@decocms/apps-nuvemshop 7.75.0 → 7.77.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/apps-nuvemshop",
-  "version": "7.75.0",
+  "version": "7.77.0",
   "type": "module",
   "description": "Deco commerce app: Nuvemshop (Tiendanube) Storefront API integration",
   "repository": {
@@ -30,9 +30,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.75.0",
-    "@decocms/apps-commerce": "7.75.0",
-    "@decocms/apps-website": "7.75.0"
+    "@decocms/blocks": "7.77.0",
+    "@decocms/apps-commerce": "7.77.0",
+    "@decocms/apps-website": "7.77.0"
   },
   "peerDependencies": {
     "react": "^19.0.0"

package/src/__tests__/account.test.ts

@@ -0,0 +1,250 @@
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import login from "../actions/account/login";
+import logout from "../actions/account/logout";
+import register from "../actions/account/register";
+import { configureNuvemshop, setNuvemshopFetch } from "../client";
+import user from "../loaders/user";
+
+const STORE = "https://demodeco.lojavirtualnuvem.com.br";
+const SITE = "https://www.loja.example";
+const ADMIN = "https://api.nuvemshop.com.br/v1/8336778";
+
+type Route = (url: URL, init: RequestInit) => Response | Promise<Response>;
+let routes: Record<string, Route> = {};
+const fetchMock = vi.fn(async (input: string | URL | Request, init: RequestInit = {}) => {
+  const url = new URL(String(input));
+  const key = `${init.method ?? "GET"} ${url.origin}${url.pathname}`;
+  const route = routes[key];
+  if (!route) throw new Error(`unexpected ${key}`);
+  return route(url, init);
+});
+const calls = (key: string) =>
+  fetchMock.mock.calls.filter(
+    ([u, i]) =>
+      `${i?.method ?? "GET"} ${new URL(String(u)).origin}${new URL(String(u)).pathname}` === key,
+  );
+const html = (body: string, init: ResponseInit = {}) =>
+  new Response(body, { ...init, headers: { "content-type": "text/html", ...init.headers } });
+const redirect = (location: string, cookies: string[] = []) => {
+  const headers = new Headers({ location });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(null, { status: 302, headers });
+};
+const SESSION_SET = `store_session_payload_8336778=NEW; expires=Thu, 05-Nov-2026 23:56:42 GMT; path=/; domain=demodeco.lojavirtualnuvem.com.br; secure; HttpOnly; SameSite=Lax`;
+const inRequest = <T>(fn: () => Promise<T>, cookie = "") =>
+  RequestContext.run(new Request(`${SITE}/deco/invoke/x`, { headers: { cookie } }), async () => {
+    const result = await fn();
+    return { result, setCookies: RequestContext.current!.responseHeaders.getSetCookie() };
+  });
+
+beforeEach(() => {
+  fetchMock.mockClear();
+  routes = {};
+  configureNuvemshop({ storeId: "8336778", storeUrl: STORE, adminToken: "admintoken" });
+  setNuvemshopFetch(fetchMock as unknown as typeof fetch);
+});
+
+describe("login", () => {
+  it("posts the classic form and forwards the store session cookie onto our domain", async () => {
+    const CF =
+      "__cf_bm=abc; HttpOnly; SameSite=None; Secure; Path=/; Domain=lojavirtualnuvem.com.br";
+    routes[`POST ${STORE}/account/login/`] = () => redirect(`${STORE}/account/`, [SESSION_SET, CF]);
+    const { result, setCookies } = await inRequest(
+      () => login({ email: "a@b.com", password: "pw" }),
+      "store_session_payload_8336778=OLD; _ga=GA1.1; other=x",
+    );
+    expect(result).toEqual({ ok: true });
+
+    const [, init] = calls(`POST ${STORE}/account/login/`)[0];
+    expect(String(init!.body)).toBe("email=a%40b.com&password=pw");
+    const headers = new Headers(init!.headers);
+    // only the store's own cookies go upstream — never the site's (_ga, other)
+    expect(headers.get("cookie")).toBe("store_session_payload_8336778=OLD");
+    expect(headers.get("origin")).toBe(STORE);
+    expect(init!.redirect).toBe("manual");
+
+    // only the store session is re-emitted on our domain (not the store's Cloudflare cookies)
+    expect(setCookies).toEqual([
+      SESSION_SET.replace("domain=demodeco.lojavirtualnuvem.com.br", "Domain=www.loja.example"),
+    ]);
+  });
+
+  it.each([
+    [
+      '<div class="alert alert-danger js-login-general-error"> Esses dados estão incorretos.',
+      "invalid_credentials",
+    ],
+    [
+      '<div class="js-account-validation-pending alert alert-danger">Valide seu e-mail',
+      "email_not_validated",
+    ],
+    ["<form id=login-form></form>", "unknown"],
+  ])("maps the login page marker to a reason (%#)", async (marker, error) => {
+    routes[`POST ${STORE}/account/login/`] = () =>
+      redirect(`${STORE}/account/login/`, [SESSION_SET]);
+    routes[`GET ${STORE}/account/login/`] = () => html(`<html>${marker}</html>`);
+    const { result } = await inRequest(() => login({ email: "a@b.com", password: "bad" }));
+    expect(result).toEqual({ ok: false, error });
+    // the follow-up page read reuses the session the POST just set
+    expect(new Headers(calls(`GET ${STORE}/account/login/`)[0][1]!.headers).get("cookie")).toBe(
+      "store_session_payload_8336778=NEW",
+    );
+  });
+
+  it("rejects missing credentials without calling the store", async () => {
+    const { result } = await inRequest(() => login({ email: "", password: "" }));
+    expect(result).toEqual({ ok: false, error: "invalid_credentials" });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("requires storeUrl", async () => {
+    configureNuvemshop({ storeId: "8336778" });
+    await expect(inRequest(() => login({ email: "a@b.com", password: "pw" }))).rejects.toThrow(
+      /storeUrl/,
+    );
+  });
+});
+
+describe("logout", () => {
+  it("hits /account/logout/ with the session and forwards the expiring cookie", async () => {
+    const expired =
+      "store_session_payload_8336778=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=demodeco.lojavirtualnuvem.com.br";
+    routes[`GET ${STORE}/account/logout/`] = () => redirect(`${STORE}/`, [expired]);
+    const { result, setCookies } = await inRequest(
+      () => logout({}),
+      "store_session_payload_8336778=S",
+    );
+    expect(result).toEqual({ ok: true });
+    expect(setCookies[0]).toContain("Domain=www.loja.example");
+  });
+});
+
+describe("register", () => {
+  const ok = () =>
+    new Response(JSON.stringify({ id: 350524152, email: "a@b.com", active: true }), {
+      status: 201,
+    });
+  const props = { name: "Ana", email: "a@b.com", password: "s3nha-forte", captchaToken: "tok" };
+
+  it("creates the customer through the Admin API (no reCAPTCHA) after verifying Turnstile", async () => {
+    configureNuvemshop({
+      storeId: "8336778",
+      storeUrl: STORE,
+      adminToken: "admintoken",
+      turnstileSecret: "ts",
+    });
+    routes["POST https://challenges.cloudflare.com/turnstile/v0/siteverify"] = () =>
+      Response.json({ success: true });
+    routes[`POST ${ADMIN}/customers`] = ok;
+    const { result } = await inRequest(() => register(props));
+    expect(result).toEqual({ ok: true, customerId: 350524152, emailValidationRequired: true });
+
+    const [, init] = calls(`POST ${ADMIN}/customers`)[0];
+    expect(new Headers(init!.headers).get("authentication")).toBe("bearer admintoken");
+    expect(new Headers(init!.headers).get("user-agent")).toMatch(/deco/);
+    expect(JSON.parse(String(init!.body))).toEqual({
+      name: "Ana",
+      email: "a@b.com",
+      password: "s3nha-forte",
+      send_email_invite: false,
+    });
+    const verify = new URLSearchParams(
+      String(calls("POST https://challenges.cloudflare.com/turnstile/v0/siteverify")[0][1]!.body),
+    );
+    expect(Object.fromEntries(verify)).toMatchObject({ secret: "ts", response: "tok" });
+  });
+
+  it("refuses when bot protection isn't configured (the Admin API has no captcha)", async () => {
+    const { result } = await inRequest(() => register(props));
+    expect(result).toEqual({ ok: false, error: "captcha_not_configured" });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("allows an explicit opt-out for demos", async () => {
+    configureNuvemshop({
+      storeId: "8336778",
+      storeUrl: STORE,
+      adminToken: "admintoken",
+      allowUnverifiedRegistration: true,
+    });
+    routes[`POST ${ADMIN}/customers`] = ok;
+    expect(
+      (await inRequest(() => register({ ...props, captchaToken: undefined }))).result,
+    ).toMatchObject({ ok: true });
+  });
+
+  it("maps a failed captcha, a taken email and weak input", async () => {
+    configureNuvemshop({
+      storeId: "8336778",
+      storeUrl: STORE,
+      adminToken: "admintoken",
+      turnstileSecret: "ts",
+    });
+    routes["POST https://challenges.cloudflare.com/turnstile/v0/siteverify"] = () =>
+      Response.json({ success: false });
+    expect((await inRequest(() => register(props))).result).toEqual({
+      ok: false,
+      error: "captcha_failed",
+    });
+
+    routes["POST https://challenges.cloudflare.com/turnstile/v0/siteverify"] = () =>
+      Response.json({ success: true });
+    routes[`POST ${ADMIN}/customers`] = () =>
+      Response.json({ email: ["The email must be unique."] }, { status: 422 });
+    expect((await inRequest(() => register(props))).result).toEqual({
+      ok: false,
+      error: "email_taken",
+    });
+
+    expect((await inRequest(() => register({ ...props, email: "nope" }))).result).toEqual({
+      ok: false,
+      error: "invalid_input",
+    });
+    expect((await inRequest(() => register({ ...props, password: "123" }))).result).toEqual({
+      ok: false,
+      error: "invalid_input",
+    });
+  });
+
+  it("requires the admin token", async () => {
+    configureNuvemshop({ storeId: "8336778", storeUrl: STORE, allowUnverifiedRegistration: true });
+    await expect(inRequest(() => register(props))).rejects.toThrow(/adminToken/);
+  });
+});
+
+describe("user", () => {
+  it("returns null without a store session and never calls upstream", async () => {
+    const { result } = await inRequest(() => user({}), "_ga=1");
+    expect(result).toBeNull();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("returns null when the store redirects to login", async () => {
+    routes[`GET ${STORE}/account/`] = () => redirect(`${STORE}/account/login/`);
+    expect((await inRequest(() => user({}), "store_session_payload_8336778=S")).result).toBeNull();
+  });
+
+  it("reads the logged-in customer id from the account page and its data from the Admin API", async () => {
+    routes[`GET ${STORE}/account/`] = () => html("<script>LS.customer = 350524152;</script>");
+    routes[`GET ${ADMIN}/customers/350524152`] = () =>
+      Response.json({
+        id: 350524152,
+        name: "Ana",
+        email: "a@b.com",
+        phone: "11999990000",
+        total_spent: "10.00",
+        addresses: [],
+      });
+    const { result } = await inRequest(() => user({}), "store_session_payload_8336778=S");
+    expect(result).toEqual({ id: 350524152, name: "Ana", email: "a@b.com", phone: "11999990000" });
+  });
+
+  it("falls back to just the id without an admin token", async () => {
+    configureNuvemshop({ storeId: "8336778", storeUrl: STORE });
+    routes[`GET ${STORE}/account/`] = () => html("<script>LS.customer = 7;</script>");
+    expect((await inRequest(() => user({}), "store_session_payload_8336778=S")).result).toEqual({
+      id: 7,
+    });
+  });
+});

package/src/__tests__/cart.test.ts

@@ -0,0 +1,118 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import browseFixture from "../__fixtures__/browse-category.json";
+import { clearNuvemshopCache, configureNuvemshop, setNuvemshopFetch } from "../client";
+import cart from "../loaders/cart";
+
+// browse fixture: [0] camisa-xadrez 189.90 (stock 17,20,…), [1] camisa-flanela 169.90 promo / 199.90, [2] camiseta-gamer 89.90
+const [xadrez, flanela, gamer] = browseFixture.data;
+const SITE = "https://www.loja.example";
+const fetchMock = vi.fn(async (input: string | URL | Request) => {
+  const url = new URL(String(input));
+  const ids = (url.searchParams.get("ids") ?? "").split(",").map(Number);
+  const data = browseFixture.data.filter((p) => ids.includes(p.id));
+  return new Response(
+    JSON.stringify({
+      data,
+      pagination: { page: 1, per_page: 30, total: data.length, total_pages: 1 },
+    }),
+  );
+});
+const item = (p: (typeof browseFixture.data)[number], v = 0, quantity = 1) => ({
+  productId: p.id,
+  variantId: p.variants[v].id,
+  quantity,
+});
+
+beforeEach(() => {
+  fetchMock.mockClear();
+  clearNuvemshopCache();
+  configureNuvemshop({ storeId: "8336778" });
+  setNuvemshopFetch(fetchMock as unknown as typeof fetch);
+});
+
+describe("cart loader", () => {
+  it("resolves each line from the Storefront API with prices, image and variant", async () => {
+    const c = await cart({ items: [item(xadrez, 0, 2), item(flanela, 5)], __pageUrl: `${SITE}/` });
+    expect(c.lines).toHaveLength(2);
+    expect(c.lines[0]).toMatchObject({
+      productId: xadrez.id,
+      variantId: xadrez.variants[0].id,
+      name: "Camisa Xadrez Lenhador Azul",
+      variantName: "P / Azul e Preto",
+      quantity: 2,
+      maxQuantity: 17,
+      price: 189.9,
+      listPrice: 189.9,
+      subtotal: 379.8,
+      url: `${SITE}/produtos/camisa-xadrez-lenhador-azul?variant=${xadrez.variants[0].id}`,
+    });
+    expect(c.lines[1]).toMatchObject({
+      variantName: "M / Cinza",
+      price: 169.9,
+      listPrice: 199.9,
+      subtotal: 169.9,
+    });
+    expect(c.lines[1].image).toBe(
+      flanela.images.find((i) => i.id === flanela.variants[5].image_id)!.src,
+    );
+    expect(c).toMatchObject({
+      itemCount: 3,
+      subtotal: 549.7,
+      listSubtotal: 579.7,
+      savings: 30,
+      currency: "BRL",
+      unavailable: [],
+    });
+  });
+
+  it("asks only for the products in the cart (ids, deduped) and nothing for an empty cart", async () => {
+    await cart({ items: [item(xadrez, 0), item(xadrez, 1), item(gamer)] });
+    const url = new URL(String(fetchMock.mock.calls[0][0]));
+    expect(url.searchParams.get("ids")).toBe(`${xadrez.id},${gamer.id}`);
+    expect(url.searchParams.get("per_page")).toBe("30");
+
+    fetchMock.mockClear();
+    expect(await cart({ items: [] })).toMatchObject({ lines: [], itemCount: 0, subtotal: 0 });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("clamps quantities to stock (the checkout rejects more) and to 99", async () => {
+    const c = await cart({ items: [{ ...item(xadrez, 0), quantity: 50 }] });
+    expect(c.lines[0]).toMatchObject({ quantity: 17, maxQuantity: 17, adjusted: true });
+  });
+
+  it("moves missing and sold-out variants out of the lines", async () => {
+    const soldOut = { ...item(gamer, 0), variantId: gamer.variants[0].id };
+    fetchMock.mockImplementationOnce(async () =>
+      Response.json({
+        data: [
+          { ...gamer, variants: gamer.variants.map((v, i) => (i === 0 ? { ...v, stock: 0 } : v)) },
+        ],
+        pagination: { page: 1, per_page: 30, total: 1, total_pages: 1 },
+      }),
+    );
+    const c = await cart({
+      items: [
+        soldOut,
+        { productId: gamer.id, variantId: 999, quantity: 1 },
+        { productId: 1, variantId: 2, quantity: 1 },
+      ],
+    });
+    expect(c.lines).toEqual([]);
+    expect(c.unavailable).toEqual([
+      { ...soldOut, reason: "out_of_stock" },
+      { productId: gamer.id, variantId: 999, quantity: 1, reason: "not_found" },
+      { productId: 1, variantId: 2, quantity: 1, reason: "not_found" },
+    ]);
+  });
+
+  it("fetches in batches of 30 ids (the API limit)", async () => {
+    const items = Array.from({ length: 31 }, (_, i) => ({
+      productId: i + 1,
+      variantId: 1,
+      quantity: 1,
+    }));
+    await cart({ items });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+});

package/src/__tests__/loaders.test.ts

@@ -205,7 +205,7 @@ describe("createCheckout", () => {
       items: [{ productId: 372190453, variantId: 1612648502, quantity: 2 }],
       coupon: " TEST ",
     });
-    expect(res.checkoutUrl).toBe(checkoutFixture.checkout_url);
+    expect(res).toEqual({ checkoutUrl: checkoutFixture.checkout_url });
     const body = JSON.parse(String(fetchMock.mock.calls.at(-1)![1]!.body));
     expect(body).toEqual({
       line_items: [{ product_id: 372190453, variant_id: 1612648502, quantity: 2 }],
@@ -213,8 +213,27 @@ describe("createCheckout", () => {
     });
   });
 
-  it("rejects an empty cart without calling the API", async () => {
-    await expect(createCheckout({ items: [] })).rejects.toThrow(/empty/);
+  it("returns a typed error for an empty cart without calling the API", async () => {
+    expect(await createCheckout({ items: [] })).toEqual({
+      error: "invalid",
+      message: "Cannot checkout an empty cart",
+    });
     expect(fetchMock).not.toHaveBeenCalled();
   });
+
+  it.each([
+    [422, "coupon_rejected", "coupon_rejected"],
+    [422, "checkout_rejected", "out_of_stock"],
+    [404, "resource_not_found", "unavailable"],
+    [400, "invalid_request", "invalid"],
+    [500, "boom", "unknown"],
+  ])("maps the API's %i %s to a typed error (%s)", async (status, code, error) => {
+    fetchMock.mockImplementationOnce(async () =>
+      json({ error: { code, message: `msg ${code}` } }, status),
+    );
+    expect(await createCheckout({ items: [{ productId: 1, variantId: 2, quantity: 1 }] })).toEqual({
+      error,
+      message: `msg ${code}`,
+    });
+  });
 });

package/src/__tests__/mod.test.ts

@@ -23,13 +23,41 @@ describe("configure", () => {
     }
   });
 
+  it("resolves the admin token and Turnstile secret as secrets and keeps storeUrl", async () => {
+    const keys: string[] = [];
+    await configure(
+      {
+        storeId: "1",
+        storeUrl: "https://loja.example/",
+        adminToken: { e: 1 },
+        turnstileSecret: { e: 2 },
+        allowUnverifiedRegistration: true,
+      },
+      async (_v, key) => {
+        keys.push(key);
+        return `secret-for-${key}`;
+      },
+    );
+    expect(keys).toEqual([
+      "NUVEMSHOP_STOREFRONT_TOKEN",
+      "NUVEMSHOP_ADMIN_TOKEN",
+      "NUVEMSHOP_TURNSTILE_SECRET",
+    ]);
+    expect(getNuvemshopConfig()).toMatchObject({
+      storeUrl: "https://loja.example/",
+      adminToken: "secret-for-NUVEMSHOP_ADMIN_TOKEN",
+      turnstileSecret: "secret-for-NUVEMSHOP_TURNSTILE_SECRET",
+      allowUnverifiedRegistration: true,
+    });
+  });
+
   it("resolves the token through the secret resolver (env fallback key)", async () => {
-    let envKey = "";
+    const keys: string[] = [];
     await configure({ storeId: "1", token: { encrypted: "x" } }, async (_v, key) => {
-      envKey = key;
-      return "tok";
+      keys.push(key);
+      return key === "NUVEMSHOP_STOREFRONT_TOKEN" ? "tok" : null;
     });
-    expect(envKey).toBe("NUVEMSHOP_STOREFRONT_TOKEN");
+    expect(keys[0]).toBe("NUVEMSHOP_STOREFRONT_TOKEN");
     expect(getNuvemshopConfig().token).toBe("tok");
   });
 });
@@ -63,6 +91,12 @@ describe("nuvemshopOperationRouter", () => {
     [`${base}/categories/calcados`, "categories.get"],
     [`${base}/shipping-options`, "shipping.options"],
     [`${base}/checkouts`, "checkout.create"],
+    ["https://demodeco.lojavirtualnuvem.com.br/account/login/", "store.account.login"],
+    ["https://demodeco.lojavirtualnuvem.com.br/account/logout/", "store.account.logout"],
+    ["https://demodeco.lojavirtualnuvem.com.br/account/", "store.account.page"],
+    ["https://api.nuvemshop.com.br/v1/1/customers", "admin.customers"],
+    ["https://api.nuvemshop.com.br/v1/1/customers/42", "admin.customers"],
+    ["https://challenges.cloudflare.com/turnstile/v0/siteverify", "turnstile.verify"],
     ["https://example.com/other", undefined],
   ])("%s → %s", (url, op) => {
     expect(nuvemshopOperationRouter(url, "GET")).toBe(op);

package/src/actions/account/login.ts

@@ -0,0 +1,30 @@
+import { storeFetch } from "../../store";
+
+export interface Props {
+  email: string;
+  password: string;
+}
+
+export type LoginResult =
+  | { ok: true }
+  | { ok: false; error: "invalid_credentials" | "email_not_validated" | "unknown" };
+
+/**
+ * @title Nuvemshop - Login
+ * @description Signs the buyer into the store session (the theme's login form, server-side).
+ * Success is a redirect to /account/; on failure the login page carries the reason.
+ */
+export default async function login(props: Props): Promise<LoginResult> {
+  if (!props?.email || !props?.password) return { ok: false, error: "invalid_credentials" };
+  const res = await storeFetch("/account/login/", {
+    method: "POST",
+    form: { email: props.email, password: props.password },
+  });
+  if (res.location && new URL(res.location).pathname === "/account/") return { ok: true };
+
+  const page = await (await storeFetch("/account/login/", { cookie: res.cookie })).text();
+  if (page.includes("js-account-validation-pending"))
+    return { ok: false, error: "email_not_validated" };
+  if (page.includes("js-login-general-error")) return { ok: false, error: "invalid_credentials" };
+  return { ok: false, error: "unknown" };
+}

package/src/actions/account/logout.ts

@@ -0,0 +1,10 @@
+import { storeFetch } from "../../store";
+
+/**
+ * @title Nuvemshop - Logout
+ * @description Ends the store session (and forwards the expired session cookie).
+ */
+export default async function logout(_props: unknown): Promise<{ ok: true }> {
+  await storeFetch("/account/logout/");
+  return { ok: true };
+}

package/src/actions/account/register.ts

@@ -0,0 +1,83 @@
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { nuvemshopAdmin } from "../../admin";
+import { getNuvemshopConfig, nuvemshopFetch } from "../../client";
+
+export interface Props {
+  name: string;
+  email: string;
+  password: string;
+  phone?: string;
+  /** Cloudflare Turnstile token from the registration form. */
+  captchaToken?: string;
+}
+
+export type RegisterResult =
+  | { ok: true; customerId: number; emailValidationRequired: true }
+  | {
+      ok: false;
+      error:
+        | "invalid_input"
+        | "email_taken"
+        | "captcha_failed"
+        | "captcha_not_configured"
+        | "unknown";
+    };
+
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+async function verifyTurnstile(secret: string, token: string | undefined) {
+  if (!token) return false;
+  const remoteip = RequestContext.current?.request.headers.get("cf-connecting-ip") ?? "";
+  const res = await nuvemshopFetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      secret,
+      response: token,
+      ...(remoteip && { remoteip }),
+    }).toString(),
+  });
+  return ((await res.json().catch(() => null)) as { success?: boolean } | null)?.success === true;
+}
+
+/**
+ * @title Nuvemshop - Register
+ * @description Creates a customer through the Admin API. The store's own form needs a reCAPTCHA
+ * bound to its domain; the Admin API has none, so this action requires Cloudflare Turnstile
+ * (`turnstileSecret`) unless `allowUnverifiedRegistration` is set. The store still emails a
+ * validation link before the first login.
+ */
+export default async function register(props: Props): Promise<RegisterResult> {
+  const { turnstileSecret, allowUnverifiedRegistration } = getNuvemshopConfig();
+  const name = props?.name?.trim();
+  const email = props?.email?.trim();
+  if (!name || !email || !EMAIL.test(email) || !props.password || props.password.length < 6) {
+    return { ok: false, error: "invalid_input" };
+  }
+  if (!allowUnverifiedRegistration) {
+    if (!turnstileSecret) return { ok: false, error: "captcha_not_configured" };
+    if (!(await verifyTurnstile(turnstileSecret, props.captchaToken))) {
+      return { ok: false, error: "captcha_failed" };
+    }
+  }
+  const res = await nuvemshopAdmin("/customers", {
+    method: "POST",
+    body: {
+      name,
+      email,
+      password: props.password,
+      ...(props.phone && { phone: props.phone }),
+      send_email_invite: false,
+    },
+  });
+  if (res.status === 422) {
+    const body = (await res.json().catch(() => ({}))) as { email?: string[] };
+    return {
+      ok: false,
+      error: body.email?.some((m) => /unique/i.test(m)) ? "email_taken" : "invalid_input",
+    };
+  }
+  if (!res.ok) return { ok: false, error: "unknown" };
+  const customer = (await res.json()) as { id: number };
+  return { ok: true, customerId: customer.id, emailValidationRequired: true };
+}