@blamejs/blamejs-shop 0.3.52 → 0.3.54

package/lib/admin.js

@@ -35,6 +35,7 @@ var collectionsModule = require("./collections");
 var quantityDiscountsModule = require("./quantity-discounts");
 var loyaltyEarnRulesModule = require("./loyalty-earn-rules");
 var loyaltyRedemptionModule = require("./loyalty-redemption");
+var trustBadgesModule = require("./trust-badges");
 var textGuard = require("./text-guard");
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
@@ -514,6 +515,10 @@ function mount(router, deps) {
   var complianceExport = deps.complianceExport || null; // DSR queue (export/erasure) disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
   var orderRatings    = deps.orderRatings    || null; // per-order rating moderation queue (flag/clear + public reply) disabled when absent
+  var clickAndCollect = deps.clickAndCollect || null; // pickup-locations CRUD + pickup queue console disabled when absent
+  var giftOptions     = deps.giftOptions     || null; // gift-wrap catalog console disabled when absent
+  var searchRanking   = deps.searchRanking   || null; // search-ranking weight-set + pin console disabled when absent
+  var trustBadges     = deps.trustBadges     || null; // trust-badge authoring console disabled when absent
   var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
   // Read-only activity log at /admin/audit. Defaults ON — the framework
   // audit chain is always booted by createApp, so the screen always has a
@@ -528,7 +533,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport, auditLog: auditLog };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4593,6 +4598,318 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- click-and-collect (pickup locations + the pickup queue) --------
+  //
+  // Two operator surfaces: the pickup-location CRUD (define / archive) and
+  // the front-counter pickup queue per location (the FSM: ready / picked-up
+  // / no-show). The primitive throws PLAIN TypeError (no `.code`) on every
+  // refusal EXCEPT markPickedUp's internal `fsm/illegal-transition` handling,
+  // so the action wrapper maps TypeError → 400/?err=1 — but RESOLVES EXISTENCE
+  // FIRST (getScheduleByOrder / getLocation null → 404) so a not-found isn't
+  // mislabeled a bad-shape 400.
+  if (clickAndCollect) {
+    // Parse the operator's hours textarea (one "Mon 09:00-17:00" line per
+    // weekday) into the hours_json object the primitive validates. An empty
+    // textarea yields {} (the primitive only requires a JSON-serialisable
+    // object). Unparseable lines are skipped so a typo doesn't 500 the save.
+    function _parseHoursJson(raw) {
+      var hours = {};
+      if (typeof raw !== "string" || !raw.trim()) return hours;
+      raw.split(/\r?\n/).forEach(function (line) {
+        var m = line.trim().match(/^([A-Za-z]{3,})\s+(\d{1,2}:\d{2})\s*-\s*(\d{1,2}:\d{2})$/);
+        if (m) hours[m[1].toLowerCase().slice(0, 3)] = { open: m[2], close: m[3] };
+      });
+      return hours;
+    }
+
+    // GET /admin/pickup-locations — the active-location list (the primitive
+    // has no "list all incl archived" verb; archived rows drop out of
+    // availableLocations, which is the operator's working set — re-open an
+    // archived-locations list if operators ask for it).
+    router.get("/admin/pickup-locations", _pageOrApi(true,
+      R(async function (req, res) {
+        var rows = await clickAndCollect.availableLocations({ limit: 200 });
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await clickAndCollect.availableLocations({ limit: 200 });
+        _sendHtml(res, 200, renderAdminPickupLocations({
+          shop_name: deps.shop_name, nav_available: navAvailable, locations: rows,
+          saved: url && url.searchParams.get("saved"),
+          notice: url && url.searchParams.get("err") ? "That location couldn't be saved — check the fields and try again." : null,
+        }));
+      },
+    ));
+
+    // POST /admin/pickup-locations — definePickupLocation upsert. A bad
+    // shape (missing name / bad capacity / bad address) is a TypeError → 400.
+    router.post("/admin/pickup-locations", _pageOrApi(false,
+      W("pickup.location.define", async function (req, res) {
+        var body = req.body || {};
+        var loc;
+        try { loc = await _definePickupFromBody(body); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 201, loc);
+        return loc;
+      }),
+      async function (req, res) {
+        try { await _definePickupFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickup-locations?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup.location.define", outcome: "success", metadata: { code: (req.body || {}).code } });
+        _redirect(res, "/admin/pickup-locations?saved=1");
+      },
+    ));
+
+    function _definePickupFromBody(body) {
+      return clickAndCollect.definePickupLocation({
+        code:              body.code,
+        name:              body.name,
+        address:          { line1: body.line1, city: body.city, country: body.country },
+        hours_json:        _parseHoursJson(body.hours),
+        capacity_per_hour: parseInt(body.capacity_per_hour, 10),
+        lead_time_hours:   parseInt(body.lead_time_hours, 10),
+        active:            !(body.active === "0" || body.active === false),
+      });
+    }
+
+    // POST /admin/pickup-locations/:code/archive — soft-delete. Resolve
+    // existence first (getLocation null → 404) so a typo'd code is a 404, not
+    // a 400/500. The archive verb itself only throws on a malformed code.
+    router.post("/admin/pickup-locations/:code/archive", _pageOrApi(false,
+      W("pickup.location.archive", async function (req, res) {
+        var code = req.params.code;
+        var existing;
+        try { existing = await clickAndCollect.getLocation(code); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "pickup-location-not-found");
+        var row = await clickAndCollect.archiveLocation(code);
+        _json(res, 200, row);
+        return row;
+      }),
+      async function (req, res) {
+        var code = req.params.code;
+        var existing;
+        try { existing = await clickAndCollect.getLocation(code); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickup-locations?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/pickup-locations?err=1");
+        await clickAndCollect.archiveLocation(code);
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup.location.archive", outcome: "success", metadata: { code: code } });
+        _redirect(res, "/admin/pickup-locations?saved=1");
+      },
+    ));
+
+    // GET /admin/pickups — the per-location pickup queue. The primitive has
+    // no all-locations queue verb, so the screen requires a ?location=
+    // selector defaulting to the first active location. A wide window
+    // (now-7d … now+30d) bounds the read.
+    router.get("/admin/pickups", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var locs = await clickAndCollect.availableLocations({ limit: 200 });
+        var selected = (url && url.searchParams.get("location")) || (locs[0] && locs[0].code) || null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = selected ? await _pickupQueue(selected, status) : [];
+        _json(res, 200, { rows: rows, location: selected, status: status });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var locs = await clickAndCollect.availableLocations({ limit: 200 });
+        var selected = (url && url.searchParams.get("location")) || (locs[0] && locs[0].code) || null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = [];
+        if (selected) {
+          try { rows = await _pickupQueue(selected, status); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; rows = []; }
+        }
+        _sendHtml(res, 200, renderAdminPickups({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          locations: locs, selected: selected, status: status, pickups: rows,
+          moved:  url && url.searchParams.get("moved"),
+          notice: url && url.searchParams.get("err") ? "That pickup action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    function _pickupQueue(locationCode, status) {
+      var now = Date.now();
+      var opts2 = {
+        location_code: locationCode,
+        from: now - b.constants.TIME.days(7),
+        to:   now + b.constants.TIME.days(30),
+      };
+      if (status && PICKUP_QUEUE_STATUSES.indexOf(status) !== -1) opts2.status = status;
+      return clickAndCollect.pickupsForLocation(opts2);
+    }
+
+    // The three FSM action routes. Each RESOLVES EXISTENCE FIRST
+    // (getScheduleByOrder null → 404) so a not-found order isn't mislabeled a
+    // 400; a real refusal (wrong status / bad shape) is a TypeError → 400.
+    function _pickupAction(verb, auditEvent, opFn) {
+      router.post("/admin/pickups/:order_id/" + verb, _pageOrApi(false,
+        W("pickup." + auditEvent, async function (req, res) {
+          var orderId = req.params.order_id;
+          var existing;
+          try { existing = await clickAndCollect.getScheduleByOrder(orderId); }
+          catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+          if (!existing) return _problem(res, 404, "pickup-schedule-not-found");
+          var row;
+          try { row = await opFn(orderId, req.body || {}); }
+          catch (e) {
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            if (e && e.code === "fsm/illegal-transition") return _problem(res, 409, "conflict", e.message);
+            throw e;
+          }
+          _json(res, 200, row);
+          return row;
+        }),
+        async function (req, res) {
+          var orderId = req.params.order_id;
+          var existing;
+          try { existing = await clickAndCollect.getScheduleByOrder(orderId); }
+          catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickups?err=1"); throw e; }
+          if (!existing) return _redirect(res, "/admin/pickups?err=1");
+          var backLoc = "&location=" + encodeURIComponent(existing.location_code);
+          try { await opFn(orderId, req.body || {}); }
+          catch (e) {
+            if (e instanceof TypeError || (e && e.code === "fsm/illegal-transition")) {
+              return _redirect(res, "/admin/pickups?err=1" + backLoc);
+            }
+            throw e;
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup." + auditEvent, outcome: "success", metadata: { order_id: orderId } });
+          _redirect(res, "/admin/pickups?moved=1" + backLoc);
+        },
+      ));
+    }
+    _pickupAction("ready", "ready", function (orderId) {
+      return clickAndCollect.markReadyForPickup({ order_id: orderId });
+    });
+    _pickupAction("picked-up", "picked_up", function (orderId, body) {
+      return clickAndCollect.markPickedUp({
+        order_id: orderId, picked_up_at: Date.now(),
+        signature: body.signature || undefined,
+        customer_id_proof_kind: body.proof_kind || undefined,
+      });
+    });
+    _pickupAction("no-show", "no_show", function (orderId, body) {
+      return clickAndCollect.markNoShow({ order_id: orderId, reason: body.reason });
+    });
+  }
+
+  // ---- gift wraps -----------------------------------------------------
+  //
+  // The operator-defined gift-wrap catalog: define / update / archive a wrap
+  // option whose wrap_sku is a real catalog variant (so the fee flows through
+  // inventory + pricing). defineWrap / updateWrap / archiveWrap throw PLAIN
+  // TypeError on a bad shape / unknown sku / not-found → 400; update/archive
+  // resolve existence first (getWrap null → 404) for parity.
+  if (giftOptions) {
+    router.get("/admin/gift-wraps", _pageOrApi(true,
+      R(async function (req, res) {
+        var rows = await giftOptions.listWraps({});
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await giftOptions.listWraps({});
+        _sendHtml(res, 200, renderAdminGiftWraps({
+          shop_name: deps.shop_name, nav_available: navAvailable, wraps: rows,
+          saved: url && url.searchParams.get("saved"),
+          notice: url && url.searchParams.get("err") ? "That wrap couldn't be saved — the SKU must be a real catalog variant." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/gift-wraps", _pageOrApi(false,
+      W("gift.wrap.define", async function (req, res) {
+        var wrap;
+        try { wrap = await _defineWrapFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 201, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        try { await _defineWrapFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.define", outcome: "success", metadata: { wrap_sku: (req.body || {}).wrap_sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+
+    function _defineWrapFromBody(body) {
+      return giftOptions.defineWrap({
+        wrap_sku:      body.wrap_sku,
+        title:         body.title,
+        fee_minor:     parseInt(body.fee_minor, 10),
+        image_url:     body.image_url ? body.image_url : undefined,
+        max_per_order: body.max_per_order ? parseInt(body.max_per_order, 10) : undefined,
+        active:        !(body.active === "0" || body.active === false),
+      });
+    }
+
+    router.post("/admin/gift-wraps/:wrap_sku/update", _pageOrApi(false,
+      W("gift.wrap.update", async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "gift-wrap-not-found");
+        var wrap;
+        try { wrap = await giftOptions.updateWrap(sku, _wrapPatchFromBody(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/gift-wraps?err=1");
+        try { await giftOptions.updateWrap(sku, _wrapPatchFromBody(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.update", outcome: "success", metadata: { wrap_sku: sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+
+    // Build the updateWrap patch from the edit form — only the columns the
+    // operator actually changed (a blank field is omitted, never sent as "").
+    function _wrapPatchFromBody(body) {
+      var patch = {};
+      if (body.title != null && body.title !== "")              patch.title = body.title;
+      if (body.fee_minor != null && body.fee_minor !== "")      patch.fee_minor = parseInt(body.fee_minor, 10);
+      if (body.image_url != null && body.image_url !== "")      patch.image_url = body.image_url;
+      if (body.max_per_order != null && body.max_per_order !== "") patch.max_per_order = parseInt(body.max_per_order, 10);
+      if (body.active != null)                                  patch.active = !(body.active === "0" || body.active === false);
+      return patch;
+    }
+
+    router.post("/admin/gift-wraps/:wrap_sku/archive", _pageOrApi(false,
+      W("gift.wrap.archive", async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "gift-wrap-not-found");
+        var wrap = await giftOptions.archiveWrap(sku);
+        _json(res, 200, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/gift-wraps?err=1");
+        await giftOptions.archiveWrap(sku);
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.archive", outcome: "success", metadata: { wrap_sku: sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+  }
+
   // ---- config ---------------------------------------------------------
 
   var config = deps.config || null;
@@ -5408,6 +5725,298 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- search ranking -------------------------------------------------
+  // Operator-tunable storefront search ranking: named weight sets (one
+  // active at a time), per-query manual pins, and a per-set metrics rollup.
+  // Content-negotiated like the other consoles (bearer → JSON, browser →
+  // HTML). The weight map is authored as a small JSON object validated
+  // server-side; coded errors (NOT_FOUND / ARCHIVED) map to 404 / 400 before
+  // the TypeError fallthrough, so a bad slug never 500s.
+  if (deps.searchRanking) {
+    var searchRankingApi = deps.searchRanking;
+
+    // Parse the `weights` JSON textarea into the flat signal->number map the
+    // primitive expects. A non-object / malformed JSON surfaces as a TypeError
+    // (caught by the route → _safeNotice 400) so the operator gets a clean
+    // re-render rather than a 500.
+    function _parseWeightsJson(raw) {
+      var s = typeof raw === "string" ? raw.trim() : "";
+      if (!s.length) throw new TypeError("weights must be a JSON object of signal -> number");
+      var parsed;
+      try { parsed = JSON.parse(s); }
+      catch (_e) { throw new TypeError("weights must be valid JSON (a flat object of signal -> number)"); }
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new TypeError("weights must be a JSON object, e.g. {\"relevance\":1,\"in_stock\":0.5}");
+      }
+      return parsed;
+    }
+
+    async function _searchRankingListData() {
+      var weights = await searchRankingApi.listWeights({ include_archived: true });
+      var active  = await searchRankingApi.activeWeights();
+      return { weights: weights, active: active };
+    }
+
+    router.get("/admin/search-ranking", _pageOrApi(true,
+      R(async function (req, res) {
+        var data = await _searchRankingListData();
+        _json(res, 200, { weights: data.weights, active: data.active ? data.active.slug : null });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var data = await _searchRankingListData();
+        // Optional pin manager for a query (?pins_query=...).
+        var pinsQuery = url && url.searchParams.get("pins_query");
+        var pins = [];
+        if (pinsQuery) {
+          try { pins = await searchRankingApi.pinsForQuery(pinsQuery); }
+          catch (_e) { pins = []; }
+        }
+        // Optional metrics rollup for a weight set (?metrics_slug=&from=&to=).
+        var metrics = null;
+        var metricsSlug = url && url.searchParams.get("metrics_slug");
+        if (metricsSlug) {
+          var fromMs = _searchRankingMsParam(url && url.searchParams.get("from"), Date.now() - b.constants.TIME.days(30));
+          var toMs   = _searchRankingMsParam(url && url.searchParams.get("to"), Date.now());
+          try { metrics = await searchRankingApi.metricsForWeights({ weights_slug: metricsSlug, from: fromMs, to: toMs }); }
+          catch (_e) { metrics = null; }
+        }
+        _sendHtml(res, 200, renderAdminSearchRanking({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          weights: data.weights, active: data.active,
+          pins_query: pinsQuery, pins: pins, metrics: metrics,
+          created:  url && url.searchParams.get("created"),
+          activated: url && url.searchParams.get("activated"),
+          archived: url && url.searchParams.get("archived"),
+          pinned:   url && url.searchParams.get("pinned"),
+          unpinned: url && url.searchParams.get("unpinned"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights", _pageOrApi(false,
+      W("search_ranking.define_weights", async function (req, res) {
+        var b2 = req.body || {};
+        var row = await searchRankingApi.defineWeights({ slug: b2.slug, name: b2.name, weights: _parseWeightsJson(b2.weights) });
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try {
+          await searchRankingApi.defineWeights({ slug: b2.slug, name: b2.name, weights: _parseWeightsJson(b2.weights) });
+        } catch (e) {
+          var n = _safeNotice(e, "search_ranking.define_weights");
+          var data = await _searchRankingListData();
+          return _sendHtml(res, n.status, renderAdminSearchRanking({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            weights: data.weights, active: data.active,
+            notice: n.message.replace(/^searchRanking[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.define_weights", outcome: "success", metadata: { slug: b2.slug } });
+        _redirect(res, "/admin/search-ranking?created=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights/:slug/activate", _pageOrApi(false,
+      W("search_ranking.activate_weights", async function (req, res) {
+        var row;
+        try { row = await searchRankingApi.setActiveWeights(req.params.slug); }
+        catch (e) {
+          if (e && e.code === "SEARCH_WEIGHTS_NOT_FOUND") return _problem(res, 404, "weights-not-found");
+          if (e && e.code === "SEARCH_WEIGHTS_ARCHIVED")  return _problem(res, 400, "weights-archived");
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await searchRankingApi.setActiveWeights(slug); }
+        catch (e) {
+          // Coded errors (NOT_FOUND / ARCHIVED) are Error with .code, NOT
+          // TypeError — check e.code first, then the TypeError fallthrough.
+          if (!(e && (e.code === "SEARCH_WEIGHTS_NOT_FOUND" || e.code === "SEARCH_WEIGHTS_ARCHIVED") || e instanceof TypeError)) throw e;
+          return _redirect(res, "/admin/search-ranking?err=1");
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.activate_weights", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/search-ranking?activated=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/weights/:slug/archive", _pageOrApi(false,
+      W("search_ranking.archive_weights", async function (req, res) {
+        var row;
+        try { row = await searchRankingApi.archiveWeights(req.params.slug); }
+        catch (e) {
+          if (e && e.code === "SEARCH_WEIGHTS_NOT_FOUND") return _problem(res, 404, "weights-not-found");
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await searchRankingApi.archiveWeights(slug); }
+        catch (e) { if (!(e && e.code === "SEARCH_WEIGHTS_NOT_FOUND" || e instanceof TypeError)) throw e; return _redirect(res, "/admin/search-ranking?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.archive_weights", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/search-ranking?archived=1");
+      },
+    ));
+
+    router.post("/admin/search-ranking/pins", _pageOrApi(false,
+      W("search_ranking.pin", async function (req, res) {
+        var b2 = req.body || {};
+        var row = await searchRankingApi.pinProductForQuery({
+          query: b2.query, product_id: b2.product_id, position: _searchRankingIntField(b2.position),
+        });
+        _json(res, 201, row);
+        return { id: (row && row.product_id) || null };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try {
+          await searchRankingApi.pinProductForQuery({
+            query: b2.query, product_id: b2.product_id, position: _searchRankingIntField(b2.position),
+          });
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          return _redirect(res, "/admin/search-ranking?err=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.pin", outcome: "success" });
+        _redirect(res, "/admin/search-ranking?pinned=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+      },
+    ));
+
+    router.post("/admin/search-ranking/pins/delete", _pageOrApi(false,
+      W("search_ranking.unpin", async function (req, res) {
+        var b2 = req.body || {};
+        var result = await searchRankingApi.unpinProduct({ query: b2.query, product_id: b2.product_id });
+        _json(res, 200, result);
+        return { id: b2.product_id || null };
+      }),
+      async function (req, res) {
+        var b2 = req.body || {};
+        try { await searchRankingApi.unpinProduct({ query: b2.query, product_id: b2.product_id }); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/search-ranking?err=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : "")); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".search_ranking.unpin", outcome: "success" });
+        _redirect(res, "/admin/search-ranking?unpinned=1" + (b2.query ? "&pins_query=" + encodeURIComponent(b2.query) : ""));
+      },
+    ));
+  }
+
+  // ---- trust badges ---------------------------------------------------
+  // Operator-authored trust/certification badges. Create with EITHER an
+  // inline SVG payload (sanitized at define time through b.guardSvg — a
+  // hostile <script>/onload SVG refuses as a TypeError) OR a hosted https://
+  // image URL, plus placements, schedule, priority, alt text. The raw
+  // svg_payload is NEVER echoed into an admin HTML attribute — it's rendered
+  // inside a <textarea> (which escapes < and &) on the edit screen.
+  if (deps.trustBadges) {
+    var trustBadgesApi = deps.trustBadges;
+
+    async function _trustBadgesList() {
+      return await trustBadgesApi.listBadges({});
+    }
+
+    router.get("/admin/trust-badges", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await _trustBadgesList() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, renderAdminTrustBadges({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          badges: await _trustBadgesList(),
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the badge." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/trust-badges", _pageOrApi(false,
+      W("trust_badge.define", async function (req, res) {
+        var row = await trustBadgesApi.defineBadge(_trustBadgeFromForm(req.body || {}));
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await trustBadgesApi.defineBadge(_trustBadgeFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "trust_badge.define");
+          return _sendHtml(res, n.status, renderAdminTrustBadges({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            badges: await _trustBadgesList(),
+            notice: n.message.replace(/^trustBadges[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.define", outcome: "success" });
+        _redirect(res, "/admin/trust-badges?created=1");
+      },
+    ));
+
+    router.get("/admin/trust-badges/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await trustBadgesApi.getBadge(req.params.slug);
+        if (!row) return _problem(res, 404, "trust-badge-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row = await trustBadgesApi.getBadge(req.params.slug);
+        if (!row) return _sendHtml(res, 404, renderAdminTrustBadges({
+          shop_name: deps.shop_name, nav_available: navAvailable, badges: [], notice: "Badge not found.",
+        }));
+        _sendHtml(res, 200, renderAdminTrustBadge({
+          shop_name: deps.shop_name, nav_available: navAvailable, badge: row,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the badge." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/trust-badges/:slug/edit", _pageOrApi(false,
+      W("trust_badge.update", async function (req, res) {
+        var row;
+        try { row = await trustBadgesApi.updateBadge(req.params.slug, _trustBadgePatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        try { await trustBadgesApi.updateBadge(slug, _trustBadgePatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/trust-badges/" + enc + "?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/trust-badges/" + enc + "?updated=1");
+      },
+    ));
+
+    router.post("/admin/trust-badges/:slug/archive", _pageOrApi(false,
+      W("trust_badge.archive", async function (req, res) {
+        var row;
+        try { row = await trustBadgesApi.archiveBadge(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        try { await trustBadgesApi.archiveBadge(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/trust-badges?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".trust_badge.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/trust-badges?archived=1");
+      },
+    ));
+  }
+
   // ---- pre-orders -----------------------------------------------------
   // Campaigns that take reservations against a SKU that isn't released yet.
   // The lifecycle is draft-free: defineCampaign opens an `active` campaign,
@@ -9982,6 +10591,11 @@ var ADMIN_NAV_ITEMS = [
   { key: "dsr",          href: "/admin/dsr",          label: "Privacy requests", requires: "complianceExport" },
   { key: "exchanges",    href: "/admin/exchanges",    label: "Exchanges",    requires: "orderExchanges" },
   { key: "ratings",      href: "/admin/ratings",      label: "Ratings",      requires: "orderRatings" },
+  { key: "pickup-locations", href: "/admin/pickup-locations", label: "Pickup locations", requires: "clickAndCollect" },
+  { key: "pickups",      href: "/admin/pickups",      label: "Pickups",      requires: "clickAndCollect" },
+  { key: "gift-wraps",   href: "/admin/gift-wraps",   label: "Gift wraps",   requires: "giftOptions" },
+  { key: "search-ranking", href: "/admin/search-ranking", label: "Search ranking", requires: "searchRanking" },
+  { key: "trust-badges", href: "/admin/trust-badges", label: "Trust badges", requires: "trustBadges" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
@@ -12161,6 +12775,9 @@ function renderAdminDsrDetail(opts) {
 // lifecycle order (the terminal closed / rejected don't appear in the open
 // queue, so they're not filter chips).
 var EXCHANGE_STATUS_FILTERS = ["pending", "approved", "shipped", "delivered", "received"];
+// The pickup-queue status chips the operator can filter by (mirrors the
+// click-and-collect FSM statuses the pickupsForLocation read accepts).
+var PICKUP_QUEUE_STATUSES = ["scheduled", "ready", "picked_up", "no_show", "cancelled"];
 
 function _exchangePillClass(status) {
   if (status === "closed")   return "paid";       // completed — green
@@ -12315,6 +12932,197 @@ function renderAdminExchange(opts) {
   return _renderAdminShell(opts.shop_name, "Exchange " + String(x.id).slice(0, 8), body, "exchanges", opts.nav_available);
 }
 
+// ---- click-and-collect render fns -----------------------------------
+
+// Pickup-locations CRUD screen: the active-location list (each with an
+// archive form) + a define/upsert form. Every operator free-text field —
+// name, address parts, hours — is HTML-escaped at the sink (the primitive
+// validates length/shape, NOT HTML, so escaping here is the XSS guard).
+function renderAdminPickupLocations(opts) {
+  opts = opts || {};
+  var list = opts.locations || [];
+  var saved  = opts.saved  ? "<div class=\"banner banner--ok\">Pickup location saved.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var rows = list.map(function (l) {
+    var addr = l.address || {};
+    var addrLine = [addr.line1, addr.city, addr.country].filter(Boolean).map(String).join(", ");
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(l.code) + "</code></td>" +
+      "<td>" + _htmlEscape(l.name) + "</td>" +
+      "<td>" + _htmlEscape(addrLine) + "</td>" +
+      "<td>" + _htmlEscape(String(l.capacity_per_hour)) + "/hr</td>" +
+      "<td>" + _htmlEscape(String(l.lead_time_hours)) + "h</td>" +
+      "<td>" +
+        "<form method=\"post\" action=\"/admin/pickup-locations/" + encodeURIComponent(l.code) + "/archive\" class=\"form-inline\">" +
+          "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">Archive</button>" +
+        "</form>" +
+      "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = list.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Code</th><th scope=\"col\">Name</th><th scope=\"col\">Address</th><th scope=\"col\">Capacity</th><th scope=\"col\">Lead time</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No active pickup locations yet. Add one below.</p>";
+
+  var form =
+    "<div class=\"panel mt\"><h3 class=\"subhead\">Add / update a pickup location</h3>" +
+      "<form method=\"post\" action=\"/admin/pickup-locations\">" +
+        _setupField("Code", "code", "", "text", "Stable identifier (alnum + . _ -). Re-using a code updates that location.", " maxlength=\"64\" required") +
+        _setupField("Name", "name", "", "text", "Shown to customers at checkout.", " maxlength=\"200\" required") +
+        _setupField("Address line 1", "line1", "", "text", "", " maxlength=\"200\" required") +
+        _setupField("City", "city", "", "text", "", " maxlength=\"100\" required") +
+        _setupField("Country", "country", "", "text", "2-letter ISO code (e.g. US).", " maxlength=\"2\" class=\"input-code\" required") +
+        "<label class=\"form-field\"><span>Opening hours</span>" +
+          "<textarea name=\"hours\" rows=\"4\" placeholder=\"mon 09:00-17:00&#10;tue 09:00-17:00\"></textarea>" +
+          "<small>One line per day: <code>mon 09:00-17:00</code>. Optional.</small>" +
+        "</label>" +
+        _setupField("Capacity per hour", "capacity_per_hour", "", "number", "Max concurrent pickups in a one-hour window.", " min=\"1\" required") +
+        _setupField("Lead time (hours)", "lead_time_hours", "", "number", "Minimum gap before the earliest bookable slot. 0 allows same-hour.", " min=\"0\" required") +
+        "<div class=\"actions-row\"><button type=\"submit\" class=\"btn\">Save location</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Pickup locations</h2>" + saved + notice + table + form + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pickup locations", body, "pickup-locations", opts.nav_available);
+}
+
+// Pickup queue for one location: a location selector + status chips, the
+// scheduled/ready rows, and the FSM action forms (ready / picked-up /
+// no-show) legal from each row's status. The no_show reason is operator-
+// authored free text — escaped at the sink.
+function renderAdminPickups(opts) {
+  opts = opts || {};
+  var locs = opts.locations || [];
+  var list = opts.pickups || [];
+  var selected = opts.selected || null;
+  var status = opts.status || null;
+  var moved  = opts.moved  ? "<div class=\"banner banner--ok\">Pickup updated.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var selector = "";
+  if (locs.length) {
+    var opts2 = locs.map(function (l) {
+      return "<option value=\"" + _htmlEscape(l.code) + "\"" + (l.code === selected ? " selected" : "") + ">" +
+        _htmlEscape(l.name) + " (" + _htmlEscape(l.code) + ")</option>";
+    }).join("");
+    selector =
+      "<form method=\"get\" action=\"/admin/pickups\" class=\"form-inline\">" +
+        "<label class=\"form-field\"><span>Location</span><select name=\"location\" onchange=\"this.form.submit()\">" + opts2 + "</select></label>" +
+        "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">View</button>" +
+      "</form>";
+  }
+
+  var statusChip = function (s, label) {
+    var href = "/admin/pickups?location=" + encodeURIComponent(selected || "") + (s ? "&status=" + encodeURIComponent(s) : "");
+    var on = (s == null && status == null) || s === status;
+    return "<a class=\"chip" + (on ? " chip--on" : "") + "\" href=\"" + href + "\">" + _htmlEscape(label) + "</a>";
+  };
+  var chips = selected
+    ? "<div class=\"order-filters\">" + statusChip(null, "all") +
+        PICKUP_QUEUE_STATUSES.map(function (s) { return statusChip(s, s); }).join("") + "</div>"
+    : "";
+
+  function _pickupActions(p) {
+    var blocks = [];
+    if (p.status === "scheduled") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/ready\" class=\"form-inline\">" +
+          "<button class=\"btn btn--sm\" type=\"submit\">Mark ready</button></form>");
+    }
+    if (p.status === "ready") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/picked-up\" class=\"return-action\">" +
+          "<input type=\"hidden\" name=\"proof_kind\" value=\"store_credential\">" +
+          "<button class=\"btn btn--sm\" type=\"submit\">Mark picked up</button></form>");
+    }
+    if (p.status === "scheduled" || p.status === "ready") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/no-show\" class=\"return-action\">" +
+          _setupField("No-show reason", "reason", "", "text", "Shown in the escalation queue.", " maxlength=\"280\" required") +
+          "<button class=\"btn btn--danger btn--sm\" type=\"submit\">No-show</button></form>");
+    }
+    return blocks.length ? blocks.join("") : "<span class=\"meta\">—</span>";
+  }
+
+  var rows = list.map(function (p) {
+    return "<tr>" +
+      "<td><a class=\"order-id\" href=\"/admin/orders/" + _htmlEscape(p.order_id) + "\">" + _htmlEscape(String(p.order_id).slice(0, 8)) + "</a></td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(p.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(p.scheduled_window_start)) + "</td>" +
+      "<td>" + (p.picked_up_at ? _htmlEscape(_fmtDate(p.picked_up_at)) : "<span class=\"meta\">—</span>") + "</td>" +
+      "<td>" + _pickupActions(p) + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = !selected
+    ? "<p class=\"empty\">Add a pickup location first.</p>"
+    : (list.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Order</th><th scope=\"col\">Status</th><th scope=\"col\">Window</th><th scope=\"col\">Picked up</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+      : "<p class=\"empty\">No pickups in this window for this location.</p>");
+
+  var body = "<section><h2>Pickups</h2>" + moved + notice + selector + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pickups", body, "pickups", opts.nav_available);
+}
+
+// ---- gift-wraps render fn -------------------------------------------
+
+// Gift-wrap catalog screen: the list (incl. archived) with an inline update
+// form + archive action per row, and a define form. The wrap title is
+// operator free text — escaped at the sink (the primitive bounds length +
+// refuses control/zero-width bytes, but not HTML). image_url is escaped as
+// an attribute value.
+function renderAdminGiftWraps(opts) {
+  opts = opts || {};
+  var list = opts.wraps || [];
+  var saved  = opts.saved  ? "<div class=\"banner banner--ok\">Gift wrap saved.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var rows = list.map(function (w) {
+    var stateLabel = w.archived_at ? "archived" : (w.active ? "active" : "inactive");
+    var img = w.image_url
+      ? "<img src=\"" + _htmlEscape(String(w.image_url)) + "\" alt=\"\" width=\"32\" height=\"32\" style=\"object-fit:cover\">"
+      : "<span class=\"meta\">—</span>";
+    var updateForm =
+      "<form method=\"post\" action=\"/admin/gift-wraps/" + encodeURIComponent(w.wrap_sku) + "/update\" class=\"form-inline\">" +
+        "<input type=\"text\" name=\"title\" value=\"" + _htmlEscape(w.title) + "\" maxlength=\"200\" aria-label=\"Title\">" +
+        "<input type=\"number\" name=\"fee_minor\" value=\"" + _htmlEscape(String(w.fee_minor)) + "\" min=\"0\" aria-label=\"Fee (minor units)\">" +
+        "<button class=\"btn btn--sm\" type=\"submit\">Update</button>" +
+      "</form>";
+    var archiveForm = w.archived_at ? "" :
+      "<form method=\"post\" action=\"/admin/gift-wraps/" + encodeURIComponent(w.wrap_sku) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">Archive</button>" +
+      "</form>";
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(w.wrap_sku) + "</code></td>" +
+      "<td>" + img + "</td>" +
+      "<td>" + _htmlEscape(w.title) + "</td>" +
+      "<td>" + _htmlEscape(String(w.fee_minor)) + "</td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(stateLabel) + "</span></td>" +
+      "<td>" + updateForm + archiveForm + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = list.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">SKU</th><th scope=\"col\">Image</th><th scope=\"col\">Title</th><th scope=\"col\">Fee</th><th scope=\"col\">State</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No gift wraps yet. Define one below — the SKU must be a real catalog variant.</p>";
+
+  var form =
+    "<div class=\"panel mt\"><h3 class=\"subhead\">Define a gift wrap</h3>" +
+      "<form method=\"post\" action=\"/admin/gift-wraps\">" +
+        _setupField("Wrap SKU", "wrap_sku", "", "text", "Must be a real catalog variant SKU — the fee flows through inventory + pricing.", " maxlength=\"128\" required") +
+        _setupField("Title", "title", "", "text", "Shown to customers at checkout.", " maxlength=\"200\" required") +
+        _setupField("Fee (minor units)", "fee_minor", "", "number", "Set this equal to the variant's catalog price; the fee is charged as a real cart line.", " min=\"0\" required") +
+        _setupField("Image URL", "image_url", "", "text", "Optional. https:// or /absolute path.", " maxlength=\"2048\"") +
+        _setupField("Max per order", "max_per_order", "", "number", "Optional cap on wraps per order.", " min=\"1\"") +
+        "<div class=\"actions-row\"><button type=\"submit\" class=\"btn\">Save wrap</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Gift wraps</h2>" + saved + notice + table + form + "</section>";
+  return _renderAdminShell(opts.shop_name, "Gift wraps", body, "gift-wraps", opts.nav_available);
+}
+
 // One rating card for the moderation queue / recent list. Shows the three
 // scores, the (escaped) comment, the flag state + reason, and the operator
 // reply — plus the flag / reply action forms.
@@ -14086,6 +14894,98 @@ function _announcementPatchFromForm(body) {
   return patch;
 }
 
+// ---- search-ranking form coercion -----------------------------------
+
+// `?from`/`?to` ms-epoch query params for the metrics rollup → integer, or a
+// supplied fallback when blank/unparseable.
+function _searchRankingMsParam(v, fallback) {
+  if (v == null || v === "") return fallback;
+  var n = parseInt(v, 10);
+  return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+
+// A position form field → integer (the primitive validates the 1..MAX range +
+// throws a TypeError on a bad shape). A blank/non-numeric value is forwarded
+// as NaN so the primitive's validator (not this coercion) reports it.
+function _searchRankingIntField(v) {
+  if (v == null || v === "") return NaN;
+  var n = parseInt(v, 10);
+  return Number.isFinite(n) ? n : NaN;
+}
+
+// ---- trust-badge form coercion --------------------------------------
+
+// Read the placements multi-checkbox into a non-empty array. An HTML form
+// submits repeated `placements` fields as an array (when >1 checked) or a
+// single string (when exactly 1 checked). The primitive validates membership
+// + the 1..6 count + dedup, throwing a TypeError on a bad shape.
+function _trustBadgePlacements(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (typeof raw === "string" && raw.length) return [raw];
+  return [];   // empty → the primitive's _placements throws "non-empty array"
+}
+
+// Coerce the create form into the shape trustBadges.defineBadge expects.
+// EITHER svg_payload OR image_url (blank maps to absent so the primitive's
+// either/or rule applies). The primitive is authoritative on every field
+// (SVG sanitize via guardSvg, URL via safeUrl, slug/title/alt shape, priority
+// range, schedule monotonicity) and throws a TypeError on a bad shape, which
+// both surfaces degrade to a clean 400 / err notice.
+function _trustBadgeFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:       typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    title:      body.title,
+    alt_text:   body.alt_text,
+    placements: _trustBadgePlacements(body.placements),
+  };
+  var svg = typeof body.svg_payload === "string" ? body.svg_payload.trim() : "";
+  var img = typeof body.image_url === "string" ? body.image_url.trim() : "";
+  if (svg) out.svg_payload = svg;
+  if (img) out.image_url = img;
+  var link = typeof body.link_url === "string" ? body.link_url.trim() : "";
+  if (link) out.link_url = link;
+  if (body.priority != null && body.priority !== "") {
+    var p = parseInt(body.priority, 10);
+    out.priority = Number.isFinite(p) ? p : body.priority;
+  }
+  var sa = _epochFromForm(body.starts_at);  if (sa != null) out.starts_at = sa;
+  var ea = _epochFromForm(body.expires_at); if (ea != null) out.expires_at = ea;
+  return out;
+}
+
+// Coerce the edit form into an updateBadge patch. Each editable column rides
+// only when its hidden presence marker says so, so a partial edit doesn't
+// clear an unrelated column. The svg_payload / image_url pair is mutually
+// exclusive on the resulting row (the primitive enforces it); the edit form
+// only ever sends the column the badge already uses.
+function _trustBadgePatchFromForm(body) {
+  body = body || {};
+  var patch = {};
+  if (body.title != null && body.title !== "") patch.title = body.title;
+  if (body.alt_text != null && body.alt_text !== "") patch.alt_text = body.alt_text;
+  if (body.placements_present === "1") patch.placements = _trustBadgePlacements(body.placements);
+  if (body.svg_present === "1") {
+    var svg = typeof body.svg_payload === "string" ? body.svg_payload.trim() : "";
+    patch.svg_payload = svg ? svg : null;
+  }
+  if (body.image_present === "1") {
+    var img = typeof body.image_url === "string" ? body.image_url.trim() : "";
+    patch.image_url = img ? img : null;
+  }
+  if (body.link_present === "1") {
+    var link = typeof body.link_url === "string" ? body.link_url.trim() : "";
+    patch.link_url = link ? link : null;
+  }
+  if (body.priority != null && body.priority !== "") {
+    var p = parseInt(body.priority, 10);
+    patch.priority = Number.isFinite(p) ? p : body.priority;
+  }
+  if (body.starts_present === "1")  patch.starts_at  = _epochFromForm(body.starts_at);
+  if (body.expires_present === "1") patch.expires_at = _epochFromForm(body.expires_at);
+  return patch;
+}
+
 // Coerce the create form into the shape preorder.defineCampaign expects.
 // Prices are entered + stored in MINOR units (cents) — the form labels say
 // so, and the JSON API uses minor units too. The launch date is a
@@ -14257,6 +15157,237 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// Search-ranking console — the weight-set list (active flag + activate /
+// archive actions), the create form (slug + name + JSON weight map), the
+// per-query pin manager, and an optional per-set metrics rollup. Every
+// free-text value (name, query, product_id) is _htmlEscape'd before it lands
+// in raw HTML — the weight-set name + the pin query are the XSS-sensitive
+// operator strings (see the flow test's payload assertion).
+function renderAdminSearchRanking(opts) {
+  opts = opts || {};
+  var weights = opts.weights || [];
+  var active  = opts.active || null;
+  var banners = "";
+  if (opts.created)   banners += "<div class=\"banner banner--ok\">Weight set saved.</div>";
+  if (opts.activated) banners += "<div class=\"banner banner--ok\">Active weight set updated.</div>";
+  if (opts.archived)  banners += "<div class=\"banner banner--ok\">Weight set archived.</div>";
+  if (opts.pinned)    banners += "<div class=\"banner banner--ok\">Product pinned.</div>";
+  if (opts.unpinned)  banners += "<div class=\"banner banner--ok\">Pin removed.</div>";
+  if (opts.notice)    banners += "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>";
+
+  var rows = weights.map(function (w) {
+    var isArchived = w.archived_at != null;
+    var isActive   = w.active === true;
+    var weightStr;
+    try { weightStr = JSON.stringify(w.weights || {}); } catch (_e) { weightStr = "{}"; }
+    var actions = "";
+    if (!isArchived) {
+      if (!isActive) {
+        actions += "<form method=\"post\" action=\"/admin/search-ranking/weights/" + _htmlEscape(encodeURIComponent(w.slug)) + "/activate\" class=\"form-inline\">" +
+          "<button class=\"btn\" type=\"submit\">Make active</button></form> ";
+      }
+      actions += "<form method=\"post\" action=\"/admin/search-ranking/weights/" + _htmlEscape(encodeURIComponent(w.slug)) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
+    }
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(w.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(w.name) + "</td>" +
+      "<td><code>" + _htmlEscape(weightStr) + "</code></td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : (isActive ? "paid" : "")) + "\">" +
+        (isArchived ? "archived" : (isActive ? "active" : "inactive")) + "</span></td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+  var table = weights.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Slug</th><th scope=\"col\">Name</th><th scope=\"col\">Weights</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No weight sets yet. Create one below and make it active to rerank storefront search.</p>";
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create a weight set</h3>" +
+      "<p class=\"meta\">A weight set maps result signals to multipliers. Available signals on storefront results: <code>in_stock</code> (1 when any variant is in stock), <code>price_minor</code>. Score = sum(weight &times; signal); results sort by score descending.</p>" +
+      "<form method=\"post\" action=\"/admin/search-ranking/weights\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, e.g. in-stock-first — a stable id.", " maxlength=\"64\" required") +
+        _setupField("Name", "name", "", "text", "A human label for the console.", " maxlength=\"200\" required") +
+        "<label class=\"form-field\"><span>Weights (JSON)</span><textarea name=\"weights\" rows=\"4\" required>{&quot;in_stock&quot;:1}</textarea><small>A flat JSON object of signal &rarr; number, e.g. {&quot;in_stock&quot;:1,&quot;price_minor&quot;:-0.0001}.</small></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create weight set</button></div>" +
+      "</form>" +
+    "</div>";
+
+  // Per-query pin manager.
+  var pinsQuery = opts.pins_query;
+  var pins = opts.pins || [];
+  var pinRows = pins.map(function (p) {
+    return "<tr>" +
+      "<td><code>" + _htmlEscape(p.product_id) + "</code></td>" +
+      "<td>" + _htmlEscape(String(p.position)) + "</td>" +
+      "<td><form method=\"post\" action=\"/admin/search-ranking/pins/delete\" class=\"form-inline\">" +
+        "<input type=\"hidden\" name=\"query\" value=\"" + _htmlEscape(pinsQuery || "") + "\">" +
+        "<input type=\"hidden\" name=\"product_id\" value=\"" + _htmlEscape(p.product_id) + "\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Unpin</button></form></td>" +
+    "</tr>";
+  }).join("");
+  var pinLookupForm =
+    "<form method=\"get\" action=\"/admin/search-ranking\" class=\"form-inline\">" +
+      "<input type=\"text\" name=\"pins_query\" value=\"" + _htmlEscape(pinsQuery || "") + "\" placeholder=\"search query\" maxlength=\"500\">" +
+      "<button class=\"btn\" type=\"submit\">View pins</button>" +
+    "</form>";
+  var pinTable = pinsQuery
+    ? (pins.length
+        ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Product id</th><th scope=\"col\">Position</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + pinRows + "</tbody></table></div>"
+        : "<p class=\"empty\">No pins for &ldquo;" + _htmlEscape(pinsQuery) + "&rdquo; yet.</p>")
+    : "";
+  var pinCreateForm = pinsQuery
+    ? "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Pin a product</h3>" +
+        "<form method=\"post\" action=\"/admin/search-ranking/pins\">" +
+          "<input type=\"hidden\" name=\"query\" value=\"" + _htmlEscape(pinsQuery) + "\">" +
+          _setupField("Product id", "product_id", "", "text", "The product id (or upstream SKU) to pin.", " maxlength=\"128\" required") +
+          _setupField("Position", "position", "1", "number", "1 = top of the results for this query.", " min=\"1\" max=\"1000\" required") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Pin product</button></div>" +
+        "</form></div>"
+    : "";
+  var pinsSection =
+    "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Per-query pins</h3>" +
+      "<p class=\"meta\">Pin specific products to fixed positions for a search query. Pinned products lead the results regardless of their weighted score.</p>" +
+      pinLookupForm + "</div>" + pinTable + pinCreateForm;
+
+  // Optional metrics rollup.
+  var metrics = opts.metrics;
+  var metricsSection = "";
+  if (metrics) {
+    function _ratio(r) { return r == null ? "—" : (Math.round(r * 10000) / 100) + "%"; }
+    metricsSection =
+      "<div class=\"panel mt mw-40\"><h3 class=\"subhead\">Metrics — " + _htmlEscape(metrics.weights_slug) + "</h3>" +
+        "<dl class=\"totals-list\">" +
+          "<dt>Impressions</dt><dd>" + _htmlEscape(String(metrics.impressions)) + "</dd>" +
+          "<dt>Clicks</dt><dd>" + _htmlEscape(String(metrics.clicks)) + "</dd>" +
+          "<dt>Purchases</dt><dd>" + _htmlEscape(String(metrics.purchases)) + "</dd>" +
+          "<dt>CTR</dt><dd>" + _ratio(metrics.ctr) + "</dd>" +
+          "<dt>Conversion</dt><dd>" + _ratio(metrics.conversion_rate) + "</dd>" +
+          "<dt>Click&rarr;purchase</dt><dd>" + _ratio(metrics.click_to_purchase) + "</dd>" +
+        "</dl></div>";
+  }
+
+  var activeLine = active
+    ? "<p class=\"meta\">Active weight set: <strong>" + _htmlEscape(active.name) + "</strong> (<code>" + _htmlEscape(active.slug) + "</code>).</p>"
+    : "<p class=\"meta\">No active weight set — storefront search uses its default order.</p>";
+
+  var bodyHtml = "<section><h2>Search ranking</h2>" + banners + activeLine + table + createForm + pinsSection + metricsSection + "</section>";
+  return _renderAdminShell(opts.shop_name, "Search ranking", bodyHtml, "search-ranking", opts.nav_available);
+}
+
+// Trust-badge console — the badge list (placements + status + edit / archive
+// actions) and the create form (svg payload OR image url, link, placements,
+// schedule, priority, alt text). The raw svg_payload is NEVER echoed into an
+// admin attribute — it rides only inside a <textarea> on the edit screen
+// (which escapes < and &). title + alt_text are _htmlEscape'd in the list.
+function renderAdminTrustBadges(opts) {
+  opts = opts || {};
+  var badges = opts.badges || [];
+  var banners = "";
+  if (opts.created)  banners += "<div class=\"banner banner--ok\">Badge saved.</div>";
+  if (opts.archived) banners += "<div class=\"banner banner--ok\">Badge archived.</div>";
+  if (opts.notice)   banners += "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>";
+
+  var rows = badges.map(function (bd) {
+    var isArchived = bd.archived_at != null;
+    var kind = bd.svg_payload ? "SVG" : "image";
+    var placements = Array.isArray(bd.placements) ? bd.placements.join(", ") : "";
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(bd.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(bd.title) + "</td>" +
+      "<td>" + _htmlEscape(kind) + "</td>" +
+      "<td>" + _htmlEscape(placements) + "</td>" +
+      "<td>" + _htmlEscape(String(bd.priority)) + "</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        (isArchived ? "" :
+          "<a class=\"btn btn--ghost\" href=\"/admin/trust-badges/" + _htmlEscape(encodeURIComponent(bd.slug)) + "\">Edit</a> " +
+          "<form method=\"post\" action=\"/admin/trust-badges/" + _htmlEscape(encodeURIComponent(bd.slug)) + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+  var table = badges.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Slug</th><th scope=\"col\">Title</th><th scope=\"col\">Kind</th><th scope=\"col\">Placements</th><th scope=\"col\">Priority</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No trust badges yet. Create one below.</p>";
+
+  var placementChecks = trustBadgesModule.ALLOWED_PLACEMENTS.map(function (pl) {
+    var live = pl === "checkout" || pl === "order_confirmation";
+    return "<label class=\"kv\"><input type=\"checkbox\" name=\"placements\" value=\"" + pl + "\"" + (live ? " checked" : "") + "> " +
+      _htmlEscape(pl) + (live ? "" : " (not yet rendered)") + "</label>";
+  }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create a trust badge</h3>" +
+      "<p class=\"meta\">Supply EITHER an inline SVG payload OR a hosted https:// image URL (not both). Badges render today at the <strong>checkout</strong> and <strong>order confirmation</strong> placements; the other placements are accepted now and will render in a later update. SVG is sanitized on save (no script / event handlers).</p>" +
+      "<form method=\"post\" action=\"/admin/trust-badges\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id.", " maxlength=\"80\" required") +
+        _setupField("Title", "title", "", "text", "Shown as the badge's hover title.", " maxlength=\"200\" required") +
+        _setupField("Alt text", "alt_text", "", "text", "Describes the badge for assistive tech.", " maxlength=\"300\" required") +
+        "<label class=\"form-field\"><span>SVG payload (optional)</span><textarea name=\"svg_payload\" rows=\"4\" placeholder=\"&lt;svg ...&gt;...&lt;/svg&gt;\"></textarea><small>Inline SVG — sanitized on save. Leave blank to use an image URL instead.</small></label>" +
+        _setupField("Image URL (optional)", "image_url", "", "text", "https:// or a /-rooted path. Leave blank to use SVG instead.", " maxlength=\"2048\"") +
+        _setupField("Link URL (optional)", "link_url", "", "text", "https:// or a /-rooted path the badge links to.", " maxlength=\"2048\"") +
+        "<fieldset class=\"form-field\"><legend>Placements</legend>" + placementChecks + "</fieldset>" +
+        _setupField("Priority", "priority", "0", "number", "Higher shows first within a placement.", " min=\"0\" max=\"1000000\"") +
+        "<label class=\"form-field\"><span>Starts at (optional)</span><input type=\"datetime-local\" name=\"starts_at\"></label>" +
+        "<label class=\"form-field\"><span>Expires at (optional)</span><input type=\"datetime-local\" name=\"expires_at\"></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create badge</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Trust badges</h2>" + banners + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Trust badges", bodyHtml, "trust-badges", opts.nav_available);
+}
+
+// Trust-badge detail/edit screen. The svg_payload rides ONLY inside a
+// <textarea> (escaped) — never an attribute — so a hostile-but-sanitized
+// payload can't break out. Hidden presence markers let a partial edit avoid
+// clearing unrelated columns.
+function renderAdminTrustBadge(opts) {
+  opts = opts || {};
+  var bd = opts.badge || {};
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Badge updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var enc = _htmlEscape(encodeURIComponent(bd.slug || ""));
+
+  var placementSet = {};
+  (Array.isArray(bd.placements) ? bd.placements : []).forEach(function (p) { placementSet[p] = true; });
+  var placementChecks = trustBadgesModule.ALLOWED_PLACEMENTS.map(function (pl) {
+    return "<label class=\"kv\"><input type=\"checkbox\" name=\"placements\" value=\"" + pl + "\"" + (placementSet[pl] ? " checked" : "") + "> " + _htmlEscape(pl) + "</label>";
+  }).join("");
+
+  var startsVal   = _datetimeLocalValue(bd.starts_at);
+  var expiresVal  = _datetimeLocalValue(bd.expires_at);
+
+  var body =
+    "<section class=\"mw-40\">" +
+      "<h2>Edit badge — " + _htmlEscape(bd.slug || "") + "</h2>" +
+      updated + notice +
+      "<form method=\"post\" action=\"/admin/trust-badges/" + enc + "/edit\">" +
+        _setupField("Title", "title", bd.title, "text", "", " maxlength=\"200\" required") +
+        _setupField("Alt text", "alt_text", bd.alt_text, "text", "", " maxlength=\"300\" required") +
+        "<input type=\"hidden\" name=\"svg_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>SVG payload</span><textarea name=\"svg_payload\" rows=\"4\">" + _htmlEscape(bd.svg_payload || "") + "</textarea><small>Sanitized on save. Blank this to switch to an image URL.</small></label>" +
+        "<input type=\"hidden\" name=\"image_present\" value=\"1\">" +
+        _setupField("Image URL", "image_url", bd.image_url || "", "text", "Blank this to switch to an SVG payload.", " maxlength=\"2048\"") +
+        "<input type=\"hidden\" name=\"link_present\" value=\"1\">" +
+        _setupField("Link URL", "link_url", bd.link_url || "", "text", "https:// or a /-rooted path.", " maxlength=\"2048\"") +
+        "<input type=\"hidden\" name=\"placements_present\" value=\"1\">" +
+        "<fieldset class=\"form-field\"><legend>Placements</legend>" + placementChecks + "</fieldset>" +
+        _setupField("Priority", "priority", String(bd.priority == null ? 0 : bd.priority), "number", "", " min=\"0\" max=\"1000000\"") +
+        "<input type=\"hidden\" name=\"starts_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>Starts at</span><input type=\"datetime-local\" name=\"starts_at\" value=\"" + _htmlEscape(startsVal) + "\"></label>" +
+        "<input type=\"hidden\" name=\"expires_present\" value=\"1\">" +
+        "<label class=\"form-field\"><span>Expires at</span><input type=\"datetime-local\" name=\"expires_at\" value=\"" + _htmlEscape(expiresVal) + "\"></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save badge</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/trust-badges\">Back to badges</a></div>" +
+      "</form>" +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Edit badge", body, "trust-badges", opts.nav_available);
+}
+
 // Pre-order campaign console — the list table (status + reserved/available
 // counts + release date), the lifecycle actions (launch once the release date
 // has arrived, close any time), and the create form. The launch button only
@@ -16127,4 +17258,7 @@ module.exports = {
   renderAdminLoyaltyReward:     renderAdminLoyaltyReward,
   renderAdminConfirm:      renderAdminConfirm,
   renderAdminAudit:        renderAdminAudit,
+  renderAdminPickupLocations: renderAdminPickupLocations,
+  renderAdminPickups:      renderAdminPickups,
+  renderAdminGiftWraps:    renderAdminGiftWraps,
 };