Fix: Fixing various bugs occured on payment lifecycle

This commit introduces a RecommendationService that is used when indexing products.

The service is utilizing a recommendation rules interface, so many rules can be created and applied during indexing the products

CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.12.1] - 2026-09-03
+
+### Fixed
+- `Modules\Core\MigrateImport\Shopify\ShopifyExportImporter` now attaches a variant's `Variant Image` CSV column to that `ProductVariant`'s own `images()` media pivot (`media_product_variant`, `primary`/`position`). Previously the variant image was never read at all — every image from the CSV, including ones the export clearly scopes to one specific variant, went only into the product's own top-level gallery, so a variant swatch/option change had no way to show its own photo.
+- `Modules\Core\MigrateImport\Shopify\Resolvers\ProductOptionResolver::resolveOption()` now sets `label` (same value as `name`) when creating a `Lunar\Models\ProductOption`, not just `name`. A `ProductOption` with a null `label` crashes Lunar's own `ProductOptionIndexer::toSearchableArray()` (`foreach()` on `null`) the moment that option gets reindexed — every option created by the importer before this fix has a null `label` and needs a wipe-and-reimport (see `docs/shopify-reimport.md`, new in this release) to pick up the fix, since `firstOrCreate()` never revisits an already-existing row.
+- `product_reviews.product_id`'s foreign key had no `ON DELETE` clause, so deleting a reviewed `Product` threw a constraint violation instead of the review going with it, unlike every other product-dependent table. New migration adds `cascadeOnDelete()`.
+
+### Added
+- `Modules\Core\Catalog\Services\ProductIndexer::mapVariant()` now embeds `gtin`, `mpn`, `ean`, `backorder`, `unit_quantity`, `shippable`, `tax_ref`, and `dimensions` (length/width/height/weight/volume, each with `value`+`unit`) on every indexed variant — previously only `id`/`sku`/`stock`/`purchasable`/`options`/`prices`/`media` were embedded, so a search result or filter needing any of these had no way to get at them without a separate Postgres query per variant.
+- `ProductIndexer::toSearchableArray()` adds a top-level, filterable `skus` field (every variant's SKU, deduplicated) — filtering/matching by SKU no longer requires reaching into the nested `variants` array.
+- `docs/shopify-reimport.md` — runbook for wiping every imported product (cascading through Lunar so Meilisearch documents go too) and re-running the importer from scratch, needed whenever a fix like the two above only takes effect on newly-created rows.
+
+## [0.12.0] - 2026-09-03
+
+### Changed
+- **Breaking:** `Modules\Core\Catalog\Services\ProductService::list()` now returns `Modules\Core\Catalog\DTOs\ProductListingResult` (`->products`: the same `Illuminate\Pagination\LengthAwarePaginator` as before, `->priceBounds`: a new `Modules\Core\Catalog\DTOs\PriceSliderBounds`) instead of returning the paginator directly. A caller doing `$service->list(...)->items()`/`->through(...)` must update to `$service->list(...)->products->items()`/`->through(...)`. This collapses what used to be two separate calls a controller had to orchestrate itself (`list()` for products, `priceRange()` + manual floor/ceil/"is this actually filtered" math for the slider) into one.
+- **Breaking:** `Modules\Core\Catalog\Services\ProductSearchService::search()`'s signature changed from `search(string $query, ?string $locale = null)` to `search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null)` — the `$locale` parameter is gone (see "every configured language, always" below); `$filters`/`$sort` apply the same `Modules\Core\Catalog\Support\ProductFilterBuilder`/`ProductSort::toMeilisearchSort()` semantics `ProductService::list()` already used, so a text search can now be narrowed by price/brand/stock and sorted the same way a category listing can.
+- `ProductSearchService` now targets every configured store language's fields on every search (`Lunar\Models\Language::all()`), not just the current request locale plus the store's default language. The old `{current, default}` pairing silently stopped catching anything outside those two locales whenever they were equal (a single-language store, or a shopper browsing in the default language) — always searching every configured language closes that gap in both directions. See `docs/product-search.md`.
+- Extracted `Modules\Core\Catalog\Services\ProductService`'s private `buildFilter()` into a new standalone `Modules\Core\Catalog\Support\ProductFilterBuilder`, so `ProductSearchService` can apply the exact same Meilisearch filter-clause semantics to a text query, instead of reimplementing filter-building a second time.
+
+### Added
+- `Modules\Core\Catalog\Services\ProductService::priceSliderBounds()` — `priceRange()` rounded to whole currency units (floor/ceil) plus whether the given selected min/max actually narrows it, returned as a `PriceSliderBounds` DTO. Used internally by `list()` now; also callable directly for a caller (e.g. a text-search results page) that needs slider bounds without a full `list()` call.
+- `Modules\Core\Catalog\Services\ProductService::priceRange()` gained an optional `string $query = ''` parameter, so a caller can scope the price range to a text search's own matches (pass the shopper's search text) instead of always spanning the whole catalog.
+- `Modules\Core\Catalog\Services\ProductService::random(int $limit)` — random products still scoped to the Meilisearch index's own channel/status visibility, unlike a raw `Product::inRandomOrder()` (which has no notion of that filtering). Meilisearch has no `ORDER BY RANDOM()` equivalent, so this fetches every matching id only (`attributesToRetrieve: ['id']`), shuffles in PHP, then fetches the full localized documents for just the ids picked, restoring the shuffled order afterward (Meilisearch's `id IN [...]` filter doesn't preserve list order on its own).
+- `Modules\Core\Catalog\Services\ProductService::variantSummaries(array $product)` — the id/price/image of every variant on a product document, for a variant picker/swatch list, without a caller reaching into `$product['variants'][n]['prices'][0]`/`['media'][0]` itself.
+- `Modules\Core\Catalog\Services\ProductSearchService::search()` now also targets `variants.options.value` — a variant's own option value (e.g. "Κάπτεν Γαμέρικα" on a "Name" option) is matchable by search even when that text never appears in the product's own name or description.
+- `php artisan lunar:meilisearch:tune-product-search` (`Modules\Core\Command\TuneProductSearchCommand`) — tightens `minWordSizeForTypos` (1 typo only at 8+ characters, 2 typos only at 12+) and disables Meilisearch's `prefixSearch` on the product index. Meilisearch's defaults for both were loose enough to produce bad matches on short Greek words (confirmed the specific case was `prefixSearch`'s default `indexingTime` behavior on a shared word-start, not typo tolerance, via `showMatchesPosition`). Consuming apps should run this after `lunar:meilisearch:setup` whenever the product index needs (re)provisioning — **requires Meilisearch v1.12+** (`prefixSearch` didn't exist as a configurable setting before then).
+
+## [0.11.1] - 2026-09-01
+
+### Fixed
+- `Modules\Core\Catalog\Services\RecommendationService::recommend()` built its result with the base `Illuminate\Support\Collection` (`collect()`) instead of `Illuminate\Database\Eloquent\Collection`, even though every element is a `Product` model. `ProductIndexer::toSearchableArray()` calling `->load(['media', 'variants.prices'])` on that result threw `BadMethodCallException: Method Illuminate\Support\Collection::load does not exist` — silently failing every `MakeSearchable` queue job for a saved product (visible only as `FAIL` in the queue log, with the real exception in `storage/logs/laravel.log`). Fixed by having `RecommendationService` accumulate into a real `Eloquent\Collection` from the start.
+
+## [0.11.0] - 2026-09-01
+
+### Added
+- `Modules\Core\Catalog\Services\RecommendationService` — computes "related products" for a given product as a configurable, ordered chain of strategies (`config('catalog.recommendation_rules')`), not one hardcoded rule. Tops up from each successive rule until the limit (default 4) is reached or every rule is exhausted — e.g. 3 products from a same-category rule plus 1 from a random fallback — deduplicated across rules so the same product is never returned twice. Ships with `Modules\Core\Catalog\Recommendations\SameCategoryRule` (other products sharing the source product's first collection) and `RandomRule` (the universal fallback, placed last in the default chain). A new rule is just a class implementing `Modules\Core\Catalog\Contracts\RecommendationRule`. Documented in `docs/product-recommendations.md`.
+- `Modules\Core\Catalog\Services\ProductIndexer` embeds the result directly into each product's own Meilisearch document as `recommendations: [{id, name, price, image}, ...]` (`recommendations.id` filterable) — a product detail page renders its "related products" section with zero extra queries, same reasoning as the existing `collections` field. Deliberately embeds an `id` for the view to build a locale-correct URL from, not a resolved `href` — `product.show` is locale-prefixed, so a URL baked in at index time would only be correct for whichever locale happened to be active during that index run.
+- `Modules\Core\Catalog\Events\ProductSaved`/`ProductDeleted`, dispatched from `Product::saved()`/`Product::deleted()` in `CatalogServiceProvider` (the latter fires for both a soft delete and a force delete, matching Scout's own `unsearchable()` trigger point) — feed `Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct`, which reverse-searches Meilisearch for every product currently recommending the changed/deleted one (`recommendations.id = "..."` — there's no Postgres relation for this, a recommendation only exists inside the index) and re-indexes them via Scout's own `->searchable()`. Product creation is deliberately not hooked into this: a new product not yet appearing as a recommendation elsewhere is an accepted staleness window, the same tradeoff already documented for `in_stock`/`price` — see `docs/product-recommendations.md`.
+- `CatalogServiceProvider` schedules `lunar:search:index "Lunar\Models\Product" --refresh` daily at 03:00 — a safety net on top of the event-driven reindexing above, covering a newly-created product not yet appearing as a recommendation and any other drift already accepted between reindexes. `--refresh` also re-syncs filterable/sortable index settings, not just documents.
+
 ## [0.10.1] - 2026-09-01
 
 ### Added

composer.json

@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.10.1",
+  "version": "0.12.1",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"
@@ -42,7 +42,8 @@
         "Modules\\Core\\Providers\\CatalogServiceProvider",
         "Modules\\Core\\Providers\\CartServiceProvider",
         "Modules\\Core\\Providers\\ReviewServiceProvider",
-        "Modules\\Core\\Providers\\ShippingServiceProvider"
+        "Modules\\Core\\Providers\\ShippingServiceProvider",
+        "Modules\\Core\\Providers\\OrderServiceProvider"
       ]
     }
   },

config/catalog.php

@@ -0,0 +1,25 @@
+<?php
+
+use Modules\Core\Catalog\Recommendations\RandomRule;
+use Modules\Core\Catalog\Recommendations\SameCategoryRule;
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Product recommendation rules
+    |--------------------------------------------------------------------------
+    |
+    | Tried in order by Modules\Core\Catalog\Services\RecommendationService —
+    | the first rule that returns at least one product wins. The order here IS
+    | the fallback chain: SameCategoryRule first, then RandomRule as a
+    | last-resort so a product page is never left with zero recommendations
+    | (as long as the store has more than one product). A consuming app can
+    | reorder, add, or remove rules freely — nothing about the chain shape is
+    | hardcoded in the service itself.
+    |
+    */
+    'recommendation_rules' => [
+        SameCategoryRule::class,
+        RandomRule::class,
+    ],
+];

config/payment.php

@@ -14,18 +14,20 @@ return [
     | Lunar's own config.
     |
     | 'payment_driver' is boboko-owned, alongside Lunar's own 'driver' key —
-    | it's the Modules\Core\Checkout\Contracts\PaymentDriver class
+    | the driver instance Modules\Core\Payment\Services\PaymentDriverResolver
-    | CheckoutService::confirmPayment() resolves via the container and calls
+    | resolves via the container. 'capture_mode' ('pay' or 'authorize') is
-    | confirm() on. Kept on the same row as 'driver' rather than a second,
+    | also boboko-owned — which contract method
-    | separately-keyed map, so a type's full definition — Lunar's driver,
+    | CheckoutService::initiatePayment() calls for this type. Kept on the
-    | its config, and its PaymentDriver — lives in one place.
+    | same row as 'driver' rather than a second, separately-keyed map, so a
+    | type's full definition lives in one place.
     |
     */
     'types' => [
         'cash-on-delivery' => [
             'driver' => 'offline',
             'payment_driver' => OfflinePaymentDriver::class,
-            'authorized' => 'awaiting-payment',
+            'capture_mode' => 'pay',
+            'captured_status' => 'payment-offline',
             'fee' => 0,
         ],
     ],

database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php

@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * product_reviews.product_id's original foreign key (2026_07_10_000001) had
+ * no ON DELETE clause, so deleting a Product with reviews throws a
+ * constraint violation instead of the review rows going with it — unlike
+ * every other Product-dependent table (variants, media, etc.), which does
+ * cascade. A review is dependent, disposable data, not something worth
+ * blocking a product deletion over.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->dropForeign(['product_id']);
+        });
+
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->foreign('product_id')
+                ->references('id')
+                ->on(config('lunar.database.table_prefix').'products')
+                ->cascadeOnDelete();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->dropForeign(['product_id']);
+        });
+
+        Schema::table('product_reviews', function (Blueprint $table) {
+            $table->foreign('product_id')
+                ->references('id')
+                ->on(config('lunar.database.table_prefix').'products');
+        });
+    }
+};

database/migrations/2026_09_03_000002_add_context_to_stripe_payment_intents.php

@@ -0,0 +1,47 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Lunar\Base\Migration;
+
+/**
+ * lunarphp/stripe's own stripe_payment_intents table already correlates a
+ * Stripe intent back to a cart/order via cart_id/order_id — exactly what
+ * Modules\Core\Payment\Drivers\StripePaymentDriver needs to recover
+ * $context in handleCallback(), a separate request (a webhook) from the
+ * pay()/authorize() call that originated it. Two columns this driver
+ * needs that the vendor table doesn't have:
+ *   - context: the full opaque $context bag pay()/authorize() received,
+ *     stored so handleCallback() can dispatch the SAME context the
+ *     original call would have, without Payment inventing its own
+ *     correlation table — see docs/payments.md "Async resolution".
+ *   - payment_type: the payment type key (e.g. 'stripe') pay()/authorize()
+ *     were called with — needed to dispatch Payment events with the
+ *     correct $type in handleCallback(), which otherwise has no way to
+ *     know it (a webhook payload doesn't carry it).
+ *
+ * Extends Lunar\Base\Migration (not the plain base Migration) so $this->prefix
+ * resolves the SAME table-prefix config every Lunar-owned table uses
+ * (config('lunar.database.table_prefix')) — the vendor migration that
+ * creates this table (lunarphp/stripe's create_stripe_payment_intents_table)
+ * already does this, so a store running with a non-default prefix (this
+ * one runs with 'lunar_') would otherwise have this migration fail against
+ * a table name that doesn't exist.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->json('context')->nullable()->after('status');
+            $table->string('payment_type')->nullable()->after('context');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->dropColumn(['context', 'payment_type']);
+        });
+    }
+};

docs/payments.md

@@ -0,0 +1,189 @@
+# Payment — Design Notes
+
+**Status: abstraction layer built, drivers/wiring in progress.** `Payment` is designed as a
+standalone module: it never calls into `Checkout` or `Order`, never touches their Eloquent
+models, and communicates only via events. This document is the design spec for that
+abstraction — contracts, DTOs, events — independent of how `Checkout`/`Order` end up consuming
+it (that wiring is a separate, later pass).
+
+---
+
+## Operations, not gateways
+
+The driver contracts model the actual operations a payment gateway can perform, not vendor
+terminology. Every real gateway checked while designing this converges on the same small set
+under different names:
+
+| Operation | Mastercard | Stripe | Nexi |
+|---|---|---|---|
+| Atomic charge (authorize+capture in one call) | `Pay` | `capture_method: automatic` | `ActionType::PAY()` |
+| Hold only, settle/release later | `Authorize` | `capture_method: manual` | `ActionType::PREAUTH()` |
+| Settle a prior hold | `Capture` | `PaymentIntent::capture()` | `CaptureRequest`/`CaptureResponse` |
+| Release a prior hold without settling | `Void`/`Cancel` | `PaymentIntent::cancel()` | `CancelRequest`/`CancelResponse` |
+| Reverse settled funds | `Refund` | `Refund::create()` | (refund endpoint) |
+
+A driver implements only the interfaces its gateway actually supports:
+
+- An offline/cash type (`cash-on-delivery`, `cash-in-hand`) only ever settles atomically —
+  implements `SupportsPay` alone.
+- A card gateway capable of either mode per-transaction (Stripe, most card processors)
+  implements `SupportsPay`, `SupportsAuthorization`, `SupportsCaptures`, `SupportsVoids`, and
+  `SupportsRefunds` all at once — which one gets *called* for a given attempt is the caller's
+  policy choice (e.g. `config('lunar.stripe.policy')`), not something baked into the driver's
+  shape.
+- A redirect/wallet gateway with no separate hold step (Viva/Klarna in typical flows)
+  implements `SupportsPay` and `SupportsRefunds`, never `SupportsCaptures`/`SupportsVoids`.
+
+### `pay()` and `authorize()` stay separate methods even when a gateway implements both as "the same call with a flag"
+
+Stripe has no separate `authorize`/`pay` API endpoints — one `PaymentIntent`, confirmed with
+either `capture_method: automatic` or `manual`. Mastercard and Nexi *do* have genuinely
+separate operations. The contract abstracts over both shapes uniformly: every driver capable
+of both exposes two distinct methods, `pay()` and `authorize()`. A Mastercard-style driver
+calls two different endpoints under the hood; a Stripe-style driver calls the same endpoint
+twice with a different flag each time. Neither difference is visible to a caller.
+
+### `capture()`/`void()` are only ever valid against a prior `authorize()`
+
+They are not standalone operations — `capture()` settles a specific hold identified by the
+`reference` `authorize()` returned; `void()` releases that same hold instead. A driver that
+never implements `SupportsAuthorization` never produces a reference either of these methods
+could act on.
+
+---
+
+## `PaymentResult` — the one return shape, every operation, every driver
+
+```php
+enum PaymentResultStatus { case Succeeded; case Failed; case Pending; }
+
+final class PaymentResult {
+    public function __construct(
+        public readonly PaymentResultStatus $status,
+        public readonly string $reference,
+        public readonly int $amount,
+        public readonly ?string $failureReason = null,
+        public readonly bool $retriable = false,
+        public readonly array $raw = [],
+        public readonly array $meta = [],
+    ) {}
+}
+```
+
+Real gateway responses vary wildly in richness — confirmed by reading three SDKs directly:
+
+- **Stripe's `PaymentIntent`** is rich: `status`, `amount`, `amount_capturable`,
+  `amount_received`, `last_payment_error`, a full `getLastResponse()`.
+- **Nexi's `CaptureResponse`/`CancelResponse`** are minimal: just `operationId` +
+  `operationTime` — no echoed amount or status at all. Success is inferred from getting a
+  response rather than an SDK exception.
+- **Mastercard's** gateway sits in between, with `gatewayCode`/`acquirerCode`/
+  `merchantAdviceCode`.
+
+`PaymentResult` only requires what every driver can always know: `status`, `reference`,
+`amount` (the amount **we** requested — not necessarily echoed back by a sparse gateway like
+Nexi's capture). Everything else is best-effort: `failureReason`/`retriable` are normalized
+only when the gateway has something to normalize from; `raw` is the unconditional escape
+hatch — the untouched gateway response body, always populated, for genuine audit fidelity
+regardless of how sparse the normalized fields ended up.
+
+### `retriable` — real on some gateways, absent on others
+
+Stripe classifies declines as soft (`do_not_honor`, `insufficient_funds` — worth retrying,
+after a delay) vs. hard (`stolen_card`, `expired_card` — never retry the same method).
+Mastercard has the equivalent via `authorizationResponse.merchantAdviceCode` and card-scheme
+soft-decline codes. **Nexi has no such signal at all** — `OperationResult` is just
+`DECLINED`/`DENIED_BY_RISK`/`FAILED`/etc. with no retriability classification. `retriable`
+therefore defaults to `false` (assume not safely retriable) rather than guessing when a
+driver's gateway has nothing to base it on.
+
+---
+
+## Events — one terminal pair per operation, keyed to the business fact, not the call path
+
+`Modules\Core\Payment\Events`:
+
+| Event pair | Dispatched by |
+|---|---|
+| `PaymentAuthorized` / `PaymentAuthorizationFailed` | `SupportsAuthorization::authorize()`, or a later `HandlesPaymentCallback::handleCallback()` resolving it |
+| `PaymentCaptured` / `PaymentCaptureFailed` | `SupportsPay::pay()` **or** `SupportsCaptures::capture()` |
+| `PaymentVoided` / `PaymentVoidFailed` | `SupportsVoids::void()` |
+| `PaymentRefunded` / `PaymentRefundFailed` | `SupportsRefunds::refund()` |
+
+`PaymentCaptured` is deliberately the *same* event whether money was taken via `pay()` (one
+gateway call) or `authorize()` → `capture()` (two calls) — "a payment has been captured" is
+the same business fact either way, and a listener reacting to it never needs to know which
+path produced it. There is no separate "payment succeeded" wrapper event distinct from
+`PaymentCaptured`.
+
+Every event carries `{type: string, result: PaymentResult, context: array}`. `Payment` has no
+concept of a `Cart`, an `Order`, or a checkout fingerprint — `$context` is an opaque bag the
+caller hands in on the way down (`pay($type, $data, $context)`) and gets back untouched on
+whichever event that call (or a later `handleCallback()`) produces. Each listener interprets
+`$context` on its own terms, or ignores the event if the keys it needs aren't present —
+`Checkout` is only one possible consumer of these events, not the only one.
+
+---
+
+## Async resolution — `HandlesPaymentCallback`
+
+Only implemented by a driver whose `pay()`/`authorize()` can return `PaymentResultStatus::Pending`
+— a redirect the shopper completes elsewhere, a webhook that arrives later. A driver whose
+gateway always resolves synchronously never implements this.
+
+```php
+public function handleCallback(string $reference, array $data, array $context = []): PaymentResult;
+```
+
+Resolves into the *same* event pair the original `pay()`/`authorize()` call would have
+produced had it resolved synchronously.
+
+### The correlation problem: `handleCallback()` runs in a different request
+
+`$context` passed into the original `pay()`/`authorize()` call does not survive to
+`handleCallback()` on its own — that call is typically a separate HTTP request (a webhook)
+with no memory of the request that started the payment. Something has to persist enough to
+answer "which order/cart does gateway reference X belong to?" between the two calls.
+
+**Read directly from `lunarphp/stripe`'s own source** (`StripePaymentType::authorize()`,
+`ProcessStripeWebhook`, `WebhookController`) to see how Lunar itself solves this — confirmed
+it does **not** stash a generic opaque blob. It writes the correlating ids as real, typed
+columns on `Lunar\Stripe\Models\StripePaymentIntent` (`cart_id`, `order_id`) at the moment the
+intent is created/first seen, then reads them back the same way when the webhook arrives:
+
+```php
+// ProcessStripeWebhook::handle() — falls back through two real lookups,
+// neither of them a generic context blob:
+$cart = StripePaymentIntent::where('intent_id', $this->paymentIntentId)->first()?->cart
+    ?: Cart::where('meta->payment_intent', '=', $this->paymentIntentId)->first();
+```
+
+**`StripePaymentDriver` follows this exact precedent**: it reads `cart_id`/`order_id` out of
+`$context` at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent`
+row (a table already owned by `lunarphp/stripe`, already shaped for exactly this), then reads
+them back the same way in `handleCallback()`. No generic `context` json column, no new table.
+
+### This pattern is per-driver, not a shared table
+
+`stripe_payment_intents` is Stripe-specific — keyed on `intent_id`, typed around
+`Stripe\PaymentIntent`'s own status values. It cannot be reused as-is for a future non-Stripe
+async driver (Nexi, Viva): that driver's own gateway reference has a different shape entirely,
+and shoehorning it into Stripe-named columns would make the table misleading. The **pattern**
+generalizes — *any* driver needing async callback resolution owns a small table keyed by its
+own gateway's reference, storing whatever correlation data that driver specifically needs —
+but each driver gets its own table, matching what it actually needs to correlate, rather than
+a shared generic one.
+
+---
+
+## Explicitly out of scope for this pass
+
+- **`Checkout`/`Order` wiring** — how `Checkout` calls into `Payment`, how `Order`/`Checkout`
+  react to `Payment`'s events, where a draft `Order` gets created relative to when `Payment` is
+  called. Deliberately designed and built separately, after `Payment` itself was complete —
+  `Payment` must stand on its own regardless of what ends up consuming it.
+- **`Transaction` persistence** — Lunar's own `transactions` table (`type`: `intent`/`capture`/
+  `refund`, `parent_transaction_id` chaining) already models the audit trail these events
+  would feed, once a listener is built to write to it. `Payment` itself does not write
+  `Transaction` rows — see the events table above; that is a listener's job, in whichever
+  module ends up owning the write (likely `Order`, since `Transaction.order_id` is required).

docs/product-listing.md

@@ -1,8 +1,9 @@
 # Product Listing
 
 `Modules\Core\Catalog\Services\ProductService` provides catalog browsing/filtering AND single-product
-lookup for a storefront — `list()`, `getById()`, `getBySlug()` — all reading directly from the
+lookup for a storefront — `list()`, `getById()`, `getBySlug()`, `random()`, `variantSummaries()` —
-Meilisearch index rather than the database. One data source for everything this service does.
+all reading directly from the Meilisearch index rather than the database. One data source for
+everything this service does.
 
 This is separate from `Modules\Core\Catalog\Services\ProductSearchService` (see `product-search.md`), which
 handles free-text query search. `ProductService` is for browsing/lookup without a search term.
@@ -28,13 +29,14 @@ use Modules\Core\Catalog\Enums\ProductSort;
 
 $service = app(ProductService::class);
 
-// List everything, paginated — returns a real Illuminate\Pagination\LengthAwarePaginator,
+// One call for everything a listing page needs — products AND the price slider's
-// built from the localized Meilisearch hits (not Scout's own paginateRaw() result — see
+// bounds together, as a Modules\Core\Catalog\DTOs\ProductListingResult. A caller
-// "Meilisearch driver quirk" below), so it behaves like any other Laravel paginator.
+// used to have to call list() and priceSliderBounds() (or the older priceRange())
-$products = $service->list(perPage: 24, page: 1);
+// separately and glue the results together itself; that's now list()'s own job.
+$listing = $service->list(perPage: 24, page: 1);
 
 // Filter by collection, brand, price range, and/or stock
-$products = $service->list(
+$listing = $service->list(
     filters: new ProductFilters(collectionId: 17, minPrice: 10.0, maxPrice: 50.0, inStockOnly: true),
     perPage: 24,
     page: 1,
@@ -42,8 +44,13 @@ $products = $service->list(
 
 // Sort — cheapest/priciest first, or newest first. Omit for Meilisearch's default
 // relevance ordering (irrelevant here since the query is always empty).
-$products = $service->list(perPage: 24, page: 1, sort: ProductSort::PriceAsc);
+$listing = $service->list(perPage: 24, page: 1, sort: ProductSort::PriceAsc);
 
+$products = $listing->products;  // a real Illuminate\Pagination\LengthAwarePaginator,
+                                  // built from the localized Meilisearch hits (not Scout's
+                                  // own paginateRaw() result — see "Meilisearch driver
+                                  // quirk" below), so it behaves like any other Laravel
+                                  // paginator.
 $products->items();            // array of Meilisearch documents (plain arrays, not models)
 $products->total();
 $products->perPage();
@@ -51,12 +58,32 @@ $products->currentPage();
 $products->lastPage();
 $products->links();            // in a Blade view — renders pagination links as usual
 
+$bounds = $listing->priceBounds;  // Modules\Core\Catalog\DTOs\PriceSliderBounds
+$bounds->floor;    // ?int — floor() of the matching range's minimum, in whole currency units
+$bounds->ceil;     // ?int — ceil() of the matching range's maximum
+$bounds->filtered; // bool — whether the applied filters' minPrice/maxPrice actually
+                   // narrow the slider below/above these bounds (drives whether a
+                   // "clear filter" control should show)
+
 // Single product, by primary key
 $product = $service->getById(367);   // array, or null if not found
 
 // Single product, by URL slug (any locale — slugs are indexed across all languages)
 $product = $service->getBySlug('erotika-mprelok');   // array, or null if not found
 
+// $limit random products — still scoped to the index's own default channel/status
+// visibility, unlike Eloquent's Product::inRandomOrder() (which has no notion of
+// that filtering at all). Meilisearch has no ORDER BY RANDOM() equivalent, so this
+// pulls every matching id only, shuffles in PHP, then fetches the full localized
+// documents for just the ids picked — see random()'s own docblock.
+$randomProducts = $service->random(13);   // array of documents, same shape as list()'s items
+
+// The id/price/image of every variant on a product document — the base price and
+// thumbnail a variant picker/swatch list needs, without reaching into
+// $product['variants'][n]['prices'][0]/['media'][0] yourself.
+$variants = $service->variantSummaries($product);
+// [['id' => 1204, 'price' => 19.99, 'image' => 'https://.../thumb.jpg'], ...]
+
 // Facet counts for a sidebar — value => matching product count, scoped to whatever
 // $filters is passed. Does NOT exclude the faceted field itself from $filters — see
 // facets()'s docblock for why, and how to build a standard "every option's count,
@@ -64,11 +91,13 @@ $product = $service->getBySlug('erotika-mprelok');   // array, or null if not fo
 $brandCounts = $service->facets('brand', filters: new ProductFilters(collectionId: 17));
 // ['3Dealer.gr - 3D printed creations' => 48, 'Kraniou Topos - 3D printed creations' => 135]
 
-// Min/max price across matching products, for sizing a price-range slider.
+// Min/max price across matching products — the raw, unrounded values list() itself
-// minPrice/maxPrice are ALWAYS excluded from the filter driving this (unlike
+// uses to build priceBounds above. minPrice/maxPrice are ALWAYS excluded from the
-// facets(), which doesn't auto-exclude) — the slider's own bounds shouldn't shrink
+// filter driving this (unlike facets(), which doesn't auto-exclude) — the slider's
-// to whatever range is currently selected on it. Other filters (collectionId,
+// own bounds shouldn't shrink to whatever range is currently selected on it. Other
-// brand, inStockOnly) still apply normally.
+// filters (collectionId, brand, inStockOnly) still apply normally. Pass $query too
+// to scope the range to a text search's own matches (see product-search.md) rather
+// than the whole catalog.
 $range = $service->priceRange(new ProductFilters(collectionId: 17));
 // ['min' => 0.0, 'max' => 120.0]
 ```
@@ -77,8 +106,8 @@ All `ProductFilters` fields are optional; only the ones set are added to the Mei
 
 `facets()` only makes sense on discrete-value filterable fields (`brand`, `in_stock`) — a numeric
 field like `price` would return one "facet" per exact price, not a usable range bucket. Use
-`priceRange()` for `price` instead, which reads Meilisearch's `facetStats` (min/max), a different
+`priceRange()` (or `list()`'s own `priceBounds`) for `price` instead, which reads Meilisearch's
-feature from `facetDistribution`.
+`facetStats` (min/max), a different feature from `facetDistribution`.
 
 ---
 
@@ -106,11 +135,12 @@ needs, listing and detail alike:
 | `collections` | `$product->collections` | Array of `{id, name}` — directly assigned collections only, `name` is the translated collection name. Not filterable — see `collection_ids`. |
 | `collection_ids` | `$product->collections` + `->ancestors` | Filterable. Flat array of every directly-assigned collection's id, unioned with all of its ancestors' ids. `ProductFilters(collectionId: ...)` filters against this field, not `collections`, since products are typically attached only to leaf collections — a plain direct-match filter would never return anything for a parent/root category page. |
 | `slugs` | `$product->urls->pluck('slug')` | Filterable. Every locale's `Url::slug` for the product, so `getBySlug()` resolves purely from the index — no database read. |
+| `skus` | `$product->variants->pluck('sku')` | Filterable. Every variant's `sku`, deduplicated, empty ones dropped. Same "resolve from the index alone" reasoning as `slugs`, for a future SKU-based lookup/filter. |
 | `price` | Cheapest variant's base price | Filterable. Float in major units (e.g. `19.99`, not `1999`). Base price only — no customer group, default currency (`Currency::getDefault()`) only. `null` if the product has no priced variant yet, so it's excluded from range filters rather than treated as free. |
 | `brand` | Already indexed by Lunar's base indexer | Newly marked **filterable** — it existed in the document already, just wasn't usable in a `filter` clause. |
 | `tags` | `$product->tags->pluck('value')` | Display only. |
 | `media` | `$product->media` | Full gallery (id/url/thumb per image), not just the single thumbnail Lunar's base indexer sends. |
-| `variants` | `$product->variants` | Per variant: `id`, `sku`, `stock`, `purchasable`, `options` (option/value names, in the current locale), `prices` (per currency/customer group), `media` (variant-specific images). |
+| `variants` | `$product->variants` | Per variant: `id`, `sku`, `gtin`, `mpn`, `ean`, `stock`, `backorder`, `unit_quantity`, `purchasable`, `shippable`, `tax_ref`, `dimensions` (`length`/`width`/`height`/`weight`/`volume`, each `{value, unit}`), `options` (option/value names, in the current locale), `prices` (per currency/customer group), `media` (the variant's own images — `ProductVariant::images()`, a separate pivot from the product's own gallery above, populated by `ShopifyExportImporter` from Shopify's `Variant Image` CSV column). |
 | `reviews` | `Modules\Core\Review\Models\ProductReview` | `{items, count, average_rating}` — see "Reviews" below. |
 | `in_stock` | `$model->variants` | Filterable boolean. `true` if ANY variant currently passes `ProductVariant::canBeFulfilledAtQuantity(1)` — Lunar's own purchasability rule (`purchasable === 'always'` ignores stock entirely; `in_stock` checks `stock` alone; anything else checks `stock + backorder`). Only as fresh as the last reindex — see "Stock goes stale" below. |
 

docs/product-recommendations.md

@@ -0,0 +1,155 @@
+# Product Recommendations
+
+`Modules\Core\Catalog\Services\RecommendationService` computes "related products" for a given
+product — a same-category pick today, with a random fallback, but built as a configurable chain of
+strategies rather than one hardcoded rule. `Modules\Core\Catalog\Services\ProductIndexer` embeds
+the result directly into each product's own Meilisearch document, so a product detail page renders
+its recommendations with zero extra queries — same reasoning as `collections` (see
+`docs/product-listing.md`).
+
+---
+
+## The rule chain
+
+```php
+use Modules\Core\Catalog\Services\RecommendationService;
+
+$recommendations = app(RecommendationService::class)->recommend($product, limit: 4);
+// Illuminate\Support\Collection<int, Lunar\Models\Product>
+```
+
+`recommend()` walks `config('catalog.recommendation_rules')` in order, **topping up** from each
+successive rule until `$limit` distinct products are collected or every rule is exhausted — it does
+not stop at the first rule that returns *something*. If a product's category only has 3 other
+products, `SameCategoryRule` contributes those 3 and `RandomRule` fills the last slot. A rule is
+handed the ids already collected (`$exclude`, always including the source product's own id) so it
+never wastes its own `$limit` budget re-suggesting something already picked, and the same product
+is never returned twice even if two rules would both suggest it.
+
+Default chain (`config/catalog.php`):
+
+```php
+'recommendation_rules' => [
+    SameCategoryRule::class,   // other products sharing $product's first collection
+    RandomRule::class,          // universal fallback — always returns something as
+                                 // long as the store has more than one product
+],
+```
+
+A consuming app publishes and edits this config to reorder, add, or remove rules — nothing about
+the chain shape is hardcoded in `RecommendationService` itself. A new rule (same tag, best sellers,
+"frequently bought together", ...) is a class implementing `Modules\Core\Catalog\Contracts\
+RecommendationRule`, added to the array:
+
+```php
+interface RecommendationRule
+{
+    /**
+     * @param  array<int>  $exclude  ids to never return — the source product's own
+     *   id, plus every id an earlier rule in the chain already picked
+     * @return Collection<int, Product>  at most $limit products
+     */
+    public function recommend(Product $product, int $limit, array $exclude): Collection;
+}
+```
+
+Rules query Eloquent directly (`$product->collections->first()->products()`, `Product::query()`),
+not `Modules\Core\Catalog\Services\ProductService` — see "Why not `ProductService`" below.
+
+---
+
+## Why not `ProductService`
+
+Every other read path in `Modules\Core\Catalog` goes through `ProductService`, which reads
+Meilisearch and resolves translated fields to whatever locale the *current request* is in (see
+`docs/product-listing.md`, "Locale resolution"). Recommendation rules deliberately don't use it:
+they run inside `ProductIndexer::toSearchableArray()`, at **index time** — there is no request, no
+meaningful "current locale" to resolve against, and Meilisearch itself may be mid-write for the very
+product being indexed. Rules return raw `Lunar\Models\Product` models instead; `ProductIndexer`
+resolves what it embeds (`name` via `translateAttribute()`, `price` via the indexer's own
+`cheapestPrice()`, `image` via its own `mapMedia()`) the same way it already does for the embedded
+`collections` field — including that field's same accepted index-time-locale tradeoff (a
+recommendation's embedded `name` reflects whatever locale was active when *that* product was last
+indexed, not the viewer's current locale).
+
+---
+
+## What's embedded, and why not just an id
+
+`ProductIndexer` embeds full card data per recommendation, not just an id:
+
+```php
+$data['recommendations'] = [
+    ['id' => 42, 'name' => 'Espresso Cup', 'price' => 12.5, 'image' => 'https://.../thumb.jpg'],
+    // ...
+];
+```
+
+This shape is deliberately exactly what `x-ui.product-card`/`x-product-grid` (3dealer's storefront
+components) need — `name`, `price`, `image`, and an `id` the view resolves to a URL itself via
+`route('product.show', ['id' => $rec['id']])`. A resolved `href` is **not** embedded: `product.show`
+is locale-prefixed (`{locale}/products/{id}`), so a URL baked in at index time would be correct only
+for whichever locale happened to be active during that index run — wrong for every other locale.
+Building the URL is left to the view, which knows the current request's locale.
+
+`recommendations.id` is marked **filterable** — not for the storefront, but for the reverse-lookup
+reindexing below.
+
+---
+
+## Keeping it fresh: `ProductSaved` / `ProductDeleted`
+
+A recommendation is computed once, at index time, and embedded — it does not update itself when the
+recommended product later changes name, price, or image, or is deleted. Unlike `Modules\Core\Catalog\
+Observers\ProductOptionReindexObserver`'s equivalent problem (which product option value is used by),
+there is no Postgres relation for "which products currently recommend product X" — a recommendation
+only exists inside Meilisearch. The fix is a reverse Meilisearch filter query, not a database join,
+wired through a real event → listener pair (`Modules\Core\Providers\CatalogServiceProvider`):
+
+- `Product::saved()` dispatches `Modules\Core\Catalog\Events\ProductSaved`.
+- `Product::deleted()` dispatches `Modules\Core\Catalog\Events\ProductDeleted` — fires for both a
+  soft delete and a force delete (`Lunar\Models\Product` uses `SoftDeletes`), the same model event
+  Laravel Scout's own `ModelObserver` hooks to make a deleted product `unsearchable()`.
+- `Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct` handles both: it searches the
+  product index for `recommendations.id = "{id}"`, finds every referencing product, and calls
+  `->searchable()` on each — which recomputes their `recommendations` field fresh, picking up the
+  changed name/price/image, or (for a delete) dropping the now-gone product and topping back up to
+  the configured limit via the rule chain, same as any other reindex.
+
+`->searchable()` dispatches Scout's own reindex job, queued if `SCOUT_QUEUE` is configured — this
+listener does no synchronous Meilisearch writing itself.
+
+**Product creation is deliberately not hooked into this.** A brand-new product has no
+`recommendations` of its own until Scout's existing create-triggered indexing runs (already correct
+— nothing to add). What's *not* immediate is other products picking the new one up as a fresh
+recommendation candidate — that happens on their own next natural reindex (a save, or the nightly
+full reindex below), the same accepted staleness window `docs/product-listing.md` already documents
+for `in_stock`/`price`. A full proactive "who could now recommend this new product" pass was
+considered and rejected as unnecessary cost for a cosmetic delay.
+
+---
+
+## Nightly full reindex
+
+`Modules\Core\Providers\CatalogServiceProvider` schedules `lunar:search:index "Lunar\Models\Product"
+--refresh` daily at 03:00 — a safety net on top of the event-driven reindexing above, not a
+replacement for it. Catches what event-driven reindexing deliberately doesn't cover: a newly-created
+product not yet appearing as a recommendation elsewhere, and any other drift already accepted
+between reindexes (see `docs/product-listing.md`, "Stock goes stale between orders"). `--refresh`
+also re-syncs filterable/sortable index *settings*, not just documents, so a deploy that changed
+`ProductIndexer`'s field list self-heals overnight even if `lunar:meilisearch:setup` wasn't run
+manually right after that deploy.
+
+---
+
+## Re-syncing after this change
+
+Same as any other `ProductIndexer` field change (see `docs/product-listing.md`):
+
+```bash
+php artisan lunar:meilisearch:setup
+php artisan lunar:search:index "Lunar\Models\Product" --refresh
+```
+
+Restart the queue worker if `SCOUT_QUEUE=true` — see `docs/product-listing.md`'s "Re-syncing after
+this change" for why a running worker won't otherwise pick up the new indexer code.

docs/product-search.md

@@ -24,36 +24,62 @@ merges `$builder->options` directly into the search request).
 ## Usage
 
 ```php
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\Enums\ProductSort;
 use Modules\Core\Catalog\Services\ProductSearchService;
 
 $results = app(ProductSearchService::class)->search('running shoes');
-// or an explicit locale, bypassing App::getLocale():
+
-$results = app(ProductSearchService::class)->search('running shoes', 'el');
+// Filters/sort apply the exact same semantics ProductService::list() uses for
+// collection browsing (same ProductFilterBuilder, same ProductSort) — a shopper
+// narrowing a text search by price/brand/stock gets identical filter behavior
+// to narrowing a category listing.
+$results = app(ProductSearchService::class)->search(
+    'running shoes',
+    filters: new ProductFilters(brand: 'Acme', minPrice: 20.0, inStockOnly: true),
+    sort: ProductSort::PriceAsc,
+);
 ```
 
 Returns an `Illuminate\Database\Eloquent\Collection` of `Lunar\Models\Product` — Scout's
 `->get()` hydrates real models from the database after the Meilisearch query, so relations
 (`variants`, `brand`, `media`, etc.) are available on the results as normal.
 
-`$locale` defaults to `App::getLocale()` — already set correctly on every storefront request by
+There is no `$locale` parameter — see "Field list is dynamic, not hardcoded" below for why
-`Modules\Core\Localization\Middleware\LocaleMiddleware` (see `localization.md`), so callers in controllers
+every configured store language is always searched, regardless of the current request locale.
-don't need to pass it explicitly.
 
 ---
 
-## Missing-translation fallback
+## Missing-translation fallback, in both directions
 
 If a product was only ever given an English name, `name_el` doesn't exist on that document at
 all (Lunar's indexer only writes a `{handle}_{locale}` field for locales actually present in the
 attribute's stored data — see `ScoutIndexer::mapSearchableAttributes()`). Searching strictly
-against `name_el` would make that product invisible to Greek-locale search, even though it's a
+against the current request's locale field would make that product invisible whenever a shopper's
-real catalog item.
+locale doesn't match the language it happens to be translated into.
 
-To avoid silently hiding incompletely-translated products, `ProductSearchService` targets **both**
+`ProductSearchService` avoids this by targeting **every configured store language's fields**
-the resolved locale's fields **and** the default language's fields
+(`Lunar\Models\Language::all()`) on every search, not just the current request locale plus the
-(`Lunar\Models\Language::getDefault()->code`) — e.g. searching in `el` targets `name_el`,
+store default — e.g. with `el`/`en` configured, every search targets `name_el`, `name_en`,
-`name_en`, `description_el`, `description_en` together (assuming `en` is the default language).
+`description_el`, `description_en` together, regardless of which locale the shopper is browsing
-A product missing an `el` translation still matches via its `en` fields.
+in. This is deliberately not scoped to "current locale + default locale": if the current locale
+already equals the default (a single-language store, or a shopper browsing in the default
+language), that pairing collapses to one locale and stops catching anything else — always
+searching every configured language avoids that gap in both directions, at the cost of a larger
+`attributesToSearchOn` list as the store's language count grows.
+
+---
+
+## Variant option values are searched too
+
+Alongside the locale-suffixed attribute fields, every search also targets
+`variants.options.value` directly — e.g. a variant named "Κάπτεν Γαμέρικα" on a "Name" option
+matches a search for that text, even though it never appears in the product's own name or
+description. This isn't one of Lunar's own attributes (`AttributeManifest` has no entry for it),
+so it can't be discovered the way `name`/`description` are — it's a structural field of
+`Modules\Core\Catalog\Services\ProductIndexer`'s own document shape (see `ProductIndexer::mapVariant()`),
+added here directly. Not locale-suffixed — each option value is stored as one already-resolved
+string per variant.
 
 ---
 

docs/scratch/orders-feature-survey.html

@@ -0,0 +1,450 @@
+<title>Order Feature Survey</title>
+<style>
+  :root {
+    --paper: #FAFAF7;
+    --ink: #1C1C1A;
+    --muted: #6B6B63;
+    --accent: #2F5D50;
+    --accent-soft: #E4EDE9;
+    --good: #3F7A5C;
+    --good-soft: #E6F0EA;
+    --warn: #B8863B;
+    --warn-soft: #F5ECDC;
+    --miss: #A14B3B;
+    --miss-soft: #F5E5E0;
+    --hairline: #E4E2DB;
+    --card: #FFFFFF;
+  }
+
+  :root:not([data-theme="light"]) {
+    @media (prefers-color-scheme: dark) {
+      --paper: #17181A;
+      --ink: #EDEBE4;
+      --muted: #9B9A90;
+      --accent: #7FBFA8;
+      --accent-soft: #1E2C27;
+      --good: #6FBF97;
+      --good-soft: #1B2A22;
+      --warn: #D9A85C;
+      --warn-soft: #2C2418;
+      --miss: #D97C68;
+      --miss-soft: #2E1E1A;
+      --hairline: #2C2D2E;
+      --card: #1E1F21;
+    }
+  }
+
+  :root[data-theme="dark"] {
+    --paper: #17181A;
+    --ink: #EDEBE4;
+    --muted: #9B9A90;
+    --accent: #7FBFA8;
+    --accent-soft: #1E2C27;
+    --good: #6FBF97;
+    --good-soft: #1B2A22;
+    --warn: #D9A85C;
+    --warn-soft: #2C2418;
+    --miss: #D97C68;
+    --miss-soft: #2E1E1A;
+    --hairline: #2C2D2E;
+    --card: #1E1F21;
+  }
+
+  * { box-sizing: border-box; }
+
+  body {
+    background: var(--paper);
+    color: var(--ink);
+    font-family: "IBM Plex Sans", ui-sans-serif, system-ui, sans-serif;
+    font-size: 15.5px;
+    line-height: 1.55;
+    margin: 0;
+    padding: 4.5rem 1.5rem 6rem;
+  }
+
+  .wrap {
+    max-width: 780px;
+    margin: 0 auto;
+  }
+
+  header.page {
+    margin-bottom: 3.25rem;
+  }
+
+  .eyebrow {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--accent);
+    margin-bottom: 0.9rem;
+  }
+
+  h1 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 560;
+    font-size: clamp(2.1rem, 4.5vw, 2.65rem);
+    line-height: 1.08;
+    letter-spacing: -0.01em;
+    margin: 0 0 0.9rem;
+    text-wrap: balance;
+  }
+
+  .dek {
+    color: var(--muted);
+    max-width: 60ch;
+    font-size: 1.02rem;
+  }
+
+  .dek strong {
+    color: var(--ink);
+    font-weight: 600;
+  }
+
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.6rem;
+    margin-top: 1.6rem;
+  }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.72rem;
+    letter-spacing: 0.04em;
+    padding: 0.28rem 0.6rem;
+    border-radius: 3px;
+  }
+
+  .chip.have { background: var(--good-soft); color: var(--good); }
+  .chip.partial { background: var(--warn-soft); color: var(--warn); }
+  .chip.missing { background: var(--miss-soft); color: var(--miss); }
+
+  section.category {
+    margin-top: 3rem;
+  }
+
+  .cat-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.85rem;
+    border-bottom: 1px solid var(--hairline);
+    padding-bottom: 0.7rem;
+    margin-bottom: 1.1rem;
+  }
+
+  .cat-num {
+    font-family: "Fraunces", Georgia, serif;
+    font-size: 1.05rem;
+    color: var(--accent);
+    font-variant-numeric: tabular-nums;
+    min-width: 1.6rem;
+  }
+
+  .cat-head h2 {
+    font-family: "Fraunces", Georgia, serif;
+    font-weight: 500;
+    font-size: 1.28rem;
+    margin: 0;
+    letter-spacing: -0.005em;
+  }
+
+  .cat-note {
+    color: var(--muted);
+    font-size: 0.86rem;
+    margin: 0 0 1.2rem;
+    max-width: 62ch;
+  }
+
+  .feature {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    gap: 0.3rem 1rem;
+    padding: 1.05rem 0;
+    border-bottom: 1px solid var(--hairline);
+    align-items: start;
+  }
+
+  .feature:last-child { border-bottom: none; }
+
+  .f-name {
+    font-weight: 600;
+    font-size: 0.98rem;
+  }
+
+  .f-status {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.68rem;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    padding: 0.22rem 0.55rem;
+    border-radius: 3px;
+    white-space: nowrap;
+    height: fit-content;
+  }
+
+  .f-status.have { background: var(--good-soft); color: var(--good); }
+  .f-status.partial { background: var(--warn-soft); color: var(--warn); }
+  .f-status.missing { background: var(--miss-soft); color: var(--miss); }
+
+  .f-note {
+    grid-column: 1 / -1;
+    color: var(--muted);
+    font-size: 0.87rem;
+    margin-top: 0.15rem;
+    max-width: 66ch;
+  }
+
+  .f-note code {
+    font-family: "IBM Plex Mono", ui-monospace, monospace;
+    font-size: 0.82em;
+    background: var(--accent-soft);
+    color: var(--accent);
+    padding: 0.08em 0.35em;
+    border-radius: 3px;
+  }
+
+  footer.page {
+    margin-top: 4rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid var(--hairline);
+    color: var(--muted);
+    font-size: 0.82rem;
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    flex-wrap: wrap;
+  }
+
+  footer.page a { color: var(--accent); }
+
+  @media (max-width: 560px) {
+    body { padding: 3rem 1.1rem 4rem; }
+    .feature { grid-template-columns: 1fr; }
+    .f-status { justify-self: start; }
+  }
+</style>
+<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,400..600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
+
+<div class="wrap">
+
+  <header class="page">
+    <div class="eyebrow">boboko / order · competitive survey</div>
+    <h1>What order management elsewhere can do that boboko can't yet</h1>
+    <p class="dek">
+      Where the Checkout survey stopped — the instant <code>Order</code> exists — this
+      one starts. A feature-by-feature pass across Shopify, WooCommerce, PrestaShop, and
+      (briefly) Magento's post-placement order layer — sourced, not recalled from memory —
+      checked against what <strong>Lunar's <code>Order</code> model and the
+      already-shipped Filament <code>ManageOrder</code> page</strong> actually support
+      today. For deciding what the new <code>Order</code> module needs to own, not a
+      build order.
+    </p>
+    <div class="legend">
+      <span class="chip have">● have</span>
+      <span class="chip partial">◐ partial</span>
+      <span class="chip missing">○ missing</span>
+    </div>
+  </header>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">01</span>
+      <h2>Status model</h2>
+    </div>
+    <p class="cat-note">One field, or several axes — and who's allowed to move it.</p>
+
+    <div class="feature">
+      <div class="f-name">Payment status independent of a single overall status</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">The data exists — <code>ManageOrder::paymentStatus()</code> derives a real value from <code>transactions()</code>/<code>captureTotal()</code>/<code>refundTotal()</code>/<code>intentTotal()</code> — but it's a computed display value on the admin page, not a stored column or something the rest of the system (mailers, automations) can key off. Shopify and Magento both make payment status a first-class, independently-queryable dimension; here it's derived on the fly, once, in one Filament page.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Fulfillment status independent of overall status</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No equivalent of <code>paymentStatus()</code> exists for shipment/fulfillment state — <code>Order</code> has no <code>shipments()</code> relation of its own at all; it's added dynamically by <code>Modules\Core\Shipping\Providers\ShippingServiceProvider::resolveRelationUsing()</code>, outside Order's own boundary (see docs/checkout.md, "Where Order would likely absorb work"). Every platform researched (Shopify, Woo, PrestaShop, Magento) treats "has this shipped" as derivable from child records, not a manually-set field — Lunar has the child records (<code>Shipment</code>) but no derived status method reading them.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Staff-editable order status with a picker/action</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code> ships a working <code>UpdateStatusAction</code> out of the box, backed by <code>config('lunar.orders.statuses')</code> — a flat, merchant-configured list, each entry carrying a <code>label</code>/<code>color</code>/<code>favourite</code> flag. Closer to WooCommerce's single linear field than Shopify's multi-axis split.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Status rows carry behavior (auto-send email, generate invoice, restock)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Each status entry in <code>config('lunar.orders.statuses')</code> already declares <code>mailers</code> and <code>notifications</code> arrays — the PrestaShop-style shape is there in config — but per the Checkout survey's finding, nothing in core actually reads and dispatches from those keys on a transition. The data model for "status carries behavior" exists; the behavior doesn't.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order-status-changed event other code can react to</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Same gap the Checkout survey flagged for order creation: no <code>OrderStatusUpdated</code>/equivalent exists anywhere in core. <code>UpdateStatusAction</code> just writes the column. Anything wanting to react to a status change — a confirmation email, a webhook, re-deriving payment/fulfillment status — has to hook the raw Eloquent <code>Order::updated()</code> event and diff <code>status</code> itself.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">02</span>
+      <h2>Fulfillment &amp; shipment tracking</h2>
+    </div>
+    <p class="cat-note">Turning a placed order into a package that moves.</p>
+
+    <div class="feature">
+      <div class="f-name">Shipment as its own record, separate from the order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Modules\Core\Shipping\Models\Shipment</code> (carrier, tracking reference, label-printed timestamp, manifest reference) already exists and belongs to <code>Order</code>. Built this session, ahead of most gaps in this survey — the record shape is closer to Magento's per-shipment entity than Woo's "no shipment entity at all."</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Multiple shipments per order (partial/split fulfillment)</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note"><code>Shipment</code> has no <code>quantity</code>-per-line or <code>order_line_id</code> concept — it's one shipment record per carrier voucher, with a <code>parent_reference</code> for ACS's own multipart-voucher case (one physical order split into multiple packages by the carrier), not a per-line-item fulfillment split decided by staff. Closer to "multiple packages for one shipment" than Magento's true per-line partial-shipment model.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Create-shipment action from the order admin screen</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Modules\Core\Shipping\Extensions\OrderViewExtension</code> adds a working "Create Shipment" header action to <code>ManageOrder</code>, resolving a <code>CarrierFulfillmentInterface</code> by the order's chosen shipping method and calling <code>createShipment()</code> — genuinely wired, not a stub. Currently lives under <code>Shipping</code>, flagged in docs/checkout.md as conceptually an <code>Order</code> concern.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Tracking number + carrier surfaced on the order itself</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Shipment.tracking_reference</code>/<code>carrier</code> exist and are populated by <code>createShipment()</code>; <code>PollShipmentTrackingJob</code> (scheduled every 30 minutes) keeps <code>ShipmentInfo</code> checkpoints current via <code>CarrierFulfillmentInterface::trackShipment()</code>. Genuinely ahead of PrestaShop's thin <code>order_carrier.tracking_number</code> field — this has a real checkpoint history, not just one string.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">"Shipped"/"delivered" status auto-derived from tracking</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The tracking checkpoints exist (<code>ShipmentInfo</code>, <code>TrackingStatus</code> enum including <code>Delivered</code>) but nothing writes them back onto <code>Order.status</code> — a delivered shipment doesn't move the order out of whatever status it was already in. Every platform researched treats "delivered" as a status a customer/staff can see on the order, not something buried one relation away.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Shipping/delivery notification emails (shipped, out-for-delivery, delivered)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Research: Shopify fires four separate templated notifications across this window alone (shipping confirmation, out-for-delivery, delivered, plus edited-order). None of the pieces exist here — no order-status-changed event (01) to trigger from, and no mailer wired to <code>PollShipmentTrackingJob</code>'s own status updates either.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">03</span>
+      <h2>Payments: capture, refund, cancellation</h2>
+    </div>
+    <p class="cat-note">Money moving back out, and orders that never should have been placed.</p>
+
+    <div class="feature">
+      <div class="f-name">Refund action from the order screen, amount-scoped</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>refund</code> action already exists — picks a transaction, an amount (validated against <code>availableToRefund()</code>), and notes, then calls the driver's own <code>Transaction::refund()</code>. This is genuinely native, matching Woo/Magento's line-item-adjacent (if not line-item-exact) refund UX.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Capture action for auth-then-capture payment flows</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>capture</code> action + <code>requiresCapture()</code>/<code>canBeRefunded()</code> guard methods already exist, delegating to <code>Transaction::capture()</code> — this is the Stripe "authorize now, capture later" flow's admin-side half, already built ahead of most gaps here.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Refund tied to specific line items (not just a dollar amount)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The refund action takes a transaction + amount, with no line-item selection or restock decision — WooCommerce and Magento both make "which items, how many, restock or not" the primary refund UI; here it's one number against one transaction, closer to a manual adjustment than a structured partial return.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Order cancellation as a distinct action (vs. just changing status)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No dedicated "cancel" action exists on <code>ManageOrder</code> — a cancellation today would just be picking a "cancelled"-labeled entry from the generic status dropdown (01), with no automatic refund trigger, no stock-release logic, and no distinction from any other manual status edit.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Refund/capture reflected back into an order-level payment status</div>
+      <span class="f-status partial">partial</span>
+      <div class="f-note">Same gap as 01's payment-status finding — <code>paymentStatus()</code> recomputes correctly from transactions when the admin page loads, but a refund doesn't push the order into a <code>refunded</code>/<code>partially-refunded</code> overall status the way Shopify's <code>displayFinancialStatus</code> does automatically.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">04</span>
+      <h2>Returns (RMA)</h2>
+    </div>
+    <p class="cat-note">The one area every researched platform treats as optional, not core.</p>
+
+    <div class="feature">
+      <div class="f-name">Return-merchandise-authorization flow (customer requests, staff approves)</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No <code>Return</code>/RMA model, status set, or request flow exists anywhere in this codebase. Consistent with the research: Shopify is the only platform of the four with this genuinely native; PrestaShop ships it off-by-default; Magento gates it behind the paid Adobe Commerce tier; WooCommerce lacks it entirely. Safe to treat as a real gap, not an urgent one.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Return shipping label generation</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Depends entirely on the RMA flow above existing first — <code>CarrierFulfillmentInterface</code> already has the label-printing primitive (<code>printLabel()</code>) a return label would reuse, so the carrier-side plumbing isn't the blocker, the RMA request/approval model is.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">05</span>
+      <h2>Order editing</h2>
+    </div>
+    <p class="cat-note">Changing a placed order — and where every platform draws the line.</p>
+
+    <div class="feature">
+      <div class="f-name">Editing guardrails keyed to fulfillment state</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">No line-item add/remove exists on a placed order at all today (unlike Shopify/Woo/PrestaShop, which all allow it up to some fulfillment-keyed cutoff, then force a return instead) — so there's no guardrail to speak of yet because there's no editing to guard. Whatever gets built here should key the cutoff to <code>Shipment</code> existing, per the pattern all four researched platforms converge on.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Editable shipping/billing address after placement</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note"><code>OrderAddress</code> rows are snapshotted at creation (see Checkout survey, 02) and nothing in <code>ManageOrder</code> exposes editing them afterward — every platform researched treats address edits as lower-risk than line-item edits and allows them more freely; this codebase currently allows neither.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Tag editing on a placed order</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>ManageOrder</code>'s <code>edit_tags</code> action already works — the one piece of native post-placement editing that exists today, via <code>HasTags</code> on the <code>Order</code> model.</div>
+    </div>
+  </section>
+
+  <section class="category">
+    <div class="cat-head">
+      <span class="cat-num">06</span>
+      <h2>Notes &amp; audit trail</h2>
+    </div>
+    <p class="cat-note">The one thing every researched platform treats as non-negotiable.</p>
+
+    <div class="feature">
+      <div class="f-name">Append-only change history (who changed what, when)</div>
+      <span class="f-status have">have</span>
+      <div class="f-note"><code>Order</code> already uses Spatie's <code>LogsActivity</code> trait — every save is recorded with a diff, same underlying mechanism already relied on elsewhere in this codebase (staff activity log, translation history). Structurally equivalent to PrestaShop's <code>order_history</code> table, just via a different package.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Internal staff notes, separate from system-generated log entries</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">The activity log above captures field changes automatically, but there's no free-text "leave a note for the next person" field — every platform researched has this as a distinct feed from the automatic history (Woo's Order Notes, Shopify's Timeline comments, Magento's Comments History), usually with a private-vs-customer-visible toggle. Nothing here yet.</div>
+    </div>
+
+    <div class="feature">
+      <div class="f-name">Customer-visible note-to-customer, sent as a message</div>
+      <span class="f-status missing">missing</span>
+      <div class="f-note">Depends on both the internal-notes feature above and a working mailer (01/02) — genuinely blocked on more foundational gaps, not just unbuilt on its own.</div>
+    </div>
+  </section>
+
+  <footer class="page">
+    <span>Compiled 2026-09-01 — sources cited inline; <code>vendor/lunarphp/lunar</code> and this codebase's own <code>src/</code> reads are marked by file/class name, Shopify/WooCommerce/PrestaShop/Magento claims are marked "Research."</span>
+    <span>boboko-core / docs</span>
+  </footer>
+
+</div>

docs/shopify-import.md

@@ -2,6 +2,9 @@
 
 Findings from comparing a real Shopify product export CSV against Lunar's schema (`vendor/lunarphp/core`), plus the resulting implementation plan for `MigrateImport\Shopify\ShopifyExportImporter`.
 
+Need to discard everything and re-import from scratch (e.g. after a schema/indexer change that
+only applies to newly-created rows)? See `docs/shopify-reimport.md`.
+
 ## Idempotency problem
 
 Nothing in Lunar tracks "this record came from external system X, ID Y." Re-running an import with no external-ID tracking would duplicate every product on each run.

docs/shopify-reimport.md

@@ -0,0 +1,149 @@
+# Wiping products before a clean Shopify re-import
+
+A runbook for discarding every imported product (and everything that hangs off one —
+variants, prices, media, reviews, options/values, the Meilisearch documents) and re-running
+`ShopifyExportImporter` from scratch. Useful after a schema/indexer change that only applies to
+newly-created rows (see "Why a wipe, not an update" below), or when the export CSV itself changed
+enough that stale products need to go, not just be updated in place.
+
+Every command below is a `tinker --execute=` one-liner run inside the app container — adjust the
+exec prefix (`./bin/dc-core.sh exec app ...`, `docker compose exec app ...`, etc.) for your setup.
+
+---
+
+## Why a wipe, not an update
+
+`ShopifyExportImporter`'s resolvers are mostly `firstOrCreate` — re-running the importer against
+an *existing* database updates matched rows but leaves already-created ones exactly as they were.
+That's the right behavior for routine re-imports (an updated price, a new variant), but it means a
+change to what gets set **at creation time only** — e.g. `ProductOptionResolver` now also setting
+`label`, not just `name`, on a `ProductOption` — never reaches a `ProductOption` row that already
+exists. A wipe forces every row to go through creation again, picking up such fixes.
+
+---
+
+## 1. Delete every product
+
+Cascades to `ProductVariant`, prices, and Spatie media rows — verified live (see
+`shopify-import.md`'s own history/commit log for context). Also removes each product's Meilisearch
+document automatically, via Scout's own delete hook fired on `forceDelete()` — no separate
+`scout:flush` needed.
+
+```php
+\Lunar\Models\Product::withTrashed()->get()->each->forceDelete();
+```
+
+**Let this run to completion.** Interrupting it mid-loop (e.g. Ctrl+C on the tinker session) stops
+after whichever product it was on, leaving the rest undeleted — safe to just re-run the same
+command again afterward, since already-deleted products are simply skipped.
+
+Verify:
+
+```php
+\Lunar\Models\Product::withTrashed()->count(); // 0
+```
+
+### Requires: `product_reviews.product_id` cascades on delete
+
+`product_reviews` (boboko-core's own table, not Lunar's) originally had no `ON DELETE` clause on
+its `product_id` foreign key — deleting a reviewed product threw a constraint violation instead of
+the review going with it. Fixed by
+`database/migrations/2026_09_03_000001_add_cascade_delete_to_product_reviews_product_id.php`. Make
+sure this migration has actually run (`php artisan migrate`) before step 1, or a product with
+reviews will fail to delete.
+
+---
+
+## 2. Delete product options and values
+
+Not touched by step 1 (`ProductOption`/`ProductOptionValue` aren't scoped to one product — they're
+shared across the catalog, per `ProductOptionResolver::resolveOption()`'s `shared: true`). Safe to
+delete in full once every product (and therefore every variant referencing an option value via the
+`product_option_value_product_variant` pivot) is gone — deleting values while variants still
+reference them throws the same kind of FK violation step 1 guards against.
+
+```php
+\Lunar\Models\ProductOptionValue::query()->delete();
+\Lunar\Models\ProductOption::query()->delete();
+```
+
+Verify:
+
+```php
+\Lunar\Models\ProductOption::count();      // 0
+\Lunar\Models\ProductOptionValue::count(); // 0
+```
+
+---
+
+## 3. Clear the import mappings
+
+Without this, the importer's `ImportMapping::resolve(...)` calls still find the (now-deleted)
+mappings' rows absent, so this step is really about not leaving stale mapping rows pointing at
+nothing — `ImportMapping` rows aren't foreign-keyed to the models they map (`morphTo`, no
+constraint), so leaving them wouldn't break the re-import, but a stale mapping for a product that
+no longer exists is dead weight.
+
+```php
+\Modules\Core\MigrateImport\Models\ImportMapping::where('source', 'shopify')->delete();
+```
+
+Verify:
+
+```php
+\Modules\Core\MigrateImport\Models\ImportMapping::where('source', 'shopify')->count(); // 0
+```
+
+---
+
+## 4. Re-run the importer
+
+`boboko:migrate:import` dispatches `RunMigrateImportJob` onto the queue — **not synchronous** —
+so a queue worker must actually be running (`php artisan queue:work`, or your dev queue container)
+or the job just sits queued.
+
+```bash
+php artisan boboko:migrate:import --source=shopify --type=export --file=<absolute path to the CSV>
+```
+
+The `--file` value must be an **absolute path** inside the container (e.g.
+`/var/www/html/storage/app/private/imports/shopify/products_export.csv`) when running
+non-interactively — a path relative to `storage/app/private/imports` only resolves correctly when
+the command can fall back to its interactive prompt, which isn't available in a scripted/non-TTY
+run.
+
+Watch the queue worker's own log output for `FAIL` entries (see `docs/lunar.md` or your compose
+setup for how logs are routed to `docker compose logs`) — a clean run shows every
+`Laravel\Scout\Jobs\MakeSearchable` / `Spatie\MediaLibrary\Conversions\Jobs\PerformConversionsJob`
+line ending `DONE`, never `FAIL`.
+
+---
+
+## 5. Re-sync Meilisearch and reindex
+
+```bash
+php artisan lunar:meilisearch:setup
+php artisan lunar:meilisearch:tune-product-search
+php artisan lunar:search:index "Lunar\Models\Product" --refresh
+```
+
+`--refresh` re-syncs filterable/sortable index settings *and* reindexes every document — it does
+not reset `typoTolerance`/`prefixSearch` (confirmed live: both survived a `--refresh` run
+unchanged), so `tune-product-search` only needs re-running here for completeness/if it hadn't
+already been applied, not because `--refresh` would have clobbered it.
+
+---
+
+## Verifying the result
+
+```php
+// Product count should match the CSV's actual unique `Handle` count, not
+// whatever the database held before the wipe — those aren't the same number
+// if stale/manually-added products existed alongside the CSV-sourced ones.
+\Lunar\Models\Product::count();
+
+// Spot-check that at least one variant picked up its own image (see
+// shopify-import.md's "Images" section) — 0 is only correct if the CSV
+// genuinely has no `Variant Image` values populated.
+\Lunar\Models\ProductVariant::has('images')->count();
+```

resources/views/order/notifications/captured.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Payment of <strong>{{ $amount }}</strong> for your order <strong>{{ $reference }}</strong> has been captured.</p>

resources/views/order/notifications/delivered.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Good news — your order <strong>{{ $reference }}</strong> has been delivered.</p>

resources/views/order/notifications/refunded.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>A refund of <strong>{{ $amount }}</strong> has been issued for your order <strong>{{ $reference }}</strong>.</p>

resources/views/order/notifications/status-updated.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is now: <strong>{{ $statusLabel }}</strong></p>

src/Catalog/Contracts/RecommendationRule.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Catalog\Contracts;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+
+/**
+ * One strategy for producing recommended products for a given product —
+ * e.g. same category, same tag, best sellers, random. Modules\Core\Catalog\
+ * Services\RecommendationService runs rules registered in
+ * config('catalog.recommendation_rules') in order, topping up from each
+ * successive rule until $limit distinct products are collected or every
+ * rule is exhausted (e.g. 3 from SameCategoryRule + 1 from RandomRule) —
+ * nothing here decides that accumulation itself; a store composes its own
+ * chain by ordering rules in config (e.g. [SameCategoryRule::class,
+ * RandomRule::class]).
+ *
+ * Returns raw Product models, not ProductService::list()'s locale-resolved
+ * array output — this runs at index time (ProductIndexer::toSearchableArray()),
+ * where "the current locale" isn't a meaningful concept the way it is for a
+ * storefront request. ProductIndexer resolves translated fields itself via
+ * translateAttribute(), same as it already does for the embedded `collections`
+ * field — same known index-time-locale tradeoff, not a new one.
+ */
+interface RecommendationRule
+{
+    /**
+     * $exclude carries $product's own id plus every id already picked by an
+     * earlier rule this call — RecommendationService never shows the same
+     * product twice even when two rules would both suggest it, and a rule
+     * shouldn't spend its $limit budget re-returning something already
+     * collected.
+     *
+     * @param  array<int>  $exclude
+     * @return Collection<int, Product> at most $limit products
+     */
+    public function recommend(Product $product, int $limit, array $exclude): Collection;
+}

src/Catalog/DTOs/PriceSliderBounds.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+/**
+ * A price range slider's bounds and whether it's currently narrowed —
+ * built by ProductService::priceSliderBounds(), which owns the floor/ceil
+ * rounding and "is this actually a meaningful filter" comparison, so a
+ * controller (CategoryController, SearchController, ...) doesn't have to
+ * reimplement that rule itself.
+ */
+class PriceSliderBounds
+{
+    public function __construct(
+        public readonly ?int $floor,
+        public readonly ?int $ceil,
+        public readonly bool $filtered,
+    ) {}
+}

src/Catalog/DTOs/ProductFilters.php

@@ -17,10 +17,12 @@ class ProductFilters
      *   not a direct-assignment-only match) — the right semantics for "products on
      *   this category page", since products are typically attached only to leaf
      *   collections.
+     * @param $tag exactly one tag — no multi-select yet.
      */
     public function __construct(
         public readonly ?int $collectionId = null,
         public readonly ?string $brand = null,
+        public readonly ?string $tag = null,
         public readonly ?float $minPrice = null,
         public readonly ?float $maxPrice = null,
         public readonly bool $inStockOnly = false,

src/Catalog/DTOs/ProductListingResult.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Catalog\DTOs;
+
+use Illuminate\Pagination\LengthAwarePaginator;
+
+/**
+ * Everything a listing page needs from one ProductService::list() call —
+ * the product page itself, the price slider's bounds, and the set of tags
+ * actually present on matching products (for a tag filter sidebar) — so a
+ * controller makes one service call instead of orchestrating list(),
+ * priceSliderBounds(), and facets('tags', ...) separately. list() still
+ * issues multiple Meilisearch requests internally (the product search, the
+ * price facet stats, the tag facet distribution — see priceSliderBounds()'s
+ * own docblock for why the price ones can't be merged into one without
+ * changing the slider's UX), but that's this DTO's job to hide, not the
+ * controller's to know about.
+ */
+class ProductListingResult
+{
+    /**
+     * @param  array<int, string>  $availableTags  every distinct tag value
+     *   present on at least one product matching the listing's OTHER
+     *   filters (collection/price/stock — never the tag filter itself, so
+     *   selecting a tag doesn't collapse the list down to just that tag).
+     *   Sorted alphabetically. Empty if no product in scope has any tag.
+     */
+    public function __construct(
+        public readonly LengthAwarePaginator $products,
+        public readonly PriceSliderBounds $priceBounds,
+        public readonly array $availableTags = [],
+    ) {}
+}

src/Catalog/Events/ProductDeleted.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Modules\Core\Catalog\Events;
+
+/**
+ * Dispatched whenever a Product is deleted (see CatalogServiceProvider,
+ * which wires this to the model's own deleted() hook — fires for both a
+ * soft delete and a force delete, same as Laravel Scout's own
+ * ModelObserver::deleted() that triggers unsearchable() for the product
+ * itself). Same purpose as Modules\Core\Catalog\Events\ProductSaved: lets
+ * Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct find
+ * and re-index every OTHER product that currently embeds this one in its
+ * `recommendations` field, so a deleted product doesn't linger as a dead
+ * reference elsewhere. Carries only the id, not the Product model — by the
+ * time this fires the model may already be gone (force delete), and the
+ * reverse lookup only ever needs the id to filter on.
+ */
+class ProductDeleted
+{
+    public function __construct(
+        public readonly int $productId,
+    ) {}
+}

src/Catalog/Events/ProductSaved.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Catalog\Events;
+
+use Lunar\Models\Product;
+
+/**
+ * Dispatched whenever a Product is saved (see CatalogServiceProvider,
+ * which wires this to the model's own saved() hook) — exists specifically
+ * so Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct can
+ * find and re-index every OTHER product that currently embeds this one in
+ * its own `recommendations` field (see ProductIndexer). Those products
+ * have no direct database relationship to this one — a recommendation is
+ * computed and stored only inside Meilisearch (Modules\Core\Catalog\
+ * Services\RecommendationService) — so nothing about their own save
+ * lifecycle would otherwise pick up this product's changed name/price/
+ * image.
+ */
+class ProductSaved
+{
+    public function __construct(
+        public readonly Product $product,
+    ) {}
+}

src/Catalog/Listeners/ReindexProductsRecommendingProduct.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace Modules\Core\Catalog\Listeners;
+
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Events\ProductDeleted;
+use Modules\Core\Catalog\Events\ProductSaved;
+
+/**
+ * Keeps every product's embedded `recommendations` field (see
+ * ProductIndexer) in sync when a product they recommend changes or is
+ * removed. Unlike Modules\Core\Catalog\Observers\ProductOptionReindexObserver's
+ * equivalent ("who references this option value"), there is no Postgres
+ * table to query here — a recommendation only exists inside Meilisearch,
+ * computed by RecommendationService at index time — so the reverse lookup
+ * is a Meilisearch filter query against `recommendations.id`, not a
+ * database join.
+ *
+ * Handles both ProductSaved (name/price/image changed — referencing
+ * products' embedded copy is stale) and ProductDeleted (the recommended
+ * product no longer exists at all — referencing products need to drop it
+ * and, since RecommendationService tops up to its limit, naturally pick up
+ * a replacement on reindex). Same reverse lookup either way, just a
+ * different source for the id being searched for.
+ *
+ * Re-indexing via ->searchable() dispatches Scout's own (queued, if
+ * SCOUT_QUEUE is configured) reindex job per matched product — this
+ * listener itself does no synchronous Meilisearch writing.
+ */
+class ReindexProductsRecommendingProduct
+{
+    public function handleSaved(ProductSaved $event): void
+    {
+        $this->reindexReferencingProducts($event->product->id);
+    }
+
+    public function handleDeleted(ProductDeleted $event): void
+    {
+        $this->reindexReferencingProducts($event->productId);
+    }
+
+    private function reindexReferencingProducts(int $productId): void
+    {
+        $hits = Product::search('')
+            ->options([
+                'filter' => "recommendations.id = \"{$productId}\"",
+                'attributesToRetrieve' => ['id'],
+                // Meilisearch's own hitsPerPage default (20) would silently
+                // drop referencing products past that count — this is a
+                // reverse lookup, not a paginated storefront result, so it
+                // needs every match, up to Meilisearch's hard limit.
+                'hitsPerPage' => 1000,
+            ])
+            ->raw()['hits'] ?? [];
+
+        $ids = collect($hits)->pluck('id')->unique()->values();
+
+        if ($ids->isEmpty()) {
+            return;
+        }
+
+        Product::whereIn('id', $ids)->get()->each->searchable();
+    }
+}

src/Catalog/Recommendations/RandomRule.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Catalog\Recommendations;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * The universal fallback — always returns something as long as the store
+ * has more than one product, since it has no eligibility condition of its
+ * own to come up empty on. Meant to be placed last in
+ * config('catalog.recommendation_rules'), not first: every store using
+ * the default chain gets a real fallback, but one that only kicks in once
+ * more specific rules (same category, same tag, ...) have had a chance.
+ */
+class RandomRule implements RecommendationRule
+{
+    public function recommend(Product $product, int $limit, array $exclude): Collection
+    {
+        return Product::query()
+            ->whereKeyNot($exclude)
+            ->inRandomOrder()
+            ->limit($limit)
+            ->get();
+    }
+}

src/Catalog/Recommendations/SameCategoryRule.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Catalog\Recommendations;
+
+use Illuminate\Support\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * Recommends other products sharing at least one of $product's directly-
+ * assigned collections — takes $product's first collection (a product
+ * usually has one primary category; if it has several, the first is as
+ * good a choice as any without a "primary collection" concept to prefer).
+ * Returns nothing if $product has no collection at all, letting the next
+ * rule in the chain (see RecommendationRule's docblock) take over.
+ *
+ * Queries Eloquent directly rather than going through Modules\Core\Catalog\
+ * Services\ProductService — this runs at index time (see
+ * RecommendationRule's docblock), where Meilisearch may be mid-reindex for
+ * this very product and ProductService::list()'s locale-resolution has no
+ * meaningful "current locale" to resolve against anyway.
+ */
+class SameCategoryRule implements RecommendationRule
+{
+    public function recommend(Product $product, int $limit, array $exclude): Collection
+    {
+        $collection = $product->collections->first();
+
+        if ($collection === null) {
+            return collect();
+        }
+
+        return $collection->products()
+            ->whereKeyNot($exclude)
+            ->inRandomOrder()
+            ->limit($limit)
+            ->get();
+    }
+}

src/Catalog/Services/ProductIndexer.php

@@ -27,8 +27,14 @@ use Spatie\MediaLibrary\MediaCollections\Models\Media;
  *   - slugs (every locale's Url::slug for the product, filterable) — lets
  *     ProductService::getBySlug() resolve a product from the index directly, with
  *     no database read at all
+ *   - skus (every variant's sku, deduplicated, filterable) — same "resolve from the
+ *     index alone" reasoning as slugs, for a future SKU-based lookup/filter
  *   - price (cheapest variant, filterable) and full per-variant pricing
- *   - variants: sku, stock, purchasable, option values, prices, media
+ *   - variants: sku, gtin, mpn, ean, stock, backorder, unit_quantity, purchasable,
+ *     shippable, tax_ref, dimensions (length/width/height/weight/volume, each
+ *     {value, unit}), option values, prices, media — the variant's own images
+ *     (ProductVariant::images(), separate from the product's gallery below), not
+ *     the product's own media repeated per variant
  *   - the full media gallery (not just the single thumbnail Lunar's base indexer sends)
  *   - tags
  *   - reviews: {items: [...], count, average_rating} — items are public-safe fields
@@ -44,6 +50,21 @@ use Spatie\MediaLibrary\MediaCollections\Models\Media;
  *     Reflects stock as of the last reindex only — nothing currently reindexes a
  *     product when an order decrements its stock (see docs/product-listing.md).
  *
+ *   - recommendations (recommendations.id filterable): [{id, name, price, image}, ...]
+ *     up to 4 other products to show alongside this one (a "related products"
+ *     section), sourced from Modules\Core\Catalog\Services\RecommendationService's
+ *     configured rule chain (config('catalog.recommendation_rules')). Embedded
+ *     card data, not just ids, same reasoning as `collections`: renders
+ *     directly with zero extra Meilisearch calls. `name` is resolved via
+ *     translateAttribute() at index time (not through ProductService's
+ *     per-request locale resolution, since indexing has no "current locale"
+ *     the way a storefront request does) — same known index-time-locale
+ *     tradeoff `collections` already has. `recommendations.id` is filterable
+ *     specifically so Modules\Core\Catalog\Listeners\
+ *     ReindexProductsRecommendingProduct can find every product currently
+ *     recommending a given one, when that one changes — there's no Postgres
+ *     relation for this, a recommendation only exists inside the index.
+ *
  * A review is created/edited independently of its product (Modules\Core\Providers\
  * ReviewServiceProvider re-indexes the product on review create/update/delete), so
  * this data doesn't go stale between full reindexes.
@@ -67,6 +88,9 @@ class ProductIndexer extends BaseProductIndexer
             'slugs',
             'channel_ids',
             'in_stock',
+            'recommendations.id',
+            'skus',
+            'tags',
         ];
     }
 
@@ -110,6 +134,7 @@ class ProductIndexer extends BaseProductIndexer
             ->values()
             ->all();
         $data['slugs'] = $model->urls->pluck('slug')->unique()->values()->all();
+        $data['skus'] = $model->variants->pluck('sku')->filter()->unique()->values()->all();
         $data['tags'] = $model->tags->pluck('value')->all();
         $data['media'] = $model->media->map(fn (Media $media) => $this->mapMedia($media))->all();
         $data['variants'] = $model->variants->map(fn (ProductVariant $variant) => $this->mapVariant($variant, $currency))->all();
@@ -126,6 +151,16 @@ class ProductIndexer extends BaseProductIndexer
         $data['in_stock'] = $model->variants->contains(
             fn (ProductVariant $variant) => $variant->canBeFulfilledAtQuantity(1)
         );
+        $data['recommendations'] = app(RecommendationService::class)
+            ->recommend($model)
+            ->load(['media', 'variants.prices'])
+            ->map(fn (Product $recommendation) => [
+                'id' => $recommendation->id,
+                'name' => $recommendation->translateAttribute('name'),
+                'price' => $this->cheapestPrice($recommendation, $currency),
+                'image' => $recommendation->media->first() ? $this->mapMedia($recommendation->media->first())['thumb'] : null,
+            ])
+            ->all();
 
         return $data;
     }
@@ -135,8 +170,22 @@ class ProductIndexer extends BaseProductIndexer
         return [
             'id' => $variant->id,
             'sku' => $variant->sku,
+            'gtin' => $variant->gtin,
+            'mpn' => $variant->mpn,
+            'ean' => $variant->ean,
             'stock' => $variant->stock,
+            'backorder' => $variant->backorder,
+            'unit_quantity' => $variant->unit_quantity,
             'purchasable' => $variant->purchasable,
+            'shippable' => $variant->shippable,
+            'tax_ref' => $variant->tax_ref,
+            'dimensions' => [
+                'length' => ['value' => $variant->length_value, 'unit' => $variant->length_unit],
+                'width' => ['value' => $variant->width_value, 'unit' => $variant->width_unit],
+                'height' => ['value' => $variant->height_value, 'unit' => $variant->height_unit],
+                'weight' => ['value' => $variant->weight_value, 'unit' => $variant->weight_unit],
+                'volume' => ['value' => $variant->volume_value, 'unit' => $variant->volume_unit],
+            ],
             'options' => $variant->values->map(fn ($value) => [
                 'option' => $this->translatedName($value->option->name),
                 'handle' => $value->option->handle,

src/Catalog/Services/ProductSearchService.php

@@ -3,10 +3,12 @@
 namespace Modules\Core\Catalog\Services;
 
 use Illuminate\Database\Eloquent\Collection;
-use Illuminate\Support\Facades\App;
 use Lunar\Facades\AttributeManifest;
 use Lunar\Models\Language;
 use Lunar\Models\Product;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\Enums\ProductSort;
+use Modules\Core\Catalog\Support\ProductFilterBuilder;
 
 /**
  * Lunar's Meilisearch indexer flattens translated attributes into locale-suffixed
@@ -17,39 +19,69 @@ use Lunar\Models\Product;
  */
 class ProductSearchService
 {
+    public function __construct(
+        private readonly ProductFilterBuilder $filterBuilder,
+    ) {}
+
     /**
+     * $filters/$sort apply the exact same semantics ProductService::list()
+     * uses for collection browsing (same ProductFilterBuilder, same
+     * ProductSort::toMeilisearchSort()) — a shopper narrowing a text search
+     * by price/brand/stock gets identical filter behavior to narrowing a
+     * category listing, since both go through the same Meilisearch `filter`
+     * clause underneath.
+     *
      * @return Collection<int, Product>
      */
-    public function search(string $query, ?string $locale = null): Collection
+    public function search(string $query, ?ProductFilters $filters = null, ?ProductSort $sort = null): Collection
     {
-        $locale ??= App::getLocale();
+        $options = [
-        $defaultLocale = Language::getDefault()->code;
+            'attributesToSearchOn' => $this->searchableFields(),
+            'filter' => $this->filterBuilder->build($filters),
+        ];
+
+        if ($sort !== null) {
+            $options['sort'] = [$sort->toMeilisearchSort()];
+        }
 
         return Product::search($query)
-            ->options([
+            ->options($options)
-                'attributesToSearchOn' => $this->searchableFields($locale, $defaultLocale),
-            ])
             ->get();
     }
 
     /**
-     * Target the resolved locale's fields plus the default locale's fields, so a
+     * Targets every configured store language's fields, not just the current
-     * product that's only ever been translated into the default language still
+     * request locale plus the store default — a shopper browsing in Greek
-     * surfaces when searched in another locale, instead of becoming invisible
+     * typing an English word (or vice versa) should still match a product
-     * until every product is fully translated.
+     * whose only translation for that text happens to be in a third
+     * language. There's no per-request "current locale" concept in this
+     * method any more: which fields exist to search on is a property of the
+     * store's configured languages, not of who's asking.
+     *
+     * Also targets variants.options.value directly — a variant's option
+     * value (e.g. "Κάπτεν Γαμέρικα" on a "Name" option) is how ProductIndexer
+     * already indexes it (see mapVariant()), but it isn't one of Lunar's own
+     * attributes, so it can't come from AttributeManifest the way name/
+     * description do; it's a structural field of the document, added here
+     * directly instead. Not locale-suffixed like the attribute-manifest
+     * fields — option values are stored as one already-resolved string per
+     * variant (see ProductIndexer::translatedName()), not per-locale.
      *
      * @return array<int, string>
      */
-    private function searchableFields(string $locale, string $defaultLocale): array
+    private function searchableFields(): array
     {
         $handles = AttributeManifest::getSearchableAttributes(Product::morphName())
             ->pluck('handle');
 
-        $locales = array_unique([$locale, $defaultLocale]);
+        $locales = Language::all()->pluck('code');
 
-        return $handles
+        $attributeFields = $handles
             ->crossJoin($locales)
-            ->map(fn (array $pair) => "{$pair[0]}_{$pair[1]}")
+            ->map(fn (array $pair) => "{$pair[0]}_{$pair[1]}");
+
+        return $attributeFields
+            ->push('variants.options.value')
             ->values()
             ->all();
     }

src/Catalog/Services/ProductService.php

@@ -4,14 +4,16 @@ namespace Modules\Core\Catalog\Services;
 
 use Illuminate\Contracts\Pagination\LengthAwarePaginator as LengthAwarePaginatorContract;
 use Illuminate\Pagination\LengthAwarePaginator;
-use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\App;
 use Lunar\Base\AttributeManifest;
 use Lunar\FieldTypes\TranslatedText;
 use Lunar\Models\Product;
 use Modules\Core\Localization\Services\LanguageCache;
+use Modules\Core\Catalog\DTOs\PriceSliderBounds;
 use Modules\Core\Catalog\DTOs\ProductFilters;
+use Modules\Core\Catalog\DTOs\ProductListingResult;
 use Modules\Core\Catalog\Enums\ProductSort;
+use Modules\Core\Catalog\Support\ProductFilterBuilder;
 
 /**
  * Storefront product listing/filtering AND single-product lookup, all reading directly
@@ -27,17 +29,33 @@ class ProductService
     public function __construct(
         private readonly LanguageCache $languages,
         private readonly AttributeManifest $attributes,
+        private readonly ProductFilterBuilder $filterBuilder,
     ) {}
 
     /**
-     * Returns a real LengthAwarePaginator (not Scout's own paginateRaw() result -
+     * One call for everything a listing page needs: the product page AND
-     * see "Meilisearch driver quirk" below) so a controller/view gets normal
+     * the price slider's bounds — a controller used to have to call this
-     * pagination behaviour ($products->links(), JSON serialization, etc.)
+     * plus priceSliderBounds() separately and glue the results together
-     * without ever touching the raw Meilisearch response directly.
+     * itself; that orchestration now happens in here instead. Still issues
+     * two Meilisearch requests under the hood (the product search, and a
+     * separate price-facet-stats query — see priceSliderBounds()'s
+     * docblock for why they can't be merged into one without changing the
+     * slider's own UX), but the caller only ever makes one call.
+     *
+     * $filters->minPrice/$filters->maxPrice double as both the applied
+     * product filter AND the "is the slider actually narrowed" comparison
+     * in priceSliderBounds() — the same values, used two ways, so nothing
+     * new needs to be threaded through separately.
+     *
+     * The paginator itself is a real LengthAwarePaginator (not Scout's own
+     * paginateRaw() result - see "Meilisearch driver quirk" below) so a
+     * controller/view gets normal pagination behaviour ($products->links(),
+     * JSON serialization, etc.) without ever touching the raw Meilisearch
+     * response directly.
      */
-    public function list(?ProductFilters $filters = null, int $perPage = 24, int $page = 1, ?ProductSort $sort = null): LengthAwarePaginator
+    public function list(?ProductFilters $filters = null, int $perPage = 24, int $page = 1, ?ProductSort $sort = null): ProductListingResult
     {
-        $options = ['filter' => $this->buildFilter($filters)];
+        $options = ['filter' => $this->filterBuilder->build($filters)];
 
         if ($sort !== null) {
             $options['sort'] = [$sort->toMeilisearchSort()];
@@ -51,13 +69,36 @@ class ProductService
             ->map(fn (array $product) => $this->withLocalizedFields($product))
             ->all();
 
-        return new LengthAwarePaginator(
+        $products = new LengthAwarePaginator(
             items: $data,
             total: $paginator->total(),
             perPage: $paginator->perPage(),
             currentPage: $paginator->currentPage(),
             options: ['path' => LengthAwarePaginator::resolveCurrentPath()],
         );
+
+        $priceBounds = $this->priceSliderBounds($filters, $filters?->minPrice, $filters?->maxPrice);
+        $availableTags = $this->availableTags($filters);
+
+        return new ProductListingResult($products, $priceBounds, $availableTags);
+    }
+
+    /**
+     * Every distinct `tags` value present on a product matching $filters,
+     * excluding $filters->tag itself — same "scoped but not self-collapsing"
+     * reasoning as priceRange() excluding `price` — so selecting a tag
+     * doesn't shrink the sidebar down to just that one tag. Sorted
+     * alphabetically; Meilisearch's facetDistribution has no defined order
+     * of its own.
+     *
+     * @return array<int, string>
+     */
+    private function availableTags(?ProductFilters $filters): array
+    {
+        $filter = $this->filterBuilder->build($filters, exclude: ['tag']);
+        $tags = $this->rawFacets('tags', $filter)['facetDistribution']['tags'] ?? [];
+
+        return collect($tags)->keys()->sort()->values()->all();
     }
 
     /**
@@ -71,15 +112,18 @@ class ProductService
      * apply that field's own filter separately in the UI/query layer.
      *
      * `$field` must be one of ProductIndexer's filterable fields; only discrete-value
-     * fields make sense here (`brand`, `in_stock`) — a numeric field like `price`
+     * fields make sense here (`brand`, `tags`, `in_stock`) — a numeric field like
-     * would return one "facet" per exact price, not a usable range bucket. Use
+     * `price` would return one "facet" per exact price, not a usable range bucket.
-     * `priceRange()` for `price` instead.
+     * Use `priceRange()` for `price` instead. `facets('tags', $filters)` is how a
+     * category page gets "which tags actually appear on products in this category" —
+     * pass a $filters that omits `tag` (see `build()`'s $exclude) so the tag list
+     * itself doesn't collapse to whichever tag is already selected.
      *
      * @return array<string, int> facet value => matching product count
      */
     public function facets(string $field, ?ProductFilters $filters = null): array
     {
-        return $this->rawFacets($field, $this->buildFilter($filters))['facetDistribution'][$field] ?? [];
+        return $this->rawFacets($field, $this->filterBuilder->build($filters))['facetDistribution'][$field] ?? [];
     }
 
     /**
@@ -90,12 +134,17 @@ class ProductService
      * not `facetDistribution` — the right feature for a numeric field's range,
      * where `facets('price')` would otherwise return one entry per exact price.
      *
+     * $query defaults to '' (every product, same as list()'s own default text
+     * query) — pass the shopper's search text here too so a search page's own
+     * price slider spans only the products that search actually matched,
+     * rather than the whole catalog's price range.
+     *
      * @return array{min: ?float, max: ?float} null/null if no product matches
      */
-    public function priceRange(?ProductFilters $filters = null): array
+    public function priceRange(?ProductFilters $filters = null, string $query = ''): array
     {
-        $filter = $this->buildFilter($filters, exclude: ['price']);
+        $filter = $this->filterBuilder->build($filters, exclude: ['price']);
-        $stats = $this->rawFacets('price', $filter)['facetStats']['price'] ?? null;
+        $stats = $this->rawFacets('price', $filter, $query)['facetStats']['price'] ?? null;
 
         return [
             'min' => $stats['min'] ?? null,
@@ -103,9 +152,36 @@ class ProductService
         ];
     }
 
-    private function rawFacets(string $field, ?string $filter): array
+    /**
+     * priceRange() rounded to whole euros (floor/ceil, so the slider's ends
+     * are never tighter than what's actually in range) plus whether
+     * $selectedMinPrice/$selectedMaxPrice actually narrow it — the same
+     * "floor/ceil + is this a real filter" rule CategoryController and
+     * SearchController each used to duplicate inline. $selectedMinPrice/
+     * $selectedMaxPrice are the currently-applied filter values (e.g.
+     * CategoryListing::$minPrice), not part of $filters itself, since
+     * $filters here must already exclude price the way priceRange() expects.
+     */
+    public function priceSliderBounds(
+        ?ProductFilters $filters,
+        ?float $selectedMinPrice,
+        ?float $selectedMaxPrice,
+        string $query = '',
+    ): PriceSliderBounds {
+        $priceRange = $this->priceRange($filters, $query);
+
+        $floor = $priceRange['min'] !== null ? (int) floor($priceRange['min']) : null;
+        $ceil = $priceRange['max'] !== null ? (int) ceil($priceRange['max']) : null;
+
+        $filtered = ($selectedMinPrice !== null && $selectedMinPrice > ($floor ?? PHP_INT_MIN))
+            || ($selectedMaxPrice !== null && $selectedMaxPrice < ($ceil ?? PHP_INT_MAX));
+
+        return new PriceSliderBounds($floor, $ceil, $filtered);
+    }
+
+    private function rawFacets(string $field, ?string $filter, string $query = ''): array
     {
-        return Product::search('')
+        return Product::search($query)
             ->options([
                 'filter' => $filter,
                 'facets' => [$field],
@@ -133,15 +209,87 @@ class ProductService
         return $this->findOneWhere("id = \"{$id}\"");
     }
 
+    /**
+     * The id/price/image of every variant on a product document (from
+     * getById()/getBySlug()'s own 'variants' array) — the base price and
+     * thumbnail a variant picker/swatch list needs, without a caller
+     * reaching into $product['variants'][n]['prices'][0]/['media'][0]
+     * itself. Domain shaping (which price/image represents a variant),
+     * not presentation — a card's href/layout stays a storefront concern
+     * (e.g. App\Catalog\ProductCard in 3dealer), but "the variant's price
+     * is its first price row" is a rule about the data, true regardless of
+     * which app renders it.
+     *
+     * @param  array  $product  A document from getById()/getBySlug().
+     * @return array<int, array{id: int, price: ?float, image: ?string}>
+     */
+    public function variantSummaries(array $product): array
+    {
+        return collect($product['variants'] ?? [])
+            ->map(fn (array $variant) => [
+                'id' => $variant['id'],
+                'price' => $variant['prices'][0]['price'] ?? null,
+                'image' => $variant['media'][0]['url'] ?? null,
+            ])
+            ->values()
+            ->all();
+    }
+
+    /**
+     * $limit random products, still scoped to the index's own default
+     * visibility (channel/status), unlike Eloquent's Product::inRandomOrder()
+     * which has no notion of that filtering at all — a random pick can never
+     * surface a hidden/unpublished product this way. Meilisearch itself has
+     * no ORDER BY RANDOM() equivalent, so this pulls every matching id only
+     * (attributesToRetrieve: ['id'], the lightest possible request — no
+     * name/media/variants/etc. for documents that will mostly be discarded),
+     * shuffles in PHP, then fetches the full localized documents for just
+     * the $limit ids actually picked.
+     *
+     * @return array<int, array>
+     */
+    public function random(int $limit): array
+    {
+        $raw = Product::search('')
+            ->options(['attributesToRetrieve' => ['id']])
+            ->raw();
+
+        $ids = collect($raw['hits'] ?? [])->pluck('id')->shuffle()->take($limit)->values();
+
+        if ($ids->isEmpty()) {
+            return [];
+        }
+
+        // Meilisearch's `id IN [...]` doesn't preserve the given order — it's
+        // an unordered set filter, not a list to iterate — so the shuffle
+        // above would otherwise be silently undone by whatever order the
+        // re-fetch comes back in. Re-sort the fetched documents back into
+        // $ids's already-shuffled order instead of trusting the response's.
+        $products = collect($this->findAllWhere('id IN ['.$ids->implode(', ').']'))
+            ->keyBy('id');
+
+        return $ids->map(fn ($id) => $products->get($id))->filter()->values()->all();
+    }
+
     private function findOneWhere(string $filter): ?array
+    {
+        $products = $this->findAllWhere($filter, limit: 1);
+
+        return $products[0] ?? null;
+    }
+
+    /**
+     * @return array<int, array>
+     */
+    private function findAllWhere(string $filter, int $limit = 1000): array
     {
         $paginator = Product::search('')
             ->options(['filter' => $filter])
-            ->paginateRaw(perPage: 1, page: 1);
+            ->paginateRaw(perPage: $limit, page: 1);
 
-        $product = $this->hitsFrom($paginator)[0] ?? null;
+        return collect($this->hitsFrom($paginator))
-
+            ->map(fn (array $product) => $this->withLocalizedFields($product))
-        return $product !== null ? $this->withLocalizedFields($product) : null;
+            ->all();
     }
 
     /**
@@ -204,28 +352,4 @@ class ProductService
         return collect($rawResponse['hits'] ?? [])->values()->all();
     }
 
-    /**
-     * @param array<int, 'collectionId'|'brand'|'price'|'inStockOnly'> $exclude filter
-     *   fields to leave out even if set on $filters — e.g. priceRange() excludes
-     *   'price' so a price slider's own bounds don't shrink to whatever range is
-     *   already selected on it.
-     */
-    private function buildFilter(?ProductFilters $filters, array $exclude = []): ?string
-    {
-        if ($filters === null) {
-            return null;
-        }
-
-        $clauses = Collection::make([
-            'collectionId' => $filters->collectionId !== null ? "collection_ids = \"{$filters->collectionId}\"" : null,
-            'brand' => $filters->brand !== null ? 'brand = "'.addcslashes($filters->brand, '"\\').'"' : null,
-            'price' => Collection::make([
-                $filters->minPrice !== null ? "price >= {$filters->minPrice}" : null,
-                $filters->maxPrice !== null ? "price <= {$filters->maxPrice}" : null,
-            ])->filter()->join(' AND ') ?: null,
-            'inStockOnly' => $filters->inStockOnly ? 'in_stock = true' : null,
-        ])->except($exclude)->filter();
-
-        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
-    }
 }

src/Catalog/Services/RecommendationService.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Database\Eloquent\Collection;
+use Lunar\Models\Product;
+use Modules\Core\Catalog\Contracts\RecommendationRule;
+
+/**
+ * Runs each rule in config('catalog.recommendation_rules'), in order,
+ * topping up from each successive rule until $limit distinct products are
+ * collected or every rule is exhausted — e.g. 3 from SameCategoryRule
+ * (the product's category only has 3 other products) + 1 from RandomRule.
+ * No rule is special-cased as "the fallback" here; a store gets fallback
+ * behaviour purely by how it orders its own config (e.g. SameCategoryRule
+ * before RandomRule). Never returns the same product twice even if two
+ * rules would both suggest it (see RecommendationRule's $exclude), and
+ * never returns fewer than $limit unless the store genuinely doesn't have
+ * that many other products at all.
+ */
+class RecommendationService
+{
+    /**
+     * @return Collection<int, Product>
+     */
+    public function recommend(Product $product, int $limit = 4): Collection
+    {
+        $recommendations = new Collection();
+
+        foreach (config('catalog.recommendation_rules', []) as $ruleClass) {
+            if ($recommendations->count() >= $limit) {
+                break;
+            }
+
+            $exclude = [$product->id, ...$recommendations->pluck('id')];
+            $remaining = $limit - $recommendations->count();
+
+            /** @var RecommendationRule $rule */
+            $rule = app($ruleClass);
+            $recommendations = $recommendations->merge(
+                $rule->recommend($product, $remaining, $exclude)
+            );
+        }
+
+        return $recommendations->take($limit)->values();
+    }
+}

src/Catalog/Support/ProductFilterBuilder.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Modules\Core\Catalog\Support;
+
+use Illuminate\Support\Collection;
+use Modules\Core\Catalog\DTOs\ProductFilters;
+
+/**
+ * Builds a Meilisearch `filter` clause from a ProductFilters DTO — extracted
+ * out of ProductService (where it originated, scoped to browsing/filtering
+ * without a search term) so ProductSearchService can apply the exact same
+ * filter semantics to a text query too, rather than reimplementing it.
+ */
+class ProductFilterBuilder
+{
+    /**
+     * @param  array<int, 'collectionId'|'brand'|'tag'|'price'|'inStockOnly'>  $exclude
+     *   filter fields to leave out even if set on $filters — e.g.
+     *   ProductService::priceRange() excludes 'price' so a price slider's own
+     *   bounds don't shrink to whatever range is already selected on it.
+     */
+    public function build(?ProductFilters $filters, array $exclude = []): ?string
+    {
+        if ($filters === null) {
+            return null;
+        }
+
+        $clauses = Collection::make([
+            'collectionId' => $filters->collectionId !== null ? "collection_ids = \"{$filters->collectionId}\"" : null,
+            'brand' => $filters->brand !== null ? 'brand = "'.addcslashes($filters->brand, '"\\').'"' : null,
+            'tag' => $filters->tag !== null ? 'tags = "'.addcslashes($filters->tag, '"\\').'"' : null,
+            'price' => Collection::make([
+                $filters->minPrice !== null ? "price >= {$filters->minPrice}" : null,
+                $filters->maxPrice !== null ? "price <= {$filters->maxPrice}" : null,
+            ])->filter()->join(' AND ') ?: null,
+            'inStockOnly' => $filters->inStockOnly ? 'in_stock = true' : null,
+        ])->except($exclude)->filter();
+
+        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
+    }
+}

src/Checkout/Contracts/PaymentDriver.php

@@ -1,62 +0,0 @@
-<?php
-
-namespace Modules\Core\Checkout\Contracts;
-
-use Lunar\Exceptions\FingerprintMismatchException;
-use Lunar\Exceptions\Carts\CartException;
-use Lunar\Models\Cart;
-use Lunar\Models\Order;
-
-/**
- * A boboko-owned payment driver — wraps a payment gateway's own confirmation
- * mechanics (Stripe's synchronous authorize() call, a redirect-based
- * provider's async callback/webhook, anything else) behind one uniform
- * moment: "payment is confirmed, place the order."
- *
- * confirm() is the only thing a driver is required to do: once it has,
- * by whatever mechanism is native to that gateway, independently decided
- * the payment succeeded, it calls Modules\Core\Checkout\Services\
- * CheckoutService::placeOrder($fingerprint) itself — no driver ever calls
- * Lunar\Models\Cart::createOrder() directly. This is what lets the
- * storefront checkout sequence stay uniform regardless of which provider is
- * active: set addresses, select shipping, hand off to whichever driver is
- * configured, and the driver decides when (or whether) the order actually
- * gets created. See docs/checkout.md / docs/payments.md.
- */
-interface PaymentDriver
-{
-    /**
-     * Whether this driver can actually be used right now — e.g. Stripe
-     * checking its own API key is present, an offline-style driver always
-     * returning true since it has no external dependency. Independent of
-     * Modules\Core\Payment\Models\PaymentMethod::enabled (the admin
-     * on/off toggle) — CheckoutService::getPaymentMethods() combines both:
-     * a type is only offered to the storefront if it's administratively
-     * enabled AND its driver reports itself configured.
-     */
-    public function isConfigured(): bool;
-
-    /**
-     * $type is the payment type key being confirmed (e.g. 'cash-in-hand',
-     * 'cash-on-delivery', 'stripe') — passed through even though most
-     * drivers only ever serve one type, because a driver shared across
-     * several types (e.g. one "no real confirmation" offline driver behind
-     * both cash-in-hand and cash-on-delivery) needs it to look up that
-     * type's own config (e.g. its 'authorized' status) rather than another
-     * type's.
-     *
-     * $data carries whatever the gateway needs to confirm this specific
-     * payment (Stripe: ['payment_intent' => $id], a redirect-based
-     * provider: its callback payload) — passed explicitly by the caller
-     * (a controller, a webhook job) rather than a driver reaching into the
-     * global request(), so confirm() works the same whether it's called
-     * from a synchronous HTTP request or an async webhook/job with no
-     * active request at all.
-     *
-     * @param  array<string, mixed>  $data
-     *
-     * @throws FingerprintMismatchException
-     * @throws CartException
-     */
-    public function confirm(Cart $cart, string $type, string $fingerprint, array $data): Order;
-}

src/Checkout/Events/OrderPlaced.php

@@ -5,13 +5,17 @@ namespace Modules\Core\Checkout\Events;
 use Lunar\Models\Order;
 
 /**
- * Dispatched by CheckoutService::placeOrder() the moment an Order exists —
+ * Dispatched once an Order's placed_at is set — the handoff point between
- * the handoff point between Checkout and Order (see docs/checkout.md's
+ * Checkout/Payment and Order (see docs/checkout.md's "Three-stage
- * "Three-stage lifecycle"). Checkout has no opinion about what happens
+ * lifecycle"). Fired by Modules\Core\Order\Listeners\
- * after this fires; Order's own listeners (not built yet — Order is a
+ * ApplyResolvedPaymentStatus once it resolves a PaymentCaptured/
- * named-but-unscoped concern, same status Recovery had before it existed)
+ * PaymentAuthorized event into an actual order status change, not by
- * would be what reacts to it — e.g. a confirmation email, initializing
+ * CheckoutService directly — a draft Order can exist (via
- * order status tracking.
+ * CheckoutService::initiatePayment()) well before this fires, if payment
+ * resolves asynchronously (e.g. a redirect-based gateway). Checkout has no
+ * opinion about what happens after this fires; Order's own listeners are
+ * what react to it — e.g. a confirmation email, initializing order status
+ * tracking.
  */
 class OrderPlaced
 {

src/Checkout/Services/CheckoutService.php

@@ -10,17 +10,16 @@ use Lunar\Base\Addressable;
 use Lunar\DataTypes\ShippingOption;
 use Lunar\Facades\ShippingManifest;
 use Lunar\Models\Cart;
-use Lunar\Models\Order;
 use Modules\Core\Cart\Services\CartService;
-use Modules\Core\Checkout\Contracts\PaymentDriver;
 use Modules\Core\Checkout\Events\BillingAddressSet;
-use Modules\Core\Checkout\Events\OrderPlaced;
 use Modules\Core\Checkout\Events\PaymentMethodSelected;
 use Modules\Core\Checkout\Events\ShippingAddressSet;
 use Modules\Core\Checkout\Events\ShippingOptionSelected;
 use Modules\Core\Checkout\Exceptions\InvalidShippingOptionException;
 use Modules\Core\Checkout\Exceptions\UnknownPaymentTypeException;
+use Modules\Core\Payment\DTOs\PaymentResult;
 use Modules\Core\Payment\Models\PaymentMethod;
+use Modules\Core\Payment\Services\PaymentDriverResolver;
 
 /**
  * Storefront-facing checkout operations, mirroring
@@ -29,9 +28,11 @@ use Modules\Core\Payment\Models\PaymentMethod;
  * implementation detail. See docs/checkout.md for the full design —
  * Checkout is the middle of a three-stage lifecycle (Cart → Checkout →
  * Order): it owns the placement moment itself (address, shipping selection,
- * placeOrder()) and ends the instant an Order exists. What happens to that
+ * ensuring a draft Order exists) and hands off to Payment the instant that
- * Order afterward (status transitions, fulfillment) is deliberately out of
+ * draft exists — see initiatePayment(). What happens to that Order
- * scope here — see OrderPlaced's docblock.
+ * afterward (status transitions, fulfillment) is deliberately out of
+ * scope here — see docs/payments.md and Checkout\Events\OrderPlaced's
+ * docblock for where that now lives.
  *
  * Depends on CartService for cart access rather than reaching into
  * Lunar\Facades\CartSession directly a second time, so Checkout stays
@@ -41,6 +42,7 @@ class CheckoutService
 {
     public function __construct(
         private readonly CartService $cart,
+        private readonly PaymentDriverResolver $paymentDrivers,
     ) {}
 
     public function setShippingAddress(array|Addressable $address): Cart
@@ -97,47 +99,12 @@ class CheckoutService
         return $cart;
     }
 
-    /**
-     * $fingerprint is mandatory, not optional — the caller must prove the
-     * cart total the shopper last saw (Cart::fingerprint()) still matches
-     * before an order is placed. Cart::checkFingerprint() throws Lunar's own
-     * FingerprintMismatchException on a mismatch (a line's price changed,
-     * stock adjusted the total, another tab modified the cart) rather than
-     * silently placing an order at a different total than what was shown.
-     *
-     * Not called directly by a storefront — see confirmPayment(), which is
-     * the only caller and supplies the fingerprint captured in
-     * selectPaymentMethod(), not one the storefront has to obtain itself.
-     *
-     * No exception wrapping: Lunar\Validation\Cart\ValidateCartForOrderCreation
-     * (run inside Cart::createOrder()) already throws
-     * Lunar\Exceptions\Carts\CartException with a field-keyed MessageBag
-     * ($exception->errors()) for address/shipping-option validation and the
-     * duplicate-order guard — already the right shape for a storefront to
-     * render as form errors directly. FingerprintMismatchException
-     * propagates the same way, for the same reason.
-     *
-     * @throws FingerprintMismatchException
-     * @throws CartException
-     */
-    public function placeOrder(string $fingerprint): Order
-    {
-        $cart = $this->cart->currentOrCreate();
-        $cart->checkFingerprint($fingerprint);
-
-        $order = $cart->createOrder();
-
-        Event::dispatch(new OrderPlaced($order));
-
-        return $order;
-    }
-
     /**
      * Every payment type currently offered to the storefront — every key
      * in config('lunar.payments.types') that is BOTH administratively
      * enabled (Modules\Core\Payment\Models\PaymentMethod::enabled) AND
-     * whose registered PaymentDriver reports itself usable right now
+     * whose registered driver reports itself usable right now
-     * (PaymentDriver::isConfigured() — e.g. Stripe with no API key set is
+     * (Configurable::isConfigured() — e.g. Stripe with no API key set is
      * never offered, regardless of the enabled toggle). A type with no
      * PaymentMethod row at all (never seeded) is treated as not offered,
      * same as disabled — nothing here creates one; see
@@ -149,7 +116,7 @@ class CheckoutService
     {
         return PaymentMethod::where('enabled', true)
             ->pluck('type')
-            ->filter(fn (string $type) => $this->resolvePaymentDriver($type)?->isConfigured() ?? false)
+            ->filter(fn (string $type) => $this->paymentDrivers->resolve($type)?->isConfigured() ?? false)
             ->values()
             ->all();
     }
@@ -165,13 +132,13 @@ class CheckoutService
      * including any payment-type-specific adjustment (e.g. a COD
      * surcharge), which only exists once payment_method is set and the
      * cart recalculates. Captured here, server-side, rather than asked of
-     * the storefront: this is the last moment before confirmPayment() that
+     * the storefront: this is the last moment before initiatePayment() that
-     * the shopper's reviewed total is known, and confirmPayment() reads it
+     * the shopper's reviewed total is known, and initiatePayment() reads it
      * back internally instead of taking a fingerprint parameter — a
      * storefront should never need to know Cart::fingerprint() exists.
      *
-     * Does not itself call a PaymentDriver — selecting a method and
+     * Does not itself call a payment driver — selecting a method and
-     * confirming payment against it are deliberately separate steps, same
+     * initiating payment against it are deliberately separate steps, same
      * as selecting a shipping option happens before placing the order.
      *
      * @throws UnknownPaymentTypeException if $type isn't currently offered
@@ -185,11 +152,11 @@ class CheckoutService
         }
 
         $cart = $this->cart->currentOrCreate();
-        $cart->meta = [...$cart->meta->toArray(), 'payment_method' => $type];
+        $cart->meta = [...($cart->meta?->toArray() ?? []), 'payment_method' => $type];
         $cart->save();
 
         $cart = $cart->calculate();
-        $cart->meta = [...$cart->meta->toArray(), 'checkout_fingerprint' => $cart->fingerprint()];
+        $cart->meta = [...($cart->meta?->toArray() ?? []), 'checkout_fingerprint' => $cart->fingerprint()];
         $cart->save();
 
         Event::dispatch(new PaymentMethodSelected($cart, $type));
@@ -198,51 +165,76 @@ class CheckoutService
     }
 
     /**
-     * Resolves $type's registered PaymentDriver and calls confirm() —
+     * The one storefront-facing "place this order and pay for it" call —
-     * the driver decides whether/when the order actually gets placed (see
+     * the point where Checkout hands off to Payment. Ensures a draft
-     * Modules\Core\Checkout\Contracts\PaymentDriver's docblock). $data
+     * Order exists (Cart::createOrder() — confirmed idempotent against a
-     * carries whatever that driver needs (Stripe's payment_intent id, a
+     * cart's own pre-existing, not-yet-placed-at draft; see
-     * future redirect-based provider's callback payload).
+     * vendor/lunarphp/core/src/Actions/Carts/CreateOrder.php), then
+     * resolves the payment type selected by selectPaymentMethod() and
+     * calls pay() or authorize() on its driver, per that type's
+     * config('lunar.payments.types.{type}.capture_mode') — boboko-core's
+     * own types (config/payment.php) are merged into that same Lunar
+     * config key by PaymentServiceProvider::boot().
      *
-     * The fingerprint passed to the driver is the one captured by
+     * Returns the driver's own PaymentResult UNCHANGED — this method does
-     * selectPaymentMethod(), not supplied by the caller — see that
+     * not wait for or resolve anything past what pay()/authorize() itself
-     * method's docblock. Throws the same FingerprintMismatchException a
+     * returns synchronously. A Pending result (an async gateway like
-     * caller-supplied one would if the cart's total has since changed;
+     * Stripe requiring 3-D Secure/a redirect) is a normal, expected
-     * missing entirely (selectPaymentMethod() was never called for this
+     * outcome, not an error — the caller (a storefront controller) is
-     * cart) is treated the same as a mismatch, not a different error.
+     * responsible for whatever the gateway needs next.
      *
-     * @param  array<string, mixed>  $data
+     * KNOWN GAP, explicitly out of scope for now: PaymentResult alone does
+     * not carry gateway-specific continuation data (e.g. Stripe's
+     * PaymentIntent client_secret for a Pending result needing frontend
+     * confirmation) — that concept existed on the deleted PaymentInitiation
+     * DTO and was intentionally removed from Payment's abstraction layer.
+     * Nothing here re-introduces it; only OfflinePaymentDriver's
+     * always-Immediate-Succeeded path is fully wired end-to-end today.
      *
-     * @throws UnknownPaymentTypeException if $type isn't currently offered
+     * The draft order's own $order->total (not the Cart's) is what gets
-     *   (see getPaymentMethods()) — re-checked here, not just in
+     * passed as $amount — Order::$total is Lunar's own Price-cast
-     *   selectPaymentMethod(), since a type could be disabled between
+     * attribute, already resolving the correct Currency via the order's
-     *   selection and confirmation
+     * own currency_code, and is the authoritative total once the draft
-     * @throws \Lunar\Exceptions\FingerprintMismatchException
+     * row exists.
-     * @throws \Lunar\Exceptions\Carts\CartException
+     *
+     * $context passed to the driver is {cart_id, order_id} — the exact
+     * keys Modules\Core\Payment\Drivers\StripePaymentDriver::
+     * rememberIntent() already reads.
+     *
+     * Same fingerprint precondition the old placeOrder() had: mandatory,
+     * not optional, checked before the draft is created.
+     *
+     * @param  array<string, mixed>  $data  passed through untouched to
+     *   the driver's pay()/authorize() — e.g. Stripe's payment_method
+     *   token.
+     *
+     * @throws UnknownPaymentTypeException if the cart's selected
+     *   payment_method (from selectPaymentMethod()) is no longer offered
+     *   — re-checked here, not just at selection time, since a type could
+     *   be disabled in between
+     * @throws FingerprintMismatchException
+     * @throws CartException
      */
-    public function confirmPayment(string $type, array $data = []): Order
+    public function initiatePayment(string $fingerprint, array $data = []): PaymentResult
     {
-        if (! in_array($type, $this->getPaymentMethods(), true)) {
+        $cart = $this->cart->currentOrCreate();
-            throw new UnknownPaymentTypeException($type);
+        $cart->checkFingerprint($fingerprint);
+
+        $type = $cart->meta['payment_method'] ?? null;
+
+        if ($type === null || ! in_array($type, $this->getPaymentMethods(), true)) {
+            throw new UnknownPaymentTypeException((string) $type);
         }
 
-        $cart = $this->cart->currentOrCreate();
+        $order = $cart->createOrder();
-        $fingerprint = $cart->meta['checkout_fingerprint'] ?? '';
 
-        return $this->resolvePaymentDriver($type)->confirm($cart, $type, $fingerprint, $data);
+        $driver = $this->paymentDrivers->resolve($type);
-    }
+        $captureMode = config("lunar.payments.types.{$type}.capture_mode", 'pay');
 
-    /**
+        $context = ['cart_id' => $cart->id, 'order_id' => $order->id];
-     * Resolves $type's registered PaymentDriver, or null if $type has no
-     * 'payment_driver' registered in config('lunar.payments.types.<type>')
-     * at all — deliberately non-throwing so getPaymentMethods() can filter
-     * unresolvable types silently rather than treating "not registered"
-     * as an error condition when just checking availability.
-     */
-    private function resolvePaymentDriver(string $type): ?PaymentDriver
-    {
-        $driverClass = config("lunar.payments.types.{$type}.payment_driver");
 
-        return $driverClass ? app($driverClass) : null;
+        return $captureMode === 'authorize'
+            ? $driver->authorize($type, $order->total, $data, $context)
+            : $driver->pay($type, $order->total, $data, $context);
     }
 }

src/Command/TuneProductSearchCommand.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Modules\Core\Command;
+
+use Illuminate\Console\Command;
+use Laravel\Scout\EngineManager;
+use Laravel\Scout\Engines\MeilisearchEngine;
+use Lunar\Models\Product;
+
+/**
+ * lunarphp/meilisearch's own `lunar:meilisearch:setup` only pushes
+ * filterableAttributes/sortableAttributes (see MeilisearchSetup::handle())
+ * — it has no notion of typo tolerance or prefix search, and Meilisearch's
+ * defaults for both are loose enough to produce bad matches on short Greek
+ * words. Confirmed via showMatchesPosition that a query for "Κάπτεν" was
+ * matching "κανένας" purely through prefixSearch's default 'indexingTime'
+ * behavior (their edit distance is far past anything typo tolerance would
+ * bridge) — fixed by disabling prefix search below, verified afterward with
+ * "Super"/"Superheroes"-style prefix probes returning no results for a
+ * partial word. minWordSizeForTypos is tightened defensively alongside it
+ * so short words in general get less typo-tolerant fuzzing, even though a
+ * separate short-word collision case ("Κάπτεν" vs "κάποτε", high letter
+ * overlap despite real edit distance) persisted after both settings were
+ * confirmed live and wasn't fully root-caused — treated as a known,
+ * narrow edge case rather than a blocker. Run this after
+ * `lunar:meilisearch:setup`, whenever Product's index needs
+ * (re)provisioning.
+ *
+ * Disabling prefix search here is a deliberate tradeoff: it also turns off
+ * legitimate partial-word matching (typing "car" matching "cart" before
+ * you finish the word) — useful for a future autocomplete/search-as-you-
+ * type UI. If that's built later, re-enable prefixSearch deliberately then,
+ * informed by real UX needs, rather than leaving it on by accident today.
+ */
+class TuneProductSearchCommand extends Command
+{
+    protected $signature = 'lunar:meilisearch:tune-product-search';
+
+    protected $description = 'Tighten typo-tolerance and disable prefix search on the product search index';
+
+    public function handle(EngineManager $engineManager): void
+    {
+        /** @var MeilisearchEngine $engine */
+        $engine = $engineManager->createMeilisearchDriver();
+
+        $index = $engine->getIndex((new Product)->searchableAs());
+
+        $this->components->info('Updating typo tolerance for product search...');
+
+        $task = $index->updateTypoTolerance([
+            'minWordSizeForTypos' => [
+                'oneTypo' => 8,
+                'twoTypos' => 12,
+            ],
+        ]);
+
+        $engine->waitForTask($task['taskUid']);
+
+        $this->components->info('Disabling prefix search for product search...');
+
+        $task = $index->updatePrefixSearch('disabled');
+
+        $engine->waitForTask($task['taskUid']);
+
+        $this->components->info('Product search index tuned.');
+    }
+}

src/MigrateImport/Shopify/Resolvers/ProductOptionResolver.php

@@ -16,10 +16,16 @@ class ProductOptionResolver
         // the same option instead of creating a near-duplicate.
         $handle = Str::slug($name) ?: 'option';
 
+        // 'label' must be set even though nothing here reads it back — a null
+        // label crashes Lunar's own ProductOptionIndexer::toSearchableArray()
+        // (foreach (null as ...)) the moment this option gets reindexed, since
+        // it assumes every ProductOption always has one. Same value as 'name'
+        // is a reasonable default; Shopify's CSV has no separate "label" concept.
         return ProductOption::query()->firstOrCreate(
             ['handle' => $handle],
             [
                 'name' => [DefaultLocale::code() => $name],
+                'label' => [DefaultLocale::code() => $name],
                 'shared' => true,
             ],
         );

src/MigrateImport/Shopify/ShopifyExportImporter.php

@@ -25,6 +25,7 @@ use Modules\Core\MigrateImport\Shopify\Resolvers\ProductOptionResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\ProductTypeResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\TagResolver;
 use Modules\Core\MigrateImport\Shopify\Resolvers\TaxClassResolver;
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
 
 class ShopifyExportImporter implements Importer
 {
@@ -113,7 +114,7 @@ class ShopifyExportImporter implements Importer
         $options = $this->attachOptions($product, $row);
 
         foreach ($group->variantRows as $index => $variantRow) {
-            $this->importVariant($product, $group->handle, $index, $variantRow, $taxClass, $currency, $options);
+            $this->importVariant($product, $group->handle, $index, $variantRow, $taxClass, $currency, $options, $imagesPath);
         }
 
         foreach ($group->imageRows as $index => $imageRow) {
@@ -151,6 +152,7 @@ class ShopifyExportImporter implements Importer
         TaxClass $taxClass,
         Currency $currency,
         array $options,
+        string $imagesPath,
     ): void {
         $externalId = "{$handle}#{$index}";
         $existing = ImportMapping::resolve(self::SOURCE, 'variant', $externalId);
@@ -182,6 +184,26 @@ class ShopifyExportImporter implements Importer
             : null;
 
         $this->priceResolver->resolve($variant, $currency, $price, $comparePrice);
+
+        // Shopify's own "Variant Image" column — the one image a variant picker
+        // actually swaps to when that variant is selected — distinct from the
+        // product's full gallery (imageRows below). Often the same file as one
+        // of the product's own image rows, sometimes not yet imported at all
+        // (e.g. a variant-only image never listed as its own image row) — either
+        // way resolveOrImportImage() handles both via the same Image Src dedup
+        // key, so whichever of importVariant()/importImage() runs first for a
+        // given src does the actual import.
+        $variantImageSrc = trim((string) ($row['Variant Image'] ?? ''));
+
+        if ($variantImageSrc !== '') {
+            $media = $this->resolveOrImportImage($product, $handle, $variantImageSrc, 1, $imagesPath);
+
+            if ($media) {
+                $variant->images()->syncWithoutDetaching([
+                    $media->id => ['primary' => true, 'position' => 1],
+                ]);
+            }
+        }
     }
 
     private function importImage(
@@ -191,29 +213,54 @@ class ShopifyExportImporter implements Importer
         array $row,
         string $imagesPath,
     ): void {
-        $externalId = $row['Image Src'] ?: "{$handle}#image-{$index}";
         $position = (int) ($row['Image Position'] ?? $index + 1);
 
-        if (ImportMapping::resolve(self::SOURCE, 'image', $externalId)) {
+        $this->resolveOrImportImage($product, $handle, $row['Image Src'], $position, $imagesPath);
-            return;
+    }
+
+    /**
+     * Resolves the Media already imported for $imageSrc (recorded under
+     * source_type 'image', keyed by Image Src — the same URL Shopify repeats
+     * across a product's own image rows and any variant's "Variant Image"
+     * column), importing it via AssetResolver if this is the first time this
+     * src has been seen. Shared by importImage() (product gallery) and
+     * importVariant() (variant-specific image) so the same physical file is
+     * never uploaded to Spatie MediaLibrary twice just because Shopify's flat
+     * CSV format repeats the URL on multiple rows.
+     */
+    private function resolveOrImportImage(
+        Product $product,
+        string $handle,
+        string $imageSrc,
+        int $position,
+        string $imagesPath,
+    ): ?Media {
+        $externalId = $imageSrc ?: "{$handle}#image-{$position}";
+
+        $existing = ImportMapping::resolve(self::SOURCE, 'image', $externalId);
+
+        if ($existing instanceof Media) {
+            return $existing;
         }
 
-        $localFile = $this->findLocalFile($imagesPath, $row['Image Src']);
+        $localFile = $this->findLocalFile($imagesPath, $imageSrc);
 
         if ($localFile === null) {
             Log::warning('Shopify import: image file not found', [
                 'handle' => $handle,
-                'image_src' => $row['Image Src'],
+                'image_src' => $imageSrc,
             ]);
 
-            return;
+            return null;
         }
 
         $media = $this->assetResolver->resolve($product, $localFile, $position);
 
         if ($media) {
-            ImportMapping::record(self::SOURCE, 'image', $externalId, $product);
+            ImportMapping::record(self::SOURCE, 'image', $externalId, $media);
         }
+
+        return $media;
     }
 
     private function findLocalFile(string $imagesPath, string $imageSrc): ?string

src/Order/Enums/FulfillmentStatus.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Modules\Core\Order\Enums;
+
+/**
+ * Derived from Shipment/ShipmentInfo — no equivalent existed anywhere in
+ * Lunar or this codebase before OrderStatus::fulfillment().
+ */
+enum FulfillmentStatus: string
+{
+    case Unfulfilled = 'unfulfilled';
+    case Shipped = 'shipped';
+    case PartiallyShipped = 'partially-shipped';
+    case Delivered = 'delivered';
+}

src/Order/Enums/PaymentStatus.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Order\Enums;
+
+/**
+ * Same states/logic as Lunar's own ManageOrder::paymentStatus(), which
+ * only exists as a Filament-page Livewire #[Computed] method — this is
+ * that same derivation, reusable from anywhere via Order::paymentStatus().
+ */
+enum PaymentStatus: string
+{
+    case Offline = 'offline';
+    case Uncaptured = 'uncaptured';
+    case Captured = 'captured';
+    case PartialRefund = 'partial-refund';
+    case Refunded = 'refunded';
+}

src/Order/Events/OrderCaptured.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+
+/**
+ * Dispatched by TransactionObserver::saved() when a Transaction's type
+ * changes to 'capture' (from 'intent') and succeeds. Unlike refunds,
+ * Lunar's Stripe driver (StoreCharges) reuses the same Transaction row
+ * across intent -> capture rather than creating a new one, so this can't
+ * key off `wasRecentlyCreated` the way OrderRefunded does.
+ */
+class OrderCaptured
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly Transaction $transaction,
+    ) {}
+}

src/Order/Events/OrderDelivered.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Modules\Core\Shipping\Models\ShipmentInfo;
+
+/**
+ * Dispatched by Order's DeriveOrderDeliveredFromShipment listener, which
+ * reacts to Shipping's ShipmentStatusUpdatedByCarrier — delivery is a
+ * tracking checkpoint, not a manual status write, so it never goes through
+ * OrderStatusUpdated. Order.status itself is left untouched here; this is
+ * only the signal for delivery notifications and similar reactions.
+ */
+class OrderDelivered
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ShipmentInfo $shipmentInfo,
+    ) {}
+}

src/Order/Events/OrderRefunded.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+
+/**
+ * Dispatched by TransactionObserver::saved() whenever a successful
+ * type=refund Transaction row is written — every payment driver (Lunar's
+ * own StripePaymentType::refund(), or a future boboko-owned driver for a
+ * provider Lunar doesn't ship) creates a new row for each refund, so
+ * `created` alone (filtered to type+success) is enough here, unlike
+ * captures which can reuse an existing row.
+ */
+class OrderRefunded
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly Transaction $transaction,
+    ) {}
+}

src/Order/Events/OrderStatusUpdated.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Order\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Lunar\Models\Order;
+
+/**
+ * Dispatched by OrderObserver::updated() whenever an Order's status column
+ * changes, regardless of what wrote it — Filament's UpdateStatusAction,
+ * artisan tinker, a future API. Lunar's own UpdatesOrderStatus trait fires
+ * mailers inline, but only for that one admin action; this event is the
+ * general-purpose hook everything else (our own mailers, automations,
+ * derived payment/fulfillment status) should listen to instead.
+ */
+class OrderStatusUpdated
+{
+    use Dispatchable;
+
+    public function __construct(
+        public readonly Order $order,
+        public readonly ?string $previousStatus,
+        public readonly string $newStatus,
+    ) {}
+}

src/Order/Listeners/ApplyResolvedPaymentStatus.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Illuminate\Support\Facades\Event;
+use Lunar\Models\Order;
+use Modules\Core\Checkout\Events\OrderPlaced;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptured;
+
+/**
+ * The only place an Order's status column is written in reaction to a
+ * payment outcome. Registered against BOTH PaymentCaptured and
+ * PaymentAuthorized (see OrderServiceProvider) — same handler either way,
+ * since both carry the same {type, result, context} shape and only differ
+ * in which config key decides the resulting status.
+ *
+ * Reads $event->context['order_id'] to find which Order this outcome
+ * belongs to — Payment has no concept of an Order, so this is the one
+ * place that context key gets consumed on the Order side (Payment's own
+ * StripePaymentDriver reads $context['order_id'] independently, for its
+ * own unrelated correlation need — see that class's rememberIntent()).
+ *
+ * Loads and saves the model (not a bulk ::whereKey()->update()) so
+ * Order::observe()'s updated() hook fires and OrderStatusUpdated goes out
+ * the same as any other status write — see that event's own docblock for
+ * why it's meant to fire "regardless of what wrote it."
+ *
+ * Dispatches Checkout\Events\OrderPlaced itself, once placed_at is set —
+ * see that event's own docblock for why this, not CheckoutService, is now
+ * the dispatch point.
+ */
+class ApplyResolvedPaymentStatus
+{
+    public function handle(PaymentCaptured|PaymentAuthorized $event): void
+    {
+        $orderId = $event->context['order_id'] ?? null;
+
+        if ($orderId === null) {
+            return;
+        }
+
+        $order = Order::findOrFail($orderId);
+
+        $configKey = $event instanceof PaymentCaptured ? 'captured_status' : 'authorized_status';
+        $status = config("lunar.payments.types.{$event->type}.{$configKey}");
+
+        if ($status === null) {
+            return;
+        }
+
+        $wasPlaced = ! blank($order->placed_at);
+
+        $order->update([
+            'status' => $status,
+            'placed_at' => $order->placed_at ?? now(),
+        ]);
+
+        if (! $wasPlaced) {
+            Event::dispatch(new OrderPlaced($order));
+        }
+    }
+}

src/Order/Listeners/DeriveOrderDeliveredFromShipment.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Order\Listeners;
+
+use Modules\Core\Order\Events\OrderDelivered;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+/**
+ * Translates a carrier tracking checkpoint into OrderDelivered — the event
+ * OrderDeliveredNotification (via NotificationRegistry) actually listens
+ * to. Kept separate from the notification itself so the "is this checkpoint
+ * a delivery" filtering doesn't leak into notification code.
+ */
+class DeriveOrderDeliveredFromShipment
+{
+    public function handle(ShipmentStatusUpdatedByCarrier $event): void
+    {
+        if ($event->shipmentInfo->status !== TrackingStatus::Delivered) {
+            return;
+        }
+
+        $order = $event->shipmentInfo->shipment->order;
+
+        if (! $order) {
+            return;
+        }
+
+        OrderDelivered::dispatch($order, $event->shipmentInfo);
+    }
+}

src/Order/Notifications/OrderCapturedNotification.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderCaptured;
+
+class OrderCapturedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderCaptured $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.captured.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderCaptured::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Payment captured for your order :reference', ['reference' => $order->reference]))
+            ->view('core::order.notifications.captured', [
+                'reference' => $order->reference,
+                'amount' => $this->event->transaction->amount->formatted,
+            ]);
+    }
+}

src/Order/Notifications/OrderDeliveredNotification.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderDelivered;
+
+class OrderDeliveredNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderDelivered $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.delivered.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderDelivered::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference has been delivered', ['reference' => $order->reference]))
+            ->view('core::order.notifications.delivered', [
+                'reference' => $order->reference,
+            ]);
+    }
+}

src/Order/Notifications/OrderRefundedNotification.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderRefunded;
+
+class OrderRefundedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderRefunded $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.refunded.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderRefunded::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('A refund has been issued for your order :reference', ['reference' => $order->reference]))
+            ->view('core::order.notifications.refunded', [
+                'reference' => $order->reference,
+                'amount' => $this->event->transaction->amount->formatted,
+            ]);
+    }
+}

src/Order/Notifications/OrderStatusUpdatedNotification.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Order\Notifications;
+
+use Illuminate\Notifications\AnonymousNotifiable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Facades\Notification as NotificationFacade;
+use Modules\Core\Notification\BaseNotification;
+use Modules\Core\Order\Events\OrderStatusUpdated;
+
+class OrderStatusUpdatedNotification extends BaseNotification
+{
+    public function __construct(private readonly OrderStatusUpdated $event) {}
+
+    public static function getKey(): string
+    {
+        return 'order.status_updated.customer.mail';
+    }
+
+    public static function listensTo(): string
+    {
+        return OrderStatusUpdated::class;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function notifiable(): AnonymousNotifiable
+    {
+        $order = $this->event->order;
+
+        $email = $order->billingAddress?->contact_email ?? $order->shippingAddress?->contact_email;
+
+        return NotificationFacade::route('mail', $email);
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        $order = $this->event->order;
+
+        return (new MailMessage)
+            ->subject(__('Your order :reference has been updated', ['reference' => $order->reference]))
+            ->view('core::order.notifications.status-updated', [
+                'reference' => $order->reference,
+                'statusLabel' => config("lunar.orders.statuses.{$order->status}.label", $order->status),
+            ]);
+    }
+}

src/Order/Observers/OrderObserver.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Order\Observers;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Events\OrderStatusUpdated;
+
+class OrderObserver
+{
+    public function updated(Order $order): void
+    {
+        if (! $order->wasChanged('status')) {
+            return;
+        }
+
+        OrderStatusUpdated::dispatch(
+            $order,
+            $order->getOriginal('status'),
+            $order->status,
+        );
+    }
+}

src/Order/Observers/TransactionObserver.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Order\Observers;
+
+use Lunar\Models\Transaction;
+use Modules\Core\Order\Events\OrderCaptured;
+use Modules\Core\Order\Events\OrderRefunded;
+
+class TransactionObserver
+{
+    public function saved(Transaction $transaction): void
+    {
+        if (! $transaction->success) {
+            return;
+        }
+
+        if ($transaction->type === 'refund' && $transaction->wasRecentlyCreated) {
+            OrderRefunded::dispatch($transaction->order, $transaction);
+
+            return;
+        }
+
+        if ($transaction->type === 'capture' && $transaction->wasChanged('type')) {
+            OrderCaptured::dispatch($transaction->order, $transaction);
+        }
+    }
+}

src/Order/Support/OrderStatus.php

@@ -0,0 +1,93 @@
+<?php
+
+namespace Modules\Core\Order\Support;
+
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\FulfillmentStatus;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Shipping\Enums\TrackingStatus;
+
+/**
+ * Payment/fulfillment state, derived on read from transactions and
+ * shipments rather than stored — mirrors the logic Lunar's own
+ * ManageOrder::paymentStatus() computes as a Livewire #[Computed] method
+ * (Filament-page-only, not reusable), reimplemented here as a plain,
+ * queryable value any code can call via Order::macro() in
+ * OrderServiceProvider.
+ */
+class OrderStatus
+{
+    public static function payment(Order $order): PaymentStatus
+    {
+        $transactions = $order->transactions;
+
+        $intentTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'intent' && $t->success)
+            ->sum('amount.value');
+
+        $captureTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'capture' && $t->success)
+            ->sum('amount.value');
+
+        $refundTotal = $transactions
+            ->filter(fn ($t) => $t->type === 'refund' && $t->success)
+            ->sum('amount.value');
+
+        $total = $intentTotal ?: $captureTotal;
+
+        if (! $total) {
+            return PaymentStatus::Offline;
+        }
+
+        if (
+            ($refundTotal && $refundTotal < $total) ||
+            ($captureTotal && $captureTotal < $intentTotal)
+        ) {
+            return PaymentStatus::PartialRefund;
+        }
+
+        if ($refundTotal >= $total) {
+            return PaymentStatus::Refunded;
+        }
+
+        if ($captureTotal >= $intentTotal) {
+            return PaymentStatus::Captured;
+        }
+
+        return PaymentStatus::Uncaptured;
+    }
+
+    /**
+     * Reads shipments.shipmentInfo if already eager-loaded (the caller's
+     * job — e.g. Order::with('shipments.shipmentInfo')) and picks the
+     * latest checkpoint in PHP, instead of Shipment::latestShipmentInfo()'s
+     * per-shipment query — calling this across a list of orders would
+     * otherwise be an extra query per shipment.
+     */
+    public static function fulfillment(Order $order): FulfillmentStatus
+    {
+        $shipments = $order->shipments->reject(fn ($shipment) => $shipment->cancelled_at !== null);
+
+        if ($shipments->isEmpty()) {
+            return FulfillmentStatus::Unfulfilled;
+        }
+
+        $latestStatuses = $shipments->map(function ($shipment) {
+            $latest = $shipment->relationLoaded('shipmentInfo')
+                ? $shipment->shipmentInfo->sortByDesc('occurred_at')->first()
+                : $shipment->latestShipmentInfo();
+
+            return $latest?->status ?? TrackingStatus::Pending;
+        });
+
+        if ($latestStatuses->every(fn (TrackingStatus $status) => $status === TrackingStatus::Delivered)) {
+            return FulfillmentStatus::Delivered;
+        }
+
+        if ($latestStatuses->contains(fn (TrackingStatus $status) => $status === TrackingStatus::Delivered)) {
+            return FulfillmentStatus::PartiallyShipped;
+        }
+
+        return FulfillmentStatus::Shipped;
+    }
+}

src/Payment/Contracts/Configurable.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+/**
+ * Every driver implements this, orthogonal to which payment operations
+ * (SupportsPay, SupportsAuthorization, ...) it supports — whether a driver
+ * can actually be used right now is a separate question from what it's
+ * capable of when it can be. An offline driver has no external dependency
+ * to be missing and always returns true; a gateway driver checks its own
+ * credentials/API key.
+ */
+interface Configurable
+{
+    /**
+     * Independent of any admin-facing enabled/disabled toggle a caller
+     * might also apply on top — this is only about whether the driver
+     * itself is usable right now (e.g. Stripe with no API key configured
+     * is never usable, regardless of any such toggle).
+     */
+    public function isConfigured(): bool;
+}

src/Payment/Contracts/HandlesPaymentCallback.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * The async counterpart to SupportsPay::pay()/SupportsAuthorization::
+ * authorize() — implemented only by a driver whose gateway can't resolve
+ * one of those synchronously (a redirect the shopper completes elsewhere,
+ * a webhook that arrives later). A driver whose pay()/authorize() always
+ * returns a terminal PaymentResult (Succeeded/Failed) in the same call
+ * never implements this — there is nothing left to call back.
+ *
+ * Resolves into the SAME events the original pay()/authorize() call would
+ * have produced had it resolved synchronously — PaymentCaptured/
+ * PaymentCaptureFailed for a pending pay(), PaymentAuthorized/
+ * PaymentAuthorizationFailed for a pending authorize(). Which pair
+ * applies is up to the driver to track (e.g. against whatever it stored
+ * when the original call returned Pending), not something this method's
+ * signature can express generically.
+ */
+interface HandlesPaymentCallback
+{
+    /**
+     * $reference is the gateway's own identifier for the pending attempt
+     * (the same value the original pay()/authorize() call returned via
+     * PaymentResult::$reference) — how the driver finds which attempt
+     * this callback belongs to.
+     *
+     * $data carries whatever the callback/webhook payload contains
+     * (Stripe: ['payment_intent' => $id], a redirect-based provider: its
+     * query params or POST body) — passed explicitly by the caller rather
+     * than the driver reaching into the global request(), so this works
+     * the same whether it's called from a synchronous HTTP request or an
+     * async webhook job with no active request at all.
+     *
+     * $context is opaque to the driver, carried through untouched into
+     * whichever Payment event this callback produces — see SupportsPay::
+     * pay()'s own $context param for the full reasoning. A driver that
+     * needs the ORIGINAL context from the pay()/authorize() call (a
+     * webhook's own payload carries none of its own) must have persisted
+     * it itself when that call returned Pending — Payment provides no
+     * storage for this.
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function handleCallback(string $reference, array $data, array $context = []): PaymentResult;
+}

src/Payment/Contracts/SupportsAuthorization.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * A driver's hold-only operation (Mastercard's "Authorize", Nexi's
+ * ActionType::PREAUTH(), Stripe's capture_method=manual) — places a hold
+ * on the customer's payment method without moving any funds. Only a
+ * driver that also implements SupportsCaptures/SupportsVoids can do
+ * anything with the resulting hold afterward; implementing this alone
+ * with neither of those would leave the hold to simply expire
+ * (typically ~7 days, gateway-dependent) with no way to settle or release
+ * it early.
+ *
+ * A driver capable of both authorize-then-settle AND an atomic charge
+ * (most card gateways) implements this alongside SupportsPay — which one
+ * gets called for a given payment attempt is the CALLER's choice (a
+ * policy decision), not something this driver decides for itself.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentAuthorized or
+ * PaymentAuthorizationFailed based on the returned PaymentResult's status,
+ * unless $result->status is Pending — see SupportsPay's docblock for the
+ * same async-resolution note.
+ */
+interface SupportsAuthorization
+{
+    /**
+     * Same $type/$amount/$data/$context reasoning as SupportsPay::pay().
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function authorize(string $type, Price $amount, array $data = [], array $context = []): PaymentResult;
+}

src/Payment/Contracts/SupportsCaptures.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Settles a PRIOR SupportsAuthorization::authorize() hold — only ever
+ * valid against a reference that call (or a HandlesPaymentCallback
+ * resolving it) produced, never called standalone. A driver with no
+ * authorize-then-settle model at all (most redirect/wallet gateways, any
+ * offline driver) never implements this — it settles everything through
+ * SupportsPay::pay() in one step instead.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentCaptured or
+ * PaymentCaptureFailed — the same terminal events SupportsPay::pay()
+ * produces, since "money has been captured" is the same business fact
+ * regardless of which path reached it.
+ */
+interface SupportsCaptures
+{
+    /**
+     * $reference is the identifier SupportsAuthorization::authorize()
+     * returned (PaymentResult::$reference) for the hold being settled.
+     *
+     * $amount is Lunar's own Price (never a gateway's own minor-unit
+     * scale — see PaymentResult's docblock), and lets a driver capture
+     * less than the full authorized amount (e.g. shipping less than
+     * ordered) — up to the driver/gateway whether a partial capture also
+     * releases the remainder or leaves it capturable again later
+     * (multicapture-style gateways). Required explicitly, not derived by
+     * the driver from a live gateway lookup — the caller (whatever placed
+     * the original authorize() call) already knows it.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function capture(string $reference, Price $amount, array $context = []): PaymentResult;
+}

src/Payment/Contracts/SupportsPay.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * A driver's atomic charge — authorize and capture in one gateway call
+ * (Mastercard's own "Pay" operation, Nexi's ActionType::PAY(), Stripe's
+ * capture_method=automatic, or an offline driver with no gateway at all).
+ * Distinct from SupportsAuthorization: a driver that only ever settles in
+ * one step implements this and nothing else — there is no separate hold
+ * to later capture() or void().
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentCaptured or
+ * PaymentCaptureFailed based on the returned PaymentResult's status,
+ * unless $result->status is Pending (an async gateway that hasn't
+ * resolved yet — see HandlesPaymentCallback for how that gets resolved
+ * later, from a separate call this method's return value does not wait
+ * on).
+ */
+interface SupportsPay
+{
+    /**
+     * $type is the payment type key being charged (e.g. 'cash-on-delivery',
+     * 'stripe') — passed through even though most drivers only ever serve
+     * one type, because a driver shared across several types needs it to
+     * look up that type's own config.
+     *
+     * $amount is required, not optional data a caller might omit — there
+     * is no way to process a payment without knowing what to charge.
+     * Lunar's own Price (bundling its own currency) — the same money
+     * representation every other Payment contract method takes/returns,
+     * see PaymentResult's own docblock.
+     *
+     * $data carries whatever ELSE the gateway needs (customer details, a
+     * payment method token) — the caller's responsibility to assemble,
+     * since a driver has no notion of a cart or order to pull them from
+     * itself.
+     *
+     * $context is opaque to the driver — carried through untouched into
+     * whichever Payment event this call (or a later handleCallback()
+     * resolving it) produces, so the caller can correlate the result back
+     * to whatever it needs, without Payment ever needing to know what
+     * that is.
+     *
+     * @param  array<string, mixed>  $data
+     * @param  array<string, mixed>  $context
+     */
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult;
+}

src/Payment/Contracts/SupportsRefunds.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Reverses settled funds — independent of SupportsCaptures/SupportsVoids:
+ * a driver that only ever settles via SupportsPay::pay() (no separate
+ * authorize step) can still implement this, since a refund targets money
+ * already taken regardless of how it got taken. A driver implements this
+ * whenever its gateway exposes any refund capability at all, whether or
+ * not it also supports authorize-then-capture.
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentRefunded or
+ * PaymentRefundFailed.
+ */
+interface SupportsRefunds
+{
+    /**
+     * $reference is the identifier the original SupportsPay::pay() or
+     * SupportsCaptures::capture() call returned for the settled funds
+     * being refunded.
+     *
+     * $amount is Lunar's own Price (never a gateway's own minor-unit
+     * scale — see PaymentResult's docblock), allowing a partial refund; a
+     * gateway may allow multiple partial refunds against one settlement,
+     * up to its own total. Required explicitly, same reasoning as
+     * SupportsCaptures::capture()'s own $amount.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function refund(string $reference, Price $amount, array $context = []): PaymentResult;
+}

src/Payment/Contracts/SupportsVoids.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Modules\Core\Payment\Contracts;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Cancels a PRIOR SupportsAuthorization::authorize() hold WITHOUT
+ * settling it — the "actually, never mind" exit SupportsCaptures::capture()
+ * doesn't take. No funds ever moved, so this is not a refund: there is
+ * nothing to give back, only a hold to release early (rather than letting
+ * it simply expire on its own).
+ *
+ * Dispatches Modules\Core\Payment\Events\PaymentVoided or
+ * PaymentVoidFailed.
+ */
+interface SupportsVoids
+{
+    /**
+     * $reference is the identifier SupportsAuthorization::authorize()
+     * returned for the hold being released.
+     *
+     * $amount is the authorized amount being released — Lunar's own
+     * Price, same as every other Payment contract method (see
+     * PaymentResult's own docblock). Required explicitly: the caller
+     * (whatever placed the original authorize() call) already knows it,
+     * same reasoning as SupportsCaptures::capture()'s own $amount — a
+     * driver shouldn't need a live gateway lookup just to know what it's
+     * releasing.
+     *
+     * @param  array<string, mixed>  $context
+     */
+    public function void(string $reference, Price $amount, array $context = []): PaymentResult;
+}

src/Payment/DTOs/PaymentContinuation.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Payment\DTOs;
+
+use Modules\Core\Payment\Enums\PaymentContinuationType;
+
+/**
+ * What a caller does next with a Pending PaymentResult, gateway-agnostic —
+ * see PaymentContinuationType for the two shapes. Deliberately minimal:
+ * this is NOT a return to the deleted PaymentInitiation DTO (which also
+ * carried mode/reference/meta) — reference already lives on PaymentResult
+ * itself, and mode is now this DTO's own $type.
+ */
+final class PaymentContinuation
+{
+    public function __construct(
+        public readonly PaymentContinuationType $type,
+        public readonly string $value,
+    ) {}
+}

src/Payment/DTOs/PaymentResult.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Modules\Core\Payment\DTOs;
+
+use Lunar\DataTypes\Price;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+
+/**
+ * The one shape every Payment operation (pay, authorize, capture, void,
+ * refund, handleCallback) returns, regardless of driver — a caller never
+ * writes gateway-specific branching to read the outcome.
+ *
+ * Deliberately not one-size-fits-all in richness underneath: a gateway's
+ * own response can be as sparse as Nexi's capture (just an operation id +
+ * timestamp, no echoed amount or status) or as rich as Stripe's
+ * PaymentIntent (status, amounts, decline classification, full error
+ * detail). $status/$reference/$amount are the only fields every driver can
+ * always populate — $amount from what WE requested, not necessarily
+ * echoed by the gateway. Everything else is best-effort normalization;
+ * $raw is the unconditional escape hatch for genuine audit fidelity
+ * (the untouched gateway response), so nothing is ever lost even when a
+ * gateway has no field to normalize into $failureReason/$retriable.
+ */
+final class PaymentResult
+{
+    /**
+     * @param  $amount  Lunar's own money type (Lunar\DataTypes\Price —
+     *   integer minor units bundled with its Currency), the SAME
+     *   representation every contract method takes/returns — never a
+     *   gateway's own minor-unit scale. Each driver converts at its own
+     *   boundary (e.g. StripeManager::toStripeAmount()/fromStripeAmount())
+     *   before calling out to, or after reading back from, its gateway —
+     *   Payment itself only ever speaks Lunar's Price.
+     * @param  $failureReason  a human-readable reason, only meaningful
+     *   when $status is Failed — the driver's own normalization of
+     *   whatever the gateway called it (Stripe's decline_code message,
+     *   Nexi's ErrorsInner::$description, ...).
+     * @param  $retriable  whether the caller should offer "try again" with
+     *   the SAME payment method, vs. "use a different one" — real,
+     *   gateway-native distinction on Stripe (decline_code soft/hard) and
+     *   Mastercard (merchantAdviceCode / scheme soft-decline codes), but
+     *   Nexi's OperationResult has no such signal at all. Defaults to
+     *   false (assume not safely retriable) rather than guessing when a
+     *   driver's gateway has no such classification.
+     * @param  $raw  the untouched gateway response body — always
+     *   populated, even when the gateway's own fields were too sparse to
+     *   normalize into anything above.
+     * @param  $meta  driver-specific extras that don't fit the normalized
+     *   fields above (e.g. a card's last four digits).
+     * @param  $continuation  only meaningful when $status is Pending —
+     *   what the caller does next (a redirect URL, a client secret for
+     *   frontend JS), gateway-agnostic. Null for every other status, and
+     *   for any driver whose pay()/authorize() never returns Pending
+     *   (e.g. OfflinePaymentDriver).
+     */
+    public function __construct(
+        public readonly PaymentResultStatus $status,
+        public readonly string $reference,
+        public readonly Price $amount,
+        public readonly ?string $failureReason = null,
+        public readonly bool $retriable = false,
+        public readonly array $raw = [],
+        public readonly array $meta = [],
+        public readonly ?PaymentContinuation $continuation = null,
+    ) {}
+}

src/Payment/Drivers/OfflinePaymentDriver.php

@@ -2,35 +2,28 @@
 
 namespace Modules\Core\Payment\Drivers;
 
-use Lunar\Exceptions\Carts\CartException;
+use Illuminate\Support\Str;
-use Lunar\Exceptions\DisallowMultipleCartOrdersException;
+use Lunar\DataTypes\Price;
-use Lunar\Exceptions\FingerprintMismatchException;
+use Modules\Core\Payment\Contracts\Configurable;
-use Lunar\Models\Cart;
+use Modules\Core\Payment\Contracts\SupportsPay;
-use Lunar\Models\Order;
+use Modules\Core\Payment\DTOs\PaymentResult;
-use Modules\Core\Checkout\Contracts\PaymentDriver;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
-use Modules\Core\Checkout\Services\CheckoutService;
+use Modules\Core\Payment\Events\PaymentCaptured;
 
 /**
  * Shared by every payment type with no real gateway to confirm against —
  * cash-in-hand, cash-on-delivery — where the shopper pays at pickup/on
- * delivery, not at checkout. confirm() has nothing to wait on, so it places
+ * delivery, not at checkout. There is no separate hold-then-settle model
- * the order immediately, same as Lunar's own OfflinePayment would, but
+ * (SupportsAuthorization/SupportsCaptures/SupportsVoids) and no async
- * through CheckoutService::placeOrder() so it goes through the same
+ * resolution (HandlesPaymentCallback) — pay() decides success immediately
- * fingerprint check every other driver does. $data is unused: nothing about
+ * and dispatches PaymentCaptured before returning.
- * this confirmation depends on gateway-specific payload.
  *
- * Sets the order status to config("lunar.payments.types.{$type}.authorized")
+ * $reference is generated here (not supplied by a gateway, since there is
- * afterward, using the type actually confirmed — not a hardcoded key —
+ * none) purely so PaymentCaptured, and anything downstream keying on it,
- * since this one driver is shared across multiple types.
+ * have something to identify this attempt by.
- * placeOrder() itself leaves the order at Lunar's configured draft_status,
- * same as every driver is responsible for moving it on from.
  */
-class OfflinePaymentDriver implements PaymentDriver
+class OfflinePaymentDriver implements Configurable, SupportsPay
 {
-    public function __construct(
-        private readonly CheckoutService $checkout,
-    ) {}
-
     /**
      * Always true — no external dependency to be missing.
      */
@@ -39,19 +32,18 @@ class OfflinePaymentDriver implements PaymentDriver
         return true;
     }
 
-    /**
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
-     * @throws FingerprintMismatchException
-     * @throws CartException
-     * @throws DisallowMultipleCartOrdersException
-     */
-    public function confirm(Cart $cart, string $type, string $fingerprint, array $data): Order
     {
-        $order = $this->checkout->placeOrder($fingerprint);
+        $reference = 'offline-'.Str::uuid();
 
-        $order->update([
+        $result = new PaymentResult(
-            'status' => config("lunar.payments.types.{$type}.authorized", $order->status),
+            status: PaymentResultStatus::Succeeded,
-        ]);
+            reference: $reference,
+            amount: $amount,
+        );
 
-        return $order->refresh();
+        PaymentCaptured::dispatch($type, $result, $context);
+
+        return $result;
     }
-}
+}

src/Payment/Drivers/StripePaymentDriver.php

@@ -2,43 +2,69 @@
 
 namespace Modules\Core\Payment\Drivers;
 
-use Lunar\Exceptions\FingerprintMismatchException;
+use Lunar\DataTypes\Price;
-use Lunar\Exceptions\Carts\CartException;
+use Lunar\Models\Currency;
-use Lunar\Exceptions\DisallowMultipleCartOrdersException;
-use Lunar\Models\Cart;
-use Lunar\Models\Order;
-use Lunar\Stripe\Actions\UpdateOrderFromIntent;
 use Lunar\Stripe\Facades\Stripe;
+use Lunar\Stripe\Managers\StripeManager;
 use Lunar\Stripe\Models\StripePaymentIntent;
-use Modules\Core\Checkout\Contracts\PaymentDriver;
+use Modules\Core\Payment\Contracts\Configurable;
-use Modules\Core\Checkout\Services\CheckoutService;
+use Modules\Core\Payment\Contracts\HandlesPaymentCallback;
-use Modules\Core\Payment\Exceptions\PaymentNotConfirmedException;
+use Modules\Core\Payment\Contracts\SupportsAuthorization;
+use Modules\Core\Payment\Contracts\SupportsCaptures;
+use Modules\Core\Payment\Contracts\SupportsPay;
+use Modules\Core\Payment\Contracts\SupportsRefunds;
+use Modules\Core\Payment\Contracts\SupportsVoids;
+use Modules\Core\Payment\DTOs\PaymentContinuation;
+use Modules\Core\Payment\DTOs\PaymentResult;
+use Modules\Core\Payment\Enums\PaymentContinuationType;
+use Modules\Core\Payment\Enums\PaymentResultStatus;
+use Modules\Core\Payment\Events\PaymentAuthorizationFailed;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptureFailed;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Payment\Events\PaymentRefundFailed;
+use Modules\Core\Payment\Events\PaymentRefunded;
+use Modules\Core\Payment\Events\PaymentVoidFailed;
+use Modules\Core\Payment\Events\PaymentVoided;
+use Stripe\Exception\ApiErrorException;
 use Stripe\PaymentIntent;
 
 /**
- * Wraps Lunar\Stripe\StripePaymentType::authorize() to satisfy
+ * Talks to Stripe's PaymentIntent API directly — deliberately NOT via
- * Modules\Core\Checkout\Contracts\PaymentDriver — calls
+ * Lunar\Stripe\Facades\Stripe::createIntent()/fetchOrCreateIntent(), which
- * CheckoutService::placeOrder($fingerprint) at the moment Stripe confirms
+ * take a Lunar\Models\Cart and derive amount/currency from it. Payment
- * payment, instead of the vendor's own Cart::createOrder() call.
+ * must never receive a Cart (see docs/payments.md) — pay()/authorize()
+ * already receive $amount explicitly as their own required Lunar Price
+ * parameter (see PaymentResult's own docblock), the caller's job to
+ * assemble, same as every other driver.
  *
- * This is a fork, not a decoration: StripePaymentType::authorize() is
+ * Every amount that crosses this class's own boundary is converted right
- * `final` and calls Cart::createOrder() directly with no seam to redirect
+ * there: Lunar's Price -> Stripe's minor-unit int going INTO a gateway
- * that one call — so this class reimplements authorize()'s logic (intent
+ * call (StripeManager::toStripeAmount()), Stripe's response amount ->
- * retrieval, capture-on-policy, status mapping via UpdateOrderFromIntent)
+ * Lunar's Price coming back OUT (StripeManager::fromStripeAmount()).
- * rather than wrapping the vendor method. Kept deliberately close to the
+ * Nothing outside this class ever sees a Stripe-scaled integer.
- * original so a lunarphp/stripe upgrade is easy to diff against. See
+ *
- * docs/payments.md.
+ * Correlating a later handleCallback() (a separate request — a webhook)
+ * back to whatever $context identified this attempt is solved the same
+ * way lunarphp/stripe's own StripePaymentType/ProcessStripeWebhook solve
+ * it: real cart_id/order_id columns on Lunar\Stripe\Models\
+ * StripePaymentIntent (a table already owned by lunarphp/stripe, already
+ * shaped for exactly this), not a generic context blob. See
+ * docs/payments.md "Async resolution" for the full reasoning.
  */
-class StripePaymentDriver implements PaymentDriver
+class StripePaymentDriver implements
+    Configurable,
+    SupportsPay,
+    SupportsAuthorization,
+    SupportsCaptures,
+    SupportsVoids,
+    SupportsRefunds,
+    HandlesPaymentCallback
 {
-    public function __construct(
-        private readonly CheckoutService $checkout,
-    ) {}
-
     /**
      * Same key lunarphp/stripe's own StripeManager reads its API key from
-     * (Stripe::setApiKey(config('services.stripe.key')) in
+     * (Stripe::setApiKey(config('services.stripe.key'))) — no key, no
-     * StripeManager::__construct()) — no key, no usable driver.
+     * usable driver.
      */
     public function isConfigured(): bool
     {
@@ -46,66 +72,312 @@ class StripePaymentDriver implements PaymentDriver
     }
 
     /**
-     * @throws PaymentNotConfirmedException if Stripe hasn't confirmed the
+     * Atomic charge — capture_method: automatic. Stripe still frequently
-     *   payment intent (wrong intent id, already processed, order already
+     * confirms into requires_action/requires_confirmation rather than
-     *   placed, or the gateway call itself fails) — nothing here should be
+     * succeeded in the same call (3-D Secure, most real cards) — Pending
-     *   treated as "place the order anyway."
+     * is a normal outcome here, not an edge case, resolved later via
-     * @throws FingerprintMismatchException
+     * handleCallback().
-     * @throws CartException
      */
-    public function confirm(Cart $cart, string $type, string $fingerprint, array $data): Order
+    public function pay(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
     {
-        $paymentIntentId = $data['payment_intent'];
+        return $this->createAndConfirm($type, $amount, $data, $context, captureMethod: 'automatic');
+    }
 
-        $paymentIntentModel = StripePaymentIntent::where('intent_id', $paymentIntentId)->first();
+    /**
+     * Hold only — capture_method: manual. Resolves to Pending or an
+     * authorized (requires_capture) intent, never succeeded directly:
+     * Stripe never captures on its own for a manual intent.
+     */
+    public function authorize(string $type, Price $amount, array $data = [], array $context = []): PaymentResult
+    {
+        return $this->createAndConfirm($type, $amount, $data, $context, captureMethod: 'manual');
+    }
 
-        if ($paymentIntentModel && ! $paymentIntentModel->isActive()) {
+    private function createAndConfirm(string $type, Price $amount, array $data, array $context, string $captureMethod): PaymentResult
-            throw new PaymentNotConfirmedException('Payment intent already processed.');
+    {
-        }
+        try {
-
+            $paymentIntent = Stripe::getClient()->paymentIntents->create([
-        if (! $paymentIntentModel) {
+                'amount' => StripeManager::toStripeAmount($amount->value, $amount->currency),
-            $paymentIntentModel = StripePaymentIntent::create([
+                'currency' => $amount->currency->code,
-                'intent_id' => $paymentIntentId,
+                'capture_method' => $captureMethod,
-                'cart_id' => $cart->id,
+                'confirm' => true,
+                'payment_method' => $data['payment_method'] ?? null,
+                'automatic_payment_methods' => isset($data['payment_method'])
+                    ? null
+                    : ['enabled' => true],
             ]);
+        } catch (ApiErrorException $e) {
+            return $this->declined($type, $amount, $e, $context, authorizing: $captureMethod === 'manual');
         }
 
-        $paymentIntentModel->update(['processing_at' => now()]);
+        $this->rememberIntent($paymentIntent, $type, $context);
 
-        $stripe = Stripe::getClient();
+        return $this->resultFromIntent($type, $paymentIntent, $amount, $context, authorizing: $captureMethod === 'manual');
-        $paymentIntent = $stripe->paymentIntents->retrieve($paymentIntentId);
+    }
 
-        if (! $paymentIntent) {
+    public function handleCallback(string $reference, array $data, array $context = []): PaymentResult
-            throw new PaymentNotConfirmedException('Unable to locate payment intent.');
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context, $data['type'] ?? '');
+
+        $paymentIntent = Stripe::getClient()->paymentIntents->retrieve($reference);
+
+        $authorizing = $paymentIntent->capture_method === PaymentIntent::CAPTURE_METHOD_MANUAL;
+
+        if ($paymentIntent->status === PaymentIntent::STATUS_REQUIRES_CAPTURE && ! $authorizing) {
+            // automatic capture_method, but Stripe stopped short of
+            // capturing (rare, but the API contract allows it) — finish
+            // the job pay() started.
+            $paymentIntent = Stripe::getClient()->paymentIntents->capture($reference);
         }
 
-        $policy = config('lunar.stripe.policy', 'automatic');
+        $intentModel?->update(['status' => $paymentIntent->status]);
 
-        if ($paymentIntent->status === PaymentIntent::STATUS_REQUIRES_CAPTURE && $policy === 'automatic') {
+        $amount = $this->priceFromIntent($paymentIntent);
-            $paymentIntent = $stripe->paymentIntents->capture($paymentIntentId);
-        }
 
-        if ($paymentIntent->status !== PaymentIntent::STATUS_SUCCEEDED) {
+        return $this->resultFromIntent($type, $paymentIntent, $amount, $context, $authorizing);
-            $paymentIntentModel->update(['status' => $paymentIntent->status]);
+    }
 
-            throw new PaymentNotConfirmedException(
+    public function capture(string $reference, Price $amount, array $context = []): PaymentResult
-                $paymentIntent->last_payment_error->message ?? "Payment intent status: {$paymentIntent->status}."
+    {
-            );
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
-        }
 
         try {
-            $order = $this->checkout->placeOrder($fingerprint);
+            $paymentIntent = Stripe::getClient()->paymentIntents->capture($reference, [
-        } catch (DisallowMultipleCartOrdersException|CartException $e) {
+                'amount_to_capture' => StripeManager::toStripeAmount($amount->value, $amount->currency),
-            throw new PaymentNotConfirmedException($e->getMessage(), previous: $e);
+            ]);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentCaptureFailed::dispatch($type, $result, $context);
+
+            return $result;
         }
 
-        $paymentIntentModel->order_id = $order->id;
+        $intentModel?->update(['status' => $paymentIntent->status]);
-        $paymentIntentModel->status = $paymentIntent->status;
-        $paymentIntentModel->processed_at = now();
-        $paymentIntentModel->save();
 
-        UpdateOrderFromIntent::execute($order, $paymentIntent);
+        $result = new PaymentResult(
+            status: $paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED
+                ? PaymentResultStatus::Succeeded
+                : PaymentResultStatus::Failed,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            raw: $paymentIntent->toArray(),
+        );
 
-        return $order->refresh();
+        $paymentIntent->status === PaymentIntent::STATUS_SUCCEEDED
+            ? PaymentCaptured::dispatch($type, $result, $context)
+            : PaymentCaptureFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    public function void(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
+
+        try {
+            $paymentIntent = Stripe::getClient()->paymentIntents->cancel($reference);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentVoidFailed::dispatch($type, $result, $context);
+
+            return $result;
+        }
+
+        $intentModel?->update(['status' => $paymentIntent->status]);
+
+        $result = new PaymentResult(
+            status: $paymentIntent->status === PaymentIntent::STATUS_CANCELED
+                ? PaymentResultStatus::Succeeded
+                : PaymentResultStatus::Failed,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            raw: $paymentIntent->toArray(),
+        );
+
+        $paymentIntent->status === PaymentIntent::STATUS_CANCELED
+            ? PaymentVoided::dispatch($type, $result, $context)
+            : PaymentVoidFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    public function refund(string $reference, Price $amount, array $context = []): PaymentResult
+    {
+        [$intentModel, $type, $context] = $this->resolveIntentModel($reference, $context);
+
+        try {
+            $refund = Stripe::getClient()->refunds->create([
+                'payment_intent' => $reference,
+                'amount' => StripeManager::toStripeAmount($amount->value, $amount->currency),
+            ]);
+        } catch (ApiErrorException $e) {
+            $result = $this->failure($amount, $e, $reference);
+            PaymentRefundFailed::dispatch($type, $result, $context);
+
+            return $result;
+        }
+
+        $result = new PaymentResult(
+            status: $refund->status !== 'failed' ? PaymentResultStatus::Succeeded : PaymentResultStatus::Failed,
+            reference: $refund->id,
+            amount: $amount,
+            raw: $refund->toArray(),
+        );
+
+        $refund->status !== 'failed'
+            ? PaymentRefunded::dispatch($type, $result, $context)
+            : PaymentRefundFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    private function rememberIntent(PaymentIntent $paymentIntent, string $type, array $context): ?StripePaymentIntent
+    {
+        if (! ($context['cart_id'] ?? null)) {
+            return null;
+        }
+
+        return StripePaymentIntent::create([
+            'intent_id' => $paymentIntent->id,
+            'cart_id' => $context['cart_id'],
+            'order_id' => $context['order_id'] ?? null,
+            'status' => $paymentIntent->status,
+            'payment_type' => $type,
+            'context' => json_encode($context),
+        ]);
+    }
+
+    /**
+     * The one lookup every method past initiate() shares: find the
+     * StripePaymentIntent row this $reference belongs to, then recover
+     * $type/$context from it — the original context, if any, always
+     * takes precedence over whatever the caller passed in (see
+     * handleCallback()'s own note: a webhook caller usually has none of
+     * its own).
+     *
+     * $typeFallback only matters when there's no $intentModel to read
+     * payment_type from — handleCallback() has its own $data['type'] to
+     * fall back to; capture()/void()/refund() have nothing better than ''.
+     *
+     * @return array{0: ?StripePaymentIntent, 1: string, 2: array<string, mixed>}
+     */
+    private function resolveIntentModel(string $reference, array $context, string $typeFallback = ''): array
+    {
+        $intentModel = StripePaymentIntent::where('intent_id', $reference)->first();
+
+        return [
+            $intentModel,
+            $intentModel?->payment_type ?? $typeFallback,
+            $this->decodeContext($intentModel) ?? $context,
+        ];
+    }
+
+    /**
+     * StripePaymentIntent is a vendor model (lunarphp/stripe) with no cast
+     * declared for our own 'context' column (added by boboko-core's own
+     * migration, see database/migrations/..._add_context_to_stripe_
+     * payment_intents.php) — we can't edit the vendor model to add one, so
+     * decode manually here instead of assuming Eloquent already did it.
+     *
+     * @return array<string, mixed>|null
+     */
+    private function decodeContext(?StripePaymentIntent $intentModel): ?array
+    {
+        if (! $intentModel || ! $intentModel->context) {
+            return null;
+        }
+
+        return json_decode($intentModel->context, associative: true) ?: null;
+    }
+
+    /**
+     * Converts a live Stripe PaymentIntent's own amount/currency back
+     * into Lunar's Price — the one place this class reads a Stripe
+     * response's amount without already holding the Price that produced
+     * it (handleCallback() has no $data['amount'] to fall back on, unlike
+     * pay()/authorize()).
+     */
+    private function priceFromIntent(PaymentIntent $paymentIntent): Price
+    {
+        $currency = Currency::whereRaw('lower(code) = ?', [strtolower($paymentIntent->currency)])->firstOrFail();
+
+        return new Price(
+            (int) StripeManager::fromStripeAmount($paymentIntent->amount, $currency),
+            $currency,
+        );
+    }
+
+    private function resultFromIntent(
+        string $type,
+        PaymentIntent $paymentIntent,
+        Price $amount,
+        array $context,
+        bool $authorizing,
+    ): PaymentResult {
+        $status = match ($paymentIntent->status) {
+            PaymentIntent::STATUS_SUCCEEDED => PaymentResultStatus::Succeeded,
+            PaymentIntent::STATUS_REQUIRES_CAPTURE => $authorizing ? PaymentResultStatus::Succeeded : PaymentResultStatus::Pending,
+            PaymentIntent::STATUS_CANCELED => PaymentResultStatus::Failed,
+            default => PaymentResultStatus::Pending,
+        };
+
+        $continuation = $status === PaymentResultStatus::Pending
+            ? new PaymentContinuation(PaymentContinuationType::ClientSecret, $paymentIntent->client_secret)
+            : null;
+
+        $result = new PaymentResult(
+            status: $status,
+            reference: $paymentIntent->id,
+            amount: $amount,
+            failureReason: $paymentIntent->last_payment_error->message ?? null,
+            raw: $paymentIntent->toArray(),
+            continuation: $continuation,
+        );
+
+        if ($status === PaymentResultStatus::Pending) {
+            return $result;
+        }
+
+        $succeeded = $status === PaymentResultStatus::Succeeded;
+
+        if ($authorizing) {
+            $succeeded
+                ? PaymentAuthorized::dispatch($type, $result, $context)
+                : PaymentAuthorizationFailed::dispatch($type, $result, $context);
+        } else {
+            $succeeded
+                ? PaymentCaptured::dispatch($type, $result, $context)
+                : PaymentCaptureFailed::dispatch($type, $result, $context);
+        }
+
+        return $result;
+    }
+
+    private function declined(string $type, Price $amount, ApiErrorException $e, array $context, bool $authorizing): PaymentResult
+    {
+        $result = $this->failure($amount, $e);
+
+        $authorizing
+            ? PaymentAuthorizationFailed::dispatch($type, $result, $context)
+            : PaymentCaptureFailed::dispatch($type, $result, $context);
+
+        return $result;
+    }
+
+    private function failure(Price $amount, ApiErrorException $e, string $reference = ''): PaymentResult
+    {
+        $stripeError = $e->getError();
+
+        return new PaymentResult(
+            status: PaymentResultStatus::Failed,
+            reference: $reference ?: ($stripeError->payment_intent->id ?? ''),
+            amount: $amount,
+            failureReason: $e->getMessage(),
+            retriable: in_array($stripeError->decline_code ?? null, [
+                'do_not_honor', 'insufficient_funds', 'card_velocity_exceeded',
+                'processing_error', 'try_again_later', 'issuer_not_available',
+            ], true),
+            raw: $stripeError?->toArray() ?? [],
+        );
     }
 }

src/Payment/Enums/PaymentContinuationType.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Modules\Core\Payment\Enums;
+
+/**
+ * What a caller of a Pending PaymentResult needs to do next, gateway-
+ * agnostically. Only meaningful when PaymentResult::$continuation is not
+ * null (status === Pending).
+ */
+enum PaymentContinuationType
+{
+    /** Send the shopper to $continuation->value (a URL) — a redirect-based gateway. */
+    case Redirect;
+
+    /** Hand $continuation->value (a client secret) to frontend JS — Stripe Elements-style. */
+    case ClientSecret;
+}

src/Payment/Enums/PaymentResultStatus.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Payment\Enums;
+
+/**
+ * The normalized outcome of a single gateway operation (pay, authorize,
+ * capture, void, refund) — never the gateway's own raw status string
+ * (Stripe's "succeeded", Nexi's "EXECUTED", Mastercard's own codes), so a
+ * caller never needs gateway-specific knowledge to know what happened.
+ */
+enum PaymentResultStatus
+{
+    case Succeeded;
+    case Failed;
+
+    /**
+     * The gateway hasn't resolved this operation yet and won't in the same
+     * call — e.g. Stripe's requires_action, a redirect the shopper hasn't
+     * completed. A driver returning this from initiate()/handleCallback()
+     * has not yet dispatched a terminal event; something else (a later
+     * callback) is expected to resolve it.
+     */
+    case Pending;
+}

src/Payment/Events/PaymentAuthorizationFailed.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsAuthorization::authorize() (or a
+ * HandlesPaymentCallback::handleCallback() resolving it later) determines
+ * the gateway did not grant the requested hold. $result->retriable is how
+ * a listener knows whether "try again with the same method" is reasonable
+ * — see PaymentResult's own docblock.
+ */
+class PaymentAuthorizationFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentAuthorized.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by a driver's SupportsAuthorization::authorize() (or, for an
+ * async gateway, HandlesPaymentCallback::handleCallback() resolving that
+ * same authorize() call later) once a hold has been placed — no funds have
+ * moved yet, see SupportsCaptures/SupportsVoids for what happens next.
+ *
+ * Carries $result (the full PaymentResult, not just a reference) plus
+ * $type and $context — same reasoning throughout Payment's events: Payment
+ * has no concept of a cart, an order, or a checkout fingerprint, so
+ * whatever a listener needs to react travels through $context untouched,
+ * opaque to Payment itself.
+ */
+class PaymentAuthorized
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentCaptureFailed.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsPay::pay() or SupportsCaptures::capture() (or a
+ * HandlesPaymentCallback::handleCallback() resolving either later) fails
+ * to take the money — whether that's a sale-mode gateway declining the
+ * charge outright, or a capture call against an existing authorization
+ * being rejected. Same terminal-event symmetry as PaymentCaptured: this is
+ * the one "capture attempt failed" event regardless of which path
+ * produced it.
+ */
+class PaymentCaptureFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentCaptured.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * The one "money has actually been taken" event, dispatched from either of
+ * two different call paths that end at the same business fact:
+ *   - SupportsPay::pay() — an atomic authorize+capture gateway call
+ *     (Mastercard's "Pay", Stripe's capture_method=automatic, an offline
+ *     driver's immediate success).
+ *   - SupportsCaptures::capture() — settling a PRIOR authorize() hold.
+ * Whether the money moved in one gateway call or two is a driver-internal
+ * detail; a listener reacting to "a payment has been captured" never
+ * needs to know or care which path produced this event.
+ */
+class PaymentCaptured
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentRefundFailed.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsRefunds::refund() fails to return settled funds
+ * — e.g. the gateway rejects refunding more than was originally captured.
+ */
+class PaymentRefundFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentRefunded.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by SupportsRefunds::refund() once settled funds (from a prior
+ * pay() or capture()) have actually been returned — full or partial.
+ * Independent of whether the original settlement was a sale or an
+ * authorize-then-capture: a refund only ever targets money that was
+ * genuinely taken, regardless of how it got taken.
+ */
+class PaymentRefunded
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentVoidFailed.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched when SupportsVoids::void() fails to release a prior
+ * authorization — e.g. the hold already expired or was already captured,
+ * so there was nothing left to void.
+ */
+class PaymentVoidFailed
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Events/PaymentVoided.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Modules\Core\Payment\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Modules\Core\Payment\DTOs\PaymentResult;
+
+/**
+ * Dispatched by SupportsVoids::void() once a prior authorization hold has
+ * been released without ever settling — the "actually, never mind" exit
+ * from an authorize() that SupportsCaptures::capture() would otherwise
+ * have settled. No funds ever moved, so this is distinct from
+ * PaymentRefunded (which reverses money that was actually taken).
+ */
+class PaymentVoided
+{
+    use Dispatchable;
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public function __construct(
+        public readonly string $type,
+        public readonly PaymentResult $result,
+        public readonly array $context = [],
+    ) {}
+}

src/Payment/Exceptions/PaymentNotConfirmedException.php

@@ -1,22 +0,0 @@
-<?php
-
-namespace Modules\Core\Payment\Exceptions;
-
-use RuntimeException;
-use Throwable;
-
-/**
- * Thrown by a Modules\Core\Checkout\Contracts\PaymentDriver when the
- * gateway has not confirmed payment — wrong/expired intent, already
- * processed, or the gateway itself rejects the confirmation. A driver
- * throws this instead of silently placing the order: CheckoutService::
- * placeOrder() must only ever be called once a driver has positively
- * confirmed payment, never as a fallback.
- */
-class PaymentNotConfirmedException extends RuntimeException
-{
-    public function __construct(string $message, ?Throwable $previous = null)
-    {
-        parent::__construct($message, previous: $previous);
-    }
-}

src/Payment/Http/Controllers/StripeWebhookController.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Modules\Core\Payment\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Modules\Core\Payment\Drivers\StripePaymentDriver;
+use Stripe\Webhook;
+
+/**
+ * A boboko-owned webhook endpoint for Stripe — deliberately NOT
+ * lunarphp/stripe's own route (vendor/lunarphp/stripe/routes/webhooks.php),
+ * which dispatches into Lunar's own Payments::driver('stripe') flow (the
+ * flow StripePaymentDriver was built to replace, see that class's own
+ * docblock). Signature verification is handled by
+ * Lunar\Stripe\Http\Middleware\StripeWebhookMiddleware, registered on this
+ * route (see src/Payment/routes/webhooks.php) — pure Stripe SDK
+ * verification + event-type filtering, safe to reuse even though this
+ * controller never touches the rest of that vendor package's flow. This
+ * controller verifies the signature again itself (Webhook::constructEvent())
+ * to get the constructed Event object — the middleware doesn't stash one
+ * anywhere reusable, it only gates the request through.
+ *
+ * Resolves the driver directly by class, not via
+ * Modules\Core\Payment\Services\PaymentDriverResolver — this endpoint is
+ * inherently Stripe-specific (Stripe's own webhook payload carries no
+ * boboko payment-type key, only its own payment_intent id), and
+ * StripePaymentDriver::handleCallback() already recovers $type itself
+ * from the StripePaymentIntent row pay()/authorize() wrote.
+ */
+class StripeWebhookController extends Controller
+{
+    public function __invoke(Request $request, StripePaymentDriver $driver): JsonResponse
+    {
+        $event = Webhook::constructEvent(
+            $request->getContent(),
+            $request->header('Stripe-Signature'),
+            config('services.stripe.webhooks.lunar'),
+        );
+
+        $driver->handleCallback($event->data->object->id, $event->data->object->toArray());
+
+        return response()->json(['webhook_successful' => true]);
+    }
+}

src/Payment/Services/PaymentDriverResolver.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Modules\Core\Payment\Services;
+
+/**
+ * Resolves a payment type key (e.g. 'stripe', 'cash-on-delivery') to its
+ * registered driver instance — extracted out of CheckoutService so both it
+ * and anything else needing the same lookup share one implementation
+ * instead of duplicating this config read.
+ *
+ * Returns a plain object, not a shared interface — Payment's own drivers
+ * implement several independent, orthogonal capability interfaces at once
+ * (Configurable, SupportsPay, SupportsAuthorization, ...; see
+ * StripePaymentDriver implementing all six). There is no single common
+ * "PaymentDriver" contract to type this against; a caller checks
+ * `instanceof SupportsPay` / `instanceof SupportsAuthorization` itself,
+ * the same way Payment's own contracts are designed to be consumed.
+ */
+class PaymentDriverResolver
+{
+    /**
+     * Null if $type has no 'payment_driver' registered in
+     * config('lunar.payments.types.<type>') at all — deliberately
+     * non-throwing so a caller like CheckoutService::getPaymentMethods()
+     * can filter unresolvable types silently rather than treating "not
+     * registered" as an error condition when just checking availability.
+     */
+    public function resolve(string $type): ?object
+    {
+        $driverClass = config("lunar.payments.types.{$type}.payment_driver");
+
+        return $driverClass ? app($driverClass) : null;
+    }
+}

src/Payment/Services/TransactionRecorder.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Modules\Core\Payment\Services;
+
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Payment\DTOs\CaptureResult;
+use Modules\Core\Payment\DTOs\RefundResult;
+
+/**
+ * Writes the Transaction row a SupportsRefunds/SupportsCaptures driver's
+ * result becomes — the one place that translates a gateway-agnostic
+ * RefundResult/CaptureResult into Lunar's own transactions table, in the
+ * same shape lunarphp/stripe's StoreCharges already writes (type, success,
+ * amount, reference, driver, notes). Kept here rather than inside each
+ * driver so every driver's rows land in a consistent shape that
+ * Order::paymentStatus() and TransactionObserver both already understand,
+ * without any driver needing to know about either.
+ */
+class TransactionRecorder
+{
+    public function recordRefund(Order $order, string $driver, RefundResult $result, ?string $notes = null): Transaction
+    {
+        return $order->transactions()->create([
+            'success' => $result->success,
+            'type' => 'refund',
+            'driver' => $driver,
+            'amount' => $result->amount,
+            'reference' => $result->reference,
+            'status' => $result->success ? 'succeeded' : 'failed',
+            'notes' => $notes ?? $result->message,
+            'meta' => $result->meta,
+        ]);
+    }
+
+    public function recordCapture(Order $order, string $driver, CaptureResult $result, ?string $notes = null): Transaction
+    {
+        return $order->transactions()->create([
+            'success' => $result->success,
+            'type' => 'capture',
+            'driver' => $driver,
+            'amount' => $result->amount,
+            'reference' => $result->reference,
+            'status' => $result->success ? 'succeeded' : 'failed',
+            'notes' => $notes ?? $result->message,
+            'meta' => $result->meta,
+        ]);
+    }
+}

src/Payment/routes/webhooks.php

@@ -0,0 +1,14 @@
+<?php
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
+use Illuminate\Support\Facades\Route;
+use Lunar\Stripe\Http\Middleware\StripeWebhookMiddleware;
+use Modules\Core\Payment\Http\Controllers\StripeWebhookController;
+
+Route::post(
+    config('payment.stripe.webhook_path', 'payments/stripe/webhook'),
+    StripeWebhookController::class
+)
+    ->middleware([StripeWebhookMiddleware::class, 'api'])
+    ->withoutMiddleware([VerifyCsrfToken::class])
+    ->name('payment.stripe.webhook');

src/Providers/CatalogServiceProvider.php

@@ -2,17 +2,32 @@
 
 namespace Modules\Core\Providers;
 
+use Illuminate\Console\Scheduling\Schedule;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
+use Lunar\Models\Product;
 use Lunar\Models\ProductOption;
 use Lunar\Models\ProductOptionValue;
+use Modules\Core\Catalog\Events\ProductDeleted;
+use Modules\Core\Catalog\Events\ProductSaved;
+use Modules\Core\Catalog\Listeners\ReindexProductsRecommendingProduct;
 use Modules\Core\Catalog\Observers\ProductOptionReindexObserver;
 use Modules\Core\Catalog\OptionTypes\ColorOptionType;
 use Modules\Core\Catalog\Services\ProductOptionTypeManager;
 
 class CatalogServiceProvider extends ServiceProvider
 {
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__ . '/../../config/catalog.php', 'catalog');
+    }
+
     public function boot(): void
     {
+        $this->publishes([
+            __DIR__ . '/../../config/catalog.php' => config_path('catalog.php'),
+        ], 'core-config');
+
         ProductOptionTypeManager::get()->register([
             ColorOptionType::class,
         ]);
@@ -24,5 +39,28 @@ class CatalogServiceProvider extends ServiceProvider
 
         ProductOptionValue::saved(fn (ProductOptionValue $value) => $observer->valueSaved($value));
         ProductOptionValue::deleted(fn (ProductOptionValue $value) => $observer->valueDeleted($value));
+
+        Product::saved(fn (Product $product) => Event::dispatch(new ProductSaved($product)));
+        Product::deleted(fn (Product $product) => Event::dispatch(new ProductDeleted($product->id)));
+
+        Event::listen(ProductSaved::class, [ReindexProductsRecommendingProduct::class, 'handleSaved']);
+        Event::listen(ProductDeleted::class, [ReindexProductsRecommendingProduct::class, 'handleDeleted']);
+
+        $this->app->booted(function () {
+            // A full nightly reindex, on top of the per-event reindexing
+            // above — catches everything event-driven reindexing
+            // deliberately doesn't cover: a newly-created product not yet
+            // appearing as a recommendation elsewhere, in_stock/price
+            // drifting from an order decrementing stock outside a product
+            // save, and any other staleness ProductIndexer's own docblock
+            // already documents as accepted between reindexes. --refresh
+            // re-syncs filterable/sortable field settings too, not just
+            // documents, so a deploy that changed ProductIndexer's field
+            // list self-heals here even if `lunar:meilisearch:setup`
+            // wasn't run manually after that deploy.
+            $this->app->make(Schedule::class)
+                ->command('lunar:search:index', ['Lunar\\Models\\Product', '--refresh'])
+                ->dailyAt('03:00');
+        });
     }
 }

src/Providers/CoreServiceProvider.php

@@ -10,6 +10,7 @@ use Modules\Core\Command\ExportCommand;
 use Modules\Core\Command\ImportCommand;
 use Modules\Core\Command\InstallLunarCommand;
 use Modules\Core\Command\MigrateImportCommand;
+use Modules\Core\Command\TuneProductSearchCommand;
 
 class CoreServiceProvider extends ServiceProvider
 {
@@ -35,7 +36,7 @@ class CoreServiceProvider extends ServiceProvider
         ], 'core-assets');
 
         if ($this->app->runningInConsole()) {
-            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class]);
+            $this->commands([AnonymizeCommand::class, ExportCommand::class, ExportCleanupCommand::class, ImportCommand::class, MigrateImportCommand::class, TuneProductSearchCommand::class]);
 
             //Overriding lunar:install
             $this->app->booted(fn () => $this->commands([InstallLunarCommand::class]));

src/Providers/OrderServiceProvider.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Providers;
+
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\ServiceProvider;
+use Lunar\Models\Order;
+use Lunar\Models\Transaction;
+use Modules\Core\Notification\NotificationRegistry;
+use Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus;
+use Modules\Core\Order\Listeners\DeriveOrderDeliveredFromShipment;
+use Modules\Core\Order\Notifications\OrderCapturedNotification;
+use Modules\Core\Order\Notifications\OrderDeliveredNotification;
+use Modules\Core\Order\Notifications\OrderRefundedNotification;
+use Modules\Core\Order\Notifications\OrderStatusUpdatedNotification;
+use Modules\Core\Order\Observers\OrderObserver;
+use Modules\Core\Order\Observers\TransactionObserver;
+use Modules\Core\Order\Support\OrderStatus;
+use Modules\Core\Payment\Events\PaymentAuthorized;
+use Modules\Core\Payment\Events\PaymentCaptured;
+use Modules\Core\Shipping\Events\ShipmentStatusUpdatedByCarrier;
+
+class OrderServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        Order::observe(OrderObserver::class);
+        Transaction::observe(TransactionObserver::class);
+
+        Order::macro('paymentStatus', fn () => OrderStatus::payment($this));
+        Order::macro('fulfillmentStatus', fn () => OrderStatus::fulfillment($this));
+
+        Event::listen(ShipmentStatusUpdatedByCarrier::class, DeriveOrderDeliveredFromShipment::class);
+        Event::listen(PaymentCaptured::class, ApplyResolvedPaymentStatus::class);
+        Event::listen(PaymentAuthorized::class, ApplyResolvedPaymentStatus::class);
+
+        NotificationRegistry::get()->register([
+            OrderDeliveredNotification::class,
+            OrderStatusUpdatedNotification::class,
+            OrderRefundedNotification::class,
+            OrderCapturedNotification::class,
+        ]);
+
+        // Lets the consuming app override copy/markup without forking core
+        // — published into resources/views/vendor/core/order/notifications,
+        // which loadViewsFrom() (CoreServiceProvider) already resolves
+        // ahead of the package's own views for the `core::` namespace.
+        $this->publishes([
+            __DIR__ . '/../../resources/views/order/notifications' => resource_path('views/vendor/core/order/notifications'),
+        ], 'core-views');
+    }
+}

src/Providers/PaymentServiceProvider.php

@@ -38,5 +38,7 @@ class PaymentServiceProvider extends ServiceProvider
         }
 
         config(['lunar.cart.pipelines.cart' => $cartPipeline]);
+
+        $this->loadRoutesFrom(__DIR__ . '/../Payment/routes/webhooks.php');
     }
 }

src/Shipping/Carriers/Acs/AcsFulfillmentService.php

@@ -10,9 +10,9 @@ use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
 use Modules\Core\Shipping\Contracts\SupportsManifestBatching;
 use Modules\Core\Shipping\Contracts\SupportsTracking;
 use Modules\Core\Shipping\Carriers\Acs\Exceptions\AcsApiException;
-use Modules\Core\Shipping\DataTransferObjects\ManifestResult;
+use Modules\Core\Shipping\DTOs\ManifestResult;
-use Modules\Core\Shipping\DataTransferObjects\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
-use Modules\Core\Shipping\DataTransferObjects\TrackingCheckpoint;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
 use Modules\Core\Shipping\Enums\TrackingStatus;
 use Modules\Core\Shipping\Models\Shipment;
 

src/Shipping/Carriers/BoxNow/BoxNowFulfillmentService.php

@@ -8,8 +8,8 @@ use Lunar\Models\Order;
 use Modules\Core\Shipping\Carriers\BoxNow\Exceptions\BoxNowApiException;
 use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
 use Modules\Core\Shipping\Contracts\SupportsTracking;
-use Modules\Core\Shipping\DataTransferObjects\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
-use Modules\Core\Shipping\DataTransferObjects\TrackingCheckpoint;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
 use Modules\Core\Shipping\Enums\TrackingStatus;
 use Modules\Core\Shipping\Models\Shipment;
 

src/Shipping/Contracts/CarrierFulfillmentInterface.php

@@ -3,7 +3,7 @@
 namespace Modules\Core\Shipping\Contracts;
 
 use Lunar\Models\Order;
-use Modules\Core\Shipping\DataTransferObjects\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
 use Modules\Core\Shipping\Models\Shipment;
 
 interface CarrierFulfillmentInterface

src/Shipping/Contracts/SupportsManifestBatching.php

@@ -3,7 +3,7 @@
 namespace Modules\Core\Shipping\Contracts;
 
 use Illuminate\Support\Collection;
-use Modules\Core\Shipping\DataTransferObjects\ManifestResult;
+use Modules\Core\Shipping\DTOs\ManifestResult;
 
 /**
  * Optional capability for carriers that batch shipments into a manifest

src/Shipping/Contracts/SupportsTracking.php

@@ -3,7 +3,7 @@
 namespace Modules\Core\Shipping\Contracts;
 
 use Illuminate\Support\Collection;
-use Modules\Core\Shipping\DataTransferObjects\TrackingCheckpoint;
+use Modules\Core\Shipping\DTOs\TrackingCheckpoint;
 use Modules\Core\Shipping\Models\Shipment;
 
 /**

src/Shipping/DTOs/ManifestResult.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Shipping\DataTransferObjects;
+namespace Modules\Core\Shipping\DTOs;
 
 use Illuminate\Support\Collection;
 

src/Shipping/DTOs/ShipmentRequest.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Shipping\DataTransferObjects;
+namespace Modules\Core\Shipping\DTOs;
 
 /**
  * Carrier-agnostic input for CarrierFulfillmentInterface::createShipment().

src/Shipping/DTOs/TrackingCheckpoint.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Modules\Core\Shipping\DataTransferObjects;
+namespace Modules\Core\Shipping\DTOs;
 
 use Carbon\CarbonInterface;
 use Modules\Core\Shipping\Enums\TrackingStatus;

src/Shipping/Extensions/OrderViewExtension.php

@@ -14,7 +14,7 @@ use Lunar\Admin\Support\Extending\ViewPageExtension;
 use Lunar\Models\Order;
 use Lunar\Shipping\Models\ShippingMethod;
 use Modules\Core\Shipping\Contracts\CarrierFulfillmentInterface;
-use Modules\Core\Shipping\DataTransferObjects\ShipmentRequest;
+use Modules\Core\Shipping\DTOs\ShipmentRequest;
 
 class OrderViewExtension extends ViewPageExtension
 {