@skuio/storefront 0.6.1 → 0.7.0

package/dist/store.js

@@ -14,7 +14,7 @@ import {
   regionForCountry,
   shippingForRegion,
   slugify
-} from "./chunk-56ODALDY.js";
+} from "./chunk-NM5YP764.js";
 import {
   API_KEY_PREFIX,
   CONNECT_CODE_MINUTES,
@@ -36,15 +36,18 @@ import {
   randomToken,
   secretsEqual,
   sha256Hex
-} from "./chunk-X7VXO4QU.js";
+} from "./chunk-RUUUZ2EL.js";
 import {
   magicLinkMail,
   merchantNewOrderMail,
+  merchantQuoteMail,
   orderConfirmationMail,
   ownerPasswordResetMail,
   partnerSignInMail,
+  quoteReadyMail,
+  quoteReceivedMail,
   shippingConfirmationMail
-} from "./chunk-UCREHLZH.js";
+} from "./chunk-BD274TXU.js";
 import "./chunk-4PTKC5PH.js";
 
 // src/store/cursor.ts
@@ -86,7 +89,7 @@ var CatalogService = class {
   }
   ctx;
   ttlMs;
-  /** The catalogue snapshot: active products with availability, and the category tree. */
+  /** The catalog snapshot: active products with availability, and the category tree. */
   load() {
     const hit = cache.get(this.ctx.db);
     if (hit && hit.expires > Date.now()) return hit.catalog;
@@ -161,7 +164,7 @@ var CatalogService = class {
     return found;
   }
   /**
-   * Products in keyset order, for an operations system importing the catalogue.
+   * Products in keyset order, for an operations system importing the catalog.
    * Ordered by `(updated_at, sku)` so a cursor is strictly monotonic and a
    * re-run from a watermark never repeats or skips a row.
    */
@@ -593,7 +596,7 @@ var CheckoutService = class {
     return region ? shippingForRegion(this.ctx.config.shipping, this.ctx.config.shipToCountries, region).options : [];
   }
   /**
-   * Price a set of lines from the catalogue. Quantities are clamped to the
+   * Price a set of lines from the catalog. Quantities are clamped to the
    * store's per-line maximum; unknown or unavailable SKUs fail validation.
    */
   async quote(items, country, shippingOptionId, discountCode) {
@@ -659,13 +662,7 @@ var CheckoutService = class {
     const details = {};
     const email = normalizeEmail(input.email ?? "");
     if (!EMAIL.test(email)) details.email = "must be a valid email address";
-    const shipTo = cleanAddress(input.shippingAddress) ?? {};
-    if (!shipTo.name) details["shipping_address.name"] = "is required";
-    if (!shipTo.line1) details["shipping_address.line1"] = "is required";
-    if (!shipTo.city) details["shipping_address.city"] = "is required";
-    if (!shipTo.country || shipTo.country.length !== 2) details["shipping_address.country"] = "is required";
-    else shipTo.country = shipTo.country.toUpperCase();
-    if (shipTo.country) Object.assign(details, checkAddressFormat(shipTo));
+    const shipTo = checkShippingAddress(input.shippingAddress, details);
     if (this.ctx.config.checkout.collectPhone && !input.walletContact && !input.phone?.trim()) details.phone = "is required";
     let quote = null;
     try {
@@ -675,61 +672,96 @@ var CheckoutService = class {
       else throw error;
     }
     if (Object.keys(details).length || !quote) throw invalid("Checkout is incomplete", details);
+    const metadata = Object.fromEntries(Object.entries(input.metadata ?? {}).filter(([, v]) => typeof v === "string").slice(0, 20));
+    return this.placePricedOrder({
+      email,
+      name: input.name?.trim() || shipTo.name || null,
+      phone: input.phone?.trim() || null,
+      currency: quote.currency,
+      lines: quote.lines,
+      subtotal: quote.subtotal,
+      shipping: quote.shipping,
+      tax: 0,
+      discount: quote.discount,
+      total: quote.total,
+      shippingAddress: shipTo,
+      billingAddress: input.billingAddress ? cleanAddress(input.billingAddress) : null,
+      shippingMethod: { code: quote.option.id, name: quote.option.label },
+      notes: input.notes ?? null,
+      metadata,
+      discountCode: quote.discountCode ? normalizeDiscountCode(quote.discountCode.code) : null,
+      discountPartner: quote.discountCode?.partner ?? null,
+      commission: quote.commission,
+      createdEvent: {
+        ...quote.discountCode ? { discount_code: normalizeDiscountCode(quote.discountCode.code) } : {},
+        ...quote.quantityTier ? { quantity_tier: quote.quantityTier.minQuantity } : {},
+        ...quote.discount ? { discount: quote.discount } : {}
+      }
+    });
+  }
+  /**
+   * Insert an order whose every amount is already decided. The checkout prices from the catalog first; an accepted
+   * store quote (QuotesService.accept) passes the offered prices. Nothing on the Store API reaches this: an order is
+   * only ever placed by a buyer.
+   */
+  async placePricedOrder(spec) {
     const db = this.ctx.db;
     const now = this.ctx.now();
     const orderId = newId("ord");
-    const name = input.name?.trim() || shipTo.name || null;
-    const phone = input.phone?.trim() || null;
-    const metadata = Object.fromEntries(Object.entries(input.metadata ?? {}).filter(([, v]) => typeof v === "string").slice(0, 20));
     const statements = [
       db.prepare(
         `INSERT INTO customers (id, email, name, phone, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)
            ON CONFLICT (email) DO UPDATE SET name = COALESCE(excluded.name, customers.name), phone = COALESCE(excluded.phone, customers.phone), updated_at = excluded.updated_at`
-      ).bind(newId("cus"), email, name, phone, now, now),
+      ).bind(newId("cus"), spec.email, spec.name, spec.phone, now, now),
       db.prepare(
         `INSERT INTO orders (id, number, status, payment_status, currency, subtotal, shipping, tax, discount, total, customer_id, email,
              shipping_address_json, billing_address_json, shipping_method_code, shipping_method_name, notes, metadata_json, access_key, created_at, updated_at,
              discount_code, discount_partner, partner_commission)
-           VALUES (?, (SELECT MAX(COALESCE(MAX(number), 0) + 1, ?) FROM orders), 'pending_payment', 'unpaid', ?, ?, ?, 0, ?, ?, (SELECT id FROM customers WHERE email = ?), ?,
+           VALUES (?, (SELECT MAX(COALESCE(MAX(number), 0) + 1, ?) FROM orders), 'pending_payment', 'unpaid', ?, ?, ?, ?, ?, ?, (SELECT id FROM customers WHERE email = ?), ?,
              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       ).bind(
         orderId,
         this.ctx.config.orders.numberStart,
-        quote.currency,
-        quote.subtotal,
-        quote.shipping,
-        quote.discount,
-        quote.total,
-        email,
-        email,
-        JSON.stringify(shipTo),
-        input.billingAddress ? JSON.stringify(cleanAddress(input.billingAddress)) : null,
-        quote.option.id,
-        quote.option.label,
-        input.notes?.trim().slice(0, 2e3) || null,
-        JSON.stringify(metadata),
+        spec.currency,
+        spec.subtotal,
+        spec.shipping,
+        spec.tax,
+        spec.discount,
+        spec.total,
+        spec.email,
+        spec.email,
+        JSON.stringify(spec.shippingAddress),
+        spec.billingAddress ? JSON.stringify(spec.billingAddress) : null,
+        spec.shippingMethod?.code ?? null,
+        spec.shippingMethod?.name ?? null,
+        spec.notes?.trim().slice(0, 2e3) || null,
+        JSON.stringify(spec.metadata),
         randomToken(16),
         now,
         now,
-        quote.discountCode ? normalizeDiscountCode(quote.discountCode.code) : null,
-        quote.discountCode?.partner ?? null,
-        quote.commission
+        spec.discountCode,
+        spec.discountPartner,
+        spec.commission
       ),
-      ...quote.lines.map(
+      ...spec.lines.map(
         (l, i) => db.prepare(`INSERT INTO order_lines (id, order_id, sku, name, quantity, unit_amount, total_amount, fulfilled_quantity, image_url, position) VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?)`).bind(newId("lin"), orderId, l.sku, l.name, l.quantity, l.unitAmount, l.totalAmount, l.image, i)
       ),
-      this.events.statement(orderId, "created", {
-        lines: quote.lines.length,
-        total: quote.total,
-        ...quote.discountCode ? { discount_code: normalizeDiscountCode(quote.discountCode.code) } : {},
-        ...quote.quantityTier ? { quantity_tier: quote.quantityTier.minQuantity } : {},
-        ...quote.discount ? { discount: quote.discount } : {}
-      })
+      this.events.statement(orderId, "created", { lines: spec.lines.length, total: spec.total, ...spec.createdEvent })
     ];
     await db.batch(statements);
     return this.orders.require(orderId);
   }
 };
+function checkShippingAddress(address, details) {
+  const shipTo = cleanAddress(address) ?? {};
+  if (!shipTo.name) details["shipping_address.name"] = "is required";
+  if (!shipTo.line1) details["shipping_address.line1"] = "is required";
+  if (!shipTo.city) details["shipping_address.city"] = "is required";
+  if (!shipTo.country || shipTo.country.length !== 2) details["shipping_address.country"] = "is required";
+  else shipTo.country = shipTo.country.toUpperCase();
+  if (shipTo.country) Object.assign(details, checkAddressFormat(shipTo));
+  return shipTo;
+}
 function clampQuantity(n, max) {
   return Number.isFinite(n) ? Math.min(Math.max(Math.trunc(n), 1), max) : 1;
 }
@@ -983,21 +1015,31 @@ var InventoryService = class {
     const now = this.ctx.now();
     const unknown = [];
     const statements = [];
+    let updated = 0;
     for (const item of items) {
       if (!known.has(item.sku)) {
         unknown.push(item.sku);
         continue;
       }
+      updated++;
+      const available = Math.trunc(item.available);
+      const backorder = item.allow_backorder ? 1 : 0;
+      statements.push(
+        this.ctx.db.prepare(
+          `UPDATE products SET updated_at = ? WHERE sku = ?
+             AND NOT EXISTS (SELECT 1 FROM inventory WHERE sku = ? AND available = ? AND allow_backorder = ?)`
+        ).bind(now, item.sku, item.sku, available, backorder)
+      );
       statements.push(
         this.ctx.db.prepare(
           `INSERT INTO inventory (sku, available, allow_backorder, updated_at) VALUES (?, ?, ?, ?)
              ON CONFLICT (sku) DO UPDATE SET available = excluded.available, allow_backorder = excluded.allow_backorder, updated_at = excluded.updated_at`
-        ).bind(item.sku, Math.trunc(item.available), item.allow_backorder ? 1 : 0, now)
+        ).bind(item.sku, available, backorder, now)
       );
     }
     for (const part of chunk(statements, 250)) await this.ctx.db.batch(part);
     if (statements.length) this.invalidate();
-    return { updated: statements.length, unknown_skus: [...new Set(unknown)] };
+    return { updated, unknown_skus: [...new Set(unknown)] };
   }
   /** Availability for a set of SKUs; SKUs without a row are untracked (undefined). */
   async availability(skus) {
@@ -1012,9 +1054,10 @@ var InventoryService = class {
   /** Statements that move tracked stock by `delta` per SKU (negative to consume). Untracked SKUs are untouched. */
   adjustStatements(lines, direction) {
     const now = this.ctx.now();
-    return lines.map(
-      (l) => this.ctx.db.prepare(`UPDATE inventory SET available = available + ?, updated_at = ? WHERE sku = ?`).bind(direction * l.quantity, now, l.sku)
-    );
+    return lines.flatMap((l) => [
+      this.ctx.db.prepare(`UPDATE products SET updated_at = ? WHERE sku = ? AND EXISTS (SELECT 1 FROM inventory WHERE sku = ?)`).bind(now, l.sku, l.sku),
+      this.ctx.db.prepare(`UPDATE inventory SET available = available + ?, updated_at = ? WHERE sku = ?`).bind(direction * l.quantity, now, l.sku)
+    ]);
   }
 };
 
@@ -1550,6 +1593,425 @@ var OwnersService = class {
 };
 var DUMMY_HASH = "$pbkdf2-sha256$i=210000$AAAAAAAAAAAAAAAAAAAAAA$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
 
+// src/store/quotes.ts
+var QUOTE_SELECT = `SELECT q.*, c.name AS customer_name, c.phone AS customer_phone FROM quotes q JOIN customers c ON c.id = q.customer_id`;
+var OFFERABLE = ["requested", "quoted", "expired"];
+var encodeCursor2 = (updatedAt, id) => btoa(`${updatedAt}|${id}`).replace(/=+$/, "");
+var decodeCursor2 = (cursor) => {
+  try {
+    const raw = atob(cursor);
+    const i = raw.lastIndexOf("|");
+    return i < 0 ? null : { updatedAt: raw.slice(0, i), id: raw.slice(i + 1) };
+  } catch {
+    return null;
+  }
+};
+var clean = (v, max) => typeof v === "string" && v.trim() ? v.trim().slice(0, max) : null;
+var QuotesService = class {
+  constructor(ctx, catalog, checkout, orders) {
+    this.ctx = ctx;
+    this.catalog = catalog;
+    this.checkout = checkout;
+    this.orders = orders;
+  }
+  ctx;
+  catalog;
+  checkout;
+  orders;
+  // ---- reads -------------------------------------------------------------
+  async get(id) {
+    const [quote] = await this.hydrate(`${QUOTE_SELECT} WHERE q.id = ?`, [id]);
+    return quote ?? null;
+  }
+  async require(id) {
+    const quote = await this.get(id);
+    if (!quote) throw notFound("Quote");
+    return quote;
+  }
+  /** The emailed link's lookup: id plus the access key. This is how a guest gets back to their quote. */
+  async getWithKey(id, key) {
+    const quote = await this.get(id);
+    return quote && key && quote.accessKey === key ? quote : null;
+  }
+  async forCustomer(customerId) {
+    return this.hydrate(`${QUOTE_SELECT} WHERE q.customer_id = ? ORDER BY q.created_at DESC, q.number DESC`, [customerId]);
+  }
+  async getForCustomer(id, customerId) {
+    const [quote] = await this.hydrate(`${QUOTE_SELECT} WHERE q.id = ? AND q.customer_id = ?`, [id, customerId]);
+    return quote ?? null;
+  }
+  async count() {
+    const row = await this.ctx.db.prepare(`SELECT COUNT(*) AS n FROM quotes`).first();
+    return row?.n ?? 0;
+  }
+  /** Quotes changed since a watermark, oldest first, keyset-paged on (updated_at, id); `updatedSince` is inclusive. */
+  async changedSince(updatedSince, cursor, limit) {
+    const size = Math.min(Math.max(Math.trunc(limit) || 50, 1), 200);
+    const where = [];
+    const args = [];
+    if (cursor) {
+      const c = decodeCursor2(cursor);
+      if (!c) throw invalid("Invalid cursor", { cursor: "is not a cursor this store issued" });
+      where.push(`(q.updated_at, q.id) > (?, ?)`);
+      args.push(c.updatedAt, c.id);
+    } else if (updatedSince) {
+      where.push(`q.updated_at >= ?`);
+      args.push(updatedSince);
+    }
+    const quotes = await this.hydrate(`${QUOTE_SELECT}${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY q.updated_at ASC, q.id ASC LIMIT ?`, [...args, size + 1]);
+    const page = quotes.slice(0, size);
+    const last = page[page.length - 1];
+    return { quotes: page, nextCursor: quotes.length > size && last ? encodeCursor2(last.updatedAt, last.id) : null };
+  }
+  async events(id) {
+    const { results } = await this.ctx.db.prepare(`SELECT * FROM quote_events WHERE quote_id = ? ORDER BY id ASC`).bind(id).all();
+    return results.map((r) => ({ id: r.id, type: r.type, data: parseJson(r.data_json, null), createdAt: r.created_at }));
+  }
+  // ---- buyer -------------------------------------------------------------
+  /**
+   * Record a request for quote. The buyer needs no account and no password: the customer row is keyed by email,
+   * exactly as a guest checkout's is, and the emailed access-key link is how they come back. Sold-out products may
+   * be quoted (lead time is part of the answer); unknown or withdrawn ones may not. Throttled per email address.
+   */
+  async request(input) {
+    const details = {};
+    const email = normalizeEmail(input.email ?? "");
+    if (!EMAIL.test(email)) details.email = "must be a valid email address";
+    const name = clean(input.name, 200);
+    if (!name) details.name = "is required";
+    const items = input.items ?? [];
+    if (!items.length) details.items = "is empty";
+    if (items.length > MAX_CART_LINES) details.items = `has more than ${MAX_CART_LINES} lines`;
+    const max = this.ctx.config.quotes.maxQuantity;
+    const catalog = await this.catalog.load();
+    const merged = /* @__PURE__ */ new Map();
+    items.forEach((item, i) => {
+      const quantity = Number(item.quantity);
+      if (!Number.isInteger(quantity) || quantity < 1 || quantity > max) {
+        details[`items.${i}.quantity`] = `must be a whole number from 1 to ${max}`;
+        return;
+      }
+      if (!catalog.product(item.sku)) {
+        details[`items.${i}.sku`] = "is not a product in this store";
+        return;
+      }
+      merged.set(item.sku, Math.min((merged.get(item.sku) ?? 0) + quantity, max));
+    });
+    if (Object.keys(details).length) throw invalid("Quote request is incomplete", details);
+    await this.assertNotFlooding(email);
+    const db = this.ctx.db;
+    const now = this.ctx.now();
+    const id = newId("quo");
+    const address = cleanAddress(input.shippingAddress);
+    if (address?.country) address.country = address.country.toUpperCase();
+    const metadata = Object.fromEntries(Object.entries(input.metadata ?? {}).filter(([, v]) => typeof v === "string").slice(0, 20));
+    const lines = [...merged].map(([sku, quantity], position) => {
+      const product = catalog.product(sku);
+      return { sku, quantity, position, name: product.name, list: product.price.amount, image: product.images[0]?.src ?? null };
+    });
+    await db.batch([
+      db.prepare(
+        `INSERT INTO customers (id, email, name, phone, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT (email) DO UPDATE SET name = COALESCE(excluded.name, customers.name), phone = COALESCE(excluded.phone, customers.phone), updated_at = excluded.updated_at`
+      ).bind(newId("cus"), email, name, clean(input.phone, 50), now, now),
+      db.prepare(
+        `INSERT INTO quotes (id, number, status, customer_id, email, company, message, shipping_address_json, currency, metadata_json, access_key, created_at, updated_at)
+           VALUES (?, (SELECT MAX(COALESCE(MAX(number), 0) + 1, ?) FROM quotes), 'requested', (SELECT id FROM customers WHERE email = ?), ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).bind(
+        id,
+        this.ctx.config.quotes.numberStart,
+        email,
+        email,
+        clean(input.company, 200),
+        clean(input.message, 4e3),
+        address && Object.keys(address).length ? JSON.stringify(address) : null,
+        this.ctx.config.currency.toUpperCase(),
+        JSON.stringify(metadata),
+        randomToken(16),
+        now,
+        now
+      ),
+      ...lines.map(
+        (l) => db.prepare(`INSERT INTO quote_lines (id, quote_id, sku, name, quantity, list_amount, image_url, position) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).bind(newId("qln"), id, l.sku, l.name, l.quantity, l.list, l.image, l.position)
+      ),
+      this.event(id, "requested", { lines: lines.map((l) => ({ sku: l.sku, quantity: l.quantity })) })
+    ]);
+    const quote = await this.require(id);
+    await this.send(id, "quote_received", quote.customer.email, quoteReceivedMail(quote, this.mailContext()));
+    await this.notifyMerchant(quote, "requested");
+    return quote;
+  }
+  /**
+   * Accept a priced quote: places an order at exactly the offered prices (lines, shipping, tax) and links it. The
+   * order is pay-later (`payment_provider: manual`, never expires) — the operations system invoices and marks it
+   * paid, as B2B terms usually go; a store that wants card payment can start an adapter on the returned order.
+   * A second accept returns the same order.
+   */
+  async accept(id, input = {}) {
+    await this.expireStale();
+    const quote = await this.require(id);
+    if (quote.status === "accepted" && quote.orderId) return { quote, order: await this.orders.require(quote.orderId) };
+    if (quote.status === "expired") throw conflict("This quote has expired; ask for it to be renewed");
+    if (quote.status !== "quoted" || !quote.total) throw conflict(quote.status === "requested" ? "This quote has not been priced yet" : `A ${quote.status} quote cannot be accepted`);
+    const details = {};
+    const shipTo = checkShippingAddress(input.shippingAddress ?? quote.shippingAddress, details);
+    if (Object.keys(details).length) throw invalid("A shipping address is needed to accept this quote", details);
+    const now = this.ctx.now();
+    const claimed = await this.ctx.db.prepare(`UPDATE quotes SET status = 'accepted', accepted_at = ?, updated_at = ? WHERE id = ? AND status = 'quoted' AND (expires_at IS NULL OR expires_at > ?)`).bind(now, now, id, now).run();
+    if ((claimed.meta?.changes ?? 0) === 0) {
+      const current = await this.require(id);
+      if (current.status === "accepted" && current.orderId) return { quote: current, order: await this.orders.require(current.orderId) };
+      throw conflict("This quote changed while you were accepting it; reload it and try again");
+    }
+    const po = clean(input.poNumber, 100);
+    const lines = quote.lines.map((l) => ({
+      sku: l.sku,
+      name: l.name,
+      quantity: l.quantity,
+      unitAmount: l.unitAmount.amount,
+      totalAmount: l.totalAmount.amount,
+      image: l.image ?? null
+    }));
+    let order;
+    try {
+      order = await this.checkout.placePricedOrder({
+        email: quote.customer.email,
+        name: quote.customer.name ?? shipTo.name ?? null,
+        phone: clean(input.phone, 50) ?? quote.customer.phone,
+        currency: quote.currency,
+        lines,
+        subtotal: quote.subtotal.amount,
+        shipping: quote.shipping?.amount ?? 0,
+        tax: quote.tax?.amount ?? 0,
+        discount: 0,
+        total: quote.total.amount,
+        shippingAddress: shipTo,
+        billingAddress: null,
+        shippingMethod: { code: "quote", name: `As quoted (${this.ctx.config.quotes.numberPrefix}${quote.number})` },
+        notes: [po ? `PO ${po}` : null, clean(input.notes, 1800)].filter(Boolean).join("\n") || null,
+        metadata: {
+          quote_id: quote.id,
+          quote_number: `${this.ctx.config.quotes.numberPrefix}${quote.number}`,
+          ...po ? { po_number: po } : {},
+          ...quote.externalReference ? { quote_external_reference: quote.externalReference } : {}
+        },
+        discountCode: null,
+        discountPartner: null,
+        commission: 0,
+        createdEvent: { quote_id: quote.id }
+      });
+    } catch (error) {
+      await this.ctx.db.prepare(`UPDATE quotes SET status = 'quoted', accepted_at = NULL, updated_at = ? WHERE id = ? AND status = 'accepted' AND order_id IS NULL`).bind(this.ctx.now(), id).run();
+      throw error;
+    }
+    await this.orders.startPayment(order.id, { provider: "manual", kind: "instructions" });
+    await this.ctx.db.batch([
+      this.ctx.db.prepare(`UPDATE quotes SET order_id = ?, shipping_address_json = ?, updated_at = ? WHERE id = ?`).bind(order.id, JSON.stringify(shipTo), this.ctx.now(), id),
+      this.event(id, "accepted", { order_id: order.id, order_number: order.number, ...po ? { po_number: po } : {} })
+    ]);
+    const placed = await this.orders.require(order.id);
+    await this.orders.notifyReceived(placed);
+    const accepted = await this.require(id);
+    await this.notifyMerchant(accepted, "accepted", placed.number);
+    return { quote: accepted, order: placed };
+  }
+  /** The buyer turns a quote down — before or after it is priced. */
+  async decline(id, reason = null) {
+    const quote = await this.require(id);
+    if (quote.status === "declined") return quote;
+    if (quote.status !== "requested" && quote.status !== "quoted" && quote.status !== "expired") throw conflict(`A ${quote.status} quote cannot be declined`);
+    const now = this.ctx.now();
+    const why = clean(reason, 1e3);
+    await this.ctx.db.batch([
+      this.ctx.db.prepare(`UPDATE quotes SET status = 'declined', declined_at = ?, decline_reason = ?, updated_at = ? WHERE id = ?`).bind(now, why, now, id),
+      this.event(id, "declined", why ? { reason: why } : null)
+    ]);
+    const declined = await this.require(id);
+    await this.notifyMerchant(declined, "declined");
+    return declined;
+  }
+  // ---- operations system (Store API) ------------------------------------
+  /**
+   * Price a quote. The lines replace the request's: the operations system may change a quantity, drop a line or add
+   * an alternative (a SKU the store does not list needs a `name`). Re-offering a live or lapsed quote revises it.
+   */
+  async offer(id, input) {
+    const quote = await this.require(id);
+    if (!OFFERABLE.includes(quote.status)) throw conflict(`A ${quote.status} quote cannot be re-priced`);
+    const currency = quote.currency.toUpperCase();
+    const details = {};
+    if (!input.lines.length) details["offer.lines"] = "must have at least one line";
+    if (input.lines.length > MAX_CART_LINES) details["offer.lines"] = `has more than ${MAX_CART_LINES} lines`;
+    const catalog = await this.catalog.load();
+    const max = this.ctx.config.quotes.maxQuantity;
+    const requested = new Map(quote.lines.map((l) => [l.sku, l]));
+    const seen = /* @__PURE__ */ new Set();
+    const lines = input.lines.map((l, i) => {
+      const product = catalog.product(l.sku);
+      const name = clean(l.name, 300) ?? product?.name ?? requested.get(l.sku)?.name ?? null;
+      if (!name) details[`offer.lines.${i}.name`] = "is required for a SKU this store does not list";
+      if (seen.has(l.sku)) details[`offer.lines.${i}.sku`] = "appears twice";
+      seen.add(l.sku);
+      if (l.quantity > max) details[`offer.lines.${i}.quantity`] = `must be at most ${max}`;
+      if (l.unit_amount.currency.toUpperCase() !== currency) details[`offer.lines.${i}.unit_amount.currency`] = `must be ${currency}`;
+      return {
+        sku: l.sku,
+        name: name ?? l.sku,
+        quantity: l.quantity,
+        unit: l.unit_amount.amount,
+        total: l.unit_amount.amount * l.quantity,
+        list: product?.price.amount ?? requested.get(l.sku)?.listAmount?.amount ?? null,
+        image: product?.images[0]?.src ?? requested.get(l.sku)?.image ?? null
+      };
+    });
+    for (const [key, m] of [["shipping", input.shipping], ["tax", input.tax]]) {
+      if (m && m.currency.toUpperCase() !== currency) details[`offer.${key}.currency`] = `must be ${currency}`;
+    }
+    const now = this.ctx.now();
+    if (input.expires_at && input.expires_at <= now) details["offer.expires_at"] = "must be in the future";
+    if (Object.keys(details).length) throw invalid("Offer is invalid", details);
+    const subtotal = lines.reduce((n, l) => n + l.total, 0);
+    const shipping = input.shipping?.amount ?? 0;
+    const tax = input.tax?.amount ?? 0;
+    const total = subtotal + shipping + tax;
+    const db = this.ctx.db;
+    const statements = [
+      db.prepare(`DELETE FROM quote_lines WHERE quote_id = ?`).bind(id),
+      ...lines.map(
+        (l, position) => db.prepare(`INSERT INTO quote_lines (id, quote_id, sku, name, quantity, list_amount, unit_amount, total_amount, image_url, position) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(newId("qln"), id, l.sku, l.name, l.quantity, l.list, l.unit, l.total, l.image, position)
+      ),
+      db.prepare(
+        `UPDATE quotes SET status = 'quoted', subtotal = ?, shipping = ?, tax = ?, total = ?, offer_note = ?, expires_at = ?, quoted_at = ?, updated_at = ?
+           WHERE id = ? AND status IN ('requested', 'quoted', 'expired')`
+      ).bind(subtotal, shipping, tax, total, clean(input.note, 4e3), input.expires_at ?? null, now, now, id),
+      this.event(id, quote.status === "requested" ? "quoted" : "requoted", { total, lines: lines.length, expires_at: input.expires_at ?? null })
+    ];
+    await db.batch(statements);
+    const priced = await this.require(id);
+    if (input.notify_customer !== false) await this.send(id, "quote_ready", priced.customer.email, quoteReadyMail(priced, this.mailContext()));
+    return priced;
+  }
+  async setExternalReference(id, reference) {
+    const quote = await this.require(id);
+    if (quote.externalReference === reference) return quote;
+    const now = this.ctx.now();
+    await this.ctx.db.batch([
+      this.ctx.db.prepare(`UPDATE quotes SET external_reference = ?, updated_at = ? WHERE id = ?`).bind(reference, now, id),
+      this.event(id, "external_reference_set", { reference })
+    ]);
+    return this.require(id);
+  }
+  /** The merchant withdraws a quote. An accepted one has an order: cancel that instead. */
+  async cancel(id, reason = null) {
+    const quote = await this.require(id);
+    if (quote.status === "cancelled") return quote;
+    if (quote.status === "accepted") throw conflict("An accepted quote has become an order; cancel the order instead");
+    const now = this.ctx.now();
+    await this.ctx.db.batch([
+      this.ctx.db.prepare(`UPDATE quotes SET status = 'cancelled', cancelled_at = ?, updated_at = ? WHERE id = ?`).bind(now, now, id),
+      this.event(id, "cancelled", reason ? { reason } : null)
+    ]);
+    return this.require(id);
+  }
+  /**
+   * Lapse offers past their `expires_at`. Lazy, like abandoned checkouts: it runs at the start of the Store API quote
+   * list and of an accept, so no cron is needed and a consumer never sees a lapsed offer as live.
+   */
+  async expireStale(limit = 200) {
+    const now = this.ctx.now();
+    const { results } = await this.ctx.db.prepare(`SELECT id FROM quotes WHERE status = 'quoted' AND expires_at IS NOT NULL AND expires_at <= ? ORDER BY expires_at LIMIT ?`).bind(now, Math.min(Math.max(limit, 1), 500)).all();
+    if (!results.length) return 0;
+    const statements = results.flatMap((r) => [
+      this.ctx.db.prepare(`UPDATE quotes SET status = 'expired', updated_at = ? WHERE id = ? AND status = 'quoted'`).bind(now, r.id),
+      this.event(r.id, "expired")
+    ]);
+    for (const part of chunk(statements, 250)) await this.ctx.db.batch(part);
+    return results.length;
+  }
+  // ---- internals ---------------------------------------------------------
+  async assertNotFlooding(email) {
+    const since = new Date(new Date(this.ctx.now()).getTime() - 36e5).toISOString();
+    const row = await this.ctx.db.prepare(`SELECT COUNT(*) AS n FROM quotes WHERE email = ? AND created_at > ?`).bind(email, since).first();
+    if ((row?.n ?? 0) >= this.ctx.config.quotes.maxRequestsPerHour) {
+      throw new StoreError("rate_limited", "Too many quote requests from this address. Please try again in an hour, or contact us directly.");
+    }
+  }
+  event(quoteId, type, data = null) {
+    return this.ctx.db.prepare(`INSERT INTO quote_events (quote_id, type, data_json, created_at) VALUES (?, ?, ?, ?)`).bind(quoteId, type, data ? JSON.stringify(data) : null, this.ctx.now());
+  }
+  mailContext() {
+    return { config: this.ctx.config, siteUrl: this.ctx.siteUrl };
+  }
+  /** The merchant hears about requests and answers at QUOTE_NOTIFICATION_EMAIL, else ORDER_NOTIFICATION_EMAIL. */
+  async notifyMerchant(quote, event, orderNumber) {
+    const to = this.ctx.env.QUOTE_NOTIFICATION_EMAIL || this.ctx.env.ORDER_NOTIFICATION_EMAIL;
+    if (to) await this.send(quote.id, `merchant_quote_${event}`, to, merchantQuoteMail(quote, this.mailContext(), event, orderNumber), quote.customer.email);
+  }
+  async send(quoteId, kind, to, mail, replyTo) {
+    try {
+      await this.ctx.mail.send({ to, ...mail, ...replyTo ? { replyTo } : {} });
+      await this.event(quoteId, "email_sent", { kind, to }).run();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.ctx.log(`quotes: ${kind} email failed`, { quoteId, to, error: message });
+      await this.event(quoteId, "email_failed", { kind, to, error: message }).run().catch(() => {
+      });
+    }
+  }
+  async hydrate(sql, args) {
+    const { results: rows } = await this.ctx.db.prepare(sql).bind(...args).all();
+    if (!rows.length) return [];
+    const lines = /* @__PURE__ */ new Map();
+    for (const part of chunk(rows.map((r) => r.id))) {
+      const { results } = await this.ctx.db.prepare(`SELECT * FROM quote_lines WHERE quote_id IN (${placeholders(part.length)}) ORDER BY position, id`).bind(...part).all();
+      for (const r of results) (lines.get(r.quote_id) ?? lines.set(r.quote_id, []).get(r.quote_id)).push(r);
+    }
+    return rows.map((r) => rowToQuote(r, lines.get(r.id) ?? []));
+  }
+};
+function rowToQuote(r, lines) {
+  const money = (amount) => amount === null || amount === void 0 ? null : { amount, currency: r.currency };
+  return {
+    id: r.id,
+    number: String(r.number),
+    status: r.status,
+    currency: r.currency,
+    customer: { id: r.customer_id, email: r.email, name: r.customer_name, phone: r.customer_phone },
+    company: r.company,
+    message: r.message,
+    shippingAddress: r.shipping_address_json ? parseJson(r.shipping_address_json, null) : null,
+    lines: lines.map(
+      (l) => ({
+        id: l.id,
+        sku: l.sku,
+        name: l.name,
+        quantity: l.quantity,
+        listAmount: money(l.list_amount),
+        unitAmount: money(l.unit_amount),
+        totalAmount: money(l.total_amount),
+        ...l.image_url ? { image: l.image_url } : {}
+      })
+    ),
+    subtotal: money(r.subtotal),
+    shipping: money(r.shipping),
+    tax: money(r.tax),
+    total: money(r.total),
+    offerNote: r.offer_note,
+    expiresAt: r.expires_at,
+    externalReference: r.external_reference,
+    orderId: r.order_id,
+    declineReason: r.decline_reason,
+    metadata: parseJson(r.metadata_json, {}),
+    accessKey: r.access_key,
+    createdAt: r.created_at,
+    updatedAt: r.updated_at,
+    quotedAt: r.quoted_at,
+    acceptedAt: r.accepted_at,
+    declinedAt: r.declined_at,
+    cancelledAt: r.cancelled_at
+  };
+}
+
 // src/store/sessions.ts
 var MAGIC_LINK_MINUTES = 15;
 var SESSION_DAYS = 30;
@@ -1633,7 +2095,7 @@ function bindable(value) {
 }
 
 // src/store/index.ts
-var STORE_PLATFORM_VERSION = "2.1.0";
+var STORE_PLATFORM_VERSION = "2.2.0";
 function createStore(options) {
   const env = options.env ?? {};
   const clock = options.clock ?? (() => /* @__PURE__ */ new Date());
@@ -1652,6 +2114,7 @@ function createStore(options) {
   const customers = new CustomersService(ctx);
   const orders = new OrdersService(ctx, events, inventory);
   const checkout = new CheckoutService(ctx, catalog, orders, events);
+  const quotes = new QuotesService(ctx, catalog, checkout, orders);
   const sessions = new SessionsService(ctx, customers);
   const owners = new OwnersService(ctx);
   const connections = new ConnectionsService(ctx);
@@ -1668,20 +2131,21 @@ function createStore(options) {
     customers,
     orders,
     checkout,
+    quotes,
     sessions,
     events,
     owners,
     connections,
     partners,
     async health() {
-      const [counts, orderCount, customerCount, ownerCount] = await Promise.all([catalog.counts(), orders.count(), customers.count(), owners.count()]);
+      const [counts, orderCount, customerCount, ownerCount, quoteCount] = await Promise.all([catalog.counts(), orders.count(), customers.count(), owners.count(), quotes.count()]);
       return {
         name: ctx.config.name,
         url: ctx.config.url,
         currency: ctx.config.currency.toUpperCase(),
         locale: ctx.config.locale,
         version: STORE_PLATFORM_VERSION,
-        counts: { ...counts, orders: orderCount, customers: customerCount },
+        counts: { ...counts, orders: orderCount, customers: customerCount, quotes: quoteCount },
         owner_configured: ownerCount > 0,
         time: ctx.now()
       };
@@ -1709,6 +2173,7 @@ export {
   PASSWORD_ITERATIONS,
   PASSWORD_MIN_LENGTH,
   PartnersService,
+  QuotesService,
   RateLimiter,
   SCOPE_DESCRIPTIONS,
   SESSION_DAYS,
@@ -1716,6 +2181,7 @@ export {
   SessionsService,
   StoreError,
   bindable,
+  checkShippingAddress,
   createStore,
   deriveAvailability,
   hashPassword,