@fayz-ai/sdk 0.10.1 → 0.12.0

package/dist/{chunk-7UXTYT6I.js → chunk-4YRHC5N7.js}

@@ -1,10 +1,130 @@
 import { resetDeprecationWarnings, warnDeprecated } from './chunk-HA5O3CW7.js';
 
+// src/lib/dedupe-fetch.ts
+var DEFAULT_VARY = [
+  "authorization",
+  // a different user sees different rows under RLS
+  "apikey",
+  "accept",
+  "accept-profile",
+  // PostgREST schema selector
+  "content-profile",
+  "range",
+  // pagination window
+  "range-unit",
+  "prefer",
+  // count=exact changes Content-Range
+  "x-fayz-store",
+  // storefront tenant scope
+  "x-fayz-tenant"
+];
+var collapsed = 0;
+var flights = /* @__PURE__ */ new Map();
+function getDedupeStats() {
+  return { collapsed, inFlight: flights.size };
+}
+function resetDedupeStats() {
+  collapsed = 0;
+  flights.clear();
+}
+function headerValue(headers, name) {
+  if (!headers) return "";
+  if (headers instanceof Headers) return headers.get(name) ?? "";
+  if (Array.isArray(headers)) {
+    const hit2 = headers.find(([k]) => k.toLowerCase() === name);
+    return hit2?.[1] ?? "";
+  }
+  const hit = Object.entries(headers).find(([k]) => k.toLowerCase() === name);
+  return hit ? String(hit[1]) : "";
+}
+function bodylessStatus(status) {
+  return status === 204 || status === 205 || status === 304;
+}
+function createDedupedFetch(baseFetch = (...args) => fetch(...args), options = {}) {
+  const vary = [...DEFAULT_VARY, ...(options.varyHeaders ?? []).map((h) => h.toLowerCase())];
+  return async function dedupedFetch(input, init) {
+    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    if (method !== "GET" && method !== "HEAD" || init?.signal || input instanceof Request) {
+      return baseFetch(input, init);
+    }
+    const key = [method, url, ...vary.map((h) => headerValue(init?.headers, h))].join("\n");
+    let flight = flights.get(key);
+    if (flight) {
+      collapsed++;
+      options.onCollapse?.(key);
+    } else {
+      flight = (async () => {
+        const res = await baseFetch(input, init);
+        return {
+          status: res.status,
+          statusText: res.statusText,
+          headers: [...res.headers.entries()],
+          // Buffered so each caller can be handed its own Response: a body can
+          // only be read once, and `clone()` on a consumed response throws.
+          body: bodylessStatus(res.status) || method === "HEAD" ? new ArrayBuffer(0) : await res.arrayBuffer()
+        };
+      })();
+      flights.set(key, flight);
+      void flight.catch(() => {
+      }).finally(() => flights.delete(key));
+    }
+    const buffered = await flight;
+    const hasBody = !bodylessStatus(buffered.status) && method !== "HEAD";
+    return new Response(hasBody ? buffered.body.slice(0) : null, {
+      status: buffered.status,
+      statusText: buffered.statusText,
+      headers: buffered.headers
+    });
+  };
+}
+
 // src/shop.ts
 var _accessTokenResolver = null;
 function setShopAccessTokenResolver(resolver) {
   _accessTokenResolver = resolver;
 }
+var CARRIER_QUOTE_BUDGET_MS = 2500;
+var CARRIER_OPTION_SEPARATOR = "::";
+var CHECKOUT_GATEWAYS = {
+  abacatepay: { open: "shop-checkout-open", settle: "shop-checkout-settle" },
+  vindi: { open: "vindi-checkout-open", settle: "vindi-checkout-settle" }
+};
+function checkoutGateway(provider) {
+  const slug = String(provider ?? "").trim();
+  if (!slug) return null;
+  return CHECKOUT_GATEWAYS[slug] ?? null;
+}
+var _shippingItemsResolver = null;
+function setShopShippingItemsResolver(resolver) {
+  _shippingItemsResolver = resolver;
+}
+var _carrierQuotesResolver = null;
+function setShopCarrierQuotesResolver(resolver) {
+  _carrierQuotesResolver = resolver;
+}
+function mayAskCarrier() {
+  try {
+    return _carrierQuotesResolver?.() !== false;
+  } catch {
+    return true;
+  }
+}
+function getCartItemsForQuote() {
+  try {
+    return _shippingItemsResolver?.() ?? [];
+  } catch {
+    return [];
+  }
+}
+function cartIsFullyDigital(items) {
+  return items.length > 0 && items.every((item) => item.isPhysical === false);
+}
+var numOrNull = (value) => {
+  if (value == null || value === "") return null;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+};
 var FayzShopError = class extends Error {
   constructor(message, status, responseBody) {
     super(message);
@@ -91,6 +211,9 @@ function rowToProduct(row, overlay) {
     isPhysical: row.is_physical ?? true,
     weight: row.weight ?? null,
     weightUnit: row.weight_unit ?? "kg",
+    heightCm: numOrNull(row.height_cm),
+    widthCm: numOrNull(row.width_cm),
+    lengthCm: numOrNull(row.length_cm),
     createdAt: row.created_at ?? nowIso(),
     updatedAt: row.updated_at ?? row.created_at ?? nowIso()
   };
@@ -155,6 +278,18 @@ function rowToOrder(row) {
     paymentMethodKind: row.payment_method_kind ?? null,
     paidAt: row.paid_at ?? null,
     items: Array.isArray(row.items) ? row.items.map(rowToOrderItem) : [],
+    // Absent on the list endpoints, so [] means "not asked for" as much as
+    // "nothing shipped". The page that shows tracking reads a single order.
+    shipments: Array.isArray(row.shipments) ? row.shipments.map((shipment) => ({
+      id: shipment.id,
+      status: shipment.status ?? "pending",
+      carrier: shipment.carrier ?? null,
+      trackingCode: shipment.tracking_code ?? null,
+      trackingUrl: shipment.tracking_url ?? null,
+      shippedAt: shipment.shipped_at ?? null,
+      estimatedDeliveryAt: shipment.estimated_delivery_at ?? null,
+      deliveredAt: shipment.delivered_at ?? null
+    })) : [],
     createdAt: row.created_at ?? nowIso(),
     updatedAt: row.updated_at ?? row.created_at ?? nowIso()
   };
@@ -180,6 +315,7 @@ function rowToCustomer(row) {
     lastName: row.last_name ?? "",
     email: row.email ?? null,
     phone: row.phone ?? null,
+    document: row.document ?? null,
     notes: row.notes ?? null,
     ordersCount: row.orders_count ?? 0,
     totalSpent: row.total_spent ?? 0,
@@ -222,10 +358,67 @@ function createFayzShopProvider(options) {
     throw new FayzShopError("Fayz Shop provider requires either broker apiBaseUrl/projectId or legacy supabaseUrl/publishableKey/storeId.", 400);
   }
   const baseUrl = `${normalizeBaseUrl(options.supabaseUrl)}/rest/v1`;
-  const fetcher = options.fetcher ?? fetch;
+  const functionsUrl = options.functionsUrl ? normalizeBaseUrl(options.functionsUrl) : `${normalizeBaseUrl(options.supabaseUrl)}/functions/v1`;
+  const fetcher = createDedupedFetch(options.fetcher ?? fetch);
   const key = options.publishableKey;
   const storeId = options.storeId;
   const productMetadataOverlay = buildProductMetadataOverlay(options.productMetadata);
+  async function quoteFromCarrier(postalCode, subtotal) {
+    const abort = new AbortController();
+    const timer = setTimeout(() => abort.abort(), CARRIER_QUOTE_BUDGET_MS);
+    try {
+      const response = await (options.fetcher ?? fetch)(`${functionsUrl}/shop-shipping-quote`, {
+        method: "POST",
+        signal: abort.signal,
+        headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ tenantId: storeId, postalCode, subtotal, items: getCartItemsForQuote() })
+      });
+      if (!response.ok) return null;
+      const body = await response.json();
+      const rows = body.options ?? [];
+      if (rows.length === 0) return [];
+      if (!body.quoteId) return null;
+      return rows.map((row) => ({
+        // Carries the quote it came from, so a selection can name both without
+        // the storefront having to hold a second piece of state.
+        zoneId: `${body.quoteId}${CARRIER_OPTION_SEPARATOR}${row.service_id}`,
+        name: row.name,
+        carrier: row.carrier,
+        rate: Number(row.price ?? 0),
+        baseRate: Number(row.price ?? 0),
+        // A carrier price has no free-above rule of ours to re-derive.
+        freeAbove: null,
+        etaMinDays: row.eta_min_days ?? void 0,
+        etaMaxDays: row.eta_max_days ?? void 0,
+        free: false
+      }));
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function callPaymentFunction(slug, body) {
+    const orderId = String(body.orderId ?? "");
+    try {
+      const response = await (options.fetcher ?? fetch)(`${functionsUrl}/${slug}`, {
+        method: "POST",
+        headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ tenantId: storeId, ...body })
+      });
+      const payload = await response.json().catch(() => null);
+      if (!response.ok || !payload?.state) {
+        return {
+          state: "unopened",
+          orderId,
+          providerStatus: payload?.code ?? `http_${response.status}`
+        };
+      }
+      return { ...payload, orderId: payload.orderId ?? orderId };
+    } catch {
+      return { state: "unopened", orderId, providerStatus: "unreachable" };
+    }
+  }
   async function request(table, init = {}) {
     const query = init.query?.toString();
     const response = await fetcher(`${baseUrl}/${table}${query ? `?${query}` : ""}`, {
@@ -343,7 +536,13 @@ function createFayzShopProvider(options) {
           inventoryCount: row.inventory_count ?? 0,
           position: row.position ?? 0,
           status: row.status ?? "active",
-          imageId: row.image_id ?? null
+          imageId: row.image_id ?? null,
+          // Null inherits the product's, the way `price` has since 0028.
+          weight: numOrNull(row.weight),
+          weightUnit: row.weight_unit ?? null,
+          heightCm: numOrNull(row.height_cm),
+          widthCm: numOrNull(row.width_cm),
+          lengthCm: numOrNull(row.length_cm)
         }))
       };
     },
@@ -370,7 +569,7 @@ function createFayzShopProvider(options) {
     },
     async listOrders(options2) {
       const query = tenantQuery();
-      query.set("select", "*,items:plg_shop_order_items(*)");
+      query.set("select", "*,items:plg_shop_order_items(*),shipments:fulfillments(status,delivered_at)");
       if (options2?.status) query.set("status", `eq.${options2.status}`);
       if (options2?.financialStatus) query.set("financial_status", `eq.${options2.financialStatus}`);
       if (options2?.fulfillmentStatus) query.set("fulfillment_status", `eq.${options2.fulfillmentStatus}`);
@@ -394,6 +593,19 @@ function createFayzShopProvider(options) {
       return (rpcRows ?? []).map(rowToOrder);
     },
     async getOrder(id) {
+      const signedIn = !!_accessTokenResolver?.();
+      const viaRpc = async () => {
+        try {
+          const row = await request("rpc/shop_get_order", {
+            method: "POST",
+            body: JSON.stringify({ p_order_id: id })
+          });
+          return row ? rowToOrder(row) : null;
+        } catch {
+          return null;
+        }
+      };
+      if (!signedIn) return await viaRpc();
       const query = singleById(id);
       query.set("select", "*,items:plg_shop_order_items(*)");
       let rows = [];
@@ -403,11 +615,7 @@ function createFayzShopProvider(options) {
       }
       if (rows[0]) return rowToOrder(rows[0]);
       try {
-        const row = await request("rpc/shop_get_order", {
-          method: "POST",
-          body: JSON.stringify({ p_order_id: id })
-        });
-        return row ? rowToOrder(row) : null;
+        return await viaRpc();
       } catch {
         return null;
       }
@@ -419,6 +627,211 @@ function createFayzShopProvider(options) {
       });
       return row ? rowToOrder(row) : null;
     },
+    /**
+     * Opens the charge, or reports what the acquirer says about it.
+     *
+     * Both go through the pool's own functions, for the same reason
+     * `quoteFromCarrier` does: the credential is redeemed server-side and the
+     * storefront never learns the acquirer's URL, let alone its token. Neither
+     * call carries an amount — the function reads it off the order row, so a
+     * tampered body buys nothing.
+     *
+     * A store with no acquirer connected answers 404, which surfaces as
+     * `unopened`: the page then simply shows the order as pending, which is the
+     * behaviour every store had before this existed.
+     */
+    async openCharge(orderId, method = "pix") {
+      return await callPaymentFunction("shop-checkout-pay", { orderId, method });
+    },
+    async paymentState(orderId) {
+      return await callPaymentFunction("shop-payment-status", { orderId });
+    },
+    /**
+     * Open a charge for a cart that is NOT yet an order.
+     *
+     * Nothing about money leaves the browser: the function re-prices every line
+     * from the catalogue, so the total that comes back is the store's, not the
+     * caller's. `sessionId` is the only handle, and it neither reads nor pays on
+     * its own — `settleCheckoutSession` is what turns it into an order, and only
+     * after the acquirer says the money is in.
+     */
+    async openCheckoutSession(input) {
+      const provider = String(input.provider ?? "").trim() || "abacatepay";
+      const gateway = checkoutGateway(provider);
+      if (!gateway) {
+        throw new FayzShopError("Esta loja ainda n\xE3o recebe pagamento online.", 404);
+      }
+      const body = JSON.stringify({
+        tenantId: storeId,
+        items: input.items.map((item) => ({
+          productId: item.productId,
+          optionsLabel: item.optionsLabel ?? null,
+          quantity: item.quantity
+        })),
+        customer: input.customer,
+        shippingAddress: input.shippingAddress ?? null,
+        discountCode: input.discountCode ?? null
+      });
+      const response = await (options.fetcher ?? fetch)(`${functionsUrl}/${gateway.open}`, {
+        method: "POST",
+        headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+        body
+      }).catch(() => {
+        throw new FayzShopError("N\xE3o conseguimos falar com o pagamento agora. Tente de novo.", 0);
+      });
+      const payload = await response.json().catch(() => null);
+      if (!response.ok || !payload?.sessionId) {
+        const fallback = response.status === 404 ? "Esta loja ainda n\xE3o recebe pagamento online." : "N\xE3o conseguimos abrir a cobran\xE7a agora.";
+        throw new FayzShopError(payload?.error ?? fallback, response.status, payload);
+      }
+      return {
+        sessionId: payload.sessionId,
+        total: Number(payload.total ?? 0),
+        state: "open",
+        provider,
+        charge: payload.brCode ? {
+          emv: payload.brCode,
+          // O tipo promete base64 PURO, e a AbacatePay manda com o
+          // `data:image/png;base64,` já embutido (a AppMax mandava sem).
+          // Sem tirar aqui, a tela prefixava de novo e o QR não aparecia —
+          // um <img> com src inválido, silencioso.
+          qrcodeBase64: (payload.brCodeBase64 ?? "").replace(/^data:image\/\w+;base64,/u, "") || null,
+          expiresAt: payload.expiresAt ?? ""
+        } : null
+      };
+    },
+    /**
+     * Ask whether the money landed. Called on a timer, so a network blip must
+     * read as "still waiting" (`unknown`) and never as a payment that failed —
+     * one wrong `failed` here throws away a cart the buyer already paid for.
+     */
+    async settleCheckoutSession(sessionId, provider) {
+      const gateway = checkoutGateway(String(provider ?? "").trim() || "abacatepay");
+      if (!gateway) return { state: "unknown" };
+      try {
+        const response = await (options.fetcher ?? fetch)(`${functionsUrl}/${gateway.settle}`, {
+          method: "POST",
+          headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+          body: JSON.stringify({ tenantId: storeId, sessionId })
+        });
+        const payload = await response.json().catch(() => null);
+        if (!response.ok || !payload?.state) return { state: "unknown" };
+        return {
+          state: payload.state,
+          orderId: payload.orderId ?? null,
+          reason: payload.reason ?? null
+        };
+      } catch {
+        return { state: "unknown" };
+      }
+    },
+    /**
+     * The merchant's policy, as the shopper's browser is allowed to see it.
+     *
+     * Without this the settings screens wrote to a table nobody read on this
+     * side: StorefrontConfigHost skips the overlay when the provider has no
+     * such method, so the checkout kept offering whatever the app declared at
+     * build time — a store that turned boleto off still showed boleto.
+     *
+     * Through the RPC, never the table: plg_shop_settings is closed to anon on
+     * purpose and shop_store_settings() is the narrow window (storefront
+     * columns only, published stores only). A failure answers null, which is
+     * "no policy" — the declared config stands and the store still sells.
+     */
+    async getPublicStoreSettings() {
+      let row = null;
+      try {
+        const body = await request(
+          "rpc/shop_store_settings",
+          { method: "POST", body: JSON.stringify({ p_tenant_id: storeId }) }
+        );
+        row = Array.isArray(body) ? body[0] ?? null : body ?? null;
+      } catch {
+        return null;
+      }
+      if (!row) return null;
+      const bool = (v) => v == null ? void 0 : Boolean(v);
+      const methods = Array.isArray(row.payment_methods) && row.payment_methods.length > 0 ? row.payment_methods : void 0;
+      const fields = row.checkout_fields && typeof row.checkout_fields === "object" && Object.keys(row.checkout_fields).length > 0 ? row.checkout_fields : void 0;
+      return {
+        currency: row.currency ?? void 0,
+        locale: row.locale ?? void 0,
+        showOutOfStock: bool(row.show_out_of_stock),
+        paymentMethods: methods,
+        paymentProvider: row.payment_provider ?? void 0,
+        guestCheckout: bool(row.guest_checkout),
+        requireConfirmedEmail: bool(row.require_confirmed_email),
+        marketingOptIn: bool(row.marketing_opt_in),
+        discountsEnabled: bool(row.discounts_enabled),
+        checkoutFields: fields,
+        carrierQuotes: bool(row.carrier_quotes)
+      };
+    },
+    /**
+     * Dispatch by hand.
+     *
+     * All three are SECURITY DEFINER RPCs that check store membership
+     * themselves — the browser cannot ship someone else's order by holding its
+     * id, which is why these are not table writes.
+     */
+    async validateDiscountCode(code, subtotal) {
+      const row = await request("rpc/shop_validate_discount", {
+        method: "POST",
+        body: JSON.stringify({ p_tenant_id: storeId, p_code: code, p_subtotal: subtotal ?? 0 })
+      });
+      return {
+        valid: !!row?.valid,
+        code: row?.code ?? null,
+        type: row?.type ?? null,
+        value: Number(row?.value ?? 0),
+        reason: row?.reason ?? void 0
+      };
+    },
+    async cancelOrder(orderId, reason) {
+      const row = await request("rpc/shop_cancel_order", {
+        method: "POST",
+        body: JSON.stringify({ p_order_id: orderId, p_reason: reason?.trim() || null })
+      });
+      return row ? rowToOrder(row) : null;
+    },
+    async createFulfillment(input) {
+      return await request("rpc/shop_create_fulfillment", {
+        method: "POST",
+        body: JSON.stringify({
+          p_order_id: input.orderId,
+          p_location_id: asUuid(input.locationId ?? void 0),
+          p_carrier: input.carrier?.trim() || null,
+          p_tracking: input.trackingCode?.trim() || null,
+          // snake_case inside the jsonb: the RPC reads `order_item_id`.
+          p_items: input.items?.length ? input.items.map((line) => ({ order_item_id: line.orderItemId, quantity: line.quantity })) : null,
+          p_notes: input.notes?.trim() || null
+        })
+      });
+    },
+    async shipFulfillment(id, input) {
+      await request("rpc/shop_ship_fulfillment", {
+        method: "POST",
+        body: JSON.stringify({
+          p_fulfillment_id: id,
+          p_tracking: input.trackingCode?.trim() || null,
+          p_tracking_url: input.trackingUrl?.trim() || null,
+          p_carrier: input.carrier?.trim() || null
+        })
+      });
+    },
+    /** Chegou. Só o lojista sabe disso — nenhum provedor nos avisa hoje. */
+    async deliverFulfillment(id, deliveredAt) {
+      await request("rpc/shop_deliver_fulfillment", {
+        method: "POST",
+        body: JSON.stringify({ p_fulfillment_id: id, p_delivered_at: deliveredAt ?? null })
+      });
+    },
+    async cancelFulfillment(id, note) {
+      await request("rpc/shop_cancel_fulfillment", {
+        method: "POST",
+        body: JSON.stringify({ p_fulfillment_id: id, p_note: note?.trim() || null })
+      });
+    },
     async createOrder(input) {
       const subtotal = input.items.reduce((sum, item) => sum + item.quantity * item.unitPrice, 0);
       const discountTotal = input.discountTotal ?? 0;
@@ -503,7 +916,10 @@ function createFayzShopProvider(options) {
             country: input.shippingAddress.country ?? "BR",
             recipient: input.shippingAddress.recipient ?? null,
             phone: input.shippingAddress.phone ?? null,
-            label: input.shippingAddress.label ?? null
+            label: input.shippingAddress.label ?? null,
+            // Not an address field — see ShippingAddressInput.document. The
+            // 0050 trigger lifts it to a column and deletes it from here.
+            document: input.shippingAddress.document ?? null
           } : null,
           p_payment_method: input.paymentMethod ?? null,
           p_notes: input.notes ?? null,
@@ -540,28 +956,71 @@ function createFayzShopProvider(options) {
       if (!customer) throw new FayzShopError("shop_resolve_customer returned no row.", 500);
       return rowToCustomer(customer);
     },
+    /**
+     * The carrier first, our own zones when it does not answer in time.
+     *
+     * This is `createShippingQuoter` (packages/shop/src/providers/shipping.ts)
+     * by hand, and the duplication is deliberate: this package declares NO
+     * dependencies, which is what lets a storefront pull the client without
+     * dragging the admin stack in behind it. Importing the primitive for twelve
+     * lines would trade that for tidiness. The semantics are copied exactly and
+     * both are worth restating —
+     *
+     *   the budget is the connector's (1s, `onFailure: 'degrade'`), because a
+     *   shopper staring at "calculando" abandons faster than they accept a
+     *   slightly wrong price; and
+     *
+     *   an EMPTY provider answer is an ANSWER, not a failure. A carrier that
+     *   does not serve a postcode has told us something, and falling back to
+     *   the zones there would quote a van that does not go to São Paulo.
+     */
     async quoteShipping(postalCode, subtotal) {
       const digits = (postalCode || "").replace(/\D/g, "");
       if (digits.length !== 8) return [];
-      const rows = await request("rpc/shop_quote_shipping", {
-        method: "POST",
-        body: JSON.stringify({
-          p_tenant_id: storeId,
-          p_postal_code: digits,
-          p_subtotal: subtotal
-        })
-      });
-      return (rows ?? []).map((row) => ({
-        zoneId: row.zone_id,
-        name: row.name,
-        carrier: row.carrier ?? void 0,
-        rate: Number(row.rate ?? 0),
-        baseRate: Number(row.base_rate ?? row.rate ?? 0),
-        freeAbove: row.free_above == null ? null : Number(row.free_above),
-        etaMinDays: row.eta_min_days ?? void 0,
-        etaMaxDays: row.eta_max_days ?? void 0,
-        free: Boolean(row.free)
-      }));
+      if (cartIsFullyDigital(getCartItemsForQuote())) return [];
+      const zones = async () => {
+        const rows = await request("rpc/shop_quote_shipping", {
+          method: "POST",
+          body: JSON.stringify({
+            p_tenant_id: storeId,
+            p_postal_code: digits,
+            p_subtotal: subtotal
+          })
+        });
+        return (rows ?? []).map((row) => ({
+          zoneId: row.zone_id,
+          name: row.name,
+          carrier: row.carrier ?? void 0,
+          rate: Number(row.rate ?? 0),
+          baseRate: Number(row.base_rate ?? row.rate ?? 0),
+          freeAbove: row.free_above == null ? null : Number(row.free_above),
+          etaMinDays: row.eta_min_days ?? void 0,
+          etaMaxDays: row.eta_max_days ?? void 0,
+          free: Boolean(row.free)
+        }));
+      };
+      const carrier = mayAskCarrier() ? await quoteFromCarrier(digits, subtotal) : null;
+      return carrier ?? await zones();
+    },
+    /**
+     * Record which option the shopper picked, server-side.
+     *
+     * It sends a SERVICE, never a price: the row it points at was written by
+     * the quote function minutes ago, so the worst a tampered call achieves is
+     * choosing a different option the carrier actually offered — which is what
+     * the radio buttons are for. shop_place_order reads the stored price.
+     */
+    async selectShippingOption(optionId) {
+      const [quoteId, serviceId] = String(optionId ?? "").split(CARRIER_OPTION_SEPARATOR);
+      if (!quoteId || !serviceId) return false;
+      try {
+        return Boolean(await request("rpc/shop_select_shipping_quote", {
+          method: "POST",
+          body: JSON.stringify({ p_quote_id: quoteId, p_service_id: serviceId })
+        }));
+      } catch {
+        return false;
+      }
     },
     async listCustomerAddresses(customerId) {
       if (!asUuid(customerId)) return [];
@@ -825,6 +1284,6 @@ function createBrokerShopProvider(options) {
   };
 }
 
-export { FayzShopError, PRODUCT_METADATA_OVERLAY_DEPRECATION, createFayzShopProvider, resetProductMetadataOverlayDeprecationWarning, setShopAccessTokenResolver };
-//# sourceMappingURL=chunk-7UXTYT6I.js.map
-//# sourceMappingURL=chunk-7UXTYT6I.js.map
+export { FayzShopError, PRODUCT_METADATA_OVERLAY_DEPRECATION, createDedupedFetch, createFayzShopProvider, getDedupeStats, resetDedupeStats, resetProductMetadataOverlayDeprecationWarning, setShopAccessTokenResolver, setShopCarrierQuotesResolver, setShopShippingItemsResolver };
+//# sourceMappingURL=chunk-4YRHC5N7.js.map
+//# sourceMappingURL=chunk-4YRHC5N7.js.map