@blamejs/blamejs-shop 0.2.13 → 0.2.15

package/lib/admin.js

@@ -138,6 +138,25 @@ function _strictMinorInt(value, prefix, label) {
   return n;
 }
 
+// Parse a "k=v, k=v" form string into a variant options attribute map.
+// An empty / whitespace string yields `{}` (no options). A pair missing
+// its `=` is skipped rather than throwing — the catalog primitive does
+// the authoritative validation on the resulting object. Keys + values
+// are trimmed; a duplicate key keeps the last value.
+function _parseOptionsString(s) {
+  if (s == null) return {};
+  if (typeof s !== "string") return {};
+  var out = {};
+  s.split(",").forEach(function (pair) {
+    var eq = pair.indexOf("=");
+    if (eq === -1) return;
+    var k = pair.slice(0, eq).trim();
+    var v = pair.slice(eq + 1).trim();
+    if (k) out[k] = v;
+  });
+  return out;
+}
+
 // ---- bearer auth --------------------------------------------------------
 
 function _readBearer(req) {
@@ -300,7 +319,7 @@ function mount(router, deps) {
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -401,11 +420,77 @@ function mount(router, deps) {
     },
   ));
 
-  router.get("/admin/products/:id", R(async function (req, res) {
-    var p = await catalog.products.get(req.params.id);
-    if (!p) return _problem(res, 404, "product-not-found");
-    _json(res, 200, p);
-  }));
+  // Default currency for the price-set form — read from shop config when
+  // wired, falling back to USD. A config read failure (unconfigured store)
+  // is non-fatal: the form just defaults to USD.
+  async function _defaultCurrency() {
+    if (!deps.config) return "USD";
+    try {
+      var c = await deps.config.get("shop.currency", "USD");
+      return (typeof c === "string" && /^[A-Z]{3}$/.test(c)) ? c : "USD";
+    } catch (_e) { return "USD"; }
+  }
+
+  // Hydrate the full detail model: the product, its variants, each
+  // variant's price-per-currency (current + history), and the product's
+  // media. Throws TypeError on a malformed id (defensive id reader) — the
+  // caller maps that to a 404, never a 500.
+  async function _productDetailModel(id) {
+    var p = await catalog.products.get(id);
+    if (!p) return null;
+    var variants = await catalog.variants.listForProduct(id);
+    var pricesByVariant = {};
+    for (var i = 0; i < variants.length; i += 1) {
+      var v = variants[i];
+      var currencies = await catalog.prices.currencies(v.id);
+      var perCurrency = [];
+      for (var j = 0; j < currencies.length; j += 1) {
+        var cur = currencies[j];
+        perCurrency.push({
+          currency: cur,
+          current:  await catalog.prices.current(v.id, cur),
+          history:  await catalog.prices.history(v.id, cur),
+        });
+      }
+      pricesByVariant[v.id] = { currencies: perCurrency };
+    }
+    var media = await catalog.media.listForProduct(id);
+    return { product: p, variants: variants, prices_by_variant: pricesByVariant, media: media };
+  }
+
+  // Detail content-negotiates: bearer → JSON (product + variants + prices
+  // + media); browser → the full management screen. A bad / unknown id is
+  // a 404 page, never a 500.
+  router.get("/admin/products/:id", _pageOrApi(true,
+    R(async function (req, res) {
+      var model;
+      try { model = await _productDetailModel(req.params.id); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 404, "product-not-found", e.message); throw e; }
+      if (!model) return _problem(res, 404, "product-not-found");
+      _json(res, 200, model);
+    }),
+    async function (req, res) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var model;
+      try { model = await _productDetailModel(req.params.id); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; model = null; }
+      if (!model) {
+        var page = await catalog.products.list({ limit: 100 });
+        return _sendHtml(res, 404, renderAdminProducts({
+          shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [], notice: "Product not found.",
+        }));
+      }
+      _sendHtml(res, 200, renderAdminProduct({
+        shop_name: deps.shop_name, nav_available: navAvailable,
+        product: model.product, variants: model.variants,
+        prices_by_variant: model.prices_by_variant, media: model.media,
+        asset_prefix: assetPrefix, upload_available: !!r2,
+        default_currency: await _defaultCurrency(),
+        saved:  url && url.searchParams.get("saved"),
+        notice: (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+      }));
+    },
+  ));
 
   router.patch("/admin/products/:id", W("product.update", async function (req, res) {
     var p = await catalog.products.update(req.params.id, req.body || {});
@@ -414,6 +499,40 @@ function mount(router, deps) {
     return p;
   }));
 
+  // Browser POST alias for the product fields edit (HTML forms can't
+  // PATCH). Bearer clients keep using PATCH /admin/products/:id. Bad input
+  // re-renders the detail with a notice (?err=1), never a 500.
+  router.post("/admin/products/:id/edit", _pageOrApi(false,
+    W("product.update", async function (req, res) {
+      var p;
+      try { p = await catalog.products.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!p) return _problem(res, 404, "product-not-found");
+      _json(res, 200, p);
+      return p;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      var patch = {};
+      if (typeof body.slug === "string")        patch.slug = body.slug.trim();
+      if (typeof body.title === "string")       patch.title = body.title;
+      if (typeof body.description === "string") patch.description = body.description;
+      if (typeof body.status === "string" && body.status) patch.status = body.status;
+      try {
+        if (Object.keys(patch).length === 0) return _redirect(res, "/admin/products/" + enc + "?err=1");
+        var p = await catalog.products.update(id, patch);
+        if (!p) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.update", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   function _productStateAction(verb, op, audit) {
     return _pageOrApi(false,
       W(audit, async function (req, res) {
@@ -443,6 +562,37 @@ function mount(router, deps) {
     return v;
   }));
 
+  // Browser POST alias for variant create from the product detail screen.
+  // The options string ("k=v, k=v") and the weight / requires_shipping
+  // selects come in as form strings — coerce them to the shapes the
+  // primitive expects before handing off. Bad input → ?err=1 notice.
+  router.post("/admin/products/:id/variants/create", _pageOrApi(false,
+    W("variant.create", async function (req, res) {
+      var v = await catalog.variants.create(req.params.id, req.body || {});
+      _json(res, 201, v);
+      return v;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      try {
+        await catalog.variants.create(id, {
+          sku:               typeof body.sku === "string" ? body.sku.trim() : body.sku,
+          title:             typeof body.title === "string" ? body.title : undefined,
+          options:           _parseOptionsString(body.options),
+          weight_grams:      body.weight_grams === undefined || body.weight_grams === "" ? undefined : _strictMinorInt(body.weight_grams, "admin.variant", "weight_grams"),
+          requires_shipping: body.requires_shipping === undefined ? undefined : (String(body.requires_shipping) === "1"),
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.create", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   router.patch("/admin/variants/:id", W("variant.update", async function (req, res) {
     var v = await catalog.variants.update(req.params.id, req.body || {});
     if (!v) return _problem(res, 404, "variant-not-found");
@@ -450,6 +600,51 @@ function mount(router, deps) {
     return v;
   }));
 
+  // Resolve the owning product id for a variant so a variant-scoped
+  // browser route can redirect back to the product detail page. Returns
+  // null for a missing / malformed id.
+  async function _variantProductId(variantId) {
+    var v = null;
+    try { v = await catalog.variants.get(variantId); }
+    catch (e) { if (!(e instanceof TypeError)) throw e; }
+    return v ? v.product_id : null;
+  }
+
+  // Browser POST alias for variant edit (HTML forms can't PATCH).
+  router.post("/admin/variants/:id/edit", _pageOrApi(false,
+    W("variant.update", async function (req, res) {
+      var v;
+      try { v = await catalog.variants.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!v) return _problem(res, 404, "variant-not-found");
+      _json(res, 200, v);
+      return v;
+    }),
+    async function (req, res) {
+      var vid  = req.params.id;
+      var body = req.body || {};
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!productId) return _redirect(res, back + "?err=1");
+      try {
+        var patch = {};
+        if (typeof body.sku === "string")   patch.sku = body.sku.trim();
+        if (typeof body.title === "string") patch.title = body.title;
+        if (typeof body.options === "string") patch.options = _parseOptionsString(body.options);
+        if (body.weight_grams !== undefined && body.weight_grams !== "") patch.weight_grams = _strictMinorInt(body.weight_grams, "admin.variant", "weight_grams");
+        if (body.requires_shipping !== undefined) patch.requires_shipping = String(body.requires_shipping) === "1";
+        if (Object.keys(patch).length === 0) return _redirect(res, back + "?err=1");
+        var v = await catalog.variants.update(vid, patch);
+        if (!v) return _redirect(res, back + "?err=1");
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, back + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.update", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   router.delete("/admin/variants/:id", W("variant.delete", async function (req, res) {
     var ok = await catalog.variants.delete(req.params.id);
     if (!ok) return _problem(res, 404, "variant-not-found");
@@ -457,6 +652,56 @@ function mount(router, deps) {
     return { id: req.params.id };
   }));
 
+  // Browser confirm interstitial for variant delete — deleting a variant
+  // removes its prices + media via the FK cascade, so the console confirms
+  // first (the CSP forbids a client confirm() dialog). Reached by a GET
+  // link from the detail screen; bearer clients DELETE directly.
+  router.get("/admin/variants/:id/delete/confirm-page", _pageOrApi(true,
+    R(async function (_req, res) {
+      return _problem(res, 405, "use-canonical-endpoint", "DELETE /admin/variants/:id (or POST .../delete) directly for the JSON API");
+    }),
+    async function (req, res) {
+      var vid = req.params.id;
+      var v = null;
+      try { v = await catalog.variants.get(vid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = v ? v.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!v) return _redirect(res, back + "?err=1");
+      _sendHtml(res, 200, renderAdminConfirm({
+        shop_name: deps.shop_name, nav_available: navAvailable, active: "products",
+        heading: "Delete this variant?",
+        consequence: "Deleting the variant is permanent — its prices and any media attached to it are removed too.",
+        detail: "Variant: " + (v.title || v.sku) + " (" + v.sku + ").",
+        action: "/admin/variants/" + _htmlEscape(vid) + "/delete",
+        confirm_label: "Delete variant",
+        cancel_href: back,
+      }));
+    },
+  ));
+
+  // Browser POST for variant delete (HTML forms can't DELETE). Bearer
+  // clients keep using DELETE /admin/variants/:id.
+  router.post("/admin/variants/:id/delete", _pageOrApi(false,
+    W("variant.delete", async function (req, res) {
+      var ok = await catalog.variants.delete(req.params.id);
+      if (!ok) return _problem(res, 404, "variant-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var vid = req.params.id;
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      var ok = false;
+      try { ok = await catalog.variants.delete(vid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      if (!ok) return _redirect(res, back + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.delete", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   // ---- prices ---------------------------------------------------------
 
   router.post("/admin/variants/:id/prices", W("price.set", async function (req, res) {
@@ -465,6 +710,37 @@ function mount(router, deps) {
     return p;
   }));
 
+  // Browser POST alias for setting a price from the product detail screen.
+  // The amount comes in as a form string — coerce it with the strict
+  // integer reader (refuses "29.99" / "" / "50abc") before handing to the
+  // primitive. Bad input → ?err=1 notice on the product detail.
+  router.post("/admin/variants/:id/prices/set", _pageOrApi(false,
+    W("price.set", async function (req, res) {
+      var p = await catalog.prices.set(req.params.id, req.body || {});
+      _json(res, 201, p);
+      return p;
+    }),
+    async function (req, res) {
+      var vid  = req.params.id;
+      var body = req.body || {};
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!productId) return _redirect(res, back + "?err=1");
+      try {
+        var amount = _strictMinorInt(body.amount_minor, "admin.price", "amount_minor");
+        await catalog.prices.set(vid, {
+          currency:     typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+          amount_minor: amount,
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, back + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".price.set", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   router.get("/admin/variants/:id/prices", R(async function (req, res) {
     var url = req.url ? new URL(req.url, "http://localhost") : null;
     var currency = url && url.searchParams.get("currency");
@@ -607,6 +883,36 @@ function mount(router, deps) {
     return m;
   }));
 
+  // Browser POST alias: attach an existing R2 object to a product from the
+  // product detail screen. The product id comes from the path; the
+  // primitive validates the r2_key + content_type. Bad input → ?err=1.
+  router.post("/admin/products/:id/media/attach", _pageOrApi(false,
+    W("media.attach", async function (req, res) {
+      var body = Object.assign({}, req.body || {}, { product_id: req.params.id });
+      var m = await catalog.media.attach(body);
+      _json(res, 201, m);
+      return m;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      try {
+        await catalog.media.attach({
+          product_id:   id,
+          r2_key:       typeof body.r2_key === "string" ? body.r2_key.trim() : body.r2_key,
+          content_type: typeof body.content_type === "string" ? body.content_type.trim() : body.content_type,
+          alt_text:     typeof body.alt_text === "string" ? body.alt_text : undefined,
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.attach", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   // --- media upload (r2 bridge) ---------------------------------------
   // POST /admin/media/upload — fetches `source_url` via b.httpClient
   // (SSRF gate + size cap), uploads to R2 through the bridge, then
@@ -614,8 +920,13 @@ function mount(router, deps) {
   // r2_bridge is wired (operator hasn't set D1_BRIDGE_URL +
   // D1_BRIDGE_SECRET).
   if (r2) {
-    router.post("/admin/media/upload", W("media.upload", async function (req, res) {
-      var body = req.body || {};
+    // Fetch → store → attach, shared by the JSON upload route and the
+    // browser POST alias. Throws TypeError on bad input (mapped to 400);
+    // returns `{ status, code, detail }` for an operational failure the
+    // caller renders as a problem (JSON) or ?err=1 (browser), or `{ rec }`
+    // on success.
+    async function _performMediaUpload(body) {
+      body = body || {};
       if (typeof body.source_url !== "string" || !body.source_url.length) {
         throw new TypeError("admin.media.upload: body.source_url required");
       }
@@ -641,11 +952,10 @@ function mount(router, deps) {
           headers:   { "accept": body.content_type + ",*/*;q=0.5" },
         });
       } catch (e) {
-        return _problem(res, 502, "source-fetch-failed", (e && e.message) || String(e));
+        return { status: 502, code: "source-fetch-failed", detail: (e && e.message) || String(e) };
       }
       if (fetched.statusCode < 200 || fetched.statusCode >= 300) {
-        return _problem(res, 502, "source-fetch-status",
-          "source_url returned HTTP " + fetched.statusCode);
+        return { status: 502, code: "source-fetch-status", detail: "source_url returned HTTP " + fetched.statusCode };
       }
       var fetchedCT = String(fetched.headers && (fetched.headers["content-type"] || fetched.headers["Content-Type"]) || "");
       // Loose match — the declared content_type must be a prefix of
@@ -655,13 +965,13 @@ function mount(router, deps) {
       var declared = body.content_type.split(";")[0].trim().toLowerCase();
       var served   = fetchedCT.split(";")[0].trim().toLowerCase();
       if (served && declared !== served) {
-        return _problem(res, 422, "content-type-mismatch",
-          "source_url served `" + served + "` but operator declared `" + declared + "`");
+        return { status: 422, code: "content-type-mismatch",
+          detail: "source_url served `" + served + "` but operator declared `" + declared + "`" };
       }
       var buf = fetched.body && Buffer.isBuffer(fetched.body) ? fetched.body
               : Buffer.from(fetched.body || "");
       if (buf.length === 0) {
-        return _problem(res, 422, "source-empty", "source_url returned an empty body");
+        return { status: 422, code: "source-empty", detail: "source_url returned an empty body" };
       }
       // Generate the R2 key. The extension is inferred from the
       // declared content-type so the operator can preview the asset
@@ -672,7 +982,7 @@ function mount(router, deps) {
       try {
         await r2.put(key, buf, body.content_type);
       } catch (e) {
-        return _problem(res, 502, "r2-upload-failed", (e && e.message) || String(e));
+        return { status: 502, code: "r2-upload-failed", detail: (e && e.message) || String(e) };
       }
       var m;
       try {
@@ -690,15 +1000,42 @@ function mount(router, deps) {
         // The R2 write succeeded but the DB row didn't land — surface
         // the orphan key so the operator can reconcile or re-attach.
         var problem = e instanceof TypeError ? 400 : 500;
-        return _problem(res, problem, "media-attach-failed",
-          (e && e.message || String(e)) + " (orphan r2_key=" + key + ")");
+        return { status: problem, code: "media-attach-failed",
+          detail: (e && e.message || String(e)) + " (orphan r2_key=" + key + ")" };
       }
       // Expose the public asset URL alongside the media row so the
       // admin UI can preview without an extra round-trip.
-      var rec = Object.assign({}, m, { asset_url: assetPrefix + key });
-      _json(res, 201, rec);
-      return rec;
+      return { rec: Object.assign({}, m, { asset_url: assetPrefix + key }) };
+    }
+
+    router.post("/admin/media/upload", W("media.upload", async function (req, res) {
+      var out = await _performMediaUpload(req.body || {});
+      if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+      return _problem(res, out.status, out.code, out.detail);
     }));
+
+    // Browser POST alias: upload-from-URL scoped to a product (id from the
+    // path). On success PRGs back to the detail; an operational failure or
+    // bad input lands a ?err=1 notice rather than a problem-details JSON.
+    router.post("/admin/products/:id/media/upload", _pageOrApi(false,
+      W("media.upload", async function (req, res) {
+        var body = Object.assign({}, req.body || {}, { product_id: req.params.id });
+        var out = await _performMediaUpload(body);
+        if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+        return _problem(res, out.status, out.code, out.detail);
+      }),
+      async function (req, res) {
+        var id  = req.params.id;
+        var enc = encodeURIComponent(id);
+        var body = Object.assign({}, req.body || {}, { product_id: id });
+        var out;
+        try { out = await _performMediaUpload(body); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/products/" + enc + "?err=1"); }
+        if (!out.rec) return _redirect(res, "/admin/products/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.upload", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/products/" + enc + "?saved=1");
+      },
+    ));
   }
 
   router.delete("/admin/media/:id", W("media.delete", async function (req, res) {
@@ -708,6 +1045,57 @@ function mount(router, deps) {
     return { id: req.params.id };
   }));
 
+  // Browser confirm interstitial for media delete — removing a media row
+  // detaches the asset from the product (the R2 object itself is left in
+  // the bucket for the operator to reclaim), so the console confirms.
+  router.get("/admin/media/:id/delete/confirm-page", _pageOrApi(true,
+    R(async function (_req, res) {
+      return _problem(res, 405, "use-canonical-endpoint", "DELETE /admin/media/:id (or POST .../delete) directly for the JSON API");
+    }),
+    async function (req, res) {
+      var mid = req.params.id;
+      var m = null;
+      try { m = await catalog.media.get(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = m ? m.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!m) return _redirect(res, back + "?err=1");
+      _sendHtml(res, 200, renderAdminConfirm({
+        shop_name: deps.shop_name, nav_available: navAvailable, active: "products",
+        heading: "Delete this media?",
+        consequence: "This detaches the asset from the product. The stored object remains in your bucket — reclaim it there if no longer needed.",
+        detail: m.r2_key ? "Key: " + m.r2_key : "This media row will be removed.",
+        action: "/admin/media/" + _htmlEscape(mid) + "/delete",
+        confirm_label: "Delete media",
+        cancel_href: back,
+      }));
+    },
+  ));
+
+  // Browser POST for media delete (HTML forms can't DELETE).
+  router.post("/admin/media/:id/delete", _pageOrApi(false,
+    W("media.delete", async function (req, res) {
+      var ok = await catalog.media.delete(req.params.id);
+      if (!ok) return _problem(res, 404, "media-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var mid = req.params.id;
+      var m = null;
+      try { m = await catalog.media.get(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = m ? m.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      var ok = false;
+      try { ok = await catalog.media.delete(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      if (!ok) return _redirect(res, back + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.delete", outcome: "success", metadata: { id: mid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   // ---- bulk catalog import --------------------------------------------
 
   // POST /admin/catalog/import — Content-Type: text/csv body. The CSV
@@ -2719,6 +3107,620 @@ function mount(router, deps) {
     return issued;
   }
 
+  // ---- tax rates ------------------------------------------------------
+  //
+  // Operator-managed per-jurisdiction rate table. `defineRate` keys on a
+  // (jurisdiction, category, effective window) tuple; the console lists
+  // by jurisdiction, creates a rate, edits the mutable columns (rate_bps
+  // / effective_until / source), and archives. `bulkImport` is an
+  // API-only path (operators hydrate a paid-feed snapshot from a script);
+  // it has no console form because authoring dozens of rows by hand isn't
+  // a console gesture — the single-rate create covers operator-by-hand
+  // entry and the feed importer uses the bearer JSON surface.
+  var taxRates = deps.taxRates || null;
+  if (taxRates) {
+    router.post("/admin/tax-rates", _pageOrApi(false,
+      W("tax_rate.create", async function (req, res) {
+        var rate = await taxRates.defineRate(_taxRateInput(req.body || {}));
+        _json(res, 201, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var jurisdiction = typeof body.jurisdiction === "string" ? body.jurisdiction.trim().toUpperCase() : body.jurisdiction;
+        try {
+          await taxRates.defineRate(_taxRateInput(body));
+        } catch (e) {
+          if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP") throw e;
+          var rows = await _taxRatesForBrowser(jurisdiction);
+          return _sendHtml(res, 400, renderAdminTaxRates({
+            shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
+            jurisdiction: jurisdiction, sources: taxRates.SOURCES,
+            notice: (e && e.message || "").replace(/^taxRates[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.create", outcome: "success" });
+        _redirect(res, "/admin/tax-rates?jurisdiction=" + encodeURIComponent(jurisdiction) + "&created=1");
+      },
+    ));
+
+    router.get("/admin/tax-rates", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var j = url && url.searchParams.get("jurisdiction");
+        if (!j) return _json(res, 200, { rows: [] });
+        var includeExpired = url && url.searchParams.get("include_expired") === "1";
+        var rows = await taxRates.listForJurisdiction({ jurisdiction: j, include_expired: includeExpired });
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var j = url && url.searchParams.get("jurisdiction");
+        var jurisdiction = j ? String(j).trim().toUpperCase() : null;
+        var rows = await _taxRatesForBrowser(jurisdiction);
+        _sendHtml(res, 200, renderAdminTaxRates({
+          shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
+          jurisdiction: jurisdiction, sources: taxRates.SOURCES,
+          created:  url && url.searchParams.get("created"),
+          updated:  url && url.searchParams.get("updated"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the rate." : null,
+        }));
+      },
+    ));
+
+    // Patch the mutable columns (rate_bps / effective_until / source).
+    router.patch("/admin/tax-rates/:id", W("tax_rate.update", async function (req, res) {
+      var rate;
+      try { rate = await taxRates.updateRate(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!rate) return _problem(res, 404, "tax-rate-not-found");
+      _json(res, 200, rate);
+      return { id: rate.id };
+    }));
+
+    // Browser POST alias for the edit (HTML can't PATCH). Re-aims at the
+    // rate's jurisdiction list on success / failure.
+    router.post("/admin/tax-rates/:id/edit", _pageOrApi(false,
+      W("tax_rate.update", async function (req, res) {
+        var rate;
+        try { rate = await taxRates.updateRate(req.params.id, _taxRatePatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!rate) return _problem(res, 404, "tax-rate-not-found");
+        _json(res, 200, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var enc = "/admin/tax-rates" + (body.jurisdiction ? "?jurisdiction=" + encodeURIComponent(String(body.jurisdiction).trim().toUpperCase()) : "");
+        var rate = null;
+        try { rate = await taxRates.updateRate(req.params.id, _taxRatePatch(body)); }
+        catch (e) { if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP" && e.code !== "TAX_RATE_ARCHIVED") throw e; }
+        if (!rate) return _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.update", outcome: "success", metadata: { id: req.params.id } });
+        _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "updated=1");
+      },
+    ));
+
+    router.delete("/admin/tax-rates/:id", W("tax_rate.archive", async function (req, res) {
+      var rate;
+      try { rate = await taxRates.archiveRate(req.params.id, {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!rate) return _problem(res, 404, "tax-rate-not-found");
+      _json(res, 200, rate);
+      return { id: rate.id };
+    }));
+
+    router.post("/admin/tax-rates/:id/archive", _pageOrApi(false,
+      W("tax_rate.archive", async function (req, res) {
+        var rate;
+        try { rate = await taxRates.archiveRate(req.params.id, {}); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!rate) return _problem(res, 404, "tax-rate-not-found");
+        _json(res, 200, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var enc = "/admin/tax-rates" + (body.jurisdiction ? "?jurisdiction=" + encodeURIComponent(String(body.jurisdiction).trim().toUpperCase()) : "");
+        var rate = null;
+        try { rate = await taxRates.archiveRate(req.params.id, {}); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!rate) return _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.archive", outcome: "success", metadata: { id: req.params.id } });
+        _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "archived=1");
+      },
+    ));
+  }
+
+  // Read a jurisdiction's rate history for the browser list. A null /
+  // unset jurisdiction yields an empty list (the page shows the picker
+  // form). A malformed jurisdiction throws TypeError in the primitive —
+  // map that to an empty list so the page renders the notice, never 500.
+  async function _taxRatesForBrowser(jurisdiction) {
+    if (!jurisdiction) return [];
+    try { return await taxRates.listForJurisdiction({ jurisdiction: jurisdiction, include_expired: true }); }
+    catch (e) { if (e instanceof TypeError) return []; throw e; }
+  }
+
+  // Translate the create form / JSON body into a defineRate input.
+  // Strict integer parsing for rate_bps + the two epoch-ms windows.
+  function _taxRateInput(body) {
+    var input = {
+      jurisdiction: typeof body.jurisdiction === "string" ? body.jurisdiction.trim().toUpperCase() : body.jurisdiction,
+      rate_bps:     _strictMinorInt(body.rate_bps, "taxRates", "rate_bps"),
+      source:       typeof body.source === "string" && body.source ? body.source : "manual",
+    };
+    if (body.category != null && body.category !== "") input.category = String(body.category).trim();
+    input.effective_from = (body.effective_from == null || body.effective_from === "")
+      ? Date.now()
+      : _strictMinorInt(body.effective_from, "taxRates", "effective_from (epoch-ms)");
+    if (body.effective_until != null && body.effective_until !== "") {
+      input.effective_until = _strictMinorInt(body.effective_until, "taxRates", "effective_until (epoch-ms)");
+    }
+    return input;
+  }
+
+  // Translate the edit form / JSON body into an updateRate patch. Only
+  // the mutable columns are forwarded; absent fields are left untouched.
+  function _taxRatePatch(body) {
+    var patch = {};
+    if (body.rate_bps != null && body.rate_bps !== "") patch.rate_bps = _strictMinorInt(body.rate_bps, "taxRates", "rate_bps");
+    if (Object.prototype.hasOwnProperty.call(body, "effective_until")) {
+      patch.effective_until = (body.effective_until == null || body.effective_until === "")
+        ? null
+        : _strictMinorInt(body.effective_until, "taxRates", "effective_until (epoch-ms)");
+    }
+    if (body.source != null && body.source !== "") patch.source = String(body.source);
+    return patch;
+  }
+
+  // ---- shipping zones -------------------------------------------------
+  //
+  // Operator-defined flat-rate / table-rate zones. The console create is
+  // the common single-country, single-flat-service shape — country +
+  // service label + flat amount + currency, optionally a region. The
+  // primitive's full regions[] / rates[] vocabulary (weight + order-value
+  // buckets, multi-region) is reachable via the bearer JSON contract; the
+  // edit screen lets an operator paste the full regions / rates JSON to
+  // mutate beyond the simple shape.
+  var shippingZones = deps.shippingZones || null;
+  if (shippingZones) {
+    router.post("/admin/shipping", _pageOrApi(false,
+      W("shipping_zone.create", async function (req, res) {
+        var zone = await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
+        _json(res, 201, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        try {
+          await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_EXISTS") throw e;
+          var rows = await shippingZones.listZones({});
+          return _sendHtml(res, 400, renderAdminShipping({
+            shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
+            notice: (e && e.message || "").replace(/^shippingZones[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.create", outcome: "success" });
+        _redirect(res, "/admin/shipping?created=1");
+      },
+    ));
+
+    router.get("/admin/shipping", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeOnly = url && url.searchParams.get("active") === "1";
+        var rows = await shippingZones.listZones(activeOnly ? { active_only: true } : {});
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await shippingZones.listZones({});
+        _sendHtml(res, 200, renderAdminShipping({
+          shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
+          created:  url && url.searchParams.get("created"),
+          updated:  url && url.searchParams.get("updated"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the zone." : null,
+        }));
+      },
+    ));
+
+    router.get("/admin/shipping/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.getZone(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "shipping-zone-not-found", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var zone;
+        try { zone = await shippingZones.getZone(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; zone = null; }
+        if (!zone) return _sendHtml(res, 404, renderAdminShipping({
+          shop_name: deps.shop_name, nav_available: navAvailable, zones: [], notice: "Zone not found.",
+        }));
+        _sendHtml(res, 200, renderAdminShippingZone({
+          shop_name: deps.shop_name, nav_available: navAvailable, zone: zone,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.patch("/admin/shipping/:slug", W("shipping_zone.update", async function (req, res) {
+      var zone;
+      try { zone = await shippingZones.updateZone(req.params.slug, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+      _json(res, 200, zone);
+      return { id: zone.slug };
+    }));
+
+    // Browser edit alias. Mutates title + active (checkbox) and, when the
+    // operator pastes JSON, regions / rates. Empty paste fields are left
+    // untouched so a title-only edit doesn't wipe the rate table.
+    router.post("/admin/shipping/:slug/edit", _pageOrApi(false,
+      W("shipping_zone.update", async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.updateZone(req.params.slug, _shippingZonePatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        var zone = null;
+        try { zone = await shippingZones.updateZone(slug, _shippingZonePatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_ARCHIVED") throw e; }
+        if (!zone) return _redirect(res, "/admin/shipping/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/shipping/" + enc + "?updated=1");
+      },
+    ));
+
+    router.delete("/admin/shipping/:slug", W("shipping_zone.archive", async function (req, res) {
+      var zone;
+      try { zone = await shippingZones.archiveZone(req.params.slug); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+      _json(res, 200, zone);
+      return { id: zone.slug };
+    }));
+
+    router.post("/admin/shipping/:slug/archive", _pageOrApi(false,
+      W("shipping_zone.archive", async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.archiveZone(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var zone = null;
+        try { zone = await shippingZones.archiveZone(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!zone) return _redirect(res, "/admin/shipping?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/shipping?archived=1");
+      },
+    ));
+  }
+
+  // Translate the create form / JSON body into a defineZone input. The
+  // console form is the single-country, single-flat-rate shape; the
+  // bearer JSON path can pass the full regions[]/rates[] arrays directly,
+  // so those pass through untouched when present.
+  function _shippingZoneInput(body) {
+    if (Array.isArray(body.regions) || Array.isArray(body.rates)) {
+      // Full JSON shape from a bearer client — forward as-is.
+      return body;
+    }
+    var country = typeof body.country === "string" ? body.country.trim().toUpperCase() : body.country;
+    var region  = (body.region != null && body.region !== "") ? String(body.region).trim().toUpperCase() : null;
+    var regionEntry = { country: country };
+    if (region) regionEntry.region = region;
+    return {
+      slug:   typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title:  body.title,
+      active: body.active === "0" || body.active === "off" ? false : true,
+      regions: [regionEntry],
+      rates: [{
+        rate_minor:    _strictMinorInt(body.rate_minor, "shippingZones", "rate_minor"),
+        currency:      typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+        service_label: body.service_label,
+      }],
+    };
+  }
+
+  // Translate the edit form / JSON body into an updateZone patch. Title
+  // + active always forward; regions / rates only when the operator
+  // pasted non-empty JSON (an empty paste leaves the existing table).
+  function _shippingZonePatch(body) {
+    var patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
+    // The active checkbox is present (="on"/"1") when checked, absent when
+    // unchecked — but only treat it as a field when the form declared it
+    // via the hidden marker so a partial JSON edit doesn't flip active.
+    if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    if (typeof body.regions_json === "string" && body.regions_json.trim() !== "") {
+      patch.regions = JSON.parse(body.regions_json);
+    } else if (Array.isArray(body.regions)) {
+      patch.regions = body.regions;
+    }
+    if (typeof body.rates_json === "string" && body.rates_json.trim() !== "") {
+      patch.rates = JSON.parse(body.rates_json);
+    } else if (Array.isArray(body.rates)) {
+      patch.rates = body.rates;
+    }
+    return patch;
+  }
+
+  // ---- automatic discounts + stacking policies ------------------------
+  //
+  // Two related concerns on one console screen. `autoDiscount` rules are
+  // cart-level automatics (no code typed); `couponStacking` policies gate
+  // which codes may combine. The screen lists + creates + archives both;
+  // rule edit covers title / priority / active (the trigger + value JSON
+  // vocabularies are re-set via the create-shape edit fields). Segment-
+  // gated rules / per-customer caps / exclusions stay on the bearer JSON
+  // surface — the console covers the operator-by-hand common case (a
+  // trigger, a value, a priority); the richer JSON shapes pass through
+  // the bearer create unchanged.
+  var autoDiscount   = deps.autoDiscount   || null;
+  var couponStacking = deps.couponStacking || null;
+  if (autoDiscount) {
+    router.post("/admin/discounts", _pageOrApi(false,
+      W("auto_discount.create", async function (req, res) {
+        var rule = await autoDiscount.defineRule(_discountInput(req.body || {}));
+        _json(res, 201, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try {
+          await autoDiscount.defineRule(_discountInput(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          return _sendHtml(res, 400, await _renderDiscounts({
+            notice: (e && e.message || "").replace(/^autoDiscount[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.create", outcome: "success" });
+        _redirect(res, "/admin/discounts?created=1");
+      },
+    ));
+
+    router.get("/admin/discounts", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeOnly = url && url.searchParams.get("active") === "1";
+        var rules = await autoDiscount.listRules(activeOnly ? { active_only: true, limit: 500 } : { limit: 500 });
+        var policies = couponStacking ? await couponStacking.listPolicies({ limit: 200 }) : [];
+        _json(res, 200, { rules: rules, policies: policies });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, await _renderDiscounts({
+          created:        url && url.searchParams.get("created"),
+          updated:        url && url.searchParams.get("updated"),
+          archived:       url && url.searchParams.get("archived"),
+          policy_created: url && url.searchParams.get("policy_created"),
+          policy_archived: url && url.searchParams.get("policy_archived"),
+          notice:         (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.patch("/admin/discounts/:slug", W("auto_discount.update", async function (req, res) {
+      var rule;
+      try { rule = await autoDiscount.updateRule(req.params.slug, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, rule);
+      return { id: rule.slug };
+    }));
+
+    router.post("/admin/discounts/:slug/edit", _pageOrApi(false,
+      W("auto_discount.update", async function (req, res) {
+        var rule;
+        try { rule = await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try { await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: req.params.slug } });
+        _redirect(res, "/admin/discounts?updated=1");
+      },
+    ));
+
+    router.delete("/admin/discounts/:slug", W("auto_discount.archive", async function (req, res) {
+      var rule;
+      try { rule = await autoDiscount.archiveRule(req.params.slug); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, rule);
+      return { id: rule.slug };
+    }));
+
+    router.post("/admin/discounts/:slug/archive", _pageOrApi(false,
+      W("auto_discount.archive", async function (req, res) {
+        var rule;
+        try { rule = await autoDiscount.archiveRule(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try { await autoDiscount.archiveRule(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.archive", outcome: "success", metadata: { slug: req.params.slug } });
+        _redirect(res, "/admin/discounts?archived=1");
+      },
+    ));
+
+    // Stacking-policy lifecycle — only mounted when the couponStacking
+    // dep is wired alongside autoDiscount (the screen renders the policy
+    // section conditionally too).
+    if (couponStacking) {
+      router.post("/admin/discounts/policies", _pageOrApi(false,
+        W("coupon_policy.create", async function (req, res) {
+          var policy = await couponStacking.definePolicy(_policyInput(req.body || {}));
+          _json(res, 201, policy);
+          return { id: policy.slug };
+        }),
+        async function (req, res) {
+          try {
+            await couponStacking.definePolicy(_policyInput(req.body || {}));
+          } catch (e) {
+            if (!(e instanceof TypeError)) throw e;
+            return _sendHtml(res, 400, await _renderDiscounts({
+              notice: (e && e.message || "").replace(/^couponStacking[.:]\s*/, ""),
+            }));
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.create", outcome: "success" });
+          _redirect(res, "/admin/discounts?policy_created=1");
+        },
+      ));
+
+      router.delete("/admin/discounts/policies/:slug", W("coupon_policy.archive", async function (req, res) {
+        var policy;
+        try { policy = await couponStacking.archivePolicy(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, policy);
+        return { id: policy.slug };
+      }));
+
+      router.post("/admin/discounts/policies/:slug/archive", _pageOrApi(false,
+        W("coupon_policy.archive", async function (req, res) {
+          var policy;
+          try { policy = await couponStacking.archivePolicy(req.params.slug); }
+          catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+          _json(res, 200, policy);
+          return { id: policy.slug };
+        }),
+        async function (req, res) {
+          try { await couponStacking.archivePolicy(req.params.slug); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.archive", outcome: "success", metadata: { slug: req.params.slug } });
+          _redirect(res, "/admin/discounts?policy_archived=1");
+        },
+      ));
+    }
+  }
+
+  // Render the discounts screen — gathers rules + (optional) stacking
+  // policies, then hands them to the renderer with whatever banner flags
+  // the caller passed.
+  async function _renderDiscounts(flags) {
+    flags = flags || {};
+    var rules = await autoDiscount.listRules({ limit: 500 });
+    var policies = couponStacking ? await couponStacking.listPolicies({ limit: 200 }) : [];
+    return renderAdminDiscounts(Object.assign({
+      shop_name: deps.shop_name, nav_available: navAvailable,
+      rules: rules, policies: policies, stacking_enabled: !!couponStacking,
+    }, flags));
+  }
+
+  // Translate the create form / JSON body into a defineRule input. The
+  // console covers a single trigger + a single value + priority; the
+  // bearer JSON path can pass the full vocabulary (applies_to, segments,
+  // exclusions, caps) directly, so a body already carrying object-shaped
+  // trigger / value passes through untouched.
+  function _discountInput(body) {
+    if (body.trigger && typeof body.trigger === "object" && body.value && typeof body.value === "object") {
+      return body; // full JSON shape from a bearer client
+    }
+    var input = {
+      slug:  typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title: body.title,
+      trigger: _discountTrigger(body),
+      value:   _discountValue(body),
+    };
+    if (body.priority != null && body.priority !== "") {
+      input.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
+    }
+    return input;
+  }
+
+  function _discountTrigger(body) {
+    var kind = body.trigger_kind;
+    if (kind === "item_count_min") {
+      return { kind: "item_count_min", min_count: _strictMinorInt(body.trigger_min_count, "autoDiscount", "trigger min_count") };
+    }
+    if (kind === "sku_purchase") {
+      var skus = String(body.trigger_skus || "").split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+      var t = { kind: "sku_purchase", skus: skus };
+      if (body.trigger_min_quantity != null && body.trigger_min_quantity !== "") {
+        t.min_quantity = _strictMinorInt(body.trigger_min_quantity, "autoDiscount", "trigger min_quantity");
+      }
+      return t;
+    }
+    // default: cart_total_min
+    return { kind: "cart_total_min", min_minor: _strictMinorInt(body.trigger_min_minor, "autoDiscount", "trigger min_minor") };
+  }
+
+  function _discountValue(body) {
+    var kind = body.value_kind;
+    if (kind === "percent_off") {
+      return { kind: "percent_off", basis_points: _strictMinorInt(body.value_basis_points, "autoDiscount", "value basis_points") };
+    }
+    if (kind === "amount_off_total" || kind === "amount_off_each") {
+      return { kind: kind, minor: _strictMinorInt(body.value_minor, "autoDiscount", "value minor") };
+    }
+    if (kind === "bogo") {
+      return {
+        kind: "bogo",
+        buy_qty: _strictMinorInt(body.value_buy_qty, "autoDiscount", "value buy_qty"),
+        get_qty: _strictMinorInt(body.value_get_qty, "autoDiscount", "value get_qty"),
+      };
+    }
+    return { kind: "free_shipping" };
+  }
+
+  // Translate the rule edit form into an updateRule patch — title /
+  // priority / active. The trigger + value re-set go through the bearer
+  // JSON PATCH for the full vocabulary; the console edit is the common
+  // "rename / re-prioritise / pause" gesture.
+  function _discountPatch(body) {
+    var patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
+    if (body.priority != null && body.priority !== "") patch.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
+    if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    return patch;
+  }
+
+  // Translate the policy create form / JSON body into a definePolicy
+  // input. The console exposes the common shape (max codes + the two
+  // combine toggles + an order-min floor); exclusive_codes / segment
+  // gating stay on the bearer JSON path.
+  function _policyInput(body) {
+    if (body.allow_combine && typeof body.allow_combine === "object") {
+      return body; // full JSON shape from a bearer client
+    }
+    var input = {
+      slug:  typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title: body.title,
+      max_codes_per_order: _strictMinorInt(body.max_codes_per_order, "couponStacking", "max_codes_per_order"),
+      allow_combine: {
+        with_quantity_discounts: (body.with_quantity_discounts === "on" || body.with_quantity_discounts === "1"),
+        with_other_codes:        (body.with_other_codes === "on" || body.with_other_codes === "1"),
+      },
+    };
+    if (body.order_min_minor != null && body.order_min_minor !== "") {
+      input.order_min_minor = _strictMinorInt(body.order_min_minor, "couponStacking", "order_min_minor");
+    }
+    return input;
+  }
+
   // ---- admin web pages (browser session + setup wizard) ---------------
   //
   // The operator signs in by pasting the ADMIN_API_KEY once; that sets a
@@ -3037,6 +4039,9 @@ var ADMIN_NAV_ITEMS = [
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
+  { key: "discounts",    href: "/admin/discounts",    label: "Discounts",    requires: "autoDiscount" },
+  { key: "tax",          href: "/admin/tax-rates",    label: "Tax",          requires: "taxRates" },
+  { key: "shipping",     href: "/admin/shipping",     label: "Shipping",     requires: "shippingZones" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
   { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
@@ -3238,10 +4243,13 @@ function renderAdminProducts(opts) {
     var action = p.status === "archived"
       ? "<form method=\"post\" action=\"/admin/products/" + _htmlEscape(p.id) + "/restore\"><button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>"
       : "<form method=\"post\" action=\"/admin/products/" + _htmlEscape(p.id) + "/archive\"><button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>";
-    return "<tr><td><strong>" + _htmlEscape(p.title) + "</strong></td>" +
+    return "<tr><td><a href=\"/admin/products/" + _htmlEscape(p.id) + "\"><strong>" + _htmlEscape(p.title) + "</strong></a></td>" +
       "<td><code class=\"order-id\">" + _htmlEscape(p.slug) + "</code></td>" +
       "<td><span class=\"status-pill " + cls + "\">" + _htmlEscape(p.status) + "</span></td>" +
-      "<td>" + action + "</td></tr>";
+      "<td><div class=\"actions-row mt-0\">" +
+        "<a class=\"btn btn--ghost\" href=\"/admin/products/" + _htmlEscape(p.id) + "\">Manage</a>" +
+        action +
+      "</div></td></tr>";
   }).join("");
   var table = products.length
     ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Status</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
@@ -3878,6 +4886,354 @@ function renderAdminSubscriptionPlans(opts) {
 // •••• fill; the plaintext bearer code is never stored and so never
 // rendered here. Original (issued) + remaining balance + lifecycle
 // status + issued date per row, newest first.
+// A <select> form field matching the _setupField shape. `options` is an
+// array of { value, label }; `selected` highlights the current value.
+function _selectField(label, name, options, selected, hint, extra) {
+  var opts = (options || []).map(function (o) {
+    return "<option value=\"" + _htmlEscape(o.value) + "\"" +
+      (o.value === selected ? " selected" : "") + ">" + _htmlEscape(o.label) + "</option>";
+  }).join("");
+  return "<label class=\"form-field\"><span>" + _htmlEscape(label) + "</span>" +
+    "<select name=\"" + _htmlEscape(name) + "\"" + (extra || "") + ">" + opts + "</select>" +
+    (hint ? "<small>" + _htmlEscape(hint) + "</small>" : "") +
+    "</label>";
+}
+
+// bps → human "X.XX%". 1 bp = 0.01%.
+function _fmtBps(bps) {
+  var n = Number(bps);
+  if (!isFinite(n)) return "—";
+  return (n / 100).toFixed(2) + "%";
+}
+
+function renderAdminTaxRates(opts) {
+  opts = opts || {};
+  var rows = opts.rates || [];
+  var jurisdiction = opts.jurisdiction || "";
+  var sources = opts.sources || ["manual"];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Rate created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Rate updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Rate archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // Jurisdiction picker — the list is scoped to one jurisdiction at a
+  // time (the lib's listForJurisdiction is the only list surface).
+  var picker =
+    "<div class=\"panel mw-34\">" +
+      "<form method=\"get\" action=\"/admin/tax-rates\" class=\"form-inline\">" +
+        "<label class=\"form-field\"><span>Jurisdiction</span>" +
+          "<input type=\"text\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\" placeholder=\"US or US-CA\" maxlength=\"6\" class=\"input-code\" required>" +
+          "<small>ISO 3166-1 country, optionally -subdivision (e.g. US, US-CA, DE-BY).</small>" +
+        "</label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">View rates</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var table = "";
+  if (jurisdiction) {
+    var bodyRows = rows.map(function (r) {
+      var isArchived = r.archived_at != null;
+      var until = r.effective_until == null ? "<span class=\"meta\">open</span>" : _htmlEscape(_fmtDate(Number(r.effective_until)));
+      var editForm = isArchived ? "" :
+        "<form method=\"post\" action=\"/admin/tax-rates/" + _htmlEscape(r.id) + "/edit\" class=\"form-inline\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          "<input type=\"number\" name=\"rate_bps\" value=\"" + _htmlEscape(String(r.rate_bps)) + "\" min=\"0\" max=\"10000\" class=\"input-sm\" aria-label=\"rate basis points\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
+        "</form> " +
+        "<form method=\"post\" action=\"/admin/tax-rates/" + _htmlEscape(r.id) + "/archive\" class=\"form-inline\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Archive</button>" +
+        "</form>";
+      return "<tr>" +
+        "<td>" + (r.category ? "<code>" + _htmlEscape(r.category) + "</code>" : "<span class=\"meta\">default</span>") + "</td>" +
+        "<td class=\"num\"><strong>" + _htmlEscape(_fmtBps(r.rate_bps)) + "</strong> <span class=\"meta\">(" + _htmlEscape(String(r.rate_bps)) + " bps)</span></td>" +
+        "<td>" + _htmlEscape(_fmtDate(Number(r.effective_from))) + "</td>" +
+        "<td>" + until + "</td>" +
+        "<td>" + _htmlEscape(r.source) + "</td>" +
+        "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "live") + "</span></td>" +
+        "<td>" + editForm + "</td>" +
+      "</tr>";
+    }).join("");
+    table = rows.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Category</th><th scope=\"col\" class=\"num\">Rate</th><th scope=\"col\">From</th><th scope=\"col\">Until</th><th scope=\"col\">Source</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+      : "<p class=\"empty\">No rates for " + _htmlEscape(jurisdiction) + " yet.</p>";
+  }
+
+  var sourceOpts = sources.map(function (s) { return { value: s, label: s }; });
+  var createForm = jurisdiction
+    ? "<div class=\"panel mt mw-34\">" +
+        "<h3 class=\"subhead\">Add a rate for " + _htmlEscape(jurisdiction) + "</h3>" +
+        "<form method=\"post\" action=\"/admin/tax-rates\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          _setupField("Category (optional)", "category", "", "text", "Leave blank for the jurisdiction's default rate. Lowercase, e.g. food, books.", " maxlength=\"64\"") +
+          _setupField("Rate (basis points)", "rate_bps", "", "number", "1 bp = 0.01%. 2000 = 20.00%.", " min=\"0\" max=\"10000\" required") +
+          _setupField("Effective from (epoch-ms, optional)", "effective_from", "", "number", "When the rate starts. Blank = now.", " min=\"0\"") +
+          _setupField("Effective until (epoch-ms, optional)", "effective_until", "", "number", "When the rate ends. Blank = open-ended.", " min=\"0\"") +
+          _selectField("Source", "source", sourceOpts, "manual", "Who declared this rate.", "") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add rate</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
+  var body = "<section><h2>Tax rates</h2>" + created + updated + archived + notice + picker + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Tax rates", body, "tax", opts.nav_available);
+}
+
+function renderAdminShipping(opts) {
+  opts = opts || {};
+  var rows = opts.zones || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Zone created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Zone updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Zone archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var bodyRows = rows.map(function (z) {
+    var isArchived = z.archived_at != null;
+    var regionStr = (z.regions || []).map(function (r) {
+      return r.region ? r.country + "-" + r.region : r.country;
+    }).join(", ");
+    var rateCount = (z.rates || []).length;
+    var statusCls = isArchived ? "cancelled" : (z.active ? "paid" : "pending");
+    var statusTxt = isArchived ? "archived" : (z.active ? "active" : "paused");
+    return "<tr>" +
+      "<td><a href=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "\"><strong>" + _htmlEscape(z.title) + "</strong></a></td>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(z.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(regionStr) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(rateCount)) + "</td>" +
+      "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        "<a class=\"btn btn--ghost\" href=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "\">Manage</a>" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Regions</th><th scope=\"col\" class=\"num\">Rates</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No shipping zones yet.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Add a zone</h3>" +
+      "<p class=\"meta\">A flat-rate service for one destination. Add more rate rows / regions from the zone's manage screen.</p>" +
+      "<form method=\"post\" action=\"/admin/shipping\">" +
+        _setupField("Slug", "slug", "", "text", "Stable identifier, e.g. domestic-us.", " maxlength=\"64\" required") +
+        _setupField("Title", "title", "", "text", "Operator-facing name, e.g. Domestic (US).", " maxlength=\"200\" required") +
+        _setupField("Country", "country", "", "text", "ISO 3166-1 alpha-2, e.g. US.", " maxlength=\"2\" class=\"input-code\" required") +
+        _setupField("Region (optional)", "region", "", "text", "ISO 3166-2 subdivision without country prefix, e.g. CA. Blank = whole country.", " maxlength=\"3\" class=\"input-code\"") +
+        _setupField("Service label", "service_label", "", "text", "Shown at checkout, e.g. Standard.", " maxlength=\"128\" required") +
+        _setupField("Rate (minor units)", "rate_minor", "", "number", "In the currency's smallest unit — 500 = $5.00.", " min=\"0\" required") +
+        _setupField("Currency", "currency", "", "text", "3-letter ISO 4217, e.g. USD.", " maxlength=\"3\" class=\"input-code\" required") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add zone</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Shipping zones</h2>" + created + updated + archived + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Shipping zones", body, "shipping", opts.nav_available);
+}
+
+function renderAdminShippingZone(opts) {
+  opts = opts || {};
+  var z = opts.zone;
+  if (!z) {
+    var nf = "<section><h2>Shipping zone</h2><p class=\"empty\">Zone not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/shipping\">Back to shipping</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Shipping zone", nf, "shipping", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Zone updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var enc = encodeURIComponent(z.slug);
+
+  var rateRows = (z.rates || []).map(function (r) {
+    var bucket = [];
+    if (r.min_weight_grams != null || r.max_weight_grams != null) {
+      bucket.push((r.min_weight_grams || 0) + "–" + (r.max_weight_grams == null ? "∞" : r.max_weight_grams) + " g");
+    }
+    if (r.min_order_minor != null || r.max_order_minor != null) {
+      bucket.push((r.min_order_minor || 0) + "–" + (r.max_order_minor == null ? "∞" : r.max_order_minor) + " minor");
+    }
+    return "<tr>" +
+      "<td>" + _htmlEscape(r.service_label) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(pricing.format(r.rate_minor, String(r.currency || "").toUpperCase())) + "</td>" +
+      "<td>" + (bucket.length ? _htmlEscape(bucket.join(" · ")) : "<span class=\"meta\">any</span>") + "</td>" +
+    "</tr>";
+  }).join("");
+  var rateTable = (z.rates || []).length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Service</th><th scope=\"col\" class=\"num\">Rate</th><th scope=\"col\">Bucket</th></tr></thead><tbody>" + rateRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No rate rows.</p>";
+
+  var head = "<p class=\"meta\"><a href=\"/admin/shipping\">&larr; Shipping</a> · <code class=\"order-id\">" + _htmlEscape(z.slug) + "</code> · " +
+    "<span class=\"status-pill " + (z.archived_at != null ? "cancelled" : (z.active ? "paid" : "pending")) + "\">" +
+    (z.archived_at != null ? "archived" : (z.active ? "active" : "paused")) + "</span></p>";
+
+  // Edit form: title + active toggle always; regions / rates via JSON
+  // paste for the full vocabulary (weight + order buckets, multi-region).
+  var editForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Edit zone</h3>" +
+      "<form method=\"post\" action=\"/admin/shipping/" + _htmlEscape(enc) + "/edit\">" +
+        _setupField("Title", "title", z.title, "text", "", " maxlength=\"200\"") +
+        "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+        "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (z.active ? " checked" : "") + "> Active (serve this zone at checkout)</label>" +
+        "<label class=\"form-field\"><span>Regions JSON (optional)</span>" +
+          "<textarea name=\"regions_json\" rows=\"3\" placeholder='[{\"country\":\"US\",\"region\":\"CA\"}]'></textarea>" +
+          "<small>Paste to replace the regions array. Blank leaves it unchanged.</small></label>" +
+        "<label class=\"form-field\"><span>Rates JSON (optional)</span>" +
+          "<textarea name=\"rates_json\" rows=\"4\" placeholder='[{\"rate_minor\":500,\"currency\":\"USD\",\"service_label\":\"Standard\"}]'></textarea>" +
+          "<small>Paste to replace the rate table. Blank leaves it unchanged.</small></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save zone</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/shipping\">Back</a></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>" + _htmlEscape(z.title) + "</h2>" + updated + notice + head +
+    "<h3 class=\"subhead subhead--sp-lg\">Rates</h3>" + rateTable + editForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Zone " + z.slug, body, "shipping", opts.nav_available);
+}
+
+// Human one-liner for a rule's trigger / value JSON.
+function _fmtTrigger(t) {
+  if (!t || !t.kind) return "—";
+  if (t.kind === "cart_total_min") return "cart ≥ " + (t.min_minor || 0) + " minor";
+  if (t.kind === "item_count_min") return "≥ " + (t.min_count || 0) + " items";
+  if (t.kind === "sku_purchase")   return "buys " + (t.skus || []).join("/") + (t.min_quantity > 1 ? " ×" + t.min_quantity : "");
+  return t.kind;
+}
+function _fmtValue(v) {
+  if (!v || !v.kind) return "—";
+  if (v.kind === "percent_off")      return (Number(v.basis_points) / 100).toFixed(2) + "% off";
+  if (v.kind === "amount_off_total") return v.minor + " minor off total";
+  if (v.kind === "amount_off_each")  return v.minor + " minor off each";
+  if (v.kind === "free_shipping")    return "free shipping";
+  if (v.kind === "bogo")             return "buy " + v.buy_qty + " get " + v.get_qty;
+  return v.kind;
+}
+
+function renderAdminDiscounts(opts) {
+  opts = opts || {};
+  var rules = opts.rules || [];
+  var policies = opts.policies || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Discount rule created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Rule updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Rule archived.</div>" : "";
+  var pCreated = opts.policy_created  ? "<div class=\"banner banner--ok\">Stacking policy created.</div>" : "";
+  var pArchived = opts.policy_archived ? "<div class=\"banner banner--ok\">Stacking policy archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var ruleRows = rules.map(function (r) {
+    var isArchived = r.archived_at != null;
+    var statusCls = isArchived ? "cancelled" : (r.active ? "paid" : "pending");
+    var statusTxt = isArchived ? "archived" : (r.active ? "active" : "paused");
+    var actions = isArchived ? "" :
+      "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/edit\" class=\"form-inline\">" +
+        "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+        "<input type=\"number\" name=\"priority\" value=\"" + _htmlEscape(String(r.priority)) + "\" min=\"0\" class=\"input-sm\" aria-label=\"priority\">" +
+        "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> on</label>" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
+      "</form> " +
+      "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+    return "<tr>" +
+      "<td><strong>" + _htmlEscape(r.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(r.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(_fmtTrigger(r.trigger)) + "</td>" +
+      "<td>" + _htmlEscape(_fmtValue(r.value)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(r.priority)) + "</td>" +
+      "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+      "<td>" + actions + "</td>" +
+    "</tr>";
+  }).join("");
+  var ruleTable = rules.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Rule</th><th scope=\"col\">Trigger</th><th scope=\"col\">Value</th><th scope=\"col\" class=\"num\">Priority</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + ruleRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No automatic discount rules yet.</p>";
+
+  var TRIGGERS = [
+    { value: "cart_total_min", label: "Cart total ≥ (minor)" },
+    { value: "item_count_min", label: "Item count ≥" },
+    { value: "sku_purchase",   label: "SKU purchased" },
+  ];
+  var VALUES = [
+    { value: "percent_off",      label: "Percent off" },
+    { value: "amount_off_total", label: "Amount off total" },
+    { value: "amount_off_each",  label: "Amount off each" },
+    { value: "free_shipping",    label: "Free shipping" },
+    { value: "bogo",             label: "Buy X get Y" },
+  ];
+  // The create form is server-rendered with every trigger / value field
+  // present; the operator fills the ones that apply to the kind they
+  // pick (the lib validates the chosen kind's required fields). No client
+  // JS toggling — the strict CSP forbids inline script, and the backend
+  // is the validator.
+  var createForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Add a rule</h3>" +
+      "<form method=\"post\" action=\"/admin/discounts\">" +
+        _setupField("Slug", "slug", "", "text", "Stable handle, e.g. free-ship-50.", " maxlength=\"80\" required") +
+        _setupField("Title", "title", "", "text", "Operator-facing name.", " maxlength=\"200\" required") +
+        _selectField("Trigger kind", "trigger_kind", TRIGGERS, "cart_total_min", "What fires the rule.", "") +
+        _setupField("· Cart total min (minor)", "trigger_min_minor", "", "number", "For \"Cart total ≥\".", " min=\"0\"") +
+        _setupField("· Item count min", "trigger_min_count", "", "number", "For \"Item count ≥\".", " min=\"1\"") +
+        _setupField("· SKUs (comma-separated)", "trigger_skus", "", "text", "For \"SKU purchased\".", " maxlength=\"2000\"") +
+        _setupField("· SKU min quantity", "trigger_min_quantity", "", "number", "For \"SKU purchased\" (default 1).", " min=\"1\"") +
+        _selectField("Value kind", "value_kind", VALUES, "percent_off", "What the rule gives.", "") +
+        _setupField("· Percent (basis points)", "value_basis_points", "", "number", "For \"Percent off\". 1000 = 10.00%.", " min=\"1\" max=\"10000\"") +
+        _setupField("· Amount (minor)", "value_minor", "", "number", "For \"Amount off total / each\".", " min=\"1\"") +
+        _setupField("· BOGO buy qty", "value_buy_qty", "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+        _setupField("· BOGO get qty", "value_get_qty", "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+        _setupField("Priority", "priority", "", "number", "Higher wins ties. Default 0.", " min=\"0\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add rule</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var policySection = "";
+  if (opts.stacking_enabled) {
+    var polRows = policies.map(function (p) {
+      var isArchived = p.archived_at != null;
+      var combine = [];
+      if (p.allow_combine && p.allow_combine.with_other_codes) combine.push("codes");
+      if (p.allow_combine && p.allow_combine.with_quantity_discounts) combine.push("qty discounts");
+      var statusCls = isArchived ? "cancelled" : (p.active ? "paid" : "pending");
+      var statusTxt = isArchived ? "archived" : (p.active ? "active" : "paused");
+      var actions = isArchived ? "" :
+        "<form method=\"post\" action=\"/admin/discounts/policies/" + _htmlEscape(encodeURIComponent(p.slug)) + "/archive\" class=\"form-inline\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+      return "<tr>" +
+        "<td><strong>" + _htmlEscape(p.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(p.slug) + "</code></td>" +
+        "<td class=\"num\">" + _htmlEscape(String(p.max_codes_per_order)) + "</td>" +
+        "<td>" + (combine.length ? _htmlEscape(combine.join(", ")) : "<span class=\"meta\">none</span>") + "</td>" +
+        "<td class=\"num\">" + _htmlEscape(String(p.order_min_minor)) + "</td>" +
+        "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+        "<td>" + actions + "</td>" +
+      "</tr>";
+    }).join("");
+    var polTable = policies.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Policy</th><th scope=\"col\" class=\"num\">Max codes</th><th scope=\"col\">Combines with</th><th scope=\"col\" class=\"num\">Order min</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + polRows + "</tbody></table></div>"
+      : "<p class=\"empty\">No stacking policies yet — without one, only one code applies per order.</p>";
+    var polForm =
+      "<div class=\"panel mt mw-40\">" +
+        "<h3 class=\"subhead\">Add a stacking policy</h3>" +
+        "<form method=\"post\" action=\"/admin/discounts/policies\">" +
+          _setupField("Slug", "slug", "", "text", "Stable handle, e.g. default-stack.", " maxlength=\"80\" required") +
+          _setupField("Title", "title", "", "text", "Operator-facing name.", " maxlength=\"200\" required") +
+          _setupField("Max codes per order", "max_codes_per_order", "", "number", "1–32.", " min=\"1\" max=\"32\" required") +
+          _setupField("Order minimum (minor)", "order_min_minor", "", "number", "Subtotal floor; default 0.", " min=\"0\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"with_other_codes\"> Allow combining multiple codes</label>" +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"with_quantity_discounts\"> Allow combining with quantity discounts</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add policy</button></div>" +
+        "</form>" +
+      "</div>";
+    policySection = "<h3 class=\"subhead subhead--sp-lg\">Coupon stacking policies</h3>" +
+      "<p class=\"meta\">Gate which codes (and quantity discounts) may combine on one order.</p>" +
+      pCreated + pArchived + polTable + polForm;
+  }
+
+  var body = "<section><h2>Discounts</h2>" + created + updated + archived + notice +
+    "<p class=\"meta\">Automatic cart-level discounts — applied without a coupon code.</p>" +
+    ruleTable + createForm + policySection + "</section>";
+  return _renderAdminShell(opts.shop_name, "Discounts", body, "discounts", opts.nav_available);
+}
+
 function renderAdminGiftCards(opts) {
   opts = opts || {};
   var rows = opts.cards || [];
@@ -4618,6 +5974,209 @@ function renderAdminCollection(opts) {
   return _renderAdminShell(opts.shop_name, "Collection " + col.slug, body, "collections", opts.nav_available);
 }
 
+// Product detail / management screen — the console's full editor for a
+// single catalog product: its fields (slug / title / description /
+// status), its variants (create / edit / delete), each variant's price
+// (set, with the current price + an append-only price history) and the
+// product's media (list / attach-by-key / upload-by-URL when the R2
+// bridge is wired / delete). Mirrors `renderAdminCollection`: an edit
+// form posting to a /edit POST alias (HTML forms can't PATCH), inline
+// sub-entity tables with per-row forms, and destructive actions routed
+// through a server-rendered confirm interstitial (the CSP forbids a
+// client confirm() dialog).
+function renderAdminProduct(opts) {
+  opts = opts || {};
+  var p = opts.product;
+  if (!p) {
+    var nf = "<section><h2>Product</h2><p class=\"empty\">Product not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/products\">Back to products</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Product", nf, "products", opts.nav_available);
+  }
+  var variants     = opts.variants || [];
+  var mediaRows    = opts.media || [];
+  var pricesByVar  = opts.prices_by_variant || {};   // { variantId: { currencies: [{ currency, current, history }] } }
+  var assetPrefix  = typeof opts.asset_prefix === "string" ? opts.asset_prefix : "/assets/";
+  var uploadWired  = !!opts.upload_available;
+  var defaultCurrency = (typeof opts.default_currency === "string" && /^[A-Z]{3}$/.test(opts.default_currency)) ? opts.default_currency : "USD";
+  var pid = _htmlEscape(p.id);
+
+  var saved   = opts.saved   ? "<div class=\"banner banner--ok\">Saved.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // ---- product fields edit ---------------------------------------------
+  var statusOpts = ["draft", "active", "archived"].map(function (s) {
+    return "<option value=\"" + s + "\"" + (s === p.status ? " selected" : "") + ">" + s + "</option>";
+  }).join("");
+  var editForm =
+    "<div class=\"panel mw-40\">" +
+      "<h3 class=\"subhead\">Details</h3>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/edit\">" +
+        _setupField("Slug", "slug", p.slug, "text", "Lowercase, hyphenated — the storefront URL.", " maxlength=\"200\" required") +
+        _setupField("Title", "title", p.title, "text", "", " maxlength=\"500\" required") +
+        "<label class=\"form-field\"><span>Description</span>" +
+          "<textarea name=\"description\" maxlength=\"100000\" rows=\"4\">" + _htmlEscape(p.description || "") + "</textarea></label>" +
+        "<label class=\"form-field\"><span>Status</span><select name=\"status\">" + statusOpts + "</select></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save</button></div>" +
+      "</form>" +
+    "</div>";
+
+  // ---- variants table + per-variant price manager ----------------------
+  var variantBlocks = variants.map(function (v) {
+    var vid = _htmlEscape(v.id);
+    var optionPairs = Object.keys(v.options || {}).map(function (k) {
+      return _htmlEscape(k) + "=" + _htmlEscape(String(v.options[k]));
+    }).join(", ");
+    var optionsText = Object.keys(v.options || {}).map(function (k) {
+      return k + "=" + String(v.options[k]);
+    }).join(", ");
+
+    // Price rows — current + history per currency the variant is priced in.
+    var priceModel = pricesByVar[v.id] || { currencies: [] };
+    var priceCurrencyBlocks = (priceModel.currencies || []).map(function (pc) {
+      var current = pc.current
+        ? "<strong>" + _htmlEscape(pricing.format(pc.current.amount_minor, pc.currency)) + "</strong>"
+        : "<span class=\"u-mute\">no active price</span>";
+      var histRows = (pc.history || []).map(function (h) {
+        return "<tr>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(h.amount_minor, pc.currency)) + "</td>" +
+          "<td>" + _htmlEscape(_fmtDate(h.effective_from)) + "</td>" +
+          "<td>" + (h.effective_until == null ? "<span class=\"status-pill paid\">current</span>" : _htmlEscape(_fmtDate(h.effective_until))) + "</td>" +
+        "</tr>";
+      }).join("");
+      var histTable = (pc.history && pc.history.length)
+        ? "<table><thead><tr><th scope=\"col\" class=\"num\">Amount</th><th scope=\"col\">From</th><th scope=\"col\">Until</th></tr></thead><tbody>" + histRows + "</tbody></table>"
+        : "";
+      return "<div class=\"m-04\">" +
+        "<span class=\"u-mute\">" + _htmlEscape(pc.currency) + "</span> · " + current +
+        histTable +
+      "</div>";
+    }).join("");
+    var priceSection =
+      "<div class=\"panel-sub\">" +
+        "<h4 class=\"subhead subhead--sp\">Price</h4>" +
+        (priceCurrencyBlocks || "<p class=\"empty\">No price set yet.</p>") +
+        "<form method=\"post\" action=\"/admin/variants/" + vid + "/prices/set\" class=\"price-set-form\">" +
+          "<div class=\"actions-row\">" +
+            "<input type=\"text\" name=\"currency\" value=\"" + _htmlEscape(defaultCurrency) + "\" class=\"input-code\" aria-label=\"Currency\" maxlength=\"3\" required>" +
+            "<input type=\"number\" name=\"amount_minor\" min=\"0\" step=\"1\" placeholder=\"amount (minor units)\" aria-label=\"Amount in minor units\" required>" +
+            "<button class=\"btn btn--ghost\" type=\"submit\">Set price</button>" +
+          "</div>" +
+          "<small class=\"u-mute\">Amount in the currency's minor units — e.g. 2999 = $29.99. Setting a price is append-only; the prior price is retained in history.</small>" +
+        "</form>" +
+      "</div>";
+
+    var editVariant =
+      "<form method=\"post\" action=\"/admin/variants/" + vid + "/edit\">" +
+        "<div class=\"actions-row\">" +
+          "<label class=\"form-field mb-0\"><span>SKU</span><input type=\"text\" name=\"sku\" value=\"" + _htmlEscape(v.sku) + "\" maxlength=\"128\" required></label>" +
+          "<label class=\"form-field mb-0\"><span>Title</span><input type=\"text\" name=\"title\" value=\"" + _htmlEscape(v.title || "") + "\" maxlength=\"500\"></label>" +
+        "</div>" +
+        "<div class=\"actions-row\">" +
+          "<label class=\"form-field mb-0\"><span>Options (k=v, comma-sep)</span><input type=\"text\" name=\"options\" value=\"" + _htmlEscape(optionsText) + "\" maxlength=\"2000\"></label>" +
+          "<label class=\"form-field mb-0\"><span>Weight (g)</span><input type=\"number\" name=\"weight_grams\" value=\"" + _htmlEscape(String(v.weight_grams || 0)) + "\" min=\"0\" step=\"1\"></label>" +
+        "</div>" +
+        "<label class=\"form-field\"><span>Requires shipping</span><select name=\"requires_shipping\">" +
+          "<option value=\"1\"" + (v.requires_shipping ? " selected" : "") + ">Yes (physical)</option>" +
+          "<option value=\"0\"" + (v.requires_shipping ? "" : " selected") + ">No (digital)</option>" +
+        "</select></label>" +
+        "<div class=\"actions-row\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Save variant</button>" +
+          "<a class=\"btn btn--danger\" href=\"/admin/variants/" + vid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+        "</div>" +
+      "</form>";
+
+    return "<div class=\"panel mt-1\">" +
+      "<div class=\"actions-row mt-0\">" +
+        "<strong>" + _htmlEscape(v.title || v.sku) + "</strong>" +
+        "<code class=\"order-id\">" + _htmlEscape(v.sku) + "</code>" +
+        (optionPairs ? "<span class=\"u-mute\">" + optionPairs + "</span>" : "") +
+      "</div>" +
+      editVariant +
+      priceSection +
+    "</div>";
+  }).join("");
+  var variantsBody = variants.length ? variantBlocks : "<p class=\"empty\">No variants yet — add the first one below.</p>";
+
+  var addVariant =
+    "<div class=\"panel mt-1 mw-40\">" +
+      "<h3 class=\"subhead\">Add a variant</h3>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/variants/create\">" +
+        _setupField("SKU", "sku", "", "text", "Unique stock-keeping unit — letters, digits, . _ -", " maxlength=\"128\" required") +
+        _setupField("Title", "title", "", "text", "Optional — e.g. “Large / Blue”.", " maxlength=\"500\"") +
+        _setupField("Options", "options", "", "text", "Attribute map as k=v pairs, comma-separated — e.g. size=L, color=blue.", " maxlength=\"2000\"") +
+        _setupField("Weight (grams)", "weight_grams", "0", "number", "Used for shipping rate calculation.", " min=\"0\" step=\"1\"") +
+        "<label class=\"form-field\"><span>Requires shipping</span><select name=\"requires_shipping\">" +
+          "<option value=\"1\">Yes (physical)</option><option value=\"0\">No (digital)</option>" +
+        "</select></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add variant</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var variantsSection = "<section class=\"mt\"><h3 class=\"fs-105\">Variants</h3>" + variantsBody + addVariant + "</section>";
+
+  // ---- media -----------------------------------------------------------
+  var mediaCards = mediaRows.map(function (m) {
+    var mid = _htmlEscape(m.id);
+    var url = assetPrefix + m.r2_key;
+    var isImage = /^image\//.test(m.content_type || "");
+    var thumb = isImage
+      ? "<img class=\"media-thumb\" src=\"" + _htmlEscape(url) + "\" alt=\"" + _htmlEscape(m.alt_text || "") + "\" loading=\"lazy\">"
+      : "<span class=\"media-thumb media-thumb--file\">" + _htmlEscape((m.content_type || "file").split("/")[0]) + "</span>";
+    return "<div class=\"media-card\">" +
+      thumb +
+      "<code class=\"order-id\">" + _htmlEscape(m.r2_key) + "</code>" +
+      "<span class=\"u-mute\">" + _htmlEscape(m.content_type || "") + (m.alt_text ? " · " + _htmlEscape(m.alt_text) : "") + "</span>" +
+      "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+    "</div>";
+  }).join("");
+  var mediaGrid = mediaRows.length
+    ? "<div class=\"media-grid\">" + mediaCards + "</div>"
+    : "<p class=\"empty\">No media attached yet.</p>";
+
+  var attachForm =
+    "<div class=\"panel mt-1 mw-40\">" +
+      "<h3 class=\"subhead\">Attach media by R2 key</h3>" +
+      "<p class=\"meta\">Reference an object already in your media bucket. The key is its path under the bucket (no leading slash, no “..”).</p>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/media/attach\">" +
+        _setupField("R2 key", "r2_key", "", "text", "e.g. media/01j…png", " maxlength=\"1024\" required") +
+        _setupField("Content type", "content_type", "", "text", "MIME type — e.g. image/png.", " maxlength=\"255\" required") +
+        _setupField("Alt text", "alt_text", "", "text", "Describes the image for screen readers + SEO.", " maxlength=\"500\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Attach media</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var uploadForm = uploadWired
+    ? "<div class=\"panel mt-1 mw-40\">" +
+        "<h3 class=\"subhead\">Upload media from a URL</h3>" +
+        "<p class=\"meta\">Fetches the source (SSRF-gated), stores it in your bucket, and attaches it to this product in one step.</p>" +
+        "<form method=\"post\" action=\"/admin/products/" + pid + "/media/upload\">" +
+          _setupField("Source URL", "source_url", "", "url", "A public https URL to the asset bytes.", " maxlength=\"2000\" required") +
+          _setupField("Content type", "content_type", "", "text", "MIME type the source serves — e.g. image/png.", " maxlength=\"255\" required") +
+          _setupField("Alt text", "alt_text", "", "text", "Describes the image for screen readers + SEO.", " maxlength=\"500\"") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Upload + attach</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
+  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + attachForm + uploadForm + "</section>";
+
+  // ---- head + assembly -------------------------------------------------
+  var statusCls = p.status === "active" ? "paid" : (p.status === "archived" ? "refunded" : "pending");
+  var archiveAction = p.status === "archived"
+    ? "<form method=\"post\" action=\"/admin/products/" + pid + "/restore\" class=\"form-inline\"><button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>"
+    : "<form method=\"post\" action=\"/admin/products/" + pid + "/archive\" class=\"form-inline\"><button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>";
+  var head =
+    "<p class=\"meta\"><a href=\"/admin/products\">&larr; Products</a> · " +
+      "<code class=\"order-id\">" + _htmlEscape(p.slug) + "</code> · " +
+      "<span class=\"status-pill " + statusCls + "\">" + _htmlEscape(p.status) + "</span>" +
+      " · <a href=\"/products/" + _htmlEscape(encodeURIComponent(p.slug)) + "\" target=\"_blank\" rel=\"noreferrer\">View on storefront &rarr;</a></p>";
+
+  var body = "<section><h2>" + _htmlEscape(p.title) + "</h2>" + saved + notice + head +
+    "<div class=\"actions-row mt-0\">" + archiveAction + "</div>" +
+    editForm + "</section>" + variantsSection + mediaSection;
+  return _renderAdminShell(opts.shop_name, "Product " + p.slug, body, "products", opts.nav_available);
+}
+
 module.exports = {
   mount:           mount,
   AUDIT_NAMESPACE: AUDIT_NAMESPACE,
@@ -4627,6 +6186,7 @@ module.exports = {
   renderAdminSetup:        renderAdminSetup,
   renderAdminIntegrations: renderAdminIntegrations,
   renderAdminProducts:     renderAdminProducts,
+  renderAdminProduct:      renderAdminProduct,
   renderAdminInventory:    renderAdminInventory,
   renderAdminOrders:       renderAdminOrders,
   renderAdminOrder:        renderAdminOrder,
@@ -4640,5 +6200,9 @@ module.exports = {
   renderAdminCollection:   renderAdminCollection,
   renderAdminGiftCards:    renderAdminGiftCards,
   renderAdminGiftCard:     renderAdminGiftCard,
+  renderAdminTaxRates:     renderAdminTaxRates,
+  renderAdminShipping:     renderAdminShipping,
+  renderAdminShippingZone: renderAdminShippingZone,
+  renderAdminDiscounts:    renderAdminDiscounts,
   renderAdminConfirm:      renderAdminConfirm,
 };