domma-cms 0.84.1 → 0.85.0

package/plugins/shopping-cart/admin/views/settings.js

@@ -0,0 +1,247 @@
+/**
+ * Shop settings - the banner cog's slideover: Storefront, Delivery, Tax and
+ * Payment, each field explained in place. Secrets arrive masked and are never
+ * shown; leaving a mask as it is keeps the stored key. "Test" tries the keys
+ * typed (before saving) against Stripe or PayPal.
+ */
+
+import {api, copy, esc, moneyIn, moneyOut, openPanel, setCurrency} from '../lib/kit.js';
+import {CURRENCIES} from '/plugins/shopping-cart/public/lib/money.js';
+import {COUNTRIES} from '/plugins/shopping-cart/public/lib/orders.js';
+
+const SECTIONS = [
+    {key: 'store', label: 'Storefront', icon: 'shopping-bag'},
+    {key: 'delivery', label: 'Delivery', icon: 'truck'},
+    {key: 'tax', label: 'Tax', icon: 'percent'},
+    {key: 'payment', label: 'Payment', icon: 'credit-card'}
+];
+const MONEY_KEYS = ['shippingFlat', 'freeShippingOver'];
+const BOOL_KEYS = ['showSearch', 'showCategories', 'floatingCart', 'showStockLeft', 'allowCollection', 'pricesIncludeTax', 'taxShipping',
+    'stripeEnabled', 'paypalEnabled', 'offlineEnabled'];
+
+export async function openSettings(ctx, section = 'store') {
+    let info;
+    try { info = await api.settings.get(); } catch (err) { E.toast(`Settings did not load: ${err.message || err}`, {type: 'error'}); return; }
+    const s = info.settings;
+    const f = {};
+    for (const [k, v] of Object.entries(s)) f[k] = M.observable(MONEY_KEYS.includes(k) ? moneyIn(v) : Array.isArray(v) ? [...v] : v);
+    const tab = M.observable(SECTIONS.some(x => x.key === section) ? section : 'store');
+    const saving = M.observable(false);
+    const testing = M.observable('');
+    const snapshot = () => JSON.stringify(Object.fromEntries(Object.entries(f).map(([k, o]) => [k, o.peek()])));
+    const opened = snapshot();
+
+    const model = {
+        ...f, tab, saving, testing,
+        isStore: M.computed(() => tab.value === 'store'),
+        isDelivery: M.computed(() => tab.value === 'delivery'),
+        isTax: M.computed(() => tab.value === 'tax'),
+        isPayment: M.computed(() => tab.value === 'payment'),
+        stripeOff: M.computed(() => !f.stripeEnabled.value),
+        paypalOff: M.computed(() => !f.paypalEnabled.value),
+        offlineOff: M.computed(() => !f.offlineEnabled.value),
+        collectOff: M.computed(() => !f.allowCollection.value),
+        taxExample: M.computed(() => {
+            const r = Number(f.taxRate.value) || 0;
+            if (!r) return 'No tax is added or shown.';
+            return f.pricesIncludeTax.value
+                ? `A £120.00 price shows "Includes ${f.taxLabel.value || 'tax'} £${(120 * r / (100 + r)).toFixed(2)}" and costs £120.00.`
+                : `A £100.00 price adds ${f.taxLabel.value || 'tax'} of £${(100 * r / 100).toFixed(2)} at checkout.`;
+        }),
+        stripeMode: info.stripeMode ? `${info.stripeMode} mode` : '',
+        webhookUrl: info.webhookUrl
+    };
+
+    const check = (k, label, help = '') => `<label class="shp-check"><input type="checkbox" data-bool="${k}"> ${label}${help ? ` <span data-help="${esc(help)}"></span>` : ''}</label>`;
+    const html = `<div class="shp-form shp-settings">
+  <div class="shp-seg shp-settings-nav" role="tablist">
+    ${SECTIONS.map(x => `<button type="button" role="tab" data-tab="${x.key}" data-bind-class="tab.value === '${x.key}' && 'is-on'"><span data-icon="${x.icon}" data-icon-size="13"></span> ${x.label}</button>`).join('')}
+  </div>
+
+  <section data-bind-hidden="!isStore.value" class="shp-grid">
+    <div><label class="form-label">Shop name <span data-help="The heading on the shop's page, and the name shoppers see on the payment page."></span></label>
+      <input class="form-input" data-model="shopTitle.value" maxlength="80"></div>
+    <div><label class="form-label">Address <span data-help="Where the shop lives on your site: /shop gives /shop, /shop/cart and a page per product. Changing it takes effect at once; links people saved to the old address stop working."></span></label>
+      <input class="form-input" data-model="shopPath.value" maxlength="60"></div>
+    <div class="shp-wide"><label class="form-label">Introduction <span data-help="A line or two under the shop's name."></span></label>
+      <textarea class="form-input" rows="2" data-model="shopIntro.value" maxlength="1000"></textarea></div>
+    <div><label class="form-label">Currency <span data-help="Every price in the shop. Changing it does not convert the prices you have entered."></span></label>
+      <select class="form-select" data-model="currency.value">${Object.entries(CURRENCIES).map(([c, x]) => `<option value="${c}">${c} - ${esc(x.label)}</option>`).join('')}</select></div>
+    <div><label class="form-label">Products per row</label>
+      <select class="form-select" data-model="columns.value"><option value="2">2</option><option value="3">3</option><option value="4">4</option></select></div>
+    <div class="shp-wide shp-checks">
+      ${check('showCategories', 'Category filters', 'Chips above the products, one per category, when there are two or more.')}
+      ${check('showSearch', 'Search box', 'Shown once the shop has more than four products.')}
+      ${check('floatingCart', 'Basket button on every page', 'A floating basket button, bottom corner, on any page of the site once something is in the basket. Off: only on the shop’s own pages.')}
+      ${check('showStockLeft', 'Say "Only 3 left"', 'Shown when a product with counted stock is at or below the low-stock level.')}
+    </div>
+    <div><label class="form-label">Basket button side</label>
+      <select class="form-select" data-model="cartPosition.value"><option value="right">Right</option><option value="left">Left</option></select></div>
+    <div><label class="form-label">Low stock at <span data-help="At or below this, a product is flagged in the Overview and the Low stock filter."></span></label>
+      <input class="form-input" type="number" min="0" data-model="lowStockAt.value"></div>
+    <div class="shp-wide"><label class="form-label">Terms of sale page <span data-help="If set, shoppers tick 'I agree to the terms of sale' (linked here) before paying. /terms or a full https:// address."></span></label>
+      <input class="form-input" data-model="termsUrl.value" placeholder="/terms"></div>
+  </section>
+
+  <section data-bind-hidden="!isDelivery.value" class="shp-grid">
+    <div class="shp-wide"><label class="form-label">We deliver to <span data-help="Checkout offers only these countries. Products that need no delivery can be bought from anywhere."></span></label>
+      <div class="shp-countries" data-part="countries"></div>
+      <select class="form-select shp-add-country" data-part="add-country"><option value="">Add a country…</option>${Object.entries(COUNTRIES).map(([c, n]) => `<option value="${c}">${esc(n)}</option>`).join('')}</select></div>
+    <div><label class="form-label">Delivery charge <span data-help="One charge per order. Shopping Cart Pro adds zones and rates by weight or order value."></span></label>
+      <div class="shp-money"><span data-bind-text="currency.value"></span><input class="form-input" inputmode="decimal" data-model="shippingFlat.value" placeholder="0.00"></div></div>
+    <div><label class="form-label">Called</label><input class="form-input" data-model="shippingLabel.value" maxlength="60"></div>
+    <div><label class="form-label">Free over <span data-help="Orders at or above this (after any discount) go free. 0 = never. Shoppers see how far they are from it in the basket."></span></label>
+      <div class="shp-money"><span data-bind-text="currency.value"></span><input class="form-input" inputmode="decimal" data-model="freeShippingOver.value" placeholder="0.00"></div></div>
+    <div></div>
+    <div class="shp-wide">${check('allowCollection', 'Offer collection', 'Shoppers can choose to collect in person - no delivery charge, no address.')}</div>
+    <div class="shp-wide" data-bind-hidden="collectOff.value"><label class="form-label">Collection is called</label><input class="form-input" data-model="collectionLabel.value" maxlength="60"></div>
+  </section>
+
+  <section data-bind-hidden="!isTax.value" class="shp-grid">
+    <div><label class="form-label">Tax rate % <span data-help="One rate for every product. Shopping Cart Pro adds rates by country and tax class."></span></label>
+      <input class="form-input" type="number" min="0" max="100" step="0.001" data-model="taxRate.value"></div>
+    <div><label class="form-label">Called</label><input class="form-input" data-model="taxLabel.value" maxlength="30" placeholder="VAT"></div>
+    <div class="shp-wide shp-checks">
+      ${check('pricesIncludeTax', 'My prices include tax', 'On (usual in the UK and Europe): the price is what the shopper pays, and the receipt shows the tax inside it. Off (usual in the US): tax is added at checkout.')}
+      ${check('taxShipping', 'Tax the delivery charge too')}
+    </div>
+    <p class="shp-wide shp-note" data-bind-text="taxExample.value"></p>
+  </section>
+
+  <section data-bind-hidden="!isPayment.value" class="shp-pay">
+    <div class="shp-provider">
+      <div class="shp-provider-head">${check('stripeEnabled', '<strong>Stripe</strong> - cards, Apple Pay, Google Pay', 'Shoppers pay on Stripe’s own secure page; card details never touch this site. Needs a Stripe account.')}
+        <span class="shp-chip is-muted" data-bind-hidden="!stripeMode" data-bind-text="stripeMode"></span></div>
+      <div class="shp-grid" data-bind-hidden="stripeOff.value">
+        <div class="shp-wide"><label class="form-label">Secret key <span data-help="Stripe dashboard › Developers › API keys. Starts sk_test_ (for testing) or sk_live_. Kept on the server and never shown again."></span></label>
+          <input class="form-input" type="password" autocomplete="off" data-model="stripeSecretKey.value" placeholder="sk_live_…"></div>
+        <div class="shp-wide"><label class="form-label">Webhook <span data-help="Optional but wise: it confirms a payment even when the shopper closes the tab before coming back. In Stripe › Developers › Webhooks add this address for the event checkout.session.completed, then paste its signing secret below."></span></label>
+          <div class="shp-copy"><code data-bind-text="webhookUrl"></code><button type="button" class="btn btn-sm btn-ghost" data-on-click="copyHook"><span data-icon="copy" data-icon-size="13"></span></button></div></div>
+        <div class="shp-wide"><label class="form-label">Webhook signing secret</label>
+          <input class="form-input" type="password" autocomplete="off" data-model="stripeWebhookSecret.value" placeholder="whsec_…"></div>
+        <div class="shp-wide"><button type="button" class="btn btn-sm btn-outline" data-on-click="testStripe" data-bind-disabled="testing.value"><span data-icon="zap" data-icon-size="13"></span> Test the key</button></div>
+      </div>
+    </div>
+    <div class="shp-provider">
+      <div class="shp-provider-head">${check('paypalEnabled', '<strong>PayPal</strong>', 'Shoppers approve the payment on PayPal and come back; the money is taken as they return. Needs a PayPal Business account and a REST app.')}</div>
+      <div class="shp-grid" data-bind-hidden="paypalOff.value">
+        <div><label class="form-label">Mode <span data-help="Sandbox takes pretend money from PayPal's test accounts. Switch to Live with your live app's keys."></span></label>
+          <select class="form-select" data-model="paypalMode.value"><option value="sandbox">Sandbox (testing)</option><option value="live">Live</option></select></div>
+        <div></div>
+        <div class="shp-wide"><label class="form-label">Client ID <span data-help="developer.paypal.com › Apps & Credentials › your app."></span></label>
+          <input class="form-input" autocomplete="off" data-model="paypalClientId.value"></div>
+        <div class="shp-wide"><label class="form-label">Secret</label>
+          <input class="form-input" type="password" autocomplete="off" data-model="paypalSecret.value"></div>
+        <div class="shp-wide"><button type="button" class="btn btn-sm btn-outline" data-on-click="testPaypal" data-bind-disabled="testing.value"><span data-icon="zap" data-icon-size="13"></span> Test the keys</button></div>
+      </div>
+    </div>
+    <div class="shp-provider">
+      <div class="shp-provider-head">${check('offlineEnabled', '<strong>Pay offline</strong> - bank transfer, cash on collection', 'The order is placed as Awaiting payment and nothing is charged. Mark it paid when the money arrives - stock is taken then.')}</div>
+      <div class="shp-grid" data-bind-hidden="offlineOff.value">
+        <div class="shp-wide"><label class="form-label">Called</label><input class="form-input" data-model="offlineLabel.value" maxlength="60"></div>
+        <div class="shp-wide"><label class="form-label">What to tell the shopper <span data-help="Shown on their receipt with the order number and total. Your bank details, or when to collect and pay."></span></label>
+          <textarea class="form-input" rows="3" data-model="offlineInstructions.value" maxlength="2000"></textarea></div>
+      </div>
+    </div>
+  </section>
+
+  <div class="shp-actions">
+    <span class="shp-spacer"></span>
+    <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Close</button>
+    <button type="button" class="btn btn-sm btn-primary" data-on-click="save" data-bind-disabled="saving.value"><span data-icon="check" data-icon-size="13"></span> Save</button>
+  </div>
+</div>`;
+
+    const renderCountries = (el) => {
+        const box = el.querySelector('[data-part="countries"]');
+        box.innerHTML = '';
+        for (const c of f.countries.peek()) {
+            const chip = document.createElement('span');
+            chip.className = 'shp-chip is-primary shp-country';
+            chip.textContent = COUNTRIES[c] || c;
+            const x = document.createElement('button');
+            x.type = 'button';
+            x.textContent = '×';
+            x.title = 'Remove';
+            x.dataset.drop = c;
+            chip.appendChild(x);
+            box.appendChild(chip);
+        }
+    };
+
+    let panel = null;
+    const typedSecrets = () => ({stripeSecretKey: f.stripeSecretKey.peek(), paypalClientId: f.paypalClientId.peek(),
+        paypalSecret: f.paypalSecret.peek(), paypalMode: f.paypalMode.peek()});
+    async function test(provider) {
+        testing.value = provider;
+        try {
+            const r = await api.settings.test(provider, typedSecrets());
+            E.toast(`${provider === 'stripe' ? 'Stripe' : 'PayPal'} answered - the key works (${r.mode} mode).`, {type: 'success'});
+        } catch (err) {
+            E.toast(err.message || String(err), {type: 'error', duration: 8000});
+        } finally {
+            testing.value = '';
+        }
+    }
+
+    panel = await openPanel({
+        title: 'Shop settings',
+        size: 'md',
+        html,
+        model,
+        dirty: () => snapshot() !== opened,
+        before: (el) => {
+            for (const box of el.querySelectorAll('[data-bool]')) {
+                box.checked = Boolean(f[box.dataset.bool].peek());
+                box.addEventListener('change', () => { f[box.dataset.bool].value = box.checked; });
+            }
+            renderCountries(el);
+            el.querySelector('[data-part="countries"]').addEventListener('click', (e) => {
+                const c = e.target.closest('[data-drop]')?.dataset.drop;
+                if (c) { f.countries.value = f.countries.peek().filter(x => x !== c); renderCountries(el); }
+            });
+            el.querySelector('[data-part="add-country"]').addEventListener('change', (e) => {
+                const c = e.target.value;
+                if (c && !f.countries.peek().includes(c)) { f.countries.value = [...f.countries.peek(), c]; renderCountries(el); }
+                e.target.value = '';
+            });
+            el.querySelector('.shp-settings-nav').addEventListener('click', (e) => {
+                const b = e.target.closest('[data-tab]');
+                if (b) tab.value = b.dataset.tab;
+            });
+        },
+        methods: {
+            cancel: () => panel?.close(),
+            copyHook: () => copy(info.webhookUrl, 'Webhook address copied'),
+            testStripe: () => test('stripe'),
+            testPaypal: () => test('paypal'),
+            async save() {
+                const out = {};
+                for (const [k, o] of Object.entries(f)) out[k] = o.peek();
+                for (const k of MONEY_KEYS) {
+                    const m = moneyOut(out[k]);
+                    if (Number.isNaN(m)) { E.toast('Check the amounts under Delivery.', {type: 'warning'}); tab.value = 'delivery'; return; }
+                    out[k] = m ?? 0;
+                }
+                for (const k of BOOL_KEYS) out[k] = Boolean(out[k]);
+                out.columns = Number(out.columns);
+                out.taxRate = Number(out.taxRate) || 0;
+                out.lowStockAt = Number(out.lowStockAt) || 0;
+                saving.value = true;
+                try {
+                    const r = await api.settings.save(out);
+                    Object.assign(ctx.settings, r.settings);
+                    setCurrency(r.settings.currency);
+                    E.toast('Shop settings saved.', {type: 'success'});
+                    const moved = r.settings.currency !== s.currency || r.settings.shopPath !== s.shopPath;
+                    panel.close(true);
+                    if (moved) location.reload();
+                } catch (err) {
+                    E.toast(`Not saved: ${err.message || err}`, {type: 'error', duration: 8000});
+                } finally {
+                    saving.value = false;
+                }
+            }
+        }
+    });
+}

package/plugins/shopping-cart/admin/views/shop.js

@@ -0,0 +1,130 @@
+/**
+ * The Shop - one Tool, one sidebar entry, its screens as tabs under the
+ * banner: Overview, Orders, Products, and any an extension adds (Shopping
+ * Cart Pro's Discounts, Shipping & tax, Emails, Insights).
+ *
+ *   #/plugins/shopping-cart              Overview
+ *   #/plugins/shopping-cart/orders[/id]  Orders (an id opens that order)
+ *   #/plugins/shopping-cart/products[/id|new]
+ *   #/plugins/shopping-cart/<ext-key>    an extension's screen
+ *
+ * Path segments, not ?query: the admin router 404s a query on a fresh load.
+ * Settings are behind the banner's cog, in a slideover.
+ */
+
+import {api, loadKit, setCurrency, store} from '../lib/kit.js';
+
+const ROUTE = /^#\/plugins\/shopping-cart(\/|$)/;
+const V = '1.0.0';
+const TABS = [
+    {key: 'overview', label: 'Overview', icon: 'bar-chart', module: `/plugins/shopping-cart/admin/views/overview.js?v=${V}`},
+    {key: 'orders', label: 'Orders', icon: 'receipt', module: `/plugins/shopping-cart/admin/views/orders.js?v=${V}`},
+    {key: 'products', label: 'Products', icon: 'package', module: `/plugins/shopping-cart/admin/views/products.js?v=${V}`}
+];
+
+let lifetime = null;
+
+/** tab and id from the address. */
+function where() {
+    const m = location.hash.match(/^#\/plugins\/shopping-cart(?:\/([a-z0-9-]+))?(?:\/([^/?#]+))?/);
+    return {tab: m?.[1] || 'overview', id: m?.[2] ? decodeURIComponent(m[2]) : ''};
+}
+
+export const shopView = {
+    templateUrl: '/plugins/shopping-cart/admin/templates/shop.html',
+
+    async onMount($container) {
+        const kit = await loadKit();
+        lifetime ??= kit.viewLifetime(ROUTE);
+        if (!ROUTE.test(location.hash)) return;
+        lifetime.reset();
+        const scope = (fn) => { lifetime.add(fn); return fn; };
+        const container = $container.get(0);
+        const root = container.querySelector('[data-shop-admin]') || container;
+        const mountedFor = location.hash;
+        const here = () => location.hash === mountedFor && root.isConnected;
+        const {tab, id} = where();
+
+        let settingsRes = null;
+        let ext = {tabs: []};
+        try {
+            [settingsRes, ext] = await Promise.all([api.settings.get(), api.extensions().catch(() => ({tabs: []}))]);
+        } catch (err) {
+            root.innerHTML = '';
+            const p = document.createElement('p');
+            p.className = 'shp-error';
+            p.textContent = `The Shop could not load: ${err.message || err}`;
+            root.appendChild(p);
+            return;
+        }
+        if (!here()) return;
+        const settings = settingsRes.settings;
+        setCurrency(settings.currency);
+
+        const tabs = [...TABS, ...(ext.tabs || [])];
+        const current = tabs.find(t => t.key === tab) || TABS[0];
+
+        // "Shop › Orders" in the banner.
+        const name = container.querySelector('.dm-plugin-banner-name');
+        if (name) {
+            name.textContent = '';
+            const a = document.createElement('span');
+            a.className = 'dm-plugin-banner-parent';
+            a.textContent = 'Shop';
+            const sep = document.createElement('span');
+            sep.className = 'dm-plugin-banner-sep';
+            sep.textContent = '›';
+            sep.setAttribute('aria-hidden', 'true');
+            name.append(a, sep, document.createTextNode(current.label));
+        }
+
+        // The tab row.
+        root.innerHTML = '';
+        const nav = document.createElement('nav');
+        nav.className = 'shp-nav';
+        nav.setAttribute('aria-label', 'Shop');
+        for (const t of tabs) {
+            const a = document.createElement('a');
+            a.href = t.key === 'overview' ? '#/plugins/shopping-cart' : `#/plugins/shopping-cart/${t.key}`;
+            const icon = document.createElement('span');
+            icon.setAttribute('data-icon', t.icon || 'puzzle');
+            icon.setAttribute('data-icon-size', '15');
+            a.append(icon, document.createTextNode(t.label));
+            if (t.owner) a.classList.add('is-ext');
+            if (t === current) { a.classList.add('is-on'); a.setAttribute('aria-current', 'page'); }
+            nav.appendChild(a);
+        }
+        const body = document.createElement('div');
+        body.className = 'shp-body';
+        root.append(nav, body);
+        I.scan(nav);
+
+        const ctx = {
+            kit, scope, here, root: body, container, settings, settingsInfo: settingsRes, id, extensions: ext,
+            go(t, i = '') { location.hash = `#/plugins/shopping-cart${t && t !== 'overview' ? `/${t}` : ''}${i ? `/${encodeURIComponent(i)}` : ''}`; },
+            async openSettings(section) {
+                const m = await import(`/plugins/shopping-cart/admin/views/settings.js?v=${V}`);
+                m.openSettings(ctx, section);
+            }
+        };
+
+        kit.addBannerAction($container, {id: 'shop-settings', icon: 'settings', title: 'Shop settings', onClick: () => ctx.openSettings()});
+        kit.addBannerAction($container, {id: 'shop-visit', icon: 'external-link', title: 'Open the shop in a new tab',
+            onClick: () => window.open(settings.shopPath, '_blank', 'noopener')});
+
+        try {
+            const mod = await import(current.module);
+            if (!here()) return;
+            const mount = mod.mount || mod.default?.mount;
+            const cleanup = await mount(body, ctx);
+            if (typeof cleanup === 'function') scope(cleanup);
+        } catch (err) {
+            body.innerHTML = '';
+            const p = document.createElement('p');
+            p.className = 'shp-error';
+            p.textContent = `This screen could not load: ${err.message || err}`;
+            body.appendChild(p);
+        }
+        store.set('shopping-cart.last-tab', current.key);
+    }
+};

package/plugins/shopping-cart/collections/shop-orders.json

@@ -0,0 +1,20 @@
+{
+  "slug": "shop-orders",
+  "title": "Shop Orders",
+  "description": "Orders placed in the Shop. Amounts are minor units (pence). Move and refund them in the Shop, never here: stock and payments follow the status.",
+  "plugin": "shopping-cart",
+  "fields": [
+    {"name": "number", "label": "Number", "type": "number"},
+    {"name": "status", "label": "Status", "type": "text"},
+    {"name": "total", "label": "Total (minor units)", "type": "number"},
+    {"name": "currency", "label": "Currency", "type": "text"},
+    {"name": "provider", "label": "Payment", "type": "text"},
+    {"name": "email", "label": "Email", "type": "text"}
+  ],
+  "api": {
+    "create": {"enabled": false, "access": "admin"},
+    "read":   {"enabled": false, "access": "admin"},
+    "update": {"enabled": false, "access": "admin"},
+    "delete": {"enabled": false, "access": "admin"}
+  }
+}

package/plugins/shopping-cart/collections/shop-products.json

@@ -0,0 +1,24 @@
+{
+  "slug": "shop-products",
+  "title": "Shop Products",
+  "description": "Products on sale in the Shop. Amounts are minor units (pence). Edit them in the Shop, which checks every field.",
+  "plugin": "shopping-cart",
+  "fields": [
+    {"name": "name", "label": "Name", "type": "text", "required": true},
+    {"name": "slug", "label": "Address", "type": "text"},
+    {"name": "summary", "label": "Summary", "type": "text"},
+    {"name": "description", "label": "Description", "type": "textarea"},
+    {"name": "price", "label": "Price (minor units)", "type": "number"},
+    {"name": "compareAt", "label": "Was (minor units)", "type": "number"},
+    {"name": "sku", "label": "SKU", "type": "text"},
+    {"name": "category", "label": "Category", "type": "text"},
+    {"name": "status", "label": "Status", "type": "text"},
+    {"name": "stock", "label": "Stock", "type": "number"}
+  ],
+  "api": {
+    "create": {"enabled": false, "access": "admin"},
+    "read":   {"enabled": false, "access": "admin"},
+    "update": {"enabled": false, "access": "admin"},
+    "delete": {"enabled": false, "access": "admin"}
+  }
+}

package/plugins/shopping-cart/config.js

@@ -0,0 +1,52 @@
+/**
+ * Shopping Cart - default settings.
+ *
+ * Every one is editable from the cog in the Shop's banner, which writes to
+ * config/plugins.json under `shopping-cart.settings`. Amounts are MINOR units
+ * (pence): shippingFlat 395 is £3.95.
+ *
+ * Secrets (stripeSecretKey, stripeWebhookSecret, paypalSecret) are never sent
+ * to the browser - the settings route masks them, and saving a mask keeps the
+ * stored value.
+ */
+export default {
+    // The storefront
+    shopTitle: 'Shop',
+    shopPath: '/shop',
+    shopIntro: '',
+    currency: 'GBP',
+    columns: 3,
+    showSearch: true,
+    showCategories: true,
+    floatingCart: true,
+    cartPosition: 'right',
+    lowStockAt: 3,
+    showStockLeft: true,
+    termsUrl: '',
+
+    // Delivery
+    countries: ['GB'],
+    shippingFlat: 0,
+    shippingLabel: 'Delivery',
+    freeShippingOver: 0,
+    allowCollection: false,
+    collectionLabel: 'Collect in person',
+
+    // Tax
+    taxRate: 0,
+    taxLabel: 'VAT',
+    pricesIncludeTax: true,
+    taxShipping: true,
+
+    // Payment
+    stripeEnabled: false,
+    stripeSecretKey: '',
+    stripeWebhookSecret: '',
+    paypalEnabled: false,
+    paypalClientId: '',
+    paypalSecret: '',
+    paypalMode: 'sandbox',
+    offlineEnabled: true,
+    offlineLabel: 'Pay by bank transfer',
+    offlineInstructions: 'Thank you! We will email you our bank details. Your order is sent as soon as payment arrives.'
+};

package/plugins/shopping-cart/inject/body.html

@@ -0,0 +1,2 @@
+<link rel="stylesheet" href="/plugins/shopping-cart/public/shop.css?v=1.0.0">
+<script type="module" src="/plugins/shopping-cart/public/cart.js?v=1.0.0"></script>

package/plugins/shopping-cart/lib/extensions.js

@@ -0,0 +1,96 @@
+/**
+ * The Cart's door for extensions - how Shopping Cart Pro (or anything else)
+ * adds to the free Cart without replacing it.
+ *
+ * It lives on `globalThis` under a registered symbol, so an extension reaches
+ * it WITHOUT importing a file from this plugin: plugins load in one process,
+ * in an order nobody promises, and a paid plugin must not break when this
+ * one's files move. An extension registers from its `onReady` hook, when every
+ * plugin has loaded:
+ *
+ *   const cart = globalThis[Symbol.for('domma.shopping-cart')];
+ *   if (cart?.version >= 1) cart.register('shopping-cart-pro', {
+ *       label: 'Shopping Cart Pro',
+ *       stages: {discount, shipping, tax},          // see lib/pricing.js
+ *       on: {paid(order), status(order, from, to), checkout(order)},
+ *       tabs: [{key, label, icon, module, help}],    // admin screens in the Shop
+ *       checkout: {codes: true}                     // storefront features to show
+ *   });
+ *
+ * And uses `cart.services` (orders, products, settings, money) to read the
+ * Cart's data the way the Cart does. A licence that lapses means the extension
+ * never loads, never registers, and the Cart carries on alone.
+ *
+ * @module shopping-cart/lib/extensions
+ */
+
+export const KEY = Symbol.for('domma.shopping-cart');
+export const VERSION = 1;
+
+const EVENTS = ['paid', 'status', 'checkout'];
+
+/** The registry, made once per process. */
+export function cartRegistry() {
+    if (globalThis[KEY]?.version === VERSION) return globalThis[KEY];
+    const extensions = new Map();
+    const reg = {
+        version: VERSION,
+        services: {},
+
+        register(owner, ext = {}) {
+            if (!/^[a-z0-9-]{2,60}$/.test(String(owner))) throw new Error('An extension needs its plugin name.');
+            extensions.set(owner, {
+                owner,
+                label: String(ext.label || owner),
+                stages: ext.stages || {},
+                on: ext.on || {},
+                tabs: Array.isArray(ext.tabs) ? ext.tabs : [],
+                checkout: ext.checkout || {},
+                order: Number(ext.order) || 0
+            });
+        },
+
+        unregister(owner) { extensions.delete(owner); },
+
+        list() { return [...extensions.values()].sort((a, b) => a.order - b.order); },
+
+        /** stage -> the handler that wins it (the last registered, by order). */
+        handlers() {
+            const out = {};
+            for (const ext of reg.list()) {
+                for (const [stage, fn] of Object.entries(ext.stages)) if (typeof fn === 'function') out[stage] = fn;
+            }
+            return out;
+        },
+
+        /** Storefront features the extensions ask for, merged: {codes: true, ...}. */
+        checkoutFeatures() {
+            return Object.assign({}, ...reg.list().map(e => e.checkout));
+        },
+
+        /** Admin screens, for the Shop's tab row. */
+        tabs() {
+            return reg.list().flatMap(e => e.tabs.map(t => ({
+                key: String(t.key), label: String(t.label || t.key), icon: String(t.icon || 'puzzle'),
+                module: String(t.module || ''), help: String(t.help || ''), owner: e.owner
+            }))).filter(t => /^[a-z0-9-]{1,40}$/.test(t.key) && t.module.startsWith('/plugins/'));
+        },
+
+        /**
+         * Tell every extension. Never throws and never waits: an email that
+         * fails must not fail the payment that triggered it.
+         */
+        emit(event, ...args) {
+            if (!EVENTS.includes(event)) return;
+            for (const ext of reg.list()) {
+                const fn = ext.on[event];
+                if (typeof fn !== 'function') continue;
+                Promise.resolve().then(() => fn(...args)).catch(err => {
+                    console.warn(`[shopping-cart] ${ext.owner} failed on "${event}": ${err?.message || err}`);
+                });
+            }
+        }
+    };
+    globalThis[KEY] = reg;
+    return reg;
+}