includio-cms 0.14.6 → 0.15.0

package/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to includio-cms are documented here.
 Generated from `src/lib/updates/` — do not edit manually.
 
+## 0.15.0 — 2026-04-14
+
+Shop module MVP — headless e-commerce: products, cart, orders, payments, emails
+
+### Added
+- New optional `shop` module — activate via `defineShop()` in `cms.config.ts`
+- Product = CMS entry + built-in `shop` field (like `seo`) — add `{ type: "shop", slug: "shop" }` to any collection to make its entries purchasable. Shop data lives in `shop_products` (keyed by entry_id FK cascade), never in entry JSON
+- Runtime `schema.ts` generator — auto-emits `src/lib/cms/runtime/schema.ts` combining core + auth + shop tables; point your `drizzle.config.ts` schema field at it, then `pnpm drizzle-kit push`
+- Entry edit panel shows Shop section with net/gross toggle + live VAT preview; optional variants (auto default variant when disabled) and per-variant stock
+- Shop admin: list of all shoppable entries across collections, list+drag-n-drop reorder for shipping methods, full orders list + detail with status history, change status, resend status email
+- Headless cart (signed cookie) with server-hydrated totals — `POST/PATCH/DELETE /api/shop/cart` + typed `createShopClient()` SDK
+- Checkout endpoint `POST /api/shop/checkout` — creates order from cart with consent validation, stock reservation (30-min TTL, released on cancel/reject, consumed on paid), and status emails
+- Payment adapter interface + `manualAdapter()` for bank transfer / COD (order stays in `awaitingPayment` until admin marks paid)
+- Shipping methods — admin CRUD with free-above threshold, carrier-agnostic (InPost/Stripe etc. slotted as adapters in later 0.15.x patches)
+- Feature flags `variants`, `stock`, `accounts` — off by default; enable per project
+- Rate-limit middleware on checkout + webhook endpoints
+- Status-change emails rendered inline (PL/EN), sent via existing `EmailAdapter` — no new dependency
+- Order numbers: random Crockford base32 (`XXXXX-XXXXX`) — unguessable
+- CLI scaffold includes all shop routes (admin pages + public API stubs) — run `scaffoldAdmin()` to provision them in your consumer app
+- `nodemailerAdapter` — `transportOptions` now typed as full `SMTPTransport.Options`, unlocking OAuth2 (Gmail etc.), pooled connections and all native Nodemailer options
+
+### Notes
+
+Headless e-commerce MVP. Stripe (0.15.1), PayU (0.15.2) and InPost geowidget (0.15.3) ship as optional adapters in follow-up patches. Consumer UI (cart drawer, checkout forms, success screens) is built in the app — shop only exposes the API and admin.
+
 ## 0.14.6 — 2026-04-13
 
 Admin page titles — meaningful <title> in every admin route

package/DOCS.md

@@ -1,4 +1,4 @@
-# Includio CMS Documentation (v0.14.6)
+# Includio CMS Documentation (v0.15.0)
 
 > This file is auto-generated from the docs site. For the latest version, update the package.
 
@@ -3240,6 +3240,10 @@ interface SendMailOptions {
 
 ## Built-in: Nodemailer
 
+`transportOptions` accepts the full Nodemailer `SMTPTransport.Options` type, so anything Nodemailer supports works — classic SMTP, OAuth2, pooled connections, TLS options, etc.
+
+### SMTP with user/password
+
 ```typescript
 import { nodemailerAdapter } from 'includio-cms/email-nodemailer';
 
@@ -3257,6 +3261,46 @@ email: nodemailerAdapter({
 })
 ```
 
+### OAuth2 (generic)
+
+```typescript
+email: nodemailerAdapter({
+  defaultFromAddress: 'noreply@example.com',
+  defaultFromName: 'My Site',
+  transportOptions: {
+    host: 'smtp.example.com',
+    port: 465,
+    secure: true,
+    auth: {
+      type: 'OAuth2',
+      user: 'noreply@example.com',
+      clientId: process.env.OAUTH_CLIENT_ID,
+      clientSecret: process.env.OAUTH_CLIENT_SECRET,
+      refreshToken: process.env.OAUTH_REFRESH_TOKEN
+    }
+  }
+})
+```
+
+### OAuth2 (Gmail)
+
+```typescript
+email: nodemailerAdapter({
+  defaultFromAddress: 'noreply@gmail.com',
+  defaultFromName: 'My Site',
+  transportOptions: {
+    service: 'gmail',
+    auth: {
+      type: 'OAuth2',
+      user: 'noreply@gmail.com',
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      refreshToken: process.env.GOOGLE_REFRESH_TOKEN
+    }
+  }
+})
+```
+
 > **Transactional Email:** For production, use a transactional email service (SendGrid, Postmark, Resend, etc). Implement the `EmailAdapter` interface with their SDK.
 
 ## Custom Adapter Example

package/ROADMAP.md

@@ -287,14 +287,35 @@
 - [x] `[feature]` `[P2]` Manual poster regeneration in media library file details <!-- files: src/lib/core/server/media/operations/regenerateVideoPoster.ts, src/lib/admin/components/media/file/file-details.svelte -->
 - [x] `[feature]` `[P2]` Config flag `sidebarHelp` to hide admin sidebar Help link (default true) <!-- files: src/lib/types/cms.ts, src/lib/core/cms.ts, src/routes/admin/(afterLogin)/+layout.server.ts, src/lib/admin/components/layout/nav-footer.svelte -->
 
-## 0.15.0 — SEO module
+## 0.15.0 — Shop MVP (headless e-commerce)
+
+- [x] `[feature]` `[P0]` Scaffold: `defineShop`, types, CMSConfig slot, package export `./shop` <!-- files: src/lib/shop/index.ts, src/lib/shop/types.ts -->
+- [x] `[feature]` `[P0]` Drizzle tables: products (entry-backed), variants, orders, order items, status history, payments, shipping methods, stock reservations <!-- files: src/lib/db-postgres/schema/shop/ -->
+- [x] `[feature]` `[P0]` Runtime `schema.ts` generator for drizzle-kit (core + auth + optional shop) <!-- files: src/lib/core/server/generator/generator.ts, src/lib/db-postgres/schema-core.ts, src/lib/db-postgres/schema-shop.ts -->
+- [x] `[feature]` `[P0]` Rate-limit middleware (checkout/webhook) <!-- files: src/lib/shop/rate-limit.ts -->
+- [x] `[feature]` `[P0]` Built-in `shop` field type — makes entries purchasable, auto-hydrated via populateEntryData <!-- files: src/lib/admin/components/fields/shop-field.svelte, src/lib/shop/server/populate.ts -->
+- [x] `[feature]` `[P0]` Net/gross price toggle + live VAT preview in shop field and shipping form
+- [x] `[feature]` `[P0]` Auto default variant on upsert — cart/order always reference variantId
+- [x] `[feature]` `[P0]` Shop admin: products list (JOIN entries × shop_products), shipping methods CRUD with drag-n-drop reorder + free-above threshold
+- [x] `[feature]` `[P0]` Cart (signed cookie) service + `/api/shop/cart` REST + headless SDK `createShopClient()` <!-- files: src/lib/shop/cart/, src/lib/shop/client/ -->
+- [x] `[feature]` `[P0]` Orders + checkout + `manualAdapter` + status emails (inline HTML, PL/EN) <!-- files: src/lib/shop/server/orders.ts, src/lib/shop/http/checkout-handler.ts -->
+- [x] `[feature]` `[P0]` Stock reservation with 30-min TTL — released on cancel/reject, consumed on paid
+- [x] `[feature]` `[P0]` Admin orders view — list (status + email filter), detail (items, history, customer/address/consents, change status, resend email)
+- [x] `[feature]` `[P0]` Random Crockford base32 order numbers (`XXXXX-XXXXX`), unguessable
+- [x] `[feature]` `[P0]` CLI scaffold provisions all shop routes (admin + public API) in consumer app
+- [ ] `[feature]` `[P1]` Stripe payment adapter + webhook — deferred to 0.15.1
+- [ ] `[feature]` `[P1]` PayU payment adapter + webhook — deferred to 0.15.2
+- [ ] `[feature]` `[P2]` InPost carrier adapter (headless geowidget config) — deferred to 0.15.3
+- [x] `[feature]` `[P2]` `nodemailerAdapter` — typowanie `transportOptions` jako `SMTPTransport.Options` (OAuth2, pool, itd.)
+
+## 0.16.0 — SEO module
 
 - [ ] `[feature]` `[P1]` SERP preview + character limits for title/description <!-- files: src/lib/admin/components/fields/seo-field.svelte -->
 - [ ] `[feature]` `[P1]` Global SEO settings
 - [ ] `[feature]` `[P1]` Dedicated frontend SEO components <!-- files: src/lib/sveltekit/components/seo.svelte -->
 - [ ] `[feature]` `[P2]` Sitemap generation
 
-## 0.16.0 — WCAG/ATAG compliance
+## 0.17.0 — WCAG/ATAG compliance
 
 - [ ] `[chore]` `[P0]` Full WCAG/ATAG audit
 - [ ] `[feature]` `[P0]` Accessibility rework based on audit findings