includio-cms 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -3,6 +3,46 @@
 All notable changes to includio-cms are documented here.
 Generated from `src/lib/updates/` — do not edit manually.
 
+## 0.15.4 — 2026-04-21
+
+Forms: auto-scaffolded public submission endpoint + decoupled notification emails from submission success.
+
+### Added
+- CLI scaffold (`pnpm includio scaffold admin`) now emits `src/routes/api/forms/[slug]/submit/+server.ts` — the public POST endpoint for form submissions. Previously each project had to hand-roll this file (the handler lives in the library, but SvelteKit does not load routes from `node_modules`). New projects get it out-of-the-box; existing projects can run `includio scaffold admin` to generate it without overwriting other admin files.
+- Added `ideas/health-check-module.md` — proposal for built-in `/api/health` + `/api/health/ready` endpoints, opt-in SMTP verify, and a ręczny "Test SMTP connection / Send test mail" section in the admin maintenance page. Context: diagnosing a silent SMTP misconfiguration in a live project required grepping through library internals; a one-click diagnostics panel would have surfaced the empty `EMAIL_HOST` immediately.
+
+### Fixed
+- `createFormSubmission()` now keeps the notification-email call in a separate `try/catch` from the DB write. Before: if SMTP was misconfigured (empty `EMAIL_HOST` locally, unreachable relay, etc.) the whole operation returned `false` → endpoint responded `500 "Submission failed"` even though the submission was already persisted. After: DB failure still returns `false` (critical path); email failure is logged via `console.error` and the submission succeeds with `200`.
+
+### Notes
+
+No SQL migration. No API signature changes. Existing projects that already have a hand-rolled `src/routes/api/forms/[slug]/submit/+server.ts` keep working — scaffold skips existing files unless `--force` is passed.
+
+## 0.15.3 — 2026-04-16
+
+Shop: InPost carrier adapter — Geowidget v5 picker + ShipX shipment + webhook auto-status.
+
+### Added
+- `inpostAdapter()` ships in `includio-cms/shop` — wires Geowidget v5 (paczkomat picker on the frontend), ShipX (admin "Utwórz przesyłkę InPost" button creates the shipment, auto-buys the offer, fetches the label PDF) and a webhook receiver (`POST /api/shop/carriers/inpost/webhook?secret=...`) that updates order status + tracking number when ShipX events arrive.
+- `<InpostPicker>` Svelte component (`includio-cms/shop/svelte`) — drop-in widget with `bind:value={carrierRef}`, lazy-loads the geowidget script + CSS, hides itself for `inpost_courier_*` services. Raw API alternative: `GET /api/shop/carriers/inpost`.
+- Per-shipping-method service config — `shop_shipping_methods.carrier_config` jsonb with `serviceType` (`inpost_locker_standard` / `inpost_locker_express` / `inpost_courier_standard` / `inpost_courier_express`) and `defaultSize` (A/B/C → small/medium/large). Admin shipping form ungates the InPost option and shows the new fields when selected.
+- Customer order endpoint exposes `trackingNumber` + `trackingUrl` (resolved via `adapter.trackingUrl()`); `<OrderStatus>` renders a "Śledzenie przesyłki" section automatically. Status emails for `preparing` / `sent` / `done` include a tracking block with a clickable carrier link.
+- Admin order detail page gains a "Przesyłka {carrierType}" panel: Utwórz przesyłkę / Pobierz etykietę PDF / Anuluj przesyłkę. PDF is streamed through an admin-auth proxy at `/api/shop/admin/orders/[id]/label`.
+- Checkout validates `carrierRef` against the carrier (Operating-only paczkomats via InPost Points API, in-memory cached 5 min). Invalid selections reject with HTTP 400 before the order is created.
+- CLI scaffold (`pnpm includio scaffold admin`) emits the new routes: `api/shop/carriers/[id]/+server.ts`, `api/shop/carriers/[id]/webhook/+server.ts`, `api/shop/admin/orders/[id]/label/+server.ts`.
+- CLI scaffolder auto-detects shop usage by scanning `src/lib/cms/cms.config.ts` for an active `shop:` property — projects without the shop module get a clean route tree by default, no flag required. Override with `--shop` / `--no-shop` (or pass `scaffoldAdmin({ shop: false })` programmatically). Combined with the existing config-driven schema generator + admin sidebar guard, shop is now fully opt-in with zero footprint when unused.
+
+### Migration
+
+```sql
+ALTER TABLE shop_shipping_methods ADD COLUMN carrier_config jsonb;
+ALTER TABLE shop_orders ADD COLUMN shipment_id text, ADD COLUMN tracking_number text, ADD COLUMN label_url text, ADD COLUMN shipment_created_at timestamptz;
+```
+
+### Notes
+
+Run the SQL once, then `pnpm db:push` to sync the rest of the schema. InPost requires two tokens: a public Geowidget v5 token (browser-side, from `manager.paczkomaty.pl`) and a private ShipX organization token (server-side). On sandbox, ShipX `POST /shipments/:id/buy` is asynchronous and often stalls in `offer_selected` because test accounts have no wallet to pay the offer — the webhook reconciles whatever ends up. See /docs/shop/inpost for full setup.
+
 ## 0.15.2 — 2026-04-15
 
 Shop: cena przechowywana jako numeric(20,6) — eliminacja driftu brutto/netto po reload; toggle netto/brutto per wariant.

package/DOCS.md

@@ -1,4 +1,4 @@
-# Includio CMS Documentation (v0.15.2)
+# Includio CMS Documentation (v0.15.4)
 
 > This file is auto-generated from the docs site. For the latest version, update the package.
 
@@ -2743,9 +2743,13 @@ Forms can be submitted from your frontend via a public POST endpoint:
 
 ```
 POST /api/forms/{slug}/submit
-Content-Type: multipart/form-data
+Content-Type: multipart/form-data   # or application/json for file-less payloads
 ```
 
+> **Auto-generated endpoint:** Running `includio scaffold admin` generates `src/routes/api/forms/[slug]/submit/+server.ts` automatically — no manual setup required. To customize (extra middleware, logging, honeypot handling), edit the generated file; it won't be overwritten unless you re-run scaffold with `--force`.
+
+> **Notification emails are best-effort:** If a form has `notificationEmailAddresses` set and email sending fails (e.g. misconfigured SMTP), the submission is still saved and the endpoint returns `200`. The error is logged to `console.error` — check server logs if you stop receiving notifications.
+
 ### Submitting from Frontend
 
 ```typescript
@@ -4311,6 +4315,7 @@ Headless e-commerce module. Optional — activate by adding `shop: defineShop({.
 - **Cart** — signed cookie, headless SDK (`createShopClient()`), `POST/PATCH/DELETE /api/shop/cart`.
 - **Checkout + orders** — `POST /api/shop/checkout` creates an order with consent validation, stock reservation (30-min TTL), and status emails.
 - **Payment adapters** — `manualAdapter()` (bank transfer / COD) and `payuAdapter()` ship built-in; plug your own by implementing `PaymentAdapter`.
+- **Carrier adapters** — `inpostAdapter()` ships built-in (Geowidget v5 picker + ShipX shipments + webhook). Plug other carriers by implementing `CarrierAdapter`.
 - **Webhook infrastructure** — `createPaymentWebhookHandler()` dispatches provider callbacks, verifies signatures, is idempotent.
 - **Secure order view** — per-order `accessToken` + cookie fallback + `GET /api/shop/orders/[number]` token-gated API.
 - **Shipping ↔ payment compatibility** — restrict payment methods per shipping (e.g. no COD for paczkomat).
@@ -4344,7 +4349,18 @@ export const cmsConfig = defineCMS({
 
 ## Routes
 
-Scaffold provisions these endpoints in your app:
+Shop is **opt-in**: projects without `shop: defineShop(...)` in their CMS config don't get shop tables in the DB schema (generator gates on `config.shop`), the admin sidebar hides the Shop section, and shop API handlers always return 404.
+
+The CLI scaffolder **auto-detects** shop usage by scanning your `src/lib/cms/cms.config.ts` for `shop: …`. Override with `--shop` or `--no-shop` if needed:
+
+```sh
+pnpm includio scaffold admin           # auto: detects shop in cms config
+pnpm includio scaffold admin --shop    # force include shop routes
+pnpm includio scaffold admin --no-shop # force exclude shop routes
+pnpm includio scaffold admin --cms-config path/to/config.ts   # custom location
+```
+
+Scaffold provisions these endpoints (when shop is enabled):
 
 | Path | Handler | Purpose |
 |------|---------|---------|
@@ -4355,11 +4371,15 @@ Scaffold provisions these endpoints in your app:
 | `POST /api/shop/orders/[number]/refresh-payment` | `createRefreshPaymentHandler()` | Pull status from provider |
 | `POST /api/shop/orders/[number]/retry-payment` | `createRetryPaymentHandler()` | New payment attempt |
 | `POST /api/shop/webhooks/[provider]` | `createPaymentWebhookHandler()` | Provider callbacks |
+| `GET /api/shop/carriers/[id]` | `createCarrierConfigHandler()` | Public carrier widget descriptor |
+| `POST /api/shop/carriers/[id]/webhook` | `createCarrierWebhookHandler()` | Carrier event receiver |
+| `GET /api/shop/admin/orders/[id]/label` | `createShipmentLabelHandler()` | Admin shipping-label PDF proxy |
 
 ## See also
 
 - [Order view](/docs/shop/order-view) — generic `<OrderStatus>` component + headless helper
 - [Retry payment](/docs/shop/retry-payment) — lifecycle + endpoint
+- [InPost carrier](/docs/shop/inpost) — Geowidget v5 + ShipX shipment + webhook
 
 
 ---
@@ -4527,6 +4547,125 @@ if (url) window.location.href = url;
 If the customer is completely stuck, the admin can manually move the order to `paid` / `cancelled` from the orders detail page — same as before, status-change emails trigger automatically.
 
 
+---
+
+# InPost carrier
+
+`inpostAdapter()` ships in 0.15.3. Wires three things together:
+
+1. **Geowidget v5** — customer picks a paczkomat on the checkout page (`<InpostPicker>` Svelte component or raw config endpoint).
+2. **ShipX shipment** — admin clicks "Utwórz przesyłkę InPost" on the order detail page → backend POSTs the shipment to ShipX, auto-confirms the offer, stores the carrier-side shipment id + tracking number.
+3. **Webhook** — ShipX events (`confirmed`/`taken_by_courier`/`delivered`) update the order status and tracking number automatically.
+
+> InPost requires two separate tokens: a **public Geowidget v5 token** (delivered to the browser) and a **private ShipX organization token** (server-side only). Both come from `manager.paczkomaty.pl` (production) or `sandbox-manager.paczkomaty.pl` (sandbox).
+
+## Config
+
+```ts
+import { defineShop, inpostAdapter } from 'includio-cms/shop';
+
+defineShop({
+  // …currency, payment, etc.
+  carriers: [
+    inpostAdapter({
+      geowidgetToken: process.env.INPOST_GEOWIDGET_TOKEN!,
+      shipxToken: process.env.INPOST_SHIPX_TOKEN!,
+      organizationId: process.env.INPOST_ORG_ID!,
+      environment: 'production', // or 'sandbox'
+      webhookSecret: process.env.INPOST_WEBHOOK_SECRET!,
+      senderAddress: {
+        name: 'Twoja firma',
+        company: 'AriaCMS',
+        street: 'Mokotowska',
+        buildingNumber: '1',
+        city: 'Warszawa',
+        postCode: '00-001',
+        email: 'shop@example.com',
+        phone: '+48500600700'
+      }
+    })
+  ]
+});
+```
+
+**Optional opts:**
+
+- `additionalServices: ['email', 'sms']` — InPost SMS/email notifications. Requires the service to be enabled on your account; sandbox usually doesn't have it.
+- `autoConfirm: false` — disable the post-create `POST /shipments/:id/buy` step. Default `true`.
+- `autoConfirmDelayMs` (default `1500`), `autoConfirmPollTimeoutMs` (default `8000`) — tune the offer-prep wait and post-buy polling.
+- `trackingUrlTemplate` — override `https://inpost.pl/sledzenie-przesylek?number={trackingNumber}`.
+- `labelFormat: 'Pdf' | 'ZebraLP'`, `labelSize: 'A4' | 'A6'` — default label format.
+- `debug: true` — verbose logging of the create→buy→poll flow (payload dump, every poll tick). Off by default; warnings + errors always log.
+
+## Routes scaffolded
+
+`pnpm includio scaffold admin` provisions:
+
+| Path | Handler | Purpose |
+|------|---------|---------|
+| `GET /api/shop/carriers/[id]` | `createCarrierConfigHandler()` | Public widget descriptor (script URL + token + preset) |
+| `POST /api/shop/carriers/[id]/webhook` | `createCarrierWebhookHandler()` | ShipX event receiver — secret-gated via `?secret=…` |
+| `GET /api/shop/admin/orders/[id]/label` | `createShipmentLabelHandler()` | Admin-only PDF proxy for the shipment label |
+
+In `manager.paczkomaty.pl` configure the webhook URL as
+`https://your-domain.pl/api/shop/carriers/inpost/webhook?secret=<INPOST_WEBHOOK_SECRET>`.
+
+## Per-shipping-method service
+
+Each shipping method with `carrierType=inpost` carries a `carrierConfig`:
+
+| Field | Values |
+|------|--------|
+| `serviceType` | `inpost_locker_standard` (paczkomat), `inpost_locker_express`, `inpost_courier_standard`, `inpost_courier_express` |
+| `defaultSize` | `A` (small, 8×38×64 cm) / `B` (medium, 19×38×64 cm) / `C` (large, 41×38×64 cm) |
+
+Set both in admin → Shop → Shipping methods. For `inpost_courier_*` services the picker hides itself and the receiver address from the order is used instead.
+
+## Frontend picker
+
+```svelte
+<InpostPicker
+  bind:value={carrierRef}
+  serviceType="inpost_locker_standard"
+  onSelect={(point) => console.log('picked', point.name, point.address)}
+/>
+```
+
+The component lazy-loads the Geowidget v5 script + CSS, mounts the `<inpost-geowidget>` custom element, and writes the chosen paczkomat code into `value`. For `inpost_courier_*` services it renders a short notice instead.
+
+**Custom UI** — skip the component and call `GET /api/shop/carriers/inpost` yourself; the response is `{ id, label, widget: { scriptUrl, stylesheetUrl, config: { token, language, config } } }`.
+
+## Admin actions
+
+On any order with an InPost shipping method, the order detail page shows:
+
+- **"Utwórz przesyłkę InPost"** when status is `paid`/`preparing` and no shipment exists yet — POSTs to ShipX, auto-buys the offer, polls until status leaves `offer_selected`, writes `shipmentId` + `trackingNumber` on the order, bumps status to `preparing`.
+- **"Pobierz etykietę PDF"** — opens the admin label proxy in a new tab.
+- **"Anuluj przesyłkę"** — `DELETE /v1/shipments/:id` on ShipX, clears local data. Only works after the shipment reaches `confirmed`.
+
+## Webhook → status mapping
+
+| ShipX event status | Order status |
+|---|---|
+| `created`, `offers_prepared`, `offer_selected`, `confirmed`, `dispatched_by_sender` | `preparing` |
+| `taken_by_courier`, `adopted_at_*`, `out_for_delivery`, `ready_to_pickup` | `sent` |
+| `delivered` | `done` |
+| `canceled`, `returned_to_sender`, `rejected` | `cancelled` |
+| anything else | (ignored) |
+
+Tracking number is updated whenever the webhook payload contains a non-null `tracking_number`. Status emails (built-in PL/EN templates) include a tracking block on `preparing`/`sent`/`done`.
+
+## Sandbox quirks
+
+- ShipX `POST /shipments/:id/buy` is **asynchronous**. Production confirms in ~1–3 s; sandbox often **stalls in `offer_selected`** because test accounts have no wallet to pay the offer. The adapter polls for ~8 s then gives up and lets the webhook reconcile.
+- Sandbox geowidget paczkomaty are **separate** from production codes. Use `KRA012` (Kraków, Os. Kombatantów 20) or any code from `GET https://sandbox-api-shipx-pl.easypack24.net/v1/points?per_page=10`.
+- Sandbox `additional_services: ['email', 'sms']` returns `unavailable` — drop the option for sandbox testing.
+
+## Customer tracking display
+
+`OrderStatus.svelte` (the built-in component) renders a "Śledzenie przesyłki" section automatically when the order has a `trackingNumber`. If you wrote a custom order view, read `order.trackingNumber` and `order.trackingUrl` from the order endpoint response and render them yourself.
+
+
 ---
 
 # Migration Guide

package/ROADMAP.md

@@ -304,8 +304,8 @@
 - [x] `[feature]` `[P0]` Random Crockford base32 order numbers (`XXXXX-XXXXX`), unguessable
 - [x] `[feature]` `[P0]` CLI scaffold provisions all shop routes (admin + public API) in consumer app
 - [x] `[feature]` `[P1]` PayU payment adapter + webhook — shipped in 0.15.1 (access-token-gated order view, idempotent webhooks, MD5 signature, shipping↔payment compat, poll fallback)
-- [ ] `[feature]` `[P1]` Stripe payment adapter + webhook — deferred to 0.15.3
-- [ ] `[feature]` `[P2]` InPost carrier adapter (headless geowidget config) — deferred to 0.15.3
+- [ ] `[feature]` `[P1]` Stripe payment adapter + webhook — deferred to 0.15.4
+- [x] `[feature]` `[P2]` InPost carrier adapter — shipped in 0.15.3 (Geowidget v5 picker + ShipX shipments + auto-confirm + webhook status updates)
 
 ## 0.15.2 — Price precision fix
 
@@ -313,6 +313,17 @@
 - [x] `[feature]` `[P2]` Variant price toggle netto/brutto (spójne z toggle\'em ceny bazowej)
 - [x] `[feature]` `[P2]` `nodemailerAdapter` — typowanie `transportOptions` jako `SMTPTransport.Options` (OAuth2, pool, itd.)
 
+## 0.15.3 — InPost carrier
+
+- [x] `[feature]` `[P2]` `inpostAdapter()` — Geowidget v5 (`<InpostPicker>` Svelte + raw config endpoint), ShipX shipment create + auto-buy + label PDF + cancel, webhook → status + tracking, per-shipping-method service config, customer tracking display in `<OrderStatus>` + email templates
+- [x] `[chore]` `[P2]` Verbose logging on adapter auto-confirm flow (offer prep wait, buy POST, polling) for sandbox debugging
+
+## 0.15.4 — Forms submission scaffold + best-effort notification emails
+
+- [x] `[feature]` `[P1]` CLI scaffold emits `src/routes/api/forms/[slug]/submit/+server.ts` — public form submit endpoint auto-generated, no manual setup per project <!-- files: src/lib/cli/scaffold/admin.ts, src/lib/cli/scaffold/admin.spec.ts -->
+- [x] `[fix]` `[P0]` `createFormSubmission` — split try/catch so SMTP failure no longer returns `false` (endpoint responded 500 even though submission was persisted); notification email is best-effort, logged via `console.error` <!-- files: src/lib/core/server/forms/submissions/operations/create.ts -->
+- [ ] `[feature]` `[P1]` Built-in `/api/health` + `/api/health/ready` with per-adapter checks (db/files/email/ai) + ręczny SMTP diagnostics panel in maintenance page <!-- files: ideas/health-check-module.md -->
+
 ## 0.16.0 — SEO module
 
 - [ ] `[feature]` `[P1]` SERP preview + character limits for title/description <!-- files: src/lib/admin/components/fields/seo-field.svelte -->

package/dist/admin/client/shop/shipping-method-form.svelte

@@ -3,6 +3,16 @@
 	import { Switch } from '../../../components/ui/switch/index.js';
 
 	type CarrierType = 'none' | 'inpost';
+	type InpostServiceType =
+		| 'inpost_locker_standard'
+		| 'inpost_locker_express'
+		| 'inpost_courier_standard'
+		| 'inpost_courier_express';
+	type InpostParcelSize = 'A' | 'B' | 'C';
+	interface CarrierConfig {
+		serviceType?: InpostServiceType | string;
+		defaultSize?: InpostParcelSize | string;
+	}
 	export interface PaymentMethodOption {
 		id: string;
 		label: Record<string, string>;
@@ -13,6 +23,7 @@
 		price: number; // PLN (number, netto)
 		vatRate: number;
 		carrierType: CarrierType;
+		carrierConfig: CarrierConfig | null;
 		conditions: { freeAbove?: number } | null; // freeAbove: grosze
 		allowedPaymentMethods: string[] | null;
 		isActive: boolean;
@@ -24,6 +35,7 @@
 		price?: number | string;
 		vatRate?: number;
 		carrierType?: string;
+		carrierConfig?: CarrierConfig | null;
 		conditions?: { freeAbove?: number } | null;
 		allowedPaymentMethods?: string[] | null;
 		isActive?: boolean;
@@ -97,6 +109,12 @@
 		inputPrice = formatPln(preserved);
 	}
 	let carrierType = $state<CarrierType>((initial?.carrierType as CarrierType) ?? 'none');
+	let inpostServiceType = $state<InpostServiceType>(
+		(initial?.carrierConfig?.serviceType as InpostServiceType) ?? 'inpost_locker_standard'
+	);
+	let inpostDefaultSize = $state<InpostParcelSize>(
+		(initial?.carrierConfig?.defaultSize as InpostParcelSize) ?? 'A'
+	);
 	let isActive = $state(initial?.isActive ?? true);
 	// null/undefined = no restriction (all allowed); otherwise a whitelist.
 	let restrictPayments = $state(
@@ -132,6 +150,10 @@
 			price: netPln,
 			vatRate: Number(vatRate),
 			carrierType,
+			carrierConfig:
+				carrierType === 'inpost'
+					? { serviceType: inpostServiceType, defaultSize: inpostDefaultSize }
+					: null,
 			conditions: freeAboveEnabled
 				? { freeAbove: Math.round(parseFloat(freeAbove || '0') * 100) }
 				: null,
@@ -300,9 +322,52 @@
 			<span class="mb-1 block text-sm font-semibold">Typ</span>
 			<select bind:value={carrierType} class="border-border w-full rounded-lg border px-3 py-2">
 				<option value="none">Bez integracji (adres)</option>
-				<option value="inpost" disabled>InPost paczkomat (wkrótce)</option>
+				<option value="inpost">InPost</option>
 			</select>
 		</label>
+
+		{#if carrierType === 'inpost'}
+			<div class="space-y-4 border-l-2 border-primary/30 pl-4">
+				<p class="text-muted-foreground text-sm">
+					Wymaga skonfigurowanego adaptera <code>inpostAdapter</code> w <code>cms.config.ts</code>.
+				</p>
+
+				<label class="block">
+					<span class="mb-1 block text-sm font-semibold">Usługa ShipX</span>
+					<select
+						bind:value={inpostServiceType}
+						class="border-border w-full rounded-lg border px-3 py-2"
+					>
+						<option value="inpost_locker_standard">Paczkomat — standard</option>
+						<option value="inpost_locker_express">Paczkomat — Express</option>
+						<option value="inpost_courier_standard">Kurier — standard</option>
+						<option value="inpost_courier_express">Kurier — Express</option>
+					</select>
+				</label>
+
+				<label class="block">
+					<span class="mb-1 block text-sm font-semibold">Domyślny rozmiar paczki</span>
+					<select
+						bind:value={inpostDefaultSize}
+						class="border-border w-full rounded-lg border px-3 py-2"
+					>
+						<option value="A">A — mała (8 × 38 × 64 cm)</option>
+						<option value="B">B — średnia (19 × 38 × 64 cm)</option>
+						<option value="C">C — duża (41 × 38 × 64 cm)</option>
+					</select>
+				</label>
+
+				{#if inpostServiceType.startsWith('inpost_courier_')}
+					<p class="text-muted-foreground text-xs">
+						Kurier dostarcza pod adres — klient nie wybiera paczkomatu.
+					</p>
+				{:else}
+					<p class="text-muted-foreground text-xs">
+						Klient wybiera paczkomat odbiorczy w geowidgetcie InPost.
+					</p>
+				{/if}
+			</div>
+		{/if}
 	</section>
 
 	<div class="flex gap-3">

package/dist/admin/client/shop/shipping-method-form.svelte.d.ts

@@ -1,4 +1,10 @@
 type CarrierType = 'none' | 'inpost';
+type InpostServiceType = 'inpost_locker_standard' | 'inpost_locker_express' | 'inpost_courier_standard' | 'inpost_courier_express';
+type InpostParcelSize = 'A' | 'B' | 'C';
+interface CarrierConfig {
+    serviceType?: InpostServiceType | string;
+    defaultSize?: InpostParcelSize | string;
+}
 export interface PaymentMethodOption {
     id: string;
     label: Record<string, string>;
@@ -9,6 +15,7 @@ export interface ShippingFormPayload {
     price: number;
     vatRate: number;
     carrierType: CarrierType;
+    carrierConfig: CarrierConfig | null;
     conditions: {
         freeAbove?: number;
     } | null;
@@ -22,6 +29,7 @@ export interface ShippingFormInitial {
     price?: number | string;
     vatRate?: number;
     carrierType?: string;
+    carrierConfig?: CarrierConfig | null;
     conditions?: {
         freeAbove?: number;
     } | null;

package/dist/admin/client/shop/shop-order-detail-page.svelte

@@ -45,6 +45,7 @@
 	let note = $state('');
 	let saving = $state(false);
 	let resending = $state(false);
+	let shipping = $state(false);
 	let errorMessage = $state<string | null>(null);
 	let successMessage = $state<string | null>(null);
 
@@ -102,6 +103,49 @@
 			resending = false;
 		}
 	}
+
+	async function handleCreateShipment() {
+		shipping = true;
+		errorMessage = null;
+		successMessage = null;
+		try {
+			const result = await remotes.createShipmentForOrderCmd({ orderId });
+			if (!result.success) {
+				errorMessage = result.error;
+			} else {
+				successMessage = result.trackingNumber
+					? `Przesyłka utworzona — ${result.trackingNumber}`
+					: 'Przesyłka utworzona. Numer śledzenia pojawi się po potwierdzeniu w ShipX.';
+				await query.refresh();
+			}
+		} catch (err) {
+			errorMessage =
+				err instanceof Error ? err.message : 'Błąd przy tworzeniu przesyłki';
+		} finally {
+			shipping = false;
+		}
+	}
+
+	async function handleCancelShipment() {
+		if (!confirm('Anulować przesyłkę? Etykieta zostanie unieważniona w ShipX.')) return;
+		shipping = true;
+		errorMessage = null;
+		successMessage = null;
+		try {
+			const result = await remotes.cancelShipmentForOrderCmd({ orderId });
+			if (!result.success) {
+				errorMessage = result.error;
+			} else {
+				successMessage = 'Przesyłka anulowana.';
+				await query.refresh();
+			}
+		} catch (err) {
+			errorMessage =
+				err instanceof Error ? err.message : 'Błąd przy anulowaniu przesyłki';
+		} finally {
+			shipping = false;
+		}
+	}
 </script>
 
 {#if !query.ready}
@@ -268,6 +312,63 @@
 					</Button>
 				</section>
 
+				{#if order.carrierType && order.carrierType !== 'none'}
+					<section class="border-border bg-card space-y-3 rounded-xl border p-5 text-sm">
+						<h2 class="text-base font-bold">
+							Przesyłka <span class="text-muted-foreground font-mono text-xs">{order.carrierType}</span>
+						</h2>
+						{#if order.shipmentId}
+							<div class="space-y-1">
+								<div class="text-muted-foreground text-xs font-semibold">Shipment ID</div>
+								<div class="font-mono text-xs break-all">{order.shipmentId}</div>
+							</div>
+							{#if order.trackingNumber}
+								<div class="space-y-1">
+									<div class="text-muted-foreground text-xs font-semibold">Numer śledzenia</div>
+									<div class="font-mono text-xs break-all">{order.trackingNumber}</div>
+								</div>
+							{:else}
+								<p class="text-xs text-amber-700">
+									Numer śledzenia pojawi się gdy ShipX potwierdzi przesyłkę (zwykle w kilka minut).
+								</p>
+							{/if}
+							<div class="flex flex-wrap gap-2 pt-2">
+								<Button
+									href="/api/shop/admin/orders/{orderId}/label"
+									variant="outline"
+									size="sm"
+									target="_blank"
+								>
+									Pobierz etykietę PDF
+								</Button>
+								<Button
+									onclick={handleCancelShipment}
+									disabled={shipping}
+									variant="outline"
+									size="sm"
+								>
+									Anuluj przesyłkę
+								</Button>
+							</div>
+						{:else if order.status === 'paid' || order.status === 'preparing'}
+							<p class="text-muted-foreground text-xs">
+								Wygeneruj etykietę i nadaj paczkę przez ShipX.
+							</p>
+							<Button
+								onclick={handleCreateShipment}
+								disabled={shipping}
+								class="w-full"
+							>
+								{shipping ? 'Tworzenie…' : 'Utwórz przesyłkę InPost'}
+							</Button>
+						{:else}
+							<p class="text-muted-foreground text-xs">
+								Przesyłkę można utworzyć po opłaceniu zamówienia.
+							</p>
+						{/if}
+					</section>
+				{/if}
+
 				<section class="border-border bg-card space-y-2 rounded-xl border p-5 text-sm">
 					<h2 class="text-base font-bold">Klient</h2>
 					<div>

package/dist/admin/remote/shop.remote.d.ts

@@ -39,6 +39,10 @@ export declare const createShippingMethodCmd: import("@sveltejs/kit").RemoteComm
     vatRate: number;
     description?: Record<string, string> | null | undefined;
     carrierType?: string | undefined;
+    carrierConfig?: {
+        serviceType?: string | undefined;
+        defaultSize?: string | undefined;
+    } | null | undefined;
     conditions?: {
         freeAbove?: number | undefined;
     } | null | undefined;
@@ -54,6 +58,10 @@ export declare const updateShippingMethodCmd: import("@sveltejs/kit").RemoteComm
         price?: number | undefined;
         vatRate?: number | undefined;
         carrierType?: string | undefined;
+        carrierConfig?: {
+            serviceType?: string | undefined;
+            defaultSize?: string | undefined;
+        } | null | undefined;
         conditions?: {
             freeAbove?: number | undefined;
         } | null | undefined;
@@ -99,6 +107,10 @@ export declare const listOrdersAdmin: import("@sveltejs/kit").RemoteQueryFunctio
     shippingGross: number;
     shippingMethodId: string | null;
     carrierRef: string | null;
+    shipmentId: string | null;
+    trackingNumber: string | null;
+    labelUrl: string | null;
+    shipmentCreatedAt: Date | null;
     paymentMethod: string | null;
     paymentProviderRef: string | null;
     notes: string | null;
@@ -130,6 +142,10 @@ export declare const getOrderForAdmin: import("@sveltejs/kit").RemoteQueryFuncti
         shippingGross: number;
         shippingMethodId: string | null;
         carrierRef: string | null;
+        shipmentId: string | null;
+        trackingNumber: string | null;
+        labelUrl: string | null;
+        shipmentCreatedAt: Date | null;
         paymentMethod: string | null;
         paymentProviderRef: string | null;
         notes: string | null;
@@ -185,6 +201,10 @@ export declare const updateOrderStatusCmd: import("@sveltejs/kit").RemoteCommand
     shippingGross: number;
     shippingMethodId: string | null;
     carrierRef: string | null;
+    shipmentId: string | null;
+    trackingNumber: string | null;
+    labelUrl: string | null;
+    shipmentCreatedAt: Date | null;
     paymentMethod: string | null;
     paymentProviderRef: string | null;
     notes: string | null;
@@ -195,6 +215,30 @@ export declare const resendOrderEmailCmd: import("@sveltejs/kit").RemoteCommand<
 }, Promise<{
     success: boolean;
 }>>;
+export declare const createShipmentForOrderCmd: import("@sveltejs/kit").RemoteCommand<{
+    orderId: string;
+}, Promise<{
+    success: true;
+    shipmentId: string | null;
+    trackingNumber: string | null;
+    status: import("../../shop/types.js").OrderStatus;
+    error?: undefined;
+} | {
+    success: false;
+    error: string;
+    shipmentId?: undefined;
+    trackingNumber?: undefined;
+    status?: undefined;
+}>>;
+export declare const cancelShipmentForOrderCmd: import("@sveltejs/kit").RemoteCommand<{
+    orderId: string;
+}, Promise<{
+    success: true;
+    error?: undefined;
+} | {
+    success: false;
+    error: string;
+}>>;
 export declare const listShopableCollections: import("@sveltejs/kit").RemoteQueryFunction<void, {
     slug: string;
     labels: {

package/dist/admin/remote/shop.remote.js

@@ -4,6 +4,7 @@ import { getCMS } from '../../core/cms.js';
 import { deleteShopData, getShopDataByEntry, listShopEntries, upsertShopData } from '../../shop/server/shop-data.js';
 import { createShippingMethod, deleteShippingMethod, getShippingMethod, listShippingMethods, reorderShippingMethods, updateShippingMethod } from '../../shop/server/shipping.js';
 import { getOrderById, getOrderItems, getOrderStatusHistory, listOrders, updateOrderStatus } from '../../shop/server/orders.js';
+import { cancelShipmentForOrder, createShipmentForOrder } from '../../shop/server/shipments.js';
 import { sendOrderStatusEmail } from '../../shop/server/email.js';
 import { requireAuth } from './middleware/auth.js';
 export const getShopEnabled = query(async () => {
@@ -63,6 +64,13 @@ const shippingMethodInputSchema = z.object({
     price: z.number().nonnegative().max(1e9), // PLN netto (≤6dp)
     vatRate: z.number().int().min(0).max(100),
     carrierType: z.string().optional(),
+    carrierConfig: z
+        .object({
+        serviceType: z.string().optional(),
+        defaultSize: z.string().optional()
+    })
+        .nullable()
+        .optional(),
     conditions: z
         .object({ freeAbove: z.number().int().nonnegative().optional() })
         .nullable()
@@ -143,6 +151,33 @@ export const resendOrderEmailCmd = command(z.object({ orderId: z.string(), statu
     await sendOrderStatusEmail(orderId, status);
     return { success: true };
 });
+export const createShipmentForOrderCmd = command(z.object({ orderId: z.string() }), async ({ orderId }) => {
+    requireAuth();
+    try {
+        const order = await createShipmentForOrder(orderId);
+        return {
+            success: true,
+            shipmentId: order.shipmentId,
+            trackingNumber: order.trackingNumber,
+            status: order.status
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Shipment create failed';
+        return { success: false, error: message };
+    }
+});
+export const cancelShipmentForOrderCmd = command(z.object({ orderId: z.string() }), async ({ orderId }) => {
+    requireAuth();
+    try {
+        await cancelShipmentForOrder(orderId);
+        return { success: true };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Shipment cancel failed';
+        return { success: false, error: message };
+    }
+});
 export const listShopableCollections = query(async () => {
     requireAuth();
     const cms = getCMS();