domma-cms 1.6.31 → 1.6.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.31",
+  "version": "1.6.32",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@8b9c2f1",
+  "source": "dcms-marketplace@91d03cf",
   "plugins": {
     "blog": {
       "version": "1.9.5",
@@ -175,32 +175,32 @@
       }
     },
     "shopping-cart": {
-      "version": "1.1.1",
+      "version": "1.2.0",
       "files": {
-        "CLAUDE.md": "70765cf061e97d0a57890d7731e0624b224e36267df42741e763e3efcd076d05",
-        "admin/css/index.css": "a6bab1d0072e364ee1d94c2d7d7b99c3660ba91c5eba537e269a579f5b17f924",
-        "admin/lib/kit.js": "c2111d1b10c6c8b18bc061f9f55c83ee8baecc2bcff66f74eb38298f39886d86",
+        "CLAUDE.md": "0a0d019e6eceb2260cf965d3eb589c9a53615c388f212af382a00a129cb2c0dc",
+        "admin/css/index.css": "2ea348d9f969193f198dac25b1962a400967566b835c7bf1402e17e33d81bfd2",
+        "admin/lib/kit.js": "ebb439a31123b9c4fbda8a2c299cc79d1ec50e66d019b5cc49dcd00f269124d5",
         "admin/templates/shop.html": "c5bb03f1f7cbabfbd8202f3533783eb1848103755b1ba25fdcf1fd8e9478cb8e",
-        "admin/views/orders.js": "e69694e5fe0b56662a2df3f7c7b8a5cc5f9a602debda469c2da464cb78fdd458",
+        "admin/views/orders.js": "c10789a82cf3efb4419f223668a5fa71b021420a094cda291c8d492a644b25da",
         "admin/views/overview.js": "6abd9779cf5fc359c4708f96cf0e8ecad155fb52583b2ec854400b288fc9ba98",
-        "admin/views/products.js": "4947de61aa57da59fd0e819ac0f5380bbdee6b73855bd91d3872445fdd6c3e2d",
+        "admin/views/products.js": "e109660355aaec8db07eb65fa1169e7d2ec20bc2ec45293cc20e34f7c1bd62bf",
         "admin/views/settings.js": "28cb0b5e8d45e3723ffe77e46299bfc13fbad02a2ae8103843c6894dc232387a",
-        "admin/views/shop.js": "a53a1793251b962a87c5d01685f934b6476bcfcdd51e3dea3a319eb8c03a4137",
+        "admin/views/shop.js": "1b6ee66b4ef768983ed32752711ed4ca8438bd37eb33be9587f6679452557b2c",
         "collections/shop-orders.json": "0bca8eef2d5f9108651f73d273480265c167dc983aa115ce59613d13015ca255",
         "collections/shop-products.json": "4d4613ecec7b8a5a0744c4f0a57b17a4429b461e060206a4bbdea5ad7c8c75dc",
         "config.js": "dcb91db2839c1ab9e40bb1811397024fad9e37e3753d17e2baa2b9b31d4a7d7c",
-        "docs/guide.md": "2aae4382723fb2c6a3b4a953547cda28c3d2f19024b736e10e0548af0b106360",
-        "inject/body.html": "de20f92c83229545d20e5186fd37ef0046a8820881bff34e7df5391cd7a2c75d",
-        "lib/extensions.js": "2cba90efef5b437ace557c7265fe7363ac7923d155681087a63e31e1168f6601",
+        "docs/guide.md": "4b4fbf3d61d73114f3b1b42ba48c72debb720e2c65bcd17df2feaa372463882f",
+        "inject/body.html": "9deda0324d60ef1e62f653513748faa4c6ac546493906c8bd195e445a55f7476",
+        "lib/extensions.js": "180820bcfb8ada9acfb260d0cc0a1c8cc4f37f9ab969400f4b6e8bf2d5babb3f",
         "lib/payments.js": "84ad14813688de1f38448b4935180a786cda8af2f7f4b8890a8f1d426982d1aa",
         "lib/pricing.js": "3ae965e042f5af0acdcecc66d27145ca5f608c656717288832b881a2a181dd2e",
-        "lib/render.js": "310d528f69cd0160db3bd3d3c88f16221e43004c93856587175c0bb149fe3a3d",
+        "lib/render.js": "442cd305810e53edcfa184796db19371b304567100e2662c96b4b3bee2cf7231",
         "lib/samples.js": "912b3d5bd543dffa5f870caf3c2b873f642fd55e3ebf3f97e1b31eeaaac77d3b",
-        "lib/shop.js": "4399931dd46ab4dc9bd28e8613c992420ab822bd694b1495ef2b4ad6483b5153",
+        "lib/shop.js": "6edd3618d53ecd614a03bf476abe5cb8615fd7d19ac765406a6ac550ebcf75e9",
         "lib/summary.js": "5697ffa45c9cc5338bbcb6eada08671c3e8376c49c629d2ae99b022397523f71",
-        "plugin.js": "1f8477188b4054d172b37d953a439b4d5d4a532c6d26daaf9808346f332ddfcf",
-        "plugin.json": "e379f3d5a713684d3f1d32dfa2ae1ec26f8a79a346e2591b1b2ea9b1263d6f54",
-        "plugin.public.js": "98fa32b6c69db4a967577f3536fc521c926053319dd20d2bae8bc7e94830e3e8",
+        "plugin.js": "c72c526ccd71d8c055b82ef7e166afc542d4e8c36251e2f4ca1861505d5febb4",
+        "plugin.json": "bb7e9268ce075ec400f9df0932a74b26f61ca8930471ebbf41f3a8deef2e813a",
+        "plugin.public.js": "99ef559dc8c3bd369047091623bbad29a1f6067322f07ac0db547938d97fe014",
         "public/cart.js": "fcc706773a36e4bfd02ea235bcdad629137e996218e0a0e23892e33c689f2a6e",
         "public/lib/money.js": "d22b2b6f80dde6f7887b69e24188c05ea93c02217aba639b5331aa3bd616f4fc",
         "public/lib/orders.js": "09478e20d238adc8e387b3d9efcb13c441898fab18387ce6a1a8a92304ac4c5b",
@@ -217,10 +217,10 @@
         "public/samples/tee.svg": "287a82d7fc00acb1543b3209927ae20dcbe3d4b2a2b3de03574ab0c463385f3c",
         "public/samples/tote-2.svg": "9c7f41cc57866e71973e413a6c87f46be48f7488d3490ceea58e24559c334813",
         "public/samples/tote.svg": "01de817a32c8d3d8ea47ff491049f439ca3e4d4fce943dbdc62a4187139e016c",
-        "public/shop.css": "277904382e491f0ecc76aad916126970b87e161ef06ac6deeff193358b4e4c31",
+        "public/shop.css": "c5adbc7b08cff3dc3b1c2b796ba693ad52c586ef35d236d0bba9a0cb7c3673c1",
         "templates/shop.html": "4649e57d23458833a157799dc80141824eb0f658d96734bd1859c68e0ba9a8b9",
-        "tests/api.test.js": "04105c5d4f7bf4fd7b9e4dea5e8b8de4a4ebbba0a8795b47c166b0a6798fd089",
-        "tests/pure.test.js": "f00f27ee8c941d6268eb780520007b7413b0872e2590487f1b460ce5ea09dbb1"
+        "tests/api.test.js": "8b71353b9649d6274c4e6d9358bac8fa6737d3effee00c35c62dab6f2a377968",
+        "tests/pure.test.js": "27a40f04315c17b92e4782d6f8621c965ae89bb73df377064775eec71335a5b7"
       }
     },
     "support": {

package/plugins/shopping-cart/CLAUDE.md

@@ -112,3 +112,28 @@ A cached page can show a stale stock flag until it is re-rendered; checkout re-p
   - The product form can never set or clear the two fields (POST strips them, PUT keeps the stored ones).
   - A copy is the shop's own.
   - `services.saveProduct` and `services.removeProduct` are how the extension manages them.
+
+## 1.2.0: extensions add to products, orders and the receipt
+
+For Shopping Cart Pro's downloads. All optional: a Cart without extensions, or an extension that registers none of
+these, behaves as 1.1.
+- **`panels: [{key, label, icon, module, help, on}]`** (`on`: `product` | `order`) - a `<details>` section in the
+  product editor (collapsed) or an order (open), marked Pro. `admin/lib/kit.js` `mountPanels` imports the module
+  (`/plugins/...` only) and calls `mount(body, {product | order, variants(), changed(order), ctx})`, which may
+  return `{value(), dirty(), destroy()}`. A section that fails to load says so and sends nothing.
+- **`product.clean(input, {had, copy, product})` -> `{data, errors}`** - the editor saves each panel's `value()` as
+  `ext[owner]`; `registry.cleanProductExt` hands each part to its own extension. Not sent, or the extension not
+  running (lapsed licence), or its cleaner throwing: the stored part stays. `data: null` removes it; errors come
+  back keyed `<owner>.<field>` and refuse the save. PATCH (quick edits) never touches `ext`. A copy starts empty
+  and each extension decides what carries over (`copy: true`). `publicProduct` never includes `ext`, but the admin
+  product list does - anything secret (licence keys) is visible to `shop:read`.
+- **`receipt(order, {settings})` -> HTML** - `registry.receiptParts` collects them for the receipt page, above the
+  items, in `.shop-r-ext[data-ext=owner]`. The extension escapes its own HTML. Each has 3 s; one that throws or
+  dawdles is left out. The page is server-rendered and reloads once paid, but `on.paid` does not wait, so a
+  receipt handler should not assume `paid` has run.
+- **`services.updateProductExt(id, owner, fn)`** - `fn(part) -> part` (null removes) on the product as it is now,
+  under the order lock, no form check: an extension's own bookkeeping (Pro taking licence keys). `saveProduct` runs
+  under the same lock, so a sale's stock, an edit and this never overwrite each other.
+- A copy (`POST /products/:id/duplicate`) gives options new ids and passes `variantMap` (old -> new) to `clean`.
+- **`services.moveOrder(id, to, {by, note})`** - moves an order as the admin's status route does (same rules,
+  409 on a move the table refuses) and emits `status`.

package/plugins/shopping-cart/admin/css/index.css

@@ -151,6 +151,8 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-sect > summary { cursor: pointer; font-weight: 600; padding: .2rem 0; }
 .shp-sect[open] > summary { margin-bottom: .6rem; }
 .shp-sect > * + * { margin-top: .6rem; }
+.shp-sect.is-ext > summary::after { content: 'Pro'; margin-left: .4rem; font-size: .62rem; font-weight: 700; letter-spacing: .04em; padding: .05rem .35rem;
+    border-radius: 999px; background: color-mix(in srgb, var(--dm-primary) 15%, transparent); color: var(--dm-primary); vertical-align: middle; }
 
 .shp-pics { display: flex; flex-wrap: wrap; gap: .5rem; }
 .shp-pic, .shp-pic-add { position: relative; width: 5.5rem; height: 5.5rem; border-radius: var(--dm-radius-md); overflow: hidden; }

package/plugins/shopping-cart/admin/lib/kit.js

@@ -156,6 +156,47 @@ export async function openPanel({title, size = 'md', html, model = {}, methods =
     return {so, panel, close: (force) => so.close(force)};
 }
 
+/**
+ * Extensions' sections in the product editor or an order (`ctx.extensions.panels`,
+ * on 'product' | 'order'), each a <details> put before `anchor` - collapsed in
+ * the editor, open on an order; a module can open its own. The module's
+ * `mount(body, {...info, ctx})` may return `{value(), dirty(), destroy()}`:
+ * the editor saves `value()` as `ext[owner]`. One that fails to load says so
+ * and sends nothing, so what it stored is kept.
+ *
+ * @returns {Promise<{panels: Array<{owner: string, handle: object}>, destroy: () => void}>}
+ */
+export async function mountPanels(anchor, {on, ctx, info = {}}) {
+    const {helpPopovers} = await loadKit();
+    const panels = [];
+    const undo = [];
+    for (const p of (ctx.extensions?.panels || []).filter(x => x.on === on)) {
+        const sect = fragment(`<details class="shp-sect is-ext" data-ext="${esc(p.owner)}"${on === 'order' ? ' open' : ''}>
+  <summary><span data-icon="${esc(p.icon)}" data-icon-size="14"></span> ${esc(p.label)}${p.help ? ` <span data-help="${esc(p.help)}"></span>` : ''}</summary>
+  <div class="shp-ext-body"></div>
+</details>`);
+        anchor.before(sect);
+        const body = sect.querySelector('.shp-ext-body');
+        try {
+            const mod = await import(p.module);
+            const mount = mod.mount || mod.default?.mount;
+            const handle = (await mount(body, {...info, ctx})) || {};
+            panels.push({owner: p.owner, handle});
+            if (typeof handle.destroy === 'function') undo.push(() => handle.destroy());
+        } catch (err) {
+            body.textContent = '';
+            const e = document.createElement('p');
+            e.className = 'shp-error';
+            e.textContent = `This section could not load: ${err.message || err}`;
+            body.appendChild(e);
+        }
+        // After the mount, so the section's own help marks work too.
+        I.scan(sect);
+        undo.push(helpPopovers(sect));
+    }
+    return {panels, destroy: () => undo.forEach(fn => { try { fn(); } catch { /* gone */ } })};
+}
+
 /**
  * Rows: click (or Enter) = the main action; right-click, ⋮ or Shift+F10 = the
  * menu. `scope` receives the teardown.

package/plugins/shopping-cart/admin/views/orders.js

@@ -9,7 +9,7 @@
  * slip. A notification's link (#/plugins/shopping-cart/orders/<id>) opens one.
  */
 
-import {api, copy, entriesOf, esc, fmtDate, fmtDateTime, money, openPanel, refreshBadge, store, when, wireRows} from '../lib/kit.js';
+import {api, copy, entriesOf, esc, fmtDate, fmtDateTime, money, mountPanels, openPanel, refreshBadge, store, when, wireRows} from '../lib/kit.js';
 import {NEXT, STATUS_LABEL, STATUS_TONE, addressLines, orderLabel} from '/plugins/shopping-cart/public/lib/orders.js';
 
 const FILTERS = [
@@ -269,6 +269,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
         const staffNote = M.observable(d.staffNote || '');
         const status = M.observable(d.status);
         let panel = null;
+        let extPanels = null;
         const ext = Object.entries(d.ext || {}).flatMap(([owner, facts]) => Object.entries(facts || {}).map(([k, v]) => ({owner, k, v})))
             .filter(x => ['string', 'number', 'boolean'].includes(typeof x.v));
         const addr = addressLines(d.address);
@@ -301,6 +302,7 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
   <textarea class="form-input" rows="2" data-model="staffNote.value" data-part="staff" placeholder="Wrapped as a gift, sent second class…"></textarea>
   ${d.paymentRef || d.providerRef ? `<p class="shp-muted shp-ref">Payment reference: <code>${esc(d.paymentRef || d.providerRef)}</code></p>` : ''}
   ${ext.length ? `<div class="shp-ext">${ext.map(x => `<span class="shp-chip is-muted">${esc(x.k)}: ${esc(String(x.v))}</span>`).join('')}</div>` : ''}
+  <div data-part="ext-panels" hidden></div>
   <h4>History</h4>
   <ol class="shp-history">${(d.history || []).slice().reverse().map(h => `<li><span class="shp-chip is-${STATUS_TONE[h.status] || 'muted'}">${esc(STATUS_LABEL[h.status] || h.status)}</span>
     <span>${esc(fmtDateTime(h.at))} · ${esc(h.by || '')}${h.note ? ` - ${esc(h.note)}` : ''}</span></li>`).join('')}</ol>
@@ -311,10 +313,17 @@ ${(d.lines || []).map(l => `<tr><td class="q">${l.qty}</td><td>${esc(l.name)}${l
             model: {staffNote, status},
             html,
             before: (el) => { const n = el.querySelector('.shp-callout p'); if (n) n.textContent = d.note; },
-            cleanup: () => panels.delete(panel?.so)
+            cleanup: () => { panels.delete(panel?.so); extPanels?.destroy(); }
         });
         panels.add(panel.so);
         const el = panel.panel;
+        // Extensions' sections (Shopping Cart Pro's Downloads). `changed` takes the order an extension
+        // updated, so the list keeps up.
+        extPanels = await mountPanels(el.querySelector('[data-part="ext-panels"]'), {on: 'order', ctx, info: {
+            order: o,
+            changed: (next) => { if (next?.id === o.id) replace(next); }
+        }});
+        if (!el.isConnected) extPanels.destroy();
 
         // Main actions as buttons, the rest in ⋮.
         const renderActs = (cur) => {

package/plugins/shopping-cart/admin/views/products.js

@@ -10,7 +10,7 @@
  * adds one; #/plugins/shopping-cart/products/new opens a blank one.
  */
 
-import {api, entriesOf, esc, getCurrency, money, moneyIn, moneyOut, openPanel, store, wireRows} from '../lib/kit.js';
+import {api, entriesOf, esc, getCurrency, money, moneyIn, moneyOut, mountPanels, openPanel, store, wireRows} from '../lib/kit.js';
 import {STATUS_LABEL, cleanProduct, priceRange, slugify, totalStock} from '/plugins/shopping-cart/public/lib/products.js';
 
 const FILTERS = [
@@ -205,7 +205,9 @@ export async function mount(root, ctx) {
 
         const snapshot = () => JSON.stringify([Object.fromEntries(Object.entries(f).map(([k, o]) => [k, o.peek()])), images.peek(), variants.peek()]);
         const opened = snapshot();
-        const dirty = () => snapshot() !== opened;
+        // Extensions' sections (Shopping Cart Pro's Downloads), mounted once the panel is open.
+        let ext = {panels: [], destroy() {}};
+        const dirty = () => snapshot() !== opened || ext.panels.some(x => x.handle.dirty?.());
 
         const payload = () => ({
             ...Object.fromEntries(Object.entries(f).map(([k, o]) => [k, o.peek()])),
@@ -216,8 +218,15 @@ export async function mount(root, ctx) {
             weight: f.weight.peek() === '' ? null : Number(f.weight.peek()),
             images: images.peek(),
             variants: variants.peek().map(v => ({id: v.id, name: v.name, sku: v.sku,
-                price: moneyOut(v.price), stock: v.stock === '' || v.stock === null ? null : Number(v.stock)}))
+                price: moneyOut(v.price), stock: v.stock === '' || v.stock === null ? null : Number(v.stock)})),
+            ...extPayload()
         });
+        // Only the sections that loaded send their part; the server keeps the rest as stored.
+        const extPayload = () => {
+            const out = {};
+            for (const {owner, handle} of ext.panels) if (typeof handle.value === 'function') out[owner] = handle.value();
+            return Object.keys(out).length ? {ext: out} : {};
+        };
         // Checked as typed, by the server's own rules.
         const check = M.computed(() => {
             f.name.value; f.price.value; f.compareAt.value; f.stock.value; f.weight.value; images.value; variants.value;
@@ -402,7 +411,7 @@ export async function mount(root, ctx) {
                 renderPics(el);
                 renderVariants(el);
             },
-            cleanup: () => { panels.delete(panel?.so); stopSlug?.(); },
+            cleanup: () => { panels.delete(panel?.so); stopSlug?.(); ext.destroy(); },
             methods: {
                 cancel: () => panel?.close(),
                 editSlug: () => { panel.panel.querySelector('[data-part="slug"]').hidden = false; slugTouched.value = true; panel.panel.querySelector('#sp-slug').focus(); },
@@ -431,6 +440,12 @@ export async function mount(root, ctx) {
         });
         panels.add(panel.so);
         const el = panel.panel;
+        ext = await mountPanels(el.querySelector('.shp-actions'), {on: 'product', ctx, info: {
+            product: had ? {id: had.id, data: had.data} : null,
+            // Options as they are in the form; one added since the last save has no id yet.
+            variants: () => variants.peek().map(v => ({id: v.id || '', name: v.name}))
+        }});
+        if (!el.isConnected) ext.destroy();
 
         // Pictures: add from Media, remove, drag to reorder.
         const pics = el.querySelector('[data-part="pics"]');

package/plugins/shopping-cart/admin/views/shop.js

@@ -15,7 +15,7 @@
 import {api, loadKit, setCurrency, store} from '../lib/kit.js';
 
 const ROUTE = /^#\/plugins\/shopping-cart(\/|$)/;
-const V = '1.0.0';
+const V = '1.2.0';
 const TABS = [
     {key: 'overview', label: 'Overview', icon: 'bar-chart', module: `/plugins/shopping-cart/admin/views/overview.js?v=${V}`},
     {key: 'orders', label: 'Orders', icon: 'receipt', module: `/plugins/shopping-cart/admin/views/orders.js?v=${V}`},

package/plugins/shopping-cart/docs/guide.md

@@ -91,6 +91,8 @@ The product form:
 - **Options & stock** - tick **Count stock** to track stock; it then sells out at 0. Add options with **Add an option**, each with a name, price (empty uses the product's price), SKU and stock. **Options are** names them (for example Size).
 - **Delivery & tax** - untick **Needs delivering** for downloads, services and tickets (no delivery charge, no address asked). **Weight (g)** and **Tax class** are used by Shopping Cart Pro.
 
+Shopping Cart Pro adds sections of its own, marked **Pro**, to the product form and to an order.
+
 Ctrl+Enter saves the form.
 
 ## Settings

package/plugins/shopping-cart/inject/body.html

@@ -1,2 +1,2 @@
-<link rel="stylesheet" href="/plugins/shopping-cart/public/shop.css?v=1.0.0">
+<link rel="stylesheet" href="/plugins/shopping-cart/public/shop.css?v=1.2.0">
 <script type="module" src="/plugins/shopping-cart/public/cart.js?v=1.0.0"></script>

package/plugins/shopping-cart/lib/extensions.js

@@ -14,6 +14,9 @@
  *       stages: {discount, shipping, tax},          // see lib/pricing.js
  *       on: {paid(order), status(order, from, to), checkout(order)},
  *       tabs: [{key, label, icon, module, help}],    // admin screens in the Shop
+ *       panels: [{key, label, icon, module, help, on}], // a section in the product editor or an order (on: 'product' | 'order')
+ *       product: {clean(input, {had, copy, product, variantMap})}, // checks what a product panel saves (product.ext[owner])
+ *       receipt(order, {settings}),                 // HTML for the shopper's receipt page (escape it yourself)
  *       checkout: {codes: true}                     // storefront features to show
  *   });
  *
@@ -28,6 +31,10 @@ export const KEY = Symbol.for('domma.shopping-cart');
 export const VERSION = 1;
 
 const EVENTS = ['paid', 'status', 'checkout'];
+const PANEL_ON = ['product', 'order'];
+const RECEIPT_WAIT = 3000;
+
+const panelOk = (t) => /^[a-z0-9-]{1,40}$/.test(t.key) && t.module.startsWith('/plugins/') && PANEL_ON.includes(t.on);
 
 /** The registry, made once per process. */
 export function cartRegistry() {
@@ -45,6 +52,9 @@ export function cartRegistry() {
                 stages: ext.stages || {},
                 on: ext.on || {},
                 tabs: Array.isArray(ext.tabs) ? ext.tabs : [],
+                panels: Array.isArray(ext.panels) ? ext.panels : [],
+                product: ext.product || {},
+                receipt: typeof ext.receipt === 'function' ? ext.receipt : null,
                 checkout: ext.checkout || {},
                 order: Number(ext.order) || 0
             });
@@ -76,6 +86,67 @@ export function cartRegistry() {
             }))).filter(t => /^[a-z0-9-]{1,40}$/.test(t.key) && t.module.startsWith('/plugins/'));
         },
 
+        /** Sections an extension adds to the product editor and the order view. */
+        panels() {
+            return reg.list().flatMap(e => e.panels.map(t => ({
+                key: String(t.key), label: String(t.label || t.key), icon: String(t.icon || 'puzzle'),
+                module: String(t.module || ''), help: String(t.help || ''), on: String(t.on || 'product'), owner: e.owner
+            }))).filter(panelOk);
+        },
+
+        /**
+         * A product's `ext`, saved. What each extension keeps on a product is
+         * its own: `input` (from the product form) is checked by that
+         * extension's `product.clean`, and anything it does not send, or an
+         * extension that is not running (a lapsed licence) left there, is kept
+         * as it was. A copy starts with nothing and asks each extension what it
+         * carries over (`copy: true`). A cleaner that throws keeps what was
+         * stored: an extension cannot stop a product being saved.
+         *
+         * @returns {Promise<{ext: object, errors: object}>}
+         */
+        async cleanProductExt(input, had, {copy = false, product = null, variantMap = null} = {}) {
+            const ext = copy ? {} : {...(had && typeof had === 'object' ? had : {})};
+            const errors = {};
+            if (!input || typeof input !== 'object') return {ext, errors};
+            for (const e of reg.list()) {
+                const clean = e.product?.clean;
+                if (typeof clean !== 'function' || !Object.hasOwn(input, e.owner)) continue;
+                try {
+                    const r = await clean(input[e.owner], {had: had?.[e.owner] ?? null, copy, product, variantMap});
+                    for (const [k, v] of Object.entries(r?.errors || {})) errors[`${e.owner}.${k}`] = String(v);
+                    if (r?.data === null || r?.data === undefined) delete ext[e.owner];
+                    else ext[e.owner] = r.data;
+                } catch (err) {
+                    console.warn(`[shopping-cart] ${e.owner} could not check a product: ${err?.message || err}`);
+                }
+            }
+            return {ext, errors};
+        },
+
+        /**
+         * What extensions add to a shopper's receipt: [{owner, html}]. Each has
+         * a few seconds; one that fails or dawdles is left out, never the page.
+         */
+        async receiptParts(order, ctx = {}) {
+            const parts = await Promise.all(reg.list().filter(e => e.receipt).map(async (e) => {
+                let timer;
+                try {
+                    const html = await Promise.race([
+                        Promise.resolve().then(() => e.receipt(order, ctx)),
+                        new Promise((_, no) => { timer = setTimeout(() => no(new Error('took too long')), RECEIPT_WAIT); })
+                    ]);
+                    return typeof html === 'string' && html.trim() ? {owner: e.owner, html} : null;
+                } catch (err) {
+                    console.warn(`[shopping-cart] ${e.owner} failed on the receipt: ${err?.message || err}`);
+                    return null;
+                } finally {
+                    clearTimeout(timer);
+                }
+            }));
+            return parts.filter(Boolean);
+        },
+
         /**
          * Tell every extension. Never throws and never waits: an email that
          * fails must not fail the payment that triggered it.

package/plugins/shopping-cart/lib/render.js

@@ -233,8 +233,11 @@ export function cartHtml({settings, base}) {
 </div>`;
 }
 
-/** A shopper's receipt. */
-export function receiptHtml({order, settings, base, problem = ''}) {
+/**
+ * A shopper's receipt. `parts` are extensions' sections ([{owner, html}],
+ * their own HTML, escaped by them) - Shopping Cart Pro's downloads.
+ */
+export function receiptHtml({order, settings, base, problem = '', parts = []}) {
     const cur = order.currency;
     const status = order.status;
     const waiting = status === 'pending';
@@ -271,6 +274,7 @@ export function receiptHtml({order, settings, base, problem = ''}) {
   ${status === 'awaiting' && settings.offlineInstructions ? `<div class="shop-r-note"><strong>${esc(settings.offlineLabel || 'How to pay')}</strong><p>${esc(settings.offlineInstructions)}</p><p>Please quote <strong>#${esc(order.number)}</strong> with your payment - ${esc(formatMoney(order.total, cur))}.</p></div>` : ''}
   ${closed ? '' : `<ol class="shop-r-steps">${steps.map(s => `<li class="${s.done ? 'is-done' : ''}"><span></span>${esc(s.label)}</li>`).join('')}</ol>`}
   ${t ? `<div class="shop-r-note">${ICON.truck} <strong>${esc(t.carrier || 'Tracking')}</strong> ${esc(t.number || '')} ${t.url ? `<a href="${esc(t.url)}" target="_blank" rel="noopener">Track it</a>` : ''}</div>` : ''}
+  ${parts.map(p => `<div class="shop-r-ext" data-ext="${esc(p.owner)}">${p.html}</div>`).join('')}
   <div class="shop-r-grid">
     <section><h2>Items</h2><ul class="shop-r-lines">${lines}</ul>${totals}</section>
     <section class="shop-r-side">

package/plugins/shopping-cart/lib/shop.js

@@ -17,6 +17,7 @@ import {getPluginSettings, getPluginStates, savePluginState} from '../../../serv
 import {cleanProduct} from '../public/lib/products.js';
 import {NEXT, SOLD, canMove} from '../public/lib/orders.js';
 import {currencyOf} from '../public/lib/money.js';
+import {cartRegistry} from './extensions.js';
 import defaults from '../config.js';
 
 export const NAME = 'shopping-cart';
@@ -174,22 +175,45 @@ async function uniqueSlug(slug, exceptId = null) {
     return `${slug}-${Date.now()}`;
 }
 
-export async function saveProduct(input, {id = null, currency = 'GBP', by = null} = {}) {
-    const {data, errors} = cleanProduct(input, {currency, minor: true});
-    if (Object.keys(errors).length) return {errors};
-    data.slug = await uniqueSlug(data.slug, id);
-    if (id) {
-        const had = await getProduct(id);
-        if (!had) return {notFound: true};
-        const entry = await updateEntry(PRODUCTS, id, data);
+/**
+ * Save a product. Under the order lock: a sale's stock and an extension's
+ * `updateProductExt` (licence keys taken) never interleave with an edit.
+ * `variantMap` (a copy) is old option id -> the copy's, for extensions' parts.
+ */
+export function saveProduct(input, {id = null, currency = 'GBP', by = null, copy = false, variantMap = null} = {}) {
+    return withLock(async () => {
+        const had = id ? await getProduct(id) : null;
+        if (id && !had) return {notFound: true};
+        const {data, errors} = cleanProduct(input, {currency, minor: true});
+        // What extensions keep on a product (Shopping Cart Pro's downloads), each checked by its own extension.
+        const x = await cartRegistry().cleanProductExt(input?.ext, copy ? input?.ext : had?.data?.ext, {copy, product: data, variantMap});
+        Object.assign(errors, x.errors);
+        if (Object.keys(errors).length) return {errors};
+        if (Object.keys(x.ext).length) data.ext = x.ext;
+        data.slug = await uniqueSlug(data.slug, id);
+        const entry = id ? await updateEntry(PRODUCTS, id, data) : await createEntry(PRODUCTS, data, {createdBy: by, source: 'plugin'});
         await refreshShelf();
         return {entry};
-    }
-    const entry = await createEntry(PRODUCTS, data, {createdBy: by, source: 'plugin'});
-    await refreshShelf();
-    return {entry};
+    });
 }
 
+/**
+ * Change only an extension's part of a product, under the order lock, from
+ * the product as it is now: `fn(part) -> part` (null removes it). No form
+ * check - the extension's own write (Shopping Cart Pro taking licence keys).
+ */
+export const updateProductExt = (id, owner, fn) => withLock(async () => {
+    const had = await getProduct(id);
+    if (!had) throw Object.assign(new Error('No such product.'), {status: 404});
+    const next = await fn(had.data.ext?.[owner] ?? null);
+    const ext = {...(had.data.ext || {})};
+    if (next === null || next === undefined) delete ext[owner];
+    else ext[owner] = next;
+    const entry = await updateEntry(PRODUCTS, id, {...had.data, ext});
+    await refreshShelf();
+    return entry;
+});
+
 export async function removeProduct(id) {
     await deleteEntry(PRODUCTS, id);
     await refreshShelf();

package/plugins/shopping-cart/plugin.js

@@ -4,7 +4,7 @@
  * Admin (the `shop` permission; read to look, manage to change):
  *   GET  /summary                 Overview figures
  *   GET  /count                   sidebar badge: paid orders to fulfil (else how many products)
- *   GET  /extensions              admin tabs extensions (Pro) add
+ *   GET  /extensions              admin tabs and panels extensions (Pro) add
  *   GET  /products · POST /products · PUT /products/:id · DELETE /products/:id
  *   POST /products/:id/duplicate · PUT /products/:id/stock
  *   GET  /orders · GET /orders/:id · PUT /orders/:id/status · PUT /orders/:id/note
@@ -34,7 +34,7 @@ import * as pay from './lib/payments.js';
 import {
     NAME, allOrders, allProducts, annotateOrder, cleanSettings, cleanTracking, createOrder, ensureCollections, extendOrder,
     getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, publicOrder, removeOrder,
-    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk
+    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk, updateProductExt
 } from './lib/shop.js';
 import {cardHtml, esc, gridHtml} from './lib/render.js';
 
@@ -177,6 +177,14 @@ export default async function shoppingCart(fastify, options) {
         liveSettings, allOrders, getOrder, allProducts, getProduct, extendOrder, publicOrder,
         formatMoney, orderLabel,
         siteBase: () => siteBase(null),
+        /** Change only an extension's part of a product, under the order lock (lib/shop.js updateProductExt). */
+        updateProductExt,
+        /** Move an order on (Shopping Cart Pro fulfils an order with nothing to post), telling every extension. */
+        async moveOrder(id, to, {by = 'shop', note = ''} = {}) {
+            const {order, from} = await moveOrder(id, String(to), {by, note});
+            announceMove(order, from, order.data.status);
+            return order;
+        },
         receiptUrl: (order) => liveSettings().then(s => `${siteBase(null)}${receiptPath(s, order)}`)
     };
 
@@ -199,6 +207,7 @@ export default async function shoppingCart(fastify, options) {
 
     fastify.get('/extensions', can('read'), async () => ({
         tabs: registry.tabs(),
+        panels: registry.panels(),
         extensions: registry.list().map(e => ({owner: e.owner, label: e.label}))
     }));
 
@@ -237,7 +246,9 @@ export default async function shoppingCart(fastify, options) {
         const patch = {};
         for (const k of ['status', 'featured', 'stock', 'trackStock', 'position', 'variants']) if (b[k] !== undefined) patch[k] = b[k];
         const s = await liveSettings();
-        const r = await saveProduct({...had.data, ...patch}, {id: had.id, currency: s.currency});
+        // An extension's part of the product (ext) is left as it is: no quick edit touches it.
+        const {ext, ...data} = had.data;
+        const r = await saveProduct({...data, ...patch}, {id: had.id, currency: s.currency});
         if (r.errors) return fail(reply, 400, Object.values(r.errors)[0], {errors: r.errors});
         return r.entry;
     });
@@ -247,8 +258,11 @@ export default async function shoppingCart(fastify, options) {
         if (!had) return fail(reply, 404, 'That product is gone.');
         const s = await liveSettings();
         // A copy is the shop's own product, even of an extension's: listed, and nobody else's to change.
-        const r = await saveProduct({...had.data, name: `${had.data.name} (copy)`, slug: '', status: 'draft', unlisted: false, owner: '',
-            variants: (had.data.variants || []).map(v => ({...v, id: ''}))}, {currency: s.currency, by: request.user?.id});
+        // Its options get new ids; extensions are told which old one became which (a file for one option).
+        const variantMap = {};
+        const variants = (had.data.variants || []).map(v => { variantMap[v.id] = Math.random().toString(36).slice(2, 10); return {...v, id: variantMap[v.id]}; });
+        const r = await saveProduct({...had.data, name: `${had.data.name} (copy)`, slug: '', status: 'draft', unlisted: false, owner: '', variants},
+            {currency: s.currency, by: request.user?.id, copy: true, variantMap});
         if (r.errors) return fail(reply, 400, Object.values(r.errors)[0]);
         return reply.code(201).send(r.entry);
     });

package/plugins/shopping-cart/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "shopping-cart",
   "displayName": "Shopping Cart",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "tier": "free",
   "description": "Sell from your site: products with options, stock and pictures, a storefront and a cart that follows shoppers from page to page, and checkout with Stripe, PayPal or payment offline. Orders to fulfil in the sidebar, refunds from the order.",
   "author": "Domma CMS",
-  "date": "2026-09-27",
+  "date": "2026-10-12",
   "icon": "shopping-bag",
   "permissions": [
     {
@@ -45,7 +45,7 @@
     ],
     "views": {
       "plugin-shopping-cart": {
-        "entry": "shopping-cart/admin/views/shop.js?v=1.0.2",
+        "entry": "shopping-cart/admin/views/shop.js?v=1.2.0",
         "exportName": "shopView"
       }
     }

package/plugins/shopping-cart/plugin.public.js

@@ -118,9 +118,10 @@ export default async function shopPublic(fastify) {
             const confirm = cartRegistry().services?.confirmStripe;
             if (confirm) entry = await confirm(entry, request.query?.session_id, request.log);
             const order = publicOrder(entry);
+            const parts = await cartRegistry().receiptParts(entry, {settings: s});
             return send(reply, request, s, {
                 page: 'order',
-                body: receiptHtml({order, settings: s, base: s.shopPath, problem: String(request.query?.problem || '')}),
+                body: receiptHtml({order, settings: s, base: s.shopPath, problem: String(request.query?.problem || ''), parts}),
                 title: `Order #${order.number}`,
                 urlPath: `${s.shopPath}/order/${id}`,
                 noindex: true,

package/plugins/shopping-cart/public/shop.css

@@ -300,6 +300,17 @@ body {
 @keyframes shop-spin { to { transform: rotate(360deg); } }
 .shop-r-note { border-radius: var(--shop-radius-sm); padding: 1rem 1.2rem; background: var(--shop-softer); border: 1px solid var(--shop-line); margin: 0 0 1.25rem; }
 .shop-r-note p { margin: .35rem 0 0; }
+.shop-r-ext { margin: 0 0 1.25rem; }
+.shop-r-ext > :last-child { margin-bottom: 0; }
+/* Files and keys on the receipt (Shopping Cart Pro's downloads). */
+.shop-r-files { list-style: none; padding: 0; margin: .6rem 0 0; display: grid; gap: .6rem; }
+.shop-r-files li { display: flex; align-items: center; gap: .75rem; flex-wrap: wrap; }
+.shop-r-fname { flex: 1 1 12rem; font-weight: 600; }
+.shop-r-fname small { display: block; color: var(--shop-muted); font-weight: 400; }
+.shop-r-files code { padding: .15rem .45rem; border-radius: 6px; background: var(--shop-soft); user-select: all; word-break: break-all; }
+.shop-r-get { display: inline-flex; align-items: center; gap: .35rem; border-radius: 999px; padding: .45rem 1.1rem; background: var(--shop-accent);
+    color: var(--shop-accent-ink); text-decoration: none; font-weight: 600; }
+.shop-r-get:hover { filter: brightness(1.05); }
 .shop-r-steps { list-style: none; padding: 0; margin: 0 0 2rem; display: grid; grid-template-columns: repeat(3, 1fr); counter-reset: s; }
 .shop-r-steps li { position: relative; padding-top: 1.6rem; font-size: .88rem; color: var(--shop-muted); text-align: center; }
 .shop-r-steps li span { position: absolute; top: .3rem; left: 50%; width: .9rem; height: .9rem; margin-left: -.45rem; border-radius: 50%;
@@ -400,6 +411,7 @@ html.shop-locked { overflow: hidden; }
 .shop-page .shop-qty input, .shop-drawer .shop-qty input, .shop-search input {
     background: transparent !important; border: 0 !important; box-shadow: none !important; outline: 0; padding-left: 0; padding-right: 0; margin: 0; min-height: 0; }
 .shop-card-title a, .shop-card-title a:hover, .shop-line-name, .shop-crumbs a, .shop-quick { text-decoration: none !important; }
+.shop-r-get, .shop-r-get:hover, .shop-r-get:visited { color: var(--shop-accent-ink) !important; text-decoration: none !important; }
 .shop-card-title a:hover { color: var(--shop-accent); }
 
 @media (max-width: 640px) {

package/plugins/shopping-cart/tests/api.test.js

@@ -188,3 +188,54 @@ test('an extension sells its own unlisted product through services.startCheckout
         reg.unregister('test-credits');
     }
 });
+
+test('an extension keeps its own part of a product, and moves its orders on', async () => {
+    const {cartRegistry} = await import('../lib/extensions.js');
+    const reg = cartRegistry();
+    const moves = [];
+    reg.register('test-dl', {
+        product: {clean: (input, {copy}) => (input?.file === 'x' ? {data: null, errors: {file: 'No such file.'}}
+            : {data: {file: String(input?.file || ''), keys: copy ? [] : [].concat(input?.keys || [])}})},
+        on: {status: (order, from, to) => moves.push(`${from}>${to}`)}
+    });
+    try {
+        await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB']});
+        let r = await call('POST', '/products', {name: 'E-book', price: 500, status: 'active', shippable: false, ext: {'test-dl': {file: 'f1', keys: ['K1']}}});
+        assert.equal(r.status, 201, JSON.stringify(r.body));
+        const book = r.body;
+        assert.deepEqual(book.data.ext, {'test-dl': {file: 'f1', keys: ['K1']}});
+        // Never on the storefront.
+        assert.ok(!('ext' in (await call('GET', '/catalogue')).body.products.find(p => p.id === book.id)));
+        // Refused by the extension: not saved, its message back.
+        r = await call('PUT', `/products/${book.id}`, {...book.data, ext: {'test-dl': {file: 'x'}}});
+        assert.equal(r.status, 400);
+        assert.equal(r.body.error, 'No such file.');
+        // A form that sends no ext (the section did not load) keeps it; quick edits keep it.
+        r = await call('PUT', `/products/${book.id}`, {...book.data, ext: undefined, name: 'The E-book'});
+        assert.deepEqual(r.body.data.ext, book.data.ext);
+        r = await call('PATCH', `/products/${book.id}`, {featured: true});
+        assert.deepEqual(r.body.data.ext, book.data.ext);
+        // A copy carries what the extension says (no licence keys).
+        r = await call('POST', `/products/${book.id}/duplicate`);
+        assert.deepEqual(r.body.data.ext, {'test-dl': {file: 'f1', keys: []}});
+        // updateProductExt changes only that part, from the product as it is now, with no form check.
+        await call('PATCH', `/products/${book.id}`, {stock: 7});
+        const up = await reg.services.updateProductExt(book.id, 'test-dl', (part) => ({...part, keys: part.keys.slice(1)}));
+        assert.deepEqual(up.data.ext['test-dl'].keys, []);
+        assert.equal(up.data.stock, 7, 'the rest of the product as it is now');
+        assert.equal(up.data.name, 'The E-book');
+
+        // services.moveOrder moves an order and tells every extension.
+        r = await call('POST', '/checkout', {lines: [{productId: book.id, qty: 1}], provider: 'offline', customer: {name: 'Ann', email: 'ann@example.com'}});
+        assert.equal(r.status, 200, JSON.stringify(r.body));
+        const id = r.body.orderId;
+        await call('PUT', `/orders/${id}/status`, {status: 'paid'});
+        const moved = await reg.services.moveOrder(id, 'fulfilled', {by: 'test-dl', note: 'Nothing to post'});
+        assert.equal(moved.data.status, 'fulfilled');
+        await new Promise(res => setTimeout(res, 20));
+        assert.ok(moves.includes('paid>fulfilled'));
+        await assert.rejects(reg.services.moveOrder(id, 'awaiting'), /cannot become/);
+    } finally {
+        reg.unregister('test-dl');
+    }
+});

package/plugins/shopping-cart/tests/pure.test.js

@@ -10,6 +10,7 @@ import {badge, summarise} from '../lib/summary.js';
 import {cartRegistry} from '../lib/extensions.js';
 import {matchShopPath} from '../plugin.public.js';
 import {cleanPath, cleanSettings, MASK, maskSettings} from '../lib/shop.js';
+import {receiptHtml} from '../lib/render.js';
 import defaults from '../config.js';
 
 test('money: minor units in, formatted out', () => {
@@ -126,6 +127,54 @@ test('registry: stages, tabs, and emit that never throws', async () => {
     assert.equal(reg.list().length, 0);
 });
 
+test('registry: panels, a product\'s ext kept per extension, receipt parts', async () => {
+    const reg = cartRegistry();
+    reg.register('test-dl', {
+        panels: [{key: 'files', label: 'Downloads', module: '/plugins/test-dl/admin/files.js', on: 'product'},
+            {key: 'files', label: 'Downloads', module: '/plugins/test-dl/admin/order.js', on: 'order'},
+            {key: 'bad', module: 'https://evil/x.js', on: 'product'}, {key: 'where', module: '/plugins/test-dl/x.js', on: 'basket'}],
+        product: {clean: (input, {had, copy}) => {
+            if (input?.files === 'bad') return {data: had, errors: {files: 'Not a file.'}};
+            if (input?.files === 'none') return {data: null};
+            return {data: {files: [].concat(input?.files || []), keys: copy ? [] : (input?.keys || [])}};
+        }},
+        receipt: (order) => (order.data.status === 'paid' ? '<p>Your files</p>' : '')
+    });
+    reg.register('test-boom', {product: {clean: () => { throw new Error('nope'); }}, receipt: () => { throw new Error('nope'); }});
+    try {
+        assert.deepEqual(reg.panels().map(p => `${p.owner}:${p.on}`), ['test-dl:product', 'test-dl:order']);
+
+        const had = {'test-dl': {files: ['a'], keys: ['K1']}, 'test-boom': {x: 1}, 'gone-ext': {kept: true}};
+        // Nothing sent: everything stored stays.
+        assert.deepEqual((await reg.cleanProductExt(undefined, had)).ext, had);
+        // An extension's part is its own to check; a lapsed one's and a throwing one's stay as stored.
+        let r = await reg.cleanProductExt({'test-dl': {files: ['b']}, 'test-boom': {x: 2}, 'gone-ext': {kept: false}}, had);
+        assert.deepEqual(r.ext, {'test-dl': {files: ['b'], keys: []}, 'test-boom': {x: 1}, 'gone-ext': {kept: true}});
+        r = await reg.cleanProductExt({'test-dl': {files: 'bad'}}, had);
+        assert.deepEqual(r.errors, {'test-dl.files': 'Not a file.'});
+        r = await reg.cleanProductExt({'test-dl': {files: 'none'}}, had);
+        assert.ok(!('test-dl' in r.ext), 'null data removes the part');
+        // A copy starts empty and carries what each extension says.
+        r = await reg.cleanProductExt(had, had, {copy: true});
+        assert.deepEqual(r.ext, {'test-dl': {files: ['a'], keys: []}});
+
+        assert.deepEqual(await reg.receiptParts({data: {status: 'paid'}}), [{owner: 'test-dl', html: '<p>Your files</p>'}]);
+        assert.deepEqual(await reg.receiptParts({data: {status: 'pending'}}), []);
+    } finally {
+        reg.unregister('test-dl');
+        reg.unregister('test-boom');
+    }
+});
+
+test('receipt: extension parts sit above the items', () => {
+    const order = {id: 'o1', number: 1001, status: 'paid', currency: 'GBP', lines: [], subtotal: 0, adjustments: [], total: 0,
+        customer: {name: 'Ann'}, email: 'ann@x.test', address: null, delivery: 'none', placedAt: new Date().toISOString()};
+    const html = receiptHtml({order, settings: {}, base: '/shop', parts: [{owner: 'test-dl', html: '<p>Your files</p>'}]});
+    assert.match(html, /<div class="shop-r-ext" data-ext="test-dl"><p>Your files<\/p><\/div>/);
+    assert.ok(html.indexOf('shop-r-ext') < html.indexOf('shop-r-grid'));
+    assert.ok(!receiptHtml({order, settings: {}, base: '/shop'}).includes('shop-r-ext'));
+});
+
 test('stripe: form encoding, itemising, signature, paid check', () => {
     assert.equal(stripeForm({a: {b: [{c: 1}]}, d: 'x', e: null}).toString(), 'a%5Bb%5D%5B0%5D%5Bc%5D=1&d=x');
     const order = {id: 'o1', number: 1001, currency: 'GBP', total: 1395,