@fire-spark/core 0.15.2 → 0.16.0

package/dist/index.js

@@ -1889,6 +1889,34 @@ const resolveBaseUrl = (baseUrl) => {
 	return (baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
 };
 //#endregion
+//#region src/auth/DelegatedSessionExpiredError.ts
+/**
+* A delegated customer session is still active, but its access token was
+* rejected or has expired. The anonymous subject token is not exchanged.
+*/
+var DelegatedSessionExpiredError = class extends Error {
+	code = "DELEGATED_SESSION_EXPIRED";
+	constructor() {
+		super("Delegated customer session expired");
+		this.name = "DelegatedSessionExpiredError";
+	}
+};
+const isDelegatedSessionExpiredError = (error) => {
+	return error instanceof DelegatedSessionExpiredError;
+};
+//#endregion
+//#region src/auth/OrderAuthPinnedError.ts
+/**
+* `Order` was built with an explicit `accessToken`. It cannot follow
+* `auth.switchCustomer`, which swaps the shared auth session.
+*/
+var OrderAuthPinnedError = class extends Error {
+	constructor() {
+		super("This order uses a fixed accessToken and cannot follow auth.switchCustomer");
+		this.name = "OrderAuthPinnedError";
+	}
+};
+//#endregion
 //#region src/auth/exchange.ts
 const exchangeSubjectToken = async (subjectToken, options = {}) => {
 	const base = resolveBaseUrl(options.baseUrl);
@@ -1910,20 +1938,105 @@ const exchangeSubjectToken = async (subjectToken, options = {}) => {
 	if (!json.data?.access_token) throw new Error("Token exchange response missing access_token");
 	return json.data;
 };
+const GRANT = "urn:ietf:params:oauth:grant-type:token-exchange";
+const switchCustomerToken = async (body, options = {}) => {
+	const base = resolveBaseUrl(options.baseUrl);
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const url = `${base}/api/storefront/v1/oauth/exchange`;
+	const payload = {
+		grant_type: GRANT,
+		...body
+	};
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(payload)
+	});
+	if (!response.ok) {
+		const message = await response.text();
+		throw new Error(message || `Token exchange failed (${response.status})`);
+	}
+	const data = (await response.json()).data;
+	if (!data?.access_token || !data.customer_id || !data.order) throw new Error("Token exchange response missing access_token");
+	const order = data.order;
+	return {
+		...data,
+		token_type: "Bearer",
+		order
+	};
+};
 //#endregion
 //#region src/auth/auth.ts
 const DEFAULT_TOKEN_SKEW_MS = 3e4;
+const ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token";
+const PROOF = "urn:fire-spark:params:oauth:token-type:customer-switch-proof";
+const ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
 let state = null;
+const signatureOf = (options) => {
+	return `${options.getAccessToken ? "direct" : "subject"}\n${resolveBaseUrl(options.baseUrl)}\n${options.audience ?? ""}`;
+};
+const decodeJwtPart = (token) => {
+	const part = token.split(".")[1];
+	if (!part) return null;
+	try {
+		const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
+		const pad = b64 + "=".repeat((4 - b64.length % 4) % 4);
+		return JSON.parse(atob(pad));
+	} catch {
+		return null;
+	}
+};
+const decodeJwtSub = (token) => {
+	const payload = decodeJwtPart(token);
+	if (typeof payload?.sub !== "string" || !payload.sub) return null;
+	return payload.sub;
+};
+const emit$1 = (customerId) => {
+	if (!state) return;
+	for (const listener of state.listeners) listener(customerId);
+};
+const dropDelegated = () => {
+	if (!state?.delegated) return false;
+	state.delegated = null;
+	state.accessToken = null;
+	state.expiresAt = 0;
+	return true;
+};
 const configure = (options) => {
+	const signature = signatureOf(options);
+	const current = state;
+	const sameSig = current?.signature === signature;
+	const keep = Boolean(current && sameSig && current.delegated);
+	const listeners = current?.listeners ?? /* @__PURE__ */ new Set();
+	const delegated = keep && current ? current.delegated : null;
+	const accessToken = keep && current ? current.accessToken : null;
+	const expiresAt = keep && current ? current.expiresAt : 0;
+	const getSubjectToken = options.getSubjectToken ?? null;
+	const getDirectToken = options.getAccessToken ?? null;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const tokenSkewMs = options.tokenSkewMs ?? DEFAULT_TOKEN_SKEW_MS;
+	const b1 = {
+		signature,
+		getSubjectToken,
+		getDirectToken,
+		audience: options.audience
+	};
+	const b2 = {
+		baseUrl,
+		fetchImpl,
+		tokenSkewMs,
+		accessToken
+	};
+	const b3 = {
+		expiresAt,
+		delegated,
+		listeners
+	};
 	state = {
-		getSubjectToken: options.getSubjectToken ?? null,
-		getDirectToken: options.getAccessToken ?? null,
-		audience: options.audience,
-		baseUrl: resolveBaseUrl(options.baseUrl),
-		fetchImpl: options.fetchImpl ?? fetch,
-		tokenSkewMs: options.tokenSkewMs ?? DEFAULT_TOKEN_SKEW_MS,
-		accessToken: null,
-		expiresAt: 0
+		...b1,
+		...b2,
+		...b3
 	};
 };
 const getBaseUrl = () => {
@@ -1932,8 +2045,53 @@ const getBaseUrl = () => {
 };
 const clear = () => {
 	if (!state) return;
+	const had = dropDelegated();
 	state.accessToken = null;
 	state.expiresAt = 0;
+	if (had) emit$1(null);
+};
+const isDelegatedSession = () => {
+	return state?.delegated !== null && state?.delegated !== void 0;
+};
+const onCustomerChange = (listener) => {
+	if (!state) {
+		const baseUrl = resolveBaseUrl();
+		const c1 = {
+			signature: "",
+			getSubjectToken: null,
+			getDirectToken: null
+		};
+		const c2 = {
+			audience: void 0,
+			baseUrl,
+			fetchImpl: fetch
+		};
+		const c3 = {
+			tokenSkewMs: DEFAULT_TOKEN_SKEW_MS,
+			accessToken: null
+		};
+		const c4 = {
+			expiresAt: 0,
+			delegated: null,
+			listeners: /* @__PURE__ */ new Set()
+		};
+		state = {
+			...c1,
+			...c2,
+			...c3,
+			...c4
+		};
+	}
+	state.listeners.add(listener);
+	return () => {
+		state?.listeners.delete(listener);
+	};
+};
+/** Drops the delegated token when that order is no longer OPEN. */
+const releaseDelegatedOrder = (orderId) => {
+	if (!state?.delegated || state.delegated.orderId !== orderId) return;
+	dropDelegated();
+	emit$1(null);
 };
 const issueToken = async (current) => {
 	if (current.getDirectToken) return current.getDirectToken();
@@ -1944,15 +2102,100 @@ const issueToken = async (current) => {
 		audience: current.audience
 	});
 };
+const subjectRotated = async (current) => {
+	const actorSub = current.delegated?.actorSub;
+	if (!actorSub || !current.getSubjectToken) return false;
+	const raw = await current.getSubjectToken();
+	const sub = decodeJwtSub(raw);
+	return Boolean(sub && sub !== actorSub);
+};
 const getAccessToken = async () => {
 	if (!state) throw new Error("auth.configure() must be called before getAccessToken()");
 	const now = Date.now();
+	let rotated = false;
+	if (state.delegated) {
+		rotated = await subjectRotated(state);
+		if (rotated) dropDelegated();
+		else if (state.delegated.expiresAt > now + state.tokenSkewMs) return state.delegated.accessToken;
+		else throw new DelegatedSessionExpiredError();
+	}
 	if (state.accessToken && state.expiresAt > now + state.tokenSkewMs) return state.accessToken;
 	const issued = await issueToken(state);
 	state.accessToken = issued.access_token;
 	state.expiresAt = now + issued.expires_in * 1e3;
+	if (rotated) emit$1(null);
 	return state.accessToken;
 };
+const orderIdFromProof = (token) => {
+	const payload = decodeJwtPart(token);
+	if (typeof payload?.order_id !== "string" || !payload.order_id) throw new Error("Customer switch proof is invalid");
+	return payload.order_id;
+};
+const isIdToken = (input) => {
+	if (typeof input === "string" || !("type" in input)) return false;
+	return input.type === "id_token";
+};
+const proofOf = (input) => {
+	if (typeof input === "string") return {
+		token: input,
+		orderId: orderIdFromProof(input)
+	};
+	if (isIdToken(input)) return null;
+	const token = input.customer_switch_proof;
+	if (!token) throw new Error("Masivo verify did not return a customer switch proof");
+	return {
+		token,
+		orderId: orderIdFromProof(token)
+	};
+};
+const switchCustomer = async (input) => {
+	if (!state) throw new Error("auth.configure() must be called before switchCustomer()");
+	const actorToken = await getAccessToken();
+	let actorSub = null;
+	if (state.getSubjectToken) {
+		const raw = await state.getSubjectToken();
+		actorSub = decodeJwtSub(raw);
+	}
+	const proof = proofOf(input);
+	const idToken = isIdToken(input) ? input : null;
+	const subject_token = proof ? proof.token : idToken?.token;
+	const orderId = proof ? proof.orderId : idToken?.orderId;
+	if (!subject_token || !orderId) throw new Error("Customer switch proof is invalid");
+	const subject_token_type = proof ? PROOF : ID_TOKEN;
+	const b1 = {
+		actor_token: actorToken,
+		actor_token_type: ACCESS_TOKEN
+	};
+	const b2 = {
+		subject_token,
+		subject_token_type,
+		order_id: orderId
+	};
+	const result = await switchCustomerToken({
+		...b1,
+		...b2
+	}, {
+		baseUrl: state.baseUrl,
+		fetchImpl: state.fetchImpl
+	});
+	const expiresAt = Date.now() + result.expires_in * 1e3;
+	const d1 = {
+		accessToken: result.access_token,
+		expiresAt
+	};
+	const d2 = {
+		actorSub,
+		orderId
+	};
+	state.delegated = {
+		...d1,
+		...d2
+	};
+	state.accessToken = result.access_token;
+	state.expiresAt = expiresAt;
+	emit$1(result.customer_id);
+	return result;
+};
 //#endregion
 //#region src/auth/index.ts
 const auth = {
@@ -1961,7 +2204,11 @@ const auth = {
 	getBaseUrl,
 	clear,
 	exchangeSubjectToken,
-	resolveBaseUrl
+	resolveBaseUrl,
+	switchCustomer,
+	isDelegatedSession,
+	onCustomerChange,
+	releaseDelegatedOrder
 };
 //#endregion
 //#region src/order/customer.ts
@@ -2239,6 +2486,7 @@ const resolveAccessToken = async (options) => {
 const withAuthRetry = async (options, run) => {
 	const response = await run(await resolveAccessToken(options));
 	if (response.status !== 401 || options.accessToken) return response;
+	if (auth.isDelegatedSession()) throw new DelegatedSessionExpiredError();
 	auth.clear();
 	return run(await resolveAccessToken(options));
 };
@@ -2358,11 +2606,11 @@ const getCmsBlock = (name, options) => {
 };
 //#endregion
 //#region src/services/customers.ts
-const customerPath = (id) => {
+const customerPath$1 = (id) => {
 	return `/api/storefront/v1/customers/${encodeURIComponent(id)}`;
 };
 const getCustomer = (id, options) => {
-	return storefrontJson(customerPath(id), {}, options);
+	return storefrontJson(customerPath$1(id), {}, options);
 };
 const createCustomer = (body, options) => {
 	return storefrontJson("/api/storefront/v1/customers", {
@@ -2371,19 +2619,19 @@ const createCustomer = (body, options) => {
 	}, options);
 };
 const identifyAnonymousCustomer = (id, body, options) => {
-	return storefrontJson(`${customerPath(id)}/identify/anonymous`, {
+	return storefrontJson(`${customerPath$1(id)}/identify/anonymous`, {
 		method: "PATCH",
 		body: JSON.stringify(body)
 	}, options);
 };
 const updateCustomer = (id, body, options) => {
-	return storefrontJson(customerPath(id), {
+	return storefrontJson(customerPath$1(id), {
 		method: "PATCH",
 		body: JSON.stringify(body)
 	}, options);
 };
 const deleteCustomer = (id, options) => {
-	return storefrontVoid(customerPath(id), { method: "DELETE" }, options);
+	return storefrontVoid(customerPath$1(id), { method: "DELETE" }, options);
 };
 //#endregion
 //#region src/services/fulfillment.ts
@@ -2565,6 +2813,22 @@ const fetchKioskRealtimeToken = async (input, options) => {
 	return (await response.json()).data;
 };
 //#endregion
+//#region src/services/masivo.ts
+const VERIFY_PATH = "/api/storefront/v1/masivo/totp/verify";
+const CREATE_PATH = "/api/storefront/v1/masivo/totp";
+const verifyMasivoTotp = (input, options) => {
+	const params = new URLSearchParams({ code: input.code });
+	if (input.order_id) params.set("order_id", input.order_id);
+	return storefrontJson(`${VERIFY_PATH}?${params.toString()}`, {}, options);
+};
+const createMasivoTotp = (input, options) => {
+	const init = {
+		method: "POST",
+		body: JSON.stringify({ customer_id: input.customer_id })
+	};
+	return storefrontJson(CREATE_PATH, init, options);
+};
+//#endregion
 //#region src/services/menus.ts
 const menuQuery = (scope, stream) => {
 	const params = new URLSearchParams();
@@ -2741,6 +3005,36 @@ const updateOrder = (id, body, options) => {
 		options
 	]);
 };
+const customerPath = (id) => `${orderPath(id)}/customer`;
+/**
+* `PUT /storefront/v1/orders/:id/customer`. Copies that customer onto the
+* open order. `409` `ORDER_NOT_OPEN` when the order is not `OPEN`. `404`
+* `CUSTOMER_NOT_FOUND` when the customer does not exist. `409`
+* `ORDER_OPEN_SCOPE_TAKEN` when they already have an open cart in scope.
+*/
+const setOrderCustomer = (id, body, options) => {
+	const init = {
+		method: "PUT",
+		body: JSON.stringify(body)
+	};
+	return storefrontJson(...[
+		customerPath(id),
+		init,
+		options
+	]);
+};
+/**
+* `DELETE /storefront/v1/orders/:id/customer`. Makes the open order
+* anonymous and clears the customer snapshot. `customer_id` stays.
+* `409` `ORDER_NOT_OPEN` when the order is not `OPEN`.
+*/
+const clearOrderCustomer = (id, options) => {
+	return storefrontJson(...[
+		customerPath(id),
+		{ method: "DELETE" },
+		options
+	]);
+};
 const postCancel = (path, options, body) => {
 	const method = "POST";
 	if (!body) return storefrontJson(path, { method }, options);
@@ -3231,11 +3525,17 @@ const services = {
 		get: listMenus,
 		stream: listMenusStream
 	},
+	masivo: {
+		verifyTotp: verifyMasivoTotp,
+		createTotp: createMasivoTotp
+	},
 	orders: {
 		list: listOrders,
 		post: createOrder,
 		get: getOrder,
 		patch: updateOrder,
+		setCustomer: setOrderCustomer,
+		clearCustomer: clearOrderCustomer,
 		cancel: cancelOrder,
 		refund: refundOrder,
 		reorder: reorderOrder,
@@ -3457,6 +3757,22 @@ const isGenId = (value) => {
 	return HASH_RUN.test(value);
 };
 //#endregion
+//#region src/order/OrderNotOpenError.ts
+/**
+* The order is not `OPEN` (`CLOSED`, `COMPLETED`, `VOIDED`, `REVERSED`,
+* `REFUNDED`, or legacy `CANCELLED`). Same code as the storefront API's
+* `409`, so callers map both the same way.
+*/
+var OrderNotOpenError = class extends StorefrontHttpError {
+	constructor(status = 409, details = null) {
+		super("Order is not open", status, "ORDER_NOT_OPEN", details ?? { code: "ORDER_NOT_OPEN" });
+		this.name = "OrderNotOpenError";
+	}
+};
+const isOrderNotOpenError = (error) => {
+	return error instanceof OrderNotOpenError;
+};
+//#endregion
 //#region src/order/OrderPaymentRequiredError.ts
 /**
 * `placeOrder` has no real tender (no `payment`, no `setTenders`, no
@@ -3555,6 +3871,7 @@ const withExponentialRetry = async (run, options = {}) => {
 		return await run();
 	} catch (error) {
 		lastError = error;
+		if ((error.code ?? "").startsWith("SCHEDULED_AT_")) throw error;
 		if (attempt === extraAttempts) break;
 		await sleep(baseDelayMs * 2 ** attempt);
 	}
@@ -3580,6 +3897,24 @@ var OrderSyncRejectedError = class extends StorefrontHttpError {
 		this.name = "OrderSyncRejectedError";
 	}
 };
+const sameSlot = (left, right) => {
+	if (left === right) return true;
+	if (!left || !right) return false;
+	return Date.parse(left) === Date.parse(right);
+};
+const SCHEDULED_AT_ERROR_CODES = [
+	"ORDER_NOT_OPEN",
+	"SCHEDULED_AT_IN_PAST",
+	"SCHEDULED_AT_BEFORE_LEAD",
+	"SCHEDULED_AT_BEYOND_HORIZON",
+	"SCHEDULED_AT_INVALID_SLOT",
+	"SCHEDULED_AT_STORE_CLOSED"
+];
+const isScheduledAtError = (error) => {
+	if (!(error instanceof StorefrontHttpError)) return false;
+	const code = error.code ?? "";
+	return SCHEDULED_AT_ERROR_CODES.some((item) => item === code);
+};
 const createFlushController = (runtime) => {
 	let timer = null;
 	let inFlight = false;
@@ -3594,7 +3929,7 @@ const createFlushController = (runtime) => {
 		pending = false;
 		rejected = null;
 	};
-	const patchBody = (order) => {
+	const patchBody = (order, synced) => {
 		const b1 = {
 			store_id: order.store_id,
 			channel_id: order.channel_id
@@ -3613,13 +3948,17 @@ const createFlushController = (runtime) => {
 			redeem: order.redeem
 		};
 		const b6 = { redemption_steps: order.redemption_steps };
+		const nextSlot = order.scheduled_at ?? null;
+		const prevSlot = synced.scheduled_at ?? null;
+		const slot = sameSlot(nextSlot, prevSlot) ? {} : { scheduled_at: nextSlot };
 		return {
 			...b1,
 			...b2,
 			...b3,
 			...b4,
 			...b5,
-			...b6
+			...b6,
+			...slot
 		};
 	};
 	const insertBody = (order) => {
@@ -3643,6 +3982,7 @@ const createFlushController = (runtime) => {
 		};
 		const b7 = { redeem: order.redeem };
 		const b8 = { redemption_steps: order.redemption_steps };
+		const slot = order.scheduled_at ? { scheduled_at: order.scheduled_at } : {};
 		return {
 			...b1,
 			...b2,
@@ -3651,7 +3991,8 @@ const createFlushController = (runtime) => {
 			...b5,
 			...b6,
 			...b7,
-			...b8
+			...b8,
+			...slot
 		};
 	};
 	const flushNow = () => {
@@ -3704,9 +4045,10 @@ const createFlushController = (runtime) => {
 		try {
 			const updated = await withExponentialRetry(() => {
 				if (!wasPersisted) return services.orders.post(insertBody(payload), runtime.http);
+				const body = patchBody(payload, batchBase);
 				const p1 = [
 					payload.id,
-					patchBody(payload),
+					body,
 					runtime.http
 				];
 				return services.orders.patch(...p1);
@@ -5093,51 +5435,65 @@ const DAY_OF_WEEK = [
 	"friday",
 	"saturday"
 ];
-const timeToMinutes = (time) => {
+const timeToMinutes$1 = (time) => {
 	const [hours = "0", minutes = "0"] = time.split(":");
 	return Number(hours) * 60 + Number(minutes);
 };
-const hasSpecificDates = (period) => {
+const hasSpecificDates$1 = (period) => {
 	return period.start_date != null && period.end_date != null;
 };
-const periodCoversDate = (period, now) => {
-	if (!hasSpecificDates(period)) return false;
+const periodCoversDate$1 = (period, now) => {
+	if (!hasSpecificDates$1(period)) return false;
 	const nowMs = now.getTime();
 	const startMs = Date.parse(period.start_date);
 	const endMs = Date.parse(period.end_date);
 	if (Number.isNaN(startMs) || Number.isNaN(endMs)) return false;
 	return startMs <= nowMs && nowMs <= endMs;
 };
-const timeMatches = (period, now) => {
+/**
+* `end <= start` is an overnight or full-day window on the day it starts:
+* 18:00–02:00 matches from 18:00 onward, 10:00–00:00 until midnight,
+* 00:00–00:00 the whole day. The next morning is `isWrapTail`.
+*/
+const timeMatches$1 = (period, now) => {
 	if (!period.start_time || !period.end_time) return false;
 	const nowMinutes = now.getHours() * 60 + now.getMinutes();
-	const start = timeToMinutes(period.start_time);
-	const end = timeToMinutes(period.end_time);
+	const start = timeToMinutes$1(period.start_time);
+	const end = timeToMinutes$1(period.end_time);
+	if (end <= start) return nowMinutes >= start;
 	return nowMinutes >= start && nowMinutes < end;
 };
-const isClosedAt = (period, now) => {
+const isClosedAt$1 = (period, now) => {
 	if (!period.closed) return false;
 	if (!period.start_time || !period.end_time) return true;
-	return timeMatches(period, now);
+	return timeMatches$1(period, now);
 };
-const isOpenAt = (period, now) => {
+const isOpenAt$1 = (period, now) => {
 	if (period.closed) return false;
-	return timeMatches(period, now);
+	return timeMatches$1(period, now);
 };
-const isPeriodsActiveAt = (periods, now) => {
-	return getOpenPeriodAt(periods, now) != null;
+const isPeriodsActiveAt = (periods, now, span = now) => {
+	return getOpenPeriodAt$1(periods, now, span) != null;
 };
-const getOpenPeriodAt = (periods, now) => {
+const getOpenPeriodAt$1 = (periods, now, span = now) => {
 	if (periods.length === 0) return null;
 	const coveringSpecific = periods.filter((period) => {
-		return periodCoversDate(period, now);
+		return periodCoversDate$1(period, span);
 	});
-	const fallback = periods.filter((period) => !hasSpecificDates(period));
+	const fallback = periods.filter((period) => !hasSpecificDates$1(period));
 	const specificOpens = coveringSpecific.filter((period) => !period.closed);
-	if (coveringSpecific.filter((period) => period.closed).some((period) => isClosedAt(period, now))) return null;
-	if (specificOpens.length > 0) return specificOpens.find((period) => isOpenAt(period, now)) ?? null;
-	if (fallback.some((period) => isClosedAt(period, now))) return null;
-	return fallback.filter((period) => !period.closed).find((period) => isOpenAt(period, now)) ?? null;
+	if (coveringSpecific.filter((period) => period.closed).some((period) => isClosedAt$1(period, now))) return null;
+	if (specificOpens.length > 0) return specificOpens.find((period) => isOpenAt$1(period, now)) ?? null;
+	if (fallback.some((period) => isClosedAt$1(period, now))) return null;
+	return fallback.filter((period) => !period.closed).find((period) => isOpenAt$1(period, now)) ?? null;
+};
+/** Next-morning slice of a window whose end is before or at its start. */
+const isWrapTail = (period, nowMinutes) => {
+	if (!period.start_time || !period.end_time) return false;
+	const start = timeToMinutes$1(period.start_time);
+	const end = timeToMinutes$1(period.end_time);
+	if (end > start || end === 0) return false;
+	return nowMinutes < end;
 };
 const atTimeOnDate = (day, time) => {
 	const [hours = "0", minutes = "0"] = time.split(":");
@@ -5146,80 +5502,213 @@ const atTimeOnDate = (day, time) => {
 	return next;
 };
 const isWithinPeriodDates = (period, instantMs) => {
-	if (!hasSpecificDates(period)) return true;
+	if (!hasSpecificDates$1(period)) return true;
 	const startMs = Date.parse(period.start_date);
 	const endMs = Date.parse(period.end_date);
 	if (Number.isNaN(startMs) || Number.isNaN(endMs)) return false;
 	return startMs <= instantMs && instantMs <= endMs;
 };
-const dayPeriods = (schedule, instant) => {
-	const day = DAY_OF_WEEK[instant.getDay()];
+const previousWeekday = (now) => {
+	return DAY_OF_WEEK[(now.getDay() + 6) % 7];
+};
+const yesterdayPeriods = (schedule, now) => {
+	const day = previousWeekday(now);
 	if (!day) return [];
 	return schedule.find((row) => row.day_of_week === day)?.periods ?? [];
 };
-const getActiveUntil = (periods, now) => {
-	const open = getOpenPeriodAt(periods, now);
+const splitPeriods = (periods, span) => {
+	const specific = periods.filter((period) => periodCoversDate$1(period, span)).filter((period) => hasSpecificDates$1(period));
+	return {
+		specific,
+		fallback: periods.filter((period) => !hasSpecificDates$1(period)),
+		specificOpens: specific.filter((period) => !period.closed)
+	};
+};
+/** Yesterday's closed overnight window still covers this morning. */
+const yesterdayClosedWrap = (schedule, now, span = now) => {
+	const periods = yesterdayPeriods(schedule, now);
+	const minutes = now.getHours() * 60 + now.getMinutes();
+	const { specific, fallback, specificOpens } = splitPeriods(periods, span);
+	const closedTail = (band) => {
+		return band.some((period) => period.closed && isWrapTail(period, minutes));
+	};
+	if (closedTail(specific)) return true;
+	if (specificOpens.length > 0) return false;
+	return closedTail(fallback);
+};
+/**
+* Open minutes after midnight that belong to yesterday's overnight window.
+* A dated open on that day replaces the everyday hours.
+*/
+const yesterdayOpenUntil = (schedule, now, span = now) => {
+	const periods = yesterdayPeriods(schedule, now);
+	const minutes = now.getHours() * 60 + now.getMinutes();
+	const { specific, fallback, specificOpens } = splitPeriods(periods, span);
+	if (specific.some((period) => isClosedAt$1(period, now))) return null;
+	const band = specificOpens.length > 0 ? specificOpens : null;
+	const pool = band ?? fallback.filter((period) => !period.closed);
+	if (!band && fallback.some((period) => isClosedAt$1(period, now))) return null;
+	const open = pool.find((period) => isWrapTail(period, minutes));
+	if (!open?.end_time) return null;
+	return atTimeOnDate(now, open.end_time);
+};
+const rollsToNextDay = (period) => {
+	if (!period.start_time || !period.end_time) return false;
+	const start = timeToMinutes$1(period.start_time);
+	return timeToMinutes$1(period.end_time) <= start;
+};
+const getActiveUntil = (periods, now, span = now) => {
+	const open = getOpenPeriodAt$1(periods, now, span);
 	if (!open?.end_time) return null;
-	let untilMs = atTimeOnDate(now, open.end_time).getTime();
-	const openIsSpecific = hasSpecificDates(open);
+	const end = atTimeOnDate(now, open.end_time);
+	const until = new Date(end);
+	if (rollsToNextDay(open)) until.setDate(until.getDate() + 1);
+	let untilMs = until.getTime();
+	const openIsSpecific = hasSpecificDates$1(open);
 	for (const period of periods) {
 		if (!period.closed || !period.start_time) continue;
 		const closeMs = atTimeOnDate(now, period.start_time).getTime();
 		if (closeMs <= now.getTime() || closeMs >= untilMs) continue;
 		if (!isWithinPeriodDates(period, closeMs)) continue;
-		if (!hasSpecificDates(period) && openIsSpecific) continue;
+		if (!hasSpecificDates$1(period) && openIsSpecific) continue;
 		untilMs = closeMs;
 	}
 	return new Date(untilMs);
 };
+const dayPeriods$2 = (schedule, instant) => {
+	const day = DAY_OF_WEEK[instant.getDay()];
+	if (!day) return [];
+	return schedule.find((row) => row.day_of_week === day)?.periods ?? [];
+};
+const closedNow$1 = (periods, now, span = now) => {
+	return periods.some((period) => {
+		if (!period.closed) return false;
+		if (hasSpecificDates$1(period) && !periodCoversDate$1(period, span)) return false;
+		return isClosedAt$1(period, now);
+	});
+};
+/** Active at `now`, including yesterday's overnight tail or closed wrap. */
+const scheduleActiveAt = (schedule, now, span = now) => {
+	if (yesterdayClosedWrap(schedule, now, span)) return false;
+	const periods = dayPeriods$2(schedule, now);
+	if (isPeriodsActiveAt(periods, now, span)) return true;
+	if (closedNow$1(periods, now, span)) return false;
+	return yesterdayOpenUntil(schedule, now, span) != null;
+};
 const getNextStart = (schedule, now) => {
 	const nowMs = now.getTime();
 	let nextStartMs = null;
-	const consider = (candidate, periods) => {
+	const consider = (candidate) => {
 		const startMs = candidate.getTime();
 		if (startMs <= nowMs) return;
-		if (!isPeriodsActiveAt(periods, candidate)) return;
+		if (!scheduleActiveAt(schedule, candidate)) return;
 		if (nextStartMs === null || startMs < nextStartMs) nextStartMs = startMs;
 	};
-	for (let dayOffset = 0; dayOffset < 8; dayOffset += 1) {
+	for (let dayOffset = -1; dayOffset < 8; dayOffset += 1) {
 		const candidateDate = new Date(now);
 		candidateDate.setDate(candidateDate.getDate() + dayOffset);
 		candidateDate.setSeconds(0, 0);
-		const periods = dayPeriods(schedule, candidateDate);
+		const periods = dayPeriods$2(schedule, candidateDate);
 		if (periods.length === 0) continue;
 		for (const period of periods) {
 			if (period.closed || !period.start_time) continue;
 			const start = atTimeOnDate(candidateDate, period.start_time);
 			if (!isWithinPeriodDates(period, start.getTime())) continue;
-			consider(start, periods);
+			consider(start);
 		}
 		for (const period of periods) {
 			if (!period.closed || !period.end_time) continue;
 			const reopen = atTimeOnDate(candidateDate, period.end_time);
+			if (rollsToNextDay(period)) reopen.setDate(reopen.getDate() + 1);
 			if (!isWithinPeriodDates(period, reopen.getTime())) continue;
-			consider(reopen, periods);
+			consider(reopen);
 		}
 	}
 	return nextStartMs === null ? null : new Date(nextStartMs);
 };
+const safeTimeZone$1 = (timeZone) => {
+	try {
+		Intl.DateTimeFormat("en-US", { timeZone });
+		return timeZone;
+	} catch {
+		return "UTC";
+	}
+};
+/** Local getters of the returned Date match the wall clock in `timeZone`. */
+const wallClockDate$1 = (instant, timeZone) => {
+	const zone = safeTimeZone$1(timeZone);
+	const date = {
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit"
+	};
+	const time = {
+		hour: "2-digit",
+		minute: "2-digit"
+	};
+	const sec = {
+		second: "2-digit",
+		hourCycle: "h23"
+	};
+	const opts = {
+		timeZone: zone,
+		...date,
+		...time,
+		...sec
+	};
+	const parts = new Intl.DateTimeFormat("en-US", opts).formatToParts(instant);
+	const read = (type) => {
+		const part = parts.find((item) => item.type === type);
+		return Number(part?.value ?? 0);
+	};
+	let year = read("year");
+	let month = read("month");
+	let day = read("day");
+	let hour = read("hour");
+	if (hour === 24) {
+		hour = 0;
+		const next = new Date(Date.UTC(year, month - 1, day + 1));
+		year = next.getUTCFullYear();
+		month = next.getUTCMonth() + 1;
+		day = next.getUTCDate();
+	}
+	const ymd = [
+		year,
+		month - 1,
+		day
+	];
+	const hms = [
+		hour,
+		read("minute"),
+		read("second")
+	];
+	return new Date(...ymd, ...hms);
+};
 /** Whether `schedule` is in hours now, and until / next open. */
-const getScheduleWindow = (schedule, now = /* @__PURE__ */ new Date()) => {
+const getScheduleWindow = (schedule, now = /* @__PURE__ */ new Date(), span) => {
 	if (schedule == null) return {
 		active: true,
 		until: null
 	};
-	const periods = dayPeriods(schedule, now);
-	if (isPeriodsActiveAt(periods, now)) return {
+	const covers = span ?? now;
+	if (!scheduleActiveAt(schedule, now, covers)) return {
+		active: false,
+		next: getNextStart(schedule, now)
+	};
+	const periods = dayPeriods$2(schedule, now);
+	if (isPeriodsActiveAt(periods, now, covers)) return {
 		active: true,
-		until: getActiveUntil(periods, now)
+		until: getActiveUntil(periods, now, covers)
 	};
 	return {
-		active: false,
-		next: getNextStart(schedule, now)
+		active: true,
+		until: yesterdayOpenUntil(schedule, now, covers)
 	};
 };
-const isOnSchedule = (schedule, now) => {
-	return getScheduleWindow(schedule, now).active;
+const isOnSchedule = (schedule, now, timeZone) => {
+	const instant = now ?? /* @__PURE__ */ new Date();
+	const clock = timeZone ? wallClockDate$1(instant, timeZone) : instant;
+	return getScheduleWindow(schedule, clock, timeZone ? instant : void 0).active;
 };
 //#endregion
 //#region src/order/recommendations.ts
@@ -5766,6 +6255,25 @@ const buildLocalDraft = (insert) => {
 const sameBrand = (left, right) => {
 	return (optionalBrandId(left) ?? null) === (optionalBrandId(right) ?? null);
 };
+const proofToken = (proof) => {
+	if (typeof proof === "string") return proof;
+	if ("type" in proof) return null;
+	return proof.customer_switch_proof ?? null;
+};
+/** Order id carried by a switch proof. Null for an ID token or a bad proof. */
+const proofOrderId = (proof) => {
+	const part = proofToken(proof)?.split(".")[1];
+	if (!part) return null;
+	try {
+		const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
+		const pad = b64 + "=".repeat((4 - b64.length % 4) % 4);
+		const payload = JSON.parse(atob(pad));
+		if (typeof payload.order_id !== "string" || !payload.order_id) return null;
+		return payload.order_id;
+	} catch {
+		return null;
+	}
+};
 /** Newest OPEN order for customer + scope, if any. */
 const findOpenOrder = async (scope, http) => {
 	const brandId = optionalBrandId(scope.brand_id);
@@ -6173,6 +6681,72 @@ var Order = class Order {
 		};
 		this.scheduleAfterMutate();
 	}
+	async commitCustomer(run) {
+		await this.persist();
+		await this.flush.settle();
+		if (this.deleted) return this.getOrder();
+		try {
+			const next = await run();
+			this.applyServerOrder(next);
+		} catch (error) {
+			if (error instanceof StorefrontHttpError && error.code === "ORDER_NOT_OPEN") throw new OrderNotOpenError(error.status, error.details);
+			throw error;
+		}
+		return this.getOrder();
+	}
+	/**
+	* Replaces the customer on this open order. The server copies that
+	* customer's profile onto the order and sets `customer_id` and
+	* `is_anonymous` from the customer. Rejects with `OrderNotOpenError`
+	* (`409`, `details.code` `ORDER_NOT_OPEN`) when the order is not `OPEN`
+	* (`CLOSED`, `COMPLETED`, `VOIDED`, `REVERSED`, `REFUNDED`, or legacy
+	* `CANCELLED`). `404` `CUSTOMER_NOT_FOUND` when that customer does not
+	* exist. `409` `ORDER_OPEN_SCOPE_TAKEN` when they already have an open
+	* cart for this store, channel, fulfillment, and brand.
+	*
+	* After a different `customer_id`, the order belongs to that customer.
+	* Later calls need their storefront access token.
+	*/
+	async setCustomer(customerId) {
+		if (this.deleted) return this.getOrder();
+		const body = { customer_id: customerId };
+		const run = () => {
+			const id = this.draft.id;
+			return services.orders.setCustomer(id, body, this.http);
+		};
+		return this.commitCustomer(run);
+	}
+	/**
+	* Makes this open order anonymous: `is_anonymous` becomes true and the
+	* customer snapshot is cleared to guest placeholders. `customer_id`
+	* stays the authenticated owner. Rejects with `OrderNotOpenError`
+	* (`409`, `ORDER_NOT_OPEN`) when the order is not `OPEN`.
+	*/
+	async clearCustomer() {
+		if (this.deleted) return this.getOrder();
+		const run = () => {
+			const id = this.draft.id;
+			return services.orders.clearCustomer(id, this.http);
+		};
+		return this.commitCustomer(run);
+	}
+	/**
+	* Moves this open order to the customer proved by `proof` and keeps
+	* the returned order on this instance. Requires `auth.configure()`
+	* without a fixed `accessToken` on this order.
+	*/
+	async switchCustomer(proof) {
+		if (this.http.accessToken) throw new OrderAuthPinnedError();
+		const bound = proofOrderId(proof);
+		if (bound && bound !== this.draft.id) throw new Error("Customer switch proof is for a different order");
+		const arg = typeof proof === "object" && "type" in proof && proof.type === "id_token" ? {
+			...proof,
+			orderId: this.draft.id
+		} : proof;
+		const result = await auth.switchCustomer(arg);
+		this.applyServerOrder(result.order);
+		return this.getOrder();
+	}
 	async cancelOrder() {
 		if (this.deleted) return;
 		this.flush.cancel();
@@ -6201,6 +6775,7 @@ var Order = class Order {
 		}
 		this.deleted = true;
 		this.notify();
+		auth.releaseDelegatedOrder(this.draft.id);
 	}
 	/**
 	* Reopens this placed, unpaid order: the server voids every payment
@@ -6246,6 +6821,7 @@ var Order = class Order {
 		this.synced = cloneOrder(next);
 		this.deleted = true;
 		this.notify();
+		auth.releaseDelegatedOrder(this.draft.id);
 	}
 	async validateOrder() {
 		const draft = this.getOrder();
@@ -6329,6 +6905,7 @@ var Order = class Order {
 		this.replaceDraft(cloneOrder(next));
 		this.synced = cloneOrder(next);
 		this.notify();
+		if (next.status !== "OPEN") auth.releaseDelegatedOrder(next.id);
 	}
 	/** Keeps the applied redeems while the server holds the same capped ones. */
 	replaceDraft(next) {
@@ -6583,6 +7160,15 @@ var Order = class Order {
 		this.notify();
 		this.flush.schedule();
 	}
+	/** Sets or clears the pickup time on an open order. */
+	setScheduledAt(scheduledAt) {
+		this.draft = {
+			...this.draft,
+			scheduled_at: scheduledAt
+		};
+		this.scheduleAfterMutate();
+		return this.getOrder();
+	}
 	notify() {
 		this.externalNotify?.();
 		this.listeners.forEach((listener) => listener());
@@ -7776,7 +8362,7 @@ const checkRootProductQuantities = (roots, lookup, out) => {
 		}
 	}
 };
-const validateProductRoot = (root, lines, lookup, locale, out) => {
+const validateProductRoot = (root, lines, lookup, locale, out, at, timeZone) => {
 	const product = lookup.productsById[root.id];
 	if (!product) {
 		pushLineIssue(out, root.uid, { code: "PRODUCT_NOT_FOUND" });
@@ -7790,7 +8376,8 @@ const validateProductRoot = (root, lines, lookup, locale, out) => {
 	const status = product.availability.status;
 	if (status === "HIDDEN") pushLineIssue(out, root.uid, { code: "HIDDEN" });
 	if (status === "OUT_OF_STOCK") pushLineIssue(out, root.uid, { code: "OUT_OF_STOCK" });
-	if (!isOnSchedule(product.availability.schedules)) pushLineIssue(out, root.uid, { code: "OUTSIDE_HOURS" });
+	const hours = product.availability.schedules;
+	if (!isOnSchedule(hours, at, timeZone)) pushLineIssue(out, root.uid, { code: "OUTSIDE_HOURS" });
 	collectUnmatchedModifiers(lines, lookup, root.id, root.uid, out);
 	let expected;
 	if (needsSlotPlacement(lines, root.uid, lookup)) {
@@ -8024,6 +8611,8 @@ const compareRootGroups = (submitted, expected, out) => {
 /** Compare cart lines/totals against a fresh menu (exact Big.js equality). */
 const validateOrderAgainstMenu = (input) => {
 	const locale = input.locale ?? "en_us";
+	const at = input.scheduleAt ?? /* @__PURE__ */ new Date();
+	const zone = input.timeZone;
 	const issues = [];
 	const lineIssues = {};
 	if (!input.menu) return {
@@ -8048,7 +8637,18 @@ const validateOrderAgainstMenu = (input) => {
 			checkFeeSelfConsistency(root, lineIssues);
 			continue;
 		}
-		validateProductRoot(root, menuLines, lookup, locale, lineIssues);
+		const p1 = [
+			root,
+			menuLines,
+			lookup,
+			locale
+		];
+		const p2 = [
+			lineIssues,
+			at,
+			zone
+		];
+		validateProductRoot(...p1, ...p2);
 	}
 	checkRootProductQuantities(roots, lookup, lineIssues);
 	if (input.expectedFeeLines) compareExpectedFeeLines(input.lines, input.expectedFeeLines, lineIssues);
@@ -8156,229 +8756,8 @@ const collectOrderLineDiffs = (input) => {
 	return diffs;
 };
 //#endregion
-//#region src/logs/serializeError.ts
-const UNKNOWN_MESSAGE = "Unknown error";
-const MAX_CAUSE_DEPTH = 3;
-const safeStringify = (value) => {
-	try {
-		const json = JSON.stringify(value);
-		return json === void 0 ? String(value) : json;
-	} catch {
-		return String(value);
-	}
-};
-const messageOf = (value) => {
-	if (value instanceof Error) return value.message || value.name;
-	if (typeof value === "string") return value;
-	if (value && typeof value === "object" && "message" in value) {
-		const message = value.message;
-		if (typeof message === "string") return message;
-	}
-	if (value === void 0) return "";
-	return safeStringify(value);
-};
-/** `TypeError: boom ← caused by: Error: socket closed` style chain. */
-const describeCause = (cause, depth = 0) => {
-	if (cause instanceof Error) {
-		const head = `${cause.name}: ${cause.message}`;
-		const inner = cause.cause;
-		if (inner === void 0 || depth >= MAX_CAUSE_DEPTH) return head;
-		return `${head} ← caused by: ${describeCause(inner, depth + 1)}`;
-	}
-	return messageOf(cause);
-};
-const nameOf = (value) => {
-	if (value instanceof Error) return value.name;
-	if (value && typeof value === "object" && "name" in value) {
-		const name = value.name;
-		if (typeof name === "string") return name;
-	}
-	return null;
-};
-const stackOf = (value) => {
-	if (value && typeof value === "object" && "stack" in value) {
-		const stack = value.stack;
-		if (typeof stack === "string" && stack) return stack;
-	}
-	return null;
-};
-const causeOf = (value) => {
-	if (!value || typeof value !== "object" || !("cause" in value)) return null;
-	const cause = value.cause;
-	if (cause === void 0 || cause === null) return null;
-	return describeCause(cause) || null;
-};
-/** Accepts anything a `catch` can receive. */
-const serializeError = (value) => {
-	const message = truncate(messageOf(value).trim() || UNKNOWN_MESSAGE, LOG_LIMITS.message);
-	const name = nameOf(value);
-	const stack = stackOf(value);
-	const cause = causeOf(value);
-	const e1 = { name: name ? truncate(name, LOG_LIMITS.errorName) : null };
-	const e2 = { stack: stack ? truncate(stack, LOG_LIMITS.stack) : null };
-	const e3 = { cause: cause ? truncate(cause, LOG_LIMITS.cause) : null };
-	return {
-		message,
-		error: {
-			...e1,
-			...e2,
-			...e3
-		}
-	};
-};
-//#endregion
-//#region src/logs/log.ts
-const LOGS_PATH = "/api/storefront/v1/logs";
-const POS_LOGS_PATH = "/api/storefront/v1/pos/logs";
-const FLUSH_DELAY_MS = 500;
-let queue = [];
-let timer = null;
-const optionalText = (value, max) => {
-	const trimmed = value?.trim();
-	if (!trimmed) return null;
-	return truncate(trimmed, max);
-};
-const buildEntry = (level, message, options, error) => {
-	const text = typeof message === "string" ? message.trim() : "";
-	if (!text) return null;
-	const b1 = {
-		level,
-		message: truncate(text, LOG_LIMITS.message)
-	};
-	const b2 = { alias: optionalText(options.alias, LOG_LIMITS.alias) };
-	const b3 = { detail: optionalText(options.detail, LOG_LIMITS.detail) };
-	const b4 = { status: optionalText(options.status, LOG_LIMITS.status) };
-	const b5 = {
-		error: error ?? null,
-		occurred_at: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	return {
-		...b1,
-		...b2,
-		...b3,
-		...b4,
-		...getLogContext(),
-		...b5
-	};
-};
-const isAuthConfigured = () => {
-	try {
-		getBaseUrl();
-		return true;
-	} catch {
-		return false;
-	}
-};
-/** Browsers cap keepalive bodies at 64 KB; bigger batches send normally. */
-const postInit = (body) => {
-	return {
-		method: "POST",
-		body,
-		keepalive: body.length < LOG_LIMITS.keepaliveBytes
-	};
-};
-const sendPos = async (device, logs) => {
-	const fetchImpl = device.http.fetchImpl ?? fetch;
-	const url = `${resolveBaseUrl(device.http.baseUrl)}${POS_LOGS_PATH}`;
-	const { device_uid, device_secret } = device;
-	const body = JSON.stringify({
-		device_uid,
-		device_secret,
-		logs
-	});
-	const headers = { "Content-Type": "application/json" };
-	return (await fetchImpl(url, {
-		...postInit(body),
-		headers
-	})).ok;
-};
-const sendBatch = async (logs) => {
-	try {
-		const device = getPosLogDevice();
-		if (device) return await sendPos(device, logs);
-		if (!isAuthConfigured()) return false;
-		await storefrontJson(LOGS_PATH, postInit(JSON.stringify({ logs })));
-		return true;
-	} catch {
-		return false;
-	}
-};
-/** Sends queued logs now; resolves once every batch has been attempted. */
-const flushLogs = async () => {
-	if (timer) clearTimeout(timer);
-	timer = null;
-	const pending = queue;
-	queue = [];
-	const jobs = [];
-	for (let i = 0; i < pending.length; i += LOG_LIMITS.batch) {
-		const chunk = pending.slice(i, i + LOG_LIMITS.batch);
-		const entries = chunk.map((item) => item.entry);
-		const job = sendBatch(entries).then((sent) => {
-			for (const item of chunk) item.resolve(sent);
-		});
-		jobs.push(job);
-	}
-	await Promise.all(jobs);
-};
-const enqueue = (entry) => {
-	return new Promise((resolve) => {
-		queue.push({
-			entry,
-			resolve
-		});
-		if (queue.length >= LOG_LIMITS.batch) {
-			flushLogs();
-			return;
-		}
-		if (!timer) timer = setTimeout(() => void flushLogs(), FLUSH_DELAY_MS);
-	});
-};
-/**
-* Reports a log to the merchant dashboard with the SDK's current context
-* (channel, fulfillment, store, brand, device). Never throws; resolves to
-* `false` when the log could not be delivered.
-*/
-const log = (level, message, options = {}) => {
-	const entry = buildEntry(level, message, options);
-	if (!entry) return Promise.resolve(false);
-	return enqueue(entry);
-};
-/** `log("error", …)` with message, name, stack and cause read from `error`. */
-const logError = (error, options = {}) => {
-	const { message, error: info } = serializeError(error);
-	const entry = buildEntry("error", message, options, info);
-	if (!entry) return Promise.resolve(false);
-	return enqueue(entry);
-};
-//#endregion
-//#region src/webhooks/verifyWebhookSignature.ts
-const SIGNATURE_PREFIX = "sha256=";
-const hmacHex = async (secret, body) => {
-	const raw = new TextEncoder().encode(secret);
-	const key = await crypto.subtle.importKey("raw", raw, {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const data = new TextEncoder().encode(body);
-	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, data));
-	return Array.from(sig, (byte) => byte.toString(16).padStart(2, "0")).join("");
-};
-const safeEqual = (left, right) => {
-	if (left.length !== right.length) return false;
-	let diff = 0;
-	for (let i = 0; i < left.length; i += 1) diff |= left.charCodeAt(i) ^ right.charCodeAt(i);
-	return diff === 0;
-};
-/** Checks a Fire Spark webhook/callback signature in constant time. */
-const verifyWebhookSignature = async (input) => {
-	const { secret, body, signature } = input;
-	if (!secret || !signature?.startsWith(SIGNATURE_PREFIX)) return false;
-	const received = signature.slice(7).toLowerCase();
-	return safeEqual(received, await hmacHex(secret, body));
-};
-//#endregion
-//#region ../../node_modules/.pnpm/dayjs@1.11.9/node_modules/dayjs/dayjs.min.js
-var require_dayjs_min = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+//#region src/rules/assert.ts
+var import_dayjs_min = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(t, e) {
 		"object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).dayjs = e();
 	})(exports, (function() {
@@ -8673,9 +9052,7 @@ var require_dayjs_min = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return w(1e3 * t);
 		}, w.en = D[g], w.Ls = D, w.p = {}, w;
 	}));
-}));
-//#endregion
-//#region src/rules/assert.ts
+})))(), 1);
 const assert = (value, message) => {
 	if (value) return;
 	throw new Error(message);
@@ -8704,7 +9081,6 @@ const countCartProducts = (lines, includeModifiers) => {
 };
 //#endregion
 //#region src/rules/absoluteDateMatcher.ts
-var import_dayjs_min = /* @__PURE__ */ __toESM(require_dayjs_min(), 1);
 const matchAbsoluteDateOperator = (condition, matcher) => {
 	const { primitive, operator, value } = condition;
 	assert(primitive === "absolute date", primitiveError("absolute date"));
@@ -8775,6 +9151,14 @@ const paymentCaptured = (condition, captured) => {
 	assert(value != null, "Invalid value");
 	return matchBooleanOperator(condition, captured ?? false);
 };
+const orderIsScheduled = (condition, scheduledAt) => {
+	const { type, primitive, value } = condition;
+	const matcherType = "Order is scheduled";
+	assert(primitive === "boolean", primitiveError("boolean"));
+	assert(type === matcherType, typeError(matcherType));
+	assert(value != null, "Invalid value");
+	return matchBooleanOperator(condition, Boolean(scheduledAt));
+};
 //#endregion
 //#region src/rules/currencyMatcher.ts
 const matchCurrencyOperator = (condition, matcher) => {
@@ -9501,6 +9885,10 @@ var RulesEngine = class {
 			const payment = this.getDependency("payment", type);
 			return paymentCaptured(condition, payment.captured);
 		}
+		if (type === "Order is scheduled") {
+			const order = this.getDependency("order", type);
+			return orderIsScheduled(condition, order.scheduled_at);
+		}
 		throw new Error(`Condition ${type} not supported in boolean matcher`);
 	};
 	assertCurrency = (condition) => {
@@ -9668,6 +10056,731 @@ var RulesEngine = class {
 	};
 };
 //#endregion
+//#region src/prepTime/resolvePrepTime.ts
+const MIN_MINUTES = 1;
+const MAX_MINUTES = 1e3;
+const clampMinutes = (value) => {
+	const rounded = Math.round(value);
+	if (rounded < MIN_MINUTES) return MIN_MINUTES;
+	if (rounded > MAX_MINUTES) return MAX_MINUTES;
+	return rounded;
+};
+const matchesPreparing = (effect, count) => {
+	const { operator, preparing } = effect;
+	if (operator == null || preparing == null) return true;
+	if (operator === "gt") return count > preparing;
+	if (operator === "gte") return count >= preparing;
+	if (operator === "lt") return count < preparing;
+	if (operator === "lte") return count <= preparing;
+	return count === preparing;
+};
+const applyEffect = (rule, order) => {
+	const { effect } = rule;
+	if (effect.strategy === "PER_ORDER") return clampMinutes(effect.value);
+	const count = countCartProducts(order.lines, false);
+	return clampMinutes(effect.value * count);
+};
+/** Cart-aware prep minutes. One minute when no rule matches. */
+const resolveSchedulePrepMinutes = (input) => {
+	const { rules, order } = input;
+	const preparingCount = input.preparingCount ?? 0;
+	const engine = new RulesEngine({ order });
+	const ranked = rules.filter((item) => !item.fallback);
+	const hit = engine.matchRules(ranked, { exclusive: false }).find((rule) => {
+		return matchesPreparing(rule.effect, preparingCount);
+	});
+	const fallback = rules.find((item) => item.fallback);
+	const rule = hit ?? fallback;
+	if (!rule) return MIN_MINUTES;
+	return applyEffect(rule, order);
+};
+//#endregion
+//#region src/schedule/scheduleTime.ts
+/** Default earliest pickup slot: one hour from now. */
+const SCHEDULED_ORDER_MIN_LEAD_MINUTES = 60;
+/** Latest bookable instant. No merchant preference stores this yet. */
+const SCHEDULED_ORDER_MAX_HORIZON_HOURS = 48;
+const SCHEDULED_ORDER_MAX_HORIZON_MINUTES = 2880;
+/** Slot grid used when a customer picks a time. */
+const SCHEDULED_ORDER_SLOT_MINUTES = 15;
+const MINUTE_MS$1 = 6e4;
+const DAY_MINUTES = 1440;
+const safeTimeZone = (timeZone) => {
+	try {
+		Intl.DateTimeFormat("en-US", { timeZone });
+		return timeZone;
+	} catch {
+		return "UTC";
+	}
+};
+const partValue = (parts, type) => {
+	return Number(parts.find((part) => part.type === type)?.value ?? 0);
+};
+const formatters = /* @__PURE__ */ new Map();
+const zonedFormat = (timeZone) => {
+	const zone = safeTimeZone(timeZone);
+	const cached = formatters.get(zone);
+	if (cached) return cached;
+	const b1 = {
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit"
+	};
+	const b2 = {
+		hour: "2-digit",
+		minute: "2-digit",
+		second: "2-digit"
+	};
+	const opts = {
+		timeZone: zone,
+		hourCycle: "h23",
+		...b1,
+		...b2
+	};
+	const format = new Intl.DateTimeFormat("en-US", opts);
+	formatters.set(zone, format);
+	return format;
+};
+/** Calendar fields of `instant` in `timeZone`. Hour 24 rolls forward. */
+const zonedParts = (instant, timeZone) => {
+	const parts = zonedFormat(timeZone).formatToParts(instant);
+	let year = partValue(parts, "year");
+	let month = partValue(parts, "month");
+	let day = partValue(parts, "day");
+	let hour = partValue(parts, "hour");
+	if (hour === 24) {
+		hour = 0;
+		const next = new Date(Date.UTC(year, month - 1, day + 1));
+		year = next.getUTCFullYear();
+		month = next.getUTCMonth() + 1;
+		day = next.getUTCDate();
+	}
+	return {
+		year,
+		month,
+		day,
+		hour,
+		minute: partValue(parts, "minute"),
+		second: partValue(parts, "second")
+	};
+};
+/**
+* A Date whose local getters match the wall clock in `timeZone`.
+* Same trick as the call-center shift helper.
+*/
+const wallClockDate = (instant, timeZone) => {
+	const parts = zonedParts(instant, timeZone);
+	const ymd = [
+		parts.year,
+		parts.month - 1,
+		parts.day
+	];
+	const hms = [
+		parts.hour,
+		parts.minute,
+		parts.second
+	];
+	return new Date(...ymd, ...hms);
+};
+const offsetMs = (instant, timeZone) => {
+	const parts = zonedParts(instant, timeZone);
+	const month = parts.month - 1;
+	const hms = [
+		parts.hour,
+		parts.minute,
+		parts.second
+	];
+	return Date.UTC(parts.year, month, parts.day, ...hms) - instant.getTime();
+};
+const sameWall = (instant, year, month, day, minutes, timeZone) => {
+	const parts = zonedParts(instant, timeZone);
+	const hour = Math.floor(minutes / 60);
+	const minute = minutes % 60;
+	if (parts.year !== year || parts.month !== month) return false;
+	if (parts.day !== day || parts.hour !== hour) return false;
+	return parts.minute === minute;
+};
+/**
+* UTC instant of a wall-clock minute in `timeZone`.
+* Missing civil times (spring-forward gaps) return null.
+* Repeated civil times (fall-back) return both instants, earlier first.
+*/
+const zoneOffsetHours = /* @__PURE__ */ new Map();
+const instantAtOffset = (wall, hours, year, month, day, minutes, timeZone) => {
+	const guess = new Date(wall + hours * MINUTE_MS$1 * 60);
+	const utc = new Date(wall - offsetMs(guess, timeZone));
+	if (!sameWall(utc, year, month, day, minutes, timeZone)) return null;
+	return utc;
+};
+const wallMinuteToInstants = (year, month, day, minutes, timeZone) => {
+	const hour = Math.floor(minutes / 60);
+	const minute = minutes % 60;
+	const monthIndex = month - 1;
+	const wall = Date.UTC(year, monthIndex, day, hour, minute, 0);
+	const zone = safeTimeZone(timeZone);
+	const found = /* @__PURE__ */ new Map();
+	const keep = (utc, hours) => {
+		found.set(utc.getTime(), utc);
+		zoneOffsetHours.set(zone, hours);
+		const hour = MINUTE_MS$1 * 60;
+		for (const delta of [hour, -36e5]) {
+			const other = new Date(utc.getTime() + delta);
+			const parts = zonedParts(other, timeZone);
+			const sameDay = parts.year === year && parts.month === month;
+			const sameMinute = parts.hour * 60 + parts.minute === minutes;
+			if (sameDay && parts.day === day && sameMinute) found.set(other.getTime(), other);
+		}
+	};
+	const cached = zoneOffsetHours.get(zone);
+	const seeds = cached == null ? [] : [
+		cached - 1,
+		cached,
+		cached + 1
+	];
+	for (const hours of seeds) {
+		const utc = instantAtOffset(wall, hours, year, month, day, minutes, timeZone);
+		if (utc) keep(utc, hours);
+	}
+	if (found.size === 0) for (let hours = -14; hours <= 14; hours += 1) {
+		const utc = instantAtOffset(wall, hours, year, month, day, minutes, timeZone);
+		if (utc) keep(utc, hours);
+	}
+	return [...found.values()].sort((a, b) => a.getTime() - b.getTime());
+};
+const addCalendarDays = (year, month, day, days) => {
+	const utc = new Date(Date.UTC(year, month - 1, day + days));
+	return {
+		year: utc.getUTCFullYear(),
+		month: utc.getUTCMonth() + 1,
+		day: utc.getUTCDate()
+	};
+};
+const WEEKDAYS = [
+	"sunday",
+	"monday",
+	"tuesday",
+	"wednesday",
+	"thursday",
+	"friday",
+	"saturday"
+];
+const weekdayOf = (year, month, day) => {
+	const utc = new Date(Date.UTC(year, month - 1, day));
+	return WEEKDAYS[utc.getUTCDay()] ?? "sunday";
+};
+const labelFormatters = /* @__PURE__ */ new Map();
+const scheduleLabel = (instant, timeZone, locale = "en-US") => {
+	const zone = safeTimeZone(timeZone);
+	const key = `${locale}|${zone}`;
+	const cached = labelFormatters.get(key);
+	if (cached) return cached.format(instant);
+	const date = {
+		month: "short",
+		day: "numeric"
+	};
+	const time = {
+		hour: "numeric",
+		minute: "2-digit"
+	};
+	const opts = {
+		timeZone: zone,
+		...date,
+		...time
+	};
+	const format = new Intl.DateTimeFormat(locale, opts);
+	labelFormatters.set(key, format);
+	return format.format(instant);
+};
+/** Absolute UTC instant. Naive strings are read in `timeZone`. */
+const scheduledInstant = (value, timeZone) => {
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	if (/(?:z|[+-]\d{2}:?\d{2})$/i.test(trimmed)) {
+		const date = new Date(trimmed);
+		if (Number.isNaN(date.getTime())) return null;
+		return date.toISOString();
+	}
+	const match = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})/.exec(trimmed);
+	if (!match) return null;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	const minutes = Number(match[4]) * 60 + Number(match[5]);
+	const first = wallMinuteToInstants(year, month, day, minutes, timeZone)[0];
+	if (!first) return null;
+	return first.toISOString();
+};
+const dayPeriods$1 = (schedule, weekday) => {
+	return schedule.find((row) => row.day_of_week === weekday)?.periods ?? [];
+};
+const periodMinutes = (start, end) => {
+	const [sh = "0", sm = "0"] = start.split(":");
+	const [eh = "0", em = "0"] = end.split(":");
+	const startMin = Number(sh) * 60 + Number(sm);
+	let endMin = Number(eh) * 60 + Number(em);
+	if (endMin <= startMin) endMin += DAY_MINUTES;
+	return {
+		startMin,
+		endMin
+	};
+};
+const DAY_MINUTES_COUNT = DAY_MINUTES;
+//#endregion
+//#region src/schedule/scheduleInZone.ts
+const timeToMinutes = (time) => {
+	const [hours = "0", minutes = "0"] = time.split(":");
+	return Number(hours) * 60 + Number(minutes);
+};
+const hasSpecificDates = (period) => {
+	return period.start_date != null && period.end_date != null;
+};
+const periodCoversDate = (period, instantMs) => {
+	if (!hasSpecificDates(period)) return false;
+	const startMs = Date.parse(period.start_date);
+	const endMs = Date.parse(period.end_date);
+	if (Number.isNaN(startMs) || Number.isNaN(endMs)) return false;
+	return startMs <= instantMs && instantMs <= endMs;
+};
+const timeMatches = (period, now) => {
+	if (!period.start_time || !period.end_time) return false;
+	const nowMinutes = now.getHours() * 60 + now.getMinutes();
+	const start = timeToMinutes(period.start_time);
+	const end = timeToMinutes(period.end_time);
+	if (end <= start) return nowMinutes >= start;
+	return nowMinutes >= start && nowMinutes < end;
+};
+const isClosedAt = (period, now) => {
+	if (!period.closed) return false;
+	if (!period.start_time || !period.end_time) return true;
+	return timeMatches(period, now);
+};
+const isOpenAt = (period, now) => {
+	if (period.closed) return false;
+	return timeMatches(period, now);
+};
+const getOpenPeriodAt = (periods, now, instantMs) => {
+	if (periods.length === 0) return null;
+	const coveringSpecific = periods.filter((period) => {
+		return periodCoversDate(period, instantMs);
+	});
+	const fallback = periods.filter((period) => !hasSpecificDates(period));
+	const specificOpens = coveringSpecific.filter((period) => !period.closed);
+	if (coveringSpecific.filter((period) => period.closed).some((period) => isClosedAt(period, now))) return null;
+	if (specificOpens.length > 0) return specificOpens.find((period) => isOpenAt(period, now)) ?? null;
+	if (fallback.some((period) => isClosedAt(period, now))) return null;
+	return fallback.filter((period) => !period.closed).find((period) => isOpenAt(period, now)) ?? null;
+};
+const closedNow = (periods, now, instantMs) => {
+	return periods.some((period) => {
+		if (!period.closed) return false;
+		if (hasSpecificDates(period) && !periodCoversDate(period, instantMs)) return false;
+		return isClosedAt(period, now);
+	});
+};
+const isOvernightTail = (period, nowMinutes) => {
+	if (period.closed || !period.start_time || !period.end_time) return false;
+	const start = timeToMinutes(period.start_time);
+	const end = timeToMinutes(period.end_time);
+	if (end > start) return false;
+	return nowMinutes < end;
+};
+const inPreviousOvernight = (schedule, now, instantMs) => {
+	const day = WEEKDAYS[(now.getDay() + 6) % 7] ?? "sunday";
+	const periods = schedule.find((row) => row.day_of_week === day)?.periods ?? [];
+	const nowMinutes = now.getHours() * 60 + now.getMinutes();
+	const specific = periods.filter((period) => {
+		return periodCoversDate(period, instantMs);
+	}).filter((period) => hasSpecificDates(period));
+	const fallback = periods.filter((period) => !hasSpecificDates(period));
+	if (specific.some((period) => isClosedAt(period, now))) return false;
+	const opens = specific.filter((period) => !period.closed);
+	if (opens.length > 0) return opens.some((period) => isOvernightTail(period, nowMinutes));
+	if (fallback.some((period) => isClosedAt(period, now))) return false;
+	return fallback.some((period) => isOvernightTail(period, nowMinutes));
+};
+const dayPeriods = (schedule, instant) => {
+	const day = WEEKDAYS[instant.getDay()] ?? "sunday";
+	return schedule.find((row) => row.day_of_week === day)?.periods ?? [];
+};
+/** Slot checks only. Existing menu and product callers stay on isOnSchedule. */
+const isOnScheduleInZone = (schedule, instant, timeZone) => {
+	if (schedule == null) return true;
+	const clock = wallClockDate(instant, timeZone);
+	const periods = dayPeriods(schedule, clock);
+	const instantMs = instant.getTime();
+	if (getOpenPeriodAt(periods, clock, instantMs) != null) return true;
+	if (closedNow(periods, clock, instantMs)) return false;
+	return inPreviousOvernight(schedule, clock, instantMs);
+};
+//#endregion
+//#region src/schedule/buildScheduleSlots.ts
+const alwaysOpen = () => {
+	return WEEKDAYS.map((day_of_week) => {
+		return {
+			day_of_week,
+			periods: [{
+				closed: false,
+				start_time: "00:00",
+				end_time: "24:00"
+			}]
+		};
+	});
+};
+const MINUTE_MS = 6e4;
+const prepLeadMs = (cart, minLead) => {
+	const lead = minLead * MINUTE_MS;
+	const rules = cart?.prepTime?.rules;
+	if (!rules?.length) return lead;
+	const lines = (cart?.lines ?? []).map((line) => {
+		return {
+			id: line.id ?? "",
+			quantity: line.quantity ?? 1,
+			type: line.type,
+			parent_uid: line.parent_uid
+		};
+	});
+	const prep = resolveSchedulePrepMinutes({
+		rules,
+		order: {
+			total: cart?.total ?? 0,
+			is_anonymous: cart?.is_anonymous ?? false,
+			lines
+		},
+		preparingCount: cart?.preparingCount
+	});
+	return Math.max(lead, prep * MINUTE_MS);
+};
+const insideWindow = (line, instant) => {
+	const windows = line.windows ?? [];
+	if (windows.length === 0) return true;
+	const ms = instant.getTime();
+	return windows.some((window) => {
+		const start = Date.parse(window.start);
+		const end = Date.parse(window.end);
+		if (Number.isNaN(start) || Number.isNaN(end)) return false;
+		return ms >= start && ms < end;
+	});
+};
+const lineAllows = (line, instant, timeZone) => {
+	if (line.unavailable) return false;
+	if (line.inactiveUntil) {
+		const until = Date.parse(line.inactiveUntil);
+		if (!Number.isNaN(until) && instant.getTime() < until) return false;
+	}
+	const productOpen = isOnScheduleInZone(line.schedules, instant, timeZone);
+	if (line.schedules && !productOpen) return false;
+	const category = line.categorySchedules;
+	const categoryOpen = isOnScheduleInZone(category, instant, timeZone);
+	if (category && !categoryOpen) return false;
+	return insideWindow(line, instant);
+};
+const cartAllows = (cart, instant, timeZone) => {
+	return (cart?.lines ?? []).every((line) => lineAllows(line, instant, timeZone));
+};
+const storeAllows = (config, instant, timeZone) => {
+	const status = config.storeStatus;
+	if (status && status !== "OPEN") return false;
+	const hours = config.storeSchedule;
+	if (!hours) return true;
+	return isOnScheduleInZone(hours, instant, timeZone);
+};
+/** True when `instant` is one stepped slot the menu, store, and cart allow. */
+const isScheduleSlot = (instant, config) => {
+	if (!Number.isFinite(instant.getTime())) return false;
+	const { timezone, stepMinutes } = config;
+	if (stepMinutes <= 0) return false;
+	if (config.menuSchedule && config.menuSchedule.length === 0) return false;
+	const parts = zonedParts(instant, timezone);
+	if (parts.second !== 0) return false;
+	if ((parts.hour * 60 + parts.minute) % stepMinutes !== 0) return false;
+	if (!isOnScheduleInZone(config.menuSchedule ?? alwaysOpen(), instant, timezone)) return false;
+	if (!storeAllows(config, instant, timezone)) return false;
+	return cartAllows(config.cart, instant, timezone);
+};
+/**
+* Stepped instants inside menu hours, in the store timezone.
+* Drops the past, anything before now + lead (and prep, when a cart is
+* given), and slots a cart line cannot sell.
+*/
+const buildScheduleSlots = (config) => {
+	const { timezone, stepMinutes } = config;
+	if (stepMinutes <= 0) return [];
+	if (config.menuSchedule && config.menuSchedule.length === 0) return [];
+	const menuSchedule = config.menuSchedule ?? alwaysOpen();
+	const now = config.now ?? /* @__PURE__ */ new Date();
+	const minLead = config.minLeadTime ?? 60;
+	const horizonMin = config.maxHorizonMinutes ?? 2880;
+	const readyAt = now.getTime() + prepLeadMs(config.cart, minLead);
+	const latest = now.getTime() + horizonMin * MINUTE_MS;
+	const start = zonedParts(now, timezone);
+	const seen = /* @__PURE__ */ new Set();
+	const slots = [];
+	const horizonDays = Math.ceil(horizonMin / DAY_MINUTES_COUNT);
+	const dayCount = Math.min(horizonDays, 7) + 1;
+	for (let offset = -1; offset < dayCount; offset += 1) {
+		const date = addCalendarDays(start.year, start.month, start.day, offset);
+		const periods = dayPeriods$1(menuSchedule, weekdayOf(date.year, date.month, date.day));
+		for (const period of periods) {
+			if (period.closed || !period.start_time || !period.end_time) continue;
+			const window = periodMinutes(period.start_time, period.end_time);
+			let minute = Math.ceil(window.startMin / stepMinutes) * stepMinutes;
+			for (; minute < window.endMin; minute += stepMinutes) {
+				const spill = Math.floor(minute / DAY_MINUTES_COUNT);
+				const minOfDay = minute % DAY_MINUTES_COUNT;
+				const at = addCalendarDays(date.year, date.month, date.day, spill);
+				const instants = wallMinuteToInstants(...[
+					at.year,
+					at.month,
+					at.day,
+					minOfDay,
+					timezone
+				]);
+				for (const instant of instants) {
+					const ms = instant.getTime();
+					if (seen.has(ms) || ms < readyAt || ms > latest) continue;
+					if (!isOnScheduleInZone(menuSchedule, instant, timezone)) continue;
+					if (!storeAllows(config, instant, timezone)) continue;
+					if (!cartAllows(config.cart, instant, timezone)) continue;
+					seen.add(ms);
+					const startIso = instant.toISOString();
+					const label = scheduleLabel(instant, timezone, config.locale);
+					slots.push({
+						start: startIso,
+						label
+					});
+				}
+			}
+		}
+	}
+	slots.sort((left, right) => {
+		if (left.start < right.start) return -1;
+		if (left.start > right.start) return 1;
+		return 0;
+	});
+	return slots;
+};
+//#endregion
+//#region src/logs/serializeError.ts
+const UNKNOWN_MESSAGE = "Unknown error";
+const MAX_CAUSE_DEPTH = 3;
+const safeStringify = (value) => {
+	try {
+		const json = JSON.stringify(value);
+		return json === void 0 ? String(value) : json;
+	} catch {
+		return String(value);
+	}
+};
+const messageOf = (value) => {
+	if (value instanceof Error) return value.message || value.name;
+	if (typeof value === "string") return value;
+	if (value && typeof value === "object" && "message" in value) {
+		const message = value.message;
+		if (typeof message === "string") return message;
+	}
+	if (value === void 0) return "";
+	return safeStringify(value);
+};
+/** `TypeError: boom ← caused by: Error: socket closed` style chain. */
+const describeCause = (cause, depth = 0) => {
+	if (cause instanceof Error) {
+		const head = `${cause.name}: ${cause.message}`;
+		const inner = cause.cause;
+		if (inner === void 0 || depth >= MAX_CAUSE_DEPTH) return head;
+		return `${head} ← caused by: ${describeCause(inner, depth + 1)}`;
+	}
+	return messageOf(cause);
+};
+const nameOf = (value) => {
+	if (value instanceof Error) return value.name;
+	if (value && typeof value === "object" && "name" in value) {
+		const name = value.name;
+		if (typeof name === "string") return name;
+	}
+	return null;
+};
+const stackOf = (value) => {
+	if (value && typeof value === "object" && "stack" in value) {
+		const stack = value.stack;
+		if (typeof stack === "string" && stack) return stack;
+	}
+	return null;
+};
+const causeOf = (value) => {
+	if (!value || typeof value !== "object" || !("cause" in value)) return null;
+	const cause = value.cause;
+	if (cause === void 0 || cause === null) return null;
+	return describeCause(cause) || null;
+};
+/** Accepts anything a `catch` can receive. */
+const serializeError = (value) => {
+	const message = truncate(messageOf(value).trim() || UNKNOWN_MESSAGE, LOG_LIMITS.message);
+	const name = nameOf(value);
+	const stack = stackOf(value);
+	const cause = causeOf(value);
+	const e1 = { name: name ? truncate(name, LOG_LIMITS.errorName) : null };
+	const e2 = { stack: stack ? truncate(stack, LOG_LIMITS.stack) : null };
+	const e3 = { cause: cause ? truncate(cause, LOG_LIMITS.cause) : null };
+	return {
+		message,
+		error: {
+			...e1,
+			...e2,
+			...e3
+		}
+	};
+};
+//#endregion
+//#region src/logs/log.ts
+const LOGS_PATH = "/api/storefront/v1/logs";
+const POS_LOGS_PATH = "/api/storefront/v1/pos/logs";
+const FLUSH_DELAY_MS = 500;
+let queue = [];
+let timer = null;
+const optionalText = (value, max) => {
+	const trimmed = value?.trim();
+	if (!trimmed) return null;
+	return truncate(trimmed, max);
+};
+const buildEntry = (level, message, options, error) => {
+	const text = typeof message === "string" ? message.trim() : "";
+	if (!text) return null;
+	const b1 = {
+		level,
+		message: truncate(text, LOG_LIMITS.message)
+	};
+	const b2 = { alias: optionalText(options.alias, LOG_LIMITS.alias) };
+	const b3 = { detail: optionalText(options.detail, LOG_LIMITS.detail) };
+	const b4 = { status: optionalText(options.status, LOG_LIMITS.status) };
+	const b5 = {
+		error: error ?? null,
+		occurred_at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	return {
+		...b1,
+		...b2,
+		...b3,
+		...b4,
+		...getLogContext(),
+		...b5
+	};
+};
+const isAuthConfigured = () => {
+	try {
+		getBaseUrl();
+		return true;
+	} catch {
+		return false;
+	}
+};
+/** Browsers cap keepalive bodies at 64 KB; bigger batches send normally. */
+const postInit = (body) => {
+	return {
+		method: "POST",
+		body,
+		keepalive: body.length < LOG_LIMITS.keepaliveBytes
+	};
+};
+const sendPos = async (device, logs) => {
+	const fetchImpl = device.http.fetchImpl ?? fetch;
+	const url = `${resolveBaseUrl(device.http.baseUrl)}${POS_LOGS_PATH}`;
+	const { device_uid, device_secret } = device;
+	const body = JSON.stringify({
+		device_uid,
+		device_secret,
+		logs
+	});
+	const headers = { "Content-Type": "application/json" };
+	return (await fetchImpl(url, {
+		...postInit(body),
+		headers
+	})).ok;
+};
+const sendBatch = async (logs) => {
+	try {
+		const device = getPosLogDevice();
+		if (device) return await sendPos(device, logs);
+		if (!isAuthConfigured()) return false;
+		await storefrontJson(LOGS_PATH, postInit(JSON.stringify({ logs })));
+		return true;
+	} catch {
+		return false;
+	}
+};
+/** Sends queued logs now; resolves once every batch has been attempted. */
+const flushLogs = async () => {
+	if (timer) clearTimeout(timer);
+	timer = null;
+	const pending = queue;
+	queue = [];
+	const jobs = [];
+	for (let i = 0; i < pending.length; i += LOG_LIMITS.batch) {
+		const chunk = pending.slice(i, i + LOG_LIMITS.batch);
+		const entries = chunk.map((item) => item.entry);
+		const job = sendBatch(entries).then((sent) => {
+			for (const item of chunk) item.resolve(sent);
+		});
+		jobs.push(job);
+	}
+	await Promise.all(jobs);
+};
+const enqueue = (entry) => {
+	return new Promise((resolve) => {
+		queue.push({
+			entry,
+			resolve
+		});
+		if (queue.length >= LOG_LIMITS.batch) {
+			flushLogs();
+			return;
+		}
+		if (!timer) timer = setTimeout(() => void flushLogs(), FLUSH_DELAY_MS);
+	});
+};
+/**
+* Reports a log to the merchant dashboard with the SDK's current context
+* (channel, fulfillment, store, brand, device). Never throws; resolves to
+* `false` when the log could not be delivered.
+*/
+const log = (level, message, options = {}) => {
+	const entry = buildEntry(level, message, options);
+	if (!entry) return Promise.resolve(false);
+	return enqueue(entry);
+};
+/** `log("error", …)` with message, name, stack and cause read from `error`. */
+const logError = (error, options = {}) => {
+	const { message, error: info } = serializeError(error);
+	const entry = buildEntry("error", message, options, info);
+	if (!entry) return Promise.resolve(false);
+	return enqueue(entry);
+};
+//#endregion
+//#region src/webhooks/verifyWebhookSignature.ts
+const SIGNATURE_PREFIX = "sha256=";
+const hmacHex = async (secret, body) => {
+	const raw = new TextEncoder().encode(secret);
+	const key = await crypto.subtle.importKey("raw", raw, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const data = new TextEncoder().encode(body);
+	const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, data));
+	return Array.from(sig, (byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+const safeEqual = (left, right) => {
+	if (left.length !== right.length) return false;
+	let diff = 0;
+	for (let i = 0; i < left.length; i += 1) diff |= left.charCodeAt(i) ^ right.charCodeAt(i);
+	return diff === 0;
+};
+/** Checks a Fire Spark webhook/callback signature in constant time. */
+const verifyWebhookSignature = async (input) => {
+	const { secret, body, signature } = input;
+	if (!secret || !signature?.startsWith(SIGNATURE_PREFIX)) return false;
+	const received = signature.slice(7).toLowerCase();
+	return safeEqual(received, await hmacHex(secret, body));
+};
+//#endregion
 //#region src/rules/checkout.ts
 const DEFAULT_SHIPPING_FIELDS = {
 	address_line1: "required",
@@ -10130,4 +11243,4 @@ const cardPreviewGroups = (value) => {
 	return groups;
 };
 //#endregion
-export { CARD_BRANDS, CUSTOMER_INFO_PLACEHOLDERS, DEFAULT_RECOMMENDATION_TYPES, ID_HASH_FORMATS, Order, OrderPaymentRequiredError, OrderSyncPendingError, OrderSyncRejectedError, OrderValidationError, RecurringDateCron, RulesEngine, StorefrontHttpError, addLines, auth, buildCustomerSnapshot, cancelTypeOf, capRedeems, cappedRedeems, cardBrandSpec, cardDigits, cardNumberGaps, cardNumberMaxLength, cardPreviewGroups, caretAfterDigits, collectOrderLineDiffs, computeStartingPrice, countCartProducts, coveredAmount, createDeunaWidgetApi, createSession, currentNodes, cvcMaxLength, defaultConditionError, detectCardBrand, fitRedeems, flattenMenuCategories, flushLogs, formatCardNumber, formatCvc, formatExpiry, fromOrderLines, genId, genOrderId, getLogContext, getScheduleWindow, indexMenu, isCardNumberComplete, isCardNumberDefinitelyInvalid, isCheckoutFieldFilled, isCustomerInfoFieldFilled, isCustomerInfoPlaceholder, isCustomerInfoValueValid, isCvcComplete, isDeviceCharged, isDeviceNotLinked, isExpiryComplete, isGenId, isKioskUnauthorized, isMilestoneStepDone, isOnSchedule, isOrderPaymentRequiredError, isOrderValidationError, isPosDeviceNotLinked, isPosUnauthorized, isRealPaymentMethod, isStorefrontNotFound, isVariantBase, linePayableTotal, listMenusStream, localizePosError, log, logError, luhnCheck, matchAbsoluteDateOperator, matchBooleanOperator, matchCurrencyOperator, matchEnumOperator, matchNumberOperator, matchRecurringDateOperator, matchRelativeDateOperator, matchStringOperator, milestoneSteps, milestoneTrack, nestMenuCategories, normalizeCardholderName, normalizeCustomerPhone, orderPayableTotal, orderRedeemedTotal, orderRedeems, parseExpiry, paymentMatchesClientConditions, rebuildRootGroups, recomputeTotals, redeemedTotal, redeemsForPayment, redemptionCap, redemptionSteps, remainingAmount, removeLine, replaceLine, resolveCheckout, resolveModifierImageUrl, reversePayment, runPaymentAttempt, selectablePayments, serializeError, services, setLineQuantity, storefrontJson, toOrderLines, toPaymentCardBrand, validateCardNumber, validateCardholderName, validateCvc, validateExpiry, validateOrderAgainstMenu, verifyWebhookSignature, visitedStates };
+export { CARD_BRANDS, CUSTOMER_INFO_PLACEHOLDERS, DEFAULT_RECOMMENDATION_TYPES, DelegatedSessionExpiredError, ID_HASH_FORMATS, Order, OrderAuthPinnedError, OrderNotOpenError, OrderPaymentRequiredError, OrderSyncPendingError, OrderSyncRejectedError, OrderValidationError, RecurringDateCron, RulesEngine, SCHEDULED_AT_ERROR_CODES, SCHEDULED_ORDER_MAX_HORIZON_HOURS, SCHEDULED_ORDER_MAX_HORIZON_MINUTES, SCHEDULED_ORDER_MIN_LEAD_MINUTES, SCHEDULED_ORDER_SLOT_MINUTES, StorefrontHttpError, addLines, auth, buildCustomerSnapshot, buildScheduleSlots, cancelTypeOf, capRedeems, cappedRedeems, cardBrandSpec, cardDigits, cardNumberGaps, cardNumberMaxLength, cardPreviewGroups, caretAfterDigits, collectOrderLineDiffs, computeStartingPrice, countCartProducts, coveredAmount, createDeunaWidgetApi, createSession, currentNodes, cvcMaxLength, defaultConditionError, detectCardBrand, fitRedeems, flattenMenuCategories, flushLogs, formatCardNumber, formatCvc, formatExpiry, fromOrderLines, genId, genOrderId, getLogContext, getScheduleWindow, indexMenu, isCardNumberComplete, isCardNumberDefinitelyInvalid, isCheckoutFieldFilled, isCustomerInfoFieldFilled, isCustomerInfoPlaceholder, isCustomerInfoValueValid, isCvcComplete, isDelegatedSessionExpiredError, isDeviceCharged, isDeviceNotLinked, isExpiryComplete, isGenId, isKioskUnauthorized, isMilestoneStepDone, isOnSchedule, isOrderNotOpenError, isOrderPaymentRequiredError, isOrderValidationError, isPosDeviceNotLinked, isPosUnauthorized, isRealPaymentMethod, isScheduleSlot, isScheduledAtError, isStorefrontNotFound, isVariantBase, linePayableTotal, listMenusStream, localizePosError, log, logError, luhnCheck, matchAbsoluteDateOperator, matchBooleanOperator, matchCurrencyOperator, matchEnumOperator, matchNumberOperator, matchRecurringDateOperator, matchRelativeDateOperator, matchStringOperator, milestoneSteps, milestoneTrack, nestMenuCategories, normalizeCardholderName, normalizeCustomerPhone, orderPayableTotal, orderRedeemedTotal, orderRedeems, parseExpiry, paymentMatchesClientConditions, rebuildRootGroups, recomputeTotals, redeemedTotal, redeemsForPayment, redemptionCap, redemptionSteps, remainingAmount, removeLine, replaceLine, resolveCheckout, resolveModifierImageUrl, resolveSchedulePrepMinutes, reversePayment, runPaymentAttempt, scheduledInstant, selectablePayments, serializeError, services, setLineQuantity, storefrontJson, toOrderLines, toPaymentCardBrand, validateCardNumber, validateCardholderName, validateCvc, validateExpiry, validateOrderAgainstMenu, verifyWebhookSignature, visitedStates };