@blamejs/blamejs-shop 0.3.51 → 0.3.53

package/lib/admin.js

@@ -35,6 +35,7 @@ var collectionsModule = require("./collections");
 var quantityDiscountsModule = require("./quantity-discounts");
 var loyaltyEarnRulesModule = require("./loyalty-earn-rules");
 var loyaltyRedemptionModule = require("./loyalty-redemption");
+var trustBadgesModule = require("./trust-badges");
 var textGuard = require("./text-guard");
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
@@ -514,7 +515,15 @@ function mount(router, deps) {
   var complianceExport = deps.complianceExport || null; // DSR queue (export/erasure) disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
   var orderRatings    = deps.orderRatings    || null; // per-order rating moderation queue (flag/clear + public reply) disabled when absent
+  var searchRanking   = deps.searchRanking   || null; // search-ranking weight-set + pin console disabled when absent
+  var trustBadges     = deps.trustBadges     || null; // trust-badge authoring console disabled when absent
   var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
+  // Read-only activity log at /admin/audit. Defaults ON — the framework
+  // audit chain is always booted by createApp, so the screen always has a
+  // data source (unlike the optional primitives above, which default off).
+  // An operator who wants the console surface minimized can pass
+  // `auditLog: false` to hide both the route and the nav link.
+  var auditLog        = deps.auditLog !== false;
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -522,7 +531,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -1739,6 +1748,72 @@ function mount(router, deps) {
     },
   ));
 
+  // ---- audit / activity log (read-only) -------------------------------
+  //
+  // A read-only window onto the framework's tamper-evident audit chain —
+  // every mutating admin action (`shop_admin.*`) and catalog-API error is
+  // recorded there. Container-only: it reads `b.audit.query`, which needs
+  // the booted framework DB, so there is no edge twin (and none is needed —
+  // the whole admin console is container-only). Defaults ON; hidden when an
+  // operator passes `auditLog: false`. No POST forms (read-only), so the
+  // shell's CSRF field injection is a no-op here. `b.audit.query` itself
+  // logs an `audit.read` row before each query, so opening this screen is
+  // forensically recorded.
+  //
+  // Request-shape reader → RETURN-DEFAULT discipline: bad query params are
+  // clamped / ignored, never thrown (a dashboard 500 on a fat-fingered URL
+  // is worse than showing all). An unrecognized ?outcome= falls back to
+  // no-filter with a notice, mirroring the orders bad-filter fallback.
+  var AUDIT_OUTCOMES = ["success", "failure", "denied"];
+  function _parseAuditQuery(req) {
+    var url = req.url ? new URL(req.url, "http://localhost") : null;
+    var q = {};
+    var notice = null;
+    var outcome = url && url.searchParams.get("outcome");
+    if (outcome) {
+      if (AUDIT_OUTCOMES.indexOf(outcome) !== -1) q.outcome = outcome;
+      else notice = "Unknown outcome filter — showing all.";
+    }
+    var action = url && url.searchParams.get("action");
+    if (typeof action === "string" && action.length) q.action = action.slice(0, 200);
+    var actorUserId = url && url.searchParams.get("actorUserId");
+    if (typeof actorUserId === "string" && actorUserId.length) q.actorUserId = actorUserId.slice(0, 200);
+    // limit: clamp to 1..200, default 50. offset: >= 0, default 0.
+    var limitN = parseInt((url && url.searchParams.get("limit")) || "", 10);
+    q.limit = (Number.isFinite(limitN) && limitN >= 1 && limitN <= 200) ? limitN : 50;
+    var offsetN = parseInt((url && url.searchParams.get("offset")) || "", 10);
+    q.offset = (Number.isFinite(offsetN) && offsetN >= 0) ? offsetN : 0;
+    q._page = Math.floor(q.offset / q.limit) + 1;
+    q._notice = notice;
+    return q;
+  }
+
+  if (auditLog) {
+    router.get("/admin/audit", _pageOrApi(true,
+      R(async function (req, res) {            // bearer → JSON
+        var q = _parseAuditQuery(req);
+        var rows = [];
+        try { rows = await b.audit.query(q); }
+        catch (_e) { rows = []; }
+        _json(res, 200, { rows: rows, page: q._page, limit: q.limit });
+      }),
+      async function (req, res) {              // browser cookie → HTML
+        var q = _parseAuditQuery(req);
+        var rows = [];
+        var notice = q._notice;
+        // Read-only observability view: ANY query failure (a malformed
+        // criterion, or an unavailable audit store) degrades to an empty
+        // table + notice, never a 500. Drop-silent by design.
+        try { rows = await b.audit.query(q); }
+        catch (_e) { rows = []; notice = notice || "The audit log is temporarily unavailable."; }
+        _sendHtml(res, 200, renderAdminAudit({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          rows: rows, filters: q, notice: notice,
+        }));
+      },
+    ));
+  }
+
   // ---- shipment tracking (operator-managed) ---------------------------
   //
   // Attach a shipment to an order (carrier + optional tracking number) and
@@ -5336,6 +5411,298 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- search ranking -------------------------------------------------
+  // Operator-tunable storefront search ranking: named weight sets (one
+  // active at a time), per-query manual pins, and a per-set metrics rollup.
+  // Content-negotiated like the other consoles (bearer → JSON, browser →
+  // HTML). The weight map is authored as a small JSON object validated
+  // server-side; coded errors (NOT_FOUND / ARCHIVED) map to 404 / 400 before
+  // the TypeError fallthrough, so a bad slug never 500s.
+  if (deps.searchRanking) {
+    var searchRankingApi = deps.searchRanking;
+
+    // Parse the `weights` JSON textarea into the flat signal->number map the
+    // primitive expects. A non-object / malformed JSON surfaces as a TypeError
+    // (caught by the route → _safeNotice 400) so the operator gets a clean
+    // re-render rather than a 500.
+    function _parseWeightsJson(raw) {
+      var s = typeof raw === "string" ? raw.trim() : "";
+      if (!s.length) throw new TypeError("weights must be a JSON object of signal -> number");
+      var parsed;
+      try { parsed = JSON.parse(s); }
+      catch (_e) { throw new TypeError("weights must be valid JSON (a flat object of signal -> number)"); }
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new TypeError("weights must be a JSON object, e.g. {\"relevance\":1,\"in_stock\":0.5}");
+      }
+      return parsed;
+    }
+
+    async function _searchRankingListData() {
+      var weights = await searchRankingApi.listWeights({ include_archived: true });
+      var active  = await searchRankingApi.activeWeights();
+      return { weights: weights, active: active };
+    }
+
+    router.get("/admin/search-ranking", _pageOrApi(true,
+      R(async function (req, res) {
+        var data = await _searchRankingListData();
+        _json(res, 200, { weights: data.weights, active: data.active ? data.active.slug : null });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var data = await _searchRankingListData();
+        // Optional pin manager for a query (?pins_query=...).
+        var pinsQuery = url && url.searchParams.get("pins_query");
+        var pins = [];
+        if (pinsQuery) {
+          try { pins = await searchRankingApi.pinsForQuery(pinsQuery); }
+          catch (_e) { pins = []; }
+        }
+        // Optional metrics rollup for a weight set (?metrics_slug=&from=&to=).
+        var metrics = null;
+        var metricsSlug = url && url.searchParams.get("metrics_slug");
+        if (metricsSlug) {
+          var fromMs = _searchRankingMsParam(url && url.searchParams.get("from"), Date.now() - b.constants.TIME.days(30));
+          var toMs   = _searchRankingMsParam(url && url.searchParams.get("to"), Date.now());
+          try { metrics = await searchRankingApi.metricsForWeights({ weights_slug: metricsSlug, from: fromMs, to: toMs }); }
+          catch (_e) { metrics = null; }
+        }
+        _sendHtml(res, 200, renderAdminSearchRanking({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          weights: data.weights, active: data.active,
+          pins_query: pinsQuery, pins: pins, metrics: metrics,
+          created:  url && url.searchParams.get("created"),
+          activated: url && url.searchParams.get("activated"),
+          archived: url && url.searchParams.get("archived"),
+          pinned:   url && url.searchParams.get("pinned"),
+          unpinned: url && url.searchParams.get("unpinned"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights", _pageOrApi(false,
+      W("search_ranking.define_weights", async function (req, res) {
+        var b2 = req.body || {};
+        var row = await searchRankingApi.defineWeights({ slug: b2.slug, name: b2.name, weights: _parseWeightsJson(b2.weights) });
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try {
+          await searchRankingApi.defineWeights({ slug: b2.slug, name: b2.name, weights: _parseWeightsJson(b2.weights) });
+        } catch (e) {
+          var n = _safeNotice(e, "search_ranking.define_weights");
+          var data = await _searchRankingListData();
+          return _sendHtml(res, n.status, renderAdminSearchRanking({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            weights: data.weights, active: data.active,
+            notice: n.message.replace(/^searchRanking[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.define_weights", outcome: "success", metadata: { slug: b2.slug } });
+        _redirect(res, "/admin/search-ranking?created=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights/:slug/activate", _pageOrApi(false,
+      W("search_ranking.activate_weights", async function (req, res) {
+        var row;
+        try { row = await searchRankingApi.setActiveWeights(req.params.slug); }
+        catch (e) {
+          if (e && e.code === "SEARCH_WEIGHTS_NOT_FOUND") return _problem(res, 404, "weights-not-found");
+          if (e && e.code === "SEARCH_WEIGHTS_ARCHIVED")  return _problem(res, 400, "weights-archived");
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await searchRankingApi.setActiveWeights(slug); }
+        catch (e) {
+          // Coded errors (NOT_FOUND / ARCHIVED) are Error with .code, NOT
+          // TypeError — check e.code first, then the TypeError fallthrough.
+          if (!(e && (e.code === "SEARCH_WEIGHTS_NOT_FOUND" || e.code === "SEARCH_WEIGHTS_ARCHIVED") || e instanceof TypeError)) throw e;
+          return _redirect(res, "/admin/search-ranking?err=1");
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.activate_weights", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/search-ranking?activated=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights/:slug/archive", _pageOrApi(false,
+      W("search_ranking.archive_weights", async function (req, res) {
+        var row;
+        try { row = await searchRankingApi.archiveWeights(req.params.slug); }
+        catch (e) {
+          if (e && e.code === "SEARCH_WEIGHTS_NOT_FOUND") return _problem(res, 404, "weights-not-found");
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await searchRankingApi.archiveWeights(slug); }
+        catch (e) { if (!(e && e.code === "SEARCH_WEIGHTS_NOT_FOUND" || e instanceof TypeError)) throw e; return _redirect(res, "/admin/search-ranking?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.archive_weights", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/search-ranking?archived=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/pins", _pageOrApi(false,
+      W("search_ranking.pin", async function (req, res) {
+        var b2 = req.body || {};
+        var row = await searchRankingApi.pinProductForQuery({
+          query: b2.query, product_id: b2.product_id, position: _searchRankingIntField(b2.position),
+        });
+        _json(res, 201, row);
+        return { id: (row && row.product_id) || null };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try {
+          await searchRankingApi.pinProductForQuery({
+            query: b2.query, product_id: b2.product_id, position: _searchRankingIntField(b2.position),
+          });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          return _redirect(res, "/admin/search-ranking?err=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.pin", outcome: "success" });
+        _redirect(res, "/admin/search-ranking?pinned=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+      },
+    ));
+
+    router.post("/admin/search-ranking/pins/delete", _pageOrApi(false,
+      W("search_ranking.unpin", async function (req, res) {
+        var b2 = req.body || {};
+        var result = await searchRankingApi.unpinProduct({ query: b2.query, product_id: b2.product_id });
+        _json(res, 200, result);
+        return { id: b2.product_id || null };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try { await searchRankingApi.unpinProduct({ query: b2.query, product_id: b2.product_id }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/search-ranking?err=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : "")); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.unpin", outcome: "success" });
+        _redirect(res, "/admin/search-ranking?unpinned=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+      },
+    ));
+  }
+
+  // ---- trust badges ---------------------------------------------------
+  // Operator-authored trust/certification badges. Create with EITHER an
+  // inline SVG payload (sanitized at define time through b.guardSvg — a
+  // hostile <script>/onload SVG refuses as a TypeError) OR a hosted https://
+  // image URL, plus placements, schedule, priority, alt text. The raw
+  // svg_payload is NEVER echoed into an admin HTML attribute — it's rendered
+  // inside a <textarea> (which escapes < and &) on the edit screen.
+  if (deps.trustBadges) {
+    var trustBadgesApi = deps.trustBadges;
+
+    async function _trustBadgesList() {
+      return await trustBadgesApi.listBadges({});
+    }
+
+    router.get("/admin/trust-badges", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await _trustBadgesList() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, renderAdminTrustBadges({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          badges: await _trustBadgesList(),
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the badge." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/trust-badges", _pageOrApi(false,
+      W("trust_badge.define", async function (req, res) {
+        var row = await trustBadgesApi.defineBadge(_trustBadgeFromForm(req.body || {}));
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await trustBadgesApi.defineBadge(_trustBadgeFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "trust_badge.define");
+          return _sendHtml(res, n.status, renderAdminTrustBadges({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            badges: await _trustBadgesList(),
+            notice: n.message.replace(/^trustBadges[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.define", outcome: "success" });
+        _redirect(res, "/admin/trust-badges?created=1");
+      },
+    ));
+
+    router.get("/admin/trust-badges/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await trustBadgesApi.getBadge(req.params.slug);
+        if (!row) return _problem(res, 404, "trust-badge-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row = await trustBadgesApi.getBadge(req.params.slug);
+        if (!row) return _sendHtml(res, 404, renderAdminTrustBadges({
+          shop_name: deps.shop_name, nav_available: navAvailable, badges: [], notice: "Badge not found.",
+        }));
+        _sendHtml(res, 200, renderAdminTrustBadge({
+          shop_name: deps.shop_name, nav_available: navAvailable, badge: row,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the badge." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/trust-badges/:slug/edit", _pageOrApi(false,
+      W("trust_badge.update", async function (req, res) {
+        var row;
+        try { row = await trustBadgesApi.updateBadge(req.params.slug, _trustBadgePatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        try { await trustBadgesApi.updateBadge(slug, _trustBadgePatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/trust-badges/" + enc + "?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/trust-badges/" + enc + "?updated=1");
+      },
+    ));
+
+    router.post("/admin/trust-badges/:slug/archive", _pageOrApi(false,
+      W("trust_badge.archive", async function (req, res) {
+        var row;
+        try { row = await trustBadgesApi.archiveBadge(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await trustBadgesApi.archiveBadge(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/trust-badges?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/trust-badges?archived=1");
+      },
+    ));
+  }
+
   // ---- pre-orders -----------------------------------------------------
   // Campaigns that take reservations against a SKU that isn't released yet.
   // The lifecycle is draft-free: defineCampaign opens an `active` campaign,
@@ -9901,6 +10268,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "inventory",    href: "/admin/inventory",    label: "Inventory" },
   { key: "orders",       href: "/admin/orders",       label: "Orders" },
   { key: "reports",      href: "/admin/reports",      label: "Reports" },
+  { key: "audit",        href: "/admin/audit",        label: "Audit",        requires: "auditLog" },
   { key: "exports",      href: "/admin/exports",      label: "Exports",      requires: "orderExport" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "segments",     href: "/admin/segments",     label: "Segments",     requires: "customerSegments" },
@@ -9909,6 +10277,8 @@ var ADMIN_NAV_ITEMS = [
   { key: "dsr",          href: "/admin/dsr",          label: "Privacy requests", requires: "complianceExport" },
   { key: "exchanges",    href: "/admin/exchanges",    label: "Exchanges",    requires: "orderExchanges" },
   { key: "ratings",      href: "/admin/ratings",      label: "Ratings",      requires: "orderRatings" },
+  { key: "search-ranking", href: "/admin/search-ranking", label: "Search ranking", requires: "searchRanking" },
+  { key: "trust-badges", href: "/admin/trust-badges", label: "Trust badges", requires: "trustBadges" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
@@ -10212,6 +10582,90 @@ function renderAdminOrders(opts) {
   return _renderAdminShell(opts.shop_name, "Orders", body, "orders", opts.nav_available);
 }
 
+// The outcomes an operator can filter the audit log by — drives the chips.
+var AUDIT_OUTCOME_FILTERS = ["success", "failure", "denied"];
+
+// Read-only activity log. Renders the framework audit rows (action, outcome,
+// actor, resource, truncated metadata) for the selected outcome filter, with
+// offset/limit paging.
+//
+// XSS-CRITICAL: audit rows carry operator-controlled action names and
+// ATTACKER-INFLUENCED free text — a bot-driven `actorUserAgent`, a caught
+// error's message folded into `metadata`, an attacker-chosen resource id.
+// EVERY cell value flows through `_htmlEscape` (escape-by-default). This
+// class is un-lintable (no detector can tell a render-concat apart from a
+// string-build), so the XSS-payload regression test is the guarantee — see
+// test/layer-2-integration/admin-audit-console.test.js.
+function renderAdminAudit(opts) {
+  opts = opts || {};
+  var rows = opts.rows || [];
+  var filters = opts.filters || {};
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var active = filters.outcome || null;
+  var limit  = filters.limit || 50;
+  var offset = filters.offset || 0;
+
+  // Preserve an active ?action= filter across the outcome chips + pager.
+  function _withParams(extra) {
+    var parts = [];
+    if (extra.outcome)     parts.push("outcome=" + encodeURIComponent(extra.outcome));
+    if (filters.action)    parts.push("action=" + encodeURIComponent(filters.action));
+    if (filters.actorUserId) parts.push("actorUserId=" + encodeURIComponent(filters.actorUserId));
+    if (extra.offset != null) parts.push("offset=" + encodeURIComponent(String(extra.offset)));
+    if (limit !== 50)      parts.push("limit=" + encodeURIComponent(String(limit)));
+    return "/admin/audit" + (parts.length ? "?" + parts.join("&") : "");
+  }
+
+  var chips = "<div class=\"order-filters\">" +
+    "<a class=\"chip" + (active ? "" : " chip--on") + "\" href=\"" + _htmlEscape(_withParams({})) + "\">All</a>" +
+    AUDIT_OUTCOME_FILTERS.map(function (o) {
+      return "<a class=\"chip" + (active === o ? " chip--on" : "") + "\" href=\"" + _htmlEscape(_withParams({ outcome: o })) + "\">" + _htmlEscape(o) + "</a>";
+    }).join("") +
+    "</div>";
+
+  var bodyRows = rows.map(function (row) {
+    // metadata is a JSON string (audit.record stores it as JSON.stringify);
+    // escape THEN truncate so a long redacted blob can't blow the row, and
+    // so a payload inside it is neutralized before it reaches the DOM.
+    var meta = row.metadata == null ? "" : String(row.metadata);
+    var metaEsc = _htmlEscape(meta.length > 120 ? meta.slice(0, 120) + "…" : meta);
+    var resource = "";
+    if (row.resourceKind || row.resourceId) {
+      resource = _htmlEscape(row.resourceKind || "") +
+        (row.resourceId ? " <code>" + _htmlEscape(row.resourceId) + "</code>" : "");
+    } else {
+      resource = "—";
+    }
+    return "<tr>" +
+      "<td>" + _htmlEscape(_fmtDate(row.recordedAt)) + "</td>" +
+      "<td><code>" + _htmlEscape(row.action) + "</code></td>" +
+      "<td><span class=\"status-pill " + _htmlEscape(row.outcome) + "\">" + _htmlEscape(row.outcome) + "</span></td>" +
+      "<td>" + _htmlEscape(row.actorUserId == null ? "—" : row.actorUserId) + "</td>" +
+      "<td>" + resource + "</td>" +
+      "<td class=\"audit-meta\">" + metaEsc + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Time</th><th scope=\"col\">Action</th><th scope=\"col\">Outcome</th><th scope=\"col\">Actor</th><th scope=\"col\">Resource</th><th scope=\"col\">Details</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No audit events match.</p>";
+
+  // Pager: Newer steps back one page (disabled at offset 0); Older steps
+  // forward (shown only when the page is full — the standard "there may be
+  // more" heuristic). Filters are preserved in both hrefs.
+  var prevOffset = Math.max(0, offset - limit);
+  var newer = offset > 0
+    ? "<a class=\"btn btn--ghost\" href=\"" + _htmlEscape(_withParams({ outcome: active, offset: prevOffset })) + "\">← Newer</a>"
+    : "<span class=\"btn btn--ghost\" aria-disabled=\"true\">← Newer</span>";
+  var older = rows.length === limit
+    ? "<a class=\"btn btn--ghost\" href=\"" + _htmlEscape(_withParams({ outcome: active, offset: offset + limit })) + "\">Older →</a>"
+    : "";
+  var pager = "<div class=\"order-filters\">" + newer + older + "</div>";
+
+  var body = "<section><h2>Audit log</h2>" + notice + chips + table + (rows.length || offset > 0 ? pager : "") + "</section>";
+  return _renderAdminShell(opts.shop_name, "Audit", body, "audit", opts.nav_available);
+}
+
 // epoch-ms → "YYYY-MM-DD" for a date <input>'s value. Mirrors `_fmtDate`'s
 // guard so a bad value never throws inside the template.
 function _dateInputValue(v) {
@@ -13929,6 +14383,98 @@ function _announcementPatchFromForm(body) {
   return patch;
 }
 
+// ---- search-ranking form coercion -----------------------------------
+
+// `?from`/`?to` ms-epoch query params for the metrics rollup → integer, or a
+// supplied fallback when blank/unparseable.
+function _searchRankingMsParam(v, fallback) {
+  if (v == null || v === "") return fallback;
+  var n = parseInt(v, 10);
+  return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+
+// A position form field → integer (the primitive validates the 1..MAX range +
+// throws a TypeError on a bad shape). A blank/non-numeric value is forwarded
+// as NaN so the primitive's validator (not this coercion) reports it.
+function _searchRankingIntField(v) {
+  if (v == null || v === "") return NaN;
+  var n = parseInt(v, 10);
+  return Number.isFinite(n) ? n : NaN;
+}
+
+// ---- trust-badge form coercion --------------------------------------
+
+// Read the placements multi-checkbox into a non-empty array. An HTML form
+// submits repeated `placements` fields as an array (when >1 checked) or a
+// single string (when exactly 1 checked). The primitive validates membership
+// + the 1..6 count + dedup, throwing a TypeError on a bad shape.
+function _trustBadgePlacements(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (typeof raw === "string" && raw.length) return [raw];
+  return [];   // empty → the primitive's _placements throws "non-empty array"
+}
+
+// Coerce the create form into the shape trustBadges.defineBadge expects.
+// EITHER svg_payload OR image_url (blank maps to absent so the primitive's
+// either/or rule applies). The primitive is authoritative on every field
+// (SVG sanitize via guardSvg, URL via safeUrl, slug/title/alt shape, priority
+// range, schedule monotonicity) and throws a TypeError on a bad shape, which
+// both surfaces degrade to a clean 400 / err notice.
+function _trustBadgeFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:       typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    title:      body.title,
+    alt_text:   body.alt_text,
+    placements: _trustBadgePlacements(body.placements),
+  };
+  var svg = typeof body.svg_payload === "string" ? body.svg_payload.trim() : "";
+  var img = typeof body.image_url === "string" ? body.image_url.trim() : "";
+  if (svg) out.svg_payload = svg;
+  if (img) out.image_url = img;
+  var link = typeof body.link_url === "string" ? body.link_url.trim() : "";
+  if (link) out.link_url = link;
+  if (body.priority != null && body.priority !== "") {
+    var p = parseInt(body.priority, 10);
+    out.priority = Number.isFinite(p) ? p : body.priority;
+  }
+  var sa = _epochFromForm(body.starts_at);  if (sa != null) out.starts_at = sa;
+  var ea = _epochFromForm(body.expires_at); if (ea != null) out.expires_at = ea;
+  return out;
+}
+
+// Coerce the edit form into an updateBadge patch. Each editable column rides
+// only when its hidden presence marker says so, so a partial edit doesn't
+// clear an unrelated column. The svg_payload / image_url pair is mutually
+// exclusive on the resulting row (the primitive enforces it); the edit form
+// only ever sends the column the badge already uses.
+function _trustBadgePatchFromForm(body) {
+  body = body || {};
+  var patch = {};
+  if (body.title != null && body.title !== "") patch.title = body.title;
+  if (body.alt_text != null && body.alt_text !== "") patch.alt_text = body.alt_text;
+  if (body.placements_present === "1") patch.placements = _trustBadgePlacements(body.placements);
+  if (body.svg_present === "1") {
+    var svg = typeof body.svg_payload === "string" ? body.svg_payload.trim() : "";
+    patch.svg_payload = svg ? svg : null;
+  }
+  if (body.image_present === "1") {
+    var img = typeof body.image_url === "string" ? body.image_url.trim() : "";
+    patch.image_url = img ? img : null;
+  }
+  if (body.link_present === "1") {
+    var link = typeof body.link_url === "string" ? body.link_url.trim() : "";
+    patch.link_url = link ? link : null;
+  }
+  if (body.priority != null && body.priority !== "") {
+    var p = parseInt(body.priority, 10);
+    patch.priority = Number.isFinite(p) ? p : body.priority;
+  }
+  if (body.starts_present === "1")  patch.starts_at  = _epochFromForm(body.starts_at);
+  if (body.expires_present === "1") patch.expires_at = _epochFromForm(body.expires_at);
+  return patch;
+}
+
 // Coerce the create form into the shape preorder.defineCampaign expects.
 // Prices are entered + stored in MINOR units (cents) — the form labels say
 // so, and the JSON API uses minor units too. The launch date is a
@@ -14100,6 +14646,237 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// Search-ranking console — the weight-set list (active flag + activate /
+// archive actions), the create form (slug + name + JSON weight map), the
+// per-query pin manager, and an optional per-set metrics rollup. Every
+// free-text value (name, query, product_id) is _htmlEscape'd before it lands
+// in raw HTML — the weight-set name + the pin query are the XSS-sensitive
+// operator strings (see the flow test's payload assertion).
+function renderAdminSearchRanking(opts) {
+  opts = opts || {};
+  var weights = opts.weights || [];
+  var active  = opts.active || null;
+  var banners = "";
+  if (opts.created)   banners += "<div class=\"banner banner--ok\">Weight set saved.</div>";
+  if (opts.activated) banners += "<div class=\"banner banner--ok\">Active weight set updated.</div>";
+  if (opts.archived)  banners += "<div class=\"banner banner--ok\">Weight set archived.</div>";
+  if (opts.pinned)    banners += "<div class=\"banner banner--ok\">Product pinned.</div>";
+  if (opts.unpinned)  banners += "<div class=\"banner banner--ok\">Pin removed.</div>";
+  if (opts.notice)    banners += "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>";
+
+  var rows = weights.map(function (w) {
+    var isArchived = w.archived_at != null;
+    var isActive   = w.active === true;
+    var weightStr;
+    try { weightStr = JSON.stringify(w.weights || {}); } catch (_e) { weightStr = "{}"; }
+    var actions = "";
+    if (!isArchived) {
+      if (!isActive) {
+        actions += "<form method=\"post\" action=\"/admin/search-ranking/weights/" + _htmlEscape(encodeURIComponent(w.slug)) + "/activate\" class=\"form-inline\">" +
+          "<button class=\"btn\" type=\"submit\">Make active</button></form> ";
+      }
+      actions += "<form method=\"post\" action=\"/admin/search-ranking/weights/" + _htmlEscape(encodeURIComponent(w.slug)) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+    }
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(w.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(w.name) + "</td>" +
+      "<td><code>" + _htmlEscape(weightStr) + "</code></td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : (isActive ? "paid" : "")) + "\">" +
+        (isArchived ? "archived" : (isActive ? "active" : "inactive")) + "</span></td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+  var table = weights.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Slug</th><th scope=\"col\">Name</th><th scope=\"col\">Weights</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No weight sets yet. Create one below and make it active to rerank storefront search.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create a weight set</h3>" +
+      "<p class=\"meta\">A weight set maps result signals to multipliers. Available signals on storefront results: <code>in_stock</code> (1 when any variant is in stock), <code>price_minor</code>. Score = sum(weight &times; signal); results sort by score descending.</p>" +
+      "<form method=\"post\" action=\"/admin/search-ranking/weights\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, e.g. in-stock-first — a stable id.", " maxlength=\"64\" required") +
+        _setupField("Name", "name", "", "text", "A human label for the console.", " maxlength=\"200\" required") +
+        "<label class=\"form-field\"><span>Weights (JSON)</span><textarea name=\"weights\" rows=\"4\" required>{&quot;in_stock&quot;:1}</textarea><small>A flat JSON object of signal &rarr; number, e.g. {&quot;in_stock&quot;:1,&quot;price_minor&quot;:-0.0001}.</small></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create weight set</button></div>" +
+      "</form>" +
+    "</div>";
+
+  // Per-query pin manager.
+  var pinsQuery = opts.pins_query;
+  var pins = opts.pins || [];
+  var pinRows = pins.map(function (p) {
+    return "<tr>" +
+      "<td><code>" + _htmlEscape(p.product_id) + "</code></td>" +
+      "<td>" + _htmlEscape(String(p.position)) + "</td>" +
+      "<td><form method=\"post\" action=\"/admin/search-ranking/pins/delete\" class=\"form-inline\">" +
+        "<input type=\"hidden\" name=\"query\" value=\"" + _htmlEscape(pinsQuery || "") + "\">" +
+        "<input type=\"hidden\" name=\"product_id\" value=\"" + _htmlEscape(p.product_id) + "\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Unpin</button></form></td>" +
+    "</tr>";
+  }).join("");
+  var pinLookupForm =
+    "<form method=\"get\" action=\"/admin/search-ranking\" class=\"form-inline\">" +
+      "<input type=\"text\" name=\"pins_query\" value=\"" + _htmlEscape(pinsQuery || "") + "\" placeholder=\"search query\" maxlength=\"500\">" +
+      "<button class=\"btn\" type=\"submit\">View pins</button>" +
+    "</form>";
+  var pinTable = pinsQuery
+    ? (pins.length
+        ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Product id</th><th scope=\"col\">Position</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + pinRows + "</tbody></table></div>"
+        : "<p class=\"empty\">No pins for &ldquo;" + _htmlEscape(pinsQuery) + "&rdquo; yet.</p>")
+    : "";
+  var pinCreateForm = pinsQuery
+    ? "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Pin a product</h3>" +
+        "<form method=\"post\" action=\"/admin/search-ranking/pins\">" +
+          "<input type=\"hidden\" name=\"query\" value=\"" + _htmlEscape(pinsQuery) + "\">" +
+          _setupField("Product id", "product_id", "", "text", "The product id (or upstream SKU) to pin.", " maxlength=\"128\" required") +
+          _setupField("Position", "position", "1", "number", "1 = top of the results for this query.", " min=\"1\" max=\"1000\" required") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Pin product</button></div>" +
+        "</form></div>"
+    : "";
+  var pinsSection =
+    "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Per-query pins</h3>" +
+      "<p class=\"meta\">Pin specific products to fixed positions for a search query. Pinned products lead the results regardless of their weighted score.</p>" +
+      pinLookupForm + "</div>" + pinTable + pinCreateForm;
+
+  // Optional metrics rollup.
+  var metrics = opts.metrics;
+  var metricsSection = "";
+  if (metrics) {
+    function _ratio(r) { return r == null ? "—" : (Math.round(r * 10000) / 100) + "%"; }
+    metricsSection =
+      "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Metrics — " + _htmlEscape(metrics.weights_slug) + "</h3>" +
+        "<dl class=\"totals-list\">" +
+          "<dt>Impressions</dt><dd>" + _htmlEscape(String(metrics.impressions)) + "</dd>" +
+          "<dt>Clicks</dt><dd>" + _htmlEscape(String(metrics.clicks)) + "</dd>" +
+          "<dt>Purchases</dt><dd>" + _htmlEscape(String(metrics.purchases)) + "</dd>" +
+          "<dt>CTR</dt><dd>" + _ratio(metrics.ctr) + "</dd>" +
+          "<dt>Conversion</dt><dd>" + _ratio(metrics.conversion_rate) + "</dd>" +
+          "<dt>Click&rarr;purchase</dt><dd>" + _ratio(metrics.click_to_purchase) + "</dd>" +
+        "</dl></div>";
+  }
+
+  var activeLine = active
+    ? "<p class=\"meta\">Active weight set: <strong>" + _htmlEscape(active.name) + "</strong> (<code>" + _htmlEscape(active.slug) + "</code>).</p>"
+    : "<p class=\"meta\">No active weight set — storefront search uses its default order.</p>";
+
+  var bodyHtml = "<section><h2>Search ranking</h2>" + banners + activeLine + table + createForm + pinsSection + metricsSection + "</section>";
+  return _renderAdminShell(opts.shop_name, "Search ranking", bodyHtml, "search-ranking", opts.nav_available);
+}
+
+// Trust-badge console — the badge list (placements + status + edit / archive
+// actions) and the create form (svg payload OR image url, link, placements,
+// schedule, priority, alt text). The raw svg_payload is NEVER echoed into an
+// admin attribute — it rides only inside a <textarea> on the edit screen
+// (which escapes < and &). title + alt_text are _htmlEscape'd in the list.
+function renderAdminTrustBadges(opts) {
+  opts = opts || {};
+  var badges = opts.badges || [];
+  var banners = "";
+  if (opts.created)  banners += "<div class=\"banner banner--ok\">Badge saved.</div>";
+  if (opts.archived) banners += "<div class=\"banner banner--ok\">Badge archived.</div>";
+  if (opts.notice)   banners += "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>";
+
+  var rows = badges.map(function (bd) {
+    var isArchived = bd.archived_at != null;
+    var kind = bd.svg_payload ? "SVG" : "image";
+    var placements = Array.isArray(bd.placements) ? bd.placements.join(", ") : "";
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(bd.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(bd.title) + "</td>" +
+      "<td>" + _htmlEscape(kind) + "</td>" +
+      "<td>" + _htmlEscape(placements) + "</td>" +
+      "<td>" + _htmlEscape(String(bd.priority)) + "</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        (isArchived ? "" :
+          "<a class=\"btn btn--ghost\" href=\"/admin/trust-badges/" + _htmlEscape(encodeURIComponent(bd.slug)) + "\">Edit</a> " +
+          "<form method=\"post\" action=\"/admin/trust-badges/" + _htmlEscape(encodeURIComponent(bd.slug)) + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+  var table = badges.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Slug</th><th scope=\"col\">Title</th><th scope=\"col\">Kind</th><th scope=\"col\">Placements</th><th scope=\"col\">Priority</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No trust badges yet. Create one below.</p>";
+
+  var placementChecks = trustBadgesModule.ALLOWED_PLACEMENTS.map(function (pl) {
+    var live = pl === "checkout" || pl === "order_confirmation";
+    return "<label class=\"kv\"><input type=\"checkbox\" name=\"placements\" value=\"" + pl + "\"" + (live ? " checked" : "") + "> " +
+      _htmlEscape(pl) + (live ? "" : " (not yet rendered)") + "</label>";
+  }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create a trust badge</h3>" +
+      "<p class=\"meta\">Supply EITHER an inline SVG payload OR a hosted https:// image URL (not both). Badges render today at the <strong>checkout</strong> and <strong>order confirmation</strong> placements; the other placements are accepted now and will render in a later update. SVG is sanitized on save (no script / event handlers).</p>" +
+      "<form method=\"post\" action=\"/admin/trust-badges\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id.", " maxlength=\"80\" required") +
+        _setupField("Title", "title", "", "text", "Shown as the badge's hover title.", " maxlength=\"200\" required") +
+        _setupField("Alt text", "alt_text", "", "text", "Describes the badge for assistive tech.", " maxlength=\"300\" required") +
+        "<label class=\"form-field\"><span>SVG payload (optional)</span><textarea name=\"svg_payload\" rows=\"4\" placeholder=\"&lt;svg ...&gt;...&lt;/svg&gt;\"></textarea><small>Inline SVG — sanitized on save. Leave blank to use an image URL instead.</small></label>" +
+        _setupField("Image URL (optional)", "image_url", "", "text", "https:// or a /-rooted path. Leave blank to use SVG instead.", " maxlength=\"2048\"") +
+        _setupField("Link URL (optional)", "link_url", "", "text", "https:// or a /-rooted path the badge links to.", " maxlength=\"2048\"") +
+        "<fieldset class=\"form-field\"><legend>Placements</legend>" + placementChecks + "</fieldset>" +
+        _setupField("Priority", "priority", "0", "number", "Higher shows first within a placement.", " min=\"0\" max=\"1000000\"") +
+        "<label class=\"form-field\"><span>Starts at (optional)</span><input type=\"datetime-local\" name=\"starts_at\"></label>" +
+        "<label class=\"form-field\"><span>Expires at (optional)</span><input type=\"datetime-local\" name=\"expires_at\"></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create badge</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Trust badges</h2>" + banners + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Trust badges", bodyHtml, "trust-badges", opts.nav_available);
+}
+
+// Trust-badge detail/edit screen. The svg_payload rides ONLY inside a
+// <textarea> (escaped) — never an attribute — so a hostile-but-sanitized
+// payload can't break out. Hidden presence markers let a partial edit avoid
+// clearing unrelated columns.
+function renderAdminTrustBadge(opts) {
+  opts = opts || {};
+  var bd = opts.badge || {};
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Badge updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var enc = _htmlEscape(encodeURIComponent(bd.slug || ""));
+
+  var placementSet = {};
+  (Array.isArray(bd.placements) ? bd.placements : []).forEach(function (p) { placementSet[p] = true; });
+  var placementChecks = trustBadgesModule.ALLOWED_PLACEMENTS.map(function (pl) {
+    return "<label class=\"kv\"><input type=\"checkbox\" name=\"placements\" value=\"" + pl + "\"" + (placementSet[pl] ? " checked" : "") + "> " + _htmlEscape(pl) + "</label>";
+  }).join("");
+
+  var startsVal   = _datetimeLocalValue(bd.starts_at);
+  var expiresVal  = _datetimeLocalValue(bd.expires_at);
+
+  var body =
+    "<section class=\"mw-40\">" +
+      "<h2>Edit badge — " + _htmlEscape(bd.slug || "") + "</h2>" +
+      updated + notice +
+      "<form method=\"post\" action=\"/admin/trust-badges/" + enc + "/edit\">" +
+        _setupField("Title", "title", bd.title, "text", "", " maxlength=\"200\" required") +
+        _setupField("Alt text", "alt_text", bd.alt_text, "text", "", " maxlength=\"300\" required") +
+        "<input type=\"hidden\" name=\"svg_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>SVG payload</span><textarea name=\"svg_payload\" rows=\"4\">" + _htmlEscape(bd.svg_payload || "") + "</textarea><small>Sanitized on save. Blank this to switch to an image URL.</small></label>" +
+        "<input type=\"hidden\" name=\"image_present\" value=\"1\">" +
+        _setupField("Image URL", "image_url", bd.image_url || "", "text", "Blank this to switch to an SVG payload.", " maxlength=\"2048\"") +
+        "<input type=\"hidden\" name=\"link_present\" value=\"1\">" +
+        _setupField("Link URL", "link_url", bd.link_url || "", "text", "https:// or a /-rooted path.", " maxlength=\"2048\"") +
+        "<input type=\"hidden\" name=\"placements_present\" value=\"1\">" +
+        "<fieldset class=\"form-field\"><legend>Placements</legend>" + placementChecks + "</fieldset>" +
+        _setupField("Priority", "priority", String(bd.priority == null ? 0 : bd.priority), "number", "", " min=\"0\" max=\"1000000\"") +
+        "<input type=\"hidden\" name=\"starts_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>Starts at</span><input type=\"datetime-local\" name=\"starts_at\" value=\"" + _htmlEscape(startsVal) + "\"></label>" +
+        "<input type=\"hidden\" name=\"expires_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>Expires at</span><input type=\"datetime-local\" name=\"expires_at\" value=\"" + _htmlEscape(expiresVal) + "\"></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save badge</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/trust-badges\">Back to badges</a></div>" +
+      "</form>" +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Edit badge", body, "trust-badges", opts.nav_available);
+}
+
 // Pre-order campaign console — the list table (status + reserved/available
 // counts + release date), the lifecycle actions (launch once the release date
 // has arrived, close any time), and the create form. The launch button only
@@ -15969,4 +16746,5 @@ module.exports = {
   renderAdminLoyaltyRewards:    renderAdminLoyaltyRewards,
   renderAdminLoyaltyReward:     renderAdminLoyaltyReward,
   renderAdminConfirm:      renderAdminConfirm,
+  renderAdminAudit:        renderAdminAudit,
 };