@cimplify/sdk 0.103.0 → 0.104.0

package/dist/mock/cli.mjs

@@ -3040,6 +3040,8 @@ var ERROR_SUGGESTIONS = {
   CARD_DECLINED: "Card was declined. Ask shopper to retry or switch payment method.",
   INVALID_OTP: "Authorization code is invalid. Let shopper re-enter OTP/PIN and retry.",
   OTP_EXPIRED: "Authorization code expired. Request a new OTP and re-submit authorization.",
+  OTP_CHALLENGE_EXHAUSTED: "This verification challenge has no attempts left. Continue checkout without saved details or request a fresh challenge.",
+  OTP_CHALLENGE_CONSUMED: "This verification challenge has already been used. Continue with the established session or request a fresh challenge.",
   AUTHORIZATION_FAILED: "Additional payment authorization failed. Retry authorization or change payment method.",
   PAYMENT_ACTION_NOT_COMPLETED: "Required payment action was not completed. Resume provider flow and poll for status.",
   SLOT_UNAVAILABLE: "Selected schedule slot is unavailable. Refresh available slots and ask shopper to reselect.",
@@ -3452,6 +3454,36 @@ function buildV1(deps) {
     "/catalogue/quotes/:quote_id/refresh",
     (c) => tryRoute(c, () => deps.catalogue.refreshQuote(c.req.param("quote_id")))
   );
+  app.get("/reviews/summary", (c) => {
+    const productId = c.req.query("product_id");
+    if (productId !== void 0 && (productId.length === 0 || productId.trim() !== productId)) {
+      return fail(c, validation("product_id must be a non-empty canonical identifier"));
+    }
+    const response = {
+      data: {
+        ratings: {
+          product_id: productId ?? null,
+          review_count: 0,
+          rating_sum: 0,
+          average_rating: null,
+          distribution: { one: 0, two: 0, three: 0, four: 0, five: 0 }
+        },
+        trust_chips: {
+          on_time_delivery_percent: null,
+          delivery_sample_size: 0,
+          average_first_response_seconds: null,
+          support_sample_size: 0
+        }
+      }
+    };
+    return c.json(response);
+  });
+  app.get("/reviews", (c) => {
+    const response = {
+      data: { items: [], next_cursor: null }
+    };
+    return c.json(response);
+  });
   app.get("/cart", (c) => tryRoute(c, () => deps.cart.toUICart(deps.cart.get(c.var.session))));
   app.delete("/cart", (c) => tryRoute(c, () => deps.cart.clear(c.var.session)));
   app.get("/cart/items", (c) => tryRoute(c, () => deps.cart.getItems(c.var.session)));
@@ -4347,9 +4379,10 @@ function buildLink(deps) {
   app.post("/auth/request-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      deps.auth.requestOtp(body.contact ?? "");
+      const challenge = deps.auth.requestOtp(body.contact ?? "");
       return {
         success: true,
+        challenge_id: challenge.otp_id,
         message: `OTP sent to ${body.contact ?? "contact"}`,
         expires_in: 300,
         is_new_account: false
@@ -4359,7 +4392,11 @@ function buildLink(deps) {
   app.post("/auth/verify-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      const session = deps.auth.verifyOtp(body.contact ?? "", body.otp_code ?? "");
+      const session = deps.auth.verifyOtp(
+        body.contact ?? "",
+        body.otp_code ?? "",
+        body.challenge_id
+      );
       c.header("x-session-token", session.token);
       const customer = deps.link.ensureCustomer(session.customer_id ?? session.id, {
         email: body.contact?.includes("@") ? body.contact : void 0,
@@ -4453,10 +4490,7 @@ function buildLink(deps) {
       };
     });
   });
-  app.get(
-    "/preferences",
-    (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c)))
-  );
+  app.get("/preferences", (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c))));
   app.post("/preferences", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
@@ -4933,9 +4967,16 @@ function createAuthService(opts) {
         code_hint: options.mode === "permissive" ? code : void 0
       };
     },
-    verifyOtp(contact, code) {
-      const matching = registry.otps.list((o) => o.contact === contact);
-      const otp = matching[matching.length - 1];
+    verifyOtp(contact, code, challengeId) {
+      let otp = challengeId ? registry.otps.get(challengeId) : void 0;
+      if (!challengeId) {
+        const matching = registry.otps.list((o) => o.contact === contact);
+        otp = matching[matching.length - 1];
+      }
+      if (challengeId) {
+        if (!otp) throw new Error("No OTP challenge found");
+        if (otp.contact !== contact) throw new Error("OTP challenge does not match contact");
+      }
       if (options.mode === "strict") {
         if (!otp) throw new Error("No OTP requested");
         if (otp.code !== code && code !== options.defaultOtp) throw new Error("Invalid OTP");
@@ -6263,7 +6304,7 @@ function createCartService(opts) {
 
 // src/mock/domain/checkout.ts
 function createCheckoutService(opts) {
-  const { registry, clock, ids, bus} = opts;
+  const { registry, clock, ids, bus } = opts;
   return {
     process(session, body) {
       if (!body.cart_id) throw validation("cart_id required");
@@ -6750,6 +6791,7 @@ function createDeliveryService() {
             rate_id: "dlvrt_mock_standard",
             name: "Standard",
             fee: standardFree ? money(0) : money(15),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: standardFree,
             free_over_amount: money(200),
@@ -6763,6 +6805,7 @@ function createDeliveryService() {
             name: "Express",
             description: "Delivered within the hour",
             fee: money(25),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: false,
             eta_min_minutes: 30,

package/dist/mock/library.js

@@ -2102,6 +2102,8 @@ var ERROR_SUGGESTIONS = {
   CARD_DECLINED: "Card was declined. Ask shopper to retry or switch payment method.",
   INVALID_OTP: "Authorization code is invalid. Let shopper re-enter OTP/PIN and retry.",
   OTP_EXPIRED: "Authorization code expired. Request a new OTP and re-submit authorization.",
+  OTP_CHALLENGE_EXHAUSTED: "This verification challenge has no attempts left. Continue checkout without saved details or request a fresh challenge.",
+  OTP_CHALLENGE_CONSUMED: "This verification challenge has already been used. Continue with the established session or request a fresh challenge.",
   AUTHORIZATION_FAILED: "Additional payment authorization failed. Retry authorization or change payment method.",
   PAYMENT_ACTION_NOT_COMPLETED: "Required payment action was not completed. Resume provider flow and poll for status.",
   SLOT_UNAVAILABLE: "Selected schedule slot is unavailable. Refresh available slots and ask shopper to reselect.",
@@ -2514,6 +2516,36 @@ function buildV1(deps) {
     "/catalogue/quotes/:quote_id/refresh",
     (c) => tryRoute(c, () => deps.catalogue.refreshQuote(c.req.param("quote_id")))
   );
+  app.get("/reviews/summary", (c) => {
+    const productId = c.req.query("product_id");
+    if (productId !== void 0 && (productId.length === 0 || productId.trim() !== productId)) {
+      return fail(c, validation("product_id must be a non-empty canonical identifier"));
+    }
+    const response = {
+      data: {
+        ratings: {
+          product_id: productId ?? null,
+          review_count: 0,
+          rating_sum: 0,
+          average_rating: null,
+          distribution: { one: 0, two: 0, three: 0, four: 0, five: 0 }
+        },
+        trust_chips: {
+          on_time_delivery_percent: null,
+          delivery_sample_size: 0,
+          average_first_response_seconds: null,
+          support_sample_size: 0
+        }
+      }
+    };
+    return c.json(response);
+  });
+  app.get("/reviews", (c) => {
+    const response = {
+      data: { items: [], next_cursor: null }
+    };
+    return c.json(response);
+  });
   app.get("/cart", (c) => tryRoute(c, () => deps.cart.toUICart(deps.cart.get(c.var.session))));
   app.delete("/cart", (c) => tryRoute(c, () => deps.cart.clear(c.var.session)));
   app.get("/cart/items", (c) => tryRoute(c, () => deps.cart.getItems(c.var.session)));
@@ -3409,9 +3441,10 @@ function buildLink(deps) {
   app.post("/auth/request-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      deps.auth.requestOtp(body.contact ?? "");
+      const challenge = deps.auth.requestOtp(body.contact ?? "");
       return {
         success: true,
+        challenge_id: challenge.otp_id,
         message: `OTP sent to ${body.contact ?? "contact"}`,
         expires_in: 300,
         is_new_account: false
@@ -3421,7 +3454,11 @@ function buildLink(deps) {
   app.post("/auth/verify-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      const session = deps.auth.verifyOtp(body.contact ?? "", body.otp_code ?? "");
+      const session = deps.auth.verifyOtp(
+        body.contact ?? "",
+        body.otp_code ?? "",
+        body.challenge_id
+      );
       c.header("x-session-token", session.token);
       const customer = deps.link.ensureCustomer(session.customer_id ?? session.id, {
         email: body.contact?.includes("@") ? body.contact : void 0,
@@ -3515,10 +3552,7 @@ function buildLink(deps) {
       };
     });
   });
-  app.get(
-    "/preferences",
-    (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c)))
-  );
+  app.get("/preferences", (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c))));
   app.post("/preferences", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
@@ -3995,9 +4029,16 @@ function createAuthService(opts) {
         code_hint: options.mode === "permissive" ? code : void 0
       };
     },
-    verifyOtp(contact, code) {
-      const matching = registry.otps.list((o) => o.contact === contact);
-      const otp = matching[matching.length - 1];
+    verifyOtp(contact, code, challengeId) {
+      let otp = challengeId ? registry.otps.get(challengeId) : void 0;
+      if (!challengeId) {
+        const matching = registry.otps.list((o) => o.contact === contact);
+        otp = matching[matching.length - 1];
+      }
+      if (challengeId) {
+        if (!otp) throw new Error("No OTP challenge found");
+        if (otp.contact !== contact) throw new Error("OTP challenge does not match contact");
+      }
       if (options.mode === "strict") {
         if (!otp) throw new Error("No OTP requested");
         if (otp.code !== code && code !== options.defaultOtp) throw new Error("Invalid OTP");
@@ -5325,7 +5366,7 @@ function createCartService(opts) {
 
 // src/mock/domain/checkout.ts
 function createCheckoutService(opts) {
-  const { registry, clock, ids, bus} = opts;
+  const { registry, clock, ids, bus } = opts;
   return {
     process(session, body) {
       if (!body.cart_id) throw validation("cart_id required");
@@ -5812,6 +5853,7 @@ function createDeliveryService() {
             rate_id: "dlvrt_mock_standard",
             name: "Standard",
             fee: standardFree ? money(0) : money(15),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: standardFree,
             free_over_amount: money(200),
@@ -5825,6 +5867,7 @@ function createDeliveryService() {
             name: "Express",
             description: "Delivered within the hour",
             fee: money(25),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: false,
             eta_min_minutes: 30,

package/dist/mock/library.mjs

@@ -2100,6 +2100,8 @@ var ERROR_SUGGESTIONS = {
   CARD_DECLINED: "Card was declined. Ask shopper to retry or switch payment method.",
   INVALID_OTP: "Authorization code is invalid. Let shopper re-enter OTP/PIN and retry.",
   OTP_EXPIRED: "Authorization code expired. Request a new OTP and re-submit authorization.",
+  OTP_CHALLENGE_EXHAUSTED: "This verification challenge has no attempts left. Continue checkout without saved details or request a fresh challenge.",
+  OTP_CHALLENGE_CONSUMED: "This verification challenge has already been used. Continue with the established session or request a fresh challenge.",
   AUTHORIZATION_FAILED: "Additional payment authorization failed. Retry authorization or change payment method.",
   PAYMENT_ACTION_NOT_COMPLETED: "Required payment action was not completed. Resume provider flow and poll for status.",
   SLOT_UNAVAILABLE: "Selected schedule slot is unavailable. Refresh available slots and ask shopper to reselect.",
@@ -2512,6 +2514,36 @@ function buildV1(deps) {
     "/catalogue/quotes/:quote_id/refresh",
     (c) => tryRoute(c, () => deps.catalogue.refreshQuote(c.req.param("quote_id")))
   );
+  app.get("/reviews/summary", (c) => {
+    const productId = c.req.query("product_id");
+    if (productId !== void 0 && (productId.length === 0 || productId.trim() !== productId)) {
+      return fail(c, validation("product_id must be a non-empty canonical identifier"));
+    }
+    const response = {
+      data: {
+        ratings: {
+          product_id: productId ?? null,
+          review_count: 0,
+          rating_sum: 0,
+          average_rating: null,
+          distribution: { one: 0, two: 0, three: 0, four: 0, five: 0 }
+        },
+        trust_chips: {
+          on_time_delivery_percent: null,
+          delivery_sample_size: 0,
+          average_first_response_seconds: null,
+          support_sample_size: 0
+        }
+      }
+    };
+    return c.json(response);
+  });
+  app.get("/reviews", (c) => {
+    const response = {
+      data: { items: [], next_cursor: null }
+    };
+    return c.json(response);
+  });
   app.get("/cart", (c) => tryRoute(c, () => deps.cart.toUICart(deps.cart.get(c.var.session))));
   app.delete("/cart", (c) => tryRoute(c, () => deps.cart.clear(c.var.session)));
   app.get("/cart/items", (c) => tryRoute(c, () => deps.cart.getItems(c.var.session)));
@@ -3407,9 +3439,10 @@ function buildLink(deps) {
   app.post("/auth/request-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      deps.auth.requestOtp(body.contact ?? "");
+      const challenge = deps.auth.requestOtp(body.contact ?? "");
       return {
         success: true,
+        challenge_id: challenge.otp_id,
         message: `OTP sent to ${body.contact ?? "contact"}`,
         expires_in: 300,
         is_new_account: false
@@ -3419,7 +3452,11 @@ function buildLink(deps) {
   app.post("/auth/verify-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      const session = deps.auth.verifyOtp(body.contact ?? "", body.otp_code ?? "");
+      const session = deps.auth.verifyOtp(
+        body.contact ?? "",
+        body.otp_code ?? "",
+        body.challenge_id
+      );
       c.header("x-session-token", session.token);
       const customer = deps.link.ensureCustomer(session.customer_id ?? session.id, {
         email: body.contact?.includes("@") ? body.contact : void 0,
@@ -3513,10 +3550,7 @@ function buildLink(deps) {
       };
     });
   });
-  app.get(
-    "/preferences",
-    (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c)))
-  );
+  app.get("/preferences", (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c))));
   app.post("/preferences", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
@@ -3993,9 +4027,16 @@ function createAuthService(opts) {
         code_hint: options.mode === "permissive" ? code : void 0
       };
     },
-    verifyOtp(contact, code) {
-      const matching = registry.otps.list((o) => o.contact === contact);
-      const otp = matching[matching.length - 1];
+    verifyOtp(contact, code, challengeId) {
+      let otp = challengeId ? registry.otps.get(challengeId) : void 0;
+      if (!challengeId) {
+        const matching = registry.otps.list((o) => o.contact === contact);
+        otp = matching[matching.length - 1];
+      }
+      if (challengeId) {
+        if (!otp) throw new Error("No OTP challenge found");
+        if (otp.contact !== contact) throw new Error("OTP challenge does not match contact");
+      }
       if (options.mode === "strict") {
         if (!otp) throw new Error("No OTP requested");
         if (otp.code !== code && code !== options.defaultOtp) throw new Error("Invalid OTP");
@@ -5323,7 +5364,7 @@ function createCartService(opts) {
 
 // src/mock/domain/checkout.ts
 function createCheckoutService(opts) {
-  const { registry, clock, ids, bus} = opts;
+  const { registry, clock, ids, bus } = opts;
   return {
     process(session, body) {
       if (!body.cart_id) throw validation("cart_id required");
@@ -5810,6 +5851,7 @@ function createDeliveryService() {
             rate_id: "dlvrt_mock_standard",
             name: "Standard",
             fee: standardFree ? money(0) : money(15),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: standardFree,
             free_over_amount: money(200),
@@ -5823,6 +5865,7 @@ function createDeliveryService() {
             name: "Express",
             description: "Delivered within the hour",
             fee: money(25),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: false,
             eta_min_minutes: 30,

package/dist/mock/msw.js

@@ -2100,6 +2100,8 @@ var ERROR_SUGGESTIONS = {
   CARD_DECLINED: "Card was declined. Ask shopper to retry or switch payment method.",
   INVALID_OTP: "Authorization code is invalid. Let shopper re-enter OTP/PIN and retry.",
   OTP_EXPIRED: "Authorization code expired. Request a new OTP and re-submit authorization.",
+  OTP_CHALLENGE_EXHAUSTED: "This verification challenge has no attempts left. Continue checkout without saved details or request a fresh challenge.",
+  OTP_CHALLENGE_CONSUMED: "This verification challenge has already been used. Continue with the established session or request a fresh challenge.",
   AUTHORIZATION_FAILED: "Additional payment authorization failed. Retry authorization or change payment method.",
   PAYMENT_ACTION_NOT_COMPLETED: "Required payment action was not completed. Resume provider flow and poll for status.",
   SLOT_UNAVAILABLE: "Selected schedule slot is unavailable. Refresh available slots and ask shopper to reselect.",
@@ -2512,6 +2514,36 @@ function buildV1(deps) {
     "/catalogue/quotes/:quote_id/refresh",
     (c) => tryRoute(c, () => deps.catalogue.refreshQuote(c.req.param("quote_id")))
   );
+  app.get("/reviews/summary", (c) => {
+    const productId = c.req.query("product_id");
+    if (productId !== void 0 && (productId.length === 0 || productId.trim() !== productId)) {
+      return fail(c, validation("product_id must be a non-empty canonical identifier"));
+    }
+    const response = {
+      data: {
+        ratings: {
+          product_id: productId ?? null,
+          review_count: 0,
+          rating_sum: 0,
+          average_rating: null,
+          distribution: { one: 0, two: 0, three: 0, four: 0, five: 0 }
+        },
+        trust_chips: {
+          on_time_delivery_percent: null,
+          delivery_sample_size: 0,
+          average_first_response_seconds: null,
+          support_sample_size: 0
+        }
+      }
+    };
+    return c.json(response);
+  });
+  app.get("/reviews", (c) => {
+    const response = {
+      data: { items: [], next_cursor: null }
+    };
+    return c.json(response);
+  });
   app.get("/cart", (c) => tryRoute(c, () => deps.cart.toUICart(deps.cart.get(c.var.session))));
   app.delete("/cart", (c) => tryRoute(c, () => deps.cart.clear(c.var.session)));
   app.get("/cart/items", (c) => tryRoute(c, () => deps.cart.getItems(c.var.session)));
@@ -3407,9 +3439,10 @@ function buildLink(deps) {
   app.post("/auth/request-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      deps.auth.requestOtp(body.contact ?? "");
+      const challenge = deps.auth.requestOtp(body.contact ?? "");
       return {
         success: true,
+        challenge_id: challenge.otp_id,
         message: `OTP sent to ${body.contact ?? "contact"}`,
         expires_in: 300,
         is_new_account: false
@@ -3419,7 +3452,11 @@ function buildLink(deps) {
   app.post("/auth/verify-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      const session = deps.auth.verifyOtp(body.contact ?? "", body.otp_code ?? "");
+      const session = deps.auth.verifyOtp(
+        body.contact ?? "",
+        body.otp_code ?? "",
+        body.challenge_id
+      );
       c.header("x-session-token", session.token);
       const customer = deps.link.ensureCustomer(session.customer_id ?? session.id, {
         email: body.contact?.includes("@") ? body.contact : void 0,
@@ -3513,10 +3550,7 @@ function buildLink(deps) {
       };
     });
   });
-  app.get(
-    "/preferences",
-    (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c)))
-  );
+  app.get("/preferences", (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c))));
   app.post("/preferences", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
@@ -3993,9 +4027,16 @@ function createAuthService(opts) {
         code_hint: options.mode === "permissive" ? code : void 0
       };
     },
-    verifyOtp(contact, code) {
-      const matching = registry.otps.list((o) => o.contact === contact);
-      const otp = matching[matching.length - 1];
+    verifyOtp(contact, code, challengeId) {
+      let otp = challengeId ? registry.otps.get(challengeId) : void 0;
+      if (!challengeId) {
+        const matching = registry.otps.list((o) => o.contact === contact);
+        otp = matching[matching.length - 1];
+      }
+      if (challengeId) {
+        if (!otp) throw new Error("No OTP challenge found");
+        if (otp.contact !== contact) throw new Error("OTP challenge does not match contact");
+      }
       if (options.mode === "strict") {
         if (!otp) throw new Error("No OTP requested");
         if (otp.code !== code && code !== options.defaultOtp) throw new Error("Invalid OTP");
@@ -5323,7 +5364,7 @@ function createCartService(opts) {
 
 // src/mock/domain/checkout.ts
 function createCheckoutService(opts) {
-  const { registry, clock, ids, bus} = opts;
+  const { registry, clock, ids, bus } = opts;
   return {
     process(session, body) {
       if (!body.cart_id) throw validation("cart_id required");
@@ -5810,6 +5851,7 @@ function createDeliveryService() {
             rate_id: "dlvrt_mock_standard",
             name: "Standard",
             fee: standardFree ? money(0) : money(15),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: standardFree,
             free_over_amount: money(200),
@@ -5823,6 +5865,7 @@ function createDeliveryService() {
             name: "Express",
             description: "Delivered within the hour",
             fee: money(25),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: false,
             eta_min_minutes: 30,

package/dist/mock/msw.mjs

@@ -2098,6 +2098,8 @@ var ERROR_SUGGESTIONS = {
   CARD_DECLINED: "Card was declined. Ask shopper to retry or switch payment method.",
   INVALID_OTP: "Authorization code is invalid. Let shopper re-enter OTP/PIN and retry.",
   OTP_EXPIRED: "Authorization code expired. Request a new OTP and re-submit authorization.",
+  OTP_CHALLENGE_EXHAUSTED: "This verification challenge has no attempts left. Continue checkout without saved details or request a fresh challenge.",
+  OTP_CHALLENGE_CONSUMED: "This verification challenge has already been used. Continue with the established session or request a fresh challenge.",
   AUTHORIZATION_FAILED: "Additional payment authorization failed. Retry authorization or change payment method.",
   PAYMENT_ACTION_NOT_COMPLETED: "Required payment action was not completed. Resume provider flow and poll for status.",
   SLOT_UNAVAILABLE: "Selected schedule slot is unavailable. Refresh available slots and ask shopper to reselect.",
@@ -2510,6 +2512,36 @@ function buildV1(deps) {
     "/catalogue/quotes/:quote_id/refresh",
     (c) => tryRoute(c, () => deps.catalogue.refreshQuote(c.req.param("quote_id")))
   );
+  app.get("/reviews/summary", (c) => {
+    const productId = c.req.query("product_id");
+    if (productId !== void 0 && (productId.length === 0 || productId.trim() !== productId)) {
+      return fail(c, validation("product_id must be a non-empty canonical identifier"));
+    }
+    const response = {
+      data: {
+        ratings: {
+          product_id: productId ?? null,
+          review_count: 0,
+          rating_sum: 0,
+          average_rating: null,
+          distribution: { one: 0, two: 0, three: 0, four: 0, five: 0 }
+        },
+        trust_chips: {
+          on_time_delivery_percent: null,
+          delivery_sample_size: 0,
+          average_first_response_seconds: null,
+          support_sample_size: 0
+        }
+      }
+    };
+    return c.json(response);
+  });
+  app.get("/reviews", (c) => {
+    const response = {
+      data: { items: [], next_cursor: null }
+    };
+    return c.json(response);
+  });
   app.get("/cart", (c) => tryRoute(c, () => deps.cart.toUICart(deps.cart.get(c.var.session))));
   app.delete("/cart", (c) => tryRoute(c, () => deps.cart.clear(c.var.session)));
   app.get("/cart/items", (c) => tryRoute(c, () => deps.cart.getItems(c.var.session)));
@@ -3405,9 +3437,10 @@ function buildLink(deps) {
   app.post("/auth/request-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      deps.auth.requestOtp(body.contact ?? "");
+      const challenge = deps.auth.requestOtp(body.contact ?? "");
       return {
         success: true,
+        challenge_id: challenge.otp_id,
         message: `OTP sent to ${body.contact ?? "contact"}`,
         expires_in: 300,
         is_new_account: false
@@ -3417,7 +3450,11 @@ function buildLink(deps) {
   app.post("/auth/verify-otp", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
-      const session = deps.auth.verifyOtp(body.contact ?? "", body.otp_code ?? "");
+      const session = deps.auth.verifyOtp(
+        body.contact ?? "",
+        body.otp_code ?? "",
+        body.challenge_id
+      );
       c.header("x-session-token", session.token);
       const customer = deps.link.ensureCustomer(session.customer_id ?? session.id, {
         email: body.contact?.includes("@") ? body.contact : void 0,
@@ -3511,10 +3548,7 @@ function buildLink(deps) {
       };
     });
   });
-  app.get(
-    "/preferences",
-    (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c)))
-  );
+  app.get("/preferences", (c) => tryRoute(c, () => deps.link.getPreferences(customerId(c))));
   app.post("/preferences", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return tryRoute(c, () => {
@@ -3991,9 +4025,16 @@ function createAuthService(opts) {
         code_hint: options.mode === "permissive" ? code : void 0
       };
     },
-    verifyOtp(contact, code) {
-      const matching = registry.otps.list((o) => o.contact === contact);
-      const otp = matching[matching.length - 1];
+    verifyOtp(contact, code, challengeId) {
+      let otp = challengeId ? registry.otps.get(challengeId) : void 0;
+      if (!challengeId) {
+        const matching = registry.otps.list((o) => o.contact === contact);
+        otp = matching[matching.length - 1];
+      }
+      if (challengeId) {
+        if (!otp) throw new Error("No OTP challenge found");
+        if (otp.contact !== contact) throw new Error("OTP challenge does not match contact");
+      }
       if (options.mode === "strict") {
         if (!otp) throw new Error("No OTP requested");
         if (otp.code !== code && code !== options.defaultOtp) throw new Error("Invalid OTP");
@@ -5321,7 +5362,7 @@ function createCartService(opts) {
 
 // src/mock/domain/checkout.ts
 function createCheckoutService(opts) {
-  const { registry, clock, ids, bus} = opts;
+  const { registry, clock, ids, bus } = opts;
   return {
     process(session, body) {
       if (!body.cart_id) throw validation("cart_id required");
@@ -5808,6 +5849,7 @@ function createDeliveryService() {
             rate_id: "dlvrt_mock_standard",
             name: "Standard",
             fee: standardFree ? money(0) : money(15),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: standardFree,
             free_over_amount: money(200),
@@ -5821,6 +5863,7 @@ function createDeliveryService() {
             name: "Express",
             description: "Delivered within the hour",
             fee: money(25),
+            fee_status: "priced",
             currency: "GHS",
             free_delivery_applied: false,
             eta_min_minutes: 30,