Feat: Moving Email Updates to Core

.env.example

@@ -59,6 +59,7 @@ MAIL_USERNAME=null
 MAIL_PASSWORD=null
 MAIL_FROM_ADDRESS="hello@example.com"
 MAIL_FROM_NAME="${APP_NAME}"
+CONTACT_EMAIL=
 
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=

README.md

@@ -0,0 +1,29 @@
+# 3dealer
+
+Storefront for 3dealer.gr: Laravel 12 + Lunar PHP (headless), on top of `boboko/core`. Front-end conventions are in [CLAUDE.md](CLAUDE.md).
+
+## Scheduled jobs
+
+These run in the `scheduler` container (`php artisan schedule:work`).
+
+| Command | When | What it does |
+|---|---|---|
+| `custom-fields:prune-uploads` | Daily, 04:00 | Deletes custom-field photo uploads older than 24 h that no cart line or order line references. |
+| `lunar:search:index` | Daily, 03:00 | Full product reindex. Registered by `boboko/core`. |
+
+## Product custom fields
+
+Admins can add custom fields to a product in the Lunar admin (the product's **Custom Fields** section, from `boboko/core`). The customer fills them in on the product page before adding the product to the cart. The answers are stored on the cart line (`meta.custom_fields`) and carried over to the order line.
+
+| Field type | Storefront input | Limit |
+|---|---|---|
+| Short text | text input | 255 characters |
+| Long text | textarea | 2,000 characters |
+| File upload | photo upload | JPG, PNG, WEBP, HEIC/HEIF, up to 10 MB |
+
+- **Photos upload as soon as they're picked.** They go to `POST /{locale}/custom-field-uploads`, which is limited to 20 per minute per client. They're stored on the private `local` disk under `storage/app/private/custom-field-uploads/`. Only an encrypted reference is sent with add-to-cart. The allowed types and size are set in `App\Http\Controllers\CustomFieldUploadController`.
+- **Photos are never public.** The cart drawer, checkout summary and order confirmation link to a photo through a signed URL that expires after 2 hours.
+- **Emails show text answers only**, never photos.
+- **Photos are cleaned up automatically.** Photos never added to a cart are deleted by `custom-fields:prune-uploads` (see above). A photo on a cart line is kept as long as that cart line exists, and a photo on an order is kept indefinitely.
+- **Products with custom fields can't be quick-added.** On product cards, the "add to cart" button becomes a link to the product page.
+- Field labels are entered once in the admin and aren't translated, so they appear as entered in both `/el` and `/en`.

app/Catalog/ProductCard.php

@@ -19,7 +19,7 @@ final class ProductCard
 {
     /**
      * @param  array<string, mixed>  $product  one item from ProductService's localized array shape
-     * @return array{name: ?string, price: ?string, image: ?string, href: string}
+     * @return array{name: ?string, price: ?string, image: ?string, href: string, variantId: ?int, hasCustomFields: bool}
      */
     public static function fromIndexed(array $product): array
     {
@@ -28,6 +28,16 @@ public static function fromIndexed(array $product): array
             'price' => $product['price'],
             'image' => $product['media'][0]['url'] ?? null,
             'href' => route('product.show', ['id' => $product['id']]),
+            // The card's quick "Add to cart" always adds this variant, same
+            // default Modules\Core\Catalog\Services\ProductService::
+            // variantSummaries() and product/show.blade.php both use — no
+            // picker at listing-grid scope, unlike the product page's own
+            // color swatches.
+            'variantId' => $product['variants'][0]['id'] ?? null,
+            // A product with custom fields (photo upload, engraving text…)
+            // can't be quick-added from a card — the card links to the
+            // product page instead, even when every field is optional.
+            'hasCustomFields' => ! empty($product['custom_fields']),
         ];
     }
 }

app/Catalog/ProductListingPage.php

@@ -17,7 +17,14 @@
  */
 final class ProductListingPage
 {
-    private const PER_PAGE = 12;
+    private const PER_PAGE = 40;
+
+    /** Category pages rarely have enough products to fill a page, so this
+     * ceiling is high enough to act as "no pagination" in practice — the
+     * pagination component self-hides via hasPages() when everything fits.
+     * If a category ever exceeds it, pagination reappears as a safety net
+     * rather than silently truncating results. */
+    private const CATEGORY_PER_PAGE = 200;
 
     public function __construct(
         private readonly ProductService $products,
@@ -33,6 +40,7 @@ public function __construct(
     public function build(ProductListing $listing, Closure $url, ?int $collectionId = null, ?string $query = null): array
     {
         $filters = $listing->filters($collectionId);
+        $perPage = $collectionId !== null ? self::CATEGORY_PER_PAGE : self::PER_PAGE;
 
         // Listing reads from the Meilisearch index via ProductService/
         // ProductSearchService, not Eloquent. Both return a
@@ -45,12 +53,12 @@ public function build(ProductListing $listing, Closure $url, ?int $collectionId
                 query: $query,
                 filters: $filters,
                 sort: $listing->sort,
-                perPage: self::PER_PAGE,
+                perPage: $perPage,
                 page: $listing->page,
             )
             : $this->products->list(
                 filters: $filters,
-                perPage: self::PER_PAGE,
+                perPage: $perPage,
                 page: $listing->page,
                 sort: $listing->sort,
             );

app/Http/Controllers/Account/AccountController.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+use Lunar\Models\Country;
+use Lunar\Models\State;
+use Modules\Core\Cart\Services\CartService;
+use Modules\Core\Checkout\Services\CheckoutService;
+use Modules\Core\Customer\Services\CustomerAccountService;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * The profile page: name, invoice details, the one address, and account
+ * deletion. The customer keeps a single address, flagged as both the
+ * shipping and billing default, so allowing several later is a UI change
+ * only (the data is already Lunar's own addresses table).
+ */
+class AccountController extends Controller
+{
+    // Single-country store, same as CheckoutController::STORE_COUNTRY_ISO3.
+    private const STORE_COUNTRY_ISO3 = 'GRC';
+
+    private const ADDRESS_FIELDS = ['line_one', 'city', 'postcode', 'state', 'contact_phone'];
+
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function show(string $locale, Request $request): View
+    {
+        $user = $request->user();
+        $customer = $this->account->customer($user);
+
+        return view('account.show', [
+            'user' => $user,
+            'customer' => $customer,
+            'address' => $this->defaultAddress($user),
+            'regions' => State::where('country_id', $this->storeCountry()->id)->orderBy('name')->get(['id', 'name']),
+        ]);
+    }
+
+    public function update(string $locale, Request $request): RedirectResponse
+    {
+        $user = $request->user();
+        $country = $this->storeCountry();
+
+        // The address is all-or-nothing: typing any part of it makes the rest
+        // (and the name, which Lunar requires on every address) required.
+        $anyAddressField = implode(',', self::ADDRESS_FIELDS);
+
+        $data = $request->validate([
+            'first_name' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'last_name' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'invoice' => ['boolean'],
+            'company_name' => ['nullable', 'string', 'max:255', 'required_if_accepted:invoice'],
+            'tax_identifier' => ['nullable', 'digits:9', 'required_if_accepted:invoice'],
+            'line_one' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'city' => ['nullable', 'string', 'max:255', 'required_with:'.$anyAddressField],
+            'postcode' => ['nullable', 'regex:/^\d{3}\s?\d{2}$/', 'required_with:'.$anyAddressField],
+            'state' => [
+                'nullable',
+                'string',
+                'required_with:'.$anyAddressField,
+                Rule::exists((new State)->getTable(), 'name')->where('country_id', $country->id),
+            ],
+            'contact_phone' => ['nullable', 'string', 'max:30'],
+            'recovery_consent' => ['boolean'],
+        ]);
+
+        $invoice = $request->boolean('invoice');
+
+        $this->account->updateProfile($user, [
+            'first_name' => $data['first_name'] ?? null,
+            'last_name' => $data['last_name'] ?? null,
+            'company_name' => $invoice ? $data['company_name'] : null,
+            'tax_identifier' => $invoice ? $data['tax_identifier'] : null,
+        ]);
+
+        if (filled($data['line_one'] ?? null)) {
+            $addressData = [
+                ...collect($data)->only(self::ADDRESS_FIELDS)->all(),
+                'first_name' => $data['first_name'],
+                'last_name' => $data['last_name'],
+                'country_id' => $country->id,
+                'contact_email' => $user->email,
+                'shipping_default' => true,
+                'billing_default' => true,
+            ];
+
+            $existing = $this->defaultAddress($user);
+
+            $existing
+                ? $this->account->updateAddress($user, $existing->id, $addressData)
+                : $this->account->createAddress($user, $addressData);
+        }
+
+        $this->updateRecoveryConsent($user, $request->boolean('recovery_consent'));
+
+        return redirect()->route('account')->with('status', __('storefront.account.saved'));
+    }
+
+    /**
+     * "Email me a reminder if I don't finish my order", as a standing
+     * choice — stored on the customer via boboko-core's
+     * CustomerAccountService::setRecoveryConsent(), and applied to the
+     * current cart too, so opting out stops reminders for it right away.
+     */
+    private function updateRecoveryConsent($user, bool $consent): void
+    {
+        $this->account->setRecoveryConsent($user, $consent);
+
+        // Only an existing cart; never create one just to record this.
+        $cart = app(CartService::class)->current();
+
+        if ($cart && (bool) data_get($cart, 'meta.recovery_consent') !== $consent) {
+            app(CheckoutService::class)->setRecoveryConsent($consent);
+        }
+    }
+
+    /**
+     * Self-service deletion: opens core's 30-day grace-period erasure request
+     * (which blocks the login right away) and logs out. Logging back in within
+     * the grace period cancels it; see core's docs/privacy.md.
+     */
+    public function destroy(string $locale, Request $request, PrivacyService $privacy): RedirectResponse
+    {
+        $user = $request->user();
+
+        $privacy->requestErasureForUser($user, $user);
+
+        Auth::logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login')->with('status', __('storefront.account.deletion_requested'));
+    }
+
+    private function defaultAddress($user)
+    {
+        $addresses = collect($this->account->addresses($user));
+
+        return $addresses->firstWhere('shipping_default', true) ?? $addresses->first();
+    }
+
+    private function storeCountry(): Country
+    {
+        return Country::where('iso3', self::STORE_COUNTRY_ISO3)->firstOrFail();
+    }
+}

app/Http/Controllers/Account/EmailController.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
+use Modules\Core\Customer\Exceptions\EmailAlreadyTakenException;
+use Modules\Core\Customer\Exceptions\InvalidEmailChangeCodeException;
+use Modules\Core\Customer\Services\CustomerEmailChangeService;
+
+/**
+ * Changing the login email — a thin wrapper over boboko-core's
+ * Customer\Services\CustomerEmailChangeService, which owns the actual
+ * request/confirm mechanics, throttling, pending-change storage, and
+ * mailables. This controller's own job is just the storefront's session-
+ * scoped "which email did I just ask to switch to" UI state (so the
+ * .code/.resend pages know which address to show/resend to) and
+ * translating the service's exceptions into the flash-message flow the
+ * views expect.
+ */
+class EmailController extends Controller
+{
+    private const SESSION_KEY = 'pending_email_change';
+
+    public function edit(string $locale, Request $request): View
+    {
+        return view('account.email', ['user' => $request->user()]);
+    }
+
+    public function send(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $user = $request->user();
+
+        $request->merge(['email' => Str::lower(trim((string) $request->input('email')))]);
+
+        $validated = $request->validate([
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::notIn([$user->email]),
+            ],
+        ], [
+            'email.not_in' => __('storefront.account.email_same'),
+        ]);
+
+        try {
+            $emailChange->request($user, $validated['email']);
+        } catch (EmailAlreadyTakenException) {
+            return back()->withInput()->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (OtpThrottledException) {
+            return back()->withInput()->withErrors(['email' => __('storefront.auth.too_many_codes')]);
+        }
+
+        $request->session()->put(self::SESSION_KEY, $validated['email']);
+
+        return redirect()->route('account.email.code');
+    }
+
+    public function code(string $locale, Request $request): View|RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        return view('account.email-code', ['email' => $pendingEmail]);
+    }
+
+    public function resend(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        try {
+            $emailChange->request($request->user(), $pendingEmail);
+        } catch (EmailAlreadyTakenException) {
+            $request->session()->forget(self::SESSION_KEY);
+
+            return redirect()->route('account.email.edit')
+                ->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (OtpThrottledException) {
+            return back()->withErrors(['code' => __('storefront.auth.too_many_codes')]);
+        }
+
+        return back()->with('status', __('storefront.auth.code_resent'));
+    }
+
+    public function verify(string $locale, Request $request, CustomerEmailChangeService $emailChange): RedirectResponse
+    {
+        $pendingEmail = $request->session()->get(self::SESSION_KEY);
+
+        if (! $pendingEmail) {
+            return redirect()->route('account.email.edit');
+        }
+
+        $validated = $request->validate(['code' => ['required', 'digits:6']]);
+
+        try {
+            $emailChange->confirm($request->user(), $validated['code']);
+        } catch (EmailAlreadyTakenException) {
+            $request->session()->forget(self::SESSION_KEY);
+
+            return redirect()->route('account.email.edit')
+                ->withErrors(['email' => __('storefront.account.email_taken')]);
+        } catch (InvalidEmailChangeCodeException) {
+            return back()->withErrors(['code' => __('storefront.auth.invalid_code')]);
+        }
+
+        $request->session()->forget(self::SESSION_KEY);
+
+        return redirect()->route('account')->with('status', __('storefront.account.email_changed'));
+    }
+}

app/Http/Controllers/Account/OrderController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Customer\Exceptions\OrderNotFoundException;
+use Modules\Core\Customer\Services\CustomerAccountService;
+
+/**
+ * Order history. Every lookup goes through CustomerAccountService, which only
+ * ever returns the logged-in user's own placed orders, so an order id from
+ * the URL can't reach someone else's order.
+ */
+class OrderController extends Controller
+{
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function index(string $locale, Request $request): View
+    {
+        return view('account.orders.index', [
+            'orders' => $this->account->orders($request->user(), 15),
+        ]);
+    }
+
+    public function show(string $locale, Request $request, int $orderId): View
+    {
+        try {
+            $order = $this->account->order($request->user(), $orderId);
+        } catch (OrderNotFoundException) {
+            abort(404);
+        }
+
+        // By type, like the checkout confirmation: the method may since have
+        // been disabled, but the order still shows what was used.
+        $paymentMethodName = PaymentMethod::where('type', $order->meta['payment_method'] ?? null)
+            ->first()
+            ?->translate('name');
+
+        return view('account.orders.show', [
+            'order' => $order,
+            'paymentMethodName' => $paymentMethodName,
+            'shipments' => $order->shipments->whereNull('cancelled_at')->whereNotNull('tracking_reference'),
+        ]);
+    }
+}

app/Http/Controllers/Auth/LoginController.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+use Illuminate\View\View;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
+use Modules\Core\Auth\Services\UserOtpService;
+
+/**
+ * Passwordless customer login: email → emailed 6-digit code → logged in.
+ * Login and registration are the same flow — UserOtpService::generateAndSend()
+ * find-or-creates the user (and its Customer).
+ *
+ * All the security lives in UserOtpService: per-email code-request throttling
+ * (OtpThrottledException), wrong-guess lockout, the Auth::login() itself (which
+ * also regenerates the session and merges the guest cart via Lunar's Login
+ * listener) and the session-registry record. This controller only moves the
+ * shopper between the two steps, carrying the email in the session rather
+ * than the URL.
+ */
+class LoginController extends Controller
+{
+    /**
+     * `?redirect=/el/checkout` (e.g. from the checkout's login tab) becomes the
+     * intended URL that verify() returns to. Only a same-site path is accepted:
+     * no scheme, no protocol-relative `//host`, so it can't redirect off-site.
+     */
+    public function create(string $locale, Request $request): View
+    {
+        $redirect = (string) $request->query('redirect', '');
+
+        if (preg_match('#^/(?![/\\\\])#', $redirect)) {
+            $request->session()->put('url.intended', url($redirect));
+        }
+
+        return view('auth.login');
+    }
+
+    public function send(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        $validated = $request->validate([
+            'email' => ['required', 'email', 'max:255'],
+        ]);
+
+        $email = Str::lower(trim($validated['email']));
+
+        try {
+            $otp->generateAndSend($email);
+        } catch (OtpThrottledException) {
+            return back()->withInput()->withErrors([
+                'email' => __('storefront.auth.too_many_codes'),
+            ]);
+        }
+
+        $request->session()->put('login.email', $email);
+
+        return redirect()->route('login.code');
+    }
+
+    public function code(string $locale, Request $request): View|RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        return view('auth.login-code', ['email' => $email]);
+    }
+
+    public function resend(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        try {
+            $otp->generateAndSend($email);
+        } catch (OtpThrottledException) {
+            return back()->withErrors([
+                'code' => __('storefront.auth.too_many_codes'),
+            ]);
+        }
+
+        return back()->with('status', __('storefront.auth.code_resent'));
+    }
+
+    public function verify(string $locale, Request $request, UserOtpService $otp): RedirectResponse
+    {
+        $email = $request->session()->get('login.email');
+
+        if (! $email) {
+            return redirect()->route('login');
+        }
+
+        $validated = $request->validate([
+            'code' => ['required', 'digits:6'],
+        ]);
+
+        // Wrong, expired, or locked out after too many guesses — core doesn't
+        // say which, so neither do we; the page offers "resend code" for all three.
+        if (! $otp->validate($email, $validated['code'], $request)) {
+            return back()->withErrors([
+                'code' => __('storefront.auth.invalid_code'),
+            ]);
+        }
+
+        $request->session()->forget('login.email');
+
+        return redirect()->intended(route('home'));
+    }
+
+    public function destroy(string $locale, Request $request): RedirectResponse
+    {
+        Auth::logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('home');
+    }
+}

app/Http/Controllers/Checkout/CartController.php

@@ -3,11 +3,22 @@
 namespace App\Http\Controllers\Checkout;
 
 use App\Http\Controllers\Controller;
+use App\Http\Controllers\CustomFieldUploadController;
+use Closure;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
 use Illuminate\View\View;
+use Lunar\Exceptions\Carts\CartException;
+use Lunar\Models\CartLine;
 use Lunar\Models\ProductVariant;
+use Illuminate\Support\Facades\App;
 use Modules\Core\Cart\Exceptions\InvalidCouponException;
 use Modules\Core\Cart\Services\CartService;
+use Modules\Core\File\Models\File;
+use Modules\Core\File\Services\FileService;
+use Modules\Core\Localization\Services\LanguageCache;
 
 /**
  * Thin storefront cart endpoints for the checkout module. Every action mutates
@@ -22,33 +33,186 @@ public function __construct(
         private readonly CartService $cart,
     ) {}
 
-    public function add(string $locale, Request $request): View
+    /**
+     * CartException here is Lunar's own add_to_cart validation pipeline
+     * (CartLineQuantity/CartLineStock) rejecting the line — most commonly
+     * "not enough stock at this quantity" for a tracked (purchasable =
+     * in_stock) variant. Its own message is an untranslated, hardcoded
+     * English string not meant for storefront display, so this returns our
+     * own translated one instead rather than passing it through — a
+     * storefront.* key rather than checkout.*, since this is a catalog/stock
+     * concern the storefront owns, not something specific to the portable
+     * checkout module.
+     */
+    public function add(string $locale, Request $request): View|JsonResponse
     {
         $data = $request->validate([
             'purchasable_id' => ['required', 'integer'],
             'quantity' => ['nullable', 'integer', 'min:1'],
+            'custom_fields' => ['nullable', 'array'],
         ]);
 
         $variant = ProductVariant::findOrFail($data['purchasable_id']);
 
-        $this->cart->addLine($variant, $data['quantity'] ?? 1);
+        try {
+            $meta = $this->customFieldsMeta($variant, $data['custom_fields'] ?? []);
+        } catch (ValidationException $e) {
+            return response()->json(['error' => collect($e->errors())->flatten()->first()], 422);
+        }
+
+        try {
+            $this->cart->addLine($variant, $data['quantity'] ?? 1, $meta);
+        } catch (CartException) {
+            return $this->stockError($variant);
+        }
 
         return view('checkout::partials.cart-body');
     }
 
-    public function updateLine(string $locale, Request $request, int $line): View
+    /**
+     * The shopper's answers to the product's custom fields (boboko-core's
+     * Product::$custom_fields — {key, type: text|textarea|file, label,
+     * required}), as cart line meta. Lunar copies CartLine.meta onto the
+     * OrderLine at order creation, so this is also what the order keeps.
+     *
+     * Only keys the product actually defines are kept, nested under
+     * `custom_fields` — line meta also carries behavior flags (core's
+     * `saved_for_later` zeroes the line's price), so shopper input must never
+     * be merged into it directly. Label and type are snapshotted alongside
+     * each value so the cart/order still reads correctly if the product's
+     * fields are edited later.
+     *
+     * A `file` answer is the id of a File row the host's own upload endpoint
+     * (CustomFieldUploadController) already created via boboko-core's
+     * FileService — never the file's bytes, disk, or path, all of which
+     * FileService alone is the source of truth for. A shopper can't point
+     * this at someone else's file: the id must resolve to a File that is
+     * BOTH unowned (isFileAnswerValid()) and tagged with
+     * CustomFieldUploadController::PURPOSE, so an id belonging to an
+     * already-ordered file (owned, and/or a different purpose entirely) is
+     * rejected. Attaching the File to the real CartLine it belongs to
+     * happens afterward, in boboko-core's own Modules\Core\File\Listeners\
+     * AttachCustomFieldFileToCartLine (listening for Cart\Events\
+     * CartLineAdded) — not here, since this method only builds the meta
+     * $this->cart->addLine() is about to receive, before any CartLine
+     * actually exists to own anything.
+     *
+     * Two adds with identical answers merge into one line (Lunar matches
+     * existing lines on meta); different answers stay separate lines.
+     */
+    private function customFieldsMeta(ProductVariant $variant, array $input): array
+    {
+        $fields = collect($variant->product?->custom_fields ?? [])
+            ->keyBy('key')
+            ->map(fn (array $field) => [...$field, 'label' => $this->resolveLabel($field['label'])]);
+
+        if ($fields->isEmpty()) {
+            return [];
+        }
+
+        $validated = Validator::make(
+            $input,
+            $fields->map(fn (array $field) => [
+                ($field['required'] ?? false) ? 'required' : 'nullable',
+                ...match ($field['type']) {
+                    'textarea' => ['string', 'max:2000'],
+                    'file' => [function (string $attribute, mixed $value, Closure $fail) {
+                        if (! $this->isFileAnswerValid($value)) {
+                            $fail('validation.uploaded')->translate();
+                        }
+                    }],
+                    default => ['string', 'max:255'],
+                },
+            ])->all(),
+            [],
+            $fields->map(fn (array $field) => $field['label'])->all(),
+        )->validate();
+
+        $answers = $fields
+            ->filter(fn (array $field) => filled($validated[$field['key']] ?? null))
+            ->map(fn (array $field) => [
+                'key' => $field['key'],
+                'label' => $field['label'],
+                'type' => $field['type'],
+                ...($field['type'] === 'file'
+                    ? ['file_id' => (int) $validated[$field['key']]]
+                    : ['value' => $validated[$field['key']]]),
+            ])
+            ->values()
+            ->all();
+
+        return $answers === [] ? [] : ['custom_fields' => $answers];
+    }
+
+    /**
+     * Product::$custom_fields stores `label` as {locale: string} (see
+     * boboko-core's Catalog\Filament\Pages\ManageProductCustomFields) — this
+     * resolves it to the single current-locale string cart/order line meta
+     * actually needs, the same filled()-over-?? fallback boboko-core's
+     * ProductDocumentLocalizer uses for every other translated field (an
+     * empty string for the current locale still falls through to the
+     * store's default language, rather than showing blank). A product
+     * saved before labels became translatable still has a plain string
+     * here, returned as-is.
+     */
+    private function resolveLabel(mixed $label): string
+    {
+        if (! is_array($label)) {
+            return (string) $label;
+        }
+
+        $locale = App::getLocale();
+        $fallbackLocale = app(LanguageCache::class)->defaultLocale();
+
+        return filled($label[$locale] ?? null)
+            ? $label[$locale]
+            : ($label[$fallbackLocale] ?? '');
+    }
+
+    private function isFileAnswerValid(mixed $fileId): bool
+    {
+        $file = File::find($fileId);
+
+        return $file !== null
+            && $file->purpose === CustomFieldUploadController::PURPOSE
+            && $file->owner_id === null
+            && app(FileService::class)->exists($file);
+    }
+
+    public function updateLine(string $locale, Request $request, int $line): View|JsonResponse
     {
         $quantity = (int) $request->validate([
             'quantity' => ['required', 'integer', 'min:0'],
         ])['quantity'];
 
-        $quantity === 0
-            ? $this->cart->removeLine($line)
-            : $this->cart->updateLine($line, $quantity);
+        try {
+            $quantity === 0
+                ? $this->cart->removeLine($line)
+                : $this->cart->updateLine($line, $quantity);
+        } catch (CartException) {
+            $variant = CartLine::find($line)?->purchasable;
+
+            return $this->stockError($variant instanceof ProductVariant ? $variant : null);
+        }
 
         return view('checkout::partials.cart-body');
     }
 
+    /**
+     * getTotalInventory() is the same number canBeFulfilledAtQuantity()
+     * checked against (stock, for a tracked in_stock variant) — telling the
+     * shopper how many are actually left beats a generic "not enough stock"
+     * they'd otherwise have to guess around by trial and error.
+     */
+    private function stockError(?ProductVariant $variant): JsonResponse
+    {
+        $available = $variant?->getTotalInventory() ?? 0;
+
+        return response()->json([
+            'error' => trans_choice('storefront.product.add_to_cart_failed', $available, ['count' => $available]),
+        ], 422);
+    }
+
     public function remove(string $locale, int $line): View
     {
         $this->cart->removeLine($line);

app/Http/Controllers/Checkout/CheckoutController.php

@@ -7,6 +7,7 @@
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\View\View;
@@ -22,7 +23,9 @@
 use Modules\Core\Checkout\Exceptions\TermsNotAcceptedException;
 use Modules\Core\Checkout\Exceptions\UnknownPaymentTypeException;
 use Modules\Core\Checkout\Services\CheckoutService;
+use Modules\Core\Customer\Services\CustomerAccountService;
 use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Models\PaymentMethod;
 
 /**
  * The checkout page — one page, sections (contact / billing / shipping /
@@ -37,7 +40,11 @@
  * lenient — nothing is rejected mid-typing; required-field enforcement is the
  * job of the (not-yet-built) "Continue to payment" gate.
  *
- * Guest-only for now — the Contact section's login tab is UI only.
+ * Guests type their email; the login tab links to the storefront's own
+ * `login` route and back. Logged in: the email is the account's (forced in
+ * saveAddress()), the first visit prefills addresses from the account
+ * (prefillFromAccount()), and Lunar's Login listener has already attached the
+ * cart, so the placed order lands in the account's history.
  *
  * Single-country store: STORE_COUNTRY_ISO3 fixes the country to Greece (hidden
  * field, forced server-side). Set it to null for the full country picker (the
@@ -50,6 +57,7 @@ class CheckoutController extends Controller
     public function __construct(
         private readonly CartService $cart,
         private readonly CheckoutService $checkout,
+        private readonly CustomerAccountService $account,
     ) {}
 
     public function show(string $locale): View
@@ -60,10 +68,24 @@ public function show(string $locale): View
 
         $shippingOptions = collect();
 
+        // Captured before prefillFromAccount(), which may recreate the address
+        // row (dropping its shipping_option) — same reason as in saveAddress().
+        $previousOption = $cart?->shippingAddress?->shipping_option;
+
+        if ($cart && Auth::check()) {
+            $cart = $this->prefillFromAccount($cart);
+
+            // Nothing chosen on this cart yet: carry over the account's standing
+            // opt-in (an explicit earlier choice, recorded with its own
+            // timestamp/policy version). Never opts anyone in by default.
+            if (! array_key_exists('recovery_consent', $cart->meta?->toArray() ?? [])
+                && data_get($this->account->customer(Auth::user()), 'meta.recovery_consent')) {
+                $cart = $this->checkout->setRecoveryConsent(true);
+            }
+        }
+
         if ($cart?->shippingAddress) {
-            // Nothing recreates the address row in this path — its own current
-            // value is the correct "previous" to carry forward if still valid.
-            $shippingOptions = $this->syncShipping($cart, $cart->shippingAddress->shipping_option);
+            $shippingOptions = $this->syncShipping($cart, $previousOption);
 
             // Cart's CachesProperties::refresh() explicitly nulls total/
             // subTotal/shippingTotal/etc. back to their defaults — every
@@ -73,14 +95,29 @@ public function show(string $locale): View
             $cart->refresh()->recalculate();
         }
 
+        $paymentMethods = $this->checkout->getPaymentMethods();
+
+        // Nothing checked yet (fresh cart), or the shopper's earlier pick is
+        // no longer offered (method disabled/removed since) — auto-select
+        // the first one, same as a manual click would, so the payment
+        // section (and the Stripe Element mounting under it) isn't sitting
+        // inert behind an unchecked radio. A still-valid previous choice is
+        // left alone.
+        $firstMethod = $paymentMethods->first();
+
+        if ($cart && $firstMethod && ! $paymentMethods->contains('type', data_get($cart, 'meta.payment_method'))) {
+            $cart = $this->checkout->selectPaymentMethod($firstMethod->type);
+        }
+
         return view('checkout::page', [
             'cart' => $cart,
             'lines' => $lines,
             'billingAddress' => $cart?->billingAddress,
             'shippingAddress' => $cart?->shippingAddress,
             'shippingOptions' => $shippingOptions,
-            'paymentMethods' => $this->checkout->getPaymentMethods(),
+            'paymentMethods' => $paymentMethods,
             'shipToBilling' => (bool) data_get($cart, 'meta.ship_to_billing', true),
+            'wantsInvoice' => (bool) data_get($cart, 'meta.wants_invoice', false),
             'storeCountry' => $storeCountry,
             'countries' => $storeCountry
                 ? collect()
@@ -124,7 +161,6 @@ public function saveAddress(string $locale, Request $request): JsonResponse
             'billing_company_name' => ['nullable', 'string', 'max:255'],
             'billing_tax_identifier' => ['nullable', 'string', 'max:255'],
             'billing_line_one' => ['nullable', 'string', 'max:255'],
-            'billing_line_two' => ['nullable', 'string', 'max:255'],
             'billing_city' => ['nullable', 'string', 'max:255'],
             'billing_state' => $stateRule,
             'billing_postcode' => ['nullable', 'string', 'max:20'],
@@ -133,9 +169,7 @@ public function saveAddress(string $locale, Request $request): JsonResponse
 
             'shipping_first_name' => ['nullable', 'string', 'max:255'],
             'shipping_last_name' => ['nullable', 'string', 'max:255'],
-            'shipping_company_name' => ['nullable', 'string', 'max:255'],
             'shipping_line_one' => ['nullable', 'string', 'max:255'],
-            'shipping_line_two' => ['nullable', 'string', 'max:255'],
             'shipping_city' => ['nullable', 'string', 'max:255'],
             'shipping_state' => $stateRule,
             'shipping_postcode' => ['nullable', 'string', 'max:20'],
@@ -147,16 +181,25 @@ public function saveAddress(string $locale, Request $request): JsonResponse
         $errors = $validator->errors()->toArray();
         $data = $validator->valid();
 
+        // Logged in: the order email is always the account's. It isn't a field
+        // on the page then, and a submitted value isn't trusted.
+        if ($user = Auth::user()) {
+            $data['contact_email'] = $user->email;
+        }
+
         $billingCountryId = $storeCountry?->id ?? ($data['billing_country_id'] ?? null);
         $shippingCountryId = $storeCountry?->id ?? ($data['shipping_country_id'] ?? $billingCountryId);
 
+        // Company/ΑΦΜ only count when "I want an invoice" is ticked; the fields
+        // stay in the DOM (just hidden) when it isn't, so ignore what they send.
+        $wantsInvoice = $request->boolean('wants_invoice');
+
         $billing = [
             'first_name' => $data['billing_first_name'] ?? null,
             'last_name' => $data['billing_last_name'] ?? null,
-            'company_name' => $data['billing_company_name'] ?? null,
-            'tax_identifier' => $data['billing_tax_identifier'] ?? null,
+            'company_name' => $wantsInvoice ? ($data['billing_company_name'] ?? null) : null,
+            'tax_identifier' => $wantsInvoice ? ($data['billing_tax_identifier'] ?? null) : null,
             'line_one' => $data['billing_line_one'] ?? null,
-            'line_two' => $data['billing_line_two'] ?? null,
             'city' => $data['billing_city'] ?? null,
             'state' => $data['billing_state'] ?? null,
             'postcode' => $data['billing_postcode'] ?? null,
@@ -166,13 +209,14 @@ public function saveAddress(string $locale, Request $request): JsonResponse
         ];
 
         $shipping = $sameAsBilling
-            ? [...$billing, 'delivery_instructions' => $data['shipping_delivery_instructions'] ?? null]
+            ? [
+                ...array_diff_key($billing, ['company_name' => 1, 'tax_identifier' => 1]),
+                'delivery_instructions' => $data['shipping_delivery_instructions'] ?? null,
+            ]
             : [
                 'first_name' => $data['shipping_first_name'] ?? null,
                 'last_name' => $data['shipping_last_name'] ?? null,
-                'company_name' => $data['shipping_company_name'] ?? null,
                 'line_one' => $data['shipping_line_one'] ?? null,
-                'line_two' => $data['shipping_line_two'] ?? null,
                 'city' => $data['shipping_city'] ?? null,
                 'state' => $data['shipping_state'] ?? null,
                 'postcode' => $data['shipping_postcode'] ?? null,
@@ -185,7 +229,11 @@ public function saveAddress(string $locale, Request $request): JsonResponse
         $this->checkout->setBillingAddress($billing);
         $cart = $this->checkout->setShippingAddress($shipping);
 
-        $cart->meta = [...($cart->meta?->toArray() ?? []), 'ship_to_billing' => $sameAsBilling];
+        $cart->meta = [
+            ...($cart->meta?->toArray() ?? []),
+            'ship_to_billing' => $sameAsBilling,
+            'wants_invoice' => $wantsInvoice,
+        ];
         $cart->save();
 
         // Abandoned-cart-recovery opt-in — boboko-core owns the record (bool +
@@ -193,6 +241,10 @@ public function saveAddress(string $locale, Request $request): JsonResponse
         // Deliberately its own scope, not merged with any future newsletter opt-in.
         $this->checkout->setRecoveryConsent($request->boolean('recovery_consent'));
 
+        if (Auth::check()) {
+            $this->account->setRecoveryConsent(Auth::user(), $request->boolean('recovery_consent'));
+        }
+
         $rateKeyAfter = $cart->shippingAddress?->only(['postcode', 'state', 'country_id']);
         $rateChanged = $rateKeyAfter != $rateKeyBefore;
 
@@ -275,6 +327,63 @@ public function placeOrder(string $locale, Request $request): JsonResponse
 
         $cart = $this->cart->current();
 
+        // Captured now, before initiatePayment() can place the order — Lunar's
+        // CartSessionManager::fetchOrCreate() silently swaps the session onto a
+        // BRAND NEW empty cart the moment the current one hasCompletedOrders()
+        // (i.e. has an order with placed_at set), which happens synchronously
+        // for an immediately-captured payment. Any later $this->cart->current()
+        // call in this same flow (here, or in a subsequent orderStatus() poll
+        // once the 3-D Secure webhook sets placed_at) would then resolve to
+        // that fresh, order-less cart instead of the one that was just placed.
+        // Storing the real cart id ourselves, under our own session key,
+        // sidesteps CartSession entirely for the rest of the placement flow.
+        session(['checkout.cart_id' => $cart?->id]);
+
+        // Lunar's own ValidateCartForOrderCreation (order_create validator)
+        // never checks for this — an empty cart with a valid billing address
+        // sails straight through it and would place a real, zero-line order.
+        // The disabled "place order" button is only the client-side half of
+        // this fix; this is the half that actually matters.
+        if ($cart === null || $this->cart->activeLines($cart)->isEmpty()) {
+            return response()->json([
+                'status' => 'invalid',
+                'message' => __('checkout.page.cart_empty'),
+            ], 422);
+        }
+
+        // Lenient autosave never requires these; this is the gate.
+        if (data_get($cart, 'meta.wants_invoice')
+            && (blank($cart->billingAddress?->company_name) || blank($cart->billingAddress?->tax_identifier))) {
+            return response()->json([
+                'status' => 'invalid',
+                'message' => __('checkout.page.invoice_required'),
+            ], 422);
+        }
+
+        // Same check Lunar's own ValidateCartForOrderCreation runs inside
+        // initiatePayment() (a product unpublished/deleted after it was
+        // added to the cart) — checked here first so the shopper is told
+        // which product is the problem, rather than falling into the
+        // catch-all "complete your billing/shipping details" message below,
+        // which is what actually happened and is generic to every
+        // CartException reason, misleading when the real cause is a line,
+        // not an address.
+        $unavailableLines = $this->cart->activeLines($cart)->filter(
+            fn ($line) => ! $line->purchasable || ! $line->purchasable->isPurchasable(),
+        );
+
+        if ($unavailableLines->isNotEmpty()) {
+            $names = $unavailableLines
+                ->map(fn ($line) => $line->purchasable?->product?->translateAttribute('name') ?? $line->purchasable?->getIdentifier())
+                ->filter()
+                ->implode(', ');
+
+            return response()->json([
+                'status' => 'invalid',
+                'message' => __('checkout.page.cart_line_unavailable', ['name' => $names]),
+            ], 422);
+        }
+
         // The one incomplete-cart case worth a specific message + pointing the
         // shopper at the right section: a region resolving 2+ methods needs an
         // explicit pick (no auto-select), easy to miss since nothing else on
@@ -312,13 +421,20 @@ public function placeOrder(string $locale, Request $request): JsonResponse
             return response()->json(['error' => __('checkout.page.terms_required')], 422);
         }
 
-        return match ($result->status) {
-            PaymentResultStatus::Succeeded => $this->orderPlacedResponse($locale),
-            PaymentResultStatus::Pending => response()->json([
+        // Pending with no continuation (cash-on-delivery, or any other
+        // deferred/offline method) means CheckoutService::initiatePayment()
+        // already created the placed order — money just hasn't changed
+        // hands yet. Only a Pending WITH a continuation (Stripe's client
+        // secret) means the shopper still has something to do before the
+        // order exists as far as the storefront is concerned.
+        return match (true) {
+            $result->status === PaymentResultStatus::Succeeded => $this->orderPlacedResponse($locale),
+            $result->status === PaymentResultStatus::Pending && $result->continuation === null => $this->orderPlacedResponse($locale),
+            $result->status === PaymentResultStatus::Pending => response()->json([
                 'status' => 'pending',
                 'clientSecret' => $result->continuation?->value,
             ]),
-            PaymentResultStatus::Failed => response()->json([
+            default => response()->json([
                 'status' => 'failed',
                 'message' => $result->failureReason ?: __('checkout.page.payment_failed'),
                 'retriable' => $result->retriable,
@@ -350,14 +466,24 @@ public function confirmation(string $locale): View|RedirectResponse
         $orderId = session('checkout.order_id');
 
         $order = $orderId
-            ? Order::with(['lines', 'shippingAddress', 'billingAddress'])->find($orderId)
+            ? Order::with(['lines.purchasable.product', 'shippingAddress', 'billingAddress'])->find($orderId)
             : null;
 
         if (! $order) {
             return redirect()->route('products', $locale);
         }
 
-        return view('checkout::confirmation', ['order' => $order]);
+        // Looked up by type rather than a stored relation — the method may since
+        // have been disabled/deleted, but the order still needs to show what was
+        // actually used at the time.
+        $paymentMethodName = PaymentMethod::where('type', $order->meta['payment_method'] ?? null)
+            ->first()
+            ?->translate('name');
+
+        return view('checkout::confirmation', [
+            'order' => $order,
+            'paymentMethodName' => $paymentMethodName,
+        ]);
     }
 
     private function orderPlacedResponse(string $locale): JsonResponse
@@ -373,8 +499,13 @@ private function orderPlacedResponse(string $locale): JsonResponse
 
     private function placedOrder(): ?Order
     {
-        return $this->cart->current()
-            ?->orders()
+        $cartId = session('checkout.cart_id');
+
+        if ($cartId === null) {
+            return null;
+        }
+
+        return Order::where('cart_id', $cartId)
             ->whereNotNull('placed_at')
             ->latest('placed_at')
             ->first();
@@ -447,6 +578,93 @@ private function fragments(?Cart $cart, ?Collection $options, array $errors = []
         ]);
     }
 
+    /**
+     * Logged-in shopper: fills any BLANK cart address field from the account
+     * (name, saved default address, phone, email), on every checkout load, so
+     * an account filled in after checkout started still shows up. Never
+     * overwrites anything already in the cart.
+     *
+     * Company/ΑΦΜ (and ticking "I want an invoice") only on the first pass
+     * (meta.account_prefilled): someone who then clears them or unticks the
+     * box for this order shouldn't get them back on the next reload.
+     *
+     * Writes only when something actually changes, so a normal reload costs
+     * nothing extra.
+     */
+    private function prefillFromAccount(Cart $cart): Cart
+    {
+        $user = Auth::user();
+        $customer = $this->account->customer($user);
+        $addresses = collect($this->account->addresses($user));
+        $saved = $addresses->firstWhere('shipping_default', true) ?? $addresses->first();
+        $firstPass = ! data_get($cart, 'meta.account_prefilled');
+
+        $fromAccount = array_filter([
+            'first_name' => $customer?->first_name ?: $saved?->first_name,
+            'last_name' => $customer?->last_name ?: $saved?->last_name,
+            'line_one' => $saved?->line_one,
+            'city' => $saved?->city,
+            'state' => $saved?->state,
+            'postcode' => $saved?->postcode,
+            'country_id' => $this->storeCountry()?->id ?? $saved?->country_id,
+            'contact_email' => $user->email,
+            'contact_phone' => $saved?->contact_phone,
+        ], 'filled');
+
+        $invoice = $firstPass
+            ? array_filter([
+                'company_name' => $customer?->company_name,
+                'tax_identifier' => $customer?->tax_identifier,
+            ], 'filled')
+            : [];
+
+        $fields = ['first_name', 'last_name', 'company_name', 'tax_identifier', 'line_one', 'city',
+            'state', 'postcode', 'country_id', 'contact_email', 'contact_phone'];
+
+        $fillBlanks = function (?array $current, array $values) {
+            $current ??= [];
+
+            foreach ($values as $key => $value) {
+                if (blank($current[$key] ?? null)) {
+                    $current[$key] = $value;
+                }
+            }
+
+            return $current;
+        };
+
+        $billingBefore = $cart->billingAddress?->only($fields);
+        $billing = $fillBlanks($billingBefore, [...$fromAccount, ...$invoice]);
+
+        // Shipping has no company/ΑΦΜ (same shape saveAddress() writes).
+        $shipToBilling = (bool) data_get($cart, 'meta.ship_to_billing', true);
+        $shippingFields = [...array_diff($fields, ['company_name', 'tax_identifier']), 'delivery_instructions'];
+
+        $shippingBefore = $cart->shippingAddress?->only($shippingFields);
+        $shipping = $shipToBilling
+            ? [
+                ...array_diff_key($billing, ['company_name' => 1, 'tax_identifier' => 1]),
+                'delivery_instructions' => $shippingBefore['delivery_instructions'] ?? null,
+            ]
+            : $fillBlanks($shippingBefore, $fromAccount);
+
+        if ($billing != ($billingBefore ?? []) || $shipping != ($shippingBefore ?? [])) {
+            $this->checkout->setBillingAddress($billing);
+            $cart = $this->checkout->setShippingAddress($shipping);
+        }
+
+        if ($firstPass) {
+            $cart->meta = [
+                ...($cart->meta?->toArray() ?? []),
+                'account_prefilled' => true,
+                'wants_invoice' => (bool) data_get($cart, 'meta.wants_invoice') || $invoice !== [],
+            ];
+            $cart->save();
+        }
+
+        return $cart;
+    }
+
     private function storeCountry(): ?Country
     {
         if (self::STORE_COUNTRY_ISO3 === null) {

app/Http/Controllers/ContactController.php

@@ -2,10 +2,71 @@
 
 namespace App\Http\Controllers;
 
+use App\Http\Requests\ContactRequest;
+use App\Mail\ContactConfirmationMail;
+use App\Mail\ContactMessageMail;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\View\View;
+use Throwable;
+
+/**
+ * Contact form. Nothing is stored: the message is emailed to the store
+ * (CONTACT_EMAIL) and the sender gets a generic confirmation. Both are sent
+ * synchronously so a failed store email can be reported back on the form.
+ *
+ * Limited per IP in here rather than with throttle middleware, so the limit
+ * shows as a message on the form instead of a bare 429 page.
+ */
 class ContactController extends Controller
 {
-    public function index(string $locale)
+    private const SEND_LIMIT = 3;
+    private const SEND_DECAY_SECONDS = 600;
+
+    public function index(string $locale): View
     {
         return view('contact');
     }
+
+    public function send(string $locale, ContactRequest $request): RedirectResponse
+    {
+        $key = 'contact:'.$request->ip();
+
+        if (RateLimiter::tooManyAttempts($key, self::SEND_LIMIT)) {
+            return back()->withInput()->with('contact_error', __('storefront.contact.too_many'));
+        }
+
+        RateLimiter::hit($key, self::SEND_DECAY_SECONDS);
+
+        $data = $request->validated();
+        $to = config('services.contact.email');
+
+        try {
+            if (blank($to)) {
+                throw new \RuntimeException('CONTACT_EMAIL is not set.');
+            }
+
+            Mail::to($to)->send(new ContactMessageMail(
+                $data['name'],
+                $data['email'],
+                $data['message'],
+                $locale,
+            ));
+        } catch (Throwable $e) {
+            Log::error('Contact form: store email failed', ['exception' => $e]);
+
+            return back()->withInput()->with('contact_error', __('storefront.contact.send_failed'));
+        }
+
+        // The store already has the message, so a failed confirmation is only logged.
+        try {
+            Mail::to($data['email'])->locale($locale)->send(new ContactConfirmationMail);
+        } catch (Throwable $e) {
+            Log::warning('Contact form: confirmation email failed', ['exception' => $e]);
+        }
+
+        return redirect()->route('contact')->with('status', __('storefront.contact.sent'));
+    }
 }

app/Http/Controllers/CustomFieldUploadController.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Modules\Core\File\Http\Controllers\UploadFileController;
+
+/**
+ * Stores the shopper's photo for a product custom field of type `file` (see
+ * boboko-core's Product::$custom_fields) the moment it's picked on the product
+ * page — before add-to-cart, see custom-field-upload-controller.js.
+ *
+ * Which files are acceptable (extensions, size) is a per-site decision — this
+ * site: photographs — so it lives here as this app's own policy, extending
+ * boboko-core's Modules\Core\File\Http\Controllers\UploadFileController for
+ * the actual store()/validate()/respond() mechanics. The module's add-to-cart
+ * endpoint only ever receives the stored File row's own `id` — FileService is
+ * the single source of truth for disk/path/name/mime, never duplicated into
+ * cart/order line meta (see Checkout\CartController::customFieldsMeta()). A
+ * shopper can't point a cart line at someone else's file: CartController only
+ * accepts an id that is both unowned and tagged with this exact PURPOSE.
+ *
+ * Stored on the private `local` disk: these are customers' personal photos,
+ * never reachable by a public URL except through FileService's own signed
+ * download route. Uploads nobody adds to a cart are removed by core's
+ * `boboko:file:prune-unowned custom-field-upload` command.
+ */
+class CustomFieldUploadController extends UploadFileController
+{
+    public const PURPOSE = 'custom-field-upload';
+
+    public const MAX_KILOBYTES = 10240;
+
+    public const EXTENSIONS = ['jpg', 'jpeg', 'png', 'webp', 'heic', 'heif'];
+
+    /**
+     * For the file input's `accept` attribute — same list the server enforces.
+     */
+    public static function accept(): string
+    {
+        return '.'.implode(',.', self::EXTENSIONS);
+    }
+
+    protected function purpose(): string
+    {
+        return self::PURPOSE;
+    }
+
+    protected function validationRules(Request $request): array
+    {
+        return [
+            'file' => ['required', 'file', 'mimes:'.implode(',', self::EXTENSIONS), 'max:'.self::MAX_KILOBYTES],
+        ];
+    }
+
+    // `label` is the admin-authored field label, only used as the
+    // :attribute in the validation message shown next to that field.
+    protected function validationAttributes(Request $request): array
+    {
+        return ['file' => (string) $request->input('label', 'file')];
+    }
+}

app/Http/Controllers/ProductController.php

@@ -4,8 +4,15 @@
 
 use App\Catalog\ProductListing;
 use App\Catalog\ProductListingPage;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Validator;
+use Lunar\Models\Product;
+use Lunar\Models\ProductVariant;
 use Modules\Core\Catalog\Services\ProductService;
+use Modules\Core\Review\Models\ProductReview;
 
 class ProductController extends Controller
 {
@@ -35,18 +42,205 @@ public function show(string $locale, int $id)
         $product = $this->products->getById($id);
         abort_if($product === null, Response::HTTP_NOT_FOUND);
 
+        $product = $this->mergeJustSubmittedReview($product);
+
         $collection = $product['collections'][0] ?? null;
-
-        $variantsData = $this->products->variantSummaries($product);
-
-        $firstVariant = $product['variants'][0] ?? null;
-        $option = $firstVariant['options'][0]['option'] ?? null;
+        // dd($product);
+        [$productOptions, $variantsData] = $this->buildOptionPicker($id);
 
         return view('product.show', [
             'collection' => $collection,
             'product' => $product,
-            'option' => $option,
+            'productOptions' => $productOptions,
             'variantsData' => $variantsData,
         ]);
     }
+
+    /**
+     * One button/swatch group per product option (a product can have several
+     * — e.g. a custom-photo product with size + style + person-count, each
+     * combination resolved client-side to one exact ProductVariant, see
+     * product-form-controller.js) plus the per-variant data the picker
+     * resolves a selection against.
+     *
+     * Reads live Eloquent rather than the Meilisearch-indexed $product array
+     * the rest of the page uses (same reasoning as checkStock() below): the
+     * index has no concept of option/value display order (Lunar's
+     * `position` column) or a stable value id, both of which the picker
+     * needs — to render values in the merchant's intended order, and to
+     * match a combination back to one exact variant without relying on
+     * translated label strings staying unique.
+     *
+     * @return array{0: array, 1: array}
+     */
+    private function buildOptionPicker(int $productId): array
+    {
+        $variants = ProductVariant::query()
+            ->where('product_id', $productId)
+            ->with(['values.option', 'prices', 'images'])
+            ->get();
+
+        $productOptions = $variants
+            ->flatMap(fn (ProductVariant $variant) => $variant->values)
+            ->unique('id')
+            ->groupBy(fn ($value) => $value->option->handle)
+            ->map(function ($values, $handle) {
+                $sorted = $values->sortBy([['position', 'asc'], ['id', 'asc']]);
+
+                return [
+                    'handle' => $handle,
+                    'label' => $sorted->first()->option->translate('name'),
+                    // The "Color" option type is the only one that writes a
+                    // hex code into meta (see boboko/core's ColorOptionType)
+                    // — its presence is how we tell a color option (swatches)
+                    // from any other option (buttons).
+                    'isColor' => $sorted->contains(fn ($v) => !empty($v->meta['hex'] ?? null)),
+                    'values' => $sorted->map(fn ($v) => [
+                        'id' => $v->id,
+                        'label' => $v->translate('name'),
+                        'hex' => $v->meta['hex'] ?? null,
+                    ])->values()->all(),
+                ];
+            })
+            ->values()
+            ->all();
+
+        $variantsData = $variants->map(fn (ProductVariant $variant) => [
+            'id' => $variant->id,
+            'price' => $variant->prices->first()?->price?->decimal(),
+            'image' => $variant->images->first()?->getUrl(),
+            // handle => selected value id, for matching a combination of
+            // selections back to this variant — see selectVariant() in
+            // product-form-controller.js.
+            'options' => $variant->values->mapWithKeys(fn ($v) => [$v->option->handle => $v->id])->all(),
+        ])->values()->all();
+
+        return [$productOptions, $variantsData];
+    }
+
+    /**
+     * Meilisearch's own write API is itself async — addDocuments() enqueues an
+     * indexing task and returns immediately, and Laravel\Scout\Engines\
+     * MeilisearchEngine::update() never waits on that task, so even
+     * $product->searchableSync() (which only skips OUR queue) can still land
+     * the shopper back on this page before Meilisearch has actually processed
+     * the write. storeReview() flashes the review it just created for exactly
+     * this one next request; splice it in here rather than trust the index is
+     * already caught up. Guarded by id so a race the other way — the index
+     * DID catch up in time — doesn't show the same review twice.
+     */
+    private function mergeJustSubmittedReview(array $product): array
+    {
+        $justSubmitted = session('justSubmittedReview');
+
+        if (! $justSubmitted || (string) ($justSubmitted['product_id'] ?? null) !== (string) $product['id']) {
+            return $product;
+        }
+
+        $items = $product['reviews']['items'] ?? [];
+
+        if (collect($items)->contains('id', $justSubmitted['id'])) {
+            return $product;
+        }
+
+        $items = [$justSubmitted, ...$items];
+
+        $product['reviews']['items'] = $items;
+        $product['reviews']['count'] = count($items);
+        $product['reviews']['average_rating'] = round(collect($items)->avg('rating'), 1);
+
+        return $product;
+    }
+
+    /**
+     * A storefront-owned, checkout-module-independent stock check — the
+     * product page's "Add to cart" calls this first and only submits to the
+     * checkout module's own add-to-cart endpoint once this says `ok`. Reads
+     * the live Eloquent ProductVariant directly (not the Meilisearch index
+     * ProductService otherwise reads from, which can lag behind an actual
+     * sale until the next reindex) via the SAME method Lunar's own
+     * CartLineStock validator calls, so this can never disagree with what
+     * the module's own server-side check would decide.
+     */
+    public function checkStock(string $locale, Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'variant' => ['required', 'integer'],
+            'quantity' => ['nullable', 'integer', 'min:1'],
+        ]);
+
+        $variant = ProductVariant::find($data['variant']);
+        $quantity = $data['quantity'] ?? 1;
+
+        if ($variant === null) {
+            return response()->json(['ok' => true]);
+        }
+
+        return response()->json([
+            'ok' => $variant->canBeFulfilledAtQuantity($quantity),
+            'stock' => $variant->purchasable === 'always' ? null : $variant->getTotalInventory(),
+        ]);
+    }
+
+    /**
+     * boboko/core's product_reviews table has no moderation/status column, so
+     * this goes live immediately — no approval queue to land in.
+     */
+    public function storeReview(string $locale, Request $request, Product $product): RedirectResponse
+    {
+        $reviewsUrl = route('product.show', [
+            'locale' => $locale,
+            'id' => $product->id,
+            'tab' => 'reviews',
+        ]).'#product-tabs';
+
+        $validator = Validator::make($request->all(), [
+            'rating' => ['required', 'integer', 'between:1,5'],
+            'content' => ['required', 'string'],
+            'name' => ['nullable', 'string', 'max:255'],
+            'email' => ['required', 'email'],
+        ]);
+
+        if ($validator->fails()) {
+            return redirect($reviewsUrl)->withErrors($validator)->withInput();
+        }
+
+        $data = $validator->validated();
+
+        // Not $product->reviews()->create(...): that relation only exists via a
+        // Product::macro() registered in CorePlugin::register(Panel $panel), which
+        // Filament calls solely when the /boboko admin panel boots — never on a
+        // plain storefront request, where the macro is simply undefined.
+        $review = ProductReview::create([
+            'product_id' => $product->id,
+            'rating' => $data['rating'],
+            'body' => $data['content'],
+            'reviewer_name' => $data['name'] ?? null,
+            'reviewer_email' => $data['email'],
+            'reviewed_at' => now(),
+            'source' => 'storefront',
+        ]);
+
+        // ReviewServiceProvider also reindexes on the model's `created` event, but
+        // queued (SCOUT_QUEUE=true) — it wouldn't land before this redirect's page
+        // load. Syncing here skips our queue too, but Meilisearch's own write API
+        // is itself async on top of that (see mergeJustSubmittedReview()), so this
+        // alone still isn't a guarantee — it's the flash below that actually is.
+        $product->searchableSync();
+
+        return redirect($reviewsUrl)
+            ->with('reviewSubmitted', true)
+            ->with('justSubmittedReview', [
+                'id' => $review->id,
+                'product_id' => $review->product_id,
+                'title' => $review->title,
+                'body' => $review->body,
+                'rating' => $review->rating,
+                'reviewed_at' => $review->reviewed_at?->timestamp,
+                'reviewer_name' => $review->reviewer_name,
+                'reply' => null,
+                'replied_at' => null,
+                'media' => [],
+            ]);
+    }
 }

app/Http/Controllers/WishlistController.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Catalog\ProductCard;
+use App\Services\Wishlist;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+use Illuminate\View\View;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Services\ProductService;
+
+class WishlistController extends Controller
+{
+    public function __construct(
+        private readonly Wishlist $wishlist,
+    ) {}
+
+    /**
+     * The account's wishlist page.
+     */
+    public function index(string $locale, ProductService $products): View
+    {
+        return view('account.wishlist', ['products' => $this->products($products)]);
+    }
+
+    /**
+     * The same list for a guest, from their cookie. Logged-in users are sent
+     * to the account version.
+     */
+    public function guest(string $locale, ProductService $products): View|RedirectResponse
+    {
+        if (auth()->check()) {
+            return redirect()->route('account.wishlist');
+        }
+
+        return view('wishlist.guest', ['products' => $this->products($products)]);
+    }
+
+    /**
+     * Adds or removes a product, for guests and logged-in shoppers alike. The
+     * heart button's Stimulus controller asks for JSON; without JS the form
+     * posts normally and comes back to the same page.
+     */
+    public function toggle(string $locale, Request $request, int $productId): JsonResponse|RedirectResponse
+    {
+        abort_unless(Product::whereKey($productId)->exists(), 404);
+
+        $active = $this->wishlist->toggle($productId);
+
+        if ($request->expectsJson()) {
+            return response()->json(['active' => $active]);
+        }
+
+        return back();
+    }
+
+    /**
+     * Product cards for the current wishlist, newest first. Products no longer
+     * in the search index (deleted, unpublished) are simply skipped.
+     */
+    private function products(ProductService $products): Collection
+    {
+        return collect($this->wishlist->ids())
+            ->map(fn (int $id) => $products->getById($id))
+            ->filter()
+            ->map(fn (array $product) => ['id' => $product['id'], ...ProductCard::fromIndexed($product)])
+            ->values();
+    }
+}

app/Http/Requests/ContactRequest.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ContactRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'email' => ['required', 'email', 'max:255'],
+            'message' => ['required', 'string', 'max:5000'],
+        ];
+    }
+}

app/Listeners/MergeGuestWishlistOnLogin.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Services\Wishlist;
+use Modules\Core\Auth\Events\UserAuthenticated;
+
+/**
+ * Picked up by Laravel's listener discovery (app/Listeners), no manual
+ * registration. Runs inside the login request, so it can read the guest
+ * wishlist cookie and queue its removal.
+ */
+class MergeGuestWishlistOnLogin
+{
+    public function __construct(
+        private readonly Wishlist $wishlist,
+    ) {}
+
+    public function handle(UserAuthenticated $event): void
+    {
+        $this->wishlist->mergeGuestInto($event->user);
+    }
+}

app/Listeners/SaveAddressFromFirstOrder.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Listeners;
+
+use Lunar\Models\Order;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Customer\Services\CustomerAccountService;
+
+/**
+ * When a logged-in shopper places an order and their account has no saved
+ * address yet, the order's shipping address (and their name, if the profile
+ * has none) becomes the account's. Never overwrites anything already saved.
+ *
+ * Uses the order's own user, not Auth: OrderPlaced can fire from a payment
+ * webhook, where nobody is logged in. Picked up by listener discovery.
+ */
+class SaveAddressFromFirstOrder
+{
+    public function __construct(
+        private readonly CustomerAccountService $account,
+    ) {}
+
+    public function handle(OrderPlaced $event): void
+    {
+        $order = $event->order;
+        $user = $order->user;
+        $shipping = $order->shippingAddress;
+
+        if (! $user || ! $shipping || ! $shipping->line_one) {
+            return;
+        }
+
+        $customer = $this->account->customer($user);
+
+        if (! $customer) {
+            return;
+        }
+
+        if (! $customer->first_name && ! $customer->last_name) {
+            $this->account->updateProfile($user, [
+                'first_name' => $shipping->first_name,
+                'last_name' => $shipping->last_name,
+            ]);
+        }
+
+        if (collect($this->account->addresses($user))->isNotEmpty()) {
+            return;
+        }
+
+        $this->account->createAddress($user, [
+            ...$shipping->only(['first_name', 'last_name', 'line_one', 'city', 'state', 'postcode', 'country_id', 'contact_phone']),
+            'contact_email' => $user->email,
+            'shipping_default' => true,
+            'billing_default' => true,
+        ]);
+    }
+}

app/Mail/ContactConfirmationMail.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * Sent to whoever submitted the contact form. Deliberately generic: it never
+ * repeats what they wrote, so the form can't be used to deliver arbitrary text
+ * to someone else's inbox.
+ */
+class ContactConfirmationMail extends Mailable
+{
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: __('storefront.contact.confirmation_subject'));
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'emails.contact-confirmation');
+    }
+}

app/Mail/ContactMessageMail.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Address;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * A contact-form message, sent to the store's CONTACT_EMAIL. Reply-To is the
+ * sender, so replying from the inbox goes straight to them.
+ */
+class ContactMessageMail extends Mailable
+{
+    public function __construct(
+        public readonly string $senderName,
+        public readonly string $senderEmail,
+        public readonly string $body,
+        public readonly string $senderLocale,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            replyTo: [new Address($this->senderEmail, $this->senderName)],
+            subject: "Νέο μήνυμα επικοινωνίας από {$this->senderName}",
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'emails.contact-message');
+    }
+}

app/Models/WishlistItem.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * One product on a logged-in user's wishlist. Guests' wishlists live in a
+ * cookie instead — see App\Services\Wishlist.
+ */
+class WishlistItem extends Model
+{
+    protected $fillable = ['user_id', 'product_id'];
+}

app/Providers/AppServiceProvider.php

@@ -17,6 +17,13 @@
 
 class AppServiceProvider extends ServiceProvider
 {
+    public function register(): void
+    {
+        // One instance per request: it caches the guest cookie's ids, so a
+        // toggle and a later has() in the same request agree.
+        $this->app->scoped(\App\Services\Wishlist::class);
+    }
+
     public function boot(): void
     {
         Telemetry::optOut();

app/Services/Wishlist.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\WishlistItem;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cookie;
+
+/**
+ * The current shopper's wishlist, product ids only.
+ *
+ * Logged in: rows in wishlist_items. Guest: a 1-year cookie holding the ids
+ * (encrypted like every cookie, by the web group's EncryptCookies), so nothing
+ * is written to the database for anonymous visitors. On login the cookie is
+ * merged into the account and cleared (MergeGuestWishlistOnLogin).
+ */
+class Wishlist
+{
+    public const COOKIE = 'wishlist';
+
+    private const COOKIE_MINUTES = 60 * 24 * 365;
+
+    // Keeps the cookie well under the 4KB browser limit.
+    private const GUEST_MAX = 100;
+
+    /** @var array<int>|null ids for this request, including a toggle just made */
+    private ?array $guestIds = null;
+
+    /** @return array<int> newest first */
+    public function ids(): array
+    {
+        if ($user = Auth::user()) {
+            return WishlistItem::where('user_id', $user->id)
+                ->latest('id')
+                ->pluck('product_id')
+                ->all();
+        }
+
+        return $this->guestIds();
+    }
+
+    public function has(int $productId): bool
+    {
+        return in_array($productId, $this->ids(), true);
+    }
+
+    /**
+     * @return bool whether the product is on the wishlist afterwards
+     */
+    public function toggle(int $productId): bool
+    {
+        if ($user = Auth::user()) {
+            $deleted = WishlistItem::where('user_id', $user->id)->where('product_id', $productId)->delete();
+
+            if ($deleted) {
+                return false;
+            }
+
+            WishlistItem::create(['user_id' => $user->id, 'product_id' => $productId]);
+
+            return true;
+        }
+
+        $ids = $this->guestIds();
+
+        if (in_array($productId, $ids, true)) {
+            $this->storeGuestIds(array_values(array_diff($ids, [$productId])));
+
+            return false;
+        }
+
+        $this->storeGuestIds(array_slice([$productId, ...$ids], 0, self::GUEST_MAX));
+
+        return true;
+    }
+
+    public function remove(int $productId): void
+    {
+        if ($this->has($productId)) {
+            $this->toggle($productId);
+        }
+    }
+
+    /**
+     * Moves the guest cookie's products onto $user's wishlist and clears it.
+     */
+    public function mergeGuestInto(Authenticatable $user): void
+    {
+        $ids = $this->guestIds();
+
+        if ($ids === []) {
+            return;
+        }
+
+        // Oldest first, so the newest cookie item also ends up newest here.
+        foreach (array_reverse($ids) as $productId) {
+            WishlistItem::firstOrCreate(['user_id' => $user->id, 'product_id' => $productId]);
+        }
+
+        $this->guestIds = [];
+        Cookie::queue(Cookie::forget(self::COOKIE));
+    }
+
+    /** @return array<int> */
+    private function guestIds(): array
+    {
+        if ($this->guestIds !== null) {
+            return $this->guestIds;
+        }
+
+        $decoded = json_decode((string) request()->cookie(self::COOKIE), true);
+
+        return $this->guestIds = is_array($decoded)
+            ? array_values(array_unique(array_filter(array_map('intval', $decoded))))
+            : [];
+    }
+
+    /** @param  array<int>  $ids */
+    private function storeGuestIds(array $ids): void
+    {
+        $this->guestIds = $ids;
+
+        Cookie::queue(self::COOKIE, json_encode($ids), self::COOKIE_MINUTES);
+    }
+}

bootstrap/app.php

@@ -11,7 +11,18 @@
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        // Laravel's priority list would otherwise run `auth` before core's
+        // `locale` middleware, so the redirects below would build URLs before
+        // URL::defaults(['locale' => …]) is set, throwing a missing-parameter error.
+        $middleware->prependToPriorityList(
+            before: \Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests::class,
+            prepend: \Modules\Core\Localization\Middleware\LocaleMiddleware::class,
+        );
+
+        // Both resolve inside the {locale} group, after the `locale` middleware
+        // has set URL::defaults(['locale' => …]), so route() needs no locale arg.
+        $middleware->redirectGuestsTo(fn () => route('login'));
+        $middleware->redirectUsersTo(fn () => route('home'));
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //

composer.lock

@@ -515,11 +515,11 @@
         },
         {
             "name": "boboko/core",
-            "version": "0.17.1",
+            "version": "0.20.0",
             "source": {
                 "type": "git",
                 "url": "https://code.radical-elements.com/boboko/core.git",
-                "reference": "d9fb3bbde661bc8f49b3032462af029c5983b03a"
+                "reference": "c7035d678275a6c7aae6eb2a2ee1b12569da1a3d"
             },
             "require": {
                 "laravel/framework": "^12.0",
@@ -527,10 +527,10 @@
                 "lunarphp/lunar": "1.5.0",
                 "lunarphp/meilisearch": "*",
                 "lunarphp/search": "*",
-                "lunarphp/stripe": "^1.5",
                 "lunarphp/table-rate-shipping": "1.5.0",
                 "php": "^8.5",
                 "spatie/laravel-translation-loader": "^2.8",
+                "stripe/stripe-php": "^16.6",
                 "symfony/yaml": "^7.0"
             },
             "require-dev": {
@@ -558,7 +558,8 @@
                         "Modules\\Core\\Providers\\CartServiceProvider",
                         "Modules\\Core\\Providers\\ReviewServiceProvider",
                         "Modules\\Core\\Providers\\ShippingServiceProvider",
-                        "Modules\\Core\\Providers\\OrderServiceProvider"
+                        "Modules\\Core\\Providers\\OrderServiceProvider",
+                        "Modules\\Core\\Providers\\PrivacyServiceProvider"
                     ]
                 }
             },
@@ -568,7 +569,7 @@
                 }
             },
             "description": "Core module — authentication and shared panel behaviour",
-            "time": "2026-09-15T13:12:03+00:00"
+            "time": "2026-09-23T06:47:28+00:00"
         },
         {
             "name": "brick/math",
@@ -934,16 +935,16 @@
         },
         {
             "name": "composer/semver",
-            "version": "3.4.4",
+            "version": "3.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/composer/semver.git",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95"
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/composer/semver/zipball/198166618906cb2de69b95d7d47e5fa8aa1b2b95",
-                "reference": "198166618906cb2de69b95d7d47e5fa8aa1b2b95",
+                "url": "https://api.github.com/repos/composer/semver/zipball/f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
+                "reference": "f7a296f4c4cf8cb8bb83e35d6951a406bb11afa5",
                 "shasum": ""
             },
             "require": {
@@ -985,7 +986,7 @@
                     "homepage": "http://robbast.nl"
                 }
             ],
-            "description": "Semver library that offers utilities, version constraint parsing and validation.",
+            "description": "Version comparison library that offers utilities, version constraint parsing and validation.",
             "keywords": [
                 "semantic",
                 "semver",
@@ -995,7 +996,7 @@
             "support": {
                 "irc": "ircs://irc.libera.chat:6697/composer",
                 "issues": "https://github.com/composer/semver/issues",
-                "source": "https://github.com/composer/semver/tree/3.4.4"
+                "source": "https://github.com/composer/semver/tree/3.5.0"
             },
             "funding": [
                 {
@@ -1007,7 +1008,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2025-08-20T19:15:30+00:00"
+            "time": "2026-09-24T14:38:51+00:00"
         },
         {
             "name": "danharrin/date-format-converter",
@@ -1062,16 +1063,16 @@
         },
         {
             "name": "danharrin/livewire-rate-limiting",
-            "version": "v2.2.1",
+            "version": "v2.3.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/danharrin/livewire-rate-limiting.git",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5"
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/69436717dc70e30f80d7f8fd02504c22992a9ad5",
-                "reference": "69436717dc70e30f80d7f8fd02504c22992a9ad5",
+                "url": "https://api.github.com/repos/danharrin/livewire-rate-limiting/zipball/46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
+                "reference": "46c4ceaf7997c713c79afe7c507a39649f6c9d6f",
                 "shasum": ""
             },
             "require": {
@@ -1112,7 +1113,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-06T08:41:51+00:00"
+            "time": "2026-09-18T07:38:01+00:00"
         },
         {
             "name": "dflydev/dot-access-data",
@@ -1329,27 +1330,25 @@
         },
         {
             "name": "doctrine/lexer",
-            "version": "3.0.1",
+            "version": "3.0.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/doctrine/lexer.git",
-                "reference": "31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd"
+                "reference": "e96fe45e92a54233726014a7cc7340abf29bb14c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/doctrine/lexer/zipball/31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd",
-                "reference": "31ad66abc0fc9e1a1f2d9bc6a42668d2fbbcd6dd",
+                "url": "https://api.github.com/repos/doctrine/lexer/zipball/e96fe45e92a54233726014a7cc7340abf29bb14c",
+                "reference": "e96fe45e92a54233726014a7cc7340abf29bb14c",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.1"
             },
             "require-dev": {
-                "doctrine/coding-standard": "^12",
-                "phpstan/phpstan": "^1.10",
-                "phpunit/phpunit": "^10.5",
-                "psalm/plugin-phpunit": "^0.18.3",
-                "vimeo/psalm": "^5.21"
+                "doctrine/coding-standard": "^14",
+                "phpstan/phpstan": "^2",
+                "phpunit/phpunit": "^10.5.58 || ^12.5.4"
             },
             "type": "library",
             "autoload": {
@@ -1386,7 +1385,7 @@
             ],
             "support": {
                 "issues": "https://github.com/doctrine/lexer/issues",
-                "source": "https://github.com/doctrine/lexer/tree/3.0.1"
+                "source": "https://github.com/doctrine/lexer/tree/3.0.2"
             },
             "funding": [
                 {
@@ -1402,7 +1401,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-02-05T11:56:58+00:00"
+            "time": "2026-06-14T20:44:06+00:00"
         },
         {
             "name": "dompdf/dompdf",
@@ -1692,16 +1691,16 @@
         },
         {
             "name": "filament/actions",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/actions.git",
-                "reference": "ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce"
+                "reference": "1eb39ac07f06302262cf6f5d77927bff1ed626fb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/actions/zipball/ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce",
-                "reference": "ca6b6e7fb2f8b3aee5540155474af3ac7f3e47ce",
+                "url": "https://api.github.com/repos/filamentphp/actions/zipball/1eb39ac07f06302262cf6f5d77927bff1ed626fb",
+                "reference": "1eb39ac07f06302262cf6f5d77927bff1ed626fb",
                 "shasum": ""
             },
             "require": {
@@ -1737,20 +1736,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:28+00:00"
+            "time": "2026-09-15T16:56:16+00:00"
         },
         {
             "name": "filament/filament",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/panels.git",
-                "reference": "8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a"
+                "reference": "1215d7d79b5609f66c1e432933610eefa0ab3ad6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/panels/zipball/8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a",
-                "reference": "8c1adf1b10d43cc17cd34deb4d6f7c42f0bb776a",
+                "url": "https://api.github.com/repos/filamentphp/panels/zipball/1215d7d79b5609f66c1e432933610eefa0ab3ad6",
+                "reference": "1215d7d79b5609f66c1e432933610eefa0ab3ad6",
                 "shasum": ""
             },
             "require": {
@@ -1795,20 +1794,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:21:27+00:00"
+            "time": "2026-09-20T19:15:07+00:00"
         },
         {
             "name": "filament/forms",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/forms.git",
-                "reference": "4da33a7be66aa238158816e439fa591aac0ac239"
+                "reference": "10d7ba430544ae706a406713105ba37b18f52008"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/forms/zipball/4da33a7be66aa238158816e439fa591aac0ac239",
-                "reference": "4da33a7be66aa238158816e439fa591aac0ac239",
+                "url": "https://api.github.com/repos/filamentphp/forms/zipball/10d7ba430544ae706a406713105ba37b18f52008",
+                "reference": "10d7ba430544ae706a406713105ba37b18f52008",
                 "shasum": ""
             },
             "require": {
@@ -1845,20 +1844,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:18:49+00:00"
+            "time": "2026-09-20T18:45:30+00:00"
         },
         {
             "name": "filament/infolists",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/infolists.git",
-                "reference": "638b0b37ce492594567e5819f99e2b0f43b3a69b"
+                "reference": "1979591422ff823543622b87e0276cdca3f863e8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/infolists/zipball/638b0b37ce492594567e5819f99e2b0f43b3a69b",
-                "reference": "638b0b37ce492594567e5819f99e2b0f43b3a69b",
+                "url": "https://api.github.com/repos/filamentphp/infolists/zipball/1979591422ff823543622b87e0276cdca3f863e8",
+                "reference": "1979591422ff823543622b87e0276cdca3f863e8",
                 "shasum": ""
             },
             "require": {
@@ -1890,20 +1889,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:32+00:00"
+            "time": "2026-09-20T18:45:56+00:00"
         },
         {
             "name": "filament/notifications",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/notifications.git",
-                "reference": "6279e7d1353b370cd4fa2dadaa245227c47add21"
+                "reference": "40989f93ec3dc36f5582024ca41f99333a4c0ea7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/notifications/zipball/6279e7d1353b370cd4fa2dadaa245227c47add21",
-                "reference": "6279e7d1353b370cd4fa2dadaa245227c47add21",
+                "url": "https://api.github.com/repos/filamentphp/notifications/zipball/40989f93ec3dc36f5582024ca41f99333a4c0ea7",
+                "reference": "40989f93ec3dc36f5582024ca41f99333a4c0ea7",
                 "shasum": ""
             },
             "require": {
@@ -1937,20 +1936,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:35:57+00:00"
+            "time": "2026-09-20T18:48:58+00:00"
         },
         {
             "name": "filament/query-builder",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/query-builder.git",
-                "reference": "d5c5c94cbede3a3d56855e5de173c0a35da2328e"
+                "reference": "0428645f4cd0a232b6bc446437cbfafa366e56c0"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/query-builder/zipball/d5c5c94cbede3a3d56855e5de173c0a35da2328e",
-                "reference": "d5c5c94cbede3a3d56855e5de173c0a35da2328e",
+                "url": "https://api.github.com/repos/filamentphp/query-builder/zipball/0428645f4cd0a232b6bc446437cbfafa366e56c0",
+                "reference": "0428645f4cd0a232b6bc446437cbfafa366e56c0",
                 "shasum": ""
             },
             "require": {
@@ -1983,20 +1982,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:00+00:00"
+            "time": "2026-09-20T18:53:32+00:00"
         },
         {
             "name": "filament/schemas",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/schemas.git",
-                "reference": "fec2747e8cf1e6ca76d6c883c7f1019da994f771"
+                "reference": "dc4eeb57671b104b9e60f6d3f435f803c705e6df"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/schemas/zipball/fec2747e8cf1e6ca76d6c883c7f1019da994f771",
-                "reference": "fec2747e8cf1e6ca76d6c883c7f1019da994f771",
+                "url": "https://api.github.com/repos/filamentphp/schemas/zipball/dc4eeb57671b104b9e60f6d3f435f803c705e6df",
+                "reference": "dc4eeb57671b104b9e60f6d3f435f803c705e6df",
                 "shasum": ""
             },
             "require": {
@@ -2028,11 +2027,11 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-08T10:20:09+00:00"
+            "time": "2026-09-20T18:49:21+00:00"
         },
         {
             "name": "filament/spatie-laravel-media-library-plugin",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/spatie-laravel-media-library-plugin.git",
@@ -2069,16 +2068,16 @@
         },
         {
             "name": "filament/support",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/support.git",
-                "reference": "73fc0fda6692ac878b9cc0255dd3288577a50cb6"
+                "reference": "6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/support/zipball/73fc0fda6692ac878b9cc0255dd3288577a50cb6",
-                "reference": "73fc0fda6692ac878b9cc0255dd3288577a50cb6",
+                "url": "https://api.github.com/repos/filamentphp/support/zipball/6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc",
+                "reference": "6bd7bdb5f5ff3b1a70cac6dabe28f5d996a36bcc",
                 "shasum": ""
             },
             "require": {
@@ -2124,20 +2123,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:12+00:00"
+            "time": "2026-09-20T19:14:52+00:00"
         },
         {
             "name": "filament/tables",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/tables.git",
-                "reference": "57662d3b2098e7d156ef507842d4ae98a892212b"
+                "reference": "8a0c6634d752e0b71ed0871f92d533c0d03d7601"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/tables/zipball/57662d3b2098e7d156ef507842d4ae98a892212b",
-                "reference": "57662d3b2098e7d156ef507842d4ae98a892212b",
+                "url": "https://api.github.com/repos/filamentphp/tables/zipball/8a0c6634d752e0b71ed0871f92d533c0d03d7601",
+                "reference": "8a0c6634d752e0b71ed0871f92d533c0d03d7601",
                 "shasum": ""
             },
             "require": {
@@ -2170,20 +2169,20 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:28+00:00"
+            "time": "2026-09-20T18:53:09+00:00"
         },
         {
             "name": "filament/widgets",
-            "version": "v4.13.1",
+            "version": "v4.13.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/filamentphp/widgets.git",
-                "reference": "3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1"
+                "reference": "5ec044730102c3444d019232d8edc3d8922876c6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/filamentphp/widgets/zipball/3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1",
-                "reference": "3d5a4dde469ad9f8e6cb2d5928e4882f6a92afe1",
+                "url": "https://api.github.com/repos/filamentphp/widgets/zipball/5ec044730102c3444d019232d8edc3d8922876c6",
+                "reference": "5ec044730102c3444d019232d8edc3d8922876c6",
                 "shasum": ""
             },
             "require": {
@@ -2214,7 +2213,7 @@
                 "issues": "https://github.com/filamentphp/filament/issues",
                 "source": "https://github.com/filamentphp/filament"
             },
-            "time": "2026-09-07T18:36:33+00:00"
+            "time": "2026-09-20T18:53:38+00:00"
         },
         {
             "name": "fruitcake/php-cors",
@@ -3362,16 +3361,16 @@
         },
         {
             "name": "laravel/serializable-closure",
-            "version": "v2.0.16",
+            "version": "v2.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/serializable-closure.git",
-                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed"
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
-                "reference": "7cfc24e4fa2cca045fb8dd2a797a2b2b13b655ed",
+                "url": "https://api.github.com/repos/laravel/serializable-closure/zipball/2d5869a838bbcf37e0d8b0568fc41914e81374b5",
+                "reference": "2d5869a838bbcf37e0d8b0568fc41914e81374b5",
                 "shasum": ""
             },
             "require": {
@@ -3419,7 +3418,7 @@
                 "issues": "https://github.com/laravel/serializable-closure/issues",
                 "source": "https://github.com/laravel/serializable-closure"
             },
-            "time": "2026-08-18T20:28:54+00:00"
+            "time": "2026-09-22T14:32:34+00:00"
         },
         {
             "name": "laravel/tinker",
@@ -3492,16 +3491,16 @@
         },
         {
             "name": "league/commonmark",
-            "version": "2.10.1",
+            "version": "2.10.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "9d489ab67a02960fd8ffe624d93f751daf95439e"
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/9d489ab67a02960fd8ffe624d93f751daf95439e",
-                "reference": "9d489ab67a02960fd8ffe624d93f751daf95439e",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/6efbd9c472b91db0a3350fcd601c8332c2382e1f",
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f",
                 "shasum": ""
             },
             "require": {
@@ -3595,7 +3594,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-09-07T13:44:26+00:00"
+            "time": "2026-09-21T13:07:34+00:00"
         },
         {
             "name": "league/config",
@@ -4757,68 +4756,6 @@
             },
             "time": "2026-08-26T14:50:54+00:00"
         },
-        {
-            "name": "lunarphp/stripe",
-            "version": "1.5.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/lunarphp/stripe.git",
-                "reference": "9c091d4f8f868966605f488e8d6a94c4af07f0bb"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/lunarphp/stripe/zipball/9c091d4f8f868966605f488e8d6a94c4af07f0bb",
-                "reference": "9c091d4f8f868966605f488e8d6a94c4af07f0bb",
-                "shasum": ""
-            },
-            "require": {
-                "lunarphp/core": "self.version",
-                "php": "^8.3",
-                "stripe/stripe-php": "^16.0"
-            },
-            "type": "project",
-            "extra": {
-                "lunar": {
-                    "name": "Stripe Payments"
-                },
-                "laravel": {
-                    "providers": [
-                        "Lunar\\Stripe\\StripePaymentsServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Lunar\\Stripe\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Lunar",
-                    "homepage": "https://lunarphp.io/"
-                }
-            ],
-            "description": "Stripe payment driver for Lunar.",
-            "keywords": [
-                "cart",
-                "e-commerce",
-                "ecommerce",
-                "headless",
-                "laravel",
-                "lunarphp",
-                "shop",
-                "store",
-                "stripe"
-            ],
-            "support": {
-                "source": "https://github.com/lunarphp/stripe/tree/1.5.0"
-            },
-            "time": "2026-08-26T14:51:06+00:00"
-        },
         {
             "name": "lunarphp/table-rate-shipping",
             "version": "1.5.0",
@@ -7906,20 +7843,20 @@
         },
         {
             "name": "ramsey/uuid",
-            "version": "4.9.3",
+            "version": "4.9.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ramsey/uuid.git",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8"
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ramsey/uuid/zipball/1df15849d00943a67d677dc9cfd80795f038c9f8",
-                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8",
+                "url": "https://api.github.com/repos/ramsey/uuid/zipball/75d73f48d02797c2c285a7e9f348fadc0102ffe2",
+                "reference": "75d73f48d02797c2c285a7e9f348fadc0102ffe2",
                 "shasum": ""
             },
             "require": {
-                "brick/math": ">=0.8.16 <=0.18",
+                "brick/math": "^0.8.16 || ^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
                 "php": "^8.0",
                 "ramsey/collection": "^1.2 || ^2.0"
             },
@@ -7978,9 +7915,9 @@
             ],
             "support": {
                 "issues": "https://github.com/ramsey/uuid/issues",
-                "source": "https://github.com/ramsey/uuid/tree/4.9.3"
+                "source": "https://github.com/ramsey/uuid/tree/4.9.4"
             },
-            "time": "2026-06-18T03:57:49+00:00"
+            "time": "2026-09-16T11:39:30+00:00"
         },
         {
             "name": "ryangjchandler/blade-capture-directive",
@@ -8062,35 +7999,33 @@
         },
         {
             "name": "sabberworm/php-css-parser",
-            "version": "v9.4.0",
+            "version": "v9.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/MyIntervals/PHP-CSS-Parser.git",
-                "reference": "fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f"
+                "reference": "f284e63b6e891e0c28631e54ba06c3ed102a9ef3"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/MyIntervals/PHP-CSS-Parser/zipball/fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f",
-                "reference": "fd3bf9fb173e0df649bc4e3e0d088a1b2417c08f",
+                "url": "https://api.github.com/repos/MyIntervals/PHP-CSS-Parser/zipball/f284e63b6e891e0c28631e54ba06c3ed102a9ef3",
+                "reference": "f284e63b6e891e0c28631e54ba06c3ed102a9ef3",
                 "shasum": ""
             },
             "require": {
                 "ext-iconv": "*",
-                "php": "^7.2.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0",
-                "thecodingmachine/safe": "^1.3 || ^2.5 || ^3.4"
+                "php": "^7.2.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 || ~8.6.0"
             },
             "require-dev": {
                 "php-parallel-lint/php-parallel-lint": "1.4.0",
                 "phpstan/extension-installer": "1.4.3",
-                "phpstan/phpstan": "1.12.33 || 2.2.2",
-                "phpstan/phpstan-phpunit": "1.4.2 || 2.0.16",
-                "phpstan/phpstan-strict-rules": "1.6.2 || 2.0.11",
-                "phpunit/phpunit": "8.5.52",
+                "phpstan/phpstan": "1.12.33 || 2.2.9",
+                "phpstan/phpstan-phpunit": "1.4.2 || 2.0.18",
+                "phpstan/phpstan-strict-rules": "1.6.2 || 2.0.12",
+                "phpunit/phpunit": "8.5.54",
                 "rawr/phpunit-data-provider": "3.3.1",
-                "rector/rector": "1.2.10 || 2.4.6",
-                "rector/type-perfect": "1.0.0 || 2.1.3",
-                "squizlabs/php_codesniffer": "4.0.1",
-                "thecodingmachine/phpstan-safe-rule": "1.2.0 || 1.4.3"
+                "rector/rector": "1.2.10 || 2.6.2",
+                "rector/type-perfect": "1.0.0 || 2.1.4",
+                "squizlabs/php_codesniffer": "4.0.4"
             },
             "suggest": {
                 "ext-mbstring": "for parsing UTF-8 CSS"
@@ -8098,7 +8033,7 @@
             "type": "library",
             "extra": {
                 "branch-alias": {
-                    "dev-main": "9.5.x-dev"
+                    "dev-main": "9.6.x-dev"
                 }
             },
             "autoload": {
@@ -8136,9 +8071,9 @@
             ],
             "support": {
                 "issues": "https://github.com/MyIntervals/PHP-CSS-Parser/issues",
-                "source": "https://github.com/MyIntervals/PHP-CSS-Parser/tree/v9.4.0"
+                "source": "https://github.com/MyIntervals/PHP-CSS-Parser/tree/v9.5.0"
             },
-            "time": "2026-06-18T15:10:53+00:00"
+            "time": "2026-09-20T15:02:00+00:00"
         },
         {
             "name": "scrivo/highlight.php",
@@ -12665,16 +12600,16 @@
         },
         {
             "name": "technikermathe/blade-lucide-icons",
-            "version": "v3.180.0",
+            "version": "v3.181.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PascaleBeier/blade-lucide-icons.git",
-                "reference": "adac9da3a65910fedc271129eea5340093910203"
+                "reference": "64ccac4ecfe1b833e9a5cf1ebe7216acbe3cac98"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/PascaleBeier/blade-lucide-icons/zipball/adac9da3a65910fedc271129eea5340093910203",
-                "reference": "adac9da3a65910fedc271129eea5340093910203",
+                "url": "https://api.github.com/repos/PascaleBeier/blade-lucide-icons/zipball/64ccac4ecfe1b833e9a5cf1ebe7216acbe3cac98",
+                "reference": "64ccac4ecfe1b833e9a5cf1ebe7216acbe3cac98",
                 "shasum": ""
             },
             "require": {
@@ -12724,152 +12659,9 @@
             ],
             "support": {
                 "issues": "https://github.com/PascaleBeier/blade-lucide-icons/issues",
-                "source": "https://github.com/PascaleBeier/blade-lucide-icons/tree/v3.180.0"
+                "source": "https://github.com/PascaleBeier/blade-lucide-icons/tree/v3.181.0"
             },
-            "time": "2026-09-15T02:25:56+00:00"
-        },
-        {
-            "name": "thecodingmachine/safe",
-            "version": "v3.4.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/thecodingmachine/safe.git",
-                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/thecodingmachine/safe/zipball/705683a25bacf0d4860c7dea4d7947bfd09eea19",
-                "reference": "705683a25bacf0d4860c7dea4d7947bfd09eea19",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^8.1"
-            },
-            "require-dev": {
-                "php-parallel-lint/php-parallel-lint": "^1.4",
-                "phpstan/phpstan": "^2",
-                "phpunit/phpunit": "^10",
-                "squizlabs/php_codesniffer": "^3.2"
-            },
-            "type": "library",
-            "autoload": {
-                "files": [
-                    "lib/special_cases.php",
-                    "generated/apache.php",
-                    "generated/apcu.php",
-                    "generated/array.php",
-                    "generated/bzip2.php",
-                    "generated/calendar.php",
-                    "generated/classobj.php",
-                    "generated/com.php",
-                    "generated/cubrid.php",
-                    "generated/curl.php",
-                    "generated/datetime.php",
-                    "generated/dir.php",
-                    "generated/eio.php",
-                    "generated/errorfunc.php",
-                    "generated/exec.php",
-                    "generated/fileinfo.php",
-                    "generated/filesystem.php",
-                    "generated/filter.php",
-                    "generated/fpm.php",
-                    "generated/ftp.php",
-                    "generated/funchand.php",
-                    "generated/gettext.php",
-                    "generated/gmp.php",
-                    "generated/gnupg.php",
-                    "generated/hash.php",
-                    "generated/ibase.php",
-                    "generated/ibmDb2.php",
-                    "generated/iconv.php",
-                    "generated/image.php",
-                    "generated/imap.php",
-                    "generated/info.php",
-                    "generated/inotify.php",
-                    "generated/json.php",
-                    "generated/ldap.php",
-                    "generated/libxml.php",
-                    "generated/lzf.php",
-                    "generated/mailparse.php",
-                    "generated/mbstring.php",
-                    "generated/misc.php",
-                    "generated/mysql.php",
-                    "generated/mysqli.php",
-                    "generated/network.php",
-                    "generated/oci8.php",
-                    "generated/opcache.php",
-                    "generated/openssl.php",
-                    "generated/outcontrol.php",
-                    "generated/pcntl.php",
-                    "generated/pcre.php",
-                    "generated/pgsql.php",
-                    "generated/posix.php",
-                    "generated/ps.php",
-                    "generated/pspell.php",
-                    "generated/readline.php",
-                    "generated/rnp.php",
-                    "generated/rpminfo.php",
-                    "generated/rrd.php",
-                    "generated/sem.php",
-                    "generated/session.php",
-                    "generated/shmop.php",
-                    "generated/sockets.php",
-                    "generated/sodium.php",
-                    "generated/solr.php",
-                    "generated/spl.php",
-                    "generated/sqlsrv.php",
-                    "generated/ssdeep.php",
-                    "generated/ssh2.php",
-                    "generated/stream.php",
-                    "generated/strings.php",
-                    "generated/swoole.php",
-                    "generated/uodbc.php",
-                    "generated/uopz.php",
-                    "generated/url.php",
-                    "generated/var.php",
-                    "generated/xdiff.php",
-                    "generated/xml.php",
-                    "generated/xmlrpc.php",
-                    "generated/yaml.php",
-                    "generated/yaz.php",
-                    "generated/zip.php",
-                    "generated/zlib.php"
-                ],
-                "classmap": [
-                    "lib/DateTime.php",
-                    "lib/DateTimeImmutable.php",
-                    "lib/Exceptions/",
-                    "generated/Exceptions/"
-                ]
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "description": "PHP core functions that throw exceptions instead of returning FALSE on error",
-            "support": {
-                "issues": "https://github.com/thecodingmachine/safe/issues",
-                "source": "https://github.com/thecodingmachine/safe/tree/v3.4.0"
-            },
-            "funding": [
-                {
-                    "url": "https://github.com/OskarStark",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/shish",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/silasjoisten",
-                    "type": "github"
-                },
-                {
-                    "url": "https://github.com/staabm",
-                    "type": "github"
-                }
-            ],
-            "time": "2026-02-04T18:08:13+00:00"
+            "time": "2026-09-18T02:09:04+00:00"
         },
         {
             "name": "tijsverkoyen/css-to-inline-styles",

config/checkout.php

@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * Per-site settings for the cart + checkout module (see
+ * App\Providers\CheckoutModuleServiceProvider). Becomes the package's
+ * publishable config when the module moves to boboko-core.
+ */
+return [
+
+    /*
+     * Name of the storefront's login route. The checkout's login tab and the
+     * confirmation page link to it with `?redirect=<checkout path>`, so the
+     * login page must send the shopper back there afterwards (3dealer's
+     * Auth\LoginController does). null: no login offered in checkout at all.
+     */
+    'login_route' => 'login',
+
+];

config/lunar/search.php

@@ -20,7 +20,17 @@
         Lunar\Models\Collection::class,
         Lunar\Models\Customer::class,
         Lunar\Models\Order::class,
-        Lunar\Models\Product::class,
+        // Modules\Core\Catalog\Models\Product, not Lunar\Models\Product —
+        // both share the same underlying Meilisearch index name, so
+        // listing the base class here too would make every reindex
+        // (this default list is always merged in, even when a specific
+        // model is passed on the CLI — see Lunar\Console\Commands\
+        // ScoutIndexerCommand::handle()) run the base class's indexing a
+        // second time right after the subclass's, silently overwriting
+        // every document with one missing custom_fields/order_count
+        // (the whole reason Modules\Core\Catalog\Models\Product exists —
+        // see its own docblock). Caught in practice.
+        Modules\Core\Catalog\Models\Product::class,
         Lunar\Models\ProductOption::class,
 
         /*
@@ -49,6 +59,20 @@
         Lunar\Models\Collection::class => Modules\Core\Catalog\Services\CollectionIndexer::class,
         Lunar\Models\Customer::class => Lunar\Search\CustomerIndexer::class,
         Lunar\Models\Order::class => Lunar\Search\OrderIndexer::class,
+        // Lunar\Models\Product::class, NOT Modules\Core\Catalog\Models\
+        // Product::class — Lunar\Base\Traits\Searchable::indexer() (and
+        // getFilterableAttributes()/getSortableAttributes(), same trait)
+        // reads `$config[self::class]`, and `self::class` inside a TRAIT
+        // METHOD is a compile-time literal bound to whichever class first
+        // `use`s the trait — Lunar\Models\Product, since the subclass
+        // never re-declares indexer() itself — regardless of which
+        // instance actually calls the method at runtime. Keying this by
+        // the subclass here made the lookup miss entirely, silently
+        // falling back to Lunar\Search\ScoutIndexer's own near-empty
+        // filterable/sortable field list — confirmed live: it wiped every
+        // real filterable/sortable attribute the index had (including
+        // ones that already worked, like collection_ids), not just the
+        // new order_count one. Caught in practice, reverted.
         Lunar\Models\Product::class => Modules\Core\Catalog\Services\ProductIndexer::class,
         Lunar\Models\ProductOption::class => Lunar\Search\ProductOptionIndexer::class,
     ],

config/services.php

@@ -35,6 +35,11 @@
         ],
     ],
 
+    // Where contact-form messages are sent (ContactController).
+    'contact' => [
+        'email' => env('CONTACT_EMAIL'),
+    ],
+
     'stoic' => [
         'sso_secret' => env('STOIC_SSO_SECRET'),
         'host' => env('STOIC_HOST'),

database/migrations/2026_09_24_000001_create_wishlist_items_table.php

@@ -0,0 +1,25 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('wishlist_items', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('product_id')->constrained('lunar_products')->cascadeOnDelete();
+            $table->timestamps();
+
+            $table->unique(['user_id', 'product_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('wishlist_items');
+    }
+};

database/seeders/ValidationTranslationsSeeder.php

@@ -0,0 +1,115 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Modules\Core\Localization\Services\TranslationService;
+use Spatie\TranslationLoader\LanguageLine;
+
+/**
+ * Default `validation` translation lines — Laravel's own error-message group
+ * (`validation.required`, `validation.email`, `validation.attributes.*`, …),
+ * resolved by every `Validator::make()`/`$request->validate()` call in the app
+ * (see CheckoutController::saveAddress(), CartController, ProductController),
+ * not just the checkout module.
+ *
+ * Spatie's DB loader (spatie/laravel-translation-loader, wired in boboko-core's
+ * LocalizationServiceProvider) merges this group over Laravel's file-based
+ * validation.php, which the project doesn't ship a `lang/` copy of — so without
+ * this, Greek requests fall back to Laravel's untranslated English defaults.
+ * Only the rule keys and field attributes actually in use are seeded; add more
+ * as new rules/fields show up.
+ *
+ * Additive and idempotent: a key that already exists is left untouched, so
+ * anything edited in the Filament Language Lines UI wins on a re-run. Runs
+ * explicitly — `php artisan db:seed --class=ValidationTranslationsSeeder` — it
+ * is not wired into DatabaseSeeder.
+ *
+ * Greek copy uses the project's informal register (εσύ/σου).
+ */
+class ValidationTranslationsSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $translations = app(TranslationService::class);
+
+        foreach ($this->lines() as $key => [$en, $el]) {
+            $exists = LanguageLine::query()
+                ->where('group', 'validation')
+                ->where('key', $key)
+                ->exists();
+
+            if ($exists) {
+                $this->command?->warn("validation.{$key} already exists — skipped");
+
+                continue;
+            }
+
+            $translations->create('validation', $key, ['en' => $en, 'el' => $el]);
+            $this->command?->info("validation.{$key} added");
+        }
+    }
+
+    /**
+     * key => [English, Greek].
+     *
+     * @return array<string, array{0: string, 1: string}>
+     */
+    private function lines(): array
+    {
+        return [
+            // ── Rule messages ─────────────────────────────────────────────
+            'required' => ['The :attribute field is required.', 'Το πεδίο :attribute είναι υποχρεωτικό.'],
+            'email' => ['The :attribute field must be a valid email address.', 'Το πεδίο :attribute πρέπει να είναι έγκυρη διεύθυνση email.'],
+            'string' => ['The :attribute field must be a string.', 'Το πεδίο :attribute πρέπει να είναι κείμενο.'],
+            'integer' => ['The :attribute field must be an integer.', 'Το πεδίο :attribute πρέπει να είναι ακέραιος αριθμός.'],
+            'boolean' => ['The :attribute field must be true or false.', 'Το πεδίο :attribute πρέπει να είναι true ή false.'],
+            'min.numeric' => ['The :attribute field must be at least :min.', 'Το πεδίο :attribute πρέπει να είναι τουλάχιστον :min.'],
+            'max.string' => ['The :attribute field must not be greater than :max characters.', 'Το πεδίο :attribute δεν πρέπει να ξεπερνά τους :max χαρακτήρες.'],
+            'between.numeric' => ['The :attribute field must be between :min and :max.', 'Το πεδίο :attribute πρέπει να είναι μεταξύ :min και :max.'],
+            'exists' => ['The selected :attribute is invalid.', 'Η επιλεγμένη τιμή για το πεδίο :attribute δεν είναι έγκυρη.'],
+            // Product custom-field photo uploads (CustomFieldUploadController, CartController).
+            'file' => ['The :attribute field must be a file.', 'Το πεδίο :attribute πρέπει να είναι αρχείο.'],
+            'mimes' => ['The :attribute field must be a file of type: :values.', 'Το πεδίο :attribute πρέπει να είναι αρχείο τύπου: :values.'],
+            'max.file' => ['The :attribute field must not be greater than :max kilobytes.', 'Το αρχείο στο πεδίο :attribute δεν πρέπει να ξεπερνά τα :max kilobytes.'],
+            'uploaded' => ['The :attribute failed to upload.', 'Η μεταφόρτωση στο πεδίο :attribute απέτυχε.'],
+
+            // ── Field names (checkout: billing/shipping address) ──────────
+            'attributes.contact_email' => ['email', 'email'],
+            'attributes.billing_first_name' => ['first name', 'όνομα'],
+            'attributes.billing_last_name' => ['last name', 'επώνυμο'],
+            'attributes.billing_company_name' => ['company name', 'επωνυμία εταιρείας'],
+            'attributes.billing_tax_identifier' => ['tax ID', 'ΑΦΜ'],
+            'attributes.billing_line_one' => ['address', 'διεύθυνση'],
+            'attributes.billing_line_two' => ['address line 2', 'διεύθυνση (γραμμή 2)'],
+            'attributes.billing_city' => ['city', 'πόλη'],
+            'attributes.billing_state' => ['region', 'νομό / περιοχή'],
+            'attributes.billing_postcode' => ['postcode', 'ταχυδρομικό κώδικα'],
+            'attributes.billing_country_id' => ['country', 'χώρα'],
+            'attributes.billing_contact_phone' => ['phone', 'τηλέφωνο'],
+            'attributes.shipping_first_name' => ['first name', 'όνομα'],
+            'attributes.shipping_last_name' => ['last name', 'επώνυμο'],
+            'attributes.shipping_company_name' => ['company name', 'επωνυμία εταιρείας'],
+            'attributes.shipping_line_one' => ['address', 'διεύθυνση'],
+            'attributes.shipping_line_two' => ['address line 2', 'διεύθυνση (γραμμή 2)'],
+            'attributes.shipping_city' => ['city', 'πόλη'],
+            'attributes.shipping_state' => ['region', 'νομό / περιοχή'],
+            'attributes.shipping_postcode' => ['postcode', 'ταχυδρομικό κώδικα'],
+            'attributes.shipping_country_id' => ['country', 'χώρα'],
+            'attributes.shipping_contact_phone' => ['phone', 'τηλέφωνο'],
+            'attributes.shipping_delivery_instructions' => ['delivery notes', 'σχόλια για την παράδοση'],
+
+            // ── Field names (cart) ─────────────────────────────────────────
+            'attributes.purchasable_id' => ['product', 'προϊόν'],
+            'attributes.quantity' => ['quantity', 'ποσότητα'],
+            'attributes.code' => ['coupon code', 'κωδικό κουπονιού'],
+
+            // ── Field names (product reviews / stock check) ────────────────
+            'attributes.variant' => ['variant', 'παραλλαγή'],
+            'attributes.rating' => ['rating', 'βαθμολογία'],
+            'attributes.content' => ['review text', 'κείμενο κριτικής'],
+            'attributes.name' => ['name', 'όνομα'],
+            'attributes.email' => ['email', 'email'],
+        ];
+    }
+}

public/site.webmanifest

@@ -0,0 +1,21 @@
+{
+  "name": "3dealer",
+  "short_name": "3dealer",
+  "icons": [
+    {
+      "src": "/web-app-manifest-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/web-app-manifest-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "theme_color": "#ffffff",
+  "background_color": "#ffffff",
+  "display": "standalone"
+}

resources/css/checkout.css

@@ -200,8 +200,51 @@ .bbk-cart-item-media img {
 .bbk-cart-item-detail { min-width: 0; }
 
 .bbk-cart-item-title {
+    display: block;
     margin: 0 0 0.25rem;
     font-weight: 600;
+    color: inherit;
+    text-decoration: none;
+}
+
+a.bbk-cart-item-title:hover { text-decoration: underline; }
+
+.bbk-cart-item-variant {
+    margin: 0 0 0.25rem;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+/* A line's custom-field answers (checkout::partials.line-custom-fields). */
+.bbk-line-fields {
+    display: grid;
+    gap: 0.25rem;
+    margin: 0 0 0.5rem;
+    font-size: 0.8125rem;
+}
+
+.bbk-line-field dt {
+    color: var(--bbk-color-muted);
+}
+
+.bbk-line-field dd {
+    margin: 0;
+    white-space: pre-line;
+    overflow-wrap: anywhere;
+}
+
+.bbk-line-field-file {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    color: inherit;
+}
+
+.bbk-line-field-file img {
+    width: 40px;
+    height: 40px;
+    object-fit: cover;
+    border-radius: 0;
 }
 
 .bbk-cart-item-unit {
@@ -361,6 +404,19 @@ .bbk-cart-coupon-error {
     color: var(--bbk-color-danger);
 }
 
+.bbk-cart-error {
+    margin: 0;
+    padding: 0.75rem 1.5rem 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+.bbk-add-to-cart-error {
+    margin: 0.375rem 0 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
 .bbk-cart-checkout {
     display: block;
     width: 100%;
@@ -448,35 +504,12 @@ .bbk-checkout-note {
     font-size: 0.875rem;
 }
 
-/* Contact tabs */
+/* Contact: "logged in as" line, or the guest login prompt */
 
-.bbk-checkout-tabs { display: flex; flex-direction: column; gap: 1rem; }
+.bbk-checkout-logged-in,
+.bbk-checkout-login-prompt { margin: 0; }
 
-.bbk-checkout-tab {
-    display: inline-flex;
-    width: fit-content;
-    margin-right: 0.5rem;
-    padding: 0.5rem 1rem;
-    border: 1px solid var(--bbk-color-border);
-    border-radius: var(--bbk-radius-sm);
-    background: var(--bbk-color-bg);
-    font: inherit;
-    font-weight: 600;
-    color: var(--bbk-color-muted);
-    cursor: pointer;
-    transition: background-color 0.15s ease, color 0.15s ease;
-}
-
-.bbk-checkout-tab[aria-selected="true"] {
-    background: var(--bbk-color-text);
-    border-color: var(--bbk-color-text);
-    color: var(--bbk-color-bg);
-}
-
-.bbk-checkout-tab:focus-visible {
-    outline: 2px solid var(--bbk-color-accent);
-    outline-offset: 2px;
-}
+.bbk-checkout-login-prompt a { color: inherit; font-weight: 600; }
 
 /* Fields */
 
@@ -546,6 +579,12 @@ .bbk-checkbox {
 }
 
 /* For a full-sentence label that can wrap — align the box to the first line. */
+/* "I want an invoice": company/ΑΦΜ only while ticked */
+
+.bbk-invoice { display: flex; flex-direction: column; gap: 1rem; }
+
+.bbk-invoice:not(:has(input[name="wants_invoice"]:checked)) .bbk-invoice-fields { display: none; }
+
 .bbk-checkbox--stacked {
     display: flex;
     align-items: flex-start;
@@ -630,6 +669,8 @@ .bbk-checkout-continue {
     font: inherit;
     font-weight: 600;
     text-align: center;
+    text-decoration: none;
+    box-sizing: border-box;
     cursor: pointer;
     transition: opacity 0.15s ease;
 }
@@ -747,6 +788,23 @@ .bbk-confirmation-heading {
 
 .bbk-confirmation-ref { margin: 0 0 0.25rem; }
 
+.bbk-confirmation-meta {
+    margin: 0 0 1rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+}
+
+.bbk-confirmation-meta-row {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    font-size: 0.9375rem;
+}
+
+.bbk-confirmation-meta-row dt { color: var(--bbk-color-muted); }
+.bbk-confirmation-meta-row dd { margin: 0; font-weight: 600; }
+
 .bbk-confirmation-body {
     margin: 2rem 0;
     display: grid;
@@ -764,11 +822,14 @@ .bbk-confirmation-lines {
 }
 
 .bbk-confirmation-line {
-    display: flex;
-    justify-content: space-between;
-    gap: 1rem;
+    display: grid;
+    grid-template-columns: 72px 1fr auto;
+    align-items: start;
+    gap: 0.875rem;
 }
 
+.bbk-confirmation-line-detail { min-width: 0; }
+
 .bbk-confirmation-line-qty { color: var(--bbk-color-muted); }
 
 .bbk-confirmation-lines .bbk-cart-summary { margin-top: 0.75rem; }
@@ -793,8 +854,3 @@ .bbk-address-lines {
     font-size: 0.875rem;
     color: var(--bbk-color-muted);
 }
-
-.bbk-confirmation-continue {
-    max-width: 280px;
-    text-decoration: none;
-}

resources/js/checkout/bbk-add-to-cart-controller.js

@@ -6,12 +6,15 @@ import { csrfToken } from './csrf'
 // `bbk-cart:changed` window event. No DOM building here — the drawer
 // (bbk-cart-controller) owns rendering.
 export default class extends Controller {
+    static targets = ['error']
+
     async add(event) {
         event.preventDefault()
 
         const form = this.element
         const submit = form.querySelector('[type="submit"]')
 
+        this.clearError()
         form.setAttribute('data-bbk-add-to-cart-state', 'loading')
         if (submit) submit.disabled = true
 
@@ -21,11 +24,16 @@ export default class extends Controller {
                 headers: {
                     'X-CSRF-TOKEN': csrfToken(),
                     'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
                 },
                 body: new FormData(form),
             })
 
-            if (!response.ok) return
+            if (!response.ok) {
+                const data = await response.json().catch(() => null)
+                this.showError(data?.error)
+                return
+            }
 
             window.dispatchEvent(new CustomEvent('bbk-cart:changed', {
                 detail: { html: await response.text() },
@@ -35,4 +43,15 @@ export default class extends Controller {
             if (submit) submit.disabled = false
         }
     }
+
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
 }

resources/js/checkout/bbk-cart-controller.js

@@ -13,11 +13,12 @@ import { csrfToken } from './csrf'
 // Appearance is entirely CSS-driven: open state is the data-bbk-cart-state
 // attribute on the root, nothing here touches styles or class lists.
 export default class extends Controller {
-    static targets = ['panel', 'body']
+    static targets = ['panel', 'body', 'error']
 
     connect() {
         this.onChanged = this.onChanged.bind(this)
         this.onKeydown = this.onKeydown.bind(this)
+        this.updateTimers = new Map() // line id -> pending debounce timer
 
         window.addEventListener('bbk-cart:changed', this.onChanged)
         window.addEventListener('bbk-cart:open', this.open.bind(this))
@@ -30,6 +31,7 @@ export default class extends Controller {
     disconnect() {
         window.removeEventListener('bbk-cart:changed', this.onChanged)
         document.removeEventListener('keydown', this.onKeydown)
+        this.updateTimers.forEach((timer) => clearTimeout(timer))
     }
 
     onChanged(event) {
@@ -63,7 +65,11 @@ export default class extends Controller {
     submit(event) {
         event.preventDefault()
         const form = event.target.closest('form')
-        if (form) this.send(form)
+        if (!form) return
+
+        // A remove is a deliberate, one-shot action — only the quantity form
+        // (typing, or the +/- stepper below) benefits from debouncing.
+        form.classList.contains('bbk-cart-qty') ? this.scheduleSend(form) : this.send(form)
     }
 
     // +/- stepper buttons inside a line
@@ -73,11 +79,27 @@ export default class extends Controller {
         const input = form.querySelector('input[type="number"]')
         const next = Math.max(0, parseInt(input.value || '0', 10) + Number(event.params.dir))
         input.value = String(next)
-        this.send(form)
+        this.scheduleSend(form)
+    }
+
+    // Repeated clicks (or spinner nudges) update the input instantly but only
+    // send once they settle for 300ms — sending on every single click was
+    // firing overlapping requests that raced each other and made the drawer
+    // visibly flicker/lag under quick clicking.
+    scheduleSend(form) {
+        const lineId = form.closest('[data-bbk-line-id]')?.dataset.bbkLineId
+        if (!lineId) return this.send(form)
+
+        clearTimeout(this.updateTimers.get(lineId))
+        this.updateTimers.set(lineId, setTimeout(() => {
+            this.updateTimers.delete(lineId)
+            this.send(form)
+        }, 300))
     }
 
     async send(form) {
         this.bodyTarget.setAttribute('aria-busy', 'true')
+        this.clearError()
 
         try {
             const response = await fetch(form.action, {
@@ -85,16 +107,42 @@ export default class extends Controller {
                 headers: {
                     'X-CSRF-TOKEN': csrfToken(),
                     'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
                 },
                 body: new FormData(form),
             })
 
-            if (response.ok) this.replaceBody(await response.text())
+            if (response.ok) {
+                this.replaceBody(await response.text())
+                return
+            }
+
+            const data = await response.json().catch(() => null)
+            this.showError(data?.error)
+
+            // The rejected quantity (typed, or from a +/- click) is left
+            // sitting in the input with nothing to correct it — the update
+            // never reached the cart, so the input must be put back to what
+            // the cart actually still holds, not just left showing whatever
+            // was rejected.
+            const input = form.querySelector('[data-bbk-cart-confirmed-quantity]')
+            if (input) input.value = input.dataset.bbkCartConfirmedQuantity
         } finally {
             this.bodyTarget.removeAttribute('aria-busy')
         }
     }
 
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
+
     replaceBody(html) {
         this.bodyTarget.innerHTML = html
         this.emitUpdated(this.bodyTarget.querySelector('[data-bbk-cart-count]'))

resources/js/checkout/bbk-checkout-form-controller.js

@@ -13,7 +13,6 @@ import { csrfToken } from './csrf'
 // already uses). Shipping-method radios post to selectShippingUrl the same way.
 export default class extends Controller {
     static targets = [
-        'guestTab', 'loginTab', 'guestPanel', 'loginPanel',
         'sameAsBilling', 'shippingFields',
         'form', 'shippingOptions', 'status',
     ]
@@ -41,22 +40,6 @@ export default class extends Controller {
         this.saveController?.abort()
     }
 
-    // ── Contact tabs ────────────────────────────────────────────────────
-
-    showGuest() {
-        this.guestPanelTarget.hidden = false
-        this.loginPanelTarget.hidden = true
-        this.guestTabTarget.setAttribute('aria-selected', 'true')
-        this.loginTabTarget.setAttribute('aria-selected', 'false')
-    }
-
-    showLogin() {
-        this.guestPanelTarget.hidden = true
-        this.loginPanelTarget.hidden = false
-        this.guestTabTarget.setAttribute('aria-selected', 'false')
-        this.loginTabTarget.setAttribute('aria-selected', 'true')
-    }
-
     // ── Same as billing ────────────────────────────────────────────────
 
     toggleSameAsBilling() {
@@ -93,7 +76,6 @@ export default class extends Controller {
         // react to fields that actually belong to the address form.
         const el = event.target
         const belongsToForm = el.form?.id === 'bbk-address-form'
-            || el.closest('[data-bbk-checkout-form-target="guestPanel"]')
         if (!belongsToForm) return
 
         // No status during the wait — it only shows once the request is in flight,

resources/js/checkout/bbk-payment-controller.js

@@ -43,6 +43,16 @@ export default class extends Controller {
                 this.amountValue = total
                 this.elements.update({ amount: Math.max(total, 1) })
             }
+
+            // Removing the last line while sitting on the checkout page (via
+            // the order summary's own remove form) must not leave "place
+            // order" clickable with nothing left to charge for — this fires
+            // from both the drawer and the checkout page's own summary
+            // instance, whichever the shopper actually used.
+            const count = event.detail?.count
+            if (typeof count === 'number' && this.hasSubmitTarget) {
+                this.submitTarget.disabled = count === 0
+            }
         }
         window.addEventListener('bbk-cart:updated', this.onSummaryUpdate)
 

resources/js/stimulus/custom-field-upload-controller.js

@@ -0,0 +1,108 @@
+import { Controller } from '@hotwired/stimulus'
+
+// One product custom field of type `file` (see x-product-custom-fields).
+// Uploads the photo to the storefront's own endpoint (CustomFieldUploadController)
+// as soon as it's picked, then writes the returned File row's id (boboko-core's
+// Modules\Core\File\Models\File) into the hidden input the add-to-cart form
+// actually submits — the checkout module never receives the file itself.
+//
+// While uploading, the file input is marked invalid via setCustomValidity(),
+// so the browser's own form validation blocks add-to-cart until the id is in
+// place. A failed upload clears the input, so `required` blocks it too.
+export default class extends Controller {
+    static targets = ['file', 'reference', 'preview', 'error']
+    static values  = {
+        url: String,
+        label: String,
+        uploadingMessage: String,
+        failedMessage: String,
+    }
+
+    disconnect() {
+        this.abortController?.abort()
+        this.revokePreview()
+    }
+
+    async upload() {
+        this.reset()
+
+        const file = this.fileTarget.files[0]
+        if (!file) return
+
+        const abortController = new AbortController()
+        this.abortController = abortController
+
+        this.fileTarget.setCustomValidity(this.uploadingMessageValue)
+        this.fileTarget.setAttribute('aria-busy', 'true')
+
+        const body = new FormData()
+        body.append('file', file)
+        body.append('label', this.labelValue)
+
+        try {
+            const response = await fetch(this.urlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]')?.content ?? '',
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body,
+                signal: abortController.signal,
+            })
+            const data = await response.json().catch(() => null)
+
+            if (!response.ok || !data?.file_id) {
+                this.fail(data?.error)
+                return
+            }
+
+            this.referenceTarget.value = data.file_id
+            this.showPreview(file)
+        } catch (error) {
+            // A newer pick superseded this upload — reset() already handled it.
+            if (error.name === 'AbortError') return
+            this.fail()
+        } finally {
+            if (!abortController.signal.aborted) this.markIdle()
+        }
+    }
+
+    reset() {
+        this.abortController?.abort()
+        this.referenceTarget.value = ''
+        this.errorTarget.hidden = true
+        this.markIdle()
+        this.revokePreview()
+    }
+
+    fail(message) {
+        this.fileTarget.value = ''
+        this.errorTarget.textContent = message || this.failedMessageValue
+        this.errorTarget.hidden = false
+    }
+
+    markIdle() {
+        this.fileTarget.setCustomValidity('')
+        this.fileTarget.removeAttribute('aria-busy')
+    }
+
+    showPreview(file) {
+        this.previewUrl = URL.createObjectURL(file)
+        this.previewTarget.src = this.previewUrl
+        this.previewTarget.hidden = false
+    }
+
+    // Formats the browser can't render (HEIC outside Safari) — the file
+    // input's own filename is enough there.
+    hidePreview() {
+        this.previewTarget.hidden = true
+    }
+
+    revokePreview() {
+        if (this.previewUrl) URL.revokeObjectURL(this.previewUrl)
+        this.previewUrl = null
+        this.previewTarget.removeAttribute('src')
+        this.previewTarget.hidden = true
+    }
+}

resources/js/stimulus/index.js

@@ -8,6 +8,7 @@ import AutoSubmitController     from './auto-submit-controller'
 import BackToTopController      from './back-to-top-controller'
 import CartCountController      from './cart-count-controller'
 import CarouselController       from './carousel-controller'
+import CustomFieldUploadController from './custom-field-upload-controller'
 import DropdownController       from './dropdown-controller'
 import FrameScrollController    from './frame-scroll-controller'
 import NavSearchController      from './nav-search-controller'
@@ -16,7 +17,9 @@ import ProductGalleryController from './product-gallery-controller'
 import QuantityController      from './quantity-controller'
 import RangeSliderController   from './range-slider-controller'
 import StarRatingController    from './star-rating-controller'
+import TabLinkController       from './tab-link-controller'
 import TabsController          from './tabs-controller'
+import WishlistController      from './wishlist-controller'
 
 export function registerControllers(application) {
     application.register('appear',           AppearController)
@@ -24,6 +27,7 @@ export function registerControllers(application) {
     application.register('back-to-top',      BackToTopController)
     application.register('cart-count',       CartCountController)
     application.register('carousel',         CarouselController)
+    application.register('custom-field-upload', CustomFieldUploadController)
     application.register('dropdown',         DropdownController)
     application.register('frame-scroll',     FrameScrollController)
     application.register('nav-search',       NavSearchController)
@@ -32,5 +36,7 @@ export function registerControllers(application) {
     application.register('quantity',         QuantityController)
     application.register('range-slider',     RangeSliderController)
     application.register('star-rating',      StarRatingController)
+    application.register('tab-link',         TabLinkController)
     application.register('tabs',             TabsController)
+    application.register('wishlist',         WishlistController)
 }

resources/js/stimulus/product-form-controller.js

@@ -2,25 +2,134 @@ import { Controller } from '@hotwired/stimulus'
 import { formatPrice } from '../utils/format-price'
 
 export default class extends Controller {
-    static targets = ['price', 'image', 'swatch', 'colorName']
-    static values  = { variants: Array, selected: Number }
+    static targets = ['price', 'image', 'swatch', 'colorName', 'stockError']
+    static values  = {
+        variants: Array,
+        selected: Number,
+        stockCheckUrl: String,
+        // Two pre-rendered translated templates (see product/show.blade.php)
+        // rather than one — this controller doesn't reimplement Laravel's
+        // pluralization rules, it just picks whichever of these two the
+        // count actually needs and fills in the number.
+        stockErrorOne: String,
+        stockErrorMany: String,
+    }
 
     connect() {
-        const params    = new URLSearchParams(window.location.search)
-        const urlId     = parseInt(params.get('variant'))
-        const defaultId = this.variantsValue[0]?.id
+        const params      = new URLSearchParams(window.location.search)
+        const urlId       = parseInt(params.get('variant'))
+        const urlVariant  = this.variantsValue.find(v => v.id === urlId)
+        const initial     = urlVariant ?? this.variantsValue[0]
 
-        this.selectedValue = urlId && this.variantsValue.find(v => v.id === urlId)
-            ? urlId
-            : defaultId
+        // A product can have several independent options (e.g. size + style
+        // + person-count) — this tracks the currently-picked value id per
+        // option handle, and selectVariant() below resolves the full
+        // combination back to one exact variant on every change.
+        this.selections = { ...initial?.options }
+        this.selectedValue = initial?.id
+
+        // Capture phase, on this controller's own root element (an ancestor
+        // of the checkout module's add-to-cart <form>) — runs BEFORE that
+        // form's own bubble-phase submit handler (bbk-add-to-cart#add), so a
+        // failed check can stop it from ever reaching the module at all. The
+        // module itself is never touched or modified for this: it keeps
+        // validating server-side regardless, this is purely an up-front,
+        // storefront-owned check (see [[project_checkout_module]] for why
+        // that split matters — stock UX is a catalog concern, not something
+        // the portable checkout module should own) — and a REAL, live check
+        // against the backend (ProductController::checkStock(), reading the
+        // Eloquent model directly), not page-load data that can go stale.
+        this.onSubmitCapture = this.checkStock.bind(this)
+        this.element.addEventListener('submit', this.onSubmitCapture, true)
+    }
+
+    disconnect() {
+        this.element.removeEventListener('submit', this.onSubmitCapture, true)
+    }
+
+    checkStock(event) {
+        const form = event.target
+        if (!form.matches('.bbk-add-to-cart')) return
+
+        // The re-submit this itself triggers below, once the backend has
+        // confirmed the quantity is fine — let that one through to the
+        // module's own submit handler instead of checking a second time.
+        if (form.dataset.bbkStockChecked) {
+            delete form.dataset.bbkStockChecked
+            return
+        }
+
+        event.preventDefault()
+        event.stopPropagation()
+        this.verifyStock(form)
+    }
+
+    async verifyStock(form) {
+        this.clearStockError()
+
+        const submit = form.querySelector('[type="submit"]')
+        if (submit) submit.disabled = true
+
+        const purchasableId = form.querySelector('[data-bbk-purchasable-input]')?.value
+        const quantity = form.querySelector('[name="quantity"]')?.value || '1'
+
+        try {
+            const url = new URL(this.stockCheckUrlValue, window.location.origin)
+            url.searchParams.set('variant', purchasableId)
+            url.searchParams.set('quantity', quantity)
+
+            const response = await fetch(url, { headers: { Accept: 'application/json' } })
+            const data = await response.json()
+
+            if (!data.ok) {
+                this.showStockError(data.stock)
+                return
+            }
+        } catch {
+            // Network hiccup — fall through and let the checkout module's
+            // own server-side check have the final word rather than
+            // silently blocking the shopper here.
+        } finally {
+            if (submit) submit.disabled = false
+        }
+
+        form.dataset.bbkStockChecked = 'true'
+        form.requestSubmit()
+    }
+
+    showStockError(available) {
+        if (!this.hasStockErrorTarget) return
+
+        this.stockErrorTarget.textContent = available === 1
+            ? this.stockErrorOneValue
+            : this.stockErrorManyValue.replace(':count', String(available))
+        this.stockErrorTarget.hidden = false
+    }
+
+    clearStockError() {
+        if (!this.hasStockErrorTarget) return
+        this.stockErrorTarget.hidden = true
     }
 
     selectVariant(event) {
-        const id = parseInt(event.currentTarget.dataset.variantId)
-        this.selectedValue = id
+        const option = event.currentTarget.dataset.option
+        const valueId = parseInt(event.currentTarget.dataset.valueId)
+        this.selections = { ...this.selections, [option]: valueId }
+
+        const match = this.variantsValue.find(variant =>
+            Object.keys(this.selections).every(key => variant.options?.[key] === this.selections[key])
+        )
+
+        // No variant exists for this combination (e.g. an option value that
+        // isn't offered together with another currently-selected value) —
+        // leave the previous selection in place rather than pointing the
+        // add-to-cart form at nothing.
+        if (!match) return
+
+        this.selectedValue = match.id
 
         const url = new URL(window.location)
-        url.searchParams.set('variant', id)
+        url.searchParams.set('variant', match.id)
         window.history.pushState({}, '', url)
     }
 
@@ -30,6 +139,8 @@ export default class extends Controller {
         const variant = this.variantsValue.find(v => v.id === id)
         if (!variant) return
 
+        this.clearStockError()
+
         if (this.hasPriceTarget && variant.price !== null) {
             this.priceTarget.textContent = formatPrice(variant.price)
         }
@@ -46,12 +157,16 @@ export default class extends Controller {
         if (purchasableInput) purchasableInput.value = id
 
         this.swatchTargets.forEach(swatch => {
-            const isSelected = parseInt(swatch.dataset.variantId) === id
+            const isSelected = this.selections[swatch.dataset.option] === parseInt(swatch.dataset.valueId)
             swatch.classList.toggle('is-selected', isSelected)
             swatch.setAttribute('aria-pressed', String(isSelected))
 
-            if (isSelected && this.hasColorNameTarget) {
-                this.colorNameTarget.textContent = swatch.getAttribute('aria-label')
+            if (isSelected) {
+                // Each color-option group has its own colorName echo (see
+                // x-ui.color-swatch) — matched by option handle so a swatch
+                // in one group never overwrites another group's label.
+                const colorName = this.colorNameTargets.find(target => target.dataset.option === swatch.dataset.option)
+                if (colorName) colorName.textContent = swatch.getAttribute('aria-label')
             }
         })
     }

resources/js/stimulus/star-rating-controller.js

@@ -1,9 +1,25 @@
 import { Controller } from '@hotwired/stimulus'
 
 export default class extends Controller {
-    static targets = ['star', 'input']
+    static targets = ['star', 'input', 'error']
     static values  = { rating: { type: Number, default: 0 } }
 
+    connect() {
+        this.#fill(this.ratingValue)
+    }
+
+    // Bound to the form's submit event (this controller sits on the <form>
+    // itself, not just the star widget) — a plain `required` on the hidden
+    // rating input would never surface: browsers exclude type="hidden" from
+    // constraint validation entirely, so there'd be nothing to see or hear.
+    validate(event) {
+        if (this.ratingValue < 1) {
+            event.preventDefault()
+            this.errorTarget.hidden = false
+            this.starTargets[0]?.focus()
+        }
+    }
+
     hover(event) {
         this.#fill(parseInt(event.currentTarget.dataset.value))
     }
@@ -16,6 +32,7 @@ export default class extends Controller {
         const val = parseInt(event.currentTarget.dataset.value)
         this.ratingValue = val
         this.inputTarget.value = val
+        this.errorTarget.hidden = true
 
         this.starTargets.forEach(star => {
             star.setAttribute('aria-pressed', String(parseInt(star.dataset.value) === val))

resources/js/stimulus/tab-link-controller.js

@@ -0,0 +1,15 @@
+import { Controller } from '@hotwired/stimulus'
+
+// Jumps to a tab panel from an element outside the tabs' own markup — the
+// review count and the "read more" link both sit elsewhere in the DOM, too
+// far apart from the tabs for a plain data-action, hence the outlet.
+export default class extends Controller {
+    static outlets = ['tabs']
+    static values = { panel: String }
+
+    activate(event) {
+        event?.preventDefault()
+        this.tabsOutlet.activate(this.panelValue)
+        this.tabsOutlet.element.scrollIntoView({ block: 'start', behavior: 'smooth' })
+    }
+}

resources/js/stimulus/tabs-controller.js

@@ -4,10 +4,10 @@ export default class extends Controller {
     static targets = ['button', 'panel']
 
     show(event) {
-        this.#activate(event.currentTarget.dataset.panel)
+        this.activate(event.currentTarget.dataset.panel)
     }
 
-    #activate(panelId) {
+    activate(panelId) {
         this.buttonTargets.forEach(btn => {
             const active = btn.dataset.panel === panelId
             btn.classList.toggle('is-active', active)

resources/js/stimulus/wishlist-controller.js

@@ -0,0 +1,42 @@
+import { Controller } from '@hotwired/stimulus'
+
+// Heart toggle (x-wishlist-button). Posts the form with fetch and reflects the
+// server's answer on aria-pressed, which the CSS uses to swap the outline and
+// filled heart. If the request fails, falls back to a normal form submit.
+export default class extends Controller {
+    static targets = ['button', 'status']
+
+    static values = {
+        addLabel: String,
+        removeLabel: String,
+        addedMessage: String,
+        removedMessage: String,
+    }
+
+    async toggle(event) {
+        event.preventDefault()
+
+        if (this.busy) return
+        this.busy = true
+
+        try {
+            const response = await fetch(this.element.action, {
+                method: 'POST',
+                headers: { Accept: 'application/json', 'X-Requested-With': 'XMLHttpRequest' },
+                body: new FormData(this.element),
+            })
+
+            if (!response.ok) throw new Error(`Wishlist toggle failed: ${response.status}`)
+
+            const { active } = await response.json()
+
+            this.buttonTarget.setAttribute('aria-pressed', active ? 'true' : 'false')
+            this.buttonTarget.setAttribute('aria-label', active ? this.removeLabelValue : this.addLabelValue)
+            this.statusTarget.textContent = active ? this.addedMessageValue : this.removedMessageValue
+        } catch {
+            this.element.submit()
+        } finally {
+            this.busy = false
+        }
+    }
+}

resources/views/account/email-code.blade.php

@@ -0,0 +1,65 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.auth.enter_code'))
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.auth.enter_code') }}
+            </h1>
+
+            <p>
+                {{ __('storefront.auth.code_sent_to') }} <strong class="break-all">{{ $email }}</strong>
+            </p>
+
+            <x-ui.status />
+        </div>
+
+        <form method="POST" action="{{ route('account.email.verify') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.code')"
+                for="account-email-code"
+                :required="true"
+                :error="$errors->first('code')"
+            >
+                <x-ui.input
+                    id="account-email-code"
+                    name="code"
+                    inputmode="numeric"
+                    autocomplete="one-time-code"
+                    pattern="[0-9]{6}"
+                    maxlength="6"
+                    :required="true"
+                    autofocus
+                    class="text-2xl font-bold tracking-[0.5em]"
+                    :aria-invalid="$errors->has('code') ? 'true' : null"
+                    :aria-describedby="$errors->has('code') ? 'account-email-code-error' : null"
+                />
+            </x-ui.field>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.account.email_confirm') }}</x-ui.button>
+            </div>
+        </form>
+
+        <div class="flex flex-wrap items-center gap-x-8 gap-y-4 text-sm">
+            <form method="POST" action="{{ route('account.email.resend') }}">
+                @csrf
+                <button type="submit" class="cursor-pointer underline hover:no-underline">
+                    {{ __('storefront.auth.resend_code') }}
+                </button>
+            </form>
+
+            <a href="{{ route('account.email.edit') }}" class="underline hover:no-underline">
+                {{ __('storefront.auth.change_email') }}
+            </a>
+        </div>
+
+    </div>
+
+@endsection

resources/views/account/email.blade.php

@@ -0,0 +1,53 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.email_change_heading'))
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.account.email_change_heading') }}
+            </h1>
+
+            <p>
+                {{ __('storefront.account.email_current') }} <strong class="break-all">{{ $user->email }}</strong>
+            </p>
+        </div>
+
+        <form method="POST" action="{{ route('account.email.send') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.account.email_new')"
+                for="account-new-email"
+                :required="true"
+                :description="__('storefront.account.email_new_hint')"
+                :error="$errors->first('email')"
+            >
+                <x-ui.input
+                    id="account-new-email"
+                    name="email"
+                    type="email"
+                    autocomplete="email"
+                    :value="old('email')"
+                    :required="true"
+                    autofocus
+                    :aria-invalid="$errors->has('email') ? 'true' : null"
+                    :aria-describedby="$errors->has('email') ? 'account-new-email-error' : 'account-new-email-description'"
+                />
+            </x-ui.field>
+
+            <div class="flex flex-wrap items-center gap-8">
+                <x-ui.button type="submit">{{ __('storefront.auth.send_code') }}</x-ui.button>
+
+                <a href="{{ route('account') }}" class="text-sm underline hover:no-underline">
+                    {{ __('storefront.account.delete_cancel') }}
+                </a>
+            </div>
+        </form>
+
+    </div>
+
+@endsection

resources/views/account/orders/index.blade.php

@@ -0,0 +1,67 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_orders'))
+
+@section('account')
+
+    <div class="flex max-w-4xl flex-col gap-12">
+
+        <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.account.nav_orders') }}
+        </h1>
+
+        @if ($orders->isEmpty())
+            <div class="flex flex-col items-start gap-8">
+                <p>{{ __('storefront.orders.empty') }}</p>
+                <x-ui.button :href="route('products')" size="md">{{ __('storefront.orders.shop_now') }}</x-ui.button>
+            </div>
+        @else
+            {{-- A list, not a table, so each order can stack on mobile. The column
+                 headings are visual only; each cell carries its own sr-only label. --}}
+            <div>
+                <div class="hidden grid-cols-[1fr_1fr_1.5fr_1fr_auto] gap-6 border-b border-black pb-3 text-sm uppercase font-display font-extrabold sm:grid" aria-hidden="true">
+                    <span>{{ __('storefront.orders.date') }}</span>
+                    <span>{{ __('storefront.orders.number') }}</span>
+                    <span>{{ __('storefront.orders.status') }}</span>
+                    <span>{{ __('storefront.orders.total') }}</span>
+                    <span class="w-24"></span>
+                </div>
+
+                <ul>
+                    @foreach ($orders as $order)
+                        <li class="grid grid-cols-2 gap-x-6 gap-y-2 border-b border-black py-5 sm:grid-cols-[1fr_1fr_1.5fr_1fr_auto] sm:items-center">
+                            <span>
+                                <span class="sr-only">{{ __('storefront.orders.date') }}:</span>
+                                {{ $order->placed_at->format('d/m/Y') }}
+                            </span>
+                            <span class="text-right font-bold sm:text-left">
+                                <span class="sr-only">{{ __('storefront.orders.number') }}:</span>
+                                #{{ $order->reference }}
+                            </span>
+                            <span>
+                                <span class="sr-only">{{ __('storefront.orders.status') }}:</span>
+                                <x-order-status :status="$order->status" />
+                            </span>
+                            <span class="text-right sm:text-left">
+                                <span class="sr-only">{{ __('storefront.orders.total') }}:</span>
+                                {{ $order->total?->formatted() }}
+                            </span>
+                            <a
+                                href="{{ route('account.orders.show', ['orderId' => $order->id]) }}"
+                                class="col-span-2 mt-2 inline-flex w-24 items-center gap-2 font-bold underline hover:no-underline sm:col-span-1 sm:mt-0"
+                                aria-label="{{ __('storefront.orders.view_order', ['number' => $order->reference]) }}"
+                            >
+                                {{ __('storefront.orders.view') }}
+                                <x-ui.icon name="arrow-right" :size="16" />
+                            </a>
+                        </li>
+                    @endforeach
+                </ul>
+            </div>
+
+            <x-ui.pagination :paginator="$orders" />
+        @endif
+
+    </div>
+
+@endsection

resources/views/account/orders/show.blade.php

@@ -0,0 +1,158 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.orders.order_title', ['number' => $order->reference]))
+
+@php
+    $productLines = $order->lines->where('type', '!=', 'shipping');
+    $shippingLine = $order->lines->firstWhere('type', 'shipping');
+@endphp
+
+@section('account')
+
+    <div class="flex max-w-4xl flex-col gap-12">
+
+        <div class="flex flex-col gap-6">
+            <a href="{{ route('account.orders') }}" class="inline-flex items-center gap-2 self-start text-sm underline hover:no-underline">
+                <x-ui.icon name="arrow-left" :size="16" />
+                {{ __('storefront.orders.back') }}
+            </a>
+
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.orders.order_title', ['number' => $order->reference]) }}
+            </h1>
+        </div>
+
+        {{-- Summary --}}
+        <dl class="grid grid-cols-1 gap-6 border-y border-black py-6 sm:grid-cols-2 lg:grid-cols-4">
+            <div class="flex flex-col gap-1">
+                <dt class="text-sm text-neutral-500">{{ __('storefront.orders.date') }}</dt>
+                <dd>{{ $order->placed_at->format('d/m/Y') }}</dd>
+            </div>
+
+            <div class="flex flex-col gap-1">
+                <dt class="text-sm text-neutral-500">{{ __('storefront.orders.status') }}</dt>
+                <dd class="font-bold"><x-order-status :status="$order->status" /></dd>
+            </div>
+
+            @if ($paymentMethodName)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.payment') }}</dt>
+                    <dd>{{ $paymentMethodName }}</dd>
+                </div>
+            @endif
+
+            @if ($shippingLine)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.shipping_method') }}</dt>
+                    <dd>{{ $shippingLine->description }}</dd>
+                </div>
+            @endif
+
+            @foreach ($shipments as $shipment)
+                <div class="flex flex-col gap-1">
+                    <dt class="text-sm text-neutral-500">{{ __('storefront.orders.tracking') }}</dt>
+                    <dd class="break-all">{{ $shipment->tracking_reference }}</dd>
+                </div>
+            @endforeach
+        </dl>
+
+        {{-- Items + totals --}}
+        <section class="flex flex-col gap-6" aria-labelledby="order-items-heading">
+            <h2 id="order-items-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.orders.items') }}</h2>
+
+            <ul>
+                @foreach ($productLines as $line)
+                    <li class="flex gap-4 border-b border-black py-5 sm:gap-6">
+                        <div class="size-18 shrink-0 bg-neutral-300 sm:size-24">
+                            @if ($thumb = $line->purchasable?->getThumbnailImage())
+                                <img src="{{ $thumb }}" alt="" aria-hidden="true" width="96" height="96" loading="lazy" class="size-full object-cover">
+                            @endif
+                        </div>
+
+                        <div class="flex min-w-0 flex-1 flex-col gap-1">
+                            {{-- Linked only while the product still exists and is published;
+                                 otherwise the name stays plain text (the order keeps it). --}}
+                            @php($lineProduct = $line->purchasable?->product)
+                            <p class="font-bold">
+                                @if ($lineProduct?->status === 'published')
+                                    <a href="{{ route('product.show', ['id' => $lineProduct->id]) }}" class="underline hover:no-underline">{{ $line->description }}</a>
+                                @else
+                                    {{ $line->description }}
+                                @endif
+                                <span class="font-normal">&times; {{ $line->quantity }}</span>
+                            </p>
+
+                            @if ($line->option)
+                                <p class="text-sm text-neutral-500">{{ $line->option }}</p>
+                            @endif
+
+                            @include('checkout::partials.line-custom-fields', ['line' => $line])
+                        </div>
+
+                        <p class="shrink-0 font-bold">{{ $line->sub_total?->formatted() }}</p>
+                    </li>
+                @endforeach
+            </ul>
+
+            <dl class="ml-auto flex w-full max-w-sm flex-col gap-2">
+                <div class="flex justify-between gap-6">
+                    <dt>{{ __('storefront.orders.subtotal') }}</dt>
+                    <dd>{{ $order->sub_total?->formatted() }}</dd>
+                </div>
+
+                @if ($order->discount_total?->value > 0)
+                    <div class="flex justify-between gap-6">
+                        <dt>{{ __('storefront.orders.discount') }}</dt>
+                        <dd>&minus;{{ $order->discount_total->formatted() }}</dd>
+                    </div>
+                @endif
+
+                <div class="flex justify-between gap-6">
+                    <dt>{{ __('storefront.orders.shipping') }}</dt>
+                    <dd>{{ $order->shipping_total?->formatted() }}</dd>
+                </div>
+
+                @if ($order->tax_total?->value > 0)
+                    <div class="flex justify-between gap-6 text-sm text-neutral-500">
+                        <dt>{{ __('storefront.orders.tax') }}</dt>
+                        <dd>{{ $order->tax_total->formatted() }}</dd>
+                    </div>
+                @endif
+
+                <div class="flex justify-between gap-6 border-t border-black pt-3 font-display text-h4 font-extrabold">
+                    <dt>{{ __('storefront.orders.total') }}</dt>
+                    <dd>{{ $order->total?->formatted() }}</dd>
+                </div>
+            </dl>
+        </section>
+
+        {{-- Addresses --}}
+        <div class="grid grid-cols-1 gap-12 sm:grid-cols-2">
+            @foreach ([
+                'shipping_to' => $order->shippingAddress,
+                'billing' => $order->billingAddress,
+            ] as $heading => $address)
+                @if ($address)
+                    <section class="flex flex-col gap-4" aria-labelledby="order-{{ $heading }}-heading">
+                        <h2 id="order-{{ $heading }}-heading" class="font-display text-h4 font-extrabold">{{ __("storefront.orders.{$heading}") }}</h2>
+
+                        <address class="flex flex-col not-italic">
+                            <span>{{ trim($address->first_name.' '.$address->last_name) }}</span>
+                            @if ($address->company_name)<span>{{ $address->company_name }}</span>@endif
+                            @if ($address->tax_identifier)<span>{{ __('storefront.account.tax_identifier') }}: {{ $address->tax_identifier }}</span>@endif
+                            <span>{{ $address->line_one }}</span>
+                            @if ($address->line_two)<span>{{ $address->line_two }}</span>@endif
+                            <span>{{ trim($address->postcode.' '.$address->city) }}</span>
+                            @if ($address->state)
+                                <span>{{ Lang::has("core::states.{$address->state}") ? __("core::states.{$address->state}") : $address->state }}</span>
+                            @endif
+                            @if ($address->contact_phone)<span>{{ $address->contact_phone }}</span>@endif
+                        </address>
+                    </section>
+                @endif
+            @endforeach
+        </div>
+
+    </div>
+
+@endsection

resources/views/account/show.blade.php

@@ -0,0 +1,204 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_profile'))
+
+@php
+    $wantsInvoice = (bool) old('invoice', filled($customer?->company_name) || filled($customer?->tax_identifier));
+
+    $regionOptions = $regions->map(fn ($region) => [
+        'value' => $region->name,
+        'label' => Lang::has("core::states.{$region->name}") ? __("core::states.{$region->name}") : $region->name,
+    ])->all();
+
+@endphp
+
+@section('account')
+
+    <div class="flex max-w-2xl flex-col gap-16">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.account.nav_profile') }}
+            </h1>
+
+            <x-ui.status />
+        </div>
+
+        {{-- Email: the login itself, so it's changed through its own verified flow --}}
+        <section class="flex flex-col gap-6" aria-labelledby="account-email-heading">
+            <h2 id="account-email-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.email_heading') }}</h2>
+
+            <div class="flex flex-wrap items-center justify-between gap-x-8 gap-y-2 border-b border-black py-2">
+                <span class="break-all">{{ $user->email }}</span>
+                <a href="{{ route('account.email.edit') }}" class="text-sm underline hover:no-underline">
+                    {{ __('storefront.account.email_change') }}
+                </a>
+            </div>
+        </section>
+
+        <form method="POST" action="{{ route('account.update') }}" class="flex flex-col gap-16">
+            @csrf
+            @method('PUT')
+
+            {{-- Details --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-details-heading">
+                <h2 id="account-details-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.details_heading') }}</h2>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.first_name')" for="account-first-name" :error="$errors->first('first_name')">
+                        <x-ui.input id="account-first-name" name="first_name" autocomplete="given-name"
+                            :value="old('first_name', $customer?->first_name)"
+                            :aria-invalid="$errors->has('first_name') ? 'true' : null" :aria-describedby="$errors->has('first_name') ? 'account-first-name-error' : null" />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.last_name')" for="account-last-name" :error="$errors->first('last_name')">
+                        <x-ui.input id="account-last-name" name="last_name" autocomplete="family-name"
+                            :value="old('last_name', $customer?->last_name)"
+                            :aria-invalid="$errors->has('last_name') ? 'true' : null" :aria-describedby="$errors->has('last_name') ? 'account-last-name-error' : null" />
+                    </x-ui.field>
+                </div>
+
+                {{-- Invoice details, revealed by the checkbox (CSS :has(), no JS). Not
+                     `required` in HTML: a hidden required field would block submit, so
+                     the server requires them only when the box is ticked. --}}
+                <div class="group/invoice flex flex-col gap-8">
+                    <input type="hidden" name="invoice" value="0">
+                    <x-ui.checkbox
+                        id="account-invoice"
+                        name="invoice"
+                        :checked="$wantsInvoice"
+                        :label="__('storefront.account.invoice')"
+                        aria-controls="account-invoice-fields"
+                    />
+
+                    <div id="account-invoice-fields" class="hidden grid-cols-1 gap-8 sm:grid-cols-2 group-has-[#account-invoice:checked]/invoice:grid">
+                        <x-ui.field :label="__('storefront.account.company_name')" for="account-company" :error="$errors->first('company_name')">
+                            <x-ui.input id="account-company" name="company_name" autocomplete="organization"
+                                :value="old('company_name', $customer?->company_name)"
+                                :aria-invalid="$errors->has('company_name') ? 'true' : null" :aria-describedby="$errors->has('company_name') ? 'account-company-error' : null" />
+                        </x-ui.field>
+
+                        <x-ui.field :label="__('storefront.account.tax_identifier')" for="account-tax-id" :error="$errors->first('tax_identifier')">
+                            <x-ui.input id="account-tax-id" name="tax_identifier" inputmode="numeric" maxlength="9" pattern="[0-9]{9}"
+                                :value="old('tax_identifier', $customer?->tax_identifier)"
+                                :aria-invalid="$errors->has('tax_identifier') ? 'true' : null" :aria-describedby="$errors->has('tax_identifier') ? 'account-tax-id-error' : null" />
+                        </x-ui.field>
+                    </div>
+                </div>
+            </section>
+
+            {{-- Address: one, used as both shipping and billing default --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-address-heading">
+                <h2 id="account-address-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.address_heading') }}</h2>
+
+                <x-ui.field :label="__('storefront.account.line_one')" for="account-line-one" :error="$errors->first('line_one')">
+                    <x-ui.input id="account-line-one" name="line_one" autocomplete="address-line1"
+                        :value="old('line_one', $address?->line_one)"
+                        :aria-invalid="$errors->has('line_one') ? 'true' : null" :aria-describedby="$errors->has('line_one') ? 'account-line-one-error' : null" />
+                </x-ui.field>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.city')" for="account-city" :error="$errors->first('city')">
+                        <x-ui.input id="account-city" name="city" autocomplete="address-level2"
+                            :value="old('city', $address?->city)"
+                            :aria-invalid="$errors->has('city') ? 'true' : null" :aria-describedby="$errors->has('city') ? 'account-city-error' : null" />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.postcode')" for="account-postcode" :error="$errors->first('postcode')">
+                        <x-ui.input id="account-postcode" name="postcode" autocomplete="postal-code" inputmode="numeric"
+                            :value="old('postcode', $address?->postcode)"
+                            :aria-invalid="$errors->has('postcode') ? 'true' : null" :aria-describedby="$errors->has('postcode') ? 'account-postcode-error' : null" />
+                    </x-ui.field>
+                </div>
+
+                <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
+                    <x-ui.field :label="__('storefront.account.state')" for="account-state" :error="$errors->first('state')">
+                        <x-ui.select
+                            id="account-state"
+                            name="state"
+                            :block="true"
+                            :options="$regionOptions"
+                            :value="old('state', $address?->state)"
+                            :placeholder="__('storefront.account.state_placeholder')"
+                            :aria-invalid="$errors->has('state') ? 'true' : null"
+                            :aria-describedby="$errors->has('state') ? 'account-state-error' : null"
+                        />
+                    </x-ui.field>
+
+                    <x-ui.field :label="__('storefront.account.phone')" for="account-phone" :error="$errors->first('contact_phone')">
+                        <x-ui.input id="account-phone" name="contact_phone" type="tel" autocomplete="tel"
+                            :value="old('contact_phone', $address?->contact_phone)"
+                            :aria-invalid="$errors->has('contact_phone') ? 'true' : null" :aria-describedby="$errors->has('contact_phone') ? 'account-phone-error' : null" />
+                    </x-ui.field>
+                </div>
+            </section>
+
+            {{-- Standing opt-in for abandoned-cart reminders (explicit, off by
+                 default); checkout starts from it and can change it again. --}}
+            <section class="flex flex-col gap-8" aria-labelledby="account-emails-heading">
+                <h2 id="account-emails-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.emails_heading') }}</h2>
+
+                <div>
+                    <input type="hidden" name="recovery_consent" value="0">
+                    <x-ui.checkbox
+                        id="account-recovery-consent"
+                        name="recovery_consent"
+                        :checked="(bool) old('recovery_consent', data_get($customer, 'meta.recovery_consent'))"
+                        :label="__('storefront.account.recovery_consent')"
+                    />
+                </div>
+            </section>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.account.save') }}</x-ui.button>
+            </div>
+        </form>
+
+        {{-- Delete account --}}
+        <section class="flex flex-col gap-6 border-t border-black pt-12" aria-labelledby="account-delete-heading">
+            <h2 id="account-delete-heading" class="font-display text-h4 font-extrabold">{{ __('storefront.account.delete_heading') }}</h2>
+
+            <p>{{ __('storefront.account.delete_text') }}</p>
+
+            <div>
+                <x-ui.button
+                    variant="secondary"
+                    size="md"
+                    popovertarget="account-delete-dialog"
+                    aria-haspopup="dialog"
+                >{{ __('storefront.account.delete') }}</x-ui.button>
+            </div>
+
+            <div
+                id="account-delete-dialog"
+                popover
+                role="dialog"
+                aria-modal="true"
+                aria-labelledby="account-delete-dialog-heading"
+                class="m-auto w-[calc(100%-2rem)] max-w-lg border border-black bg-neutral-200 p-8 backdrop:bg-black/50"
+            >
+                <h3 id="account-delete-dialog-heading" class="mb-4 font-display text-h4 font-extrabold">
+                    {{ __('storefront.account.delete_confirm_heading') }}
+                </h3>
+
+                <p class="mb-8">{{ __('storefront.account.delete_confirm_text') }}</p>
+
+                <form method="POST" action="{{ route('account.destroy') }}" class="flex flex-wrap gap-4">
+                    @csrf
+                    @method('DELETE')
+
+                    <x-ui.button type="submit" size="md">{{ __('storefront.account.delete_confirm') }}</x-ui.button>
+
+                    <x-ui.button
+                        variant="secondary"
+                        size="md"
+                        popovertarget="account-delete-dialog"
+                        popovertargetaction="hide"
+                    >{{ __('storefront.account.delete_cancel') }}</x-ui.button>
+                </form>
+            </div>
+        </section>
+
+    </div>
+
+@endsection

resources/views/account/wishlist.blade.php

@@ -0,0 +1,17 @@
+@extends('layouts.account')
+
+@section('title', __('storefront.account.nav_wishlist'))
+
+@section('account')
+
+    <div class="flex flex-col gap-12">
+
+        <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.account.nav_wishlist') }}
+        </h1>
+
+        @include('wishlist.list')
+
+    </div>
+
+@endsection

resources/views/auth/login-code.blade.php

@@ -0,0 +1,67 @@
+@extends('layouts.app')
+
+@section('title', __('storefront.auth.enter_code'))
+
+@push('seo')
+    <meta name="robots" content="noindex, nofollow">
+@endpush
+
+@section('content')
+
+    <section class="mx-auto max-w-2xl px-4 py-20 sm:px-8 sm:py-32">
+
+        <h1 class="mb-6 font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.auth.enter_code') }}
+        </h1>
+
+        <p class="mb-12">
+            {{ __('storefront.auth.code_sent_to') }} <strong class="break-all">{{ $email }}</strong>
+        </p>
+
+        <x-ui.status class="mb-8" />
+
+        <form method="POST" action="{{ route('login.verify') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.code')"
+                for="login-code"
+                :required="true"
+                :error="$errors->first('code')"
+            >
+                <x-ui.input
+                    id="login-code"
+                    name="code"
+                    inputmode="numeric"
+                    autocomplete="one-time-code"
+                    pattern="[0-9]{6}"
+                    maxlength="6"
+                    :required="true"
+                    autofocus
+                    class="text-2xl font-bold tracking-[0.5em]"
+                    :aria-invalid="$errors->has('code') ? 'true' : null"
+                    :aria-describedby="$errors->has('code') ? 'login-code-error' : null"
+                />
+            </x-ui.field>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.auth.login') }}</x-ui.button>
+            </div>
+        </form>
+
+        <div class="mt-12 flex flex-wrap items-center gap-x-8 gap-y-4 text-sm">
+            <form method="POST" action="{{ route('login.resend') }}">
+                @csrf
+                <button type="submit" class="cursor-pointer underline hover:no-underline">
+                    {{ __('storefront.auth.resend_code') }}
+                </button>
+            </form>
+
+            <a href="{{ route('login') }}" class="underline hover:no-underline">
+                {{ __('storefront.auth.change_email') }}
+            </a>
+        </div>
+
+    </section>
+
+@endsection

resources/views/auth/login.blade.php

@@ -0,0 +1,62 @@
+@extends('layouts.app')
+
+@section('title', __('storefront.auth.login'))
+
+@push('seo')
+    <meta name="robots" content="noindex, follow">
+@endpush
+
+@section('content')
+
+    <section class="mx-auto max-w-2xl px-4 py-20 sm:px-8 sm:py-32">
+
+        <h1 class="mb-6 font-display text-h3 font-black tracking-tight sm:text-h2">
+            {{ __('storefront.auth.login') }}
+        </h1>
+
+        {{-- Unescaped: the label holds a <br /> (edited in Filament › Language Lines, staff only). --}}
+        <p class="mb-12">{!! __('storefront.auth.login_intro') !!}</p>
+
+        {{-- e.g. "account deletion scheduled", after AccountController::destroy() --}}
+        <x-ui.status class="mb-12" />
+
+        <form method="POST" action="{{ route('login.send') }}" class="flex flex-col gap-8">
+            @csrf
+
+            <x-ui.field
+                :label="__('storefront.auth.email')"
+                for="login-email"
+                :required="true"
+                :error="$errors->first('email')"
+            >
+                <x-ui.input
+                    id="login-email"
+                    name="email"
+                    type="email"
+                    autocomplete="email"
+                    :value="old('email')"
+                    :required="true"
+                    autofocus
+                    :aria-invalid="$errors->has('email') ? 'true' : null"
+                    :aria-describedby="$errors->has('email') ? 'login-email-error' : null"
+                />
+            </x-ui.field>
+
+            {{-- Shown to everyone. Recording acceptance for new accounts is a
+                 boboko-core task (UserOtpService). Unescaped: the label holds the
+                 two links (Language Lines, staff only). --}}
+            <p class="text-sm text-neutral-500 [&_a]:underline [&_a:hover]:no-underline">
+                {!! __('storefront.auth.terms_notice', [
+                    'terms' => route('legal.terms'),
+                    'privacy' => route('legal.privacy'),
+                ]) !!}
+            </p>
+
+            <div>
+                <x-ui.button type="submit">{{ __('storefront.auth.send_code') }}</x-ui.button>
+            </div>
+        </form>
+
+    </section>
+
+@endsection

resources/views/category/show.blade.php

@@ -14,7 +14,8 @@
 @endpush
 
 @section('content')
-    <div class="max-w-5xl mx-auto pt-26 pb-12">
+    {{-- <div class="max-w-5xl mx-auto pt-26 pb-12"> --}}
+    <div class="max-w-7xl mx-auto px-4 sm:px-8 pt-26 pb-12">
 
         <div class="flex items-end justify-between gap-6 flex-wrap mb-16">
             <h1 class="font-medium text-h2">{{ $collection['name'] }}</h1>

resources/views/checkout/components/add-to-cart.blade.php

@@ -39,4 +39,6 @@
     @endif
 
     {{ $slot }}
+
+    <p class="bbk-add-to-cart-error" data-bbk-add-to-cart-target="error" hidden role="alert"></p>
 </form>

resources/views/checkout/confirmation.blade.php

@@ -11,19 +11,71 @@
     <div class="bbk-confirmation">
         <h1 class="bbk-confirmation-heading">{{ __('checkout.page.confirmation_heading') }}</h1>
 
-        <p class="bbk-confirmation-ref">
-            {{ __('checkout.page.confirmation_order_number') }}: <strong>{{ $order->reference }}</strong>
-        </p>
+        <dl class="bbk-confirmation-meta">
+            <div class="bbk-confirmation-meta-row">
+                <dt>{{ __('checkout.page.confirmation_order_number') }}</dt>
+                <dd>{{ $order->reference }}</dd>
+            </div>
+
+            @if ($order->billingAddress?->contact_email)
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.email_label') }}</dt>
+                    <dd>{{ $order->billingAddress->contact_email }}</dd>
+                </div>
+            @endif
+
+            @if ($paymentMethodName)
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.payment_heading') }}</dt>
+                    <dd>{{ $paymentMethodName }}</dd>
+                </div>
+            @endif
+
+            @if ($shippingLine = $order->lines->firstWhere('type', 'shipping'))
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.shipping_method_heading') }}</dt>
+                    <dd>{{ $shippingLine->description }}</dd>
+                </div>
+            @endif
+        </dl>
+
         <p class="bbk-checkout-note">{{ __('checkout.page.confirmation_email_note') }}</p>
 
+        {{-- Guests: logging in with the order's email attaches it to an account
+             (boboko-core's Modules\Core\Customer\Listeners\ClaimGuestOrdersOnLogin),
+             so it shows in their history. --}}
+        @guest
+            @if ($loginRoute = config('checkout.login_route'))
+                <p class="bbk-checkout-note">
+                    {{ __('checkout.page.confirmation_login_hint') }}
+                    <a href="{{ route($loginRoute) }}">{{ __('checkout.page.login_link') }}</a>
+                </p>
+            @endif
+        @endguest
+
         <div class="bbk-confirmation-body">
             <div class="bbk-confirmation-lines">
                 @foreach ($order->lines->where('type', '!=', 'shipping') as $line)
                     <div class="bbk-confirmation-line">
-                        <span class="bbk-confirmation-line-name">
-                            {{ $line->description }}
-                            <span class="bbk-confirmation-line-qty">&times; {{ $line->quantity }}</span>
-                        </span>
+                        <div class="bbk-cart-item-media">
+                            @if ($thumb = $line->purchasable?->getThumbnailImage())
+                                <img src="{{ $thumb }}" alt="{{ $line->description }}" width="72" height="72" loading="lazy">
+                            @endif
+                        </div>
+
+                        <div class="bbk-confirmation-line-detail">
+                            <span class="bbk-confirmation-line-name">
+                                {{ $line->description }}
+                                <span class="bbk-confirmation-line-qty">&times; {{ $line->quantity }}</span>
+                            </span>
+
+                            @if ($line->option)
+                                <p class="bbk-cart-item-variant">{{ $line->option }}</p>
+                            @endif
+
+                            @include('checkout::partials.line-custom-fields', ['line' => $line])
+                        </div>
+
                         <span class="bbk-confirmation-line-total">{{ $line->sub_total?->formatted() }}</span>
                     </div>
                 @endforeach
@@ -76,9 +128,5 @@
                 @endif
             </div>
         </div>
-
-        <a class="bbk-checkout-continue bbk-confirmation-continue" href="{{ route('products', app()->getLocale()) }}">
-            {{ __('checkout.page.confirmation_continue') }}
-        </a>
     </div>
 @endsection

resources/views/checkout/drawer.blade.php

@@ -5,7 +5,7 @@
     .bbk-* classes from its own stylesheet. No host components, no Tailwind.
 --}}
 <div class="bbk-cart" data-controller="bbk-cart" hidden>
-    <div class="bbk-cart-backdrop" data-action="bbk-cart#close"></div>
+    <div class="bbk-cart-backdrop" data-action="click->bbk-cart#close"></div>
 
     <aside
         class="bbk-cart-panel"
@@ -24,6 +24,8 @@ class="bbk-cart-dismiss"
             >&times;</button>
         </header>
 
+        @include('checkout::partials.cart-error')
+
         <div class="bbk-cart-panel-body" data-bbk-cart-target="body" aria-live="polite">
             @include('checkout::partials.cart-body')
         </div>

resources/views/checkout/page.blade.php

@@ -38,73 +38,51 @@ class="bbk-checkout-main"
                 data-bbk-payment-processing-slow-value="{{ __('checkout.page.payment_processing_slow') }}"
             >
 
-                {{-- Contact --}}
+                {{-- Contact. Logged in: the order email is the account's (forced
+                     server-side in saveAddress()), so there's no field. Guests type
+                     their email, plus a login link when config('checkout.login_route')
+                     is set; the storefront's login page sends them back here and Lunar
+                     merges the guest cart into the account. --}}
+                @php($loginRoute = config('checkout.login_route'))
                 <section class="bbk-checkout-section">
-                    <div
-                        class="bbk-checkout-tabs"
-                        role="tablist"
-                        aria-label="{{ __('checkout.page.contact_heading') }}"
-                    >
-                        <button
-                            type="button"
-                            class="bbk-checkout-tab"
-                            role="tab"
-                            aria-selected="true"
-                            data-bbk-checkout-form-target="guestTab"
-                            data-action="bbk-checkout-form#showGuest"
-                        >{{ __('checkout.page.guest_tab') }}</button>
+                    @auth
+                        <p class="bbk-checkout-logged-in">
+                            {{ __('checkout.page.logged_in_as') }} <strong>{{ auth()->user()->email }}</strong>
+                        </p>
+                    @else
+                        @if ($loginRoute)
+                            <p class="bbk-checkout-login-prompt">
+                                {{ __('checkout.page.login_prompt') }}
+                                <a href="{{ route($loginRoute, ['redirect' => route('checkout.show', app()->getLocale(), false)]) }}">{{ __('checkout.page.login_link') }}</a>
+                            </p>
+                        @endif
 
-                        <button
-                            type="button"
-                            class="bbk-checkout-tab"
-                            role="tab"
-                            aria-selected="false"
-                            data-bbk-checkout-form-target="loginTab"
-                            data-action="bbk-checkout-form#showLogin"
-                        >{{ __('checkout.page.login_tab') }}</button>
+                        <x-checkout::field
+                            name="contact_email"
+                            label="{{ __('checkout.page.email_label') }}"
+                            type="email"
+                            :value="$shippingAddress?->contact_email ?? $billingAddress?->contact_email"
+                            required
+                            form="bbk-address-form"
+                        />
+                    @endauth
 
-                        <div class="bbk-checkout-tab-panel" role="tabpanel" data-bbk-checkout-form-target="guestPanel">
-                            <x-checkout::field
-                                name="contact_email"
-                                label="{{ __('checkout.page.email_label') }}"
-                                type="email"
-                                :value="$shippingAddress?->contact_email ?? $billingAddress?->contact_email"
-                                required
-                                form="bbk-address-form"
-                            />
-
-                            {{-- Abandoned-cart-recovery opt-in. Optional, unticked, never
-                                 required — direct marketing under ePrivacy (GR L. 3471/2006
-                                 art. 11), so it needs an explicit opt-in and checkout can't be
-                                 gated on it. Narrow scope by design (boboko-core's
-                                 setRecoveryConsent) — a general newsletter opt-in, if wanted,
-                                 is a separate checkbox. --}}
-                            <label class="bbk-checkbox bbk-checkbox--stacked">
-                                <input
-                                    type="checkbox"
-                                    name="recovery_consent"
-                                    value="1"
-                                    form="bbk-address-form"
-                                    {{ old('recovery_consent', data_get($cart, 'meta.recovery_consent')) ? 'checked' : '' }}
-                                >
-                                {{ __('checkout.page.recovery_consent') }}
-                            </label>
-                        </div>
-
-                        {{-- Not wired yet — Modules\Core\Auth\Services\UserOtpService exists
-                             (email + one-time code, passwordless) but nothing in the storefront
-                             calls it yet. UI placeholder only; see project notes. --}}
-                        <div class="bbk-checkout-tab-panel" role="tabpanel" hidden data-bbk-checkout-form-target="loginPanel">
-                            <div class="bbk-field">
-                                <label class="bbk-field-label" for="bbk-login-email">{{ __('checkout.page.login_email_label') }}</label>
-                                <input type="email" id="bbk-login-email" class="bbk-field-input" disabled>
-                            </div>
-                            <button type="button" class="bbk-checkout-continue" disabled>
-                                {{ __('checkout.page.send_code') }}
-                            </button>
-                            <p class="bbk-checkout-note">{{ __('checkout.page.login_coming_soon') }}</p>
-                        </div>
-                    </div>
+                    {{-- Abandoned-cart-recovery opt-in. Optional, unticked, never
+                         required — direct marketing under ePrivacy (GR L. 3471/2006
+                         art. 11), so it needs an explicit opt-in and checkout can't be
+                         gated on it. Narrow scope by design (boboko-core's
+                         setRecoveryConsent) — a general newsletter opt-in, if wanted,
+                         is a separate checkbox. --}}
+                    <label class="bbk-checkbox bbk-checkbox--stacked">
+                        <input
+                            type="checkbox"
+                            name="recovery_consent"
+                            value="1"
+                            form="bbk-address-form"
+                            {{ old('recovery_consent', data_get($cart, 'meta.recovery_consent')) ? 'checked' : '' }}
+                        >
+                        {{ __('checkout.page.recovery_consent') }}
+                    </label>
                 </section>
 
                 {{-- Autosaves — no submit button. Any `change` inside .bbk-checkout-main
@@ -128,13 +106,28 @@ class="bbk-checkout-tab"
                             <x-checkout::field name="billing_last_name" label="{{ __('checkout.page.last_name') }}" :value="$billingAddress?->last_name" required />
                         </div>
 
-                        <div class="bbk-field-row">
-                            <x-checkout::field name="billing_company_name" label="{{ __('checkout.page.company_name') }}" :value="$billingAddress?->company_name" />
-                            <x-checkout::field name="billing_tax_identifier" label="{{ __('checkout.page.tax_identifier') }}" :value="$billingAddress?->tax_identifier" />
+                        {{-- Company/ΑΦΜ only when an invoice is wanted. Revealed by CSS
+                             (:has on the checkbox), saved/cleared by saveAddress(), and
+                             required at place-order. --}}
+                        <div class="bbk-invoice">
+                            <label class="bbk-checkbox">
+                                <input
+                                    type="checkbox"
+                                    name="wants_invoice"
+                                    value="1"
+                                    aria-controls="bbk-invoice-fields"
+                                    @checked($wantsInvoice)
+                                >
+                                {{ __('checkout.page.wants_invoice') }}
+                            </label>
+
+                            <div class="bbk-field-row bbk-invoice-fields" id="bbk-invoice-fields">
+                                <x-checkout::field name="billing_company_name" label="{{ __('checkout.page.company_name') }}" :value="$billingAddress?->company_name" />
+                                <x-checkout::field name="billing_tax_identifier" label="{{ __('checkout.page.tax_identifier') }}" :value="$billingAddress?->tax_identifier" />
+                            </div>
                         </div>
 
                         <x-checkout::field name="billing_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$billingAddress?->line_one" required />
-                        <x-checkout::field name="billing_line_two" label="{{ __('checkout.page.address_line_two') }}" :value="$billingAddress?->line_two" />
 
                         <div class="bbk-field-row">
                             <x-checkout::field name="billing_city" label="{{ __('checkout.page.city') }}" :value="$billingAddress?->city" required />
@@ -174,10 +167,7 @@ class="bbk-checkout-tab"
                                 <x-checkout::field name="shipping_last_name" label="{{ __('checkout.page.last_name') }}" :value="$shippingAddress?->last_name" required />
                             </div>
 
-                            <x-checkout::field name="shipping_company_name" label="{{ __('checkout.page.company_name') }}" :value="$shippingAddress?->company_name" />
-
                             <x-checkout::field name="shipping_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$shippingAddress?->line_one" required />
-                            <x-checkout::field name="shipping_line_two" label="{{ __('checkout.page.address_line_two') }}" :value="$shippingAddress?->line_two" />
 
                             <div class="bbk-field-row">
                                 <x-checkout::field name="shipping_city" label="{{ __('checkout.page.city') }}" :value="$shippingAddress?->city" required />
@@ -260,6 +250,7 @@ class="bbk-checkout-status"
                         class="bbk-checkout-continue"
                         data-bbk-payment-target="submit"
                         data-action="bbk-payment#placeOrder"
+                        @disabled($lines->isEmpty())
                     >
                         {{ __('checkout.page.place_order') }}
                     </button>
@@ -277,6 +268,7 @@ class="bbk-checkout-continue"
             <aside class="bbk-checkout-aside">
                 <div class="bbk-checkout-summary" data-controller="bbk-cart">
                     <h2 class="bbk-checkout-summary-heading">{{ __('checkout.page.order_summary_heading') }}</h2>
+                    @include('checkout::partials.cart-error')
                     <div data-bbk-cart-target="body" aria-live="polite">
                         @include('checkout::partials.cart-body')
                     </div>

resources/views/checkout/partials/cart-error.blade.php

@@ -0,0 +1,9 @@
+{{--
+    Shared error slot for any host wrapping cart-body in a bbk-cart controller
+    instance (the drawer, and the checkout page's own order summary) —
+    bbk-cart-controller.js#showError() writes into whichever one is present.
+    Without this element in a given host, a rejected quantity update (e.g.
+    over stock) still gets rejected server-side, but the shopper never sees
+    why.
+--}}
+<p class="bbk-cart-error" data-bbk-cart-target="error" hidden role="alert"></p>

resources/views/checkout/partials/cart-line.blade.php

@@ -7,18 +7,43 @@
     $variant = $line->purchasable;
     $product = $variant?->product;
     $name = $product?->translateAttribute('name') ?? $variant?->sku ?? '—';
-    $thumb = $product?->getThumbnailImage() ?: null;
+    // The variant's own image (falls back to the product's thumbnail
+    // internally — see ProductVariant::getThumbnail()) — the specific option
+    // the shopper picked, not just the product in general.
+    $thumb = $variant?->getThumbnailImage() ?: null;
+    $variantLabel = $variant?->getOption();
+    // Not routed through checkout::'s own locale-explicit convention — this
+    // is a storefront route, so it follows the storefront's own (implicit
+    // locale) call shape, same as App\Catalog\ProductCard. Carries the
+    // variant id along so the product page can restore the same option the
+    // shopper actually has in their cart, not just default to the first one
+    // (see product-form-controller.js reading ?variant= on connect()).
+    $productUrl = $product ? route('product.show', ['id' => $product->id, 'variant' => $variant?->id]) : null;
 @endphp
 
 <li class="bbk-cart-item" data-bbk-line-id="{{ $line->id }}">
     <div class="bbk-cart-item-media">
         @if ($thumb)
-            <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
+            @if ($productUrl)
+                <a href="{{ $productUrl }}" aria-hidden="true" tabindex="-1">
+                    <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
+                </a>
+            @else
+                <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
+            @endif
         @endif
     </div>
 
     <div class="bbk-cart-item-detail">
-        <p class="bbk-cart-item-title">{{ $name }}</p>
+        @if ($productUrl)
+            <a href="{{ $productUrl }}" class="bbk-cart-item-title">{{ $name }}</a>
+        @else
+            <p class="bbk-cart-item-title">{{ $name }}</p>
+        @endif
+        @if ($variantLabel)
+            <p class="bbk-cart-item-variant">{{ $variantLabel }}</p>
+        @endif
+        @include('checkout::partials.line-custom-fields', ['line' => $line])
         <p class="bbk-cart-item-unit">{{ $line->unitPrice?->formatted() }}</p>
 
         <form
@@ -44,6 +69,7 @@ class="bbk-cart-qty-btn"
                 inputmode="numeric"
                 class="bbk-cart-qty-input"
                 data-action="change->bbk-cart#submit"
+                data-bbk-cart-confirmed-quantity="{{ $line->quantity }}"
                 aria-label="{{ __('checkout.cart.quantity') }}"
             >
 

resources/views/checkout/partials/line-custom-fields.blade.php

@@ -0,0 +1,49 @@
+{{--
+    @include('checkout::partials.line-custom-fields', ['line' => $line])
+
+    A cart or order line's custom-field answers (meta.custom_fields, written by
+    CartController::customFieldsMeta()). A file answer only carries a File id
+    (Modules\Core\File\Models\File is the source of truth for name/mime/disk/
+    path — never duplicated into meta), resolved here and linked through
+    boboko-core's own signed download route (files.download), minted fresh on
+    every render, with a thumbnail when the browser can display the format
+    (HEIC can't be shown outside Safari, so it gets the name only).
+--}}
+@php
+    $fields = $line->meta['custom_fields'] ?? [];
+    $previewable = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+@endphp
+
+@if (! empty($fields))
+    <dl class="bbk-line-fields">
+        @foreach ($fields as $field)
+            <div class="bbk-line-field">
+                <dt>{{ $field['label'] }}</dt>
+                <dd>
+                    @if ($field['type'] === 'file')
+                        @php
+                            $file = \Modules\Core\File\Models\File::find($field['file_id'] ?? null);
+                        @endphp
+                        @if ($file)
+                            @php
+                                $fileUrl = \Illuminate\Support\Facades\URL::temporarySignedRoute(
+                                    'files.download',
+                                    now()->addHours(2),
+                                    ['file' => $file->id],
+                                );
+                            @endphp
+                            <a href="{{ $fileUrl }}" class="bbk-line-field-file" target="_blank" rel="noopener">
+                                @if (in_array($file->mime, $previewable, true))
+                                    <img src="{{ $fileUrl }}" alt="" width="40" height="40" loading="lazy">
+                                @endif
+                                <span>{{ $file->original_name }}</span>
+                            </a>
+                        @endif
+                    @else
+                        {{ $field['value'] }}
+                    @endif
+                </dd>
+            </div>
+        @endforeach
+    </dl>
+@endif

resources/views/components/header.blade.php

@@ -41,6 +41,25 @@
                 </a>
             @endforeach
 
+            {{-- Wishlist — the account page, or the cookie-based guest page --}}
+            <a
+                href="{{ auth()->check() ? route('account.wishlist') : route('wishlist') }}"
+                class="flex items-center justify-center w-10 h-10 hover:opacity-70 transition-opacity"
+                aria-label="{{ __('storefront.account.nav_wishlist') }}"
+                @if (request()->routeIs('account.wishlist', 'wishlist')) aria-current="page" @endif
+            >
+                <x-ui.icon name="heart" :size="40" />
+            </a>
+
+            {{-- Account — the account page, or login for guests --}}
+            <a
+                href="{{ auth()->check() ? route('account') : route('login') }}"
+                class="flex items-center justify-center w-10 h-10 hover:opacity-70 transition-opacity"
+                aria-label="{{ auth()->check() ? __('storefront.nav.account') : __('storefront.auth.login') }}"
+            >
+                <x-ui.icon name="user" :size="40" />
+            </a>
+
             {{-- Cart — opens the checkout module's drawer, no separate cart page --}}
             <button
                 type="button"

resources/views/components/order-status.blade.php

@@ -0,0 +1,13 @@
+{{--
+    An order status as text, e.g. "Σε επεξεργασία". Translated through
+    storefront.order_status.{status}, falling back to Lunar's own (English)
+    label from config('lunar.orders.statuses') when that key doesn't exist.
+--}}
+@props(['status'])
+
+@php
+    $key = "storefront.order_status.{$status}";
+    $label = Lang::has($key) ? __($key) : config("lunar.orders.statuses.{$status}.label", $status);
+@endphp
+
+<span {{ $attributes }}>{{ $label }}</span>

resources/views/components/product-custom-fields.blade.php

@@ -0,0 +1,77 @@
+{{--
+    <x-product-custom-fields :fields="$product['custom_fields']" />
+
+    The product's custom fields (boboko-core's Product::$custom_fields), rendered
+    inside the add-to-cart <form> so their values travel with it as
+    custom_fields[key]. text → input, textarea → textarea, file → photo upload.
+
+    A photo is uploaded as soon as it's picked (custom-field-upload-controller.js)
+    and only the resulting File row's id (boboko-core's Modules\Core\File\
+    Models\File) is submitted with the form — the file input itself has no
+    name. It still carries `required`, so the browser's own validation blocks
+    add-to-cart until a photo is picked, and the controller marks it invalid
+    (setCustomValidity) while the upload is in flight.
+--}}
+@props(['fields' => []])
+
+@use('App\Http\Controllers\CustomFieldUploadController')
+
+<div class="flex flex-col gap-6">
+    @foreach ($fields as $field)
+        @php
+            $id = 'custom-field-'.$field['key'];
+            $name = 'custom_fields['.$field['key'].']';
+            $required = (bool) ($field['required'] ?? false);
+        @endphp
+
+        @switch($field['type'])
+            @case('textarea')
+                <x-ui.field :label="$field['label']" :for="$id" :required="$required">
+                    <x-ui.textarea :id="$id" :name="$name" :required="$required" :rows="4" maxlength="2000" />
+                </x-ui.field>
+                @break
+
+            @case('file')
+                <x-ui.field
+                    :label="$field['label']"
+                    :for="$id"
+                    :required="$required"
+                    :description="__('storefront.product.custom_field_photo_hint', ['size' => CustomFieldUploadController::MAX_KILOBYTES / 1024])"
+                    data-controller="custom-field-upload"
+                    data-custom-field-upload-url-value="{{ route('custom-field-upload.store') }}"
+                    data-custom-field-upload-label-value="{{ $field['label'] }}"
+                    data-custom-field-upload-uploading-message-value="{{ __('storefront.product.custom_field_uploading') }}"
+                    data-custom-field-upload-failed-message-value="{{ __('storefront.product.custom_field_upload_failed') }}"
+                >
+                    <input type="hidden" name="{{ $name }}" data-custom-field-upload-target="reference">
+
+                    <x-ui.file-input
+                        :id="$id"
+                        :accept="CustomFieldUploadController::accept()"
+                        :required="$required"
+                        aria-describedby="{{ $id }}-description {{ $id }}-error"
+                        data-custom-field-upload-target="file"
+                        data-action="change->custom-field-upload#upload"
+                    />
+
+                    <img
+                        alt=""
+                        width="96"
+                        height="96"
+                        hidden
+                        class="w-24 h-24 object-cover border border-black"
+                        data-custom-field-upload-target="preview"
+                        data-action="error->custom-field-upload#hidePreview"
+                    >
+
+                    <p id="{{ $id }}-error" class="text-sm text-red-600" role="alert" hidden data-custom-field-upload-target="error"></p>
+                </x-ui.field>
+                @break
+
+            @default
+                <x-ui.field :label="$field['label']" :for="$id" :required="$required">
+                    <x-ui.input :id="$id" :name="$name" :required="$required" maxlength="255" />
+                </x-ui.field>
+        @endswitch
+    @endforeach
+</div>

resources/views/components/product-grid.blade.php

@@ -24,6 +24,8 @@
                 :price="$product['price'] ?? null"
                 :image="$product['image'] ?? null"
                 :href="$product['href'] ?? '#'"
+                :variant-id="$product['variantId'] ?? null"
+                :has-custom-fields="$product['hasCustomFields'] ?? false"
             />
         @endforeach
     </div>

resources/views/components/review-card.blade.php

@@ -1,26 +1,39 @@
 @props(['review'])
 
-<article class="flex flex-col gap-3 py-6 border-b border-black last:border-0">
+<article class="flex flex-col gap-3 py-6">
 
-    <div class="flex items-center justify-between gap-4">
-        <div class="flex items-center gap-4">
-            <x-reviews-stars :rating="$review['rating']" :size="18" />
-            <span class="font-bold">
-                {{ $review['name'] ?? 'Ανώνυμος' }}
-            </span>
-        </div>
-        <time class="text-sm text-neutral-500 shrink-0">{{ $review['date'] }}</time>
+    <x-reviews-stars :rating="$review['rating']" :size="23" />
+
+    <div class="flex items-end gap-4">
+        <span class="text-2xl font-bold leading-none">
+            {{ $review['name'] ?? 'Ανώνυμος' }}
+        </span>
+        <time class="text-sm text-neutral-500 shrink-0 leading-none pb-0.5">{{ $review['date'] }}</time>
     </div>
 
     <p class="leading-relaxed">{{ $review['text'] }}</p>
 
     @if (!empty($review['image']))
         <div class="mt-1">
-            <img
-                src="{{ $review['image'] }}"
-                alt="Φωτογραφία από τον αγοραστή"
-                class="w-24 h-24 object-cover border border-black"
-            >
+            <a href="{{ $review['image'] }}" target="_blank" rel="noopener noreferrer">
+                <img
+                    src="{{ $review['image'] }}"
+                    alt="Φωτογραφία από τον αγοραστή"
+                    class="w-24 h-24 object-cover border border-black"
+                >
+            </a>
+        </div>
+    @endif
+
+    @if (!empty($review['reply']))
+        <div class="mt-2 pl-4 border-l-2 border-neutral-300 flex flex-col gap-1">
+            <p class="text-sm font-bold">
+                {{ __('storefront.review.reply') }}
+                @if (!empty($review['replyDate']))
+                    <span class="font-normal text-neutral-500">— {{ $review['replyDate'] }}</span>
+                @endif
+            </p>
+            <p class="leading-relaxed">{{ $review['reply'] }}</p>
         </div>
     @endif
 

resources/views/components/review-form.blade.php

@@ -1,23 +1,28 @@
 @props(['product'])
 
+@php $oldRating = (int) old('rating', 0); @endphp
+
 <form
     method="POST"
-    action="#"
+    action="{{ route('product.reviews.store', ['locale' => app()->getLocale(), 'product' => $product['id']]) }}"
     class="flex flex-col gap-8 mt-10"
+    data-controller="star-rating"
+    data-star-rating-rating-value="{{ $oldRating }}"
+    data-action="submit->star-rating#validate"
 >
     @csrf
 
     {{-- Rating --}}
-    <x-ui.field :label="__('storefront.review.rating')" for="rating" :required="true">
+    <x-ui.field :label="__('storefront.review.rating')" for="rating" :required="true" :error="$errors->first('rating')">
         <div
             id="rating"
-            data-controller="star-rating"
             class="flex items-center gap-1.5 text-brand"
             role="radiogroup"
             aria-label="{{ __('storefront.review.rating') }}"
             aria-required="true"
+            aria-describedby="rating-client-error"
         >
-            <input type="hidden" name="rating" value="0" data-star-rating-target="input">
+            <input type="hidden" name="rating" value="{{ $oldRating }}" data-star-rating-target="input">
             @for($i = 1; $i <= 5; $i++)
                 <button
                     type="button"
@@ -25,7 +30,7 @@ class="flex items-center gap-1.5 text-brand"
                     data-value="{{ $i }}"
                     data-action="click->star-rating#select mouseenter->star-rating#hover mouseleave->star-rating#leave"
                     aria-label="{{ trans_choice('storefront.review.stars_count', $i, ['count' => $i]) }}"
-                    aria-pressed="false"
+                    aria-pressed="{{ $i === $oldRating ? 'true' : 'false' }}"
                 >
                     <svg
                         xmlns="http://www.w3.org/2000/svg"
@@ -41,24 +46,21 @@ class="w-6 h-6"
                 </button>
             @endfor
         </div>
+        <p id="rating-client-error" data-star-rating-target="error" class="text-sm text-red-600" role="alert" hidden>{{ __('storefront.review.rating_required') }}</p>
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.write_label')" for="review-content" :required="true">
-        <x-ui.textarea id="review-content" name="content" :required="true" />
+    <x-ui.field :label="__('storefront.review.write_label')" for="review-content" :required="true" :error="$errors->first('content')">
+        <x-ui.textarea id="review-content" name="content" :required="true" :rows="6">{{ old('content') }}</x-ui.textarea>
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.name')" for="review-name" :labelDescription="__('storefront.review.name_optional')">
-        <x-ui.input id="review-name" name="name" autocomplete="name" />
+    <x-ui.field :label="__('storefront.review.name')" for="review-name" :labelDescription="__('storefront.review.name_optional')" :error="$errors->first('name')">
+        <x-ui.input id="review-name" name="name" autocomplete="name" :value="old('name')" />
     </x-ui.field>
 
-    <x-ui.field :label="__('storefront.review.email')" for="review-email" :required="true" :labelDescription="__('storefront.review.email_not_published')">
-        <x-ui.input id="review-email" name="email" type="email" :required="true" autocomplete="email" />
+    <x-ui.field :label="__('storefront.review.email')" for="review-email" :required="true" :labelDescription="__('storefront.review.email_not_published')" :error="$errors->first('email')">
+        <x-ui.input id="review-email" name="email" type="email" :required="true" autocomplete="email" :value="old('email')" />
     </x-ui.field>
 
-    <x-ui.checkbox id="review-save-info" name="save_info" >
-        <span class="text-sm">{{ __('storefront.review.save_info') }}</span>
-    </x-ui.checkbox>
-
     <div>
         <x-ui.button type="submit">{{ __('storefront.review.submit') }}</x-ui.button>
     </div>

resources/views/components/reviews-stars.blade.php

@@ -3,6 +3,7 @@
     'count'     => 0,
     'showCount' => false,
     'size'      => 24,
+    'linkable'  => false,
 ])
 
 <div class="flex items-center gap-3" {{ $attributes }}>
@@ -28,9 +29,17 @@ class="flex items-center gap-1.5 text-brand"
     </div>
 
     @if ($showCount && $count > 0)
-        <span class="text-sm text-neutral-500">
-            ({{ trans_choice('storefront.customer_reviews', $count, ['count' => $count]) }})
-        </span>
+        @php $countText = '(' . trans_choice('storefront.customer_reviews', $count, ['count' => $count]) . ')'; @endphp
+        @if ($linkable)
+            <button
+                type="button"
+                data-action="click->tab-link#activate"
+                class="text-sm text-neutral-500 hover:underline cursor-pointer"
+                aria-controls="tab-panel-reviews"
+            >{{ $countText }}</button>
+        @else
+            <span class="text-sm text-neutral-500">{{ $countText }}</span>
+        @endif
     @endif
 
 </div>

resources/views/components/ui/button.blade.php

@@ -3,6 +3,7 @@
     'href'     => null,
     'type'     => 'button',
     'size'     => 'lg',
+    'variant'  => 'primary',
     'position' => 'relative',
 ])
 
@@ -15,6 +16,16 @@
         default => 'py-5 px-[46px] text-[19px]',
     };
 
+    // 'primary' is the CTA look (offset-shadow via .btn-primary's ::before/
+    // ::after, italic, uppercase). 'secondary' is a plain bordered toggle —
+    // no shadow layers, fills solid on hover/aria-pressed=true instead, used
+    // for option pickers (see x-ui.option-buttons) and anywhere else a
+    // secondary/toggle action shouldn't compete visually with the CTA.
+    $variantClasses = match($variant) {
+        'secondary' => 'font-semibold hover:bg-black hover:text-neutral-200 aria-pressed:bg-black aria-pressed:text-neutral-200 transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-black',
+        default     => 'btn-primary font-bold italic uppercase',
+    };
+
     // $position defaults to 'relative' (needed so the ::before/::after layers
     // in .btn-primary position against the button itself), but callers that
     // need to place the button absolutely (e.g. a hover-reveal CTA over a
@@ -22,7 +33,7 @@
     // "absolute" via the class prop — Tailwind's generated stylesheet always
     // orders the "relative" utility after "absolute", so on a class clash
     // "relative" silently wins and the button never actually gets positioned.
-    $class = 'btn-primary '.$position.' isolate inline-flex items-center justify-center border border-black font-display font-bold italic text-black cursor-pointer no-underline uppercase ' . $sizeClasses;
+    $class = trim($position.' isolate inline-flex items-center justify-center border border-black text-black cursor-pointer no-underline '.$variantClasses.' '.$sizeClasses);
 
     $attrs = $href
         ? $attributes->merge(['href' => $href, 'class' => $class])

resources/views/components/ui/color-swatch.blade.php

@@ -1,12 +1,11 @@
-{{-- $variants: array of Modules\Core\Catalog\Services\ProductIndexer's mapVariant()
-     shape (id, options: [{option, value, meta}], ...) — plain arrays, not Eloquent
-     models, since this is fed from Modules\Core\Catalog\Services\ProductService. --}}
-@props(['variants', 'option' => null])
+{{-- $values: one product option's de-duplicated, ordered values, as built by
+     ProductController::buildOptionPicker() — [{id, label, hex}]. --}}
+@props(['values', 'option' => null, 'optionHandle' => null])
 
 <div {{ $attributes }}>
     @if($option)
         <p class="font-bold mb-3 text-sm uppercase tracking-wide">
-            {{ $option }}: <span data-product-form-target="colorName" class="font-normal normal-case"></span>
+            {{ $option }}: <span data-product-form-target="colorName" data-option="{{ $optionHandle }}" class="font-normal normal-case"></span>
         </p>
     @endif
 
@@ -15,22 +14,17 @@ class="flex flex-wrap gap-2"
         role="group"
         aria-label="{{ $option ?? 'Color' }}"
     >
-        @foreach($variants as $variant)
-            @php
-                $value = $variant['options'][0] ?? null;
-                $label = $value['value'] ?? '';
-                $bg = $value['meta']['hex'] ?? '#cccccc';
-            @endphp
+        @foreach($values as $value)
             <button
                 type="button"
                 class="color-swatch"
                 data-product-form-target="swatch"
                 data-action="click->product-form#selectVariant"
-                data-variant-id="{{ $variant['id'] }}"
-                style="background-color: {{ $bg }};"
-                aria-label="{{ $label }}"
+                data-option="{{ $optionHandle }}"
+                data-value-id="{{ $value['id'] }}"
+                style="background-color: {{ $value['hex'] ?? '#cccccc' }};"
+                aria-label="{{ $value['label'] }}"
                 aria-pressed="false"
-                title="{{ $label }}"
             ></button>
         @endforeach
     </div>

resources/views/components/ui/file-input.blade.php

@@ -0,0 +1,20 @@
+@props([
+    'accept'   => null,
+    'required' => false,
+    'disabled' => false,
+])
+
+<input
+    type="file"
+    @if ($accept) accept="{{ $accept }}" @endif
+    @required($required)
+    @disabled($disabled)
+    {{ $attributes->merge([
+        'class' => 'w-full py-2 text-sm
+                    file:mr-4 file:py-2 file:px-4 file:rounded-none file:border file:border-black file:bg-transparent
+                    file:font-semibold file:cursor-pointer file:transition-colors
+                    hover:file:bg-black hover:file:text-neutral-200
+                    focus:outline-none focus-visible:ring-2 focus-visible:ring-black
+                    disabled:cursor-not-allowed disabled:opacity-50',
+    ]) }}
+/>

resources/views/components/ui/icon.blade.php

@@ -6,7 +6,7 @@
 ])
 
 @php
-    $fillIcons = ['facebook', 'instagram', 'tiktok', 'search', 'bag'];
+    $fillIcons = ['facebook', 'instagram', 'tiktok', 'search', 'bag', 'user', 'heart', 'heart-fill'];
     $svgStroke = $stroke ?? (in_array($name, $fillIcons) ? 'none' : $color);
 @endphp
 
@@ -16,6 +16,12 @@
 
         'bag'    => '<path stroke-width=0.5 d="M20.0049 22H4.00488C3.4526 22 3.00488 21.5523 3.00488 21V3C3.00488 2.44772 3.4526 2 4.00488 2H20.0049C20.5572 2 21.0049 2.44772 21.0049 3V21C21.0049 21.5523 20.5572 22 20.0049 22ZM19.0049 20V4H5.00488V20H19.0049ZM9.00488 6V8C9.00488 9.65685 10.348 11 12.0049 11C13.6617 11 15.0049 9.65685 15.0049 8V6H17.0049V8C17.0049 10.7614 14.7663 13 12.0049 13C9.24346 13 7.00488 10.7614 7.00488 8V6H9.00488Z"/>',
 
+        'user'   => '<path stroke-width=0.5 d="M4 22C4 17.5817 7.58172 14 12 14C16.4183 14 20 17.5817 20 22H18C18 18.6863 15.3137 16 12 16C8.68629 16 6 18.6863 6 22H4ZM12 13C8.685 13 6 10.315 6 7C6 3.685 8.685 1 12 1C15.315 1 18 3.685 18 7C18 10.315 15.315 13 12 13ZM12 11C14.21 11 16 9.21 16 7C16 4.79 14.21 3 12 3C9.79 3 8 4.79 8 7C8 9.21 9.79 11 12 11Z"/>',
+
+        'heart'  => '<path stroke-width=0.5 d="M12.001 4.52853C14.35 2.42 17.98 2.49 20.2426 4.75736C22.5053 7.02472 22.583 10.637 20.4786 12.993L11.9999 21.485L3.52138 12.993C1.41705 10.637 1.49571 7.01901 3.75736 4.75736C6.02157 2.49315 9.64519 2.41687 12.001 4.52853ZM18.827 6.1701C17.3279 4.66794 14.9076 4.60701 13.337 6.01687L12.0019 7.21524L10.6661 6.01781C9.09098 4.60597 6.67506 4.66808 5.17157 6.17157C3.68183 7.66131 3.60704 10.0473 4.97993 11.6232L11.9999 18.6543L19.0201 11.6232C20.3935 10.0467 20.319 7.66525 18.827 6.1701Z"/>',
+
+        'heart-fill' => '<path stroke-width=2 d="M12.001 4.52853C14.35 2.42 17.98 2.49 20.2426 4.75736C22.5053 7.02472 22.583 10.637 20.4786 12.993L11.9999 21.485L3.52138 12.993C1.41705 10.637 1.49571 7.01901 3.75736 4.75736C6.02157 2.49315 9.64519 2.41687 12.001 4.52853Z"/>',
+
         'close'       => '<path fill="none" stroke-width="1.5" stroke-linecap="round" d="M6 6L18 18M18 6L6 18"/>',
 
         'arrow-left'  => '<path fill="none" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" d="M19 12H5M5 12L11 6M5 12L11 18"/>',

resources/views/components/ui/option-buttons.blade.php

@@ -0,0 +1,32 @@
+{{-- $values: one product option's de-duplicated, ordered values, as built by
+     ProductController::buildOptionPicker() — [{id, label, hex}]. Use this
+     instead of <x-ui.color-swatch> for options that aren't a color (no hex),
+     where a swatch dot has nothing meaningful to show. --}}
+@props(['values', 'option' => null, 'optionHandle' => null])
+
+<div {{ $attributes }}>
+    @if($option)
+        <p class="font-bold mb-3 text-sm uppercase tracking-wide">
+            {{ $option }}
+        </p>
+    @endif
+
+    <div
+        class="flex flex-wrap gap-2"
+        role="group"
+        aria-label="{{ $option ?? 'Option' }}"
+    >
+        @foreach($values as $value)
+            <x-ui.button
+                variant="secondary"
+                size="sm"
+                data-product-form-target="swatch"
+                data-action="click->product-form#selectVariant"
+                data-option="{{ $optionHandle }}"
+                data-value-id="{{ $value['id'] }}"
+                aria-label="{{ $value['label'] }}"
+                aria-pressed="false"
+            >{{ $value['label'] }}</x-ui.button>
+        @endforeach
+    </div>
+</div>

resources/views/components/ui/product-card.blade.php

@@ -1,8 +1,13 @@
 @props([
-    'name'  => '',
-    'price' => null,
-    'image' => null,
-    'href'  => '#',
+    'name'      => '',
+    'price'     => null,
+    'image'     => null,
+    'href'      => '#',
+    'variantId' => null,
+    'hasCustomFields' => false,
+    // Heart toggle at the top right of the image; needs productId.
+    'productId' => null,
+    'wishlist'  => false,
 ])
 
 {{-- data-turbo-frame="_top" on the links: this card renders inside the
@@ -27,9 +32,35 @@ class="w-full h-auto block"
             @endif
         </a>
 
-        <x-ui.button size="md" position="absolute" class="opacity-0 group-hover:opacity-100 transition-opacity duration-100">
-            {{ __('storefront.product.add_to_cart') }}
-        </x-ui.button>
+        @if ($wishlist && $productId)
+            <x-wishlist-button :product-id="$productId" class="absolute top-4 right-4 z-10" />
+        @endif
+
+        @if ($hasCustomFields)
+            {{-- Custom fields have to be filled in on the product page. --}}
+            <x-ui.button
+                :href="$href"
+                size="md"
+                position="absolute"
+                data-turbo-frame="_top"
+                class="opacity-0 group-hover:opacity-100 focus-visible:opacity-100 transition-opacity duration-100"
+            >
+                {{ __('storefront.product.personalize') }}
+            </x-ui.button>
+        @elseif ($variantId)
+            {{-- has-[...] forces the button visible while an add-to-cart error
+                 is showing, so it isn't only readable on hover — a shopper who
+                 already moved off the card (mouse or the click itself) must
+                 still see why nothing happened. --}}
+            <x-checkout::add-to-cart
+                :purchasable="$variantId"
+                class="absolute opacity-0 group-hover:opacity-100 has-[.bbk-add-to-cart-error:not([hidden])]:opacity-100 transition-opacity duration-100"
+            >
+                <x-ui.button type="submit" size="md">
+                    {{ __('storefront.product.add_to_cart') }}
+                </x-ui.button>
+            </x-checkout::add-to-cart>
+        @endif
     </div>
 
     <div class="flex items-baseline justify-between gap-4">

resources/views/components/ui/select.blade.php

@@ -1,17 +1,22 @@
 @props([
-    'options'   => [],
-    'value'     => null,
-    'name'      => null,
-    'ariaLabel' => null,
+    'options'     => [],
+    'value'       => null,
+    'name'        => null,
+    'ariaLabel'   => null,
+    'placeholder' => null,
+    'block'       => false,
 ])
 
 
-<div class="relative inline-flex items-center">
+<div @class(['relative items-center', 'flex w-full' => $block, 'inline-flex' => ! $block])>
     <select
         @if($name) name="{{ $name }}" @endif
         @if($ariaLabel) aria-label="{{ $ariaLabel }}" @endif
-        {{ $attributes->merge(['class' => 'appearance-none bg-transparent border-b border-black  pr-10 py-2.5 cursor-pointer focus:outline-none']) }}
+        {{ $attributes->merge(['class' => 'appearance-none bg-transparent border-b border-black  pr-10 py-2.5 cursor-pointer focus:outline-none'.($block ? ' w-full' : '')]) }}
     >
+        @if($placeholder !== null)
+            <option value="" @selected($value === null || $value === '')>{{ $placeholder }}</option>
+        @endif
         @foreach($options as $option)
             <option value="{{ $option['value'] }}" @selected($value === $option['value'])>{{ $option['label'] }}</option>
         @endforeach

resources/views/components/ui/status.blade.php

@@ -0,0 +1,11 @@
+{{--
+    Flash confirmation box ("Changes saved." etc.). Renders nothing when there's
+    no message; defaults to session('status'). Spacing comes from the caller.
+--}}
+@props([
+    'message' => session('status'),
+])
+
+@if (filled($message))
+    <p role="status" aria-live="polite" {{ $attributes->merge(['class' => 'border border-black bg-brand p-6 text-black']) }}>{{ $message }}</p>
+@endif

resources/views/components/ui/tabs.blade.php

@@ -1,9 +1,10 @@
-@props(['tabs' => [], 'size' => 'md'])
+@props(['tabs' => [], 'size' => 'md', 'active' => null])
 @php
     $sizeClasses = match($size) {
         'lg'    => 'text-[36px] font-extrabold [--slide-h:5px]',
         default => 'text-xl font-bold [--slide-h:3px]',
     };
+    $activeId = $active ?? ($tabs[0]['id'] ?? null);
 @endphp
 
 {{--
@@ -21,22 +22,22 @@
 
 <div data-controller="tabs" {{ $attributes }}>
     <div class="flex gap-10 mb-8" role="tablist">
-        @foreach($tabs as $i => $tab)
+        @foreach($tabs as $tab)
             <button
                 type="button"
                 role="tab"
                 data-tabs-target="button"
                 data-action="click->tabs#show"
                 data-panel="{{ $tab['id'] }}"
-                class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $i === 0 ? 'is-active' : '' }}"
-                aria-selected="{{ $i === 0 ? 'true' : 'false' }}"
+                class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $tab['id'] === $activeId ? 'is-active' : '' }}"
+                aria-selected="{{ $tab['id'] === $activeId ? 'true' : 'false' }}"
                 aria-controls="tab-panel-{{ $tab['id'] }}"
                 id="tab-btn-{{ $tab['id'] }}"
             >{{ $tab['label'] }}</button>
         @endforeach
     </div>
 
-    @foreach($tabs as $i => $tab)
+    @foreach($tabs as $tab)
         @php $panelKey = $tab['id']; $panel = $$panelKey ?? null; @endphp
         <div
             role="tabpanel"
@@ -44,7 +45,7 @@ class="underline-slide font-display pb-1 {{ $sizeClasses }} {{ $i === 0 ? 'is-ac
             id="tab-panel-{{ $tab['id'] }}"
             aria-labelledby="tab-btn-{{ $tab['id'] }}"
             tabindex="0"
-            @if($i !== 0) hidden @endif
+            @if($tab['id'] !== $activeId) hidden @endif
         >{{ $panel }}</div>
     @endforeach
 </div>

resources/views/components/wishlist-button.blade.php

@@ -0,0 +1,41 @@
+{{--
+    Heart toggle for one product. A real form, so it works without JS; the
+    `wishlist` Stimulus controller turns the submit into a fetch and flips
+    aria-pressed, which the CSS (group-aria-pressed) uses to swap the icons.
+
+    Usage: <x-wishlist-button :product-id="$product['id']" class="absolute top-4 right-4" />
+--}}
+@props(['productId'])
+
+@php
+    $active = app(\App\Services\Wishlist::class)->has((int) $productId);
+    $addLabel = __('storefront.wishlist.add');
+    $removeLabel = __('storefront.wishlist.remove');
+@endphp
+
+<form
+    method="POST"
+    action="{{ route('wishlist.toggle', ['productId' => $productId]) }}"
+    data-controller="wishlist"
+    data-action="submit->wishlist#toggle"
+    data-wishlist-add-label-value="{{ $addLabel }}"
+    data-wishlist-remove-label-value="{{ $removeLabel }}"
+    data-wishlist-added-message-value="{{ __('storefront.wishlist.added') }}"
+    data-wishlist-removed-message-value="{{ __('storefront.wishlist.removed') }}"
+    {{ $attributes }}
+>
+    @csrf
+
+    <button
+        type="submit"
+        class="group/heart flex size-12 cursor-pointer items-center justify-center"
+        aria-pressed="{{ $active ? 'true' : 'false' }}"
+        aria-label="{{ $active ? $removeLabel : $addLabel }}"
+        data-wishlist-target="button"
+    >
+        <x-ui.icon name="heart" :size="30" class="group-aria-pressed/heart:hidden" />
+        <x-ui.icon name="heart-fill" :size="28" stroke="#000" class="hidden group-aria-pressed/heart:block text-brand" />
+    </button>
+
+    <span class="sr-only" role="status" aria-live="polite" data-wishlist-target="status"></span>
+</form>

resources/views/contact.blade.php

@@ -24,23 +24,35 @@
                 Έχεις απορία, ιδέα ή θες να μας πεις κάτι; Γράψε μας το μήνυμά σου και θα σου απαντήσουμε το συντομότερο δυνατό.
             </p>
 
-            <form method="POST" action="#" class="flex flex-col gap-8 max-w-xl">
+            <x-ui.status class="max-w-xl" />
+
+            <form method="POST" action="{{ route('contact.send') }}" class="flex flex-col gap-8 max-w-xl">
                 @csrf
 
                 <div class="grid grid-cols-1 gap-8 sm:grid-cols-2">
-                    <x-ui.field label="Το όνομά σου" for="contact-name">
-                        <x-ui.input id="contact-name" name="name" autocomplete="name" :required="true" />
+                    <x-ui.field label="Το όνομά σου" for="contact-name" :error="$errors->first('name')">
+                        <x-ui.input id="contact-name" name="name" autocomplete="name" maxlength="100" :value="old('name')" :required="true"
+                            :aria-invalid="$errors->has('name') ? 'true' : null"
+                            :aria-describedby="$errors->has('name') ? 'contact-name-error' : null" />
                     </x-ui.field>
 
-                    <x-ui.field label="Το email σου" for="contact-email">
-                        <x-ui.input id="contact-email" name="email" type="email" autocomplete="email" :required="true" />
+                    <x-ui.field label="Το email σου" for="contact-email" :error="$errors->first('email')">
+                        <x-ui.input id="contact-email" name="email" type="email" autocomplete="email" maxlength="255" :value="old('email')" :required="true"
+                            :aria-invalid="$errors->has('email') ? 'true' : null"
+                            :aria-describedby="$errors->has('email') ? 'contact-email-error' : null" />
                     </x-ui.field>
                 </div>
 
-                <x-ui.field label="Το μήνυμά σου" for="contact-message">
-                    <x-ui.textarea id="contact-message" name="message" rows="5" :required="true" />
+                <x-ui.field label="Το μήνυμά σου" for="contact-message" :error="$errors->first('message')">
+                    <x-ui.textarea id="contact-message" name="message" rows="5" maxlength="5000" :required="true"
+                        :aria-invalid="$errors->has('message') ? 'true' : null"
+                        :aria-describedby="$errors->has('message') ? 'contact-message-error' : null">{{ old('message') }}</x-ui.textarea>
                 </x-ui.field>
 
+                @if (session('contact_error'))
+                    <p role="alert" class="text-sm text-red-600">{{ session('contact_error') }}</p>
+                @endif
+
                 <div>
                     <x-ui.button type="submit" size="md">Υποβολή</x-ui.button>
                 </div>

resources/views/emails/contact-confirmation.blade.php

@@ -0,0 +1,17 @@
+@extends('emails.layout')
+
+@section('title', __('storefront.contact.confirmation_subject'))
+
+@section('preheader', __('storefront.contact.confirmation_preheader'))
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        {{ __('storefront.contact.confirmation_heading') }}
+    </h1>
+
+    <p style="margin:0;">{{ __('storefront.contact.confirmation_body') }}</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">{{ __('storefront.contact.confirmation_footer') }}</p>
+@endsection

resources/views/emails/contact-message.blade.php

@@ -0,0 +1,21 @@
+@extends('emails.layout')
+
+@section('title', 'Νέο μήνυμα επικοινωνίας')
+
+@section('preheader', "Από {$senderName} ({$senderEmail})")
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        Νέο μήνυμα επικοινωνίας
+    </h1>
+
+    <p style="margin:0 0 4px;"><strong>Όνομα:</strong> {{ $senderName }}</p>
+    <p style="margin:0 0 4px;"><strong>Email:</strong> <a href="mailto:{{ $senderEmail }}" style="color:#000000;">{{ $senderEmail }}</a></p>
+    <p style="margin:0 0 24px;"><strong>Γλώσσα:</strong> {{ strtoupper($senderLocale) }}</p>
+
+    <p style="margin:0;white-space:pre-line;">{{ $body }}</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">Στάλθηκε από τη φόρμα επικοινωνίας του 3dealer. Απάντησε σε αυτό το email για να απαντήσεις στον αποστολέα.</p>
+@endsection

resources/views/emails/layout.blade.php

@@ -0,0 +1,97 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" lang="{{ str_replace('_', '-', app()->getLocale()) }}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="x-apple-disable-message-reformatting">
+<meta name="format-detection" content="telephone=no, date=no, address=no, email=no, url=no">
+<meta name="color-scheme" content="light">
+<meta name="supported-color-schemes" content="light">
+<title>@yield('title', '3Dealer')</title>
+<!--[if mso]>
+<noscript>
+<xml>
+<o:OfficeDocumentSettings>
+<o:PixelsPerInch>96</o:PixelsPerInch>
+<o:AllowPNG/>
+</o:OfficeDocumentSettings>
+</xml>
+</noscript>
+<style>
+  table { border-collapse: collapse !important; }
+  .email-container { width: 600px !important; }
+</style>
+<![endif]-->
+<!--[if !mso]><!-->
+<link href="https://fonts.googleapis.com/css2?family=Manrope:wght@400;600;700;800&display=swap" rel="stylesheet" type="text/css">
+<!--<![endif]-->
+<style>
+  body, table, td, a { -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; }
+  table, td { mso-table-lspace: 0pt; mso-table-rspace: 0pt; }
+  img { -ms-interpolation-mode: bicubic; border: 0; height: auto; line-height: 100%; outline: none; text-decoration: none; }
+  body { height: 100% !important; margin: 0 !important; padding: 0 !important; width: 100% !important; background-color: #e5e5e5; }
+  a[x-apple-data-detectors] {
+    color: inherit !important;
+    text-decoration: none !important;
+    font-size: inherit !important;
+    font-family: inherit !important;
+    font-weight: inherit !important;
+    line-height: inherit !important;
+  }
+  #MessageViewBody, #MessageWebViewDiv { width: 100% !important; }
+  u + #email-body a { color: inherit; text-decoration: none; }
+
+  @media only screen and (max-width: 480px) {
+    .email-container { width: 100% !important; max-width: 100% !important; }
+    .email-header { padding: 24px 20px 12px !important; }
+    .email-card { padding: 28px 20px !important; }
+    .email-footer { padding: 0 20px 32px !important; }
+  }
+</style>
+</head>
+<body id="email-body" style="margin:0;padding:0;background-color:#e5e5e5;">
+<div style="display:none;max-height:0;overflow:hidden;mso-hide:all;font-size:1px;line-height:1px;color:#e5e5e5;">
+  @yield('preheader', '')
+  &nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;&nbsp;&zwnj;
+</div>
+
+<center role="article" aria-roledescription="email" style="width:100%;background-color:#e5e5e5;">
+<!--[if mso]>
+<table role="presentation" width="600" align="center" cellpadding="0" cellspacing="0" bgcolor="#e5e5e5"><tr><td>
+<![endif]-->
+<table role="presentation" class="email-container" width="100%" cellpadding="0" cellspacing="0" bgcolor="#e5e5e5" style="max-width:600px;margin:0 auto;">
+  <tr>
+    <td class="email-header" align="center" style="padding:32px 24px 16px;">
+      <a href="{{ url('/') }}" target="_blank" style="text-decoration:none;">
+        <img src="{{ asset('images/logo.png') }}" width="140" height="123" alt="3Dealer" style="display:inline-block;border:0;outline:none;text-decoration:none;height:auto;max-width:140px;width:100%;">
+      </a>
+    </td>
+  </tr>
+  <tr>
+    <td style="padding:0 24px;">
+      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" bgcolor="#ffffff" style="background-color:#ffffff;border-radius:0;">
+        <tr>
+          <td class="email-card" style="padding:40px 32px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:16px;line-height:1.5;color:#000000;text-align:left;">
+            @yield('content')
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+  <tr>
+    <td class="email-footer" align="center" style="padding:24px 24px 40px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:13px;line-height:1.6;color:#7a7a7a;">
+      @yield('footer')
+      <p style="margin:12px 0 0;">
+        <a href="{{ url('/') }}" style="color:#7a7a7a;text-decoration:underline;">3dealer.gr</a>
+        &nbsp;&middot;&nbsp;&copy; {{ date('Y') }} 3Dealer
+      </p>
+    </td>
+  </tr>
+</table>
+<!--[if mso]>
+</td></tr></table>
+<![endif]-->
+</center>
+</body>
+</html>

resources/views/home.blade.php

@@ -60,9 +60,25 @@ class="w-full h-full object-cover"
                                         @endif
                                     </a>
 
-                                    <x-ui.button size="md" position="absolute" class="opacity-0 group-hover:opacity-100 transition-opacity duration-100">
-                                        {{ __('storefront.product.add_to_cart') }}
-                                    </x-ui.button>
+                                    @if ($product['hasCustomFields'] ?? false)
+                                        <x-ui.button
+                                            :href="$product['href']"
+                                            size="md"
+                                            position="absolute"
+                                            class="opacity-0 group-hover:opacity-100 focus-visible:opacity-100 transition-opacity duration-100"
+                                        >
+                                            {{ __('storefront.product.personalize') }}
+                                        </x-ui.button>
+                                    @elseif ($product['variantId'] ?? null)
+                                        <x-checkout::add-to-cart
+                                            :purchasable="$product['variantId']"
+                                            class="absolute opacity-0 group-hover:opacity-100 has-[.bbk-add-to-cart-error:not([hidden])]:opacity-100 transition-opacity duration-100"
+                                        >
+                                            <x-ui.button type="submit" size="md">
+                                                {{ __('storefront.product.add_to_cart') }}
+                                            </x-ui.button>
+                                        </x-checkout::add-to-cart>
+                                    @endif
                                 </div>
 
                                 <div class="flex items-baseline justify-between gap-4 absolute bottom-0 left-0 w-full">
@@ -155,6 +171,8 @@ class="max-w-xs"
                                 :price="$product['price']"
                                 :image="$product['image']"
                                 :href="$product['href']"
+                                :variant-id="$product['variantId'] ?? null"
+                                :has-custom-fields="$product['hasCustomFields'] ?? false"
                             />
                         @endforeach
                     </div>

resources/views/layouts/account.blade.php

@@ -0,0 +1,71 @@
+{{--
+    Account area: full-width, fixed-width sidebar + fluid content. Pages set
+    @section('title') and fill @section('account').
+
+    Below lg the sidebar becomes a horizontally scrollable row above the
+    content.
+--}}
+@extends('layouts.app')
+
+@push('seo')
+    <meta name="robots" content="noindex, nofollow">
+@endpush
+
+@php
+    $accountNav = [
+        [
+            'label' => __('storefront.account.nav_profile'),
+            'href' => route('account'),
+            'active' => request()->routeIs('account', 'account.email.*'),
+        ],
+        [
+            'label' => __('storefront.account.nav_orders'),
+            'href' => route('account.orders'),
+            'active' => request()->routeIs('account.orders*'),
+        ],
+        [
+            'label' => __('storefront.account.nav_wishlist'),
+            'href' => route('account.wishlist'),
+            'active' => request()->routeIs('account.wishlist'),
+        ],
+    ];
+
+    $accountNavLink = 'nav-link uppercase inline-flex shrink-0 whitespace-nowrap font-display font-extrabold italic text-black no-underline';
+@endphp
+
+@section('content')
+
+    <div class="flex flex-col lg:flex-row lg:min-h-[calc(100vh-102px)]">
+
+        <aside class="border-b border-black lg:w-80 lg:shrink-0 lg:border-b-0 lg:border-r">
+            <nav aria-label="{{ __('storefront.nav.account') }}">
+                <ul class="flex gap-8 overflow-x-auto px-4 py-5 sm:px-8 lg:flex-col lg:gap-5 lg:overflow-visible lg:px-10 lg:py-12">
+                    @foreach ($accountNav as $item)
+                        <li class="shrink-0">
+                            <a
+                                href="{{ $item['href'] }}"
+                                @class([$accountNavLink, 'is-active' => $item['active']])
+                                @if ($item['active']) aria-current="page" @endif
+                            ><span>{{ $item['label'] }}</span></a>
+                        </li>
+                    @endforeach
+
+                    <li class="shrink-0">
+                        <form method="POST" action="{{ route('logout') }}">
+                            @csrf
+                            <button type="submit" class="{{ $accountNavLink }} cursor-pointer">
+                                <span>{{ __('storefront.auth.logout') }}</span>
+                            </button>
+                        </form>
+                    </li>
+                </ul>
+            </nav>
+        </aside>
+
+        <div class="min-w-0 flex-1 px-4 py-12 sm:px-8 lg:px-16 lg:py-16">
+            @yield('account')
+        </div>
+
+    </div>
+
+@endsection

resources/views/layouts/app.blade.php

@@ -10,6 +10,7 @@
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <link rel="shortcut icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+    <meta name="apple-mobile-web-app-title" content="3dealer" />
     <link rel="manifest" href="/site.webmanifest" />
 
     <title>@yield('title', config('app.name'))</title>

resources/views/product/show.blade.php

@@ -17,13 +17,20 @@
             class="grid grid-cols-1 md:grid-cols-2 gap-12"
             data-controller="product-form"
             data-product-form-variants-value="{{ json_encode($variantsData) }}"
+            data-product-form-stock-check-url-value="{{ route('product.stock-check', app()->getLocale()) }}"
+            data-product-form-stock-error-one-value="{{ trans_choice('storefront.product.add_to_cart_failed', 1) }}"
+            data-product-form-stock-error-many-value="{{ trans_choice('storefront.product.add_to_cart_failed', 2, ['count' => ':count']) }}"
         >
 
             {{-- Image --}}
+            {{-- relative: anchors the wishlist heart to the top right, which is
+                 the main image's corner (thumbnails sit on the left). --}}
             <div
                 data-controller="product-gallery"
-                class="flex gap-4 items-start"
+                class="relative flex gap-4 items-start"
             >
+                <x-wishlist-button :product-id="$product['id']" class="absolute top-4 right-4 z-10" />
+
                 @if(!empty($product['media']))
                     {{-- Thumbnails --}}
                     <div class="flex flex-col items-center gap-1 w-[116px] shrink-0 -mt-12.5">
@@ -146,7 +153,15 @@ class="absolute bottom-6 right-8 text-white text-sm"
                     {{ $product['name'] }}
                 </h1>
 
-                <x-reviews-stars :rating="$product['reviews']['average_rating'] ?? 0" :count="$product['reviews']['count']" :showCount="true" />
+                <x-reviews-stars
+                    :rating="$product['reviews']['average_rating'] ?? 0"
+                    :count="$product['reviews']['count']"
+                    :showCount="true"
+                    :linkable="true"
+                    data-controller="tab-link"
+                    data-tab-link-tabs-outlet="#product-tabs"
+                    data-tab-link-panel-value="reviews"
+                />
 
                 @if($product['price'] !== null)
                     <p class="text-2xl font-bold" data-product-form-target="price">
@@ -155,35 +170,58 @@ class="absolute bottom-6 right-8 text-white text-sm"
                 @endif
 
                 @php
-                    $desc = strip_tags($product['description'] ?? '');
+                    $desc = html_entity_decode(strip_tags($product['description'] ?? ''), ENT_QUOTES | ENT_HTML5, 'UTF-8');
                     $descTruncated = Str::limit($desc, 137);
                     $descNeedsMore = mb_strlen($desc) > mb_strlen(rtrim($descTruncated, '.'));
                 @endphp
                 <div class="text-base leading-relaxed">
                     {{ $descTruncated }}
                     @if($descNeedsMore)
-                        <a href="#tab-panel-description" class="underline-slide font-semibold whitespace-nowrap">{{ __('storefront.product.read_more') }}</a>
+                        <a
+                            href="#tab-panel-description"
+                            class="underline-slide font-semibold whitespace-nowrap"
+                            data-controller="tab-link"
+                            data-tab-link-tabs-outlet="#product-tabs"
+                            data-tab-link-panel-value="description"
+                            data-action="click->tab-link#activate"
+                        >{{ __('storefront.product.read_more') }}</a>
                     @endif
                 </div>
 
-                @if($option && !empty($product['variants']))
-                    <x-ui.color-swatch :variants="$product['variants']" :option="$option" />
-                @endif
+                @foreach($productOptions as $productOption)
+                    @if($productOption['isColor'])
+                        <x-ui.color-swatch :values="$productOption['values']" :option="$productOption['label']" :option-handle="$productOption['handle']" />
+                    @else
+                        <x-ui.option-buttons :values="$productOption['values']" :option="$productOption['label']" :option-handle="$productOption['handle']" />
+                    @endif
+                @endforeach
 
                 <x-checkout::add-to-cart
                     :purchasable="$variantsData[0]['id'] ?? null"
                     :quantity="false"
-                    class="flex items-stretch gap-10"
+                    class="flex flex-col gap-6"
                 >
-                    <x-ui.quantity name="quantity" />
-                    <x-ui.button type="submit" class="flex-1">{{ __('storefront.product.add_to_cart') }}</x-ui.button>
+                    @if(!empty($product['custom_fields']))
+                        <x-product-custom-fields :fields="$product['custom_fields']" />
+                    @endif
+
+                    <div class="flex items-stretch gap-10">
+                        <x-ui.quantity name="quantity" />
+                        <x-ui.button type="submit" class="flex-1">{{ __('storefront.product.add_to_cart') }}</x-ui.button>
+                    </div>
                 </x-checkout::add-to-cart>
 
+                {{-- Storefront-owned, not part of the checkout module — the
+                     local stock pre-check in product-form-controller.js stops
+                     an over-limit submit before it ever reaches the module
+                     and reports it here. --}}
+                <p class="text-sm text-red-600" data-product-form-target="stockError" hidden role="alert"></p>
+
             </div>
 
         </div>
 
-        <x-ui.tabs class="mt-16" size="lg" :tabs="[
+        <x-ui.tabs id="product-tabs" class="mt-16 scroll-mt-28" size="lg" :active="request('tab')" :tabs="[
             ['id' => 'description',  'label' => __('storefront.product.description')],
             ['id' => 'reviews',      'label' => __('storefront.product.reviews') . ' (' . $product['reviews']['count'] . ')'],
         ]">
@@ -198,6 +236,10 @@ class="flex items-stretch gap-10"
                 </ul>
             </x-slot>
             <x-slot name="reviews">
+                @if(session('reviewSubmitted'))
+                    <p class="mb-8 text-sm font-semibold" role="status">{{ __('storefront.review.thank_you') }}</p>
+                @endif
+
                 @if(!empty($product['reviews']['items']))
                     <div class="mb-10">
                         @foreach($product['reviews']['items'] as $review)
@@ -207,6 +249,8 @@ class="flex items-stretch gap-10"
                                 'date' => $review['reviewed_at'] ? \Illuminate\Support\Carbon::createFromTimestamp($review['reviewed_at'])->translatedFormat('d M Y') : '',
                                 'text' => $review['body'],
                                 'image' => $review['media'][0]['url'] ?? null,
+                                'reply' => $review['reply'] ?? null,
+                                'replyDate' => $review['replied_at'] ? \Illuminate\Support\Carbon::createFromTimestamp($review['replied_at'])->translatedFormat('d M Y') : null,
                             ]" />
                         @endforeach
                     </div>

resources/views/product/show2.blade.php

@@ -1,236 +0,0 @@
-@extends('layouts.app')
-
-@section('title', $product->translateAttribute('name') . ' — ' . config('app.name'))
-@section('description', $product->translateAttribute('description'))
-
-@section('content')
-    <div class="max-w-7xl mx-auto px-4 sm:px-8 py-12">
-
-        @php $collection = $product->collections->first(); @endphp
-
-        <x-breadcrumb class="mb-14 justify-end" :items="[
-            $collection
-                ? ['label' => $collection->translateAttribute('name'), 'href' => '/category/' . $collection->id]
-                : ['label' => 'Products', 'href' => '/products'],
-            ['label' => $product->translateAttribute('name')],
-        ]" />
-
-        <div
-            class="grid grid-cols-1 md:grid-cols-2 gap-12"
-            data-controller="product-form"
-            data-product-form-variants-value="{{ json_encode($variantsData) }}"
-        >
-
-            {{-- Image --}}
-            <div
-                data-controller="product-gallery"
-                class="flex gap-4 items-start"
-            >
-                @if($product->media->isNotEmpty())
-                    {{-- Thumbnails --}}
-                    <div class="flex flex-col items-center gap-1 w-[116px] shrink-0 -mt-12.5">
-                        <button
-                            type="button"
-                            data-action="click->product-gallery#scrollUp"
-                            class="gallery-arrow w-full flex items-center justify-center py-2"
-                            aria-label="Scroll thumbnails up"
-                        ><x-ui.icon name="arrow-up" :size="30" /></button>
-
-                        <div
-                            data-product-gallery-target="track"
-                            class="flex flex-col gap-4 overflow-hidden"
-                            style="max-height: var(--gallery-height, 600px)"
-                        >
-                            @foreach($product->media as $i => $media)
-                                <button
-                                    type="button"
-                                    data-action="click->product-gallery#select"
-                                    data-product-gallery-target="thumb"
-                                    data-src="{{ $media->getUrl() }}"
-                                    data-alt="{{ $product->translateAttribute('name') }}"
-                                    class="block w-full shrink-0 border border-black overflow-hidden "
-                                    aria-label="View image {{ $i + 1 }}"
-                                    aria-pressed="{{ $i === 0 ? 'true' : 'false' }}"
-                                >
-
-                                    <!-- opacity-50 transition-opacity {{ $i === 0 ? 'opacity-100' : '' }}" -->
-                                    <img src="{{ $media->getUrl() }}" alt="" class="w-full h-auto object-cover" aria-hidden="true">
-                                </button>
-                            @endforeach
-                        </div>
-
-                        <button
-                            type="button"
-                            data-action="click->product-gallery#scrollDown"
-                            class="gallery-arrow w-full flex items-center justify-center py-2"
-                            aria-label="Scroll thumbnails down"
-                        ><x-ui.icon name="arrow-down" :size="30" /></button>
-                    </div>
-
-                    {{-- Main image --}}
-                    <button
-                        type="button"
-                        class="flex-1 border border-black bg-white cursor-zoom-in block p-0"
-                        data-action="click->product-gallery#openLightbox"
-                        aria-label="View full size image"
-                    >
-                        <img
-                            data-product-form-target="image"
-                            data-product-gallery-target="main"
-                            src="{{ $product->media->first()->getUrl() }}"
-                            alt="{{ $product->translateAttribute('name') }}"
-                            class="w-full h-auto block"
-                        >
-                    </button>
-
-                    {{-- Lightbox --}}
-                    <div
-                        id="product-lightbox"
-                        popover
-                        class="product-lightbox"
-                        data-product-gallery-target="lightbox"
-                        data-action="click->product-gallery#closeLightboxOnBackdrop"
-                        role="dialog"
-                        aria-label="Product image gallery"
-                        aria-modal="true"
-                    >
-                        {{-- Prev --}}
-                        <button
-                            type="button"
-                            data-action="click->product-gallery#prevImage click->product-gallery#noop"
-                            class="lightbox-arrow absolute left-8 top-1/2 -translate-y-1/2"
-                            aria-label="Previous image"
-                        ><x-ui.icon name="arrow-left" :size="72" color="white" /></button>
-
-                        {{-- Image + close button as a unit --}}
-                        <div class="relative" data-action="click->product-gallery#noop">
-                            <img
-                                data-product-gallery-target="lightboxImage"
-                                src=""
-                                alt=""
-                                class="max-h-[90vh] max-w-[80vw] object-contain block"
-                            >
-                            <button
-                                type="button"
-                                popovertarget="product-lightbox"
-                                popovertargetaction="hide"
-                                class="lightbox-close absolute -top-10 -right-10"
-                                aria-label="Close gallery"
-                            ><x-ui.icon name="close" :size="36" color="white" /></button>
-                        </div>
-
-                        {{-- Next --}}
-                        <button
-                            type="button"
-                            data-action="click->product-gallery#nextImage click->product-gallery#noop"
-                            class="lightbox-arrow absolute right-8 top-1/2 -translate-y-1/2"
-                            aria-label="Next image"
-                        ><x-ui.icon name="arrow-right" :size="72" color="white" /></button>
-
-                        {{-- Counter --}}
-                        <p
-                            data-product-gallery-target="lightboxCounter"
-                            class="absolute bottom-6 right-8 text-white text-sm"
-                            aria-live="polite"
-                        ></p>
-                    </div>
-                @else
-                    <div class="w-full bg-neutral-300 flex items-center justify-center text-neutral-500 min-h-64">
-                        No image
-                    </div>
-                @endif
-            </div>
-
-            {{-- Info --}}
-            <div class="flex flex-col gap-6">
-
-                <h1 class="font-display font-medium text-4xl lg:text-[54px]">
-                    {{ $product->translateAttribute('name') }}
-                </h1>
-
-                <x-reviews-stars :rating="3" :count="24" :showCount="true" />
-
-                @if($product->variants->first()?->prices->isNotEmpty())
-                    <p class="text-2xl font-bold" data-product-form-target="price">
-                        <x-ui.price :amount="$product->variants->first()->prices->first()->price->decimal" />
-                    </p>
-                @endif
-
-                @php
-                    $desc = strip_tags($product->translateAttribute('description') ?? '');
-                    $descTruncated = Str::limit($desc, 137);
-                    $descNeedsMore = mb_strlen($desc) > mb_strlen(rtrim($descTruncated, '.'));
-                @endphp
-                <div class="text-base leading-relaxed">
-                    {{ $descTruncated }}
-                    @if($descNeedsMore)
-                        <a href="#tab-panel-description" class="underline-slide font-semibold whitespace-nowrap">Περισσότερα</a>
-                    @endif
-                </div>
-
-                @if($option && $product->variants->count() >= 1)
-                    <x-ui.color-swatch :variants="$product->variants" :option="$option" />
-                @endif
-
-                <div class="flex items-stretch gap-10">
-                    <x-ui.quantity name="quantity" />
-                    <x-ui.button class="flex-1">Προσθήκη στο καλάθι</x-ui.button>
-                </div>
-
-            </div>
-
-        </div>
-
-        <x-ui.tabs class="mt-16" size="lg" :tabs="[
-            ['id' => 'description',  'label' => 'Περιγραφή'],
-            // ['id' => 'reviews',      'label' => 'Αξιολογήσεις (' . count($reviews) . ')'],
-            ['id' => 'reviews',      'label' => 'Αξιολογήσεις (3)'],
-        ]">
-            <x-slot name="description">
-                <div class="leading-7 [&_p]:mt-4">
-                    {!! $product->translateAttribute('description') !!}
-                </div>
-                @if($product->translateAttribute('details'))
-                    <div class="mt-6">{!! $product->translateAttribute('details') !!}</div>
-                @endif
-                <ul class="mt-8 flex flex-col gap-3 text-neutral-600 list-disc list-outside pl-5">
-                    <li>Όλα τα προϊόντα εκτυπώνονται και προετοιμάζονται κατά παραγγελία. Ο χρόνος προετοιμασίας κυμαίνεται μεταξύ 2 και 7 εργάσιμων ημερών.</li>
-                    <li>Όλα τα προϊόντα κατασκευάζονται με τρισδιάστατη εκτύπωση σε ειδικούς εκτυπωτές πλαστικού υλικού. Πιθανώς να έχουν εμφανείς γραμμές ένωσης, στρώσεις εκτύπωσης υλικού και μικρές ατέλειες. Είναι φυσιολογικό για το αποτέλεσμα αυτής της δημιουργικής διαδικασίας.</li>
-                    <li>Όλα τα προϊόντα είναι σχεδιασμένα και κατασκευασμένα είτε για διακόσμηση είτε για χρήση σε λογικά, ρεαλιστικά πλαίσια. Υπερβολική ισχύς, υψηλότατες θερμοκρασίες και αποσυναρμολόγηση μπορεί να προκαλέσουν ζημιά στο προϊόν για την οποία δεν ευθύνεται το 3Dealer.</li>
-                </ul>
-            </x-slot>
-            <x-slot name="reviews">
-                {{-- @if(count($reviews) > 0)
-                    <div class="mb-10">
-                        @foreach($reviews as $review)
-                            <x-review-card :review="$review" />
-                        @endforeach
-                    </div>
-                @else
-                    <p class="text-neutral-500 mb-10">Δεν υπάρχουν αξιολογήσεις ακόμα.</p>
-                @endif
-
-                <h3 class="text-h4 font-bold">
-                    {{ count($reviews) > 0 ? 'Πρόσθεσε μια' : 'Γράψε την πρώτη' }} αξιολόγηση για το «{{ $product->translateAttribute('name') }}»
-                </h3> --}}
-
-                <x-review-form :product="$product" />
-            </x-slot>
-        </x-ui.tabs>
-
-        <x-product-grid
-            class="mt-20"
-            title="Σχετικά προϊόντα"
-            :products="[
-                ['name' => 'Camper',      'price' => '30', 'image' => null, 'href' => '#'],
-                ['name' => 'Ponderer IPA','price' => '25', 'image' => null, 'href' => '#'],
-                ['name' => 'Squish Red',  'price' => '35', 'image' => null, 'href' => '#'],
-                ['name' => 'Red Light',   'price' => '25', 'image' => null, 'href' => '#'],
-            ]"
-        />
-
-    </div>
-
-    <x-newsletter class="py-20"  />
-
-@endsection

resources/views/products/index.blade.php

@@ -12,7 +12,8 @@
 @endpush
 
 @section('content')
-    <div class="max-w-5xl mx-auto pt-26 pb-12">
+    {{-- <div class="max-w-5xl mx-auto pt-26 pb-12"> --}}
+    <div class="max-w-7xl mx-auto px-4 sm:px-8 pt-26 pb-12">
 
         <div class="flex items-end justify-between gap-6 flex-wrap mb-16">
             <h1 class="font-medium text-h2">{{ __('storefront.shop.all_products') }}</h1>

resources/views/search/index.blade.php

@@ -12,7 +12,8 @@
 @endpush
 
 @section('content')
-    <div class="max-w-5xl mx-auto pt-26 pb-12">
+    {{-- <div class="max-w-5xl mx-auto pt-26 pb-12"> --}}
+    <div class="max-w-7xl mx-auto px-4 sm:px-8 pt-26 pb-12">
 
         <div class="flex items-end justify-between gap-6 flex-wrap mb-16">
             <h1 class="font-medium text-h2">{{ $heading }}</h1>

resources/views/vendor/core/auth/mail/email-change-code.blade.php

@@ -0,0 +1,29 @@
+@extends('emails.layout')
+
+@section('title', 'Επιβεβαίωσε το νέο σου email')
+
+@section('preheader', "Ο κωδικός επιβεβαίωσης: {$code}")
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        Επιβεβαίωσε το νέο σου email
+    </h1>
+
+    <p style="margin:0 0 24px;">Βάλε τον παρακάτω κωδικό στο 3dealer για να γίνει αυτή η διεύθυνση το νέο email του λογαριασμού σου.</p>
+
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
+        <tr>
+            <td align="center" bgcolor="#18c28a" style="background-color:#18c28a;border:1px solid #000000;border-radius:0;padding:20px;">
+                <span style="font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:32px;font-weight:800;letter-spacing:8px;color:#000000;">{{ $code }}</span>
+            </td>
+        </tr>
+    </table>
+
+    <p style="margin:0 0 16px;color:#5c5c5c;font-size:14px;">Ο κωδικός ισχύει για 10 λεπτά.</p>
+
+    <p style="margin:0;color:#5c5c5c;font-size:14px;">Αν δεν ζήτησες εσύ αυτή την αλλαγή, αγνόησε αυτό το email. Τίποτα δεν θα αλλάξει.</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">Αυτό το email στάλθηκε επειδή ζητήθηκε αλλαγή email σε λογαριασμό του 3dealer.</p>
+@endsection

resources/views/vendor/core/auth/mail/email-changed-notice.blade.php

@@ -0,0 +1,21 @@
+@extends('emails.layout')
+
+@section('title', 'Το email του λογαριασμού σου άλλαξε')
+
+@section('preheader', "Νέο email λογαριασμού: {$maskedEmail}")
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        Το email του λογαριασμού σου άλλαξε
+    </h1>
+
+    <p style="margin:0 0 16px;">Το email σύνδεσης του λογαριασμού σου στο 3dealer άλλαξε σε <strong>{{ $maskedEmail }}</strong>.</p>
+
+    <p style="margin:0 0 24px;">Από εδώ και πέρα οι κωδικοί σύνδεσης θα πηγαίνουν στη νέα διεύθυνση.</p>
+
+    <p style="margin:0;color:#5c5c5c;font-size:14px;">Αν δεν έκανες εσύ αυτή την αλλαγή, <a href="{{ route('contact', ['locale' => 'el']) }}" style="color:#000000;">επικοινώνησε μαζί μας</a> άμεσα.</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">Αυτό το email στάλθηκε στην προηγούμενη διεύθυνση του λογαριασμού σου στο 3dealer.</p>
+@endsection

resources/views/vendor/core/auth/mail/otp.blade.php

@@ -0,0 +1,31 @@
+@extends('emails.layout')
+
+@section('title', 'Ο κωδικός σύνδεσής σου')
+
+@section('preheader', "Ο κωδικός σύνδεσής σου στο 3dealer: {$code}")
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        Ο κωδικός σύνδεσής σου
+    </h1>
+
+    <p style="margin:0 0 16px;">Γεια σου {{ $name }},</p>
+
+    <p style="margin:0 0 24px;">Χρησιμοποίησε τον παρακάτω κωδικό για να συνδεθείς στο διαχειριστικό του 3dealer.</p>
+
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
+        <tr>
+            <td align="center" bgcolor="#18c28a" style="background-color:#18c28a;border:1px solid #000000;border-radius:0;padding:20px;">
+                <span style="font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:32px;font-weight:800;letter-spacing:8px;color:#000000;">{{ $code }}</span>
+            </td>
+        </tr>
+    </table>
+
+    <p style="margin:0 0 16px;color:#5c5c5c;font-size:14px;">Ο κωδικός ισχύει για περιορισμένο χρονικό διάστημα και μπορεί να χρησιμοποιηθεί μία μόνο φορά.</p>
+
+    <p style="margin:0;color:#5c5c5c;font-size:14px;">Αν δεν ζήτησες εσύ αυτόν τον κωδικό, αγνόησε αυτό το email &mdash; ο λογαριασμός σου παραμένει ασφαλής.</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">Αυτό το email στάλθηκε επειδή ζητήθηκε σύνδεση στο διαχειριστικό του 3dealer.</p>
+@endsection

resources/views/vendor/core/auth/mail/user-otp.blade.php

@@ -0,0 +1,32 @@
+@extends('emails.layout')
+
+@section('title', 'Ο κωδικός σύνδεσής σου')
+
+@section('preheader', "Ο κωδικός σύνδεσής σου στο 3dealer: {$code}")
+
+@section('content')
+    <h1 style="margin:0 0 20px;font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:22px;line-height:1.3;font-weight:700;color:#000000;">
+        Ο κωδικός σύνδεσής σου
+    </h1>
+
+    {{-- A brand-new account has no name yet, and core falls back to the email — skip that. --}}
+    <p style="margin:0 0 16px;">Γεια σου{{ str_contains($name, '@') ? '' : ' '.$name }},</p>
+
+    <p style="margin:0 0 24px;">Χρησιμοποίησε τον παρακάτω κωδικό για να συνδεθείς στον λογαριασμό σου στο 3dealer.</p>
+
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="margin:0 0 24px;">
+        <tr>
+            <td align="center" bgcolor="#18c28a" style="background-color:#18c28a;border:1px solid #000000;border-radius:0;padding:20px;">
+                <span style="font-family:'Manrope',Arial,Helvetica,sans-serif;font-size:32px;font-weight:800;letter-spacing:8px;color:#000000;">{{ $code }}</span>
+            </td>
+        </tr>
+    </table>
+
+    <p style="margin:0 0 16px;color:#5c5c5c;font-size:14px;">Ο κωδικός ισχύει για 10 λεπτά και μπορεί να χρησιμοποιηθεί μία μόνο φορά.</p>
+
+    <p style="margin:0;color:#5c5c5c;font-size:14px;">Αν δεν ζήτησες εσύ αυτόν τον κωδικό, αγνόησε αυτό το email &mdash; ο λογαριασμός σου παραμένει ασφαλής.</p>
+@endsection
+
+@section('footer')
+    <p style="margin:0;">Αυτό το email στάλθηκε επειδή ζητήθηκε σύνδεση στο 3dealer με αυτή τη διεύθυνση email.</p>
+@endsection

resources/views/vendor/core/order/notifications/placed.blade.php

@@ -4,7 +4,15 @@
 
 <ul>
     @foreach ($lines as $line)
-        <li>{{ $line->quantity }} &times; {{ $line->description }} — {{ $line->total?->formatted }}</li>
+        <li>
+            {{ $line->quantity }} &times; {{ $line->description }} — {{ $line->total?->formatted }}
+            {{-- Text answers only — photo answers are deliberately left out of emails. --}}
+            @foreach ($line->meta['custom_fields'] ?? [] as $field)
+                @if ($field['type'] !== 'file')
+                    <br>{{ $field['label'] }}: {!! nl2br(e($field['value'])) !!}
+                @endif
+            @endforeach
+        </li>
     @endforeach
 </ul>
 

resources/views/wishlist/guest.blade.php

@@ -0,0 +1,29 @@
+{{-- A guest's wishlist (from the cookie). Logged-in users get account/wishlist instead. --}}
+@extends('layouts.app')
+
+@section('title', __('storefront.account.nav_wishlist'))
+
+@push('seo')
+    <meta name="robots" content="noindex, follow">
+@endpush
+
+@section('content')
+
+    <section class="flex flex-col gap-12 px-4 py-20 sm:px-8 lg:px-16">
+
+        <div class="flex flex-col gap-6">
+            <h1 class="font-display text-h3 font-black tracking-tight sm:text-h2">
+                {{ __('storefront.account.nav_wishlist') }}
+            </h1>
+
+            <p>
+                {{ __('storefront.wishlist.guest_hint') }}
+                <a href="{{ route('login') }}" class="font-bold underline hover:no-underline">{{ __('storefront.auth.login') }}</a>
+            </p>
+        </div>
+
+        @include('wishlist.list')
+
+    </section>
+
+@endsection