@blamejs/blamejs-shop 0.3.37 → 0.3.39

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.39 (2026-05-31) — **Paginated lists no longer show an empty extra page at exact page boundaries.** Several paginated lists offered a next page even when the current page was the last one, if the list's length happened to be an exact multiple of the page size — following that next link landed on an empty page. This affected a customer's order history, loyalty history, and store-credit history, and the admin customer list. Each now checks whether a further item actually exists before offering a next page, so the next link appears only when there is genuinely more to show. **Fixed:** *No phantom next page on exactly-full lists* — A customer's order history, loyalty history, and store-credit history, and the admin customer list, offered a next page whenever the current page was full — so a list whose total was an exact multiple of the page size showed a next link that led to an empty page. These lists now look one item past the page before offering a next link, so it appears only when a further item exists. This matches the fix already in place for collection pages.
+
+- v0.3.38 (2026-05-31) — **Pre-order campaigns — reserve a product before it is released.** Products that are not yet released could not be sold or reserved. Operators can now run a pre-order campaign for a product from the admin console — setting its release date, price, and an optional reservation cap. While the campaign is open, the product page shows a Pre-order control with the release date and how many reservations remain, and a signed-in customer can reserve their quantity without paying upfront. Customers see and can cancel their reservations from their account, and when the operator launches the campaign on its release date, each reservation is turned into a pending order the customer pays for through normal checkout. **Added:** *Pre-order campaigns* — A Pre-orders screen in the admin console runs a campaign for a product's SKU — release date, price, an optional deposit, and a reservation cap — with launch and close controls (launch is available once the release date arrives). While a campaign is open, the product page shows a Pre-order control with the release date and remaining availability instead of the usual add-to-cart, and a signed-in customer can reserve their quantity (no charge at reservation time; reserving past the cap or on a closed campaign is refused). Customers manage their reservations under Pre-orders in their account and can cancel one, which frees that capacity. Launching the campaign converts each open reservation into a pending order the customer completes through normal checkout. A customer can only see and cancel their own reservations.
+
 - v0.3.37 (2026-05-31) — **Gift registries — create one, share it, and let people mark gifts as bought.** A customer can now create a gift registry for an occasion — a wedding, baby, or birthday — add the products they want with the quantity desired, and share a public link. Anyone with the link can open the registry without an account, see what is still needed, add an item to their own cart to buy it through normal checkout, or mark an item as already purchased so it stops showing as needed. Registries can be public, unlisted, or private, and a private registry is not viewable from its link. The shared page never reveals who owns the registry or who bought what, and is not indexed by search engines. **Added:** *Gift registries* — A new Registry section in the account area lets a customer create a registry (title, occasion, event date, and a public/unlisted/private visibility), add and remove the items they want with a desired quantity, edit its details, and close it. Each registry has a shareable public page at its own link where anyone — no account needed — can see the items and how many of each are still needed, add an item to their cart to buy it through the normal checkout, or mark an item as already purchased so the registry's progress updates. A private registry is not viewable from its link, the public page shows only the items (never the owner's identity, address, or who purchased what), and registry pages are excluded from search indexing.
 
 - v0.3.36 (2026-05-31) — **Customers can request an exchange instead of only a refund.** Returning an order could only result in a refund, so a customer who received the wrong size had to refund and buy again. A customer can now request an exchange from the order page — choosing the item to swap, the replacement, and a reason — and operators work those requests from a new Exchanges queue in the admin console, moving each one through approval, shipping the replacement, receiving the returned item, and closing it out. A customer can only request and view exchanges on their own orders. This release also updates the vendored blamejs runtime to v0.14.10. **Added:** *Order exchanges* — An order can now be exchanged, not just refunded. From the order page a customer requests an exchange — picking the line to return, the replacement variant, and a reason — and tracks its status under Exchanges in their account. Operators get an Exchanges queue in the admin console with a status filter and a per-exchange screen that offers only the actions valid at the current step: approve or reject the request, mark the replacement shipped and delivered, mark the returned item received, and close it once both sides are complete. Every customer-facing exchange action is scoped to the customer's own orders, and an order must be in a fulfilled state to be eligible. **Changed:** *Vendored blamejs runtime updated to v0.14.10* — The bundled blamejs runtime is updated to v0.14.10, which routes the framework's full-text-search index token hashing through a keyed MAC (HMAC-SHAKE256) instead of a static-salted digest, so an index token hash cannot be forged or correlated across deployments without the per-deployment key. The change is internal to the runtime and requires no operator action.

package/lib/admin.js

@@ -510,6 +510,7 @@ function mount(router, deps) {
   var salesTaxFilings = deps.salesTaxFilings || null; // sales-tax-filing remittance console disabled when absent
   var supportTickets  = deps.supportTickets  || null; // support-ticket queue + thread console disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
+  var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -517,7 +518,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4932,6 +4933,117 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- pre-orders -----------------------------------------------------
+  // Campaigns that take reservations against a SKU that isn't released yet.
+  // The lifecycle is draft-free: defineCampaign opens an `active` campaign,
+  // launchCampaign converts every active reservation into a regular order
+  // (via the shared order handle wired into the primitive) and flips the
+  // campaign to `launched`, closeCampaign terminates it without launching.
+  // A reservation is intent, not a charge — the convert step at launch is
+  // what produces the order the customer then pays through normal checkout.
+  // Content-negotiated like the other console screens: bearer → the JSON
+  // contract; signed-in browser → the HTML table + create form + lifecycle
+  // actions. The launch action is calendar-gated by the primitive (it
+  // refuses `now < launch_at`), so the console surfaces the launch button
+  // only once the release date has arrived.
+  if (preorder) {
+    // Decorate each campaign row with its reserved/remaining counts (the
+    // availability read) so the table reads honestly without a second query
+    // per row in the renderer. One availability call per campaign; a read
+    // failure on a row degrades that row to null counts rather than 500-ing
+    // the screen.
+    async function _preorderRows() {
+      var campaigns = await preorder.listCampaigns();
+      for (var i = 0; i < campaigns.length; i += 1) {
+        try { campaigns[i].availability = await preorder.availability({ slug: campaigns[i].slug }); }
+        catch (_e) { campaigns[i].availability = null; }
+      }
+      return campaigns;
+    }
+
+    router.get("/admin/preorders", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await preorder.listCampaigns() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var ok = url && url.searchParams.get("ok");
+        var noticeKey = url && url.searchParams.get("err");
+        _sendHtml(res, 200, renderAdminPreorders({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          campaigns: await _preorderRows(),
+          ok:        ok,
+          notice:    noticeKey ? "That action couldn't be completed for the campaign." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/preorders", _pageOrApi(false,
+      W("preorder.define", async function (req, res) {
+        var row = await preorder.defineCampaign(_preorderFromForm(req.body || {}));
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await preorder.defineCampaign(_preorderFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "preorder.define");
+          return _sendHtml(res, n.status, renderAdminPreorders({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            campaigns: await _preorderRows(),
+            notice: n.message.replace(/^preorder[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.define", outcome: "success" });
+        _redirect(res, "/admin/preorders?ok=created");
+      },
+    ));
+
+    // Launch — convert every active reservation into a regular order and flip
+    // the campaign to `launched`. The primitive composes the shared order
+    // handle (wired in server.js) so each converted reservation lands a real
+    // order the customer pays through normal checkout; the response reports
+    // how many converted. Calendar-gated: a launch before launch_at is a clean
+    // 400 (browser → ?err=1). A bearer client gets the conversion summary.
+    router.post("/admin/preorders/:slug/launch", _pageOrApi(false,
+      W("preorder.launch", async function (req, res) {
+        var result;
+        try { result = await preorder.launchCampaign({ slug: req.params.slug, now: Date.now() }); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, result);
+        return { id: req.params.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await preorder.launchCampaign({ slug: slug, now: Date.now() }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/preorders?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.launch", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/preorders?ok=launched");
+      },
+    ));
+
+    // Close — terminate the campaign without launching (the fab batch fell
+    // through). Reservations stay `active` so the operator can refund deposits
+    // through the order/refund surface, then cancel them explicitly.
+    router.post("/admin/preorders/:slug/close", _pageOrApi(false,
+      W("preorder.close", async function (req, res) {
+        var row;
+        try { row = await preorder.closeCampaign({ slug: req.params.slug, reason: (req.body || {}).reason || "" }); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: req.params.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await preorder.closeCampaign({ slug: slug, reason: (req.body || {}).reason || "" }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/preorders?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".preorder.close", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/preorders?ok=closed");
+      },
+    ));
+  }
+
   // ---- blog -----------------------------------------------------------
   // Author the operator's editorial blog. The edge Worker serves the
   // customer-facing /blog index + /blog/:slug posts + the RSS feed,
@@ -8978,6 +9090,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
+  { key: "preorders",    href: "/admin/preorders",    label: "Pre-orders",   requires: "preorder" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
   { key: "discounts",    href: "/admin/discounts",    label: "Discounts",    requires: "autoDiscount" },
   { key: "discount-allocation", href: "/admin/discount-allocation", label: "Discount splits", requires: "discountAllocation" },
@@ -12463,6 +12576,41 @@ function _announcementPatchFromForm(body) {
   return patch;
 }
 
+// Coerce the create form into the shape preorder.defineCampaign expects.
+// Prices are entered + stored in MINOR units (cents) — the form labels say
+// so, and the JSON API uses minor units too. The launch date is a
+// datetime-local string parsed to epoch ms. A blank cap maps to null
+// (unlimited). The primitive is authoritative on every range
+// (deposit <= full price, non-negative integers, ISO 4217 currency, slug /
+// sku shape) and throws a TypeError on a bad shape, which both surfaces
+// degrade to a clean 400 / err notice. A blank numeric field is left as the
+// empty string so the primitive's validator (not this coercion) is the one
+// that reports it.
+function _preorderIntOrNull(v) {
+  if (v == null || v === "") return null;
+  var n = Number(v);
+  return Number.isInteger(n) ? n : v;   // a non-integer passes through for the primitive to reject
+}
+function _preorderFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:             typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    sku:              typeof body.sku === "string" ? body.sku.trim() : body.sku,
+    launch_at:        _epochFromForm(body.launch_at),
+    full_price_minor: _preorderIntOrNull(body.full_price_minor),
+    currency:         typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+  };
+  // Optional fields — only forward when supplied so the primitive applies its
+  // defaults (deposit 0, charge_at = launch_at, unlimited cap, empty copy).
+  var cap = _preorderIntOrNull(body.max_units_available);
+  if (body.max_units_available != null && body.max_units_available !== "") out.max_units_available = cap;
+  if (body.deposit_minor != null && body.deposit_minor !== "") out.deposit_minor = _preorderIntOrNull(body.deposit_minor);
+  var chargeAt = _epochFromForm(body.charge_at);
+  if (chargeAt != null) out.charge_at = chargeAt;
+  if (typeof body.marketing_copy === "string" && body.marketing_copy.trim()) out.marketing_copy = body.marketing_copy.trim();
+  return out;
+}
+
 // epoch ms → the <datetime-local> value an <input> renders back. Returns
 // "" for a null/absent bound so the field stays empty (open-ended).
 function _datetimeLocalValue(epochMs) {
@@ -12599,6 +12747,95 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// Pre-order campaign console — the list table (status + reserved/available
+// counts + release date), the lifecycle actions (launch once the release date
+// has arrived, close any time), and the create form. The launch button only
+// renders for an `active` campaign whose launch_at has passed (the primitive
+// refuses an early launch, so showing the button before then would just
+// bounce back with an error); close renders for any `active` campaign.
+function renderAdminPreorders(opts) {
+  opts = opts || {};
+  var rows = opts.campaigns || [];
+  var okKind = opts.ok;
+  var okCopy = okKind === "created"  ? "Pre-order campaign created."
+             : okKind === "launched" ? "Campaign launched — active reservations converted to orders."
+             : okKind === "closed"   ? "Campaign closed."
+             : "";
+  var okBanner = okCopy ? "<div class=\"banner banner--ok\">" + _htmlEscape(okCopy) + "</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var now = Date.now();
+  function _money(minor, currency) {
+    try { return pricing.format(Number(minor), String(currency || "USD")); }
+    catch (_e) { return String(minor); }
+  }
+  function _date(epochMs) {
+    if (epochMs == null) return "—";
+    var d = new Date(Number(epochMs));
+    return isNaN(d.getTime()) ? "—" : d.toISOString().slice(0, 10);
+  }
+
+  var bodyRows = rows.map(function (c) {
+    var av = c.availability || null;
+    var reserved = av != null ? av.units_reserved : c.units_reserved;
+    var cap = c.max_units_available == null ? "∞" : String(c.max_units_available);
+    var remaining = c.max_units_available == null ? "∞"
+      : String(av != null ? av.remaining_units : (Number(c.max_units_available) - Number(c.units_reserved)));
+    var isActive = c.status === "active";
+    var canLaunch = isActive && Number(c.launch_at) <= now;
+    var enc = _htmlEscape(encodeURIComponent(c.slug));
+    var actions = "";
+    if (isActive) {
+      if (canLaunch) {
+        actions +=
+          "<form method=\"post\" action=\"/admin/preorders/" + enc + "/launch\" class=\"form-inline\">" +
+            "<button class=\"btn\" type=\"submit\">Launch &amp; convert</button></form> ";
+      }
+      actions +=
+        "<form method=\"post\" action=\"/admin/preorders/" + enc + "/close\" class=\"form-inline\">" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Close</button></form>";
+    }
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(c.slug) + "</code></td>" +
+      "<td><code>" + _htmlEscape(c.sku) + "</code></td>" +
+      "<td>" + _htmlEscape(_date(c.launch_at)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(_money(c.full_price_minor, c.currency)) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(String(reserved)) + " / " + _htmlEscape(cap) + "</td>" +
+      "<td class=\"num\">" + _htmlEscape(remaining) + "</td>" +
+      "<td><span class=\"status-pill " + (c.status === "active" ? "paid" : c.status === "launched" ? "fulfilled" : "cancelled") + "\">" + _htmlEscape(c.status) + "</span></td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr>" +
+        "<th scope=\"col\">Slug</th><th scope=\"col\">SKU</th><th scope=\"col\">Ships</th>" +
+        "<th scope=\"col\">Price</th><th scope=\"col\">Reserved / cap</th><th scope=\"col\">Remaining</th>" +
+        "<th scope=\"col\">Status</th><th scope=\"col\">Actions</th>" +
+      "</tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No pre-order campaigns yet.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Open a pre-order campaign</h3>" +
+      "<p class=\"meta\">A reservation is intent, not a charge — at launch every active reservation converts to a regular order the customer pays through checkout. Prices are in minor units (cents). Leave the cap blank for unlimited.</p>" +
+      "<form method=\"post\" action=\"/admin/preorders\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id + the URL slug.", " maxlength=\"128\" required") +
+        _setupField("SKU", "sku", "", "text", "The variant SKU this campaign reserves against.", " maxlength=\"128\" required") +
+        _setupField("Release date", "launch_at", "", "datetime-local", "When the campaign converts reservations to orders.", " required") +
+        _setupField("Full price (minor units)", "full_price_minor", "", "number", "e.g. 4999 = $49.99. The locked-in unit price on the order line.", " min=\"0\" step=\"1\" required") +
+        _setupField("Deposit (minor units, optional)", "deposit_minor", "", "number", "Partial payment collected at reservation. Blank = no deposit.", " min=\"0\" step=\"1\"") +
+        _setupField("Reservation cap (optional)", "max_units_available", "", "number", "Caps reservations against a known batch. Blank = unlimited.", " min=\"0\" step=\"1\"") +
+        _setupField("Currency", "currency", "USD", "text", "3-letter ISO 4217 code.", " maxlength=\"3\" class=\"input-code\" required") +
+        "<label class=\"form-field\"><span>Marketing copy (optional)</span><textarea name=\"marketing_copy\" maxlength=\"2000\"></textarea></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Open campaign</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Pre-orders</h2>" + okBanner + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pre-orders", bodyHtml, "preorders", opts.nav_available);
+}
+
 // ---- blog form coercion + render --------------------------------------
 
 // A comma- or newline-separated tag field → the normalized string array

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.37",
+  "version": "0.3.39",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/customers.js

@@ -255,20 +255,27 @@ function create(opts) {
         }
       }
       var sql, params;
+      // Fetch one row beyond the page so the next cursor is emitted ONLY
+      // when a customer past this page actually exists. Keying the cursor
+      // off a full page alone (rows.length === limit) advertises a
+      // phantom next page when the roster size is an exact multiple of
+      // the limit — the console's "Next page" link then lands empty.
       if (cursorVals) {
         sql = "SELECT id, email_hash, display_name, created_at, updated_at FROM customers " +
               "WHERE (created_at < ?1 OR (created_at = ?1 AND id < ?2)) " +
               "ORDER BY created_at DESC, id DESC LIMIT ?3";
-        params = [cursorVals[0], cursorVals[1], limit];
+        params = [cursorVals[0], cursorVals[1], limit + 1];
       } else {
         sql = "SELECT id, email_hash, display_name, created_at, updated_at FROM customers " +
               "ORDER BY created_at DESC, id DESC LIMIT ?1";
-        params = [limit];
+        params = [limit + 1];
       }
-      var rows = (await query(sql, params)).rows;
+      var fetched = (await query(sql, params)).rows;
+      var hasMore = fetched.length > limit;
+      var rows    = hasMore ? fetched.slice(0, limit) : fetched;
       var last = rows[rows.length - 1];
       var next = null;
-      if (last && rows.length === limit) {
+      if (last && hasMore) {
         next = b.pagination.encodeCursor({
           orderKey: CUSTOMERS_ORDER_KEY,
           vals:     [last.created_at, last.id],

package/lib/loyalty.js

@@ -450,11 +450,17 @@ function create(opts) {
         sql += " AND occurred_at < ?2";
         params.push(cursor);
       }
+      // Fetch one row beyond the page so the next cursor is emitted ONLY
+      // when an older transaction actually exists. Keying the cursor off
+      // a full page alone (rows.length === limit) advertises a phantom
+      // next page when the history length is an exact multiple of the
+      // limit — the "Older activity" link then lands on an empty page.
       sql += " ORDER BY occurred_at DESC LIMIT ?" + (params.length + 1);
-      params.push(limit);
+      params.push(limit + 1);
       var r = await query(sql, params);
-      var rows = r.rows;
-      var nextCursor = rows.length === limit ? rows[rows.length - 1].occurred_at : null;
+      var hasMore = r.rows.length > limit;
+      var rows = hasMore ? r.rows.slice(0, limit) : r.rows;
+      var nextCursor = hasMore ? rows[rows.length - 1].occurred_at : null;
       return { rows: rows, next_cursor: nextCursor };
     },
 

package/lib/order.js

@@ -412,19 +412,28 @@ function create(opts) {
         }
       }
       var sql, params;
+      // Fetch one row beyond the page so the next cursor is emitted ONLY
+      // when an order past this page actually exists. Keying the cursor
+      // off a full page alone (rows.length === limit) advertises a
+      // phantom next page when the customer's order count is an exact
+      // multiple of the limit — the "Load more" link then lands on an
+      // empty page.
       if (cursorVals) {
         sql = "SELECT * FROM orders WHERE customer_id = ?1 AND " +
               "(updated_at < ?2 OR (updated_at = ?2 AND id < ?3)) " +
               "ORDER BY updated_at DESC, id DESC LIMIT ?4";
-        params = [customerId, cursorVals[0], cursorVals[1], limit];
+        params = [customerId, cursorVals[0], cursorVals[1], limit + 1];
       } else {
         sql = "SELECT * FROM orders WHERE customer_id = ?1 " +
               "ORDER BY updated_at DESC, id DESC LIMIT ?2";
-        params = [customerId, limit];
+        params = [customerId, limit + 1];
       }
-      var rows = (await query(sql, params)).rows;
+      var fetched = (await query(sql, params)).rows;
+      var hasMore = fetched.length > limit;
+      var rows    = hasMore ? fetched.slice(0, limit) : fetched;
       // Hydrate ship_to_json + lines on each row so the renderer
-      // doesn't need a separate trip per order.
+      // doesn't need a separate trip per order. The peeked row is sliced
+      // off first so it never costs a hydration trip.
       for (var i = 0; i < rows.length; i += 1) {
         rows[i].ship_to = JSON.parse(rows[i].ship_to_json);
         rows[i].lines   = (await query(
@@ -434,7 +443,7 @@ function create(opts) {
       }
       var last = rows[rows.length - 1];
       var next = null;
-      if (last && rows.length === limit) {
+      if (last && hasMore) {
         next = b.pagination.encodeCursor({
           orderKey: ORDER_ORDER_KEY,
           vals:     [last.updated_at, last.id],

package/lib/preorder.js

@@ -316,6 +316,35 @@ function create(opts) {
       return await _getCampaign(slug);
     },
 
+    // The OPEN campaign for a SKU, or null. Drives the storefront PDP's
+    // pre-order CTA: a not-yet-released SKU isn't in the catalog as a buyable
+    // variant, so the page keys the reservation affordance off this read.
+    // Returns at most one row — the most recently updated active campaign when
+    // more than one names the SKU. Mirrors the edge read
+    // (worker/data/catalog.js#getOpenPreorderForSku) so the dual-rendered CTA
+    // resolves the same campaign in both substrates.
+    openCampaignForSku: async function (sku) {
+      _sku(sku);
+      var r = await query(
+        "SELECT * FROM preorder_campaigns WHERE sku = ?1 AND status = 'active' " +
+        "ORDER BY updated_at DESC, slug DESC LIMIT 1",
+        [sku],
+      );
+      return r.rows[0] || null;
+    },
+
+    // Operator-facing campaign list for the admin console. Newest-defined
+    // first (created_at DESC, slug DESC tiebreak). A pure read — no cursor;
+    // the console shows the full set (an operator runs tens of campaigns, not
+    // thousands).
+    listCampaigns: async function () {
+      var r = await query(
+        "SELECT * FROM preorder_campaigns ORDER BY created_at DESC, slug DESC",
+        [],
+      );
+      return r.rows;
+    },
+
     // Customer-driven reserve. Refuses when:
     //   - the campaign doesn't exist / isn't active
     //   - the requested quantity would push units_reserved past the

package/lib/store-credit.js

@@ -331,11 +331,17 @@ function create(opts) {
         sql += " AND occurred_at < ?2";
         params.push(cursor);
       }
+      // Fetch one row beyond the page so the next cursor is emitted ONLY
+      // when an older ledger entry actually exists. Keying the cursor off
+      // a full page alone (rows.length === limit) advertises a phantom
+      // next page when the ledger length is an exact multiple of the
+      // limit — the "Older activity" link then lands on an empty page.
       sql += " ORDER BY occurred_at DESC, id DESC LIMIT ?" + (params.length + 1);
-      params.push(limit);
+      params.push(limit + 1);
       var r = await query(sql, params);
-      var rows = r.rows;
-      var nextCursor = rows.length === limit ? rows[rows.length - 1].occurred_at : null;
+      var hasMore = r.rows.length > limit;
+      var rows = hasMore ? r.rows.slice(0, limit) : r.rows;
+      var nextCursor = hasMore ? rows[rows.length - 1].occurred_at : null;
       return { rows: rows, next_cursor: nextCursor };
     },
 

package/lib/storefront.js

@@ -1944,6 +1944,115 @@ function _pdpShippingNote(availability) {
          "See our <a href=\"/terms\">shipping &amp; returns policy</a>.</p>";
 }
 
+// Pre-order CTA — replaces the add-to-cart buy box on a PDP whose lead SKU
+// has an OPEN pre-order campaign (a SKU that isn't released yet, so it's not
+// normally purchasable). `preorder` is the resolved shape the route loads:
+//   { product_slug, release_date_iso, remaining_units (null = unlimited),
+//     full_price_str, deposit_str (null when no deposit), sold_out,
+//     reserve_form }
+// A reservation is INTENT, not a charge — the form POSTs to the container
+// /products/:slug/preorder route, which pins the reservation to the signed-in
+// session customer and converts it into a regular (Stripe-gated) order at
+// launch. The reserve POST is CSRF-protected + auth-gated, so the POST FORM is
+// rendered ONLY by the container (where the per-request `_csrf` token is
+// injected): `reserve_form` is true on the container render, false on the edge.
+// The edge render shows the same pre-order info + a sign-in affordance instead
+// of a token-less form — a logged-in customer's session-cookie request skips
+// the edge cache and routes to the container, so they always reach the real
+// (tokened) form; an anonymous edge visitor can't reserve anyway (the route
+// 303s guests to login). This mirrors how cart-count / session chrome is
+// handled on edge-cached pages. The non-form parts stay byte-identical to the
+// edge builder. A sold-out campaign renders a disabled control + an honest
+// note, mirroring the out-of-stock add control.
+function _buildPreorderCta(preorder, escAttr) {
+  var soldOut = !!preorder.sold_out;
+  var remaining = preorder.remaining_units;
+  var availLine = remaining == null
+    ? "<p class=\"pdp__preorder-avail\" role=\"status\">Open for pre-order.</p>"
+    : (remaining > 0
+        ? "<p class=\"pdp__preorder-avail\" role=\"status\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> " + escAttr(String(remaining)) + " of " + escAttr(String(preorder.max_units_available)) + " reservations remaining.</p>"
+        : "<p class=\"pdp__preorder-avail\" role=\"status\">All reservations are spoken for.</p>");
+  var depositLine = preorder.deposit_str
+    ? "<p class=\"pdp__preorder-deposit\">Reserve with a " + escAttr(preorder.deposit_str) + " deposit · " + escAttr(preorder.full_price_str) + " total at launch.</p>"
+    : "<p class=\"pdp__preorder-deposit\">No payment due now · " + escAttr(preorder.full_price_str) + " charged when it ships.</p>";
+  var head =
+    "<div class=\"pdp__buybox pdp__buybox--preorder\">\n" +
+    "        <p class=\"pdp__badge pdp__badge--preorder\">Pre-order · ships " + escAttr(preorder.release_date_iso) + "</p>\n" +
+    "        <p class=\"featured-product__price\">" + escAttr(preorder.full_price_str) + "</p>\n" +
+    "        " + availLine + "\n" +
+    "        " + depositLine + "\n";
+  // Sold-out: the same disabled control in both substrates (no POST either way).
+  if (soldOut) {
+    return head +
+           "        <button type=\"submit\" class=\"btn-primary cart-page__checkout\" disabled aria-disabled=\"true\">Pre-orders full</button>\n" +
+           "        <p class=\"pdp__soldout-note\" role=\"status\">Every pre-order reservation has been claimed.</p>\n" +
+           "      </div>";
+  }
+  if (!preorder.reserve_form) {
+    // Edge render — no per-session CSRF token here, so render a sign-in
+    // affordance instead of a token-less POST form. A signed-in customer's
+    // request skips the edge cache and gets the container form below.
+    return head +
+           "        <a class=\"btn-primary cart-page__checkout\" href=\"/account/login\">Sign in to reserve</a>\n" +
+           "        <p class=\"pdp__preorder-note\">A reservation holds your unit. We charge through secure checkout when it launches.</p>\n" +
+           "      </div>";
+  }
+  return head +
+         "        <form method=\"post\" action=\"/products/" + escAttr(preorder.product_slug) + "/preorder\">\n" +
+         "          <label class=\"pdp__variants-title\" for=\"preorder-qty\">Quantity</label>\n" +
+         "          <input id=\"preorder-qty\" type=\"number\" name=\"qty\" value=\"1\" min=\"1\" max=\"99\" class=\"variant-row__qty\" aria-label=\"Quantity\">\n" +
+         "          <button type=\"submit\" class=\"btn-primary cart-page__checkout\">Reserve your pre-order</button>\n" +
+         "          <p class=\"pdp__preorder-note\">A reservation holds your unit. We charge through secure checkout when it launches.</p>\n" +
+         "        </form>\n" +
+         "      </div>";
+}
+
+// Build the renderProduct `preorder` opts shape from a campaign row + the
+// primitive's `availability` read + a price formatter. Returns null unless the
+// campaign is OPEN (status 'active') — a launched / closed campaign is no
+// longer reservable, so its PDP renders the standard buy box. Shared so the
+// container route + the edge handler derive the identical shape and the
+// dual-rendered CTA stays byte-consistent. `fmt(minor, currency)` is the
+// page's price formatter; `slug` is the product (URL) slug the reserve form
+// posts to.
+function preorderCtaShape(campaign, availability, fmt, slug) {
+  if (!campaign || campaign.status !== "active") return null;
+  var remaining = availability ? availability.remaining_units : null;
+  var max = campaign.max_units_available == null ? null : campaign.max_units_available;
+  var deposit = Number(campaign.deposit_minor) || 0;
+  return {
+    product_slug:        slug,
+    release_date_iso:    new Date(Number(campaign.launch_at)).toISOString().slice(0, 10),
+    remaining_units:     remaining,
+    max_units_available: max,
+    full_price_str:      fmt(campaign.full_price_minor, campaign.currency),
+    deposit_str:         deposit > 0 ? fmt(deposit, campaign.currency) : null,
+    sold_out:            remaining != null && remaining <= 0,
+    // The container injects the per-request `_csrf` token into POST forms, so
+    // the container render carries the real reserve form. The edge twin
+    // (worker/render/product.js#preorderCtaShape) sets this false and renders a
+    // sign-in affordance — see _buildPreorderCta.
+    reserve_form:        true,
+  };
+}
+
+// The reserve-PRG banner, keyed off the closed ?preorder marker set so a
+// forged query can never inject copy. Empty string for an absent / unknown
+// marker. Mirrored byte-for-byte by worker/render/product.js#_buildPreorderNotice.
+var _PREORDER_NOTICES = {
+  reserved:    { kind: "ok",    copy: "Reserved. We'll email you when it ships and charge your card through secure checkout." },
+  unavailable: { kind: "error", copy: "This pre-order couldn't be reserved — it may be full or closed. Nothing was charged." },
+  closed:      { kind: "error", copy: "This pre-order is no longer open." },
+};
+function _buildPreorderNotice(marker) {
+  var n = marker && Object.prototype.hasOwnProperty.call(_PREORDER_NOTICES, marker)
+    ? _PREORDER_NOTICES[marker] : null;
+  if (!n) return "";
+  var cls = n.kind === "error" ? "form-notice form-notice--error" : "form-notice form-notice--ok";
+  var role = n.kind === "error" ? "alert" : "status";
+  return "<p class=\"" + cls + "\" role=\"" + role + "\">" + b.template.escapeHtml(n.copy) + "</p>\n      ";
+}
+
 var PRODUCT_PAGE =
   "<section class=\"pdp\">\n" +
   "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
@@ -4958,6 +5067,76 @@ function renderAccountSubscriptions(opts) {
   });
 }
 
+// The customer's pre-order reservations (`GET /account/preorders`). Each row
+// shows the campaign (the SKU's product context isn't loaded here — the
+// campaign slug + release date + status are the durable identity), its
+// release date, the reserved quantity, and the reservation status pill. An
+// ACTIVE reservation offers a Cancel control (ownership-scoped POST); a
+// converted (now an order) / cancelled reservation is read-only. `reservations`
+// rows are decorated with `.campaign` by the route. JS-off-native.
+function renderAccountPreorders(opts) {
+  var esc = b.template.escapeHtml;
+  var rows = opts.reservations || [];
+  var rowsHtml = "";
+  for (var i = 0; i < rows.length; i += 1) {
+    var r = rows[i];
+    var c = r.campaign || null;
+    var releaseStr = c && c.launch_at
+      ? new Date(Number(c.launch_at)).toISOString().slice(0, 10)
+      : "";
+    var priceStr = "";
+    if (c) {
+      try { priceStr = esc(pricing.format(Number(c.full_price_minor), String(c.currency || "USD"))) + " · "; }
+      catch (_e) { priceStr = ""; }
+    }
+    var status = String(r.status || "active");
+    var statusLabel = status === "converted" ? "Ordered" : status === "cancelled" ? "Canceled" : "Reserved";
+    var releaseLine = releaseStr
+      ? "Ships <time datetime=\"" + esc(releaseStr) + "\">" + esc(releaseStr) + "</time>"
+      : "";
+    var cancelControl = status === "active"
+      ? "<form class=\"preorder-card__control\" method=\"post\" action=\"/account/preorders/" + esc(String(r.id)) + "/cancel\">" +
+          "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Cancel reservation</button>" +
+        "</form>"
+      : "";
+    rowsHtml +=
+      "<li class=\"preorder-card preorder-card--" + esc(status) + "\">" +
+        "<div class=\"preorder-card__head\">" +
+          "<span class=\"preorder-card__title\">" + esc(c ? String(c.slug) : String(r.campaign_slug)) + "</span>" +
+          "<span class=\"status-pill preorder-status--" + esc(status) + "\">" + esc(statusLabel) + "</span>" +
+        "</div>" +
+        "<p class=\"preorder-card__meta\">" + priceStr + "Qty " + esc(String(r.quantity)) + (releaseLine ? " · " + releaseLine : "") + "</p>" +
+        cancelControl +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"preorder-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">You have no pre-order reservations.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
+  var noticeHtml = opts.notice
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var body =
+    "<section class=\"account-preorders\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Pre-orders</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-preorders__title\">Pre-orders</h1>" +
+      noticeHtml +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      "Pre-orders",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Server-rendered confirmation step for canceling a subscription. CSP
 // forbids an inline confirm() dialog, so the destructive choice is gated
 // by this page: it spells out the period-end date and, for the
@@ -5198,7 +5377,25 @@ function renderProduct(opts) {
   // loads ({ sku: { stock_on_hand, stock_held } }); absent it, the
   // product reads as in stock (never-block-on-missing-inventory stance).
   var availability = _resolveAvailability(variants, opts.inventory);
-  var buyboxHtml = _buildBuyBox(rendered, b.template.escapeHtml, availability);
+  // An OPEN pre-order campaign for the lead SKU swaps the add-to-cart buy box
+  // for the reservation CTA — a not-yet-released SKU isn't normally
+  // purchasable, so the only honest action is to reserve a unit. The route
+  // threads `opts.preorder_campaign` ({ campaign, remaining_units }) from a
+  // live D1 read; the shape is built here with the page's own `fmt` so the
+  // CTA's prices track the active currency context exactly as the buy-box
+  // prices do, and the container + edge render byte-identically. Absent a
+  // campaign (or a non-active one), the standard buy box renders unchanged.
+  var preorderShape = opts.preorder_campaign
+    ? preorderCtaShape(opts.preorder_campaign.campaign, { remaining_units: opts.preorder_campaign.remaining_units }, fmt, opts.product.slug)
+    : null;
+  var buyboxHtml = preorderShape
+    ? _buildPreorderCta(preorderShape, b.template.escapeHtml)
+    : _buildBuyBox(rendered, b.template.escapeHtml, availability);
+  // The reserve PRG lands the shopper back on the PDP with a fixed
+  // ?preorder=<reserved|unavailable|closed> marker; the banner prepends the
+  // buy box. The marker set is closed (built from a lookup, never the raw
+  // query), so a forged query can't inject copy. Mirrored at the edge.
+  buyboxHtml = _buildPreorderNotice(opts.preorder_notice) + buyboxHtml;
   var availabilityHtml = _buildAvailability(availability);
   var shippingNoteHtml = _pdpShippingNote(availability);
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
@@ -7253,6 +7450,7 @@ var ACCOUNT_DASH_PAGE =
   "      <a class=\"btn-secondary\" href=\"/account/credit\">Store credit</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/referrals\">Refer a friend</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/subscriptions\">Subscriptions</a>\n" +
+  "      RAW_PREORDER_LINK\n" +
   // begin: profile + passkey management actions
   "      <a class=\"btn-secondary\" href=\"/account/profile\">Edit profile</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/passkeys\">Manage passkeys</a>\n" +
@@ -7357,7 +7555,13 @@ function renderAccount(opts) {
     member_since:    memberSince,
     passkey_count:   String(passkeyCount),
     order_rows:      "RAW_ORDER_ROWS",
-  }).replace("RAW_ORDER_ROWS", rows);
+  }).replace("RAW_ORDER_ROWS", rows)
+    // The Pre-orders link only renders when the preorder primitive is wired
+    // (the /account/preorders route is mounted) — a deploy without it never
+    // links to a 404.
+    .replace("RAW_PREORDER_LINK", opts.preorders_enabled
+      ? "<a class=\"btn-secondary\" href=\"/account/preorders\">Pre-orders</a>"
+      : "");
   return _wrap({
     title:      "Account",
     shop_name:  opts.shop_name || "blamejs.shop",
@@ -7964,6 +8168,12 @@ function mount(router, deps) {
   // cancel route additionally needs the payment handle (cancel composes
   // Stripe via the primitive); without it the list stays read-only.
   var subscriptions = deps.subscriptions || null;
+  // Pre-order reservations — opts in the PDP reserve route + the
+  // /account/preorders surface. The PDP swaps the add-to-cart buy box for a
+  // reservation CTA when the lead SKU has an OPEN campaign; the reserve POST
+  // pins the reservation to the signed-in session customer (no charge — the
+  // launch flow converts the reservation into a Stripe-gated order).
+  var preorder = deps.preorder || null;
 
   // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
   // from the consent primitive per request so a runtime `policyVersion`
@@ -9482,10 +9692,32 @@ function mount(router, deps) {
     // mirrored at the edge). Best-effort inside the helper; an empty list
     // hides the rail.
     var related = await _relatedProductsFor(product.id, 4);
+    // Pre-order campaign for the lead SKU — when an OPEN campaign exists, the
+    // renderer swaps the add-to-cart buy box for the reservation CTA (release
+    // date + remaining availability). One indexed read; degrades to "no
+    // campaign" (the standard buy box) on a missing table / read failure so
+    // the buy path renders regardless. Mirrors the edge resolution so the
+    // dual-rendered CTA agrees across substrates.
+    var preorderCampaign = null;
+    if (deps.preorder && firstVariant) {
+      try {
+        var openCampaign = await deps.preorder.openCampaignForSku(firstVariant.sku);
+        if (openCampaign) {
+          var avail = await deps.preorder.availability({ slug: openCampaign.slug });
+          preorderCampaign = { campaign: openCampaign, remaining_units: avail ? avail.remaining_units : null };
+        }
+      } catch (_e) { preorderCampaign = null; }
+    }
+    // The reserve PRG lands here with a ?preorder=<marker> the renderer maps
+    // to a banner; only meaningful when a campaign is present.
+    var pdpUrl = req.url ? new URL(req.url, "http://localhost") : null;
+    var preorderNotice = pdpUrl ? pdpUrl.searchParams.get("preorder") : null;
     var html = renderProduct(Object.assign({
       product:        product,
       variants:       variants,
       prices:         prices,
+      preorder_campaign: preorderCampaign,
+      preorder_notice:   preorderNotice,
       media:          media,
       inventory:      inventory,
       review_summary: reviewSummary,
@@ -10836,6 +11068,7 @@ function mount(router, deps) {
         orders:                orders,
         order_product_lookup:  orderProductLookup,
         passkey_count:         passkeyCount,
+        preorders_enabled:     !!preorder,
         shop_name:             shopName,
         cart_count:            cartCount,
       }));
@@ -12798,6 +13031,165 @@ function mount(router, deps) {
       }
     }
 
+    // Pre-order reservations — the PDP reserve POST + the customer's
+    // /account/preorders surface (list + cancel). A reservation is INTENT, not
+    // a charge: reserve() writes a row pinned to the SIGNED-IN SESSION
+    // customer (never a body/query id) + decrements the campaign's capacity;
+    // the launch flow later converts it into a regular (Stripe-gated) order.
+    // Mounts only when the preorder primitive is wired.
+    if (preorder) {
+      function _preorderAuth(req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        return auth;
+      }
+
+      // Defensive request-shape reader for the reserve form's quantity. A
+      // missing / non-numeric / non-positive value defaults to 1 so a no-JS
+      // submit still reserves a unit; the primitive is authoritative on the
+      // cap (it refuses an over-cap quantity), and a >99 paste clamps to 99 to
+      // match the form's max attribute.
+      function _preorderQty(raw) {
+        var n = parseInt(String(raw == null ? "" : raw), 10);
+        if (!Number.isFinite(n) || n <= 0) return 1;
+        return n > 99 ? 99 : n;
+      }
+
+      // POST /products/:slug/preorder — reserve a unit of the lead SKU's OPEN
+      // campaign. Auth-gated; the reservation is pinned to the session
+      // customer (auth.customer_id), NEVER a body/query id. The campaign is
+      // resolved from the product's lead SKU (not a client-supplied slug), so
+      // a shopper can only reserve against the campaign the PDP actually
+      // shows. Over-cap / closed / missing campaign → a clean 4xx PRG back to
+      // the PDP with a fixed ?preorder error code (no raw error text).
+      router.post("/products/:slug/preorder", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var slug = req.params && req.params.slug;
+        var enc = encodeURIComponent(slug || "");
+        var product = slug ? await deps.catalog.products.bySlug(slug) : null;
+        if (!product) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        var variants = await deps.catalog.variants.listForProduct(product.id);
+        var lead = variants[0] || null;
+        // No lead variant, or no OPEN campaign for it → there's nothing
+        // reservable here; bounce to the PDP with the closed marker.
+        var campaign = null;
+        if (lead) {
+          try { campaign = await preorder.openCampaignForSku(lead.sku); }
+          catch (_e) { campaign = null; }
+        }
+        if (!campaign) {
+          res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=closed");
+          return res.end ? res.end() : res.send("");
+        }
+        var qty = _preorderQty((req.body || {}).qty);
+        try {
+          await preorder.reserve({
+            campaign_slug: campaign.slug,
+            customer_id:   auth.customer_id,
+            quantity:      qty,
+          });
+        } catch (e) {
+          // A capacity / closed-campaign / shape refusal is the customer's
+          // problem to see, not a 500 — map every TypeError to a fixed
+          // ?preorder error marker (the reason copy is rendered on the PDP,
+          // never the raw message). Anything else rethrows (a real 500).
+          if (!(e instanceof TypeError)) throw e;
+          res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=unavailable");
+          return res.end ? res.end() : res.send("");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/products/" + enc + "?preorder=reserved");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Load the reservation named in :id and confirm it belongs to the
+      // signed-in customer. A malformed id (guardUuid TypeError), a missing
+      // row, or another customer's reservation all return 404 after sending
+      // it — never a 500, never a cross-customer cancel. The reservation
+      // primitive cancels by id alone, so the route owns the ownership
+      // decision.
+      async function _ownedReservation(req, res, auth) {
+        var resv;
+        try { resv = await preorder.getReservation(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return null; }
+          throw e;
+        }
+        if (!resv || resv.customer_id !== auth.customer_id) {
+          _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+          return null;
+        }
+        return resv;
+      }
+
+      // The customer's reservations, decorated with each campaign's status +
+      // release date so the list reads "Operator Tee — ships 2026-09-01 —
+      // active". Campaigns are batched: one getCampaign per distinct slug,
+      // cached across rows. A read failure (table not migrated) degrades to an
+      // empty list rather than 500-ing the account page.
+      async function _preordersForCustomer(customerId) {
+        var rows;
+        try { rows = await preorder.reservationsForCustomer(customerId); }
+        catch (e) {
+          if (e instanceof TypeError) return [];
+          throw e;
+        }
+        var campaignCache = {};
+        for (var i = 0; i < rows.length; i += 1) {
+          var cslug = rows[i].campaign_slug;
+          if (cslug != null && !Object.prototype.hasOwnProperty.call(campaignCache, cslug)) {
+            try { campaignCache[cslug] = await preorder.getCampaign(cslug); }
+            catch (_e) { campaignCache[cslug] = null; }
+          }
+          rows[i].campaign = cslug != null ? campaignCache[cslug] : null;
+        }
+        return rows;
+      }
+
+      router.get("/account/preorders", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var rows = await _preordersForCustomer(auth.customer_id);
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var okKind = url ? url.searchParams.get("ok") : null;
+        var notice = okKind === "canceled" ? "Your pre-order reservation has been canceled." : null;
+        _send(res, 200, renderAccountPreorders({
+          reservations: rows,
+          notice:       notice,
+          shop_name:    shopName,
+          cart_count:   cartCount,
+        }));
+      });
+
+      // POST /account/preorders/:id/cancel — cancel the customer's own active
+      // reservation, freeing the held capacity. Ownership-scoped: a malformed
+      // / unknown / foreign reservation id 404s before any write. A
+      // non-active reservation (already converted / cancelled) is a clean PRG
+      // back to the list, not a 500.
+      router.post("/account/preorders/:id/cancel", async function (req, res) {
+        var auth = _preorderAuth(req, res); if (!auth) return;
+        var resv = await _ownedReservation(req, res, auth); if (!resv) return;
+        try {
+          await preorder.cancelReservation({ reservation_id: resv.id, reason: "customer-cancelled" });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          // Already converted/cancelled → nothing to do; bounce back clean.
+          res.status(303); res.setHeader && res.setHeader("location", "/account/preorders");
+          return res.end ? res.end() : res.send("");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/account/preorders?ok=canceled");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     // Self-serve returns — a customer requests an RMA against one of
     // their own orders and tracks its status. Operators action it via
     // the admin /admin/returns queue. Needs the returns primitive + an
@@ -14657,6 +15049,7 @@ module.exports = {
   renderHome:            renderHome,
   renderSearch:          renderSearch,
   renderProduct:         renderProduct,
+  preorderCtaShape:      preorderCtaShape,
   renderCollectionList:  renderCollectionList,
   renderCollection:      renderCollection,
   renderCategoryIndex:   renderCategoryIndex,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.37",
+  "version": "0.3.39",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {