@blamejs/blamejs-shop 0.3.36 → 0.3.38

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.38 (2026-05-31) — **Pre-order campaigns — reserve a product before it is released.** Products that are not yet released could not be sold or reserved. Operators can now run a pre-order campaign for a product from the admin console — setting its release date, price, and an optional reservation cap. While the campaign is open, the product page shows a Pre-order control with the release date and how many reservations remain, and a signed-in customer can reserve their quantity without paying upfront. Customers see and can cancel their reservations from their account, and when the operator launches the campaign on its release date, each reservation is turned into a pending order the customer pays for through normal checkout. **Added:** *Pre-order campaigns* — A Pre-orders screen in the admin console runs a campaign for a product's SKU — release date, price, an optional deposit, and a reservation cap — with launch and close controls (launch is available once the release date arrives). While a campaign is open, the product page shows a Pre-order control with the release date and remaining availability instead of the usual add-to-cart, and a signed-in customer can reserve their quantity (no charge at reservation time; reserving past the cap or on a closed campaign is refused). Customers manage their reservations under Pre-orders in their account and can cancel one, which frees that capacity. Launching the campaign converts each open reservation into a pending order the customer completes through normal checkout. A customer can only see and cancel their own reservations.
+
+- v0.3.37 (2026-05-31) — **Gift registries — create one, share it, and let people mark gifts as bought.** A customer can now create a gift registry for an occasion — a wedding, baby, or birthday — add the products they want with the quantity desired, and share a public link. Anyone with the link can open the registry without an account, see what is still needed, add an item to their own cart to buy it through normal checkout, or mark an item as already purchased so it stops showing as needed. Registries can be public, unlisted, or private, and a private registry is not viewable from its link. The shared page never reveals who owns the registry or who bought what, and is not indexed by search engines. **Added:** *Gift registries* — A new Registry section in the account area lets a customer create a registry (title, occasion, event date, and a public/unlisted/private visibility), add and remove the items they want with a desired quantity, edit its details, and close it. Each registry has a shareable public page at its own link where anyone — no account needed — can see the items and how many of each are still needed, add an item to their cart to buy it through the normal checkout, or mark an item as already purchased so the registry's progress updates. A private registry is not viewable from its link, the public page shows only the items (never the owner's identity, address, or who purchased what), and registry pages are excluded from search indexing.
+
 - v0.3.36 (2026-05-31) — **Customers can request an exchange instead of only a refund.** Returning an order could only result in a refund, so a customer who received the wrong size had to refund and buy again. A customer can now request an exchange from the order page — choosing the item to swap, the replacement, and a reason — and operators work those requests from a new Exchanges queue in the admin console, moving each one through approval, shipping the replacement, receiving the returned item, and closing it out. A customer can only request and view exchanges on their own orders. This release also updates the vendored blamejs runtime to v0.14.10. **Added:** *Order exchanges* — An order can now be exchanged, not just refunded. From the order page a customer requests an exchange — picking the line to return, the replacement variant, and a reason — and tracks its status under Exchanges in their account. Operators get an Exchanges queue in the admin console with a status filter and a per-exchange screen that offers only the actions valid at the current step: approve or reject the request, mark the replacement shipped and delivered, mark the returned item received, and close it once both sides are complete. Every customer-facing exchange action is scoped to the customer's own orders, and an order must be in a fulfilled state to be eligible. **Changed:** *Vendored blamejs runtime updated to v0.14.10* — The bundled blamejs runtime is updated to v0.14.10, which routes the framework's full-text-search index token hashing through a keyed MAC (HMAC-SHAKE256) instead of a static-salted digest, so an index token hash cannot be forged or correlated across deployments without the per-deployment key. The change is internal to the runtime and requires no operator action.
 
 - v0.3.35 (2026-05-31) — **Share a wishlist with a private link.** A customer's wishlist could only be viewed by the customer themselves. From the wishlist page a shopper can now create a shareable link and send it to someone — a friend buying a gift, for example — who opens it without needing an account and sees the wishlist's products. The link can be revoked at any time, after which it stops working. The shared page shows only the products: it does not reveal who owns the wishlist or any private notes on it, and it is not indexed by search engines. **Added:** *Shareable wishlist links* — The wishlist page now has a Share control that creates a private link to the wishlist. The full link is shown once, to copy and send; anyone with it can open the shared wishlist without an account and see its products, each linking to the product page. The owner sees their active links and can revoke any of them, which immediately stops the link from working. The shared view shows only the products — never the owner's identity or private notes — and is marked not to be indexed by search engines, so a personal wishlist stays private to whoever holds the link.

package/lib/admin.js

@@ -510,6 +510,7 @@ function mount(router, deps) {
   var salesTaxFilings = deps.salesTaxFilings || null; // sales-tax-filing remittance console disabled when absent
   var supportTickets  = deps.supportTickets  || null; // support-ticket queue + thread console disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
+  var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -517,7 +518,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4932,6 +4933,117 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- pre-orders -----------------------------------------------------
+  // Campaigns that take reservations against a SKU that isn't released yet.
+  // The lifecycle is draft-free: defineCampaign opens an `active` campaign,
+  // launchCampaign converts every active reservation into a regular order
+  // (via the shared order handle wired into the primitive) and flips the
+  // campaign to `launched`, closeCampaign terminates it without launching.
+  // A reservation is intent, not a charge — the convert step at launch is
+  // what produces the order the customer then pays through normal checkout.
+  // Content-negotiated like the other console screens: bearer → the JSON
+  // contract; signed-in browser → the HTML table + create form + lifecycle
+  // actions. The launch action is calendar-gated by the primitive (it
+  // refuses `now < launch_at`), so the console surfaces the launch button
+  // only once the release date has arrived.
+  if (preorder) {
+    // Decorate each campaign row with its reserved/remaining counts (the
+    // availability read) so the table reads honestly without a second query
+    // per row in the renderer. One availability call per campaign; a read
+    // failure on a row degrades that row to null counts rather than 500-ing
+    // the screen.
+    async function _preorderRows() {
+      var campaigns = await preorder.listCampaigns();
+      for (var i = 0; i < campaigns.length; i += 1) {
+        try { campaigns[i].availability = await preorder.availability({ slug: campaigns[i].slug }); }
+        catch (_e) { campaigns[i].availability = null; }
+      }
+      return campaigns;
+    }
+
+    router.get("/admin/preorders", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await preorder.listCampaigns() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var ok = url && url.searchParams.get("ok");
+        var noticeKey = url && url.searchParams.get("err");
+        _sendHtml(res, 200, renderAdminPreorders({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          campaigns: await _preorderRows(),
+          ok:        ok,
+          notice:    noticeKey ? "That action couldn't be completed for the campaign." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/preorders", _pageOrApi(false,
+      W("preorder.define", async function (req, res) {
+        var row = await preorder.defineCampaign(_preorderFromForm(req.body || {}));
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await preorder.defineCampaign(_preorderFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "preorder.define");
+          return _sendHtml(res, n.status, renderAdminPreorders({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            campaigns: await _preorderRows(),
+            notice: n.message.replace(/^preorder[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.define", outcome: "success" });
+        _redirect(res, "/admin/preorders?ok=created");
+      },
+    ));
+
+    // Launch — convert every active reservation into a regular order and flip
+    // the campaign to `launched`. The primitive composes the shared order
+    // handle (wired in server.js) so each converted reservation lands a real
+    // order the customer pays through normal checkout; the response reports
+    // how many converted. Calendar-gated: a launch before launch_at is a clean
+    // 400 (browser → ?err=1). A bearer client gets the conversion summary.
+    router.post("/admin/preorders/:slug/launch", _pageOrApi(false,
+      W("preorder.launch", async function (req, res) {
+        var result;
+        try { result = await preorder.launchCampaign({ slug: req.params.slug, now: Date.now() }); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, result);
+        return { id: req.params.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await preorder.launchCampaign({ slug: slug, now: Date.now() }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/preorders?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.launch", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/preorders?ok=launched");
+      },
+    ));
+
+    // Close — terminate the campaign without launching (the fab batch fell
+    // through). Reservations stay `active` so the operator can refund deposits
+    // through the order/refund surface, then cancel them explicitly.
+    router.post("/admin/preorders/:slug/close", _pageOrApi(false,
+      W("preorder.close", async function (req, res) {
+        var row;
+        try { row = await preorder.closeCampaign({ slug: req.params.slug, reason: (req.body || {}).reason || "" }); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: req.params.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await preorder.closeCampaign({ slug: slug, reason: (req.body || {}).reason || "" }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/preorders?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.close", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/preorders?ok=closed");
+      },
+    ));
+  }
+
   // ---- blog -----------------------------------------------------------
   // Author the operator's editorial blog. The edge Worker serves the
   // customer-facing /blog index + /blog/:slug posts + the RSS feed,
@@ -8978,6 +9090,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
+  { key: "preorders",    href: "/admin/preorders",    label: "Pre-orders",   requires: "preorder" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
   { key: "discounts",    href: "/admin/discounts",    label: "Discounts",    requires: "autoDiscount" },
   { key: "discount-allocation", href: "/admin/discount-allocation", label: "Discount splits", requires: "discountAllocation" },
@@ -12463,6 +12576,41 @@ function _announcementPatchFromForm(body) {
   return patch;
 }
 
+// Coerce the create form into the shape preorder.defineCampaign expects.
+// Prices are entered + stored in MINOR units (cents) — the form labels say
+// so, and the JSON API uses minor units too. The launch date is a
+// datetime-local string parsed to epoch ms. A blank cap maps to null
+// (unlimited). The primitive is authoritative on every range
+// (deposit <= full price, non-negative integers, ISO 4217 currency, slug /
+// sku shape) and throws a TypeError on a bad shape, which both surfaces
+// degrade to a clean 400 / err notice. A blank numeric field is left as the
+// empty string so the primitive's validator (not this coercion) is the one
+// that reports it.
+function _preorderIntOrNull(v) {
+  if (v == null || v === "") return null;
+  var n = Number(v);
+  return Number.isInteger(n) ? n : v;   // a non-integer passes through for the primitive to reject
+}
+function _preorderFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:             typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    sku:              typeof body.sku === "string" ? body.sku.trim() : body.sku,
+    launch_at:        _epochFromForm(body.launch_at),
+    full_price_minor: _preorderIntOrNull(body.full_price_minor),
+    currency:         typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+  };
+  // Optional fields — only forward when supplied so the primitive applies its
+  // defaults (deposit 0, charge_at = launch_at, unlimited cap, empty copy).
+  var cap = _preorderIntOrNull(body.max_units_available);
+  if (body.max_units_available != null && body.max_units_available !== "") out.max_units_available = cap;
+  if (body.deposit_minor != null && body.deposit_minor !== "") out.deposit_minor = _preorderIntOrNull(body.deposit_minor);
+  var chargeAt = _epochFromForm(body.charge_at);
+  if (chargeAt != null) out.charge_at = chargeAt;
+  if (typeof body.marketing_copy === "string" && body.marketing_copy.trim()) out.marketing_copy = body.marketing_copy.trim();
+  return out;
+}
+
 // epoch ms → the <datetime-local> value an <input> renders back. Returns
 // "" for a null/absent bound so the field stays empty (open-ended).
 function _datetimeLocalValue(epochMs) {
@@ -12599,6 +12747,95 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// Pre-order campaign console — the list table (status + reserved/available
+// counts + release date), the lifecycle actions (launch once the release date
+// has arrived, close any time), and the create form. The launch button only
+// renders for an `active` campaign whose launch_at has passed (the primitive
+// refuses an early launch, so showing the button before then would just
+// bounce back with an error); close renders for any `active` campaign.
+function renderAdminPreorders(opts) {
+  opts = opts || {};
+  var rows = opts.campaigns || [];
+  var okKind = opts.ok;
+  var okCopy = okKind === "created"  ? "Pre-order campaign created."
+             : okKind === "launched" ? "Campaign launched — active reservations converted to orders."
+             : okKind === "closed"   ? "Campaign closed."
+             : "";
+  var okBanner = okCopy ? "<div class=\"banner banner--ok\">" + _htmlEscape(okCopy) + "</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var now = Date.now();
+  function _money(minor, currency) {
+    try { return pricing.format(Number(minor), String(currency || "USD")); }
+    catch (_e) { return String(minor); }
+  }
+  function _date(epochMs) {
+    if (epochMs == null) return "—";
+    var d = new Date(Number(epochMs));
+    return isNaN(d.getTime()) ? "—" : d.toISOString().slice(0, 10);
+  }
+
+  var bodyRows = rows.map(function (c) {
+    var av = c.availability || null;
+    var reserved = av != null ? av.units_reserved : c.units_reserved;
+    var cap = c.max_units_available == null ? "∞" : String(c.max_units_available);
+    var remaining = c.max_units_available == null ? "∞"
+      : String(av != null ? av.remaining_units : (Number(c.max_units_available) - Number(c.units_reserved)));
+    var isActive = c.status === "active";
+    var canLaunch = isActive && Number(c.launch_at) <= now;
+    var enc = _htmlEscape(encodeURIComponent(c.slug));
+    var actions = "";
+    if (isActive) {
+      if (canLaunch) {
+        actions +=
+          "<form method=\"post\" action=\"/admin/preorders/" + enc + "/launch\" class=\"form-inline\">" +
+            "<button class=\"btn\" type=\"submit\">Launch &amp; convert</button></form> ";
+      }
+      actions +=
+        "<form method=\"post\" action=\"/admin/preorders/" + enc + "/close\" class=\"form-inline\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Close</button></form>";
+    }
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(c.slug) + "</code></td>" +
+      "<td><code>" + _htmlEscape(c.sku) + "</code></td>" +
+      "<td>" + _htmlEscape(_date(c.launch_at)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(_money(c.full_price_minor, c.currency)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(reserved)) + " / " + _htmlEscape(cap) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(remaining) + "</td>" +
+      "<td><span class=\"status-pill " + (c.status === "active" ? "paid" : c.status === "launched" ? "fulfilled" : "cancelled") + "\">" + _htmlEscape(c.status) + "</span></td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr>" +
+        "<th scope=\"col\">Slug</th><th scope=\"col\">SKU</th><th scope=\"col\">Ships</th>" +
+        "<th scope=\"col\">Price</th><th scope=\"col\">Reserved / cap</th><th scope=\"col\">Remaining</th>" +
+        "<th scope=\"col\">Status</th><th scope=\"col\">Actions</th>" +
+      "</tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No pre-order campaigns yet.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Open a pre-order campaign</h3>" +
+      "<p class=\"meta\">A reservation is intent, not a charge — at launch every active reservation converts to a regular order the customer pays through checkout. Prices are in minor units (cents). Leave the cap blank for unlimited.</p>" +
+      "<form method=\"post\" action=\"/admin/preorders\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id + the URL slug.", " maxlength=\"128\" required") +
+        _setupField("SKU", "sku", "", "text", "The variant SKU this campaign reserves against.", " maxlength=\"128\" required") +
+        _setupField("Release date", "launch_at", "", "datetime-local", "When the campaign converts reservations to orders.", " required") +
+        _setupField("Full price (minor units)", "full_price_minor", "", "number", "e.g. 4999 = $49.99. The locked-in unit price on the order line.", " min=\"0\" step=\"1\" required") +
+        _setupField("Deposit (minor units, optional)", "deposit_minor", "", "number", "Partial payment collected at reservation. Blank = no deposit.", " min=\"0\" step=\"1\"") +
+        _setupField("Reservation cap (optional)", "max_units_available", "", "number", "Caps reservations against a known batch. Blank = unlimited.", " min=\"0\" step=\"1\"") +
+        _setupField("Currency", "currency", "USD", "text", "3-letter ISO 4217 code.", " maxlength=\"3\" class=\"input-code\" required") +
+        "<label class=\"form-field\"><span>Marketing copy (optional)</span><textarea name=\"marketing_copy\" maxlength=\"2000\"></textarea></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Open campaign</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Pre-orders</h2>" + okBanner + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pre-orders", bodyHtml, "preorders", opts.nav_available);
+}
+
 // ---- blog form coercion + render --------------------------------------
 
 // A comma- or newline-separated tag field → the normalized string array

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.36",
+  "version": "0.3.38",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/preorder.js

@@ -316,6 +316,35 @@ function create(opts) {
       return await _getCampaign(slug);
     },
 
+    // The OPEN campaign for a SKU, or null. Drives the storefront PDP's
+    // pre-order CTA: a not-yet-released SKU isn't in the catalog as a buyable
+    // variant, so the page keys the reservation affordance off this read.
+    // Returns at most one row — the most recently updated active campaign when
+    // more than one names the SKU. Mirrors the edge read
+    // (worker/data/catalog.js#getOpenPreorderForSku) so the dual-rendered CTA
+    // resolves the same campaign in both substrates.
+    openCampaignForSku: async function (sku) {
+      _sku(sku);
+      var r = await query(
+        "SELECT * FROM preorder_campaigns WHERE sku = ?1 AND status = 'active' " +
+        "ORDER BY updated_at DESC, slug DESC LIMIT 1",
+        [sku],
+      );
+      return r.rows[0] || null;
+    },
+
+    // Operator-facing campaign list for the admin console. Newest-defined
+    // first (created_at DESC, slug DESC tiebreak). A pure read — no cursor;
+    // the console shows the full set (an operator runs tens of campaigns, not
+    // thousands).
+    listCampaigns: async function () {
+      var r = await query(
+        "SELECT * FROM preorder_campaigns ORDER BY created_at DESC, slug DESC",
+        [],
+      );
+      return r.rows;
+    },
+
     // Customer-driven reserve. Refuses when:
     //   - the campaign doesn't exist / isn't active
     //   - the requested quantity would push units_reserved past the