Merge branch 'cart-temp' into box-now-test-

.env.example

@@ -59,6 +59,10 @@ MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_FROM_ADDRESS="hello@example.com"
 MAIL_FROM_NAME="${APP_NAME}"
+CONTACT_EMAIL=
+
+HCAPTCHA_SITEKEY=
+HCAPTCHA_SECRET=
 
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=

README.md

@@ -0,0 +1,29 @@
+# 3dealer
+
+Storefront for 3dealer.gr: Laravel 12 + Lunar PHP (headless), on top of `boboko/core`. Front-end conventions are in [CLAUDE.md](CLAUDE.md).
+
+## Scheduled jobs
+
+These run in the `scheduler` container (`php artisan schedule:work`).
+
+| Command | When | What it does |
+|---|---|---|
+| `custom-fields:prune-uploads` | Daily, 04:00 | Deletes custom-field photo uploads older than 24 h that no cart line or order line references. |
+| `lunar:search:index` | Daily, 03:00 | Full product reindex. Registered by `boboko/core`. |
+
+## Product custom fields
+
+Admins can add custom fields to a product in the Lunar admin (the product's **Custom Fields** section, from `boboko/core`). The customer fills them in on the product page before adding the product to the cart. The answers are stored on the cart line (`meta.custom_fields`) and carried over to the order line.
+
+| Field type | Storefront input | Limit |
+|---|---|---|
+| Short text | text input | 255 characters |
+| Long text | textarea | 2,000 characters |
+| File upload | photo upload | JPG, PNG, WEBP, HEIC/HEIF, up to 10 MB |
+
+- **Photos upload as soon as they're picked.** They go to `POST /{locale}/custom-field-uploads`, which is limited to 20 per minute per client. They're stored on the private `local` disk under `storage/app/private/custom-field-uploads/`. Only an encrypted reference is sent with add-to-cart. The allowed types and size are set in `App\Http\Controllers\CustomFieldUploadController`.
+- **Photos are never public.** The cart drawer, checkout summary and order confirmation link to a photo through a signed URL that expires after 2 hours.
+- **Emails show text answers only**, never photos.
+- **Photos are cleaned up automatically.** Photos never added to a cart are deleted by `custom-fields:prune-uploads` (see above). A photo on a cart line is kept as long as that cart line exists, and a photo on an order is kept indefinitely.
+- **Products with custom fields can't be quick-added.** On product cards, the "add to cart" button becomes a link to the product page.
+- Field labels are entered once in the admin and aren't translated, so they appear as entered in both `/el` and `/en`.

app/Catalog/ProductCard.php

@@ -19,7 +19,7 @@ final class ProductCard
 {
     /**
      * @param  array<string, mixed>  $product  one item from ProductService's localized array shape
-     * @return array{name: ?string, price: ?string, image: ?string, href: string}
+     * @return array{name: ?string, price: ?string, image: ?string, href: string, variantId: ?int, hasCustomFields: bool, soldOut: bool}
      */
     public static function fromIndexed(array $product): array
     {
@@ -28,6 +28,20 @@ public static function fromIndexed(array $product): array
             'price' => $product['price'],
             'image' => $product['media'][0]['url'] ?? null,
             'href' => route('product.show', ['id' => $product['id']]),
+            // The card's quick "Add to cart" always adds this variant, same
+            // default Modules\Core\Catalog\Services\ProductService::
+            // variantSummaries() and product/show.blade.php both use — no
+            // picker at listing-grid scope, unlike the product page's own
+            // color swatches.
+            'variantId' => $product['variants'][0]['id'] ?? null,
+            // A product with custom fields (photo upload, engraving text…)
+            // can't be quick-added from a card — the card links to the
+            // product page instead, even when every field is optional.
+            'hasCustomFields' => ! empty($product['custom_fields']),
+            // Index-time stock (see boboko-core's ProductIndexer `in_stock`),
+            // so only as fresh as the last reindex. A document missing the
+            // field is treated as in stock rather than hiding its cart button.
+            'soldOut' => ! ($product['in_stock'] ?? true),
         ];
     }
 }

app/Catalog/ProductListingPage.php

@@ -17,7 +17,14 @@
  */
 final class ProductListingPage
 {
-    private const PER_PAGE = 12;
+    private const PER_PAGE = 40;
+
+    /** Category pages rarely have enough products to fill a page, so this
+     * ceiling is high enough to act as "no pagination" in practice — the
+     * pagination component self-hides via hasPages() when everything fits.
+     * If a category ever exceeds it, pagination reappears as a safety net
+     * rather than silently truncating results. */
+    private const CATEGORY_PER_PAGE = 200;
 
     public function __construct(
         private readonly ProductService $products,
@@ -33,6 +40,7 @@ public function __construct(
     public function build(ProductListing $listing, Closure $url, ?int $collectionId = null, ?string $query = null): array
     {
         $filters = $listing->filters($collectionId);
+        $perPage = $collectionId !== null ? self::CATEGORY_PER_PAGE : self::PER_PAGE;
 
         // Listing reads from the Meilisearch index via ProductService/
         // ProductSearchService, not Eloquent. Both return a
@@ -45,12 +53,12 @@ public function build(ProductListing $listing, Closure $url, ?int $collectionId
                 query: $query,
                 filters: $filters,
                 sort: $listing->sort,
-                perPage: self::PER_PAGE,
+                perPage: $perPage,
                 page: $listing->page,
             )
             : $this->products->list(
                 filters: $filters,
-                perPage: self::PER_PAGE,
+                perPage: $perPage,
                 page: $listing->page,
                 sort: $listing->sort,
             );

app/Http/Controllers/Account/AccountController.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+use Lunar\Models\Country;
+use Lunar\Models\State;
+use Modules\Core\Cart\Services\CartService;
+use Modules\Core\Checkout\Services\CheckoutService;
+use Modules\Core\Customer\Services\CustomerAccountService;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * The profile page: name, invoice details, the one address, and account
+ * deletion. The customer keeps a single address, flagged as both the
+ * shipping and billing default, so allowing several later is a UI change
+ * only (the data is already Lunar's own addresses table).
+ */
+class AccountController extends Controller
+{
+    // Single-country store, same as CheckoutController::STORE_COUNTRY_ISO3.
+    private const STORE_COUNTRY_ISO3 = 'GRC';
+
+    private const ADDRESS_FIELDS = ['line_one', 'city', 'postcode', 'state', 'contact_phone'];
+
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function show(string $locale, Request $request): View
+    {
+        $user = $request->user();
+        $customer = $this->account->customer($user);
+
+        return view('account.show', [
+            'user' => $user,
+            'customer' => $customer,
+            'address' => $this->defaultAddress($user),
+            'regions' => State::where('country_id', $this->storeCountry()->id)->orderBy('name')->get(['id', 'name']),
+        ]);
+    }
+
+    public function update(string $locale, Request $request): RedirectResponse
+    {
+        $user = $request->user();
+        $country = $this->storeCountry();
+
+        // The address is all-or-nothing: typing any part of it makes the rest
+        // (and the name, which Lunar requires on every address) required.
+        $anyAddressField = implode(',', self::ADDRESS_FIELDS);
+
+        $data = $request->validate([
+            'first_name' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'last_name' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'invoice' => ['boolean'],
+            'company_name' => ['nullable', 'string', 'max:255', 'required_if_accepted:invoice'],
+            'tax_identifier' => ['nullable', 'digits:9', 'required_if_accepted:invoice'],
+            'line_one' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'city' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'postcode' => ['nullable', 'regex:/^\d{3}\s?\d{2}$/', 'required_with:'.$anyAddressField],
+            'state' => [
+                'nullable',
+                'string',
+                'required_with:'.$anyAddressField,
+                Rule::exists((new State)->getTable(), 'name')->where('country_id', $country->id),
+            ],
+            'contact_phone' => ['nullable', 'string', 'max:30'],
+            'recovery_consent' => ['boolean'],
+        ]);
+
+        $invoice = $request->boolean('invoice');
+
+        $this->account->updateProfile($user, [
+            'first_name' => $data['first_name'] ?? null,
+            'last_name' => $data['last_name'] ?? null,
+            'company_name' => $invoice ? $data['company_name'] : null,
+            'tax_identifier' => $invoice ? $data['tax_identifier'] : null,
+        ]);
+
+        if (filled($data['line_one'] ?? null)) {
+            $addressData = [
+                ...collect($data)->only(self::ADDRESS_FIELDS)->all(),
+                'first_name' => $data['first_name'],
+                'last_name' => $data['last_name'],
+                'country_id' => $country->id,
+                'contact_email' => $user->email,
+                'shipping_default' => true,
+                'billing_default' => true,
+            ];
+
+            $existing = $this->defaultAddress($user);
+
+            $existing
+                ? $this->account->updateAddress($user, $existing->id, $addressData)
+                : $this->account->createAddress($user, $addressData);
+        }
+
+        $this->updateRecoveryConsent($user, $request->boolean('recovery_consent'));
+
+        return redirect()->route('account')->with('status', __('storefront.account.saved'));
+    }
+
+    /**
+     * "Email me a reminder if I don't finish my order", as a standing
+     * choice — stored on the customer via boboko-core's
+     * CustomerAccountService::setRecoveryConsent(), and applied to the
+     * current cart too, so opting out stops reminders for it right away.
+     */
+    private function updateRecoveryConsent($user, bool $consent): void
+    {
+        $this->account->setRecoveryConsent($user, $consent);
+
+        // Only an existing cart; never create one just to record this.
+        $cart = app(CartService::class)->current();
+
+        if ($cart && (bool) data_get($cart, 'meta.recovery_consent') !== $consent) {
+            app(CheckoutService::class)->setRecoveryConsent($consent);
+        }
+    }
+
+    /**
+     * Self-service deletion: opens core's 30-day grace-period erasure request
+     * (which blocks the login right away) and logs out. Logging back in within
+     * the grace period cancels it; see core's docs/privacy.md.
+     */
+    public function destroy(string $locale, Request $request, PrivacyService $privacy): RedirectResponse
+    {
+        $user = $request->user();
+
+        $privacy->requestErasureForUser($user, $user);
+
+        Auth::logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login')->with('status', __('storefront.account.deletion_requested'));
+    }
+
+    private function defaultAddress($user)
+    {
+        $addresses = collect($this->account->addresses($user));
+
+        return $addresses->firstWhere('shipping_default', true) ?? $addresses->first();
+    }
+
+    private function storeCountry(): Country
+    {
+        return Country::where('iso3', self::STORE_COUNTRY_ISO3)->firstOrFail();
+    }
+}

app/Http/Controllers/Account/EmailController.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
+use Modules\Core\Customer\Exceptions\EmailAlreadyTakenException;
+use Modules\Core\Customer\Exceptions\InvalidEmailChangeCodeException;
+use Modules\Core\Customer\Services\CustomerEmailChangeService;
+
+/**
+ * Changing the login email — a thin wrapper over boboko-core's
+ * Customer\Services\CustomerEmailChangeService, which owns the actual
+ * request/confirm mechanics, throttling, pending-change storage, and
+ * mailables. This controller's own job is just the storefront's session-
+ * scoped "which email did I just ask to switch to" UI state (so the
+ * .code/.resend pages know which address to show/resend to) and
+ * translating the service's exceptions into the flash-message flow the
+ * views expect.
+ */
+class EmailController extends Controller
+{
+    private const SESSION_KEY = 'pending_email_change';
+
+    public function edit(string $locale, Request $request): View
+    {
+        return view('account.email', ['user' => $request->user()]);
+    }
+
+    public function send(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $user = $request->user();
+
+        $request->merge(['email' => Str::lower(trim((string) $request->input('email')))]);
+
+        $validated = $request->validate([
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::notIn([$user->email]),
+            ],
+        ], [
+            'email.not_in' => __('storefront.account.email_same'),
+        ]);
+
+        try {
+            $emailChange->request($user, $validated['email']);
+        } catch (EmailAlreadyTakenException) {
+            return back()->withInput()->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (OtpThrottledException) {
+            return back()->withInput()->withErrors(['email' => __('storefront.auth.too_many_codes')]);
+        }
+
+        $request->session()->put(self::SESSION_KEY, $validated['email']);
+
+        return redirect()->route('account.email.code');
+    }
+
+    public function code(string $locale, Request $request): View|RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        return view('account.email-code', ['email' => $pendingEmail]);
+    }
+
+    public function resend(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        try {
+            $emailChange->request($request->user(), $pendingEmail);
+        } catch (EmailAlreadyTakenException) {
+            $request->session()->forget(self::SESSION_KEY);
+
+            return redirect()->route('account.email.edit')
+                ->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (OtpThrottledException) {
+            return back()->withErrors(['code' => __('storefront.auth.too_many_codes')]);
+        }
+
+        return back()->with('status', __('storefront.auth.code_resent'));
+    }
+
+    public function verify(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        $validated = $request->validate(['code' => ['required', 'digits:6']]);
+
+        try {
+            $emailChange->confirm($request->user(), $validated['code']);
+        } catch (EmailAlreadyTakenException) {
+            $request->session()->forget(self::SESSION_KEY);
+
+            return redirect()->route('account.email.edit')
+                ->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (InvalidEmailChangeCodeException) {
+            return back()->withErrors(['code' => __('storefront.auth.invalid_code')]);
+        }
+
+        $request->session()->forget(self::SESSION_KEY);
+
+        return redirect()->route('account')->with('status', __('storefront.account.email_changed'));
+    }
+}

app/Http/Controllers/Account/OrderController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Customer\Exceptions\OrderNotFoundException;
+use Modules\Core\Customer\Services\CustomerAccountService;
+
+/**
+ * Order history. Every lookup goes through CustomerAccountService, which only
+ * ever returns the logged-in user's own placed orders, so an order id from
+ * the URL can't reach someone else's order.
+ */
+class OrderController extends Controller
+{
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function index(string $locale, Request $request): View
+    {
+        return view('account.orders.index', [
+            'orders' => $this->account->orders($request->user(), 15),
+        ]);
+    }
+
+    public function show(string $locale, Request $request, int $orderId): View
+    {
+        try {
+            $order = $this->account->order($request->user(), $orderId);
+        } catch (OrderNotFoundException) {
+            abort(404);
+        }
+
+        // By type, like the checkout confirmation: the method may since have
+        // been disabled, but the order still shows what was used.
+        $paymentMethodName = PaymentMethod::where('type', $order->meta['payment_method'] ?? null)
+            ->first()
+            ?->translate('name');
+
+        return view('account.orders.show', [
+            'order' => $order,
+            'paymentMethodName' => $paymentMethodName,
+            'shipments' => $order->shipments->whereNull('cancelled_at')->whereNotNull('tracking_reference'),
+        ]);
+    }
+}

app/Http/Controllers/Auth/LoginController.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Rules\HCaptcha;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+use Illuminate\View\View;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
+use Modules\Core\Auth\Services\UserOtpService;
+
+/**
+ * Passwordless customer login: email → emailed 6-digit code → logged in.
+ * Login and registration are the same flow — UserOtpService::generateAndSend()
+ * find-or-creates the user (and its Customer).
+ *
+ * All the security lives in UserOtpService: per-email code-request throttling
+ * (OtpThrottledException), wrong-guess lockout, the Auth::login() itself (which
+ * also regenerates the session and merges the guest cart via Lunar's Login
+ * listener) and the session-registry record. This controller only moves the
+ * shopper between the two steps, carrying the email in the session rather
+ * than the URL.
+ */
+class LoginController extends Controller
+{
+    /**
+     * `?redirect=/el/checkout` (e.g. from the checkout's login tab) becomes the
+     * intended URL that verify() returns to. Only a same-site path is accepted:
+     * no scheme, no protocol-relative `//host`, so it can't redirect off-site.
+     */
+    public function create(string $locale, Request $request): View
+    {
+        $redirect = (string) $request->query('redirect', '');
+
+        if (preg_match('#^/(?![/\\\\])#', $redirect)) {
+            $request->session()->put('url.intended', url($redirect));
+        }
+
+        return view('auth.login');
+    }
+
+    public function send(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        // Captcha only here: verify() and resend() need the email this step
+        // puts in the session, so they can't be reached without passing it.
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+            'h-captcha-response' => ['bail', 'required', new HCaptcha],
+        ], [
+            'h-captcha-response.required' => __('storefront.auth.captcha_failed'),
+        ]);
+
+        $email = Str::lower(trim($validated['email']));
+
+        try {
+            $otp->generateAndSend($email);
+        } catch (OtpThrottledException) {
+            return back()->withInput()->withErrors([
+                'email' => __('storefront.auth.too_many_codes'),
+            ]);
+        }
+
+        $request->session()->put('login.email', $email);
+
+        return redirect()->route('login.code');
+    }
+
+    public function code(string $locale, Request $request): View|RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        return view('auth.login-code', ['email' => $email]);
+    }
+
+    public function resend(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        try {
+            $otp->generateAndSend($email);
+        } catch (OtpThrottledException) {
+            return back()->withErrors([
+                'code' => __('storefront.auth.too_many_codes'),
+            ]);
+        }
+
+        return back()->with('status', __('storefront.auth.code_resent'));
+    }
+
+    public function verify(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        $validated = $request->validate([
+            'code' => ['required', 'digits:6'],
+        ]);
+
+        // Wrong, expired, or locked out after too many guesses — core doesn't
+        // say which, so neither do we; the page offers "resend code" for all three.
+        if (! $otp->validate($email, $validated['code'], $request)) {
+            return back()->withErrors([
+                'code' => __('storefront.auth.invalid_code'),
+            ]);
+        }
+
+        $request->session()->forget('login.email');
+
+        return redirect()->intended(route('home'));
+    }
+
+    public function destroy(string $locale, Request $request): RedirectResponse
+    {
+        Auth::logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('home');
+    }
+}

app/Http/Controllers/Checkout/CartController.php

@@ -1,89 +0,0 @@
-<?php
-
-namespace App\Http\Controllers\Checkout;
-
-use App\Http\Controllers\Controller;
-use Illuminate\Http\Request;
-use Illuminate\View\View;
-use Lunar\Models\ProductVariant;
-use Modules\Core\Cart\Exceptions\InvalidCouponException;
-use Modules\Core\Cart\Services\CartService;
-
-/**
- * Thin storefront cart endpoints for the checkout module. Every action mutates
- * the session cart via boboko-core's CartService and returns the same
- * server-rendered `cart-body` partial — the drawer's Stimulus controller swaps
- * that fragment in place (no JSON, no client-side templating). $cart / $lines
- * for the partial come from the view composer in CheckoutModuleServiceProvider.
- */
-class CartController extends Controller
-{
-    public function __construct(
-        private readonly CartService $cart,
-    ) {}
-
-    public function add(string $locale, Request $request): View
-    {
-        $data = $request->validate([
-            'purchasable_id' => ['required', 'integer'],
-            'quantity' => ['nullable', 'integer', 'min:1'],
-        ]);
-
-        $variant = ProductVariant::findOrFail($data['purchasable_id']);
-
-        $this->cart->addLine($variant, $data['quantity'] ?? 1);
-
-        return view('checkout::partials.cart-body');
-    }
-
-    public function updateLine(string $locale, Request $request, int $line): View
-    {
-        $quantity = (int) $request->validate([
-            'quantity' => ['required', 'integer', 'min:0'],
-        ])['quantity'];
-
-        $quantity === 0
-            ? $this->cart->removeLine($line)
-            : $this->cart->updateLine($line, $quantity);
-
-        return view('checkout::partials.cart-body');
-    }
-
-    public function remove(string $locale, int $line): View
-    {
-        $this->cart->removeLine($line);
-
-        return view('checkout::partials.cart-body');
-    }
-
-    /**
-     * A bad code is a normal, expected outcome here (typo, expired code), not
-     * an error state for the request — it re-renders the same cart-body
-     * partial with $couponError set, rather than a 4xx/redirect, so the fetch
-     * + swap in bbk-cart-controller stays the one code path for every cart
-     * mutation.
-     */
-    public function applyCoupon(string $locale, Request $request): View
-    {
-        $code = $request->validate([
-            'code' => ['required', 'string'],
-        ])['code'];
-
-        $couponError = false;
-
-        try {
-            $this->cart->applyCoupon($code);
-        } catch (InvalidCouponException) {
-            $couponError = true;
-        }
-
-        return view('checkout::partials.cart-body', ['couponError' => $couponError]);
-    }
-
-    public function removeCoupon(string $locale): View
-    {
-        $this->cart->removeCoupon();
-
-        return view('checkout::partials.cart-body');
-    }
-}

app/Http/Controllers/Checkout/CheckoutController.php

@@ -1,531 +0,0 @@
-<?php
-
-namespace App\Http\Controllers\Checkout;
-
-use App\Http\Controllers\Controller;
-use Illuminate\Http\JsonResponse;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
-use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Validator;
-use Illuminate\Validation\Rule;
-use Illuminate\View\View;
-use Lunar\Exceptions\Carts\CartException;
-use Lunar\Exceptions\FingerprintMismatchException;
-use Lunar\Facades\CartSession;
-use Lunar\Models\Cart;
-use Lunar\Models\Country;
-use Lunar\Models\Order;
-use Lunar\Models\State;
-use Modules\Core\Cart\Services\CartService;
-use Modules\Core\Checkout\Exceptions\InvalidShippingOptionException;
-use Modules\Core\Checkout\Exceptions\NoShippingAddressException;
-use Modules\Core\Checkout\Exceptions\TermsNotAcceptedException;
-use Modules\Core\Checkout\Exceptions\UnknownPaymentTypeException;
-use Modules\Core\Checkout\Services\CheckoutService;
-use Modules\Core\Payment\Enums\PaymentResultStatus;
-use Modules\Core\Shipping\Carriers\BoxNow\BoxNowClient;
-
-/**
- * The checkout page — one page, sections (contact / billing / shipping /
- * shipping method), reviewed against boboko-core's CheckoutService. Stops
- * short of payment for this slice (see project memory).
- *
- * The address form and the shipping-method radios **autosave** — no submit
- * buttons. `saveAddress()` / `selectShippingOption()` are called by
- * bbk-checkout-form (debounced fetch) and return a JSON envelope of
- * server-rendered fragments (shipping options + order summary) plus any
- * field errors, rather than redirecting. Address validation is deliberately
- * lenient — nothing is rejected mid-typing; required-field enforcement is the
- * job of the (not-yet-built) "Continue to payment" gate.
- *
- * Guest-only for now — the Contact section's login tab is UI only.
- *
- * Single-country store: STORE_COUNTRY_ISO3 fixes the country to Greece (hidden
- * field, forced server-side). Set it to null for the full country picker (the
- * portable path for a multi-country boboko store).
- */
-class CheckoutController extends Controller
-{
-    private const STORE_COUNTRY_ISO3 = 'GRC';
-
-    public function __construct(
-        private readonly CartService $cart,
-        private readonly CheckoutService $checkout,
-    ) {}
-
-    public function show(string $locale): View
-    {
-        $cart = $this->cart->current();
-        $lines = $cart ? $this->cart->activeLines($cart) : collect();
-        $storeCountry = $this->storeCountry();
-
-        $shippingOptions = collect();
-
-        if ($cart?->shippingAddress) {
-            // Nothing recreates the address row in this path — its own current
-            // value is the correct "previous" to carry forward if still valid.
-            $shippingOptions = $this->syncShipping($cart, $cart->shippingAddress->shipping_option);
-
-            // Cart's CachesProperties::refresh() explicitly nulls total/
-            // subTotal/shippingTotal/etc. back to their defaults — every
-            // Lunar call site pairs it with recalculate() for exactly that
-            // reason. Bare refresh() here was leaving $cart->total null on
-            // reload, which fed a 0 amount straight into the Stripe Element.
-            $cart->refresh()->recalculate();
-        }
-
-        return view('checkout::page', [
-            'cart' => $cart,
-            'lines' => $lines,
-            'billingAddress' => $cart?->billingAddress,
-            'shippingAddress' => $cart?->shippingAddress,
-            'shippingOptions' => $shippingOptions,
-            'paymentMethods' => $this->checkout->getPaymentMethods(),
-            'shipToBilling' => (bool) data_get($cart, 'meta.ship_to_billing', true),
-            'storeCountry' => $storeCountry,
-            'countries' => $storeCountry
-                ? collect()
-                : Country::orderBy('name')->get(['id', 'name']),
-            'regions' => $storeCountry
-                ? State::where('country_id', $storeCountry->id)->orderBy('name')->get(['id', 'name'])
-                : collect(),
-        ]);
-    }
-
-    public function saveAddress(string $locale, Request $request): JsonResponse
-    {
-        $storeCountry = $this->storeCountry();
-        $sameAsBilling = $request->boolean('same_as_billing');
-
-        // Only the fields shipping rates resolve against — if none of these
-        // changed (shopper edited their name, phone, email, …) there's no point
-        // re-quoting shipping or re-rendering the summary.
-        $addressBefore = $this->cart->current()?->shippingAddress;
-        $rateKeyBefore = $addressBefore?->only(['postcode', 'state', 'country_id']);
-
-        // setShippingAddress() below always deletes + recreates this row (see
-        // syncShipping()'s docblock) — capture what was selected NOW, before
-        // it's gone, so it can be carried forward onto the fresh row.
-        $previousOption = $addressBefore?->shipping_option;
-
-        $stateRule = $storeCountry
-            ? ['nullable', 'string', Rule::exists((new State)->getTable(), 'name')->where('country_id', $storeCountry->id)]
-            : ['nullable', 'string', 'max:255'];
-        $countryRule = $storeCountry
-            ? ['nullable']
-            : ['nullable', 'integer', 'exists:'.(new Country)->getTable().',id'];
-
-        // Lenient — only format checks. Anything that fails is simply left out
-        // of what gets persisted, and reported back for inline display.
-        $validator = Validator::make($request->all(), [
-            'contact_email' => ['nullable', 'email'],
-
-            'billing_first_name' => ['nullable', 'string', 'max:255'],
-            'billing_last_name' => ['nullable', 'string', 'max:255'],
-            'billing_company_name' => ['nullable', 'string', 'max:255'],
-            'billing_tax_identifier' => ['nullable', 'string', 'max:255'],
-            'billing_line_one' => ['nullable', 'string', 'max:255'],
-            'billing_line_two' => ['nullable', 'string', 'max:255'],
-            'billing_city' => ['nullable', 'string', 'max:255'],
-            'billing_state' => $stateRule,
-            'billing_postcode' => ['nullable', 'string', 'max:20'],
-            'billing_country_id' => $countryRule,
-            'billing_contact_phone' => ['nullable', 'string', 'max:50'],
-
-            'shipping_first_name' => ['nullable', 'string', 'max:255'],
-            'shipping_last_name' => ['nullable', 'string', 'max:255'],
-            'shipping_company_name' => ['nullable', 'string', 'max:255'],
-            'shipping_line_one' => ['nullable', 'string', 'max:255'],
-            'shipping_line_two' => ['nullable', 'string', 'max:255'],
-            'shipping_city' => ['nullable', 'string', 'max:255'],
-            'shipping_state' => $stateRule,
-            'shipping_postcode' => ['nullable', 'string', 'max:20'],
-            'shipping_country_id' => $countryRule,
-            'shipping_contact_phone' => ['nullable', 'string', 'max:50'],
-            'shipping_delivery_instructions' => ['nullable', 'string', 'max:1000'],
-        ]);
-
-        $errors = $validator->errors()->toArray();
-        $data = $validator->valid();
-
-        $billingCountryId = $storeCountry?->id ?? ($data['billing_country_id'] ?? null);
-        $shippingCountryId = $storeCountry?->id ?? ($data['shipping_country_id'] ?? $billingCountryId);
-
-        $billing = [
-            'first_name' => $data['billing_first_name'] ?? null,
-            'last_name' => $data['billing_last_name'] ?? null,
-            'company_name' => $data['billing_company_name'] ?? null,
-            'tax_identifier' => $data['billing_tax_identifier'] ?? null,
-            'line_one' => $data['billing_line_one'] ?? null,
-            'line_two' => $data['billing_line_two'] ?? null,
-            'city' => $data['billing_city'] ?? null,
-            'state' => $data['billing_state'] ?? null,
-            'postcode' => $data['billing_postcode'] ?? null,
-            'country_id' => $billingCountryId,
-            'contact_email' => $data['contact_email'] ?? null,
-            'contact_phone' => $data['billing_contact_phone'] ?? null,
-        ];
-
-        $shipping = $sameAsBilling
-            ? [...$billing, 'delivery_instructions' => $data['shipping_delivery_instructions'] ?? null]
-            : [
-                'first_name' => $data['shipping_first_name'] ?? null,
-                'last_name' => $data['shipping_last_name'] ?? null,
-                'company_name' => $data['shipping_company_name'] ?? null,
-                'line_one' => $data['shipping_line_one'] ?? null,
-                'line_two' => $data['shipping_line_two'] ?? null,
-                'city' => $data['shipping_city'] ?? null,
-                'state' => $data['shipping_state'] ?? null,
-                'postcode' => $data['shipping_postcode'] ?? null,
-                'country_id' => $shippingCountryId,
-                'contact_email' => $data['contact_email'] ?? null,
-                'contact_phone' => $data['shipping_contact_phone'] ?? null,
-                'delivery_instructions' => $data['shipping_delivery_instructions'] ?? null,
-            ];
-
-        $this->checkout->setBillingAddress($billing);
-        $cart = $this->checkout->setShippingAddress($shipping);
-
-        $cart->meta = [...($cart->meta?->toArray() ?? []), 'ship_to_billing' => $sameAsBilling];
-        $cart->save();
-
-        // Abandoned-cart-recovery opt-in — boboko-core owns the record (bool +
-        // timestamp + policy version on Cart::meta, RecoveryConsentSet event).
-        // Deliberately its own scope, not merged with any future newsletter opt-in.
-        $this->checkout->setRecoveryConsent($request->boolean('recovery_consent'));
-
-        $rateKeyAfter = $cart->shippingAddress?->only(['postcode', 'state', 'country_id']);
-        $rateChanged = $rateKeyAfter != $rateKeyBefore;
-
-        // setShippingAddress() above always deletes and recreates the
-        // CartAddress row (Lunar's AddAddress action), which drops whatever
-        // shipping_option was previously selected — regardless of whether the
-        // rate-determining fields actually changed. So this always has to run
-        // to restore/re-validate it, even on a save that only touched e.g. the
-        // phone number. Only the fragment RE-RENDER is skippable when nothing
-        // rate-relevant moved — the re-select itself is not optional.
-        $options = $this->syncShipping($cart, $previousOption);
-
-        if (! $rateChanged) {
-            return $this->fragments($cart, null, $errors);
-        }
-
-        return $this->fragments($cart, $options, $errors);
-    }
-
-    public function selectShippingOption(string $locale, Request $request): JsonResponse
-    {
-        $identifier = (string) $request->input('shipping_option');
-
-        try {
-            $this->checkout->selectShippingOption($identifier);
-        } catch (InvalidShippingOptionException) {
-            // Re-render with whatever is currently valid; no hard error surfaced.
-        }
-
-        $cart = $this->cart->current();
-        $options = $cart?->shippingAddress
-            ? $this->checkout->getShippingOptions()
-            : collect();
-
-        return $this->fragments($cart, $options);
-    }
-
-    /**
-     * A plain, own-hosted stand-in for Box Now's Destination Map widget —
-     * that widget only talks to their Production environment (see their
-     * Partner API manual §4.1), which is useless while developing against
-     * Stage credentials. Same underlying data (GET /destinations), no map.
-     */
-    public function boxNowLockers(string $locale, BoxNowClient $boxNow): JsonResponse
-    {
-        $lockers = collect($boxNow->destinations())
-            // Drops entries with a blank `name` (e.g. id 8288, "Virtual
-            // Locker" in Sudan at lat 12.3/lng 25.3) — a real, in-range
-            // coordinate, but sandbox test fixture noise rather than an
-            // actual pickup point, and it alone was enough to make
-            // fitBounds() below zoom the map out to the whole Balkans/
-            // Middle East to fit every marker's cluster in Greece.
-            ->filter(fn (array $destination) => filled($destination['name'] ?? null))
-            ->map(fn (array $destination) => [
-                'id' => $destination['id'],
-                'name' => $destination['name'] ?? $destination['title'] ?? $destination['id'],
-                'addressLine1' => $destination['addressLine1'] ?? null,
-                'addressLine2' => $destination['addressLine2'] ?? null,
-                'postalCode' => $destination['postalCode'] ?? null,
-                'country' => $destination['country'] ?? null,
-                'note' => $destination['note'] ?? null,
-                'image' => $destination['image'] ?? null,
-                'lat' => isset($destination['lat']) ? (float) $destination['lat'] : null,
-                'lng' => isset($destination['lng']) ? (float) $destination['lng'] : null,
-            ])
-            // Box Now's own Stage/sandbox data has at least one malformed
-            // entry observed in practice (locker id 47: lat/lng as huge
-            // integers with the decimal point apparently dropped, e.g.
-            // 96065874308606 instead of ~37.96) — a single such point blows
-            // out L.featureGroup().getBounds() on the frontend, zooming the
-            // map out to near-nothing with every real marker imperceptible
-            // at that scale. Valid latitude/longitude ranges are absolute,
-            // not guesswork, so filtering on them is safe regardless of
-            // what BoxNow's API does or doesn't fix upstream.
-            ->filter(fn (array $locker) => $locker['lat'] !== null && $locker['lng'] !== null
-                && abs($locker['lat']) <= 90 && abs($locker['lng']) <= 180)
-            ->values();
-
-        return response()->json(['lockers' => $lockers]);
-    }
-
-    /**
-     * Persists the shopper's chosen locker (radio/select change, same
-     * autosave shape as selectShippingOption()) via
-     * CheckoutService::selectBoxNowLocker() onto the cart's shipping
-     * address meta.
-     */
-    public function selectBoxNowLocker(string $locale, Request $request): JsonResponse
-    {
-        $locationId = (string) $request->input('locker_id');
-
-        if ($locationId === '') {
-            return response()->json(['errors' => ['locker_id' => __('checkout.page.box_now_locker_required')]], 422);
-        }
-
-        try {
-            $this->checkout->selectBoxNowLocker([
-                'locationId' => $locationId,
-                'name' => (string) $request->input('locker_name'),
-                'addressLine1' => (string) $request->input('locker_address'),
-            ]);
-        } catch (NoShippingAddressException) {
-            return response()->json(['errors' => ['locker_id' => __('checkout.page.box_now_locker_required')]], 422);
-        }
-
-        return response()->json(['ok' => true]);
-    }
-
-    /**
-     * Autosave-select a payment method (radio change). Persists it via
-     * CheckoutService (which also records it on Cart::meta and re-snapshots
-     * the fingerprint) so ApplyCashOnDeliveryFee etc. show in the summary.
-     */
-    public function selectPaymentMethod(string $locale, Request $request): JsonResponse
-    {
-        $type = (string) $request->input('payment_type');
-
-        try {
-            $this->checkout->selectPaymentMethod($type);
-        } catch (UnknownPaymentTypeException) {
-            // Radio value out of sync with what's offered — ignore, the summary
-            // just won't reflect a method fee. place-order re-checks properly.
-        }
-
-        return response()->json([
-            'summaryHtml' => view('checkout::partials.cart-body')->render(),
-        ]);
-    }
-
-    /**
-     * The real submit — the hard gate. Re-selects the payment method (fresh
-     * fingerprint), then hands off to CheckoutService::initiatePayment(), which
-     * creates the draft order, records terms acceptance, and charges the driver.
-     * Returns JSON the bbk-payment controller routes on:
-     *   { redirect }                       — placed, go to confirmation
-     *   { status: 'pending', clientSecret }— 3-D Secure; client does handleNextAction then polls
-     *   { status: 'failed', message }      — declined
-     *   { status: 'invalid'|'stale', ... } — cart incomplete / changed since selection
-     */
-    public function placeOrder(string $locale, Request $request): JsonResponse
-    {
-        if (! $request->boolean('terms_accepted')) {
-            return response()->json(['error' => __('checkout.page.terms_required')], 422);
-        }
-
-        try {
-            $this->checkout->selectPaymentMethod((string) $request->input('payment_type'));
-        } catch (UnknownPaymentTypeException) {
-            return response()->json(['error' => __('checkout.page.choose_payment_method')], 422);
-        }
-
-        $cart = $this->cart->current();
-
-        // The one incomplete-cart case worth a specific message + pointing the
-        // shopper at the right section: a region resolving 2+ methods needs an
-        // explicit pick (no auto-select), easy to miss since nothing else on
-        // the page demands it. Everything else CartException catches below.
-        if ($cart?->shippingAddress && ! $cart->shippingAddress->shipping_option) {
-            return response()->json([
-                'status' => 'invalid',
-                'message' => __('checkout.page.shipping_method_required'),
-                'field' => 'shipping_option',
-            ], 422);
-        }
-
-        $fingerprint = (string) ($cart?->meta['checkout_fingerprint'] ?? '');
-
-        $data = $request->filled('payment_method')
-            ? ['payment_method' => (string) $request->input('payment_method')]
-            : [];
-
-        try {
-            $result = $this->checkout->initiatePayment(
-                $fingerprint,
-                termsAccepted: true,
-                policyVersion: (string) config('legal.terms_version'),
-                data: $data,
-            );
-        } catch (FingerprintMismatchException) {
-            return response()->json(['status' => 'stale', 'message' => __('checkout.page.payment_cart_changed')], 409);
-        } catch (CartException $e) {
-            return response()->json([
-                'status' => 'invalid',
-                'message' => __('checkout.page.payment_incomplete_details'),
-                'errors' => collect($e->errors()->toArray())->map(fn ($m) => is_array($m) ? ($m[0] ?? null) : $m)->all(),
-            ], 422);
-        } catch (TermsNotAcceptedException) {
-            return response()->json(['error' => __('checkout.page.terms_required')], 422);
-        }
-
-        return match ($result->status) {
-            PaymentResultStatus::Succeeded => $this->orderPlacedResponse($locale),
-            PaymentResultStatus::Pending => response()->json([
-                'status' => 'pending',
-                'clientSecret' => $result->continuation?->value,
-            ]),
-            PaymentResultStatus::Failed => response()->json([
-                'status' => 'failed',
-                'message' => $result->failureReason ?: __('checkout.page.payment_failed'),
-                'retriable' => $result->retriable,
-            ], 422),
-        };
-    }
-
-    /**
-     * Poll target for the 3-D Secure path: has the webhook placed the order yet?
-     * boboko-core's StripeWebhookController -> handleCallback -> PaymentCaptured
-     * -> ApplyResolvedPaymentStatus sets placed_at.
-     */
-    public function orderStatus(string $locale): JsonResponse
-    {
-        $order = $this->placedOrder();
-
-        if (! $order) {
-            return response()->json(['placed' => false]);
-        }
-
-        session(['checkout.order_id' => $order->id]);
-        CartSession::forget();
-
-        return response()->json(['placed' => true, 'redirect' => route('checkout.confirmation', $locale)]);
-    }
-
-    public function confirmation(string $locale): View|RedirectResponse
-    {
-        $orderId = session('checkout.order_id');
-
-        $order = $orderId
-            ? Order::with(['lines', 'shippingAddress', 'billingAddress'])->find($orderId)
-            : null;
-
-        if (! $order) {
-            return redirect()->route('products', $locale);
-        }
-
-        return view('checkout::confirmation', ['order' => $order]);
-    }
-
-    private function orderPlacedResponse(string $locale): JsonResponse
-    {
-        if ($order = $this->placedOrder()) {
-            session(['checkout.order_id' => $order->id]);
-        }
-
-        CartSession::forget();
-
-        return response()->json(['redirect' => route('checkout.confirmation', $locale)]);
-    }
-
-    private function placedOrder(): ?Order
-    {
-        return $this->cart->current()
-            ?->orders()
-            ->whereNotNull('placed_at')
-            ->latest('placed_at')
-            ->first();
-    }
-
-    /**
-     * Re-resolve shipping options for the cart's current address and keep the
-     * selection sane: auto-select when exactly one resolves, or carry a
-     * previous pick forward when it's still among the resolved options.
-     *
-     * $previousOption must be captured by the CALLER before setShippingAddress()
-     * runs — Lunar's AddAddress action always deletes and recreates the
-     * CartAddress row on every save (see saveAddress()), so by the time this
-     * runs, $address->shipping_option is unconditionally null regardless of
-     * what was selected a moment ago. There is nothing meaningful left to read
-     * off $address itself; $previousOption is the only source of truth for
-     * "what was chosen before this save wiped the row." show() passes the
-     * address's own (not-just-wiped) current value, since nothing recreated
-     * anything in that path.
-     *
-     * Always (re-)applies the resolved target via selectShippingOption() rather
-     * than comparing against the (always-blank, post-recreation) current value
-     * — the fresh row needs the write regardless of whether the decision
-     * "which option" actually changed.
-     *
-     * @return Collection<int, \Lunar\DataTypes\ShippingOption>
-     */
-    private function syncShipping(Cart $cart, ?string $previousOption): Collection
-    {
-        if (! $cart->shippingAddress) {
-            return collect();
-        }
-
-        $options = $this->checkout->getShippingOptions();
-
-        $target = match (true) {
-            $options->count() === 1 => $options->first()->identifier,
-            $previousOption !== null && $options->contains(fn ($option) => $option->identifier === $previousOption) => $previousOption,
-            default => null,
-        };
-
-        if ($target !== null) {
-            try {
-                $this->checkout->selectShippingOption($target);
-            } catch (InvalidShippingOptionException) {
-                // $target came from $options itself — shouldn't happen, stay defensive
-            }
-        }
-
-        return $options;
-    }
-
-    /**
-     * $options === null means "nothing money-relevant changed" — acknowledge the
-     * save (and any field errors) without re-rendering the shipping options or
-     * the order summary, so a plain name/phone edit is a cheap round-trip.
-     */
-    private function fragments(?Cart $cart, ?Collection $options, array $errors = []): JsonResponse
-    {
-        return response()->json([
-            'errors' => collect($errors)
-                ->map(fn ($messages) => is_array($messages) ? ($messages[0] ?? null) : $messages)
-                ->all(),
-            'shippingOptionsHtml' => $options === null ? null : view('checkout::partials.shipping-options', [
-                'shippingAddress' => $cart?->shippingAddress,
-                'shippingOptions' => $options,
-            ])->render(),
-            // Composer (CheckoutModuleServiceProvider) fills $cart / $lines.
-            'summaryHtml' => $options === null ? null : view('checkout::partials.cart-body')->render(),
-        ]);
-    }
-
-    private function storeCountry(): ?Country
-    {
-        if (self::STORE_COUNTRY_ISO3 === null) {
-            return null;
-        }
-
-        return Country::where('iso3', self::STORE_COUNTRY_ISO3)->first();
-    }
-}

app/Http/Controllers/ContactController.php

@@ -2,10 +2,71 @@
 
 namespace App\Http\Controllers;
 
+use App\Http\Requests\ContactRequest;
+use App\Mail\ContactConfirmationMail;
+use App\Mail\ContactMessageMail;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\View\View;
+use Throwable;
+
+/**
+ * Contact form. Nothing is stored: the message is emailed to the store
+ * (CONTACT_EMAIL) and the sender gets a generic confirmation. Both are sent
+ * synchronously so a failed store email can be reported back on the form.
+ *
+ * Limited per IP in here rather than with throttle middleware, so the limit
+ * shows as a message on the form instead of a bare 429 page.
+ */
 class ContactController extends Controller
 {
-    public function index(string $locale)
+    private const SEND_LIMIT = 3;
+    private const SEND_DECAY_SECONDS = 600;
+
+    public function index(string $locale): View
     {
         return view('contact');
     }
+
+    public function send(string $locale, ContactRequest $request): RedirectResponse
+    {
+        $key = 'contact:'.$request->ip();
+
+        if (RateLimiter::tooManyAttempts($key, self::SEND_LIMIT)) {
+            return back()->withInput()->with('contact_error', __('storefront.contact.too_many'));
+        }
+
+        RateLimiter::hit($key, self::SEND_DECAY_SECONDS);
+
+        $data = $request->validated();
+        $to = config('services.contact.email');
+
+        try {
+            if (blank($to)) {
+                throw new \RuntimeException('CONTACT_EMAIL is not set.');
+            }
+
+            Mail::to($to)->send(new ContactMessageMail(
+                $data['name'],
+                $data['email'],
+                $data['message'],
+                $locale,
+            ));
+        } catch (Throwable $e) {
+            Log::error('Contact form: store email failed', ['exception' => $e]);
+
+            return back()->withInput()->with('contact_error', __('storefront.contact.send_failed'));
+        }
+
+        // The store already has the message, so a failed confirmation is only logged.
+        try {
+            Mail::to($data['email'])->locale($locale)->send(new ContactConfirmationMail);
+        } catch (Throwable $e) {
+            Log::warning('Contact form: confirmation email failed', ['exception' => $e]);
+        }
+
+        return redirect()->route('contact')->with('status', __('storefront.contact.sent'));
+    }
 }

app/Http/Controllers/CustomFieldUploadController.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Modules\Core\File\Http\Controllers\UploadFileController;
+
+/**
+ * Stores the shopper's photo for a product custom field of type `file` (see
+ * boboko-core's Product::$custom_fields) the moment it's picked on the product
+ * page — before add-to-cart, see custom-field-upload-controller.js.
+ *
+ * Which files are acceptable (extensions, size) is a per-site decision — this
+ * site: photographs — so it lives here as this app's own policy, extending
+ * boboko-core's Modules\Core\File\Http\Controllers\UploadFileController for
+ * the actual store()/validate()/respond() mechanics. The module's add-to-cart
+ * endpoint only ever receives the stored File row's own `id` — FileService is
+ * the single source of truth for disk/path/name/mime, never duplicated into
+ * cart/order line meta (see Checkout\CartController::customFieldsMeta()). A
+ * shopper can't point a cart line at someone else's file: CartController only
+ * accepts an id that is both unowned and tagged with this exact PURPOSE.
+ *
+ * Stored on the private `local` disk: these are customers' personal photos,
+ * never reachable by a public URL except through FileService's own signed
+ * download route. Uploads nobody adds to a cart are removed by core's
+ * `boboko:file:prune-unowned custom-field-upload` command.
+ */
+class CustomFieldUploadController extends UploadFileController
+{
+    public const PURPOSE = 'custom-field-upload';
+
+    public const MAX_KILOBYTES = 10240;
+
+    public const EXTENSIONS = ['jpg', 'jpeg', 'png', 'webp', 'heic', 'heif'];
+
+    /**
+     * For the file input's `accept` attribute — same list the server enforces.
+     */
+    public static function accept(): string
+    {
+        return '.'.implode(',.', self::EXTENSIONS);
+    }
+
+    protected function purpose(): string
+    {
+        return self::PURPOSE;
+    }
+
+    protected function validationRules(Request $request): array
+    {
+        return [
+            'file' => ['required', 'file', 'mimes:'.implode(',', self::EXTENSIONS), 'max:'.self::MAX_KILOBYTES],
+        ];
+    }
+
+    // `label` is the admin-authored field label, only used as the
+    // :attribute in the validation message shown next to that field.
+    protected function validationAttributes(Request $request): array
+    {
+        return ['file' => (string) $request->input('label', 'file')];
+    }
+}

app/Http/Controllers/ProductController.php

@@ -4,8 +4,15 @@
 
 use App\Catalog\ProductListing;
 use App\Catalog\ProductListingPage;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Validator;
+use Lunar\Models\Product;
+use Lunar\Models\ProductVariant;
 use Modules\Core\Catalog\Services\ProductService;
+use Modules\Core\Review\Models\ProductReview;
 
 class ProductController extends Controller
 {
@@ -35,18 +42,208 @@ public function show(string $locale, int $id)
         $product = $this->products->getById($id);
         abort_if($product === null, Response::HTTP_NOT_FOUND);
 
+        $product = $this->mergeJustSubmittedReview($product);
+
         $collection = $product['collections'][0] ?? null;
-
-        $variantsData = $this->products->variantSummaries($product);
-
-        $firstVariant = $product['variants'][0] ?? null;
-        $option = $firstVariant['options'][0]['option'] ?? null;
+        // dd($product);
+        [$productOptions, $variantsData] = $this->buildOptionPicker($id);
 
         return view('product.show', [
             'collection' => $collection,
             'product' => $product,
-            'option' => $option,
+            'productOptions' => $productOptions,
             'variantsData' => $variantsData,
         ]);
     }
+
+    /**
+     * One button/swatch group per product option (a product can have several
+     * — e.g. a custom-photo product with size + style + person-count, each
+     * combination resolved client-side to one exact ProductVariant, see
+     * product-form-controller.js) plus the per-variant data the picker
+     * resolves a selection against.
+     *
+     * Reads live Eloquent rather than the Meilisearch-indexed $product array
+     * the rest of the page uses (same reasoning as checkStock() below): the
+     * index has no concept of option/value display order (Lunar's
+     * `position` column) or a stable value id, both of which the picker
+     * needs — to render values in the merchant's intended order, and to
+     * match a combination back to one exact variant without relying on
+     * translated label strings staying unique.
+     *
+     * @return array{0: array, 1: array}
+     */
+    private function buildOptionPicker(int $productId): array
+    {
+        $variants = ProductVariant::query()
+            ->where('product_id', $productId)
+            ->with(['values.option', 'prices', 'images'])
+            ->get();
+
+        $productOptions = $variants
+            ->flatMap(fn (ProductVariant $variant) => $variant->values)
+            ->unique('id')
+            ->groupBy(fn ($value) => $value->option->handle)
+            ->map(function ($values, $handle) {
+                $sorted = $values->sortBy([['position', 'asc'], ['id', 'asc']]);
+
+                return [
+                    'handle' => $handle,
+                    'label' => $sorted->first()->option->translate('name'),
+                    // The "Color" option type is the only one that writes a
+                    // hex code into meta (see boboko/core's ColorOptionType)
+                    // — its presence is how we tell a color option (swatches)
+                    // from any other option (buttons).
+                    'isColor' => $sorted->contains(fn ($v) => !empty($v->meta['hex'] ?? null)),
+                    'values' => $sorted->map(fn ($v) => [
+                        'id' => $v->id,
+                        'label' => $v->translate('name'),
+                        'hex' => $v->meta['hex'] ?? null,
+                    ])->values()->all(),
+                ];
+            })
+            ->values()
+            ->all();
+
+        $variantsData = $variants->map(fn (ProductVariant $variant) => [
+            'id' => $variant->id,
+            'price' => $variant->prices->first()?->price?->decimal(),
+            'image' => $variant->images->first()?->getUrl(),
+            // Live from the DB (not the index's in_stock), with Lunar's own
+            // purchasability rule — drives the disabled add-to-cart button.
+            'inStock' => $variant->canBeFulfilledAtQuantity(1),
+            // handle => selected value id, for matching a combination of
+            // selections back to this variant — see selectVariant() in
+            // product-form-controller.js.
+            'options' => $variant->values->mapWithKeys(fn ($v) => [$v->option->handle => $v->id])->all(),
+        ])->values()->all();
+
+        return [$productOptions, $variantsData];
+    }
+
+    /**
+     * Meilisearch's own write API is itself async — addDocuments() enqueues an
+     * indexing task and returns immediately, and Laravel\Scout\Engines\
+     * MeilisearchEngine::update() never waits on that task, so even
+     * $product->searchableSync() (which only skips OUR queue) can still land
+     * the shopper back on this page before Meilisearch has actually processed
+     * the write. storeReview() flashes the review it just created for exactly
+     * this one next request; splice it in here rather than trust the index is
+     * already caught up. Guarded by id so a race the other way — the index
+     * DID catch up in time — doesn't show the same review twice.
+     */
+    private function mergeJustSubmittedReview(array $product): array
+    {
+        $justSubmitted = session('justSubmittedReview');
+
+        if (! $justSubmitted || (string) ($justSubmitted['product_id'] ?? null) !== (string) $product['id']) {
+            return $product;
+        }
+
+        $items = $product['reviews']['items'] ?? [];
+
+        if (collect($items)->contains('id', $justSubmitted['id'])) {
+            return $product;
+        }
+
+        $items = [$justSubmitted, ...$items];
+
+        $product['reviews']['items'] = $items;
+        $product['reviews']['count'] = count($items);
+        $product['reviews']['average_rating'] = round(collect($items)->avg('rating'), 1);
+
+        return $product;
+    }
+
+    /**
+     * A storefront-owned, checkout-module-independent stock check — the
+     * product page's "Add to cart" calls this first and only submits to the
+     * checkout module's own add-to-cart endpoint once this says `ok`. Reads
+     * the live Eloquent ProductVariant directly (not the Meilisearch index
+     * ProductService otherwise reads from, which can lag behind an actual
+     * sale until the next reindex) via the SAME method Lunar's own
+     * CartLineStock validator calls, so this can never disagree with what
+     * the module's own server-side check would decide.
+     */
+    public function checkStock(string $locale, Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'variant' => ['required', 'integer'],
+            'quantity' => ['nullable', 'integer', 'min:1'],
+        ]);
+
+        $variant = ProductVariant::find($data['variant']);
+        $quantity = $data['quantity'] ?? 1;
+
+        if ($variant === null) {
+            return response()->json(['ok' => true]);
+        }
+
+        return response()->json([
+            'ok' => $variant->canBeFulfilledAtQuantity($quantity),
+            'stock' => $variant->purchasable === 'always' ? null : $variant->getTotalInventory(),
+        ]);
+    }
+
+    /**
+     * boboko/core's product_reviews table has no moderation/status column, so
+     * this goes live immediately — no approval queue to land in.
+     */
+    public function storeReview(string $locale, Request $request, Product $product): RedirectResponse
+    {
+        $reviewsUrl = route('product.show', [
+            'locale' => $locale,
+            'id' => $product->id,
+            'tab' => 'reviews',
+        ]).'#product-tabs';
+
+        $validator = Validator::make($request->all(), [
+            'rating' => ['required', 'integer', 'between:1,5'],
+            'content' => ['required', 'string'],
+            'name' => ['nullable', 'string', 'max:255'],
+            'email' => ['required', 'email'],
+        ]);
+
+        if ($validator->fails()) {
+            return redirect($reviewsUrl)->withErrors($validator)->withInput();
+        }
+
+        $data = $validator->validated();
+
+        // Not $product->reviews()->create(...): that relation only exists via a
+        // Product::macro() registered in CorePlugin::register(Panel $panel), which
+        // Filament calls solely when the /boboko admin panel boots — never on a
+        // plain storefront request, where the macro is simply undefined.
+        $review = ProductReview::create([
+            'product_id' => $product->id,
+            'rating' => $data['rating'],
+            'body' => $data['content'],
+            'reviewer_name' => $data['name'] ?? null,
+            'reviewer_email' => $data['email'],
+            'reviewed_at' => now(),
+            'source' => 'storefront',
+        ]);
+
+        // ReviewServiceProvider also reindexes on the model's `created` event, but
+        // queued (SCOUT_QUEUE=true) — it wouldn't land before this redirect's page
+        // load. Syncing here skips our queue too, but Meilisearch's own write API
+        // is itself async on top of that (see mergeJustSubmittedReview()), so this
+        // alone still isn't a guarantee — it's the flash below that actually is.
+        $product->searchableSync();
+
+        return redirect($reviewsUrl)
+            ->with('reviewSubmitted', true)
+            ->with('justSubmittedReview', [
+                'id' => $review->id,
+                'product_id' => $review->product_id,
+                'title' => $review->title,
+                'body' => $review->body,
+                'rating' => $review->rating,
+                'reviewed_at' => $review->reviewed_at?->timestamp,
+                'reviewer_name' => $review->reviewer_name,
+                'reply' => null,
+                'replied_at' => null,
+                'media' => [],
+            ]);
+    }
 }

app/Http/Controllers/WishlistController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Catalog\ProductCard;
+use App\Services\Wishlist;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+use Illuminate\View\View;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Services\ProductService;
+
+class WishlistController extends Controller
+{
+    public function __construct(
+        private readonly Wishlist $wishlist,
+    ) {}
+
+    /**
+     * The account's wishlist page.
+     */
+    public function index(string $locale, ProductService $products): View
+    {
+        return view('account.wishlist', ['products' => $this->products($products)]);
+    }
+
+    /**
+     * The same list for a guest, from their cookie. Logged-in users are sent
+     * to the account version.
+     */
+    public function guest(string $locale, ProductService $products): View|RedirectResponse
+    {
+        if (auth()->check()) {
+            return redirect()->route('account.wishlist');
+        }
+
+        return view('wishlist.guest', ['products' => $this->products($products)]);
+    }
+
+    /**
+     * Adds or removes a product, for guests and logged-in shoppers alike. The
+     * heart button's Stimulus controller asks for JSON; without JS the form
+     * posts normally and comes back to the same page.
+     */
+    public function toggle(string $locale, Request $request, int $productId): JsonResponse|RedirectResponse
+    {
+        abort_unless(Product::whereKey($productId)->exists(), 404);
+
+        $active = $this->wishlist->toggle($productId);
+
+        if ($request->expectsJson()) {
+            return response()->json(['active' => $active]);
+        }
+
+        return back();
+    }
+
+    /**
+     * Product cards for the current wishlist, newest first. Products no longer
+     * in the search index (deleted, unpublished) are simply skipped.
+     */
+    private function products(ProductService $products): Collection
+    {
+        return collect($this->wishlist->ids())
+            ->map(fn (int $id) => $products->getById($id))
+            ->filter()
+            ->map(fn (array $product) => ['id' => $product['id'], ...ProductCard::fromIndexed($product)])
+            ->values();
+    }
+}

app/Http/Requests/ContactRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Rules\HCaptcha;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ContactRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'email' => ['required', 'email', 'max:255'],
+            'message' => ['required', 'string', 'max:5000'],
+            'h-captcha-response' => ['bail', 'required', new HCaptcha],
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'h-captcha-response.required' => __('storefront.auth.captcha_failed'),
+        ];
+    }
+}

app/Listeners/MergeGuestWishlistOnLogin.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Services\Wishlist;
+use Modules\Core\Auth\Events\UserAuthenticated;
+
+/**
+ * Picked up by Laravel's listener discovery (app/Listeners), no manual
+ * registration. Runs inside the login request, so it can read the guest
+ * wishlist cookie and queue its removal.
+ */
+class MergeGuestWishlistOnLogin
+{
+    public function __construct(
+        private readonly Wishlist $wishlist,
+    ) {}
+
+    public function handle(UserAuthenticated $event): void
+    {
+        $this->wishlist->mergeGuestInto($event->user);
+    }
+}

app/Listeners/SaveAddressFromFirstOrder.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Listeners;
+
+use Lunar\Models\Order;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Customer\Services\CustomerAccountService;
+
+/**
+ * When a logged-in shopper places an order and their account has no saved
+ * address yet, the order's shipping address (and their name, if the profile
+ * has none) becomes the account's. Never overwrites anything already saved.
+ *
+ * Uses the order's own user, not Auth: OrderPlaced can fire from a payment
+ * webhook, where nobody is logged in. Picked up by listener discovery.
+ */
+class SaveAddressFromFirstOrder
+{
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function handle(OrderPlaced $event): void
+    {
+        $order = $event->order;
+        $user = $order->user;
+        $shipping = $order->shippingAddress;
+
+        if (! $user || ! $shipping || ! $shipping->line_one) {
+            return;
+        }
+
+        $customer = $this->account->customer($user);
+
+        if (! $customer) {
+            return;
+        }
+
+        if (! $customer->first_name && ! $customer->last_name) {
+            $this->account->updateProfile($user, [
+                'first_name' => $shipping->first_name,
+                'last_name' => $shipping->last_name,
+            ]);
+        }
+
+        if (collect($this->account->addresses($user))->isNotEmpty()) {
+            return;
+        }
+
+        $this->account->createAddress($user, [
+            ...$shipping->only(['first_name', 'last_name', 'line_one', 'city', 'state', 'postcode', 'country_id', 'contact_phone']),
+            'contact_email' => $user->email,
+            'shipping_default' => true,
+            'billing_default' => true,
+        ]);
+    }
+}

app/Mail/ContactConfirmationMail.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * Sent to whoever submitted the contact form. Deliberately generic: it never
+ * repeats what they wrote, so the form can't be used to deliver arbitrary text
+ * to someone else's inbox.
+ */
+class ContactConfirmationMail extends Mailable
+{
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: __('storefront.contact.confirmation_subject'));
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'emails.contact-confirmation');
+    }
+}

app/Mail/ContactMessageMail.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Address;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * A contact-form message, sent to the store's CONTACT_EMAIL. Reply-To is the
+ * sender, so replying from the inbox goes straight to them.
+ */
+class ContactMessageMail extends Mailable
+{
+    public function __construct(
+        public readonly string $senderName,
+        public readonly string $senderEmail,
+        public readonly string $body,
+        public readonly string $senderLocale,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            replyTo: [new Address($this->senderEmail, $this->senderName)],
+            subject: "Νέο μήνυμα επικοινωνίας από {$this->senderName}",
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'emails.contact-message');
+    }
+}

app/Models/WishlistItem.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * One product on a logged-in user's wishlist. Guests' wishlists live in a
+ * cookie instead — see App\Services\Wishlist.
+ */
+class WishlistItem extends Model
+{
+    protected $fillable = ['user_id', 'product_id'];
+}

app/Providers/AppServiceProvider.php

@@ -17,6 +17,13 @@
 
 class AppServiceProvider extends ServiceProvider
 {
+    public function register(): void
+    {
+        // One instance per request: it caches the guest cookie's ids, so a
+        // toggle and a later has() in the same request agree.
+        $this->app->scoped(\App\Services\Wishlist::class);
+    }
+
     public function boot(): void
     {
         Telemetry::optOut();

app/Providers/CheckoutModuleServiceProvider.php

@@ -1,53 +0,0 @@
-<?php
-
-namespace App\Providers;
-
-use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\Route;
-use Illuminate\Support\Facades\View;
-use Illuminate\Support\ServiceProvider;
-use Illuminate\View\View as ViewInstance;
-use Modules\Core\Cart\Services\CartService;
-
-/**
- * The seam for the (currently in-repo) cart + checkout module.
- *
- * Everything the module needs to boot inside a host app lives here: its view /
- * component namespaces, its routes, and the composer that feeds the
- * always-present cart drawer. Strings (__('checkout.cart.*')) are NOT wired up
- * here — same as storefront.* elsewhere in this app, they resolve through
- * Lunar's DB-backed translation UI (spatie/laravel-translation-loader), added
- * manually there rather than shipped as lang/ files. The module's own files
- * (resources/views/checkout/**, resources/js/checkout/**, resources/css/checkout.css,
- * routes/checkout.php, app/Http/Controllers/Checkout/**) contain nothing
- * 3dealer-specific.
- *
- * When the module is extracted to boboko-core, this class is deleted and its
- * body becomes the package's own ServiceProvider. The only other host wiring
- * is the one registerCheckout() call in resources/js/app.js and the two lines
- * in the layout (the checkout.css @vite entry and @include('checkout::drawer')).
- */
-class CheckoutModuleServiceProvider extends ServiceProvider
-{
-    public function boot(): void
-    {
-        $this->loadViewsFrom(resource_path('views/checkout'), 'checkout');
-        Blade::anonymousComponentNamespace('checkout::components', 'checkout');
-
-        Route::middleware('web')->group(base_path('routes/checkout.php'));
-
-        // The drawer is rendered on every page (from the layout) and its body
-        // partial is re-rendered on every cart mutation — both need the current
-        // cart without a controller in the loop.
-        View::composer(
-            ['checkout::drawer', 'checkout::partials.cart-body'],
-            function (ViewInstance $view) {
-                $service = app(CartService::class);
-                $cart = $service->current();
-
-                $view->with('cart', $cart);
-                $view->with('lines', $cart ? $service->activeLines($cart) : collect());
-            },
-        );
-    }
-}

app/Rules/HCaptcha.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Verifies the `h-captcha-response` token the hCaptcha widget adds to a form.
+ * Use it as `'h-captcha-response' => ['required', new HCaptcha]`.
+ *
+ * Fails closed: if hCaptcha can't be reached the submission is rejected, since
+ * letting it through would reopen the hole this exists to close (bots making
+ * us send email to arbitrary addresses).
+ */
+class HCaptcha implements ValidationRule
+{
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (! is_string($value) || $value === '') {
+            $fail(__('storefront.auth.captcha_failed'));
+
+            return;
+        }
+
+        try {
+            $response = Http::asForm()
+                ->timeout(5)
+                ->post('https://api.hcaptcha.com/siteverify', [
+                    'secret' => config('services.hcaptcha.secret'),
+                    'response' => $value,
+                    // Rejects tokens solved against someone else's sitekey.
+                    'sitekey' => config('services.hcaptcha.sitekey'),
+                    'remoteip' => request()->ip(),
+                ]);
+        } catch (ConnectionException $e) {
+            Log::warning('hCaptcha siteverify unreachable', ['error' => $e->getMessage()]);
+            $fail(__('storefront.auth.captcha_failed'));
+
+            return;
+        }
+
+        if (! $response->successful() || $response->json('success') !== true) {
+            // A bad/missing secret or sitekey would otherwise look like every
+            // shopper failing the captcha.
+            $configErrors = array_intersect((array) $response->json('error-codes'), [
+                'missing-input-secret',
+                'invalid-input-secret',
+                'sitekey-secret-mismatch',
+                'invalid-sitekey',
+            ]);
+
+            if ($response->failed() || $configErrors) {
+                Log::warning('hCaptcha siteverify error', [
+                    'status' => $response->status(),
+                    'error-codes' => $response->json('error-codes'),
+                ]);
+            }
+
+            $fail(__('storefront.auth.captcha_failed'));
+        }
+    }
+}

app/Services/Wishlist.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\WishlistItem;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cookie;
+
+/**
+ * The current shopper's wishlist, product ids only.
+ *
+ * Logged in: rows in wishlist_items. Guest: a 1-year cookie holding the ids
+ * (encrypted like every cookie, by the web group's EncryptCookies), so nothing
+ * is written to the database for anonymous visitors. On login the cookie is
+ * merged into the account and cleared (MergeGuestWishlistOnLogin).
+ */
+class Wishlist
+{
+    public const COOKIE = 'wishlist';
+
+    private const COOKIE_MINUTES = 60 * 24 * 365;
+
+    // Keeps the cookie well under the 4KB browser limit.
+    private const GUEST_MAX = 100;
+
+    /** @var array<int>|null ids for this request, including a toggle just made */
+    private ?array $guestIds = null;
+
+    /** @return array<int> newest first */
+    public function ids(): array
+    {
+        if ($user = Auth::user()) {
+            return WishlistItem::where('user_id', $user->id)
+                ->latest('id')
+                ->pluck('product_id')
+                ->all();
+        }
+
+        return $this->guestIds();
+    }
+
+    public function has(int $productId): bool
+    {
+        return in_array($productId, $this->ids(), true);
+    }
+
+    /**
+     * @return bool whether the product is on the wishlist afterwards
+     */
+    public function toggle(int $productId): bool
+    {
+        if ($user = Auth::user()) {
+            $deleted = WishlistItem::where('user_id', $user->id)->where('product_id', $productId)->delete();
+
+            if ($deleted) {
+                return false;
+            }
+
+            WishlistItem::create(['user_id' => $user->id, 'product_id' => $productId]);
+
+            return true;
+        }
+
+        $ids = $this->guestIds();
+
+        if (in_array($productId, $ids, true)) {
+            $this->storeGuestIds(array_values(array_diff($ids, [$productId])));
+
+            return false;
+        }
+
+        $this->storeGuestIds(array_slice([$productId, ...$ids], 0, self::GUEST_MAX));
+
+        return true;
+    }
+
+    public function remove(int $productId): void
+    {
+        if ($this->has($productId)) {
+            $this->toggle($productId);
+        }
+    }
+
+    /**
+     * Moves the guest cookie's products onto $user's wishlist and clears it.
+     */
+    public function mergeGuestInto(Authenticatable $user): void
+    {
+        $ids = $this->guestIds();
+
+        if ($ids === []) {
+            return;
+        }
+
+        // Oldest first, so the newest cookie item also ends up newest here.
+        foreach (array_reverse($ids) as $productId) {
+            WishlistItem::firstOrCreate(['user_id' => $user->id, 'product_id' => $productId]);
+        }
+
+        $this->guestIds = [];
+        Cookie::queue(Cookie::forget(self::COOKIE));
+    }
+
+    /** @return array<int> */
+    private function guestIds(): array
+    {
+        if ($this->guestIds !== null) {
+            return $this->guestIds;
+        }
+
+        $decoded = json_decode((string) request()->cookie(self::COOKIE), true);
+
+        return $this->guestIds = is_array($decoded)
+            ? array_values(array_unique(array_filter(array_map('intval', $decoded))))
+            : [];
+    }
+
+    /** @param  array<int>  $ids */
+    private function storeGuestIds(array $ids): void
+    {
+        $this->guestIds = $ids;
+
+        Cookie::queue(self::COOKIE, json_encode($ids), self::COOKIE_MINUTES);
+    }
+}

bootstrap/app.php

@@ -11,7 +11,18 @@
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        // Laravel's priority list would otherwise run `auth` before core's
+        // `locale` middleware, so the redirects below would build URLs before
+        // URL::defaults(['locale' => …]) is set, throwing a missing-parameter error.
+        $middleware->prependToPriorityList(
+            before: \Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests::class,
+            prepend: \Modules\Core\Localization\Middleware\LocaleMiddleware::class,
+        );
+
+        // Both resolve inside the {locale} group, after the `locale` middleware
+        // has set URL::defaults(['locale' => …]), so route() needs no locale arg.
+        $middleware->redirectGuestsTo(fn () => route('login'));
+        $middleware->redirectUsersTo(fn () => route('home'));
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //

bootstrap/providers.php

@@ -1,11 +1,9 @@
 <?php
 
 use App\Providers\AppServiceProvider;
-use App\Providers\CheckoutModuleServiceProvider;
 use App\Providers\PanelServiceProvider;
 
 return [
     AppServiceProvider::class,
     PanelServiceProvider::class,
-    CheckoutModuleServiceProvider::class,
 ];

composer.lock

@@ -515,11 +515,11 @@
         },
         {
             "name": "boboko/core",
-            "version": "0.17.1",
+            "version": "0.22.0",
             "source": {
                 "type": "git",
                 "url": "https://code.radical-elements.com/boboko/core.git",
-                "reference": "d9fb3bbde661bc8f49b3032462af029c5983b03a"
+                "reference": "985f53efa2d34849f35c8e0f4129f861be762e76"
             },
             "require": {
                 "laravel/framework": "^12.0",
@@ -527,10 +527,10 @@
                 "lunarphp/lunar": "1.5.0",
                 "lunarphp/meilisearch": "*",
                 "lunarphp/search": "*",
-                "lunarphp/stripe": "^1.5",
                 "lunarphp/table-rate-shipping": "1.5.0",
                 "php": "^8.5",
                 "spatie/laravel-translation-loader": "^2.8",
+                "stripe/stripe-php": "^16.6",
                 "symfony/yaml": "^7.0"
             },
             "require-dev": {
@@ -557,8 +557,10 @@
                         "Modules\\Core\\Providers\\CatalogServiceProvider",
                         "Modules\\Core\\Providers\\CartServiceProvider",
                         "Modules\\Core\\Providers\\ReviewServiceProvider",
+                        "Modules\\Core\\Providers\\FileServiceProvider",
                         "Modules\\Core\\Providers\\ShippingServiceProvider",
-                        "Modules\\Core\\Providers\\OrderServiceProvider"
+                        "Modules\\Core\\Providers\\OrderServiceProvider",
+                        "Modules\\Core\\Providers\\PrivacyServiceProvider"
                     ]
                 }
             },
@@ -568,7 +570,7 @@
                 }
             },
             "description": "Core module — authentication and shared panel behaviour",
-            "time": "2026-09-15T13:12:03+00:00"
+            "time": "2026-09-25T12:58:41+00:00"
         },
         {
             "name": "brick/math",
@@ -934,16 +936,16 @@
         },
         {
             "name": "composer/semver",
-            "version": "3.4.4",
+            "version": "3.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/semver.git",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95"
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/semver/zipball/198166618906cb2de69b95d7d47e5fa8aa1b2b95",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95",
+                "url": "https://api.github.com/repos/composer/semver/zipball/f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
                 "shasum": ""
             },
             "require": {
@@ -985,7 +987,7 @@
                     "homepage": "http://robbast.nl"
                 }
             ],
-            "description": "Semver library that offers utilities, version constraint parsing and validation.",
+            "description": "Version comparison library that offers utilities, version constraint parsing and validation.",
             "keywords": [
                 "semantic",
                 "semver",
@@ -995,7 +997,7 @@
             "support": {
                 "irc": "ircs://irc.libera.chat:6697/composer",
                 "issues": "https://github.com/composer/semver/issues",
-                "source": "https://github.com/composer/semver/tree/3.4.4"
+                "source": "https://github.com/composer/semver/tree/3.5.0"
             },
             "funding": [
                 {
@@ -1007,7 +1009,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-08-20T19:15:30+00:00"
+            "time": "2026-09-24T14:38:51+00:00"
         },
         {
             "name": "danharrin/date-format-converter",
@@ -1062,16 +1064,16 @@
         },
         {
             "name": "danharrin/livewire-rate-limiting",
-            "version": "v2.2.1",
+            "version": "v2.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/danharrin/livewire-rate-limiting.git",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5"
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/69436717dc70e30f80d7f8fd02504c22992a9ad5",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5",
+                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
                 "shasum": ""
             },
             "require": {
@@ -1112,7 +1114,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-06T08:41:51+00:00"
+            "time": "2026-09-18T07:38:01+00:00"
         },
         {
             "name": "dflydev/dot-access-data",
@@ -1329,27 +1331,25 @@
         },
         {
             "name": "doctrine/lexer",
-            "version": "3.0.1",
+            "version": "3.0.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/doctrine/lexer.git",
-                "reference": "31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd"
+                "reference": "e96fe45e92a54233726014a7cc7340abf29bb14c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/doctrine/lexer/zipball/31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd",
-                "reference": "31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd",
+                "url": "https://api.github.com/repos/doctrine/lexer/zipball/e96fe45e92a54233726014a7cc7340abf29bb14c",
+                "reference": "e96fe45e92a54233726014a7cc7340abf29bb14c",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.1"
             },
             "require-dev": {
-                "doctrine/coding-standard": "^12",
-                "phpstan/phpstan": "^1.10",
-                "phpunit/phpunit": "^10.5",
-                "psalm/plugin-phpunit": "^0.18.3",
-                "vimeo/psalm": "^5.21"
+                "doctrine/coding-standard": "^14",
+                "phpstan/phpstan": "^2",
+                "phpunit/phpunit": "^10.5.58 || ^12.5.4"
             },
             "type": "library",
             "autoload": {
@@ -1386,7 +1386,7 @@
             ],
             "support": {
                 "issues": "https://github.com/doctrine/lexer/issues",
-                "source": "https://github.com/doctrine/lexer/tree/3.0.1"
+                "source": "https://github.com/doctrine/lexer/tree/3.0.2"
             },
             "funding": [
                 {
@@ -1402,7 +1402,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-02-05T11:56:58+00:00"
+            "time": "2026-06-14T20:44:06+00:00"
         },
         {
             "name": "dompdf/dompdf",
@@ -1692,16 +1692,16 @@
         },
         {
             "name": "filament/actions",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/actions.git",
-                "reference": "ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce"
+                "reference": "1eb39ac07f06302262cf6f5d77927bff1ed626fb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/actions/zipball/ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce",
-                "reference": "ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce",
+                "url": "https://api.github.com/repos/filamentphp/actions/zipball/1eb39ac07f06302262cf6f5d77927bff1ed626fb",
+                "reference": "1eb39ac07f06302262cf6f5d77927bff1ed626fb",
                 "shasum": ""
             },
             "require": {
@@ -1737,20 +1737,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:28+00:00"
+            "time": "2026-09-15T16:56:16+00:00"
         },
         {
             "name": "filament/filament",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/panels.git",
-                "reference": "8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a"
+                "reference": "1215d7d79b5609f66c1e432933610eefa0ab3ad6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/panels/zipball/8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a",
-                "reference": "8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a",
+                "url": "https://api.github.com/repos/filamentphp/panels/zipball/1215d7d79b5609f66c1e432933610eefa0ab3ad6",
+                "reference": "1215d7d79b5609f66c1e432933610eefa0ab3ad6",
                 "shasum": ""
             },
             "require": {
@@ -1795,20 +1795,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:21:27+00:00"
+            "time": "2026-09-20T19:15:07+00:00"
         },
         {
             "name": "filament/forms",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/forms.git",
-                "reference": "4da33a7be66aa238158816e439fa591aac0ac239"
+                "reference": "10d7ba430544ae706a406713105ba37b18f52008"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/forms/zipball/4da33a7be66aa238158816e439fa591aac0ac239",
-                "reference": "4da33a7be66aa238158816e439fa591aac0ac239",
+                "url": "https://api.github.com/repos/filamentphp/forms/zipball/10d7ba430544ae706a406713105ba37b18f52008",
+                "reference": "10d7ba430544ae706a406713105ba37b18f52008",
                 "shasum": ""
             },
             "require": {
@@ -1845,20 +1845,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:18:49+00:00"
+            "time": "2026-09-20T18:45:30+00:00"
         },
         {
             "name": "filament/infolists",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/infolists.git",
-                "reference": "638b0b37ce492594567e5819f99e2b0f43b3a69b"
+                "reference": "1979591422ff823543622b87e0276cdca3f863e8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/infolists/zipball/638b0b37ce492594567e5819f99e2b0f43b3a69b",
-                "reference": "638b0b37ce492594567e5819f99e2b0f43b3a69b",
+                "url": "https://api.github.com/repos/filamentphp/infolists/zipball/1979591422ff823543622b87e0276cdca3f863e8",
+                "reference": "1979591422ff823543622b87e0276cdca3f863e8",
                 "shasum": ""
             },
             "require": {
@@ -1890,20 +1890,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:32+00:00"
+            "time": "2026-09-20T18:45:56+00:00"
         },
         {
             "name": "filament/notifications",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/notifications.git",
-                "reference": "6279e7d1353b370cd4fa2dadaa245227c47add21"
+                "reference": "40989f93ec3dc36f5582024ca41f99333a4c0ea7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/notifications/zipball/6279e7d1353b370cd4fa2dadaa245227c47add21",
-                "reference": "6279e7d1353b370cd4fa2dadaa245227c47add21",
+                "url": "https://api.github.com/repos/filamentphp/notifications/zipball/40989f93ec3dc36f5582024ca41f99333a4c0ea7",
+                "reference": "40989f93ec3dc36f5582024ca41f99333a4c0ea7",
                 "shasum": ""
             },
             "require": {
@@ -1937,20 +1937,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:35:57+00:00"
+            "time": "2026-09-20T18:48:58+00:00"
         },
         {
             "name": "filament/query-builder",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/query-builder.git",
-                "reference": "d5c5c94cbede3a3d56855e5de173c0a35da2328e"
+                "reference": "0428645f4cd0a232b6bc446437cbfafa366e56c0"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/query-builder/zipball/d5c5c94cbede3a3d56855e5de173c0a35da2328e",
-                "reference": "d5c5c94cbede3a3d56855e5de173c0a35da2328e",
+                "url": "https://api.github.com/repos/filamentphp/query-builder/zipball/0428645f4cd0a232b6bc446437cbfafa366e56c0",
+                "reference": "0428645f4cd0a232b6bc446437cbfafa366e56c0",
                 "shasum": ""
             },
             "require": {
@@ -1983,20 +1983,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:00+00:00"
+            "time": "2026-09-20T18:53:32+00:00"
         },
         {
             "name": "filament/schemas",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/schemas.git",
-                "reference": "fec2747e8cf1e6ca76d6c883c7f1019da994f771"
+                "reference": "dc4eeb57671b104b9e60f6d3f435f803c705e6df"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/schemas/zipball/fec2747e8cf1e6ca76d6c883c7f1019da994f771",
-                "reference": "fec2747e8cf1e6ca76d6c883c7f1019da994f771",
+                "url": "https://api.github.com/repos/filamentphp/schemas/zipball/dc4eeb57671b104b9e60f6d3f435f803c705e6df",
+                "reference": "dc4eeb57671b104b9e60f6d3f435f803c705e6df",
                 "shasum": ""
             },
             "require": {
@@ -2028,11 +2028,11 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:20:09+00:00"
+            "time": "2026-09-20T18:49:21+00:00"
         },
         {
             "name": "filament/spatie-laravel-media-library-plugin",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/spatie-laravel-media-library-plugin.git",
@@ -2069,16 +2069,16 @@
         },
         {
             "name": "filament/support",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/support.git",
-                "reference": "73fc0fda6692ac878b9cc0255dd3288577a50cb6"
+                "reference": "6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/support/zipball/73fc0fda6692ac878b9cc0255dd3288577a50cb6",
-                "reference": "73fc0fda6692ac878b9cc0255dd3288577a50cb6",
+                "url": "https://api.github.com/repos/filamentphp/support/zipball/6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc",
+                "reference": "6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc",
                 "shasum": ""
             },
             "require": {
@@ -2124,20 +2124,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:12+00:00"
+            "time": "2026-09-20T19:14:52+00:00"
         },
         {
             "name": "filament/tables",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/tables.git",
-                "reference": "57662d3b2098e7d156ef507842d4ae98a892212b"
+                "reference": "8a0c6634d752e0b71ed0871f92d533c0d03d7601"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/tables/zipball/57662d3b2098e7d156ef507842d4ae98a892212b",
-                "reference": "57662d3b2098e7d156ef507842d4ae98a892212b",
+                "url": "https://api.github.com/repos/filamentphp/tables/zipball/8a0c6634d752e0b71ed0871f92d533c0d03d7601",
+                "reference": "8a0c6634d752e0b71ed0871f92d533c0d03d7601",
                 "shasum": ""
             },
             "require": {
@@ -2170,20 +2170,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:28+00:00"
+            "time": "2026-09-20T18:53:09+00:00"
         },
         {
             "name": "filament/widgets",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/widgets.git",
-                "reference": "3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1"
+                "reference": "5ec044730102c3444d019232d8edc3d8922876c6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/widgets/zipball/3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1",
-                "reference": "3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1",
+                "url": "https://api.github.com/repos/filamentphp/widgets/zipball/5ec044730102c3444d019232d8edc3d8922876c6",
+                "reference": "5ec044730102c3444d019232d8edc3d8922876c6",
                 "shasum": ""
             },
             "require": {
@@ -2214,7 +2214,7 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:33+00:00"
+            "time": "2026-09-20T18:53:38+00:00"
         },
         {
             "name": "fruitcake/php-cors",
@@ -2938,16 +2938,16 @@
         },
         {
             "name": "kirschbaum-development/eloquent-power-joins",
-            "version": "4.3.3",
+            "version": "4.3.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/kirschbaum-development/eloquent-power-joins.git",
-                "reference": "c609dbbe4ad2051b667e937f1ab554067519d64b"
+                "reference": "a0e6c0420c381861e1830693c4b74bdac7f7fb5f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/kirschbaum-development/eloquent-power-joins/zipball/c609dbbe4ad2051b667e937f1ab554067519d64b",
-                "reference": "c609dbbe4ad2051b667e937f1ab554067519d64b",
+                "url": "https://api.github.com/repos/kirschbaum-development/eloquent-power-joins/zipball/a0e6c0420c381861e1830693c4b74bdac7f7fb5f",
+                "reference": "a0e6c0420c381861e1830693c4b74bdac7f7fb5f",
                 "shasum": ""
             },
             "require": {
@@ -2995,9 +2995,9 @@
             ],
             "support": {
                 "issues": "https://github.com/kirschbaum-development/eloquent-power-joins/issues",
-                "source": "https://github.com/kirschbaum-development/eloquent-power-joins/tree/4.3.3"
+                "source": "https://github.com/kirschbaum-development/eloquent-power-joins/tree/4.3.4"
             },
-            "time": "2026-07-23T11:41:37+00:00"
+            "time": "2026-09-25T11:10:42+00:00"
         },
         {
             "name": "laravel/framework",
@@ -3362,16 +3362,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.0.16",
+            "version": "v2.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed"
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
-                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/2d5869a838bbcf37e0d8b0568fc41914e81374b5",
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5",
                 "shasum": ""
             },
             "require": {
@@ -3419,7 +3419,7 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2026-08-18T20:28:54+00:00"
+            "time": "2026-09-22T14:32:34+00:00"
         },
         {
             "name": "laravel/tinker",
@@ -3492,16 +3492,16 @@
         },
         {
             "name": "league/commonmark",
-            "version": "2.10.1",
+            "version": "2.10.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "9d489ab67a02960fd8ffe624d93f751daf95439e"
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/9d489ab67a02960fd8ffe624d93f751daf95439e",
-                "reference": "9d489ab67a02960fd8ffe624d93f751daf95439e",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/6efbd9c472b91db0a3350fcd601c8332c2382e1f",
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f",
                 "shasum": ""
             },
             "require": {
@@ -3595,7 +3595,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-09-07T13:44:26+00:00"
+            "time": "2026-09-21T13:07:34+00:00"
         },
         {
             "name": "league/config",
@@ -4757,68 +4757,6 @@
             },
             "time": "2026-08-26T14:50:54+00:00"
         },
-        {
-            "name": "lunarphp/stripe",
-            "version": "1.5.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/lunarphp/stripe.git",
-                "reference": "9c091d4f8f868966605f488e8d6a94c4af07f0bb"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/lunarphp/stripe/zipball/9c091d4f8f868966605f488e8d6a94c4af07f0bb",
-                "reference": "9c091d4f8f868966605f488e8d6a94c4af07f0bb",
-                "shasum": ""
-            },
-            "require": {
-                "lunarphp/core": "self.version",
-                "php": "^8.3",
-                "stripe/stripe-php": "^16.0"
-            },
-            "type": "project",
-            "extra": {
-                "lunar": {
-                    "name": "Stripe Payments"
-                },
-                "laravel": {
-                    "providers": [
-                        "Lunar\\Stripe\\StripePaymentsServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Lunar\\Stripe\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Lunar",
-                    "homepage": "https://lunarphp.io/"
-                }
-            ],
-            "description": "Stripe payment driver for Lunar.",
-            "keywords": [
-                "cart",
-                "e-commerce",
-                "ecommerce",
-                "headless",
-                "laravel",
-                "lunarphp",
-                "shop",
-                "store",
-                "stripe"
-            ],
-            "support": {
-                "source": "https://github.com/lunarphp/stripe/tree/1.5.0"
-            },
-            "time": "2026-08-26T14:51:06+00:00"
-        },
         {
             "name": "lunarphp/table-rate-shipping",
             "version": "1.5.0",
@@ -7906,20 +7844,20 @@
         },
         {
             "name": "ramsey/uuid",
-            "version": "4.9.3",
+            "version": "4.9.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ramsey/uuid.git",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8"
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ramsey/uuid/zipball/1df15849d00943a67d677dc9cfd80795f038c9f8",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8",
+                "url": "https://api.github.com/repos/ramsey/uuid/zipball/75d73f48d02797c2c285a7e9f348fadc0102ffe2",
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2",
                 "shasum": ""
             },
             "require": {
-                "brick/math": ">=0.8.16 <=0.18",
+                "brick/math": "^0.8.16 || ^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
                 "php": "^8.0",
                 "ramsey/collection": "^1.2 || ^2.0"
             },
@@ -7978,9 +7916,9 @@
             ],
             "support": {
                 "issues": "https://github.com/ramsey/uuid/issues",
-                "source": "https://github.com/ramsey/uuid/tree/4.9.3"
+                "source": "https://github.com/ramsey/uuid/tree/4.9.4"
             },
-            "time": "2026-06-18T03:57:49+00:00"
+            "time": "2026-09-16T11:39:30+00:00"
         },
         {
             "name": "ryangjchandler/blade-capture-directive",
@@ -8062,35 +8000,33 @@
         },
         {
             "name": "sabberworm/php-css-parser",
-            "version": "v9.4.0",
+            "version": "v9.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/MyIntervals/PHP-CSS-Parser.git",
-                "reference": "fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f"
+                "reference": "f284e63b6e891e0c28631e54ba06c3ed102a9ef3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/MyIntervals/PHP-CSS-Parser/zipball/fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f",
-                "reference": "fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f",
+                "url": "https://api.github.com/repos/MyIntervals/PHP-CSS-Parser/zipball/f284e63b6e891e0c28631e54ba06c3ed102a9ef3",
+                "reference": "f284e63b6e891e0c28631e54ba06c3ed102a9ef3",
                 "shasum": ""
             },
             "require": {
                 "ext-iconv": "*",
-                "php": "^7.2.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0",
-                "thecodingmachine/safe": "^1.3 || ^2.5 || ^3.4"
+                "php": "^7.2.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 || ~8.6.0"
             },
             "require-dev": {
                 "php-parallel-lint/php-parallel-lint": "1.4.0",
                 "phpstan/extension-installer": "1.4.3",
-                "phpstan/phpstan": "1.12.33 || 2.2.2",
-                "phpstan/phpstan-phpunit": "1.4.2 || 2.0.16",
-                "phpstan/phpstan-strict-rules": "1.6.2 || 2.0.11",
-                "phpunit/phpunit": "8.5.52",
+                "phpstan/phpstan": "1.12.33 || 2.2.9",
+                "phpstan/phpstan-phpunit": "1.4.2 || 2.0.18",
+                "phpstan/phpstan-strict-rules": "1.6.2 || 2.0.12",
+                "phpunit/phpunit": "8.5.54",
                 "rawr/phpunit-data-provider": "3.3.1",
-                "rector/rector": "1.2.10 || 2.4.6",
-                "rector/type-perfect": "1.0.0 || 2.1.3",
-                "squizlabs/php_codesniffer": "4.0.1",
-                "thecodingmachine/phpstan-safe-rule": "1.2.0 || 1.4.3"
+                "rector/rector": "1.2.10 || 2.6.2",
+                "rector/type-perfect": "1.0.0 || 2.1.4",
+                "squizlabs/php_codesniffer": "4.0.4"
             },
             "suggest": {
                 "ext-mbstring": "for parsing UTF-8 CSS"
@@ -8098,7 +8034,7 @@
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-main": "9.5.x-dev"
+                    "dev-main": "9.6.x-dev"
                 }
             },
             "autoload": {
@@ -8136,9 +8072,9 @@
             ],
             "support": {
                 "issues": "https://github.com/MyIntervals/PHP-CSS-Parser/issues",
-                "source": "https://github.com/MyIntervals/PHP-CSS-Parser/tree/v9.4.0"
+                "source": "https://github.com/MyIntervals/PHP-CSS-Parser/tree/v9.5.0"
             },
-            "time": "2026-06-18T15:10:53+00:00"
+            "time": "2026-09-20T15:02:00+00:00"
         },
         {
             "name": "scrivo/highlight.php",
@@ -12665,16 +12601,16 @@
         },
         {
             "name": "technikermathe/blade-lucide-icons",
-            "version": "v3.180.0",
+            "version": "v3.182.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PascaleBeier/blade-lucide-icons.git",
-                "reference": "adac9da3a65910fedc271129eea5340093910203"
+                "reference": "11253aa7d9aa7430da61d3534c62dc69a95b703b"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PascaleBeier/blade-lucide-icons/zipball/adac9da3a65910fedc271129eea5340093910203",
-                "reference": "adac9da3a65910fedc271129eea5340093910203",
+                "url": "https://api.github.com/repos/PascaleBeier/blade-lucide-icons/zipball/11253aa7d9aa7430da61d3534c62dc69a95b703b",
+                "reference": "11253aa7d9aa7430da61d3534c62dc69a95b703b",
                 "shasum": ""
             },
             "require": {
@@ -12724,152 +12660,9 @@
             ],
             "support": {
                 "issues": "https://github.com/PascaleBeier/blade-lucide-icons/issues",
-                "source": "https://github.com/PascaleBeier/blade-lucide-icons/tree/v3.180.0"
+                "source": "https://github.com/PascaleBeier/blade-lucide-icons/tree/v3.182.0"
             },
-            "time": "2026-09-15T02:25:56+00:00"
-        },
-        {
-            "name": "thecodingmachine/safe",
-            "version": "v3.4.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/thecodingmachine/safe.git",
-                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/thecodingmachine/safe/zipball/705683a25bacf0d4860c7dea4d7947bfd09eea19",
-                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^8.1"
-            },
-            "require-dev": {
-                "php-parallel-lint/php-parallel-lint": "^1.4",
-                "phpstan/phpstan": "^2",
-                "phpunit/phpunit": "^10",
-                "squizlabs/php_codesniffer": "^3.2"
-            },
-            "type": "library",
-            "autoload": {
-                "files": [
-                    "lib/special_cases.php",
-                    "generated/apache.php",
-                    "generated/apcu.php",
-                    "generated/array.php",
-                    "generated/bzip2.php",
-                    "generated/calendar.php",
-                    "generated/classobj.php",
-                    "generated/com.php",
-                    "generated/cubrid.php",
-                    "generated/curl.php",
-                    "generated/datetime.php",
-                    "generated/dir.php",
-                    "generated/eio.php",
-                    "generated/errorfunc.php",
-                    "generated/exec.php",
-                    "generated/fileinfo.php",
-                    "generated/filesystem.php",
-                    "generated/filter.php",
-                    "generated/fpm.php",
-                    "generated/ftp.php",
-                    "generated/funchand.php",
-                    "generated/gettext.php",
-                    "generated/gmp.php",
-                    "generated/gnupg.php",
-                    "generated/hash.php",
-                    "generated/ibase.php",
-                    "generated/ibmDb2.php",
-                    "generated/iconv.php",
-                    "generated/image.php",
-                    "generated/imap.php",
-                    "generated/info.php",
-                    "generated/inotify.php",
-                    "generated/json.php",
-                    "generated/ldap.php",
-                    "generated/libxml.php",
-                    "generated/lzf.php",
-                    "generated/mailparse.php",
-                    "generated/mbstring.php",
-                    "generated/misc.php",
-                    "generated/mysql.php",
-                    "generated/mysqli.php",
-                    "generated/network.php",
-                    "generated/oci8.php",
-                    "generated/opcache.php",
-                    "generated/openssl.php",
-                    "generated/outcontrol.php",
-                    "generated/pcntl.php",
-                    "generated/pcre.php",
-                    "generated/pgsql.php",
-                    "generated/posix.php",
-                    "generated/ps.php",
-                    "generated/pspell.php",
-                    "generated/readline.php",
-                    "generated/rnp.php",
-                    "generated/rpminfo.php",
-                    "generated/rrd.php",
-                    "generated/sem.php",
-                    "generated/session.php",
-                    "generated/shmop.php",
-                    "generated/sockets.php",
-                    "generated/sodium.php",
-                    "generated/solr.php",
-                    "generated/spl.php",
-                    "generated/sqlsrv.php",
-                    "generated/ssdeep.php",
-                    "generated/ssh2.php",
-                    "generated/stream.php",
-                    "generated/strings.php",
-                    "generated/swoole.php",
-                    "generated/uodbc.php",
-                    "generated/uopz.php",
-                    "generated/url.php",
-                    "generated/var.php",
-                    "generated/xdiff.php",
-                    "generated/xml.php",
-                    "generated/xmlrpc.php",
-                    "generated/yaml.php",
-                    "generated/yaz.php",
-                    "generated/zip.php",
-                    "generated/zlib.php"
-                ],
-                "classmap": [
-                    "lib/DateTime.php",
-                    "lib/DateTimeImmutable.php",
-                    "lib/Exceptions/",
-                    "generated/Exceptions/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "description": "PHP core functions that throw exceptions instead of returning FALSE on error",
-            "support": {
-                "issues": "https://github.com/thecodingmachine/safe/issues",
-                "source": "https://github.com/thecodingmachine/safe/tree/v3.4.0"
-            },
-            "funding": [
-                {
-                    "url": "https://github.com/OskarStark",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/shish",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/silasjoisten",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/staabm",
-                    "type": "github"
-                }
-            ],
-            "time": "2026-02-04T18:08:13+00:00"
+            "time": "2026-09-25T02:29:00+00:00"
         },
         {
             "name": "tijsverkoyen/css-to-inline-styles",

config/catalog.php

@@ -0,0 +1,25 @@
+<?php
+
+use Modules\Core\Catalog\Recommendations\RandomRule;
+use Modules\Core\Catalog\Recommendations\SameCategoryRule;
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Product recommendation rules
+    |--------------------------------------------------------------------------
+    |
+    | Tried in order by Modules\Core\Catalog\Services\RecommendationService —
+    | the first rule that returns at least one product wins. The order here IS
+    | the fallback chain: SameCategoryRule first, then RandomRule as a
+    | last-resort so a product page is never left with zero recommendations
+    | (as long as the store has more than one product). A consuming app can
+    | reorder, add, or remove rules freely — nothing about the chain shape is
+    | hardcoded in the service itself.
+    |
+    */
+    'recommendation_rules' => [
+        SameCategoryRule::class,
+        RandomRule::class,
+    ],
+];

config/checkout.php

@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Per-site settings for the cart + checkout module (see
+ * Modules\Core\Providers\CheckoutModuleServiceProvider). Publishable —
+ * artisan vendor:publish --tag=core-config.
+ */
+return [
+
+    /*
+     * Name of the storefront's login route. The checkout's login tab and the
+     * confirmation page link to it with `?redirect=<checkout path>`, so the
+     * login page must send the shopper back there afterwards. null: no login
+     * offered in checkout at all.
+     */
+    'login_route' => 'login',
+
+    /*
+     * Name of the storefront's product-listing route — where confirmation()
+     * redirects a visit with no placed order to look at (session expired,
+     * direct navigation, a bookmark). route($this, $locale) must resolve.
+     */
+    'products_route' => 'products',
+
+    /*
+     * ISO 3166-1 alpha-3 code fixing checkout to a single country (a hidden
+     * field, forced server-side — no country picker shown at all). null (the
+     * default) gives the full country/region picker, for a multi-country
+     * store. 3dealer is Greece-only for now.
+     */
+    'store_country_iso3' => 'GRC',
+
+    /*
+     * The `purpose` tag CartController expects a product custom field's
+     * `file` answer to already carry (see Modules\Core\File\Models\File) —
+     * matches whatever purpose string the host's own upload endpoint
+     * (extending Modules\Core\File\Http\Controllers\UploadFileController)
+     * tags its stored files with. This module never reaches into that
+     * host controller directly; this config value is the one shared
+     * source of truth between the two.
+     */
+    'custom_field_upload_purpose' => 'custom-field-upload',
+
+];

config/core.php

@@ -16,4 +16,126 @@
 
     'auto_create_customer_for_user' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Privacy / GDPR data-subject requests
+    |--------------------------------------------------------------------------
+    |
+    | 'providers' lists every Modules\Core\Privacy\Contracts\PersonalDataProvider
+    | that should be consulted for right-of-access/right-of-erasure requests. A
+    | module never needs to be known to core in advance — it just adds its own
+    | provider class here, the same way config('lunar.search.indexers') maps a
+    | model to its indexer. See docs/privacy.md.
+    |
+    | 'grace_period_days' is how long an erasure request stays cancellable
+    | (account deactivated, not yet erased) before it's actually processed by
+    | the privacy:process-erasure-requests scheduled command.
+    |
+    */
+
+    'privacy' => [
+        'providers' => [
+            // ActivityLogDataProvider MUST run before AddressDataProvider —
+            // it resolves which activity_log rows belong to this customer
+            // (including ones keyed by an Address id) before
+            // AddressDataProvider hard-deletes those Address rows. See that
+            // provider's own class docblock.
+            \Modules\Core\Logging\Privacy\ActivityLogDataProvider::class,
+            \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+            \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+            \Modules\Core\Order\Privacy\OrderDataProvider::class,
+            \Modules\Core\Cart\Privacy\CartDataProvider::class,
+            \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+            \Modules\Core\Payment\Privacy\PaymentDataProvider::class,
+            \Modules\Core\Auth\Privacy\UserSessionDataProvider::class,
+        ],
+
+        'grace_period_days' => 30,
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cart Abandonment Threshold
+    |--------------------------------------------------------------------------
+    |
+    | How long a cart (that hasn't converted to a placed order) can go without
+    | activity before Modules\Core\Cart\Filament\Resources\CartResource treats
+    | it as "Abandoned" rather than "Ongoing". Anything DateInterval::createFromDateString()
+    | accepts works, e.g. '1 hour', '30 minutes', '2 days'.
+    |
+    */
+
+    'cart' => [
+        'abandoned_after' => '1 hour',
+
+        /*
+        |----------------------------------------------------------------------
+        | Unrecoverable Cap
+        |----------------------------------------------------------------------
+        |
+        | Beyond this age, a stale cart stops being treated as an active
+        | "Abandoned Cart"/"Abandoned Checkout" (Modules\Core\Cart\Services\
+        | CartLifecycleService) — too old to be a realistic recovery target
+        | (pricing/stock/tax likely stale by then). This is about the
+        | abandoned-cart pipeline only, not data retention — no rows are
+        | deleted or pruned based on this value.
+        |
+        */
+
+        'unrecoverable_after' => '90 days',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Order Return Window
+    |--------------------------------------------------------------------------
+    |
+    | How many days after a carrier order is delivered (Order::fulfillment_status
+    | becomes 'return_window_open') before Modules\Core\Order\Commands\
+    | CloseExpiredReturnWindows auto-completes it, if no return was requested.
+    | Store-pickup orders have no return-window step and are unaffected by
+    | this value (see Modules\Core\Order\Listeners\CompleteOrderOnPickedUp).
+    |
+    */
+
+    'order' => [
+        'return_window_days' => 14,
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Storefront OTP Login
+    |--------------------------------------------------------------------------
+    |
+    | Modules\Core\Auth\Services\UserOtpService's passwordless login.
+    | max_attempts caps how many wrong codes a shopper can guess against ONE
+    | generated code before it's invalidated outright. generation_limit/
+    | generation_decay_minutes cap how often a NEW code can be requested for
+    | the same email — independent of max_attempts, since generating a fresh
+    | code also resets the guess count, so an attempt cap alone doesn't stop
+    | an attacker from just requesting a new code every few tries. This same
+    | limit is also what stands between a malicious/careless caller and
+    | mail-bombing one inbox.
+    |
+    */
+
+    'auth' => [
+        'otp' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+        ],
+
+        // Modules\Core\Customer\Services\CustomerEmailChangeService — same
+        // shape/reasoning as auth.otp above, independent limits since this
+        // is a separate flow (changing an existing account's login email,
+        // not logging in).
+        'email_change' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+            'expiry_minutes' => 10,
+        ],
+    ],
+
 ];

config/lunar/search.php

@@ -20,7 +20,17 @@
         Lunar\Models\Collection::class,
         Lunar\Models\Customer::class,
         Lunar\Models\Order::class,
-        Lunar\Models\Product::class,
+        // Modules\Core\Catalog\Models\Product, not Lunar\Models\Product —
+        // both share the same underlying Meilisearch index name, so
+        // listing the base class here too would make every reindex
+        // (this default list is always merged in, even when a specific
+        // model is passed on the CLI — see Lunar\Console\Commands\
+        // ScoutIndexerCommand::handle()) run the base class's indexing a
+        // second time right after the subclass's, silently overwriting
+        // every document with one missing custom_fields/order_count
+        // (the whole reason Modules\Core\Catalog\Models\Product exists —
+        // see its own docblock). Caught in practice.
+        Modules\Core\Catalog\Models\Product::class,
         Lunar\Models\ProductOption::class,
 
         /*
@@ -49,6 +59,20 @@
         Lunar\Models\Collection::class => Modules\Core\Catalog\Services\CollectionIndexer::class,
         Lunar\Models\Customer::class => Lunar\Search\CustomerIndexer::class,
         Lunar\Models\Order::class => Lunar\Search\OrderIndexer::class,
+        // Lunar\Models\Product::class, NOT Modules\Core\Catalog\Models\
+        // Product::class — Lunar\Base\Traits\Searchable::indexer() (and
+        // getFilterableAttributes()/getSortableAttributes(), same trait)
+        // reads `$config[self::class]`, and `self::class` inside a TRAIT
+        // METHOD is a compile-time literal bound to whichever class first
+        // `use`s the trait — Lunar\Models\Product, since the subclass
+        // never re-declares indexer() itself — regardless of which
+        // instance actually calls the method at runtime. Keying this by
+        // the subclass here made the lookup miss entirely, silently
+        // falling back to Lunar\Search\ScoutIndexer's own near-empty
+        // filterable/sortable field list — confirmed live: it wiped every
+        // real filterable/sortable attribute the index had (including
+        // ones that already worked, like collection_ids), not just the
+        // new order_count one. Caught in practice, reverted.
         Lunar\Models\Product::class => Modules\Core\Catalog\Services\ProductIndexer::class,
         Lunar\Models\ProductOption::class => Lunar\Search\ProductOptionIndexer::class,
     ],

config/services.php

@@ -35,6 +35,20 @@
         ],
     ],
 
+    // Where contact-form messages are sent (ContactController).
+    'contact' => [
+        'email' => env('CONTACT_EMAIL'),
+    ],
+
+    // Bot check on guest forms (login, contact), verified by App\Rules\HCaptcha. For
+    // local dev use hCaptcha's test keys, the real ones reject localhost:
+    // sitekey 10000000-ffff-ffff-ffff-000000000001,
+    // secret 0x0000000000000000000000000000000000000000.
+    'hcaptcha' => [
+        'sitekey' => env('HCAPTCHA_SITEKEY'),
+        'secret' => env('HCAPTCHA_SECRET'),
+    ],
+
     'stoic' => [
         'sso_secret' => env('STOIC_SSO_SECRET'),
         'host' => env('STOIC_HOST'),

config/shippingCarriers/acs.php

@@ -0,0 +1,50 @@
+<?php
+
+/*
+|--------------------------------------------------------------------------
+| ACS Courier credentials
+|--------------------------------------------------------------------------
+|
+| ACS requires two credential mechanisms simultaneously: an AcsApiKey
+| HTTP header (gates the REST gateway itself) and four account fields
+| (Company_ID/Company_Password/User_ID/User_Password) sent in every
+| request body. Both are supplied by ACS when your account is set up.
+|
+| Set these via environment variables — never commit real values.
+|
+| ACS_BASE_URL           Root REST endpoint (unversioned, single URL for
+|                        every ACSAlias call).
+| ACS_API_KEY            The AcsApiKey header value.
+| ACS_COMPANY_ID         Company_ID body field.
+| ACS_COMPANY_PASSWORD   Company_Password body field.
+| ACS_USER_ID            User_ID body field.
+| ACS_USER_PASSWORD      User_Password body field.
+| ACS_BILLING_CODE       Your ACS credit/billing code, used for price
+|                        calculation and voucher creation.
+| ACS_SENDER_*           Static sender details reused on every voucher.
+|
+*/
+
+return [
+
+    'base_url' => env('ACS_BASE_URL', 'https://webservices.acscourier.net/ACSRestServices/api/ACSAutoRest'),
+
+    'api_key' => env('ACS_API_KEY'),
+
+    'company_id' => env('ACS_COMPANY_ID'),
+    'company_password' => env('ACS_COMPANY_PASSWORD'),
+    'user_id' => env('ACS_USER_ID'),
+    'user_password' => env('ACS_USER_PASSWORD'),
+
+    'billing_code' => env('ACS_BILLING_CODE'),
+
+    'sender' => [
+        'name' => env('ACS_SENDER_NAME'),
+        'address' => env('ACS_SENDER_ADDRESS'),
+        'zip_code' => env('ACS_SENDER_ZIP'),
+        'phone' => env('ACS_SENDER_PHONE'),
+    ],
+
+    'timeout' => env('ACS_HTTP_TIMEOUT', 10),
+
+];

config/shippingCarriers/boxnow.php

@@ -0,0 +1,61 @@
+<?php
+
+/*
+|--------------------------------------------------------------------------
+| Box Now credentials
+|--------------------------------------------------------------------------
+|
+| Box Now uses OAuth2 client-credentials: exchange BOXNOW_CLIENT_ID /
+| BOXNOW_CLIENT_SECRET for a Bearer access token (POST /auth-sessions,
+| ~1hr expiry), then attach it as an Authorization header on every call.
+| Unlike ACS, there is no separate per-request credential body — the
+| token alone authorizes all calls once obtained.
+|
+| Set these via environment variables — never commit real values.
+|
+| Box Now has two environments (see their Partner API manual, section 2):
+| Stage/Sandbox for testing, Production once live. Each has its own
+| client_id/client_secret pair and its own base_url/location_api_url —
+| there is no shared "switch an env var" flag, since stage credentials
+| don't work against the production host or vice versa.
+|
+| BOXNOW_BASE_URL         Root REST endpoint for delivery-requests/parcels.
+| BOXNOW_LOCATION_API_URL Separate, faster endpoint for origins/destinations
+|                         lookups (Box Now recommends this over the main
+|                         base URL for those two calls specifically).
+| BOXNOW_CLIENT_ID        OAuth2 client id.
+| BOXNOW_CLIENT_SECRET    OAuth2 client secret.
+| BOXNOW_PARTNER_ID       Numeric partnerId Box Now issues alongside your
+|                         credentials. NOT used for REST API authentication
+|                         (BoxNowClient authenticates with client_id/
+|                         client_secret alone) — this is only consumed by
+|                         the client-side Destination Map widget config
+|                         (_bn_map_widget_config.partnerId), confirmed
+|                         against Box Now's own WooCommerce plugin source.
+| BOXNOW_ORIGIN_LOCATION_ID  Your warehouse's Box Now locationId, used as
+|                            the pickup origin on every delivery request.
+| BOXNOW_SENDER_*         Static sender contact details reused on every
+|                         delivery request.
+|
+*/
+
+return [
+
+    'base_url' => env('BOXNOW_BASE_URL', 'https://api-production.boxnow.gr/api/v1'),
+    'location_api_url' => env('BOXNOW_LOCATION_API_URL', 'https://locationapi-production.boxnow.gr/api/v1'),
+
+    'client_id' => env('BOXNOW_CLIENT_ID'),
+    'client_secret' => env('BOXNOW_CLIENT_SECRET'),
+    'partner_id' => env('BOXNOW_PARTNER_ID'),
+
+    'origin_location_id' => env('BOXNOW_ORIGIN_LOCATION_ID'),
+
+    'sender' => [
+        'name' => env('BOXNOW_SENDER_NAME'),
+        'email' => env('BOXNOW_SENDER_EMAIL'),
+        'phone' => env('BOXNOW_SENDER_PHONE'),
+    ],
+
+    'timeout' => env('BOXNOW_HTTP_TIMEOUT', 10),
+
+];

database/migrations/2026_09_24_000001_create_wishlist_items_table.php

@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('wishlist_items', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('product_id')->constrained('lunar_products')->cascadeOnDelete();
+            $table->timestamps();
+
+            $table->unique(['user_id', 'product_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('wishlist_items');
+    }
+};

database/seeders/CheckoutTranslationsSeeder.php

@@ -1,211 +0,0 @@
-<?php
-
-namespace Database\Seeders;
-
-use Illuminate\Database\Seeder;
-use Modules\Core\Localization\Services\TranslationService;
-use Spatie\TranslationLoader\LanguageLine;
-
-/**
- * Default `checkout` translation lines for the cart drawer and the checkout
- * page (see the checkout module under resources/views/checkout).
- *
- * Additive and idempotent: a group/key that already exists is left untouched,
- * so anything edited in the Filament Language Lines UI wins on a re-run. Runs
- * explicitly — `php artisan db:seed --class=CheckoutTranslationsSeeder` — it is
- * not wired into DatabaseSeeder.
- *
- * Greek copy uses the project's informal register (εσύ/σου). When the checkout
- * module moves to boboko-core this becomes the module's own default-strings
- * seeder.
- */
-class CheckoutTranslationsSeeder extends Seeder
-{
-    public function run(): void
-    {
-        $translations = app(TranslationService::class);
-
-        foreach ($this->lines() as $key => [$en, $el]) {
-            $exists = LanguageLine::query()
-                ->where('group', 'checkout')
-                ->where('key', $key)
-                ->exists();
-
-            if ($exists) {
-                $this->command?->warn("checkout.{$key} already exists — skipped");
-
-                continue;
-            }
-
-            $translations->create('checkout', $key, ['en' => $en, 'el' => $el]);
-            $this->command?->info("checkout.{$key} added");
-        }
-    }
-
-    /**
-     * key => [English, Greek].
-     *
-     * @return array<string, array{0: string, 1: string}>
-     */
-    private function lines(): array
-    {
-        return [
-            // ── Cart drawer + order summary ──────────────────────────────
-            'cart.title' => ['Your cart', 'Το καλάθι σου'],
-            'cart.close' => ['Close', 'Κλείσιμο'],
-            'cart.empty' => ['Your cart is empty', 'Το καλάθι σου είναι άδειο'],
-            'cart.quantity' => ['Quantity', 'Ποσότητα'],
-            'cart.increase' => ['Increase quantity', 'Αύξηση ποσότητας'],
-            'cart.decrease' => ['Decrease quantity', 'Μείωση ποσότητας'],
-            'cart.remove' => ['Remove', 'Αφαίρεση'],
-            'cart.subtotal' => ['Subtotal', 'Υποσύνολο'],
-            'cart.discount' => ['Discount', 'Έκπτωση'],
-            'cart.shipping' => ['Shipping', 'Μεταφορικά'],
-            'cart.shipping_pending' => ['Not selected yet', 'Δεν έχει επιλεγεί ακόμη'],
-            'cart.tax' => ['VAT', 'ΦΠΑ'],
-            'cart.total' => ['Total', 'Σύνολο'],
-            'cart.checkout' => ['Checkout', 'Ολοκλήρωση παραγγελίας'],
-            'cart.coupon_label' => ['Coupon code', 'Κωδικός κουπονιού'],
-            'cart.coupon_placeholder' => ['Coupon code', 'Κωδικός κουπονιού'],
-            'cart.coupon_apply' => ['Apply', 'Εφαρμογή'],
-            'cart.coupon_remove' => ['Remove', 'Αφαίρεση'],
-            'cart.coupon_invalid' => ["That coupon code isn't valid", 'Ο κωδικός κουπονιού δεν είναι έγκυρος'],
-
-            // ── Checkout page ────────────────────────────────────────────
-            'page.title' => ['Checkout', 'Ολοκλήρωση παραγγελίας'],
-            'page.contact_heading' => ['Contact', 'Στοιχεία επικοινωνίας'],
-            'page.guest_tab' => ['Guest', 'Ως επισκέπτης'],
-            'page.login_tab' => ['Log in', 'Σύνδεση'],
-            'page.email_label' => ['Email', 'Email'],
-            'page.recovery_consent' => [
-                "Email me a reminder if I don't finish my order",
-                'Στείλε μου μια υπενθύμιση αν δεν ολοκληρώσω την παραγγελία μου',
-            ],
-            'page.login_email_label' => ['Email', 'Email'],
-            'page.send_code' => ['Send code', 'Αποστολή κωδικού'],
-            'page.login_coming_soon' => [
-                'Login is coming soon — continue as a guest for now.',
-                'Η σύνδεση θα είναι διαθέσιμη σύντομα — προς το παρόν συνέχισε ως επισκέπτης.',
-            ],
-            'page.billing_heading' => ['Billing information', 'Στοιχεία τιμολόγησης'],
-            'page.shipping_heading' => ['Shipping information', 'Στοιχεία αποστολής'],
-            'page.same_as_billing' => ['Same as billing address', 'Ίδια με τη διεύθυνση τιμολόγησης'],
-            'page.first_name' => ['First name', 'Όνομα'],
-            'page.last_name' => ['Last name', 'Επώνυμο'],
-            'page.company_name' => ['Company name', 'Επωνυμία εταιρείας'],
-            'page.tax_identifier' => ['Tax ID', 'ΑΦΜ'],
-            'page.address_line_one' => ['Address', 'Διεύθυνση'],
-            'page.address_line_two' => ['Address line 2', 'Διεύθυνση (γραμμή 2)'],
-            'page.city' => ['City', 'Πόλη'],
-            'page.state' => ['Region / Prefecture', 'Νομός / Περιοχή'],
-            'page.state_placeholder' => ['Select a region', 'Επίλεξε νομό'],
-            'page.postcode' => ['Postcode', 'Ταχυδρομικός κώδικας'],
-            'page.country' => ['Country', 'Χώρα'],
-            'page.country_placeholder' => ['Select a country', 'Επίλεξε χώρα'],
-            'page.phone' => ['Phone', 'Τηλέφωνο'],
-            'page.delivery_instructions' => ['Delivery notes', 'Σχόλια για την παράδοση'],
-            'page.save_address' => ['Save and continue', 'Αποθήκευση και συνέχεια'],
-            'page.saving' => ['Saving…', 'Αποθήκευση…'],
-            'page.saved' => ['Saved', 'Αποθηκεύτηκε'],
-            'page.save_error' => ["Couldn't save — check your connection", 'Δεν αποθηκεύτηκε — έλεγξε τη σύνδεσή σου'],
-            'page.shipping_method_heading' => ['Shipping method', 'Τρόπος αποστολής'],
-            'page.shipping_method_empty' => [
-                'Add your shipping address to see delivery options.',
-                'Συμπλήρωσε τη διεύθυνση αποστολής για να δεις τις διαθέσιμες επιλογές.',
-            ],
-            'page.shipping_method_none' => [
-                'No delivery options are available for this address.',
-                'Δεν υπάρχουν διαθέσιμες επιλογές αποστολής για αυτή τη διεύθυνση.',
-            ],
-            'page.box_now_locker_label' => [
-                'Choose a Box Now locker',
-                'Επίλεξε Box Now locker',
-            ],
-            'page.box_now_locker_loading' => [
-                'Loading lockers…',
-                'Φόρτωση lockers…',
-            ],
-            'page.box_now_locker_required' => [
-                'Choose a Box Now locker to continue.',
-                'Επίλεξε ένα Box Now locker για να συνεχίσεις.',
-            ],
-            'page.box_now_locker_select' => [
-                'Select this locker',
-                'Επιλογή αυτού του locker',
-            ],
-            'page.box_now_locker_selected' => [
-                'Selected',
-                'Επιλέχθηκε',
-            ],
-            'page.box_now_locker_search' => [
-                'Search by area or address…',
-                'Αναζήτηση με περιοχή ή διεύθυνση…',
-            ],
-            'page.box_now_locker_no_results' => [
-                'No lockers match your search.',
-                'Δεν βρέθηκαν lockers για αυτή την αναζήτηση.',
-            ],
-            'page.select_shipping_method' => ['Continue', 'Συνέχεια'],
-            'page.shipping_option_invalid' => [
-                'That shipping option is no longer available.',
-                'Αυτός ο τρόπος αποστολής δεν είναι πλέον διαθέσιμος.',
-            ],
-            'page.continue_to_payment' => ['Continue to payment', 'Συνέχεια στην πληρωμή'],
-            'page.order_summary_heading' => ['Order summary', 'Σύνοψη παραγγελίας'],
-
-            // ── Payment step ────────────────────────────────────────────
-            'page.payment_heading' => ['Payment', 'Πληρωμή'],
-            'page.payment_method_none' => [
-                'No payment methods are available right now.',
-                'Δεν υπάρχουν διαθέσιμοι τρόποι πληρωμής αυτή τη στιγμή.',
-            ],
-            'page.terms_accept' => [
-                "I accept the <a href=':terms' target='_blank'>Terms of Sale</a> and the <a href=':privacy' target='_blank'>Privacy Policy</a>",
-                "Αποδέχομαι τους <a href=':terms' target='_blank'>Όρους Πώλησης</a> και την <a href=':privacy' target='_blank'>Πολιτική Απορρήτου</a>",
-            ],
-            'page.terms_required' => [
-                'You must accept the terms to place your order.',
-                'Πρέπει να αποδεχτείς τους όρους για να ολοκληρώσεις την παραγγελία.',
-            ],
-            'page.withdrawal_notice' => [
-                "You have a 14-day right of withdrawal. <a href=':link' target='_blank'>See details</a>.",
-                "Έχεις δικαίωμα υπαναχώρησης εντός 14 ημερών. <a href=':link' target='_blank'>Δες λεπτομέρειες</a>.",
-            ],
-            'page.place_order' => ['Place order — payment obligation', 'Παραγγελία με υποχρέωση πληρωμής'],
-            'page.choose_payment_method' => ['Choose a payment method.', 'Επίλεξε τρόπο πληρωμής.'],
-            'page.shipping_method_required' => [
-                'Choose a shipping method below to continue.',
-                'Επίλεξε τρόπο αποστολής παρακάτω για να συνεχίσεις.',
-            ],
-            'page.payment_failed' => ['Payment failed. Please try again.', 'Η πληρωμή απέτυχε. Δοκίμασε ξανά.'],
-            'page.payment_incomplete_details' => [
-                'Complete your billing and shipping details above.',
-                'Συμπλήρωσε τα στοιχεία χρέωσης και αποστολής παραπάνω.',
-            ],
-            'page.payment_cart_changed' => [
-                'Your cart changed. Refresh the page and place your order again.',
-                'Το καλάθι σου άλλαξε. Ανανέωσε τη σελίδα και ολοκλήρωσε ξανά.',
-            ],
-            'page.payment_processing' => ['Confirming your payment…', 'Επιβεβαίωση πληρωμής…'],
-            'page.payment_processing_slow' => [
-                "Your payment is still processing. You'll get an email once it's confirmed.",
-                'Η πληρωμή σου επεξεργάζεται ακόμη. Θα λάβεις email μόλις επιβεβαιωθεί.',
-            ],
-
-            // ── Confirmation page ──────────────────────────────────────
-            'page.confirmation_title' => ['Your order', 'Η παραγγελία σου'],
-            'page.confirmation_heading' => [
-                'Thank you! Your order is confirmed.',
-                'Ευχαριστούμε! Η παραγγελία σου καταχωρήθηκε.',
-            ],
-            'page.confirmation_order_number' => ['Order number', 'Αριθμός παραγγελίας'],
-            'page.confirmation_email_note' => [
-                'A confirmation email will follow shortly.',
-                'Θα λάβεις email επιβεβαίωσης σύντομα.',
-            ],
-            'page.confirmation_shipping_to' => ['Shipping to', 'Αποστολή σε'],
-            'page.confirmation_billing' => ['Billing', 'Χρέωση'],
-            'page.confirmation_continue' => ['Continue shopping', 'Συνέχεια αγορών'],
-        ];
-    }
-}

database/seeders/ValidationTranslationsSeeder.php

@@ -0,0 +1,115 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Modules\Core\Localization\Services\TranslationService;
+use Spatie\TranslationLoader\LanguageLine;
+
+/**
+ * Default `validation` translation lines — Laravel's own error-message group
+ * (`validation.required`, `validation.email`, `validation.attributes.*`, …),
+ * resolved by every `Validator::make()`/`$request->validate()` call in the app
+ * (see CheckoutController::saveAddress(), CartController, ProductController),
+ * not just the checkout module.
+ *
+ * Spatie's DB loader (spatie/laravel-translation-loader, wired in boboko-core's
+ * LocalizationServiceProvider) merges this group over Laravel's file-based
+ * validation.php, which the project doesn't ship a `lang/` copy of — so without
+ * this, Greek requests fall back to Laravel's untranslated English defaults.
+ * Only the rule keys and field attributes actually in use are seeded; add more
+ * as new rules/fields show up.
+ *
+ * Additive and idempotent: a key that already exists is left untouched, so
+ * anything edited in the Filament Language Lines UI wins on a re-run. Runs
+ * explicitly — `php artisan db:seed --class=ValidationTranslationsSeeder` — it
+ * is not wired into DatabaseSeeder.
+ *
+ * Greek copy uses the project's informal register (εσύ/σου).
+ */
+class ValidationTranslationsSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $translations = app(TranslationService::class);
+
+        foreach ($this->lines() as $key => [$en, $el]) {
+            $exists = LanguageLine::query()
+                ->where('group', 'validation')
+                ->where('key', $key)
+                ->exists();
+
+            if ($exists) {
+                $this->command?->warn("validation.{$key} already exists — skipped");
+
+                continue;
+            }
+
+            $translations->create('validation', $key, ['en' => $en, 'el' => $el]);
+            $this->command?->info("validation.{$key} added");
+        }
+    }
+
+    /**
+     * key => [English, Greek].
+     *
+     * @return array<string, array{0: string, 1: string}>
+     */
+    private function lines(): array
+    {
+        return [
+            // ── Rule messages ─────────────────────────────────────────────
+            'required' => ['The :attribute field is required.', 'Το πεδίο :attribute είναι υποχρεωτικό.'],
+            'email' => ['The :attribute field must be a valid email address.', 'Το πεδίο :attribute πρέπει να είναι έγκυρη διεύθυνση email.'],
+            'string' => ['The :attribute field must be a string.', 'Το πεδίο :attribute πρέπει να είναι κείμενο.'],
+            'integer' => ['The :attribute field must be an integer.', 'Το πεδίο :attribute πρέπει να είναι ακέραιος αριθμός.'],
+            'boolean' => ['The :attribute field must be true or false.', 'Το πεδίο :attribute πρέπει να είναι true ή false.'],
+            'min.numeric' => ['The :attribute field must be at least :min.', 'Το πεδίο :attribute πρέπει να είναι τουλάχιστον :min.'],
+            'max.string' => ['The :attribute field must not be greater than :max characters.', 'Το πεδίο :attribute δεν πρέπει να ξεπερνά τους :max χαρακτήρες.'],
+            'between.numeric' => ['The :attribute field must be between :min and :max.', 'Το πεδίο :attribute πρέπει να είναι μεταξύ :min και :max.'],
+            'exists' => ['The selected :attribute is invalid.', 'Η επιλεγμένη τιμή για το πεδίο :attribute δεν είναι έγκυρη.'],
+            // Product custom-field photo uploads (CustomFieldUploadController, CartController).
+            'file' => ['The :attribute field must be a file.', 'Το πεδίο :attribute πρέπει να είναι αρχείο.'],
+            'mimes' => ['The :attribute field must be a file of type: :values.', 'Το πεδίο :attribute πρέπει να είναι αρχείο τύπου: :values.'],
+            'max.file' => ['The :attribute field must not be greater than :max kilobytes.', 'Το αρχείο στο πεδίο :attribute δεν πρέπει να ξεπερνά τα :max kilobytes.'],
+            'uploaded' => ['The :attribute failed to upload.', 'Η μεταφόρτωση στο πεδίο :attribute απέτυχε.'],
+
+            // ── Field names (checkout: billing/shipping address) ──────────
+            'attributes.contact_email' => ['email', 'email'],
+            'attributes.billing_first_name' => ['first name', 'όνομα'],
+            'attributes.billing_last_name' => ['last name', 'επώνυμο'],
+            'attributes.billing_company_name' => ['company name', 'επωνυμία εταιρείας'],
+            'attributes.billing_tax_identifier' => ['tax ID', 'ΑΦΜ'],
+            'attributes.billing_line_one' => ['address', 'διεύθυνση'],
+            'attributes.billing_line_two' => ['address line 2', 'διεύθυνση (γραμμή 2)'],
+            'attributes.billing_city' => ['city', 'πόλη'],
+            'attributes.billing_state' => ['region', 'νομό / περιοχή'],
+            'attributes.billing_postcode' => ['postcode', 'ταχυδρομικό κώδικα'],
+            'attributes.billing_country_id' => ['country', 'χώρα'],
+            'attributes.billing_contact_phone' => ['phone', 'τηλέφωνο'],
+            'attributes.shipping_first_name' => ['first name', 'όνομα'],
+            'attributes.shipping_last_name' => ['last name', 'επώνυμο'],
+            'attributes.shipping_company_name' => ['company name', 'επωνυμία εταιρείας'],
+            'attributes.shipping_line_one' => ['address', 'διεύθυνση'],
+            'attributes.shipping_line_two' => ['address line 2', 'διεύθυνση (γραμμή 2)'],
+            'attributes.shipping_city' => ['city', 'πόλη'],
+            'attributes.shipping_state' => ['region', 'νομό / περιοχή'],
+            'attributes.shipping_postcode' => ['postcode', 'ταχυδρομικό κώδικα'],
+            'attributes.shipping_country_id' => ['country', 'χώρα'],
+            'attributes.shipping_contact_phone' => ['phone', 'τηλέφωνο'],
+            'attributes.shipping_delivery_instructions' => ['delivery notes', 'σχόλια για την παράδοση'],
+
+            // ── Field names (cart) ─────────────────────────────────────────
+            'attributes.purchasable_id' => ['product', 'προϊόν'],
+            'attributes.quantity' => ['quantity', 'ποσότητα'],
+            'attributes.code' => ['coupon code', 'κωδικό κουπονιού'],
+
+            // ── Field names (product reviews / stock check) ────────────────
+            'attributes.variant' => ['variant', 'παραλλαγή'],
+            'attributes.rating' => ['rating', 'βαθμολογία'],
+            'attributes.content' => ['review text', 'κείμενο κριτικής'],
+            'attributes.name' => ['name', 'όνομα'],
+            'attributes.email' => ['email', 'email'],
+        ];
+    }
+}

public/site.webmanifest

@@ -0,0 +1,21 @@
+{
+  "name": "3dealer",
+  "short_name": "3dealer",
+  "icons": [
+    {
+      "src": "/web-app-manifest-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/web-app-manifest-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "theme_color": "#ffffff",
+  "background_color": "#ffffff",
+  "display": "standalone"
+}

resources/css/app.css

@@ -331,7 +331,7 @@ @layer components {
         transition: transform 0.35s cubic-bezier(0.2, 0.78, 0.12, 0.86);
     }
 
-    .btn-primary:hover::after {
+    .btn-primary:not(:disabled):hover::after {
         transform: translate(0, 0);
     }
 

resources/css/checkout.css

@@ -200,8 +200,51 @@ .bbk-cart-item-media img {
 .bbk-cart-item-detail { min-width: 0; }
 
 .bbk-cart-item-title {
+    display: block;
     margin: 0 0 0.25rem;
     font-weight: 600;
+    color: inherit;
+    text-decoration: none;
+}
+
+a.bbk-cart-item-title:hover { text-decoration: underline; }
+
+.bbk-cart-item-variant {
+    margin: 0 0 0.25rem;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+/* A line's custom-field answers (checkout::partials.line-custom-fields). */
+.bbk-line-fields {
+    display: grid;
+    gap: 0.25rem;
+    margin: 0 0 0.5rem;
+    font-size: 0.8125rem;
+}
+
+.bbk-line-field dt {
+    color: var(--bbk-color-muted);
+}
+
+.bbk-line-field dd {
+    margin: 0;
+    white-space: pre-line;
+    overflow-wrap: anywhere;
+}
+
+.bbk-line-field-file {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    color: inherit;
+}
+
+.bbk-line-field-file img {
+    width: 40px;
+    height: 40px;
+    object-fit: cover;
+    border-radius: 0;
 }
 
 .bbk-cart-item-unit {
@@ -361,6 +404,19 @@ .bbk-cart-coupon-error {
     color: var(--bbk-color-danger);
 }
 
+.bbk-cart-error {
+    margin: 0;
+    padding: 0.75rem 1.5rem 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+.bbk-add-to-cart-error {
+    margin: 0.375rem 0 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
 .bbk-cart-checkout {
     display: block;
     width: 100%;
@@ -448,35 +504,12 @@ .bbk-checkout-note {
     font-size: 0.875rem;
 }
 
-/* Contact tabs */
+/* Contact: "logged in as" line, or the guest login prompt */
 
-.bbk-checkout-tabs { display: flex; flex-direction: column; gap: 1rem; }
+.bbk-checkout-logged-in,
+.bbk-checkout-login-prompt { margin: 0; }
 
-.bbk-checkout-tab {
-    display: inline-flex;
-    width: fit-content;
-    margin-right: 0.5rem;
-    padding: 0.5rem 1rem;
-    border: 1px solid var(--bbk-color-border);
-    border-radius: var(--bbk-radius-sm);
-    background: var(--bbk-color-bg);
-    font: inherit;
-    font-weight: 600;
-    color: var(--bbk-color-muted);
-    cursor: pointer;
-    transition: background-color 0.15s ease, color 0.15s ease;
-}
-
-.bbk-checkout-tab[aria-selected="true"] {
-    background: var(--bbk-color-text);
-    border-color: var(--bbk-color-text);
-    color: var(--bbk-color-bg);
-}
-
-.bbk-checkout-tab:focus-visible {
-    outline: 2px solid var(--bbk-color-accent);
-    outline-offset: 2px;
-}
+.bbk-checkout-login-prompt a { color: inherit; font-weight: 600; }
 
 /* Fields */
 
@@ -546,6 +579,12 @@ .bbk-checkbox {
 }
 
 /* For a full-sentence label that can wrap — align the box to the first line. */
+/* "I want an invoice": company/ΑΦΜ only while ticked */
+
+.bbk-invoice { display: flex; flex-direction: column; gap: 1rem; }
+
+.bbk-invoice:not(:has(input[name="wants_invoice"]:checked)) .bbk-invoice-fields { display: none; }
+
 .bbk-checkbox--stacked {
     display: flex;
     align-items: flex-start;
@@ -765,6 +804,8 @@ .bbk-checkout-continue {
     font: inherit;
     font-weight: 600;
     text-align: center;
+    text-decoration: none;
+    box-sizing: border-box;
     cursor: pointer;
     transition: opacity 0.15s ease;
 }
@@ -882,6 +923,23 @@ .bbk-confirmation-heading {
 
 .bbk-confirmation-ref { margin: 0 0 0.25rem; }
 
+.bbk-confirmation-meta {
+    margin: 0 0 1rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+}
+
+.bbk-confirmation-meta-row {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    font-size: 0.9375rem;
+}
+
+.bbk-confirmation-meta-row dt { color: var(--bbk-color-muted); }
+.bbk-confirmation-meta-row dd { margin: 0; font-weight: 600; }
+
 .bbk-confirmation-body {
     margin: 2rem 0;
     display: grid;
@@ -899,11 +957,14 @@ .bbk-confirmation-lines {
 }
 
 .bbk-confirmation-line {
-    display: flex;
-    justify-content: space-between;
-    gap: 1rem;
+    display: grid;
+    grid-template-columns: 72px 1fr auto;
+    align-items: start;
+    gap: 0.875rem;
 }
 
+.bbk-confirmation-line-detail { min-width: 0; }
+
 .bbk-confirmation-line-qty { color: var(--bbk-color-muted); }
 
 .bbk-confirmation-lines .bbk-cart-summary { margin-top: 0.75rem; }
@@ -928,8 +989,3 @@ .bbk-address-lines {
     font-size: 0.875rem;
     color: var(--bbk-color-muted);
 }
-
-.bbk-confirmation-continue {
-    max-width: 280px;
-    text-decoration: none;
-}

resources/js/checkout/bbk-add-to-cart-controller.js

@@ -6,12 +6,15 @@ import { csrfToken } from './csrf'
 // `bbk-cart:changed` window event. No DOM building here — the drawer
 // (bbk-cart-controller) owns rendering.
 export default class extends Controller {
+    static targets = ['error']
+
     async add(event) {
         event.preventDefault()
 
         const form = this.element
         const submit = form.querySelector('[type="submit"]')
 
+        this.clearError()
         form.setAttribute('data-bbk-add-to-cart-state', 'loading')
         if (submit) submit.disabled = true
 
@@ -21,11 +24,16 @@ export default class extends Controller {
                 headers: {
                     'X-CSRF-TOKEN': csrfToken(),
                     'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
                 },
                 body: new FormData(form),
             })
 
-            if (!response.ok) return
+            if (!response.ok) {
+                const data = await response.json().catch(() => null)
+                this.showError(data?.error)
+                return
+            }
 
             window.dispatchEvent(new CustomEvent('bbk-cart:changed', {
                 detail: { html: await response.text() },
@@ -35,4 +43,15 @@ export default class extends Controller {
             if (submit) submit.disabled = false
         }
     }
+
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
 }

resources/js/checkout/bbk-cart-controller.js

@@ -13,11 +13,12 @@ import { csrfToken } from './csrf'
 // Appearance is entirely CSS-driven: open state is the data-bbk-cart-state
 // attribute on the root, nothing here touches styles or class lists.
 export default class extends Controller {
-    static targets = ['panel', 'body']
+    static targets = ['panel', 'body', 'error']
 
     connect() {
         this.onChanged = this.onChanged.bind(this)
         this.onKeydown = this.onKeydown.bind(this)
+        this.updateTimers = new Map() // line id -> pending debounce timer
 
         window.addEventListener('bbk-cart:changed', this.onChanged)
         window.addEventListener('bbk-cart:open', this.open.bind(this))
@@ -30,6 +31,7 @@ export default class extends Controller {
     disconnect() {
         window.removeEventListener('bbk-cart:changed', this.onChanged)
         document.removeEventListener('keydown', this.onKeydown)
+        this.updateTimers.forEach((timer) => clearTimeout(timer))
     }
 
     onChanged(event) {
@@ -63,7 +65,11 @@ export default class extends Controller {
     submit(event) {
         event.preventDefault()
         const form = event.target.closest('form')
-        if (form) this.send(form)
+        if (!form) return
+
+        // A remove is a deliberate, one-shot action — only the quantity form
+        // (typing, or the +/- stepper below) benefits from debouncing.
+        form.classList.contains('bbk-cart-qty') ? this.scheduleSend(form) : this.send(form)
     }
 
     // +/- stepper buttons inside a line
@@ -73,11 +79,27 @@ export default class extends Controller {
         const input = form.querySelector('input[type="number"]')
         const next = Math.max(0, parseInt(input.value || '0', 10) + Number(event.params.dir))
         input.value = String(next)
-        this.send(form)
+        this.scheduleSend(form)
+    }
+
+    // Repeated clicks (or spinner nudges) update the input instantly but only
+    // send once they settle for 300ms — sending on every single click was
+    // firing overlapping requests that raced each other and made the drawer
+    // visibly flicker/lag under quick clicking.
+    scheduleSend(form) {
+        const lineId = form.closest('[data-bbk-line-id]')?.dataset.bbkLineId
+        if (!lineId) return this.send(form)
+
+        clearTimeout(this.updateTimers.get(lineId))
+        this.updateTimers.set(lineId, setTimeout(() => {
+            this.updateTimers.delete(lineId)
+            this.send(form)
+        }, 300))
     }
 
     async send(form) {
         this.bodyTarget.setAttribute('aria-busy', 'true')
+        this.clearError()
 
         try {
             const response = await fetch(form.action, {
@@ -85,16 +107,42 @@ export default class extends Controller {
                 headers: {
                     'X-CSRF-TOKEN': csrfToken(),
                     'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
                 },
                 body: new FormData(form),
             })
 
-            if (response.ok) this.replaceBody(await response.text())
+            if (response.ok) {
+                this.replaceBody(await response.text())
+                return
+            }
+
+            const data = await response.json().catch(() => null)
+            this.showError(data?.error)
+
+            // The rejected quantity (typed, or from a +/- click) is left
+            // sitting in the input with nothing to correct it — the update
+            // never reached the cart, so the input must be put back to what
+            // the cart actually still holds, not just left showing whatever
+            // was rejected.
+            const input = form.querySelector('[data-bbk-cart-confirmed-quantity]')
+            if (input) input.value = input.dataset.bbkCartConfirmedQuantity
         } finally {
             this.bodyTarget.removeAttribute('aria-busy')
         }
     }
 
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
+
     replaceBody(html) {
         this.bodyTarget.innerHTML = html
         this.emitUpdated(this.bodyTarget.querySelector('[data-bbk-cart-count]'))

resources/js/checkout/bbk-checkout-form-controller.js

@@ -13,7 +13,6 @@ import { csrfToken } from './csrf'
 // already uses). Shipping-method radios post to selectShippingUrl the same way.
 export default class extends Controller {
     static targets = [
-        'guestTab', 'loginTab', 'guestPanel', 'loginPanel',
         'sameAsBilling', 'shippingFields',
         'form', 'shippingOptions', 'status',
     ]
@@ -41,22 +40,6 @@ export default class extends Controller {
         this.saveController?.abort()
     }
 
-    // ── Contact tabs ────────────────────────────────────────────────────
-
-    showGuest() {
-        this.guestPanelTarget.hidden = false
-        this.loginPanelTarget.hidden = true
-        this.guestTabTarget.setAttribute('aria-selected', 'true')
-        this.loginTabTarget.setAttribute('aria-selected', 'false')
-    }
-
-    showLogin() {
-        this.guestPanelTarget.hidden = true
-        this.loginPanelTarget.hidden = false
-        this.guestTabTarget.setAttribute('aria-selected', 'false')
-        this.loginTabTarget.setAttribute('aria-selected', 'true')
-    }
-
     // ── Same as billing ────────────────────────────────────────────────
 
     toggleSameAsBilling() {
@@ -93,7 +76,6 @@ export default class extends Controller {
         // react to fields that actually belong to the address form.
         const el = event.target
         const belongsToForm = el.form?.id === 'bbk-address-form'
-            || el.closest('[data-bbk-checkout-form-target="guestPanel"]')
         if (!belongsToForm) return
 
         // No status during the wait — it only shows once the request is in flight,

resources/js/checkout/bbk-payment-controller.js

@@ -43,6 +43,16 @@ export default class extends Controller {
                 this.amountValue = total
                 this.elements.update({ amount: Math.max(total, 1) })
             }
+
+            // Removing the last line while sitting on the checkout page (via
+            // the order summary's own remove form) must not leave "place
+            // order" clickable with nothing left to charge for — this fires
+            // from both the drawer and the checkout page's own summary
+            // instance, whichever the shopper actually used.
+            const count = event.detail?.count
+            if (typeof count === 'number' && this.hasSubmitTarget) {
+                this.submitTarget.disabled = count === 0
+            }
         }
         window.addEventListener('bbk-cart:updated', this.onSummaryUpdate)
 

resources/js/stimulus/custom-field-upload-controller.js

@@ -0,0 +1,108 @@
+import { Controller } from '@hotwired/stimulus'
+
+// One product custom field of type `file` (see x-product-custom-fields).
+// Uploads the photo to the storefront's own endpoint (CustomFieldUploadController)
+// as soon as it's picked, then writes the returned File row's id (boboko-core's
+// Modules\Core\File\Models\File) into the hidden input the add-to-cart form
+// actually submits — the checkout module never receives the file itself.
+//
+// While uploading, the file input is marked invalid via setCustomValidity(),
+// so the browser's own form validation blocks add-to-cart until the id is in
+// place. A failed upload clears the input, so `required` blocks it too.
+export default class extends Controller {
+    static targets = ['file', 'reference', 'preview', 'error']
+    static values  = {
+        url: String,
+        label: String,
+        uploadingMessage: String,
+        failedMessage: String,
+    }
+
+    disconnect() {
+        this.abortController?.abort()
+        this.revokePreview()
+    }
+
+    async upload() {
+        this.reset()
+
+        const file = this.fileTarget.files[0]
+        if (!file) return
+
+        const abortController = new AbortController()
+        this.abortController = abortController
+
+        this.fileTarget.setCustomValidity(this.uploadingMessageValue)
+        this.fileTarget.setAttribute('aria-busy', 'true')
+
+        const body = new FormData()
+        body.append('file', file)
+        body.append('label', this.labelValue)
+
+        try {
+            const response = await fetch(this.urlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]')?.content ?? '',
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body,
+                signal: abortController.signal,
+            })
+            const data = await response.json().catch(() => null)
+
+            if (!response.ok || !data?.file_id) {
+                this.fail(data?.error)
+                return
+            }
+
+            this.referenceTarget.value = data.file_id
+            this.showPreview(file)
+        } catch (error) {
+            // A newer pick superseded this upload — reset() already handled it.
+            if (error.name === 'AbortError') return
+            this.fail()
+        } finally {
+            if (!abortController.signal.aborted) this.markIdle()
+        }
+    }
+
+    reset() {
+        this.abortController?.abort()
+        this.referenceTarget.value = ''
+        this.errorTarget.hidden = true
+        this.markIdle()
+        this.revokePreview()
+    }
+
+    fail(message) {
+        this.fileTarget.value = ''
+        this.errorTarget.textContent = message || this.failedMessageValue
+        this.errorTarget.hidden = false
+    }
+
+    markIdle() {
+        this.fileTarget.setCustomValidity('')
+        this.fileTarget.removeAttribute('aria-busy')
+    }
+
+    showPreview(file) {
+        this.previewUrl = URL.createObjectURL(file)
+        this.previewTarget.src = this.previewUrl
+        this.previewTarget.hidden = false
+    }
+
+    // Formats the browser can't render (HEIC outside Safari) — the file
+    // input's own filename is enough there.
+    hidePreview() {
+        this.previewTarget.hidden = true
+    }
+
+    revokePreview() {
+        if (this.previewUrl) URL.revokeObjectURL(this.previewUrl)
+        this.previewUrl = null
+        this.previewTarget.removeAttribute('src')
+        this.previewTarget.hidden = true
+    }
+}

resources/js/stimulus/index.js

@@ -8,6 +8,7 @@ import AutoSubmitController     from './auto-submit-controller'
 import BackToTopController      from './back-to-top-controller'
 import CartCountController      from './cart-count-controller'
 import CarouselController       from './carousel-controller'
+import CustomFieldUploadController from './custom-field-upload-controller'
 import DropdownController       from './dropdown-controller'
 import FrameScrollController    from './frame-scroll-controller'
 import NavSearchController      from './nav-search-controller'
@@ -16,7 +17,9 @@ import ProductGalleryController from './product-gallery-controller'
 import QuantityController      from './quantity-controller'
 import RangeSliderController   from './range-slider-controller'
 import StarRatingController    from './star-rating-controller'
+import TabLinkController       from './tab-link-controller'
 import TabsController          from './tabs-controller'
+import WishlistController      from './wishlist-controller'
 
 export function registerControllers(application) {
     application.register('appear',           AppearController)
@@ -24,6 +27,7 @@ export function registerControllers(application) {
     application.register('back-to-top',      BackToTopController)
     application.register('cart-count',       CartCountController)
     application.register('carousel',         CarouselController)
+    application.register('custom-field-upload', CustomFieldUploadController)
     application.register('dropdown',         DropdownController)
     application.register('frame-scroll',     FrameScrollController)
     application.register('nav-search',       NavSearchController)
@@ -32,5 +36,7 @@ export function registerControllers(application) {
     application.register('quantity',         QuantityController)
     application.register('range-slider',     RangeSliderController)
     application.register('star-rating',      StarRatingController)
+    application.register('tab-link',         TabLinkController)
     application.register('tabs',             TabsController)
+    application.register('wishlist',         WishlistController)
 }

resources/js/stimulus/product-form-controller.js

@@ -2,25 +2,138 @@ import { Controller } from '@hotwired/stimulus'
 import { formatPrice } from '../utils/format-price'
 
 export default class extends Controller {
-    static targets = ['price', 'image', 'swatch', 'colorName']
-    static values  = { variants: Array, selected: Number }
+    static targets = ['price', 'image', 'swatch', 'colorName', 'stockError', 'submit']
+    static values  = {
+        variants: Array,
+        selected: Number,
+        stockCheckUrl: String,
+        // Two pre-rendered translated templates (see product/show.blade.php)
+        // rather than one — this controller doesn't reimplement Laravel's
+        // pluralization rules, it just picks whichever of these two the
+        // count actually needs and fills in the number.
+        stockErrorOne: String,
+        stockErrorMany: String,
+    }
 
     connect() {
-        const params    = new URLSearchParams(window.location.search)
-        const urlId     = parseInt(params.get('variant'))
-        const defaultId = this.variantsValue[0]?.id
+        const params      = new URLSearchParams(window.location.search)
+        const urlId       = parseInt(params.get('variant'))
+        const urlVariant  = this.variantsValue.find(v => v.id === urlId)
+        const initial     = urlVariant ?? this.variantsValue[0]
 
-        this.selectedValue = urlId && this.variantsValue.find(v => v.id === urlId)
-            ? urlId
-            : defaultId
+        // A product can have several independent options (e.g. size + style
+        // + person-count) — this tracks the currently-picked value id per
+        // option handle, and selectVariant() below resolves the full
+        // combination back to one exact variant on every change.
+        this.selections = { ...initial?.options }
+        this.selectedValue = initial?.id
+
+        // Capture phase, on this controller's own root element (an ancestor
+        // of the checkout module's add-to-cart <form>) — runs BEFORE that
+        // form's own bubble-phase submit handler (bbk-add-to-cart#add), so a
+        // failed check can stop it from ever reaching the module at all. The
+        // module itself is never touched or modified for this: it keeps
+        // validating server-side regardless, this is purely an up-front,
+        // storefront-owned check (see [[project_checkout_module]] for why
+        // that split matters — stock UX is a catalog concern, not something
+        // the portable checkout module should own) — and a REAL, live check
+        // against the backend (ProductController::checkStock(), reading the
+        // Eloquent model directly), not page-load data that can go stale.
+        this.onSubmitCapture = this.checkStock.bind(this)
+        this.element.addEventListener('submit', this.onSubmitCapture, true)
+    }
+
+    disconnect() {
+        this.element.removeEventListener('submit', this.onSubmitCapture, true)
+    }
+
+    checkStock(event) {
+        const form = event.target
+        if (!form.matches('.bbk-add-to-cart')) return
+
+        // The re-submit this itself triggers below, once the backend has
+        // confirmed the quantity is fine — let that one through to the
+        // module's own submit handler instead of checking a second time.
+        if (form.dataset.bbkStockChecked) {
+            delete form.dataset.bbkStockChecked
+            return
+        }
+
+        event.preventDefault()
+        event.stopPropagation()
+        this.verifyStock(form)
+    }
+
+    async verifyStock(form) {
+        this.clearStockError()
+
+        const submit = form.querySelector('[type="submit"]')
+        if (submit) submit.disabled = true
+
+        const purchasableId = form.querySelector('[data-bbk-purchasable-input]')?.value
+        const quantity = form.querySelector('[name="quantity"]')?.value || '1'
+
+        try {
+            const url = new URL(this.stockCheckUrlValue, window.location.origin)
+            url.searchParams.set('variant', purchasableId)
+            url.searchParams.set('quantity', quantity)
+
+            const response = await fetch(url, { headers: { Accept: 'application/json' } })
+            const data = await response.json()
+
+            if (!data.ok) {
+                this.showStockError(data.stock)
+                return
+            }
+        } catch {
+            // Network hiccup — fall through and let the checkout module's
+            // own server-side check have the final word rather than
+            // silently blocking the shopper here.
+        } finally {
+            if (submit) submit.disabled = !this.selectedVariant?.inStock
+        }
+
+        form.dataset.bbkStockChecked = 'true'
+        form.requestSubmit()
+    }
+
+    showStockError(available) {
+        if (!this.hasStockErrorTarget) return
+
+        this.stockErrorTarget.textContent = available === 1
+            ? this.stockErrorOneValue
+            : this.stockErrorManyValue.replace(':count', String(available))
+        this.stockErrorTarget.hidden = false
+    }
+
+    clearStockError() {
+        if (!this.hasStockErrorTarget) return
+        this.stockErrorTarget.hidden = true
+    }
+
+    get selectedVariant() {
+        return this.variantsValue.find(v => v.id === this.selectedValue)
     }
 
     selectVariant(event) {
-        const id = parseInt(event.currentTarget.dataset.variantId)
-        this.selectedValue = id
+        const option = event.currentTarget.dataset.option
+        const valueId = parseInt(event.currentTarget.dataset.valueId)
+        this.selections = { ...this.selections, [option]: valueId }
+
+        const match = this.variantsValue.find(variant =>
+            Object.keys(this.selections).every(key => variant.options?.[key] === this.selections[key])
+        )
+
+        // No variant exists for this combination (e.g. an option value that
+        // isn't offered together with another currently-selected value) —
+        // leave the previous selection in place rather than pointing the
+        // add-to-cart form at nothing.
+        if (!match) return
+
+        this.selectedValue = match.id
 
         const url = new URL(window.location)
-        url.searchParams.set('variant', id)
+        url.searchParams.set('variant', match.id)
         window.history.pushState({}, '', url)
     }
 
@@ -30,6 +143,8 @@ export default class extends Controller {
         const variant = this.variantsValue.find(v => v.id === id)
         if (!variant) return
 
+        this.clearStockError()
+
         if (this.hasPriceTarget && variant.price !== null) {
             this.priceTarget.textContent = formatPrice(variant.price)
         }
@@ -45,13 +160,20 @@ export default class extends Controller {
         const purchasableInput = this.element.querySelector('[data-bbk-purchasable-input]')
         if (purchasableInput) purchasableInput.value = id
 
+        // Out-of-stock variant (as of page load) can't be added at all.
+        if (this.hasSubmitTarget) this.submitTarget.disabled = !variant.inStock
+
         this.swatchTargets.forEach(swatch => {
-            const isSelected = parseInt(swatch.dataset.variantId) === id
+            const isSelected = this.selections[swatch.dataset.option] === parseInt(swatch.dataset.valueId)
             swatch.classList.toggle('is-selected', isSelected)
             swatch.setAttribute('aria-pressed', String(isSelected))
 
-            if (isSelected && this.hasColorNameTarget) {
-                this.colorNameTarget.textContent = swatch.getAttribute('aria-label')
+            if (isSelected) {
+                // Each color-option group has its own colorName echo (see
+                // x-ui.color-swatch) — matched by option handle so a swatch
+                // in one group never overwrites another group's label.
+                const colorName = this.colorNameTargets.find(target => target.dataset.option === swatch.dataset.option)
+                if (colorName) colorName.textContent = swatch.getAttribute('aria-label')
             }
         })
     }

resources/js/stimulus/star-rating-controller.js

@@ -1,9 +1,25 @@
 import { Controller } from '@hotwired/stimulus'
 
 export default class extends Controller {
-    static targets = ['star', 'input']
+    static targets = ['star', 'input', 'error']
     static values  = { rating: { type: Number, default: 0 } }
 
+    connect() {
+        this.#fill(this.ratingValue)
+    }
+
+    // Bound to the form's submit event (this controller sits on the <form>
+    // itself, not just the star widget) — a plain `required` on the hidden
+    // rating input would never surface: browsers exclude type="hidden" from
+    // constraint validation entirely, so there'd be nothing to see or hear.
+    validate(event) {
+        if (this.ratingValue < 1) {
+            event.preventDefault()
+            this.errorTarget.hidden = false
+            this.starTargets[0]?.focus()
+        }
+    }
+
     hover(event) {
         this.#fill(parseInt(event.currentTarget.dataset.value))
     }
@@ -16,6 +32,7 @@ export default class extends Controller {
         const val = parseInt(event.currentTarget.dataset.value)
         this.ratingValue = val
         this.inputTarget.value = val
+        this.errorTarget.hidden = true
 
         this.starTargets.forEach(star => {
             star.setAttribute('aria-pressed', String(parseInt(star.dataset.value) === val))

resources/js/stimulus/tab-link-controller.js

@@ -0,0 +1,15 @@
+import { Controller } from '@hotwired/stimulus'
+
+// Jumps to a tab panel from an element outside the tabs' own markup — the
+// review count and the "read more" link both sit elsewhere in the DOM, too
+// far apart from the tabs for a plain data-action, hence the outlet.
+export default class extends Controller {
+    static outlets = ['tabs']
+    static values = { panel: String }
+
+    activate(event) {
+        event?.preventDefault()
+        this.tabsOutlet.activate(this.panelValue)
+        this.tabsOutlet.element.scrollIntoView({ block: 'start', behavior: 'smooth' })
+    }
+}

resources/js/stimulus/tabs-controller.js

@@ -4,10 +4,10 @@ export default class extends Controller {
     static targets = ['button', 'panel']
 
     show(event) {
-        this.#activate(event.currentTarget.dataset.panel)
+        this.activate(event.currentTarget.dataset.panel)
     }
 
-    #activate(panelId) {
+    activate(panelId) {
         this.buttonTargets.forEach(btn => {
             const active = btn.dataset.panel === panelId
             btn.classList.toggle('is-active', active)

resources/js/stimulus/wishlist-controller.js

@@ -0,0 +1,42 @@
+import { Controller } from '@hotwired/stimulus'
+
+// Heart toggle (x-wishlist-button). Posts the form with fetch and reflects the
+// server's answer on aria-pressed, which the CSS uses to swap the outline and
+// filled heart. If the request fails, falls back to a normal form submit.
+export default class extends Controller {
+    static targets = ['button', 'status']
+
+    static values = {
+        addLabel: String,
+        removeLabel: String,
+        addedMessage: String,
+        removedMessage: String,
+    }
+
+    async toggle(event) {
+        event.preventDefault()
+
+        if (this.busy) return
+        this.busy = true
+
+        try {
+            const response = await fetch(this.element.action, {
+                method: 'POST',
+                headers: { Accept: 'application/json', 'X-Requested-With': 'XMLHttpRequest' },
+                body: new FormData(this.element),
+            })
+
+            if (!response.ok) throw new Error(`Wishlist toggle failed: ${response.status}`)
+
+            const { active } = await response.json()
+
+            this.buttonTarget.setAttribute('aria-pressed', active ? 'true' : 'false')
+            this.buttonTarget.setAttribute('aria-label', active ? this.removeLabelValue : this.addLabelValue)
+            this.statusTarget.textContent = active ? this.addedMessageValue : this.removedMessageValue
+        } catch {
+            this.element.submit()
+        } finally {
+            this.busy = false
+        }
+    }
+}

resources/views/account/email-code.blade.php

@@ -0,0 +1,65 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.auth.enter_code'))
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.auth.enter_code') }}
+            </h1>
+
+            <p>
+                {{ __('storefront.auth.code_sent_to') }} <strong class="break-all">{{ $email }}</strong>
+            </p>
+
+            <x-ui.status />
+        </div>
+
+        <form method="POST" action="{{ route('account.email.verify') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.code')"
+                for="account-email-code"
+                :required="true"
+                :error="$errors->first('code')"
+            >
+                <x-ui.input
+                    id="account-email-code"
+                    name="code"
+                    inputmode="numeric"
+                    autocomplete="one-time-code"
+                    pattern="[0-9]{6}"
+                    maxlength="6"
+                    :required="true"
+                    autofocus
+                    class="text-2xl font-bold tracking-[0.5em]"
+                    :aria-invalid="$errors->has('code') ? 'true' : null"
+                    :aria-describedby="$errors->has('code') ? 'account-email-code-error' : null"
+                />
+            </x-ui.field>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.account.email_confirm') }}</x-ui.button>
+            </div>
+        </form>
+
+        <div class="flex flex-wrap items-center gap-x-8 gap-y-4 text-sm">
+            <form method="POST" action="{{ route('account.email.resend') }}">
+                @csrf
+                <button type="submit" class="cursor-pointer underline hover:no-underline">
+                    {{ __('storefront.auth.resend_code') }}
+                </button>
+            </form>
+
+            <a href="{{ route('account.email.edit') }}" class="underline hover:no-underline">
+                {{ __('storefront.auth.change_email') }}
+            </a>
+        </div>
+
+    </div>
+
+@endsection

resources/views/account/email.blade.php

@@ -0,0 +1,53 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.email_change_heading'))
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.account.email_change_heading') }}
+            </h1>
+
+            <p>
+                {{ __('storefront.account.email_current') }} <strong class="break-all">{{ $user->email }}</strong>
+            </p>
+        </div>
+
+        <form method="POST" action="{{ route('account.email.send') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.account.email_new')"
+                for="account-new-email"
+                :required="true"
+                :description="__('storefront.account.email_new_hint')"
+                :error="$errors->first('email')"
+            >
+                <x-ui.input
+                    id="account-new-email"
+                    name="email"
+                    type="email"
+                    autocomplete="email"
+                    :value="old('email')"
+                    :required="true"
+                    autofocus
+                    :aria-invalid="$errors->has('email') ? 'true' : null"
+                    :aria-describedby="$errors->has('email') ? 'account-new-email-error' : 'account-new-email-description'"
+                />
+            </x-ui.field>
+
+            <div class="flex flex-wrap items-center gap-8">
+                <x-ui.button type="submit">{{ __('storefront.auth.send_code') }}</x-ui.button>
+
+                <a href="{{ route('account') }}" class="text-sm underline hover:no-underline">
+                    {{ __('storefront.account.delete_cancel') }}
+                </a>
+            </div>
+        </form>
+
+    </div>
+
+@endsection

resources/views/account/orders/index.blade.php

@@ -0,0 +1,67 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_orders'))
+
+@section('account')
+
+    <div class="flex max-w-4xl flex-col gap-12">
+
+        <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.account.nav_orders') }}
+        </h1>
+
+        @if ($orders->isEmpty())
+            <div class="flex flex-col items-start gap-8">
+                <p>{{ __('storefront.orders.empty') }}</p>
+                <x-ui.button :href="route('products')" size="md">{{ __('storefront.orders.shop_now') }}</x-ui.button>
+            </div>
+        @else
+            {{-- A list, not a table, so each order can stack on mobile. The column
+                 headings are visual only; each cell carries its own sr-only label. --}}
+            <div>
+                <div class="hidden grid-cols-[1fr_1fr_1.5fr_1fr_auto] gap-6 border-b border-black pb-3 text-sm uppercase font-display font-extrabold sm:grid" aria-hidden="true">
+                    <span>{{ __('storefront.orders.date') }}</span>
+                    <span>{{ __('storefront.orders.number') }}</span>
+                    <span>{{ __('storefront.orders.status') }}</span>
+                    <span>{{ __('storefront.orders.total') }}</span>
+                    <span class="w-24"></span>
+                </div>
+
+                <ul>
+                    @foreach ($orders as $order)
+                        <li class="grid grid-cols-2 gap-x-6 gap-y-2 border-b border-black py-5 sm:grid-cols-[1fr_1fr_1.5fr_1fr_auto] sm:items-center">
+                            <span>
+                                <span class="sr-only">{{ __('storefront.orders.date') }}:</span>
+                                {{ $order->placed_at->format('d/m/Y') }}
+                            </span>
+                            <span class="text-right font-bold sm:text-left">
+                                <span class="sr-only">{{ __('storefront.orders.number') }}:</span>
+                                #{{ $order->reference }}
+                            </span>
+                            <span>
+                                <span class="sr-only">{{ __('storefront.orders.status') }}:</span>
+                                <x-order-status :status="$order->status" />
+                            </span>
+                            <span class="text-right sm:text-left">
+                                <span class="sr-only">{{ __('storefront.orders.total') }}:</span>
+                                {{ $order->total?->formatted() }}
+                            </span>
+                            <a
+                                href="{{ route('account.orders.show', ['orderId' => $order->id]) }}"
+                                class="col-span-2 mt-2 inline-flex w-24 items-center gap-2 font-bold underline hover:no-underline sm:col-span-1 sm:mt-0"
+                                aria-label="{{ __('storefront.orders.view_order', ['number' => $order->reference]) }}"
+                            >
+                                {{ __('storefront.orders.view') }}
+                                <x-ui.icon name="arrow-right" :size="16" />
+                            </a>
+                        </li>
+                    @endforeach
+                </ul>
+            </div>
+
+            <x-ui.pagination :paginator="$orders" />
+        @endif
+
+    </div>
+
+@endsection

resources/views/account/orders/show.blade.php

@@ -0,0 +1,158 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.orders.order_title', ['number' => $order->reference]))
+
+@php
+    $productLines = $order->lines->where('type', '!=', 'shipping');
+    $shippingLine = $order->lines->firstWhere('type', 'shipping');
+@endphp
+
+@section('account')
+
+    <div class="flex max-w-4xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <a href="{{ route('account.orders') }}" class="inline-flex items-center gap-2 self-start text-sm underline hover:no-underline">
+                <x-ui.icon name="arrow-left" :size="16" />
+                {{ __('storefront.orders.back') }}
+            </a>
+
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.orders.order_title', ['number' => $order->reference]) }}
+            </h1>
+        </div>
+
+        {{-- Summary --}}
+        <dl class="grid grid-cols-1 gap-6 border-y border-black py-6 sm:grid-cols-2 lg:grid-cols-4">
+            <div class="flex flex-col gap-1">
+                <dt class="text-sm text-neutral-500">{{ __('storefront.orders.date') }}</dt>
+                <dd>{{ $order->placed_at->format('d/m/Y') }}</dd>
+            </div>
+
+            <div class="flex flex-col gap-1">
+                <dt class="text-sm text-neutral-500">{{ __('storefront.orders.status') }}</dt>
+                <dd class="font-bold"><x-order-status :status="$order->status" /></dd>
+            </div>
+
+            @if ($paymentMethodName)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.payment') }}</dt>
+                    <dd>{{ $paymentMethodName }}</dd>
+                </div>
+            @endif
+
+            @if ($shippingLine)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.shipping_method') }}</dt>
+                    <dd>{{ $shippingLine->description }}</dd>
+                </div>
+            @endif
+
+            @foreach ($shipments as $shipment)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.tracking') }}</dt>
+                    <dd class="break-all">{{ $shipment->tracking_reference }}</dd>
+                </div>
+            @endforeach
+        </dl>
+
+        {{-- Items + totals --}}
+        <section class="flex flex-col gap-6" aria-labelledby="order-items-heading">
+            <h2 id="order-items-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.orders.items') }}</h2>
+
+            <ul>
+                @foreach ($productLines as $line)
+                    <li class="flex gap-4 border-b border-black py-5 sm:gap-6">
+                        <div class="size-18 shrink-0 bg-neutral-300 sm:size-24">
+                            @if ($thumb = $line->purchasable?->getThumbnailImage())
+                                <img src="{{ $thumb }}" alt="" aria-hidden="true" width="96" height="96" loading="lazy" class="size-full object-cover">
+                            @endif
+                        </div>
+
+                        <div class="flex min-w-0 flex-1 flex-col gap-1">
+                            {{-- Linked only while the product still exists and is published;
+                                 otherwise the name stays plain text (the order keeps it). --}}
+                            @php($lineProduct = $line->purchasable?->product)
+                            <p class="font-bold">
+                                @if ($lineProduct?->status === 'published')
+                                    <a href="{{ route('product.show', ['id' => $lineProduct->id]) }}" class="underline hover:no-underline">{{ $line->description }}</a>
+                                @else
+                                    {{ $line->description }}
+                                @endif
+                                <span class="font-normal">&times; {{ $line->quantity }}</span>
+                            </p>
+
+                            @if ($line->option)
+                                <p class="text-sm text-neutral-500">{{ $line->option }}</p>
+                            @endif
+
+                            @include('checkout::partials.line-custom-fields', ['line' => $line])
+                        </div>
+
+                        <p class="shrink-0 font-bold">{{ $line->sub_total?->formatted() }}</p>
+                    </li>
+                @endforeach
+            </ul>
+
+            <dl class="ml-auto flex w-full max-w-sm flex-col gap-2">
+                <div class="flex justify-between gap-6">
+                    <dt>{{ __('storefront.orders.subtotal') }}</dt>
+                    <dd>{{ $order->sub_total?->formatted() }}</dd>
+                </div>
+
+                @if ($order->discount_total?->value > 0)
+                    <div class="flex justify-between gap-6">
+                        <dt>{{ __('storefront.orders.discount') }}</dt>
+                        <dd>&minus;{{ $order->discount_total->formatted() }}</dd>
+                    </div>
+                @endif
+
+                <div class="flex justify-between gap-6">
+                    <dt>{{ __('storefront.orders.shipping') }}</dt>
+                    <dd>{{ $order->shipping_total?->formatted() }}</dd>
+                </div>
+
+                @if ($order->tax_total?->value > 0)
+                    <div class="flex justify-between gap-6 text-sm text-neutral-500">
+                        <dt>{{ __('storefront.orders.tax') }}</dt>
+                        <dd>{{ $order->tax_total->formatted() }}</dd>
+                    </div>
+                @endif
+
+                <div class="flex justify-between gap-6 border-t border-black pt-3 font-display text-h4 font-extrabold">
+                    <dt>{{ __('storefront.orders.total') }}</dt>
+                    <dd>{{ $order->total?->formatted() }}</dd>
+                </div>
+            </dl>
+        </section>
+
+        {{-- Addresses --}}
+        <div class="grid grid-cols-1 gap-12 sm:grid-cols-2">
+            @foreach ([
+                'shipping_to' => $order->shippingAddress,
+                'billing' => $order->billingAddress,
+            ] as $heading => $address)
+                @if ($address)
+                    <section class="flex flex-col gap-4" aria-labelledby="order-{{ $heading }}-heading">
+                        <h2 id="order-{{ $heading }}-heading" class="font-display text-h4 font-extrabold">{{ __("storefront.orders.{$heading}") }}</h2>
+
+                        <address class="flex flex-col not-italic">
+                            <span>{{ trim($address->first_name.' '.$address->last_name) }}</span>
+                            @if ($address->company_name)<span>{{ $address->company_name }}</span>@endif
+                            @if ($address->tax_identifier)<span>{{ __('storefront.account.tax_identifier') }}: {{ $address->tax_identifier }}</span>@endif
+                            <span>{{ $address->line_one }}</span>
+                            @if ($address->line_two)<span>{{ $address->line_two }}</span>@endif
+                            <span>{{ trim($address->postcode.' '.$address->city) }}</span>
+                            @if ($address->state)
+                                <span>{{ Lang::has("core::states.{$address->state}") ? __("core::states.{$address->state}") : $address->state }}</span>
+                            @endif
+                            @if ($address->contact_phone)<span>{{ $address->contact_phone }}</span>@endif
+                        </address>
+                    </section>
+                @endif
+            @endforeach
+        </div>
+
+    </div>
+
+@endsection

resources/views/account/show.blade.php

@@ -0,0 +1,204 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_profile'))
+
+@php
+    $wantsInvoice = (bool) old('invoice', filled($customer?->company_name) || filled($customer?->tax_identifier));
+
+    $regionOptions = $regions->map(fn ($region) => [
+        'value' => $region->name,
+        'label' => Lang::has("core::states.{$region->name}") ? __("core::states.{$region->name}") : $region->name,
+    ])->all();
+
+@endphp
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-16">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.account.nav_profile') }}
+            </h1>
+
+            <x-ui.status />
+        </div>
+
+        {{-- Email: the login itself, so it's changed through its own verified flow --}}
+        <section class="flex flex-col gap-6" aria-labelledby="account-email-heading">
+            <h2 id="account-email-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.email_heading') }}</h2>
+
+            <div class="flex flex-wrap items-center justify-between gap-x-8 gap-y-2 border-b border-black py-2">
+                <span class="break-all">{{ $user->email }}</span>
+                <a href="{{ route('account.email.edit') }}" class="text-sm underline hover:no-underline">
+                    {{ __('storefront.account.email_change') }}
+                </a>
+            </div>
+        </section>
+
+        <form method="POST" action="{{ route('account.update') }}" class="flex flex-col gap-16">
+            @csrf
+            @method('PUT')
+
+            {{-- Details --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-details-heading">
+                <h2 id="account-details-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.details_heading') }}</h2>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.first_name')" for="account-first-name" :error="$errors->first('first_name')">
+                        <x-ui.input id="account-first-name" name="first_name" autocomplete="given-name"
+                            :value="old('first_name', $customer?->first_name)"
+                            :aria-invalid="$errors->has('first_name') ? 'true' : null" :aria-describedby="$errors->has('first_name') ? 'account-first-name-error' : null" />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.last_name')" for="account-last-name" :error="$errors->first('last_name')">
+                        <x-ui.input id="account-last-name" name="last_name" autocomplete="family-name"
+                            :value="old('last_name', $customer?->last_name)"
+                            :aria-invalid="$errors->has('last_name') ? 'true' : null" :aria-describedby="$errors->has('last_name') ? 'account-last-name-error' : null" />
+                    </x-ui.field>
+                </div>
+
+                {{-- Invoice details, revealed by the checkbox (CSS :has(), no JS). Not
+                     `required` in HTML: a hidden required field would block submit, so
+                     the server requires them only when the box is ticked. --}}
+                <div class="group/invoice flex flex-col gap-8">
+                    <input type="hidden" name="invoice" value="0">
+                    <x-ui.checkbox
+                        id="account-invoice"
+                        name="invoice"
+                        :checked="$wantsInvoice"
+                        :label="__('storefront.account.invoice')"
+                        aria-controls="account-invoice-fields"
+                    />
+
+                    <div id="account-invoice-fields" class="hidden grid-cols-1 gap-8 sm:grid-cols-2 group-has-[#account-invoice:checked]/invoice:grid">
+                        <x-ui.field :label="__('storefront.account.company_name')" for="account-company" :error="$errors->first('company_name')">
+                            <x-ui.input id="account-company" name="company_name" autocomplete="organization"
+                                :value="old('company_name', $customer?->company_name)"
+                                :aria-invalid="$errors->has('company_name') ? 'true' : null" :aria-describedby="$errors->has('company_name') ? 'account-company-error' : null" />
+                        </x-ui.field>
+
+                        <x-ui.field :label="__('storefront.account.tax_identifier')" for="account-tax-id" :error="$errors->first('tax_identifier')">
+                            <x-ui.input id="account-tax-id" name="tax_identifier" inputmode="numeric" maxlength="9" pattern="[0-9]{9}"
+                                :value="old('tax_identifier', $customer?->tax_identifier)"
+                                :aria-invalid="$errors->has('tax_identifier') ? 'true' : null" :aria-describedby="$errors->has('tax_identifier') ? 'account-tax-id-error' : null" />
+                        </x-ui.field>
+                    </div>
+                </div>
+            </section>
+
+            {{-- Address: one, used as both shipping and billing default --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-address-heading">
+                <h2 id="account-address-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.address_heading') }}</h2>
+
+                <x-ui.field :label="__('storefront.account.line_one')" for="account-line-one" :error="$errors->first('line_one')">
+                    <x-ui.input id="account-line-one" name="line_one" autocomplete="address-line1"
+                        :value="old('line_one', $address?->line_one)"
+                        :aria-invalid="$errors->has('line_one') ? 'true' : null" :aria-describedby="$errors->has('line_one') ? 'account-line-one-error' : null" />
+                </x-ui.field>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.city')" for="account-city" :error="$errors->first('city')">
+                        <x-ui.input id="account-city" name="city" autocomplete="address-level2"
+                            :value="old('city', $address?->city)"
+                            :aria-invalid="$errors->has('city') ? 'true' : null" :aria-describedby="$errors->has('city') ? 'account-city-error' : null" />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.postcode')" for="account-postcode" :error="$errors->first('postcode')">
+                        <x-ui.input id="account-postcode" name="postcode" autocomplete="postal-code" inputmode="numeric"
+                            :value="old('postcode', $address?->postcode)"
+                            :aria-invalid="$errors->has('postcode') ? 'true' : null" :aria-describedby="$errors->has('postcode') ? 'account-postcode-error' : null" />
+                    </x-ui.field>
+                </div>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.state')" for="account-state" :error="$errors->first('state')">
+                        <x-ui.select
+                            id="account-state"
+                            name="state"
+                            :block="true"
+                            :options="$regionOptions"
+                            :value="old('state', $address?->state)"
+                            :placeholder="__('storefront.account.state_placeholder')"
+                            :aria-invalid="$errors->has('state') ? 'true' : null"
+                            :aria-describedby="$errors->has('state') ? 'account-state-error' : null"
+                        />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.phone')" for="account-phone" :error="$errors->first('contact_phone')">
+                        <x-ui.input id="account-phone" name="contact_phone" type="tel" autocomplete="tel"
+                            :value="old('contact_phone', $address?->contact_phone)"
+                            :aria-invalid="$errors->has('contact_phone') ? 'true' : null" :aria-describedby="$errors->has('contact_phone') ? 'account-phone-error' : null" />
+                    </x-ui.field>
+                </div>
+            </section>
+
+            {{-- Standing opt-in for abandoned-cart reminders (explicit, off by
+                 default); checkout starts from it and can change it again. --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-emails-heading">
+                <h2 id="account-emails-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.emails_heading') }}</h2>
+
+                <div>
+                    <input type="hidden" name="recovery_consent" value="0">
+                    <x-ui.checkbox
+                        id="account-recovery-consent"
+                        name="recovery_consent"
+                        :checked="(bool) old('recovery_consent', data_get($customer, 'meta.recovery_consent'))"
+                        :label="__('storefront.account.recovery_consent')"
+                    />
+                </div>
+            </section>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.account.save') }}</x-ui.button>
+            </div>
+        </form>
+
+        {{-- Delete account --}}
+        <section class="flex flex-col gap-6 border-t border-black pt-12" aria-labelledby="account-delete-heading">
+            <h2 id="account-delete-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.delete_heading') }}</h2>
+
+            <p>{{ __('storefront.account.delete_text') }}</p>
+
+            <div>
+                <x-ui.button
+                    variant="secondary"
+                    size="md"
+                    popovertarget="account-delete-dialog"
+                    aria-haspopup="dialog"
+                >{{ __('storefront.account.delete') }}</x-ui.button>
+            </div>
+
+            <div
+                id="account-delete-dialog"
+                popover
+                role="dialog"
+                aria-modal="true"
+                aria-labelledby="account-delete-dialog-heading"
+                class="m-auto w-[calc(100%-2rem)] max-w-lg border border-black bg-neutral-200 p-8 backdrop:bg-black/50"
+            >
+                <h3 id="account-delete-dialog-heading" class="mb-4 font-display text-h4 font-extrabold">
+                    {{ __('storefront.account.delete_confirm_heading') }}
+                </h3>
+
+                <p class="mb-8">{{ __('storefront.account.delete_confirm_text') }}</p>
+
+                <form method="POST" action="{{ route('account.destroy') }}" class="flex flex-wrap gap-4">
+                    @csrf
+                    @method('DELETE')
+
+                    <x-ui.button type="submit" size="md">{{ __('storefront.account.delete_confirm') }}</x-ui.button>
+
+                    <x-ui.button
+                        variant="secondary"
+                        size="md"
+                        popovertarget="account-delete-dialog"
+                        popovertargetaction="hide"
+                    >{{ __('storefront.account.delete_cancel') }}</x-ui.button>
+                </form>
+            </div>
+        </section>
+
+    </div>
+
+@endsection

resources/views/account/wishlist.blade.php

@@ -0,0 +1,17 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_wishlist'))
+
+@section('account')
+
+    <div class="flex flex-col gap-12">
+
+        <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.account.nav_wishlist') }}
+        </h1>
+
+        @include('wishlist.list')
+
+    </div>
+
+@endsection

resources/views/auth/login-code.blade.php

@@ -0,0 +1,67 @@
+@extends('layouts.app')
+
+@section('title', __('storefront.auth.enter_code'))
+
+@push('seo')
+    <meta name="robots" content="noindex, nofollow">
+@endpush
+
+@section('content')
+
+    <section class="mx-auto max-w-2xl px-4 py-20 sm:px-8 sm:py-32">
+
+        <h1 class="mb-6 font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.auth.enter_code') }}
+        </h1>
+
+        <p class="mb-12">
+            {{ __('storefront.auth.code_sent_to') }} <strong class="break-all">{{ $email }}</strong>
+        </p>
+
+        <x-ui.status class="mb-8" />
+
+        <form method="POST" action="{{ route('login.verify') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.code')"
+                for="login-code"
+                :required="true"
+                :error="$errors->first('code')"
+            >
+                <x-ui.input
+                    id="login-code"
+                    name="code"
+                    inputmode="numeric"
+                    autocomplete="one-time-code"
+                    pattern="[0-9]{6}"
+                    maxlength="6"
+                    :required="true"
+                    autofocus
+                    class="text-2xl font-bold tracking-[0.5em]"
+                    :aria-invalid="$errors->has('code') ? 'true' : null"
+                    :aria-describedby="$errors->has('code') ? 'login-code-error' : null"
+                />
+            </x-ui.field>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.auth.login') }}</x-ui.button>
+            </div>
+        </form>
+
+        <div class="mt-12 flex flex-wrap items-center gap-x-8 gap-y-4 text-sm">
+            <form method="POST" action="{{ route('login.resend') }}">
+                @csrf
+                <button type="submit" class="cursor-pointer underline hover:no-underline">
+                    {{ __('storefront.auth.resend_code') }}
+                </button>
+            </form>
+
+            <a href="{{ route('login') }}" class="underline hover:no-underline">
+                {{ __('storefront.auth.change_email') }}
+            </a>
+        </div>
+
+    </section>
+
+@endsection

resources/views/auth/login.blade.php

@@ -0,0 +1,79 @@
+@extends('layouts.app')
+
+@section('title', __('storefront.auth.login'))
+
+@push('seo')
+    <meta name="robots" content="noindex, follow">
+@endpush
+
+{{-- Only on pages with a captcha, not in the global layout. --}}
+@push('scripts')
+    <script src="https://js.hcaptcha.com/1/api.js?hl={{ app()->getLocale() }}" async defer></script>
+@endpush
+
+@section('content')
+
+    <section class="mx-auto max-w-2xl px-4 py-20 sm:px-8 sm:py-32">
+
+        <h1 class="mb-6 font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.auth.login') }}
+        </h1>
+
+        {{-- Unescaped: the label holds a <br /> (edited in Filament › Language Lines, staff only). --}}
+        <p class="mb-12">{!! __('storefront.auth.login_intro') !!}</p>
+
+        {{-- e.g. "account deletion scheduled", after AccountController::destroy() --}}
+        <x-ui.status class="mb-12" />
+
+        <form method="POST" action="{{ route('login.send') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.email')"
+                for="login-email"
+                :required="true"
+                :error="$errors->first('email')"
+            >
+                <x-ui.input
+                    id="login-email"
+                    name="email"
+                    type="email"
+                    autocomplete="email"
+                    :value="old('email')"
+                    :required="true"
+                    autofocus
+                    :aria-invalid="$errors->has('email') ? 'true' : null"
+                    :aria-describedby="$errors->has('email') ? 'login-email-error' : null"
+                />
+            </x-ui.field>
+
+            {{-- Shown to everyone. Recording acceptance for new accounts is a
+                 boboko-core task (UserOtpService). Unescaped: the label holds the
+                 two links (Language Lines, staff only). --}}
+            <p class="text-sm text-neutral-500 [&_a]:underline [&_a:hover]:no-underline">
+                {!! __('storefront.auth.terms_notice', [
+                    'terms' => route('legal.terms'),
+                    'privacy' => route('legal.privacy'),
+                ]) !!}
+            </p>
+
+            {{-- hCaptcha checkbox, verified by App\Rules\HCaptcha. The widget adds
+                 the `h-captcha-response` field itself. Fixed height reserves the
+                 iframe's space so the button doesn't jump when it loads. --}}
+            <x-ui.field for="login-captcha" :error="$errors->first('h-captcha-response')">
+                <div
+                    id="login-captcha"
+                    class="h-captcha min-h-[78px]"
+                    data-sitekey="{{ config('services.hcaptcha.sitekey') }}"
+                    @if ($errors->has('h-captcha-response')) aria-describedby="login-captcha-error" @endif
+                ></div>
+            </x-ui.field>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.auth.send_code') }}</x-ui.button>
+            </div>
+        </form>
+
+    </section>
+
+@endsection

resources/views/category/show.blade.php

@@ -14,7 +14,8 @@
 @endpush
 
 @section('content')
-    <div class="max-w-5xl mx-auto pt-26 pb-12">
+    {{-- <div class="max-w-5xl mx-auto pt-26 pb-12"> --}}
+    <div class="max-w-7xl mx-auto px-4 sm:px-8 pt-26 pb-12">
 
         <div class="flex items-end justify-between gap-6 flex-wrap mb-16">
             <h1 class="font-medium text-h2">{{ $collection['name'] }}</h1>

resources/views/checkout/components/add-to-cart.blade.php

@@ -1,42 +0,0 @@
-{{--
-    <x-checkout::add-to-cart :purchasable="$variantId" />
-
-    A self-contained add-to-cart form. Posts the line via bbk-add-to-cart-controller
-    (fetch) and hands the rendered cart body to the drawer over the
-    `bbk-cart:changed` window event.
-
-    Props:
-      purchasable  ProductVariant id. Omit to render no hidden id field — the host
-                   must then supply [data-bbk-purchasable-input] itself (e.g. a
-                   variant picker writing the selected id into it).
-      quantity     Integer for the hidden quantity field, or false to omit it
-                   (the host then puts its own name="quantity" control in the slot).
-
-    The button and any quantity control come from the slot, so the host owns all
-    appearance. Extra attributes (class, etc.) land on the <form>.
---}}
-@props([
-    'purchasable' => null,
-    'quantity' => 1,
-    'action' => null,
-])
-
-<form
-    method="POST"
-    action="{{ $action ?? route('checkout.cart.add', app()->getLocale()) }}"
-    data-controller="bbk-add-to-cart"
-    data-action="bbk-add-to-cart#add"
-    {{ $attributes->class('bbk-add-to-cart') }}
->
-    @csrf
-
-    @if (! is_null($purchasable))
-        <input type="hidden" name="purchasable_id" value="{{ $purchasable }}" data-bbk-purchasable-input>
-    @endif
-
-    @if ($quantity !== false)
-        <input type="hidden" name="quantity" value="{{ $quantity }}">
-    @endif
-
-    {{ $slot }}
-</form>

resources/views/checkout/components/address-lines.blade.php

@@ -1,15 +0,0 @@
-{{--
-    Read-only formatted address. $address is any Lunar address model
-    (OrderAddress / CartAddress) — same column names on both.
---}}
-@props(['address'])
-
-<address class="bbk-address-lines">
-    <span>{{ trim(($address->first_name ?? '') . ' ' . ($address->last_name ?? '')) }}</span>
-    @if ($address->company_name)<span>{{ $address->company_name }}</span>@endif
-    <span>{{ $address->line_one }}</span>
-    @if ($address->line_two)<span>{{ $address->line_two }}</span>@endif
-    <span>{{ trim(($address->postcode ?? '') . ' ' . ($address->city ?? '')) }}</span>
-    @if ($address->state)<span>{{ $address->state }}</span>@endif
-    @if ($address->contact_phone)<span>{{ $address->contact_phone }}</span>@endif
-</address>

resources/views/checkout/components/field.blade.php

@@ -1,29 +0,0 @@
-{{--
-    <x-checkout::field name="billing_first_name" label="First name" required />
-
-    Generic labelled text input with old-input repopulation and validation
-    error display — the module's own equivalent of a host x-ui.field, used
-    instead of it per the module's independence rule. All styling is .bbk-field*
-    (resources/css/checkout.css); no host classes.
---}}
-@props([
-    'name',
-    'label',
-    'type' => 'text',
-    'value' => null,
-    'required' => false,
-])
-
-<div class="bbk-field">
-    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
-    <input
-        type="{{ $type }}"
-        name="{{ $name }}"
-        id="bbk-{{ $name }}"
-        value="{{ old($name, $value) }}"
-        @if ($required) required @endif
-        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
-    >
-    {{-- Always present so bbk-checkout-form can fill it live on an autosave. --}}
-    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
-</div>

resources/views/checkout/components/region-country.blade.php

@@ -1,52 +0,0 @@
-{{--
-    The state/region + country pair for one address (billing or shipping).
-
-    Single-country store ($storeCountry set): region is a <select> of that
-    country's Lunar states, submitting `->name` (table-rate-shipping resolves
-    zones with State::whereName()), and country is a fixed hidden field + label.
-    Otherwise: free-text region + full country <select>, as before.
---}}
-@props([
-    'prefix',
-    'storeCountry' => null,
-    'regions' => [],
-    'countries' => [],
-    'address' => null,
-])
-
-<div class="bbk-field-row">
-    @if ($storeCountry)
-        <x-checkout::select
-            :name="$prefix . '_state'"
-            label="{{ __('checkout.page.state') }}"
-            :options="$regions"
-            value-field="name"
-            translation-group="states"
-            :value="$address?->state"
-            placeholder="{{ __('checkout.page.state_placeholder') }}"
-            required
-        />
-
-        <div class="bbk-field">
-            <span class="bbk-field-label">{{ __('checkout.page.country') }}</span>
-            <p class="bbk-field-static">
-                {{ \Illuminate\Support\Facades\Lang::has("core::countries.{$storeCountry->name}")
-                    ? __("core::countries.{$storeCountry->name}")
-                    : $storeCountry->name }}
-            </p>
-            <input type="hidden" name="{{ $prefix }}_country_id" value="{{ $storeCountry->id }}">
-        </div>
-    @else
-        <x-checkout::field :name="$prefix . '_state'" label="{{ __('checkout.page.state') }}" :value="$address?->state" />
-
-        <x-checkout::select
-            :name="$prefix . '_country_id'"
-            label="{{ __('checkout.page.country') }}"
-            :options="$countries"
-            translation-group="countries"
-            :value="$address?->country_id"
-            placeholder="{{ __('checkout.page.country_placeholder') }}"
-            required
-        />
-    @endif
-</div>

resources/views/checkout/components/select.blade.php

@@ -1,62 +0,0 @@
-{{--
-    <x-checkout::select name="billing_country_id" label="Country" :options="$countries" required />
-    <x-checkout::select name="shipping_state" label="Region" :options="$regions" value-field="name" translation-group="states" required />
-
-    `options` is an iterable of models/objects; `label` is always read from
-    `->name`, the submitted value from `->{$valueField}` (default `id`, but e.g.
-    `name` for Lunar states — table-rate-shipping resolves those with
-    State::whereName(), so the address must carry the exact name string).
-
-    `translationGroup` (optional, e.g. "countries"/"states") looks the raw
-    `->name` up in boboko-core's `core::{group}.{name}` lang file (see
-    boboko-core's lang/el/countries.php, lang/el/states.php) for the
-    DISPLAYED label only — the submitted `value` is always the untranslated
-    `->{$valueField}`, since table-rate-shipping/Lunar's Country lookups key
-    off the original English name. Falls back to the raw name when no
-    translation exists for the current locale (e.g. English, or a country
-    outside the covered set).
---}}
-@props([
-    'name',
-    'label',
-    'options' => [],
-    'value' => null,
-    'placeholder' => null,
-    'required' => false,
-    'valueField' => 'id',
-    'translationGroup' => null,
-])
-
-@php
-    $optionLabel = function ($option) use ($translationGroup) {
-        if (! $translationGroup) {
-            return $option->name;
-        }
-
-        $key = "core::{$translationGroup}.{$option->name}";
-
-        return \Illuminate\Support\Facades\Lang::has($key) ? __($key) : $option->name;
-    };
-@endphp
-
-@php($selected = old($name, $value))
-
-<div class="bbk-field">
-    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
-    <select
-        name="{{ $name }}"
-        id="bbk-{{ $name }}"
-        @if ($required) required @endif
-        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
-    >
-        @if ($placeholder)
-            <option value="" @selected(! $selected)>{{ $placeholder }}</option>
-        @endif
-        @foreach ($options as $option)
-            <option value="{{ $option->{$valueField} }}" @selected((string) $selected === (string) $option->{$valueField})>
-                {{ $optionLabel($option) }}
-            </option>
-        @endforeach
-    </select>
-    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
-</div>

resources/views/checkout/components/textarea.blade.php

@@ -1,18 +0,0 @@
-@props([
-    'name',
-    'label',
-    'value' => null,
-    'required' => false,
-])
-
-<div class="bbk-field">
-    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
-    <textarea
-        name="{{ $name }}"
-        id="bbk-{{ $name }}"
-        rows="3"
-        @if ($required) required @endif
-        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
-    >{{ old($name, $value) }}</textarea>
-    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
-</div>

resources/views/checkout/confirmation.blade.php

@@ -1,84 +0,0 @@
-{{--
-    Order confirmation. Reached only via a session flash of the placed order id
-    (CheckoutController::confirmation) — not deep-linkable. $order is a
-    Lunar\Models\Order with lines + shipping/billing addresses eager-loaded.
---}}
-@extends('layouts.app')
-
-@section('title', __('checkout.page.confirmation_title') . ' — ' . config('app.name'))
-
-@section('content')
-    <div class="bbk-confirmation">
-        <h1 class="bbk-confirmation-heading">{{ __('checkout.page.confirmation_heading') }}</h1>
-
-        <p class="bbk-confirmation-ref">
-            {{ __('checkout.page.confirmation_order_number') }}: <strong>{{ $order->reference }}</strong>
-        </p>
-        <p class="bbk-checkout-note">{{ __('checkout.page.confirmation_email_note') }}</p>
-
-        <div class="bbk-confirmation-body">
-            <div class="bbk-confirmation-lines">
-                @foreach ($order->lines->where('type', '!=', 'shipping') as $line)
-                    <div class="bbk-confirmation-line">
-                        <span class="bbk-confirmation-line-name">
-                            {{ $line->description }}
-                            <span class="bbk-confirmation-line-qty">&times; {{ $line->quantity }}</span>
-                        </span>
-                        <span class="bbk-confirmation-line-total">{{ $line->sub_total?->formatted() }}</span>
-                    </div>
-                @endforeach
-
-                <div class="bbk-cart-summary">
-                    <div class="bbk-cart-summary-row">
-                        <span>{{ __('checkout.cart.subtotal') }}</span>
-                        <span>{{ $order->sub_total?->formatted() }}</span>
-                    </div>
-
-                    @if ($order->discount_total?->value > 0)
-                        <div class="bbk-cart-summary-row bbk-cart-summary-row--discount">
-                            <span>{{ __('checkout.cart.discount') }}</span>
-                            <span>&minus;{{ $order->discount_total->formatted() }}</span>
-                        </div>
-                    @endif
-
-                    <div class="bbk-cart-summary-row">
-                        <span>{{ __('checkout.cart.shipping') }}</span>
-                        <span>{{ $order->shipping_total?->formatted() }}</span>
-                    </div>
-
-                    @if ($order->tax_total?->value > 0)
-                        <div class="bbk-cart-summary-row">
-                            <span>{{ __('checkout.cart.tax') }}</span>
-                            <span>{{ $order->tax_total->formatted() }}</span>
-                        </div>
-                    @endif
-
-                    <div class="bbk-cart-summary-row bbk-cart-summary-row--total">
-                        <span>{{ __('checkout.cart.total') }}</span>
-                        <span>{{ $order->total?->formatted() }}</span>
-                    </div>
-                </div>
-            </div>
-
-            <div class="bbk-confirmation-addresses">
-                @if ($order->shippingAddress)
-                    <div class="bbk-confirmation-address">
-                        <h2 class="bbk-confirmation-address-heading">{{ __('checkout.page.confirmation_shipping_to') }}</h2>
-                        <x-checkout::address-lines :address="$order->shippingAddress" />
-                    </div>
-                @endif
-
-                @if ($order->billingAddress)
-                    <div class="bbk-confirmation-address">
-                        <h2 class="bbk-confirmation-address-heading">{{ __('checkout.page.confirmation_billing') }}</h2>
-                        <x-checkout::address-lines :address="$order->billingAddress" />
-                    </div>
-                @endif
-            </div>
-        </div>
-
-        <a class="bbk-checkout-continue bbk-confirmation-continue" href="{{ route('products', app()->getLocale()) }}">
-            {{ __('checkout.page.confirmation_continue') }}
-        </a>
-    </div>
-@endsection

resources/views/checkout/drawer.blade.php

@@ -1,31 +0,0 @@
-{{--
-    Slide-in cart drawer. Rendered once, globally, from the app layout
-    (@include('checkout::drawer')). Structure only — all styling lives in
-    resources/css/checkout.css under @layer bbk-checkout; the host restyles the
-    .bbk-* classes from its own stylesheet. No host components, no Tailwind.
---}}
-<div class="bbk-cart" data-controller="bbk-cart" hidden>
-    <div class="bbk-cart-backdrop" data-action="bbk-cart#close"></div>
-
-    <aside
-        class="bbk-cart-panel"
-        role="dialog"
-        aria-modal="true"
-        aria-labelledby="bbk-cart-heading"
-        data-bbk-cart-target="panel"
-    >
-        <header class="bbk-cart-panel-header">
-            <h2 class="bbk-cart-heading" id="bbk-cart-heading">{{ __('checkout.cart.title') }}</h2>
-            <button
-                type="button"
-                class="bbk-cart-dismiss"
-                data-action="bbk-cart#close"
-                aria-label="{{ __('checkout.cart.close') }}"
-            >&times;</button>
-        </header>
-
-        <div class="bbk-cart-panel-body" data-bbk-cart-target="body" aria-live="polite">
-            @include('checkout::partials.cart-body')
-        </div>
-    </aside>
-</div>

resources/views/checkout/page.blade.php

@@ -1,287 +0,0 @@
-{{--
-    The checkout page. Two columns: left is contact + billing + shipping +
-    shipping method, right is the order summary (the same cart-body partial the
-    drawer uses, minus its own "Checkout" CTA — see .bbk-checkout-summary in
-    checkout.css). Stops short of payment for this slice — see
-    CheckoutController's class docblock.
-
-    $cart, $lines, $billingAddress, $shippingAddress, $shippingOptions,
-    $countries come from CheckoutController::show().
---}}
-@extends('layouts.app')
-
-@section('title', __('checkout.page.title') . ' — ' . config('app.name'))
-
-@section('content')
-    <div class="bbk-checkout-page">
-        <h1 class="bbk-checkout-heading">{{ __('checkout.page.title') }}</h1>
-
-        <div class="bbk-checkout">
-            <div
-                class="bbk-checkout-main"
-                data-controller="bbk-checkout-form bbk-payment"
-                data-action="input->bbk-checkout-form#scheduleSave"
-                data-bbk-checkout-form-save-url-value="{{ route('checkout.address.save', app()->getLocale()) }}"
-                data-bbk-checkout-form-select-shipping-url-value="{{ route('checkout.shipping-option.select', app()->getLocale()) }}"
-                data-bbk-checkout-form-status-saving-value="{{ __('checkout.page.saving') }}"
-                data-bbk-checkout-form-status-saved-value="{{ __('checkout.page.saved') }}"
-                data-bbk-checkout-form-status-error-value="{{ __('checkout.page.save_error') }}"
-                data-bbk-payment-select-url-value="{{ route('checkout.payment-method.select', app()->getLocale()) }}"
-                data-bbk-payment-place-order-url-value="{{ route('checkout.place-order', app()->getLocale()) }}"
-                data-bbk-payment-order-status-url-value="{{ route('checkout.order-status', app()->getLocale()) }}"
-                data-bbk-payment-stripe-key-value="{{ config('services.stripe.public_key') }}"
-                data-bbk-payment-amount-value="{{ $cart?->total?->value ?? 0 }}"
-                data-bbk-payment-currency-value="{{ strtolower($cart?->total?->currency?->code ?? 'eur') }}"
-                data-bbk-payment-terms-required-value="{{ __('checkout.page.terms_required') }}"
-                data-bbk-payment-choose-method-value="{{ __('checkout.page.choose_payment_method') }}"
-                data-bbk-payment-generic-error-value="{{ __('checkout.page.payment_failed') }}"
-                data-bbk-payment-processing-slow-value="{{ __('checkout.page.payment_processing_slow') }}"
-            >
-
-                {{-- Contact --}}
-                <section class="bbk-checkout-section">
-                    <div
-                        class="bbk-checkout-tabs"
-                        role="tablist"
-                        aria-label="{{ __('checkout.page.contact_heading') }}"
-                    >
-                        <button
-                            type="button"
-                            class="bbk-checkout-tab"
-                            role="tab"
-                            aria-selected="true"
-                            data-bbk-checkout-form-target="guestTab"
-                            data-action="bbk-checkout-form#showGuest"
-                        >{{ __('checkout.page.guest_tab') }}</button>
-
-                        <button
-                            type="button"
-                            class="bbk-checkout-tab"
-                            role="tab"
-                            aria-selected="false"
-                            data-bbk-checkout-form-target="loginTab"
-                            data-action="bbk-checkout-form#showLogin"
-                        >{{ __('checkout.page.login_tab') }}</button>
-
-                        <div class="bbk-checkout-tab-panel" role="tabpanel" data-bbk-checkout-form-target="guestPanel">
-                            <x-checkout::field
-                                name="contact_email"
-                                label="{{ __('checkout.page.email_label') }}"
-                                type="email"
-                                :value="$shippingAddress?->contact_email ?? $billingAddress?->contact_email"
-                                required
-                                form="bbk-address-form"
-                            />
-
-                            {{-- Abandoned-cart-recovery opt-in. Optional, unticked, never
-                                 required — direct marketing under ePrivacy (GR L. 3471/2006
-                                 art. 11), so it needs an explicit opt-in and checkout can't be
-                                 gated on it. Narrow scope by design (boboko-core's
-                                 setRecoveryConsent) — a general newsletter opt-in, if wanted,
-                                 is a separate checkbox. --}}
-                            <label class="bbk-checkbox bbk-checkbox--stacked">
-                                <input
-                                    type="checkbox"
-                                    name="recovery_consent"
-                                    value="1"
-                                    form="bbk-address-form"
-                                    {{ old('recovery_consent', data_get($cart, 'meta.recovery_consent')) ? 'checked' : '' }}
-                                >
-                                {{ __('checkout.page.recovery_consent') }}
-                            </label>
-                        </div>
-
-                        {{-- Not wired yet — Modules\Core\Auth\Services\UserOtpService exists
-                             (email + one-time code, passwordless) but nothing in the storefront
-                             calls it yet. UI placeholder only; see project notes. --}}
-                        <div class="bbk-checkout-tab-panel" role="tabpanel" hidden data-bbk-checkout-form-target="loginPanel">
-                            <div class="bbk-field">
-                                <label class="bbk-field-label" for="bbk-login-email">{{ __('checkout.page.login_email_label') }}</label>
-                                <input type="email" id="bbk-login-email" class="bbk-field-input" disabled>
-                            </div>
-                            <button type="button" class="bbk-checkout-continue" disabled>
-                                {{ __('checkout.page.send_code') }}
-                            </button>
-                            <p class="bbk-checkout-note">{{ __('checkout.page.login_coming_soon') }}</p>
-                        </div>
-                    </div>
-                </section>
-
-                {{-- Autosaves — no submit button. Any `change` inside .bbk-checkout-main
-                     (this form, plus the contact email/consent which sit outside it but
-                     link via form="bbk-address-form") is debounced and POSTed as the whole
-                     form; the shipping-method radios are excluded in scheduleSave(). --}}
-                <form
-                    id="bbk-address-form"
-                    method="POST"
-                    action="{{ route('checkout.address.save', app()->getLocale()) }}"
-                    data-bbk-checkout-form-target="form"
-                >
-                    @csrf
-
-                    {{-- Billing --}}
-                    <section class="bbk-checkout-section">
-                        <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.billing_heading') }}</h2>
-
-                        <div class="bbk-field-row">
-                            <x-checkout::field name="billing_first_name" label="{{ __('checkout.page.first_name') }}" :value="$billingAddress?->first_name" required />
-                            <x-checkout::field name="billing_last_name" label="{{ __('checkout.page.last_name') }}" :value="$billingAddress?->last_name" required />
-                        </div>
-
-                        <div class="bbk-field-row">
-                            <x-checkout::field name="billing_company_name" label="{{ __('checkout.page.company_name') }}" :value="$billingAddress?->company_name" />
-                            <x-checkout::field name="billing_tax_identifier" label="{{ __('checkout.page.tax_identifier') }}" :value="$billingAddress?->tax_identifier" />
-                        </div>
-
-                        <x-checkout::field name="billing_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$billingAddress?->line_one" required />
-                        <x-checkout::field name="billing_line_two" label="{{ __('checkout.page.address_line_two') }}" :value="$billingAddress?->line_two" />
-
-                        <div class="bbk-field-row">
-                            <x-checkout::field name="billing_city" label="{{ __('checkout.page.city') }}" :value="$billingAddress?->city" required />
-                            <x-checkout::field name="billing_postcode" label="{{ __('checkout.page.postcode') }}" :value="$billingAddress?->postcode" required />
-                        </div>
-
-                        <x-checkout::region-country
-                            prefix="billing"
-                            :store-country="$storeCountry"
-                            :regions="$regions"
-                            :countries="$countries"
-                            :address="$billingAddress"
-                        />
-
-                        <x-checkout::field name="billing_contact_phone" label="{{ __('checkout.page.phone') }}" type="tel" :value="$billingAddress?->contact_phone" />
-                    </section>
-
-                    {{-- Shipping --}}
-                    <section class="bbk-checkout-section">
-                        <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.shipping_heading') }}</h2>
-
-                        <label class="bbk-checkbox">
-                            <input
-                                type="checkbox"
-                                name="same_as_billing"
-                                value="1"
-                                data-bbk-checkout-form-target="sameAsBilling"
-                                data-action="bbk-checkout-form#toggleSameAsBilling"
-                                @checked($shipToBilling)
-                            >
-                            {{ __('checkout.page.same_as_billing') }}
-                        </label>
-
-                        <div class="bbk-checkout-shipping-fields" data-bbk-checkout-form-target="shippingFields">
-                            <div class="bbk-field-row">
-                                <x-checkout::field name="shipping_first_name" label="{{ __('checkout.page.first_name') }}" :value="$shippingAddress?->first_name" required />
-                                <x-checkout::field name="shipping_last_name" label="{{ __('checkout.page.last_name') }}" :value="$shippingAddress?->last_name" required />
-                            </div>
-
-                            <x-checkout::field name="shipping_company_name" label="{{ __('checkout.page.company_name') }}" :value="$shippingAddress?->company_name" />
-
-                            <x-checkout::field name="shipping_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$shippingAddress?->line_one" required />
-                            <x-checkout::field name="shipping_line_two" label="{{ __('checkout.page.address_line_two') }}" :value="$shippingAddress?->line_two" />
-
-                            <div class="bbk-field-row">
-                                <x-checkout::field name="shipping_city" label="{{ __('checkout.page.city') }}" :value="$shippingAddress?->city" required />
-                                <x-checkout::field name="shipping_postcode" label="{{ __('checkout.page.postcode') }}" :value="$shippingAddress?->postcode" required />
-                            </div>
-
-                            <x-checkout::region-country
-                                prefix="shipping"
-                                :store-country="$storeCountry"
-                                :regions="$regions"
-                                :countries="$countries"
-                                :address="$shippingAddress"
-                            />
-
-                            <x-checkout::field name="shipping_contact_phone" label="{{ __('checkout.page.phone') }}" type="tel" :value="$shippingAddress?->contact_phone" />
-                        </div>
-
-                        <x-checkout::textarea
-                            name="shipping_delivery_instructions"
-                            label="{{ __('checkout.page.delivery_instructions') }}"
-                            :value="$shippingAddress?->delivery_instructions"
-                        />
-                    </section>
-                </form>
-
-                <p
-                    class="bbk-checkout-status"
-                    data-bbk-checkout-form-target="status"
-                    role="status"
-                    aria-live="polite"
-                    hidden
-                ></p>
-
-                {{-- Shipping method — resolves from the saved shipping address;
-                     re-rendered as a fragment by bbk-checkout-form after each
-                     autosave / option change. --}}
-                <section class="bbk-checkout-section">
-                    <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.shipping_method_heading') }}</h2>
-
-                    <div id="bbk-shipping-options" data-bbk-checkout-form-target="shippingOptions">
-                        @include('checkout::partials.shipping-options', [
-                            'shippingAddress' => $shippingAddress,
-                            'shippingOptions' => $shippingOptions,
-                        ])
-                    </div>
-                </section>
-
-                {{-- Payment --}}
-                <section class="bbk-checkout-section">
-                    <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.payment_heading') }}</h2>
-
-                    <div id="bbk-payment-methods">
-                        @include('checkout::partials.payment-methods', [
-                            'paymentMethods' => $paymentMethods,
-                            'cart' => $cart,
-                        ])
-                    </div>
-
-                    {{-- Stripe Payment Element mounts here when a Stripe method is picked. --}}
-                    <div class="bbk-payment-element" data-bbk-payment-target="element" hidden></div>
-
-                    <label class="bbk-checkbox bbk-checkbox--stacked">
-                        <input type="checkbox" data-bbk-payment-target="terms">
-                        {!! __('checkout.page.terms_accept', [
-                            'terms' => route('legal.terms', app()->getLocale()),
-                            'privacy' => route('legal.privacy', app()->getLocale()),
-                        ]) !!}
-                    </label>
-
-                    <p class="bbk-checkout-withdrawal">
-                        {!! __('checkout.page.withdrawal_notice', [
-                            'link' => route('legal.shipping-returns', app()->getLocale()),
-                        ]) !!}
-                    </p>
-
-                    <p class="bbk-checkout-error" data-bbk-payment-target="error" role="alert" hidden></p>
-
-                    <button
-                        type="button"
-                        class="bbk-checkout-continue"
-                        data-bbk-payment-target="submit"
-                        data-action="bbk-payment#placeOrder"
-                    >
-                        {{ __('checkout.page.place_order') }}
-                    </button>
-                </section>
-
-                {{-- Fixed overlay while a payment is confirming (3-D Secure / webhook
-                     poll). Inside .bbk-checkout-main so bbk-payment can target it. --}}
-                <div class="bbk-checkout-processing" data-bbk-payment-target="processing" hidden>
-                    <span class="bbk-spinner" aria-hidden="true"></span>
-                    <p data-bbk-payment-target="processingText">{{ __('checkout.page.payment_processing') }}</p>
-                </div>
-
-            </div>
-
-            <aside class="bbk-checkout-aside">
-                <div class="bbk-checkout-summary" data-controller="bbk-cart">
-                    <h2 class="bbk-checkout-summary-heading">{{ __('checkout.page.order_summary_heading') }}</h2>
-                    <div data-bbk-cart-target="body" aria-live="polite">
-                        @include('checkout::partials.cart-body')
-                    </div>
-                </div>
-            </aside>
-        </div>
-    </div>
-@endsection

resources/views/checkout/partials/cart-body.blade.php

@@ -1,121 +0,0 @@
-{{--
-    Server-rendered cart contents. Rendered inline on first page load inside
-    checkout/drawer.blade.php, and re-fetched + swapped into the drawer by
-    bbk-cart-controller after every mutation. $cart / $lines come from the view
-    composer in CheckoutModuleServiceProvider.
-
-    The data-bbk-cart-* attributes on the root are the module's read API for the
-    host (e.g. the header bag-icon count) — bbk-cart-controller reads them after
-    each swap and re-emits them on the `bbk-cart:updated` window event.
---}}
-@php($count = $lines->sum('quantity'))
-
-{{-- @dump($lines) --}}
-
-<div
-    class="bbk-cart-content"
-    data-bbk-cart-count="{{ $count }}"
-    data-bbk-cart-total="{{ $cart?->total?->value ?? 0 }}"
->
-    @if ($lines->isEmpty())
-        <p class="bbk-cart-empty">{{ __('checkout.cart.empty') }}</p>
-    @else
-        <ul class="bbk-cart-items">
-            @each('checkout::partials.cart-line', $lines, 'line')
-        </ul>
-
-        <div class="bbk-cart-summary">
-            <div class="bbk-cart-coupon">
-                @if ($cart?->coupon_code)
-                    <div class="bbk-cart-coupon-applied">
-                        <span class="bbk-cart-coupon-code">{{ $cart->coupon_code }}</span>
-
-                        <form
-                            method="POST"
-                            action="{{ route('checkout.cart.coupon.remove', app()->getLocale()) }}"
-                            data-action="submit->bbk-cart#submit"
-                        >
-                            @csrf
-                            @method('DELETE')
-                            <button type="submit" class="bbk-cart-coupon-remove">
-                                {{ __('checkout.cart.coupon_remove') }}
-                            </button>
-                        </form>
-                    </div>
-                @else
-                    <form
-                        class="bbk-cart-coupon-form"
-                        method="POST"
-                        action="{{ route('checkout.cart.coupon.apply', app()->getLocale()) }}"
-                        data-action="submit->bbk-cart#submit"
-                    >
-                        @csrf
-                        <label class="bbk-visually-hidden" for="bbk-coupon-code">
-                            {{ __('checkout.cart.coupon_label') }}
-                        </label>
-                        <input
-                            type="text"
-                            name="code"
-                            id="bbk-coupon-code"
-                            class="bbk-cart-coupon-input"
-                            placeholder="{{ __('checkout.cart.coupon_placeholder') }}"
-                            autocomplete="off"
-                            required
-                        >
-                        <button type="submit" class="bbk-cart-coupon-submit">
-                            {{ __('checkout.cart.coupon_apply') }}
-                        </button>
-                    </form>
-
-                    @if ($couponError ?? false)
-                        <p class="bbk-cart-coupon-error" role="alert">{{ __('checkout.cart.coupon_invalid') }}</p>
-                    @endif
-                @endif
-            </div>
-
-            <div class="bbk-cart-summary-row">
-                <span>{{ __('checkout.cart.subtotal') }}</span>
-                <span>{{ $cart?->subTotal?->formatted() }}</span>
-            </div>
-
-            @if ($cart?->discountTotal?->value > 0)
-                <div class="bbk-cart-summary-row bbk-cart-summary-row--discount">
-                    <span>{{ __('checkout.cart.discount') }}</span>
-                    <span>&minus;{{ $cart->discountTotal->formatted() }}</span>
-                </div>
-            @endif
-
-            {{-- Shipping + tax appear once the shopper has a shipping address
-                 (i.e. they're on the checkout page). In the drawer, where no
-                 address is set yet, only subtotal + total show. --}}
-            @if ($cart?->shippingAddress)
-                <div class="bbk-cart-summary-row">
-                    <span>{{ __('checkout.cart.shipping') }}</span>
-                    @if ($cart->shippingAddress->shipping_option)
-                        <span>{{ $cart->shippingTotal?->formatted() }}</span>
-                    @else
-                        <span class="bbk-cart-summary-pending">{{ __('checkout.cart.shipping_pending') }}</span>
-                    @endif
-                </div>
-            @endif
-
-            @if ($cart?->taxTotal?->value > 0)
-                <div class="bbk-cart-summary-row">
-                    <span>{{ __('checkout.cart.tax') }}</span>
-                    <span>{{ $cart->taxTotal->formatted() }}</span>
-                </div>
-            @endif
-
-            {{-- Always shown — equals subtotal with nothing else applied,
-                 diverges as discount / shipping / tax come in. --}}
-            <div class="bbk-cart-summary-row bbk-cart-summary-row--total">
-                <span>{{ __('checkout.cart.total') }}</span>
-                <span>{{ $cart?->total?->formatted() }}</span>
-            </div>
-
-            <a class="bbk-cart-checkout" href="{{ route('checkout.show', app()->getLocale()) }}">
-                {{ __('checkout.cart.checkout') }}
-            </a>
-        </div>
-    @endif
-</div>

resources/views/checkout/partials/cart-line.blade.php

@@ -1,77 +0,0 @@
-{{--
-    One cart line. $line is a Lunar\Models\CartLine (iteration var set by
-    @each in cart-body). The two forms post through bbk-cart-controller
-    (fetch + method spoofing) and the response re-renders cart-body.
---}}
-@php
-    $variant = $line->purchasable;
-    $product = $variant?->product;
-    $name = $product?->translateAttribute('name') ?? $variant?->sku ?? '—';
-    $thumb = $product?->getThumbnailImage() ?: null;
-@endphp
-
-<li class="bbk-cart-item" data-bbk-line-id="{{ $line->id }}">
-    <div class="bbk-cart-item-media">
-        @if ($thumb)
-            <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
-        @endif
-    </div>
-
-    <div class="bbk-cart-item-detail">
-        <p class="bbk-cart-item-title">{{ $name }}</p>
-        <p class="bbk-cart-item-unit">{{ $line->unitPrice?->formatted() }}</p>
-
-        <form
-            class="bbk-cart-qty"
-            method="POST"
-            action="{{ route('checkout.cart.update', ['locale' => app()->getLocale(), 'line' => $line->id]) }}"
-        >
-            @csrf
-            @method('PATCH')
-            <button
-                type="button"
-                class="bbk-cart-qty-btn"
-                data-action="bbk-cart#step"
-                data-bbk-cart-dir-param="-1"
-                aria-label="{{ __('checkout.cart.decrease') }}"
-            >&minus;</button>
-
-            <input
-                type="number"
-                name="quantity"
-                value="{{ $line->quantity }}"
-                min="0"
-                inputmode="numeric"
-                class="bbk-cart-qty-input"
-                data-action="change->bbk-cart#submit"
-                aria-label="{{ __('checkout.cart.quantity') }}"
-            >
-
-            <button
-                type="button"
-                class="bbk-cart-qty-btn"
-                data-action="bbk-cart#step"
-                data-bbk-cart-dir-param="1"
-                aria-label="{{ __('checkout.cart.increase') }}"
-            >+</button>
-        </form>
-    </div>
-
-    <div class="bbk-cart-item-aside">
-        <p class="bbk-cart-item-total">{{ $line->subTotal?->formatted() }}</p>
-
-        <form
-            method="POST"
-            action="{{ route('checkout.cart.remove', ['locale' => app()->getLocale(), 'line' => $line->id]) }}"
-            data-action="submit->bbk-cart#submit"
-        >
-            @csrf
-            @method('DELETE')
-            <button
-                type="submit"
-                class="bbk-cart-item-remove"
-                aria-label="{{ __('checkout.cart.remove') }}"
-            >&times;</button>
-        </form>
-    </div>
-</li>

resources/views/checkout/partials/payment-methods.blade.php

@@ -1,30 +0,0 @@
-{{--
-    Payment method radios. $paymentMethods is Collection<Modules\Core\Payment\
-    Models\PaymentMethod> from CheckoutService::getPaymentMethods() (already
-    filtered to enabled + driver-resolves + isConfigured()). Selecting one
-    autosaves via bbk-payment#selectMethod; `data-payment-driver` tells the
-    controller whether to mount the Stripe Element.
-
-    $paymentMethods, $cart come from the page / controller.
---}}
-@php($selected = $cart?->meta['payment_method'] ?? null)
-
-@if ($paymentMethods->isEmpty())
-    <p class="bbk-checkout-note">{{ __('checkout.page.payment_method_none') }}</p>
-@else
-    <div class="bbk-checkout-payment-options">
-        @foreach ($paymentMethods as $method)
-            <label class="bbk-checkout-payment-option">
-                <input
-                    type="radio"
-                    name="payment_type"
-                    value="{{ $method->type }}"
-                    data-payment-driver="{{ $method->driver }}"
-                    @checked($selected === $method->type)
-                    data-action="change->bbk-payment#selectMethod"
-                >
-                <span class="bbk-checkout-payment-option-name">{{ $method->translate('name') }}</span>
-            </label>
-        @endforeach
-    </div>
-@endif

resources/views/checkout/partials/shipping-options.blade.php

@@ -1,106 +0,0 @@
-{{--
-    Shipping methods for the checkout page. Rendered inline by page.blade.php on
-    load, and re-rendered as a fragment by CheckoutController after every
-    address save / option change (bbk-checkout-form swaps it in). Radios
-    autosave via bbk-checkout-form#selectShipping — no submit button. A single
-    resolved option is auto-selected server-side and shown as a fixed line.
-
-    $shippingAddress, $shippingOptions come from the controller / page scope.
---}}
-@php($selected = $shippingAddress?->shipping_option)
-
-{{-- Rate resolution needs country (always Greece here) + postcode; until a
-     postcode is saved there's nothing to quote against yet. --}}
-@if (! $shippingAddress?->postcode)
-    <p class="bbk-checkout-note">{{ __('checkout.page.shipping_method_empty') }}</p>
-@elseif ($shippingOptions->isEmpty())
-    <p class="bbk-checkout-note">{{ __('checkout.page.shipping_method_none') }}</p>
-@elseif ($shippingOptions->count() === 1)
-    @php($only = $shippingOptions->first())
-    <div class="bbk-checkout-shipping-confirmed">
-        <span class="bbk-checkout-shipping-option-detail">
-            <span class="bbk-checkout-shipping-option-name">{{ $only->name }}</span>
-            @if ($only->description)
-                <span class="bbk-checkout-shipping-option-description">{{ strip_tags($only->description) }}</span>
-            @endif
-        </span>
-        <span class="bbk-checkout-shipping-option-price">{{ $only->price->formatted() }}</span>
-    </div>
-@else
-    <div class="bbk-checkout-shipping-options">
-        @foreach ($shippingOptions as $option)
-            <label class="bbk-checkout-shipping-option">
-                <input
-                    type="radio"
-                    name="shipping_option"
-                    value="{{ $option->identifier }}"
-                    @checked($selected === $option->identifier)
-                    data-action="change->bbk-checkout-form#selectShipping"
-                >
-                <span class="bbk-checkout-shipping-option-detail">
-                    <span class="bbk-checkout-shipping-option-name">{{ $option->name }}</span>
-                    @if ($option->description)
-                        <span class="bbk-checkout-shipping-option-description">{{ strip_tags($option->description) }}</span>
-                    @endif
-                </span>
-                <span class="bbk-checkout-shipping-option-price">{{ $option->price->formatted() }}</span>
-            </label>
-        @endforeach
-    </div>
-@endif
-
-{{--
-    Dummy Box Now locker picker — a Leaflet map standing in for Box Now's own
-    Destination Map JS widget, which only talks to their Production API (not
-    Stage/sandbox — see their Partner API manual §4.1), making it useless
-    for local/staging development. Backed by the same GET /destinations data
-    (including lat/lng) via CheckoutController::boxNowLockers(). Only shown
-    once the "box-now" shipping option is selected (bbk-checkout-form
-    toggles [hidden] on shipping-option change; see bbk-box-now-locker
-    Stimulus controller). Persists the choice via a separate autosave POST
-    (checkout.box-now.locker.select) rather than piggybacking on the
-    shipping-option field, since the two are independent pieces of state
-    (method vs. destination) that CheckoutService models as two calls
-    (selectShippingOption() / selectBoxNowLocker()).
---}}
-<div
-    id="bbk-box-now-locker"
-    class="bbk-checkout-box-now-locker"
-    data-controller="bbk-box-now-locker"
-    data-bbk-box-now-locker-lockers-url-value="{{ route('checkout.box-now.lockers', app()->getLocale()) }}"
-    data-bbk-box-now-locker-select-url-value="{{ route('checkout.box-now.locker.select', app()->getLocale()) }}"
-    data-bbk-box-now-locker-loading-value="{{ __('checkout.page.box_now_locker_loading') }}"
-    data-bbk-box-now-locker-select-label-value="{{ __('checkout.page.box_now_locker_select') }}"
-    data-bbk-box-now-locker-selected-label-value="{{ __('checkout.page.box_now_locker_selected') }}"
-    data-bbk-box-now-locker-no-results-value="{{ __('checkout.page.box_now_locker_no_results') }}"
-    @if ($selected !== 'box-now') hidden @endif
->
-    <p class="bbk-checkout-box-now-locker-label">
-        {{ __('checkout.page.box_now_locker_label') }}
-    </p>
-    <input
-        type="search"
-        class="bbk-checkout-box-now-locker-search"
-        placeholder="{{ __('checkout.page.box_now_locker_search') }}"
-        data-bbk-box-now-locker-target="search"
-        data-action="input->bbk-box-now-locker#search"
-        autocomplete="off"
-    >
-    <div
-        id="bbk-box-now-locker-map"
-        class="bbk-checkout-box-now-locker-map"
-        data-bbk-box-now-locker-target="map"
-    ></div>
-    <p
-        class="bbk-checkout-box-now-locker-chosen"
-        data-bbk-box-now-locker-target="chosen"
-        hidden
-    ></p>
-    <p
-        class="bbk-checkout-status"
-        data-bbk-box-now-locker-target="status"
-        role="status"
-        aria-live="polite"
-        hidden
-    ></p>
-</div>

resources/views/components/header.blade.php

@@ -41,6 +41,25 @@
                 </a>
             @endforeach
 
+            {{-- Wishlist — the account page, or the cookie-based guest page --}}
+            <a
+                href="{{ auth()->check() ? route('account.wishlist') : route('wishlist') }}"
+                class="flex items-center justify-center w-10 h-10 hover:opacity-70 transition-opacity"
+                aria-label="{{ __('storefront.account.nav_wishlist') }}"
+                @if (request()->routeIs('account.wishlist', 'wishlist')) aria-current="page" @endif
+            >
+                <x-ui.icon name="heart" :size="40" />
+            </a>
+
+            {{-- Account — the account page, or login for guests --}}
+            <a
+                href="{{ auth()->check() ? route('account') : route('login') }}"
+                class="flex items-center justify-center w-10 h-10 hover:opacity-70 transition-opacity"
+                aria-label="{{ auth()->check() ? __('storefront.nav.account') : __('storefront.auth.login') }}"
+            >
+                <x-ui.icon name="user" :size="40" />
+            </a>
+
             {{-- Cart — opens the checkout module's drawer, no separate cart page --}}
             <button
                 type="button"

resources/views/components/newsletter-split.blade.php

@@ -3,10 +3,10 @@
 ])
 
 <section {{ $attributes }}>
-    <div class="max-w-6xl mx-auto grid grid-cols-1 lg:grid-cols-2 border border-black">
-        <div class="flex flex-col justify-center gap-8 px-8 py-16 lg:px-16">
+    <div class="grid grid-cols-1 lg:grid-cols-2">
+        <div class="flex flex-col justify-center gap-8 px-8 py-16 lg:px-16 items-center">
             <h2
-                class="text-h2 leading-tight"
+                class="text-h1 leading-[1.3] max-w-xl text-center"
                 aria-label="Γράψου στο newsletter μας"
                 data-controller="appear"
                 data-appear-visible-class="is-visible"
@@ -17,13 +17,13 @@ class="text-h2 leading-tight"
                 μας
             </h2>
 
-            <p class="max-w-md text-neutral-600">
+            <p class="max-w-xl text-neutral-600 text-center">
                 Γίνε μέλος της λίστας μας και κέρδισε <span class="font-bold">5% έκπτωση</span> στην πρώτη σου παραγγελία, μαζί με αποκλειστικές προσφορές και νέα.
             </p>
 
-            <form method="POST" action="#" class="flex flex-col gap-6 max-w-md">
+            <form method="POST" action="#" class="flex flex-col gap-6 max-w-xl items-center">
                 @csrf
-                <div class="relative">
+                <div class="relative max-w-xs w-full">
                     <x-ui.input
                         name="email"
                         type="email"
@@ -44,7 +44,7 @@ class="absolute right-0 bottom-2 cursor-pointer"
                 </div>
 
                 <x-ui.checkbox name="gdpr_consent" :required="true" id="newsletter_split_gdpr_consent" class="after:mix-blend-multiply">
-                    <span class="text-sm text-left">Επιθυμώ διακαώς 🔥 να εγγραφώ στη λίστα αποστολής ενημερωτικού υλικού</span>
+                    <span class="text-sm">Επιθυμώ διακαώς 🔥 να εγγραφώ στη λίστα αποστολής ενημερωτικού υλικού</span>
                 </x-ui.checkbox>
             </form>
         </div>

resources/views/components/order-status.blade.php

@@ -0,0 +1,13 @@
+{{--
+    An order status as text, e.g. "Σε επεξεργασία". Translated through
+    storefront.order_status.{status}, falling back to Lunar's own (English)
+    label from config('lunar.orders.statuses') when that key doesn't exist.
+--}}
+@props(['status'])
+
+@php
+    $key = "storefront.order_status.{$status}";
+    $label = Lang::has($key) ? __($key) : config("lunar.orders.statuses.{$status}.label", $status);
+@endphp
+
+<span {{ $attributes }}>{{ $label }}</span>

resources/views/components/product-custom-fields.blade.php

@@ -0,0 +1,77 @@
+{{--
+    <x-product-custom-fields :fields="$product['custom_fields']" />
+
+    The product's custom fields (boboko-core's Product::$custom_fields), rendered
+    inside the add-to-cart <form> so their values travel with it as
+    custom_fields[key]. text → input, textarea → textarea, file → photo upload.
+
+    A photo is uploaded as soon as it's picked (custom-field-upload-controller.js)
+    and only the resulting File row's id (boboko-core's Modules\Core\File\
+    Models\File) is submitted with the form — the file input itself has no
+    name. It still carries `required`, so the browser's own validation blocks
+    add-to-cart until a photo is picked, and the controller marks it invalid
+    (setCustomValidity) while the upload is in flight.
+--}}
+@props(['fields' => []])
+
+@use('App\Http\Controllers\CustomFieldUploadController')
+
+<div class="flex flex-col gap-6">
+    @foreach ($fields as $field)
+        @php
+            $id = 'custom-field-'.$field['key'];
+            $name = 'custom_fields['.$field['key'].']';
+            $required = (bool) ($field['required'] ?? false);
+        @endphp
+
+        @switch($field['type'])
+            @case('textarea')
+                <x-ui.field :label="$field['label']" :for="$id" :required="$required">
+                    <x-ui.textarea :id="$id" :name="$name" :required="$required" :rows="4" maxlength="2000" />
+                </x-ui.field>
+                @break
+
+            @case('file')
+                <x-ui.field
+                    :label="$field['label']"
+                    :for="$id"
+                    :required="$required"
+                    :description="__('storefront.product.custom_field_photo_hint', ['size' => CustomFieldUploadController::MAX_KILOBYTES / 1024])"
+                    data-controller="custom-field-upload"
+                    data-custom-field-upload-url-value="{{ route('custom-field-upload.store') }}"
+                    data-custom-field-upload-label-value="{{ $field['label'] }}"
+                    data-custom-field-upload-uploading-message-value="{{ __('storefront.product.custom_field_uploading') }}"
+                    data-custom-field-upload-failed-message-value="{{ __('storefront.product.custom_field_upload_failed') }}"
+                >
+                    <input type="hidden" name="{{ $name }}" data-custom-field-upload-target="reference">
+
+                    <x-ui.file-input
+                        :id="$id"
+                        :accept="CustomFieldUploadController::accept()"
+                        :required="$required"
+                        aria-describedby="{{ $id }}-description {{ $id }}-error"
+                        data-custom-field-upload-target="file"
+                        data-action="change->custom-field-upload#upload"
+                    />
+
+                    <img
+                        alt=""
+                        width="96"
+                        height="96"
+                        hidden
+                        class="w-24 h-24 object-cover border border-black"
+                        data-custom-field-upload-target="preview"
+                        data-action="error->custom-field-upload#hidePreview"
+                    >
+
+                    <p id="{{ $id }}-error" class="text-sm text-red-600" role="alert" hidden data-custom-field-upload-target="error"></p>
+                </x-ui.field>
+                @break
+
+            @default
+                <x-ui.field :label="$field['label']" :for="$id" :required="$required">
+                    <x-ui.input :id="$id" :name="$name" :required="$required" maxlength="255" />
+                </x-ui.field>
+        @endswitch
+    @endforeach
+</div>

resources/views/components/product-grid.blade.php

@@ -24,6 +24,9 @@
                 :price="$product['price'] ?? null"
                 :image="$product['image'] ?? null"
                 :href="$product['href'] ?? '#'"
+                :variant-id="$product['variantId'] ?? null"
+                :has-custom-fields="$product['hasCustomFields'] ?? false"
+                :sold-out="$product['soldOut'] ?? false"
             />
         @endforeach
     </div>

resources/views/components/review-card.blade.php

@@ -1,26 +1,39 @@
 @props(['review'])
 
-<article class="flex flex-col gap-3 py-6 border-b border-black last:border-0">
+<article class="flex flex-col gap-3 py-6">
 
-    <div class="flex items-center justify-between gap-4">
-        <div class="flex items-center gap-4">
-            <x-reviews-stars :rating="$review['rating']" :size="18" />
-            <span class="font-bold">
-                {{ $review['name'] ?? 'Ανώνυμος' }}
-            </span>
-        </div>
-        <time class="text-sm text-neutral-500 shrink-0">{{ $review['date'] }}</time>
+    <x-reviews-stars :rating="$review['rating']" :size="23" />
+
+    <div class="flex items-end gap-4">
+        <span class="text-2xl font-bold leading-none">
+            {{ $review['name'] ?? 'Ανώνυμος' }}
+        </span>
+        <time class="text-sm text-neutral-500 shrink-0 leading-none pb-0.5">{{ $review['date'] }}</time>
     </div>
 
     <p class="leading-relaxed">{{ $review['text'] }}</p>
 
     @if (!empty($review['image']))
         <div class="mt-1">
-            <img
-                src="{{ $review['image'] }}"
-                alt="Φωτογραφία από τον αγοραστή"
-                class="w-24 h-24 object-cover border border-black"
-            >
+            <a href="{{ $review['image'] }}" target="_blank" rel="noopener noreferrer">
+                <img
+                    src="{{ $review['image'] }}"
+                    alt="Φωτογραφία από τον αγοραστή"
+                    class="w-24 h-24 object-cover border border-black"
+                >
+            </a>
+        </div>
+    @endif
+
+    @if (!empty($review['reply']))
+        <div class="mt-2 pl-4 border-l-2 border-neutral-300 flex flex-col gap-1">
+            <p class="text-sm font-bold">
+                {{ __('storefront.review.reply') }}
+                @if (!empty($review['replyDate']))
+                    <span class="font-normal text-neutral-500">— {{ $review['replyDate'] }}</span>
+                @endif
+            </p>
+            <p class="leading-relaxed">{{ $review['reply'] }}</p>
         </div>
     @endif
 

resources/views/components/review-form.blade.php

@@ -1,23 +1,28 @@
 @props(['product'])
 
+@php $oldRating = (int) old('rating', 0); @endphp
+
 <form
     method="POST"
-    action="#"
+    action="{{ route('product.reviews.store', ['locale' => app()->getLocale(), 'product' => $product['id']]) }}"
     class="flex flex-col gap-8 mt-10"
+    data-controller="star-rating"
+    data-star-rating-rating-value="{{ $oldRating }}"
+    data-action="submit->star-rating#validate"
 >
     @csrf
 
     {{-- Rating --}}
-    <x-ui.field :label="__('storefront.review.rating')" for="rating" :required="true">
+    <x-ui.field :label="__('storefront.review.rating')" for="rating" :required="true" :error="$errors->first('rating')">
         <div
             id="rating"
-            data-controller="star-rating"
             class="flex items-center gap-1.5 text-brand"
             role="radiogroup"
             aria-label="{{ __('storefront.review.rating') }}"
             aria-required="true"
+            aria-describedby="rating-client-error"
         >
-            <input type="hidden" name="rating" value="0" data-star-rating-target="input">
+            <input type="hidden" name="rating" value="{{ $oldRating }}" data-star-rating-target="input">
             @for($i = 1; $i <= 5; $i++)
                 <button
                     type="button"
@@ -25,7 +30,7 @@ class="flex items-center gap-1.5 text-brand"
                     data-value="{{ $i }}"
                     data-action="click->star-rating#select mouseenter->star-rating#hover mouseleave->star-rating#leave"
                     aria-label="{{ trans_choice('storefront.review.stars_count', $i, ['count' => $i]) }}"
-                    aria-pressed="false"
+                    aria-pressed="{{ $i === $oldRating ? 'true' : 'false' }}"
                 >
                     <svg
                         xmlns="http://www.w3.org/2000/svg"
@@ -41,24 +46,21 @@ class="w-6 h-6"
                 </button>
             @endfor
         </div>
+        <p id="rating-client-error" data-star-rating-target="error" class="text-sm text-red-600" role="alert" hidden>{{ __('storefront.review.rating_required') }}</p>
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.write_label')" for="review-content" :required="true">
-        <x-ui.textarea id="review-content" name="content" :required="true" />
+    <x-ui.field :label="__('storefront.review.write_label')" for="review-content" :required="true" :error="$errors->first('content')">
+        <x-ui.textarea id="review-content" name="content" :required="true" :rows="6">{{ old('content') }}</x-ui.textarea>
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.name')" for="review-name" :labelDescription="__('storefront.review.name_optional')">
-        <x-ui.input id="review-name" name="name" autocomplete="name" />
+    <x-ui.field :label="__('storefront.review.name')" for="review-name" :labelDescription="__('storefront.review.name_optional')" :error="$errors->first('name')">
+        <x-ui.input id="review-name" name="name" autocomplete="name" :value="old('name')" />
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.email')" for="review-email" :required="true" :labelDescription="__('storefront.review.email_not_published')">
-        <x-ui.input id="review-email" name="email" type="email" :required="true" autocomplete="email" />
+    <x-ui.field :label="__('storefront.review.email')" for="review-email" :required="true" :labelDescription="__('storefront.review.email_not_published')" :error="$errors->first('email')">
+        <x-ui.input id="review-email" name="email" type="email" :required="true" autocomplete="email" :value="old('email')" />
     </x-ui.field>
 
-    <x-ui.checkbox id="review-save-info" name="save_info" >
-        <span class="text-sm">{{ __('storefront.review.save_info') }}</span>
-    </x-ui.checkbox>
-
     <div>
         <x-ui.button type="submit">{{ __('storefront.review.submit') }}</x-ui.button>
     </div>

resources/views/components/reviews-stars.blade.php

@@ -3,6 +3,7 @@
     'count'     => 0,
     'showCount' => false,
     'size'      => 24,
+    'linkable'  => false,
 ])
 
 <div class="flex items-center gap-3" {{ $attributes }}>
@@ -28,9 +29,17 @@ class="flex items-center gap-1.5 text-brand"
     </div>
 
     @if ($showCount && $count > 0)
-        <span class="text-sm text-neutral-500">
-            ({{ trans_choice('storefront.customer_reviews', $count, ['count' => $count]) }})
-        </span>
+        @php $countText = '(' . trans_choice('storefront.customer_reviews', $count, ['count' => $count]) . ')'; @endphp
+        @if ($linkable)
+            <button
+                type="button"
+                data-action="click->tab-link#activate"
+                class="text-sm text-neutral-500 hover:underline cursor-pointer"
+                aria-controls="tab-panel-reviews"
+            >{{ $countText }}</button>
+        @else
+            <span class="text-sm text-neutral-500">{{ $countText }}</span>
+        @endif
     @endif
 
 </div>

resources/views/components/ui/button.blade.php

@@ -3,6 +3,7 @@
     'href'     => null,
     'type'     => 'button',
     'size'     => 'lg',
+    'variant'  => 'primary',
     'position' => 'relative',
 ])
 
@@ -15,6 +16,16 @@
         default => 'py-5 px-[46px] text-[19px]',
     };
 
+    // 'primary' is the CTA look (offset-shadow via .btn-primary's ::before/
+    // ::after, italic, uppercase). 'secondary' is a plain bordered toggle —
+    // no shadow layers, fills solid on hover/aria-pressed=true instead, used
+    // for option pickers (see x-ui.option-buttons) and anywhere else a
+    // secondary/toggle action shouldn't compete visually with the CTA.
+    $variantClasses = match($variant) {
+        'secondary' => 'font-semibold hover:bg-black hover:text-neutral-200 aria-pressed:bg-black aria-pressed:text-neutral-200 transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-black',
+        default     => 'btn-primary font-bold italic uppercase',
+    };
+
     // $position defaults to 'relative' (needed so the ::before/::after layers
     // in .btn-primary position against the button itself), but callers that
     // need to place the button absolutely (e.g. a hover-reveal CTA over a
@@ -22,7 +33,7 @@
     // "absolute" via the class prop — Tailwind's generated stylesheet always
     // orders the "relative" utility after "absolute", so on a class clash
     // "relative" silently wins and the button never actually gets positioned.
-    $class = 'btn-primary '.$position.' isolate inline-flex items-center justify-center border border-black font-display font-bold italic text-black cursor-pointer no-underline uppercase ' . $sizeClasses;
+    $class = trim($position.' isolate inline-flex items-center justify-center border border-black text-black cursor-pointer no-underline disabled:cursor-not-allowed disabled:opacity-50 '.$variantClasses.' '.$sizeClasses);
 
     $attrs = $href
         ? $attributes->merge(['href' => $href, 'class' => $class])

resources/views/components/ui/color-swatch.blade.php

@@ -1,12 +1,11 @@
-{{-- $variants: array of Modules\Core\Catalog\Services\ProductIndexer's mapVariant()
-     shape (id, options: [{option, value, meta}], ...) — plain arrays, not Eloquent
-     models, since this is fed from Modules\Core\Catalog\Services\ProductService. --}}
-@props(['variants', 'option' => null])
+{{-- $values: one product option's de-duplicated, ordered values, as built by
+     ProductController::buildOptionPicker() — [{id, label, hex}]. --}}
+@props(['values', 'option' => null, 'optionHandle' => null])
 
 <div {{ $attributes }}>
     @if($option)
         <p class="font-bold mb-3 text-sm uppercase tracking-wide">
-            {{ $option }}: <span data-product-form-target="colorName" class="font-normal normal-case"></span>
+            {{ $option }}: <span data-product-form-target="colorName" data-option="{{ $optionHandle }}" class="font-normal normal-case"></span>
         </p>
     @endif
 
@@ -15,22 +14,17 @@ class="flex flex-wrap gap-2"
         role="group"
         aria-label="{{ $option ?? 'Color' }}"
     >
-        @foreach($variants as $variant)
-            @php
-                $value = $variant['options'][0] ?? null;
-                $label = $value['value'] ?? '';
-                $bg = $value['meta']['hex'] ?? '#cccccc';
-            @endphp
+        @foreach($values as $value)
             <button
                 type="button"
                 class="color-swatch"
                 data-product-form-target="swatch"
                 data-action="click->product-form#selectVariant"
-                data-variant-id="{{ $variant['id'] }}"
-                style="background-color: {{ $bg }};"
-                aria-label="{{ $label }}"
+                data-option="{{ $optionHandle }}"
+                data-value-id="{{ $value['id'] }}"
+                style="background-color: {{ $value['hex'] ?? '#cccccc' }};"
+                aria-label="{{ $value['label'] }}"
                 aria-pressed="false"
-                title="{{ $label }}"
             ></button>
         @endforeach
     </div>

resources/views/components/ui/file-input.blade.php

@@ -0,0 +1,20 @@
+@props([
+    'accept'   => null,
+    'required' => false,
+    'disabled' => false,
+])
+
+<input
+    type="file"
+    @if ($accept) accept="{{ $accept }}" @endif
+    @required($required)
+    @disabled($disabled)
+    {{ $attributes->merge([
+        'class' => 'w-full py-2 text-sm
+                    file:mr-4 file:py-2 file:px-4 file:rounded-none file:border file:border-black file:bg-transparent
+                    file:font-semibold file:cursor-pointer file:transition-colors
+                    hover:file:bg-black hover:file:text-neutral-200
+                    focus:outline-none focus-visible:ring-2 focus-visible:ring-black
+                    disabled:cursor-not-allowed disabled:opacity-50',
+    ]) }}
+/>

resources/views/components/ui/icon.blade.php

@@ -6,7 +6,7 @@
 ])
 
 @php
-    $fillIcons = ['facebook', 'instagram', 'tiktok', 'search', 'bag'];
+    $fillIcons = ['facebook', 'instagram', 'tiktok', 'search', 'bag', 'user', 'heart', 'heart-fill'];
     $svgStroke = $stroke ?? (in_array($name, $fillIcons) ? 'none' : $color);
 @endphp
 
@@ -16,6 +16,12 @@
 
         'bag'    => '<path stroke-width=0.5 d="M20.0049 22H4.00488C3.4526 22 3.00488 21.5523 3.00488 21V3C3.00488 2.44772 3.4526 2 4.00488 2H20.0049C20.5572 2 21.0049 2.44772 21.0049 3V21C21.0049 21.5523 20.5572 22 20.0049 22ZM19.0049 20V4H5.00488V20H19.0049ZM9.00488 6V8C9.00488 9.65685 10.348 11 12.0049 11C13.6617 11 15.0049 9.65685 15.0049 8V6H17.0049V8C17.0049 10.7614 14.7663 13 12.0049 13C9.24346 13 7.00488 10.7614 7.00488 8V6H9.00488Z"/>',
 
+        'user'   => '<path stroke-width=0.5 d="M4 22C4 17.5817 7.58172 14 12 14C16.4183 14 20 17.5817 20 22H18C18 18.6863 15.3137 16 12 16C8.68629 16 6 18.6863 6 22H4ZM12 13C8.685 13 6 10.315 6 7C6 3.685 8.685 1 12 1C15.315 1 18 3.685 18 7C18 10.315 15.315 13 12 13ZM12 11C14.21 11 16 9.21 16 7C16 4.79 14.21 3 12 3C9.79 3 8 4.79 8 7C8 9.21 9.79 11 12 11Z"/>',
+
+        'heart'  => '<path stroke-width=0.5 d="M12.001 4.52853C14.35 2.42 17.98 2.49 20.2426 4.75736C22.5053 7.02472 22.583 10.637 20.4786 12.993L11.9999 21.485L3.52138 12.993C1.41705 10.637 1.49571 7.01901 3.75736 4.75736C6.02157 2.49315 9.64519 2.41687 12.001 4.52853ZM18.827 6.1701C17.3279 4.66794 14.9076 4.60701 13.337 6.01687L12.0019 7.21524L10.6661 6.01781C9.09098 4.60597 6.67506 4.66808 5.17157 6.17157C3.68183 7.66131 3.60704 10.0473 4.97993 11.6232L11.9999 18.6543L19.0201 11.6232C20.3935 10.0467 20.319 7.66525 18.827 6.1701Z"/>',
+
+        'heart-fill' => '<path stroke-width=2 d="M12.001 4.52853C14.35 2.42 17.98 2.49 20.2426 4.75736C22.5053 7.02472 22.583 10.637 20.4786 12.993L11.9999 21.485L3.52138 12.993C1.41705 10.637 1.49571 7.01901 3.75736 4.75736C6.02157 2.49315 9.64519 2.41687 12.001 4.52853Z"/>',
+
         'close'       => '<path fill="none" stroke-width="1.5" stroke-linecap="round" d="M6 6L18 18M18 6L6 18"/>',
 
         'arrow-left'  => '<path fill="none" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" d="M19 12H5M5 12L11 6M5 12L11 18"/>',

resources/views/components/ui/option-buttons.blade.php

@@ -0,0 +1,32 @@
+{{-- $values: one product option's de-duplicated, ordered values, as built by
+     ProductController::buildOptionPicker() — [{id, label, hex}]. Use this
+     instead of <x-ui.color-swatch> for options that aren't a color (no hex),
+     where a swatch dot has nothing meaningful to show. --}}
+@props(['values', 'option' => null, 'optionHandle' => null])
+
+<div {{ $attributes }}>
+    @if($option)
+        <p class="font-bold mb-3 text-sm uppercase tracking-wide">
+            {{ $option }}
+        </p>
+    @endif
+
+    <div
+        class="flex flex-wrap gap-2"
+        role="group"
+        aria-label="{{ $option ?? 'Option' }}"
+    >
+        @foreach($values as $value)
+            <x-ui.button
+                variant="secondary"
+                size="sm"
+                data-product-form-target="swatch"
+                data-action="click->product-form#selectVariant"
+                data-option="{{ $optionHandle }}"
+                data-value-id="{{ $value['id'] }}"
+                aria-label="{{ $value['label'] }}"
+                aria-pressed="false"
+            >{{ $value['label'] }}</x-ui.button>
+        @endforeach
+    </div>
+</div>

resources/views/components/ui/product-card.blade.php

@@ -1,8 +1,15 @@
 @props([
-    'name'  => '',
-    'price' => null,
-    'image' => null,
-    'href'  => '#',
+    'name'      => '',
+    'price'     => null,
+    'image'     => null,
+    'href'      => '#',
+    'variantId' => null,
+    'hasCustomFields' => false,
+    // Shows the "sold" star and drops the quick add-to-cart/personalize button.
+    'soldOut'   => false,
+    // Heart toggle at the top right of the image; needs productId.
+    'productId' => null,
+    'wishlist'  => false,
 ])
 
 {{-- data-turbo-frame="_top" on the links: this card renders inside the
@@ -27,9 +34,37 @@ class="w-full h-auto block"
             @endif
         </a>
 
-        <x-ui.button size="md" position="absolute" class="opacity-0 group-hover:opacity-100 transition-opacity duration-100">
-            {{ __('storefront.product.add_to_cart') }}
-        </x-ui.button>
+        @if ($wishlist && $productId)
+            <x-wishlist-button :product-id="$productId" class="absolute top-4 right-4 z-10" />
+        @endif
+
+        @if ($soldOut)
+            <x-ui.sold-badge class="absolute top-2 right-2 {{ $wishlist && $productId ? 'mt-12' : '' }}" />
+        @elseif ($hasCustomFields)
+            {{-- Custom fields have to be filled in on the product page. --}}
+            <x-ui.button
+                :href="$href"
+                size="md"
+                position="absolute"
+                data-turbo-frame="_top"
+                class="opacity-0 group-hover:opacity-100 focus-visible:opacity-100 transition-opacity duration-100"
+            >
+                {{ __('storefront.product.personalize') }}
+            </x-ui.button>
+        @elseif ($variantId)
+            {{-- has-[...] forces the button visible while an add-to-cart error
+                 is showing, so it isn't only readable on hover — a shopper who
+                 already moved off the card (mouse or the click itself) must
+                 still see why nothing happened. --}}
+            <x-checkout::add-to-cart
+                :purchasable="$variantId"
+                class="absolute opacity-0 group-hover:opacity-100 has-[.bbk-add-to-cart-error:not([hidden])]:opacity-100 transition-opacity duration-100"
+            >
+                <x-ui.button type="submit" size="md">
+                    {{ __('storefront.product.add_to_cart') }}
+                </x-ui.button>
+            </x-checkout::add-to-cart>
+        @endif
     </div>
 
     <div class="flex items-baseline justify-between gap-4">

resources/views/components/ui/select.blade.php

@@ -1,17 +1,22 @@
 @props([
-    'options'   => [],
-    'value'     => null,
-    'name'      => null,
-    'ariaLabel' => null,
+    'options'     => [],
+    'value'       => null,
+    'name'        => null,
+    'ariaLabel'   => null,
+    'placeholder' => null,
+    'block'       => false,
 ])
 
 
-<div class="relative inline-flex items-center">
+<div @class(['relative items-center', 'flex w-full' => $block, 'inline-flex' => ! $block])>
     <select
         @if($name) name="{{ $name }}" @endif
         @if($ariaLabel) aria-label="{{ $ariaLabel }}" @endif
-        {{ $attributes->merge(['class' => 'appearance-none bg-transparent border-b border-black  pr-10 py-2.5 cursor-pointer focus:outline-none']) }}
+        {{ $attributes->merge(['class' => 'appearance-none bg-transparent border-b border-black  pr-10 py-2.5 cursor-pointer focus:outline-none'.($block ? ' w-full' : '')]) }}
     >
+        @if($placeholder !== null)
+            <option value="" @selected($value === null || $value === '')>{{ $placeholder }}</option>
+        @endif
         @foreach($options as $option)
             <option value="{{ $option['value'] }}" @selected($value === $option['value'])>{{ $option['label'] }}</option>
         @endforeach

resources/views/components/ui/sold-badge.blade.php

@@ -0,0 +1,8 @@
+{{-- Black "sold" star for out-of-stock products. Position it from the caller
+     (e.g. class="absolute top-2 right-2"). --}}
+<div {{ $attributes->class('z-10 flex h-20 w-22 items-center justify-center text-black') }}>
+    <svg viewBox="0 0 87 80" class="absolute inset-0 size-full" fill="currentColor" aria-hidden="true">
+        <path d="M56.942,0l2.607,18.642,19.143-3.363L69.468,31.842,87,40,69.468,48.158l9.224,16.563L59.549,61.358,56.942,80,43.5,66.4,30.058,80,27.451,61.358,8.308,64.721l9.224-16.563L0,40l17.532-8.158L8.308,15.279l19.143,3.363L30.058,0,43.5,13.6Z"/>
+    </svg>
+    <span class="relative text-base italic font-black text-white uppercase">{{ __('storefront.product.sold') }}</span>
+</div>

resources/views/components/ui/status.blade.php

@@ -0,0 +1,11 @@
+{{--
+    Flash confirmation box ("Changes saved." etc.). Renders nothing when there's
+    no message; defaults to session('status'). Spacing comes from the caller.
+--}}
+@props([
+    'message' => session('status'),
+])
+
+@if (filled($message))
+    <p role="status" aria-live="polite" {{ $attributes->merge(['class' => 'border border-black bg-brand p-6 text-black']) }}>{{ $message }}</p>
+@endif

resources/views/components/ui/tabs.blade.php

@@ -1,9 +1,10 @@
-@props(['tabs' => [], 'size' => 'md'])
+@props(['tabs' => [], 'size' => 'md', 'active' => null])
 @php
     $sizeClasses = match($size) {
         'lg'    => 'text-[36px] font-extrabold [--slide-h:5px]',
         default => 'text-xl font-bold [--slide-h:3px]',
     };
+    $activeId = $active ?? ($tabs[0]['id'] ?? null);
 @endphp
 
 {{--
@@ -21,22 +22,22 @@
 
 <div data-controller="tabs" {{ $attributes }}>
     <div class="flex gap-10 mb-8" role="tablist">
-        @foreach($tabs as $i => $tab)
+        @foreach($tabs as $tab)
             <button
                 type="button"
                 role="tab"
                 data-tabs-target="button"
                 data-action="click->tabs#show"
                 data-panel="{{ $tab['id'] }}"
-                class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $i === 0 ? 'is-active' : '' }}"
-                aria-selected="{{ $i === 0 ? 'true' : 'false' }}"
+                class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $tab['id'] === $activeId ? 'is-active' : '' }}"
+                aria-selected="{{ $tab['id'] === $activeId ? 'true' : 'false' }}"
                 aria-controls="tab-panel-{{ $tab['id'] }}"
                 id="tab-btn-{{ $tab['id'] }}"
             >{{ $tab['label'] }}</button>
         @endforeach
     </div>
 
-    @foreach($tabs as $i => $tab)
+    @foreach($tabs as $tab)
         @php $panelKey = $tab['id']; $panel = $$panelKey ?? null; @endphp
         <div
             role="tabpanel"
@@ -44,7 +45,7 @@ class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $i === 0 ? 'is-ac
             id="tab-panel-{{ $tab['id'] }}"
             aria-labelledby="tab-btn-{{ $tab['id'] }}"
             tabindex="0"
-            @if($i !== 0) hidden @endif
+            @if($tab['id'] !== $activeId) hidden @endif
         >{{ $panel }}</div>
     @endforeach
 </div>

resources/views/components/wishlist-button.blade.php

@@ -0,0 +1,41 @@
+{{--
+    Heart toggle for one product. A real form, so it works without JS; the
+    `wishlist` Stimulus controller turns the submit into a fetch and flips
+    aria-pressed, which the CSS (group-aria-pressed) uses to swap the icons.
+
+    Usage: <x-wishlist-button :product-id="$product['id']" class="absolute top-4 right-4" />
+--}}
+@props(['productId'])
+
+@php
+    $active = app(\App\Services\Wishlist::class)->has((int) $productId);
+    $addLabel = __('storefront.wishlist.add');
+    $removeLabel = __('storefront.wishlist.remove');
+@endphp
+
+<form
+    method="POST"
+    action="{{ route('wishlist.toggle', ['productId' => $productId]) }}"
+    data-controller="wishlist"
+    data-action="submit->wishlist#toggle"
+    data-wishlist-add-label-value="{{ $addLabel }}"
+    data-wishlist-remove-label-value="{{ $removeLabel }}"
+    data-wishlist-added-message-value="{{ __('storefront.wishlist.added') }}"
+    data-wishlist-removed-message-value="{{ __('storefront.wishlist.removed') }}"
+    {{ $attributes }}
+>
+    @csrf
+
+    <button
+        type="submit"
+        class="group/heart flex size-12 cursor-pointer items-center justify-center"
+        aria-pressed="{{ $active ? 'true' : 'false' }}"
+        aria-label="{{ $active ? $removeLabel : $addLabel }}"
+        data-wishlist-target="button"
+    >
+        <x-ui.icon name="heart" :size="30" class="group-aria-pressed/heart:hidden" />
+        <x-ui.icon name="heart-fill" :size="28" stroke="#000" class="hidden group-aria-pressed/heart:block text-brand" />
+    </button>
+
+    <span class="sr-only" role="status" aria-live="polite" data-wishlist-target="status"></span>
+</form>