@blamejs/blamejs-shop 0.3.36 → 0.3.38

package/lib/storefront.js

@@ -30,6 +30,12 @@ var pricing      = require("./pricing");
 var currencyDisplayModule = require("./currency-display");
 var translationsModule = require("./translations");
 var securityMiddleware = require("./security-middleware");
+var giftRegistryModule = require("./gift-registry");
+
+// Registry occasion values, sourced from the gift-registry primitive so the
+// storefront's <select> options never drift from the column CHECK enum the
+// migration enforces. The primitive is the single source of truth.
+var REGISTRY_OCCASIONS = giftRegistryModule.OCCASIONS;
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
 var b = require("./vendor/blamejs");
@@ -1938,6 +1944,115 @@ function _pdpShippingNote(availability) {
          "See our <a href=\"/terms\">shipping &amp; returns policy</a>.</p>";
 }
 
+// Pre-order CTA — replaces the add-to-cart buy box on a PDP whose lead SKU
+// has an OPEN pre-order campaign (a SKU that isn't released yet, so it's not
+// normally purchasable). `preorder` is the resolved shape the route loads:
+//   { product_slug, release_date_iso, remaining_units (null = unlimited),
+//     full_price_str, deposit_str (null when no deposit), sold_out,
+//     reserve_form }
+// A reservation is INTENT, not a charge — the form POSTs to the container
+// /products/:slug/preorder route, which pins the reservation to the signed-in
+// session customer and converts it into a regular (Stripe-gated) order at
+// launch. The reserve POST is CSRF-protected + auth-gated, so the POST FORM is
+// rendered ONLY by the container (where the per-request `_csrf` token is
+// injected): `reserve_form` is true on the container render, false on the edge.
+// The edge render shows the same pre-order info + a sign-in affordance instead
+// of a token-less form — a logged-in customer's session-cookie request skips
+// the edge cache and routes to the container, so they always reach the real
+// (tokened) form; an anonymous edge visitor can't reserve anyway (the route
+// 303s guests to login). This mirrors how cart-count / session chrome is
+// handled on edge-cached pages. The non-form parts stay byte-identical to the
+// edge builder. A sold-out campaign renders a disabled control + an honest
+// note, mirroring the out-of-stock add control.
+function _buildPreorderCta(preorder, escAttr) {
+  var soldOut = !!preorder.sold_out;
+  var remaining = preorder.remaining_units;
+  var availLine = remaining == null
+    ? "<p class=\"pdp__preorder-avail\" role=\"status\">Open for pre-order.</p>"
+    : (remaining > 0
+        ? "<p class=\"pdp__preorder-avail\" role=\"status\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> " + escAttr(String(remaining)) + " of " + escAttr(String(preorder.max_units_available)) + " reservations remaining.</p>"
+        : "<p class=\"pdp__preorder-avail\" role=\"status\">All reservations are spoken for.</p>");
+  var depositLine = preorder.deposit_str
+    ? "<p class=\"pdp__preorder-deposit\">Reserve with a " + escAttr(preorder.deposit_str) + " deposit · " + escAttr(preorder.full_price_str) + " total at launch.</p>"
+    : "<p class=\"pdp__preorder-deposit\">No payment due now · " + escAttr(preorder.full_price_str) + " charged when it ships.</p>";
+  var head =
+    "<div class=\"pdp__buybox pdp__buybox--preorder\">\n" +
+    "        <p class=\"pdp__badge pdp__badge--preorder\">Pre-order · ships " + escAttr(preorder.release_date_iso) + "</p>\n" +
+    "        <p class=\"featured-product__price\">" + escAttr(preorder.full_price_str) + "</p>\n" +
+    "        " + availLine + "\n" +
+    "        " + depositLine + "\n";
+  // Sold-out: the same disabled control in both substrates (no POST either way).
+  if (soldOut) {
+    return head +
+           "        <button type=\"submit\" class=\"btn-primary cart-page__checkout\" disabled aria-disabled=\"true\">Pre-orders full</button>\n" +
+           "        <p class=\"pdp__soldout-note\" role=\"status\">Every pre-order reservation has been claimed.</p>\n" +
+           "      </div>";
+  }
+  if (!preorder.reserve_form) {
+    // Edge render — no per-session CSRF token here, so render a sign-in
+    // affordance instead of a token-less POST form. A signed-in customer's
+    // request skips the edge cache and gets the container form below.
+    return head +
+           "        <a class=\"btn-primary cart-page__checkout\" href=\"/account/login\">Sign in to reserve</a>\n" +
+           "        <p class=\"pdp__preorder-note\">A reservation holds your unit. We charge through secure checkout when it launches.</p>\n" +
+           "      </div>";
+  }
+  return head +
+         "        <form method=\"post\" action=\"/products/" + escAttr(preorder.product_slug) + "/preorder\">\n" +
+         "          <label class=\"pdp__variants-title\" for=\"preorder-qty\">Quantity</label>\n" +
+         "          <input id=\"preorder-qty\" type=\"number\" name=\"qty\" value=\"1\" min=\"1\" max=\"99\" class=\"variant-row__qty\" aria-label=\"Quantity\">\n" +
+         "          <button type=\"submit\" class=\"btn-primary cart-page__checkout\">Reserve your pre-order</button>\n" +
+         "          <p class=\"pdp__preorder-note\">A reservation holds your unit. We charge through secure checkout when it launches.</p>\n" +
+         "        </form>\n" +
+         "      </div>";
+}
+
+// Build the renderProduct `preorder` opts shape from a campaign row + the
+// primitive's `availability` read + a price formatter. Returns null unless the
+// campaign is OPEN (status 'active') — a launched / closed campaign is no
+// longer reservable, so its PDP renders the standard buy box. Shared so the
+// container route + the edge handler derive the identical shape and the
+// dual-rendered CTA stays byte-consistent. `fmt(minor, currency)` is the
+// page's price formatter; `slug` is the product (URL) slug the reserve form
+// posts to.
+function preorderCtaShape(campaign, availability, fmt, slug) {
+  if (!campaign || campaign.status !== "active") return null;
+  var remaining = availability ? availability.remaining_units : null;
+  var max = campaign.max_units_available == null ? null : campaign.max_units_available;
+  var deposit = Number(campaign.deposit_minor) || 0;
+  return {
+    product_slug:        slug,
+    release_date_iso:    new Date(Number(campaign.launch_at)).toISOString().slice(0, 10),
+    remaining_units:     remaining,
+    max_units_available: max,
+    full_price_str:      fmt(campaign.full_price_minor, campaign.currency),
+    deposit_str:         deposit > 0 ? fmt(deposit, campaign.currency) : null,
+    sold_out:            remaining != null && remaining <= 0,
+    // The container injects the per-request `_csrf` token into POST forms, so
+    // the container render carries the real reserve form. The edge twin
+    // (worker/render/product.js#preorderCtaShape) sets this false and renders a
+    // sign-in affordance — see _buildPreorderCta.
+    reserve_form:        true,
+  };
+}
+
+// The reserve-PRG banner, keyed off the closed ?preorder marker set so a
+// forged query can never inject copy. Empty string for an absent / unknown
+// marker. Mirrored byte-for-byte by worker/render/product.js#_buildPreorderNotice.
+var _PREORDER_NOTICES = {
+  reserved:    { kind: "ok",    copy: "Reserved. We'll email you when it ships and charge your card through secure checkout." },
+  unavailable: { kind: "error", copy: "This pre-order couldn't be reserved — it may be full or closed. Nothing was charged." },
+  closed:      { kind: "error", copy: "This pre-order is no longer open." },
+};
+function _buildPreorderNotice(marker) {
+  var n = marker && Object.prototype.hasOwnProperty.call(_PREORDER_NOTICES, marker)
+    ? _PREORDER_NOTICES[marker] : null;
+  if (!n) return "";
+  var cls = n.kind === "error" ? "form-notice form-notice--error" : "form-notice form-notice--ok";
+  var role = n.kind === "error" ? "alert" : "status";
+  return "<p class=\"" + cls + "\" role=\"" + role + "\">" + b.template.escapeHtml(n.copy) + "</p>\n      ";
+}
+
 var PRODUCT_PAGE =
   "<section class=\"pdp\">\n" +
   "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
@@ -2644,6 +2759,391 @@ function renderSharedWishlist(opts) {
   });
 }
 
+// ---- gift registry -------------------------------------------------------
+//
+// Owner side (renderRegistryList / renderRegistryManage) is gated on the
+// session customer; the public giver view (renderRegistryPublic) takes no
+// auth — the slug (resolved through the privacy gate) is the access.
+
+// Human label for an occasion enum value. Unknown values fall back to the
+// raw token (never throws) so a future migration that adds an occasion the
+// renderer hasn't been taught still shows something readable.
+var REGISTRY_OCCASION_LABELS = {
+  wedding:      "Wedding",
+  baby:         "Baby",
+  housewarming: "Housewarming",
+  birthday:     "Birthday",
+  graduation:   "Graduation",
+  anniversary:  "Anniversary",
+  other:        "Other",
+};
+function _registryOccasionLabel(occasion) {
+  return REGISTRY_OCCASION_LABELS[occasion] || (occasion || "Registry");
+}
+
+// Build a <select> of occasion options. `selected` highlights the current
+// value (the edit form); absent it the first option is the browser default.
+function _registryOccasionSelect(name, selected, esc) {
+  var opts = "";
+  for (var i = 0; i < REGISTRY_OCCASIONS.length; i += 1) {
+    var v = REGISTRY_OCCASIONS[i];
+    var sel = v === selected ? " selected" : "";
+    opts += "<option value=\"" + esc(v) + "\"" + sel + ">" + esc(_registryOccasionLabel(v)) + "</option>";
+  }
+  return "<select name=\"" + esc(name) + "\" required>" + opts + "</select>";
+}
+
+// Build a <select> of privacy options with inline help text.
+var REGISTRY_PRIVACY_LABELS = {
+  private:  "Private — only you can see it",
+  unlisted: "Unlisted — anyone with the link can see it",
+  public:   "Public — discoverable in the shop",
+};
+function _registryPrivacySelect(name, selected, esc) {
+  var order = ["unlisted", "public", "private"];
+  var opts = "";
+  for (var i = 0; i < order.length; i += 1) {
+    var v = order[i];
+    var sel = v === selected ? " selected" : "";
+    opts += "<option value=\"" + esc(v) + "\"" + sel + ">" + esc(REGISTRY_PRIVACY_LABELS[v] || v) + "</option>";
+  }
+  return "<select name=\"" + esc(name) + "\" required>" + opts + "</select>";
+}
+
+// Owner-facing list of registries (`GET /account/registry`). `opts.rows` is
+// each registry decoded by `listForOwner`, decorated with its `progress`
+// rollup ({ overall_percent, total_desired, total_purchased }). The create
+// form posts to /account/registry. `opts.notice` surfaces a created/closed/
+// updated confirmation. A per-customer page — noindex.
+var REGISTRY_LIST_NOTICES = {
+  created: "Registry created. Add the items you're hoping for below.",
+  closed:  "Registry closed. It's still viewable so you can send thank-you notes.",
+  updated: "Registry updated.",
+  removed: "Item removed from your registry.",
+  added:   "Item added to your registry.",
+};
+function renderRegistryList(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var rows = opts.rows || [];
+  var rowsHtml = "";
+  for (var i = 0; i < rows.length; i += 1) {
+    var r = rows[i];
+    var reg = r.registry;
+    var prog = r.progress || { overall_percent: 0, total_purchased: 0, total_desired: 0 };
+    var statusBadge = reg.status === "closed"
+      ? "<span class=\"registry-card__status registry-card__status--closed\">Closed</span>"
+      : "<span class=\"registry-card__status registry-card__status--active\">Active</span>";
+    rowsHtml +=
+      "<li class=\"registry-card\">" +
+        "<div class=\"registry-card__head\">" +
+          "<a class=\"registry-card__title\" href=\"/account/registry/" + esc(reg.slug) + "\">" + esc(reg.title) + "</a>" +
+          statusBadge +
+        "</div>" +
+        "<p class=\"registry-card__meta\">" + esc(_registryOccasionLabel(reg.occasion)) + " · " +
+          esc(REGISTRY_PRIVACY_LABELS[reg.privacy] || reg.privacy) + "</p>" +
+        "<p class=\"registry-card__progress\">" + esc(String(prog.overall_percent)) + "% fulfilled" +
+          " (" + esc(String(prog.total_purchased)) + " of " + esc(String(prog.total_desired)) + ")</p>" +
+        "<a class=\"card-link\" href=\"/account/registry/" + esc(reg.slug) + "\">Manage registry →</a>" +
+      "</li>";
+  }
+  var list = rowsHtml
+    ? "<ul class=\"registry-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">You haven't created a registry yet. Start one below for a wedding, a baby, a housewarming, or any occasion — then share the link with friends and family.</p>" +
+      "</div>";
+  var noticeMsg = REGISTRY_LIST_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+  var errMsg = (typeof opts.error === "string" && opts.error.length) ? opts.error : "";
+  var errBlock = errMsg
+    ? "<p class=\"form-notice form-notice--err\" role=\"alert\">" + esc(errMsg) + "</p>"
+    : "";
+  // The slug field is operator-authored (lowercase alnum + dash) — the
+  // backend validates it; the form pattern is a UX hint only (backend
+  // remains authoritative, never the client).
+  var createForm =
+    "<section class=\"registry-create\" aria-labelledby=\"registry-create-heading\">" +
+      "<h2 id=\"registry-create-heading\" class=\"registry-create__title\">Create a registry</h2>" +
+      errBlock +
+      "<form class=\"registry-create__form\" method=\"post\" action=\"/account/registry\">" +
+        "<label class=\"field\"><span class=\"field__label\">Title</span>" +
+          "<input type=\"text\" name=\"title\" required maxlength=\"200\" placeholder=\"Alice &amp; Bob's Wedding\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Registry link (lowercase letters, numbers, dashes)</span>" +
+          "<input type=\"text\" name=\"slug\" required maxlength=\"200\" pattern=\"[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\" placeholder=\"alice-and-bob-2026\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Recipient name</span>" +
+          "<input type=\"text\" name=\"recipient_name\" required maxlength=\"200\" placeholder=\"Alice &amp; Bob\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Occasion</span>" +
+          _registryOccasionSelect("occasion", "wedding", esc) + "</label>" +
+        "<label class=\"field\"><span class=\"field__label\">Event date (optional)</span>" +
+          "<input type=\"date\" name=\"event_date\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Who can see it</span>" +
+          _registryPrivacySelect("privacy", "unlisted", esc) + "</label>" +
+        "<button type=\"submit\" class=\"btn-primary\">Create registry</button>" +
+      "</form>" +
+    "</section>";
+  var body =
+    "<section class=\"account-registry\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Gift registry</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-registry__title\">Your gift registries</h1>" +
+      notice +
+      list +
+      createForm +
+    "</section>";
+  return _wrap({
+    title:      "Gift registry",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    // Per-customer management surface — keep it out of the index.
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+// Owner-facing manage page for one registry (`GET /account/registry/:slug`).
+// `opts.registry` is the decoded row; `opts.items` is each item decorated
+// with { product, hero_media, purchased, remaining, desired }; `opts.share_url`
+// is the absolute public URL (built from the request origin by the route).
+// Carries the add-item / edit / close forms. Per-customer — noindex.
+function renderRegistryManage(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var prefix = opts.asset_prefix || "/assets/";
+  var reg = opts.registry || {};
+  var items = opts.items || [];
+  var closed = reg.status === "closed";
+  var rowsHtml = "";
+  for (var i = 0; i < items.length; i += 1) {
+    var it = items[i];
+    var media = it.hero_media
+      ? "<img src=\"" + esc(prefix + it.hero_media.r2_key) + "\" alt=\"" + esc(it.hero_media.alt_text || (it.product && it.product.title) || it.sku) + "\" loading=\"lazy\">"
+      : "<span class=\"registry-item__mark\" aria-hidden=\"true\">" + esc(((it.product && it.product.title) || it.sku || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    var titleHtml = it.product
+      ? "<a class=\"registry-item__title\" href=\"/products/" + esc(it.product.slug) + "\">" + esc(it.product.title) + "</a>"
+      : "<span class=\"registry-item__title\">" + esc(it.sku) + " (no longer in the catalog)</span>";
+    var removeForm = closed ? "" :
+      "<form class=\"registry-item__remove\" method=\"post\" action=\"/account/registry/" + esc(reg.slug) + "/items/" + esc(it.item_id) + "/remove\">" +
+        "<button type=\"submit\" class=\"btn-ghost\">Remove</button>" +
+      "</form>";
+    rowsHtml +=
+      "<li class=\"registry-item\">" +
+        "<span class=\"registry-item__media\">" + media + "</span>" +
+        "<div class=\"registry-item__body\">" +
+          titleHtml +
+          "<p class=\"registry-item__progress\">" + esc(String(it.purchased)) + " of " + esc(String(it.desired)) +
+            " purchased · " + esc(String(it.remaining)) + " still needed</p>" +
+        "</div>" +
+        removeForm +
+      "</li>";
+  }
+  var list = rowsHtml
+    ? "<ul class=\"registry-item-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\"><p class=\"account-empty__lede\">No items yet. Add the products you're hoping for below.</p></div>";
+
+  var addForm = closed ? "" :
+    "<section class=\"registry-add\" aria-labelledby=\"registry-add-heading\">" +
+      "<h2 id=\"registry-add-heading\" class=\"registry-add__title\">Add an item</h2>" +
+      "<form class=\"registry-add__form\" method=\"post\" action=\"/account/registry/" + esc(reg.slug) + "/items\">" +
+        "<label class=\"field\"><span class=\"field__label\">Product SKU</span>" +
+          "<input type=\"text\" name=\"sku\" required maxlength=\"200\" placeholder=\"BLENDER-12CUP\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Quantity wanted</span>" +
+          "<input type=\"number\" name=\"quantity_desired\" required min=\"1\" max=\"999\" value=\"1\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Priority (1 = most wanted)</span>" +
+          "<input type=\"number\" name=\"priority\" min=\"1\" max=\"5\" value=\"3\"></label>" +
+        "<button type=\"submit\" class=\"btn-secondary\">Add to registry</button>" +
+      "</form>" +
+    "</section>";
+
+  var eventDateValue = (typeof reg.event_date === "number")
+    ? new Date(reg.event_date).toISOString().slice(0, 10)
+    : "";
+  var editForm = closed ? "" :
+    "<section class=\"registry-edit\" aria-labelledby=\"registry-edit-heading\">" +
+      "<h2 id=\"registry-edit-heading\" class=\"registry-edit__title\">Registry details</h2>" +
+      "<form class=\"registry-edit__form\" method=\"post\" action=\"/account/registry/" + esc(reg.slug) + "/edit\">" +
+        "<label class=\"field\"><span class=\"field__label\">Title</span>" +
+          "<input type=\"text\" name=\"title\" required maxlength=\"200\" value=\"" + esc(reg.title || "") + "\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Recipient name</span>" +
+          "<input type=\"text\" name=\"recipient_name\" required maxlength=\"200\" value=\"" + esc(reg.recipient_name || "") + "\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Event date</span>" +
+          "<input type=\"date\" name=\"event_date\" value=\"" + esc(eventDateValue) + "\"></label>" +
+        "<label class=\"field\"><span class=\"field__label\">Who can see it</span>" +
+          _registryPrivacySelect("privacy", reg.privacy, esc) + "</label>" +
+        "<button type=\"submit\" class=\"btn-secondary\">Save details</button>" +
+      "</form>" +
+    "</section>";
+
+  var closeForm = closed
+    ? "<p class=\"registry-manage__closed-note\">This registry is closed. It stays viewable so you can review what arrived.</p>"
+    : "<form class=\"registry-close__form\" method=\"post\" action=\"/account/registry/" + esc(reg.slug) + "/close\">" +
+        "<button type=\"submit\" class=\"btn-ghost registry-close__btn\">Close this registry</button>" +
+      "</form>";
+
+  // The shareable public URL — shown only for a non-private registry (a
+  // private registry isn't publicly viewable, so there's no link to share).
+  var shareBlock = "";
+  if (reg.privacy !== "private" && opts.share_url) {
+    shareBlock =
+      "<section class=\"registry-share\" aria-labelledby=\"registry-share-heading\">" +
+        "<h2 id=\"registry-share-heading\" class=\"registry-share__title\">Share this registry</h2>" +
+        "<p class=\"registry-share__lede\">Send this link to friends and family. They can see what you're hoping for and mark items as purchased — buyers stay anonymous unless they choose otherwise.</p>" +
+        "<label class=\"registry-share__label\" for=\"registry-share-url\">Public link</label>" +
+        "<input id=\"registry-share-url\" class=\"registry-share__url\" type=\"text\" readonly value=\"" + esc(opts.share_url) + "\" " +
+          "aria-label=\"Public registry link\" onfocus=\"this.select()\">" +
+      "</section>";
+  } else if (reg.privacy === "private") {
+    shareBlock = "<p class=\"registry-share__private-note\">This registry is private — no public link. Change it to unlisted or public above to share it.</p>";
+  }
+
+  var noticeMsg = REGISTRY_LIST_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+  var errMsg = (typeof opts.error === "string" && opts.error.length) ? opts.error : "";
+  var errBlock = errMsg
+    ? "<p class=\"form-notice form-notice--err\" role=\"alert\">" + esc(errMsg) + "</p>"
+    : "";
+
+  var body =
+    "<section class=\"account-registry-manage\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/registry\">Gift registry</a></li>" +
+        "<li aria-current=\"page\">" + esc(reg.title || "Registry") + "</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-registry-manage__title\">" + esc(reg.title || "Registry") + "</h1>" +
+      "<p class=\"account-registry-manage__meta\">" + esc(_registryOccasionLabel(reg.occasion)) + " · " +
+        esc(REGISTRY_PRIVACY_LABELS[reg.privacy] || reg.privacy) + (closed ? " · Closed" : "") + "</p>" +
+      notice +
+      errBlock +
+      shareBlock +
+      list +
+      addForm +
+      editForm +
+      closeForm +
+    "</section>";
+  return _wrap({
+    title:      reg.title || "Registry",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+// Confirmation copy after a public giver action. Unknown keys render nothing
+// so a forged ?ok= query can't inject arbitrary copy onto the page.
+var REGISTRY_PUBLIC_NOTICES = {
+  gifted: "Thank you! We've marked that item as purchased.",
+};
+
+// Public, no-auth giver view of a registry (`GET /registry/:slug`). The route
+// resolves the registry ONLY through getBySlug (which honors the privacy
+// gate — a private registry returns null and the route 404s); the owner's
+// customer id + shipping address + buyer identities are NEVER carried into
+// this shape (the route passes title/occasion/event_date + per-item desired /
+// purchased / remaining counts + product cards only). Each not-yet-fulfilled
+// item carries a "mark purchased" form (records a gift via purchaseItem —
+// buyer anonymous by default) and an "add to cart" link so the giver can buy
+// it normally through the regular cart/checkout. Carries a noindex robots
+// directive — a personal registry is not search-index material.
+function renderRegistryPublic(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var prefix = opts.asset_prefix || "/assets/";
+  var reg = opts.registry || {};
+  var items = opts.items || [];
+  var heading = (reg.title && String(reg.title).length) ? reg.title : "A gift registry";
+  var occasionLine = esc(_registryOccasionLabel(reg.occasion));
+  if (typeof reg.event_date === "number") {
+    var dt = new Date(reg.event_date);
+    if (!isNaN(dt.getTime())) {
+      occasionLine += " · " + esc(dt.toISOString().slice(0, 10));
+    }
+  }
+  var rowsHtml = "";
+  for (var i = 0; i < items.length; i += 1) {
+    var it = items[i];
+    var media = it.hero_media
+      ? "<img src=\"" + esc(prefix + it.hero_media.r2_key) + "\" alt=\"" + esc(it.hero_media.alt_text || (it.product && it.product.title) || it.sku) + "\" loading=\"lazy\">"
+      : "<span class=\"registry-item__mark\" aria-hidden=\"true\">" + esc(((it.product && it.product.title) || it.sku || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    var titleHtml = it.product
+      ? "<a class=\"registry-item__title\" href=\"/products/" + esc(it.product.slug) + "\">" + esc(it.product.title) + "</a>"
+      : "<span class=\"registry-item__title\">" + esc(it.sku) + "</span>";
+    // Progress line — desired vs already purchased. A fully-purchased item
+    // shows a "fully gifted" badge and offers no purchase control.
+    var fulfilled = it.remaining <= 0;
+    var progressHtml = fulfilled
+      ? "<p class=\"registry-item__progress registry-item__progress--done\">Fully gifted — thank you!</p>"
+      : "<p class=\"registry-item__progress\">" + esc(String(it.purchased)) + " of " + esc(String(it.desired)) +
+          " purchased · " + esc(String(it.remaining)) + " still needed</p>";
+    // Giver controls: only for an item that's both buyable (resolves to a
+    // catalog variant) and not yet fully gifted, and only while the registry
+    // is active (a closed registry refuses purchaseItem).
+    var controls = "";
+    if (!fulfilled && reg.status === "active") {
+      var markForm =
+        "<form class=\"registry-item__gift\" method=\"post\" action=\"/registry/" + esc(reg.slug) + "/items/" + esc(it.item_id) + "/purchase\">" +
+          "<input type=\"hidden\" name=\"quantity\" value=\"1\">" +
+          "<label class=\"registry-item__reveal\"><input type=\"checkbox\" name=\"reveal\" value=\"1\"> Let the recipient see it was from me (requires sign-in)</label>" +
+          "<button type=\"submit\" class=\"btn-secondary\">Mark as purchased</button>" +
+        "</form>";
+      var cartForm = it.variant_id
+        ? "<form class=\"registry-item__cart\" method=\"post\" action=\"/cart/lines\">" +
+            "<input type=\"hidden\" name=\"variant_id\" value=\"" + esc(it.variant_id) + "\">" +
+            "<input type=\"hidden\" name=\"qty\" value=\"1\">" +
+            "<button type=\"submit\" class=\"btn-ghost\">Add to cart</button>" +
+          "</form>"
+        : "";
+      controls = "<div class=\"registry-item__actions\">" + cartForm + markForm + "</div>";
+    }
+    rowsHtml +=
+      "<li class=\"registry-item\">" +
+        "<span class=\"registry-item__media\">" + media + "</span>" +
+        "<div class=\"registry-item__body\">" +
+          titleHtml +
+          progressHtml +
+          controls +
+        "</div>" +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"registry-item-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\"><p class=\"account-empty__lede\">This registry doesn't have any items yet — check back soon.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a></div>";
+  var noticeMsg = REGISTRY_PUBLIC_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+  var messageBlock = (reg.message && String(reg.message).length)
+    ? "<p class=\"registry-public__message\">" + esc(reg.message) + "</p>"
+    : "";
+  var body =
+    "<section class=\"registry-public\">" +
+      "<p class=\"eyebrow\">Gift registry</p>" +
+      "<h1 class=\"registry-public__title\">" + esc(heading) + "</h1>" +
+      "<p class=\"registry-public__meta\">" + occasionLine + "</p>" +
+      messageBlock +
+      notice +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      heading,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    // A personal registry is not search-index material.
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
 // Compare page notice banner — surfaced after a toggle / a full-basket
 // refusal. The route passes a short message key; unknown keys render
 // nothing so a forged `?notice=` query can't inject arbitrary copy.
@@ -4567,6 +5067,76 @@ function renderAccountSubscriptions(opts) {
   });
 }
 
+// The customer's pre-order reservations (`GET /account/preorders`). Each row
+// shows the campaign (the SKU's product context isn't loaded here — the
+// campaign slug + release date + status are the durable identity), its
+// release date, the reserved quantity, and the reservation status pill. An
+// ACTIVE reservation offers a Cancel control (ownership-scoped POST); a
+// converted (now an order) / cancelled reservation is read-only. `reservations`
+// rows are decorated with `.campaign` by the route. JS-off-native.
+function renderAccountPreorders(opts) {
+  var esc = b.template.escapeHtml;
+  var rows = opts.reservations || [];
+  var rowsHtml = "";
+  for (var i = 0; i < rows.length; i += 1) {
+    var r = rows[i];
+    var c = r.campaign || null;
+    var releaseStr = c && c.launch_at
+      ? new Date(Number(c.launch_at)).toISOString().slice(0, 10)
+      : "";
+    var priceStr = "";
+    if (c) {
+      try { priceStr = esc(pricing.format(Number(c.full_price_minor), String(c.currency || "USD"))) + " · "; }
+      catch (_e) { priceStr = ""; }
+    }
+    var status = String(r.status || "active");
+    var statusLabel = status === "converted" ? "Ordered" : status === "cancelled" ? "Canceled" : "Reserved";
+    var releaseLine = releaseStr
+      ? "Ships <time datetime=\"" + esc(releaseStr) + "\">" + esc(releaseStr) + "</time>"
+      : "";
+    var cancelControl = status === "active"
+      ? "<form class=\"preorder-card__control\" method=\"post\" action=\"/account/preorders/" + esc(String(r.id)) + "/cancel\">" +
+          "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Cancel reservation</button>" +
+        "</form>"
+      : "";
+    rowsHtml +=
+      "<li class=\"preorder-card preorder-card--" + esc(status) + "\">" +
+        "<div class=\"preorder-card__head\">" +
+          "<span class=\"preorder-card__title\">" + esc(c ? String(c.slug) : String(r.campaign_slug)) + "</span>" +
+          "<span class=\"status-pill preorder-status--" + esc(status) + "\">" + esc(statusLabel) + "</span>" +
+        "</div>" +
+        "<p class=\"preorder-card__meta\">" + priceStr + "Qty " + esc(String(r.quantity)) + (releaseLine ? " · " + releaseLine : "") + "</p>" +
+        cancelControl +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"preorder-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">You have no pre-order reservations.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
+  var noticeHtml = opts.notice
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var body =
+    "<section class=\"account-preorders\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Pre-orders</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-preorders__title\">Pre-orders</h1>" +
+      noticeHtml +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      "Pre-orders",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Server-rendered confirmation step for canceling a subscription. CSP
 // forbids an inline confirm() dialog, so the destructive choice is gated
 // by this page: it spells out the period-end date and, for the
@@ -4807,7 +5377,25 @@ function renderProduct(opts) {
   // loads ({ sku: { stock_on_hand, stock_held } }); absent it, the
   // product reads as in stock (never-block-on-missing-inventory stance).
   var availability = _resolveAvailability(variants, opts.inventory);
-  var buyboxHtml = _buildBuyBox(rendered, b.template.escapeHtml, availability);
+  // An OPEN pre-order campaign for the lead SKU swaps the add-to-cart buy box
+  // for the reservation CTA — a not-yet-released SKU isn't normally
+  // purchasable, so the only honest action is to reserve a unit. The route
+  // threads `opts.preorder_campaign` ({ campaign, remaining_units }) from a
+  // live D1 read; the shape is built here with the page's own `fmt` so the
+  // CTA's prices track the active currency context exactly as the buy-box
+  // prices do, and the container + edge render byte-identically. Absent a
+  // campaign (or a non-active one), the standard buy box renders unchanged.
+  var preorderShape = opts.preorder_campaign
+    ? preorderCtaShape(opts.preorder_campaign.campaign, { remaining_units: opts.preorder_campaign.remaining_units }, fmt, opts.product.slug)
+    : null;
+  var buyboxHtml = preorderShape
+    ? _buildPreorderCta(preorderShape, b.template.escapeHtml)
+    : _buildBuyBox(rendered, b.template.escapeHtml, availability);
+  // The reserve PRG lands the shopper back on the PDP with a fixed
+  // ?preorder=<reserved|unavailable|closed> marker; the banner prepends the
+  // buy box. The marker set is closed (built from a lookup, never the raw
+  // query), so a forged query can't inject copy. Mirrored at the edge.
+  buyboxHtml = _buildPreorderNotice(opts.preorder_notice) + buyboxHtml;
   var availabilityHtml = _buildAvailability(availability);
   var shippingNoteHtml = _pdpShippingNote(availability);
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
@@ -6862,6 +7450,7 @@ var ACCOUNT_DASH_PAGE =
   "      <a class=\"btn-secondary\" href=\"/account/credit\">Store credit</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/referrals\">Refer a friend</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/subscriptions\">Subscriptions</a>\n" +
+  "      RAW_PREORDER_LINK\n" +
   // begin: profile + passkey management actions
   "      <a class=\"btn-secondary\" href=\"/account/profile\">Edit profile</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/passkeys\">Manage passkeys</a>\n" +
@@ -6966,7 +7555,13 @@ function renderAccount(opts) {
     member_since:    memberSince,
     passkey_count:   String(passkeyCount),
     order_rows:      "RAW_ORDER_ROWS",
-  }).replace("RAW_ORDER_ROWS", rows);
+  }).replace("RAW_ORDER_ROWS", rows)
+    // The Pre-orders link only renders when the preorder primitive is wired
+    // (the /account/preorders route is mounted) — a deploy without it never
+    // links to a 404.
+    .replace("RAW_PREORDER_LINK", opts.preorders_enabled
+      ? "<a class=\"btn-secondary\" href=\"/account/preorders\">Pre-orders</a>"
+      : "");
   return _wrap({
     title:      "Account",
     shop_name:  opts.shop_name || "blamejs.shop",
@@ -7573,6 +8168,12 @@ function mount(router, deps) {
   // cancel route additionally needs the payment handle (cancel composes
   // Stripe via the primitive); without it the list stays read-only.
   var subscriptions = deps.subscriptions || null;
+  // Pre-order reservations — opts in the PDP reserve route + the
+  // /account/preorders surface. The PDP swaps the add-to-cart buy box for a
+  // reservation CTA when the lead SKU has an OPEN campaign; the reserve POST
+  // pins the reservation to the signed-in session customer (no charge — the
+  // launch flow converts the reservation into a Stripe-gated order).
+  var preorder = deps.preorder || null;
 
   // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
   // from the consent primitive per request so a runtime `policyVersion`
@@ -9091,10 +9692,32 @@ function mount(router, deps) {
     // mirrored at the edge). Best-effort inside the helper; an empty list
     // hides the rail.
     var related = await _relatedProductsFor(product.id, 4);
+    // Pre-order campaign for the lead SKU — when an OPEN campaign exists, the
+    // renderer swaps the add-to-cart buy box for the reservation CTA (release
+    // date + remaining availability). One indexed read; degrades to "no
+    // campaign" (the standard buy box) on a missing table / read failure so
+    // the buy path renders regardless. Mirrors the edge resolution so the
+    // dual-rendered CTA agrees across substrates.
+    var preorderCampaign = null;
+    if (deps.preorder && firstVariant) {
+      try {
+        var openCampaign = await deps.preorder.openCampaignForSku(firstVariant.sku);
+        if (openCampaign) {
+          var avail = await deps.preorder.availability({ slug: openCampaign.slug });
+          preorderCampaign = { campaign: openCampaign, remaining_units: avail ? avail.remaining_units : null };
+        }
+      } catch (_e) { preorderCampaign = null; }
+    }
+    // The reserve PRG lands here with a ?preorder=<marker> the renderer maps
+    // to a banner; only meaningful when a campaign is present.
+    var pdpUrl = req.url ? new URL(req.url, "http://localhost") : null;
+    var preorderNotice = pdpUrl ? pdpUrl.searchParams.get("preorder") : null;
     var html = renderProduct(Object.assign({
       product:        product,
       variants:       variants,
       prices:         prices,
+      preorder_campaign: preorderCampaign,
+      preorder_notice:   preorderNotice,
       media:          media,
       inventory:      inventory,
       review_summary: reviewSummary,
@@ -10445,6 +11068,7 @@ function mount(router, deps) {
         orders:                orders,
         order_product_lookup:  orderProductLookup,
         passkey_count:         passkeyCount,
+        preorders_enabled:     !!preorder,
         shop_name:             shopName,
         cart_count:            cartCount,
       }));
@@ -11266,6 +11890,535 @@ function mount(router, deps) {
       });
     }
 
+    // ---- gift registry --------------------------------------------------
+    //
+    // Owner side (gated on the session customer, CSRF-protected by the
+    // container form chokepoint): list the customer's registries with
+    // progress, create one, then a per-registry manage page (add / remove
+    // items, edit details, close) plus the shareable public URL. Every owner
+    // route is scoped to the session customer — a registry whose
+    // `owner_customer_id` isn't the signed-in customer resolves to a clean
+    // 404 (no IDOR), because the gift-registry primitive moves a registry by
+    // slug alone and has no notion of the requesting customer.
+    //
+    // Public side (NO auth): `GET /registry/:slug` resolves the registry ONLY
+    // through `getBySlug(slug)` — never a guessable owner/registry id from the
+    // path or query — and the route honors the privacy gate: a `private`
+    // registry (and an unknown slug) 404s identically, with no existence
+    // oracle. The view renders the title / occasion /
+    // event date + per-item desired-vs-purchased counts + product links, and
+    // NEVER carries the owner's customer id / shipping address or any buyer
+    // identity into the page (the primitive's getBySlug surfaces items +
+    // aggregate counts only; the per-buyer purchase rows stay owner-internal).
+    // A giver marks an item purchased (records a gift via purchaseItem,
+    // anonymous by default) or adds it to their own cart to buy normally.
+    // noindex (a personal registry isn't index material).
+    if (deps.giftRegistry) {
+      // Load a registry the SESSION customer owns, or null. The primitive's
+      // getRegistry moves by slug alone, so the route owns the ownership
+      // decision: a registry whose owner_customer_id isn't the session
+      // customer is treated identically to a missing one (clean 404, no
+      // oracle on existence). A malformed slug throws inside the primitive's
+      // slug validator — caught by the caller and mapped to a 404.
+      async function _ownedRegistry(slug, customerId) {
+        var reg;
+        try { reg = await deps.giftRegistry.getRegistry(slug); }
+        catch (_e) { return null; }   // malformed slug → not found
+        if (!reg || reg.owner_customer_id !== customerId) return null;
+        return reg;
+      }
+
+      // Resolve a registry item's sku to its catalog product + hero image +
+      // buyable variant id. Returns { product, hero_media, variant_id } —
+      // any field null when the sku no longer resolves (the item still shows,
+      // with no buy control). Best-effort: a catalog read failure degrades to
+      // an undecorated item rather than throwing.
+      async function _decorateRegistryItem(item) {
+        var out = {
+          item_id:    item.id,
+          sku:        item.sku,
+          variant_id: null,
+          product:    null,
+          hero_media: null,
+        };
+        try {
+          var variant = await deps.catalog.variants.bySku(item.sku);
+          if (variant) {
+            out.variant_id = variant.id;
+            var product = await deps.catalog.products.get(variant.product_id);
+            if (product && product.status === "active") {
+              out.product = product;
+              var media = await deps.catalog.media.listForProduct(product.id);
+              out.hero_media = media.length ? media[0] : null;
+            }
+          }
+        } catch (_e) { /* drop-silent — an undecorated item still renders */ }
+        return out;
+      }
+
+      // GET /account/registry — the session customer's registries, each with
+      // its progress rollup, plus the create form.
+      router.get("/account/registry", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var regs = [];
+        try { regs = await deps.giftRegistry.listForOwner(auth.customer_id); }
+        catch (_e) { regs = []; }
+        var rows = [];
+        for (var i = 0; i < regs.length; i += 1) {
+          var prog = null;
+          try { prog = await deps.giftRegistry.progressFor(regs[i].slug); }
+          catch (_e) { prog = null; }
+          rows.push({ registry: regs[i], progress: prog });
+        }
+        var listUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderRegistryList({
+          rows:         rows,
+          notice:       listUrl ? listUrl.searchParams.get("ok") : null,
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+
+      // POST /account/registry — create a registry owned by the session
+      // customer. The owner id comes from the session, never the body, so a
+      // shopper can only ever create a registry under their own id.
+      router.post("/account/registry", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var body = req.body || {};
+        // event_date arrives as a yyyy-mm-dd string from <input type=date>;
+        // convert to epoch-ms (midnight UTC) or null. A malformed value
+        // becomes null rather than 400-ing — the date is optional.
+        var eventDate = null;
+        if (typeof body.event_date === "string" && body.event_date.length) {
+          var parsed = Date.parse(body.event_date + "T00:00:00Z");
+          if (!isNaN(parsed)) eventDate = parsed;
+        }
+        try {
+          await deps.giftRegistry.createRegistry({
+            owner_customer_id: auth.customer_id,
+            slug:              String(body.slug || ""),
+            title:             String(body.title || ""),
+            recipient_name:    String(body.recipient_name || ""),
+            occasion:          String(body.occasion || ""),
+            privacy:           String(body.privacy || ""),
+            event_date:        eventDate,
+          });
+        } catch (e) {
+          // A bad slug / title / occasion / duplicate slug is operator error
+          // (TypeError) — re-render the list with the message; anything else
+          // is a 500.
+          if (e instanceof TypeError) {
+            var regs = [];
+            try { regs = await deps.giftRegistry.listForOwner(auth.customer_id); }
+            catch (_e2) { regs = []; }
+            var rows = [];
+            for (var i = 0; i < regs.length; i += 1) rows.push({ registry: regs[i], progress: null });
+            return _send(res, 400, renderRegistryList({
+              rows:         rows,
+              error:        (e && e.message) || "We couldn't create that registry.",
+              shop_name:    shopName,
+              cart_count:   await _cartCountForReq(req),
+              asset_prefix: deps.asset_prefix || "/assets/",
+            }));
+          }
+          res.status(500);
+          return res.end ? res.end("Error") : res.send("Error");
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/registry/" + encodeURIComponent(String(body.slug || "")) + "?ok=created");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET /account/registry/:slug — manage one registry the session
+      // customer owns. A registry the customer doesn't own (or an unknown
+      // slug) 404s.
+      router.get("/account/registry/:slug", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var slug = (req.params && req.params.slug) || "";
+        var reg = await _ownedRegistry(slug, auth.customer_id);
+        if (!reg) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        // Items + their progress. getBySlug returns items with their
+        // purchased-aggregate; progressFor gives the remaining count.
+        var view = null;
+        try { view = await deps.giftRegistry.getBySlug(slug); }
+        catch (_e) { view = null; }
+        var prog = null;
+        try { prog = await deps.giftRegistry.progressFor(slug); }
+        catch (_e) { prog = null; }
+        var remainingById = Object.create(null);
+        var purchasedById = Object.create(null);
+        var desiredById   = Object.create(null);
+        if (prog && prog.items) {
+          for (var p = 0; p < prog.items.length; p += 1) {
+            remainingById[prog.items[p].item_id] = prog.items[p].remaining;
+            purchasedById[prog.items[p].item_id] = prog.items[p].purchased;
+            desiredById[prog.items[p].item_id]   = prog.items[p].quantity_desired;
+          }
+        }
+        var items = [];
+        var rawItems = (view && view.items) || [];
+        for (var i = 0; i < rawItems.length; i += 1) {
+          var dec = await _decorateRegistryItem(rawItems[i]);
+          dec.desired   = desiredById[rawItems[i].id] != null ? desiredById[rawItems[i].id] : rawItems[i].quantity_desired;
+          dec.purchased = purchasedById[rawItems[i].id] || 0;
+          dec.remaining = remainingById[rawItems[i].id] != null ? remainingById[rawItems[i].id] : dec.desired;
+          items.push(dec);
+        }
+        // The shareable public URL — built from this request's ORIGIN (scheme
+        // + host), never by trimming a path off the canonical (this GET lands
+        // on /account/registry/:slug, so a trim would mangle the link).
+        var shareUrl = "";
+        if (reg.privacy !== "private") {
+          var origin = "";
+          try { origin = new URL(_requestUrls(req).canonical_url).origin; }
+          catch (_e) { origin = ""; }
+          shareUrl = origin + "/registry/" + encodeURIComponent(reg.slug);
+        }
+        var manageUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderRegistryManage({
+          registry:     reg,
+          items:        items,
+          share_url:    shareUrl,
+          notice:       manageUrl ? manageUrl.searchParams.get("ok") : null,
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+
+      // POST /account/registry/:slug/items — add an item to a registry the
+      // session customer owns. Ownership-scoped (404 on a foreign / unknown
+      // registry).
+      router.post("/account/registry/:slug/items", async function (req, res) {
+        var auth = _registryAuthOrRedirect(req, res);
+        if (!auth) return;
+        var slug = (req.params && req.params.slug) || "";
+        var reg = await _ownedRegistry(slug, auth.customer_id);
+        if (!reg) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        var body = req.body || {};
+        var qty = parseInt(body.quantity_desired, 10);
+        var priorityRaw = parseInt(body.priority, 10);
+        try {
+          await deps.giftRegistry.addItem({
+            registry_slug:    slug,
+            sku:              String(body.sku || ""),
+            quantity_desired: Number.isFinite(qty) ? qty : 0,
+            priority:         Number.isFinite(priorityRaw) ? priorityRaw : 3,
+          });
+        } catch (e) {
+          return _registryManageError(req, res, reg, e);
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/registry/" + encodeURIComponent(slug) + "?ok=added");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // POST /account/registry/:slug/items/:item_id/remove — archive an item
+      // on a registry the session customer owns.
+      router.post("/account/registry/:slug/items/:item_id/remove", async function (req, res) {
+        var auth = _registryAuthOrRedirect(req, res);
+        if (!auth) return;
+        var slug = (req.params && req.params.slug) || "";
+        var reg = await _ownedRegistry(slug, auth.customer_id);
+        if (!reg) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        try {
+          await deps.giftRegistry.removeItem({
+            registry_slug: slug,
+            item_id:       (req.params && req.params.item_id) || "",
+          });
+        } catch (e) {
+          return _registryManageError(req, res, reg, e);
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/registry/" + encodeURIComponent(slug) + "?ok=removed");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // POST /account/registry/:slug/edit — update registry details
+      // (title / recipient_name / event_date / privacy) on a registry the
+      // session customer owns.
+      router.post("/account/registry/:slug/edit", async function (req, res) {
+        var auth = _registryAuthOrRedirect(req, res);
+        if (!auth) return;
+        var slug = (req.params && req.params.slug) || "";
+        var reg = await _ownedRegistry(slug, auth.customer_id);
+        if (!reg) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        var body = req.body || {};
+        var patch = {
+          title:          String(body.title || ""),
+          recipient_name: String(body.recipient_name || ""),
+          privacy:        String(body.privacy || ""),
+        };
+        if (typeof body.event_date === "string" && body.event_date.length) {
+          var parsed = Date.parse(body.event_date + "T00:00:00Z");
+          patch.event_date = isNaN(parsed) ? null : parsed;
+        } else {
+          patch.event_date = null;
+        }
+        try {
+          await deps.giftRegistry.update(slug, patch);
+        } catch (e) {
+          return _registryManageError(req, res, reg, e);
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/registry/" + encodeURIComponent(slug) + "?ok=updated");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // POST /account/registry/:slug/close — close a registry the session
+      // customer owns (the only FSM transition; refuses further mutation).
+      router.post("/account/registry/:slug/close", async function (req, res) {
+        var auth = _registryAuthOrRedirect(req, res);
+        if (!auth) return;
+        var slug = (req.params && req.params.slug) || "";
+        var reg = await _ownedRegistry(slug, auth.customer_id);
+        if (!reg) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        try {
+          await deps.giftRegistry.closeRegistry(slug);
+        } catch (e) {
+          return _registryManageError(req, res, reg, e);
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/registry/" + encodeURIComponent(slug) + "?ok=closed");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET /registry/:slug — the public, no-auth giver view. Resolves the
+      // registry ONLY through getBySlug (never a guessable owner/registry id),
+      // then enforces the privacy gate in the route: a `private` registry
+      // 404s exactly like an unknown slug — no existence oracle. The owner's
+      // identity / shipping address / per-buyer purchase rows are NEVER
+      // carried into this shape. noindex.
+      router.get("/registry/:slug", async function (req, res) {
+        var slug = (req.params && req.params.slug) || "";
+        var view = null;
+        try {
+          view = await deps.giftRegistry.getBySlug(slug);
+        } catch (_e) {
+          // A malformed slug (TypeError) renders the same 404 as an unknown
+          // one — no oracle on why.
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        // Honor the privacy gate: a missing registry AND a `private` one are
+        // not publicly viewable — both 404 identically (no existence oracle).
+        // `private` resolves only through the owner's /account/registry surface
+        // (scoped to the session customer); `unlisted` + `public` are reachable
+        // by anyone who knows the slug.
+        if (!view || !view.registry || view.registry.privacy === "private") {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        var prog = null;
+        try { prog = await deps.giftRegistry.progressFor(slug); }
+        catch (_e) { prog = null; }
+        var remainingById = Object.create(null);
+        var purchasedById = Object.create(null);
+        var desiredById   = Object.create(null);
+        if (prog && prog.items) {
+          for (var p = 0; p < prog.items.length; p += 1) {
+            remainingById[prog.items[p].item_id] = prog.items[p].remaining;
+            purchasedById[prog.items[p].item_id] = prog.items[p].purchased;
+            desiredById[prog.items[p].item_id]   = prog.items[p].quantity_desired;
+          }
+        }
+        var items = [];
+        var rawItems = view.items || [];
+        for (var i = 0; i < rawItems.length; i += 1) {
+          var dec = await _decorateRegistryItem(rawItems[i]);
+          dec.desired   = desiredById[rawItems[i].id] != null ? desiredById[rawItems[i].id] : rawItems[i].quantity_desired;
+          dec.purchased = purchasedById[rawItems[i].id] || 0;
+          dec.remaining = remainingById[rawItems[i].id] != null ? remainingById[rawItems[i].id] : dec.desired;
+          items.push(dec);
+        }
+        var pubUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        // Build a redacted, public-safe registry view — only the fields a
+        // giver may see (title / occasion / event_date / message / privacy /
+        // status). The owner_customer_id + shipping_address_id are dropped
+        // here so they can NEVER reach the rendered HTML.
+        var reg = view.registry;
+        var publicReg = {
+          slug:       reg.slug,
+          title:      reg.title,
+          occasion:   reg.occasion,
+          event_date: reg.event_date,
+          message:    reg.message,
+          privacy:    reg.privacy,
+          status:     reg.status,
+        };
+        _send(res, 200, renderRegistryPublic({
+          registry:     publicReg,
+          items:        items,
+          notice:       pubUrl ? pubUrl.searchParams.get("ok") : null,
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+
+      // POST /registry/:slug/items/:item_id/purchase — a giver records a gift
+      // (marks the item purchased). This is the mark-purchased / record-a-gift
+      // action the primitive's purchaseItem implements: it decrements the
+      // remaining-needed qty and tracks who bought it (anonymous by default).
+      // It carries NO payment — a giver who wants to actually buy the item
+      // adds it to their cart (the per-item "Add to cart" form posts to
+      // /cart/lines) and pays through the regular Stripe-gated checkout. A
+      // dedicated registry-funds settlement (charge the giver, route the money
+      // to the owner) is intentionally not wired: the normal cart/checkout path
+      // already lets a giver buy a registry item end-to-end, so it only lands
+      // if an operator needs registry-scoped fulfillment (ship-to-owner +
+      // gift-message capture) the standard order flow doesn't cover. The action
+      // is slug+item gated to the registry, NOT customer-scoped (a giver need
+      // not be logged in); it is shape-safe — a closed registry, an
+      // over-purchase, an unknown item, or a malformed slug all resolve to a
+      // clean redirect
+      // / 404, never a 500.
+      router.post("/registry/:slug/items/:item_id/purchase", async function (req, res) {
+        var slug = (req.params && req.params.slug) || "";
+        var itemId = (req.params && req.params.item_id) || "";
+        // Resolve through getBySlug so a private / unknown registry is never
+        // purchasable (the same privacy gate the GET view uses) — a giver can
+        // only act on a registry they could legitimately reach by link.
+        var view = null;
+        try { view = await deps.giftRegistry.getBySlug(slug); }
+        catch (_e) { view = null; }
+        // Same privacy gate as the GET view — a private (or unknown) registry
+        // is never publicly purchasable.
+        if (!view || !view.registry || view.registry.privacy === "private") {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        var body = req.body || {};
+        var qty = parseInt(body.quantity, 10);
+        if (!Number.isFinite(qty) || qty < 1) qty = 1;
+        // `reveal` requires a signed-in giver — an anonymous reveal makes no
+        // sense (there's no identity to surface). When the box is ticked and
+        // the giver is logged in, attribute the gift to them; otherwise the
+        // purchase is anonymous.
+        var reveal = (body.reveal === "1" || body.reveal === "on" || body.reveal === true);
+        var buyerId = null;
+        if (reveal) {
+          var giverAuth = null;
+          try { giverAuth = _currentCustomer(req); } catch (_e) { giverAuth = null; }
+          if (giverAuth && giverAuth.customer_id) buyerId = giverAuth.customer_id;
+          else reveal = false;   // not signed in → fall back to anonymous
+        }
+        var purchaseInput = {
+          registry_slug: slug,
+          item_id:       itemId,
+          quantity:      qty,
+          reveal_buyer:  reveal,
+        };
+        if (buyerId) purchaseInput.buyer_customer_id = buyerId;
+        try {
+          await deps.giftRegistry.purchaseItem(purchaseInput);
+        } catch (_e) {
+          // A closed registry, an over-purchase, an archived / unknown item,
+          // or a malformed slug/item id are all giver-recoverable: bounce
+          // back to the public registry page (no item landed) rather than
+          // 500. A truly unexpected error (non-TypeError, uncoded) still
+          // surfaces as a redirect — the page re-render shows current state.
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/registry/" + encodeURIComponent(slug));
+          return res.end ? res.end() : res.send("");
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/registry/" + encodeURIComponent(slug) + "?ok=gifted");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Shared owner-route auth gate: resolve the session customer or send the
+      // redirect / 503 and return null. Mirrors the wishlist `_savedAuth`
+      // shape so every owner registry write funnels through one check.
+      function _registryAuthOrRedirect(req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        return auth;
+      }
+
+      // Re-render the manage page with an inline error after a refused owner
+      // mutation (a bad sku, a duplicate item, a closed-registry write). A
+      // TypeError / coded over-purchase is operator-recoverable → 400 with the
+      // message; anything else is a 500.
+      async function _registryManageError(req, res, reg, e) {
+        var status = (e instanceof TypeError || (e && e.code === "GIFT_REGISTRY_OVER_PURCHASE")) ? 400 : 500;
+        // Reload current items so the error page shows live state.
+        var items = [];
+        try {
+          var view = await deps.giftRegistry.getBySlug(reg.slug);
+          var prog = await deps.giftRegistry.progressFor(reg.slug);
+          var remById = Object.create(null), purById = Object.create(null), desById = Object.create(null);
+          if (prog && prog.items) {
+            for (var p = 0; p < prog.items.length; p += 1) {
+              remById[prog.items[p].item_id] = prog.items[p].remaining;
+              purById[prog.items[p].item_id] = prog.items[p].purchased;
+              desById[prog.items[p].item_id] = prog.items[p].quantity_desired;
+            }
+          }
+          var rawItems = (view && view.items) || [];
+          for (var i = 0; i < rawItems.length; i += 1) {
+            var dec = await _decorateRegistryItem(rawItems[i]);
+            dec.desired   = desById[rawItems[i].id] != null ? desById[rawItems[i].id] : rawItems[i].quantity_desired;
+            dec.purchased = purById[rawItems[i].id] || 0;
+            dec.remaining = remById[rawItems[i].id] != null ? remById[rawItems[i].id] : dec.desired;
+            items.push(dec);
+          }
+        } catch (_e) { items = []; }
+        return _send(res, status, renderRegistryManage({
+          registry:     reg,
+          items:        items,
+          error:        status === 400 ? ((e && e.message) || "We couldn't make that change.") : "Something went wrong. Please try again.",
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      }
+    }
+
     // Save for later — move a cart line into a per-customer holding
     // list and back. Login required (the list is per-customer).
     if (deps.saveForLater) {
@@ -11878,6 +13031,165 @@ function mount(router, deps) {
       }
     }
 
+    // Pre-order reservations — the PDP reserve POST + the customer's
+    // /account/preorders surface (list + cancel). A reservation is INTENT, not
+    // a charge: reserve() writes a row pinned to the SIGNED-IN SESSION
+    // customer (never a body/query id) + decrements the campaign's capacity;
+    // the launch flow later converts it into a regular (Stripe-gated) order.
+    // Mounts only when the preorder primitive is wired.
+    if (preorder) {
+      function _preorderAuth(req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        return auth;
+      }
+
+      // Defensive request-shape reader for the reserve form's quantity. A
+      // missing / non-numeric / non-positive value defaults to 1 so a no-JS
+      // submit still reserves a unit; the primitive is authoritative on the
+      // cap (it refuses an over-cap quantity), and a >99 paste clamps to 99 to
+      // match the form's max attribute.
+      function _preorderQty(raw) {
+        var n = parseInt(String(raw == null ? "" : raw), 10);
+        if (!Number.isFinite(n) || n <= 0) return 1;
+        return n > 99 ? 99 : n;
+      }
+
+      // POST /products/:slug/preorder — reserve a unit of the lead SKU's OPEN
+      // campaign. Auth-gated; the reservation is pinned to the session
+      // customer (auth.customer_id), NEVER a body/query id. The campaign is
+      // resolved from the product's lead SKU (not a client-supplied slug), so
+      // a shopper can only reserve against the campaign the PDP actually
+      // shows. Over-cap / closed / missing campaign → a clean 4xx PRG back to
+      // the PDP with a fixed ?preorder error code (no raw error text).
+      router.post("/products/:slug/preorder", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var slug = req.params && req.params.slug;
+        var enc = encodeURIComponent(slug || "");
+        var product = slug ? await deps.catalog.products.bySlug(slug) : null;
+        if (!product) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        var variants = await deps.catalog.variants.listForProduct(product.id);
+        var lead = variants[0] || null;
+        // No lead variant, or no OPEN campaign for it → there's nothing
+        // reservable here; bounce to the PDP with the closed marker.
+        var campaign = null;
+        if (lead) {
+          try { campaign = await preorder.openCampaignForSku(lead.sku); }
+          catch (_e) { campaign = null; }
+        }
+        if (!campaign) {
+          res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=closed");
+          return res.end ? res.end() : res.send("");
+        }
+        var qty = _preorderQty((req.body || {}).qty);
+        try {
+          await preorder.reserve({
+            campaign_slug: campaign.slug,
+            customer_id:   auth.customer_id,
+            quantity:      qty,
+          });
+        } catch (e) {
+          // A capacity / closed-campaign / shape refusal is the customer's
+          // problem to see, not a 500 — map every TypeError to a fixed
+          // ?preorder error marker (the reason copy is rendered on the PDP,
+          // never the raw message). Anything else rethrows (a real 500).
+          if (!(e instanceof TypeError)) throw e;
+          res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=unavailable");
+          return res.end ? res.end() : res.send("");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=reserved");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Load the reservation named in :id and confirm it belongs to the
+      // signed-in customer. A malformed id (guardUuid TypeError), a missing
+      // row, or another customer's reservation all return 404 after sending
+      // it — never a 500, never a cross-customer cancel. The reservation
+      // primitive cancels by id alone, so the route owns the ownership
+      // decision.
+      async function _ownedReservation(req, res, auth) {
+        var resv;
+        try { resv = await preorder.getReservation(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return null; }
+          throw e;
+        }
+        if (!resv || resv.customer_id !== auth.customer_id) {
+          _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+          return null;
+        }
+        return resv;
+      }
+
+      // The customer's reservations, decorated with each campaign's status +
+      // release date so the list reads "Operator Tee — ships 2026-09-01 —
+      // active". Campaigns are batched: one getCampaign per distinct slug,
+      // cached across rows. A read failure (table not migrated) degrades to an
+      // empty list rather than 500-ing the account page.
+      async function _preordersForCustomer(customerId) {
+        var rows;
+        try { rows = await preorder.reservationsForCustomer(customerId); }
+        catch (e) {
+          if (e instanceof TypeError) return [];
+          throw e;
+        }
+        var campaignCache = {};
+        for (var i = 0; i < rows.length; i += 1) {
+          var cslug = rows[i].campaign_slug;
+          if (cslug != null && !Object.prototype.hasOwnProperty.call(campaignCache, cslug)) {
+            try { campaignCache[cslug] = await preorder.getCampaign(cslug); }
+            catch (_e) { campaignCache[cslug] = null; }
+          }
+          rows[i].campaign = cslug != null ? campaignCache[cslug] : null;
+        }
+        return rows;
+      }
+
+      router.get("/account/preorders", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var rows = await _preordersForCustomer(auth.customer_id);
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var okKind = url ? url.searchParams.get("ok") : null;
+        var notice = okKind === "canceled" ? "Your pre-order reservation has been canceled." : null;
+        _send(res, 200, renderAccountPreorders({
+          reservations: rows,
+          notice:       notice,
+          shop_name:    shopName,
+          cart_count:   cartCount,
+        }));
+      });
+
+      // POST /account/preorders/:id/cancel — cancel the customer's own active
+      // reservation, freeing the held capacity. Ownership-scoped: a malformed
+      // / unknown / foreign reservation id 404s before any write. A
+      // non-active reservation (already converted / cancelled) is a clean PRG
+      // back to the list, not a 500.
+      router.post("/account/preorders/:id/cancel", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var resv = await _ownedReservation(req, res, auth); if (!resv) return;
+        try {
+          await preorder.cancelReservation({ reservation_id: resv.id, reason: "customer-cancelled" });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          // Already converted/cancelled → nothing to do; bounce back clean.
+          res.status(303); res.setHeader && res.setHeader("location", "/account/preorders");
+          return res.end ? res.end() : res.send("");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/account/preorders?ok=canceled");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     // Self-serve returns — a customer requests an RMA against one of
     // their own orders and tracks its status. Operators action it via
     // the admin /admin/returns queue. Needs the returns primitive + an
@@ -13737,6 +15049,7 @@ module.exports = {
   renderHome:            renderHome,
   renderSearch:          renderSearch,
   renderProduct:         renderProduct,
+  preorderCtaShape:      preorderCtaShape,
   renderCollectionList:  renderCollectionList,
   renderCollection:      renderCollection,
   renderCategoryIndex:   renderCategoryIndex,