Bump version to 0.18.1

This commit introduces the data retention and data export Admin Services, accessed by the Boboko admin UI

CHANGELOG.md

@@ -4,9 +4,260 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.18.1] - 2026-09-16
+
+### Added
+- `Modules\Core\Payment\Privacy\PaymentDataProvider` — `lunar_transactions` (`card_type`/
+  `last_four`) and `stripe_payment_intents` were previously uncovered by any Privacy provider.
+  Pseudonymizes card metadata on erasure (same tax/accounting retention reasoning as
+  `OrderDataProvider`); deletes the Stripe correlation rows outright, since their only purpose
+  (resolving an async webhook callback) has already been served by the time an erasure request
+  runs. No Stripe Customer object exists anywhere in this app to also request deletion of — see
+  `docs/payments.md` "Reconciliation".
+- `Modules\Core\Auth\Privacy\UserSessionDataProvider` — `user_sessions` (`ip_address`,
+  `user_agent`) was previously uncovered. User-scope only; deleted outright on erasure, no legal
+  retention argument applies to login-session metadata.
+- `Modules\Core\Logging\Privacy\ActivityLogDataProvider` — Spatie's `activity_log` table
+  (`Modules\Core\Logging\ActivityLogService`, plus several Lunar models' native `LogsActivity`)
+  durably retained full PII snapshots in `properties` even after the real row was erased
+  elsewhere. Redacts `properties` by subject (`Customer`/`Address`/`CartAddress`/`OrderAddress`/
+  `Transaction`) on erasure; deliberately never touches `causer_id`, which is an actor reference,
+  not PII content. Must run before `AddressDataProvider` in `config('core.privacy.providers')` —
+  see the class's own docblock.
+- `ErasureOutcome::Failed` — a provider throwing an exception is now a genuine, distinct outcome
+  from `Skipped` (a deliberate no-op), surfaced in the erasure report rather than silently
+  aborting the request.
+
+### Fixed
+- `PrivacyService::completeErasure()` and `ExportDataSubjectJob::handle()` ran every registered
+  provider through a plain `array_map()` with no per-provider error handling — one provider
+  throwing aborted the entire request, discarding every other provider's already-computed
+  result and leaving the request stuck `Pending`/`Failed` with no report at all. Both now catch
+  per-provider (`PrivacyService::safeErase()`, `ExportDataSubjectJob::safeExport()`), logging the
+  exception and recording `ErasureOutcome::Failed`/`ProviderExportResult::$error` for that one
+  provider while every other provider's result is still recorded normally. Verified live:
+  simulating a throwing provider mid-erasure now correctly completes the request with a mixed
+  `erased`/`failed`/`erased` report instead of leaving it `Pending` forever.
+- `CartDataProvider`/`OrderDataProvider` never covered PII-adjacent keys living in `Cart.meta`/
+  `Order.meta`/`OrderAddress.meta` — `recovery_consent*`, `payment_method`, `checkout_fingerprint`
+  (Cart), `terms_accepted*` (Order), and `box_now_locker` (OrderAddress) all survived an erasure
+  request untouched. Both providers now clear these keys alongside their existing address/
+  free-text field erasure.
+- `CustomerDataProvider::eraseForUser()` left `otp_code`/`otp_expires_at`/`otp_attempts` on an
+  otherwise-erased `User` row. Now cleared alongside name/email.
+- `Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource`'s "Outcome" section
+  referenced `docs/privacy.md` directly in staff-facing UI text (meaningless to a user with no
+  repo access) and rendered the per-provider report as raw JSON strings via a `KeyValueEntry`
+  (the wrong component for a list of structured rows). Replaced with a plain-language
+  description and a proper `RepeatableEntry` table (Data category / Outcome badge / Reason).
+
+### Changed
+- The 5 existing Privacy providers (`CustomerDataProvider`, `AddressDataProvider`,
+  `OrderDataProvider`, `CartDataProvider`, `ReviewDataProvider`) moved out of
+  `Modules\Core\Privacy\Providers` into their owning domain module's own `Privacy/` subdirectory
+  (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`) — `Modules\Core\Privacy` now owns only
+  the shared contract, request lifecycle, and DTOs/enums. Matters concretely if a module is ever
+  extracted into its own composer package: the provider that knows how to erase that module's
+  data now travels with it, rather than being stranded in `Privacy` depending on a package that
+  no longer ships in this repo. See `docs/privacy.md` for the full reasoning.
+
+## [0.18.0] - 2026-09-16
+
+### Added
+
+Customer-portal backend groundwork — no routes/controllers/views yet (a storefront-facing UI is
+3dealer's job once a frontend designer picks it up), but the boboko-owned services it needs to
+call now exist:
+
+- `Modules\Core\Auth\Services\UserOtpService::validate()` now actually logs the shopper in
+  (`Auth::login()`, `web` guard) — previously it only returned the `User` model with no session
+  established and no route/controller anywhere ever called it (the checkout page's "Login" tab
+  was a disabled placeholder). `Auth::login()` alone is enough to merge/associate any active
+  guest cart too — it fires `Illuminate\Auth\Events\Login`, which Lunar's own
+  `Lunar\Listeners\CartSessionAuthListener` (registered unconditionally in core, no opt-in
+  needed) already reacts to, honoring `config('lunar.cart.auth_policy')` (`'merge'` by default).
+  An earlier draft of this also called `Cart::associate()` directly from this service — removed
+  as redundant and actually wrong: it ran a second, separate association with a hardcoded
+  `'merge'` policy that ignored whatever a consumer had actually set `auth_policy` to. Also fixed
+  an unbounded brute-force window: a 6-digit code (1M combinations, was guessable for its full
+  10-minute expiry with no attempt cap) now invalidates itself after 5 wrong guesses
+  (`users.otp_attempts`, new column), forcing a fresh code request rather than leaving a live one
+  guessable indefinitely.
+- `Modules\Core\Auth\Events\CustomerLoggedIn` — dispatched on every successful OTP login (new
+  user or returning), for a storefront to hook into (e.g. post-login redirect, analytics).
+- `Modules\Core\Customer\Services\CustomerAccountService` — the storefront-facing "My Account"
+  API (mirrors `CartService`/`CheckoutService`'s shape): `orders()` (paginated, placed orders
+  only), `order()`, `addresses()`, `createAddress()`/`updateAddress()`/`deleteAddress()`,
+  `updateProfile()`. Every method is scoped to the given user's own `latestCustomer()` — there
+  is no method that accepts a bare order/address id without also requiring the owning user, so a
+  controller built on top of this can't leak one customer's data to another by trusting a
+  client-supplied id alone (verified live: a second customer attempting to read/edit the first's
+  address or order gets `AddressNotFoundException`/`OrderNotFoundException`, not the record).
+
+### Fixed
+- `Modules\Core\Auth\Services\UserOtpService::validate()`'s wrong-guess counter (`otp_attempts`)
+  was read-check-increment-saved with no locking — two guesses fired in parallel for the same
+  user could each read the same pre-increment value and both save past `max_attempts`, letting an
+  attacker exceed the 5-guess lockout by parallelizing requests instead of sending them serially.
+  Now wrapped in a `DB::transaction()` with `lockForUpdate()` on the user row, so concurrent
+  guesses serialize correctly against the shared counter.
+- The OTP code comparison used a plain `!=` rather than a timing-safe comparison. Now
+  `hash_equals()`.
+
+## [0.17.5] - 2026-09-15
+
+### Added
+
+- Greek translations for `Lunar\Models\Country`/`State` reference data (`lang/el/countries.php`,
+  `lang/el/states.php`), keyed by the exact English spellings Lunar's own installer seeds for
+  Greece (fetched from `data.lunarphp.io/countries+states.json`). Loaded via
+  `loadTranslationsFrom()` under the `core::` namespace — a plain lang file, not
+  `Modules\Core\Localization`'s DB-backed `TranslationService`, since this is fixed reference
+  data, not admin-editable UI copy. A consuming app's storefront looks these up itself (e.g.
+  `__('core::countries.'.$country->name)`) — core has no storefront UI of its own to wire this
+  into.
+- `Modules\Core\Order\Filament\Extensions\OrderActionsExtension::fixCaptureAction()` — reroutes
+  the backoffice "Capture" header action through `Modules\Core\Payment\Support\
+TransactionDriverAdapter::capture()`, the same app-level payment pipeline checkout-time captures
+  use, instead of vendor Lunar's `Lunar\Models\Transaction::capture()` (which resolved
+  `Lunar\Facades\Payments`, an entirely separate, unused driver registry, and never dispatched
+  `Modules\Core\Payment\Events\PaymentCaptured`).
+- `Modules\Core\Payment\Drivers\StripePaymentDriver::cardMetaFromIntent()` — extracts card
+  brand/last-four digits from the Stripe PaymentIntent's `latest_charge`, populated into
+  `PaymentResult::$meta` and mapped onto `Transaction.card_type`/`last_four` by
+  `Modules\Core\Order\Services\TransactionRecorder`. Fixes the admin activity log's "Payment of
+  :amount on card ending :last_four" line rendering with no digits, on both checkout-time and
+  manual captures. Only applies to transactions recorded after this change.
+- `PaymentMethod.name` and `Lunar\Shipping\Models\ShippingMethod.name` are now locale-keyed JSON
+  columns, rendered in Filament via Lunar's own `Lunar\Admin\Support\Forms\Components\
+TranslatedText` — one input per configured `Language` row, same shape/resolution as
+  Product/Collection names. Existing plain-string rows are preserved under the store's default
+  language on migration. `ShippingMethod` has no model cast/`ModelManifest` extension point
+  available (vendor table, `Contracts\ShippingMethod` exists but is never bound by the package),
+  so its translation is decoded/encoded at the Filament field boundary and via the new
+  `Modules\Core\Shipping\Support\ShippingMethodName::resolve()` helper, rather than a model cast.
+- `Modules\Core\Shipping\Contracts\DeclaresFulfillmentType` — lets a shipping rate driver declare
+  whether it fulfils via carrier delivery or in-store pickup as a hardcoded fact about the driver
+  (`AcsRateDriver`, `BoxNowRateDriver` both declare `'carrier'`), instead of asking a merchant to
+  also pick "Carrier delivery" on every row regardless of driver. The merchant-facing "Fulfillment
+  type" Select (`ShippingMethod.data['fulfillment_type']`) now only appears for
+  table-rate-shipping's generic drivers (flat-rate, ship-by, free-shipping), which are genuinely
+  ambiguous, and moved next to `charge_by` instead of trailing at the end of the form,
+  disconnected from the decisions it relates to. `Modules\Core\Shipping\Support\
+FulfillmentType::resolve()`/`isStorePickup()` is the new single source of truth, replacing a
+  direct `data['fulfillment_type']` read in `Order::isStorePickupOrder()`.
+
+### Fixed
+
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` never advanced `Order::status` past
+  `awaiting_payment` on a capture — only `paid`/`paid_at` were written, so a fully captured order
+  could sit indefinitely at "awaiting payment" until a staff member manually clicked "Update
+  Status". Now, on `PaymentCaptured` (not `PaymentAuthorized`), `status` advances to the next step
+  in the order's flow, but only when it's still exactly `awaiting_payment`, so a duplicate/delayed
+  capture event never regresses an order staff already moved further.
+- `Lunar\DataTypes\ShippingOption::$collect` (the flag `docs/checkout.md` documents as the
+  mechanism for detecting a pickup option at checkout) was never actually set by any shipping rate
+  driver — `Modules\Core\Shipping\Concerns\ResolvesFixedPricing` now populates it from the same
+  `FulfillmentType` resolution `Order::isStorePickupOrder()` uses, closing a real gap between
+  documented and actual behavior.
+
+### Changed
+
+- `Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension` renamed to
+  `OrderActionsExtension` — the class now fixes both the refund and capture header actions on the
+  order page, not just refund.
+- Removed the `lunarphp/stripe` dependency in favour of depending on `stripe/stripe-php` directly.
+  `Modules\Core\Payment\Drivers\StripePaymentDriver` had already replaced every bit of Lunar's own
+  Stripe payment flow (checkout, webhook processing) with its own — all that remained load-bearing
+  from the package was raw API-client access, amount conversion, and a correlation table, none of
+  which are Lunar-specific. Added first-party replacements: `Modules\Core\Payment\Support\
+StripeManager`, `Modules\Core\Payment\Models\StripePaymentIntent`, `Modules\Core\Payment\Http\
+Middleware\StripeWebhookMiddleware`, and a first-party copy of the vendor's
+  `create_stripe_payment_intents_table` migration (guarded with `Schema::hasTable()`). No behavior
+  change for consuming apps.
+
+## [0.17.4] - 2026-09-15
+
+### Added
+
+- `boboko:catalog:backfill-skus` — one-off Artisan command to generate a SKU
+  (`SKU-P{product_id}-V{variant_id}`) for every `Lunar\Models\ProductVariant` left with a `null`
+  SKU by the earlier Shopify import (the source export's `Variant SKU` column was genuinely blank
+  for these rows, not an importer mapping bug — see `Modules\MigrateImport\Shopify\
+ShopifyExportImporter`). Only touches variants missing a SKU; `--dry-run` lists what would
+  change without writing.
+
+## [0.17.3] - 2026-09-15
+
+### Changed
+
+- Removed the `lunarphp/stripe` dependency in favour of depending on `stripe/stripe-php` directly.
+  `Modules\Core\Payment\Drivers\StripePaymentDriver` had already replaced every bit of Lunar's own
+  Stripe payment flow (checkout, webhook processing) with its own — all that remained load-bearing
+  from the package was raw API-client access, amount conversion, and a correlation table, none of
+  which are Lunar-specific. Added first-party replacements: `Modules\Core\Payment\Support\
+StripeManager` (API client + `toStripeAmount()`/`fromStripeAmount()`), `Modules\Core\Payment\
+Models\StripePaymentIntent` (now with a proper `context` array cast, replacing manual
+  `json_encode`/`json_decode`), and `Modules\Core\Payment\Http\Middleware\
+StripeWebhookMiddleware`. Added `database/migrations/..._create_stripe_payment_intents_table.php`,
+  a first-party copy of the vendor migration (guarded with `Schema::hasTable()` so it's a no-op on
+  any environment that already has the table from the vendor package's own earlier migration run,
+  and only actually creates it on a genuinely fresh install). No behavior change for consuming
+  apps — same table, same driver contract, same webhook endpoint.
+
+## [0.17.2] - 2026-09-15
+
+### Fixed
+
+- `Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus` never advanced `Order::status` past
+  `awaiting_payment` on a capture — only `paid`/`paid_at` were written, so a fully captured order
+  could sit indefinitely at "awaiting payment" until a staff member manually clicked "Update
+  Status". Now, on `PaymentCaptured` (not `PaymentAuthorized` — an authorization isn't yet
+  captured funds), `status` advances to the next step in the order's flow
+  (`Modules\Core\Order\Services\OrderStatusFlow::nextOptions()`) — but only when it's still
+  exactly `awaiting_payment`, so a duplicate/delayed capture event never regresses an order staff
+  already moved further.
+- The backoffice "Capture" action on the order page (Filament) called vendor Lunar's
+  `Lunar\Models\Transaction::capture()` directly, which resolves `Lunar\Facades\Payments` — an
+  entirely separate, unused driver registry — and never dispatched `Modules\Core\Payment\Events\
+PaymentCaptured`. This meant a manual capture from the admin panel never ran this app's own
+  payment pipeline at all (including the status-advance fix above). `Modules\Core\Order\Filament\
+Extensions\OrderActionsExtension` (renamed from `OrderRefundActionsExtension`, since it now
+  fixes both the refund and capture header actions — see below) now routes capture through
+  `Modules\Core\Payment\Support\TransactionDriverAdapter::capture()`, the same app-level path
+  checkout-time captures use.
+- `Modules\Core\Payment\Drivers\StripePaymentDriver` never extracted a card's brand/last four
+  digits from Stripe's response, so `Lunar\Models\Transaction::card_type`/`last_four` were always
+  empty and the admin's "Payment of :amount on card ending :last_four" activity-log line rendered
+  with no digits — reproduced on both checkout-time and manual captures. Added
+  `cardMetaFromIntent()`, reading `payment_method_details` off the PaymentIntent's `latest_charge`
+  (same source `lunarphp/stripe`'s own `StoreCharges` uses), populated into `PaymentResult::$meta`
+  from `resultFromIntent()` and `capture()`. `Modules\Core\Order\Services\TransactionRecorder`
+  now maps `meta['card_type']`/`meta['last_four']` onto the `Transaction` row. Only applies to
+  transactions recorded after this change — existing rows are not backfilled.
+
+### Changed
+
+- `Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension` renamed to
+  `OrderActionsExtension` — the class now fixes both the refund and capture header actions on the
+  order page, not just refund, so the old name undersold its scope.
+
+## [0.17.1] - 2026-09-15
+
+### Fixed
+
+- `Modules\Core\Payment\Drivers\StripePaymentDriver::createAndConfirm()` only set
+  `automatic_payment_methods` when no `payment_method` was given — the actual checkout flow always
+  sends one, so it was omitted, and Stripe fell back to whatever payment methods are enabled in the
+  Dashboard and demanded a `return_url` on confirm. Fixed by setting `automatic_payment_methods`
+  unconditionally with `allow_redirects: never` — the storefront's Payment Element already restricts
+  itself to `paymentMethodTypes: ['card']`, so this just tells Stripe the same thing server-side,
+  which drops the `return_url` requirement.
+
 ## [0.17.0] - 2026-09-14
 
 ### Added
+
 - `Modules\Core\Order\Notifications\OrderPlacedNotification` — an order confirmation email,
   registered against `Modules\Core\Checkout\Events\OrderPlaced` (fires exactly once per order,
   regardless of `capture_mode`/driver). Previously only a Stripe (auto-captured) order triggered
@@ -22,7 +273,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `always`/`backorder` variants are deliberately left alone (their stock has no purchasing
   consequence, decrementing it would just make the column an inaccurate negative number). Also
   re-triggers Scout reindexing for every affected product, closing the gap `Modules\Core\Catalog\
-  Services\ProductIndexer`'s own docblock flagged ("nothing currently reindexes a product when an
+Services\ProductIndexer`'s own docblock flagged ("nothing currently reindexes a product when an
   order decrements its stock") — the search index's `in_stock` filter now reflects the change
   immediately rather than only on the next scheduled reindex.
 - `Modules\Core\Cart\Services\CartLifecycleService` — the single source of truth for the four
@@ -67,12 +318,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   courier might not reconcile cash for weeks after an order is already marked completed.
 
 ### Changed
+
 - **Order status model, redesigned from scratch.** `Order.status` is a single column again
   (a same-session 3-axis `payment_status`/`fulfillment_status`/`return_status` design was built,
   then abandoned before shipping — three independent selects let staff set any combination with no
   cross-field validation, and didn't map onto how staff actually think about an order: one linear
   journey, not three simultaneous dials). Now driven by `Modules\Core\Order\Services\
-  OrderStatusFlow`, a pure transition-table service offering exactly two sequences — carrier and
+OrderStatusFlow`, a pure transition-table service offering exactly two sequences — carrier and
   store-pickup (`Order::isStorePickupOrder()`) — never four; payment method (prepaid vs. COD)
   affects `Order::paid` only, not which sequence an order follows or where it sits in it. The
   Filament order page's several guided buttons are replaced by three header actions: "Update
@@ -121,14 +373,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
     redirect a parcel to a different locker than the one the customer picked at checkout; it's only
     editable for the (current, checkout-UI-less) case where nothing set it yet.
 - New "Shipments" section on the order page (`Modules\Core\Shipping\Extensions\
-  OrderShipmentsExtension`, between Transactions and Timeline) — "Create Shipment" previously had no
+OrderShipmentsExtension`, between Transactions and Timeline) — "Create Shipment" previously had no
   counterpart anywhere to actually see what it created. One entry per `Shipment` record (a multi-box
   Box Now order shows one entry per parcel), rendered as two inline-labelled lines — carrier +
   tracking reference, then status + a "Created … · Locker …" helper line — rather than a grid of
   individually stacked label/value blocks, which reads as a wall of repeated labels once the admin's
   main content area narrows below Filament's own grid breakpoint (1024px, common with the sidebar
   open). Two actions per shipment: "Print Label" and "Cancel". Also added `Modules\Core\Shipping\
-  Http\Controllers\DownloadShipmentLabelController` (short-lived signed URL, same auth model as
+Http\Controllers\DownloadShipmentLabelController` (short-lived signed URL, same auth model as
   Lunar's own vendor order-PDF download) — the only other place that called
   `CarrierFulfillmentInterface::printLabel()` (`ManagePickupManifests`' bulk "Print" action)
   discarded the returned bytes entirely; this is the first place in the codebase that actually
@@ -141,16 +393,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   plain `int $shipment` and looking the record up directly in the controller.
 - `Modules\Core\Shipping\Enums\TrackingStatus::Failed` — previously unused — is now wired to the
   new `delivery_failed` status via `Modules\Core\Order\Listeners\
-  MarkDeliveryFailedOnCarrierCheckpoint`, from which staff can retry dispatch or convert to a
+MarkDeliveryFailedOnCarrierCheckpoint`, from which staff can retry dispatch or convert to a
   return.
 - Fixed a separate, unrelated bug hit while testing the above: `Lunar\Shipping\Models\
-  ShippingMethod::macro('isStorePickup', ...)` silently never registered — `Lunar\Base\Traits\
-  HasModelExtending::__callStatic()` (used by every `Lunar\Base\BaseModel` subclass that doesn't
-  declare its own `macro()`, `ShippingMethod` included) intercepts *every* unmatched static call
+ShippingMethod::macro('isStorePickup', ...)` silently never registered — `Lunar\Base\Traits\
+HasModelExtending::__callStatic()` (used by every `Lunar\Base\BaseModel` subclass that doesn't
+  declare its own `macro()`, `ShippingMethod` included) intercepts _every_ unmatched static call
   and dispatches it as an instance call instead of forwarding to `Macroable`, so `hasMacro()` always
   returned `false` and every order was silently treated as carrier-fulfilled — including store-pickup
   ones. `Order::isStorePickupOrder()` (the only caller) now reads `ShippingMethod.data
-  ['fulfillment_type']` directly instead of going through the broken macro.
+['fulfillment_type']` directly instead of going through the broken macro.
 - `CartResource::getEloquentQuery()` no longer filters to carts with a known `user_id`/
   `customer_id` — every cart is now listed, guest carts included. Reverses an earlier deliberate
   exclusion (an anonymous cart has nothing a staff member could click into — no name, no email),
@@ -199,7 +451,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
     broke the relation manager's Livewire component mount, surfacing as a CSRF-token 419 redirect
     loop specifically on `/boboko/manifests/{id}`.
 - "Create Shipment"'s ACS branch gained a "Number of packages" field (`ShipmentRequest::
-  $packageCount`, already plumbed through to ACS's `Item_Quantity`/`persistMultipartVouchers()` but
+$packageCount`, already plumbed through to ACS's `Item_Quantity`/`persistMultipartVouchers()` but
   never exposed in the form) — more than 1 issues a main voucher plus a multi-part sub-voucher per
   extra package, each its own `Shipment` row sharing the same total weight. The existing weight
   field was relabeled "Total weight (kg)" to make explicit that ACS bills by one total shipment
@@ -208,6 +460,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.16.3] - 2026-09-10
 
 ### Fixed
+
 - Stripe `createAndConfirm()` built its `PaymentIntent` params with
   `'automatic_payment_methods' => isset($data['payment_method']) ? null : ['enabled' => true]`. The
   Stripe PHP SDK does not omit `null`-valued params from `create()` — it serializes them to an empty
@@ -216,7 +469,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `payment_method` was supplied (i.e. every real charge in this flow). Fixed by building `$params`
   conditionally so the key is either omitted entirely or set to `['enabled' => true]`, never `null`.
 - `Modules\Core\Payment\Filament\Resources\PaymentMethodResource`'s "Driver status" column only
-  flagged a payment method whose driver *class* no longer resolves (`driver_missing_at`) — it gave
+  flagged a payment method whose driver _class_ no longer resolves (`driver_missing_at`) — it gave
   no indication when a driver resolves fine but fails `Configurable::isConfigured()` (e.g. Stripe
   enabled in the DB with no `services.stripe.key` set), which `CheckoutService::getPaymentMethods()`
   filters out identically. An admin had no way to tell "this method is silently absent at checkout
@@ -247,7 +500,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `Lunar\Managers\CartSessionManager` memoizes one `Cart` instance per request, so this was true on
   every request where the checkout page's initial render had already calculated the cart. The
   result: after switching payment methods, the just-saved `meta['payment_method']` change was
-  persisted, but the cart's totals silently kept reflecting whichever method was calculated *first*
+  persisted, but the cart's totals silently kept reflecting whichever method was calculated _first_
   in the request — a shopper switching from Cash in Hand to Cash on Delivery would keep seeing Cash
   in Hand's total, with no COD fee applied, until something else forced a fresh calculation. Fixed
   by calling `$cart->recalculate()` instead, which forces the pipeline to re-run.
@@ -255,6 +508,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.16.2] - 2026-09-09
 
 ### Fixed
+
 - `Lunar\Base\ShippingManifest` is a request-lifetime singleton whose `getOptions()` re-runs the
   shipping modifier pipeline without ever clearing its `$options` collection first, and whose
   `addOption()` keeps the first entry per `getIdentifier()` and silently drops any later one. In
@@ -271,16 +525,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.16.1] - 2026-09-09
 
 ### Fixed
+
 - OTP login page (`resources/views/auth/filament/pages/login.blade.php`) had no visible spacing
   between the email/OTP input, error text, and buttons following the Filament v3 → v4 upgrade.
   The view relied on a bare `grid gap-y-4` Tailwind utility class, but since this view ships from
   the `boboko-core` package rather than a consuming app, that class was never present in any
   host app's compiled Tailwind output. Replaced with an inline `style` (flex column, `row-gap:
-  1rem`) so the layout no longer depends on the consuming app's Tailwind content scanning.
+1rem`) so the layout no longer depends on the consuming app's Tailwind content scanning.
 
 ## [0.16.0] - 2026-09-08
 
 ### Added
+
 - `Modules\Core\Checkout\Services\CheckoutService::setRecoveryConsent(bool $consent): Cart` — the
   shopper's promotional/abandoned-cart-recovery opt-in, given once during guest checkout and
   deliberately independent of `setShippingAddress()`/`setBillingAddress()`: consent is a
@@ -296,9 +552,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `Modules\Core\Checkout\Events\RecoveryConsentSet`. Newsletter opt-in is explicitly a separate
   scope — never merged into this flag.
 - `Modules\Core\Checkout\Services\CheckoutService::initiatePayment()` now requires `bool
-  $termsAccepted` and `string $policyVersion` as mandatory parameters (not optional data a caller
+$termsAccepted` and `string $policyVersion` as mandatory parameters (not optional data a caller
   might omit) — throws the new `Modules\Core\Checkout\Exceptions\TermsNotAcceptedException`
-  *before* `Cart::createOrder()` is ever called if `$termsAccepted` is `false`, so an order can
+  _before_ `Cart::createOrder()` is ever called if `$termsAccepted` is `false`, so an order can
   never exist without a recorded acceptance (refused, not created-then-flagged). On success,
   writes `terms_accepted` (`true`), `terms_accepted_at` (ISO 8601), and
   `terms_accepted_policy_version` onto the created `Order`'s own `meta` — the durable,
@@ -319,6 +575,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.15.0] - 2026-09-07
 
 ### Changed
+
 - **Breaking:** `Modules\Core\Payment\Models\PaymentMethod` is now the full DB-instance layer for
   Payment, same three-layer split (registry / DB instance / cross-cutting config) `Shipping`
   already has via `ShippingMethod` — see `docs/payments.md`. Every value that used to live in
@@ -328,13 +585,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   (admin-facing label, nothing played this role before), `capture_mode`, `captured_status`,
   `authorized_status`, `position` (admin-controlled ordering, new — reorderable in the Filament
   table), `driver_missing_at`. `config('lunar.payments.types')` is gone entirely; `config/
-  payment.php` now holds only `cart_pipeline` (genuinely cross-cutting — every store gets the
+payment.php` now holds only `cart_pipeline` (genuinely cross-cutting — every store gets the
   same pipeline wiring regardless of how many payment methods it configures).
 - **Breaking:** `Modules\Core\Payment\Services\PaymentDriverResolver` is deleted, replaced by
   `Modules\Core\Payment\Services\PaymentDriverRegistry` — `register(string $key, string
-  $driverClass)`/`resolve(string $key): ?object`/`all(): array<string, string>`. Deliberately
+$driverClass)`/`resolve(string $key): ?object`/`all(): array<string, string>`. Deliberately
   knows nothing about `PaymentMethod` or the database (mirrors `Lunar\Shipping\Managers\
-  ShippingManager`'s built-in-methods + `Manager::extend()` split, purpose-built rather than
+ShippingManager`'s built-in-methods + `Manager::extend()` split, purpose-built rather than
   extending `Illuminate\Support\Manager` — Payment's drivers implement several independent
   capability interfaces at once, not one uniform contract). Built-ins (`OfflinePaymentDriver`
   as `'offline'`, `StripePaymentDriver` as `'stripe'`) registered in
@@ -363,6 +620,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   should be called; that's a merchant decision). Skip-if-exists, same as before.
 
 ### Added
+
 - `php artisan boboko:payment:sync-drivers` — reconciles every `PaymentMethod` row's `driver`
   against `PaymentDriverRegistry`, setting `driver_missing_at` when a driver no longer resolves
   (a package removed, a custom `register()` call deleted) and clearing it automatically if that
@@ -393,9 +651,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `Modules\Core\Payment\Models\CoreTransaction` (a `Lunar\Models\Transaction` subclass) +
   `Modules\Core\Payment\Support\TransactionDriverAdapter`, registered via
   `Lunar\Facades\ModelManifest::replace(Lunar\Models\Contracts\Transaction::class,
-  CoreTransaction::class)` — the same contract-swap mechanism already used elsewhere for
+CoreTransaction::class)` — the same contract-swap mechanism already used elsewhere for
   `Customer`/`Staff`. Fixes a real crash (`InvalidArgumentException: Driver [cash-on-delivery] not
-  supported`) the first time anything called `$transaction->refund()`/`->capture()`:
+supported`) the first time anything called `$transaction->refund()`/`->capture()`:
   `Lunar\Models\Transaction::driver()` calls Lunar's own, entirely separate
   `Lunar\Facades\Payments::driver()` manager, which had never heard of any of this codebase's
   driver keys. `CoreTransaction::driver()` returns `TransactionDriverAdapter` instead, which
@@ -404,7 +662,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   system underneath, including correctly reporting failure (not a silently-faked success) when
   the resolved driver doesn't implement `SupportsRefunds`/`SupportsCaptures`.
 - `TransactionDriverAdapter::refundVia(Transaction $transaction, ?string $driverKey, int $amount,
-  ?string $notes = null)` — refund through an explicitly chosen driver, independent of the one
+?string $notes = null)` — refund through an explicitly chosen driver, independent of the one
   the original payment went through (e.g. a cash-on-delivery order refunded via Bank Transfer,
   which has no notion of the original offline payment at all). The order page's refund action
   gained a "Refund via" `Select` (every `PaymentDriverRegistry` driver implementing
@@ -439,18 +697,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - New `payment_methods.refunded_status` column + form field (same `Select` pattern as
   `captured_status`/`authorized_status`) — `ApplyResolvedPaymentStatus` now also reacts to
   `PaymentRefunded`, so `Order.status` actually changes on a refund; before this, only the
-  *derived* `Order::paymentStatus()` reflected a refund (reading `transactions` live), while the
+  _derived_ `Order::paymentStatus()` reflected a refund (reading `transactions` live), while the
   stored `status` column — what admin filtering, customer emails, etc. actually key off — never
   moved. Resolves the ORIGINAL payment method for this lookup, not the refund event's own
   `$type`: a refund routed through a different driver via `refundVia()` (e.g. cash-on-delivery
   refunded through Bank Transfer) carries the REFUND driver's registry key as `$event->type`,
   which usually isn't even a real `PaymentMethod.type` — the listener now finds the order's
   earliest successful `capture`/`intent` transaction instead and reads `refunded_status` off
-  *that* transaction's own `PaymentMethod` row, since that's the payment the refund is actually
+  _that_ transaction's own `PaymentMethod` row, since that's the payment the refund is actually
   reversing. Deliberately no `void_status` yet — a void never moved money, so it doesn't carry
   the same "the customer needs to see this changed" weight a refund does.
 
 ### Fixed
+
 - Existing `PaymentMethod` rows seeded before this release (`cash-on-delivery`, `cash-in-hand`)
   had `driver`/`capture_mode`/`captured_status` all `NULL` after the migration ran — a data
   backfill was required (not automated by the migration itself) to restore them to a resolvable
@@ -478,15 +737,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.14.0] - 2026-09-03
 
 ### Changed
+
 - **Breaking:** `Modules\Core\Catalog\Services\ProductSearchService::search()` now returns `Modules\Core\Catalog\DTOs\ProductListingResult` — the exact same shape `ProductService::list()` already returns — instead of a bare `Illuminate\Database\Eloquent\Collection<Product>` of hydrated models with no pagination at all. New signature: `search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null, int $perPage = 24, int $page = 1): ProductListingResult`. `->products` is a real `LengthAwarePaginator` of plain, localized indexed-document arrays (not Eloquent models, not Scout's raw response) — a search results page and a category listing page are now interchangeable from a controller's perspective: same DTO, same `ProductCard::fromIndexed()` mapping, same pagination/sort/tag/price-slider handling. `->priceBounds`/`->availableTags` are scoped to the search query itself (delegated to `ProductService::priceSliderBounds()`/`availableTags()`, both of which already accepted a `$query` param for this).
 - `Modules\Core\Catalog\Services\ProductService::availableTags()` is now `public` (was `private`) and takes an optional `$query` parameter, so `ProductSearchService::search()` can reuse it directly instead of reimplementing the same facet call.
 
 ### Added
+
 - `Modules\Core\Catalog\Support\ProductDocumentLocalizer` — the per-locale field resolution and raw-Meilisearch-response unwrapping (`withLocalizedFields()`, `hitsFrom()`) extracted out of `ProductService` into its own class, since `ProductSearchService` needed the exact same logic against the exact same kind of document. Both services now depend on this one class instead of `ProductService` owning logic a second service also needed.
 
 ## [0.13.0] - 2026-09-03
 
 ### Changed
+
 - **Breaking:** `Payment` is now a genuinely standalone module — no direct calls into `Checkout`/`Order`, no reaching into their Eloquent models, communication only via events. The entire old `confirm()`-based flow is gone: `Modules\Core\Payment\Contracts\PaymentDriver` (and the already-stale `Modules\Core\Checkout\Contracts\PaymentDriver` duplicate), `Checkout\Events\PaymentConfirmed`, `Payment\Contracts\InitiatesPayment`, `Payment\DataTransferObjects\PaymentInitiation`, `Payment\Enums\PaymentInitiationMode`, `Payment\Events\PaymentSucceeded`/`PaymentFailed`, `Payment\Events\OrderPaymentStatusResolved`, and `Payment\Exceptions\PaymentNotConfirmedException` are all deleted. This flow was non-functional on `master` before this release — `CheckoutService::confirmPayment()` dispatched an event nothing listened for, so no order was ever placed after payment.
 - **Breaking:** Every payment operation is now its own explicit, opt-in contract, modeled on how real gateways (Stripe, Mastercard's own gateway, Nexi) actually split these operations — see `docs/payments.md`: `Modules\Core\Payment\Contracts\SupportsPay` (atomic authorize+capture), `SupportsAuthorization` (hold only), `SupportsCaptures` (settle a prior hold), `SupportsVoids` (release a prior hold without settling), `SupportsRefunds` (reverse settled funds), `HandlesPaymentCallback` (resolve an async pay()/authorize() later, from a webhook), and `Configurable` (`isConfigured()`, split out of the old single `PaymentDriver` interface). A driver implements only the operations its gateway actually supports.
 - **Breaking:** Every amount flowing through these contracts is `Lunar\DataTypes\Price` (Lunar's own bundled minor-unit-value + `Currency` type) — never a bare `int` paired separately with a `Currency`. Each driver converts at its own boundary (e.g. `StripeManager::toStripeAmount()`/`fromStripeAmount()`); `Payment` itself only ever speaks Lunar's `Price`.
@@ -495,6 +757,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `config/payment.php`'s `cash-on-delivery` entry gains `capture_mode` (`'pay'`, since `OfflinePaymentDriver` only implements `SupportsPay`) and `captured_status` (`'payment-offline'`, replacing the previously dead `'authorized' => 'awaiting-payment'` key, which nothing ever read).
 
 ### Added
+
 - `Modules\Core\Payment\DTOs\PaymentResult` — the one return shape every operation (`pay`, `authorize`, `capture`, `void`, `refund`, `handleCallback`) produces, regardless of gateway: `status` (`Modules\Core\Payment\Enums\PaymentResultStatus`: `Succeeded`/`Failed`/`Pending`), `reference`, `amount` (a `Price`), `failureReason`, `retriable` (real on Stripe/Mastercard's own soft-decline classification, always `false` on Nexi — it has no such signal), `raw` (the untouched gateway response, for audit), `meta`, and `continuation` (see below).
 - `Modules\Core\Payment\DTOs\PaymentContinuation` / `Modules\Core\Payment\Enums\PaymentContinuationType` — what a caller does next with a `Pending` `PaymentResult`, gateway-agnostically (`Redirect` or `ClientSecret`), so a storefront controller never needs gateway-specific knowledge of e.g. Stripe's own `PaymentIntent` fields to drive a 3-D Secure/redirect continuation.
 - Eight new events, one terminal pair per operation, replacing the old single `PaymentSucceeded`/`PaymentFailed`: `PaymentAuthorized`/`PaymentAuthorizationFailed`, `PaymentCaptured`/`PaymentCaptureFailed`, `PaymentVoided`/`PaymentVoidFailed`, `PaymentRefunded`/`PaymentRefundFailed`. `PaymentCaptured` is deliberately the same event whether money was taken via `pay()` (one gateway call) or `authorize()`→`capture()` (two calls) — "a payment has been captured" is the same business fact either way. Every event carries `{type, result: PaymentResult, context}` — `context` is an opaque bag the caller hands in and gets back untouched, so `Payment` never needs to know what a `Cart` or `Order` is.
@@ -504,22 +767,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `docs/payments.md` — full design notes: the operation/contract table cross-referenced against Mastercard/Stripe/Nexi's real APIs, why `PaymentResult` normalizes only what every gateway can always provide, the async-correlation pattern, and what's explicitly out of scope (a `Transaction`-writing listener, the `stripe` config entry, frontend Stripe Elements integration).
 
 ### Fixed
+
 - `Modules\Core\Checkout\Services\CheckoutService::selectPaymentMethod()` crashed (`Call to a member function toArray() on null`) the first time it ran against a cart whose `meta` column was still a genuine SQL `NULL` (any freshly-created cart) — `Cart::$meta`'s `AsArrayObject` cast returns `null`, not an empty array-like object, for a `null` column. Fixed with a null-safe fallback.
 - `Modules\Core\Shipping\Carriers\Acs\AcsRateDriver`/`BoxNowRateDriver` referenced `Lunar\Shipping\DTOs\ShippingOptionRequest`, a namespace that doesn't exist in the installed `lunarphp/table-rate-shipping` version (the real class is `Lunar\Shipping\DataTransferObjects\ShippingOptionRequest`) — crashed `Illuminate\Support\Manager`'s interface-compatibility check the moment anything touched `ShippingManager::getSupportedDrivers()`, including simply adding a line to a cart (via `Modules\Core\Shipping\Listeners\FlushLivePricingCache`).
 
 ## [0.13.1] - 2026-09-03
 
 ### Added
+
 - `Modules\Core\Order\Listeners\RecordPaymentTransaction` — writes the `lunar_transactions` row for a successful `PaymentCaptured`/`PaymentAuthorized`/`PaymentVoided`/`PaymentRefunded` event, via a new `Modules\Core\Order\Services\TransactionRecorder` (moved here from `Payment\Services`, and rewritten to take a `PaymentResult` directly instead of the deleted `CaptureResult`/`RefundResult` DTOs — `Payment` never writes to `Order`'s models, `Transaction.order_id` being required is exactly why this lives in `Order`, same reasoning as `ApplyResolvedPaymentStatus`). Closes a real gap introduced in `0.13.0`: `Order::paymentStatus()` (which derives its answer entirely from `$order->transactions`) always resolved to `PaymentStatus::Offline` — its "no transactions at all" fallback — regardless of what actually happened, since nothing had ever written a row. Verified live: a captured offline payment now produces a `type: capture` transaction and `Order::paymentStatus()` correctly resolves to `captured`.
 
 ## [0.12.1] - 2026-09-03
 
 ### Fixed
+
 - `Modules\Core\MigrateImport\Shopify\ShopifyExportImporter` now attaches a variant's `Variant Image` CSV column to that `ProductVariant`'s own `images()` media pivot (`media_product_variant`, `primary`/`position`). Previously the variant image was never read at all — every image from the CSV, including ones the export clearly scopes to one specific variant, went only into the product's own top-level gallery, so a variant swatch/option change had no way to show its own photo.
 - `Modules\Core\MigrateImport\Shopify\Resolvers\ProductOptionResolver::resolveOption()` now sets `label` (same value as `name`) when creating a `Lunar\Models\ProductOption`, not just `name`. A `ProductOption` with a null `label` crashes Lunar's own `ProductOptionIndexer::toSearchableArray()` (`foreach()` on `null`) the moment that option gets reindexed — every option created by the importer before this fix has a null `label` and needs a wipe-and-reimport (see `docs/shopify-reimport.md`, new in this release) to pick up the fix, since `firstOrCreate()` never revisits an already-existing row.
 - `product_reviews.product_id`'s foreign key had no `ON DELETE` clause, so deleting a reviewed `Product` threw a constraint violation instead of the review going with it, unlike every other product-dependent table. New migration adds `cascadeOnDelete()`.
 
 ### Added
+
 - `Modules\Core\Catalog\Services\ProductIndexer::mapVariant()` now embeds `gtin`, `mpn`, `ean`, `backorder`, `unit_quantity`, `shippable`, `tax_ref`, and `dimensions` (length/width/height/weight/volume, each with `value`+`unit`) on every indexed variant — previously only `id`/`sku`/`stock`/`purchasable`/`options`/`prices`/`media` were embedded, so a search result or filter needing any of these had no way to get at them without a separate Postgres query per variant.
 - `ProductIndexer::toSearchableArray()` adds a top-level, filterable `skus` field (every variant's SKU, deduplicated) — filtering/matching by SKU no longer requires reaching into the nested `variants` array.
 - `docs/shopify-reimport.md` — runbook for wiping every imported product (cascading through Lunar so Meilisearch documents go too) and re-running the importer from scratch, needed whenever a fix like the two above only takes effect on newly-created rows.
@@ -527,12 +794,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.12.0] - 2026-09-03
 
 ### Changed
+
 - **Breaking:** `Modules\Core\Catalog\Services\ProductService::list()` now returns `Modules\Core\Catalog\DTOs\ProductListingResult` (`->products`: the same `Illuminate\Pagination\LengthAwarePaginator` as before, `->priceBounds`: a new `Modules\Core\Catalog\DTOs\PriceSliderBounds`) instead of returning the paginator directly. A caller doing `$service->list(...)->items()`/`->through(...)` must update to `$service->list(...)->products->items()`/`->through(...)`. This collapses what used to be two separate calls a controller had to orchestrate itself (`list()` for products, `priceRange()` + manual floor/ceil/"is this actually filtered" math for the slider) into one.
 - **Breaking:** `Modules\Core\Catalog\Services\ProductSearchService::search()`'s signature changed from `search(string $query, ?string $locale = null)` to `search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null)` — the `$locale` parameter is gone (see "every configured language, always" below); `$filters`/`$sort` apply the same `Modules\Core\Catalog\Support\ProductFilterBuilder`/`ProductSort::toMeilisearchSort()` semantics `ProductService::list()` already used, so a text search can now be narrowed by price/brand/stock and sorted the same way a category listing can.
 - `ProductSearchService` now targets every configured store language's fields on every search (`Lunar\Models\Language::all()`), not just the current request locale plus the store's default language. The old `{current, default}` pairing silently stopped catching anything outside those two locales whenever they were equal (a single-language store, or a shopper browsing in the default language) — always searching every configured language closes that gap in both directions. See `docs/product-search.md`.
 - Extracted `Modules\Core\Catalog\Services\ProductService`'s private `buildFilter()` into a new standalone `Modules\Core\Catalog\Support\ProductFilterBuilder`, so `ProductSearchService` can apply the exact same Meilisearch filter-clause semantics to a text query, instead of reimplementing filter-building a second time.
 
 ### Added
+
 - `Modules\Core\Catalog\Services\ProductService::priceSliderBounds()` — `priceRange()` rounded to whole currency units (floor/ceil) plus whether the given selected min/max actually narrows it, returned as a `PriceSliderBounds` DTO. Used internally by `list()` now; also callable directly for a caller (e.g. a text-search results page) that needs slider bounds without a full `list()` call.
 - `Modules\Core\Catalog\Services\ProductService::priceRange()` gained an optional `string $query = ''` parameter, so a caller can scope the price range to a text search's own matches (pass the shopper's search text) instead of always spanning the whole catalog.
 - `Modules\Core\Catalog\Services\ProductService::random(int $limit)` — random products still scoped to the Meilisearch index's own channel/status visibility, unlike a raw `Product::inRandomOrder()` (which has no notion of that filtering). Meilisearch has no `ORDER BY RANDOM()` equivalent, so this fetches every matching id only (`attributesToRetrieve: ['id']`), shuffles in PHP, then fetches the full localized documents for just the ids picked, restoring the shuffled order afterward (Meilisearch's `id IN [...]` filter doesn't preserve list order on its own).
@@ -543,11 +812,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.11.1] - 2026-09-01
 
 ### Fixed
+
 - `Modules\Core\Catalog\Services\RecommendationService::recommend()` built its result with the base `Illuminate\Support\Collection` (`collect()`) instead of `Illuminate\Database\Eloquent\Collection`, even though every element is a `Product` model. `ProductIndexer::toSearchableArray()` calling `->load(['media', 'variants.prices'])` on that result threw `BadMethodCallException: Method Illuminate\Support\Collection::load does not exist` — silently failing every `MakeSearchable` queue job for a saved product (visible only as `FAIL` in the queue log, with the real exception in `storage/logs/laravel.log`). Fixed by having `RecommendationService` accumulate into a real `Eloquent\Collection` from the start.
 
 ## [0.11.0] - 2026-09-01
 
 ### Added
+
 - `Modules\Core\Catalog\Services\RecommendationService` — computes "related products" for a given product as a configurable, ordered chain of strategies (`config('catalog.recommendation_rules')`), not one hardcoded rule. Tops up from each successive rule until the limit (default 4) is reached or every rule is exhausted — e.g. 3 products from a same-category rule plus 1 from a random fallback — deduplicated across rules so the same product is never returned twice. Ships with `Modules\Core\Catalog\Recommendations\SameCategoryRule` (other products sharing the source product's first collection) and `RandomRule` (the universal fallback, placed last in the default chain). A new rule is just a class implementing `Modules\Core\Catalog\Contracts\RecommendationRule`. Documented in `docs/product-recommendations.md`.
 - `Modules\Core\Catalog\Services\ProductIndexer` embeds the result directly into each product's own Meilisearch document as `recommendations: [{id, name, price, image}, ...]` (`recommendations.id` filterable) — a product detail page renders its "related products" section with zero extra queries, same reasoning as the existing `collections` field. Deliberately embeds an `id` for the view to build a locale-correct URL from, not a resolved `href` — `product.show` is locale-prefixed, so a URL baked in at index time would only be correct for whichever locale happened to be active during that index run.
 - `Modules\Core\Catalog\Events\ProductSaved`/`ProductDeleted`, dispatched from `Product::saved()`/`Product::deleted()` in `CatalogServiceProvider` (the latter fires for both a soft delete and a force delete, matching Scout's own `unsearchable()` trigger point) — feed `Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct`, which reverse-searches Meilisearch for every product currently recommending the changed/deleted one (`recommendations.id = "..."` — there's no Postgres relation for this, a recommendation only exists inside the index) and re-indexes them via Scout's own `->searchable()`. Product creation is deliberately not hooked into this: a new product not yet appearing as a recommendation elsewhere is an accepted staleness window, the same tradeoff already documented for `in_stock`/`price` — see `docs/product-recommendations.md`.
@@ -556,28 +827,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.10.1] - 2026-09-01
 
 ### Added
+
 - `Modules\Core\Localization\Services\StorefrontLabels::all()` gains three keys found missing from `3dealer`'s actual `storefront.*` translation usage: `shop.price_min`, `shop.price_max`, `shop.reset` (the price-filter sidebar's min/max labels and its reset link). Picked up by `InstallLunarCommand`'s existing per-key upsert — re-running `lunar:install` on an already-installed store adds only these three rows, leaving everything already seeded or admin-edited untouched.
 
 ## [0.10.0] - 2026-08-31
 
 ### Changed
+
 - **Breaking:** Upgraded `lunarphp/lunar`, `lunarphp/core`, `lunarphp/stripe`, `lunarphp/table-rate-shipping`, and `lunarphp/search` to `1.5.0`, and `filament/filament` to `v4.12.6` — the first Filament v4 admin panel on this codebase. `lunarphp/filament3-2fa` and `kalnoy/nestedset` are gone, replaced by Filament v4's native two-factor auth and `lunarphp/nestedset`. Ran Filament's automated `filament-v4` migration tool across `src/`, then hand-fixed three bugs it introduced or left behind: a stale `$infolist` variable reference in `CartResource`'s `ViewCart` page (the parameter had been renamed to `$schema` but the body wasn't updated), `ShippingMethodResourceExtension` rewritten to call `getDefaultChildComponents()` (returns `array|Schema`) instead of the type-safe `getChildComponents()` (always `array<Component>`), and — unrelated to the tool, but surfaced by the same PHP version bump — `InvalidCouponException`'s `readonly $code` property illegally shadowing the built-in `Exception::$code`, renamed to `$couponCode`. `LunarStaff::addActivitylogExcept()` updated for the renamed `two_factor_secret`/`two_factor_recovery_codes` staff columns (now `app_authentication_secret`/`app_authentication_recovery_codes`; `two_factor_confirmed_at` removed). Consuming apps must run `composer update boboko/core --with-all-dependencies` and `php artisan migrate`.
 
 ### Added
+
 - `Modules\Core\Checkout\Contracts\PaymentDriver` — the abstraction every payment provider implements: `confirm(Cart $cart, string $type, string $fingerprint, array $data): Order` and `isConfigured(): bool`. A driver only ever calls `CheckoutService::placeOrder()` once it has, by whatever mechanism is native to that gateway, independently confirmed payment — never Lunar's raw `Cart::createOrder()`. This is what lets the storefront checkout sequence stay uniform regardless of which provider is active: set addresses, select shipping, hand off to whichever driver is configured, and the driver decides when (or whether) the order gets created.
 - `Modules\Core\Payment\Drivers\OfflinePaymentDriver` — shared by every payment type with no real gateway to confirm against (`cash-in-hand`, `cash-on-delivery`): places the order immediately via `CheckoutService::placeOrder()`, then sets the order status from `config("lunar.payments.types.{$type}.authorized")` using the type actually confirmed, not a hardcoded key, since one driver instance serves multiple types.
 - `Modules\Core\Payment\Drivers\StripePaymentDriver` — a fork, not a decoration, of `lunarphp/stripe`'s `StripePaymentType::authorize()`: that method is `final` and calls `Cart::createOrder()` directly with no seam to redirect into our fingerprint-checked `placeOrder()`, so this class reimplements its logic (intent retrieval, capture-on-policy, status mapping via `UpdateOrderFromIntent`) with that one substitution. Throws the new `Modules\Core\Payment\Exceptions\PaymentNotConfirmedException` on anything short of a genuinely confirmed payment intent — never falls through to placing an order on ambiguity.
 - `CheckoutService::getPaymentMethods(): array` — every payment type currently offered to the storefront: every key in `config('lunar.payments.types')` that is both administratively enabled (`Modules\Core\Payment\Models\PaymentMethod::enabled`) and whose driver reports `isConfigured()` (e.g. Stripe with no API key set is never offered, regardless of the enabled toggle). `selectPaymentMethod(string $type)` and `confirmPayment(string $type, array $data)` both validate against this list, throwing the new `UnknownPaymentTypeException` for a type that isn't currently offered — re-checked in `confirmPayment()` too, since a type could be disabled between selection and confirmation.
-- `CheckoutService::selectPaymentMethod()` snapshots `Cart::fingerprint()` into `cart->meta['checkout_fingerprint']` *after* saving the chosen type and recalculating — the fingerprint has to reflect the final total including any payment-type-specific adjustment (e.g. a COD surcharge), which only exists once `payment_method` is set. `confirmPayment()` reads this stored fingerprint internally rather than taking one as a parameter: a storefront should never need to know `Cart::fingerprint()` exists or capture it at exactly the right moment itself.
+- `CheckoutService::selectPaymentMethod()` snapshots `Cart::fingerprint()` into `cart->meta['checkout_fingerprint']` _after_ saving the chosen type and recalculating — the fingerprint has to reflect the final total including any payment-type-specific adjustment (e.g. a COD surcharge), which only exists once `payment_method` is set. `confirmPayment()` reads this stored fingerprint internally rather than taking one as a parameter: a storefront should never need to know `Cart::fingerprint()` exists or capture it at exactly the right moment itself.
 - `Modules\Core\Payment\Models\PaymentMethod` — one DB row per payment type key (matching `config('lunar.payments.types')`), `enabled` boolean plus a `data` jsonb column (starting with `fee`, the flat cash-on-delivery surcharge) — mirrors Lunar's own `Discount` model (a single jsonb column of keyed settings, not a fixed column per setting or a separate conditions table). Seeded idempotently by `InstallLunarCommand` (skip-if-exists per type, safe to re-run after installing a new payment-provider package), always `enabled: false` — a newly-seeded type shouldn't go live for shoppers before staff have configured and reviewed it. Admin-editable via the new `PaymentMethodResource` (inline enabled toggle, modal fee editor) under Settings.
 - `ApplyCashOnDeliveryFee` now reads its surcharge from `PaymentMethod` instead of static config, so it's admin-editable without a deploy.
 
 ### Fixed
+
 - `CashOnDeliveryPaymentDriver` renamed to `OfflinePaymentDriver` and generalized to work for any offline-style type — it previously hardcoded `'cash-on-delivery'` when reading the post-placement order status from config, which would have silently read the wrong type's status the moment a second offline type (`cash-in-hand`) used it.
 
 ## [0.9.0] - 2026-08-29
 
 ### Added
+
 - `Modules\Core\Cart\Services\CartService` — the boboko-owned API for all cart mutation, wrapping Lunar's `CartSession`/`Cart` primitives: `addLine()`, `updateLine()`, `removeLine()`, `clear()`, `applyCoupon()`/`removeCoupon()` (throws `InvalidCouponException` on an invalid code), and save-for-later (`saveForLater()`/`moveToCart()`/`activeLines()`/`savedLines()`, backed by a `meta.saved_for_later` flag and a new `Modules\Core\Cart\Pipelines\ZeroSavedForLaterPrice` cart-line pipeline step that zeroes a saved line's price so it's excluded from cart totals without being removed). Dispatches 8 real domain events (`CartLineAdded`/`Updated`/`Removed`/`Saved`/`MovedToCart`, `CartCleared`, `CartCouponApplied`/`Removed`) — none have a listener yet, built so a future concern (analytics, recovery) has something to attach to. Documented in `docs/cart.md`.
 - `Modules\Core\Checkout\Services\CheckoutService` — the boboko-owned API for the checkout stage (address → shipping selection → order placement), sitting between `CartService` and `Order`: `setShippingAddress()`/`setBillingAddress()`, `getShippingOptions()`/`selectShippingOption()` (throws the new `InvalidShippingOptionException` on an identifier that doesn't resolve — previously a silent no-op), and `placeOrder(string $fingerprint)` (the fingerprint is mandatory, not optional — forces re-confirmation via Lunar's own `FingerprintMismatchException` if the cart changed since the shopper last saw its total). Dispatches `ShippingAddressSet`/`BillingAddressSet`/`ShippingOptionSelected`/`OrderPlaced`, each carrying richer, already-resolved payload (e.g. the resolved `ShippingOption`, not just its identifier) than `CartService`'s events. No exception wrapping otherwise — Lunar's own `CartException`/`FingerprintMismatchException` are already the right shape for a storefront to render as form errors. Documented in `docs/checkout.md`.
 - `Modules\Core\Cart\Filament\Resources\CartResource`'s list view now classifies every cart into one of four states — **Ongoing**, **Abandoned Cart**, **Abandoned Checkout**, **Completed** — instead of the previous two-tab Abandoned/Completed split, distinguishing a cart that never reached checkout from one that has a started-but-unplaced order (mirrors the real distinction in Lunar's own `Cart::scopeActive()`). Abandonment threshold is a fixed, configurable cutoff (`config('core.cart.abandoned_after')`, default 1 hour). Added a customer hyperlink (list column + a "View Customer" header action on the view page, both pointing straight at `customers/{id}` via the plain `customer_id` column, no extra query via the `customer` relation).
@@ -587,17 +863,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `AcsRateDriver::resolveLivePrice()` now falls back to the rate's own configured static price if the live ACS API call fails (previously: the shipping option silently disappeared from the list on any API error, including a brief outage). `ManageShippingRates` (our Filament subclass of the vendor rates page) now allows a static price to be configured and saved on a "live" rate specifically for this fallback — previously those fields were hidden and discarded on save for any live-priced rate.
 
 ### Fixed
+
 - Fixed a crash (`Attempt to read property "price" on null`) opening/editing a live-priced shipping rate with no fallback price configured yet — the vendor `ManageShippingRates` page's `afterStateHydrated` callback for the price field had no null-guard for a rate with zero `basePrices`, which is now the routine case for an unconfigured live rate.
 - Fixed the Filament admin panel's home URL (`/boboko/home`) incorrectly resolving to the Shipping module's `ManagePickupManifests` page instead of the Dashboard — Filament falls back to the first item of the first registered navigation group when no explicit `homeUrl()` is set, and `ManagePickupManifests` had no `navigationGroup`/`navigationSort` of its own. Fixed via explicit `navigationGroup = 'Sales'` / `navigationSort = 100`, placing it after Sales in the nav instead of first overall.
 
 ## [0.8.0] - 2026-08-27
 
 ### Added
+
 - `Modules\Core\Cart\Filament\Resources\CartResource` gives staff read-only visibility into carts in the Filament admin panel — Lunar ships no cart admin view at all. Scoped to carts with a known `user_id`/`customer_id` (an anonymous guest cart carries no identity staff could act on); list table shows customer/user, line/item counts (via Filament's built-in `->counts()`/`->sum()`, no per-row queries), currency, and last activity. List page has only two tabs, **Abandoned** (default active) and **Completed** — no "All" tab, so the list never runs an unfiltered fetch over the whole table. They key off whether the cart has a **placed** order (`orders.placed_at IS NOT NULL`), not `Cart::completed_at` — that column is declared/cast on the model but never actually written anywhere in Lunar core, so it's not a real signal; "Abandoned" mirrors Lunar's own `Cart::scopeActive()`. `getNavigationBadge()` shows the abandoned-cart count in the sidebar via a single `COUNT(*)` query, no rows loaded. View page runs `$cart->calculate()` once so line/cart totals (plain public properties Lunar never persists) are populated, without paying that cost per row in the list. Documented in `docs/cart.md`.
 
 ## [0.7.0] - 2026-08-27
 
 ### Added
+
 - `Modules\Core\Catalog\Services\CollectionService` provides category browsing/nav AND single-collection lookup from Meilisearch, mirroring `ProductService` exactly (`list()`, `getById()`, `getBySlug()`, same locale-resolution logic). `Modules\Core\Catalog\Services\CollectionIndexer` extends Lunar's own `Lunar\Search\CollectionIndexer` (which only carried `id`/`name`/`created_at`) to add `parent_id`, `_lft`/`_rgt` (nested-set tree position, filterable/sortable), `collection_group_id`, `slugs`, and `thumbnail`. `Modules\Core\Catalog\DTOs\CollectionFilters` supports `parentId` (children of a specific collection), `groupId`, and `rootOnly` (top-level collections, `parent_id IS NULL` — mutually exclusive with `parentId`). `Modules\Core\Catalog\Enums\CollectionSort` adds `Position` (`_lft:asc`, the recommended default for nav/tree UIs — matches admin arrangement order), `Name`, `Newest`. Must be registered in a consuming app's `config/lunar/search.php` (`Lunar\Models\Collection::class => CollectionIndexer::class`), same as `ProductIndexer`. Documented in `docs/collections.md`.
 - `Modules\Core\Localization\Services\StorefrontLabels::all()` extracts the default storefront UI label list out of `InstallLunarCommand` into its own class, and adds every previously-missing key (`nav.contact`, `product.description`/`no_image`/`read_more`/`reviews`, `customer_reviews`, `pagination.*`, `review.*`, `shop.*`) that had already been seeded manually in some stores but was absent from the command's own list — bringing the code-side default back in sync with what a real store actually has. `InstallLunarCommand::seedStorefrontLabels()` now does a **per-key upsert** instead of an all-or-nothing "only seed if the group is empty" guard: a key already present in the database (including one an admin has since edited via the Filament **Language Lines** resource) is left untouched, and only missing keys are created via `TranslationService::create()`. This makes it safe to add new keys to `StorefrontLabels::all()` later and re-run `lunar:install` on an already-installed store without either silently skipping the new keys (the old guard's behavior) or reverting an admin's edits back to the hardcoded default. Documented in `docs/localization.md` ("Seeding").
 - `Modules\Core\Catalog\Services\CollectionIndexer` adds `ancestors` — `[{id, name}, ...]` ordered root-first (via the newly eager-loaded `ancestors` relation) — so a breadcrumb can render directly from `CollectionService::getById()`/`getBySlug()` with zero extra queries, and `product_count` — how many products are in a collection or any of its descendants, queried from the product Meilisearch index at collection-index time via the same `collection_ids` field `ProductFilters(collectionId:)` filters against. Documented in `docs/collections.md`, including the reindex-ordering gotcha (`product_count` needs the product index reindexed first).
@@ -605,6 +884,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `Modules\Core\Catalog\Services\ProductService::facets(string $field, ?ProductFilters $filters = null): array` returns Meilisearch facet value counts (e.g. `['Brand A' => 48, 'Brand B' => 135]`) for a discrete-value filterable field, scoped to the given filters. Uses Scout's plain `->options(['facets' => [...]])`, merged directly into the raw Meilisearch query the same way `filter`/`sort` already are — no adoption of Lunar's separate `SearchManager`/`Search` facade needed. `ProductService::priceRange(?ProductFilters $filters = null): array{min, max}` covers the numeric-field case `facets()` explicitly doesn't (`price` would otherwise return one "facet" per exact price) — backed by Meilisearch's `facetStats`, not `facetDistribution`. `priceRange()` always excludes `minPrice`/`maxPrice` from the filter it builds (via a new `$exclude` parameter on the private `buildFilter()`), so a price slider's own bounds don't shrink to whatever range is already selected on it; other filters (`collectionId`, `brand`, `inStockOnly`) still apply normally. Documented in `docs/product-listing.md`.
 
 ### Changed
+
 - **Breaking:** Renamed the `Product` module to `Catalog`, flattened. Every class under `Modules\Core\Product\*` (`Contracts`, `DTOs`, `Enums`, `Services`, `Observers`, `Filament\Extensions`, `OptionTypes`) now lives under `Modules\Core\Catalog\*` at the same sub-path — e.g. `Modules\Core\Product\Services\ProductService` is now `Modules\Core\Catalog\Services\ProductService`, `Modules\Core\Product\DTOs\ProductFilters` is now `Modules\Core\Catalog\DTOs\ProductFilters`. Class names themselves are unchanged (still `ProductService`, `ProductIndexer`, `ProductFilters`, etc.) — only the namespace/folder moved, to make room for `Collection` as a sibling concern under the same `Catalog` umbrella rather than a disconnected top-level module. Consuming apps must update every `use Modules\Core\Product\...` import and any FQCN reference (`config/lunar/search.php`'s indexer registration, service provider bindings).
 - **Breaking:** `Modules\Core\Providers\ProductServiceProvider` renamed to `Modules\Core\Providers\CatalogServiceProvider` (composer.json's provider list updated accordingly) — it now only wires `Catalog`-namespace classes (`ProductOptionTypeManager`, `ProductOptionReindexObserver`), so the name follows the same by-concern convention as `LocalizationServiceProvider`/`ReviewServiceProvider`.
 - **Breaking:** `Modules\Core\Review`'s flat `Extensions/`/`Pages/` folders now nest under `Filament/`, matching the strict per-concern subfolder convention already applied to `Product`(now `Catalog`)/`Localization`. `Modules\Core\Review\Extensions\ProductResourceExtension` is now `Modules\Core\Review\Filament\Extensions\ProductResourceExtension`; `Modules\Core\Review\Pages\ManageProductReviews` is now `Modules\Core\Review\Filament\Pages\ManageProductReviews`. `Modules\Core\Review\Models\ProductReview` is unchanged.
@@ -613,29 +893,35 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.6.1] - 2026-08-27
 
 ### Added
+
 - `Modules\Core\Product\Contracts\ProductOptionTypeInterface` describes how a category of `Lunar\Models\ProductOption` (e.g. "Color", "Size") behaves — what structured data its values carry in their free-form `meta` jsonb column, and how an admin edits it via Filament — without introducing a new model. Registered via `Modules\Core\Product\Services\ProductOptionTypeManager::get()->register([...])` (a singleton registry, same shape as `Modules\Core\Notification\NotificationRegistry`) from a service provider's `boot()`. An admin then picks one per `ProductOption` from an "Option Type" dropdown on the option's own edit form (added by `Modules\Core\Product\Filament\Extensions\ProductOptionResourceExtension`), stored in `ProductOption::meta['option_type']` — deliberately not tied to the option's `handle`, since a shop's own handle naming shouldn't have to match a type's key. `Modules\Core\Product\Filament\Extensions\ValuesRelationManagerExtension` hooks Lunar's own `ValuesRelationManager` (both extensions via `LunarPanel::extensions()`, registered in `CorePlugin`) to append the resolved type's meta form fields to the stock "Values" tab — no fork of Lunar's classes needed. Ships a reference implementation, `Modules\Core\Product\OptionTypes\ColorOptionType`, registered automatically by the new `Modules\Core\Providers\ProductServiceProvider`. Documented in `docs/product-options.md`.
 - `Modules\Core\Product\Services\ProductIndexer::mapVariant()` now includes each option's `handle` (alongside its translated name) in a variant's indexed `options[]` — previously only the translated `option`/`value` names and `meta` were indexed, with no stable, locale-independent identifier for which option a value belongs to.
-- `Modules\Core\Product\Observers\ProductOptionReindexObserver`, wired in the new `Modules\Core\Providers\ProductServiceProvider`, keeps Meilisearch in sync when a `ProductOption` or `ProductOptionValue` is saved or deleted — e.g. picking an Option Type or editing a color's hex. `ProductIndexer::mapVariant()` embeds each option value's `meta` directly into a product's indexed document, but saving the option/value never fires the *product's* own save events, so without this a changed hex would only reach the index on that product's next unrelated reindex. The observer resolves every `Lunar\Models\Product` whose variants use the changed option (or option value) via the `product_option_value_product_variant` pivot, and calls `->searchable()` on each.
+- `Modules\Core\Product\Observers\ProductOptionReindexObserver`, wired in the new `Modules\Core\Providers\ProductServiceProvider`, keeps Meilisearch in sync when a `ProductOption` or `ProductOptionValue` is saved or deleted — e.g. picking an Option Type or editing a color's hex. `ProductIndexer::mapVariant()` embeds each option value's `meta` directly into a product's indexed document, but saving the option/value never fires the _product's_ own save events, so without this a changed hex would only reach the index on that product's next unrelated reindex. The observer resolves every `Lunar\Models\Product` whose variants use the changed option (or option value) via the `product_option_value_product_variant` pivot, and calls `->searchable()` on each.
 
 ### Changed
+
 - **Breaking:** `Modules\Core\Product\Services\ProductIndexer`'s indexed `collections` field is now an array of `{id, name}` objects instead of two parallel arrays (`collections` as bare ID strings, `collection_names` as translated names joined only by array index). `collection_names` is removed. Filtering by collection now targets the nested field `collections.id` (Meilisearch supports filtering on nested object fields), not bare `collections` — `Modules\Core\Product\Services\ProductService::buildFilter()` updated accordingly; `ProductFilters(collectionId: ...)`'s public API is unchanged. Run `php artisan lunar:meilisearch:setup` then `lunar:search:index --refresh` after upgrading (see docs/product-listing.md "Gotchas").
 - **Breaking:** `ProductIndexer`'s indexed `review_count`/`average_rating` top-level keys are folded into the existing `reviews` key: `reviews` is now `{items, count, average_rating}` instead of a bare array with `review_count`/`average_rating` as separate sibling keys. `reviews` (the array of review items) moved to `reviews.items`.
 
 ## [0.6.0] - 2026-08-27
 
 ### Added
+
 - `Modules\Core\Localization\Models\LanguageLine` extends `spatie/laravel-translation-loader`'s `LanguageLine` to fall back to the store's actual default language (`LanguageCache::defaultLocale()`, backed by Lunar's `languages.default` flag) instead of the package's stock behavior of falling back to the static `config('app.fallback_locale')` — the two were previously disconnected, so changing the default language via the Filament **Languages** resource had no effect on which locale an untranslated storefront label silently fell back to. Swapped in automatically via `config('translation-loader.model')` in `LocalizationServiceProvider::register()`; no consuming app changes needed. Documented in `docs/localization.md` ("Fallback locale follows the store's default language").
 
 ### Changed
+
 - **Breaking:** `Modules\Core\Catalog\ProductService::list()` now returns a real `Illuminate\Pagination\LengthAwarePaginator` (built from the localized Meilisearch hits) instead of a plain `array{data, meta}` — gives callers normal Laravel pagination behaviour (`$products->links()`, standard JSON serialization) without ever touching Scout's raw `paginateRaw()` response directly. `getById()`/`getBySlug()` are unaffected (still return `?array`).
 - `ProductService::withLocalizedFields()` (used by `list()`, `getById()`, `getBySlug()`) no longer hardcodes `name`/`description` as the only translated fields — it now reads every `TranslatedText` attribute on `Product` from `Lunar\Base\AttributeManifest` (the same source Lunar's own indexer reads), so a store's own custom translated attributes (e.g. `seo_title`, `seo_description`) are resolved and locale-stripped automatically with no code change here. Raw `{handle}_{locale}` keys (e.g. `name_el`, `seo_title_en`) are now stripped from every returned product, not just `name_*`/`description_*`.
 - Extracted `Modules\Core\Localization\Services\LanguageCache` (cached read layer over Lunar's `languages` table: `all()`, `defaultLocale()`, `availableLocales()`, `forget()`) out of `LocaleMiddleware`, which previously owned this as private/static methods despite not being middleware-specific behavior. `LocaleMiddleware` now takes `LanguageCache` via constructor injection. `LocaleMiddleware::defaultLocale()`/`forgetLanguagesCache()` (static) are removed — use `app(LanguageCache::class)` or inject `LanguageCache` directly.
 
 ### Fixed
+
 - `Modules\Core\MigrateImport\JudgeMe\Resolvers\ProductResolver::resolve()` picked whichever `lunar_urls` row matched a slug first, which can be a soft-deleted product left behind by an earlier import batch rather than the current live one — a store can easily end up with more than one `Product` row sharing the same slug across re-imports, since a soft-deleted product's URL row isn't cleaned up. This silently broke every downstream lookup for that handle (e.g. `Modules\Core\MigrateImport\JudgeMe\JudgeMeExportImporter` logging "no product found for handle, skipping review" and dropping the row, even though a live product with that exact handle existed). Rewrote as a join against `lunar_products` — via `Product::query()`, so Eloquent's `SoftDeletes` global scope excludes trashed rows — so only a URL pointing at a live product resolves.
 - `Modules\Core\Review\Models\ProductReview` had no `registerMediaConversions()` at all, unlike `Product`/`ProductVariant` which get one automatically from Lunar's own `Lunar\Base\StandardMediaDefinitions`. `Modules\Core\Search\ProductIndexer::mapMedia()` is shared across product, variant, and review media and always requests the `small` conversion — the first time a review had an attached image, indexing it threw `Spatie\MediaLibrary\MediaCollections\Exceptions\InvalidConversion`, silently failing the product's `MakeSearchable` queue job (and everything queued after it, since Scout batches). Added a matching `small` conversion (300×300, same fit/border/background as Lunar's standard one) directly on `ProductReview`.
 
 ### Breaking
+
 - Merged `Modules\Core\Catalog` and `Modules\Core\Search` into a single `Modules\Core\Product` concern, since both existed purely to serve `Product` (browsing/filtering vs. indexing/full-text search — two services, one concern), following a stricter subfolder convention (`Contracts/`, `Enums/`, `Services/`, `DTOs/`, `Models/`, etc. per concern) going forward:
   - `Modules\Core\Catalog\ProductService` → `Modules\Core\Product\Services\ProductService`
   - `Modules\Core\Catalog\ProductFilters` → `Modules\Core\Product\DTOs\ProductFilters`
@@ -644,6 +930,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   - `Modules\Core\Search\ProductSearchService` → `Modules\Core\Product\Services\ProductSearchService`
 
   Consuming apps must update any direct references — notably `config/lunar/search.php`'s `'indexers'` map, which points at `ProductIndexer` by FQCN. `Modules\Core\Catalog\ProductOptionTypeInterface` (in-progress, not yet wired to anything) was deliberately left in place rather than moved.
+
 - Reorganized `Modules\Core\Localization` under the same stricter per-concern subfolder convention — `Events/`, `Filament/`, `Listeners/` were already correctly categorized; four loose root files moved into typed buckets by structural role:
   - `Modules\Core\Localization\LocaleMiddleware` → `Modules\Core\Localization\Middleware\LocaleMiddleware`
   - `Modules\Core\Localization\LanguageCacheObserver` → `Modules\Core\Localization\Observers\LanguageCacheObserver`
@@ -655,26 +942,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.5.4] - 2026-08-26
 
 ### Added
+
 - `Modules\Core\Catalog\ProductService::list()` accepts a `sort` parameter (new `ProductSort` enum: `PriceAsc`, `PriceDesc`, `Newest`), translated into a Meilisearch `sort` clause — `list()` previously had no way to order results, since it always searches with an empty query string and so has no relevance score to fall back on. `Modules\Core\Search\ProductIndexer::getSortableFields()` now also marks `price` sortable (Lunar's base indexer only marks `created_at`/`updated_at`/`skus`/`status`). Requires re-syncing index settings (`php artisan lunar:meilisearch:setup`) on existing stores. Documented in `docs/product-listing.md` ("Sorting").
 
 ## [0.5.3] - 2026-08-26
 
 ### Fixed
+
 - `Modules\Core\Search\ProductIndexer::toSearchableArray()` threw `column reference "id" is ambiguous` on Postgres when computing `channel_ids` — `$model->channels()->wherePivot('enabled', true)->pluck('id')` joins `lunar_channels` and `lunar_channelables`, both of which have an `id` column, and the unqualified `pluck('id')` left Postgres unable to resolve which table's column to select (SQLite/MySQL tolerated the ambiguity). Qualified as `pluck('lunar_channels.id')`.
 
 ## [0.5.2] - 2026-08-26
 
 ### Fixed
+
 - `Modules\Core\Localization\LocaleMiddleware`'s shared view data only ever surfaced a single alternate locale (`altLocale`/`altLocaleUrl`, found via `firstWhere('code', '!=', $current)`) — correct by coincidence for a 2-language store, but silently dropped every locale past the first "other" one found for a 3+ language store, with no error. Replaced with `altLocales`, a collection of every other configured language (`code`, `name`, `url` for the current route each), so a language switcher or `hreflang` tags scale to any number of locales. Documented in `docs/localization.md` ("Shared view data — language switcher and `hreflang` tags").
 
 ## [0.5.1] - 2026-08-25
 
 ### Added
+
 - `Modules\Core\Search\ProductIndexer` now indexes `channel_ids` (filterable) — Lunar's base indexer only marks `status` as filterable, not channel assignment, so storefront search couldn't otherwise scope results to products actually assigned and enabled on the current sales channel. Computed from `$product->channels()->wherePivot('enabled', true)`. Ported from an older `Products` branch whose remote had been deleted; the branch's other, now-superseded `ProductIndexer` changes were dropped in favor of the richer indexer already on `master` (collections, price, variants, reviews — see `0.5.0`).
 
 ## [0.5.0] - 2026-08-24
 
 ### Added
+
 - **`Modules\Core\Catalog\ProductService`**: storefront product listing/filtering (`list()`) and single-product lookup (`getById()`, `getBySlug()`), reading directly from the Meilisearch index rather than the database — one data source, no `->get()` model hydration. Returns plain arrays (not Eloquent models), meant to be called directly from a consuming app's controllers.
   - `ProductFilters` DTO: optional `collectionId`, `brand`, `minPrice`, `maxPrice`, translated into a Meilisearch `filter` expression.
   - Listing results are locale-aware: `withLocalizedFields()` resolves `name`/`description` from the indexer's per-locale fields, falling back to the store's default language (via `LocaleMiddleware::defaultLocale()`) when the current locale has no translation yet, instead of rendering blank.
@@ -685,26 +977,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `docs/lunar.md` "Gotchas": three new entries hit while building this — `ProductOption`/`ProductOptionValue::name` isn't `attribute_data` (so `translateAttribute()` silently returns `null` for it), a running `queue:work` process not picking up an edited Scout indexer class, and Scout's `paginateRaw()->items()` on the Meilisearch driver returning the whole raw response rather than a hit list.
 
 ### Fixed
+
 - The admin login form (`Modules\Core\Auth\Filament\Pages\Login`) had no way back from the OTP-entry step to the email step short of reloading the page. A `back()` method resets to the email step; a "← Back" link/button is shown on the OTP step only.
 
 ## [0.4.0] - 2026-08-06
 
 ### Added
+
 - **Locale-prefixed routing** (`Modules\Core\Localization\LocaleMiddleware`): a `locale` route-middleware alias, opt-in per shop (not pushed onto the `web` group globally, since admin/Livewire/webhook routes must not be locale-redirected). Reads the first URL segment against Lunar's own `languages` table, sets `App::setLocale()`, and redirects unprefixed/unknown-locale requests to a resolved locale (`Accept-Language` match → default language → first language). Every locale is prefixed, including the default (`/el/...`, `/en/...`), never a bare root — avoids the hreflang/duplicate-content ambiguity of a bare-root default locale.
   - Language list cached with `Cache::rememberForever()`, invalidated via `Modules\Core\Localization\LanguageCacheObserver` dispatching `LanguageCreated`/`LanguageUpdated`/`LanguageDeleted` events (see below) rather than doing the work itself.
   - **Language rename safety**: renaming a `Language::code` (e.g. `el` → `gr`) no longer strands existing translations. `MigrateTranslationsForRenamedLanguage` (listening on `LanguageUpdated`) migrates every affected `LanguageLine.text` key from the old code to the new one and flushes both codes' translation caches — closing a real data-loss gap where a rename would otherwise make existing `LanguageLine` translations permanently unreachable.
-- **Storefront UI label translations**: pulled in `spatie/laravel-translation-loader` (self-registers via Composer package auto-discovery; its loader *extends* Laravel's file-based `FileLoader` and merges DB translations on top — existing Filament/Lunar vendor `lang/` strings are unaffected). Labels are looked up via Laravel's native `__('storefront.nav.cart')`, kept in its own `storefront` group so nothing collides with Lunar/Filament's own translation groups.
+- **Storefront UI label translations**: pulled in `spatie/laravel-translation-loader` (self-registers via Composer package auto-discovery; its loader _extends_ Laravel's file-based `FileLoader` and merges DB translations on top — existing Filament/Lunar vendor `lang/` strings are unaffected). Labels are looked up via Laravel's native `__('storefront.nav.cart')`, kept in its own `storefront` group so nothing collides with Lunar/Filament's own translation groups.
   - `Modules\Core\Command\InstallLunarCommand` (overriding `lunar:install`) seeds a starter set of ~15 common e-shop labels (`nav.*`, `cart.*`, `product.*`, `auth.*`, `search.*`, English + Greek), idempotently guarded so it's safe on every boot.
   - `Modules\Core\Localization\TranslationReader::group('storefront')` returns the whole reduced/cached label array for a locale (backed by `LanguageLine`'s own forever-cache) — for sharing to a view as `$labels` or `@json()`-ing to JS, on top of `__()` for single-key Blade lookups.
   - **Admin UI**: `Modules\Core\Localization\Filament\Resources\LanguageLineResource` (registered in `CorePlugin`) lists/searches/filters `language_lines` and edits each row's `group`, `key`, and one text input per locale currently in `lunar_languages` — locale columns/inputs are generated dynamically from the language list, so a new language needs no resource changes.
   - **Event-driven writes**: `Modules\Core\Localization\TranslationService` (`create`/`update`/`delete`) is the single write path for `LanguageLine` — the Filament resource's Create/Edit/Delete pages route through it rather than Filament's default direct-model writes. Dispatches `TranslationCreated`/`TranslationUpdated` (carries the full pre-update `{group, key, text}` snapshot, so a bare rename is tracked the same as a text edit)/`TranslationDeleted`, each handled by two listeners:
-    - `FlushTranslationCache` — closes a real gap in `LanguageLine`'s own self-invalidation, which only flushes locales/groups present *after* a save. Flushes the union of old and new group+locale combinations, so a locale removed from `text`, or a `group`/`key` rename, can't leave a stale cached array behind.
+    - `FlushTranslationCache` — closes a real gap in `LanguageLine`'s own self-invalidation, which only flushes locales/groups present _after_ a save. Flushes the union of old and new group+locale combinations, so a locale removed from `text`, or a `group`/`key` rename, can't leave a stale cached array behind.
     - `LogTranslationActivity` — audits every write via the existing `Modules\Core\Logging\ActivityLogService` (`lunar` activity log channel), same `created`/`updated`/`deleted` shape as every other domain write in this project. Properties are flattened with `Arr::dot()` before logging (`text.en`, `text.el` instead of a nested `text` object) since Filament's Activity resource renders `properties` with a flat `KeyValue` field that can't display nested arrays.
 - `Modules\Core\Providers\LocalizationServiceProvider` — split out of the growing `CoreServiceProvider` (per this project's own "split when a provider does too much" convention) to own all locale/translation middleware, observer, and event-listener registration.
 
 ## [0.3.0] - 2026-07-12
 
 ### Added
+
 - **Meilisearch product search**: pulled in `lunarphp/search` (Lunar's driver-agnostic search abstraction — `database`/`meilisearch`/`typesense` engines, selectable via Scout's own `SCOUT_DRIVER` config) and `lunarphp/meilisearch`, wiring Meilisearch in as the search engine for products.
   - `Search\ProductIndexer` overrides Lunar's own indexer to strip HTML tags from string fields (e.g. `name_en`, `description_en`) before they reach the search index — Lunar's default indexer sends raw attribute HTML straight through, which pollutes relevance ranking and highlighting with markup.
   - Meilisearch itself is treated as app-level infrastructure, not a `boboko-core` concern: the actual Meilisearch container, host port, and master key live in each consuming app's own `docker-compose.yml`/`.env` (e.g. `3dealer`), the same way Postgres and Valkey do — `boboko-core` only declares the PHP package dependency and the indexing code.
@@ -712,17 +1007,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [0.2.0] - 2026-07-10
 
 ### Added
+
 - **Product reviews** (`Modules\Core\Review`): a new `ProductReview` model + `product_reviews` table (plain, unprefixed — same convention as `import_mappings`), linked to Lunar's `Product` via a `Product::reviews()` macro (registered in `CorePlugin`, since `Lunar\Models\Product` is a vendor model and can't be edited directly).
   - **JudgeMe CSV review importer** (`MigrateImport\JudgeMe\JudgeMeExportImporter`), wired into the existing `boboko:migrate:import --source=judgeme --type=export` command: reads a Judge.me review export, resolves each row's `product_handle` to a Lunar product via `Lunar\Models\Url`, and creates/updates `ProductReview` rows idempotently via `import_mappings` (`source=judgeme`, `source_type=review`, keyed on Judge.me's `metaobject_handle`). Rows with no matching product are skipped with a logged warning rather than failing the whole import.
   - Review images (`picture_urls` in the CSV) are downloaded and stored as real media via Spatie MediaLibrary (`ProductReview::IMAGES_COLLECTION`), not just linked by URL — consistent with how product images are handled.
   - **Admin UI**: a new "Reviews" sub-navigation page on the product edit screen (`Review\Pages\ManageProductReviews`, wired via `Review\Extensions\ProductResourceExtension`), listing rating/title/reviewer with View, Reply, and Delete actions. The Reply action lets staff write/edit a reply directly from the table, setting `replied_at`. The View modal shows full review detail (body, reviewer email, location, source, dates, reply, downloaded images).
 
 ### Fixed
+
 - `Shopify\ShopifyExportImporter` never wrote a Lunar `Url` (slug) row for imported products, despite `docs/shopify-import.md` specifying it should — meaning no code outside the importer itself could resolve "which Lunar product has handle X" (only the importer's own private `import_mappings` bookkeeping could). It now creates/updates a default `Url` row (`slug` = Shopify handle) per product on every import, which the new JudgeMe review importer depends on for product resolution.
 
 ## [0.1.0] - 2026-07-09
 
 ### Added
+
 - **Shipping**: registered Lunar's `lunarphp/table-rate-shipping` plugin (`ShippingPlugin`) directly on `CorePlugin`, so table-rate shipping is available to every consumer app without per-app wiring.
 - **Product migration/import framework** (`Modules\Core\MigrateImport`): a source-agnostic pipeline for importing a vendor's product catalog into Lunar.
   - `boboko:migrate:import` Artisan command — interactively prompts for source, type (export/API), and credentials or file path, then dispatches the import as a queued job (`RunMigrateImportJob`) on the default queue. The file-path prompt resolves relative to `storage/app/private/imports/`, so answering e.g. `shopify` picks up the first CSV found in `imports/shopify/` automatically.
@@ -737,6 +1035,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   - `CONTRIBUTE.md` — local dev setup (path-repo + `bin/dc-core.sh`), and the manual DB-verification workflow used to build this feature.
 
 ### Fixed
+
 - `ProductOptionResolver` created duplicate `ProductOption`/`ProductOptionValue` rows when the same option or value appeared with different casing across products (e.g. Shopify export rows using both "Size" and "size"), and could create a duplicate value within a single product's own variant rows due to relying on a stale lazy-loaded relation. Both now resolve by normalized (slugified) identity queried fresh from the database.
 - `boboko:migrate:import` could dispatch an import job with a blank file path (silent no-op failure) if the file-path prompt was answered empty; it now re-prompts until a valid, existing file is given.
 
@@ -745,6 +1044,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 First release.
 
 ### Added
+
 - OTP-based authentication built around `User` instead of `Customer` (`UserOtpService`, `UserOtpMail`), replacing the earlier customer-scoped OTP flow.
 - `UserCreated` event with a `CreateCustomerForUser` listener to provision a Lunar customer automatically when a user is created.
 - `UserRelationManager` for managing users from the customer resource in the panel.
@@ -755,7 +1055,9 @@ First release.
 - `docs/modules.md` documenting module structure.
 
 ### Removed
+
 - `CustomerOtpMail` and `CustomerOtpService`, superseded by the user-based OTP flow.
 
 ### Dependencies
+
 - Added explicit `symfony/yaml` requirement (used directly by `Stoic::loadConfig()`).

README.md

@@ -1,6 +1,9 @@
 # Core Module
 
-A Laravel module providing authentication, notifications, activity logging, CLI tooling, and functional types on top of the [Lunar](https://lunarphp.io) admin panel. Designed to be consumed as a standalone Composer package.
+A Laravel module providing authentication, localization, product search/catalog, privacy/GDPR
+tooling, notifications, activity logging, CLI tooling, and functional types on top of the
+[Lunar](https://lunarphp.io) e-commerce package. Designed to be consumed as a standalone Composer
+package by any Lunar-based e-shop.
 
 ---
 
@@ -8,13 +11,83 @@ A Laravel module providing authentication, notifications, activity logging, CLI
 
 ### OTP Authentication
 
-Passwordless login for both staff (Lunar panel) and customers via 6-digit codes delivered by email. Codes expire after 10 minutes. The Lunar panel login page is a two-step flow: email → OTP. Rate-limited to 5 attempts.
+Passwordless login for both staff (Lunar panel) and customers via 6-digit codes delivered by
+email. Codes expire after 10 minutes, rate-limited to 5 attempts. The Lunar panel login page is a
+two-step flow (email → OTP) with a back button to return from the code step to the email step.
 
 See [`docs/otp-auth.md`](docs/otp-auth.md).
 
+### Localization
+
+Locale-prefixed routing (`Modules\Core\Localization\LocaleMiddleware`) — a `locale` route
+middleware, opt-in per shop, that resolves and redirects to the correct language segment
+(`/el/...`, `/en/...`) based on Lunar's own language list, with caching and rename-safe
+translation migration. Also brings in storefront UI label translations
+(`spatie/laravel-translation-loader`) with an admin-editable `LanguageLine` resource.
+
+See [`docs/localization.md`](docs/localization.md).
+
+### Product Search & Catalog
+
+Two complementary services on top of Meilisearch:
+
+- **`Modules\Core\Search\ProductSearchService`** — locale-aware full-text product search.
+- **`Modules\Core\Catalog\ProductService`** — listing/filtering (by collection, brand, price
+  range) and single-product lookup by id or slug, reading directly from the Meilisearch index
+  rather than the database.
+
+Both are backed by `Modules\Core\Search\ProductIndexer`, which extends Lunar's own indexer with
+collections, price, variants, media, tags, and reviews — everything needed for both a listing
+page and a full product detail page from one index.
+
+See [`docs/product-search.md`](docs/product-search.md) and
+[`docs/product-listing.md`](docs/product-listing.md).
+
+### Product Reviews
+
+`Modules\Core\Review\ProductReview` — ratings/reviews with staff replies, a Filament sub-navigation
+page on the product edit screen, and automatic re-indexing (via `ReviewServiceProvider`) whenever
+a review is created, updated, or deleted, so a product's Meilisearch document never goes stale.
+
+### Privacy / GDPR Data-Subject Requests
+
+Right of access (export) and right of erasure, built as an extensible contract
+(`Modules\Core\Privacy\Contracts\PersonalDataProvider`) rather than a fixed table list — any
+module can register its own data without core knowing it exists.
+
+- **Two independent scopes**: erasing/exporting a Lunar `Customer` (business account) is never
+  the same operation as erasing/exporting a `User` (individual login) — a `Customer` erasure
+  never touches any linked `User`'s login, and a `User` erasure never touches a `Customer`
+  account's own data. See `docs/privacy.md` "User-scope vs Customer-scope".
+- **Cancellable grace period** (default 30 days, configurable) before anything is actually
+  erased — logging back in during the window automatically reverts the request, mirroring
+  Shopify's own account-deletion flow. Immediate erasure exists but is staff-only by type, never
+  reachable from a self-service flow.
+- **Sole-owner cascade**: erasing the last remaining `User` on a `Customer` also opens a (grace
+  period) erasure request for that now-orphaned `Customer`, so its PII doesn't sit unreachable
+  forever — traced back to the triggering request so login-reactivation can revert exactly that
+  cascade.
+- **Queued export**: gathering data and writing a CSV-per-provider zip (via the generic,
+  reusable `Modules\Core\Export\CsvWriter`) runs as a background job; a consuming app hooks its
+  own notification onto the completion event via the Notification Registry (below).
+
+See [`docs/privacy.md`](docs/privacy.md).
+
+### Shopify Migration
+
+`Modules\Core\MigrateImport\Shopify\ShopifyExportImporter` — imports a Shopify CSV product export
+(products, variants, images, collections, tags, prices) into Lunar, idempotently re-runnable via
+an `import_mappings` table. Part of a source-agnostic import framework
+(`boboko:migrate:import`) designed to support additional sources later.
+
+See [`docs/shopify-import.md`](docs/shopify-import.md).
+
 ### Notification Registry
 
-An event-driven notification system. Each notification class declares which event it listens to and who to notify — the registry wires up the listener automatically. All notifications extend `BaseNotification` which implements `ShouldQueue`, so delivery is async. Supports optional delays.
+An event-driven notification system. Each notification class declares which event it listens to
+and who to notify — the registry wires up the listener automatically. All notifications extend
+`BaseNotification`, which implements `ShouldQueue`, so delivery is async. Supports optional
+delays.
 
 **Creating a notification:**
 
@@ -33,9 +106,13 @@ class MyNotification extends BaseNotification
 NotificationRegistry::get()->register([MyNotification::class]);
 ```
 
+See [`docs/notifications.md`](docs/notifications.md).
+
 ### Activity Logging
 
-Thin wrapper around [Spatie Laravel Activity Log](https://github.com/spatie/laravel-activitylog). Four standardized methods: `created()`, `updated()`, `failed()`, `deleted()`. Logs to the `lunar` channel and auto-resolves the actor from the staff session.
+Thin wrapper around [Spatie Laravel Activity Log](https://github.com/spatie/laravel-activitylog).
+Four standardized methods: `created()`, `updated()`, `failed()`, `deleted()`. Logs to the `lunar`
+channel and auto-resolves the actor from the staff session.
 
 See [`docs/activity-log.md`](docs/activity-log.md).
 
@@ -43,8 +120,11 @@ See [`docs/activity-log.md`](docs/activity-log.md).
 
 - Custom OTP login page replacing the default Lunar panel login
 - `StaffResourceExtension` — removes password field from Lunar's staff resource
-- `CustomerResourceExtension` — replaces default address relation manager with a custom implementation
-- `CorePlugin` — configures panel path, branding, logos, navigation items, and activity log field exclusions for staff
+- `CustomerResourceExtension` — replaces default address relation manager with a custom
+  implementation
+- Table-rate shipping (`ShippingPlugin`) registered by default
+- `CorePlugin` — configures panel path, branding, logos, navigation items, and activity log
+  field exclusions for staff
 
 Register the plugin in your Lunar panel provider:
 
@@ -52,30 +132,36 @@ Register the plugin in your Lunar panel provider:
 ->plugin(\Modules\Core\CorePlugin::make())
 ```
 
+See [`docs/lunar.md`](docs/lunar.md) for the full Lunar reference and non-obvious gotchas hit
+while building against it.
+
 ### CLI Commands
 
 | Command | Description |
 |---|---|
-| `core:create-admin` | Create a Lunar admin user |
-| `core:anonymize` | GDPR anonymization of users and customers (local only) |
-| `core:export` | Dump database + storage files to a timestamped zip |
-| `core:import` | Restore from a zip export (runs anonymize automatically, local only) |
-| `core:export-cleanup` | Delete old export zips, keep N most recent |
+| `boboko:anonymize` | Dummy-scrub personal data in `users`/`lunar_customers` for local dev safety (local environment only — **not** the GDPR erasure tool; see Privacy above for that) |
+| `boboko:export` | Dump database + storage files to a timestamped zip |
+| `boboko:import` | Restore from a `boboko:export` zip archive |
+| `boboko:export:cleanup` | Delete old export zips, keep N most recent |
+| `boboko:migrate:import` | Import a vendor product catalog (Shopify, etc.) into Lunar |
+| `boboko:privacy:process-erasure-requests` | Dispatch an erasure job for every due GDPR erasure request (wire into your own scheduler) |
+| `lunar:create-admin` | Create a Lunar admin user (overrides Lunar's own command) |
+| `lunar:install` | Seed default Lunar store data — countries, channel, currency, tax zone, attributes, product type (overrides Lunar's own command) |
 
 ### Functional Types
 
-Result and Option monads for explicit error handling without exceptions.
+Result and Option types for explicit error handling without exceptions.
 
 ```php
 // Result<T, E>
-$result = Success::of($value);
-$result = Error::of('something went wrong');
+$result = Success::create($value);
+$result = Error::create('something went wrong');
 $result->map(fn($v) => ...)->flatMap(fn($v) => ...);
 
 // Option<T>
-$option = Option::fromValue($nullableValue);
-$option->getOrElse('default');
-$option->map(fn($v) => ...)->filter(fn($v) => $v > 0);
+$option = Some::create($value);
+$option = None::create();
+$option->map(fn($v) => ...);
 ```
 
 ---
@@ -102,17 +188,22 @@ Then run:
 
 ```bash
 composer require boboko/core
+php artisan vendor:publish --tag=core-config
 php artisan vendor:publish --tag=core-assets
 php artisan migrate
 ```
 
+For local core development alongside a consuming app (path-repo symlink + Docker mount), see
+[`docs/modules.md`](docs/modules.md) "Docker Compose: the local-core mount".
+
 ---
 
 ## Requirements
 
-- PHP 8.2+
-- Laravel 11+
-- Lunar (lunarphp/lunar + lunarphp/admin)
+- PHP 8.5+
+- Laravel 12+
+- Lunar 1.3 (`lunarphp/lunar`)
+- Meilisearch (for product search/listing/catalog)
 - Spatie Laravel Activity Log
 
 ---
@@ -120,7 +211,12 @@ php artisan migrate
 ## Documentation
 
 - [`docs/otp-auth.md`](docs/otp-auth.md) — OTP authentication flow
+- [`docs/localization.md`](docs/localization.md) — Locale-prefixed routing and storefront translations
+- [`docs/product-search.md`](docs/product-search.md) — Full-text product search
+- [`docs/product-listing.md`](docs/product-listing.md) — Product listing/filtering/detail catalog service
+- [`docs/privacy.md`](docs/privacy.md) — GDPR right of access/erasure, User-scope vs Customer-scope
+- [`docs/shopify-import.md`](docs/shopify-import.md) — Shopify CSV → Lunar field mapping and import design
 - [`docs/activity-log.md`](docs/activity-log.md) — Activity logging
-- [`docs/lunar.md`](docs/lunar.md) — Lunar framework reference
 - [`docs/notifications.md`](docs/notifications.md) — Notification registry
+- [`docs/lunar.md`](docs/lunar.md) — Lunar framework reference and gotchas
 - [`docs/modules.md`](docs/modules.md) — Module architecture, Customer/User pairing, provider registration pitfalls

composer.json

@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"
@@ -18,7 +18,7 @@
     "lunarphp/search": "*",
     "lunarphp/meilisearch": "*",
     "spatie/laravel-translation-loader": "^2.8",
-    "lunarphp/stripe": "^1.5"
+    "stripe/stripe-php": "^16.6"
   },
   "require-dev": {
     "fakerphp/faker": "^1.23",
@@ -44,7 +44,8 @@
         "Modules\\Core\\Providers\\CartServiceProvider",
         "Modules\\Core\\Providers\\ReviewServiceProvider",
         "Modules\\Core\\Providers\\ShippingServiceProvider",
-        "Modules\\Core\\Providers\\OrderServiceProvider"
+        "Modules\\Core\\Providers\\OrderServiceProvider",
+        "Modules\\Core\\Providers\\PrivacyServiceProvider"
       ]
     }
   },

config/core.php

@@ -16,6 +16,43 @@ return [
 
     'auto_create_customer_for_user' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Privacy / GDPR data-subject requests
+    |--------------------------------------------------------------------------
+    |
+    | 'providers' lists every Modules\Core\Privacy\Contracts\PersonalDataProvider
+    | that should be consulted for right-of-access/right-of-erasure requests. A
+    | module never needs to be known to core in advance — it just adds its own
+    | provider class here, the same way config('lunar.search.indexers') maps a
+    | model to its indexer. See docs/privacy.md.
+    |
+    | 'grace_period_days' is how long an erasure request stays cancellable
+    | (account deactivated, not yet erased) before it's actually processed by
+    | the privacy:process-erasure-requests scheduled command.
+    |
+    */
+
+    'privacy' => [
+        'providers' => [
+            // ActivityLogDataProvider MUST run before AddressDataProvider —
+            // it resolves which activity_log rows belong to this customer
+            // (including ones keyed by an Address id) before
+            // AddressDataProvider hard-deletes those Address rows. See that
+            // provider's own class docblock.
+            \Modules\Core\Logging\Privacy\ActivityLogDataProvider::class,
+            \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+            \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+            \Modules\Core\Order\Privacy\OrderDataProvider::class,
+            \Modules\Core\Cart\Privacy\CartDataProvider::class,
+            \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+            \Modules\Core\Payment\Privacy\PaymentDataProvider::class,
+            \Modules\Core\Auth\Privacy\UserSessionDataProvider::class,
+        ],
+
+        'grace_period_days' => 30,
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Cart Abandonment Threshold
@@ -65,4 +102,29 @@ return [
         'return_window_days' => 14,
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Storefront OTP Login
+    |--------------------------------------------------------------------------
+    |
+    | Modules\Core\Auth\Services\UserOtpService's passwordless login.
+    | max_attempts caps how many wrong codes a shopper can guess against ONE
+    | generated code before it's invalidated outright. generation_limit/
+    | generation_decay_minutes cap how often a NEW code can be requested for
+    | the same email — independent of max_attempts, since generating a fresh
+    | code also resets the guess count, so an attempt cap alone doesn't stop
+    | an attacker from just requesting a new code every few tries. This same
+    | limit is also what stands between a malicious/careless caller and
+    | mail-bombing one inbox.
+    |
+    */
+
+    'auth' => [
+        'otp' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+        ],
+    ],
+
 ];

database/migrations/2026_08_24_000001_add_deactivated_at_to_users_table.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->timestamp('deactivated_at')->nullable()->after('otp_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('deactivated_at');
+        });
+    }
+};

database/migrations/2026_08_24_000002_create_data_erasure_requests_table.php

@@ -0,0 +1,56 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('data_erasure_requests', function (Blueprint $table) {
+            $table->id();
+            // Polymorphic, not a fixed customer_id — a request targets either a
+            // Lunar Customer (business account) or a User (individual), never
+            // both at once. See docs/privacy.md "User-scope vs Customer-scope".
+            $table->string('subject_type');
+            $table->unsignedBigInteger('subject_id');
+            // Snapshot, not a live-looked-up value — the subject's email may
+            // change or the record may be gone by the time this is read.
+            $table->string('email')->nullable();
+            // Who asked for this: the subject themselves (self-service deletion)
+            // or a staff member acting on their behalf. Plain nullable type+id
+            // columns rather than morphs() — only ever one of two concrete actor
+            // types, not an open-ended polymorphic set.
+            $table->string('requested_by_type');
+            $table->unsignedBigInteger('requested_by_id');
+            $table->string('status')->default('pending');
+            // Set only on a Customer-scoped request that was auto-created because
+            // erasing a User left them as the sole remaining user on that Customer
+            // (see Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener).
+            // Null for every normal, directly-requested erasure. Lets login-
+            // reactivation find and revert exactly the Customer request THIS
+            // User's cancellation caused, without touching an unrelated,
+            // independently-requested Customer erasure the User happens to be
+            // linked to.
+            $table->foreignId('caused_by_request_id')->nullable()->constrained('data_erasure_requests')->nullOnDelete();
+            // now() + config('core.privacy.grace_period_days') at creation time —
+            // when privacy:process-erasure-requests will actually run this.
+            $table->timestamp('scheduled_for');
+            $table->timestamp('cancelled_at')->nullable();
+            $table->timestamp('completed_at')->nullable();
+            // Every provider's outcome, written once the request completes —
+            // see Modules\Core\Privacy\ErasureReport. Null until then.
+            $table->json('report')->nullable();
+            $table->timestamps();
+
+            $table->index(['status', 'scheduled_for']);
+            $table->index(['subject_type', 'subject_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('data_erasure_requests');
+    }
+};

database/migrations/2026_08_24_000003_create_data_export_requests_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('data_export_requests', function (Blueprint $table) {
+            $table->id();
+            // Polymorphic, not a fixed customer_id — see data_erasure_requests
+            // for the same shape and reasoning.
+            $table->string('subject_type');
+            $table->unsignedBigInteger('subject_id');
+            // Snapshot, not a live lookup — same reasoning as
+            // data_erasure_requests.email (see that migration).
+            $table->string('email')->nullable();
+            $table->string('status')->default('pending');
+            // Storage path of the assembled export .zip, set once the queued job
+            // finishes. Null while pending.
+            $table->string('file_path')->nullable();
+            $table->timestamp('completed_at')->nullable();
+            $table->timestamps();
+
+            $table->index('status');
+            $table->index(['subject_type', 'subject_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('data_export_requests');
+    }
+};

database/migrations/2026_09_03_000001_create_stripe_payment_intents_table.php

@@ -0,0 +1,46 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Lunar\Base\Migration;
+
+/**
+ * First-party copy of lunarphp/stripe's own create_stripe_payment_intents_table
+ * migration (package removed in favour of depending on stripe/stripe-php
+ * directly — see Modules\Core\Payment\Support\StripeManager and
+ * Modules\Core\Payment\Models\StripePaymentIntent, which replace the
+ * package's own classes over this same table). Timestamped to run just
+ * before this app's own add_context_to_stripe_payment_intents migration,
+ * which already alters this table.
+ *
+ * Guarded with hasTable(): on any environment that already ran
+ * lunarphp/stripe's own copy of this migration before the package was
+ * removed, the table already exists — this migration is only the one that
+ * actually creates it on a fresh install/database from now on.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable($this->prefix.'stripe_payment_intents')) {
+            return;
+        }
+
+        Schema::create($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('cart_id')->constrained($this->prefix.'carts');
+            $table->foreignId('order_id')->nullable()->constrained($this->prefix.'orders');
+            $table->string('intent_id')->index();
+            $table->string('status')->nullable();
+            $table->string('event_id')->index()->nullable();
+            $table->timestamp('processing_at')->nullable();
+            $table->timestamp('processed_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists($this->prefix.'stripe_payment_intents');
+    }
+};

database/migrations/2026_09_14_000001_add_otp_attempts_to_users_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Caps brute-forcing a 6-digit OTP code (1M combinations, 10-minute
+ * window, previously uncapped) — see Modules\Core\Auth\Services\
+ * UserOtpService::validate(), which now invalidates the code entirely
+ * (forcing a fresh generateAndSend()) once otp_attempts reaches its max,
+ * rather than leaving a live code guessable indefinitely within its
+ * expiry window.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->unsignedTinyInteger('otp_attempts')->default(0)->after('otp_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('otp_attempts');
+        });
+    }
+};

database/migrations/2026_09_15_000001_create_user_sessions_table.php

@@ -0,0 +1,41 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A per-login session registry, independent of the actual session store
+ * driver (SESSION_DRIVER=redis in this app — no "sessions" table to
+ * purge by user_id the way the database driver would allow). Each
+ * successful OTP login (Modules\Core\Auth\Services\UserOtpService::
+ * validate()) records one row here and stamps the token into the
+ * Laravel session payload; Modules\Core\Auth\Http\Middleware\
+ * EnsureSessionNotRevoked checks it on every request. "Logout
+ * everywhere" (Modules\Core\Auth\Services\UserSessionService::
+ * revokeOtherSessions()) is then just marking every OTHER row
+ * revoked_at, no session-store-specific logic anywhere.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('user_sessions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('token', 64)->unique();
+            $table->string('user_agent')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->timestamp('last_used_at');
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+
+            $table->index(['user_id', 'revoked_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('user_sessions');
+    }
+};

database/migrations/2026_09_15_000001_make_payment_methods_name_translatable.php

@@ -0,0 +1,65 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Language;
+
+/**
+ * PaymentMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Cash On Delivery", "el": "Αντικαταβολή"}), rendered in Filament
+ * via Lunar's own Lunar\Admin\Support\Forms\Components\TranslatedText —
+ * the same reusable component/data-shape Product/Collection names already
+ * use (Lunar\Base\Traits\HasTranslations), just applied directly to a
+ * plain column here rather than through attribute_data, since
+ * PaymentMethod is a merchant-configured settings row, not a translatable
+ * catalog attribute.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet — this
+ * migration can run before lunar:install seeds one) rather than dropped,
+ * so an already-configured payment method's name isn't blanked out.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (which requires doctrine/dbal — not installed in this project) —
+ * Postgres-specific (this project runs on `pgsql`, per its own docker
+ * setup), with an explicit USING clause since json isn't implicitly
+ * castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name DROP DEFAULT');
+        DB::statement("ALTER TABLE payment_methods ALTER COLUMN name TYPE json USING NULL");
+
+        foreach ($existing as $id => $name) {
+            if ($name === null) {
+                continue;
+            }
+
+            DB::table('payment_methods')
+                ->where('id', $id)
+                ->update(['name' => json_encode([$defaultLocale => $name])]);
+        }
+    }
+
+    public function down(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name TYPE varchar(255) USING NULL');
+
+        foreach ($existing as $id => $name) {
+            $decoded = json_decode((string) $name, true);
+            $flat = is_array($decoded) ? ($decoded[$defaultLocale] ?? reset($decoded) ?: null) : $name;
+
+            DB::table('payment_methods')->where('id', $id)->update(['name' => $flat]);
+        }
+    }
+};

database/migrations/2026_09_15_000002_make_shipping_methods_name_translatable.php

@@ -0,0 +1,74 @@
+<?php
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Base\Migration;
+use Lunar\Models\Language;
+
+/**
+ * ShippingMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Standard Delivery", "el": "Κανονική Παράδοση"}), rendered in
+ * Filament via Lunar's own Lunar\Admin\Support\Forms\Components\
+ * TranslatedText (Modules\Core\Shipping\Extensions\
+ * ShippingMethodResourceExtension::replaceNameField()) — same shape/
+ * resolution as PaymentMethod.name (see its own migration,
+ * 2026_09_15_000001_make_payment_methods_name_translatable.php) and
+ * Product/Collection names (Lunar\Base\Traits\HasTranslations).
+ *
+ * ShippingMethod is a vendor (lunarphp/table-rate-shipping) table, but
+ * converting a vendor column's type via a migration is no different from
+ * any other schema change this project already makes against a vendor
+ * table (see database/migrations/2026_08_31_000001_create_payment_methods_table.php's
+ * sibling migrations for the same pattern against PaymentMethod) — there
+ * was no good reason to route this through `data.name` instead, unlike
+ * `data.fulfillment_type` which is a genuinely NEW field the vendor table
+ * never had at all.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet)
+ * rather than dropped.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (requires doctrine/dbal — not installed in this project) — Postgres-
+ * specific (this project runs on `pgsql`), with an explicit USING clause
+ * since json isn't implicitly castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // The column is NOT NULL (vendor migration never marked it
+        // nullable) — converting via `USING NULL` first, then
+        // backfilling with a second UPDATE, violates that constraint
+        // before the backfill ever runs. json_build_object() converts
+        // each existing string in place, in the same statement, so the
+        // column is never transiently NULL. $defaultLocale is inlined
+        // (not bound) — parameter binding inside an ALTER TABLE ... USING
+        // expression isn't reliable across drivers; it's a Language::code
+        // value we control, not user input, so quote_literal-safe
+        // interpolation here is fine.
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement("ALTER TABLE {$table} ALTER COLUMN name TYPE json USING json_build_object({$quotedLocale}, name)");
+    }
+
+    public function down(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // Same NOT NULL constraint applies going back — ->>'{locale}'
+        // extracts the default locale's text value directly in the
+        // USING clause, falling back to the first key present via
+        // COALESCE for any row missing that locale (e.g. one only ever
+        // filled in via a non-default language).
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement(
+            "ALTER TABLE {$table} ALTER COLUMN name TYPE varchar(255) ".
+            "USING COALESCE(name->>{$quotedLocale}, (SELECT value FROM json_each_text(name) LIMIT 1))"
+        );
+    }
+};

docs/payments.md

@@ -145,23 +145,20 @@ produced had it resolved synchronously.
 with no memory of the request that started the payment. Something has to persist enough to
 answer "which order/cart does gateway reference X belong to?" between the two calls.
 
-**Read directly from `lunarphp/stripe`'s own source** (`StripePaymentType::authorize()`,
-`ProcessStripeWebhook`, `WebhookController`) to see how Lunar itself solves this — confirmed
-it does **not** stash a generic opaque blob. It writes the correlating ids as real, typed
-columns on `Lunar\Stripe\Models\StripePaymentIntent` (`cart_id`, `order_id`) at the moment the
-intent is created/first seen, then reads them back the same way when the webhook arrives:
+The precedent for this originally came from reading `lunarphp/stripe`'s own source
+(`StripePaymentType::authorize()`, `ProcessStripeWebhook`, `WebhookController`) — that package
+solved this the same way, writing the correlating ids as real, typed columns on its own
+`StripePaymentIntent` model rather than a generic opaque blob. **`lunarphp/stripe` has since
+been removed from this project** in favour of depending on `stripe/stripe-php` directly (see
+CHANGELOG.md) — `Modules\Core\Payment\Models\StripePaymentIntent` is now a first-party model
+over the same table shape, kept for exactly the same reason.
 
-```php
-// ProcessStripeWebhook::handle() — falls back through two real lookups,
-// neither of them a generic context blob:
-$cart = StripePaymentIntent::where('intent_id', $this->paymentIntentId)->first()?->cart
-    ?: Cart::where('meta->payment_intent', '=', $this->paymentIntentId)->first();
-```
-
-**`StripePaymentDriver` follows this exact precedent**: it reads `cart_id`/`order_id` out of
-`$context` at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent`
-row (a table already owned by `lunarphp/stripe`, already shaped for exactly this), then reads
-them back the same way in `handleCallback()`. No generic `context` json column, no new table.
+**`StripePaymentDriver` follows this pattern**: it reads `cart_id`/`order_id` out of `$context`
+at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent` row (`src/
+Payment/Models/StripePaymentIntent.php`, table `stripe_payment_intents`), then reads them back
+the same way in `handleCallback()`. No generic `context` json column beyond what that table
+already carries (`context`, added for a different purpose — see that migration's own
+docblock), no new table.
 
 ### This pattern is per-driver, not a shared table
 
@@ -176,6 +173,48 @@ a shared generic one.
 
 ---
 
+## Reconciliation — a charge that succeeds on Stripe but is never written locally
+
+This app never creates or reuses a Stripe **Customer** object — every PaymentIntent is a
+one-off (`StripePaymentDriver::createAndConfirm()`'s own `$params` never includes a `customer`
+key), and nothing calls Stripe's Customer API anywhere in this codebase. That's a deliberate
+choice, not an oversight: a Customer object only earns its keep if something actually needs it
+(saved/reusable payment methods, subscriptions, Stripe-side lifetime-value grouping across
+orders) — none of which exist in this checkout flow today. Creating one anyway would just be
+more PII sitting on a third party's servers for no functional benefit, and it would become
+another cross-reference a future Payment privacy provider has to account for (detaching/
+deleting the Customer on erasure, not just the local PaymentIntent row). If a real feature
+needs it later (e.g. "save my card"), add it then, scoped to that feature.
+
+The gap this creates: with no Customer object and no other identifying field previously sent
+to Stripe, a PaymentIntent that succeeds on Stripe's side but is never written to our own DB
+(e.g. a database outage at exactly the wrong moment, between Stripe confirming the charge and
+`rememberIntent()`'s insert) would be **untraceable** back to a cart or order — nothing to
+search Stripe's dashboard by except amount, timestamp, and card last-4.
+
+**Fix**: `createAndConfirm()` now sets `metadata: ['cart_id' => ..., 'order_id' => ...]`
+(`array_filter()`-ed, since `order_id` isn't known yet at initial `pay()`/`authorize()` time —
+same null-coalesce `rememberIntent()` already does) on every PaymentIntent. This is metadata
+only, visible on Stripe's own dashboard/API for manual reconciliation — it does not create a
+Customer object and does not change anything about how `handleCallback()`/webhook correlation
+works (that still goes through `stripe_payment_intents`, per "Async resolution" above). It's
+purely a recovery aid for the case where our own write never happened at all.
+
+---
+
+## GDPR erasure/export
+
+`Modules\Core\Payment\Privacy\PaymentDataProvider` covers `lunar_transactions`
+(`card_type`/`last_four`) and `stripe_payment_intents` — see `docs/privacy.md` for the full
+right-of-erasure/right-of-access design. Pseudonymizes card metadata on erasure (same
+tax/accounting retention reasoning `Order`'s own provider uses) and deletes the Stripe
+correlation rows outright, since their only purpose — resolving an async webhook callback, see
+"Async resolution" above — has already been served by the time an erasure request runs. No
+Stripe Customer object exists anywhere in this app (see "Reconciliation" above) for this
+provider to also request deletion of.
+
+---
+
 ## Explicitly out of scope for this pass
 
 - **`Checkout`/`Order` wiring** — how `Checkout` calls into `Payment`, how `Order`/`Checkout`

docs/privacy.md

@@ -0,0 +1,417 @@
+# Privacy / GDPR Data-Subject Requests
+
+`Modules\Core\Privacy` implements the right of access (export) and right of erasure for
+customers, as an extensible contract rather than a fixed list of tables — any module (core,
+or a future ERP/banking/etc. module) can register its own data without core knowing it exists.
+
+---
+
+## User-scope vs Customer-scope — two genuinely different operations
+
+A Lunar `Customer` (business account: orders, addresses, buyer record) and a `User` (individual
+login identity) are linked many-to-many via the `customer_user` pivot (see `docs/modules.md`
+"Customer/User Pairing") — **one User can belong to many Customer accounts, and one Customer
+account can have many linked Users.** This is the real shape of B2B multi-seat access: a person
+can have login access to several separate business accounts, and a business account can have
+several employees each with their own login.
+
+That means "delete my personal data" and "delete this business account" are not the same request,
+and conflating them is actively wrong:
+
+- **Erasing a Customer must never touch any linked User's login or identity.** Erasing "Acme
+  Corp" must not deactivate or destroy access for the employees who work there — and must not
+  touch any *other* Customer account, even one sharing some of the same Users.
+- **Erasing a User must never touch any Customer account's own data.** John asking to delete
+  *his* account must clear his name/email/login wherever it appears — and correctly end his
+  membership on every Customer he's linked to (detach the pivot) — but must not erase Acme Corp's
+  orders or addresses, and must not affect any other employee still linked to Acme Corp.
+
+Every part of this module is split along that line — a `PersonalDataProvider`, a `PrivacyService`
+method, a request record — is always explicitly **for a Customer** or **for a User**, never both
+at once, and never one with an implicit cascade into the other.
+
+---
+
+## Why an extensible contract, not a hardcoded script
+
+A GDPR erasure/export request has to touch every module that holds personal data, but core can't
+know in advance what future modules will exist or what data they'll hold — and different data
+needs fundamentally different handling (freely erasable PII vs. financial records that must be
+pseudonymized-not-deleted for legal retention vs. data that must be retained outright). There's
+deliberately no central taxonomy for this in the contract — each module owns its own retention
+judgment, since only the module that owns a table actually knows its legal requirements.
+
+`Modules\Core\Privacy\Contracts\PersonalDataProvider` is the whole contract:
+
+```php
+interface PersonalDataProvider
+{
+    public function name(): string;
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult;
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult;
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult;
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult;
+}
+```
+
+Every provider implements all four methods. A provider with nothing relevant to one scope
+implements that method as a no-op — `ErasureOutcome::Skipped` with a reason for erase, an empty
+payload for export (e.g. `AddressDataProvider::eraseForUser()`, since addresses belong to a
+Customer, not an individual).
+
+A provider implementation lives inside the module that owns the data it erases/exports, under
+that module's own `Privacy/` subdirectory (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`,
+`Modules\Core\Customer\Privacy\CustomerDataProvider`) — never inside `Modules\Core\Privacy`
+itself, which only owns the shared contract (`Contracts\PersonalDataProvider`), the request
+lifecycle (`Services\PrivacyManager`/`PrivacyService`), and the DTOs/enums every provider
+returns. This mirrors how this codebase already handles other cross-cutting-but-domain-specific
+code (e.g. a resource's own `Filament/Extensions/` subdirectory) — and matters concretely if a
+module is ever extracted into its own composer package (see `docs/modules.md`): the provider
+that knows how to erase that module's data must travel with it, not get stranded in `Privacy`
+depending on a package that no longer ships in this repo.
+
+A module registers by adding its provider class to `config('core.privacy.providers')` — the
+same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
+
+```php
+// config/core.php
+'privacy' => [
+    'providers' => [
+        \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+        \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+        \Modules\Core\Order\Privacy\OrderDataProvider::class,
+        \Modules\Core\Cart\Privacy\CartDataProvider::class,
+        \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+        // A future module just adds its own provider here.
+    ],
+],
+```
+
+`PrivacyManager` resolves each class via the container and asserts every `name()` is unique —
+two providers registering the same name throws, so a naming collision fails loudly at
+resolution time rather than silently overwriting one provider's data in an export/report.
+
+---
+
+## `UserSubject` and `CustomerSubject` — identifying "the person" vs "the account"
+
+Two separate value objects, not one — each deliberately carries only what its own scope needs, so
+a provider can't accidentally reach across the boundary:
+
+```php
+class CustomerSubject
+{
+    public readonly int $customerId;
+    // No userIds, no email — Customer-scope has no business knowing about logins.
+}
+
+class UserSubject
+{
+    public readonly int $userId;
+    public readonly ?string $email;
+    // No customerId — one User can be linked to many Customers; a provider that
+    // needs to know which ones looks that up itself (e.g. to detach the pivot),
+    // rather than this value object assuming or privileging any single one.
+}
+```
+
+`CustomerSubject::forCustomer(Customer $customer)` and `UserSubject::forUser($user)` build one
+from the record staff (or the person themselves) look up.
+
+---
+
+## Providers shipped in core
+
+| Provider | `name()` | Lives in | Covers | Customer-scope | User-scope |
+|---|---|---|---|---|---|
+| `ActivityLogDataProvider` | `activity_log` | `Modules\Core\Logging\Privacy` | `activity_log` (Spatie) for subject types `Customer`/`Address`/`CartAddress`/`OrderAddress`/`Transaction` | **Pseudonymized** — `properties` redacted, who/what/when metadata kept | Skipped — `causer_id` is an actor reference, not PII content; see below |
+| `CustomerDataProvider` | `customer` | `Modules\Core\Customer\Privacy` | `lunar_customers`, and separately the `User`'s own name/email/OTP fields | Erases the account's own fields only | Erases that User's name/email/OTP fields only, and detaches them from every linked Customer |
+| `AddressDataProvider` | `addresses` | `Modules\Core\Customer\Privacy` | `lunar_addresses` | Erased (deleted outright) | Skipped — belongs to a Customer, not an individual |
+| `OrderDataProvider` | `orders` | `Modules\Core\Order\Privacy` | `lunar_orders`, `lunar_order_addresses`, and their `meta` (`terms_accepted*`, `payment_method`, `box_now_locker`) | **Pseudonymized, not erased** — see below | Skipped — belongs to a Customer, not an individual |
+| `CartDataProvider` | `carts` | `Modules\Core\Cart\Privacy` | `lunar_cart_addresses`, and `lunar_carts.meta` (`recovery_consent*`, `payment_method`, `checkout_fingerprint`) | Erased | Skipped — belongs to a Customer, not an individual |
+| `ReviewDataProvider` | `reviews` | `Modules\Core\Review\Privacy` | `product_reviews` | Skipped — authored by an individual, not a business account | Pseudonymized by matching `reviewer_email`; rating/title/body text kept |
+| `PaymentDataProvider` | `payments` | `Modules\Core\Payment\Privacy` | `lunar_transactions` (`card_type`/`last_four`), `stripe_payment_intents` | **Pseudonymized** — card metadata cleared, correlation rows deleted, amounts/statuses kept | Skipped — belongs to Customer-owned orders, not individual users |
+| `UserSessionDataProvider` | `sessions` | `Modules\Core\Auth\Privacy` | `user_sessions` (`ip_address`, `user_agent`) | Skipped — belongs to an individual User, not a business account | Erased (deleted outright) |
+
+`CustomerDataProvider` is the one provider that implements both scopes meaningfully, and keeps
+them from touching each other — see the class docblock for the full reasoning.
+
+### `activity_log` is redacted by subject, never by causer
+
+`Modules\Core\Logging\ActivityLogService` (plus several Lunar models' own native `use
+LogsActivity` — `Customer`, `CartAddress`, `OrderAddress`, `Transaction`) durably retains a full
+snapshot of whatever it logged in `properties`, completely independent of the real row it
+describes — erasing/pseudonymizing a `Customer`/`Address`/`Order`/etc. elsewhere does nothing to
+this table on its own. `ActivityLogDataProvider::eraseForCustomer()` redacts `properties` on
+every row whose **subject** (not causer) resolves back to that customer, across all five
+PII-bearing subject types.
+
+It deliberately never touches `causer_id` — the causer is "who performed this action," not PII
+content, and erasing it would defeat the audit trail's own purpose. `eraseForUser()` is
+therefore a no-op: a `User` appears in this table only as a causer, never as subject content, so
+there's nothing to redact from the User side alone.
+
+**Ordering dependency**: `ActivityLogDataProvider` must run *before* `AddressDataProvider` in
+`config('core.privacy.providers')` — it resolves which `activity_log` rows are keyed by an
+`Address` id while those Address rows still exist; `AddressDataProvider` then hard-deletes them.
+Reversing the order would make matching those rows impossible once the addresses are gone.
+
+**`ReviewDataProvider` needs review.** It moved from Customer-scope to User-scope on the
+reasoning that authorship is a personal attribute, not a business-account attribute — but this
+hasn't been fully validated against how reviews are actually attributed in this codebase. The
+class carries a `NEEDS REVIEW` note; revisit before relying on it for a real request.
+
+### Orders are pseudonymized, not deleted
+
+GDPR Art. 17(3)(b) explicitly allows retaining data an erasure request would otherwise cover,
+when a legal obligation requires it — tax/accounting law generally requires invoices be kept for
+several years. `OrderDataProvider::eraseForCustomer()` clears the free-text PII fields on `Order`/
+`OrderAddress` (`customer_reference`, `notes`, name/address/contact fields) but leaves the order
+row, totals, line items, and tax data fully intact. Its `ProviderErasureResult` reports
+`ErasureOutcome::Pseudonymized`, not `Erased` — a compliance report or admin UI can see exactly
+why an order wasn't deleted without reading `OrderDataProvider`'s source.
+
+### Reviews are matched by email — a real, documented limitation
+
+`ProductReview` has no FK to Customer/User at all (see `docs/product-listing.md` "Reviews") —
+it's deliberately anonymous, just free-text `reviewer_name`/`reviewer_email`. `ReviewDataProvider`
+matches by `reviewer_email` against `UserSubject::$email`; a review submitted under a different
+email than the one on file simply won't be found. There's no stronger signal available without
+changing `ProductReview`'s schema.
+
+### Staff/employee data is out of scope
+
+`Staff` (admin/panel employees) is never a `UserSubject`/`CustomerSubject` at all — this feature
+is scoped to customer-initiated and staff-initiated-on-a-customer's-behalf requests. An employee's
+own data (a different HR/access-management concern) isn't reachable through this flow.
+
+---
+
+## Erasure isn't immediate — a cancellable grace period
+
+`PrivacyService` has parallel methods for each scope: `requestErasureForCustomer()` /
+`requestErasureForUser()`. Neither erases anything immediately. Each opens a `DataErasureRequest`
+(`pending`, `scheduled_for` = now + `config('core.privacy.grace_period_days')`, default 30). This
+mirrors Shopify's own account-deletion flow: a window where the subject can change their mind
+before anything is actually erased.
+
+**Only the User-scoped request deactivates a login.** `requestErasureForCustomer()` deactivates
+no one — a business-account erasure must never block anyone's access.
+`requestErasureForUser()` deactivates that one User's login (blocks it — see
+`Modules\Core\Auth\Services\UserOtpService` — nothing else changes).
+
+```php
+use Modules\Core\Privacy\Services\PrivacyService;
+
+$service = app(PrivacyService::class);
+
+// Customer-scoped: either the Customer itself (self-service) or a Staff member.
+$request = $service->requestErasureForCustomer($customer, $requestedBy);
+
+// User-scoped: either the User itself (self-service) or a Staff member.
+$request = $service->requestErasureForUser($user, $requestedBy);
+
+// Cancel before scheduled_for — for a User-scoped request, reactivates the
+// account. A Customer-scoped request never deactivated anything, so there's
+// nothing to reactivate for it.
+$service->cancelErasure($request);
+```
+
+### Logging back in during the grace period cancels the request automatically
+
+Authentication is never blocked by deactivation — `UserOtpService::validate()` still requires
+the correct OTP code. Once validated, it dispatches `Modules\Core\Auth\Events\UserAuthenticated`;
+`Modules\Core\Privacy\Listeners\CancelErasureOnLoginListener` (registered in
+`PrivacyServiceProvider`, **queued** — see below) looks for a pending request keyed on *that
+User's own id* — never a Customer-scoped one, since Customer-scope never deactivates a login in
+the first place — and calls `cancelErasure()` on it, then reverts every Customer erasure request
+it caused (see "The sole-owner cascade" below). Logging back in **is** the "I changed my mind"
+action — no separate UI/flow needed for reactivation.
+
+This listener is queued rather than synchronous, so login returns to the browser without waiting
+on the bookkeeping. Nothing else in this codebase currently reads `deactivated_at` besides this
+listener and `PrivacyService` itself — `UserOtpService::validate()` never gates the login on it —
+so the brief window between the login response and the job actually running has no other consumer
+to observe it as stale.
+
+### The sole-owner cascade — erasing the last User on a Customer also erases the Customer
+
+If a User is erased and they were the **only** User linked to a given Customer, that Customer's
+data (orders, addresses, buyer record) becomes permanently unreachable through any login the
+moment the User's identity is gone — nobody could ever again log in to exercise a data-subject
+right over it. GDPR's data minimization principle (Art. 5(1)(c)) means it shouldn't just sit
+there indefinitely with no legitimate purpose.
+
+`requestErasureForUser()` and `requestImmediateErasureForUser()` both fire
+`Modules\Core\Privacy\Events\UserErasureRequested` right after the request is created (and, for
+the immediate path, before `completeErasure()` runs — see below).
+`Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener` (**queued**, registered in
+`PrivacyServiceProvider`) handles it: for every Customer the User is linked to, if that User is
+currently the *sole* linked User (count is 1, and that one User is this one — not just count ===
+1, to be explicit rather than relying on an assumption), it opens a second, independent
+grace-period request via `requestErasureForCustomer($customer, $user, causedByRequestId: ...)`.
+Both requests then run through their own separate 30-day windows.
+
+```
+User erasure requested
+   │
+   ▼
+UserErasureRequested event ──▶ CascadeCustomerErasureListener (queued)
+                                    │
+                                    ▼
+                    for each linked Customer: sole owner?
+                                    │ yes
+                                    ▼
+                    requestErasureForCustomer(..., causedByRequestId: <user request id>)
+```
+
+**Tracing the cascade — `caused_by_request_id`.** A cascade-created Customer request's
+`caused_by_request_id` points back at the User request that triggered it. This is what lets
+`CancelErasureOnLoginListener` revert *exactly* the cascade a User's own cancellation should
+undo (via `DataErasureRequest::caused()`) without ever touching an unrelated, independently
+staff-requested Customer erasure the User happens to still be linked to.
+
+**Why this is queued, not synchronous.** `CascadeCustomerErasureListener` runs as an independent,
+separately-retryable job rather than inline inside `requestErasureForUser()` — a failure in the
+cascade check never rolls back or blocks the User's own request, and there's no
+`DB::transaction()` wrapping needed, since the two writes (the User's request, and any cascaded
+Customer request) aren't required to be atomic with each other.
+
+**A known, accepted race on the immediate-erasure path only.** Because the listener is queued,
+Eloquent re-fetches its models fresh when the job actually runs (see
+`Illuminate\Queue\SerializesModels`) — so `$event->request->subject->customers` reflects the
+*real* state at execution time, not a stale snapshot from dispatch time. For
+`requestImmediateErasureForUser()`, that job may run before or after `completeErasure()` detaches
+the User's memberships in the same call. If the detach happens first, the User is simply no
+longer linked to anything by the time the cascade job runs, and nothing cascades — an accepted
+race for that rare, staff-only path (see "Immediate erasure" below), not a concern for the
+everyday `requestErasureForUser()` grace-period path, where nothing detaches until its own later,
+separate `completeErasure()` run — well after the cascade job has had time to fire.
+
+### Processing due requests — one job per request
+
+`php artisan boboko:privacy:process-erasure-requests` finds every `pending` request whose
+`scheduled_for` has passed and dispatches one `Modules\Core\Privacy\Jobs\EraseDataSubjectJob` per
+request — it does not run `completeErasure()` inline itself. Each job independently calls
+`PrivacyService::completeErasure()`, which checks the request's polymorphic `subject` and calls
+either every registered provider's `eraseForCustomer()` or `eraseForUser()`, writing the full
+per-provider outcome onto the request's `report` column and marking it `completed`. One job per
+request means one request's failure (a provider throwing, a DB error) doesn't block or crash
+processing of the others, and Laravel's normal per-job retry/failure handling applies to each
+request independently. This package doesn't register a schedule itself; each consuming app wires
+the command into its own scheduler (daily is reasonable), the same way it owns any other
+scheduled task.
+
+### Immediate erasure — staff-only, not self-service
+
+`requestImmediateErasureForCustomer(Customer $customer, Staff $requestedBy): ErasureReport` and
+`requestImmediateErasureForUser($user, Staff $requestedBy): ErasureReport` bypass the grace
+period entirely and erase right away. Both are `Staff`-only **by type**, not just by convention —
+their signatures take `Staff $requestedBy` specifically (not the union type the grace-period
+methods accept), so a self-service/customer-facing code path can't reach either one even by
+accident; calling with a `Customer`/`User` actor is a compile-time type error, not a runtime
+check to remember.
+
+This exists for a formal legal request or regulator inquiry that genuinely requires immediate
+action, not as a convenience for an impatient customer. GDPR Art. 17 requires erasure "without
+undue delay," but doesn't set a maximum number of days for a grace period, and a short, disclosed,
+cancellable hold before executing a self-service request is a widely-used, generally accepted
+pattern (the same one Shopify and most major platforms use) — it is **not** offered as a
+same-click alternative on the self-service deletion flow, since doing so would mostly defeat the
+grace period's purpose (protecting an impulsive requester from themselves). If a subject
+explicitly insists on immediate deletion, that's a staff/support decision to make on the record
+via one of these methods, not a checkbox exposed to every customer.
+
+```php
+$report = $service->requestImmediateErasureForCustomer($customer, $staffMember);
+$report = $service->requestImmediateErasureForUser($user, $staffMember);
+// Both run synchronously — no queueing, no grace period. $report is the same
+// ErasureReport completeErasure() would produce.
+```
+
+---
+
+## Export — queued, not synchronous
+
+Export gathers real data across every registered provider — potentially slow, and there's no
+reason to block whatever request triggered it (a customer clicking "export my data," an API
+call). `requestExportForCustomer()`/`requestExportForUser()` are fast synchronous calls that only
+create a `DataExportRequest` row and dispatch the actual work:
+
+```php
+$request = $service->requestExportForCustomer($customer);
+$request = $service->requestExportForUser($user);
+// $request->status is 'pending'; nothing has been gathered yet.
+```
+
+### The event chain
+
+1. **`ExportDataSubjectJob`** (queued) checks the request's polymorphic `subject` and calls every
+   registered provider's `exportForCustomer()` or `exportForUser()` — all sequentially, in this
+   one job, not fanned out into one job per provider. Per-subject export work is small (a handful
+   of indexed queries per provider), so there's no real parallelism win, and one job means
+   "finished" is just "`handle()` returned," with no `Bus::batch()`/completion-counting needed. If
+   a future provider ever does something genuinely slow (an external API call, a generated PDF),
+   that's the point to reconsider a per-provider batch — not before.
+2. Once every provider's data is gathered, the job fires **`PersonalDataGathered`**
+   (carries the request and the assembled `ExportReport`) — no file exists yet.
+3. **`Modules\Core\Privacy\Listeners\WriteExportToCsvListener`** (registered in
+   `PrivacyServiceProvider`) handles that event: turns each provider's data into its own CSV (via
+   the generic `Modules\Core\Export\CsvWriter` — see below), zips them together, writes the zip to
+   `storage/app/exports/privacy/`, and updates the request (`status: completed`, `file_path`).
+   This is its own listener — not inline in the job — so the export *format* is swappable (an app
+   could unregister this and register a JSON-only listener instead) without touching how data is
+   gathered.
+4. Once the file exists, that listener fires **`PersonalDataExportFileWritten`**.
+5. Core has no opinion on how the subject is told. A consuming app registers its own notification
+   against `PersonalDataExportFileWritten` via `Modules\Core\Notification\NotificationRegistry` —
+   the same pattern as `App\Notifications\QuestionnaireResultsSentNotification` listening on
+   `App\Events\QuestionnaireResultsSent` (see `boboko-test` for a working example). Core
+   deliberately does not send an email itself.
+
+### CSV shape
+
+Every provider's `data` is either a list of associative arrays (addresses, orders, reviews — each
+item becomes a row) or a single associative array (customer — becomes one row). Any nested array
+value within a row (e.g. an order's `addresses` sub-array) is JSON-encoded into that one cell
+rather than exploded into further columns — a generic, provider-agnostic rule in
+`WriteExportToCsvListener`, not something each provider has to think about.
+
+### `Modules\Core\Export\CsvWriter` — a generic, reusable piece
+
+`CsvWriter::write(array $columns, iterable $rows, string $path)` has no knowledge of GDPR,
+customers, or Lunar at all — a caller supplies a schema (`CsvColumn[]`, each just a header plus a
+closure that pulls that column's value out of one record) and any iterable data source. It's used
+here by `WriteExportToCsvListener`, but is equally usable for an unrelated future need — an admin
+bulk catalog export, an accounting handoff — by supplying a different schema and row source;
+nothing about it is GDPR-specific.
+
+---
+
+## Audit trail
+
+`DataErasureRequest` (`data_erasure_requests`) and `DataExportRequest` (`data_export_requests`)
+are the audit records for erasure and export respectively. Both have a polymorphic `subject`
+(`subject_type`/`subject_id`, pointing at either a Lunar `Customer` or a `User` — never both) —
+`subject_type`/`subject_id`/`email` are stored as a **snapshot**, not looked up live, since the
+whole point is for these tables to remain readable after the record they're about has been
+erased. `DataErasureRequest::isForCustomer()` tells you which scope a given request is.
+
+`DataErasureRequest.requested_by_type`/`requested_by_id` capture who asked for it (the subject
+themselves, self-service; `Staff` acting on their behalf; or, for a cascade-created Customer
+request, the User whose erasure caused it — see "The sole-owner cascade") at request time.
+`DataErasureRequest.caused_by_request_id` is set only on a cascade-created Customer request,
+pointing back at the User request that triggered it; null on every normal, directly-requested
+erasure — see `DataErasureRequest::causedBy()`/`::caused()`.
+`DataErasureRequest.report` holds the full per-provider outcome once `completeErasure()` runs;
+`DataExportRequest.file_path` points at the generated zip once `WriteExportToCsvListener`
+finishes.
+
+**Not yet built**: a standalone "leave/remove from a Customer account" action — unlinking a User
+from a Customer without any erasure involved (e.g. a teammate leaving a project, or an account
+admin removing someone) — is a related but separate, smaller feature, deliberately out of scope
+for this module so far. It shares the same pivot-detach primitive `CustomerDataProvider::
+eraseForUser()` already uses as part of a full erasure, but as a standalone action it doesn't
+exist yet.

lang/el/countries.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\Country::name, keyed by the exact
+ * English spelling Lunar's own installer seeds (`lunar:import:address-data`
+ * fetches http://data.lunarphp.io/countries+states.json — see
+ * vendor/lunarphp/core/src/Console/Commands/Import/AddressData.php).
+ * `Country`/`State` have no i18n support of their own (plain string
+ * columns, no translatable trait) — this is a plain Laravel lang file, not
+ * Modules\Core\Localization's DB-backed TranslationService, since these
+ * names are fixed reference data seeded once, not editable UI copy (see
+ * docs/localization.md). A consuming app's storefront looks this up
+ * itself, e.g. __('core::countries.'.$country->name) — core has no
+ * storefront UI of its own to wire this into (see docs/lunar.md).
+ *
+ * Only Greece is covered — this store operates within Greece; add further
+ * countries here as needed.
+ */
+return [
+    'Greece' => 'Ελλάδα',
+];

lang/el/states.php

@@ -0,0 +1,52 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\State::name, keyed by the exact
+ * English spelling Lunar's own installer seeds for Greece
+ * (`lunar:import:address-data` — see lang/el/countries.php's own docblock
+ * for the full explanation of why this is a plain lang file, not
+ * Modules\Core\Localization's TranslationService).
+ *
+ * Covers every Greek state/regional-unit row in Lunar's seed dataset —
+ * scoped to Greece only, matching this store's operating country.
+ */
+return [
+    'Achaea Regional Unit' => 'Περιφερειακή Ενότητα Αχαΐας',
+    'Aetolia-Acarnania Regional Unit' => 'Περιφερειακή Ενότητα Αιτωλοακαρνανίας',
+    'Arcadia Prefecture' => 'Νομός Αρκαδίας',
+    'Argolis Regional Unit' => 'Περιφερειακή Ενότητα Αργολίδας',
+    'Attica Region' => 'Περιφέρεια Αττικής',
+    'Boeotia Regional Unit' => 'Περιφερειακή Ενότητα Βοιωτίας',
+    'Central Greece Region' => 'Περιφέρεια Στερεάς Ελλάδας',
+    'Central Macedonia' => 'Κεντρική Μακεδονία',
+    'Chania Regional Unit' => 'Περιφερειακή Ενότητα Χανίων',
+    'Corfu Prefecture' => 'Νομός Κέρκυρας',
+    'Corinthia Regional Unit' => 'Περιφερειακή Ενότητα Κορινθίας',
+    'Crete Region' => 'Περιφέρεια Κρήτης',
+    'Drama Regional Unit' => 'Περιφερειακή Ενότητα Δράμας',
+    'East Attica Regional Unit' => 'Περιφερειακή Ενότητα Ανατολικής Αττικής',
+    'East Macedonia and Thrace' => 'Ανατολική Μακεδονία και Θράκη',
+    'Epirus Region' => 'Περιφέρεια Ηπείρου',
+    'Euboea' => 'Εύβοια',
+    'Grevena Prefecture' => 'Νομός Γρεβενών',
+    'Imathia Regional Unit' => 'Περιφερειακή Ενότητα Ημαθίας',
+    'Ioannina Regional Unit' => 'Περιφερειακή Ενότητα Ιωαννίνων',
+    'Ionian Islands Region' => 'Περιφέρεια Ιονίων Νήσων',
+    'Karditsa Regional Unit' => 'Περιφερειακή Ενότητα Καρδίτσας',
+    'Kastoria Regional Unit' => 'Περιφερειακή Ενότητα Καστοριάς',
+    'Kefalonia Prefecture' => 'Νομός Κεφαλληνίας',
+    'Kilkis Regional Unit' => 'Περιφερειακή Ενότητα Κιλκίς',
+    'Kozani Prefecture' => 'Νομός Κοζάνης',
+    'Laconia' => 'Λακωνία',
+    'Larissa Prefecture' => 'Νομός Λάρισας',
+    'Lefkada Regional Unit' => 'Περιφερειακή Ενότητα Λευκάδας',
+    'Pella Regional Unit' => 'Περιφερειακή Ενότητα Πέλλας',
+    'Peloponnese Region' => 'Περιφέρεια Πελοποννήσου',
+    'Phthiotis Prefecture' => 'Νομός Φθιώτιδας',
+    'Preveza Prefecture' => 'Νομός Πρέβεζας',
+    'Serres Prefecture' => 'Νομός Σερρών',
+    'South Aegean' => 'Νότιο Αιγαίο',
+    'Thessaloniki Regional Unit' => 'Περιφερειακή Ενότητα Θεσσαλονίκης',
+    'West Greece Region' => 'Περιφέρεια Δυτικής Ελλάδας',
+    'West Macedonia Region' => 'Περιφέρεια Δυτικής Μακεδονίας',
+];

src/Auth/Events/UserAuthenticated.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Auth\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Base\LunarUser;
+
+/**
+ * Dispatched by UserOtpService::validate() on every successful OTP login, not just
+ * a first-time one. Modules\Core\Privacy listens on this to auto-cancel a pending
+ * DataErasureRequest — logging back in during the grace period is the "I changed
+ * my mind" action (see Modules\Core\Privacy\Listeners\CancelErasureOnLoginListener),
+ * which needs $user->customers to resolve any pending request. Typed as
+ * Authenticatable&LunarUser rather than plain Authenticatable (unlike the sibling
+ * UserCreated event) specifically because that listener depends on it — every real
+ * User in this codebase implements LunarUser (see docs/lunar.md "LunarUser trait"),
+ * and User is the only Authenticatable entity in this project (Customer is not —
+ * see docs/modules.md "Customer/User Pairing").
+ */
+class UserAuthenticated
+{
+    public function __construct(
+        public readonly Authenticatable&LunarUser $user,
+    ) {}
+}

src/Auth/Exceptions/OtpThrottledException.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Auth\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Auth\Services\UserOtpService::generateAndSend()
+ * when an email has requested too many codes too quickly — caps both
+ * mail-bombing one inbox and the "just request a fresh code to reset my
+ * guess count" loophole a per-code attempt cap alone doesn't close.
+ */
+class OtpThrottledException extends RuntimeException
+{
+    public function __construct(
+        public readonly int $availableInSeconds,
+    ) {
+        parent::__construct("Too many code requests. Try again in {$availableInSeconds} second(s).");
+    }
+}

src/Auth/Http/Middleware/EnsureSessionNotRevoked.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Auth\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Modules\Core\Auth\Services\UserSessionService;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * The enforcement half of the session registry — see
+ * Modules\Core\Auth\Services\UserSessionService's own docblock. Not
+ * auto-registered anywhere (no routes/kernel wiring exist in this
+ * package — see Modules\Core\Customer\Services\CustomerAccountService's
+ * own docblock for why this branch stops at services); a consuming app
+ * adds this to its `web` middleware group (after `auth`) to actually get
+ * "logout everywhere" enforcement.
+ *
+ * A request with no recorded UserSession at all (see
+ * UserSessionService::currentSession()'s own docblock) is let through —
+ * only an EXPLICITLY revoked session is rejected.
+ */
+class EnsureSessionNotRevoked
+{
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $session = $this->sessions->currentSession();
+
+        if ($session && $session->isRevoked()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            abort(401, 'Your session has been revoked. Please log in again.');
+        }
+
+        $session?->update(['last_used_at' => now()]);
+
+        return $next($request);
+    }
+}

src/Auth/Models/UserSession.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Auth\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * One row per login (see Modules\Core\Auth\Services\UserOtpService::
+ * validate()) — see that table's own migration docblock for why this
+ * exists independent of the actual session-store driver.
+ */
+class UserSession extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'last_used_at' => 'datetime',
+        'revoked_at' => 'datetime',
+    ];
+
+    public function user(): BelongsTo
+    {
+        $model = config('auth.providers.users.model');
+
+        return $this->belongsTo($model);
+    }
+
+    public function isRevoked(): bool
+    {
+        return $this->revoked_at !== null;
+    }
+}

src/Auth/Privacy/UserSessionDataProvider.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Auth\Privacy;
+
+use Modules\Core\Auth\Models\UserSession;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Login-session device/location metadata (user_sessions) — ip_address and
+ * user_agent are device/location fingerprinting data tied 1:1 to a User via
+ * user_id, never to a Customer (business account), so this is User-scope
+ * only. No legal retention requirement applies to session metadata the way
+ * it does to Order (there's no tax/accounting reason to keep old login IPs
+ * around), so rows are deleted outright rather than pseudonymized.
+ *
+ * A hard delete here is safe regardless of whether the User row itself has
+ * already been erased — CustomerDataProvider::eraseForUser() nulls the
+ * User's own name/email but never touches user_sessions, and the table's
+ * own user_id FK is cascadeOnDelete() only if the User row itself were
+ * hard-deleted, which it never is (erasure here means "identity nulled,"
+ * not "row removed" — see docs/modules.md "Customer/User Pairing").
+ */
+class UserSessionDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'sessions';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('sessions', []);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        $sessions = UserSession::where('user_id', $subject->userId)->get();
+
+        return new ProviderExportResult('sessions', $sessions->map(fn (UserSession $session) => [
+            'id' => $session->id,
+            'ip_address' => $session->ip_address,
+            'user_agent' => $session->user_agent,
+            'last_used_at' => $session->last_used_at?->toIso8601String(),
+            'revoked_at' => $session->revoked_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'Login sessions belong to individual Users, not Customer accounts.');
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        $deleted = UserSession::where('user_id', $subject->userId)->delete();
+
+        if ($deleted === 0) {
+            return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'No login sessions for this user.');
+        }
+
+        return new ProviderErasureResult('sessions', ErasureOutcome::Erased);
+    }
+}

src/Auth/Services/UserOtpService.php

@@ -2,16 +2,76 @@
 
 namespace Modules\Core\Auth\Services;
 
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
 use Modules\Core\Auth\Mail\UserOtpMail;
 
+/**
+ * The storefront's passwordless login — a shopper supplies only an email
+ * (Shopify-style), gets a 6-digit code, and validate() authenticates the
+ * `web` guard via Auth::login().
+ *
+ * That alone is enough to merge/associate any active guest cart into the
+ * now-known customer — Auth::login() fires Illuminate\Auth\Events\Login,
+ * which Lunar's own Lunar\Listeners\CartSessionAuthListener (registered
+ * unconditionally in LunarServiceProvider::boot(), no opt-in needed)
+ * already listens to, calling CartSession::associate() with
+ * config('lunar.cart.auth_policy') — 'merge' by default, 'override' if a
+ * consumer changes that config. Deliberately no cart-association call
+ * here: doing our own on top would run a SECOND merge attempt with a
+ * hardcoded policy that ignores whatever the consumer configured.
+ *
+ * generateAndSend()'s find-or-create already triggers the full
+ * Customer/User pairing cascade for a genuinely new email — see
+ * Modules\Core\Auth\Events\UserCreated's own docblock and
+ * Modules\Core\Customer\Listeners\CreateCustomerForUser.
+ *
+ * Two independent throttles, both configured under core.auth.otp — see
+ * config/core.php's own comment for why they're separate: max_attempts
+ * caps wrong guesses against ONE code; generation_limit caps how often a
+ * NEW code can be requested for the same email at all (closes both the
+ * "regenerate to reset my guess count" loophole and mail-bombing one
+ * inbox).
+ *
+ * validate() also records a UserSessionService entry for the new login —
+ * see that class's own docblock for the "logout everywhere" registry
+ * this feeds (Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked
+ * is the enforcement half; a consuming app must add it to its own
+ * middleware stack). $request is optional purely so this service stays
+ * callable from a context with no HTTP request at all (a console
+ * command, a test) — user-agent/ip are simply not recorded when omitted.
+ */
 class UserOtpService
 {
     private const EXPIRY_MINUTES = 10;
     private const CODE_LENGTH = 6;
 
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    /**
+     * @throws OtpThrottledException if this email has requested too many
+     *   codes within core.auth.otp.generation_decay_minutes
+     */
     public function generateAndSend(string $email): bool
     {
+        $limiterKey = $this->generationLimiterKey($email);
+        $maxGenerations = (int) config('core.auth.otp.generation_limit', 3);
+
+        if (RateLimiter::tooManyAttempts($limiterKey, $maxGenerations)) {
+            throw new OtpThrottledException(RateLimiter::availableIn($limiterKey));
+        }
+
+        RateLimiter::hit($limiterKey, (int) config('core.auth.otp.generation_decay_minutes', 10) * 60);
+
         $model = config('auth.providers.users.model');
         $user = $model::firstOrCreate(['email' => $email]);
 
@@ -19,6 +79,7 @@ class UserOtpService
 
         $user->otp_code = $code;
         $user->otp_expires_at = now()->addMinutes(self::EXPIRY_MINUTES);
+        $user->otp_attempts = 0;
         $user->save();
 
         Mail::to($user->email)->send(new UserOtpMail($user->name ?? $user->email, $code));
@@ -26,23 +87,70 @@ class UserOtpService
         return true;
     }
 
-    public function validate(string $email, string $code)
+    /**
+     * A wrong code counts against core.auth.otp.max_attempts and, once
+     * reached, invalidates the code entirely — the shopper must request
+     * a fresh one via generateAndSend() (itself throttled independently
+     * — see this class's own docblock) rather than being able to keep
+     * guessing against a still-live code for the rest of its 10-minute
+     * expiry window.
+     */
+    public function validate(string $email, string $code, ?Request $request = null): ?Authenticatable
     {
         $model = config('auth.providers.users.model');
-        $user = $model::where('email', $email)->first();
 
-        if (! $user) {
+        // lockForUpdate() + a transaction make the read-check-increment-save
+        // below atomic across concurrent requests for the same user — without
+        // it, two guesses fired in parallel can each read the same
+        // pre-increment otp_attempts value and both save past
+        // max_attempts, letting an attacker exceed the lockout by
+        // parallelizing requests instead of sending them serially.
+        $result = DB::transaction(function () use ($model, $email, $code) {
+            $user = $model::where('email', $email)->lockForUpdate()->first();
+
+            if (! $user || ! $user->otp_expires_at || now()->isAfter($user->otp_expires_at)) {
+                return null;
+            }
+
+            if (! hash_equals((string) $user->otp_code, $code)) {
+                $user->otp_attempts++;
+
+                if ($user->otp_attempts >= (int) config('core.auth.otp.max_attempts', 5)) {
+                    $user->otp_code = null;
+                    $user->otp_expires_at = null;
+                    $user->otp_attempts = 0;
+                }
+
+                $user->save();
+
+                return null;
+            }
+
+            $user->otp_code = null;
+            $user->otp_expires_at = null;
+            $user->otp_attempts = 0;
+            $user->save();
+
+            return $user;
+        });
+
+        if (! $result) {
             return null;
         }
 
-        if (! $user->otp_expires_at || $user->otp_code != $code || now()->isAfter($user->otp_expires_at)) {
-            return null;
-        }
+        RateLimiter::clear($this->generationLimiterKey($email));
 
-        $user->otp_code = null;
-        $user->otp_expires_at = null;
-        $user->save();
+        Auth::login($result);
 
-        return $user;
+        $this->sessions->record($result, $request);
+
+        Event::dispatch(new UserAuthenticated($result));
+
+        return $result;
+    }
+
+    private function generationLimiterKey(string $email): string
+    {
+        return 'otp-generate:'.strtolower($email);
     }
 }

src/Auth/Services/UserSessionService.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Modules\Core\Auth\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Modules\Core\Auth\Models\UserSession;
+
+/**
+ * The record/revoke half of the session registry — see
+ * database/migrations/2026_09_15_000001_create_user_sessions_table.php's
+ * own docblock for why this exists (SESSION_DRIVER=redis in this app has
+ * no "sessions" table to purge by user_id). The enforcement half is
+ * Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked, which reads
+ * the token this class stamps into the session payload.
+ */
+class UserSessionService
+{
+    private const SESSION_TOKEN_KEY = 'user_session_token';
+
+    /**
+     * Called once, right after Auth::login() succeeds (see
+     * UserOtpService::validate()) — generates a fresh token, records it,
+     * and stamps it into the CURRENT session payload so
+     * EnsureSessionNotRevoked can look it up on later requests.
+     */
+    public function record(Authenticatable $user, ?Request $request = null): UserSession
+    {
+        $token = Str::random(64);
+
+        $session = UserSession::create([
+            'user_id' => $user->getAuthIdentifier(),
+            'token' => $token,
+            'user_agent' => $request?->userAgent(),
+            'ip_address' => $request?->ip(),
+            'last_used_at' => now(),
+        ]);
+
+        session([self::SESSION_TOKEN_KEY => $token]);
+
+        return $session;
+    }
+
+    /**
+     * Revokes every OTHER active session for $user — the current one
+     * (matched by the token in the CURRENT session payload) is left
+     * alone, matching Laravel's own logoutOtherDevices() semantics
+     * (there just isn't a password to re-verify against here — this is a
+     * passwordless account, so revocation is simply "every row that
+     * isn't the one making this request").
+     *
+     * Known, deliberately accepted gap: this requires only a currently
+     * valid session, not a freshly-completed login — so anyone holding
+     * an already-authenticated session (e.g. someone who sits down at an
+     * account left logged in on a shared/public PC) can use this to
+     * evict the real owner's OTHER sessions just as easily as the real
+     * owner could use it to evict an intruder's. A stricter version would
+     * require a fresh OTP re-verification (e.g. within the last few
+     * minutes) before allowing this call. Left as-is for now — revisit if
+     * this turns out to matter in practice, rather than building
+     * abuse-resistance against a threat model nobody's confirmed is real
+     * for this storefront.
+     */
+    public function revokeOtherSessions(Authenticatable $user): int
+    {
+        $currentToken = session(self::SESSION_TOKEN_KEY);
+
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->when($currentToken, fn ($query) => $query->where('token', '!=', $currentToken))
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * Revokes EVERY session for $user, current one included — for a
+     * "this account may be compromised" response, not a routine logout.
+     */
+    public function revokeAllSessions(Authenticatable $user): int
+    {
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * @return UserSession|null null if the CURRENT session has no
+     *   recorded token at all (e.g. a session predating this feature, or
+     *   one Auth::login() established outside UserOtpService) — treated
+     *   as valid by EnsureSessionNotRevoked rather than rejected, since
+     *   there's nothing to have been revoked.
+     */
+    public function currentSession(): ?UserSession
+    {
+        $token = session(self::SESSION_TOKEN_KEY);
+
+        if (! $token) {
+            return null;
+        }
+
+        return UserSession::where('token', $token)->first();
+    }
+}

src/Cart/Privacy/CartDataProvider.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Modules\Core\Cart\Privacy;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartAddress;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Carts and cart addresses (lunar_carts, lunar_cart_addresses) belong to the
+ * Customer (business account) via customer_id, not to an individual User, so this
+ * is Customer-scope only. Unlike Order/OrderAddress, an abandoned cart has no
+ * legal retention requirement, so its addresses are freely deleted. The Cart row
+ * itself is left alone (any completed order it produced is handled separately by
+ * OrderDataProvider, which is what retention law actually cares about) — only its
+ * address PII is removed.
+ *
+ * Also covers Cart.meta's own PII-adjacent keys — Modules\Core\Checkout\Services\
+ * CheckoutService::setRecoveryConsent()/selectPaymentMethod() write
+ * recovery_consent/recovery_consent_at/recovery_consent_policy_version and
+ * payment_method/checkout_fingerprint directly onto this same Cart row, which the
+ * address-only erase above never touched. Kept Customer-scope, consistent with
+ * how Cart itself is already classified — see docs/privacy.md for the
+ * User-vs-Customer discussion this raised.
+ */
+class CartDataProvider implements PersonalDataProvider
+{
+    private const META_KEYS = [
+        'recovery_consent',
+        'recovery_consent_at',
+        'recovery_consent_policy_version',
+        'payment_method',
+        'checkout_fingerprint',
+    ];
+
+    public function name(): string
+    {
+        return 'carts';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        $addresses = CartAddress::whereIn('cart_id', $carts->pluck('id'))->get();
+
+        return new ProviderExportResult('carts', [
+            'addresses' => $addresses->map(fn (CartAddress $address) => [
+                'type' => $address->type,
+                'first_name' => $address->first_name,
+                'last_name' => $address->last_name,
+                'line_one' => $address->line_one,
+                'city' => $address->city,
+                'postcode' => $address->postcode,
+                'contact_email' => $address->contact_email,
+                'contact_phone' => $address->contact_phone,
+            ])->all(),
+            'carts' => $carts->map(fn (Cart $cart) => [
+                'id' => $cart->id,
+                'meta' => $this->metaOnly($cart),
+            ])->all(),
+        ]);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('carts', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        CartAddress::whereIn('cart_id', $carts->pluck('id'))->delete();
+
+        foreach ($carts as $cart) {
+            $meta = (array) $cart->meta;
+
+            foreach (self::META_KEYS as $key) {
+                unset($meta[$key]);
+            }
+
+            $cart->update(['meta' => $meta]);
+        }
+
+        return new ProviderErasureResult('carts', ErasureOutcome::Erased);
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('carts', ErasureOutcome::Skipped, 'Carts belong to Customer accounts, not individual users.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function metaOnly(Cart $cart): array
+    {
+        $meta = (array) $cart->meta;
+
+        return array_intersect_key($meta, array_flip(self::META_KEYS));
+    }
+}

src/Command/BackfillMissingSkusCommand.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Lunar\Models\ProductVariant;
+
+/**
+ * One-off backfill for variants the Shopify import left with a blank SKU —
+ * not an importer bug, the source CSV rows genuinely had no `Variant SKU`
+ * value (see Modules\MigrateImport\Shopify\ShopifyExportImporter) — so
+ * this synthesizes one instead of re-running the import. Format is
+ * "SKU-P{product_id}-V{variant_id}": deterministic and guaranteed unique
+ * without a uniqueness check, since product_id/variant_id already are.
+ * Only variants with a null `sku` are touched.
+ */
+class BackfillMissingSkusCommand extends Command
+{
+    protected $signature = 'boboko:catalog:backfill-skus {--dry-run : List what would change without writing}';
+
+    protected $description = 'Generate a SKU for every product variant that is missing one';
+
+    public function handle(): void
+    {
+        $dryRun = (bool) $this->option('dry-run');
+
+        $query = ProductVariant::query()->whereNull('sku');
+        $total = $query->count();
+
+        if ($total === 0) {
+            $this->info('No variants are missing a SKU.');
+
+            return;
+        }
+
+        $this->info(($dryRun ? '[dry-run] ' : '') . "Backfilling SKUs for {$total} variant(s)...");
+
+        $bar = $this->output->createProgressBar($total);
+        $bar->start();
+
+        $query->chunkById(500, function ($variants) use ($dryRun, $bar) {
+            foreach ($variants as $variant) {
+                $sku = "SKU-P{$variant->product_id}-V{$variant->id}";
+
+                if ($dryRun) {
+                    $this->newLine();
+                    $this->line("Variant {$variant->id}: sku => {$sku}");
+                } else {
+                    $variant->update(['sku' => $sku]);
+                }
+
+                $bar->advance();
+            }
+        });
+
+        $bar->finish();
+        $this->newLine();
+        $this->info($dryRun ? 'Dry run complete — no changes were written.' : 'Done.');
+    }
+}

src/Command/InstallLunarCommand.php

@@ -66,6 +66,16 @@ class InstallLunarCommand extends Command
                 ]);
             }
 
+            if (! Language::where('code', 'el')->exists()) {
+                $this->components->info('Adding Greek language');
+
+                Language::create([
+                    'code' => 'el',
+                    'name' => 'Greek',
+                    'default' => false,
+                ]);
+            }
+
             if (! Currency::whereDefault(true)->exists()) {
                 $this->components->info('Adding a default currency (USD)');
 
@@ -310,7 +320,10 @@ class InstallLunarCommand extends Command
 
         PaymentMethod::create([
             'type' => 'cash-on-delivery',
-            'name' => 'Cash on Delivery',
+            'name' => [
+                'en' => 'Cash on Delivery',
+                'el' => 'Αντικαταβολή',
+            ],
             'driver' => 'cash-on-delivery',
             'capture_mode' => 'pay',
             'position' => 0,

src/Command/ProcessErasureRequestsCommand.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Jobs\EraseDataSubjectJob;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+
+/**
+ * Finds every erasure request whose grace period (config('core.privacy.
+ * grace_period_days')) has passed and dispatches one EraseDataSubjectJob per
+ * request — see docs/privacy.md. This command itself just finds due requests and
+ * dispatches; the actual erasure work happens in the queue, one job per request,
+ * so one failing request doesn't block the others. Meant to run daily via the
+ * scheduler; each consuming app wires that in its own Console\Kernel (or
+ * bootstrap/app.php schedule closure on Laravel 11+), the same way it owns any
+ * other scheduled task — this package doesn't register schedules itself.
+ */
+class ProcessErasureRequestsCommand extends Command
+{
+    protected $signature = 'boboko:privacy:process-erasure-requests';
+
+    protected $description = 'Dispatch an erasure job for every pending data-erasure request whose grace period has passed';
+
+    public function handle(): void
+    {
+        $due = DataErasureRequest::where('status', ErasureRequestStatus::Pending)
+            ->where('scheduled_for', '<=', now())
+            ->get();
+
+        if ($due->isEmpty()) {
+            $this->info('No due erasure requests.');
+
+            return;
+        }
+
+        foreach ($due as $request) {
+            EraseDataSubjectJob::dispatch($request);
+
+            $scope = $request->isForCustomer() ? 'customer' : 'user';
+            $this->info("Dispatched erasure job for {$scope} #{$request->subject_id} (request #{$request->id})");
+        }
+
+        $this->info('Dispatched '.$due->count().' erasure job(s).');
+    }
+}

src/CorePlugin.php

@@ -7,7 +7,11 @@ use Lunar\Admin\Filament\Resources\OrderResource\Pages\Components\OrderItemsTabl
 use Filament\Contracts\Plugin;
 use Filament\Panel;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
 use Illuminate\Support\Facades\Mail;
+use Lunar\Admin\Filament\Resources\CustomerResource;
+use Lunar\Admin\Filament\Resources\CustomerResource\Pages\EditCustomer;
+use Lunar\Admin\Filament\Resources\CustomerResource\Pages\ViewCustomer;
 use Lunar\Admin\Filament\Resources\ProductOptionResource;
 use Lunar\Admin\Filament\Resources\ProductOptionResource\RelationManagers\ValuesRelationManager;
 use Lunar\Admin\Filament\Resources\OrderResource;
@@ -15,6 +19,7 @@ use Lunar\Admin\Filament\Resources\ProductResource;
 use Lunar\Admin\Filament\Resources\StaffResource;
 use Lunar\Admin\Models\Staff as LunarStaff;
 use Lunar\Admin\Support\Facades\LunarPanel;
+use Lunar\Models\Customer;
 use Lunar\Models\Product;
 use Lunar\Shipping\Filament\Resources\ShippingMethodResource;
 use Lunar\Shipping\Filament\Resources\ShippingMethodResource\Pages\ListShippingMethod;
@@ -28,9 +33,15 @@ use Modules\Core\Catalog\Filament\Extensions\ValuesRelationManagerExtension;
 use Modules\Core\Localization\Filament\Resources\LanguageLineResource;
 use Modules\Core\Order\Filament\Extensions\OrderItemsTableExtension;
 use Modules\Core\Order\Filament\Extensions\OrderPaymentMethodSummaryExtension;
-use Modules\Core\Order\Filament\Extensions\OrderRefundActionsExtension;
+use Modules\Core\Order\Filament\Extensions\OrderActionsExtension;
 use Modules\Core\Order\Filament\Extensions\OrderTransactionsExtension;
 use Modules\Core\Payment\Filament\Resources\PaymentMethodResource;
+use Modules\Core\Privacy\Filament\Extensions\CustomerErasureActionsExtension;
+use Modules\Core\Privacy\Filament\Extensions\CustomerErasureRelationsExtension;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Models\DataExportRequest;
 use Modules\Core\Review\Filament\Extensions\ProductResourceExtension;
 use Modules\Core\Review\Models\ProductReview;
 use Modules\Core\Shipping\Extensions\OrderShipmentsExtension;
@@ -56,6 +67,8 @@ class CorePlugin implements Plugin
             ->login(Login::class)
             ->resources([
                 LanguageLineResource::class,
+                DataErasureRequestResource::class,
+                DataExportRequestResource::class,
                 CartResource::class,
                 PaymentMethodResource::class,
                 ShipmentResource::class,
@@ -70,13 +83,66 @@ class CorePlugin implements Plugin
             ValuesRelationManager::class => ValuesRelationManagerExtension::class,
             ShippingMethodResource::class => ShippingMethodResourceExtension::class,
             ListShippingMethod::class => ShippingMethodListExtension::class,
-            ManageOrder::class => [OrderViewExtension::class, OrderRefundActionsExtension::class, OrderTransactionsExtension::class, OrderPaymentMethodSummaryExtension::class, OrderShipmentsExtension::class],
+            ManageOrder::class => [OrderViewExtension::class, OrderActionsExtension::class, OrderTransactionsExtension::class, OrderPaymentMethodSummaryExtension::class, OrderShipmentsExtension::class],
             OrderItemsTable::class => OrderItemsTableExtension::class,
+            // headerActions() is resolved per PAGE class, not per resource class —
+            // unlike extendForm()/extendTable(), which really are resource-keyed
+            // (called statically from the Resource class itself). Registering this
+            // under CustomerResource::class would silently never fire; it has to be
+            // keyed by each concrete page it should appear on. Layered with
+            // whatever extension the consuming app registers for the same page —
+            // LunarPanel::extensions() merges per key, and this one only touches
+            // headerActions(), so it never conflicts with an app's own extension
+            // (see docs/modules.md "Layering Module and App Configuration").
+            EditCustomer::class => CustomerErasureActionsExtension::class,
+            ViewCustomer::class => CustomerErasureActionsExtension::class,
+            // getRelations(), unlike headerActions(), genuinely is resolved
+            // statically from the Resource class itself — CustomerResource::class
+            // is the correct key here.
+            CustomerResource::class => CustomerErasureRelationsExtension::class,
         ]);
 
-        Product::macro('reviews', function (): HasMany {
-            /** @var Product $this */
-            return $this->hasMany(ProductReview::class);
+        // resolveRelationUsing(), not macro() — Illuminate\Database\Eloquent\
+        // Model does not use the Macroable trait in this Laravel version, so
+        // Product::macro(...)/Customer::macro(...)/$userModel::macro(...)
+        // silently fall through to Model::__callStatic(), which instantiates
+        // the model and tries to call the method as a real one, hitting
+        // newQuery()->getConnection() — this crashes every console command
+        // and every request, since CorePlugin::register() runs during
+        // provider registration, before the DB connection is configured
+        // ("Call to a member function connection() on null"). This bit us
+        // once already; resolveRelationUsing() is Eloquent's real, intended,
+        // connection-free extension point for exactly this (Order::
+        // resolveRelationUsing('shipments', ...) in ShippingServiceProvider
+        // already uses it correctly).
+        Product::resolveRelationUsing('reviews', function (Product $product): HasMany {
+            return $product->hasMany(ProductReview::class);
+        });
+
+        // Customer::erasureRequests()/exportRequests() and the User-model
+        // equivalents below let a relation manager scope
+        // DataErasureRequest/DataExportRequest to one specific subject — both
+        // tables use a plain subject_type/subject_id pair rather than Laravel's
+        // usual morphs() convention, since one column pair identifies either a
+        // Customer or a User (see docs/privacy.md "User-scope vs Customer-scope"),
+        // so this is a MorphMany built by hand rather than a bare Eloquent
+        // convention lookup.
+        Customer::resolveRelationUsing('erasureRequests', function (Customer $customer): MorphMany {
+            return $customer->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
+        });
+
+        Customer::resolveRelationUsing('exportRequests', function (Customer $customer): MorphMany {
+            return $customer->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
+        });
+
+        $userModel = config('auth.providers.users.model');
+
+        $userModel::resolveRelationUsing('erasureRequests', function ($user): MorphMany {
+            return $user->morphMany(DataErasureRequest::class, 'subject', 'subject_type', 'subject_id');
+        });
+
+        $userModel::resolveRelationUsing('exportRequests', function ($user): MorphMany {
+            return $user->morphMany(DataExportRequest::class, 'subject', 'subject_type', 'subject_id');
         });
 
         LunarStaff::addActivitylogExcept([

src/Customer/Events/CustomerAddressCreated.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Models\Address;
+
+/**
+ * Dispatched by Modules\Core\Customer\Services\CustomerAccountService::
+ * createAddress(). $causer is carried explicitly (unlike e.g.
+ * Modules\Core\Payment\Events\PaymentMethodCreated, which is always
+ * staff-caused implicitly) because this write happens on the `web`
+ * guard, not `staff` — a listener logging this needs to know who to
+ * attribute it to without guessing a guard.
+ */
+class CustomerAddressCreated
+{
+    public function __construct(
+        public readonly Address $address,
+        public readonly Authenticatable $causer,
+    ) {}
+}

src/Customer/Events/CustomerAddressDeleted.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+
+class CustomerAddressDeleted
+{
+    /**
+     * @param  array<string, mixed>  $address  Snapshot of the deleted
+     *   row — already gone from the database by dispatch time.
+     */
+    public function __construct(
+        public readonly array $address,
+        public readonly Authenticatable $causer,
+    ) {}
+}

src/Customer/Events/CustomerAddressUpdated.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Models\Address;
+
+class CustomerAddressUpdated
+{
+    /**
+     * @param  array<string, mixed>  $old  Snapshot of the changed
+     *   attributes before the update.
+     */
+    public function __construct(
+        public readonly Address $address,
+        public readonly array $old,
+        public readonly Authenticatable $causer,
+    ) {}
+}

src/Customer/Events/CustomerProfileUpdated.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Modules\Core\Customer\Models\Customer;
+
+class CustomerProfileUpdated
+{
+    /**
+     * @param  array<string, mixed>  $old  Snapshot of the changed
+     *   attributes before the update.
+     */
+    public function __construct(
+        public readonly Customer $customer,
+        public readonly array $old,
+        public readonly Authenticatable $causer,
+    ) {}
+}

src/Customer/Exceptions/AddressNotFoundException.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Customer\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Customer\Services\CustomerAccountService when an
+ * address id doesn't belong to the customer making the request — never
+ * a plain 404/ModelNotFoundException, so a storefront can't probe for
+ * another customer's address ids by trying sequential ones and reading
+ * the response shape.
+ */
+class AddressNotFoundException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('Address not found.');
+    }
+}

src/Customer/Exceptions/OrderNotFoundException.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Customer\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Customer\Services\CustomerAccountService when an
+ * order id doesn't belong to the customer making the request (or isn't
+ * placed yet) — never a plain 404/ModelNotFoundException, so a
+ * storefront can't probe for another customer's order ids.
+ */
+class OrderNotFoundException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('Order not found.');
+    }
+}

src/Customer/Listeners/LogCustomerAccountActivity.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Modules\Core\Customer\Listeners;
+
+use Lunar\Models\Address;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
+use Modules\Core\Logging\ActivityLogService;
+
+/**
+ * Same pattern as Payment\Listeners\LogPaymentMethodActivity — routes
+ * Modules\Core\Customer\Services\CustomerAccountService's own events
+ * through the shared Logging\ActivityLogService, giving every
+ * shopper-initiated address/profile change an audit trail (previously
+ * none existed at all for account self-service writes). $causer is
+ * passed through explicitly on every call, since these events are
+ * `web`-guard-caused, not `staff`-guard — see ActivityLogService's own
+ * docblock for why that parameter exists.
+ */
+class LogCustomerAccountActivity
+{
+    public function __construct(
+        private readonly ActivityLogService $activityLog,
+    ) {}
+
+    public function handleAddressCreated(CustomerAddressCreated $event): void
+    {
+        $this->activityLog->created($event->address, $event->address->getAttributes(), $event->causer);
+    }
+
+    public function handleAddressUpdated(CustomerAddressUpdated $event): void
+    {
+        $this->activityLog->updated(
+            $event->address,
+            $event->old,
+            $event->address->only(array_keys($event->old)),
+            $event->causer,
+        );
+    }
+
+    public function handleAddressDeleted(CustomerAddressDeleted $event): void
+    {
+        $subject = (new Address)->forceFill($event->address);
+        $subject->exists = true;
+        $subject->id = $event->address['id'];
+
+        $this->activityLog->deleted($subject, $event->address, $event->causer);
+    }
+
+    public function handleProfileUpdated(CustomerProfileUpdated $event): void
+    {
+        $this->activityLog->updated(
+            $event->customer,
+            $event->old,
+            $event->customer->only(array_keys($event->old)),
+            $event->causer,
+        );
+    }
+}

src/Customer/Privacy/AddressDataProvider.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Modules\Core\Customer\Privacy;
+
+use Lunar\Models\Address;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * A customer's saved addresses (lunar_addresses) — belong to the Customer
+ * (business account) via customer_id, not to an individual User, so this is
+ * Customer-scope only. No legal retention requirement of their own (unlike
+ * OrderAddress, handled by OrderDataProvider), so they're freely deleted outright
+ * rather than pseudonymized in place.
+ */
+class AddressDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'addresses';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $addresses = Address::where('customer_id', $subject->customerId)->get();
+
+        return new ProviderExportResult('addresses', $addresses->map(fn (Address $address) => [
+            'id' => $address->id,
+            'first_name' => $address->first_name,
+            'last_name' => $address->last_name,
+            'company_name' => $address->company_name,
+            'line_one' => $address->line_one,
+            'line_two' => $address->line_two,
+            'line_three' => $address->line_three,
+            'city' => $address->city,
+            'state' => $address->state,
+            'postcode' => $address->postcode,
+            'contact_email' => $address->contact_email,
+            'contact_phone' => $address->contact_phone,
+        ])->all());
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('addresses', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        Address::where('customer_id', $subject->customerId)->delete();
+
+        return new ProviderErasureResult('addresses', ErasureOutcome::Erased);
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('addresses', ErasureOutcome::Skipped, 'Addresses belong to Customer accounts, not individual users.');
+    }
+}

src/Customer/Privacy/CustomerDataProvider.php

@@ -0,0 +1,122 @@
+<?php
+
+namespace Modules\Core\Customer\Privacy;
+
+use Lunar\Models\Customer;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * The Customer record itself (lunar_customers) and, on the User side, the User's
+ * own name/email. This is the one provider that implements both scopes
+ * meaningfully, and they are deliberately kept from touching each other's data:
+ *
+ *   - eraseForCustomer() clears the account's own fields (name, company, tax id)
+ *     only — it never touches any linked User's login or identity, even though
+ *     $customer->users exists. Erasing a business account must not destroy the
+ *     login access of every person who works there.
+ *   - eraseForUser() clears that one person's name/email only — it never touches
+ *     the Customer record's own fields, and it also detaches the User from every
+ *     Customer they're linked to (the customer_user pivot — see docs/modules.md
+ *     "Customer/User Pairing"), since erasing a person's identity should end
+ *     their membership everywhere, without erasing the business accounts
+ *     themselves or any other User still linked to them.
+ *
+ * No legal retention requirement applies to this table on its own, so both
+ * directions are freely erased — Order/OrderAddress, which DO have a retention
+ * requirement, are handled separately by OrderDataProvider.
+ */
+class CustomerDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'customer';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $customer = Customer::find($subject->customerId);
+
+        return new ProviderExportResult('customer', $customer ? [
+            'id' => $customer->id,
+            'title' => $customer->title,
+            'first_name' => $customer->first_name,
+            'last_name' => $customer->last_name,
+            'company_name' => $customer->company_name,
+            'tax_identifier' => $customer->tax_identifier,
+            'meta' => $customer->meta,
+            'users' => $customer->users->map(fn ($user) => [
+                'id' => $user->id,
+                'name' => $user->name,
+                'email' => $user->email,
+            ])->all(),
+        ] : []);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        $model = config('auth.providers.users.model');
+        $user = $model::find($subject->userId);
+
+        return new ProviderExportResult('customer', $user ? [
+            'id' => $user->id,
+            'name' => $user->name,
+            'email' => $user->email,
+            'customers' => $user->customers->map(fn (Customer $customer) => [
+                'id' => $customer->id,
+                'company_name' => $customer->company_name,
+            ])->all(),
+        ] : []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $customer = Customer::find($subject->customerId);
+
+        if (! $customer) {
+            return new ProviderErasureResult('customer', ErasureOutcome::Skipped, 'Customer record not found.');
+        }
+
+        $customer->update([
+            'title' => null,
+            'first_name' => 'Erased',
+            'last_name' => "Customer #{$customer->id}",
+            'company_name' => null,
+            'tax_identifier' => null,
+            'account_ref' => null,
+            'meta' => null,
+        ]);
+
+        return new ProviderErasureResult('customer', ErasureOutcome::Erased);
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        $model = config('auth.providers.users.model');
+        $user = $model::find($subject->userId);
+
+        if (! $user) {
+            return new ProviderErasureResult('customer', ErasureOutcome::Skipped, 'User record not found.');
+        }
+
+        $user->customers()->detach();
+
+        $user->update([
+            'name' => null,
+            'email' => "erased-user-{$user->id}@example.invalid",
+            // A live OTP code left on an otherwise-erased row is a residual
+            // secret tied to an identity that no longer exists here — clear
+            // it alongside name/email rather than leaving it to expire on
+            // its own 10-minute window.
+            'otp_code' => null,
+            'otp_expires_at' => null,
+            'otp_attempts' => 0,
+        ]);
+
+        return new ProviderErasureResult('customer', ErasureOutcome::Erased);
+    }
+}

src/Customer/Services/CustomerAccountService.php

@@ -0,0 +1,255 @@
+<?php
+
+namespace Modules\Core\Customer\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Event;
+use Lunar\Models\Address;
+use Lunar\Models\Order;
+use LogicException;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
+use Modules\Core\Customer\Exceptions\AddressNotFoundException;
+use Modules\Core\Customer\Exceptions\OrderNotFoundException;
+use Modules\Core\Customer\Models\Customer;
+
+/**
+ * The storefront-facing "My Account" API — mirrors Modules\Core\Cart\
+ * Services\CartService's shape, one boboko-owned service a storefront
+ * calls, so Lunar's own Customer/Order/Address models stay an
+ * implementation detail. Every method is scoped to the given
+ * Authenticatable's own Customer::latestCustomer() (see docs/modules.md
+ * "Customer/User Pairing") — there is no method here that accepts a bare
+ * order/address id without also requiring the owning user, precisely so
+ * a controller built on top of this can't accidentally leak one
+ * customer's data to another by trusting a client-supplied id alone.
+ *
+ * $user->latestCustomer() can be null for a User that has no paired
+ * Customer yet (shouldn't happen via the normal OTP-login cascade — see
+ * Modules\Core\Auth\Events\UserCreated — but is defended against anyway,
+ * since nothing stops a User row existing without one, e.g. seeded data)
+ * — every method returns an empty/null result rather than throwing in
+ * that case, since "no customer paired yet" isn't a not-found error, it's
+ * a legitimately empty account.
+ *
+ * Address/profile writes go through an explicit column allowlist
+ * (WRITABLE_ADDRESS_FIELDS/WRITABLE_PROFILE_FIELDS) rather than trusting
+ * Lunar\Models\Address/Customer's own $guarded = [] — that flag makes
+ * every column mass-assignable at the model layer, including
+ * customer_id on addresses, so a caller passing through an unfiltered
+ * request array (a real risk for a storefront controller built directly
+ * against this service) could otherwise reassign an address to a
+ * different customer entirely, or overwrite created_at/id. Arr::only()
+ * silently drops anything not on the allowlist rather than erroring —
+ * this is a safety boundary, not form validation (a storefront still
+ * validates its own request shape before calling this).
+ *
+ * Authorization here IS the ownership scoping itself, not a separate
+ * layer bolted on top — there is deliberately no Laravel Policy/Gate
+ * class for Order/Address, since a policy is meaningless without a
+ * controller calling authorize() against it, and this branch is scoped
+ * to backend services only (no routes/controllers — see the branch's own
+ * commit history). Every public method below takes Authenticatable $user
+ * as a required first argument and resolves everything else (Order,
+ * Address, Customer) strictly through that user's own
+ * latestCustomer() — there is no method that looks anything up by a bare
+ * id alone. A future storefront controller cannot "forget" the
+ * authorization check the way it could with a separate policy class,
+ * because the check IS how every lookup happens; skipping it isn't an
+ * option the method signatures allow.
+ */
+class CustomerAccountService
+{
+    private const WRITABLE_ADDRESS_FIELDS = [
+        'title', 'first_name', 'last_name', 'company_name',
+        'line_one', 'line_two', 'line_three', 'city', 'state', 'postcode',
+        'delivery_instructions', 'contact_email', 'contact_phone',
+        'country_id', 'shipping_default', 'billing_default',
+    ];
+
+    private const WRITABLE_PROFILE_FIELDS = [
+        'title', 'first_name', 'last_name', 'company_name', 'vat_no',
+    ];
+
+    public function customer(Authenticatable $user): ?Customer
+    {
+        /** @var Customer|null */
+        return $user->latestCustomer();
+    }
+
+    /**
+     * Placed orders only (placed_at IS NOT NULL) — a draft/abandoned
+     * order with no placed_at is checkout-in-progress state, not
+     * something that belongs in order history.
+     */
+    public function orders(Authenticatable $user, int $perPage = 15): LengthAwarePaginator
+    {
+        $customer = $this->customer($user);
+
+        if (! $customer) {
+            return new LengthAwarePaginator([], 0, $perPage);
+        }
+
+        return $customer->orders()
+            ->whereNotNull('placed_at')
+            ->latest('placed_at')
+            ->paginate($perPage);
+    }
+
+    /**
+     * @throws OrderNotFoundException if $orderId doesn't belong to this
+     *   customer, or belongs to a draft (never placed) order
+     */
+    public function order(Authenticatable $user, int $orderId): Order
+    {
+        $customer = $this->customer($user);
+
+        $order = $customer
+            ?->orders()
+            ->whereNotNull('placed_at')
+            ->with(['lines', 'shippingAddress', 'billingAddress', 'transactions', 'shipments'])
+            ->find($orderId);
+
+        if (! $order) {
+            throw new OrderNotFoundException;
+        }
+
+        return $order;
+    }
+
+    public function addresses(Authenticatable $user): iterable
+    {
+        $customer = $this->customer($user);
+
+        return $customer?->addresses ?? collect();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data  Any key not in
+     *   WRITABLE_ADDRESS_FIELDS is silently dropped — see this class's
+     *   own docblock.
+     */
+    public function createAddress(Authenticatable $user, array $data): Address
+    {
+        $customer = $this->customerOrFail($user);
+
+        $address = $customer->addresses()->create(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS));
+
+        $this->enforceSingleDefault($customer, $address);
+        $address->refresh();
+
+        Event::dispatch(new CustomerAddressCreated($address, $user));
+
+        return $address;
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    public function updateAddress(Authenticatable $user, int $addressId, array $data): Address
+    {
+        $address = $this->ownedAddress($user, $addressId);
+        $old = $address->only(array_keys(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS)));
+
+        $address->update(Arr::only($data, self::WRITABLE_ADDRESS_FIELDS));
+
+        $this->enforceSingleDefault($address->customer, $address);
+        $address->refresh();
+
+        Event::dispatch(new CustomerAddressUpdated($address, $old, $user));
+
+        return $address;
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    public function deleteAddress(Authenticatable $user, int $addressId): void
+    {
+        $address = $this->ownedAddress($user, $addressId);
+        $snapshot = $address->getAttributes();
+
+        $address->delete();
+
+        Event::dispatch(new CustomerAddressDeleted($snapshot, $user));
+    }
+
+    /**
+     * Lunar has no built-in action enforcing "at most one shipping
+     * default / one billing default per customer" — a raw update() could
+     * otherwise leave two addresses both flagged shipping_default. Runs
+     * after every create/update, unconditionally (cheap — at most two
+     * single-row UPDATEs, only fired when the just-written address
+     * itself is a default), clearing the flag on every OTHER address of
+     * the same customer.
+     */
+    private function enforceSingleDefault(Customer $customer, Address $address): void
+    {
+        if ($address->shipping_default) {
+            $customer->addresses()->where('id', '!=', $address->id)->update(['shipping_default' => false]);
+        }
+
+        if ($address->billing_default) {
+            $customer->addresses()->where('id', '!=', $address->id)->update(['billing_default' => false]);
+        }
+    }
+
+    /**
+     * @throws AddressNotFoundException if $addressId doesn't belong to
+     *   this customer
+     */
+    private function ownedAddress(Authenticatable $user, int $addressId): Address
+    {
+        $customer = $this->customer($user);
+
+        $address = $customer?->addresses()->find($addressId);
+
+        if (! $address) {
+            throw new AddressNotFoundException;
+        }
+
+        return $address;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data  Any key not in
+     *   WRITABLE_PROFILE_FIELDS is silently dropped — see this class's
+     *   own docblock.
+     */
+    public function updateProfile(Authenticatable $user, array $data): Customer
+    {
+        $customer = $this->customerOrFail($user);
+        $old = $customer->only(array_keys(Arr::only($data, self::WRITABLE_PROFILE_FIELDS)));
+
+        $customer->update(Arr::only($data, self::WRITABLE_PROFILE_FIELDS));
+        $customer->refresh();
+
+        Event::dispatch(new CustomerProfileUpdated($customer, $old, $user));
+
+        return $customer;
+    }
+
+    /**
+     * @throws LogicException if $user has no paired Customer at all —
+     *   distinct from AddressNotFoundException/OrderNotFoundException
+     *   (which mean "this id isn't yours"), this means the account
+     *   itself is in an invariant-violating state the normal OTP-login
+     *   cascade should never produce.
+     */
+    private function customerOrFail(Authenticatable $user): Customer
+    {
+        $customer = $this->customer($user);
+
+        if (! $customer) {
+            throw new LogicException('This user has no paired Customer record.');
+        }
+
+        return $customer;
+    }
+}

src/Export/CsvColumn.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Export;
+
+use Closure;
+
+/**
+ * One column in a CsvWriter schema: a header label plus a closure that pulls this
+ * column's value out of one record. The closure doesn't care what shape a record
+ * is — an array, an Eloquent model, a DTO — so the same CsvWriter serves any
+ * domain (GDPR export, an admin catalog export, an accounting export) by simply
+ * being handed a different column schema and a different row source.
+ */
+final class CsvColumn
+{
+    /**
+     * @param Closure(mixed):((string|int|float|null)) $value
+     */
+    public function __construct(
+        public readonly string $header,
+        public readonly Closure $value,
+    ) {}
+}

src/Export/CsvWriter.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Modules\Core\Export;
+
+/**
+ * A generic columns + rows -> CSV file writer. No knowledge of any domain (GDPR,
+ * catalog, accounting, ...) — a caller supplies the schema (CsvColumn[]) and the
+ * data source (any iterable of records), and this writes one CSV. Reusable for
+ * any future bulk-export need without modification.
+ */
+class CsvWriter
+{
+    /**
+     * @param  array<int, CsvColumn>  $columns
+     * @param  iterable<mixed>  $rows
+     */
+    public function write(array $columns, iterable $rows, string $path): void
+    {
+        $handle = fopen($path, 'w');
+
+        fputcsv($handle, array_map(fn (CsvColumn $column) => $column->header, $columns));
+
+        foreach ($rows as $row) {
+            fputcsv($handle, array_map(
+                fn (CsvColumn $column) => $this->stringify(($column->value)($row)),
+                $columns
+            ));
+        }
+
+        fclose($handle);
+    }
+
+    private function stringify(mixed $value): string
+    {
+        if ($value === null) {
+            return '';
+        }
+
+        if (is_array($value)) {
+            return json_encode($value);
+        }
+
+        return (string) $value;
+    }
+}

src/Logging/ActivityLogService.php

@@ -2,25 +2,31 @@
 
 namespace Modules\Core\Logging;
 
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * Thin wrapper around Spatie Activity Log that standardises the log channel,
- * actor (authenticated staff member), and property shape for all domain events.
+ * actor, and property shape for all domain events.
  *
  * All logs are written to the 'lunar' channel. The subject is always an
- * Eloquent model, and the actor is resolved from the 'staff' guard at call time.
+ * Eloquent model. $causer defaults to the 'staff' guard's current user —
+ * every existing caller of this class is admin-side — but can be passed
+ * explicitly for a non-staff actor (e.g. a customer editing their own
+ * address on the `web` guard — see Modules\Core\Customer\Services\
+ * CustomerAccountService, which passes the acting User rather than
+ * relying on this default resolving to null for a web-guard session).
  */
 class ActivityLogService
 {
     /**
      * Log a creation event. $attributes describes the initial state.
      */
-    public function created(Model $subject, array $attributes): void
+    public function created(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('created');
     }
@@ -28,11 +34,11 @@ class ActivityLogService
     /**
      * Log an update event. $old holds the previous values, $attributes the new ones.
      */
-    public function updated(Model $subject, array $old, array $attributes): void
+    public function updated(Model $subject, array $old, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['old' => $old, 'attributes' => $attributes])
             ->log('updated');
     }
@@ -40,11 +46,11 @@ class ActivityLogService
     /**
      * Log a failed operation. $attributes provides context (e.g. error message, service).
      */
-    public function failed(Model $subject, array $attributes): void
+    public function failed(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('failed');
     }
@@ -52,11 +58,11 @@ class ActivityLogService
     /**
      * Log a deletion event. $attributes provides context (e.g. reason, name).
      */
-    public function deleted(Model $subject, array $attributes): void
+    public function deleted(Model $subject, array $attributes, ?Authenticatable $causer = null): void
     {
         activity('lunar')
             ->performedOn($subject)
-            ->causedBy(auth('staff')->user())
+            ->causedBy($causer ?? auth('staff')->user())
             ->withProperties(['attributes' => $attributes])
             ->log('deleted');
     }

src/Logging/Privacy/ActivityLogDataProvider.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Modules\Core\Logging\Privacy;
+
+use Lunar\Models\Address;
+use Lunar\Models\Cart;
+use Lunar\Models\CartAddress;
+use Lunar\Models\Customer;
+use Lunar\Models\Order;
+use Lunar\Models\OrderAddress;
+use Lunar\Models\Transaction;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+use Spatie\Activitylog\Models\Activity;
+
+/**
+ * Spatie's own activity_log table (Modules\Core\Logging\ActivityLogService,
+ * plus several Lunar models' native `use LogsActivity` — Customer,
+ * CartAddress, OrderAddress, Transaction) durably retains a full snapshot
+ * of whatever it logged in `properties` (created/updated/deleted
+ * attributes, including a before/after diff on update), completely
+ * independent of the real row it describes. Erasing/pseudonymizing
+ * Customer/Address/CartAddress/OrderAddress/Transaction elsewhere (see
+ * Customer\Privacy\CustomerDataProvider, Customer\Privacy\
+ * AddressDataProvider, Cart\Privacy\CartDataProvider, Order\Privacy\
+ * OrderDataProvider, Payment\Privacy\PaymentDataProvider) does nothing to
+ * this table — a full copy of the old PII survives here regardless.
+ *
+ * Redacts by SUBJECT only, never by `causer_id` — the causer is "who did
+ * this," not PII content, and erasing it would erode the audit trail's own
+ * purpose (see this provider's own eraseForUser(), which is a deliberate
+ * no-op). Genuinely Customer-scope only: every subject type here
+ * (Customer, Address, CartAddress, OrderAddress, Transaction) resolves to
+ * a business account via its own chain (Address/Customer directly;
+ * CartAddress via cart_id -&gt; Cart.customer_id; OrderAddress/Transaction
+ * via order_id -&gt; Order.customer_id) — none of it is a User's own data on
+ * its own.
+ *
+ * MUST run before Customer\Privacy\AddressDataProvider in
+ * config('core.privacy.providers') — that provider hard-deletes Address
+ * rows, and once gone there is no way to re-derive which activity_log
+ * rows (subject_type = Address) belonged to this customer. This provider
+ * resolves that address id list itself, before anything deletes it.
+ */
+class ActivityLogDataProvider implements PersonalDataProvider
+{
+    private const REDACTED = '[redacted]';
+
+    public function name(): string
+    {
+        return 'activity_log';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $activities = Activity::query()
+            ->where(fn ($query) => $this->scopeToCustomer($query, $subject->customerId))
+            ->get();
+
+        return new ProviderExportResult('activity_log', $activities->map(fn (Activity $activity) => [
+            'id' => $activity->id,
+            'log_name' => $activity->log_name,
+            'description' => $activity->description,
+            'subject_type' => $activity->subject_type,
+            'subject_id' => $activity->subject_id,
+            'event' => $activity->event,
+            'properties' => $activity->properties?->toArray(),
+            'created_at' => $activity->created_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('activity_log', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $affected = Activity::query()
+            ->where(fn ($query) => $this->scopeToCustomer($query, $subject->customerId))
+            ->get();
+
+        if ($affected->isEmpty()) {
+            return new ProviderErasureResult('activity_log', ErasureOutcome::Skipped, 'No activity log entries for this customer.');
+        }
+
+        foreach ($affected as $activity) {
+            $activity->update(['properties' => $this->redact($activity->properties?->toArray() ?? [])]);
+        }
+
+        return new ProviderErasureResult(
+            'activity_log',
+            ErasureOutcome::Pseudonymized,
+            'PII-bearing properties redacted on matching audit log entries; who/what/when metadata (log_name, subject, event, timestamp, causer) retained for audit integrity.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult(
+            'activity_log',
+            ErasureOutcome::Skipped,
+            'A User only ever appears here as causer_id (who performed an action), not as the PII content of a log entry — redacting that would erode the audit trail\'s own record of who acted.'
+        );
+    }
+
+    private function scopeToCustomer($query, int $customerId): void
+    {
+        $customerMorph = (new Customer)->getMorphClass();
+        $addressMorph = (new Address)->getMorphClass();
+        $cartAddressMorph = (new CartAddress)->getMorphClass();
+        $orderAddressMorph = (new OrderAddress)->getMorphClass();
+        $transactionMorph = (new Transaction)->getMorphClass();
+
+        $addressIds = Address::where('customer_id', $customerId)->pluck('id');
+        $cartIds = Cart::where('customer_id', $customerId)->pluck('id');
+        $cartAddressIds = CartAddress::whereIn('cart_id', $cartIds)->pluck('id');
+        $orderIds = Order::where('customer_id', $customerId)->pluck('id');
+        $orderAddressIds = OrderAddress::whereIn('order_id', $orderIds)->pluck('id');
+        $transactionIds = Transaction::whereIn('order_id', $orderIds)->pluck('id');
+
+        $query
+            ->where(fn ($q) => $q->where('subject_type', $customerMorph)->where('subject_id', $customerId))
+            ->orWhere(fn ($q) => $q->where('subject_type', $addressMorph)->whereIn('subject_id', $addressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $cartAddressMorph)->whereIn('subject_id', $cartAddressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $orderAddressMorph)->whereIn('subject_id', $orderAddressIds))
+            ->orWhere(fn ($q) => $q->where('subject_type', $transactionMorph)->whereIn('subject_id', $transactionIds));
+    }
+
+    /**
+     * @param  array<string, mixed>  $properties
+     * @return array<string, mixed>
+     */
+    private function redact(array $properties): array
+    {
+        return array_map(function ($value) {
+            if (is_array($value)) {
+                return array_map(fn () => self::REDACTED, $value);
+            }
+
+            return self::REDACTED;
+        }, $properties);
+    }
+}

src/Order/Filament/Extensions/OrderActionsExtension.php

@@ -32,10 +32,6 @@ use ReflectionProperty;
  * could return a real, honest failure — see Payment\Support\
  * TransactionDriverAdapter's own docblock for that history.
  *
- * Fix, for capture: wrap the action's own action() closure so that, on
- * Halt, we call $action->sendFailureNotification() ourselves before letting
- * the Halt continue propagating — everything else is untouched.
- *
  * Fix, for refund: same notification fix, but the action() closure is
  * replaced outright (not wrapped) rather than reused, because refund also
  * needs a "Refund via" driver Select added to the modal (see
@@ -43,15 +39,28 @@ use ReflectionProperty;
  * Payment\Support\TransactionDriverAdapter::refundVia() instead of
  * Lunar\Models\Transaction::refund() — see fixRefundAction()'s own
  * docblock.
+ *
+ * Fix, for capture: same notification fix, but the action() closure is
+ * also replaced outright — the actual call is routed through
+ * Payment\Support\TransactionDriverAdapter::capture() instead of
+ * Lunar\Models\Transaction::capture() (see fixCaptureAction()), so a
+ * manual backoffice capture goes through the app's own payment driver
+ * registry and dispatches Payment\Events\PaymentCaptured exactly like a
+ * checkout-time capture does — the vendor path resolved
+ * Lunar\Facades\Payments (an entirely separate, unused driver registry)
+ * and never dispatched that event, which is why Order::status used to
+ * stay stuck on 'awaiting_payment' after a manual capture even though
+ * Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus now advances it
+ * on PaymentCaptured.
  */
-class OrderRefundActionsExtension extends ViewPageExtension
+class OrderActionsExtension extends ViewPageExtension
 {
     public function headerActions(array $actions): array
     {
         return array_map(
             fn (Action $action) => match ($action->getName()) {
                 'refund' => $this->fixRefundAction($action),
-                'capture' => $this->fixFailureNotification($action),
+                'capture' => $this->fixCaptureAction($action),
                 default => $action,
             },
             $actions,
@@ -123,6 +132,41 @@ class OrderRefundActionsExtension extends ViewPageExtension
         });
     }
 
+    /**
+     * Mirrors fixRefundAction()'s notification fix, but for the "amount"
+     * field already on the vendor schema — no extra field needed, since
+     * capture always goes back through the transaction's own original
+     * driver (there's no equivalent to refunding via a different driver).
+     */
+    private function fixCaptureAction(Action $action): Action
+    {
+        return $action->action(function (array $data, Action $action) {
+            $transaction = Transaction::find($data['transaction']);
+
+            if (! $transaction instanceof CoreTransaction) {
+                $action->failureNotification(fn () => Notification::make('capture_failure')->danger()->title('Transaction not found.'))
+                    ->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $response = app(TransactionDriverAdapter::class)->capture(
+                $transaction,
+                (int) bcmul((string) $data['amount'], (string) $transaction->order->currency->factor),
+            );
+
+            if (! $response->success) {
+                $action->failureNotification(
+                    fn () => Notification::make('capture_failure')->color('danger')->title($response->message)
+                )->sendFailureNotification();
+
+                throw new Halt;
+            }
+
+            $action->success();
+        });
+    }
+
     /**
      * @return array<string, string>
      */
@@ -163,37 +207,4 @@ class OrderRefundActionsExtension extends ViewPageExtension
 
         return $reflected->getValue($object);
     }
-
-    /**
-     * Wraps the action's own configured action() closure so that, if it
-     * halts (Lunar's closures throw via $action->halt() to signal failure —
-     * see this class's own docblock for why that alone never sends the
-     * notification queued via failureNotification()), we send that
-     * notification ourselves before letting the Halt continue propagating
-     * (still needed — it's what stops callMountedAction() from treating
-     * this as a success and closing the modal/committing the DB transaction).
-     *
-     * $this->evaluate() (not a plain call) matches exactly how Action::call()
-     * itself invokes the closure — Lunar's closures type-hint $data/$record/
-     * $action and rely on Filament's own container-style parameter
-     * resolution, not positional arguments.
-     */
-    private function fixFailureNotification(Action $action): Action
-    {
-        $originalAction = $action->getActionFunction();
-
-        if ($originalAction === null) {
-            return $action;
-        }
-
-        return $action->action(function (array $arguments) use ($action, $originalAction) {
-            try {
-                return $action->evaluate($originalAction, $arguments);
-            } catch (Halt $exception) {
-                $action->sendFailureNotification();
-
-                throw $exception;
-            }
-        });
-    }
 }

src/Order/Filament/Extensions/OrderItemsTableExtension.php

@@ -8,7 +8,7 @@ use Filament\Tables\Table;
 use Lunar\Admin\Support\Extending\BaseExtension;
 
 /**
- * Same fix as OrderRefundActionsExtension, applied to the order lines
+ * Same fix as OrderActionsExtension, applied to the order lines
  * table's "bulk_refund" toolbar action (Lunar\Admin\...\OrderItemsTable::
  * getBulkRefundAction()) — see that class's docblock for the underlying
  * Filament bug (failureNotification()+failure()+halt() never actually

src/Order/Filament/Extensions/OrderPaymentMethodSummaryExtension.php

@@ -42,6 +42,8 @@ class OrderPaymentMethodSummaryExtension extends ViewPageExtension
             return null;
         }
 
-        return PaymentMethod::where('type', $type)->value('name') ?? $type;
+        $method = PaymentMethod::where('type', $type)->first();
+
+        return $method?->translate('name') ?? $type;
     }
 }

src/Order/Listeners/ApplyResolvedPaymentStatus.php

@@ -6,6 +6,7 @@ use Illuminate\Support\Facades\Event;
 use Lunar\Models\Order;
 use Modules\Core\Checkout\Events\OrderPlaced;
 use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Services\OrderStatusFlow;
 use Modules\Core\Order\Services\OrderStatusWriter;
 use Modules\Core\Order\Support\OrderStatus;
 use Modules\Core\Payment\Events\PaymentAuthorized;
@@ -16,13 +17,16 @@ use Modules\Core\Payment\Events\PaymentRefunded;
  * Registered against PaymentCaptured, PaymentAuthorized, AND
  * PaymentRefunded (see OrderServiceProvider).
  *
- * A capture/authorization only ever writes Order::paid/paid_at (via
- * OrderStatusWriter::markPaid()) — never `status`. Confirmed with the
- * user: status leaving 'awaiting_payment' is always a staff-driven
- * "Update Status" click, regardless of payment method — no special-casing
- * prepaid vs. cash-on-delivery. A prepaid order briefly sitting at
- * 'awaiting_payment' with paid = true (until staff notice and advance it)
- * is expected, not a bug.
+ * PaymentCaptured writes both Order::paid/paid_at (via
+ * OrderStatusWriter::markPaid()) AND advances `status` out of
+ * 'awaiting_payment' to the next step in the order's flow (see
+ * OrderStatusFlow::nextOptions()) — re-confirmed with the user: a
+ * captured payment, manual or via Stripe's webhook, should never leave an
+ * order sitting at 'awaiting_payment'. Only fires when status is still
+ * exactly 'awaiting_payment', so a duplicate/delayed capture event never
+ * regresses an order staff already advanced further. PaymentAuthorized
+ * only marks paid — an authorization is not yet captured funds, so
+ * status stays put until the actual capture.
  *
  * A refund still moves `status` (returned -> refunded/partially_refunded)
  * — refunds are a normal step in Modules\Core\Order\Services\
@@ -44,6 +48,7 @@ class ApplyResolvedPaymentStatus
 {
     public function __construct(
         private readonly OrderStatusWriter $writer,
+        private readonly OrderStatusFlow $flow,
     ) {}
 
     public function handle(PaymentCaptured|PaymentAuthorized|PaymentRefunded $event): void
@@ -66,12 +71,30 @@ class ApplyResolvedPaymentStatus
 
         $this->writer->markPaid($order, $event::class);
 
+        if ($event instanceof PaymentCaptured) {
+            $this->advancePastAwaitingPayment($order, $event);
+        }
+
         if (! $wasPlaced) {
             $order->update(['placed_at' => $order->placed_at ?? now()]);
             Event::dispatch(new OrderPlaced($order));
         }
     }
 
+    private function advancePastAwaitingPayment(Order $order, PaymentCaptured $event): void
+    {
+        if ($order->status !== 'awaiting_payment') {
+            return;
+        }
+
+        $next = $this->flow->nextOptions($order);
+        $target = array_key_first($next);
+
+        if ($target !== null) {
+            $this->writer->write($order, $target, $event::class);
+        }
+    }
+
     /**
      * Requires the refund Transaction row to already exist (Modules\Core\
      * Order\Listeners\RecordPaymentTransaction must run first — see

src/Order/Privacy/OrderDataProvider.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Modules\Core\Order\Privacy;
+
+use Lunar\Models\Order;
+use Lunar\Models\OrderAddress;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Orders and order addresses (lunar_orders, lunar_order_addresses) belong to the
+ * Customer (business account) via customer_id, not to an individual User, so this
+ * is Customer-scope only. They're also subject to legal retention (tax/accounting
+ * law generally requires invoices be kept for several years — GDPR Art. 17(3)(b)
+ * explicitly allows this to override an erasure request). eraseForCustomer()
+ * therefore pseudonymizes the PII-bearing free-text fields in place rather than
+ * deleting the order: totals, line items, tax data, and the order itself all
+ * remain intact and auditable.
+ *
+ * Also covers PII-adjacent keys living in Order.meta and OrderAddress.meta —
+ * Modules\Core\Checkout\Services\CheckoutService::initiatePayment() writes
+ * terms_accepted/terms_accepted_at/terms_accepted_policy_version/payment_method
+ * onto Order.meta, and Modules\Core\Shipping\Carriers\BoxNow\
+ * BoxNowFulfillmentService writes the shopper's chosen box_now_locker onto
+ * OrderAddress.meta — neither of which the free-text column erase above ever
+ * touched. Kept Customer-scope, consistent with Order/OrderAddress themselves.
+ */
+class OrderDataProvider implements PersonalDataProvider
+{
+    private const ORDER_META_KEYS = [
+        'terms_accepted',
+        'terms_accepted_at',
+        'terms_accepted_policy_version',
+        'payment_method',
+    ];
+
+    private const ADDRESS_META_KEYS = [
+        'box_now_locker',
+    ];
+
+    public function name(): string
+    {
+        return 'orders';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();
+
+        return new ProviderExportResult('orders', $orders->map(fn (Order $order) => [
+            'id' => $order->id,
+            'reference' => $order->reference,
+            'status' => $order->status,
+            'total' => $order->total?->decimal(),
+            'placed_at' => $order->placed_at?->toIso8601String(),
+            'meta' => $this->onlyKeys((array) $order->meta, self::ORDER_META_KEYS),
+            'addresses' => $order->addresses->map(fn (OrderAddress $address) => [
+                'type' => $address->type,
+                'first_name' => $address->first_name,
+                'last_name' => $address->last_name,
+                'line_one' => $address->line_one,
+                'city' => $address->city,
+                'postcode' => $address->postcode,
+                'contact_email' => $address->contact_email,
+                'contact_phone' => $address->contact_phone,
+                'meta' => $this->onlyKeys((array) $address->meta, self::ADDRESS_META_KEYS),
+            ])->all(),
+        ])->all());
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('orders', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();
+
+        if ($orders->isEmpty()) {
+            return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'No orders for this customer.');
+        }
+
+        foreach ($orders as $order) {
+            $order->update([
+                'customer_reference' => null,
+                'notes' => null,
+                'meta' => $this->withoutKeys((array) $order->meta, self::ORDER_META_KEYS),
+            ]);
+
+            foreach ($order->addresses as $address) {
+                $address->update([
+                    'title' => null,
+                    'first_name' => 'Erased',
+                    'last_name' => 'Customer',
+                    'company_name' => null,
+                    'tax_identifier' => null,
+                    'line_one' => null,
+                    'line_two' => null,
+                    'line_three' => null,
+                    'delivery_instructions' => null,
+                    'contact_email' => null,
+                    'contact_phone' => null,
+                    'meta' => $this->withoutKeys((array) $address->meta, self::ADDRESS_META_KEYS),
+                ]);
+            }
+        }
+
+        return new ProviderErasureResult(
+            'orders',
+            ErasureOutcome::Pseudonymized,
+            'Order and address free-text fields and PII-bearing meta keys cleared; order records, totals, and line items retained for legal/tax record-keeping.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'Orders belong to Customer accounts, not individual users.');
+    }
+
+    /**
+     * @param  array<string, mixed>  $meta
+     * @param  array<int, string>  $keys
+     * @return array<string, mixed>
+     */
+    private function onlyKeys(array $meta, array $keys): array
+    {
+        return array_intersect_key($meta, array_flip($keys));
+    }
+
+    /**
+     * @param  array<string, mixed>  $meta
+     * @param  array<int, string>  $keys
+     * @return array<string, mixed>
+     */
+    private function withoutKeys(array $meta, array $keys): array
+    {
+        foreach ($keys as $key) {
+            unset($meta[$key]);
+        }
+
+        return $meta;
+    }
+}

src/Order/Services/TransactionRecorder.php

@@ -49,6 +49,8 @@ class TransactionRecorder
             'reference' => $result->reference,
             'status' => $result->status->name,
             'notes' => $result->failureReason,
+            'card_type' => $result->meta['card_type'] ?? null,
+            'last_four' => $result->meta['last_four'] ?? null,
             'meta' => $result->meta,
         ]);
     }

src/Payment/Drivers/BankTransferPaymentDriver.php

@@ -22,7 +22,7 @@ use Modules\Core\Payment\Events\PaymentRefunded;
  * chooses this driver explicitly in the refund action, independent of
  * which driver the original payment went through (see
  * Payment\Support\TransactionDriverAdapter::refundVia() and
- * Order\Filament\Extensions\OrderRefundActionsExtension). pay() exists so
+ * Order\Filament\Extensions\OrderActionsExtension). pay() exists so
  * the same driver also covers receiving a payment by bank transfer, but
  * the admin UI for that (bank reference, notes, proof-of-transfer upload)
  * is deliberately not built yet — see the follow-up work tracked from this

src/Payment/Drivers/StripePaymentDriver.php

@@ -4,9 +4,6 @@ namespace Modules\Core\Payment\Drivers;
 
 use Lunar\DataTypes\Price;
 use Lunar\Models\Currency;
-use Lunar\Stripe\Facades\Stripe;
-use Lunar\Stripe\Managers\StripeManager;
-use Lunar\Stripe\Models\StripePaymentIntent;
 use Modules\Core\Payment\Contracts\Configurable;
 use Modules\Core\Payment\Contracts\HandlesPaymentCallback;
 use Modules\Core\Payment\Contracts\SupportsAuthorization;
@@ -26,17 +23,20 @@ use Modules\Core\Payment\Events\PaymentRefundFailed;
 use Modules\Core\Payment\Events\PaymentRefunded;
 use Modules\Core\Payment\Events\PaymentVoidFailed;
 use Modules\Core\Payment\Events\PaymentVoided;
+use Modules\Core\Payment\Models\StripePaymentIntent;
+use Modules\Core\Payment\Support\StripeManager;
 use Stripe\Exception\ApiErrorException;
 use Stripe\PaymentIntent;
 
 /**
  * Talks to Stripe's PaymentIntent API directly — deliberately NOT via
- * Lunar\Stripe\Facades\Stripe::createIntent()/fetchOrCreateIntent(), which
- * take a Lunar\Models\Cart and derive amount/currency from it. Payment
- * must never receive a Cart (see docs/payments.md) — pay()/authorize()
- * already receive $amount explicitly as their own required Lunar Price
- * parameter (see PaymentResult's own docblock), the caller's job to
- * assemble, same as every other driver.
+ * Lunar's own checkout flow (lunarphp/stripe, since removed — see
+ * Modules\Core\Payment\Support\StripeManager's own docblock), which took a
+ * Lunar\Models\Cart and derived amount/currency from it. Payment must
+ * never receive a Cart (see docs/payments.md) — pay()/authorize() already
+ * receive $amount explicitly as their own required Lunar Price parameter
+ * (see PaymentResult's own docblock), the caller's job to assemble, same
+ * as every other driver.
  *
  * Every amount that crosses this class's own boundary is converted right
  * there: Lunar's Price -> Stripe's minor-unit int going INTO a gateway
@@ -45,12 +45,11 @@ use Stripe\PaymentIntent;
  * Nothing outside this class ever sees a Stripe-scaled integer.
  *
  * Correlating a later handleCallback() (a separate request — a webhook)
- * back to whatever $context identified this attempt is solved the same
- * way lunarphp/stripe's own StripePaymentType/ProcessStripeWebhook solve
- * it: real cart_id/order_id columns on Lunar\Stripe\Models\
- * StripePaymentIntent (a table already owned by lunarphp/stripe, already
- * shaped for exactly this), not a generic context blob. See
- * docs/payments.md "Async resolution" for the full reasoning.
+ * back to whatever $context identified this attempt is solved via real
+ * cart_id/order_id columns on Modules\Core\Payment\Models\
+ * StripePaymentIntent (a table this app now owns outright, already shaped
+ * for exactly this), not a generic context blob. See docs/payments.md
+ * "Async resolution" for the full reasoning.
  */
 class StripePaymentDriver implements
     Configurable,
@@ -61,16 +60,18 @@ class StripePaymentDriver implements
     SupportsRefunds,
     HandlesPaymentCallback
 {
+    public function __construct(
+        private readonly StripeManager $stripe,
+    ) {}
+
     /**
-     * Same key lunarphp/stripe's own StripeManager reads its API key from
-     * (Stripe::setApiKey(config('services.stripe.key'))) — no key, no
-     * usable driver.
+     * Same key StripeManager reads its API key from — no key, no usable
+     * driver.
      */
     public function isConfigured(): bool
     {
         return filled(config('services.stripe.key'));
     }
-
     /**
      * Atomic charge — capture_method: automatic. Stripe still frequently
      * confirms into requires_action/requires_confirmation rather than
@@ -100,16 +101,41 @@ class StripePaymentDriver implements
             'currency' => $amount->currency->code,
             'capture_method' => $captureMethod,
             'confirm' => true,
+            // 'never' rather than the client-side paymentMethodTypes: ['card']
+            // restriction alone — the storefront's Payment Element already
+            // excludes every redirect-based method, but without this Stripe
+            // still falls back to whatever's enabled in the Dashboard and
+            // demands a return_url on confirm. Setting this unconditionally
+            // (not only when no payment_method is given) matches the actual
+            // flow: a payment_method is always supplied here.
+            'automatic_payment_methods' => ['enabled' => true, 'allow_redirects' => 'never'],
         ];
 
         if (isset($data['payment_method'])) {
             $params['payment_method'] = $data['payment_method'];
-        } else {
-            $params['automatic_payment_methods'] = ['enabled' => true];
+        }
+
+        // Reconciliation safety net: this app never creates a Stripe Customer
+        // object and attaches no other identifying info to the PaymentIntent
+        // (see docs/payments.md "Reconciliation" for the full reasoning), so
+        // without this, a charge that succeeds on Stripe's side but is never
+        // written to our own DB (e.g. a DB outage at exactly the wrong
+        // moment) would be untraceable back to a cart/order — nothing to
+        // search Stripe's dashboard by except amount/time/card last-4.
+        // array_filter() drops order_id when it's not yet known (still null
+        // in $context at initial pay()/authorize() time — see
+        // rememberIntent()'s own null-coalesce for the same case).
+        $metadata = array_filter([
+            'cart_id' => $context['cart_id'] ?? null,
+            'order_id' => $context['order_id'] ?? null,
+        ]);
+
+        if ($metadata !== []) {
+            $params['metadata'] = $metadata;
         }
 
         try {
-            $paymentIntent = Stripe::getClient()->paymentIntents->create($params);
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->create($params);
         } catch (ApiErrorException $e) {
             return $this->declined($type, $amount, $e, $context, authorizing: $captureMethod === 'manual');
         }
@@ -123,7 +149,7 @@ class StripePaymentDriver implements
     {
         [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context, $data['type'] ?? '');
 
-        $paymentIntent = Stripe::getClient()->paymentIntents->retrieve($reference);
+        $paymentIntent = $this->stripe->getClient()->paymentIntents->retrieve($reference);
 
         $authorizing = $paymentIntent->capture_method === PaymentIntent::CAPTURE_METHOD_MANUAL;
 
@@ -131,7 +157,7 @@ class StripePaymentDriver implements
             // automatic capture_method, but Stripe stopped short of
             // capturing (rare, but the API contract allows it) — finish
             // the job pay() started.
-            $paymentIntent = Stripe::getClient()->paymentIntents->capture($reference);
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->capture($reference);
         }
 
         $intentModel?->update(['status' => $paymentIntent->status]);
@@ -146,7 +172,7 @@ class StripePaymentDriver implements
         [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
 
         try {
-            $paymentIntent = Stripe::getClient()->paymentIntents->capture($reference, [
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->capture($reference, [
                 'amount_to_capture' => StripeManager::toStripeAmount($amount->value, $amount->currency),
             ]);
         } catch (ApiErrorException $e) {
@@ -165,6 +191,7 @@ class StripePaymentDriver implements
             reference: $paymentIntent->id,
             amount: $amount,
             raw: $paymentIntent->toArray(),
+            meta: $this->cardMetaFromIntent($paymentIntent),
         );
 
         $paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED
@@ -179,7 +206,7 @@ class StripePaymentDriver implements
         [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
 
         try {
-            $paymentIntent = Stripe::getClient()->paymentIntents->cancel($reference);
+            $paymentIntent = $this->stripe->getClient()->paymentIntents->cancel($reference);
         } catch (ApiErrorException $e) {
             $result = $this->failure($amount, $e, $reference);
             PaymentVoidFailed::dispatch($type, $result, $context);
@@ -210,7 +237,7 @@ class StripePaymentDriver implements
         [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
 
         try {
-            $refund = Stripe::getClient()->refunds->create([
+            $refund = $this->stripe->getClient()->refunds->create([
                 'payment_intent' => $reference,
                 'amount' => StripeManager::toStripeAmount($amount->value, $amount->currency),
             ]);
@@ -247,7 +274,7 @@ class StripePaymentDriver implements
             'order_id' => $context['order_id'] ?? null,
             'status' => $paymentIntent->status,
             'payment_type' => $type,
-            'context' => json_encode($context),
+            'context' => $context,
         ]);
     }
 
@@ -272,28 +299,10 @@ class StripePaymentDriver implements
         return [
             $intentModel,
             $intentModel?->payment_type ?? $typeFallback,
-            $this->decodeContext($intentModel) ?? $context,
+            $intentModel?->context ?? $context,
         ];
     }
 
-    /**
-     * StripePaymentIntent is a vendor model (lunarphp/stripe) with no cast
-     * declared for our own 'context' column (added by boboko-core's own
-     * migration, see database/migrations/..._add_context_to_stripe_
-     * payment_intents.php) — we can't edit the vendor model to add one, so
-     * decode manually here instead of assuming Eloquent already did it.
-     *
-     * @return array<string, mixed>|null
-     */
-    private function decodeContext(?StripePaymentIntent $intentModel): ?array
-    {
-        if (! $intentModel || ! $intentModel->context) {
-            return null;
-        }
-
-        return json_decode($intentModel->context, associative: true) ?: null;
-    }
-
     /**
      * Converts a live Stripe PaymentIntent's own amount/currency back
      * into Lunar's Price — the one place this class reads a Stripe
@@ -335,6 +344,7 @@ class StripePaymentDriver implements
             amount: $amount,
             failureReason: $paymentIntent->last_payment_error->message ?? null,
             raw: $paymentIntent->toArray(),
+            meta: $status === PaymentResultStatus::Pending ? [] : $this->cardMetaFromIntent($paymentIntent),
             continuation: $continuation,
         );
 
@@ -357,6 +367,40 @@ class StripePaymentDriver implements
         return $result;
     }
 
+    /**
+     * card_type/last_four for Modules\Core\Order\Services\
+     * TransactionRecorder to map onto Transaction (see PaymentResult::
+     * $meta's own docblock) — same fields, same source
+     * (payment_method_details on the underlying Charge) as lunarphp/
+     * stripe's own StoreCharges, just reached via latest_charge instead of
+     * an order-level charge list, since this driver has no Order/Cart to
+     * enumerate charges from.
+     *
+     * @return array{card_type?: string, last_four?: string}
+     */
+    private function cardMetaFromIntent(PaymentIntent $paymentIntent): array
+    {
+        $chargeId = $paymentIntent->latest_charge;
+
+        if (blank($chargeId)) {
+            return [];
+        }
+
+        $charge = $this->stripe->getCharge(is_string($chargeId) ? $chargeId : $chargeId->id);
+
+        $paymentType = collect($charge->payment_method_details)->keys()->first();
+        $details = collect($charge->payment_method_details)->first();
+
+        if (blank($details)) {
+            return [];
+        }
+
+        return array_filter([
+            'card_type' => $details['brand'] ?? $paymentType,
+            'last_four' => $details['last4'] ?? null,
+        ], fn ($value) => filled($value));
+    }
+
     private function declined(string $type, Price $amount, ApiErrorException $e, array $context, bool $authorizing): PaymentResult
     {
         $result = $this->failure($amount, $e);

src/Payment/Filament/Resources/PaymentMethodResource.php

@@ -12,6 +12,7 @@ use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Columns\ToggleColumn;
 use Filament\Tables\Table;
 use Illuminate\Support\Facades\Event;
+use Lunar\Admin\Support\Forms\Components\TranslatedText;
 use Modules\Core\Payment\Contracts\Configurable;
 use Modules\Core\Payment\Events\PaymentMethodsReordered;
 use Modules\Core\Payment\Filament\Resources\PaymentMethodResource\Pages\ListPaymentMethods;
@@ -59,9 +60,9 @@ class PaymentMethodResource extends Resource
 {
     protected static ?string $model = PaymentMethod::class;
 
-    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-credit-card';
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-credit-card';
 
-    protected static string|\UnitEnum|null $navigationGroup = 'Settings';
+    protected static string | \UnitEnum | null $navigationGroup = 'Settings';
 
     protected static ?string $modelLabel = 'Payment Method';
 
@@ -76,7 +77,7 @@ class PaymentMethodResource extends Resource
                     ->sortable(),
                 TextColumn::make('name')
                     ->label('Name')
-                    ->searchable(),
+                    ->state(fn (PaymentMethod $record) => $record->translate('name')),
                 TextColumn::make('type')
                     ->label('Type'),
                 TextColumn::make('driver')
@@ -124,10 +125,9 @@ class PaymentMethodResource extends Resource
     public static function getFormComponents(): array
     {
         return [
-            TextInput::make('name')
+            TranslatedText::make('name')
                 ->label('Name')
-                ->required()
-                ->maxLength(255),
+                ->required(),
             TextInput::make('type')
                 ->label('Type')
                 ->helperText('Machine-facing slug — stored on the cart/order, used by other code to identify this method. Cannot be changed once orders reference it.')

src/Payment/Filament/Resources/PaymentMethodResource/Pages/ListPaymentMethods.php

@@ -2,6 +2,7 @@
 
 namespace Modules\Core\Payment\Filament\Resources\PaymentMethodResource\Pages;
 
+use Filament\Actions\CreateAction;
 use Filament\Actions;
 use Filament\Resources\Pages\ListRecords;
 use Modules\Core\Payment\Filament\Resources\PaymentMethodResource;
@@ -15,7 +16,7 @@ class ListPaymentMethods extends ListRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make()
+            CreateAction::make()
                 ->schema(PaymentMethodResource::getFormComponents())
                 ->fillForm(fn () => [
                     'position' => (PaymentMethod::max('position') ?? 0) + 1,

src/Payment/Http/Controllers/StripeWebhookController.php

@@ -9,18 +9,17 @@ use Modules\Core\Payment\Drivers\StripePaymentDriver;
 use Stripe\Webhook;
 
 /**
- * A boboko-owned webhook endpoint for Stripe — deliberately NOT
- * lunarphp/stripe's own route (vendor/lunarphp/stripe/routes/webhooks.php),
- * which dispatches into Lunar's own Payments::driver('stripe') flow (the
- * flow StripePaymentDriver was built to replace, see that class's own
- * docblock). Signature verification is handled by
- * Lunar\Stripe\Http\Middleware\StripeWebhookMiddleware, registered on this
- * route (see src/Payment/routes/webhooks.php) — pure Stripe SDK
- * verification + event-type filtering, safe to reuse even though this
- * controller never touches the rest of that vendor package's flow. This
- * controller verifies the signature again itself (Webhook::constructEvent())
- * to get the constructed Event object — the middleware doesn't stash one
- * anywhere reusable, it only gates the request through.
+ * A boboko-owned webhook endpoint for Stripe — never went through Lunar's
+ * own Payments::driver('stripe') flow (the flow StripePaymentDriver was
+ * built to replace, see that class's own docblock), and lunarphp/stripe
+ * has since been removed entirely (see Modules\Core\Payment\Support\
+ * StripeManager's own docblock). Signature verification is handled by
+ * Modules\Core\Payment\Http\Middleware\StripeWebhookMiddleware, registered
+ * on this route (see src/Payment/routes/webhooks.php) — pure Stripe SDK
+ * verification + event-type filtering. This controller verifies the
+ * signature again itself (Webhook::constructEvent()) to get the
+ * constructed Event object — the middleware doesn't stash one anywhere
+ * reusable, it only gates the request through.
  *
  * Resolves the driver directly by class, not via
  * Modules\Core\Payment\Services\PaymentDriverRegistry — this endpoint is

src/Payment/Http/Middleware/StripeWebhookMiddleware.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Modules\Core\Payment\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Stripe\Exception\SignatureVerificationException;
+use Stripe\Exception\UnexpectedValueException;
+use Stripe\Webhook;
+
+/**
+ * First-party replacement for Lunar\Stripe\Http\Middleware\
+ * StripeWebhookMiddleware (lunarphp/stripe removed — see
+ * Modules\Core\Payment\Support\StripeManager's own docblock). Registered
+ * on the same route as before (src/Payment/routes/webhooks.php) purely to
+ * gate malformed/irrelevant requests before they reach
+ * Modules\Core\Payment\Http\Controllers\StripeWebhookController, which
+ * re-verifies the signature itself (see that controller's own docblock)
+ * to get the constructed Event object — this duplication predates the
+ * package removal and is left unchanged here.
+ */
+class StripeWebhookMiddleware
+{
+    public function handle(Request $request, ?Closure $next = null)
+    {
+        $secret = config('services.stripe.webhooks.lunar');
+        $stripeSig = $request->header('Stripe-Signature');
+
+        try {
+            $event = Webhook::constructEvent(
+                $request->getContent(),
+                $stripeSig,
+                $secret
+            );
+        } catch (UnexpectedValueException|SignatureVerificationException $e) {
+            abort(400, $e->getMessage());
+        }
+
+        if (! in_array(
+            $event->type,
+            [
+                'payment_intent.payment_failed',
+                'payment_intent.succeeded',
+            ]
+        )) {
+            return response('', 200);
+        }
+
+        return $next($request);
+    }
+}

src/Payment/Models/PaymentMethod.php

@@ -4,6 +4,7 @@ namespace Modules\Core\Payment\Models;
 
 use Illuminate\Database\Eloquent\Casts\AsArrayObject;
 use Illuminate\Database\Eloquent\Model;
+use Lunar\Base\Traits\HasTranslations;
 
 /**
  * A merchant-configured payment method — the DB-instance layer, admin
@@ -11,7 +12,16 @@ use Illuminate\Database\Eloquent\Model;
  * shipping_methods table already has (see docs/payments.md):
  *   - type: unique, machine-facing slug (Cart::meta['payment_method'],
  *     ApplyPaymentMethodFee's lookup key, every Payment event's $type).
- *   - name: admin-facing label.
+ *   - name: admin-facing label, locale-keyed JSON (e.g.
+ *     {"en": "Cash On Delivery", "el": "Αντικαταβολή"}) — same shape/
+ *     resolution as Product/Collection names (Lunar\Base\Traits\
+ *     HasTranslations), just applied directly to this column rather than
+ *     through attribute_data, since this is a merchant settings row, not
+ *     a catalog attribute. Rendered in Filament via Lunar's own
+ *     Lunar\Admin\Support\Forms\Components\TranslatedText — one input per
+ *     configured Language row, no bespoke translation UI. Resolve a
+ *     display string with $method->translate('name') (locale defaults to
+ *     app()->getLocale(), falling back to the store's default language).
  *   - driver: the Modules\Core\Payment\Services\PaymentDriverRegistry key
  *     — NOT the same as `type`, and not unique (two rows can share one
  *     driver, e.g. two differently-named offline-style methods).
@@ -28,12 +38,15 @@ use Illuminate\Database\Eloquent\Model;
  */
 class PaymentMethod extends Model
 {
+    use HasTranslations;
+
     protected $guarded = [];
 
     protected $casts = [
         'enabled' => 'boolean',
         'position' => 'integer',
         'driver_missing_at' => 'datetime',
+        'name' => 'array',
         'data' => AsArrayObject::class,
     ];
 }

src/Payment/Models/StripePaymentIntent.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Models;
+
+use Lunar\Base\BaseModel;
+
+/**
+ * First-party replacement for Lunar\Stripe\Models\StripePaymentIntent (the
+ * lunarphp/stripe package was removed — see Modules\Core\Payment\Support\
+ * StripeManager's own docblock). Same table (lunar_stripe_payment_intents,
+ * created by database/migrations/..._create_stripe_payment_intents_table,
+ * a first-party copy of the vendor migration), including the app-owned
+ * `context`/`payment_type` columns Modules\Core\Payment\Drivers\
+ * StripePaymentDriver::handleCallback() needs to recover $context/$type
+ * across the separate request a webhook arrives on — see that class's own
+ * docblock for "Async resolution".
+ *
+ * Extends Lunar\Base\BaseModel (from lunarphp/core, unaffected by removing
+ * lunarphp/stripe) purely so table-prefix resolution
+ * (config('lunar.database.table_prefix')) stays identical to how the
+ * vendor model resolved it — this table was created under that prefix.
+ */
+class StripePaymentIntent extends BaseModel
+{
+    protected $table = 'stripe_payment_intents';
+
+    protected $guarded = [];
+
+    protected $casts = [
+        'context' => 'array',
+    ];
+}

src/Payment/Privacy/PaymentDataProvider.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Modules\Core\Payment\Privacy;
+
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\Models\StripePaymentIntent;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Payment records (lunar_transactions, stripe_payment_intents) belong to the
+ * Customer (business account) via the Order they're attached to, not to an
+ * individual User, so this is Customer-scope only — same chain
+ * OrderDataProvider already uses (Order.customer_id).
+ *
+ * Like Order itself, payment/transaction records are subject to the same
+ * tax/accounting legal retention argument (GDPR Art. 17(3)(b)) — a payment
+ * record is part of the same financial audit trail as the order it settled,
+ * so this pseudonymizes the card-identifying fields in place rather than
+ * deleting the transaction: amount, status, and the transaction/order link
+ * all remain intact and auditable.
+ *
+ * No Stripe Customer object exists anywhere in this app (see docs/
+ * payments.md "Reconciliation") — there is nothing to request deletion of
+ * on Stripe's side. The only local, erasable PII is the card brand/last-4
+ * on Transaction and the cart_id/order_id/context correlation row on
+ * stripe_payment_intents, which is deleted outright once its Order is
+ * settled (its only purpose was resolving an async webhook callback — see
+ * docs/payments.md "Async resolution" — which has already happened by the
+ * time an erasure request would run).
+ */
+class PaymentDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'payments';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');
+
+        $transactions = Transaction::whereIn('order_id', $orderIds)->get();
+        $intents = StripePaymentIntent::whereIn('order_id', $orderIds)->get();
+
+        return new ProviderExportResult('payments', [
+            'transactions' => $transactions->map(fn (Transaction $transaction) => [
+                'id' => $transaction->id,
+                'order_id' => $transaction->order_id,
+                'type' => $transaction->type,
+                'status' => $transaction->status,
+                'amount' => $transaction->amount,
+                'card_type' => $transaction->card_type,
+                'last_four' => $transaction->last_four,
+                'reference' => $transaction->reference,
+            ])->all(),
+            'stripe_payment_intents' => $intents->map(fn (StripePaymentIntent $intent) => [
+                'id' => $intent->id,
+                'order_id' => $intent->order_id,
+                'intent_id' => $intent->intent_id,
+                'status' => $intent->status,
+            ])->all(),
+        ]);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('payments', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');
+
+        if ($orderIds->isEmpty()) {
+            return new ProviderErasureResult('payments', ErasureOutcome::Skipped, 'No orders, and therefore no payment records, for this customer.');
+        }
+
+        Transaction::whereIn('order_id', $orderIds)->update([
+            'card_type' => null,
+            'last_four' => null,
+        ]);
+
+        // stripe_payment_intents only ever existed to correlate a webhook
+        // callback back to a cart/order (see docs/payments.md "Async
+        // resolution") — that correlation has already served its purpose by
+        // the time an erasure request runs, so these rows are deleted
+        // outright rather than pseudonymized, unlike Transaction, which is
+        // the actual audit-trail record.
+        StripePaymentIntent::whereIn('order_id', $orderIds)->delete();
+
+        return new ProviderErasureResult(
+            'payments',
+            ErasureOutcome::Pseudonymized,
+            'Card brand/last-four cleared from transaction records; amounts, statuses, and references retained for legal/tax record-keeping. Stripe correlation rows (no longer needed post-settlement) deleted.'
+        );
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('payments', ErasureOutcome::Skipped, 'Payments belong to Customer-owned orders, not individual users.');
+    }
+}

src/Payment/Support/StripeManager.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace Modules\Core\Payment\Support;
+
+use Lunar\Models\Contracts\Currency as CurrencyContract;
+use Stripe\Charge;
+use Stripe\StripeClient;
+
+/**
+ * First-party replacement for Lunar\Stripe\Facades\Stripe +
+ * Lunar\Stripe\Managers\StripeManager — lunarphp/stripe was removed once
+ * Modules\Core\Payment\Drivers\StripePaymentDriver already replaced every
+ * bit of Lunar's own Stripe payment flow (see that class's own docblock);
+ * all that remained load-bearing from the package was raw API-client
+ * access and amount conversion, neither of which is Lunar-specific. Only
+ * the methods StripePaymentDriver actually called are kept — no
+ * fetchOrCreateIntent()/cart-bound helpers, which belonged to Lunar's own
+ * (unused) checkout flow.
+ *
+ * getClient()/getCharge() call the Stripe SDK directly rather than going
+ * through a facade — StripePaymentDriver resolves this class via the
+ * container instead, same as every other dependency it takes.
+ */
+class StripeManager
+{
+    public function getClient(): StripeClient
+    {
+        return new StripeClient([
+            'api_key' => config('services.stripe.key'),
+        ]);
+    }
+
+    public function getCharge(string $chargeId): Charge
+    {
+        return $this->getClient()->charges->retrieve($chargeId);
+    }
+
+    /**
+     * Zero-decimal currencies, per Stripe. The amount sent to Stripe is the
+     * major unit amount as-is.
+     *
+     * @see https://docs.stripe.com/currencies#zero-decimal
+     */
+    protected const ZERO_DECIMAL_CURRENCIES = [
+        'bif', 'clp', 'djf', 'gnf', 'jpy', 'kmf', 'krw', 'mga', 'pyg',
+        'rwf', 'ugx', 'vnd', 'vuv', 'xaf', 'xof', 'xpf',
+    ];
+
+    /**
+     * Three-decimal currencies, per Stripe. The amount sent to Stripe is the
+     * major unit amount multiplied by 1000.
+     *
+     * @see https://docs.stripe.com/currencies#three-decimal
+     */
+    protected const THREE_DECIMAL_CURRENCIES = ['bhd', 'jod', 'kwd', 'omr', 'tnd'];
+
+    /**
+     * HUF, TWD and UGX are ISO zero-decimal currencies, but Stripe still
+     * requires amounts to be sent as if they had two decimal places.
+     *
+     * @see https://docs.stripe.com/currencies#special-cases
+     */
+    protected const SPECIAL_ZERO_DECIMAL_CURRENCIES = ['huf', 'twd', 'ugx'];
+
+    /**
+     * Convert a Lunar price value to the amount expected by Stripe.
+     *
+     * Lunar stores prices as integers scaled by `Currency::decimal_places`,
+     * which merchants can set independently of what Stripe expects for a
+     * given currency. This converts back to the major unit amount first,
+     * then re-scales it to whatever sub-unit Stripe requires for the
+     * currency, so the result is correct regardless of how the merchant has
+     * configured `Currency::decimal_places`.
+     *
+     * @see https://docs.stripe.com/currencies
+     */
+    public static function toStripeAmount(int $value, CurrencyContract $currency): int
+    {
+        return self::rescale($value, max($currency->decimal_places, 0), self::stripeDecimalPlaces($currency));
+    }
+
+    /**
+     * Convert an amount received from Stripe back to a Lunar price value,
+     * scaled by `Currency::decimal_places`. Inverse of `toStripeAmount()`.
+     */
+    public static function fromStripeAmount(int $amount, CurrencyContract $currency): int
+    {
+        return self::rescale($amount, self::stripeDecimalPlaces($currency), max($currency->decimal_places, 0));
+    }
+
+    /**
+     * The number of decimal places Stripe expects amounts in for a currency.
+     */
+    protected static function stripeDecimalPlaces(CurrencyContract $currency): int
+    {
+        $code = strtolower($currency->code);
+
+        // UGX is also in the zero-decimal list; the special case takes precedence.
+        if (in_array($code, self::SPECIAL_ZERO_DECIMAL_CURRENCIES, true)) {
+            return 2;
+        }
+
+        if (in_array($code, self::ZERO_DECIMAL_CURRENCIES, true)) {
+            return 0;
+        }
+
+        if (in_array($code, self::THREE_DECIMAL_CURRENCIES, true)) {
+            return 3;
+        }
+
+        return 2;
+    }
+
+    protected static function rescale(int $value, int $fromDecimalPlaces, int $toDecimalPlaces): int
+    {
+        $exponent = $toDecimalPlaces - $fromDecimalPlaces;
+
+        if ($exponent >= 0) {
+            return $value * (10 ** $exponent);
+        }
+
+        $divisor = 10 ** (-$exponent);
+
+        return intdiv(abs($value) + intdiv($divisor, 2), $divisor) * ($value < 0 ? -1 : 1);
+    }
+}

src/Payment/Support/TransactionDriverAdapter.php

@@ -54,7 +54,7 @@ class TransactionDriverAdapter
     /**
      * The PaymentDriverRegistry key $transaction was originally taken
      * through — what refund()/capture() resolve against by default, and
-     * what Order\Filament\Extensions\OrderRefundActionsExtension defaults
+     * what Order\Filament\Extensions\OrderActionsExtension defaults
      * its "Refund via" driver Select to, before an admin overrides it.
      */
     public function driverKeyFor(Transaction $transaction): ?string
@@ -72,7 +72,7 @@ class TransactionDriverAdapter
      * when refunding through the transaction's own original driver.
      *
      * Called directly by Order\Filament\Extensions\
-     * OrderRefundActionsExtension when the admin picks a different driver
+     * OrderActionsExtension when the admin picks a different driver
      * in the refund modal, bypassing Lunar\Models\Transaction::refund()
      * (whose fixed refund(int $amount, $notes = null) signature has no
      * room for a driver override) — see that extension's own docblock.

src/Payment/routes/webhooks.php

@@ -2,8 +2,8 @@
 
 use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Support\Facades\Route;
-use Lunar\Stripe\Http\Middleware\StripeWebhookMiddleware;
 use Modules\Core\Payment\Http\Controllers\StripeWebhookController;
+use Modules\Core\Payment\Http\Middleware\StripeWebhookMiddleware;
 
 Route::post(
     config('payment.stripe.webhook_path', 'payments/stripe/webhook'),

src/Privacy/Contracts/PersonalDataProvider.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Modules\Core\Privacy\Contracts;
+
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Implemented by any module that holds personal data and wants it included in
+ * right-of-access/right-of-erasure requests — core, or a future ERP/banking/etc.
+ * module. Core has no knowledge of what a provider actually stores or how; it only
+ * calls these four methods and collects the results (see PrivacyManager).
+ *
+ * Two independent scopes, not one — see docs/privacy.md "User-scope vs
+ * Customer-scope". A Customer (business account, per Lunar's model) can have many
+ * linked Users, and one User can be linked to many Customer accounts (B2B
+ * multi-seat access — see docs/modules.md "Customer/User Pairing"), so "erase this
+ * person's identity" and "erase this business account's data" are genuinely
+ * different operations with different blast radii:
+ *   - *ForUser(): erase/export one individual — their login, name, email —
+ *     wherever it appears, without touching any Customer account's own data
+ *     (orders, addresses) or any other User linked to those accounts.
+ *   - *ForCustomer(): erase/export one business account's own data, without
+ *     touching any linked User's login or personal identity.
+ * A provider with nothing relevant to one scope implements that method as a
+ * no-op returning ErasureOutcome::Skipped (for erase) or an empty payload (for
+ * export) — see e.g. AddressDataProvider::eraseForUser().
+ *
+ * A provider owns its own retention judgment. There's no central taxonomy of "PII
+ * vs financial data" in this contract on purpose — only the module that owns a
+ * given table actually knows whether its data is freely erasable, must be
+ * pseudonymized (e.g. financial records under a legal retention requirement), or
+ * must be retained outright (e.g. fraud/security records). erase*() expresses
+ * that by returning a ProviderErasureResult with the outcome that actually
+ * happened.
+ */
+interface PersonalDataProvider
+{
+    /**
+     * A short, stable, unique machine name for this provider (e.g. 'customer',
+     * 'orders', 'reviews') — used as the export payload's top-level key and in
+     * erasure reports. Must not collide with another registered provider's name.
+     */
+    public function name(): string;
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult;
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult;
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult;
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult;
+}

src/Privacy/DTOs/CustomerSubject.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+use Lunar\Models\Customer;
+
+/**
+ * Identifies "the business account" for a Customer-scoped data-subject request —
+ * erasing/exporting a Customer's own data (orders, addresses, the account record
+ * itself). Deliberately carries no userIds/email: Customer-scope must never touch
+ * any linked User's login or personal identity, only the account's own data — see
+ * docs/privacy.md "User-scope vs Customer-scope". A provider that needs to know
+ * which Users are linked (e.g. to export their names as account contacts, without
+ * erasing their logins) looks that up itself via the Customer model, rather than
+ * this value object handing it out — keeping "erase a Customer" structurally
+ * incapable of touching a User row is the whole point of the split.
+ */
+class CustomerSubject
+{
+    public function __construct(
+        public readonly int $customerId,
+    ) {}
+
+    public static function forCustomer(Customer $customer): self
+    {
+        return new self(customerId: $customer->id);
+    }
+}

src/Privacy/DTOs/ErasureReport.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+
+/**
+ * Every registered provider's outcome, assembled into one right-of-erasure response
+ * — the audit trail proving what happened and, for anything not fully erased, why.
+ * $subject is whichever scope the request was for — see docs/privacy.md
+ * "User-scope vs Customer-scope".
+ */
+class ErasureReport
+{
+    /**
+     * @param  array<int, ProviderErasureResult>  $results
+     */
+    public function __construct(
+        public readonly UserSubject|CustomerSubject $subject,
+        public readonly array $results,
+    ) {}
+
+    /**
+     * @return array<int, ProviderErasureResult>
+     */
+    public function retained(): array
+    {
+        return array_values(array_filter(
+            $this->results,
+            fn (ProviderErasureResult $result) => $result->outcome === ErasureOutcome::Retained
+        ));
+    }
+}

src/Privacy/DTOs/ExportReport.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+/**
+ * Every registered provider's export, assembled into one right-of-access response.
+ * $subject is whichever scope the request was for — see docs/privacy.md
+ * "User-scope vs Customer-scope".
+ */
+class ExportReport
+{
+    /**
+     * @param  array<int, ProviderExportResult>  $results
+     */
+    public function __construct(
+        public readonly UserSubject|CustomerSubject $subject,
+        public readonly array $results,
+    ) {}
+
+    /**
+     * @return array<string, array<string, mixed>> keyed by provider name
+     */
+    public function toArray(): array
+    {
+        $data = [];
+
+        foreach ($this->results as $result) {
+            // A provider that threw (ProviderExportResult::$error set — see
+            // Modules\Core\Privacy\Jobs\ExportDataSubjectJob::safeExport())
+            // surfaces as an explicit error marker rather than an empty
+            // array indistinguishable from "genuinely nothing to export."
+            $data[$result->provider] = $result->error !== null
+                ? ['error' => $result->error]
+                : $result->data;
+        }
+
+        return $data;
+    }
+}

src/Privacy/DTOs/ProviderErasureResult.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+
+/**
+ * One provider's outcome on an erasure request. `reason` is required whenever
+ * outcome isn't Erased, so a compliance report or admin UI can show *why* something
+ * wasn't deleted (e.g. "orders retained per tax law for 7 years from placement")
+ * without reading that module's source.
+ */
+class ProviderErasureResult
+{
+    public function __construct(
+        public readonly string $provider,
+        public readonly ErasureOutcome $outcome,
+        public readonly ?string $reason = null,
+    ) {}
+}

src/Privacy/DTOs/ProviderExportResult.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+/**
+ * One provider's contribution to a right-of-access export. `provider` is a short,
+ * stable machine name (e.g. 'customer', 'orders', 'reviews') used as the top-level
+ * key when PrivacyService assembles every provider's data into one export payload.
+ *
+ * `error` is set only when the provider threw an exception instead of returning
+ * normally — see Modules\Core\Privacy\Jobs\ExportDataSubjectJob, which catches
+ * per-provider so one provider throwing doesn't discard every other provider's
+ * already-gathered data for the same request. `data` is empty whenever `error` is
+ * set, never a partial/best-effort payload.
+ */
+class ProviderExportResult
+{
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    public function __construct(
+        public readonly string $provider,
+        public readonly array $data,
+        public readonly ?string $error = null,
+    ) {}
+}

src/Privacy/DTOs/UserSubject.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Modules\Core\Privacy\DTOs;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Base\LunarUser;
+
+/**
+ * Identifies "the person" for a User-scoped data-subject request — erasing/
+ * exporting one individual's own identity (login, name, email) wherever it
+ * appears, regardless of how many Customer (business) accounts they're linked to.
+ * Deliberately carries no customerId: a provider that needs to know which
+ * Customer accounts this User is linked to (e.g. to detach them, or to find data
+ * keyed by a shared email) looks that up itself, rather than this value object
+ * assuming one fixed Customer — the whole point is that one User can belong to
+ * many Customer accounts (B2B multi-seat access) and erasing the User must not
+ * assume or privilege any single one of them.
+ */
+class UserSubject
+{
+    public function __construct(
+        public readonly int $userId,
+        public readonly ?string $email = null,
+    ) {}
+
+    public static function forUser(Authenticatable&LunarUser $user): self
+    {
+        return new self(userId: $user->id, email: $user->email);
+    }
+}

src/Privacy/Enums/ErasureOutcome.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Privacy\Enums;
+
+/**
+ * What actually happened to a provider's data on an erasure request. Erased/
+ * Pseudonymized/Retained/Skipped are never failures — Retained is a valid, often
+ * legally-required outcome (e.g. an Order kept intact for tax retention), distinct
+ * from a provider erroring out. Failed is the one genuine failure case: a provider
+ * threw an exception instead of returning normally — see Modules\Core\Privacy\
+ * Services\PrivacyService::completeErasure(), which catches per-provider so one
+ * provider throwing doesn't discard every other provider's already-computed
+ * result for the same request.
+ */
+enum ErasureOutcome: string
+{
+    case Erased = 'erased';
+    case Pseudonymized = 'pseudonymized';
+    case Retained = 'retained';
+    case Skipped = 'skipped';
+    case Failed = 'failed';
+}

src/Privacy/Enums/ErasureRequestStatus.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Modules\Core\Privacy\Enums;
+
+enum ErasureRequestStatus: string
+{
+    case Pending = 'pending';
+    case Cancelled = 'cancelled';
+    case Completed = 'completed';
+}

src/Privacy/Enums/ExportRequestStatus.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Modules\Core\Privacy\Enums;
+
+enum ExportRequestStatus: string
+{
+    case Pending = 'pending';
+    case Completed = 'completed';
+    case Failed = 'failed';
+}

src/Privacy/Events/PersonalDataExportFileWritten.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Privacy\Events;
+
+use Modules\Core\Privacy\Models\DataExportRequest;
+
+/**
+ * Fired once the export file exists and $request has been marked completed. Core
+ * has no opinion on how the customer should be told — a consuming app registers
+ * its own notification against this event via Modules\Core\Notification\
+ * NotificationRegistry, the same pattern as App\Notifications\
+ * QuestionnaireResultsSentNotification listening on App\Events\
+ * QuestionnaireResultsSent.
+ */
+class PersonalDataExportFileWritten
+{
+    public function __construct(
+        public readonly DataExportRequest $request,
+    ) {}
+}

src/Privacy/Events/PersonalDataGathered.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Privacy\Events;
+
+use Modules\Core\Privacy\DTOs\ExportReport;
+use Modules\Core\Privacy\Models\DataExportRequest;
+
+/**
+ * Fired once ExportDataSubjectJob has gathered every registered provider's data —
+ * no file exists yet at this point. Modules\Core\Privacy\Listeners\
+ * WriteExportToCsvListener (registered in PrivacyServiceProvider) is what actually
+ * turns this into a file, kept as its own listener rather than inline in the job
+ * so the export *format* (CSV today) is swappable without touching how the data
+ * is gathered.
+ */
+class PersonalDataGathered
+{
+    public function __construct(
+        public readonly DataExportRequest $request,
+        public readonly ExportReport $report,
+    ) {}
+}

src/Privacy/Events/UserErasureRequested.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Privacy\Events;
+
+use Modules\Core\Privacy\Models\DataErasureRequest;
+
+/**
+ * Fired by PrivacyService::requestErasureForUser() right after the grace-period
+ * request is created (not at completeErasure() time — see
+ * Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener, which needs to
+ * act while the User is still linked to their Customers, before any detach has
+ * happened).
+ */
+class UserErasureRequested
+{
+    public function __construct(
+        public readonly DataErasureRequest $request,
+    ) {}
+}

src/Privacy/Filament/Extensions/CustomerErasureActionsExtension.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Extensions;
+
+use Filament\Actions\Action;
+use Filament\Forms\Components\Checkbox;
+use Filament\Notifications\Notification;
+use Lunar\Admin\Support\Extending\BaseExtension;
+use Lunar\Models\Customer;
+use Modules\Core\Auth\Models\Staff;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Adds "Request erasure" / "Request export" header actions to the Customer
+ * resource's edit/view page — the panel entry point for a staff member handling
+ * "a customer emailed asking to be forgotten/for their data" without needing
+ * tinker/code access. Registered centrally in CorePlugin, layered alongside
+ * whatever CustomerResourceExtension a consuming app registers for its own
+ * form/table/relations — LunarPanel::extensions() merges per resource (see
+ * docs/modules.md "Layering Module and App Configuration"), and this extension
+ * deliberately only implements headerActions(), so it never conflicts with an
+ * app's own extension for the same resource.
+ */
+class CustomerErasureActionsExtension extends BaseExtension
+{
+    public function headerActions(array $actions): array
+    {
+        return [
+            ...$actions,
+            Action::make('requestErasure')
+                ->label('Request Erasure')
+                ->icon('heroicon-o-shield-exclamation')
+                ->color('danger')
+                ->requiresConfirmation()
+                ->modalDescription('Opens a cancellable grace-period erasure request for this Customer account. No linked User\'s login is affected.')
+                ->schema([
+                    Checkbox::make('immediate')
+                        ->label('Erase immediately (skip the 30-day grace period)')
+                        ->helperText('Staff-only, for a formal legal request or regulator inquiry that genuinely requires urgency — not a routine deletion. Runs synchronously, cannot be cancelled once submitted.')
+                        ->default(false),
+                ])
+                ->action(function (Customer $record, array $data) {
+                    $privacyService = app(PrivacyService::class);
+
+                    if ($data['immediate']) {
+                        $privacyService->requestImmediateErasureForCustomer($record, $this->currentStaff());
+
+                        Notification::make()
+                            ->title('Customer erased')
+                            ->body('Erasure ran immediately — see the Erasure Requests list for the outcome.')
+                            ->success()
+                            ->send();
+
+                        return;
+                    }
+
+                    $privacyService->requestErasureForCustomer($record, $this->currentStaff());
+
+                    Notification::make()
+                        ->title('Erasure requested')
+                        ->body('The grace period starts now — see the Erasure Requests list.')
+                        ->success()
+                        ->send();
+                }),
+            Action::make('requestExport')
+                ->label('Request Export')
+                ->icon('heroicon-o-arrow-down-tray')
+                ->requiresConfirmation()
+                ->action(function (Customer $record) {
+                    app(PrivacyService::class)->requestExportForCustomer($record);
+
+                    Notification::make()
+                        ->title('Export requested')
+                        ->body('Generating in the background — see the Export Requests list once it completes.')
+                        ->success()
+                        ->send();
+                }),
+        ];
+    }
+
+    private function currentStaff(): Staff
+    {
+        return auth('staff')->user();
+    }
+}

src/Privacy/Filament/Extensions/CustomerErasureRelationsExtension.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Extensions;
+
+use Lunar\Admin\Filament\Resources\CustomerResource\RelationManagers\UserRelationManager as BaseUserRelationManager;
+use Lunar\Admin\Support\Extending\BaseExtension;
+use Modules\Core\Privacy\RelationManagers\ErasureRequestsRelationManager;
+use Modules\Core\Privacy\RelationManagers\ExportRequestsRelationManager;
+use Modules\Core\Privacy\RelationManagers\UserRelationManager;
+
+/**
+ * Adds the erasureRequests/exportRequests relation managers (see CorePlugin's
+ * Customer::erasureRequests()/exportRequests() macros) to the Customer resource's
+ * relation tabs — separate from CustomerErasureActionsExtension (headerActions)
+ * so each extension stays single-purpose. Unlike headerActions(), getRelations()
+ * genuinely is resource-keyed (called statically from the Resource class, not a
+ * page instance), so this is registered under CustomerResource::class itself in
+ * CorePlugin, not a page class.
+ *
+ * Also swaps Lunar's base UserRelationManager for Modules\Core\Privacy\
+ * RelationManagers\UserRelationManager, which adds a "Privacy Requests" row
+ * action per user — see that class's docblock for why this can't be a nested
+ * relation manager instead. Compares against Lunar's own base class, not any
+ * intermediate override, per docs/lunar.md "Overriding Lunar Relation Managers".
+ */
+class CustomerErasureRelationsExtension extends BaseExtension
+{
+    public function getRelations(array $relations): array
+    {
+        $relations = array_map(
+            fn ($relation) => $relation === BaseUserRelationManager::class ? UserRelationManager::class : $relation,
+            $relations
+        );
+
+        return [
+            ...$relations,
+            ErasureRequestsRelationManager::class,
+            ExportRequestsRelationManager::class,
+        ];
+    }
+}

src/Privacy/Filament/Resources/DataErasureRequestResource.php

@@ -0,0 +1,231 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources;
+
+use Filament\Schemas\Schema;
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
+use Filament\Infolists\Components\RepeatableEntry;
+use Filament\Infolists\Components\RepeatableEntry\TableColumn;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages\ListDataErasureRequests;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages\ViewDataErasureRequest;
+use Filament\Resources\Resource;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Lunar\Models\Customer;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Read-mostly audit view over data_erasure_requests — staff can see every request
+ * (who/what/when/status), inspect the per-provider outcome report once completed,
+ * and cancel a pending one. Requests themselves are created via PrivacyService
+ * (see Modules\Core\Privacy\Filament\Extensions\CustomerErasureActionsExtension
+ * for the Customer-resource entry point) — this resource has no create/edit page,
+ * since a request's lifecycle is owned by PrivacyService, not free-form editing.
+ */
+class DataErasureRequestResource extends Resource
+{
+    protected static ?string $model = DataErasureRequest::class;
+
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-shield-exclamation';
+
+    protected static string | \UnitEnum | null $navigationGroup = 'Privacy';
+
+    protected static ?string $modelLabel = 'Erasure Request';
+
+    protected static ?string $pluralModelLabel = 'Erasure Requests';
+
+    /**
+     * A real infolist, not form()'s disabled inputs/Placeholders — ViewRecord
+     * falls back to rendering form() in read-only mode when a resource has no
+     * infolist() at all (Filament\Resources\Pages\ViewRecord::hasInfolist()),
+     * which is what this resource did before: every field rendered as a
+     * plain, unstyled label/value pair with no grouping, badges, or icons.
+     */
+    public static function infolist(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make('Request')
+                ->icon('heroicon-o-shield-exclamation')
+                ->columns(4)
+                ->components([
+                    TextEntry::make('subject')
+                        ->label('Subject')
+                        ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->subject))
+                        ->weight('bold')
+                        ->size('lg'),
+                    TextEntry::make('subject_type')
+                        ->label('Scope')
+                        ->formatStateUsing(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'Customer account' : 'Individual user')
+                        ->badge()
+                        ->icon(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'heroicon-o-building-office' : 'heroicon-o-user')
+                        ->color(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
+                    TextEntry::make('email')
+                        ->label('Email (snapshot at request time)')
+                        ->icon('heroicon-o-envelope')
+                        ->copyable(),
+                    TextEntry::make('requested_by')
+                        ->label('Requested by')
+                        ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy))
+                        ->icon('heroicon-o-user-circle'),
+                    TextEntry::make('status')
+                        ->badge()
+                        ->formatStateUsing(fn (ErasureRequestStatus $state) => ucfirst($state->value))
+                        ->color(fn (ErasureRequestStatus $state) => match ($state) {
+                            ErasureRequestStatus::Pending => 'warning',
+                            ErasureRequestStatus::Cancelled => 'gray',
+                            ErasureRequestStatus::Completed => 'success',
+                        }),
+                    TextEntry::make('created_at')
+                        ->label('Requested at')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar'),
+                    TextEntry::make('scheduled_for')
+                        ->label('Scheduled for')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar-days'),
+                    TextEntry::make('completed_at')
+                        ->label('Completed at')
+                        ->dateTime()
+                        ->placeholder('—')
+                        ->icon('heroicon-o-check-circle')
+                        ->color(fn (DataErasureRequest $record) => $record->completed_at ? 'success' : 'gray'),
+                    TextEntry::make('cancelled_at')
+                        ->label('Cancelled at')
+                        ->dateTime()
+                        ->placeholder('—')
+                        ->icon('heroicon-o-x-circle')
+                        ->color(fn (DataErasureRequest $record) => $record->cancelled_at ? 'danger' : 'gray')
+                        ->visible(fn (DataErasureRequest $record) => $record->cancelled_at !== null),
+                    TextEntry::make('caused_by')
+                        ->label('Cascade')
+                        ->icon('heroicon-o-arrow-turn-down-right')
+                        ->state(fn (DataErasureRequest $record) => $record->causedBy
+                            ? "From request #{$record->causedBy->id} (".DataErasureRequest::displayNameFor($record->causedBy->subject).')'
+                            : 'Directly requested')
+                        ->color(fn (DataErasureRequest $record) => $record->caused_by_request_id !== null ? 'info' : 'gray'),
+                ]),
+
+            Section::make('Outcome')
+                ->description('What happened to each data category once the erasure ran. "Retained"/"Pseudonymized" usually means the data is kept in an anonymized form for legal or accounting reasons.')
+                ->icon('heroicon-o-document-check')
+                ->visible(fn (DataErasureRequest $record) => $record->report !== null)
+                ->components([
+                    RepeatableEntry::make('report')
+                        ->hiddenLabel()
+                        ->table([
+                            TableColumn::make('Data category'),
+                            TableColumn::make('Outcome'),
+                            TableColumn::make('Reason'),
+                        ])
+                        ->components([
+                            TextEntry::make('provider'),
+                            TextEntry::make('outcome')
+                                ->badge()
+                                ->formatStateUsing(fn (string $state) => ucfirst($state))
+                                ->color(fn (string $state) => match ($state) {
+                                    ErasureOutcome::Erased->value => 'success',
+                                    ErasureOutcome::Pseudonymized->value, ErasureOutcome::Retained->value => 'info',
+                                    ErasureOutcome::Skipped->value => 'gray',
+                                    ErasureOutcome::Failed->value => 'danger',
+                                    default => 'gray',
+                                }),
+                            TextEntry::make('reason')
+                                ->placeholder('—'),
+                        ]),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('id')
+                    ->label('#')
+                    ->sortable(),
+                TextColumn::make('subject_type')
+                    ->label('Scope')
+                    ->formatStateUsing(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'Customer' : 'User')
+                    ->badge()
+                    ->color(fn (DataErasureRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
+                TextColumn::make('subject')
+                    ->label('Subject')
+                    ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->subject))
+                    ->searchable(query: fn ($query, string $search) => $query->where('email', 'like', "%{$search}%")),
+                TextColumn::make('requestedBy')
+                    ->label('Requested by')
+                    ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy)),
+                TextColumn::make('status')
+                    ->badge()
+                    ->formatStateUsing(fn (ErasureRequestStatus $state) => ucfirst($state->value))
+                    ->color(fn (ErasureRequestStatus $state) => match ($state) {
+                        ErasureRequestStatus::Pending => 'warning',
+                        ErasureRequestStatus::Cancelled => 'gray',
+                        ErasureRequestStatus::Completed => 'success',
+                    }),
+                TextColumn::make('scheduled_for')
+                    ->label('Scheduled for')
+                    ->dateTime()
+                    ->sortable(),
+                TextColumn::make('caused_by_request_id')
+                    ->label('Cascade')
+                    ->formatStateUsing(fn (?int $state) => $state ? "from #{$state}" : '—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('created_at')
+                    ->label('Requested at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('status')
+                    ->options([
+                        ErasureRequestStatus::Pending->value => 'Pending',
+                        ErasureRequestStatus::Cancelled->value => 'Cancelled',
+                        ErasureRequestStatus::Completed->value => 'Completed',
+                    ]),
+                SelectFilter::make('subject_type')
+                    ->label('Scope')
+                    ->options(function () {
+                        $userModel = config('auth.providers.users.model');
+
+                        return [
+                            (new Customer)->getMorphClass() => 'Customer',
+                            (new $userModel)->getMorphClass() => 'User',
+                        ];
+                    }),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+                Action::make('cancel')
+                    ->label('Cancel')
+                    ->icon('heroicon-o-x-circle')
+                    ->color('danger')
+                    ->requiresConfirmation()
+                    ->visible(fn (DataErasureRequest $record) => $record->isPending())
+                    ->action(fn (DataErasureRequest $record, PrivacyService $privacyService) => $privacyService->cancelErasure($record)),
+            ]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListDataErasureRequests::route('/'),
+            'view' => ViewDataErasureRequest::route('/{record}'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+}

src/Privacy/Filament/Resources/DataErasureRequestResource/Pages/ListDataErasureRequests.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
+
+class ListDataErasureRequests extends ListRecords
+{
+    protected static string $resource = DataErasureRequestResource::class;
+}

src/Privacy/Filament/Resources/DataErasureRequestResource/Pages/ViewDataErasureRequest.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource\Pages;
+
+use Filament\Resources\Pages\ViewRecord;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
+
+class ViewDataErasureRequest extends ViewRecord
+{
+    protected static string $resource = DataErasureRequestResource::class;
+}

src/Privacy/Filament/Resources/DataExportRequestResource.php

@@ -0,0 +1,172 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources;
+
+use Filament\Schemas\Schema;
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages\ListDataExportRequests;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages\ViewDataExportRequest;
+use Filament\Resources\Resource;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Models\DataExportRequest;
+
+/**
+ * Read-only audit view over data_export_requests — see DataErasureRequestResource
+ * for the erasure-side equivalent and the shared reasoning (no create/edit page,
+ * requests are created via PrivacyService::requestExport*()).
+ */
+class DataExportRequestResource extends Resource
+{
+    protected static ?string $model = DataExportRequest::class;
+
+    protected static string | \BackedEnum | null $navigationIcon = 'heroicon-o-arrow-down-tray';
+
+    protected static string | \UnitEnum | null $navigationGroup = 'Privacy';
+
+    protected static ?string $modelLabel = 'Export Request';
+
+    protected static ?string $pluralModelLabel = 'Export Requests';
+
+    /**
+     * A real infolist, not form()'s disabled inputs/Placeholders — see
+     * DataErasureRequestResource::infolist()'s own docblock for why.
+     */
+    public static function infolist(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make('Request')
+                ->icon('heroicon-o-arrow-down-tray')
+                ->columns(4)
+                ->components([
+                    TextEntry::make('subject')
+                        ->label('Subject')
+                        ->state(fn (DataExportRequest $record) => DataErasureRequest::displayNameFor($record->subject))
+                        ->weight('bold')
+                        ->size('lg'),
+                    TextEntry::make('subject_type')
+                        ->label('Scope')
+                        ->formatStateUsing(fn (DataExportRequest $record) => $record->isForCustomer() ? 'Customer account' : 'Individual user')
+                        ->badge()
+                        ->icon(fn (DataExportRequest $record) => $record->isForCustomer() ? 'heroicon-o-building-office' : 'heroicon-o-user')
+                        ->color(fn (DataExportRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
+                    TextEntry::make('email')
+                        ->label('Email (snapshot at request time)')
+                        ->icon('heroicon-o-envelope')
+                        ->copyable(),
+                    TextEntry::make('status')
+                        ->badge()
+                        ->formatStateUsing(fn (ExportRequestStatus $state) => ucfirst($state->value))
+                        ->color(fn (ExportRequestStatus $state) => match ($state) {
+                            ExportRequestStatus::Pending => 'warning',
+                            ExportRequestStatus::Failed => 'danger',
+                            ExportRequestStatus::Completed => 'success',
+                        }),
+                    TextEntry::make('created_at')
+                        ->label('Requested at')
+                        ->dateTime()
+                        ->icon('heroicon-o-calendar'),
+                    TextEntry::make('completed_at')
+                        ->label('Completed at')
+                        ->dateTime()
+                        ->placeholder('Not generated yet')
+                        ->icon('heroicon-o-check-circle')
+                        ->color(fn (DataExportRequest $record) => $record->completed_at ? 'success' : 'gray'),
+                    TextEntry::make('file_path')
+                        ->label('File')
+                        // Just the filename, not the full server path — a raw
+                        // filesystem path (/var/www/.../export_2_....zip) isn't
+                        // actionable for staff and previously rendered as if it
+                        // were a clickable link. The actual download is the
+                        // "Download" header action below (self::downloadAction()),
+                        // shared with the table's row action.
+                        ->state(fn (DataExportRequest $record) => $record->file_path ? basename($record->file_path) : 'Not generated yet')
+                        ->icon('heroicon-o-document')
+                        ->color(fn (DataExportRequest $record) => $record->file_path ? 'success' : 'gray'),
+                ]),
+        ]);
+    }
+
+    /**
+     * Shared by the table's row action and the view page's header action
+     * (ViewDataExportRequest::getHeaderActions()) so "is this downloadable"
+     * and the download itself are defined in exactly one place.
+     */
+    public static function downloadAction(): Action
+    {
+        return Action::make('download')
+            ->label('Download')
+            ->icon('heroicon-o-arrow-down-tray')
+            ->visible(fn (DataExportRequest $record) => $record->status === ExportRequestStatus::Completed && $record->file_path && file_exists($record->file_path))
+            ->action(fn (DataExportRequest $record) => response()->download($record->file_path));
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('id')
+                    ->label('#')
+                    ->sortable(),
+                TextColumn::make('subject_type')
+                    ->label('Scope')
+                    ->formatStateUsing(fn (DataExportRequest $record) => $record->isForCustomer() ? 'Customer' : 'User')
+                    ->badge()
+                    ->color(fn (DataExportRequest $record) => $record->isForCustomer() ? 'info' : 'warning'),
+                TextColumn::make('subject')
+                    ->label('Subject')
+                    ->state(fn (DataExportRequest $record) => DataErasureRequest::displayNameFor($record->subject))
+                    ->searchable(query: fn ($query, string $search) => $query->where('email', 'like', "%{$search}%")),
+                TextColumn::make('status')
+                    ->badge()
+                    ->formatStateUsing(fn (ExportRequestStatus $state) => ucfirst($state->value))
+                    ->color(fn (ExportRequestStatus $state) => match ($state) {
+                        ExportRequestStatus::Pending => 'warning',
+                        ExportRequestStatus::Failed => 'danger',
+                        ExportRequestStatus::Completed => 'success',
+                    }),
+                TextColumn::make('created_at')
+                    ->label('Requested at')
+                    ->dateTime()
+                    ->sortable(),
+                TextColumn::make('completed_at')
+                    ->label('Completed at')
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('status')
+                    ->options([
+                        ExportRequestStatus::Pending->value => 'Pending',
+                        ExportRequestStatus::Completed->value => 'Completed',
+                        ExportRequestStatus::Failed->value => 'Failed',
+                    ]),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+                self::downloadAction(),
+            ]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListDataExportRequests::route('/'),
+            'view' => ViewDataExportRequest::route('/{record}'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+}

src/Privacy/Filament/Resources/DataExportRequestResource/Pages/ListDataExportRequests.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages;
+
+use Filament\Resources\Pages\ListRecords;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
+
+class ListDataExportRequests extends ListRecords
+{
+    protected static string $resource = DataExportRequestResource::class;
+}

src/Privacy/Filament/Resources/DataExportRequestResource/Pages/ViewDataExportRequest.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Privacy\Filament\Resources\DataExportRequestResource\Pages;
+
+use Filament\Resources\Pages\ViewRecord;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
+
+class ViewDataExportRequest extends ViewRecord
+{
+    protected static string $resource = DataExportRequestResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DataExportRequestResource::downloadAction(),
+        ];
+    }
+}

src/Privacy/Jobs/EraseDataSubjectJob.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace Modules\Core\Privacy\Jobs;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Runs PrivacyService::completeErasure() for one due DataErasureRequest, dispatched
+ * per-request by ProcessErasureRequestsCommand rather than looping over
+ * completeErasure() calls inline in the command. One job per request means one
+ * request's failure (a provider throwing, a DB error) doesn't block or crash
+ * processing of the others, and Laravel's normal per-job retry/failure handling
+ * applies to each request independently.
+ */
+class EraseDataSubjectJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public readonly DataErasureRequest $request,
+    ) {}
+
+    public function handle(PrivacyService $privacyService): void
+    {
+        $privacyService->completeErasure($this->request);
+    }
+}

src/Privacy/Jobs/ExportDataSubjectJob.php

@@ -0,0 +1,102 @@
+<?php
+
+namespace Modules\Core\Privacy\Jobs;
+
+use Throwable;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Events\PersonalDataGathered;
+use Modules\Core\Privacy\DTOs\ExportReport;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+use Modules\Core\Privacy\Models\DataExportRequest;
+use Modules\Core\Privacy\Services\PrivacyManager;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Gathers every registered PersonalDataProvider's export data for one request, all
+ * sequentially in this single job — deliberately not fanned out into one job per
+ * provider. Per-subject export work is small (a handful of indexed queries per
+ * provider), so there's no real parallelism win, and one job means "finished" is
+ * just "handle() returned," with no Bus::batch()/completion-counting needed. If a
+ * future provider ever does something genuinely slow (an external API call, a
+ * generated PDF), that's the point to reconsider — not before.
+ *
+ * Calls each provider's *ForCustomer() or *ForUser() method depending on the
+ * request's polymorphic subject — see Modules\Core\Privacy\Services\PrivacyService and
+ * docs/privacy.md "User-scope vs Customer-scope".
+ *
+ * Writing the gathered data to a file is intentionally NOT done here — see
+ * PersonalDataGathered and Modules\Core\Privacy\Listeners\WriteExportToCsvListener,
+ * which keeps the export *format* swappable without touching how data is gathered.
+ */
+class ExportDataSubjectJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public readonly DataExportRequest $request,
+    ) {}
+
+    public function handle(PrivacyManager $manager): void
+    {
+        if ($this->request->isForCustomer()) {
+            $subject = new CustomerSubject(customerId: $this->request->subject_id);
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeExport($provider, 'exportForCustomer', $subject),
+                $manager->providers()
+            );
+        } else {
+            $subject = new UserSubject(userId: $this->request->subject_id, email: $this->request->email);
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeExport($provider, 'exportForUser', $subject),
+                $manager->providers()
+            );
+        }
+
+        Event::dispatch(new PersonalDataGathered(
+            $this->request,
+            new ExportReport($subject, $results)
+        ));
+    }
+
+    public function failed(Throwable $exception): void
+    {
+        $this->request->update(['status' => ExportRequestStatus::Failed]);
+    }
+
+    /**
+     * Catches per-provider so one provider throwing doesn't discard every
+     * other provider's already-gathered export data for this same request —
+     * without this, the whole array_map aborts, handle() never reaches
+     * Event::dispatch(), and failed() marks the ENTIRE request Failed even
+     * though most providers may have already gathered their data
+     * successfully. Logged via Log::error() so a thrown provider is still
+     * visible to staff, not just an empty/missing section in the export.
+     *
+     * @param  'exportForCustomer'|'exportForUser'  $method
+     */
+    private function safeExport(PersonalDataProvider $provider, string $method, CustomerSubject|UserSubject $subject): ProviderExportResult
+    {
+        try {
+            return $provider->{$method}($subject);
+        } catch (Throwable $e) {
+            Log::error("Privacy provider {$provider->name()}::{$method}() threw during export", [
+                'provider' => $provider->name(),
+                'exception' => $e,
+            ]);
+
+            return new ProviderExportResult($provider->name(), [], $e->getMessage());
+        }
+    }
+}

src/Privacy/Listeners/CancelErasureOnLoginListener.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Modules\Core\Privacy\Listeners;
+
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Logging back in during a pending erasure request's grace period IS the "I
+ * changed my mind" action (same pattern as Shopify's own account-deletion flow).
+ * Authentication itself is never blocked by deactivation — the OTP check in
+ * UserOtpService::validate() already passed by the time this fires — only what
+ * happens to the account afterward: any pending request is cancelled and the
+ * login block lifted (see PrivacyService::cancelErasure()).
+ *
+ * Only checks this User's own erasure request, not any Customer-scoped one
+ * directly — a Customer-scoped erasure never deactivates a User's login at all
+ * (see docs/privacy.md "User-scope vs Customer-scope"), so there is nothing for a
+ * login to reactivate on that side. Only a User-scoped request (keyed on this
+ * User's own id) can have deactivated this login in the first place.
+ *
+ * If cancelling that request undoes it, this also reverts every Customer
+ * erasure request it caused (via Modules\Core\Privacy\Listeners\
+ * CascadeCustomerErasureListener — see DataErasureRequest::caused()). Those are
+ * traced by caused_by_request_id specifically so only the cascade THIS User's
+ * own request triggered is reverted, never an unrelated, independently-requested
+ * Customer erasure the User happens to be linked to.
+ *
+ * Queued (ShouldQueue) — login should return to the browser quickly, without
+ * waiting on this bookkeeping. Nothing else in this codebase currently reads
+ * deactivated_at except this listener and PrivacyService itself (grep before
+ * assuming otherwise, if that ever changes) — UserOtpService::validate() never
+ * gates the login on it — so a brief window between the login response and this
+ * job actually running has no other consumer to observe it as stale.
+ */
+class CancelErasureOnLoginListener implements ShouldQueue
+{
+    public function __construct(private readonly PrivacyService $privacyService) {}
+
+    public function handle(UserAuthenticated $event): void
+    {
+        $request = DataErasureRequest::where('subject_type', $event->user->getMorphClass())
+            ->where('subject_id', $event->user->id)
+            ->where('status', ErasureRequestStatus::Pending)
+            ->latest()
+            ->first();
+
+        if (! $request) {
+            return;
+        }
+
+        $this->privacyService->cancelErasure($request);
+
+        foreach ($request->caused as $causedRequest) {
+            $this->privacyService->cancelErasure($causedRequest);
+        }
+    }
+}

src/Privacy/Listeners/CascadeCustomerErasureListener.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace Modules\Core\Privacy\Listeners;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Lunar\Base\LunarUser;
+use Lunar\Models\Customer;
+use Modules\Core\Privacy\Events\UserErasureRequested;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * When a User's erasure leaves a Customer account with no remaining User at all,
+ * that Customer's PII (name, addresses, order history) becomes permanently
+ * unreachable through any login — GDPR data minimization (Art. 5(1)(c)) means it
+ * shouldn't just sit there. This listener checks every Customer the User is
+ * linked to: if this User is currently the SOLE user on that Customer (count ===
+ * 1 and that one user is this user — not just count === 1, in case of a
+ * stale/unexpected read), it also opens a grace-period Customer erasure request
+ * for that Customer, tagged via caused_by_request_id so
+ * CancelErasureOnLoginListener can revert exactly this cascade — and only this
+ * cascade — if the User logs back in and changes their mind.
+ *
+ * Queued (ShouldQueue), not synchronous — this runs as an independent,
+ * separately-retryable unit of work rather than inline inside
+ * PrivacyService::requestErasureForUser(), so a failure here never rolls back or
+ * blocks the User's own request. Because Eloquent models on a queued event are
+ * re-fetched fresh when the job actually runs (not a stale snapshot from dispatch
+ * time — see Illuminate\Queue\SerializesModels), $event->request->subject and its
+ * ->customers reflect the real, current state at execution time. That matters
+ * specifically for the immediate-erasure path (requestImmediateErasureForUser()):
+ * this job may run before or after completeErasure() detaches the User's
+ * memberships — if the detach happens first, ->customers is simply empty by the
+ * time this runs and nothing cascades, which is an accepted, understood race for
+ * that rare staff-triggered path (see docs/privacy.md). The everyday grace-period
+ * path (requestErasureForUser()) has no such race, since nothing detaches the
+ * User's memberships until its own later, separate completeErasure() run.
+ *
+ * Both requests then run through their own independent grace periods.
+ */
+class CascadeCustomerErasureListener implements ShouldQueue
+{
+    public function __construct(private readonly PrivacyService $privacyService) {}
+
+    public function handle(UserErasureRequested $event): void
+    {
+        $user = $event->request->subject;
+
+        if (! $user) {
+            return;
+        }
+
+        foreach ($user->customers as $customer) {
+            if ($this->isSoleUser($customer, $user)) {
+                $this->privacyService->requestErasureForCustomer($customer, $user, causedByRequestId: $event->request->id);
+            }
+        }
+    }
+
+    private function isSoleUser(Customer $customer, Authenticatable&LunarUser $user): bool
+    {
+        return $customer->users->count() === 1 && $customer->users->first()->id === $user->id;
+    }
+}

src/Privacy/Listeners/WriteExportToCsvListener.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace Modules\Core\Privacy\Listeners;
+
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Storage;
+use Modules\Core\Export\CsvColumn;
+use Modules\Core\Export\CsvWriter;
+use Modules\Core\Privacy\Events\PersonalDataExportFileWritten;
+use Modules\Core\Privacy\Events\PersonalDataGathered;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+use ZipArchive;
+
+/**
+ * Turns a PersonalDataGathered event's ExportReport into one CSV per
+ * provider, zipped together, using the generic Modules\Core\Export\CsvWriter — kept
+ * as its own listener (not inline in ExportDataSubjectJob) so the export *format*
+ * is swappable (e.g. an app could unregister this and register its own JSON-only
+ * listener) without touching how the data is gathered.
+ *
+ * Column schema: every provider's data is either a list of associative arrays
+ * (rows directly) or a single associative array (one row) — see the providers
+ * registered in config('core.privacy.providers'), each living in its own owning
+ * module's Privacy/ subdirectory (e.g. Modules\Core\Order\Privacy\
+ * OrderDataProvider), all of which return exactly one of those two shapes. Any
+ * nested array value within a row (e.g. an order's `addresses`) is
+ * JSON-encoded into that one cell rather than exploded into further columns —
+ * CsvWriter's generic stringify() behavior, not special-cased here.
+ */
+class WriteExportToCsvListener
+{
+    public function __construct(private readonly CsvWriter $writer) {}
+
+    public function handle(PersonalDataGathered $event): void
+    {
+        $disk = Storage::disk('local');
+        $exportDir = $disk->path('exports/privacy');
+
+        if (! is_dir($exportDir)) {
+            mkdir($exportDir, 0755, true);
+        }
+
+        $stamp = now()->format('Y_m_d_His');
+        $zipPath = "{$exportDir}/export_{$event->request->id}_{$stamp}.zip";
+
+        $zip = new ZipArchive;
+        $zip->open($zipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE);
+
+        foreach ($event->report->results as $result) {
+            $csvPath = "{$exportDir}/{$result->provider}_{$stamp}.csv";
+
+            $this->writer->write($this->columnsFor($result->data), $this->rowsFor($result->data), $csvPath);
+
+            $zip->addFile($csvPath, "{$result->provider}.csv");
+        }
+
+        $zip->close();
+
+        foreach ($event->report->results as $result) {
+            @unlink("{$exportDir}/{$result->provider}_{$stamp}.csv");
+        }
+
+        $event->request->update([
+            'status' => ExportRequestStatus::Completed,
+            'file_path' => $zipPath,
+            'completed_at' => now(),
+        ]);
+
+        Event::dispatch(new PersonalDataExportFileWritten($event->request));
+    }
+
+    /**
+     * @return array<int, mixed>
+     */
+    private function rowsFor(array $data): array
+    {
+        // A list of records (addresses, orders, reviews) -> those are the rows.
+        // A single associative record (customer) -> one row.
+        return array_is_list($data) ? $data : [$data];
+    }
+
+    /**
+     * @return array<int, CsvColumn>
+     */
+    private function columnsFor(array $data): array
+    {
+        $sample = array_is_list($data) ? ($data[0] ?? []) : $data;
+
+        return array_map(
+            fn (string $key) => new CsvColumn($key, fn (array $row) => $row[$key] ?? null),
+            array_keys($sample)
+        );
+    }
+}

src/Privacy/Models/DataErasureRequest.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace Modules\Core\Privacy\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+use Lunar\Models\Customer;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+
+/**
+ * A pending, cancelled, or completed right-of-erasure request — the grace-period
+ * record between "subject/staff asked for this" and "providers actually erased
+ * their data" (see Modules\Core\Privacy\Services\PrivacyService, which creates/processes
+ * these).
+ *
+ * `subject` is polymorphic — either a Lunar Customer (business account) or a User
+ * (individual), never both. See docs/privacy.md "User-scope vs Customer-scope" for
+ * why these are two genuinely different operations with different blast radii,
+ * not one "erase this customer and cascade to their users" flow.
+ *
+ * `requestedBy` is separately polymorphic (the subject themselves, self-service,
+ * or Staff acting on their behalf), stored as plain type+id columns rather than
+ * morphs() since it's always exactly one of those two concrete actor types.
+ */
+class DataErasureRequest extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'status' => ErasureRequestStatus::class,
+        'scheduled_for' => 'datetime',
+        'cancelled_at' => 'datetime',
+        'completed_at' => 'datetime',
+        'report' => 'array',
+    ];
+
+    public function subject(): MorphTo
+    {
+        return $this->morphTo(__FUNCTION__, 'subject_type', 'subject_id');
+    }
+
+    public function requestedBy(): MorphTo
+    {
+        return $this->morphTo(__FUNCTION__, 'requested_by_type', 'requested_by_id');
+    }
+
+    /**
+     * The User erasure request that caused this one to be auto-created, if any —
+     * see Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener.
+     */
+    public function causedBy(): BelongsTo
+    {
+        return $this->belongsTo(self::class, 'caused_by_request_id');
+    }
+
+    /**
+     * Every Customer erasure request THIS request caused (see causedBy()) —
+     * used by CancelErasureOnLoginListener to revert exactly the cascade this
+     * User's own cancellation should undo.
+     */
+    public function caused(): HasMany
+    {
+        return $this->hasMany(self::class, 'caused_by_request_id');
+    }
+
+    public function isForCustomer(): bool
+    {
+        return $this->subject_type === (new Customer)->getMorphClass();
+    }
+
+    public function isPending(): bool
+    {
+        return $this->status === ErasureRequestStatus::Pending;
+    }
+
+    public function isDue(): bool
+    {
+        return $this->isPending() && $this->scheduled_for->isPast();
+    }
+
+    /**
+     * A human-readable label for whichever record `$morphable` resolves to
+     * (Customer, User, or Staff — the three concrete types that appear across
+     * subject/requestedBy), since each uses a different name field and there's
+     * no shared interface for it. Falls back to "#id" if the record is gone
+     * (e.g. a Customer erased since this request completed) or the relation is
+     * simply empty.
+     */
+    public static function displayNameFor(mixed $morphable): string
+    {
+        if (! $morphable) {
+            return '—';
+        }
+
+        return match (true) {
+            isset($morphable->full_name) => $morphable->full_name,
+            isset($morphable->name) => $morphable->name,
+            isset($morphable->first_name) => trim("{$morphable->first_name} {$morphable->last_name}"),
+            default => "#{$morphable->getKey()}",
+        };
+    }
+}

src/Privacy/Models/DataExportRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Modules\Core\Privacy\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+use Lunar\Models\Customer;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+
+/**
+ * A right-of-access export request. Created synchronously (fast — one insert), then
+ * ExportDataSubjectJob (queued) does the actual work of gathering every registered
+ * provider's data and, via Modules\Core\Privacy\Listeners\WriteExportToCsvListener,
+ * writing it to a file. file_path is null until that completes.
+ *
+ * `subject` is polymorphic — either a Lunar Customer (business account) or a User
+ * (individual), never both. See docs/privacy.md "User-scope vs Customer-scope".
+ */
+class DataExportRequest extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'status' => ExportRequestStatus::class,
+        'completed_at' => 'datetime',
+    ];
+
+    public function subject(): MorphTo
+    {
+        return $this->morphTo(__FUNCTION__, 'subject_type', 'subject_id');
+    }
+
+    public function isForCustomer(): bool
+    {
+        return $this->subject_type === (new Customer)->getMorphClass();
+    }
+}

src/Privacy/RelationManagers/ErasureRequestsRelationManager.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace Modules\Core\Privacy\RelationManagers;
+
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Filament\Resources\DataErasureRequestResource;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Lists erasure requests where the record being viewed (Customer or User) is the
+ * subject — scoped via the Customer::erasureRequests()/{User}::erasureRequests()
+ * morphMany macros registered in CorePlugin. Read-mostly, same as
+ * DataErasureRequestResource itself — no create here either, requests are opened
+ * via PrivacyService (see CustomerErasureActionsExtension for the Customer-page
+ * entry point).
+ */
+class ErasureRequestsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'erasureRequests';
+
+    protected static ?string $title = 'Erasure Requests';
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('id')
+            ->columns([
+                TextColumn::make('id')
+                    ->label('#'),
+                TextColumn::make('status')
+                    ->badge()
+                    ->formatStateUsing(fn (ErasureRequestStatus $state) => ucfirst($state->value))
+                    ->color(fn (ErasureRequestStatus $state) => match ($state) {
+                        ErasureRequestStatus::Pending => 'warning',
+                        ErasureRequestStatus::Cancelled => 'gray',
+                        ErasureRequestStatus::Completed => 'success',
+                    }),
+                TextColumn::make('requestedBy')
+                    ->label('Requested by')
+                    ->state(fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy)),
+                TextColumn::make('scheduled_for')
+                    ->label('Scheduled for')
+                    ->dateTime(),
+                TextColumn::make('caused_by_request_id')
+                    ->label('Cascade')
+                    ->formatStateUsing(fn (?int $state) => $state ? "from #{$state}" : '—'),
+                TextColumn::make('created_at')
+                    ->label('Requested at')
+                    ->dateTime(),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('status')
+                    ->options([
+                        ErasureRequestStatus::Pending->value => 'Pending',
+                        ErasureRequestStatus::Cancelled->value => 'Cancelled',
+                        ErasureRequestStatus::Completed->value => 'Completed',
+                    ]),
+            ])
+            ->headerActions([])
+            ->recordActions([
+                ViewAction::make()
+                    ->url(fn (DataErasureRequest $record) => DataErasureRequestResource::getUrl('view', ['record' => $record])),
+                Action::make('cancel')
+                    ->label('Cancel')
+                    ->icon('heroicon-o-x-circle')
+                    ->color('danger')
+                    ->requiresConfirmation()
+                    ->visible(fn (DataErasureRequest $record) => $record->isPending())
+                    ->action(fn (DataErasureRequest $record, PrivacyService $privacyService) => $privacyService->cancelErasure($record)),
+            ]);
+    }
+}

src/Privacy/RelationManagers/ExportRequestsRelationManager.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Modules\Core\Privacy\RelationManagers;
+
+use Filament\Actions\ViewAction;
+use Filament\Actions\Action;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+use Modules\Core\Privacy\Filament\Resources\DataExportRequestResource;
+use Modules\Core\Privacy\Models\DataExportRequest;
+
+/**
+ * Lists export requests where the record being viewed (Customer or User) is the
+ * subject — scoped via the Customer::exportRequests()/{User}::exportRequests()
+ * morphMany macros registered in CorePlugin. See
+ * ErasureRequestsRelationManager for the erasure-side equivalent.
+ */
+class ExportRequestsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'exportRequests';
+
+    protected static ?string $title = 'Export Requests';
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('id')
+            ->columns([
+                TextColumn::make('id')
+                    ->label('#'),
+                TextColumn::make('status')
+                    ->badge()
+                    ->formatStateUsing(fn (ExportRequestStatus $state) => ucfirst($state->value))
+                    ->color(fn (ExportRequestStatus $state) => match ($state) {
+                        ExportRequestStatus::Pending => 'warning',
+                        ExportRequestStatus::Failed => 'danger',
+                        ExportRequestStatus::Completed => 'success',
+                    }),
+                TextColumn::make('created_at')
+                    ->label('Requested at')
+                    ->dateTime(),
+                TextColumn::make('completed_at')
+                    ->label('Completed at')
+                    ->dateTime(),
+            ])
+            ->defaultSort('created_at', 'desc')
+            ->filters([
+                SelectFilter::make('status')
+                    ->options([
+                        ExportRequestStatus::Pending->value => 'Pending',
+                        ExportRequestStatus::Completed->value => 'Completed',
+                        ExportRequestStatus::Failed->value => 'Failed',
+                    ]),
+            ])
+            ->headerActions([])
+            ->recordActions([
+                ViewAction::make()
+                    ->url(fn (DataExportRequest $record) => DataExportRequestResource::getUrl('view', ['record' => $record])),
+                Action::make('download')
+                    ->label('Download')
+                    ->icon('heroicon-o-arrow-down-tray')
+                    ->visible(fn (DataExportRequest $record) => $record->status === ExportRequestStatus::Completed && $record->file_path && file_exists($record->file_path))
+                    ->action(fn (DataExportRequest $record) => response()->download($record->file_path)),
+            ]);
+    }
+}

src/Privacy/RelationManagers/UserRelationManager.php

@@ -0,0 +1,112 @@
+<?php
+
+namespace Modules\Core\Privacy\RelationManagers;
+
+use Filament\Actions\Action;
+use Filament\Forms\Components\Checkbox;
+use Filament\Infolists\Components\RepeatableEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Notifications\Notification;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Modules\Core\Customer\RelationManagers\UserRelationManager as CoreUserRelationManager;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Services\PrivacyService;
+
+/**
+ * Extends core's own Customer -> User relation manager to add:
+ *   - a "Privacy Requests" row action, since a User's erasure/export requests
+ *     can't be shown as a nested relation manager two levels deep (Customer ->
+ *     User -> Requests isn't a shape Filament relation managers support) — a
+ *     modal listing that specific User's requests is the practical alternative.
+ *   - a "Request Erasure" row action — the User-scoped panel entry point,
+ *     mirroring Modules\Core\Privacy\Filament\Extensions\
+ *     CustomerErasureActionsExtension on the Customer side, including the same
+ *     "erase immediately" checkbox for a staff-triggered urgent request.
+ * See docs/privacy.md "User-scope vs Customer-scope".
+ */
+class UserRelationManager extends CoreUserRelationManager
+{
+    public function getDefaultTable(Table $table): Table
+    {
+        $table = parent::getDefaultTable($table);
+
+        return $table->recordActions([
+            ...$table->getActions(),
+            Action::make('privacyRequests')
+                ->label('Privacy Requests')
+                ->icon('heroicon-o-shield-exclamation')
+                ->modalHeading(fn (Model $record) => "Privacy requests for {$record->name}")
+                ->modalSubmitAction(false)
+                ->modalCancelActionLabel('Close')
+                ->schema(fn (Model $record) => $this->requestsInfolist($record)),
+            Action::make('requestErasure')
+                ->label('Request Erasure')
+                ->icon('heroicon-o-shield-exclamation')
+                ->color('danger')
+                ->requiresConfirmation()
+                ->modalDescription('Opens a cancellable grace-period erasure request for this individual — deactivates their login and detaches them from every linked Customer account once it completes. No Customer account\'s own data is affected.')
+                ->schema([
+                    Checkbox::make('immediate')
+                        ->label('Erase immediately (skip the 30-day grace period)')
+                        ->helperText('Staff-only, for a formal legal request or regulator inquiry that genuinely requires urgency — not a routine deletion. Runs synchronously, cannot be cancelled once submitted.')
+                        ->default(false),
+                ])
+                ->action(function (Model $record, array $data) {
+                    $privacyService = app(PrivacyService::class);
+                    $staff = auth('staff')->user();
+
+                    if ($data['immediate']) {
+                        $privacyService->requestImmediateErasureForUser($record, $staff);
+
+                        Notification::make()
+                            ->title('User erased')
+                            ->body('Erasure ran immediately — see the Erasure Requests list for the outcome.')
+                            ->success()
+                            ->send();
+
+                        return;
+                    }
+
+                    $privacyService->requestErasureForUser($record, $staff);
+
+                    Notification::make()
+                        ->title('Erasure requested')
+                        ->body('The grace period starts now, and this user\'s login is deactivated immediately — see the Erasure Requests list.')
+                        ->success()
+                        ->send();
+                }),
+        ]);
+    }
+
+    private function requestsInfolist(Model $record): array
+    {
+        return [
+            TextEntry::make('erasure_heading')
+                ->label('')
+                ->state('Erasure Requests'),
+            RepeatableEntry::make('erasureRequests')
+                ->label('')
+                ->state(fn () => $record->erasureRequests()->latest()->get())
+                ->schema([
+                    TextEntry::make('status')->formatStateUsing(fn ($state) => ucfirst($state->value)),
+                    TextEntry::make('scheduled_for')->dateTime(),
+                    TextEntry::make('requestedBy')->label('Requested by')->state(
+                        fn (DataErasureRequest $record) => DataErasureRequest::displayNameFor($record->requestedBy)
+                    ),
+                ])
+                ->columns(3),
+            TextEntry::make('export_heading')
+                ->label('')
+                ->state('Export Requests'),
+            RepeatableEntry::make('exportRequests')
+                ->label('')
+                ->state(fn () => $record->exportRequests()->latest()->get())
+                ->schema([
+                    TextEntry::make('status')->formatStateUsing(fn ($state) => ucfirst($state->value)),
+                    TextEntry::make('created_at')->label('Requested at')->dateTime(),
+                ])
+                ->columns(2),
+        ];
+    }
+}

src/Privacy/Services/PrivacyManager.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Modules\Core\Privacy\Services;
+
+use LogicException;
+use Illuminate\Contracts\Container\Container;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+
+/**
+ * The registry every PersonalDataProvider is collected through. A module registers
+ * by adding its provider's class name to config('core.privacy.providers') — the
+ * same shape as Lunar's own config('lunar.search.indexers') model->indexer map, just
+ * a plain list since a provider isn't keyed to one model. Core never references a
+ * specific provider class; a future ERP/banking/etc. module just adds its own
+ * provider class to that config array and PrivacyService picks it up automatically.
+ */
+class PrivacyManager
+{
+    public function __construct(private readonly Container $container) {}
+
+    /**
+     * @return array<int, PersonalDataProvider>
+     */
+    public function providers(): array
+    {
+        $providers = array_map(
+            fn (string $class) => $this->container->make($class),
+            config('core.privacy.providers', [])
+        );
+
+        $this->assertUniqueNames($providers);
+
+        return $providers;
+    }
+
+    /**
+     * @param  array<int, PersonalDataProvider>  $providers
+     */
+    private function assertUniqueNames(array $providers): void
+    {
+        $names = array_map(fn (PersonalDataProvider $provider) => $provider->name(), $providers);
+        $duplicates = array_diff_assoc($names, array_unique($names));
+
+        if ($duplicates !== []) {
+            throw new LogicException(
+                'Duplicate Modules\Core\Privacy provider name(s): '.implode(', ', array_unique($duplicates))
+                .'. Each provider registered in config(\'core.privacy.providers\') must return a unique name().'
+            );
+        }
+    }
+}

src/Privacy/Services/PrivacyService.php

@@ -0,0 +1,321 @@
+<?php
+
+namespace Modules\Core\Privacy\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
+use Lunar\Base\LunarUser;
+use Lunar\Models\Customer;
+use Modules\Core\Auth\Models\Staff;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\DTOs\ErasureReport;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\Enums\ErasureRequestStatus;
+use Modules\Core\Privacy\Enums\ExportRequestStatus;
+use Modules\Core\Privacy\Events\UserErasureRequested;
+use Modules\Core\Privacy\Jobs\ExportDataSubjectJob;
+use Modules\Core\Privacy\Models\DataErasureRequest;
+use Modules\Core\Privacy\Models\DataExportRequest;
+use Throwable;
+
+/**
+ * Entry point for right-of-access and right-of-erasure requests, split into two
+ * independent scopes — see docs/privacy.md "User-scope vs Customer-scope":
+ *
+ *   - *ForCustomer(): erases/exports one business account's own data (orders,
+ *     addresses, the account record itself). Never touches any linked User's
+ *     login or personal identity — a Customer erasure request must not deactivate
+ *     or destroy access for anyone who works there.
+ *   - *ForUser(): erases/exports one individual's own identity (login, name,
+ *     email) wherever it appears, and detaches them from every Customer account
+ *     they're linked to as part of erasure — without touching any Customer
+ *     account's own data or any other User still linked to it.
+ *
+ * A Customer (business account) can have many linked Users, and one User can be
+ * linked to many Customer accounts (B2B multi-seat access — see docs/modules.md
+ * "Customer/User Pairing"), so these are genuinely different operations with
+ * different blast radii, not one flow with an optional cascade.
+ *
+ * Both directions are handled as requests, not immediate synchronous actions:
+ * requestExport*() queues the (potentially slow) work of gathering every
+ * provider's data and writing a file, rather than blocking whatever triggered it.
+ * requestErasure*() opens a cancellable grace-period request (deactivating the
+ * account for a User-scoped request only — see below) — the same shape as
+ * Shopify's own account-deletion flow: a window where the subject can change
+ * their mind before anything is actually erased.
+ */
+class PrivacyService
+{
+    public function __construct(private readonly PrivacyManager $manager) {}
+
+    /**
+     * Creates a DataExportRequest (fast — one insert) and dispatches
+     * ExportDataSubjectJob to do the actual gathering/writing work. The job fires
+     * PersonalDataGathered once every provider's data is collected;
+     * Modules\Core\Privacy\Listeners\WriteExportToCsvListener turns that into a file
+     * and fires PersonalDataExportFileWritten — a consuming app registers its own
+     * notification against that event (see docs/privacy.md).
+     */
+    public function requestExportForCustomer(Customer $customer): DataExportRequest
+    {
+        return $this->createExportRequest($customer->getMorphClass(), $customer->id, null);
+    }
+
+    public function requestExportForUser(Authenticatable&LunarUser $user): DataExportRequest
+    {
+        return $this->createExportRequest($user->getMorphClass(), $user->id, $user->email);
+    }
+
+    private function createExportRequest(string $subjectType, int $subjectId, ?string $email): DataExportRequest
+    {
+        $request = DataExportRequest::create([
+            'subject_type' => $subjectType,
+            'subject_id' => $subjectId,
+            'email' => $email,
+            'status' => ExportRequestStatus::Pending,
+        ]);
+
+        ExportDataSubjectJob::dispatch($request);
+
+        return $request;
+    }
+
+    /**
+     * Opens a grace-period erasure request for the Customer's own data. Deactivates
+     * NO User — erasing a business account must not destroy anyone's login access,
+     * even the account's own primary contact. Nothing is actually erased until
+     * privacy:process-erasure-requests picks this up once scheduled_for has
+     * passed, unless cancelErasure() is called first.
+     *
+     * $requestedBy is the Customer themselves (self-service deletion), a Staff
+     * member acting on their behalf, or a User — the User case is for
+     * Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener, where erasing
+     * a User leaves a Customer with no remaining user: the User is a real,
+     * meaningful "who caused this," even though they didn't directly request the
+     * Customer's own erasure. $causedByRequestId links a cascade-created request
+     * back to the User erasure request that triggered it, so
+     * CancelErasureOnLoginListener can revert exactly that cascade on login,
+     * without touching an unrelated, independently-requested Customer erasure.
+     */
+    public function requestErasureForCustomer(
+        Customer $customer,
+        Customer|Staff|(Authenticatable&LunarUser) $requestedBy,
+        ?int $causedByRequestId = null,
+    ): DataErasureRequest {
+        return DataErasureRequest::create([
+            'subject_type' => $customer->getMorphClass(),
+            'subject_id' => $customer->id,
+            'email' => null,
+            'requested_by_type' => $requestedBy->getMorphClass(),
+            'requested_by_id' => $requestedBy->getKey(),
+            'status' => ErasureRequestStatus::Pending,
+            'scheduled_for' => now()->addDays(config('core.privacy.grace_period_days', 30)),
+            'caused_by_request_id' => $causedByRequestId,
+        ]);
+    }
+
+    /**
+     * Opens a grace-period erasure request for one individual and deactivates
+     * their login immediately (blocks it — see Modules\Core\Auth\Services\
+     * UserOtpService — without touching any Customer account's data). $requestedBy
+     * is either the User themselves (self-service deletion) or a Staff member
+     * acting on their behalf.
+     */
+    public function requestErasureForUser(Authenticatable&LunarUser $user, (Authenticatable&LunarUser)|Staff $requestedBy): DataErasureRequest
+    {
+        $request = DataErasureRequest::create([
+            'subject_type' => $user->getMorphClass(),
+            'subject_id' => $user->id,
+            'email' => $user->email,
+            'requested_by_type' => $requestedBy->getMorphClass(),
+            'requested_by_id' => $requestedBy->getKey(),
+            'status' => ErasureRequestStatus::Pending,
+            'scheduled_for' => now()->addDays(config('core.privacy.grace_period_days', 30)),
+        ]);
+
+        $this->setUserDeactivated($user->id, true);
+
+        // CascadeCustomerErasureListener implements ShouldQueue, so this just
+        // enqueues a job rather than running inline — no transaction wrapping
+        // needed here, since the cascade check happens as an independent,
+        // separately-retryable unit of work after this request is already
+        // committed, not as part of this same call.
+        Event::dispatch(new UserErasureRequested($request));
+
+        return $request;
+    }
+
+    /**
+     * Erases a Customer's data right now, bypassing the grace period entirely.
+     * Staff-only by construction — $requestedBy is typed to Staff specifically,
+     * so a self-service/customer-facing code path cannot reach this method at
+     * all, only accidentally call it with the wrong actor type and get a
+     * compile-time error. This exists for a formal legal request or regulator
+     * inquiry that genuinely requires immediate action — not a convenience
+     * option for an impatient customer. The grace period is deliberately not
+     * skippable from any customer-facing flow; see docs/privacy.md.
+     */
+    public function requestImmediateErasureForCustomer(Customer $customer, Staff $requestedBy): ErasureReport
+    {
+        $request = DataErasureRequest::create([
+            'subject_type' => $customer->getMorphClass(),
+            'subject_id' => $customer->id,
+            'email' => null,
+            'requested_by_type' => $requestedBy->getMorphClass(),
+            'requested_by_id' => $requestedBy->getKey(),
+            'status' => ErasureRequestStatus::Pending,
+            'scheduled_for' => now(),
+        ]);
+
+        return $this->completeErasure($request);
+    }
+
+    /**
+     * Erases a User's data right now, bypassing the grace period entirely.
+     * Staff-only by construction — see requestImmediateErasureForCustomer().
+     *
+     * Still fires UserErasureRequested — and deliberately BEFORE completeErasure()
+     * runs, not after — so Modules\Core\Privacy\Listeners\
+     * CascadeCustomerErasureListener sees the User still linked to their Customers
+     * (completeErasure() -> CustomerDataProvider::eraseForUser() is what detaches
+     * the pivot). The User's own erasure is immediate, but any Customer left
+     * orphaned by it still gets a normal grace-period erasure request, not an
+     * immediate one — an orphaned Customer isn't itself the subject of the
+     * original urgent request.
+     */
+    public function requestImmediateErasureForUser(Authenticatable&LunarUser $user, Staff $requestedBy): ErasureReport
+    {
+        $request = DataErasureRequest::create([
+            'subject_type' => $user->getMorphClass(),
+            'subject_id' => $user->id,
+            'email' => $user->email,
+            'requested_by_type' => $requestedBy->getMorphClass(),
+            'requested_by_id' => $requestedBy->getKey(),
+            'status' => ErasureRequestStatus::Pending,
+            'scheduled_for' => now(),
+        ]);
+
+        $this->setUserDeactivated($user->id, true);
+
+        // Queued (see requestErasureForUser()) — the cascade job may run before
+        // or after completeErasure() below detaches the pivot. Either is fine:
+        // CascadeCustomerErasureListener re-reads $user->customers fresh when it
+        // runs, so it only cascades if this User is still linked at that point.
+        // If completeErasure() detaches first, the queued job simply finds no
+        // Customers left to check and no-ops — never a wrong cascade, at worst a
+        // missed one on a race that immediate (staff-triggered, rare) erasure
+        // doesn't need to guard against as tightly as the grace-period path.
+        Event::dispatch(new UserErasureRequested($request));
+
+        return $this->completeErasure($request);
+    }
+
+    /**
+     * Cancels a pending request. For a User-scoped request, reactivates the
+     * account (see requestErasureForUser()). A Customer-scoped request never
+     * deactivated anything, so there's nothing to reactivate for it. No-op
+     * (returns false) if the request isn't pending — e.g. already completed or
+     * cancelled.
+     */
+    public function cancelErasure(DataErasureRequest $request): bool
+    {
+        if (! $request->isPending()) {
+            return false;
+        }
+
+        $request->update([
+            'status' => ErasureRequestStatus::Cancelled,
+            'cancelled_at' => now(),
+        ]);
+
+        if (! $request->isForCustomer()) {
+            $this->setUserDeactivated($request->subject_id, false);
+        }
+
+        return true;
+    }
+
+    /**
+     * Actually erases the data for a due request: runs every registered
+     * provider's *ForCustomer() or *ForUser() method (whichever matches the
+     * request's subject), records the outcome on the request, and marks it
+     * completed. Called by privacy:process-erasure-requests — not meant to be
+     * called directly for a request that hasn't passed its grace period, since
+     * that defeats the point of the window; ProcessErasureRequestsCommand
+     * enforces isDue() before calling this.
+     *
+     * Each provider call is caught individually — a provider throwing (a bug,
+     * an unexpected DB state) converts to ErasureOutcome::Failed rather than
+     * aborting the whole array_map, so one broken provider never discards
+     * every OTHER provider's already-completed erasure for this same request.
+     * Without this, the $request->update() below would never run at all on a
+     * throw, silently leaving providers that already succeeded unrecorded and
+     * the request stuck Pending forever. Logged via Log::error() so a thrown
+     * provider is still visible to staff, not just swallowed into "Failed."
+     */
+    public function completeErasure(DataErasureRequest $request): ErasureReport
+    {
+        if ($request->isForCustomer()) {
+            $subject = new CustomerSubject(customerId: $request->subject_id);
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeErase($provider, 'eraseForCustomer', $subject),
+                $this->manager->providers()
+            );
+        } else {
+            $subject = new UserSubject(userId: $request->subject_id, email: $request->email);
+            $results = array_map(
+                fn (PersonalDataProvider $provider) => $this->safeErase($provider, 'eraseForUser', $subject),
+                $this->manager->providers()
+            );
+        }
+
+        $report = new ErasureReport($subject, $results);
+
+        $request->update([
+            'status' => ErasureRequestStatus::Completed,
+            'completed_at' => now(),
+            'report' => array_map(
+                fn (ProviderErasureResult $result) => [
+                    'provider' => $result->provider,
+                    'outcome' => $result->outcome->value,
+                    'reason' => $result->reason,
+                ],
+                $results
+            ),
+        ]);
+
+        return $report;
+    }
+
+    private function setUserDeactivated(int $userId, bool $deactivated): void
+    {
+        $model = config('auth.providers.users.model');
+
+        /** @var class-string<Model> $model */
+        $model::where('id', $userId)->update([
+            'deactivated_at' => $deactivated ? now() : null,
+        ]);
+    }
+
+    /**
+     * @param  'eraseForCustomer'|'eraseForUser'  $method
+     */
+    private function safeErase(PersonalDataProvider $provider, string $method, CustomerSubject|UserSubject $subject): ProviderErasureResult
+    {
+        try {
+            return $provider->{$method}($subject);
+        } catch (Throwable $e) {
+            Log::error("Privacy provider {$provider->name()}::{$method}() threw during erasure", [
+                'provider' => $provider->name(),
+                'exception' => $e,
+            ]);
+
+            return new ProviderErasureResult($provider->name(), ErasureOutcome::Failed, $e->getMessage());
+        }
+    }
+}

src/Providers/CoreServiceProvider.php

@@ -5,11 +5,13 @@ namespace Modules\Core\Providers;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\ServiceProvider;
 use Modules\Core\Command\AnonymizeCommand;
+use Modules\Core\Command\BackfillMissingSkusCommand;
 use Modules\Core\Command\ExportCleanupCommand;
 use Modules\Core\Command\ExportCommand;
 use Modules\Core\Command\ImportCommand;
 use Modules\Core\Command\InstallLunarCommand;
 use Modules\Core\Command\MigrateImportCommand;
+use Modules\Core\Command\ProcessErasureRequestsCommand;
 use Modules\Core\Command\TuneProductSearchCommand;
 
 class CoreServiceProvider extends ServiceProvider
@@ -24,6 +26,7 @@ class CoreServiceProvider extends ServiceProvider
         $this->loadViewsFrom(__DIR__ . '/../../resources/views', 'core');
         Blade::anonymousComponentPath(__DIR__ . '/../../resources/views', 'core');
         $this->loadMigrationsFrom(__DIR__ . '/../../database/migrations');
+        $this->loadTranslationsFrom(__DIR__ . '/../../lang', 'core');
 
         $this->publishes([
             __DIR__ . '/../../config/core.php' => config_path('core.php'),
@@ -36,10 +39,10 @@ class CoreServiceProvider extends ServiceProvider
         ], 'core-assets');
 
         if ($this->app->runningInConsole()) {
-            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class, TuneProductSearchCommand::class]);
+            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class, TuneProductSearchCommand::class, BackfillMissingSkusCommand::class, ProcessErasureRequestsCommand::class]);
 
             //Overriding lunar:install
-            $this->app->booted(fn () => $this->commands([InstallLunarCommand::class]));
+            $this->app->booted(fn() => $this->commands([InstallLunarCommand::class]));
         }
     }
 }

src/Providers/CustomerServiceProvider.php

@@ -7,7 +7,12 @@ use Illuminate\Support\ServiceProvider;
 use Lunar\Facades\ModelManifest;
 use Lunar\Models\Contracts\Customer as LunarCustomer;
 use Modules\Core\Auth\Events\UserCreated;
+use Modules\Core\Customer\Events\CustomerAddressCreated;
+use Modules\Core\Customer\Events\CustomerAddressDeleted;
+use Modules\Core\Customer\Events\CustomerAddressUpdated;
+use Modules\Core\Customer\Events\CustomerProfileUpdated;
 use Modules\Core\Customer\Listeners\CreateCustomerForUser;
+use Modules\Core\Customer\Listeners\LogCustomerAccountActivity;
 use Modules\Core\Customer\Models\Customer;
 
 class CustomerServiceProvider extends ServiceProvider
@@ -17,5 +22,10 @@ class CustomerServiceProvider extends ServiceProvider
         ModelManifest::replace(LunarCustomer::class, Customer::class);
 
         Event::listen(UserCreated::class, CreateCustomerForUser::class);
+
+        Event::listen(CustomerAddressCreated::class, [LogCustomerAccountActivity::class, 'handleAddressCreated']);
+        Event::listen(CustomerAddressUpdated::class, [LogCustomerAccountActivity::class, 'handleAddressUpdated']);
+        Event::listen(CustomerAddressDeleted::class, [LogCustomerAccountActivity::class, 'handleAddressDeleted']);
+        Event::listen(CustomerProfileUpdated::class, [LogCustomerAccountActivity::class, 'handleProfileUpdated']);
     }
 }

src/Providers/PrivacyServiceProvider.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Privacy\Events\PersonalDataGathered;
+use Modules\Core\Privacy\Events\UserErasureRequested;
+use Modules\Core\Privacy\Listeners\CancelErasureOnLoginListener;
+use Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener;
+use Modules\Core\Privacy\Listeners\WriteExportToCsvListener;
+
+class PrivacyServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        Event::listen(UserAuthenticated::class, CancelErasureOnLoginListener::class);
+        Event::listen(PersonalDataGathered::class, WriteExportToCsvListener::class);
+        Event::listen(UserErasureRequested::class, CascadeCustomerErasureListener::class);
+    }
+}

src/Providers/ShippingServiceProvider.php

@@ -27,6 +27,7 @@ use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
 use Modules\Core\Shipping\Filament\Pages\ManageShippingRates;
 use Modules\Core\Shipping\Jobs\PollShipmentTrackingJob;
 use Modules\Core\Shipping\Listeners\InvalidateShippingOptions;
+use Modules\Core\Shipping\Support\FulfillmentType;
 use Modules\Core\Shipping\Models\Shipment;
 
 class ShippingServiceProvider extends ServiceProvider
@@ -80,8 +81,10 @@ class ShippingServiceProvider extends ServiceProvider
         // resolveCarrier() for the same lookup pattern already used to
         // resolve a carrier driver from it).
         //
-        // Reads ShippingMethod.data['fulfillment_type'] directly rather
-        // than through a ShippingMethod::macro('isStorePickup', ...) —
+        // Resolves via Modules\Core\Shipping\Support\FulfillmentType (driver-
+        // declared for acs/box-now, merchant-configured data['fulfillment_type']
+        // fallback for table-rate-shipping's generic drivers) rather than
+        // through a ShippingMethod::macro('isStorePickup', ...) —
         // Lunar\Base\Traits\HasModelExtending::__callStatic() (used by
         // Lunar\Shipping\Models\ShippingMethod via Lunar\Base\BaseModel)
         // intercepts EVERY unmatched static call, including macro()
@@ -91,8 +94,7 @@ class ShippingServiceProvider extends ServiceProvider
         // false. (Lunar\Models\Order is unaffected because it declares
         // its own macro() method directly, bypassing __callStatic
         // entirely — that's why Order::macro('isStorePickupOrder', ...)
-        // below still works.) Defaults to 'carrier' (false) for any row
-        // saved before this field existed.
+        // below still works.)
         Order::macro('isStorePickupOrder', function () {
             /** @var Order $this */
             $code = $this->shippingAddress?->shipping_option;
@@ -108,7 +110,7 @@ class ShippingServiceProvider extends ServiceProvider
             // attribute avoids that entirely.
             $method = ShippingMethod::where('code', $code)->first();
 
-            return ($method?->data['fulfillment_type'] ?? 'carrier') === 'store_pickup';
+            return $method && FulfillmentType::isStorePickup($method);
         });
 
         foreach ([CartLineAdded::class, CartLineUpdated::class, CartLineRemoved::class, CartCleared::class, ShippingAddressSet::class] as $event) {

src/Review/Privacy/ReviewDataProvider.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Modules\Core\Review\Privacy;
+
+use Illuminate\Database\Eloquent\Builder;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+use Modules\Core\Review\Models\ProductReview;
+
+/**
+ * ProductReview (product_reviews) has no FK to Customer/User at all — it's
+ * deliberately anonymous, just free-text reviewer_name/reviewer_email (see
+ * docs/product-listing.md "Reviews"). A review is authored by an individual, not a
+ * business account, so this is User-scope only — matched best-effort by email
+ * against UserSubject::$email.
+ *
+ * NEEDS REVIEW: moved from Customer-scope to User-scope during the User/Customer
+ * split (see docs/privacy.md "User-scope vs Customer-scope") on the reasoning that
+ * authorship is a personal attribute — but this hasn't been fully validated against
+ * how reviews are actually attributed in this codebase; revisit before relying on
+ * it for a real erasure/export request.
+ *
+ * Matching by email is itself a real, documented limitation regardless of scope: a
+ * review submitted under a different email than the one on file won't be found.
+ * There's no stronger signal available without changing ProductReview's schema.
+ */
+class ReviewDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'reviews';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('reviews', []);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        if (! $subject->email) {
+            return new ProviderExportResult('reviews', []);
+        }
+
+        $reviews = $this->matchingReviews($subject->email)->get();
+
+        return new ProviderExportResult('reviews', $reviews->map(fn (ProductReview $review) => [
+            'id' => $review->id,
+            'product_id' => $review->product_id,
+            'title' => $review->title,
+            'body' => $review->body,
+            'rating' => $review->rating,
+            'reviewer_name' => $review->reviewer_name,
+            'reviewer_email' => $review->reviewer_email,
+            'reviewed_at' => $review->reviewed_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('reviews', ErasureOutcome::Skipped, 'Reviews are authored by individuals, not Customer accounts.');
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        if (! $subject->email) {
+            return new ProviderErasureResult('reviews', ErasureOutcome::Skipped, 'No email on this subject to match reviews by.');
+        }
+
+        $matched = $this->matchingReviews($subject->email)->count();
+
+        if ($matched === 0) {
+            return new ProviderErasureResult('reviews', ErasureOutcome::Skipped, 'No reviews matched this email.');
+        }
+
+        // The review content itself (rating/title/body) is kept — it's the
+        // reviewer's own product feedback, not identity data on its own — only
+        // the identifying fields are cleared.
+        $this->matchingReviews($subject->email)->update([
+            'reviewer_name' => 'Anonymous',
+            'reviewer_email' => null,
+        ]);
+
+        return new ProviderErasureResult(
+            'reviews',
+            ErasureOutcome::Pseudonymized,
+            'Reviewer name/email cleared on reviews matched by email; rating/title/body text retained.'
+        );
+    }
+
+    private function matchingReviews(string $email): Builder
+    {
+        return ProductReview::where('reviewer_email', $email);
+    }
+}

src/Shipping/Carriers/Acs/AcsRateDriver.php

@@ -10,10 +10,12 @@ use Lunar\Shipping\Models\ShippingRate;
 use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
 use Modules\Core\Shipping\Concerns\CachesLivePricing;
 use Modules\Core\Shipping\Concerns\ResolvesFixedPricing;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
 use Modules\Core\Shipping\Contracts\SupportsLivePricing;
+use Modules\Core\Shipping\Support\ShippingMethodName;
 use Modules\Core\Shipping\Support\WeightCalculator;
 
-class AcsRateDriver implements ShippingRateInterface, SupportsLivePricing
+class AcsRateDriver implements ShippingRateInterface, SupportsLivePricing, DeclaresFulfillmentType
 {
     use ResolvesFixedPricing;
     use CachesLivePricing;
@@ -30,6 +32,11 @@ class AcsRateDriver implements ShippingRateInterface, SupportsLivePricing
         return 'ACS Courier';
     }
 
+    public function fulfillmentType(): string
+    {
+        return 'carrier';
+    }
+
     public function description(): string
     {
         return 'Live rate quote from ACS Courier.';
@@ -84,7 +91,7 @@ class AcsRateDriver implements ShippingRateInterface, SupportsLivePricing
             $amount = (int) round(($response->valueOutput['Total_Ammount'] ?? 0) * 100);
 
             return new ShippingOption(
-                name: $shippingMethod->name ?: $this->name(),
+                name: ShippingMethodName::resolve($shippingMethod) ?: $this->name(),
                 description: $shippingMethod->description ?: $this->description(),
                 identifier: $shippingRate->getIdentifier(),
                 price: new Price($amount, $cart->currency, 1),

src/Shipping/Carriers/BoxNow/BoxNowRateDriver.php

@@ -7,6 +7,7 @@ use Lunar\Shipping\DataTransferObjects\ShippingOptionRequest;
 use Lunar\Shipping\Interfaces\ShippingRateInterface;
 use Lunar\Shipping\Models\ShippingRate;
 use Modules\Core\Shipping\Concerns\ResolvesFixedPricing;
+use Modules\Core\Shipping\Contracts\DeclaresFulfillmentType;
 
 /**
  * Box Now has no pricing API, so this always resolves the method's normal
@@ -14,7 +15,7 @@ use Modules\Core\Shipping\Concerns\ResolvesFixedPricing;
  * flat-rate/ship-by drivers use. Does not implement SupportsLivePricing:
  * there is no live option to offer.
  */
-class BoxNowRateDriver implements ShippingRateInterface
+class BoxNowRateDriver implements ShippingRateInterface, DeclaresFulfillmentType
 {
     use ResolvesFixedPricing;
 
@@ -25,6 +26,11 @@ class BoxNowRateDriver implements ShippingRateInterface
         return 'Box Now Locker Delivery';
     }
 
+    public function fulfillmentType(): string
+    {
+        return 'carrier';
+    }
+
     public function description(): string
     {
         return 'Deliver to a Box Now parcel locker.';