@blamejs/blamejs-shop 0.2.14 → 0.2.17

package/lib/admin.js

@@ -319,7 +319,7 @@ function mount(router, deps) {
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -3107,6 +3107,620 @@ function mount(router, deps) {
     return issued;
   }
 
+  // ---- tax rates ------------------------------------------------------
+  //
+  // Operator-managed per-jurisdiction rate table. `defineRate` keys on a
+  // (jurisdiction, category, effective window) tuple; the console lists
+  // by jurisdiction, creates a rate, edits the mutable columns (rate_bps
+  // / effective_until / source), and archives. `bulkImport` is an
+  // API-only path (operators hydrate a paid-feed snapshot from a script);
+  // it has no console form because authoring dozens of rows by hand isn't
+  // a console gesture — the single-rate create covers operator-by-hand
+  // entry and the feed importer uses the bearer JSON surface.
+  var taxRates = deps.taxRates || null;
+  if (taxRates) {
+    router.post("/admin/tax-rates", _pageOrApi(false,
+      W("tax_rate.create", async function (req, res) {
+        var rate = await taxRates.defineRate(_taxRateInput(req.body || {}));
+        _json(res, 201, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var jurisdiction = typeof body.jurisdiction === "string" ? body.jurisdiction.trim().toUpperCase() : body.jurisdiction;
+        try {
+          await taxRates.defineRate(_taxRateInput(body));
+        } catch (e) {
+          if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP") throw e;
+          var rows = await _taxRatesForBrowser(jurisdiction);
+          return _sendHtml(res, 400, renderAdminTaxRates({
+            shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
+            jurisdiction: jurisdiction, sources: taxRates.SOURCES,
+            notice: (e && e.message || "").replace(/^taxRates[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.create", outcome: "success" });
+        _redirect(res, "/admin/tax-rates?jurisdiction=" + encodeURIComponent(jurisdiction) + "&created=1");
+      },
+    ));
+
+    router.get("/admin/tax-rates", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var j = url && url.searchParams.get("jurisdiction");
+        if (!j) return _json(res, 200, { rows: [] });
+        var includeExpired = url && url.searchParams.get("include_expired") === "1";
+        var rows = await taxRates.listForJurisdiction({ jurisdiction: j, include_expired: includeExpired });
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var j = url && url.searchParams.get("jurisdiction");
+        var jurisdiction = j ? String(j).trim().toUpperCase() : null;
+        var rows = await _taxRatesForBrowser(jurisdiction);
+        _sendHtml(res, 200, renderAdminTaxRates({
+          shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
+          jurisdiction: jurisdiction, sources: taxRates.SOURCES,
+          created:  url && url.searchParams.get("created"),
+          updated:  url && url.searchParams.get("updated"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the rate." : null,
+        }));
+      },
+    ));
+
+    // Patch the mutable columns (rate_bps / effective_until / source).
+    router.patch("/admin/tax-rates/:id", W("tax_rate.update", async function (req, res) {
+      var rate;
+      try { rate = await taxRates.updateRate(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!rate) return _problem(res, 404, "tax-rate-not-found");
+      _json(res, 200, rate);
+      return { id: rate.id };
+    }));
+
+    // Browser POST alias for the edit (HTML can't PATCH). Re-aims at the
+    // rate's jurisdiction list on success / failure.
+    router.post("/admin/tax-rates/:id/edit", _pageOrApi(false,
+      W("tax_rate.update", async function (req, res) {
+        var rate;
+        try { rate = await taxRates.updateRate(req.params.id, _taxRatePatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!rate) return _problem(res, 404, "tax-rate-not-found");
+        _json(res, 200, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var enc = "/admin/tax-rates" + (body.jurisdiction ? "?jurisdiction=" + encodeURIComponent(String(body.jurisdiction).trim().toUpperCase()) : "");
+        var rate = null;
+        try { rate = await taxRates.updateRate(req.params.id, _taxRatePatch(body)); }
+        catch (e) { if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP" && e.code !== "TAX_RATE_ARCHIVED") throw e; }
+        if (!rate) return _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.update", outcome: "success", metadata: { id: req.params.id } });
+        _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "updated=1");
+      },
+    ));
+
+    router.delete("/admin/tax-rates/:id", W("tax_rate.archive", async function (req, res) {
+      var rate;
+      try { rate = await taxRates.archiveRate(req.params.id, {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!rate) return _problem(res, 404, "tax-rate-not-found");
+      _json(res, 200, rate);
+      return { id: rate.id };
+    }));
+
+    router.post("/admin/tax-rates/:id/archive", _pageOrApi(false,
+      W("tax_rate.archive", async function (req, res) {
+        var rate;
+        try { rate = await taxRates.archiveRate(req.params.id, {}); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!rate) return _problem(res, 404, "tax-rate-not-found");
+        _json(res, 200, rate);
+        return { id: rate.id };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        var enc = "/admin/tax-rates" + (body.jurisdiction ? "?jurisdiction=" + encodeURIComponent(String(body.jurisdiction).trim().toUpperCase()) : "");
+        var rate = null;
+        try { rate = await taxRates.archiveRate(req.params.id, {}); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!rate) return _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.archive", outcome: "success", metadata: { id: req.params.id } });
+        _redirect(res, enc + (enc.indexOf("?") === -1 ? "?" : "&") + "archived=1");
+      },
+    ));
+  }
+
+  // Read a jurisdiction's rate history for the browser list. A null /
+  // unset jurisdiction yields an empty list (the page shows the picker
+  // form). A malformed jurisdiction throws TypeError in the primitive —
+  // map that to an empty list so the page renders the notice, never 500.
+  async function _taxRatesForBrowser(jurisdiction) {
+    if (!jurisdiction) return [];
+    try { return await taxRates.listForJurisdiction({ jurisdiction: jurisdiction, include_expired: true }); }
+    catch (e) { if (e instanceof TypeError) return []; throw e; }
+  }
+
+  // Translate the create form / JSON body into a defineRate input.
+  // Strict integer parsing for rate_bps + the two epoch-ms windows.
+  function _taxRateInput(body) {
+    var input = {
+      jurisdiction: typeof body.jurisdiction === "string" ? body.jurisdiction.trim().toUpperCase() : body.jurisdiction,
+      rate_bps:     _strictMinorInt(body.rate_bps, "taxRates", "rate_bps"),
+      source:       typeof body.source === "string" && body.source ? body.source : "manual",
+    };
+    if (body.category != null && body.category !== "") input.category = String(body.category).trim();
+    input.effective_from = (body.effective_from == null || body.effective_from === "")
+      ? Date.now()
+      : _strictMinorInt(body.effective_from, "taxRates", "effective_from (epoch-ms)");
+    if (body.effective_until != null && body.effective_until !== "") {
+      input.effective_until = _strictMinorInt(body.effective_until, "taxRates", "effective_until (epoch-ms)");
+    }
+    return input;
+  }
+
+  // Translate the edit form / JSON body into an updateRate patch. Only
+  // the mutable columns are forwarded; absent fields are left untouched.
+  function _taxRatePatch(body) {
+    var patch = {};
+    if (body.rate_bps != null && body.rate_bps !== "") patch.rate_bps = _strictMinorInt(body.rate_bps, "taxRates", "rate_bps");
+    if (Object.prototype.hasOwnProperty.call(body, "effective_until")) {
+      patch.effective_until = (body.effective_until == null || body.effective_until === "")
+        ? null
+        : _strictMinorInt(body.effective_until, "taxRates", "effective_until (epoch-ms)");
+    }
+    if (body.source != null && body.source !== "") patch.source = String(body.source);
+    return patch;
+  }
+
+  // ---- shipping zones -------------------------------------------------
+  //
+  // Operator-defined flat-rate / table-rate zones. The console create is
+  // the common single-country, single-flat-service shape — country +
+  // service label + flat amount + currency, optionally a region. The
+  // primitive's full regions[] / rates[] vocabulary (weight + order-value
+  // buckets, multi-region) is reachable via the bearer JSON contract; the
+  // edit screen lets an operator paste the full regions / rates JSON to
+  // mutate beyond the simple shape.
+  var shippingZones = deps.shippingZones || null;
+  if (shippingZones) {
+    router.post("/admin/shipping", _pageOrApi(false,
+      W("shipping_zone.create", async function (req, res) {
+        var zone = await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
+        _json(res, 201, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        try {
+          await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_EXISTS") throw e;
+          var rows = await shippingZones.listZones({});
+          return _sendHtml(res, 400, renderAdminShipping({
+            shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
+            notice: (e && e.message || "").replace(/^shippingZones[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.create", outcome: "success" });
+        _redirect(res, "/admin/shipping?created=1");
+      },
+    ));
+
+    router.get("/admin/shipping", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeOnly = url && url.searchParams.get("active") === "1";
+        var rows = await shippingZones.listZones(activeOnly ? { active_only: true } : {});
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await shippingZones.listZones({});
+        _sendHtml(res, 200, renderAdminShipping({
+          shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
+          created:  url && url.searchParams.get("created"),
+          updated:  url && url.searchParams.get("updated"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the zone." : null,
+        }));
+      },
+    ));
+
+    router.get("/admin/shipping/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.getZone(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "shipping-zone-not-found", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var zone;
+        try { zone = await shippingZones.getZone(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; zone = null; }
+        if (!zone) return _sendHtml(res, 404, renderAdminShipping({
+          shop_name: deps.shop_name, nav_available: navAvailable, zones: [], notice: "Zone not found.",
+        }));
+        _sendHtml(res, 200, renderAdminShippingZone({
+          shop_name: deps.shop_name, nav_available: navAvailable, zone: zone,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.patch("/admin/shipping/:slug", W("shipping_zone.update", async function (req, res) {
+      var zone;
+      try { zone = await shippingZones.updateZone(req.params.slug, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+      _json(res, 200, zone);
+      return { id: zone.slug };
+    }));
+
+    // Browser edit alias. Mutates title + active (checkbox) and, when the
+    // operator pastes JSON, regions / rates. Empty paste fields are left
+    // untouched so a title-only edit doesn't wipe the rate table.
+    router.post("/admin/shipping/:slug/edit", _pageOrApi(false,
+      W("shipping_zone.update", async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.updateZone(req.params.slug, _shippingZonePatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        var zone = null;
+        try { zone = await shippingZones.updateZone(slug, _shippingZonePatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_ARCHIVED") throw e; }
+        if (!zone) return _redirect(res, "/admin/shipping/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/shipping/" + enc + "?updated=1");
+      },
+    ));
+
+    router.delete("/admin/shipping/:slug", W("shipping_zone.archive", async function (req, res) {
+      var zone;
+      try { zone = await shippingZones.archiveZone(req.params.slug); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+      _json(res, 200, zone);
+      return { id: zone.slug };
+    }));
+
+    router.post("/admin/shipping/:slug/archive", _pageOrApi(false,
+      W("shipping_zone.archive", async function (req, res) {
+        var zone;
+        try { zone = await shippingZones.archiveZone(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!zone) return _problem(res, 404, "shipping-zone-not-found");
+        _json(res, 200, zone);
+        return { id: zone.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var zone = null;
+        try { zone = await shippingZones.archiveZone(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!zone) return _redirect(res, "/admin/shipping?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/shipping?archived=1");
+      },
+    ));
+  }
+
+  // Translate the create form / JSON body into a defineZone input. The
+  // console form is the single-country, single-flat-rate shape; the
+  // bearer JSON path can pass the full regions[]/rates[] arrays directly,
+  // so those pass through untouched when present.
+  function _shippingZoneInput(body) {
+    if (Array.isArray(body.regions) || Array.isArray(body.rates)) {
+      // Full JSON shape from a bearer client — forward as-is.
+      return body;
+    }
+    var country = typeof body.country === "string" ? body.country.trim().toUpperCase() : body.country;
+    var region  = (body.region != null && body.region !== "") ? String(body.region).trim().toUpperCase() : null;
+    var regionEntry = { country: country };
+    if (region) regionEntry.region = region;
+    return {
+      slug:   typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title:  body.title,
+      active: body.active === "0" || body.active === "off" ? false : true,
+      regions: [regionEntry],
+      rates: [{
+        rate_minor:    _strictMinorInt(body.rate_minor, "shippingZones", "rate_minor"),
+        currency:      typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+        service_label: body.service_label,
+      }],
+    };
+  }
+
+  // Translate the edit form / JSON body into an updateZone patch. Title
+  // + active always forward; regions / rates only when the operator
+  // pasted non-empty JSON (an empty paste leaves the existing table).
+  function _shippingZonePatch(body) {
+    var patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
+    // The active checkbox is present (="on"/"1") when checked, absent when
+    // unchecked — but only treat it as a field when the form declared it
+    // via the hidden marker so a partial JSON edit doesn't flip active.
+    if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    if (typeof body.regions_json === "string" && body.regions_json.trim() !== "") {
+      patch.regions = JSON.parse(body.regions_json);
+    } else if (Array.isArray(body.regions)) {
+      patch.regions = body.regions;
+    }
+    if (typeof body.rates_json === "string" && body.rates_json.trim() !== "") {
+      patch.rates = JSON.parse(body.rates_json);
+    } else if (Array.isArray(body.rates)) {
+      patch.rates = body.rates;
+    }
+    return patch;
+  }
+
+  // ---- automatic discounts + stacking policies ------------------------
+  //
+  // Two related concerns on one console screen. `autoDiscount` rules are
+  // cart-level automatics (no code typed); `couponStacking` policies gate
+  // which codes may combine. The screen lists + creates + archives both;
+  // rule edit covers title / priority / active (the trigger + value JSON
+  // vocabularies are re-set via the create-shape edit fields). Segment-
+  // gated rules / per-customer caps / exclusions stay on the bearer JSON
+  // surface — the console covers the operator-by-hand common case (a
+  // trigger, a value, a priority); the richer JSON shapes pass through
+  // the bearer create unchanged.
+  var autoDiscount   = deps.autoDiscount   || null;
+  var couponStacking = deps.couponStacking || null;
+  if (autoDiscount) {
+    router.post("/admin/discounts", _pageOrApi(false,
+      W("auto_discount.create", async function (req, res) {
+        var rule = await autoDiscount.defineRule(_discountInput(req.body || {}));
+        _json(res, 201, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try {
+          await autoDiscount.defineRule(_discountInput(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          return _sendHtml(res, 400, await _renderDiscounts({
+            notice: (e && e.message || "").replace(/^autoDiscount[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.create", outcome: "success" });
+        _redirect(res, "/admin/discounts?created=1");
+      },
+    ));
+
+    router.get("/admin/discounts", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeOnly = url && url.searchParams.get("active") === "1";
+        var rules = await autoDiscount.listRules(activeOnly ? { active_only: true, limit: 500 } : { limit: 500 });
+        var policies = couponStacking ? await couponStacking.listPolicies({ limit: 200 }) : [];
+        _json(res, 200, { rules: rules, policies: policies });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, await _renderDiscounts({
+          created:        url && url.searchParams.get("created"),
+          updated:        url && url.searchParams.get("updated"),
+          archived:       url && url.searchParams.get("archived"),
+          policy_created: url && url.searchParams.get("policy_created"),
+          policy_archived: url && url.searchParams.get("policy_archived"),
+          notice:         (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.patch("/admin/discounts/:slug", W("auto_discount.update", async function (req, res) {
+      var rule;
+      try { rule = await autoDiscount.updateRule(req.params.slug, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, rule);
+      return { id: rule.slug };
+    }));
+
+    router.post("/admin/discounts/:slug/edit", _pageOrApi(false,
+      W("auto_discount.update", async function (req, res) {
+        var rule;
+        try { rule = await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try { await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: req.params.slug } });
+        _redirect(res, "/admin/discounts?updated=1");
+      },
+    ));
+
+    router.delete("/admin/discounts/:slug", W("auto_discount.archive", async function (req, res) {
+      var rule;
+      try { rule = await autoDiscount.archiveRule(req.params.slug); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, rule);
+      return { id: rule.slug };
+    }));
+
+    router.post("/admin/discounts/:slug/archive", _pageOrApi(false,
+      W("auto_discount.archive", async function (req, res) {
+        var rule;
+        try { rule = await autoDiscount.archiveRule(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, rule);
+        return { id: rule.slug };
+      }),
+      async function (req, res) {
+        try { await autoDiscount.archiveRule(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.archive", outcome: "success", metadata: { slug: req.params.slug } });
+        _redirect(res, "/admin/discounts?archived=1");
+      },
+    ));
+
+    // Stacking-policy lifecycle — only mounted when the couponStacking
+    // dep is wired alongside autoDiscount (the screen renders the policy
+    // section conditionally too).
+    if (couponStacking) {
+      router.post("/admin/discounts/policies", _pageOrApi(false,
+        W("coupon_policy.create", async function (req, res) {
+          var policy = await couponStacking.definePolicy(_policyInput(req.body || {}));
+          _json(res, 201, policy);
+          return { id: policy.slug };
+        }),
+        async function (req, res) {
+          try {
+            await couponStacking.definePolicy(_policyInput(req.body || {}));
+          } catch (e) {
+            if (!(e instanceof TypeError)) throw e;
+            return _sendHtml(res, 400, await _renderDiscounts({
+              notice: (e && e.message || "").replace(/^couponStacking[.:]\s*/, ""),
+            }));
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.create", outcome: "success" });
+          _redirect(res, "/admin/discounts?policy_created=1");
+        },
+      ));
+
+      router.delete("/admin/discounts/policies/:slug", W("coupon_policy.archive", async function (req, res) {
+        var policy;
+        try { policy = await couponStacking.archivePolicy(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, policy);
+        return { id: policy.slug };
+      }));
+
+      router.post("/admin/discounts/policies/:slug/archive", _pageOrApi(false,
+        W("coupon_policy.archive", async function (req, res) {
+          var policy;
+          try { policy = await couponStacking.archivePolicy(req.params.slug); }
+          catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+          _json(res, 200, policy);
+          return { id: policy.slug };
+        }),
+        async function (req, res) {
+          try { await couponStacking.archivePolicy(req.params.slug); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.archive", outcome: "success", metadata: { slug: req.params.slug } });
+          _redirect(res, "/admin/discounts?policy_archived=1");
+        },
+      ));
+    }
+  }
+
+  // Render the discounts screen — gathers rules + (optional) stacking
+  // policies, then hands them to the renderer with whatever banner flags
+  // the caller passed.
+  async function _renderDiscounts(flags) {
+    flags = flags || {};
+    var rules = await autoDiscount.listRules({ limit: 500 });
+    var policies = couponStacking ? await couponStacking.listPolicies({ limit: 200 }) : [];
+    return renderAdminDiscounts(Object.assign({
+      shop_name: deps.shop_name, nav_available: navAvailable,
+      rules: rules, policies: policies, stacking_enabled: !!couponStacking,
+    }, flags));
+  }
+
+  // Translate the create form / JSON body into a defineRule input. The
+  // console covers a single trigger + a single value + priority; the
+  // bearer JSON path can pass the full vocabulary (applies_to, segments,
+  // exclusions, caps) directly, so a body already carrying object-shaped
+  // trigger / value passes through untouched.
+  function _discountInput(body) {
+    if (body.trigger && typeof body.trigger === "object" && body.value && typeof body.value === "object") {
+      return body; // full JSON shape from a bearer client
+    }
+    var input = {
+      slug:  typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title: body.title,
+      trigger: _discountTrigger(body),
+      value:   _discountValue(body),
+    };
+    if (body.priority != null && body.priority !== "") {
+      input.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
+    }
+    return input;
+  }
+
+  function _discountTrigger(body) {
+    var kind = body.trigger_kind;
+    if (kind === "item_count_min") {
+      return { kind: "item_count_min", min_count: _strictMinorInt(body.trigger_min_count, "autoDiscount", "trigger min_count") };
+    }
+    if (kind === "sku_purchase") {
+      var skus = String(body.trigger_skus || "").split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+      var t = { kind: "sku_purchase", skus: skus };
+      if (body.trigger_min_quantity != null && body.trigger_min_quantity !== "") {
+        t.min_quantity = _strictMinorInt(body.trigger_min_quantity, "autoDiscount", "trigger min_quantity");
+      }
+      return t;
+    }
+    // default: cart_total_min
+    return { kind: "cart_total_min", min_minor: _strictMinorInt(body.trigger_min_minor, "autoDiscount", "trigger min_minor") };
+  }
+
+  function _discountValue(body) {
+    var kind = body.value_kind;
+    if (kind === "percent_off") {
+      return { kind: "percent_off", basis_points: _strictMinorInt(body.value_basis_points, "autoDiscount", "value basis_points") };
+    }
+    if (kind === "amount_off_total" || kind === "amount_off_each") {
+      return { kind: kind, minor: _strictMinorInt(body.value_minor, "autoDiscount", "value minor") };
+    }
+    if (kind === "bogo") {
+      return {
+        kind: "bogo",
+        buy_qty: _strictMinorInt(body.value_buy_qty, "autoDiscount", "value buy_qty"),
+        get_qty: _strictMinorInt(body.value_get_qty, "autoDiscount", "value get_qty"),
+      };
+    }
+    return { kind: "free_shipping" };
+  }
+
+  // Translate the rule edit form into an updateRule patch — title /
+  // priority / active. The trigger + value re-set go through the bearer
+  // JSON PATCH for the full vocabulary; the console edit is the common
+  // "rename / re-prioritise / pause" gesture.
+  function _discountPatch(body) {
+    var patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
+    if (body.priority != null && body.priority !== "") patch.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
+    if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    return patch;
+  }
+
+  // Translate the policy create form / JSON body into a definePolicy
+  // input. The console exposes the common shape (max codes + the two
+  // combine toggles + an order-min floor); exclusive_codes / segment
+  // gating stay on the bearer JSON path.
+  function _policyInput(body) {
+    if (body.allow_combine && typeof body.allow_combine === "object") {
+      return body; // full JSON shape from a bearer client
+    }
+    var input = {
+      slug:  typeof body.slug === "string" ? body.slug.trim() : body.slug,
+      title: body.title,
+      max_codes_per_order: _strictMinorInt(body.max_codes_per_order, "couponStacking", "max_codes_per_order"),
+      allow_combine: {
+        with_quantity_discounts: (body.with_quantity_discounts === "on" || body.with_quantity_discounts === "1"),
+        with_other_codes:        (body.with_other_codes === "on" || body.with_other_codes === "1"),
+      },
+    };
+    if (body.order_min_minor != null && body.order_min_minor !== "") {
+      input.order_min_minor = _strictMinorInt(body.order_min_minor, "couponStacking", "order_min_minor");
+    }
+    return input;
+  }
+
   // ---- admin web pages (browser session + setup wizard) ---------------
   //
   // The operator signs in by pasting the ADMIN_API_KEY once; that sets a
@@ -3425,6 +4039,9 @@ var ADMIN_NAV_ITEMS = [
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
+  { key: "discounts",    href: "/admin/discounts",    label: "Discounts",    requires: "autoDiscount" },
+  { key: "tax",          href: "/admin/tax-rates",    label: "Tax",          requires: "taxRates" },
+  { key: "shipping",     href: "/admin/shipping",     label: "Shipping",     requires: "shippingZones" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
   { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
@@ -4269,6 +4886,354 @@ function renderAdminSubscriptionPlans(opts) {
 // •••• fill; the plaintext bearer code is never stored and so never
 // rendered here. Original (issued) + remaining balance + lifecycle
 // status + issued date per row, newest first.
+// A <select> form field matching the _setupField shape. `options` is an
+// array of { value, label }; `selected` highlights the current value.
+function _selectField(label, name, options, selected, hint, extra) {
+  var opts = (options || []).map(function (o) {
+    return "<option value=\"" + _htmlEscape(o.value) + "\"" +
+      (o.value === selected ? " selected" : "") + ">" + _htmlEscape(o.label) + "</option>";
+  }).join("");
+  return "<label class=\"form-field\"><span>" + _htmlEscape(label) + "</span>" +
+    "<select name=\"" + _htmlEscape(name) + "\"" + (extra || "") + ">" + opts + "</select>" +
+    (hint ? "<small>" + _htmlEscape(hint) + "</small>" : "") +
+    "</label>";
+}
+
+// bps → human "X.XX%". 1 bp = 0.01%.
+function _fmtBps(bps) {
+  var n = Number(bps);
+  if (!isFinite(n)) return "—";
+  return (n / 100).toFixed(2) + "%";
+}
+
+function renderAdminTaxRates(opts) {
+  opts = opts || {};
+  var rows = opts.rates || [];
+  var jurisdiction = opts.jurisdiction || "";
+  var sources = opts.sources || ["manual"];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Rate created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Rate updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Rate archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // Jurisdiction picker — the list is scoped to one jurisdiction at a
+  // time (the lib's listForJurisdiction is the only list surface).
+  var picker =
+    "<div class=\"panel mw-34\">" +
+      "<form method=\"get\" action=\"/admin/tax-rates\" class=\"form-inline\">" +
+        "<label class=\"form-field\"><span>Jurisdiction</span>" +
+          "<input type=\"text\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\" placeholder=\"US or US-CA\" maxlength=\"6\" class=\"input-code\" required>" +
+          "<small>ISO 3166-1 country, optionally -subdivision (e.g. US, US-CA, DE-BY).</small>" +
+        "</label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">View rates</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var table = "";
+  if (jurisdiction) {
+    var bodyRows = rows.map(function (r) {
+      var isArchived = r.archived_at != null;
+      var until = r.effective_until == null ? "<span class=\"meta\">open</span>" : _htmlEscape(_fmtDate(Number(r.effective_until)));
+      var editForm = isArchived ? "" :
+        "<form method=\"post\" action=\"/admin/tax-rates/" + _htmlEscape(r.id) + "/edit\" class=\"form-inline\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          "<input type=\"number\" name=\"rate_bps\" value=\"" + _htmlEscape(String(r.rate_bps)) + "\" min=\"0\" max=\"10000\" class=\"input-sm\" aria-label=\"rate basis points\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
+        "</form> " +
+        "<form method=\"post\" action=\"/admin/tax-rates/" + _htmlEscape(r.id) + "/archive\" class=\"form-inline\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Archive</button>" +
+        "</form>";
+      return "<tr>" +
+        "<td>" + (r.category ? "<code>" + _htmlEscape(r.category) + "</code>" : "<span class=\"meta\">default</span>") + "</td>" +
+        "<td class=\"num\"><strong>" + _htmlEscape(_fmtBps(r.rate_bps)) + "</strong> <span class=\"meta\">(" + _htmlEscape(String(r.rate_bps)) + " bps)</span></td>" +
+        "<td>" + _htmlEscape(_fmtDate(Number(r.effective_from))) + "</td>" +
+        "<td>" + until + "</td>" +
+        "<td>" + _htmlEscape(r.source) + "</td>" +
+        "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "live") + "</span></td>" +
+        "<td>" + editForm + "</td>" +
+      "</tr>";
+    }).join("");
+    table = rows.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Category</th><th scope=\"col\" class=\"num\">Rate</th><th scope=\"col\">From</th><th scope=\"col\">Until</th><th scope=\"col\">Source</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+      : "<p class=\"empty\">No rates for " + _htmlEscape(jurisdiction) + " yet.</p>";
+  }
+
+  var sourceOpts = sources.map(function (s) { return { value: s, label: s }; });
+  var createForm = jurisdiction
+    ? "<div class=\"panel mt mw-34\">" +
+        "<h3 class=\"subhead\">Add a rate for " + _htmlEscape(jurisdiction) + "</h3>" +
+        "<form method=\"post\" action=\"/admin/tax-rates\">" +
+          "<input type=\"hidden\" name=\"jurisdiction\" value=\"" + _htmlEscape(jurisdiction) + "\">" +
+          _setupField("Category (optional)", "category", "", "text", "Leave blank for the jurisdiction's default rate. Lowercase, e.g. food, books.", " maxlength=\"64\"") +
+          _setupField("Rate (basis points)", "rate_bps", "", "number", "1 bp = 0.01%. 2000 = 20.00%.", " min=\"0\" max=\"10000\" required") +
+          _setupField("Effective from (epoch-ms, optional)", "effective_from", "", "number", "When the rate starts. Blank = now.", " min=\"0\"") +
+          _setupField("Effective until (epoch-ms, optional)", "effective_until", "", "number", "When the rate ends. Blank = open-ended.", " min=\"0\"") +
+          _selectField("Source", "source", sourceOpts, "manual", "Who declared this rate.", "") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add rate</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
+  var body = "<section><h2>Tax rates</h2>" + created + updated + archived + notice + picker + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Tax rates", body, "tax", opts.nav_available);
+}
+
+function renderAdminShipping(opts) {
+  opts = opts || {};
+  var rows = opts.zones || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Zone created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Zone updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Zone archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var bodyRows = rows.map(function (z) {
+    var isArchived = z.archived_at != null;
+    var regionStr = (z.regions || []).map(function (r) {
+      return r.region ? r.country + "-" + r.region : r.country;
+    }).join(", ");
+    var rateCount = (z.rates || []).length;
+    var statusCls = isArchived ? "cancelled" : (z.active ? "paid" : "pending");
+    var statusTxt = isArchived ? "archived" : (z.active ? "active" : "paused");
+    return "<tr>" +
+      "<td><a href=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "\"><strong>" + _htmlEscape(z.title) + "</strong></a></td>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(z.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(regionStr) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(rateCount)) + "</td>" +
+      "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        "<a class=\"btn btn--ghost\" href=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "\">Manage</a>" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/shipping/" + _htmlEscape(encodeURIComponent(z.slug)) + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Regions</th><th scope=\"col\" class=\"num\">Rates</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No shipping zones yet.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Add a zone</h3>" +
+      "<p class=\"meta\">A flat-rate service for one destination. Add more rate rows / regions from the zone's manage screen.</p>" +
+      "<form method=\"post\" action=\"/admin/shipping\">" +
+        _setupField("Slug", "slug", "", "text", "Stable identifier, e.g. domestic-us.", " maxlength=\"64\" required") +
+        _setupField("Title", "title", "", "text", "Operator-facing name, e.g. Domestic (US).", " maxlength=\"200\" required") +
+        _setupField("Country", "country", "", "text", "ISO 3166-1 alpha-2, e.g. US.", " maxlength=\"2\" class=\"input-code\" required") +
+        _setupField("Region (optional)", "region", "", "text", "ISO 3166-2 subdivision without country prefix, e.g. CA. Blank = whole country.", " maxlength=\"3\" class=\"input-code\"") +
+        _setupField("Service label", "service_label", "", "text", "Shown at checkout, e.g. Standard.", " maxlength=\"128\" required") +
+        _setupField("Rate (minor units)", "rate_minor", "", "number", "In the currency's smallest unit — 500 = $5.00.", " min=\"0\" required") +
+        _setupField("Currency", "currency", "", "text", "3-letter ISO 4217, e.g. USD.", " maxlength=\"3\" class=\"input-code\" required") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add zone</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Shipping zones</h2>" + created + updated + archived + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Shipping zones", body, "shipping", opts.nav_available);
+}
+
+function renderAdminShippingZone(opts) {
+  opts = opts || {};
+  var z = opts.zone;
+  if (!z) {
+    var nf = "<section><h2>Shipping zone</h2><p class=\"empty\">Zone not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/shipping\">Back to shipping</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Shipping zone", nf, "shipping", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Zone updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var enc = encodeURIComponent(z.slug);
+
+  var rateRows = (z.rates || []).map(function (r) {
+    var bucket = [];
+    if (r.min_weight_grams != null || r.max_weight_grams != null) {
+      bucket.push((r.min_weight_grams || 0) + "–" + (r.max_weight_grams == null ? "∞" : r.max_weight_grams) + " g");
+    }
+    if (r.min_order_minor != null || r.max_order_minor != null) {
+      bucket.push((r.min_order_minor || 0) + "–" + (r.max_order_minor == null ? "∞" : r.max_order_minor) + " minor");
+    }
+    return "<tr>" +
+      "<td>" + _htmlEscape(r.service_label) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(pricing.format(r.rate_minor, String(r.currency || "").toUpperCase())) + "</td>" +
+      "<td>" + (bucket.length ? _htmlEscape(bucket.join(" · ")) : "<span class=\"meta\">any</span>") + "</td>" +
+    "</tr>";
+  }).join("");
+  var rateTable = (z.rates || []).length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Service</th><th scope=\"col\" class=\"num\">Rate</th><th scope=\"col\">Bucket</th></tr></thead><tbody>" + rateRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No rate rows.</p>";
+
+  var head = "<p class=\"meta\"><a href=\"/admin/shipping\">&larr; Shipping</a> · <code class=\"order-id\">" + _htmlEscape(z.slug) + "</code> · " +
+    "<span class=\"status-pill " + (z.archived_at != null ? "cancelled" : (z.active ? "paid" : "pending")) + "\">" +
+    (z.archived_at != null ? "archived" : (z.active ? "active" : "paused")) + "</span></p>";
+
+  // Edit form: title + active toggle always; regions / rates via JSON
+  // paste for the full vocabulary (weight + order buckets, multi-region).
+  var editForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Edit zone</h3>" +
+      "<form method=\"post\" action=\"/admin/shipping/" + _htmlEscape(enc) + "/edit\">" +
+        _setupField("Title", "title", z.title, "text", "", " maxlength=\"200\"") +
+        "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+        "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (z.active ? " checked" : "") + "> Active (serve this zone at checkout)</label>" +
+        "<label class=\"form-field\"><span>Regions JSON (optional)</span>" +
+          "<textarea name=\"regions_json\" rows=\"3\" placeholder='[{\"country\":\"US\",\"region\":\"CA\"}]'></textarea>" +
+          "<small>Paste to replace the regions array. Blank leaves it unchanged.</small></label>" +
+        "<label class=\"form-field\"><span>Rates JSON (optional)</span>" +
+          "<textarea name=\"rates_json\" rows=\"4\" placeholder='[{\"rate_minor\":500,\"currency\":\"USD\",\"service_label\":\"Standard\"}]'></textarea>" +
+          "<small>Paste to replace the rate table. Blank leaves it unchanged.</small></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save zone</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/shipping\">Back</a></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>" + _htmlEscape(z.title) + "</h2>" + updated + notice + head +
+    "<h3 class=\"subhead subhead--sp-lg\">Rates</h3>" + rateTable + editForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Zone " + z.slug, body, "shipping", opts.nav_available);
+}
+
+// Human one-liner for a rule's trigger / value JSON.
+function _fmtTrigger(t) {
+  if (!t || !t.kind) return "—";
+  if (t.kind === "cart_total_min") return "cart ≥ " + (t.min_minor || 0) + " minor";
+  if (t.kind === "item_count_min") return "≥ " + (t.min_count || 0) + " items";
+  if (t.kind === "sku_purchase")   return "buys " + (t.skus || []).join("/") + (t.min_quantity > 1 ? " ×" + t.min_quantity : "");
+  return t.kind;
+}
+function _fmtValue(v) {
+  if (!v || !v.kind) return "—";
+  if (v.kind === "percent_off")      return (Number(v.basis_points) / 100).toFixed(2) + "% off";
+  if (v.kind === "amount_off_total") return v.minor + " minor off total";
+  if (v.kind === "amount_off_each")  return v.minor + " minor off each";
+  if (v.kind === "free_shipping")    return "free shipping";
+  if (v.kind === "bogo")             return "buy " + v.buy_qty + " get " + v.get_qty;
+  return v.kind;
+}
+
+function renderAdminDiscounts(opts) {
+  opts = opts || {};
+  var rules = opts.rules || [];
+  var policies = opts.policies || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Discount rule created.</div>" : "";
+  var updated  = opts.updated  ? "<div class=\"banner banner--ok\">Rule updated.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Rule archived.</div>" : "";
+  var pCreated = opts.policy_created  ? "<div class=\"banner banner--ok\">Stacking policy created.</div>" : "";
+  var pArchived = opts.policy_archived ? "<div class=\"banner banner--ok\">Stacking policy archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var ruleRows = rules.map(function (r) {
+    var isArchived = r.archived_at != null;
+    var statusCls = isArchived ? "cancelled" : (r.active ? "paid" : "pending");
+    var statusTxt = isArchived ? "archived" : (r.active ? "active" : "paused");
+    var actions = isArchived ? "" :
+      "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/edit\" class=\"form-inline\">" +
+        "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+        "<input type=\"number\" name=\"priority\" value=\"" + _htmlEscape(String(r.priority)) + "\" min=\"0\" class=\"input-sm\" aria-label=\"priority\">" +
+        "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> on</label>" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
+      "</form> " +
+      "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+    return "<tr>" +
+      "<td><strong>" + _htmlEscape(r.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(r.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(_fmtTrigger(r.trigger)) + "</td>" +
+      "<td>" + _htmlEscape(_fmtValue(r.value)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(r.priority)) + "</td>" +
+      "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+      "<td>" + actions + "</td>" +
+    "</tr>";
+  }).join("");
+  var ruleTable = rules.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Rule</th><th scope=\"col\">Trigger</th><th scope=\"col\">Value</th><th scope=\"col\" class=\"num\">Priority</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + ruleRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No automatic discount rules yet.</p>";
+
+  var TRIGGERS = [
+    { value: "cart_total_min", label: "Cart total ≥ (minor)" },
+    { value: "item_count_min", label: "Item count ≥" },
+    { value: "sku_purchase",   label: "SKU purchased" },
+  ];
+  var VALUES = [
+    { value: "percent_off",      label: "Percent off" },
+    { value: "amount_off_total", label: "Amount off total" },
+    { value: "amount_off_each",  label: "Amount off each" },
+    { value: "free_shipping",    label: "Free shipping" },
+    { value: "bogo",             label: "Buy X get Y" },
+  ];
+  // The create form is server-rendered with every trigger / value field
+  // present; the operator fills the ones that apply to the kind they
+  // pick (the lib validates the chosen kind's required fields). No client
+  // JS toggling — the strict CSP forbids inline script, and the backend
+  // is the validator.
+  var createForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Add a rule</h3>" +
+      "<form method=\"post\" action=\"/admin/discounts\">" +
+        _setupField("Slug", "slug", "", "text", "Stable handle, e.g. free-ship-50.", " maxlength=\"80\" required") +
+        _setupField("Title", "title", "", "text", "Operator-facing name.", " maxlength=\"200\" required") +
+        _selectField("Trigger kind", "trigger_kind", TRIGGERS, "cart_total_min", "What fires the rule.", "") +
+        _setupField("· Cart total min (minor)", "trigger_min_minor", "", "number", "For \"Cart total ≥\".", " min=\"0\"") +
+        _setupField("· Item count min", "trigger_min_count", "", "number", "For \"Item count ≥\".", " min=\"1\"") +
+        _setupField("· SKUs (comma-separated)", "trigger_skus", "", "text", "For \"SKU purchased\".", " maxlength=\"2000\"") +
+        _setupField("· SKU min quantity", "trigger_min_quantity", "", "number", "For \"SKU purchased\" (default 1).", " min=\"1\"") +
+        _selectField("Value kind", "value_kind", VALUES, "percent_off", "What the rule gives.", "") +
+        _setupField("· Percent (basis points)", "value_basis_points", "", "number", "For \"Percent off\". 1000 = 10.00%.", " min=\"1\" max=\"10000\"") +
+        _setupField("· Amount (minor)", "value_minor", "", "number", "For \"Amount off total / each\".", " min=\"1\"") +
+        _setupField("· BOGO buy qty", "value_buy_qty", "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+        _setupField("· BOGO get qty", "value_get_qty", "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+        _setupField("Priority", "priority", "", "number", "Higher wins ties. Default 0.", " min=\"0\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add rule</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var policySection = "";
+  if (opts.stacking_enabled) {
+    var polRows = policies.map(function (p) {
+      var isArchived = p.archived_at != null;
+      var combine = [];
+      if (p.allow_combine && p.allow_combine.with_other_codes) combine.push("codes");
+      if (p.allow_combine && p.allow_combine.with_quantity_discounts) combine.push("qty discounts");
+      var statusCls = isArchived ? "cancelled" : (p.active ? "paid" : "pending");
+      var statusTxt = isArchived ? "archived" : (p.active ? "active" : "paused");
+      var actions = isArchived ? "" :
+        "<form method=\"post\" action=\"/admin/discounts/policies/" + _htmlEscape(encodeURIComponent(p.slug)) + "/archive\" class=\"form-inline\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+      return "<tr>" +
+        "<td><strong>" + _htmlEscape(p.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(p.slug) + "</code></td>" +
+        "<td class=\"num\">" + _htmlEscape(String(p.max_codes_per_order)) + "</td>" +
+        "<td>" + (combine.length ? _htmlEscape(combine.join(", ")) : "<span class=\"meta\">none</span>") + "</td>" +
+        "<td class=\"num\">" + _htmlEscape(String(p.order_min_minor)) + "</td>" +
+        "<td><span class=\"status-pill " + statusCls + "\">" + _htmlEscape(statusTxt) + "</span></td>" +
+        "<td>" + actions + "</td>" +
+      "</tr>";
+    }).join("");
+    var polTable = policies.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Policy</th><th scope=\"col\" class=\"num\">Max codes</th><th scope=\"col\">Combines with</th><th scope=\"col\" class=\"num\">Order min</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + polRows + "</tbody></table></div>"
+      : "<p class=\"empty\">No stacking policies yet — without one, only one code applies per order.</p>";
+    var polForm =
+      "<div class=\"panel mt mw-40\">" +
+        "<h3 class=\"subhead\">Add a stacking policy</h3>" +
+        "<form method=\"post\" action=\"/admin/discounts/policies\">" +
+          _setupField("Slug", "slug", "", "text", "Stable handle, e.g. default-stack.", " maxlength=\"80\" required") +
+          _setupField("Title", "title", "", "text", "Operator-facing name.", " maxlength=\"200\" required") +
+          _setupField("Max codes per order", "max_codes_per_order", "", "number", "1–32.", " min=\"1\" max=\"32\" required") +
+          _setupField("Order minimum (minor)", "order_min_minor", "", "number", "Subtotal floor; default 0.", " min=\"0\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"with_other_codes\"> Allow combining multiple codes</label>" +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"with_quantity_discounts\"> Allow combining with quantity discounts</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add policy</button></div>" +
+        "</form>" +
+      "</div>";
+    policySection = "<h3 class=\"subhead subhead--sp-lg\">Coupon stacking policies</h3>" +
+      "<p class=\"meta\">Gate which codes (and quantity discounts) may combine on one order.</p>" +
+      pCreated + pArchived + polTable + polForm;
+  }
+
+  var body = "<section><h2>Discounts</h2>" + created + updated + archived + notice +
+    "<p class=\"meta\">Automatic cart-level discounts — applied without a coupon code.</p>" +
+    ruleTable + createForm + policySection + "</section>";
+  return _renderAdminShell(opts.shop_name, "Discounts", body, "discounts", opts.nav_available);
+}
+
 function renderAdminGiftCards(opts) {
   opts = opts || {};
   var rows = opts.cards || [];
@@ -5235,5 +6200,9 @@ module.exports = {
   renderAdminCollection:   renderAdminCollection,
   renderAdminGiftCards:    renderAdminGiftCards,
   renderAdminGiftCard:     renderAdminGiftCard,
+  renderAdminTaxRates:     renderAdminTaxRates,
+  renderAdminShipping:     renderAdminShipping,
+  renderAdminShippingZone: renderAdminShippingZone,
+  renderAdminDiscounts:    renderAdminDiscounts,
   renderAdminConfirm:      renderAdminConfirm,
 };