@blamejs/blamejs-shop 0.3.18 → 0.3.19

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.19 (2026-05-30) — **Edit announcement bars, automatic-discount terms, and subscription plans from the console.** Three admin entities could be created but only partly edited from the console — the rest of their fields were reachable only through the API, so changing them meant archive-and-recreate or a manual API call. Each now has a detail screen with the full edit form. An announcement bar can have its message, links, schedule, audience, and dismissibility changed in place. An automatic discount can have its actual terms changed — the amount, percentage, threshold, or buy-x-get-y values — not just its title, priority, and on/off state. A subscription plan can have its price, billing interval, trial length, active state, and variant edited. Create and archive behavior is unchanged. **Fixed:** *Announcement bars are editable in place* — A detail screen now lets you change an announcement's message, link, theme, audience, start/end schedule, and whether it can be dismissed — instead of archiving it and creating a new one (which lost the slug and any recorded dismissal state). · *Automatic-discount terms are editable from the console* — The discount detail screen now edits the rule's trigger and value — the amount off, percent off, cart threshold, or buy-x-get-y terms — which previously could only be changed through the API. The inline priority and on/off controls are unchanged. · *Subscription plans have an edit screen* — A subscription plan's price, billing interval count, trial length, active state, and variant can now be edited from a detail screen. The Stripe-bound fields (the price id, interval unit, and currency) remain read-only, as they were always immutable.
+
 - v0.3.18 (2026-05-30) — **Write and publish blog posts from the admin console.** The storefront already served a blog — the index at /blog, individual posts at /blog/:slug, an RSS feed, and sitemap entries — but there was no way to write a post, so it rendered empty. The admin console now has a Blog screen with the full lifecycle: create a draft, edit its title, body (Markdown), tags, hero image, and meta fields, publish it, unpublish it, and archive or restore it. A post is created as a draft and stays off the storefront until it is explicitly published, so work in progress is never visible to shoppers. **Added:** *Blog authoring in the admin console* — A new Blog screen lists posts by status and lets an operator create, edit, publish, unpublish, archive, and restore them. New posts start as drafts and do not appear on the storefront /blog, its RSS feed, or the sitemap until published; archiving removes a published post from the storefront and is reversible. This wires the admin over the blog backend that was already serving the customer-facing pages.
 
 - v0.3.17 (2026-05-30) — **Search results paginate with an accurate count, and collection pages get canonical URLs.** Two customer-facing storefront fixes. Search no longer stops at the first 24 products: the result count now reports the true number of matches instead of the page size, and numbered page links (with prev/next) make every matching product reachable while preserving the active query and filters. Separately, collection pages now emit a correct canonical and og:url so search engines and shared links resolve to one address, while the cart and account pages — which should not be indexed — are explicitly marked noindex. **Fixed:** *Search shows the real match count and paginates* — The search results page previously capped at 24 products, discarded the real total, and reported the page size as the match count — so anything past the first 24 was unreachable and the count was wrong. It now computes the true total, shows it in the "Showing N matches" summary, and adds no-JavaScript numbered page links (with prev/next) that carry the active query and facet filters, so every matching product can be reached. · *Collection pages have canonical URLs; cart and account are noindex* — Collection pages now emit an absolute canonical and og:url derived from the request host, so indexers and shared links resolve to a single address instead of an empty tag. The cart and account pages, which are not meant to be indexed, now carry a noindex robots tag in their markup, consistent on both the edge and container render paths.

package/lib/admin.js

@@ -4005,6 +4005,55 @@ function mount(router, deps) {
       },
     ));
 
+    // Detail screen: the single announcement + its edit form. Content-
+    // negotiates like the list — bearer → the JSON row; browser cookie →
+    // the rendered edit page. A bad / unknown slug is a 404 page (browser)
+    // or 404 problem (bearer), never a 500.
+    router.get("/admin/announcements/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await announcements.getAnnouncement(req.params.slug);
+        if (!row) return _problem(res, 404, "announcement-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row = await announcements.getAnnouncement(req.params.slug);
+        if (!row) return _sendHtml(res, 404, renderAdminAnnouncements({
+          shop_name: deps.shop_name, nav_available: navAvailable, announcements: [], notice: "Announcement not found.",
+        }));
+        _sendHtml(res, 200, renderAdminAnnouncement({
+          shop_name: deps.shop_name, nav_available: navAvailable, announcement: row,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the announcement." : null,
+        }));
+      },
+    ));
+
+    // Edit content-negotiates: bearer POST /edit (JSON) + browser POST
+    // /edit (HTML forms can't PATCH). Both forward the full editable
+    // column set — message, link, audience, schedule, dismissible — into
+    // updateAnnouncement, preserving the slug + accumulated dismissal
+    // state (archive-and-recreate would discard both). PRG to ?updated=1;
+    // a bad shape is a clean 400 (bearer) / err notice (browser).
+    router.post("/admin/announcements/:slug/edit", _pageOrApi(false,
+      W("announcement.update", async function (req, res) {
+        var row;
+        try { row = await announcements.updateAnnouncement(req.params.slug, _announcementPatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "announcement-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        try { await announcements.updateAnnouncement(slug, _announcementPatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/announcements/" + enc + "?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/announcements/" + enc + "?updated=1");
+      },
+    ));
+
     router.post("/admin/announcements/:slug/archive", _pageOrApi(false,
       W("announcement.archive", async function (req, res) {
         var row;
@@ -4810,6 +4859,29 @@ function mount(router, deps) {
 
   var subscriptions = deps.subscriptions || null;
   if (subscriptions) {
+    // Coerce the edit form into a plans.update patch. Only the mutable
+    // columns are forwarded; an absent / blank field is omitted so a
+    // partial edit leaves the rest untouched. amount_minor /
+    // interval_count / trial_days go through the strict integer reader so
+    // "", a float, or "12abc" is refused as a clean 400 rather than
+    // coerced. active rides a hidden presence marker so a value-only edit
+    // doesn't flip it. variant_id="" links the plan to no variant
+    // (standalone); the immutable Stripe-bound columns are never on the
+    // form.
+    function _subscriptionPlanPatchFromForm(body) {
+      body = body || {};
+      var patch = {};
+      if (body.amount_minor   != null && body.amount_minor   !== "") patch.amount_minor   = _strictMinorInt(body.amount_minor, "subscriptions", "amount_minor (minor units)");
+      if (body.interval_count != null && body.interval_count !== "") patch.interval_count = _strictMinorInt(body.interval_count, "subscriptions", "interval_count");
+      if (body.trial_days     != null && body.trial_days     !== "") patch.trial_days     = _strictMinorInt(body.trial_days, "subscriptions", "trial_days");
+      if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+      if (Object.prototype.hasOwnProperty.call(body, "variant_id")) {
+        var vid = typeof body.variant_id === "string" ? body.variant_id.trim() : body.variant_id;
+        patch.variant_id = vid ? vid : null;
+      }
+      return patch;
+    }
+
     // Create content-negotiates: bearer → JSON (unchanged for tooling);
     // signed-in browser form → create, then PRG back to the catalog (a
     // bad-shape submit re-renders the form with the validator's message
@@ -4874,19 +4946,74 @@ function mount(router, deps) {
       },
     ));
 
-    router.get("/admin/subscription-plans/:id", R(async function (req, res) {
-      var p = await subscriptions.plans.get(req.params.id);
-      if (!p) return _problem(res, 404, "subscription-plan-not-found");
-      _json(res, 200, p);
-    }));
+    // Detail screen content-negotiates: bearer → the JSON plan (the
+    // tooling contract, unchanged); browser cookie → the rendered detail
+    // + edit page. A malformed / unknown id is a 404 either way, never a
+    // 500. (Previously this route was bearer-JSON-only, so the console
+    // had no way to change a plan's price / interval-count / trial after
+    // create — only archive-and-recreate against a fresh Stripe price.)
+    router.get("/admin/subscription-plans/:id", _pageOrApi(true,
+      R(async function (req, res) {
+        var p;
+        try { p = await subscriptions.plans.get(req.params.id); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "subscription-plan-not-found", e.message); throw e; }
+        if (!p) return _problem(res, 404, "subscription-plan-not-found");
+        _json(res, 200, p);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var p = null;
+        try { p = await subscriptions.plans.get(req.params.id); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; p = null; }
+        if (!p) return _sendHtml(res, 404, renderAdminSubscriptionPlans({
+          shop_name: deps.shop_name, nav_available: navAvailable, plans: [], notice: "Subscription plan not found.",
+        }));
+        _sendHtml(res, 200, renderAdminSubscriptionPlan({
+          shop_name: deps.shop_name, nav_available: navAvailable, plan: p,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the plan." : null,
+        }));
+      },
+    ));
 
     router.patch("/admin/subscription-plans/:id", W("subscription_plan.update", async function (req, res) {
-      var p = await subscriptions.plans.update(req.params.id, req.body || {});
+      var p;
+      try { p = await subscriptions.plans.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
       if (!p) return _problem(res, 404, "subscription-plan-not-found");
       _json(res, 200, p);
       return p;
     }));
 
+    // Browser edit alias for the PATCH (HTML forms can't PATCH). Forwards
+    // the mutable columns — amount / interval_count / trial_days / active
+    // / variant_id — through plans.update; the immutable Stripe-bound
+    // columns (stripe_price_id / interval / currency) are not on the form
+    // (changing those is archive-and-recreate). A bad value is a clean
+    // 400 (bearer) / err notice (browser), never a 500 or partial write.
+    router.post("/admin/subscription-plans/:id/edit", _pageOrApi(false,
+      W("subscription_plan.update", async function (req, res) {
+        var p;
+        try { p = await subscriptions.plans.update(req.params.id, _subscriptionPlanPatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!p) return _problem(res, 404, "subscription-plan-not-found");
+        _json(res, 200, p);
+        return p;
+      }),
+      async function (req, res) {
+        var id = req.params.id;
+        var enc = encodeURIComponent(id);
+        var updated = null;
+        try { updated = await subscriptions.plans.update(id, _subscriptionPlanPatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/subscription-plans/" + enc + "?err=1"); }
+        // A well-formed-but-unknown id (stale / tampered form) updates no
+        // row — plans.update returns null. Flag err, never a false success.
+        if (!updated) return _redirect(res, "/admin/subscription-plans/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".subscription_plan.update", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/subscription-plans/" + enc + "?updated=1");
+      },
+    ));
+
     // Browser confirmation interstitial for archive — terminal from the
     // console (a retired plan is replaced by creating a new one against a
     // fresh Stripe price id, never reactivated in place), so confirm it.
@@ -5858,6 +5985,30 @@ function mount(router, deps) {
       return { id: rule.slug };
     }));
 
+    // Detail screen: the single rule + a full edit form covering the
+    // trigger + value terms (not just priority/active). Content-
+    // negotiates like the list — bearer → the JSON rule; browser cookie
+    // → the rendered edit page.
+    router.get("/admin/discounts/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var rule = await autoDiscount.getRule(req.params.slug);
+        if (!rule) return _problem(res, 404, "auto-discount-not-found");
+        _json(res, 200, rule);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rule = await autoDiscount.getRule(req.params.slug);
+        if (!rule) return _sendHtml(res, 404, await _renderDiscounts({
+          notice: "Discount rule not found.",
+        }));
+        _sendHtml(res, 200, renderAdminDiscount({
+          shop_name: deps.shop_name, nav_available: navAvailable, rule: rule,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the rule." : null,
+        }));
+      },
+    ));
+
     router.post("/admin/discounts/:slug/edit", _pageOrApi(false,
       W("auto_discount.update", async function (req, res) {
         var rule;
@@ -5867,9 +6018,18 @@ function mount(router, deps) {
         return { id: rule.slug };
       }),
       async function (req, res) {
-        try { await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
-        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
-        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: req.params.slug } });
+        var slug = req.params.slug;
+        // A terms edit (trigger/value) comes from the detail screen and
+        // returns there on error so the operator sees their input in
+        // context; the inline row edit (priority/active only) stays on
+        // the list. Success PRGs to the list's ?updated banner either way.
+        var fromDetail = (req.body && (req.body.trigger_kind || req.body.value_kind));
+        var errHref = fromDetail
+          ? "/admin/discounts/" + encodeURIComponent(slug) + "?err=1"
+          : "/admin/discounts?err=1";
+        try { await autoDiscount.updateRule(slug, _discountPatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, errHref); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: slug } });
         _redirect(res, "/admin/discounts?updated=1");
       },
     ));
@@ -6263,15 +6423,24 @@ function mount(router, deps) {
     return { kind: "free_shipping" };
   }
 
-  // Translate the rule edit form into an updateRule patch — title /
-  // priority / active. The trigger + value re-set go through the bearer
-  // JSON PATCH for the full vocabulary; the console edit is the common
-  // "rename / re-prioritise / pause" gesture.
+  // Translate the rule edit form into an updateRule patch. The inline
+  // row form covers the common "rename / re-prioritise / pause" gesture
+  // (title / priority / active); the detail screen additionally posts a
+  // trigger_kind + value_kind so an operator can change the actual
+  // discount terms (amount / percentage / threshold / BOGO) from the
+  // console, not just reprioritise. The trigger / value kind fields are
+  // reused from the create form's vocabulary via _discountTrigger /
+  // _discountValue, which throw a TypeError on a bad / missing required
+  // field — so a bad terms edit degrades to a clean 400, never a 500,
+  // and never a silent partial write. The richer applies_to / segment /
+  // exclusion vocabulary stays on the bearer JSON PATCH.
   function _discountPatch(body) {
     var patch = {};
     if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
     if (body.priority != null && body.priority !== "") patch.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
     if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    if (body.trigger_kind != null && body.trigger_kind !== "") patch.trigger = _discountTrigger(body);
+    if (body.value_kind   != null && body.value_kind   !== "") patch.value   = _discountValue(body);
     return patch;
   }
 
@@ -8163,6 +8332,56 @@ function renderAdminInventory(opts) {
   return _renderAdminShell(opts.shop_name, "Inventory", bodyHtml, "inventory", opts.nav_available);
 }
 
+// Single subscription-plan detail + edit form. The Stripe-bound columns
+// (price id / interval / currency) are immutable post-create — shown
+// read-only — because they mirror a recurring Stripe Price; to change
+// those an operator archives the plan and creates a new one against a
+// fresh price id. The mutable columns (amount / interval count / trial /
+// active / variant link) are editable here.
+function renderAdminSubscriptionPlan(opts) {
+  opts = opts || {};
+  var p = opts.plan;
+  if (!p) {
+    var nf = "<section><h2>Subscription plan</h2><p class=\"empty\">Subscription plan not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/subscription-plans\">Back to plans</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Subscription plan", nf, "subscriptions", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Plan updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isActive = p.active === 1 || p.active === true;
+  var cur = String(p.currency || "").toUpperCase();
+  var every = p.interval_count > 1 ? p.interval_count + " " + p.interval + "s" : p.interval;
+
+  var summary =
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Price</dt><dd><strong>" + _htmlEscape(pricing.format(p.amount_minor, cur) + " / " + every) + "</strong></dd></div>" +
+      "<div><dt>Stripe price</dt><dd><code class=\"order-id\">" + _htmlEscape(p.stripe_price_id) + "</code></dd></div>" +
+      "<div><dt>Variant</dt><dd>" + (p.variant_id ? "<code class=\"order-id\">" + _htmlEscape(String(p.variant_id)) + "</code>" : "<span class=\"meta\">standalone</span>") + "</dd></div>" +
+      "<div><dt>Trial</dt><dd>" + (p.trial_days ? _htmlEscape(String(p.trial_days)) + " days" : "<span class=\"meta\">none</span>") + "</dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isActive ? "paid" : "cancelled") + "\">" + (isActive ? "active" : "archived") + "</span></dd></div>" +
+    "</dl></div>";
+
+  var editForm = !isActive
+    ? "<p class=\"empty\">This plan is archived and can no longer be edited. Create a new plan against a fresh Stripe price id to offer it again.</p>"
+    : "<div class=\"panel mw-34\">" +
+        "<h3 class=\"subhead\">Edit plan</h3>" +
+        "<p class=\"meta\">The Stripe price id, billing interval, and currency are fixed — they mirror the Stripe Price. To change those, archive this plan and create a new one.</p>" +
+        "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/edit\">" +
+          "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+          _setupField("Amount (minor units)", "amount_minor", String(p.amount_minor), "number", "In the currency's smallest unit — e.g. 1999 = $19.99.", " min=\"1\"") +
+          _setupField("Interval count", "interval_count", String(p.interval_count), "number", "Bill every N " + _htmlEscape(p.interval) + "s (1–12).", " min=\"1\" max=\"12\"") +
+          _setupField("Trial days", "trial_days", String(p.trial_days), "number", "Free trial length before the first charge (0–730).", " min=\"0\" max=\"730\"") +
+          _setupField("Variant id (optional)", "variant_id", p.variant_id ? String(p.variant_id) : "", "text", "Link to a storefront variant, or clear for a standalone tier.", " maxlength=\"64\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"active\" checked> Active</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Subscription plan</h2>" + updated + notice + summary + editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/subscription-plans\">Back to plans</a></div></section>";
+  return _renderAdminShell(opts.shop_name, "Subscription plan", bodyHtml, "subscriptions", opts.nav_available);
+}
+
 function renderAdminSubscriptionPlans(opts) {
   opts = opts || {};
   var rows = opts.plans || [];
@@ -8188,9 +8407,10 @@ function renderAdminSubscriptionPlans(opts) {
     var price = pricing.format(p.amount_minor, String(p.currency || "").toUpperCase()) + " / " + every;
     var isActive = p.active === 1 || p.active === true;
     var archiveCell = isActive
-      ? "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/archive/confirm\" class=\"form-inline\">" +
+      ? "<a class=\"btn btn--ghost\" href=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "\">Edit</a> " +
+        "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/archive/confirm\" class=\"form-inline\">" +
           "<button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>"
-      : "<span class=\"meta\">—</span>";
+      : "<a class=\"btn btn--ghost\" href=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "\">View</a>";
     return "<tr>" +
       "<td><strong>" + _htmlEscape(price) + "</strong>" +
         (p.trial_days ? " <span class=\"status-pill pending\">" + _htmlEscape(String(p.trial_days)) + "d trial</span>" : "") + "</td>" +
@@ -8733,6 +8953,83 @@ function _fmtValue(v) {
   return v.kind;
 }
 
+// Single auto-discount rule detail + a full edit form. Unlike the
+// inline row form (priority/active only), this form re-collects the
+// trigger + value terms so an operator can change the amount / percent
+// / threshold / BOGO quantities from the console. The trigger / value
+// field set mirrors the create form exactly; each kind's fields are
+// prefilled from the rule's current terms, and the operator fills the
+// ones the chosen kind needs (the backend validates the required
+// fields for the kind). The hidden active_present marker keeps a
+// terms-only edit from flipping active.
+function renderAdminDiscount(opts) {
+  opts = opts || {};
+  var r = opts.rule;
+  if (!r) {
+    var nf = "<section><h2>Discount rule</h2><p class=\"empty\">Discount rule not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/discounts\">Back to discounts</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Discount rule", nf, "discounts", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Rule updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isArchived = r.archived_at != null;
+  var t = r.trigger || {};
+  var v = r.value || {};
+
+  var TRIGGERS = [
+    { value: "cart_total_min", label: "Cart total ≥ (minor)" },
+    { value: "item_count_min", label: "Item count ≥" },
+    { value: "sku_purchase",   label: "SKU purchased" },
+  ];
+  var VALUES = [
+    { value: "percent_off",      label: "Percent off" },
+    { value: "amount_off_total", label: "Amount off total" },
+    { value: "amount_off_each",  label: "Amount off each" },
+    { value: "free_shipping",    label: "Free shipping" },
+    { value: "bogo",             label: "Buy X get Y" },
+  ];
+  // For amount_off_total / amount_off_each the lib stores one `minor`
+  // field; prefill it for whichever amount kind is active.
+  var amountMinor = (v.kind === "amount_off_total" || v.kind === "amount_off_each") && v.minor != null ? String(v.minor) : "";
+
+  var editForm = isArchived
+    ? "<p class=\"empty\">This rule is archived and can no longer be edited.</p>"
+    : "<div class=\"panel mw-42\">" +
+        "<h3 class=\"subhead\">Edit rule</h3>" +
+        "<p class=\"meta\">Change the trigger, the value, or the priority. Fill the fields for the trigger / value kind you pick — the others are ignored.</p>" +
+        "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/edit\">" +
+          "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+          _setupField("Title", "title", r.title, "text", "Operator-facing name.", " maxlength=\"200\"") +
+          _selectField("Trigger kind", "trigger_kind", TRIGGERS, t.kind || "cart_total_min", "What fires the rule.", "") +
+          _setupField("· Cart total min (minor)", "trigger_min_minor", t.kind === "cart_total_min" && t.min_minor != null ? String(t.min_minor) : "", "number", "For \"Cart total ≥\".", " min=\"0\"") +
+          _setupField("· Item count min", "trigger_min_count", t.kind === "item_count_min" && t.min_count != null ? String(t.min_count) : "", "number", "For \"Item count ≥\".", " min=\"1\"") +
+          _setupField("· SKUs (comma-separated)", "trigger_skus", t.kind === "sku_purchase" && Array.isArray(t.skus) ? t.skus.join(",") : "", "text", "For \"SKU purchased\".", " maxlength=\"2000\"") +
+          _setupField("· SKU min quantity", "trigger_min_quantity", t.kind === "sku_purchase" && t.min_quantity != null ? String(t.min_quantity) : "", "number", "For \"SKU purchased\" (default 1).", " min=\"1\"") +
+          _selectField("Value kind", "value_kind", VALUES, v.kind || "percent_off", "What the rule gives.", "") +
+          _setupField("· Percent (basis points)", "value_basis_points", v.kind === "percent_off" && v.basis_points != null ? String(v.basis_points) : "", "number", "For \"Percent off\". 1000 = 10.00%.", " min=\"1\" max=\"10000\"") +
+          _setupField("· Amount (minor)", "value_minor", amountMinor, "number", "For \"Amount off total / each\".", " min=\"1\"") +
+          _setupField("· BOGO buy qty", "value_buy_qty", v.kind === "bogo" && v.buy_qty != null ? String(v.buy_qty) : "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+          _setupField("· BOGO get qty", "value_get_qty", v.kind === "bogo" && v.get_qty != null ? String(v.get_qty) : "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+          _setupField("Priority", "priority", String(r.priority), "number", "Higher wins ties.", " min=\"0\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> Active</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Discount rule</h2>" + updated + notice +
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Rule</dt><dd><strong>" + _htmlEscape(r.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(r.slug) + "</code></dd></div>" +
+      "<div><dt>Trigger</dt><dd>" + _htmlEscape(_fmtTrigger(r.trigger)) + "</dd></div>" +
+      "<div><dt>Value</dt><dd>" + _htmlEscape(_fmtValue(r.value)) + "</dd></div>" +
+      "<div><dt>Priority</dt><dd>" + _htmlEscape(String(r.priority)) + "</dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isArchived ? "cancelled" : (r.active ? "paid" : "pending")) + "\">" + (isArchived ? "archived" : (r.active ? "active" : "paused")) + "</span></dd></div>" +
+    "</dl></div>" +
+    editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/discounts\">Back to discounts</a></div>" +
+  "</section>";
+  return _renderAdminShell(opts.shop_name, "Discount rule", bodyHtml, "discounts", opts.nav_available);
+}
+
 function renderAdminDiscounts(opts) {
   opts = opts || {};
   var rules = opts.rules || [];
@@ -8755,6 +9052,7 @@ function renderAdminDiscounts(opts) {
         "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> on</label>" +
         "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
       "</form> " +
+      "<a class=\"btn btn--ghost\" href=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "\">Edit terms</a> " +
       "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/archive\" class=\"form-inline\">" +
         "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
     return "<tr>" +
@@ -9249,6 +9547,112 @@ function _announcementFromForm(body) {
   return out;
 }
 
+// Coerce the edit form into an updateAnnouncement patch. Every editable
+// column the primitive's whitelist accepts is forwarded so a console
+// edit reaches the same surface as the bearer PATCH: message, theme,
+// audience, dismissible, the link pair, and the two schedule bounds.
+// The schedule + link fields use the form's hidden presence markers so
+// a partial edit doesn't unintentionally clear an unrelated column: a
+// link_present marker maps a blank pair to null (clear the link); a
+// starts_present / expires_present marker maps a blank bound to null
+// (open the schedule). Absent markers leave the column untouched. The
+// primitive validates the result (audience<->segment, link both-or-
+// neither, expires>starts) and throws a TypeError on a bad shape, which
+// both surfaces degrade to a clean 400 / err notice.
+function _announcementPatchFromForm(body) {
+  body = body || {};
+  var patch = {};
+  if (Object.prototype.hasOwnProperty.call(body, "message") && body.message !== "") patch.message = body.message;
+  if (body.theme    != null && body.theme    !== "") patch.theme = body.theme;
+  if (body.audience != null && body.audience !== "") patch.audience = body.audience;
+  // The dismissible checkbox is present (on/1) when checked, absent when
+  // unchecked — only treat it as a field when the form declared the
+  // hidden marker so a partial JSON edit doesn't flip it.
+  if (body.dismissible_present === "1") patch.dismissible = (body.dismissible === "on" || body.dismissible === "1");
+  if (body.link_present === "1") {
+    var lu = typeof body.link_url === "string" ? body.link_url.trim() : "";
+    var ll = typeof body.link_label === "string" ? body.link_label.trim() : "";
+    if (lu || ll) { patch.link_url = lu; patch.link_label = ll; }
+    else { patch.link_url = null; patch.link_label = null; }
+  }
+  if (body.starts_present === "1")  patch.starts_at  = _epochFromForm(body.starts_at);
+  if (body.expires_present === "1") patch.expires_at = _epochFromForm(body.expires_at);
+  return patch;
+}
+
+// epoch ms → the <datetime-local> value an <input> renders back. Returns
+// "" for a null/absent bound so the field stays empty (open-ended).
+function _datetimeLocalValue(epochMs) {
+  if (epochMs == null) return "";
+  var d = new Date(Number(epochMs));
+  if (isNaN(d.getTime())) return "";
+  function _pad(n) { return n < 10 ? "0" + n : String(n); }
+  return d.getUTCFullYear() + "-" + _pad(d.getUTCMonth() + 1) + "-" + _pad(d.getUTCDate()) +
+    "T" + _pad(d.getUTCHours()) + ":" + _pad(d.getUTCMinutes());
+}
+
+// Single-announcement detail + edit screen. The form prefills every
+// editable column and posts to /edit; the hidden presence markers tell
+// the patch coercion which columns the form is authoritative for, so a
+// blank schedule / link clears rather than being ignored.
+function renderAdminAnnouncement(opts) {
+  opts = opts || {};
+  var a = opts.announcement;
+  if (!a) {
+    var nf = "<section><h2>Announcement</h2><p class=\"empty\">Announcement not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/announcements\">Back to announcements</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Announcement", nf, "announcements", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Announcement updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isArchived = a.archived_at != null;
+
+  var themeOpts = ["urgency", "promo", "info", "success"].map(function (t) {
+    return "<option value=\"" + t + "\"" + (t === a.theme ? " selected" : "") + ">" + t + "</option>";
+  }).join("");
+  // segment audience needs an isMember handle that isn't wired in the
+  // console (see the create screen's note), so the picker offers the
+  // three reachable audiences; an existing segment row keeps its value
+  // as a disabled-looking selected option so an edit doesn't silently
+  // re-target it.
+  var audValues = ["all", "guest", "logged_in"];
+  if (a.audience === "segment") audValues = ["segment"].concat(audValues);
+  var audienceOpts = audValues.map(function (au) {
+    return "<option value=\"" + au + "\"" + (au === a.audience ? " selected" : "") + ">" + au + "</option>";
+  }).join("");
+
+  var editForm = isArchived
+    ? "<p class=\"empty\">This announcement is archived and can no longer be edited.</p>"
+    : "<div class=\"panel mw-40\">" +
+        "<h3 class=\"subhead\">Edit announcement</h3>" +
+        "<form method=\"post\" action=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "/edit\">" +
+          "<input type=\"hidden\" name=\"dismissible_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"link_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"starts_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"expires_present\" value=\"1\">" +
+          "<label class=\"form-field\"><span>Message</span><textarea name=\"message\" maxlength=\"500\" required>" + _htmlEscape(a.message) + "</textarea></label>" +
+          _setupField("Link URL (optional)", "link_url", a.link_url || "", "text", "https:// or a /-rooted path. Clear both to remove the link.", " maxlength=\"2048\"") +
+          _setupField("Link label (optional)", "link_label", a.link_label || "", "text", "", " maxlength=\"120\"") +
+          "<label class=\"form-field\"><span>Theme</span><select name=\"theme\">" + themeOpts + "</select></label>" +
+          "<label class=\"form-field\"><span>Audience</span><select name=\"audience\">" + audienceOpts + "</select></label>" +
+          "<label class=\"form-field\"><span>Starts at (optional)</span><input type=\"datetime-local\" name=\"starts_at\" value=\"" + _htmlEscape(_datetimeLocalValue(a.starts_at)) + "\"></label>" +
+          "<label class=\"form-field\"><span>Expires at (optional)</span><input type=\"datetime-local\" name=\"expires_at\" value=\"" + _htmlEscape(_datetimeLocalValue(a.expires_at)) + "\"></label>" +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"dismissible\" value=\"on\"" + (a.dismissible ? " checked" : "") + "> Visitors can dismiss this</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Announcement</h2>" + updated + notice +
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Slug</dt><dd><code class=\"order-id\">" + _htmlEscape(a.slug) + "</code></dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></dd></div>" +
+    "</dl></div>" +
+    editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/announcements\">Back to announcements</a></div>" +
+  "</section>";
+  return _renderAdminShell(opts.shop_name, "Announcement", bodyHtml, "announcements", opts.nav_available);
+}
+
 function renderAdminAnnouncements(opts) {
   opts = opts || {};
   var rows = opts.announcements || [];
@@ -9272,6 +9676,7 @@ function renderAdminAnnouncements(opts) {
       "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
       "<td><div class=\"actions-row\">" +
         (isArchived ? "" :
+          "<a class=\"btn btn--ghost\" href=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "\">Edit</a> " +
           "<form method=\"post\" action=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "/archive\" class=\"form-inline\">" +
             "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
       "</div></td>" +

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.18",
+  "version": "0.3.19",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {