@fayz-ai/shop 0.10.0 → 0.12.0

package/dist/index.js

@@ -1,14 +1,15 @@
-import { T } from './chunk-XERLK5LD.js';
-export { DEFAULT_STOCK_TRACKING, MockStockStore, STOCK_TRACKING_MODES, StockMovementError, SupabaseStockStore, createMockStockStore, createSupabaseStockStore, listStockMovementKinds, listStockReasonCodes, mirroredInventoryCount, registerStockMovementKind, registerStockReasonCode, registerStockStore, replayStockLedger, resolveStockStore, validateStockMovement } from './chunk-XERLK5LD.js';
-import { getShopProvider } from './chunk-IL6GA4ER.js';
-export { getShopProvider, resetShopProvider, setShopProvider } from './chunk-IL6GA4ER.js';
+import { T, resolveStockStore, createSupabaseStockStore, OPENING_BALANCE_REASON, rowToStockLocation } from './chunk-STRNMFC4.js';
+export { DEFAULT_STOCK_TRACKING, MockStockStore, OWN_FULFILLMENT, STOCK_TRACKING_MODES, StockMovementError, SupabaseStockStore, createMockStockStore, createSupabaseStockStore, listStockMovementKinds, listStockReasonCodes, mirroredInventoryCount, registerStockMovementKind, registerStockReasonCode, registerStockStore, replayStockLedger, resolveStockStore, validateStockMovement } from './chunk-STRNMFC4.js';
+import { getShopProvider } from './chunk-2WACO2TG.js';
+export { getShopProvider, resetShopProvider, setShopProvider } from './chunk-2WACO2TG.js';
 import './chunk-FQPGE3YN.js';
-export { MockShopProvider, createMockShopProvider } from './chunk-U3O2I3RM.js';
+import { normalizeVariantAxes, validateVariantAxes, variantOptionsKey, storagePathOf, mergeMediaFiles, productImageToMediaFile, displayNameOf, mediaKindOf } from './chunk-U6HV3LVP.js';
+export { MAX_VARIANT_AXES, MAX_VARIANT_COMBINATIONS, MockShopProvider, applyVariantMatrix, axesFromOptions, createMockShopProvider, displayNameOf, formatVariantCombination, hasOnlyDefaultVariant, leavesNothingSellable, mediaKindOf, mergeMediaFiles, normalizeVariantAxes, planVariantMatrix, productImageToMediaFile, storagePathOf, validateVariantAxes, variantCombinations, variantOptionsKey } from './chunk-U6HV3LVP.js';
 export { MOCK_CATEGORIES, MOCK_DISCOUNTS, MOCK_PRODUCTS, buildMockCatalog, svgPlaceholder } from './chunk-IKNGCRUM.js';
-import { createSupabaseEntityStore } from './chunk-RGTIJQJL.js';
+import { createSupabaseEntityStore } from './chunk-6BO2TMZ5.js';
 import { getShopTenantId } from './chunk-KLDS7IPU.js';
 export { getShopTenantId, setShopTenantResolver } from './chunk-KLDS7IPU.js';
-import { resolveEntityStore, SIDECAR_TABLE, validateSidecarWrite } from './chunk-XOP6SHPB.js';
+import { resolveEntityStore } from './chunk-NWW3WJ7Y.js';
 import './chunk-3GERSY5F.js';
 import { getSupabaseClientOptional } from '@fayz-ai/core';
 
@@ -19,6 +20,9 @@ function round2(n) {
 async function validateDiscount(input, provider = getShopProvider()) {
   const code = input.code.trim();
   if (!code) return { valid: false, code: null, type: null, value: 0, reason: "empty" };
+  if (typeof provider.validateDiscountCode === "function") {
+    return await provider.validateDiscountCode(code, input.subtotal);
+  }
   const list = await provider.listDiscounts({ status: "active" });
   const discount = list.find((d) => (d.code ?? "").toUpperCase() === code.toUpperCase());
   if (!discount) return { valid: false, code: null, type: null, value: 0, reason: "not_found" };
@@ -72,7 +76,7 @@ async function computeCartTotals(input, provider = getShopProvider()) {
   let discountCode = null;
   if (input.discountCode) {
     const applied = applyDiscount(
-      await validateDiscount({ code: input.discountCode, customerId: input.customerId }, provider),
+      await validateDiscount({ code: input.discountCode, subtotal, customerId: input.customerId }, provider),
       subtotal
     );
     discountTotal = applied.discountTotal;
@@ -86,6 +90,67 @@ async function computeCartTotals(input, provider = getShopProvider()) {
 async function getCustomerOrders(customerId, provider = getShopProvider()) {
   return provider.listOrders({ customerId, limit: 100 });
 }
+
+// src/data/functions.ts
+var _functionsUrl = null;
+function setShopFunctionsUrl(url) {
+  _functionsUrl = url ? url.replace(/\/+$/u, "") : null;
+}
+function getShopFunctionsUrl() {
+  return _functionsUrl;
+}
+async function callShopFunction(db, slug, body) {
+  const override = getShopFunctionsUrl();
+  if (override) {
+    let token = null;
+    try {
+      token = (await db?.auth?.getSession?.())?.data?.session?.access_token ?? null;
+    } catch {
+    }
+    const response = await fetch(`${override}/${slug}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...token ? { Authorization: `Bearer ${token}` } : {}
+      },
+      body: JSON.stringify(body)
+    });
+    const payload2 = await response.json().catch(() => null);
+    return { ok: response.ok, status: response.status, payload: payload2 };
+  }
+  const { data, error } = await db.functions.invoke(slug, { body });
+  if (!error) return { ok: true, status: 200, payload: data };
+  const status = Number(error?.context?.status ?? 502);
+  let payload = null;
+  try {
+    payload = await error?.context?.json?.();
+  } catch {
+  }
+  return { ok: false, status, payload: payload ?? { error: error.message } };
+}
+
+// src/data/checkout-gateways.ts
+var GATEWAYS = Object.freeze({
+  abacatepay: Object.freeze({ open: "shop-checkout-open", settle: "shop-checkout-settle" }),
+  vindi: Object.freeze({ open: "vindi-checkout-open", settle: "vindi-checkout-settle" })
+});
+var CHARGEABLE_PROVIDERS = Object.freeze(Object.keys(GATEWAYS));
+function isChargeableProvider(provider) {
+  return checkoutGateway(provider) !== null;
+}
+function checkoutGateway(provider) {
+  const slug = String(provider ?? "").trim();
+  if (!slug) return null;
+  return GATEWAYS[slug] ?? null;
+}
+
+// src/data/customer-search.ts
+var COLUMNS = ["first_name", "last_name", "email", "phone"];
+function customerSearchFilters(term) {
+  return String(term ?? "").trim().split(/\s+/u).map((word) => word.replace(/[%,()]/gu, "")).filter(Boolean).map((word) => COLUMNS.map((column) => `${column}.ilike.%${word}%`).join(","));
+}
+
+// src/data/supabase-provider.ts
 function getDb() {
   const supabase = getSupabaseClientOptional();
   if (!supabase) throw new Error("@fayz-ai/shop: Supabase client not initialized. Call setGlobalSupabaseClient() first.");
@@ -103,6 +168,95 @@ function toPostalDigits(value) {
   const digits = String(value ?? "").replace(/\D/g, "");
   return digits ? digits.padStart(8, "0").slice(0, 8) : void 0;
 }
+function rowToVariant(row) {
+  return {
+    id: row.id,
+    productId: row.product_id,
+    options: row.options && typeof row.options === "object" ? row.options : {},
+    sku: row.sku ?? null,
+    // numeric(12,2) arrives as a string on the wire; Number() once, here.
+    price: row.price == null ? null : Number(row.price),
+    compareAtPrice: row.compare_at_price == null ? null : Number(row.compare_at_price),
+    inventoryCount: row.inventory_count ?? 0,
+    position: row.position ?? 0,
+    status: row.status ?? "active",
+    imageId: row.image_id ?? null,
+    isDefaultVariant: row.is_default_variant ?? false,
+    // Null inherits the product's, the way `price` has since 0028.
+    weight: numOrNull(row.weight),
+    weightUnit: row.weight_unit ?? null,
+    heightCm: numOrNull(row.height_cm),
+    widthCm: numOrNull(row.width_cm),
+    lengthCm: numOrNull(row.length_cm)
+  };
+}
+function variantPatch(input) {
+  const patch = {};
+  const map = {
+    sku: "sku",
+    price: "price",
+    compareAtPrice: "compare_at_price",
+    position: "position",
+    status: "status",
+    imageId: "image_id",
+    weight: "weight",
+    weightUnit: "weight_unit",
+    heightCm: "height_cm",
+    widthCm: "width_cm",
+    lengthCm: "length_cm"
+  };
+  for (const [key, column] of Object.entries(map)) {
+    const value = input[key];
+    if (value === void 0) continue;
+    patch[column] = key === "sku" && typeof value === "string" && value.trim() === "" ? null : value;
+  }
+  return patch;
+}
+function rowToStoreSettings(row) {
+  const bool = (v) => v == null ? void 0 : Boolean(v);
+  const methods = Array.isArray(row.payment_methods) && row.payment_methods.length > 0 ? row.payment_methods : void 0;
+  const fields = row.checkout_fields && typeof row.checkout_fields === "object" && Object.keys(row.checkout_fields).length > 0 ? row.checkout_fields : void 0;
+  return {
+    currency: row.currency ?? void 0,
+    locale: row.locale ?? void 0,
+    showOutOfStock: bool(row.show_out_of_stock),
+    requireSku: bool(row.require_sku),
+    stockOwnership: row.stock_ownership ?? void 0,
+    paymentMethods: methods,
+    paymentProvider: row.payment_provider ?? void 0,
+    guestCheckout: bool(row.guest_checkout),
+    requireConfirmedEmail: bool(row.require_confirmed_email),
+    marketingOptIn: bool(row.marketing_opt_in),
+    discountsEnabled: bool(row.discounts_enabled),
+    checkoutFields: fields,
+    autoFulfill: row.auto_fulfill ?? void 0,
+    notifyNewOrder: bool(row.notify_new_order),
+    notifyLowStock: bool(row.notify_low_stock),
+    handlingNote: row.handling_note ?? void 0,
+    carrierQuotes: bool(row.carrier_quotes)
+  };
+}
+function storeSettingsPayload(input) {
+  const payload = {};
+  if (input.currency !== void 0) payload.currency = input.currency;
+  if (input.locale !== void 0) payload.locale = input.locale;
+  if (input.showOutOfStock !== void 0) payload.show_out_of_stock = input.showOutOfStock;
+  if (input.requireSku !== void 0) payload.require_sku = input.requireSku;
+  if (input.stockOwnership !== void 0) payload.stock_ownership = input.stockOwnership;
+  if (input.paymentMethods !== void 0) payload.payment_methods = input.paymentMethods;
+  if (input.paymentProvider !== void 0) payload.payment_provider = input.paymentProvider ?? null;
+  if (input.guestCheckout !== void 0) payload.guest_checkout = input.guestCheckout;
+  if (input.requireConfirmedEmail !== void 0) payload.require_confirmed_email = input.requireConfirmedEmail;
+  if (input.marketingOptIn !== void 0) payload.marketing_opt_in = input.marketingOptIn;
+  if (input.discountsEnabled !== void 0) payload.discounts_enabled = input.discountsEnabled;
+  if (input.checkoutFields !== void 0) payload.checkout_fields = input.checkoutFields ?? {};
+  if (input.autoFulfill !== void 0) payload.auto_fulfill = input.autoFulfill;
+  if (input.notifyNewOrder !== void 0) payload.notify_new_order = input.notifyNewOrder;
+  if (input.notifyLowStock !== void 0) payload.notify_low_stock = input.notifyLowStock;
+  if (input.handlingNote !== void 0) payload.handling_note = input.handlingNote || null;
+  if (input.carrierQuotes !== void 0) payload.carrier_quotes = input.carrierQuotes;
+  return payload;
+}
 function rowToShippingZone(row) {
   return {
     id: row.id,
@@ -116,9 +270,74 @@ function rowToShippingZone(row) {
     etaMinDays: row.eta_min_days ?? null,
     etaMaxDays: row.eta_max_days ?? null,
     active: row.active ?? true,
-    sortOrder: row.sort_order ?? 0
+    sortOrder: row.sort_order ?? 0,
+    excluded: row.excluded ?? false,
+    profileId: row.profile_id ?? null
+  };
+}
+function rowToShippingProfile(row) {
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    name: row.name,
+    // undefined, never false: NULL means "inherit the store's decision", and a
+    // mapper that coalesced would turn every new profile into one that refuses
+    // the gateway.
+    carrierQuotes: row.carrier_quotes == null ? void 0 : Boolean(row.carrier_quotes),
+    isDefault: row.is_default ?? false
   };
 }
+function shippingProfilePayload(input) {
+  const payload = {};
+  if (input.name !== void 0) payload.name = input.name;
+  if (input.carrierQuotes !== void 0) payload.carrier_quotes = input.carrierQuotes ?? null;
+  if (input.isDefault !== void 0) payload.is_default = input.isDefault;
+  return payload;
+}
+function toOriginPostalCode(raw) {
+  const digits = String(raw ?? "").replace(/\D/g, "");
+  if (!digits) return null;
+  if (digits.length !== 8) throw new Error("O CEP do local precisa ter 8 d\xEDgitos.");
+  return digits;
+}
+function toLocationCode(name) {
+  const slug = name.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
+  return slug || "local";
+}
+function locationWriteError(error) {
+  if (error?.code === "23505") return new Error("J\xE1 existe um local com esse nome.");
+  if (error?.code === "23503") {
+    return new Error(
+      "Este local j\xE1 tem movimenta\xE7\xF5es de estoque. Arquive-o em vez de excluir \u2014 o hist\xF3rico aponta para ele."
+    );
+  }
+  return new Error(error?.message ?? "N\xE3o foi poss\xEDvel salvar o local.");
+}
+function stockLocationPayload(input) {
+  const payload = {};
+  if (input.name !== void 0) payload.name = input.name;
+  if (input.code !== void 0) payload.code = input.code;
+  if (input.kind !== void 0) payload.kind = input.kind;
+  if (input.isSellable !== void 0) payload.is_sellable = input.isSellable;
+  if (input.isDefault !== void 0) payload.is_default = input.isDefault;
+  if (input.status !== void 0) payload.status = input.status;
+  if (input.postalCode !== void 0) payload.postal_code = toOriginPostalCode(input.postalCode);
+  if (input.city !== void 0) payload.city = input.city || null;
+  if (input.state !== void 0) payload.state = input.state || null;
+  if (input.street !== void 0) payload.street = input.street || null;
+  if (input.number !== void 0) payload.number = input.number || null;
+  if (input.district !== void 0) payload.district = input.district || null;
+  if (input.complement !== void 0) payload.complement = input.complement || null;
+  if (input.document !== void 0) payload.document = String(input.document ?? "").replace(/\D/gu, "") || null;
+  if (input.phone !== void 0) payload.phone = String(input.phone ?? "").replace(/\D/gu, "") || null;
+  if (input.email !== void 0) payload.email = input.email || null;
+  if (input.carrierAgencies !== void 0) payload.carrier_agencies = input.carrierAgencies ?? {};
+  if (input.shipsOnline !== void 0) payload.ships_online = input.shipsOnline;
+  if (input.fulfillmentProvider !== void 0) {
+    payload.fulfillment_provider = input.fulfillmentProvider || null;
+  }
+  return payload;
+}
 function shippingZonePayload(input) {
   const payload = {};
   if (input.name !== void 0) payload.name = input.name;
@@ -131,6 +350,34 @@ function shippingZonePayload(input) {
   if (input.etaMaxDays !== void 0) payload.eta_max_days = input.etaMaxDays ?? null;
   if (input.active !== void 0) payload.active = input.active;
   if (input.sortOrder !== void 0) payload.sort_order = input.sortOrder;
+  if (input.excluded !== void 0) payload.excluded = input.excluded;
+  if (input.profileId !== void 0) payload.profile_id = input.profileId ?? null;
+  return payload;
+}
+function rowToShippingPackage(row) {
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    name: row.name,
+    kind: row.kind ?? "box",
+    heightCm: Number(row.height_cm ?? 0),
+    widthCm: Number(row.width_cm ?? 0),
+    lengthCm: Number(row.length_cm ?? 0),
+    emptyWeightGrams: Number(row.empty_weight_grams ?? 0),
+    isDefault: row.is_default ?? false,
+    active: row.active ?? true
+  };
+}
+function shippingPackagePayload(input) {
+  const payload = {};
+  if (input.name !== void 0) payload.name = input.name;
+  if (input.kind !== void 0) payload.kind = input.kind;
+  if (input.heightCm !== void 0) payload.height_cm = input.heightCm;
+  if (input.widthCm !== void 0) payload.width_cm = input.widthCm;
+  if (input.lengthCm !== void 0) payload.length_cm = input.lengthCm;
+  if (input.emptyWeightGrams !== void 0) payload.empty_weight_grams = input.emptyWeightGrams;
+  if (input.isDefault !== void 0) payload.is_default = input.isDefault;
+  if (input.active !== void 0) payload.active = input.active;
   return payload;
 }
 function rowToProduct(row) {
@@ -154,10 +401,21 @@ function rowToProduct(row) {
     isPhysical: row.is_physical ?? true,
     weight: row.weight,
     weightUnit: row.weight_unit ?? "kg",
+    heightCm: numOrNull(row.height_cm),
+    widthCm: numOrNull(row.width_cm),
+    lengthCm: numOrNull(row.length_cm),
+    packageId: row.package_id ?? null,
+    handling: Array.isArray(row.handling) ? row.handling : [],
+    shippingProfileId: row.shipping_profile_id ?? null,
     createdAt: row.created_at,
     updatedAt: row.updated_at
   };
 }
+function numOrNull(value) {
+  if (value == null || value === "") return null;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+}
 function rowToImage(row) {
   return {
     id: row.id,
@@ -229,6 +487,7 @@ function rowToCustomer(row) {
     lastName: row.last_name ?? "",
     email: row.email,
     phone: row.phone,
+    document: row.document ?? null,
     notes: row.notes,
     ordersCount: row.orders_count ?? 0,
     totalSpent: row.total_spent ?? 0,
@@ -285,22 +544,13 @@ function segmentPayload(input) {
   return p;
 }
 var GIFT_CODE_ALPHABET = "ABCDEFGHJKLMNPQRTUVWXY2346789";
-var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "avif", "bmp"]);
-var VIDEO_EXTENSIONS = /* @__PURE__ */ new Set(["mp4", "mov", "webm", "m4v", "avi", "mkv"]);
 function generateGiftCardCode() {
   const bytes = new Uint8Array(12);
   globalThis.crypto.getRandomValues(bytes);
   const chars = Array.from(bytes, (b) => GIFT_CODE_ALPHABET[b % GIFT_CODE_ALPHABET.length]);
   return `${chars.slice(0, 4).join("")}-${chars.slice(4, 8).join("")}-${chars.slice(8, 12).join("")}`;
 }
-function mediaKindOf(name, mime) {
-  if (mime?.startsWith("image/")) return "image";
-  if (mime?.startsWith("video/")) return "video";
-  const ext = (name.split(".").pop() ?? "").toLowerCase();
-  if (IMAGE_EXTENSIONS.has(ext)) return "image";
-  if (VIDEO_EXTENSIONS.has(ext)) return "video";
-  return "document";
-}
+var LIBRARY_FOLDER = "library";
 function nullableNumber(value) {
   if (value === null || value === void 0 || value === "") return null;
   const n = Number(value);
@@ -418,11 +668,13 @@ var SupabaseShopProvider = class {
    *  RLS on both tables already restricts anon reads to active variants of
    *  publicly readable products; the status filter here keeps the admin path
    *  (authenticated tenant member, who CAN see archived rows) consistent. */
-  async getProductVariants(productId) {
+  async getProductVariants(productId, opts) {
     const db = getDb();
+    let variantQuery = db.from(T.productVariants).select("*").eq("product_id", productId);
+    if (!opts?.includeArchived) variantQuery = variantQuery.eq("status", "active");
     const [optionsRes, variantsRes] = await Promise.all([
       db.from(T.productOptions).select("*").eq("product_id", productId).order("position", { ascending: true }),
-      db.from(T.productVariants).select("*").eq("product_id", productId).eq("status", "active").order("position", { ascending: true })
+      variantQuery.order("position", { ascending: true })
     ]);
     if (optionsRes.error) throw optionsRes.error;
     if (variantsRes.error) throw variantsRes.error;
@@ -432,19 +684,102 @@ var SupabaseShopProvider = class {
       values: Array.isArray(row.values) ? row.values.map(String) : [],
       position: row.position ?? 0
     }));
-    const variants = (variantsRes.data ?? []).map((row) => ({
+    const variants = (variantsRes.data ?? []).map(rowToVariant);
+    return { options, variants };
+  }
+  // --- The variant admin ------------------------------------------------------
+  async saveProductOptions(productId, input) {
+    const db = getDb();
+    const tenantId = getTenantId();
+    const clean = normalizeVariantAxes(input);
+    const refusal = validateVariantAxes(clean);
+    if (refusal) throw new Error(refusal);
+    const { data: existing, error: readError } = await db.from(T.productOptions).select("*").eq("product_id", productId);
+    if (readError) throw readError;
+    const byName = new Map((existing ?? []).map((row) => [row.name, row]));
+    const wanted = new Set(clean.map((axis) => axis.name));
+    const stale = (existing ?? []).filter((row) => !wanted.has(row.name)).map((row) => row.id);
+    if (stale.length > 0) {
+      const { error: error2 } = await db.from(T.productOptions).delete().in("id", stale);
+      if (error2) throw error2;
+    }
+    for (const [position, axis] of clean.entries()) {
+      const row = byName.get(axis.name);
+      if (row) {
+        const { error: error2 } = await db.from(T.productOptions).update({ values: axis.values, position }).eq("id", row.id);
+        if (error2) throw error2;
+      } else {
+        const { error: error2 } = await db.from(T.productOptions).insert({
+          product_id: productId,
+          tenant_id: tenantId,
+          name: axis.name,
+          values: axis.values,
+          position
+        });
+        if (error2) throw error2;
+      }
+    }
+    const { data, error } = await db.from(T.productOptions).select("*").eq("product_id", productId).order("position", { ascending: true });
+    if (error) throw error;
+    return (data ?? []).map((row) => ({
       id: row.id,
-      productId: row.product_id,
-      options: row.options && typeof row.options === "object" ? row.options : {},
-      sku: row.sku ?? null,
-      price: row.price == null ? null : Number(row.price),
-      compareAtPrice: row.compare_at_price == null ? null : Number(row.compare_at_price),
-      inventoryCount: row.inventory_count ?? 0,
-      position: row.position ?? 0,
-      status: row.status ?? "active",
-      imageId: row.image_id ?? null
+      name: row.name,
+      values: Array.isArray(row.values) ? row.values.map(String) : [],
+      position: row.position ?? 0
     }));
-    return { options, variants };
+  }
+  async createProductVariant(productId, input) {
+    const db = getDb();
+    const tenantId = getTenantId();
+    if (Object.keys(input.options).length === 0) {
+      throw new Error("Uma variante sem op\xE7\xF5es \xE9 a variante padr\xE3o (0037), criada pelo banco. Declare ao menos um eixo.");
+    }
+    const { data: existing, error: readError } = await db.from(T.productVariants).select("*").eq("product_id", productId);
+    if (readError) throw readError;
+    const wantedKey = variantOptionsKey(input.options);
+    const match = (existing ?? []).find((row) => variantOptionsKey(row.options ?? {}) === wantedKey);
+    if (match) return this.updateProductVariant(match.id, { ...input, status: input.status ?? "active" });
+    const { data, error } = await db.from(T.productVariants).insert({
+      product_id: productId,
+      tenant_id: tenantId,
+      options: input.options,
+      ...variantPatch(input),
+      // NOT copied from the product: 0028 defines a null price as "inherit the
+      // product's", and 0037's header spells out why a copy is a bug — the
+      // storefront would show the new product price and the server charge the
+      // frozen variant one.
+      status: input.status ?? "active"
+    }).select("*").single();
+    if (error) throw error;
+    return rowToVariant(data);
+  }
+  async updateProductVariant(variantId, input) {
+    const db = getDb();
+    const { data, error } = await db.from(T.productVariants).update(variantPatch(input)).eq("id", variantId).select("*").single();
+    if (error) throw error;
+    return rowToVariant(data);
+  }
+  async archiveProductVariant(variantId) {
+    const db = getDb();
+    const { error } = await db.from(T.productVariants).update({ status: "archived" }).eq("id", variantId);
+    if (error) throw error;
+  }
+  async setVariantStock(variantId, count, note) {
+    const target = Math.max(0, Math.trunc(count));
+    const store = resolveStockStore(getTenantId() ?? "", () => createSupabaseStockStore());
+    const current = await store.getAvailable(variantId);
+    const delta = target - current;
+    if (delta === 0) return current;
+    const priorMovements = await store.listMovements({ variantId, limit: 1 });
+    const opening = priorMovements.length === 0 && delta > 0;
+    await store.recordMovement({
+      variantId,
+      kind: opening ? "receipt" : "adjustment",
+      reasonCode: opening ? OPENING_BALANCE_REASON : "correction",
+      quantity: delta,
+      note: note ?? "Estoque definido na matriz de variantes."
+    });
+    return target;
   }
   async createProduct(input) {
     const db = getDb();
@@ -465,7 +800,17 @@ var SupabaseShopProvider = class {
       category_id: input.categoryId ?? null,
       is_physical: input.isPhysical ?? true,
       weight: input.weight ?? null,
-      weight_unit: input.weightUnit ?? "kg"
+      weight_unit: input.weightUnit ?? "kg",
+      height_cm: input.heightCm ?? null,
+      width_cm: input.widthCm ?? null,
+      length_cm: input.lengthCm ?? null,
+      // Null = a padrão da loja (0047). É o estado normal, não um campo vazio.
+      package_id: input.packageId ?? null,
+      // NULL and not []: "nothing declared" and "declared as needing nothing"
+      // are the same fact about a box, and one representation of it keeps the
+      // `&&` overlap test in the 0048 trigger reading one way.
+      handling: input.handling?.length ? input.handling : null,
+      shipping_profile_id: input.shippingProfileId ?? null
     }).select(`*, images:${T.productImages}(*)`).single();
     if (error) throw error;
     return rowToProduct(data);
@@ -488,6 +833,13 @@ var SupabaseShopProvider = class {
     if (input.categoryId !== void 0) updates.category_id = input.categoryId;
     if (input.isPhysical !== void 0) updates.is_physical = input.isPhysical;
     if (input.weight !== void 0) updates.weight = input.weight;
+    if (input.weightUnit !== void 0) updates.weight_unit = input.weightUnit;
+    if (input.heightCm !== void 0) updates.height_cm = input.heightCm;
+    if (input.widthCm !== void 0) updates.width_cm = input.widthCm;
+    if (input.lengthCm !== void 0) updates.length_cm = input.lengthCm;
+    if (input.packageId !== void 0) updates.package_id = input.packageId || null;
+    if (input.handling !== void 0) updates.handling = input.handling.length ? input.handling : null;
+    if (input.shippingProfileId !== void 0) updates.shipping_profile_id = input.shippingProfileId ?? null;
     const { data, error } = await db.from(T.products).update(updates).eq("id", id).select(`*, images:${T.productImages}(*)`).single();
     if (error) throw error;
     return rowToProduct(data);
@@ -532,9 +884,43 @@ var SupabaseShopProvider = class {
     if (error) throw error;
     return rowToImage(data);
   }
+  async replaceProductImage(imageId, file) {
+    const db = getDb();
+    const tenantId = getTenantId();
+    const { data: row, error: readErr } = await db.from(T.productImages).select("id,url,product_id").eq("id", imageId).single();
+    if (readErr) throw readErr;
+    const path = `${tenantId}/products/${row.product_id}/${Date.now()}-${file.name}`;
+    const bucket = db.storage.from(T.mediaBucket);
+    const { error: uploadErr } = await bucket.upload(path, file);
+    if (uploadErr) throw uploadErr;
+    const { data: { publicUrl } } = bucket.getPublicUrl(path);
+    const { data, error } = await db.from(T.productImages).update({ url: publicUrl }).eq("id", imageId).select().single();
+    if (error) throw error;
+    await this.removeUnreferencedObject(row.url);
+    return rowToImage(data);
+  }
   async deleteProductImage(imageId) {
-    const { error } = await getDb().from(T.productImages).delete().eq("id", imageId);
+    const db = getDb();
+    const { data: row } = await db.from(T.productImages).select("url").eq("id", imageId).maybeSingle();
+    const { error } = await db.from(T.productImages).delete().eq("id", imageId);
     if (error) throw error;
+    if (row?.url) await this.removeUnreferencedObject(row.url);
+  }
+  /**
+   * Drop a stored file once nothing points at it anymore.
+   *
+   * The row was the only thing keeping the object reachable, so leaving it
+   * behind is a file nobody can see and nobody can delete — and the bill for it
+   * arrives all the same. Two rows can share one URL (a duplicated product), and
+   * the survivor has to keep working, so the count decides.
+   */
+  async removeUnreferencedObject(url) {
+    const path = url ? storagePathOf(url) : null;
+    if (!path) return;
+    const db = getDb();
+    const { count } = await db.from(T.productImages).select("id", { count: "exact", head: true }).eq("url", url);
+    if (count) return;
+    await db.storage.from(T.mediaBucket).remove([path]);
   }
   // ---------------------------------------------------------------------------
   // Categories
@@ -643,10 +1029,188 @@ var SupabaseShopProvider = class {
     if (error) throw error;
     return rowToShippingZone(data);
   }
+  // -------------------------------------------------------------------------
+  // Embalagens (0046)
+  //
+  // `is_default` has a partial unique index behind it, so promoting a box has
+  // to demote the previous one in the same round trip — otherwise the second
+  // default is refused by the database and the merchant sees a save that
+  // failed for a reason the screen cannot explain.
+  // -------------------------------------------------------------------------
+  async listShippingPackages() {
+    const tenantId = getTenantId();
+    const { data, error } = await getDb().from(T.shippingPackages).select("*").eq("tenant_id", tenantId).order("is_default", { ascending: false }).order("name", { ascending: true });
+    if (error) throw error;
+    return (data ?? []).map(rowToShippingPackage);
+  }
+  async createShippingPackage(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: createShippingPackage requires a tenant id.");
+    if (input.isDefault) await this.clearDefaultPackage(tenantId);
+    const { data, error } = await getDb().from(T.shippingPackages).insert({ tenant_id: tenantId, ...shippingPackagePayload(input) }).select().single();
+    if (error) throw error;
+    return rowToShippingPackage(data);
+  }
+  async updateShippingPackage(id, input) {
+    const tenantId = getTenantId();
+    if (input.isDefault && tenantId) await this.clearDefaultPackage(tenantId, id);
+    const { data, error } = await getDb().from(T.shippingPackages).update(shippingPackagePayload(input)).eq("id", id).select().single();
+    if (error) throw error;
+    return rowToShippingPackage(data);
+  }
+  async deleteShippingPackage(id) {
+    const { error } = await getDb().from(T.shippingPackages).delete().eq("id", id);
+    if (error) throw error;
+  }
+  async clearDefaultPackage(tenantId, exceptId) {
+    let query = getDb().from(T.shippingPackages).update({ is_default: false }).eq("tenant_id", tenantId).eq("is_default", true);
+    if (exceptId) query = query.neq("id", exceptId);
+    const { error } = await query;
+    if (error) throw error;
+  }
   async deleteShippingZone(id) {
     const { error } = await getDb().from(T.shippingZones).delete().eq("id", id);
     if (error) throw error;
   }
+  // -------------------------------------------------------------------------
+  // Store policy + delivery fallback (0044b / 0015)
+  //
+  // Both are ONE ROW PER TENANT, and both are upserted rather than
+  // insert-or-update: a store that never opened these screens has no row, and
+  // making the first save conditional on discovering that is two round trips to
+  // learn something the primary key already knows.
+  // -------------------------------------------------------------------------
+  async getShippingSettings() {
+    const tenantId = getTenantId();
+    const { data, error } = await getDb().from(T.shippingSettings).select("flat_rate, free_above, currency").eq("tenant_id", tenantId).maybeSingle();
+    if (error) throw error;
+    if (!data) return null;
+    return {
+      flatRate: Number(data.flat_rate ?? 0),
+      freeAbove: data.free_above == null ? null : Number(data.free_above),
+      currency: data.currency ?? "BRL"
+    };
+  }
+  async updateShippingSettings(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: updateShippingSettings requires a tenant id.");
+    const payload = { tenant_id: tenantId };
+    if (input.flatRate !== void 0) payload.flat_rate = input.flatRate;
+    if (input.freeAbove !== void 0) payload.free_above = input.freeAbove;
+    if (input.currency !== void 0) payload.currency = input.currency;
+    const { data, error } = await getDb().from(T.shippingSettings).upsert(payload, { onConflict: "tenant_id" }).select("flat_rate, free_above, currency").single();
+    if (error) throw error;
+    return {
+      flatRate: Number(data.flat_rate ?? 0),
+      freeAbove: data.free_above == null ? null : Number(data.free_above),
+      currency: data.currency ?? "BRL"
+    };
+  }
+  /**
+   * "Does this store deliver here?" — asked with the address, before the card.
+   *
+   * Degrades to "yes, and not our own zone" on any failure. A store that cannot
+   * reach the check must not stop selling: the order itself is still refused by
+   * the 0048 trigger if the region really is excluded, so the worst case is the
+   * shopper learning it one screen later instead of never selling at all.
+   */
+  async listShippingProfiles() {
+    const { data, error } = await getDb().from(T.shippingProfiles).select("*").eq("tenant_id", getTenantId()).order("is_default", { ascending: false }).order("name");
+    if (error) throw error;
+    return (data ?? []).map(rowToShippingProfile);
+  }
+  async createShippingProfile(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: createShippingProfile requires a tenant id.");
+    const { data, error } = await getDb().from(T.shippingProfiles).insert({ tenant_id: tenantId, ...shippingProfilePayload(input) }).select("*").single();
+    if (error) throw error;
+    return rowToShippingProfile(data);
+  }
+  async updateShippingProfile(id, input) {
+    const { data, error } = await getDb().from(T.shippingProfiles).update(shippingProfilePayload(input)).eq("id", id).select("*").single();
+    if (error) throw error;
+    return rowToShippingProfile(data);
+  }
+  async deleteShippingProfile(id) {
+    const { error } = await getDb().from(T.shippingProfiles).delete().eq("id", id);
+    if (error) throw error;
+  }
+  // Places the store ships from (0058). Default first, then by name — the same
+  // order the ledger's listLocations() uses, so the two screens agree.
+  async listStockLocations() {
+    const { data, error } = await getDb().from(T.stockLocations).select("*").eq("tenant_id", getTenantId()).order("is_default", { ascending: false }).order("name");
+    if (error) throw error;
+    return (data ?? []).map(rowToStockLocation);
+  }
+  async createStockLocation(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: createStockLocation requires a tenant id.");
+    if (input.isDefault) await this.clearDefaultStockLocation(tenantId);
+    const payload = stockLocationPayload(input);
+    if (payload.code === void 0) payload.code = toLocationCode(input.name);
+    const { data, error } = await getDb().from(T.stockLocations).insert({ tenant_id: tenantId, ...payload }).select("*").single();
+    if (error) throw locationWriteError(error);
+    return rowToStockLocation(data);
+  }
+  async updateStockLocation(id, input) {
+    const tenantId = getTenantId();
+    if (input.isDefault && tenantId) await this.clearDefaultStockLocation(tenantId, id);
+    const { data, error } = await getDb().from(T.stockLocations).update(stockLocationPayload(input)).eq("id", id).select("*").single();
+    if (error) throw locationWriteError(error);
+    return rowToStockLocation(data);
+  }
+  async deleteStockLocation(id) {
+    const { error } = await getDb().from(T.stockLocations).delete().eq("id", id);
+    if (error) throw locationWriteError(error);
+  }
+  async clearDefaultStockLocation(tenantId, exceptId) {
+    let query = getDb().from(T.stockLocations).update({ is_default: false }).eq("tenant_id", tenantId).eq("is_default", true);
+    if (exceptId) query = query.neq("id", exceptId);
+    const { error } = await query;
+    if (error) throw error;
+  }
+  async checkDelivery(postalCode) {
+    const tenantId = getTenantId();
+    const digits = String(postalCode ?? "").replace(/\D/g, "");
+    if (!tenantId || digits.length !== 8) return { refused: false, ownZone: false };
+    const { data, error } = await getDb().rpc("shop_delivery_check", {
+      p_tenant_id: tenantId,
+      p_postal_code: digits
+    });
+    if (error) return { refused: false, ownZone: false };
+    const row = Array.isArray(data) ? data[0] : data;
+    return {
+      refused: Boolean(row?.refused),
+      refusedZone: row?.refused_zone ?? null,
+      ownZone: Boolean(row?.own_zone)
+    };
+  }
+  async getStoreSettings() {
+    const tenantId = getTenantId();
+    const { data, error } = await getDb().from(T.settings).select("*").eq("tenant_id", tenantId).maybeSingle();
+    if (error) throw error;
+    return data ? rowToStoreSettings(data) : null;
+  }
+  async updateStoreSettings(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: updateStoreSettings requires a tenant id.");
+    const { data, error } = await getDb().from(T.settings).upsert({ tenant_id: tenantId, ...storeSettingsPayload(input) }, { onConflict: "tenant_id" }).select("*").single();
+    if (error) throw error;
+    return rowToStoreSettings(data);
+  }
+  /**
+   * The shopper's read. Through the RPC, not the table: the table is closed to
+   * anon on purpose (0029) and shop_store_settings() is the narrow window —
+   * storefront fields only, and only for a published store.
+   */
+  async getPublicStoreSettings() {
+    const tenantId = getTenantId();
+    if (!tenantId) return null;
+    const { data, error } = await getDb().rpc("shop_store_settings", { p_tenant_id: tenantId });
+    if (error) throw error;
+    const row = Array.isArray(data) ? data[0] : data;
+    return row ? rowToStoreSettings(row) : null;
+  }
   /**
    * Settle a pending order: the merchant confirming that the money arrived.
    *
@@ -664,6 +1228,227 @@ var SupabaseShopProvider = class {
     if (error) throw error;
     return this.getOrder(id);
   }
+  // ---------------------------------------------------------------------------
+  // Carrier labels. Everything goes through the function: the token never
+  // reaches the browser, and `buy` is the one call that spends money.
+  // ---------------------------------------------------------------------------
+  async labelCall(orderId, action, extra = {}) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: shipping labels require a tenant id.");
+    const { ok, payload } = await callShopFunction(getDb(), "shop-shipping-label", {
+      tenantId,
+      orderId,
+      action,
+      ...extra
+    });
+    if (!ok) throw new Error(payload?.error ?? "A transportadora n\xE3o respondeu agora.");
+    return payload;
+  }
+  async quoteShippingLabel(orderId, carrier) {
+    const payload = await this.labelCall(orderId, "quote", carrier ? { carrier } : {});
+    return {
+      options: (payload?.options ?? []).map((option) => ({
+        serviceId: Number(option.service_id ?? option.serviceId),
+        name: String(option.name ?? "Entrega"),
+        carrier: String(option.carrier ?? ""),
+        price: Number(option.price ?? 0),
+        etaMinDays: option.eta_min_days ?? null,
+        etaMaxDays: option.eta_max_days ?? null
+      })),
+      label: payload?.label ? {
+        labelId: String(payload.label.external_id),
+        labelUrl: payload.label.url ?? null,
+        status: payload.label.status ?? null,
+        tracking: payload.label.payload?.tracking ?? null
+      } : null
+    };
+  }
+  /** Spends the merchant's balance at the carrier. Never call it on a whim. */
+  async buyShippingLabel(orderId, serviceId, carrier) {
+    const payload = await this.labelCall(orderId, "buy", { serviceId, ...carrier ? { carrier } : {} });
+    return {
+      labelId: String(payload?.labelId ?? ""),
+      labelUrl: payload?.labelUrl ?? null,
+      status: "bought",
+      tracking: payload?.tracking ?? null
+    };
+  }
+  async printShippingLabel(orderId, carrier) {
+    const payload = await this.labelCall(orderId, "print", carrier ? { carrier } : {});
+    return payload?.labelUrl ?? null;
+  }
+  /** Drop-off points near a place. Store configuration — no order involved. */
+  async listShippingAgencies(query) {
+    const tenantId = getTenantId();
+    if (!tenantId) return [];
+    const { ok, payload } = await callShopFunction(getDb(), "shop-shipping-label", {
+      tenantId,
+      action: "agencies",
+      state: query.state ?? "",
+      city: query.city ?? "",
+      ...query.carrier ? { carrier: query.carrier } : {}
+    });
+    if (!ok) throw new Error(payload?.error ?? "A transportadora n\xE3o respondeu agora.");
+    return payload?.agencies ?? [];
+  }
+  async trackShippingLabel(orderId, carrier) {
+    const payload = await this.labelCall(orderId, "track", carrier ? { carrier } : {});
+    return payload?.tracking ?? null;
+  }
+  /**
+   * The customer's address book, for the console. `shop_place_order` files a
+   * new one here on every delivered order, and until now only the storefront
+   * read them back — so a repeat customer had their address retyped by hand.
+   */
+  async listCustomerAddresses(customerId) {
+    if (!asUuid(customerId)) return [];
+    const { data, error } = await getDb().from("addresses").select("id,label,recipient,phone,postal_code,street,number,complement,district,city,state,country,is_default").eq("owner_type", "shop_customer").eq("owner_id", customerId).order("is_default", { ascending: false }).order("created_at", { ascending: false });
+    if (error) return [];
+    return (data ?? []).map((row) => ({
+      id: row.id,
+      label: row.label ?? void 0,
+      recipient: row.recipient ?? void 0,
+      phone: row.phone ?? void 0,
+      postalCode: row.postal_code ?? "",
+      street: row.street ?? "",
+      number: row.number ?? void 0,
+      complement: row.complement ?? void 0,
+      district: row.district ?? void 0,
+      city: row.city ?? "",
+      state: row.state ?? "",
+      country: row.country ?? void 0,
+      isDefault: row.is_default ?? false
+    }));
+  }
+  /**
+   * What delivery costs to a postcode — the same answer the shopper gets.
+   *
+   * The console needs it to quote a price out loud while the customer is on the
+   * line. Carrier first (when the merchant did not turn gateway quotes off),
+   * zones as the fallback, exactly as the storefront resolves it. Advisory
+   * either way: shop_place_order requotes and ignores whatever a client sends.
+   */
+  async quoteShipping(postalCode, subtotal) {
+    const digits = toPostalDigits(postalCode);
+    if (!digits) return [];
+    const tenantId = getTenantId();
+    if (!tenantId) return [];
+    const settings = await this.getStoreSettings().catch(() => null);
+    if (settings?.carrierQuotes !== false) {
+      try {
+        const { ok, payload } = await callShopFunction(getDb(), "shop-shipping-quote", {
+          tenantId,
+          postalCode: digits,
+          subtotal
+        });
+        const rows = ok ? payload?.options ?? [] : [];
+        if (rows.length > 0) {
+          return rows.map((row) => ({
+            zoneId: String(row.service_id ?? ""),
+            name: String(row.name ?? "Entrega"),
+            carrier: row.carrier ?? void 0,
+            rate: Number(row.price ?? 0),
+            baseRate: Number(row.price ?? 0),
+            freeAbove: null,
+            etaMinDays: row.eta_min_days ?? void 0,
+            etaMaxDays: row.eta_max_days ?? void 0,
+            free: Number(row.price ?? 0) === 0
+          }));
+        }
+      } catch {
+      }
+    }
+    const { data, error } = await getDb().rpc("shop_quote_shipping", {
+      p_tenant_id: tenantId,
+      p_postal_code: digits,
+      p_subtotal: subtotal
+    });
+    if (error) return [];
+    return (data ?? []).map((row) => ({
+      zoneId: row.zone_id,
+      name: row.name,
+      carrier: row.carrier ?? void 0,
+      rate: Number(row.rate ?? 0),
+      baseRate: Number(row.base_rate ?? row.rate ?? 0),
+      freeAbove: row.free_above == null ? null : Number(row.free_above),
+      etaMinDays: row.eta_min_days ?? void 0,
+      etaMaxDays: row.eta_max_days ?? void 0,
+      free: Boolean(row.free)
+    }));
+  }
+  /**
+   * Charge a cart that is not an order yet — the phone sale, from the counter's
+   * side. Same door the storefront uses, on purpose: `shop_price_cart` inside
+   * the function reprices everything, so the console sends products and
+   * quantities and never money. The order is born in `settleCheckoutSession`,
+   * once the acquirer says the Pix landed, so an abandoned charge leaves no
+   * ghost order holding stock.
+   */
+  async openCheckoutSession(input) {
+    const tenantId = getTenantId();
+    if (!tenantId) throw new Error("@fayz-ai/shop: openCheckoutSession requires a tenant id.");
+    const provider = String(input.provider ?? "").trim() || "abacatepay";
+    const gateway = checkoutGateway(provider);
+    if (!gateway) {
+      throw new Error("Esta loja ainda n\xE3o tem um meio de cobran\xE7a conectado.");
+    }
+    const { ok, status, payload } = await callShopFunction(getDb(), gateway.open, {
+      tenantId,
+      items: input.items.map((item) => ({
+        productId: item.productId,
+        optionsLabel: item.optionsLabel ?? null,
+        quantity: item.quantity
+      })),
+      customer: input.customer,
+      shippingAddress: input.shippingAddress ?? null,
+      discountCode: input.discountCode ?? null
+    });
+    if (!ok || !payload?.sessionId) {
+      throw new Error(payload?.error ?? (status === 404 ? "Esta loja ainda n\xE3o tem um meio de cobran\xE7a conectado." : "N\xE3o conseguimos abrir a cobran\xE7a agora."));
+    }
+    return {
+      sessionId: payload.sessionId,
+      total: Number(payload.total ?? 0),
+      state: "open",
+      provider,
+      charge: payload.brCode ? {
+        emv: payload.brCode,
+        // AbacatePay embeds the `data:` prefix; the type promises bare
+        // base64. Left in, the view prefixes it again and the QR is a
+        // silently broken <img>.
+        //
+        // Vindi sends no base64 at all — its `qrCodeUrl` is a URL to an SVG,
+        // which cannot be squeezed into this field without lying about what
+        // it is. The buyer still gets the copy-and-paste code, which is what
+        // actually pays; a rendered QR for Vindi waits for the payment view
+        // to learn the second shape.
+        qrcodeBase64: String(payload.brCodeBase64 ?? "").replace(/^data:image\/\w+;base64,/u, "") || null,
+        expiresAt: payload.expiresAt ?? ""
+      } : null
+    };
+  }
+  /**
+   * Ask whether the money landed. Runs on a timer, so a network blip must read
+   * as "still waiting" (`unknown`) and never as a refused payment.
+   *
+   * `provider` names which gateway opened the session — handed back by
+   * `openCheckoutSession` rather than re-read from settings, because a merchant
+   * who switches acquirer mid-checkout would otherwise have the new gateway
+   * asked about a transaction that lives in the old one.
+   */
+  async settleCheckoutSession(sessionId, provider) {
+    const tenantId = getTenantId();
+    if (!tenantId) return { state: "unknown" };
+    const gateway = checkoutGateway(String(provider ?? "").trim() || "abacatepay");
+    if (!gateway) return { state: "unknown" };
+    try {
+      const { ok, payload } = await callShopFunction(getDb(), gateway.settle, { tenantId, sessionId });
+      if (!ok || !payload?.state) return { state: "unknown" };
+      return { state: payload.state, orderId: payload.orderId ?? null, reason: payload.reason ?? null };
+    } catch {
+      return { state: "unknown" };
+    }
+  }
   // Trusted placement — delegates all price/discount/inventory authority to the
   // shop_place_order RPC (SECURITY DEFINER). The browser never sets a price.
   async placeOrder(input) {
@@ -700,7 +1485,12 @@ var SupabaseShopProvider = class {
         country: input.shippingAddress.country ?? "BR",
         recipient: input.shippingAddress.recipient ?? null,
         phone: input.shippingAddress.phone ?? null,
-        label: input.shippingAddress.label ?? null
+        label: input.shippingAddress.label ?? null,
+        // Not an address field: it rides here because shop_place_order's
+        // signature cannot grow without a DROP, and 0050's trigger lifts it to
+        // plg_shop_orders.customer_document. The storefront already sent it;
+        // the console did not, so a phone sale was born with no CPF.
+        document: input.shippingAddress.document ?? null
       } : null,
       p_payment_method: input.paymentMethod ?? null,
       p_notes: input.notes ?? null,
@@ -723,7 +1513,7 @@ var SupabaseShopProvider = class {
     const tenantId = getTenantId();
     let q = db.from(T.customers).select("*").order("first_name", { ascending: true });
     if (tenantId) q = q.eq("tenant_id", tenantId);
-    if (options?.search) q = q.or(`first_name.ilike.%${options.search}%,last_name.ilike.%${options.search}%,email.ilike.%${options.search}%`);
+    for (const filter of customerSearchFilters(options?.search)) q = q.or(filter);
     if (options?.limit) q = q.limit(options.limit);
     const { data, error } = await q;
     if (error) throw error;
@@ -735,7 +1525,15 @@ var SupabaseShopProvider = class {
     return data ? rowToCustomer(data) : null;
   }
   async createCustomer(input) {
-    const { data, error } = await getDb().from(T.customers).insert({ tenant_id: getTenantId(), first_name: input.firstName, last_name: input.lastName ?? "", email: input.email ?? null, phone: input.phone ?? null, notes: input.notes ?? null }).select().single();
+    const { data, error } = await getDb().from(T.customers).insert({
+      tenant_id: getTenantId(),
+      first_name: input.firstName,
+      last_name: input.lastName ?? "",
+      email: input.email ?? null,
+      phone: input.phone ?? null,
+      document: input.document ?? null,
+      notes: input.notes ?? null
+    }).select().single();
     if (error) throw error;
     return rowToCustomer(data);
   }
@@ -745,6 +1543,7 @@ var SupabaseShopProvider = class {
     if (input.lastName !== void 0) updates.last_name = input.lastName;
     if (input.email !== void 0) updates.email = input.email;
     if (input.phone !== void 0) updates.phone = input.phone;
+    if (input.document !== void 0) updates.document = input.document;
     if (input.notes !== void 0) updates.notes = input.notes;
     const { data, error } = await getDb().from(T.customers).update(updates).eq("id", id).select().single();
     if (error) throw error;
@@ -920,22 +1719,6 @@ var SupabaseShopProvider = class {
   async deleteEntityRecord(entity, id) {
     return this.entityStore(entity).delete(id);
   }
-  // Sidecar fields on core records (migration 0031): one row per
-  // (reference, reference_id), validated on write against defineSidecarFields.
-  async getEntityFields(reference, referenceId) {
-    const { data, error } = await getDb().from(SIDECAR_TABLE).select("data").eq("reference", reference).eq("reference_id", referenceId).maybeSingle();
-    if (error) throw error;
-    return data ? data.data ?? {} : null;
-  }
-  async setEntityFields(reference, referenceId, fields) {
-    validateSidecarWrite(reference, fields);
-    const { data, error } = await getDb().from(SIDECAR_TABLE).upsert(
-      { tenant_id: getTenantId(), reference, reference_id: referenceId, data: fields },
-      { onConflict: "tenant_id,reference,reference_id" }
-    ).select("data").single();
-    if (error) throw error;
-    return data.data ?? {};
-  }
   // -------------------------------------------------------------------------
   // Coleções, grupos/segmentos, vale-presente, e-mails e mídia.
   // -------------------------------------------------------------------------
@@ -1130,10 +1913,27 @@ var SupabaseShopProvider = class {
     return rowToEmailTemplate(data);
   }
   async listMediaFiles() {
-    const db = getDb();
     const tenantId = getTenantId();
     if (!tenantId) return [];
-    const bucket = db.storage.from(T.mediaBucket);
+    const [attached, library] = await Promise.all([
+      this.listAttachedMedia(tenantId),
+      this.listLibraryFiles(tenantId)
+    ]);
+    return mergeMediaFiles(attached, library);
+  }
+  /** Every product photo in the store, each one carrying its product. */
+  async listAttachedMedia(tenantId) {
+    const db = getDb();
+    const { data: rows, error } = await db.from(T.productImages).select("id,product_id,url,alt_text,sort_order,is_primary,created_at").eq("tenant_id", tenantId).order("created_at", { ascending: false }).limit(1e3);
+    if (error || !rows?.length) return [];
+    const productIds = [...new Set(rows.map((r) => r.product_id).filter(Boolean))];
+    const { data: products } = await db.from(T.products).select("id,name").in("id", productIds);
+    const nameById = new Map((products ?? []).map((p) => [p.id, p.name]));
+    return rows.map((row) => productImageToMediaFile(rowToImage(row), nameById.get(row.product_id)));
+  }
+  /** What the merchant uploaded straight to the library — owned by nothing. */
+  async listLibraryFiles(tenantId) {
+    const bucket = getDb().storage.from(T.mediaBucket);
     const listAt = async (prefix) => {
       const { data, error } = await bucket.list(prefix, {
         limit: 1e3,
@@ -1143,14 +1943,15 @@ var SupabaseShopProvider = class {
       return (data ?? []).map((entry) => ({ prefix, entry }));
     };
     const top = await listAt(tenantId);
-    const folders = top.filter(({ entry }) => !entry.id).map(({ entry }) => `${tenantId}/${entry.name}`);
+    const folders = top.filter(({ entry }) => !entry.id && entry.name === LIBRARY_FOLDER).map(({ entry }) => `${tenantId}/${entry.name}`);
     const nested = (await Promise.all(folders.map(listAt))).flat();
     return [...top, ...nested].filter(({ entry }) => entry.id).map(({ prefix, entry }) => {
       const path = `${prefix}/${entry.name}`;
       const { data: { publicUrl } } = bucket.getPublicUrl(path);
+      const name = displayNameOf(entry.name);
       const file = {
         id: path,
-        name: entry.name,
+        name,
         url: publicUrl,
         kind: mediaKindOf(entry.name, entry.metadata?.mimetype),
         size: Number(entry.metadata?.size ?? 0),
@@ -1158,13 +1959,13 @@ var SupabaseShopProvider = class {
         createdAt: entry.created_at ?? entry.updated_at ?? ""
       };
       return file;
-    }).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    });
   }
   async uploadMediaFile(file) {
     const db = getDb();
     const tenantId = getTenantId();
     if (!tenantId) throw new Error("@fayz-ai/shop: no active tenant for media upload");
-    const path = `${tenantId}/library/${Date.now()}-${file.name}`;
+    const path = `${tenantId}/${LIBRARY_FOLDER}/${Date.now()}-${file.name}`;
     const bucket = db.storage.from(T.mediaBucket);
     const { error } = await bucket.upload(path, file);
     if (error) throw error;
@@ -1217,6 +2018,70 @@ function createSupabaseShopProvider() {
   return new SupabaseShopProvider();
 }
 
+// src/shipping/label-provider.ts
+var registry = /* @__PURE__ */ new Map();
+function registerShippingLabelProvider(provider) {
+  registry.set(provider.id, provider);
+}
+function listShippingLabelProviders() {
+  return [...registry.values()];
+}
+function resetShippingLabelProviders() {
+  registry.clear();
+}
+function resolveShippingLabelProvider(options) {
+  const { connected, preferred } = options;
+  if (preferred === "") return null;
+  if (preferred) {
+    const chosen = registry.get(preferred);
+    return chosen && connected.includes(preferred) ? chosen : null;
+  }
+  for (const id of connected) {
+    const found = registry.get(id);
+    if (found) return found;
+  }
+  return null;
+}
+
+// src/lib/document.ts
+var documentDigits = (value) => String(value ?? "").replace(/\D/g, "");
+function checkDigit(digits, weights) {
+  const sum = weights.reduce((acc, weight, index) => acc + Number(digits[index]) * weight, 0);
+  const rest = sum % 11;
+  return rest < 2 ? 0 : 11 - rest;
+}
+var CPF_FIRST = [10, 9, 8, 7, 6, 5, 4, 3, 2];
+var CPF_SECOND = [11, 10, 9, 8, 7, 6, 5, 4, 3, 2];
+var CNPJ_FIRST = [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+var CNPJ_SECOND = [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];
+function isValidCpf(value) {
+  const digits = documentDigits(value);
+  if (digits.length !== 11 || /^(\d)\1{10}$/.test(digits)) return false;
+  return checkDigit(digits, CPF_FIRST) === Number(digits[9]) && checkDigit(digits, CPF_SECOND) === Number(digits[10]);
+}
+function isValidCnpj(value) {
+  const digits = documentDigits(value);
+  if (digits.length !== 14 || /^(\d)\1{13}$/.test(digits)) return false;
+  return checkDigit(digits, CNPJ_FIRST) === Number(digits[12]) && checkDigit(digits, CNPJ_SECOND) === Number(digits[13]);
+}
+function documentKind(value) {
+  const length = documentDigits(value).length;
+  if (length === 11) return "cpf";
+  if (length === 14) return "cnpj";
+  return null;
+}
+function isValidDocument(value) {
+  const kind = documentKind(value);
+  return kind === "cpf" ? isValidCpf(value) : kind === "cnpj" ? isValidCnpj(value) : false;
+}
+function formatDocument(value) {
+  const digits = documentDigits(value).slice(0, 14);
+  if (digits.length <= 11) {
+    return digits.replace(/^(\d{3})(\d)/, "$1.$2").replace(/^(\d{3})\.(\d{3})(\d)/, "$1.$2.$3").replace(/\.(\d{3})(\d{1,2})$/, ".$1-$2");
+  }
+  return digits.replace(/^(\d{2})(\d)/, "$1.$2").replace(/^(\d{2})\.(\d{3})(\d)/, "$1.$2.$3").replace(/\.(\d{3})(\d)/, ".$1/$2").replace(/(\d{4})(\d{1,2})$/, "$1-$2");
+}
+
 // src/lib/emails.ts
 var EMAIL_PLACEHOLDERS = [
   "{{store_name}}",
@@ -1406,6 +2271,6 @@ function buildShopMessageDefaults() {
   });
 }
 
-export { EMAIL_PLACEHOLDERS, EMAIL_PREVIEW_SAMPLE, SHOP_EMAIL_EVENTS, SupabaseShopProvider, applyDiscount, buildShopDomainEvents, buildShopMessageDefaults, checkInventory, computeCartTotals, createSupabaseShopProvider, getCustomerOrders, renderEmailTemplate, resolveEmailTemplates, validateDiscount };
+export { CHARGEABLE_PROVIDERS, EMAIL_PLACEHOLDERS, EMAIL_PREVIEW_SAMPLE, SHOP_EMAIL_EVENTS, SupabaseShopProvider, applyDiscount, buildShopDomainEvents, buildShopMessageDefaults, checkInventory, checkoutGateway, computeCartTotals, createSupabaseShopProvider, documentDigits, documentKind, formatDocument, getCustomerOrders, getShopFunctionsUrl, isChargeableProvider, isValidCnpj, isValidCpf, isValidDocument, listShippingLabelProviders, registerShippingLabelProvider, renderEmailTemplate, resetShippingLabelProviders, resolveEmailTemplates, resolveShippingLabelProvider, setShopFunctionsUrl, validateDiscount };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map