domma-cms 1.6.33 → 1.6.35

package/plugins/_lib/outreach/ledger.js

@@ -0,0 +1,127 @@
+/**
+ * The outreach send ledger: one row per (thing, contact) with a hashed
+ * per-recipient token and a status - the record that makes sends resumable
+ * (the row is written before the email goes) and reminders targetable.
+ *
+ * Generic over what is being sent: `refField` names the column tying a row
+ * to its campaign/survey/journey. Surveys passes
+ * `{slug: 'surveys-invites', refField: 'surveyId', source: 'surveys'}` so its stored data is
+ * unchanged. Lifted from Surveys 1.4 (lib/ledger.js).
+ *
+ * Statuses: pending -> sent -> completed, or bounced (any send failure,
+ * including a suppressed address - deliberately excluded from reminders).
+ *
+ * @module _lib/outreach/ledger
+ */
+import {generateToken, hashToken, normaliseCode} from './tokens.js';
+
+/**
+ * @param {{createEntry,listEntries,getEntry,updateEntry}} col collections service
+ * @param {{slug?: string, refField?: string}} [opts]
+ */
+export function createLedger(col, {slug = 'outreach-invites', refField = 'ref', source = 'outreach'} = {}) {
+    async function allInvites() {
+        const {entries} = await col.listEntries(slug, {limit: 100000});
+        return entries;
+    }
+
+    async function invitesFor(refId) {
+        return (await allInvites()).filter(e => e.data[refField] === refId);
+    }
+
+    /** Issue pending invites for contacts that don't already have one. Returns [{id, contactId, token}]. */
+    async function issueInvites(refId, contactIds) {
+        const existing = await invitesFor(refId);
+        const seen = new Set(existing.map(e => e.data.contactId));
+        const out = [];
+        for (const contactId of contactIds) {
+            if (seen.has(contactId)) continue;
+            const token = generateToken();
+            const entry = await col.createEntry(slug, {
+                [refField]: refId, contactId,
+                tokenHash: hashToken(normaliseCode(token)),
+                status: 'pending', sentAt: null, completedAt: null, responseId: null
+            }, {source});
+            out.push({id: entry.id, contactId, token});
+            seen.add(contactId);
+        }
+        return out;
+    }
+
+    /**
+     * Ensure every listed contact has a FRESH token to email. New contacts get
+     * a created invite; existing non-completed invites are re-issued with a
+     * new token (so re-sends and reminders carry a working personalised link);
+     * contacts who already completed are skipped. The previous token for a
+     * re-issued invite stops working - latest link wins.
+     *
+     * Returns [{id, contactId, token}] for the invites to email.
+     */
+    async function issueOrReissue(refId, contactIds) {
+        const existing = await invitesFor(refId);
+        const byContact = new Map(existing.map(e => [e.data.contactId, e]));
+        const out = [];
+        for (const contactId of contactIds) {
+            const ex = byContact.get(contactId);
+            if (ex && ex.data.status === 'completed') continue;
+            const token = generateToken();
+            const tokenHash = hashToken(normaliseCode(token));
+            if (ex) {
+                await col.updateEntry(slug, ex.id, {...ex.data, tokenHash});
+                out.push({id: ex.id, contactId, token});
+            } else {
+                const entry = await col.createEntry(slug, {
+                    [refField]: refId, contactId, tokenHash,
+                    status: 'pending', sentAt: null, completedAt: null, responseId: null
+                }, {source});
+                out.push({id: entry.id, contactId, token});
+            }
+        }
+        return out;
+    }
+
+    /** Find an invite by submitted code (any format). Null if unknown. */
+    async function findByCode(refId, code) {
+        const hash = hashToken(normaliseCode(code));
+        const invites = await invitesFor(refId);
+        return invites.find(e => e.data.tokenHash === hash) ?? null;
+    }
+
+    /** Mark sent / bounced. */
+    async function markSent(inviteId, ok, nowIso) {
+        const entry = await col.getEntry(slug, inviteId);
+        if (!entry) return null;
+        return col.updateEntry(slug, inviteId, {
+            ...entry.data,
+            status: ok ? 'sent' : 'bounced',
+            sentAt: ok ? nowIso : entry.data.sentAt
+        });
+    }
+
+    /** Mark completed with the stored response id. */
+    async function markCompleted(inviteId, responseId, nowIso) {
+        const entry = await col.getEntry(slug, inviteId);
+        if (!entry) return null;
+        return col.updateEntry(slug, inviteId, {
+            ...entry.data, status: 'completed', completedAt: nowIso, responseId: responseId ?? null
+        });
+    }
+
+    /** Invites that are neither completed nor bounced. */
+    async function outstanding(refId) {
+        const invites = await invitesFor(refId);
+        return invites.filter(e => e.data.status !== 'completed' && e.data.status !== 'bounced');
+    }
+
+    /** Sent invites, not yet completed, whose sentAt is older than afterDays before now. */
+    async function dueForReminder(refId, afterDays, now) {
+        const cutoff = now.getTime() - Number(afterDays) * 86400000;
+        const invites = await invitesFor(refId);
+        return invites.filter(e =>
+            e.data.status === 'sent' &&
+            e.data.sentAt && new Date(e.data.sentAt).getTime() <= cutoff
+        );
+    }
+
+    return {allInvites, invitesFor, issueInvites, issueOrReissue, findByCode, markSent, markCompleted, outstanding, dueForReminder, slug, refField};
+}

package/plugins/_lib/outreach/sending.js

@@ -0,0 +1,121 @@
+/**
+ * Outreach email rendering and batch sending. Lifted from Surveys 1.4
+ * (lib/sending.js), generalised: the per-recipient link and the button label
+ * are the caller's, and a suppression check can sit in front of every send.
+ *
+ * @module _lib/outreach/sending
+ */
+import {normaliseEmail} from './suppression.js';
+
+export function escapeHtml(s) {
+    return String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+/** Escape a value for use inside a double-quoted HTML attribute (e.g. href). */
+export function escapeAttr(s) {
+    return String(s ?? '').replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+}
+
+/** 'https://example.com' from a configured address, or '' when it is not one. */
+function origin(value) {
+    const v = String(value ?? '').trim().replace(/\/+$/, '');
+    return /^https?:\/\/[^\s/?#]+$/i.test(v) ? v : '';
+}
+
+/**
+ * Where the links in outreach emails point: the Site URL setting
+ * (site.baseUrl, the address core builds password-reset, canonical and
+ * sitemap links on), else the old `site.url`, else the address this request
+ * came in on.
+ *
+ * @param {object} site - getConfig('site')
+ * @param {{protocol?: string, host?: string, headers?: object}} [req]
+ * @returns {string} origin, no trailing slash
+ */
+export function outreachBaseUrl(site, req) {
+    const configured = origin(site?.baseUrl) || origin(site?.url);
+    if (configured) return configured;
+    const host = req?.host || req?.headers?.host || '';
+    return host ? `${req?.protocol || 'http'}://${host}` : '';
+}
+
+/**
+ * Render one message's subject + plain-text + HTML from a template and a link.
+ *
+ * The HTML version turns each {{link}} into a clickable button; all non-link
+ * copy is escaped so user-authored bodies can't inject markup. The plain-text
+ * version keeps the raw URL. An optional `footerHtml` (already-safe markup -
+ * an unsubscribe line) is appended inside the wrapper.
+ *
+ * @param {{subject?: string, body?: string}} template
+ * @param {{name?: string}} contact
+ * @param {string} link
+ * @param {{buttonLabel?: string, defaultSubject?: string, defaultBody?: string, footerHtml?: string, footerText?: string}} [opts]
+ */
+export function renderInvite(template, contact, link, opts = {}) {
+    const {
+        buttonLabel = 'Open the link',
+        defaultSubject = 'A message for you',
+        defaultBody = "Hi {{name}},\n\n{{link}}",
+        footerHtml = '',
+        footerText = ''
+    } = opts;
+    const name = contact.name || 'there';
+    const subjectTpl = (template.subject && template.subject.trim()) || defaultSubject;
+    const bodyTpl = (template.body && template.body.trim()) || defaultBody;
+
+    const subject = subjectTpl.replaceAll('{{name}}', name).replaceAll('{{link}}', link);
+    const text = bodyTpl.replaceAll('{{name}}', name).replaceAll('{{link}}', link)
+        + (footerText ? `\n\n${footerText}` : '');
+
+    const button = `<p style="margin:24px 0;"><a href="${escapeAttr(link)}" `
+        + `style="display:inline-block;background:#2563eb;color:#ffffff;text-decoration:none;`
+        + `padding:12px 24px;border-radius:6px;font-weight:600;font-size:15px;">${escapeHtml(buttonLabel)}</a></p>`;
+
+    const bodyHtml = bodyTpl
+        .split('{{link}}')
+        .map((seg) => escapeHtml(seg.replaceAll('{{name}}', name)).replace(/\n/g, '<br>'))
+        .join(button);
+
+    const html = `<div style="font-family:-apple-system,Segoe UI,Roboto,Arial,sans-serif;`
+        + `max-width:560px;margin:0 auto;padding:24px;color:#1f2937;line-height:1.6;font-size:15px;">`
+        + bodyHtml
+        + `<hr style="border:none;border-top:1px solid #e5e7eb;margin:24px 0;">`
+        + `<p style="font-size:12px;color:#6b7280;">If the button doesn't work, paste this link into your browser:<br>`
+        + `<a href="${escapeAttr(link)}" style="color:#2563eb;">${escapeHtml(link)}</a></p>`
+        + (footerHtml || '')
+        + `</div>`;
+
+    return {subject, text, html};
+}
+
+/**
+ * Send to each recipient; never fails wholesale. A recipient on the
+ * suppression set is not sent to at all and comes back
+ * `{inviteId, ok: false, suppressed: true}` - the caller's ledger treats
+ * that like a bounce, which keeps them out of reminders.
+ *
+ * @param {Array<{invite: {id: string}, contact: {name?: string, email: string}, token: string}>} recipients
+ * @param {{subject?: string, body?: string}} template
+ * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite}
+ * @returns {Promise<Array<{inviteId: string, ok: boolean, suppressed?: true}>>}
+ */
+export async function sendBatch(recipients, template, deps) {
+    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}} = deps;
+    const results = [];
+    for (const r of recipients) {
+        if (suppressed && suppressed.has(normaliseEmail(r.contact.email))) {
+            results.push({inviteId: r.invite.id, ok: false, suppressed: true});
+            continue;
+        }
+        const link = linkFor(r);
+        const msg = renderInvite(template, r.contact, link, render);
+        try {
+            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text});
+            results.push({inviteId: r.invite.id, ok: true});
+        } catch {
+            results.push({inviteId: r.invite.id, ok: false});
+        }
+    }
+    return results;
+}

package/plugins/_lib/outreach/suppression.js

@@ -0,0 +1,62 @@
+/**
+ * The shared suppression list: addresses that must not be emailed by any
+ * outreach Tool. One opt-out silences them all - marketing email without a
+ * working unsubscribe is not shippable (PECR), and a surveys opt-out should
+ * silence campaigns too. Rows live in the shared `outreach-unsubscribes`
+ * collection ({email, at, source}; schema in ./collections).
+ *
+ * Addresses are compared lower-cased and trimmed. Suppressed recipients are
+ * not sent to and are marked `bounced` in the ledger, which keeps them out
+ * of reminders for good.
+ *
+ * @module _lib/outreach/suppression
+ */
+
+/** Canonical form for comparison and storage. */
+export const normaliseEmail = (email) => String(email ?? '').trim().toLowerCase();
+
+/**
+ * @param {{createEntry,listEntries,deleteEntry?}} col collections service
+ * @param {{slug?: string}} [opts]
+ */
+export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
+    async function rows() {
+        const {entries} = await col.listEntries(slug, {limit: 100000}).catch(() => ({entries: []}));
+        return entries;
+    }
+
+    /** Every suppressed address as a Set - take one per send batch. */
+    async function suppressedSet() {
+        return new Set((await rows()).map(e => normaliseEmail(e.data.email)).filter(Boolean));
+    }
+
+    async function isSuppressed(email) {
+        const want = normaliseEmail(email);
+        if (!want) return false;
+        return (await suppressedSet()).has(want);
+    }
+
+    /** Add an address (idempotent). `source` says which Tool took the opt-out. */
+    async function add(email, source = 'outreach') {
+        const want = normaliseEmail(email);
+        if (!want) return null;
+        const existing = (await rows()).find(e => normaliseEmail(e.data.email) === want);
+        if (existing) return existing;
+        return col.createEntry(slug, {email: want, at: new Date().toISOString(), source}, {source});
+    }
+
+    /** Take an address off the list (they asked to hear from us again). */
+    async function remove(email) {
+        if (typeof col.deleteEntry !== 'function') return false;
+        const want = normaliseEmail(email);
+        const hits = (await rows()).filter(e => normaliseEmail(e.data.email) === want);
+        for (const e of hits) await col.deleteEntry(slug, e.id).catch(() => {});
+        return hits.length > 0;
+    }
+
+    async function list() {
+        return (await rows()).map(e => ({id: e.id, email: e.data.email, at: e.data.at ?? null, source: e.data.source ?? ''}));
+    }
+
+    return {isSuppressed, suppressedSet, add, remove, list, slug};
+}

package/plugins/_lib/outreach/tokens.js

@@ -0,0 +1,35 @@
+/**
+ * Outreach tokens: short unambiguous codes for per-recipient links. Only the
+ * SHA-256 hash is ever stored - the plaintext travels in the emailed URL and
+ * nowhere else. Lifted from Surveys 1.4 (lib/tokens.js) unchanged.
+ *
+ * @module _lib/outreach/tokens
+ */
+import crypto from 'crypto';
+
+const ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789'; // no O,0,I,1,L
+const LENGTH = 8;
+
+/** Generate an 8-char unambiguous uppercase token. */
+export function generateToken() {
+    const bytes = crypto.randomBytes(LENGTH);
+    let out = '';
+    for (let i = 0; i < LENGTH; i++) out += ALPHABET[bytes[i] % ALPHABET.length];
+    return out;
+}
+
+/** SHA-256 hex of a normalised code. The plaintext is never stored. */
+export function hashToken(code) {
+    return crypto.createHash('sha256').update(String(code)).digest('hex');
+}
+
+/** Display form: ABCD-EFGH. */
+export function formatCode(token) {
+    const t = String(token).toUpperCase();
+    return t.length === 8 ? `${t.slice(0, 4)}-${t.slice(4)}` : t;
+}
+
+/** Canonical form for hashing/lookup: strip non-alphanumerics, uppercase. */
+export function normaliseCode(input) {
+    return String(input ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
+}

package/plugins/_lib/outreach/unsubscribe.js

@@ -0,0 +1,46 @@
+/**
+ * Unsubscribe links that keep working forever: an HMAC of the address under a
+ * per-site secret, not a ledger token (a re-send re-issues ledger tokens, and
+ * the unsubscribe link in an OLD email must still work - PECR). The secret is
+ * the engine's (server/services/outreachUnsubscribe.js) and so is the
+ * `/campaign-unsubscribe` route (server/routes/outreach-public.js), so a link
+ * keeps working after the Tool that sent it lapses or is removed.
+ *
+ * Campaigns Pro carries a byte-identical copy for engines older than this
+ * file - change the signature here and the links already sent stop verifying.
+ *
+ * @module _lib/outreach/unsubscribe
+ */
+import crypto from 'crypto';
+import {normaliseEmail} from './suppression.js';
+
+/** Where every unsubscribe link points; links already sent carry this path. */
+export const UNSUBSCRIBE_PATH = '/campaign-unsubscribe';
+
+export function mintSecret() {
+    return crypto.randomBytes(24).toString('hex');
+}
+
+export function signEmail(secret, email) {
+    return crypto.createHmac('sha256', String(secret)).update(normaliseEmail(email)).digest('hex');
+}
+
+/** The address an emailed unsubscribe link points at. */
+export function unsubscribeUrl(baseUrl, secret, email) {
+    const e = Buffer.from(normaliseEmail(email), 'utf8').toString('base64url');
+    return `${baseUrl}${UNSUBSCRIBE_PATH}?e=${e}&k=${signEmail(secret, email)}`;
+}
+
+/** The verified address from ?e=&k=, or null. Constant-time on the signature. */
+export function verifyUnsubscribe(secret, e, k) {
+    let email = '';
+    try { email = Buffer.from(String(e ?? ''), 'base64url').toString('utf8'); } catch { return null; }
+    email = normaliseEmail(email);
+    if (!email || !k) return null;
+    const want = signEmail(secret, email);
+    const got = String(k);
+    if (got.length !== want.length) return null;
+    try {
+        return crypto.timingSafeEqual(Buffer.from(got, 'hex'), Buffer.from(want, 'hex')) ? email : null;
+    } catch { return null; }
+}

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@91d03cf",
+  "source": "dcms-marketplace@1978d48",
   "plugins": {
     "blog": {
       "version": "1.9.5",
@@ -175,36 +175,43 @@
       }
     },
     "shopping-cart": {
-      "version": "1.2.0",
+      "version": "1.6.0",
       "files": {
-        "CLAUDE.md": "0a0d019e6eceb2260cf965d3eb589c9a53615c388f212af382a00a129cb2c0dc",
-        "admin/css/index.css": "2ea348d9f969193f198dac25b1962a400967566b835c7bf1402e17e33d81bfd2",
-        "admin/lib/kit.js": "ebb439a31123b9c4fbda8a2c299cc79d1ec50e66d019b5cc49dcd00f269124d5",
+        "CLAUDE.md": "31785e2236ff0469d3653426e7b84b21ce8ab6ad5e310e043b5a7a74aa8c0bb3",
+        "admin/css/index.css": "dfe1ffc05b9161af3d8a74e82bd36c46991cb3b0409223b213eb8eca6fba9d55",
+        "admin/lib/chart.js": "b01ce5cfac773c8df8efccab50b67d3dfa99fbead0037d817553db4a6688d4d6",
+        "admin/lib/kit.js": "d9aa90469b3f589beaff0c3fb6ad3d983ab3fd6d94c06965be639a665bfe052f",
         "admin/templates/shop.html": "c5bb03f1f7cbabfbd8202f3533783eb1848103755b1ba25fdcf1fd8e9478cb8e",
-        "admin/views/orders.js": "c10789a82cf3efb4419f223668a5fa71b021420a094cda291c8d492a644b25da",
-        "admin/views/overview.js": "6abd9779cf5fc359c4708f96cf0e8ecad155fb52583b2ec854400b288fc9ba98",
+        "admin/views/orders.js": "97699e18f0fe4be8f3a811cd2fa7c07ad6139ac312e05b70ab5e80a21e40f09b",
+        "admin/views/overview.js": "97045c069c6560b3f67e1b2230bdc9c4133ed92ec6f732886470f886f11c755a",
         "admin/views/products.js": "e109660355aaec8db07eb65fa1169e7d2ec20bc2ec45293cc20e34f7c1bd62bf",
-        "admin/views/settings.js": "28cb0b5e8d45e3723ffe77e46299bfc13fbad02a2ae8103843c6894dc232387a",
-        "admin/views/shop.js": "1b6ee66b4ef768983ed32752711ed4ca8438bd37eb33be9587f6679452557b2c",
+        "admin/views/sales.js": "da71b9fbb7d39e39ecd8be35b1187e88bc4b5b28f18baaeddc6ea4cd202bb330",
+        "admin/views/settings.js": "54d4b52409d0bdd1eb4c6e4d86c07a285914659eb6b7053183f77e2fb4b9feaa",
+        "admin/views/shop.js": "83d1cb3b053ff16768959c6fd243a9428b274a3f7cdfd98929a8adc51a71d03e",
         "collections/shop-orders.json": "0bca8eef2d5f9108651f73d273480265c167dc983aa115ce59613d13015ca255",
         "collections/shop-products.json": "4d4613ecec7b8a5a0744c4f0a57b17a4429b461e060206a4bbdea5ad7c8c75dc",
-        "config.js": "dcb91db2839c1ab9e40bb1811397024fad9e37e3753d17e2baa2b9b31d4a7d7c",
-        "docs/guide.md": "4b4fbf3d61d73114f3b1b42ba48c72debb720e2c65bcd17df2feaa372463882f",
-        "inject/body.html": "9deda0324d60ef1e62f653513748faa4c6ac546493906c8bd195e445a55f7476",
-        "lib/extensions.js": "180820bcfb8ada9acfb260d0cc0a1c8cc4f37f9ab969400f4b6e8bf2d5babb3f",
+        "config.js": "31b336560d21a802d799ed487d5c3116de898446ba3521068b10d192f4ebbb2d",
+        "docs/guide.md": "7d5e48e2a9820898017debeb7b864c8ff1d91094725be49ece65b0460608857a",
+        "inject/body.html": "7e7e5b408f47abb8650e0a7d5e277daf8a634f4c6877c5259f837b1bf3d6c8e8",
+        "lib/accounts.js": "d61e83e09c69993270ccca8da8df71e779c72ec7d17947b457aadcfe6f57dd4c",
+        "lib/commission.js": "5b10475d98cff2aaf4c76b9950f8d698d6262e36754a8963669690a8e3e9bd52",
+        "lib/extensions.js": "73d3515b52c066e3e616c425d91a7a48a6aab153e7d14ae7278b38ee32649352",
         "lib/payments.js": "84ad14813688de1f38448b4935180a786cda8af2f7f4b8890a8f1d426982d1aa",
-        "lib/pricing.js": "3ae965e042f5af0acdcecc66d27145ca5f608c656717288832b881a2a181dd2e",
-        "lib/render.js": "442cd305810e53edcfa184796db19371b304567100e2662c96b4b3bee2cf7231",
+        "lib/pricing.js": "5644f2dd55fc3cfd7f40b0169dea5fb547e8b302239b8c17f23cfa177e42eab5",
+        "lib/render.js": "2a2b9ab4a24728186e1e45e6429c7406a6d5ca3d4b43db1758bbd54405d105b7",
+        "lib/sales.js": "16804f0ba4e61e8a2887a7c4172da37533850a1cd975a177b754f3350268e946",
         "lib/samples.js": "912b3d5bd543dffa5f870caf3c2b873f642fd55e3ebf3f97e1b31eeaaac77d3b",
-        "lib/shop.js": "6edd3618d53ecd614a03bf476abe5cb8615fd7d19ac765406a6ac550ebcf75e9",
-        "lib/summary.js": "5697ffa45c9cc5338bbcb6eada08671c3e8376c49c629d2ae99b022397523f71",
-        "plugin.js": "c72c526ccd71d8c055b82ef7e166afc542d4e8c36251e2f4ca1861505d5febb4",
-        "plugin.json": "bb7e9268ce075ec400f9df0932a74b26f61ca8930471ebbf41f3a8deef2e813a",
-        "plugin.public.js": "99ef559dc8c3bd369047091623bbad29a1f6067322f07ac0db547938d97fe014",
-        "public/cart.js": "fcc706773a36e4bfd02ea235bcdad629137e996218e0a0e23892e33c689f2a6e",
+        "lib/shop.js": "116b0a2cc1513895ce67d2aa6fa216a16e90cafab67394ed85ef0f34e88c50e3",
+        "lib/summary.js": "cdb13ce3d1799d429059fa03f179281711dc00427ccf2eb6b8f8aa52fef26295",
+        "plugin.js": "d210a27a96251f3a5f358d9184d194e807ceb1da55f5a505f7b967aa003f29c0",
+        "plugin.json": "fff190cc0dface77302191f4bee512192556cbb64e7e8f940db90d37f87ccef4",
+        "plugin.public.js": "2f92e8340c9da653401c11dd99dab033dc6772d63fa2114489192c48e9e0be00",
+        "public/account.js": "f1a497b70c230eee464781926e36c30936820abcdebf389982eb1d8646a51cb0",
+        "public/cart.js": "7338141392ec653ff616eb75688d2a2ad08cff8427d7020d381f540be0037b73",
         "public/lib/money.js": "d22b2b6f80dde6f7887b69e24188c05ea93c02217aba639b5331aa3bd616f4fc",
         "public/lib/orders.js": "09478e20d238adc8e387b3d9efcb13c441898fab18387ce6a1a8a92304ac4c5b",
         "public/lib/products.js": "65a033b4b03c1b6d9cd7035e6be4c3fe47c7ad309dc14c4d417b6ac0fc10e2f4",
+        "public/lib/session.js": "4f71e98818a52cf2321c8dc57e33e5591deb04ebb2c0bea19dd6758827719a08",
         "public/samples/candle-2.svg": "aca5691b9168467caf6feb7622ab154ee92504be8b887ac6c818db22476e7bed",
         "public/samples/candle.svg": "ef75e95a53ce13e88928004c6f1290c45a1094765e2ba741ae1fc55d404b881f",
         "public/samples/mug-2.svg": "5f37d23e90b7e79e42d38009a56b3ea26adae03586830a0cd418565491bd4532",
@@ -217,10 +224,14 @@
         "public/samples/tee.svg": "287a82d7fc00acb1543b3209927ae20dcbe3d4b2a2b3de03574ab0c463385f3c",
         "public/samples/tote-2.svg": "9c7f41cc57866e71973e413a6c87f46be48f7488d3490ceea58e24559c334813",
         "public/samples/tote.svg": "01de817a32c8d3d8ea47ff491049f439ca3e4d4fce943dbdc62a4187139e016c",
-        "public/shop.css": "c5adbc7b08cff3dc3b1c2b796ba693ad52c586ef35d236d0bba9a0cb7c3673c1",
+        "public/shop.css": "c01603589727c91ff4204222e594b3f52e3ca165c1ebf9e6cef6c9f006f6e57b",
+        "roles/shop-customer.json": "3f3366c536c9fbf2b2ce146bb3090b008d5fbfe22752e764eb8e5a1de9cd611c",
         "templates/shop.html": "4649e57d23458833a157799dc80141824eb0f658d96734bd1859c68e0ba9a8b9",
-        "tests/api.test.js": "8b71353b9649d6274c4e6d9358bac8fa6737d3effee00c35c62dab6f2a377968",
-        "tests/pure.test.js": "27a40f04315c17b92e4782d6f8621c965ae89bb73df377064775eec71335a5b7"
+        "tests/accounts.test.js": "99566264ab5be8f8602bd7f7777e89c12d07563372843845ca9a11cc15ce061e",
+        "tests/api.test.js": "cb929e08be430064ceaa72a3a97b00ef5bce0f6af7eb5ed10ac905bf8ed05c21",
+        "tests/commission.test.js": "1dfb26a90d3dfcf9f57f2174ac5d9b2310570b21f82c79bf9a2011e7f4911e85",
+        "tests/pure.test.js": "7fd6ad3b1955dc2c3d9a9ef175b458e2150f63cdc526c1bc0c1acba83c4e01e2",
+        "tests/sales.test.js": "9025bc608b04bcc14f5bb2c98b4f7c35de99f3ddab4ffa59772d045795bf2cb7"
       }
     },
     "support": {

package/plugins/shopping-cart/CLAUDE.md

@@ -137,3 +137,67 @@ these, behaves as 1.1.
 - A copy (`POST /products/:id/duplicate`) gives options new ids and passes `variantMap` (old -> new) to `clean`.
 - **`services.moveOrder(id, to, {by, note})`** - moves an order as the admin's status route does (same rules,
   409 on a move the table refuses) and emits `status`.
+
+## 1.3.0: an extension's own priced lines (Takeaway)
+
+`services.startCheckout` (and `services.quote`, the same arguments without ordering) also take:
+- **`custom`**: lines the extension priced - `{name, optionName, variantName, unitPrice, qty, taxClass, detail[], image,
+  category, ref}` (`pricing.js cleanCustomLines`). They go through `priceBasket` like any line (discount codes and
+  tax rules apply), with `productId: ''`, `custom: true`, never shippable, no stock (`moveStock` skips them). Server
+  code only: `/quote` and `/checkout` never read `custom`. Orders keep `detail` and `ref`; the receipt, the admin
+  order, the packing slip and Pro's emails show `detail` under the line. Summaries key them by `ref`.
+- **`charges`**: `[{label, amount}]` that stand in for the shipping stage (no shipping rules asked) - a delivery
+  fee is taxed as delivery is. Leave it out and shipping runs as before; `[]` means no delivery charge.
+- **`delivery: 'none' | 'collect' | 'deliver'`** + `address` (needed for deliver, checked against the shop's
+  countries) + `note`, `code`. Stored as the order's `delivery` 'none' | 'collect' | 'ship'.
+- **`ownEmails: true`** - the extension writes to the shopper itself; stored on the order, and Shopping Cart Pro
+  then sends that order only the shop's own new-order email.
+- **`payNote`** (offline) - what the receipt says about paying ("Pay when you collect from …") instead of the shop's
+  offline instructions; on the order and in `publicOrder`.
+- **`services.refund(id, {note, restock, viaProvider})`** - the admin's refund (through Stripe / PayPal first),
+  `refundOrder()` in plugin.js, shared by `POST /orders/:id/refund`.
+
+## 1.4.0: customer accounts (optional; plan dcms-marketplace/docs/customer-accounts-plan.md)
+
+`settings.accounts` (off by default). `lib/accounts.js`, routes `/account/*`, pages `<shop>/account`, `/account/confirm`,
+`/account/reset` (plugin.public.js -> `accountHtml`; `public/account.js` does the work), browser session in
+`public/lib/session.js` (shared with extensions - Takeaway imports it).
+- A customer = core user, role `shop-customer` (roles/shop-customer.json: no permissions, admin confined to My Profile),
+  created INACTIVE with `meta.shop.pending` {hash, until (48 h)}; the emailed link activates it. Register answers the
+  same for a taken email (the holder is emailed instead) - no account discovery. A pending account that ran out is
+  replaced. A confirmation email that fails removes the account again (502). Needs SMTP (`mailReady`).
+- Signing in, refresh, logout and the new password are CORE's routes (`/api/auth/login|refresh|logout|reset-password`);
+  the Cart issues core's reset token (`issueResetToken`) and mails a link to `<shop>/account/reset`, never /admin.
+  Tokens live in localStorage `dm-shop:account`; account routes take core's Bearer (`authenticate`).
+- An account's orders = orders with its (confirmed) email, any time - nothing linked. `meta.shop` keeps phone and up
+  to 8 addresses. Delete my account: customers only (staff 409), with the password; orders stay.
+- Checkout fills in a signed-in customer (details + first saved address); the receipt offers "Save your details"
+  (`[data-shop-join]`); the storefront and basket link to the account page.
+- Extension hook `account(order, {settings})` -> HTML beside the order on the account page (`registry.accountParts`;
+  `receiptParts` and it share `registry.parts(kind)`). Takeaway: Reorder.
+- Trap fixed on the way: `if (await fail(reply, …))` - awaiting a Fastify reply resolves EMPTY once sent, so the route
+  ran on after its 404. `accountsOff` returns a boolean and sends the reply on the side.
+
+## 1.5.0: Sales (plan dcms-marketplace/docs/sales-commission-tenancy-plan.md, part 1)
+
+A **Sales** tab (admin/views/sales.js): ranges (today, this week, last 7 days, this month, last month, last 30 days,
+this year, dates), by day / week / month; tiles, takings chart, where it came from, how it was paid, the figures, a
+table of periods, CSV. `GET /sales?range|from&to&by`, `GET /sales.csv` (shop:read). All figures are `lib/sales.js` (PURE):
+- A sale = paid / fulfilled / refunded order, dated by `paidAt` in the shop's zone (`settings.timeZone`, Europe/London
+  unless set - there is no setting in the UI yet); a refund dated by `refundedAt`, so a period's net is what stayed.
+- Sources per line: `takeaway` (ref takeaway:…), `addons` (any other ref), `downloads` (a product Pro gave a link or
+  key for on that order), `shop`. Line amounts are before discounts; discount, delivery and tax are order-level.
+- `admin/lib/chart.js` - the one bar chart (single series, primary hue, rounded ends, tooltips), shared with Overview.
+
+## 1.6.0: platform commission (plan part 2; the manager side is site-manager's Customers › Commission)
+
+A value on each sale, per tenant, set by the platform's super admin on the manager - which writes this site's rates to
+`config/commission.json` (`{rates: {default?, shop?, takeaway?, addons?: {percent, fixed}}, updatedAt, by}`); the
+Cart only READS it (`lib/commission.js currentCommission`, re-read when the file's mtime changes - no restart).
+- When an order becomes paid (`markPaid`, `moveOrder` -> paid) it gets `order.data.commission` = `{type, base, percent,
+  fixed, amount, at}` - the rate of that day, kept for good (a later rate never rewrites it). `percent` is of the
+  order total; `fixed` per sale; never more than the sale; a free order gets none. Type: `takeaway` (ref takeaway:),
+  `addons` (other ref), `shop`. A refund sets `reversed`, `reversedAt`.
+- Never shown to the customer (`publicOrder` leaves it out). Shown to the shop: Sales (commission, returned, after
+  commission; a CSV column), the order, Shop settings › Payment ("set by your provider" - read-only).
+- The manager's statements add up what the orders carry - nothing is recalculated there.

package/plugins/shopping-cart/admin/css/index.css

@@ -224,3 +224,19 @@ a.shp-tile:hover { border-color: var(--dm-primary); }
 .shp-copy code { flex: 1; overflow-wrap: anywhere; font-size: var(--dm-text-xs); }
 .shp-steps li .shp-step-btns { grid-column: 3; grid-row: 1 / 3; display: flex; gap: .3rem; color: inherit; font-size: inherit; }
 .shp-steps li .shp-step-btns .btn { grid-column: auto; grid-row: auto; }
+
+/* Sales */
+.shp-sales { display: flex; flex-direction: column; gap: 1rem; }
+.shp-sales-bar { display: flex; flex-wrap: wrap; align-items: center; gap: .6rem; }
+.shp-sales-custom { display: inline-flex; align-items: center; gap: .4rem; }
+.shp-sales-custom input { width: auto; padding-top: .25rem; padding-bottom: .25rem; }
+.shp-sales-cols { display: grid; grid-template-columns: repeat(auto-fit, minmax(20rem, 1fr)); gap: 1rem; }
+.shp-sales-note { margin: .6rem 0 0; font-size: var(--dm-text-sm); }
+.shp-sales-table { width: 100%; border-collapse: collapse; font-variant-numeric: tabular-nums; font-size: var(--dm-text-sm); }
+.shp-sales-table th, .shp-sales-table td { padding: .4rem .5rem; border-bottom: 1px solid var(--dm-border); text-align: right; }
+.shp-sales-table th:first-child, .shp-sales-table td:first-child { text-align: left; font-weight: 500; }
+.shp-sales-table thead th { color: var(--dm-text-muted); font-size: var(--dm-text-xs); font-weight: 600; }
+.shp-sales-table tr.is-sum th, .shp-sales-table tr.is-sum td { font-weight: 600; }
+.shp-sales-table tr.is-total th, .shp-sales-table tr.is-total td { font-weight: 800; font-size: 1rem; border-bottom: 0; }
+.shp-sales-table tr.is-muted th, .shp-sales-table tr.is-muted td { color: var(--dm-text-muted); font-weight: 400; }
+.shp-sales-periods summary { cursor: pointer; font-weight: 600; }

package/plugins/shopping-cart/admin/lib/chart.js

@@ -0,0 +1,64 @@
+/**
+ * The Shop's one chart: a single series of bars - one hue (the theme's primary), 2px apart, 4px rounded ends on the
+ * baseline, a recessive grid with three ticks, three date labels, and a tooltip on hover or keyboard focus. Shared by
+ * the Overview and Sales. One series, so no legend: the card's title names it.
+ *
+ * @module shopping-cart/admin/lib/chart
+ */
+import {esc} from './kit.js';
+
+/** A round top for the axis: 1, 2 or 5 × a power of ten, in minor units. */
+export function niceMax(v) {
+    if (v <= 0) return 1000;
+    const p = 10 ** Math.floor(Math.log10(v));
+    for (const m of [1, 2, 5, 10]) if (m * p >= v) return m * p;
+    return 10 * p;
+}
+
+/**
+ * @param {HTMLElement} el
+ * @param {{value: number, label: string, tip: string}[]} series - `label` under the axis, `tip` beside the value
+ * @param {{money: Function, ariaLabel: string, scope: Function}} o
+ */
+export function barChart(el, series, {money, ariaLabel, scope}) {
+    const W = Math.max(360, Math.round(el.clientWidth) || 600), H = 170, padL = 44, padB = 22, padT = 8;
+    const top = niceMax(Math.max(0, ...series.map(d => d.value)));
+    const n = series.length || 1;
+    const slot = (W - padL) / n;
+    const bw = Math.max(2, slot - 2);
+    const y = (v) => padT + (H - padT - padB) * (1 - v / top);
+    const bars = series.map((d, i) => {
+        const x = padL + i * slot + 1;
+        const h = Math.max(0, H - padB - y(Math.max(0, d.value)));
+        const r = Math.min(4, bw / 2, h);
+        const path = h > 0 ? `M${x},${H - padB} v${-(h - r)} q0,${-r} ${r},${-r} h${bw - 2 * r} q${r},0 ${r},${r} v${h - r} z` : '';
+        return `<g class="shp-bar" data-i="${i}" tabindex="0" aria-label="${esc(d.label)}: ${esc(money(d.value))}, ${esc(d.tip)}">
+  <rect x="${padL + i * slot}" y="${padT}" width="${slot}" height="${H - padT - padB}" fill="transparent"/>
+  ${path ? `<path d="${path}"/>` : `<rect class="shp-bar-zero" x="${x}" y="${H - padB - 1}" width="${bw}" height="1"/>`}
+</g>`;
+    }).join('');
+    const at = [...new Set([0, Math.floor((n - 1) / 2), n - 1])].filter(i => series[i]);
+    const labels = at.map(i => `<text x="${padL + i * slot + slot / 2}" y="${H - 6}" text-anchor="middle">${esc(series[i].label)}</text>`).join('');
+    el.innerHTML = `<svg viewBox="0 0 ${W} ${H}" role="img" aria-label="${esc(ariaLabel)}">
+  ${[0, top / 2, top].map(t => `<line class="shp-gridline" x1="${padL}" x2="${W}" y1="${y(t)}" y2="${y(t)}"/><text class="shp-axis" x="${padL - 6}" y="${y(t) + 4}" text-anchor="end">${esc(money(t, {compact: true}))}</text>`).join('')}
+  ${bars}
+  <g class="shp-axis">${labels}</g>
+</svg><div class="shp-tip" hidden></div>`;
+    const tip = el.querySelector('.shp-tip');
+    const show = (g) => {
+        const d = series[Number(g.dataset.i)];
+        tip.innerHTML = `<strong>${esc(money(d.value))}</strong><span>${esc(d.label)} · ${esc(d.tip)}</span>`;
+        tip.hidden = false;
+        const r = g.getBoundingClientRect(), box = el.getBoundingClientRect();
+        tip.style.left = `${Math.min(box.width - 140, Math.max(0, r.left - box.left + r.width / 2 - 70))}px`;
+        el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on'));
+        g.classList.add('is-on');
+    };
+    const hide = () => { tip.hidden = true; el.querySelectorAll('.shp-bar.is-on').forEach(b => b.classList.remove('is-on')); };
+    const over = (e) => { const g = e.target.closest('.shp-bar'); if (g) show(g); };
+    el.addEventListener('mouseover', over);
+    el.addEventListener('focusin', over);
+    el.addEventListener('mouseleave', hide);
+    el.addEventListener('focusout', hide);
+    scope?.(() => { el.removeEventListener('mouseover', over); el.removeEventListener('focusin', over); el.removeEventListener('mouseleave', hide); el.removeEventListener('focusout', hide); });
+}