@blamejs/blamejs-shop 0.3.53 → 0.3.54

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.54 (2026-06-02) — **In-store pickup, saved payment methods, and gift wrapping at checkout.** Three more built-but-unreachable capabilities are now wired end to end. Operators can offer in-store pickup with managed pickup locations and a fulfilment queue; signed-in customers can save a card and reuse it at checkout; and operators can offer gift wrapping with a per-order gift message. The gift-wrap fee is added as a real cart line so it is included in the charged total. **Added:** *In-store pickup (click and collect)* — Operators can define pickup locations and work a pickup queue in the admin console (filtered by location), and shoppers can choose 'Pick up in store' at checkout. The order page and a new account pickups view show the pickup status. A not-found pickup or location returns a clear not-found rather than a generic error. · *Saved payment methods* — When Stripe is configured, a signed-in customer can save a card via a secure setup flow (loaded through a route-scoped policy and a same-origin script, with no inline script), manage their saved cards under their account, set a default, and reuse a saved card at checkout. A customer can only ever see or change their own saved cards. · *Gift wrapping at checkout* — Operators can define gift-wrap options (with a fee) in the admin console, and shoppers can add a wrap plus a gift message and recipient at checkout. The wrap fee is added as a real cart line, so it is included in the order total and the amount charged — never applied after the charge.
+
 - v0.3.53 (2026-06-02) — **Back-in-stock notifications, operator-tunable search ranking, and trust badges.** Three capabilities that were built into the framework but reachable from no route are now wired end to end. A shopper looking at an out-of-stock variant can ask to be emailed when it returns; operators can tune how search results are ordered and pin products for specific queries; and operators can author trust badges that render at checkout and on the order-confirmation page. **Added:** *Back-in-stock notifications* — When a variant is out of stock, the product page now shows a 'Notify me when it's back' form. The shopper confirms by email (double opt-in), and a scheduled sweep emails everyone waiting when stock returns, with a one-click unsubscribe. The notify form is served on the cached product page and is protected by same-site and fetch-metadata checks. · *Operator-tunable search ranking* — A new Search ranking screen in the admin console lets an operator define weighted ranking signals, activate a weight set, and pin specific products to the top for a given query. Ranking is applied to the search results; if a ranking configuration is missing or invalid, search falls back to its default order rather than erroring. · *Trust badges* — A new Trust badges screen lets an operator author badges (with scheduling windows) that render at checkout and on the order-confirmation page, with impression tracking. Badge content — including any SVG — is sanitized when saved.
 
 - v0.3.52 (2026-06-02) — **Read-only admin audit log, database backup tooling, an email-deliverability guide, and a cryptographic integrity gate over the vendored framework.** Audit events were recorded but had no console view, there was no documented database backup path, no operator guidance for email deliverability, and the vendored framework tree was only checked for presence — not integrity. This release adds a read-only audit log screen in the admin console, a database export script plus point-in-time recovery documentation, an SPF/DKIM/DMARC deliverability guide, and a build gate that cryptographically verifies every file in the vendored framework so a tampered or accidentally edited dependency fails the build. **Added:** *Admin audit log screen* — A read-only Audit screen in the admin console lists recorded audit events — action, outcome, actor, resource, and details — with an outcome filter and pagination. Every field is HTML-escaped. The screen is a pure observability view: if the audit store is briefly unavailable it shows an empty table with a notice rather than erroring. · *Database backup and recovery tooling* — A new export script wraps the D1 export command (suitable for a scheduled export to object storage), and the operator docs gain a recovery section pointing at D1 Time Travel for point-in-time restore. · *Email deliverability operator guide* — SECURITY.md and the README gain an email-deliverability section covering the SPF, DKIM, and DMARC DNS setup that determines whether transactional and cart-recovery mail reaches the inbox, alongside the already-handled one-click unsubscribe and suppression behavior. · *Cryptographic integrity gate over the vendored framework* — The build now re-hashes every file in the vendored framework tree against a pinned manifest and fails if any digest changes, giving the no-hand-edits-to-vendored-code rule real enforcement. The check runs across the test matrix and inside the container image build.

package/lib/admin.js

@@ -515,6 +515,8 @@ function mount(router, deps) {
   var complianceExport = deps.complianceExport || null; // DSR queue (export/erasure) disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
   var orderRatings    = deps.orderRatings    || null; // per-order rating moderation queue (flag/clear + public reply) disabled when absent
+  var clickAndCollect = deps.clickAndCollect || null; // pickup-locations CRUD + pickup queue console disabled when absent
+  var giftOptions     = deps.giftOptions     || null; // gift-wrap catalog console disabled when absent
   var searchRanking   = deps.searchRanking   || null; // search-ranking weight-set + pin console disabled when absent
   var trustBadges     = deps.trustBadges     || null; // trust-badge authoring console disabled when absent
   var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
@@ -531,7 +533,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4596,6 +4598,318 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- click-and-collect (pickup locations + the pickup queue) --------
+  //
+  // Two operator surfaces: the pickup-location CRUD (define / archive) and
+  // the front-counter pickup queue per location (the FSM: ready / picked-up
+  // / no-show). The primitive throws PLAIN TypeError (no `.code`) on every
+  // refusal EXCEPT markPickedUp's internal `fsm/illegal-transition` handling,
+  // so the action wrapper maps TypeError → 400/?err=1 — but RESOLVES EXISTENCE
+  // FIRST (getScheduleByOrder / getLocation null → 404) so a not-found isn't
+  // mislabeled a bad-shape 400.
+  if (clickAndCollect) {
+    // Parse the operator's hours textarea (one "Mon 09:00-17:00" line per
+    // weekday) into the hours_json object the primitive validates. An empty
+    // textarea yields {} (the primitive only requires a JSON-serialisable
+    // object). Unparseable lines are skipped so a typo doesn't 500 the save.
+    function _parseHoursJson(raw) {
+      var hours = {};
+      if (typeof raw !== "string" || !raw.trim()) return hours;
+      raw.split(/\r?\n/).forEach(function (line) {
+        var m = line.trim().match(/^([A-Za-z]{3,})\s+(\d{1,2}:\d{2})\s*-\s*(\d{1,2}:\d{2})$/);
+        if (m) hours[m[1].toLowerCase().slice(0, 3)] = { open: m[2], close: m[3] };
+      });
+      return hours;
+    }
+
+    // GET /admin/pickup-locations — the active-location list (the primitive
+    // has no "list all incl archived" verb; archived rows drop out of
+    // availableLocations, which is the operator's working set — re-open an
+    // archived-locations list if operators ask for it).
+    router.get("/admin/pickup-locations", _pageOrApi(true,
+      R(async function (req, res) {
+        var rows = await clickAndCollect.availableLocations({ limit: 200 });
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await clickAndCollect.availableLocations({ limit: 200 });
+        _sendHtml(res, 200, renderAdminPickupLocations({
+          shop_name: deps.shop_name, nav_available: navAvailable, locations: rows,
+          saved: url && url.searchParams.get("saved"),
+          notice: url && url.searchParams.get("err") ? "That location couldn't be saved — check the fields and try again." : null,
+        }));
+      },
+    ));
+
+    // POST /admin/pickup-locations — definePickupLocation upsert. A bad
+    // shape (missing name / bad capacity / bad address) is a TypeError → 400.
+    router.post("/admin/pickup-locations", _pageOrApi(false,
+      W("pickup.location.define", async function (req, res) {
+        var body = req.body || {};
+        var loc;
+        try { loc = await _definePickupFromBody(body); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 201, loc);
+        return loc;
+      }),
+      async function (req, res) {
+        try { await _definePickupFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickup-locations?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup.location.define", outcome: "success", metadata: { code: (req.body || {}).code } });
+        _redirect(res, "/admin/pickup-locations?saved=1");
+      },
+    ));
+
+    function _definePickupFromBody(body) {
+      return clickAndCollect.definePickupLocation({
+        code:              body.code,
+        name:              body.name,
+        address:          { line1: body.line1, city: body.city, country: body.country },
+        hours_json:        _parseHoursJson(body.hours),
+        capacity_per_hour: parseInt(body.capacity_per_hour, 10),
+        lead_time_hours:   parseInt(body.lead_time_hours, 10),
+        active:            !(body.active === "0" || body.active === false),
+      });
+    }
+
+    // POST /admin/pickup-locations/:code/archive — soft-delete. Resolve
+    // existence first (getLocation null → 404) so a typo'd code is a 404, not
+    // a 400/500. The archive verb itself only throws on a malformed code.
+    router.post("/admin/pickup-locations/:code/archive", _pageOrApi(false,
+      W("pickup.location.archive", async function (req, res) {
+        var code = req.params.code;
+        var existing;
+        try { existing = await clickAndCollect.getLocation(code); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "pickup-location-not-found");
+        var row = await clickAndCollect.archiveLocation(code);
+        _json(res, 200, row);
+        return row;
+      }),
+      async function (req, res) {
+        var code = req.params.code;
+        var existing;
+        try { existing = await clickAndCollect.getLocation(code); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickup-locations?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/pickup-locations?err=1");
+        await clickAndCollect.archiveLocation(code);
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup.location.archive", outcome: "success", metadata: { code: code } });
+        _redirect(res, "/admin/pickup-locations?saved=1");
+      },
+    ));
+
+    // GET /admin/pickups — the per-location pickup queue. The primitive has
+    // no all-locations queue verb, so the screen requires a ?location=
+    // selector defaulting to the first active location. A wide window
+    // (now-7d … now+30d) bounds the read.
+    router.get("/admin/pickups", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var locs = await clickAndCollect.availableLocations({ limit: 200 });
+        var selected = (url && url.searchParams.get("location")) || (locs[0] && locs[0].code) || null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = selected ? await _pickupQueue(selected, status) : [];
+        _json(res, 200, { rows: rows, location: selected, status: status });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var locs = await clickAndCollect.availableLocations({ limit: 200 });
+        var selected = (url && url.searchParams.get("location")) || (locs[0] && locs[0].code) || null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = [];
+        if (selected) {
+          try { rows = await _pickupQueue(selected, status); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; rows = []; }
+        }
+        _sendHtml(res, 200, renderAdminPickups({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          locations: locs, selected: selected, status: status, pickups: rows,
+          moved:  url && url.searchParams.get("moved"),
+          notice: url && url.searchParams.get("err") ? "That pickup action couldn't be completed." : null,
+        }));
+      },
+    ));
+
+    function _pickupQueue(locationCode, status) {
+      var now = Date.now();
+      var opts2 = {
+        location_code: locationCode,
+        from: now - b.constants.TIME.days(7),
+        to:   now + b.constants.TIME.days(30),
+      };
+      if (status && PICKUP_QUEUE_STATUSES.indexOf(status) !== -1) opts2.status = status;
+      return clickAndCollect.pickupsForLocation(opts2);
+    }
+
+    // The three FSM action routes. Each RESOLVES EXISTENCE FIRST
+    // (getScheduleByOrder null → 404) so a not-found order isn't mislabeled a
+    // 400; a real refusal (wrong status / bad shape) is a TypeError → 400.
+    function _pickupAction(verb, auditEvent, opFn) {
+      router.post("/admin/pickups/:order_id/" + verb, _pageOrApi(false,
+        W("pickup." + auditEvent, async function (req, res) {
+          var orderId = req.params.order_id;
+          var existing;
+          try { existing = await clickAndCollect.getScheduleByOrder(orderId); }
+          catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+          if (!existing) return _problem(res, 404, "pickup-schedule-not-found");
+          var row;
+          try { row = await opFn(orderId, req.body || {}); }
+          catch (e) {
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            if (e && e.code === "fsm/illegal-transition") return _problem(res, 409, "conflict", e.message);
+            throw e;
+          }
+          _json(res, 200, row);
+          return row;
+        }),
+        async function (req, res) {
+          var orderId = req.params.order_id;
+          var existing;
+          try { existing = await clickAndCollect.getScheduleByOrder(orderId); }
+          catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/pickups?err=1"); throw e; }
+          if (!existing) return _redirect(res, "/admin/pickups?err=1");
+          var backLoc = "&location=" + encodeURIComponent(existing.location_code);
+          try { await opFn(orderId, req.body || {}); }
+          catch (e) {
+            if (e instanceof TypeError || (e && e.code === "fsm/illegal-transition")) {
+              return _redirect(res, "/admin/pickups?err=1" + backLoc);
+            }
+            throw e;
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".pickup." + auditEvent, outcome: "success", metadata: { order_id: orderId } });
+          _redirect(res, "/admin/pickups?moved=1" + backLoc);
+        },
+      ));
+    }
+    _pickupAction("ready", "ready", function (orderId) {
+      return clickAndCollect.markReadyForPickup({ order_id: orderId });
+    });
+    _pickupAction("picked-up", "picked_up", function (orderId, body) {
+      return clickAndCollect.markPickedUp({
+        order_id: orderId, picked_up_at: Date.now(),
+        signature: body.signature || undefined,
+        customer_id_proof_kind: body.proof_kind || undefined,
+      });
+    });
+    _pickupAction("no-show", "no_show", function (orderId, body) {
+      return clickAndCollect.markNoShow({ order_id: orderId, reason: body.reason });
+    });
+  }
+
+  // ---- gift wraps -----------------------------------------------------
+  //
+  // The operator-defined gift-wrap catalog: define / update / archive a wrap
+  // option whose wrap_sku is a real catalog variant (so the fee flows through
+  // inventory + pricing). defineWrap / updateWrap / archiveWrap throw PLAIN
+  // TypeError on a bad shape / unknown sku / not-found → 400; update/archive
+  // resolve existence first (getWrap null → 404) for parity.
+  if (giftOptions) {
+    router.get("/admin/gift-wraps", _pageOrApi(true,
+      R(async function (req, res) {
+        var rows = await giftOptions.listWraps({});
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await giftOptions.listWraps({});
+        _sendHtml(res, 200, renderAdminGiftWraps({
+          shop_name: deps.shop_name, nav_available: navAvailable, wraps: rows,
+          saved: url && url.searchParams.get("saved"),
+          notice: url && url.searchParams.get("err") ? "That wrap couldn't be saved — the SKU must be a real catalog variant." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/gift-wraps", _pageOrApi(false,
+      W("gift.wrap.define", async function (req, res) {
+        var wrap;
+        try { wrap = await _defineWrapFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 201, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        try { await _defineWrapFromBody(req.body || {}); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.define", outcome: "success", metadata: { wrap_sku: (req.body || {}).wrap_sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+
+    function _defineWrapFromBody(body) {
+      return giftOptions.defineWrap({
+        wrap_sku:      body.wrap_sku,
+        title:         body.title,
+        fee_minor:     parseInt(body.fee_minor, 10),
+        image_url:     body.image_url ? body.image_url : undefined,
+        max_per_order: body.max_per_order ? parseInt(body.max_per_order, 10) : undefined,
+        active:        !(body.active === "0" || body.active === false),
+      });
+    }
+
+    router.post("/admin/gift-wraps/:wrap_sku/update", _pageOrApi(false,
+      W("gift.wrap.update", async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "gift-wrap-not-found");
+        var wrap;
+        try { wrap = await giftOptions.updateWrap(sku, _wrapPatchFromBody(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/gift-wraps?err=1");
+        try { await giftOptions.updateWrap(sku, _wrapPatchFromBody(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.update", outcome: "success", metadata: { wrap_sku: sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+
+    // Build the updateWrap patch from the edit form — only the columns the
+    // operator actually changed (a blank field is omitted, never sent as "").
+    function _wrapPatchFromBody(body) {
+      var patch = {};
+      if (body.title != null && body.title !== "")              patch.title = body.title;
+      if (body.fee_minor != null && body.fee_minor !== "")      patch.fee_minor = parseInt(body.fee_minor, 10);
+      if (body.image_url != null && body.image_url !== "")      patch.image_url = body.image_url;
+      if (body.max_per_order != null && body.max_per_order !== "") patch.max_per_order = parseInt(body.max_per_order, 10);
+      if (body.active != null)                                  patch.active = !(body.active === "0" || body.active === false);
+      return patch;
+    }
+
+    router.post("/admin/gift-wraps/:wrap_sku/archive", _pageOrApi(false,
+      W("gift.wrap.archive", async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!existing) return _problem(res, 404, "gift-wrap-not-found");
+        var wrap = await giftOptions.archiveWrap(sku);
+        _json(res, 200, wrap);
+        return wrap;
+      }),
+      async function (req, res) {
+        var sku = req.params.wrap_sku;
+        var existing;
+        try { existing = await giftOptions.getWrap(sku); }
+        catch (e) { if (e instanceof TypeError) return _redirect(res, "/admin/gift-wraps?err=1"); throw e; }
+        if (!existing) return _redirect(res, "/admin/gift-wraps?err=1");
+        await giftOptions.archiveWrap(sku);
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift.wrap.archive", outcome: "success", metadata: { wrap_sku: sku } });
+        _redirect(res, "/admin/gift-wraps?saved=1");
+      },
+    ));
+  }
+
   // ---- config ---------------------------------------------------------
 
   var config = deps.config || null;
@@ -10277,6 +10591,9 @@ var ADMIN_NAV_ITEMS = [
   { key: "dsr",          href: "/admin/dsr",          label: "Privacy requests", requires: "complianceExport" },
   { key: "exchanges",    href: "/admin/exchanges",    label: "Exchanges",    requires: "orderExchanges" },
   { key: "ratings",      href: "/admin/ratings",      label: "Ratings",      requires: "orderRatings" },
+  { key: "pickup-locations", href: "/admin/pickup-locations", label: "Pickup locations", requires: "clickAndCollect" },
+  { key: "pickups",      href: "/admin/pickups",      label: "Pickups",      requires: "clickAndCollect" },
+  { key: "gift-wraps",   href: "/admin/gift-wraps",   label: "Gift wraps",   requires: "giftOptions" },
   { key: "search-ranking", href: "/admin/search-ranking", label: "Search ranking", requires: "searchRanking" },
   { key: "trust-badges", href: "/admin/trust-badges", label: "Trust badges", requires: "trustBadges" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
@@ -12458,6 +12775,9 @@ function renderAdminDsrDetail(opts) {
 // lifecycle order (the terminal closed / rejected don't appear in the open
 // queue, so they're not filter chips).
 var EXCHANGE_STATUS_FILTERS = ["pending", "approved", "shipped", "delivered", "received"];
+// The pickup-queue status chips the operator can filter by (mirrors the
+// click-and-collect FSM statuses the pickupsForLocation read accepts).
+var PICKUP_QUEUE_STATUSES = ["scheduled", "ready", "picked_up", "no_show", "cancelled"];
 
 function _exchangePillClass(status) {
   if (status === "closed")   return "paid";       // completed — green
@@ -12612,6 +12932,197 @@ function renderAdminExchange(opts) {
   return _renderAdminShell(opts.shop_name, "Exchange " + String(x.id).slice(0, 8), body, "exchanges", opts.nav_available);
 }
 
+// ---- click-and-collect render fns -----------------------------------
+
+// Pickup-locations CRUD screen: the active-location list (each with an
+// archive form) + a define/upsert form. Every operator free-text field —
+// name, address parts, hours — is HTML-escaped at the sink (the primitive
+// validates length/shape, NOT HTML, so escaping here is the XSS guard).
+function renderAdminPickupLocations(opts) {
+  opts = opts || {};
+  var list = opts.locations || [];
+  var saved  = opts.saved  ? "<div class=\"banner banner--ok\">Pickup location saved.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var rows = list.map(function (l) {
+    var addr = l.address || {};
+    var addrLine = [addr.line1, addr.city, addr.country].filter(Boolean).map(String).join(", ");
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(l.code) + "</code></td>" +
+      "<td>" + _htmlEscape(l.name) + "</td>" +
+      "<td>" + _htmlEscape(addrLine) + "</td>" +
+      "<td>" + _htmlEscape(String(l.capacity_per_hour)) + "/hr</td>" +
+      "<td>" + _htmlEscape(String(l.lead_time_hours)) + "h</td>" +
+      "<td>" +
+        "<form method=\"post\" action=\"/admin/pickup-locations/" + encodeURIComponent(l.code) + "/archive\" class=\"form-inline\">" +
+          "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">Archive</button>" +
+        "</form>" +
+      "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = list.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Code</th><th scope=\"col\">Name</th><th scope=\"col\">Address</th><th scope=\"col\">Capacity</th><th scope=\"col\">Lead time</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No active pickup locations yet. Add one below.</p>";
+
+  var form =
+    "<div class=\"panel mt\"><h3 class=\"subhead\">Add / update a pickup location</h3>" +
+      "<form method=\"post\" action=\"/admin/pickup-locations\">" +
+        _setupField("Code", "code", "", "text", "Stable identifier (alnum + . _ -). Re-using a code updates that location.", " maxlength=\"64\" required") +
+        _setupField("Name", "name", "", "text", "Shown to customers at checkout.", " maxlength=\"200\" required") +
+        _setupField("Address line 1", "line1", "", "text", "", " maxlength=\"200\" required") +
+        _setupField("City", "city", "", "text", "", " maxlength=\"100\" required") +
+        _setupField("Country", "country", "", "text", "2-letter ISO code (e.g. US).", " maxlength=\"2\" class=\"input-code\" required") +
+        "<label class=\"form-field\"><span>Opening hours</span>" +
+          "<textarea name=\"hours\" rows=\"4\" placeholder=\"mon 09:00-17:00&#10;tue 09:00-17:00\"></textarea>" +
+          "<small>One line per day: <code>mon 09:00-17:00</code>. Optional.</small>" +
+        "</label>" +
+        _setupField("Capacity per hour", "capacity_per_hour", "", "number", "Max concurrent pickups in a one-hour window.", " min=\"1\" required") +
+        _setupField("Lead time (hours)", "lead_time_hours", "", "number", "Minimum gap before the earliest bookable slot. 0 allows same-hour.", " min=\"0\" required") +
+        "<div class=\"actions-row\"><button type=\"submit\" class=\"btn\">Save location</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Pickup locations</h2>" + saved + notice + table + form + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pickup locations", body, "pickup-locations", opts.nav_available);
+}
+
+// Pickup queue for one location: a location selector + status chips, the
+// scheduled/ready rows, and the FSM action forms (ready / picked-up /
+// no-show) legal from each row's status. The no_show reason is operator-
+// authored free text — escaped at the sink.
+function renderAdminPickups(opts) {
+  opts = opts || {};
+  var locs = opts.locations || [];
+  var list = opts.pickups || [];
+  var selected = opts.selected || null;
+  var status = opts.status || null;
+  var moved  = opts.moved  ? "<div class=\"banner banner--ok\">Pickup updated.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var selector = "";
+  if (locs.length) {
+    var opts2 = locs.map(function (l) {
+      return "<option value=\"" + _htmlEscape(l.code) + "\"" + (l.code === selected ? " selected" : "") + ">" +
+        _htmlEscape(l.name) + " (" + _htmlEscape(l.code) + ")</option>";
+    }).join("");
+    selector =
+      "<form method=\"get\" action=\"/admin/pickups\" class=\"form-inline\">" +
+        "<label class=\"form-field\"><span>Location</span><select name=\"location\" onchange=\"this.form.submit()\">" + opts2 + "</select></label>" +
+        "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">View</button>" +
+      "</form>";
+  }
+
+  var statusChip = function (s, label) {
+    var href = "/admin/pickups?location=" + encodeURIComponent(selected || "") + (s ? "&status=" + encodeURIComponent(s) : "");
+    var on = (s == null && status == null) || s === status;
+    return "<a class=\"chip" + (on ? " chip--on" : "") + "\" href=\"" + href + "\">" + _htmlEscape(label) + "</a>";
+  };
+  var chips = selected
+    ? "<div class=\"order-filters\">" + statusChip(null, "all") +
+        PICKUP_QUEUE_STATUSES.map(function (s) { return statusChip(s, s); }).join("") + "</div>"
+    : "";
+
+  function _pickupActions(p) {
+    var blocks = [];
+    if (p.status === "scheduled") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/ready\" class=\"form-inline\">" +
+          "<button class=\"btn btn--sm\" type=\"submit\">Mark ready</button></form>");
+    }
+    if (p.status === "ready") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/picked-up\" class=\"return-action\">" +
+          "<input type=\"hidden\" name=\"proof_kind\" value=\"store_credential\">" +
+          "<button class=\"btn btn--sm\" type=\"submit\">Mark picked up</button></form>");
+    }
+    if (p.status === "scheduled" || p.status === "ready") {
+      blocks.push(
+        "<form method=\"post\" action=\"/admin/pickups/" + encodeURIComponent(p.order_id) + "/no-show\" class=\"return-action\">" +
+          _setupField("No-show reason", "reason", "", "text", "Shown in the escalation queue.", " maxlength=\"280\" required") +
+          "<button class=\"btn btn--danger btn--sm\" type=\"submit\">No-show</button></form>");
+    }
+    return blocks.length ? blocks.join("") : "<span class=\"meta\">—</span>";
+  }
+
+  var rows = list.map(function (p) {
+    return "<tr>" +
+      "<td><a class=\"order-id\" href=\"/admin/orders/" + _htmlEscape(p.order_id) + "\">" + _htmlEscape(String(p.order_id).slice(0, 8)) + "</a></td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(p.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(p.scheduled_window_start)) + "</td>" +
+      "<td>" + (p.picked_up_at ? _htmlEscape(_fmtDate(p.picked_up_at)) : "<span class=\"meta\">—</span>") + "</td>" +
+      "<td>" + _pickupActions(p) + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = !selected
+    ? "<p class=\"empty\">Add a pickup location first.</p>"
+    : (list.length
+      ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Order</th><th scope=\"col\">Status</th><th scope=\"col\">Window</th><th scope=\"col\">Picked up</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+      : "<p class=\"empty\">No pickups in this window for this location.</p>");
+
+  var body = "<section><h2>Pickups</h2>" + moved + notice + selector + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Pickups", body, "pickups", opts.nav_available);
+}
+
+// ---- gift-wraps render fn -------------------------------------------
+
+// Gift-wrap catalog screen: the list (incl. archived) with an inline update
+// form + archive action per row, and a define form. The wrap title is
+// operator free text — escaped at the sink (the primitive bounds length +
+// refuses control/zero-width bytes, but not HTML). image_url is escaped as
+// an attribute value.
+function renderAdminGiftWraps(opts) {
+  opts = opts || {};
+  var list = opts.wraps || [];
+  var saved  = opts.saved  ? "<div class=\"banner banner--ok\">Gift wrap saved.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var rows = list.map(function (w) {
+    var stateLabel = w.archived_at ? "archived" : (w.active ? "active" : "inactive");
+    var img = w.image_url
+      ? "<img src=\"" + _htmlEscape(String(w.image_url)) + "\" alt=\"\" width=\"32\" height=\"32\" style=\"object-fit:cover\">"
+      : "<span class=\"meta\">—</span>";
+    var updateForm =
+      "<form method=\"post\" action=\"/admin/gift-wraps/" + encodeURIComponent(w.wrap_sku) + "/update\" class=\"form-inline\">" +
+        "<input type=\"text\" name=\"title\" value=\"" + _htmlEscape(w.title) + "\" maxlength=\"200\" aria-label=\"Title\">" +
+        "<input type=\"number\" name=\"fee_minor\" value=\"" + _htmlEscape(String(w.fee_minor)) + "\" min=\"0\" aria-label=\"Fee (minor units)\">" +
+        "<button class=\"btn btn--sm\" type=\"submit\">Update</button>" +
+      "</form>";
+    var archiveForm = w.archived_at ? "" :
+      "<form method=\"post\" action=\"/admin/gift-wraps/" + encodeURIComponent(w.wrap_sku) + "/archive\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost btn--sm\" type=\"submit\">Archive</button>" +
+      "</form>";
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(w.wrap_sku) + "</code></td>" +
+      "<td>" + img + "</td>" +
+      "<td>" + _htmlEscape(w.title) + "</td>" +
+      "<td>" + _htmlEscape(String(w.fee_minor)) + "</td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(stateLabel) + "</span></td>" +
+      "<td>" + updateForm + archiveForm + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = list.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">SKU</th><th scope=\"col\">Image</th><th scope=\"col\">Title</th><th scope=\"col\">Fee</th><th scope=\"col\">State</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No gift wraps yet. Define one below — the SKU must be a real catalog variant.</p>";
+
+  var form =
+    "<div class=\"panel mt\"><h3 class=\"subhead\">Define a gift wrap</h3>" +
+      "<form method=\"post\" action=\"/admin/gift-wraps\">" +
+        _setupField("Wrap SKU", "wrap_sku", "", "text", "Must be a real catalog variant SKU — the fee flows through inventory + pricing.", " maxlength=\"128\" required") +
+        _setupField("Title", "title", "", "text", "Shown to customers at checkout.", " maxlength=\"200\" required") +
+        _setupField("Fee (minor units)", "fee_minor", "", "number", "Set this equal to the variant's catalog price; the fee is charged as a real cart line.", " min=\"0\" required") +
+        _setupField("Image URL", "image_url", "", "text", "Optional. https:// or /absolute path.", " maxlength=\"2048\"") +
+        _setupField("Max per order", "max_per_order", "", "number", "Optional cap on wraps per order.", " min=\"1\"") +
+        "<div class=\"actions-row\"><button type=\"submit\" class=\"btn\">Save wrap</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var body = "<section><h2>Gift wraps</h2>" + saved + notice + table + form + "</section>";
+  return _renderAdminShell(opts.shop_name, "Gift wraps", body, "gift-wraps", opts.nav_available);
+}
+
 // One rating card for the moderation queue / recent list. Shows the three
 // scores, the (escaped) comment, the flag state + reason, and the operator
 // reply — plus the flag / reply action forms.
@@ -16747,4 +17258,7 @@ module.exports = {
   renderAdminLoyaltyReward:     renderAdminLoyaltyReward,
   renderAdminConfirm:      renderAdminConfirm,
   renderAdminAudit:        renderAdminAudit,
+  renderAdminPickupLocations: renderAdminPickupLocations,
+  renderAdminPickups:      renderAdminPickups,
+  renderAdminGiftWraps:    renderAdminGiftWraps,
 };

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.53",
+  "version": "0.3.54",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
@@ -44,6 +44,10 @@
     "js/paypal-checkout.js": {
       "integrity": "sha384-LI6y/1z0Y9F8Kx8RhW4EwY2WqJPXLwJozCXqnhDT+dTckLHyvhly0SsRpH0bsdui",
       "fingerprinted": "js/paypal-checkout.b05ab5572cc3728f.js"
+    },
+    "js/saved-card.js": {
+      "integrity": "sha384-Kaj6n+Any4rwCH2lyREHoq30MrAZtEd/fTa+tDnIrMJ4zO01YWRhW5TTujcYyuVn",
+      "fingerprinted": "js/saved-card.d7fd750d746dbe4d.js"
     }
   }
 }