\n" +
   "      RAW_SHIPPING_NOTE_PLACEHOLDER\n" +
+  "      RAW_DELIVERYESTIMATE_PLACEHOLDER\n" +
   "      RAW_QTYBREAK_PLACEHOLDER\n" +
   "      RAW_WISHLIST_PLACEHOLDER\n" +
   "      RAW_COMPARE_PLACEHOLDER\n" +
@@ -6229,6 +6279,13 @@ function renderProduct(opts) {
   buyboxHtml = _buildPreorderNotice(opts.preorder_notice) + buyboxHtml;
   var availabilityHtml = _buildAvailability(availability);
   var shippingNoteHtml = _pdpShippingNote(availability);
+  // "Get it by <date>" — container-only (the route resolves a per-customer
+  // estimate; the edge passes no `delivery_estimate`, so this renders empty
+  // and the edge PDP stays byte-stable). Suppressed on a digital-only product
+  // (nothing ships) and on a pre-order CTA (the release date is the headline).
+  var deliveryEstimateHtml = (availability.requires_shipping && !preorderShape)
+    ? _buildDeliveryEstimate(opts.delivery_estimate, b.template.escapeHtml)
+    : "";
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
   var qaHtml = _buildProductQa(opts.qa_questions, opts.qa_cta);
@@ -6244,6 +6301,7 @@ function renderProduct(opts) {
     .replace("RAW_AVAILABILITY_PLACEHOLDER", availabilityHtml)
     .replace("RAW_BUYBOX_PLACEHOLDER", buyboxHtml)
     .replace("RAW_SHIPPING_NOTE_PLACEHOLDER", shippingNoteHtml)
+    .replace("RAW_DELIVERYESTIMATE_PLACEHOLDER", deliveryEstimateHtml)
     .replace("RAW_QTYBREAK_PLACEHOLDER", qtyBreaksHtml)
     .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
     .replace("RAW_COMPARE_PLACEHOLDER", compareHtml)
@@ -7128,11 +7186,51 @@ function _orderTimelineBlock(status) {
     "<ol class=\"order-timeline__steps\">" + steps + "</ol></div>";
 }
 
+// Cap on how many carrier events the per-shipment timeline renders. A
+// long-haul international parcel can accumulate dozens of scans; the
+// customer-facing panel shows the most recent MAX_SHIPMENT_TIMELINE
+// (newest-first) so the page stays bounded regardless of stream length.
+// getShipment hydrates the FULL event list (it has no LIMIT of its own),
+// so the bound is applied here at the render sink.
+var MAX_SHIPMENT_TIMELINE = 20;
+
+// Render one shipment's carrier-event timeline, newest-first. Events
+// arrive oldest-first from getShipment (occurred_at ASC, recorded_at ASC),
+// so the list is reversed, then capped at MAX_SHIPMENT_TIMELINE. Each row
+// shows the status, an optional carrier location, an optional operator-
+// recorded detail note, and the event time. status / location / detail are
+// carrier- or operator-supplied free text → escaped at the sink. Returns ""
+// for a shipment with no events so the panel falls back to the carrier line
+// alone (exactly what the pre-timeline block rendered).
+function _shipmentTimeline(events) {
+  if (!Array.isArray(events) || !events.length) return "";
+  var esc = b.template.escapeHtml;
+  // Newest-first: copy + reverse (never mutate the hydrated row's array),
+  // then bound the render.
+  var ordered = events.slice().reverse().slice(0, MAX_SHIPMENT_TIMELINE);
+  var rows = ordered.map(function (ev) {
+    var when = ev && ev.occurred_at != null
+      ? new Date(Number(ev.occurred_at)).toISOString().slice(0, 16).replace("T", " ")
+      : "";
+    var loc    = ev && ev.location ? String(ev.location) : "";
+    var detail = ev && ev.detail   ? String(ev.detail)   : "";
+    return "<li class=\"order-shipment__event\">" +
+      "<span class=\"order-shipment__event-status\">" + esc(String(ev && ev.status)) + "</span>" +
+      (loc    ? " <span class=\"order-shipment__event-loc\">" + esc(loc) + "</span>" : "") +
+      (detail ? " <span class=\"order-shipment__event-detail\">" + esc(detail) + "</span>" : "") +
+      (when ? " <time class=\"order-shipment__event-when\" datetime=\"" + esc(when) + "\">" + esc(when) + "</time>" : "") +
+      "</li>";
+  }).join("");
+  return "<ol class=\"order-shipment__timeline\">" + rows + "</ol>";
+}
+
 // Render the shipment + carrier-tracking panel from order-tracking's
 // listForOrder() rows. Each shipment shows its carrier, status, the
 // tracking number (linked to the carrier's public tracking URL when one
-// is known), and the most-recent carrier event. Empty/absent shipments
-// render nothing so a digital or not-yet-shipped order shows no panel.
+// is known), and the FULL carrier-event timeline newest-first (bounded by
+// MAX_SHIPMENT_TIMELINE). Empty/absent shipments render nothing so a digital
+// or not-yet-shipped order shows no panel; a shipment with no events yet
+// shows just the carrier + status line (the pre-timeline shape).
 function _orderTrackingBlock(shipments) {
   if (!Array.isArray(shipments) || !shipments.length) return "";
   var esc = b.template.escapeHtml;
@@ -7147,24 +7245,20 @@ function _orderTrackingBlock(shipments) {
             "\" rel=\"noopener nofollow\" target=\"_blank\">" + esc(String(s.tracking_number)) + " ↗</a>"
         : "<span class=\"order-shipment__track\">" + esc(String(s.tracking_number)) + "</span>";
     }
-    // Latest carrier event (events arrive oldest-first from listForOrder's
-    // getShipment ordering; the panel's per-shipment events array, when
-    // hydrated, is the same order — take the last).
+    // Full carrier-event timeline (newest-first, bounded). getShipment
+    // hydrates the per-shipment events array oldest-first; the timeline
+    // builder reverses + caps it. An eventless shipment renders no timeline,
+    // so the card is the carrier + status line alone — identical to the
+    // block before the timeline shipped.
     var events = Array.isArray(s.events) ? s.events : [];
-    var latest = events.length ? events[events.length - 1] : null;
-    var latestHtml = latest
-      ? "<p class=\"order-shipment__event\">" +
-          esc(String(latest.status)) +
-          (latest.location ? " &middot; " + esc(String(latest.location)) : "") +
-        "</p>"
-      : "";
+    var timelineHtml = _shipmentTimeline(events);
     return "<li class=\"order-shipment\">" +
       "<div class=\"order-shipment__head\">" +
         "<span class=\"order-shipment__carrier\">" + esc(String(carrier)) + "</span>" +
         "<span class=\"pdp__badge\">" + esc(String(s.status)) + "</span>" +
       "</div>" +
       (trackingHtml ? "<p class=\"order-shipment__tracking\">Tracking: " + trackingHtml + "</p>" : "") +
-      latestHtml +
+      timelineHtml +
       "</li>";
   }).join("");
   return "<div class=\"order-tracking-panel\">" +
@@ -7567,6 +7661,7 @@ var CART_PAGE =
   "      <dl class=\"totals-list\">\n" +
   "RAW_TOTALS_ROWS" +
   "      </dl>\n" +
+  "RAW_CART_DELIVERYESTIMATE_PLACEHOLDER" +
   "RAW_CHECKOUT_CTA" +
   "    </aside>\n" +
   "  </div>\n" +
@@ -7724,6 +7819,62 @@ function _cartGiftBlock(opts) {
     "</section>";
 }
 
+// The cart-page coupon-code entry (CONTAINER-ONLY — like the gift block, it
+// is only reached for a cart WITH lines, which the edge never renders; the
+// edge cart is the cookie-less empty shell, see [[storefront-dual-render]]).
+// The form posts to /cart/coupon, which is NOT an EDGE_POST_PATHS prefix, so
+// _injectCsrfFields tokens it automatically — same posture as /cart/gift
+// (the closest sibling). It offers a single code input + Apply, lists each
+// already-applied code with a Remove control, and shows an inline PRG notice
+// (applied / removed / uniform error). The code echo is operator/shopper
+// free text → escaped at the sink. Returns "" when the coupon surface isn't
+// wired (no discount engine), so a store without discounts shows nothing.
+function _cartCouponBlock(opts) {
+  if (!opts.coupon_enabled) return "";
+  var esc = b.template.escapeHtml;
+  var applied = Array.isArray(opts.applied_codes) ? opts.applied_codes : [];
+  // Inline PRG notice — applied / removed succeed with a confirmation; an
+  // error is the uniform "couldn't apply" (no oracle on why).
+  var notice = "";
+  if (opts.code_applied) {
+    notice = "<p class=\"cart-coupon__notice cart-coupon__notice--ok\" role=\"status\">Discount code applied.</p>";
+  } else if (opts.code_removed) {
+    notice = "<p class=\"cart-coupon__notice cart-coupon__notice--ok\" role=\"status\">Discount code removed.</p>";
+  } else if (opts.code_err) {
+    notice = "<p class=\"cart-coupon__notice cart-coupon__notice--err\" role=\"status\">That code can't be applied to this cart.</p>";
+  }
+  // Already-applied codes, each with a Remove form (the code rides in a
+  // hidden field; the value is escaped). Shopper-typed free text → esc().
+  var appliedHtml = "";
+  if (applied.length) {
+    var items = applied.map(function (r) {
+      var codeStr = String(r.code);
+      return "<li class=\"cart-coupon__applied-item\">" +
+        "<code class=\"cart-coupon__code\">" + esc(codeStr) + "</code>" +
+        "<form method=\"post\" action=\"/cart/coupon/remove\" class=\"cart-coupon__remove\">" +
+          "<input type=\"hidden\" name=\"code\" value=\"" + esc(codeStr) + "\">" +
+          "<button type=\"submit\" class=\"cart-line__btn\">Remove</button>" +
+        "</form>" +
+      "</li>";
+    }).join("");
+    appliedHtml = "<ul class=\"cart-coupon__applied\">" + items + "</ul>";
+  }
+  return "<section class=\"cart-coupon\">" +
+    "<details class=\"cart-coupon__details\"" + (applied.length || opts.code_err ? " open" : "") + ">" +
+      "<summary class=\"cart-coupon__summary\">Have a discount code?</summary>" +
+      notice +
+      appliedHtml +
+      "<form method=\"post\" action=\"/cart/coupon\" class=\"cart-coupon__form\">" +
+        "<label class=\"form-field\"><span>Discount code</span>" +
+          "<input type=\"text\" name=\"code\" autocomplete=\"off\" autocapitalize=\"characters\" " +
+            "spellcheck=\"false\" maxlength=\"64\" placeholder=\"Enter code\">" +
+        "</label>" +
+        "<button type=\"submit\" class=\"btn-secondary\">Apply code</button>" +
+      "</form>" +
+    "</details>" +
+    "</section>";
+}
+
 function renderCart(opts) {
   if (!opts) throw new TypeError("storefront.renderCart: opts required");
   var lines  = opts.lines  || [];
@@ -7850,10 +8001,20 @@ function renderCart(opts) {
         "        <div><dt>Subtotal</dt><dd>" + subtotal + "</dd></div>\n" +
         "        <div class=\"totals-list__grand\"><dt>Total</dt><dd>" + total + "</dd></div>\n";
     }
+    // "Get it by <date>" for the whole cart — the slowest line's window, so
+    // the shopper sees when EVERYTHING arrives, not the optimistic item. The
+    // SAME shared builder the PDP uses (byte-identical across the dual render),
+    // spliced into the summary aside. Container-only: the route resolves a
+    // per-customer estimate (signed-in + saved address); absent that, or on
+    // any primitive failure, opts.delivery_estimate is null and this renders
+    // empty. Indented to match the aside's two-space block.
+    var cartEstimateHtml = _buildDeliveryEstimate(opts.delivery_estimate, b.template.escapeHtml);
+    cartEstimateHtml = cartEstimateHtml ? "      " + cartEstimateHtml + "\n" : "";
     body = _render(CART_PAGE, {
       line_rows: "RAW_LINES",
     }).replace("RAW_LINES", rows)
       .replace("RAW_TOTALS_ROWS", totalsRows)
+      .replace("RAW_CART_DELIVERYESTIMATE_PLACEHOLDER", cartEstimateHtml)
       .replace("RAW_CHECKOUT_CTA", checkoutCta)
       .replace("RAW_CART_NOTICE", notice);
     // CONTAINER-ONLY gift wrap disclosure, appended after the cart grid (a
@@ -7863,6 +8024,11 @@ function renderCart(opts) {
     // free text already escaped; appending — not String.replace — so a `$`
     // in a wrap title can't trip dollar substitution).
     body = body + _cartGiftBlock(opts);
+    // CONTAINER-ONLY coupon-code entry, same placement + edge-safety
+    // reasoning as the gift block (reached only for a cart with lines; the
+    // code echo is escaped at the sink; appended, not String.replace'd, so a
+    // `$` in a typed code can't trip dollar substitution).
+    body = body + _cartCouponBlock(opts);
   }
   return _wrap(Object.assign({
     title:      "Cart",
@@ -11107,6 +11273,80 @@ function mount(router, deps) {
     return { ship_to: { country: "US" }, from_saved: false };
   }
 
+  // Resolve the "Get it by <date>" delivery estimate for the PDP / cart. This
+  // is a DROP-SILENT defensive reader (the storefront read tier): it returns
+  // null on ANYTHING short of a clean, dated estimate — no deliveryEstimate
+  // dep, no signed-in customer, no saved shipping address with a postal code,
+  // an unconfigured origin/cutoff (the primitive THROWS a config-state
+  // TypeError there), or a no-match `{ ok:false }`. The route renders no
+  // estimate in every one of those cases, never a 500.
+  //
+  // WHY signed-in + saved-address only: the arrival date is destination-
+  // specific. The edge serves a shared cache across anonymous visitors and
+  // must never bake a per-visitor date, so the date is a container-only
+  // enhancement for a customer whose destination we already know (their
+  // default shipping address). v1 ships no anonymous ZIP-entry widget — that's
+  // a separate slice; an anonymous shopper simply sees no date.
+  //
+  // `originLocation` comes from operator config (`shop.estimate_origin`); the
+  // primitive REFUSES to guess an origin (no defaultLocation resolver is
+  // wired), so without that config row no estimate renders — by design.
+  // `weightGrams` (optional) lets the primitive's weight-aware rows apply.
+  //
+  // Returns the display shape the dual-render builder consumes:
+  //   { deliver_by, latest_by, service_label }
+  // or null.
+  async function _resolveDeliveryEstimate(req, opts) {
+    opts = opts || {};
+    if (!deps.deliveryEstimate) return null;
+    try {
+      // Per-customer destination: only a SIGNED-IN customer with a saved
+      // shipping address that carries a postal code yields a date. _normalize
+      // (inside _estimateDestination) drops a garbage postal, so a saved
+      // address with no usable postal falls through to null here.
+      var coAuth = _currentCustomerEnv(req);
+      if (!coAuth) return null;
+      var dest = await _estimateDestination(req);
+      if (!dest || !dest.from_saved || !dest.ship_to || !dest.ship_to.postal) return null;
+      // Operator-configured origin — the primitive won't guess one. Resolved
+      // at boot into `deps.delivery_estimate_origin` (a plain slug string) from
+      // SHOP_ESTIMATE_ORIGIN / the config primitive, since the storefront's
+      // sfDeps.config is a bare { shop_name } stub with no live .get(). Falls
+      // back to a per-request config read if a future caller wires a real
+      // config handle. Absent any origin, no date renders — by design.
+      var origin = (typeof deps.delivery_estimate_origin === "string" && deps.delivery_estimate_origin)
+        ? deps.delivery_estimate_origin
+        : null;
+      if (!origin && deps.config && typeof deps.config.get === "function") {
+        try { origin = await deps.config.get("shop.estimate_origin", null); }
+        catch (_e) { origin = null; }
+      }
+      if (typeof origin !== "string" || !origin) return null;
+      var est = await deps.deliveryEstimate.estimate({
+        origin_location:     origin,
+        destination_postal:  dest.ship_to.postal,
+        destination_country: dest.ship_to.country,
+        destination_region:  dest.ship_to.state ? dest.ship_to.state.toLowerCase() : undefined,
+        weight_grams:        Number.isInteger(opts.weight_grams) ? opts.weight_grams : undefined,
+      });
+      if (!est || !est.ok || !est.est_min_delivery_date) return null;
+      // The fastest service is the headline date (service_levels are sorted
+      // ascending by transit_days inside the primitive); the slowest gives the
+      // range upper bound so the line reads as a window, not a promise.
+      var fastest = est.service_levels && est.service_levels.length ? est.service_levels[0] : null;
+      return {
+        deliver_by:    est.est_min_delivery_date,
+        latest_by:     est.est_max_delivery_date || est.est_min_delivery_date,
+        service_label: fastest ? fastest.label : null,
+      };
+    } catch (_e) {
+      // Drop-silent — every config-state / validation throw the primitive
+      // raises (no cutoff row, origin_location required, a malformed saved
+      // postal) collapses to "no estimate", never a broken page.
+      return null;
+    }
+  }
+
   // Compute the cart/checkout totals the shopper sees BEFORE paying.
   // Composes the SAME tax + shipping primitives the charge runs through
   // (via checkout.quote, which prices tax against the pre-discount
@@ -11131,6 +11371,18 @@ function mount(router, deps) {
   // subtotal-only breakdown with tax/shipping flagged unresolved — the
   // subtotal is always honest, and the renderer labels the rest
   // "calculated at checkout" rather than fabricating a number.
+  // The discount codes a cart carries, as plain strings, for threading into
+  // checkout.confirm / checkout.quote. Drop-silent: an unmigrated
+  // cart_discount_codes table / un-wired method → [] (no codes, no
+  // code-gated discount), never a throw on the buy path.
+  async function _cartAppliedCodeStrings(cartId) {
+    if (typeof deps.cart.listDiscountCodes !== "function") return [];
+    try {
+      var rows = await deps.cart.listDiscountCodes(cartId);
+      return rows.map(function (r) { return r.code; });
+    } catch (_e) { return []; }
+  }
+
   async function _estimateCartTotals(req, c, lines, opts) {
     opts = opts || {};
     var base = pricing.totals(c, lines, {});   // subtotal-only, always valid
@@ -11156,6 +11408,10 @@ function mount(router, deps) {
       var quote = await deps.checkout.quote({
         cart_id:  c.id,
         ship_to:  dest.ship_to,
+        // Shopper-applied coupon codes so the estimate reflects a code-
+        // gated discount (the same codes checkout.confirm honours). Absent
+        // / empty → only pure-automatic rules, byte-identical to before.
+        codes:    Array.isArray(opts.codes) && opts.codes.length ? opts.codes : undefined,
       });
       var taxMinor = quote.totals.tax_minor;
       result.tax_resolved = quote.tax_rate_bps > 0 ||
@@ -11593,10 +11849,17 @@ function mount(router, deps) {
     // to a banner; only meaningful when a campaign is present.
     var pdpUrl = req.url ? new URL(req.url, "http://localhost") : null;
     var preorderNotice = pdpUrl ? pdpUrl.searchParams.get("preorder") : null;
+    // "Get it by <date>" — container-only, per-customer (see
+    // _resolveDeliveryEstimate). Weighted by the lead variant so the
+    // primitive's weight-aware transit rows apply. Drop-silent → null.
+    var leadWeight = firstVariant && Number.isInteger(firstVariant.weight_grams)
+      ? firstVariant.weight_grams : undefined;
+    var deliveryEstimate = await _resolveDeliveryEstimate(req, { weight_grams: leadWeight });
     var html = renderProduct(Object.assign({
       product:        product,
       variants:       variants,
       prices:         prices,
+      delivery_estimate: deliveryEstimate,
       preorder_campaign: preorderCampaign,
       preorder_notice:   preorderNotice,
       media:          media,
@@ -11983,6 +12246,17 @@ function mount(router, deps) {
     var cartUrl = req.url ? new URL(req.url, "http://localhost") : null;
     var added = (req.query && req.query.added === "1") ||
       (cartUrl && cartUrl.searchParams.get("added") === "1") || false;
+    // Coupon-entry PRG outcomes (set by POST /cart/coupon[/remove]). One of
+    // applied / removed / err so the cart shows an inline notice. `?code_err`
+    // carries no detail beyond "couldn't apply" — a uniform message, no
+    // code-existence oracle.
+    function _cartQp(name) {
+      return (req.query && req.query[name] === "1") ||
+        (cartUrl && cartUrl.searchParams.get(name) === "1") || false;
+    }
+    var codeApplied = _cartQp("code_applied");
+    var codeRemoved = _cartQp("code_removed");
+    var codeErr     = _cartQp("code_err");
     if (!sid) {
       return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
@@ -12003,12 +12277,23 @@ function mount(router, deps) {
     // Recomputed every render (idempotent); the stored snapshot is never
     // mutated, so changing a line's quantity re-prices it automatically.
     var lines = await _repriceCartLines(rawLines);
+    // Applied coupon codes — the strings the shopper entered on the cart
+    // page, persisted on the cart. Threaded into the totals estimate so a
+    // code-gated discount shows in the breakdown, and echoed in the coupon
+    // block (with a remove control). Drop-silent: an unmigrated
+    // cart_discount_codes table → no applied codes, no coupon discount.
+    var appliedCodes = [];
+    if (typeof deps.cart.listDiscountCodes === "function") {
+      try { appliedCodes = await deps.cart.listDiscountCodes(c.id); }
+      catch (_e) { appliedCodes = []; }
+    }
+    var appliedCodeStrings = appliedCodes.map(function (r) { return r.code; });
     // Real total before pay: compose the same tax + shipping primitives the
     // charge runs through (estimated against the shopper's saved/default
     // destination until they confirm an address at checkout). Falls back to
     // a subtotal-only breakdown — with tax/shipping labelled "calculated at
     // checkout" — when checkout isn't wired or no zone matches.
-    var totalsDetail = await _estimateCartTotals(req, c, lines, {});
+    var totalsDetail = await _estimateCartTotals(req, c, lines, { codes: appliedCodeStrings });
     var totals = totalsDetail.totals;
     // Truthful per-line stock state (out / low / ok) so the cart never
     // implies a sold-out line is buyable.
@@ -12050,10 +12335,17 @@ function mount(router, deps) {
         }
       } catch (_e) { giftWraps = []; giftWrapInCart = null; }
     }
+    // "Get it by <date>" for the whole cart — container-only, per-customer
+    // (see _resolveDeliveryEstimate). No weight is summed across lines (the
+    // cart estimate is the destination window, not a per-parcel weight quote);
+    // the primitive falls back to its weight-agnostic transit rows. Drop-
+    // silent → null, and the summary renders no estimate.
+    var cartEstimate = await _resolveDeliveryEstimate(req, {});
     _send(res, 200, renderCart(Object.assign({
       lines:           lines,
       totals:          totals,
       totals_detail:   totalsDetail,
+      delivery_estimate: cartEstimate,
       line_stock:      lineStock,
       product_lookup:  productLookup,
       can_save:        !!(deps.saveForLater && deps.customers),
@@ -12061,6 +12353,15 @@ function mount(router, deps) {
       gift_wraps:      giftWraps,
       gift_wrap_in_cart: giftWrapInCart,
       added:           added,
+      // Coupon entry: surfaced only when the discount engine is wired (the
+      // POST routes mount on the same condition). `applied_codes` echoes the
+      // typed codes so each gets a remove control; the *_notice flags drive
+      // the inline PRG banner.
+      coupon_enabled:  !!(deps.autoDiscount && typeof deps.cart.listDiscountCodes === "function"),
+      applied_codes:   appliedCodes,
+      code_applied:    codeApplied,
+      code_removed:    codeRemoved,
+      code_err:        codeErr,
       shop_name:       shopName,
       theme:           theme,
     }, ccy)));
@@ -12433,12 +12734,16 @@ function mount(router, deps) {
         } else {
           defaultShipId = deps.default_shipping_id;
         }
+        var coCodes = await _cartAppliedCodeStrings(c.id);
         var result = await deps.checkout.confirm({
           cart_id:              c.id,
           ship_to:              shipTo,
           selected_shipping_id: defaultShipId || "std",
           customer:             { email: body.email, name: body.name },
           gift_card_code:       body.gift_card_code || undefined,
+          // Shopper-applied coupon codes — honoured at charge time so the
+          // order total matches the cart-page estimate.
+          codes:                coCodes.length ? coCodes : undefined,
           loyalty_redeem_points: _parseRedeemPoints(body.loyalty_redeem_points),
           idempotency_key:      "checkout:" + c.id + ":" + b.uuid.v7(),
         });
@@ -12583,12 +12888,14 @@ function mount(router, deps) {
         try {
           var defaultShipId = typeof deps.default_shipping_id === "function"
             ? await deps.default_shipping_id() : deps.default_shipping_id;
+          var ppCodes = await _cartAppliedCodeStrings(c.id);
           var created = await deps.checkout.createPaypalOrder({
             cart_id:              c.id,
             ship_to:              shipTo,
             selected_shipping_id: body.selected_shipping_id || defaultShipId || "std",
             customer:             { email: body.email, name: body.name },
             gift_card_code:       body.gift_card_code || undefined,
+            codes:                ppCodes.length ? ppCodes : undefined,
             idempotency_key:      "paypal:" + c.id + ":" + b.uuid.v7(),
             return_url:           body.return_url || undefined,
             cancel_url:           body.cancel_url || undefined,
@@ -17557,6 +17864,67 @@ function mount(router, deps) {
     });
   }
 
+  // POST /cart/coupon — apply a shopper-typed discount code to the cart.
+  // The code is validated server-side against the discount engine
+  // (autoDiscount.ruleForCode): it must resolve to an active, code-gated
+  // rule. An accepted code is persisted on the cart (cart.addDiscountCode)
+  // so the cart totals re-render with the rule's savings and
+  // checkout.confirm honours it. An unknown / malformed / un-applicable
+  // code bounces back with ?code_err=1 and a UNIFORM message — no oracle on
+  // whether the code exists. PRG: always a 303 to /cart. CSRF: /cart/coupon
+  // is NOT an EDGE_POST_PATHS prefix, so _injectCsrfFields tokens the form +
+  // the csrf gate checks it (same posture as /cart/gift). Mounts only when
+  // the discount engine is wired.
+  if (deps.autoDiscount && typeof deps.cart.addDiscountCode === "function") {
+    router.post("/cart/coupon", async function (req, res) {
+      var body = req.body || {};
+      var typed = typeof body.code === "string" ? body.code.trim() : "";
+      var dest = "/cart?code_err=1";
+      try {
+        var resolved = await _getOrCreateCart(req, res, "USD");
+        var cartId = resolved.cart.id;
+        // ruleForCode returns null for anything that isn't an active, code-
+        // gated rule (including a malformed code) — one uniform "no" answer.
+        var rule = typed ? await deps.autoDiscount.ruleForCode(typed) : null;
+        if (rule && rule.unlock_code) {
+          // Persist the code as the operator authored it (canonical casing),
+          // not as the shopper typed it, so the applied chip + the engine
+          // lookup agree.
+          await deps.cart.addDiscountCode(cartId, rule.unlock_code, rule.slug);
+          dest = "/cart?code_applied=1";
+        }
+      } catch (e) {
+        // A malformed code (TypeError from addDiscountCode's validator) or a
+        // bad cart shape is the same uniform error — never a 500 on the cart.
+        if (!(e instanceof TypeError)) throw e;
+        dest = "/cart?code_err=1";
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", dest);
+      return res.end ? res.end() : res.send("");
+    });
+
+    // POST /cart/coupon/remove — drop one applied code. Idempotent: removing
+    // a code that isn't on the cart still lands on the removed notice (no
+    // oracle). Same CSRF posture as /cart/coupon.
+    router.post("/cart/coupon/remove", async function (req, res) {
+      var body = req.body || {};
+      var typed = typeof body.code === "string" ? body.code.trim() : "";
+      var dest = "/cart?code_removed=1";
+      try {
+        var resolved = await _getOrCreateCart(req, res, "USD");
+        if (typed) await deps.cart.removeDiscountCode(resolved.cart.id, typed);
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        // A malformed code can't be on the cart anyway — treat as removed.
+        dest = "/cart?code_removed=1";
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", dest);
+      return res.end ? res.end() : res.send("");
+    });
+  }
+
   // POST /cart/bundle — add every member of a bundle to the cart at the
   // bundle price, atomically. Reads `bundle_sku` from the form body.
   // The price is recomputed server-side from the catalog + the bundle

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.67",
+  "version": "0.3.69",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {