@blamejs/blamejs-shop 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.6 (2026-05-27) — **Business-hours page, a graceful unconfigured-checkout state, and the brand shield on the product page.** Three storefront changes. Operators can publish their open hours: define schedules (timezone + per-weekday open/close) from a new Hours screen in the admin console, and a public /hours page renders each as a weekly grid with a live open/closed status computed per request in the schedule's timezone. The cart now degrades gracefully when no payment provider is configured — instead of a checkout button that leads to a dead route, it shows a clear, disabled 'checkout isn't set up yet' notice, and a direct visit to /checkout returns a tidy 'unavailable' page rather than a 404. And the product page's post-quantum-checkout trust badge now uses the real brand shield mark (the site favicon) in place of a CSS approximation. **Added:** *Public /hours page* — A server-rendered page listing every active schedule as a weekday grid (closed days marked), with a live open/closed pill and the next transition ("Opens Monday at 09:00" / "Closes at 17:00"). Timezone-aware and computed per request, so it isn't cached stale. · *Admin console: Hours* — A new Hours screen (and matching JSON API) to create a schedule with a timezone and per-weekday open/close times (a blank day is closed), list schedules, and archive ones no longer in use. Holiday closures and one-off date exceptions — which override the weekly base — are available through the API. The screen appears only when the business-hours primitive is wired. **Changed:** *Cart and /checkout degrade gracefully without a payment provider* — When checkout isn't configured (no payment provider), the cart no longer shows a checkout button that leads nowhere — it shows a disabled control with a clear note that online checkout isn't set up yet and the cart is saved. A direct visit to /checkout now returns a tidy 503 'checkout unavailable' page instead of a 404. Configuring a payment provider restores the full cart → shipping → payment → confirmation flow with no other change. · *Product-page trust badge uses the brand shield* — The post-quantum-secured-checkout badge on the product page now renders the actual brand shield mark (the site icon) rather than a CSS-drawn hex approximation, so the badge matches the brand identity used elsewhere.
+
+- v0.2.5 (2026-05-27) — **Customer surveys — token-gated NPS / CSAT / CES feedback with an admin rollup.** Operators can now collect structured post-experience feedback. Define a survey (NPS, CSAT, CES, or a custom open-ended prompt) from a new Surveys screen in the admin console, then issue a single-use invitation for a customer — the console shows the survey link once for you to send. The customer opens the link and answers without signing in; the token itself is the access. Responses roll up on the survey's detail page with the kind-appropriate score (NPS index, CSAT positive-rate, CES mean) plus a per-question breakdown. Surveys can be archived when a campaign ends; existing invitation links keep working. **Added:** *Token-gated survey page* — A `/survey/:token` page renders the survey's questions — a rating scale, single-select options, or a free-text box — and accepts one response per invitation. The single-use token is the access (no login), and the page degrades cleanly to a clear notice when a link is already used, expired, closed, or invalid. The required-answer check re-renders the form with a message rather than losing the visitor's work. · *Admin console: Surveys* — A new Surveys screen (and matching JSON API) to create a survey for the chosen kind (the console seeds the standard question set; fully custom question lists go through the API), issue a single-use invitation for a customer id (the link is revealed exactly once), read the response rollup with the kind's headline score and per-question results, and archive finished surveys. The screen appears only when the surveys primitive is wired.
+
 - v0.2.4 (2026-05-27) — **Announcement bar — publish a sitewide promo or notice strip from the admin console.** Operators can now publish a sitewide announcement bar — a strip at the very top of every storefront page for a sale, a shipping notice, or an urgent alert. Manage it from a new Announcements screen in the admin console: set the message, an optional call-to-action link, a theme (urgency, promo, info, or success), the audience (everyone, signed-out visitors, or signed-in customers), an optional start/expiry schedule, and whether visitors can dismiss it. The highest-priority active announcement shows automatically (urgency outranks promo outranks info outranks success). The bar renders on both the edge and container paths so it appears on every page including the cached ones, and a dismissed bar stays hidden across navigation. Until an announcement is published, nothing changes. **Added:** *Sitewide announcement bar* — A page-top strip rendered on every storefront page (home, search, product, cart, blog, and the storefront chrome) in one of four themes. The single highest-priority active announcement for the viewer is shown, chosen by theme rank (urgency > promo > info > success). Audience targeting covers everyone, signed-out visitors, and signed-in customers, with an optional scheduled start and expiry. An optional call-to-action link is included; its URL is restricted to https:// or a site-relative path. · *Admin console: Announcements* — A new Announcements screen (and matching JSON API) to create announcements, filter the list to those active right now, and archive ones that are done. The screen appears in the console only when the announcement primitive is wired. · *Dismiss without a round-trip* — Dismissible announcements carry a close control. With JavaScript it's hidden in place and remembered in a local cookie so it doesn't reappear as you browse; with JavaScript off, a form submission records the dismissal and returns you to the page. The bar is always server-rendered identically for everyone, so a dismissed bar never leaks back in from a cached page — it's hidden per-visitor on the client.
 
 - v0.2.3 (2026-05-27) — **Admin console adopts the dark violet brand — the operator dashboard now matches the storefront.** The admin console has been restyled from its previous light theme and orange accent onto the same dark violet identity as the storefront: a neutral near-black canvas with violet reserved for accents, the self-hosted Hanken Grotesk and Space Mono typefaces in place of Inter, and Space Mono carrying the terminal-style chrome (header mark, navigation, micro-labels, figures, SKUs, order ids, and code). Stat cards, tables, status pills, forms, buttons, banners, nav cards, and the sign-in card are all recoloured for the dark surface with contrast preserved — order statuses keep their meaning (green for paid/shipped, amber for pending, violet for refunded, muted for cancelled), form inputs read clearly on the dark wells, and the revenue sparkline is drawn in the brand violet. Operators on the default theme get the new console on upgrade; no admin functionality, routes, or data change. **Changed:** *Dark violet admin theme* — The admin stylesheet is rebuilt on the storefront's palette — near-black surfaces, neutral hairline borders, and violet reserved for accents (active nav, primary buttons, the `/ admin` mark, focus states, and the revenue sparkline) rather than the former light paper and orange. Self-hosted Hanken Grotesk (display/body) and Space Mono (chrome/mono) replace Inter, loaded under the strict `font-src 'self'` policy. · *Components recoloured for the dark surface* — Stat cards, the orders table, status pills, filter chips, forms, buttons (primary/ghost/danger), banners, nav cards, the gift-card detail grid, and the sign-in card are all restyled for dark with contrast maintained. Order-status pills keep their semantics — green for paid/shipped/fulfilling/delivered, amber for pending, violet for refunded, muted for cancelled. Form inputs sit on recessed dark wells with light text and a violet focus ring.

package/lib/admin.js

@@ -300,7 +300,7 @@ function mount(router, deps) {
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -2171,6 +2171,198 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- customer surveys -----------------------------------------------
+  // Define NPS/CSAT/CES/custom surveys, issue token invitations (the
+  // plaintext link is shown once on issue), and read the rollup. The
+  // console creates surveys with a standard question set for the chosen
+  // kind; fully custom question lists go through the JSON API. Content-
+  // negotiated like the other screens.
+  if (deps.customerSurveys) {
+    var surveys = deps.customerSurveys;
+
+    router.get("/admin/surveys", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeS = url && url.searchParams.get("active");
+        _json(res, 200, { rows: await surveys.listSurveys(activeS === "1" ? { active_only: true } : {}) });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeS = url && url.searchParams.get("active");
+        var rows = await surveys.listSurveys(activeS === "1" ? { active_only: true } : {});
+        _sendHtml(res, 200, renderAdminSurveys({
+          shop_name: deps.shop_name, nav_available: navAvailable, surveys: rows,
+          active_filter: activeS,
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the survey." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/surveys", _pageOrApi(false,
+      W("survey.define", async function (req, res) {
+        var row = await surveys.defineSurvey(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var body = req.body || {};
+        try {
+          await surveys.defineSurvey({
+            slug:     typeof body.slug === "string" ? body.slug.trim() : body.slug,
+            title:    body.title,
+            kind:     body.kind,
+            trigger:  body.trigger || "manual",
+            questions: _standardSurveyQuestions(body.kind),
+          });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          var rows = await surveys.listSurveys({});
+          return _sendHtml(res, 400, renderAdminSurveys({
+            shop_name: deps.shop_name, nav_available: navAvailable, surveys: rows,
+            notice: (e.message || "Couldn't create that survey.").replace(/^customerSurveys[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".survey.define", outcome: "success" });
+        _redirect(res, "/admin/surveys?created=1");
+      },
+    ));
+
+    router.post("/admin/surveys/:slug/archive", _pageOrApi(false,
+      W("survey.archive", async function (req, res) {
+        var row;
+        try { row = await surveys.archiveSurvey(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "survey-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var row = null;
+        try { row = await surveys.archiveSurvey(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/surveys?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".survey.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/surveys?archived=1");
+      },
+    ));
+
+    // Detail: rollup + the issue-invitation form. The freshly-issued token
+    // link is rendered once via the ?token= flash (never stored plaintext).
+    router.get("/admin/surveys/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var roll = await surveys.rollup({ slug: req.params.slug });
+        if (!roll) return _problem(res, 404, "survey-not-found");
+        _json(res, 200, roll);
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var survey = await surveys.getSurvey(slug);
+        if (!survey) return _sendHtml(res, 404, renderAdminSurveyDetail({ shop_name: deps.shop_name, nav_available: navAvailable, survey: null }));
+        var roll = await surveys.rollup({ slug: slug });
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, renderAdminSurveyDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          survey: survey, rollup: roll,
+          issued_link: url && url.searchParams.get("link"),
+          notice: (url && url.searchParams.get("err")) ? "Couldn't issue that invitation — check the customer id." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/surveys/:slug/issue", _pageOrApi(false,
+      W("survey.issue", async function (req, res) {
+        var out = await surveys.issueInvitation(Object.assign({}, req.body || {}, { survey_slug: req.params.slug }));
+        _json(res, 201, out);
+        return { id: out.invitation_id };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        var out;
+        try {
+          out = await surveys.issueInvitation({ survey_slug: slug, customer_id: (req.body && req.body.customer_id) });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          return _redirect(res, "/admin/surveys/" + enc + "?err=1");
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".survey.issue", outcome: "success", metadata: { slug: slug } });
+        // The plaintext token is shown exactly once — pass it back via the
+        // detail redirect so the operator can copy the survey link.
+        _redirect(res, "/admin/surveys/" + enc + "?link=" + encodeURIComponent(out.plaintext_token));
+      },
+    ));
+  }
+
+  // ---- business hours -------------------------------------------------
+  // Define open/close schedules surfaced on the public /hours page. The
+  // console create form takes a per-weekday open/close pair (blank = closed
+  // that day); holidays + one-off exceptions are managed via the JSON API.
+  // Content-negotiated like the other screens.
+  if (deps.businessHours) {
+    var hours = deps.businessHours;
+
+    router.get("/admin/hours", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await hours.listSchedules() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await hours.listSchedules();
+        _sendHtml(res, 200, renderAdminHours({
+          shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the schedule." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/hours", _pageOrApi(false,
+      W("hours.define", async function (req, res) {
+        var row = await hours.defineSchedule(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await hours.defineSchedule(_scheduleFromForm(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          var rows = await hours.listSchedules();
+          return _sendHtml(res, 400, renderAdminHours({
+            shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
+            notice: (e.message || "Couldn't save that schedule.").replace(/^businessHours[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.define", outcome: "success" });
+        _redirect(res, "/admin/hours?created=1");
+      },
+    ));
+
+    router.post("/admin/hours/:slug/archive", _pageOrApi(false,
+      W("hours.archive", async function (req, res) {
+        var row;
+        try { row = await hours.archiveSchedule(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "schedule-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var row = null;
+        try { row = await hours.archiveSchedule(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/hours?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/hours?archived=1");
+      },
+    ));
+  }
+
   // ---- analytics ------------------------------------------------------
 
   var analytics = deps.analytics || null;
@@ -2846,6 +3038,8 @@ var ADMIN_NAV_ITEMS = [
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
+  { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
+  { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
   { key: "giftcards",    href: "/admin/gift-cards",    label: "Gift cards",   requires: "giftcards" },
   { key: "webhooks",     href: "/admin/webhooks",     label: "Webhooks",     requires: "webhooks" },
   { key: "integrations", href: "/admin/integrations", label: "Integrations" },
@@ -4076,6 +4270,223 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// Standard question set per survey kind, so the console can create the
+// common surveys without a dynamic question builder (fully custom question
+// lists go through the JSON defineSurvey API). Each question carries a
+// stable id so historical responses survive a later edit.
+function _standardSurveyQuestions(kind) {
+  if (kind === "nps") {
+    return [
+      { id: "score", kind: "rating", label: "How likely are you to recommend us to a friend?", max: 10, required: true },
+      { id: "reason", kind: "free_text", label: "What's the main reason for your score?", required: false },
+    ];
+  }
+  if (kind === "ces") {
+    return [
+      { id: "effort", kind: "rating", label: "How easy was it to get what you needed?", max: 7, required: true },
+      { id: "reason", kind: "free_text", label: "Anything that made it harder than it should have been?", required: false },
+    ];
+  }
+  if (kind === "csat") {
+    return [
+      { id: "score", kind: "rating", label: "How satisfied were you with your experience?", max: 5, required: true },
+      { id: "comment", kind: "free_text", label: "Anything you'd like to add?", required: false },
+    ];
+  }
+  // custom — a single open-ended prompt the operator can refine via the API.
+  return [
+    { id: "feedback", kind: "free_text", label: "Your feedback", required: true },
+  ];
+}
+
+function renderAdminSurveys(opts) {
+  opts = opts || {};
+  var rows = opts.surveys || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Survey created.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Survey archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var af = opts.active_filter;
+  var chips = "<div class=\"order-filters\">" +
+    "<a class=\"chip" + (af == null ? " chip--on" : "") + "\" href=\"/admin/surveys\">All</a>" +
+    "<a class=\"chip" + (af === "1" ? " chip--on" : "") + "\" href=\"/admin/surveys?active=1\">Active</a>" +
+    "</div>";
+
+  var bodyRows = rows.map(function (s) {
+    var isArchived = s.archived_at != null;
+    var enc = _htmlEscape(encodeURIComponent(s.slug));
+    return "<tr>" +
+      "<td><a href=\"/admin/surveys/" + enc + "\"><strong>" + _htmlEscape(s.title) + "</strong></a></td>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(s.slug) + "</code></td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(s.kind) + "</span></td>" +
+      "<td>" + _htmlEscape(s.trigger_event || s.trigger || "manual") + "</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        "<a class=\"btn btn--ghost\" href=\"/admin/surveys/" + enc + "\">Open</a>" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/surveys/" + enc + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Kind</th><th scope=\"col\">Trigger</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No surveys" + (af === "1" ? " active" : " yet") + ".</p>";
+
+  var kindOpts = [["nps", "NPS — recommend score"], ["csat", "CSAT — satisfaction"], ["ces", "CES — ease of effort"], ["custom", "Custom — open feedback"]]
+    .map(function (k) { return "<option value=\"" + k[0] + "\">" + _htmlEscape(k[1]) + "</option>"; }).join("");
+  var trigOpts = [["manual", "Manual (issue invitations yourself)"], ["after_delivery", "After delivery"], ["after_support_close", "After support close"], ["after_refund", "After refund"]]
+    .map(function (t) { return "<option value=\"" + t[0] + "\">" + _htmlEscape(t[1]) + "</option>"; }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create a survey</h3>" +
+      "<p class=\"meta\">The console seeds a standard question set for the chosen kind. After creating, open the survey to issue invitation links + read the rollup.</p>" +
+      "<form method=\"post\" action=\"/admin/surveys\">" +
+        _setupField("Title", "title", "", "text", "", " maxlength=\"200\" required") +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id.", " maxlength=\"64\" required") +
+        "<label class=\"form-field\"><span>Kind</span><select name=\"kind\">" + kindOpts + "</select></label>" +
+        "<label class=\"form-field\"><span>Trigger</span><select name=\"trigger\">" + trigOpts + "</select></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create survey</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Surveys</h2>" + created + archived + notice + chips + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Surveys", bodyHtml, "surveys", opts.nav_available);
+}
+
+function renderAdminSurveyDetail(opts) {
+  opts = opts || {};
+  var survey = opts.survey;
+  if (!survey) {
+    var nf = "<section><h2>Survey</h2><p class=\"empty\">Survey not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/surveys\">Back to surveys</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Survey", nf, "surveys", opts.nav_available);
+  }
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // Freshly-issued invitation link — shown exactly once (the plaintext
+  // token is never persisted). The operator copies it into their own
+  // email/SMS to the customer.
+  var linkReveal = "";
+  if (opts.issued_link) {
+    var path = "/survey/" + _htmlEscape(opts.issued_link);
+    linkReveal =
+      "<div class=\"banner banner--ok\">Invitation issued. Copy this single-use link and send it to the customer — it won't be shown again:" +
+        "<br><code class=\"code-block\">" + path + "</code></div>";
+  }
+
+  var roll = opts.rollup || { response_count: 0, per_question: [] };
+  var headline = "";
+  if (roll.nps)       headline = "NPS score: <strong>" + _htmlEscape(String(roll.nps.score)) + "</strong> (" + _htmlEscape(String(roll.nps.promoter_pct)) + "% promoters, " + _htmlEscape(String(roll.nps.detractor_pct)) + "% detractors)";
+  else if (roll.csat) headline = "CSAT: <strong>" + _htmlEscape(String(roll.csat.positive_pct)) + "%</strong> positive";
+  else if (roll.ces)  headline = "CES mean: <strong>" + _htmlEscape(String(roll.ces.mean)) + "</strong>";
+
+  var qRows = (roll.per_question || []).map(function (pq) {
+    var detail;
+    if (pq.kind === "rating") detail = "mean " + _htmlEscape(String(pq.mean)) + " over " + _htmlEscape(String(pq.count)) + " answers";
+    else if (pq.kind === "select") {
+      detail = Object.keys(pq.buckets || {}).map(function (o) { return _htmlEscape(o) + ": " + _htmlEscape(String(pq.buckets[o])); }).join(", ");
+    } else detail = _htmlEscape(String(pq.count)) + " written responses";
+    return "<tr><td><code class=\"order-id\">" + _htmlEscape(pq.id) + "</code></td><td>" + _htmlEscape(pq.kind) + "</td><td>" + detail + "</td></tr>";
+  }).join("");
+  var rollupPanel =
+    "<div class=\"panel\">" +
+      "<p class=\"meta\">" + _htmlEscape(String(roll.response_count)) + " response(s)." + (headline ? " " + headline : "") + "</p>" +
+      (qRows ? "<table><thead><tr><th scope=\"col\">Question</th><th scope=\"col\">Kind</th><th scope=\"col\">Result</th></tr></thead><tbody>" + qRows + "</tbody></table>" : "") +
+    "</div>";
+
+  var enc = _htmlEscape(encodeURIComponent(survey.slug));
+  var issueForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Issue an invitation</h3>" +
+      "<p class=\"meta\">Generates a single-use survey link for one customer. You send the link; the customer answers without signing in.</p>" +
+      "<form method=\"post\" action=\"/admin/surveys/" + enc + "/issue\">" +
+        _setupField("Customer id", "customer_id", "", "text", "The customer's UUID.", " maxlength=\"64\" required") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Issue invitation</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/surveys\">Back to surveys</a></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>" + _htmlEscape(survey.title) + "</h2>" + notice + linkReveal + rollupPanel + issueForm + "</section>";
+  return _renderAdminShell(opts.shop_name, survey.title, bodyHtml, "surveys", opts.nav_available);
+}
+
+// Build a defineSchedule input from the per-weekday open/close form fields
+// (d0_open/d0_close .. d6_open/d6_close). A day with both a start and end
+// time becomes a weekly_hours entry; a blank day is closed. Sun=0.
+function _scheduleFromForm(body) {
+  body = body || {};
+  var weekly = [];
+  for (var d = 0; d < 7; d += 1) {
+    var open  = body["d" + d + "_open"];
+    var close = body["d" + d + "_close"];
+    if (typeof open === "string" && open.trim() && typeof close === "string" && close.trim()) {
+      weekly.push({ day: d, open: open.trim(), close: close.trim() });
+    }
+  }
+  return {
+    slug:         typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    timezone:     body.timezone,
+    weekly_hours: weekly,
+  };
+}
+
+function renderAdminHours(opts) {
+  opts = opts || {};
+  var rows = opts.schedules || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Schedule saved.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Schedule archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var DOW = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+
+  var bodyRows = rows.map(function (s) {
+    var isArchived = s.archived_at != null;
+    var enc = _htmlEscape(encodeURIComponent(s.slug));
+    var openDays = ((s.weekly_hours || []).reduce(function (set, w) { set[w.day] = 1; return set; }, {}));
+    var dayCount = Object.keys(openDays).length;
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(s.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(s.timezone) + "</td>" +
+      "<td class=\"num\">" + dayCount + " open day(s)</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/hours/" + enc + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Schedule</th><th scope=\"col\">Timezone</th><th scope=\"col\" class=\"num\">Days</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No schedules yet.</p>";
+
+  var dayFields = DOW.map(function (label, d) {
+    return "<div class=\"actions-row\">" +
+      "<span class=\"u-mute\">" + label + "</span>" +
+      "<input type=\"time\" name=\"d" + d + "_open\" aria-label=\"" + label + " open\">" +
+      "<input type=\"time\" name=\"d" + d + "_close\" aria-label=\"" + label + " close\">" +
+    "</div>";
+  }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Create a schedule</h3>" +
+      "<p class=\"meta\">Set an open + close time per weekday (leave a day blank to mark it closed). Times are in the schedule's timezone. Holidays + one-off exceptions are managed via the API.</p>" +
+      "<form method=\"post\" action=\"/admin/hours\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — e.g. support or store.", " maxlength=\"64\" required") +
+        _setupField("Timezone", "timezone", "", "text", "IANA name, e.g. America/New_York.", " maxlength=\"64\" required") +
+        "<fieldset class=\"box\"><legend class=\"legend-sm\">Weekly hours (open / close)</legend>" + dayFields + "</fieldset>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create schedule</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Business hours</h2>" + created + archived + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Hours", bodyHtml, "hours", opts.nav_available);
+}
+
 function renderAdminCollection(opts) {
   opts = opts || {};
   var col = opts.collection;

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.4",
+  "version": "0.2.6",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-fMfWbfkIZ29Z4RjHyn3ol0SOf/VodnKqDjkrU7OCQLvzm6hFHRL3kcwMGNnXzdai",
-      "fingerprinted": "css/main.73ee71264ed8de75.css"
+      "integrity": "sha384-rjXOXDbgXWPBR/7YqM07j7oAN9Gx9SIY31GUdViVAFG/Tw4HD519zbVvXmYEpUrz",
+      "fingerprinted": "css/main.6825424436cea4c0.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/customer-surveys.js

@@ -537,6 +537,25 @@ function create(opts) {
     return _decodeSurvey(await _surveyRow(slug));
   }
 
+  // List defined surveys for the operator console, newest first. With
+  // `{ active_only: true }` archived surveys are dropped; otherwise all are
+  // returned so the console can show an archived filter.
+  async function listSurveys(listOpts) {
+    listOpts = listOpts || {};
+    var sql, params;
+    if (listOpts.active_only === true) {
+      sql = "SELECT * FROM customer_surveys WHERE archived_at IS NULL ORDER BY updated_at DESC, slug ASC";
+      params = [];
+    } else {
+      sql = "SELECT * FROM customer_surveys ORDER BY updated_at DESC, slug ASC";
+      params = [];
+    }
+    var r = await query(sql, params);
+    var out = [];
+    for (var i = 0; i < r.rows.length; i += 1) out.push(_decodeSurvey(r.rows[i]));
+    return out;
+  }
+
   async function archiveSurvey(slug) {
     _slug(slug, "slug");
     var ts = _now();
@@ -609,6 +628,25 @@ function create(opts) {
     return _decodeInvitation(r.rows[0]);
   }
 
+  // Resolve an invitation + its parent survey from the single-use plaintext
+  // token, for rendering the survey page (the token IS the access — no login
+  // needed). Returns { invitation, survey } or null when the token matches
+  // nothing. The caller inspects invitation.status / expires_at to decide
+  // whether to render the form, a thank-you, or an expired/closed notice;
+  // this read never mutates state. Constant-time hash compare mirrors
+  // submitResponse so a malformed token can't be a timing oracle.
+  async function previewByToken(token) {
+    var canon = _canonicalToken(token);
+    var hash  = _hashToken(canon);
+    var r = await query("SELECT * FROM survey_invitations WHERE token_hash = ?1", [hash]);
+    if (!r.rows.length) return null;
+    var inv = r.rows[0];
+    if (!b.crypto.timingSafeEqual(inv.token_hash, hash)) return null;
+    var surveyRow = await _surveyRow(inv.survey_slug);
+    if (!surveyRow) return null;
+    return { invitation: _decodeInvitation(inv), survey: _decodeSurvey(surveyRow) };
+  }
+
   async function invitationsForCustomer(customerId, listOpts) {
     var custId = _uuid(customerId, "customer_id");
     listOpts = listOpts || {};
@@ -989,6 +1027,8 @@ function create(opts) {
     archiveSurvey:           archiveSurvey,
     issueInvitation:         issueInvitation,
     getInvitation:           getInvitation,
+    previewByToken:          previewByToken,
+    listSurveys:             listSurveys,
     invitationsForCustomer:  invitationsForCustomer,
     submitResponse:          submitResponse,
     responsesForSurvey:      responsesForSurvey,