Feat: Extracting Cart and Checout from 3dealer

This commit introduces the data retention and data export Admin Services, accessed by the Boboko admin UI

README.md

@@ -1,6 +1,9 @@
 # Core Module
 
-A Laravel module providing authentication, notifications, activity logging, CLI tooling, and functional types on top of the [Lunar](https://lunarphp.io) admin panel. Designed to be consumed as a standalone Composer package.
+A Laravel module providing authentication, localization, product search/catalog, privacy/GDPR
+tooling, notifications, activity logging, CLI tooling, and functional types on top of the
+[Lunar](https://lunarphp.io) e-commerce package. Designed to be consumed as a standalone Composer
+package by any Lunar-based e-shop.
 
 ---
 
@@ -8,13 +11,83 @@ A Laravel module providing authentication, notifications, activity logging, CLI
 
 ### OTP Authentication
 
-Passwordless login for both staff (Lunar panel) and customers via 6-digit codes delivered by email. Codes expire after 10 minutes. The Lunar panel login page is a two-step flow: email → OTP. Rate-limited to 5 attempts.
+Passwordless login for both staff (Lunar panel) and customers via 6-digit codes delivered by
+email. Codes expire after 10 minutes, rate-limited to 5 attempts. The Lunar panel login page is a
+two-step flow (email → OTP) with a back button to return from the code step to the email step.
 
 See [`docs/otp-auth.md`](docs/otp-auth.md).
 
+### Localization
+
+Locale-prefixed routing (`Modules\Core\Localization\LocaleMiddleware`) — a `locale` route
+middleware, opt-in per shop, that resolves and redirects to the correct language segment
+(`/el/...`, `/en/...`) based on Lunar's own language list, with caching and rename-safe
+translation migration. Also brings in storefront UI label translations
+(`spatie/laravel-translation-loader`) with an admin-editable `LanguageLine` resource.
+
+See [`docs/localization.md`](docs/localization.md).
+
+### Product Search & Catalog
+
+Two complementary services on top of Meilisearch:
+
+- **`Modules\Core\Search\ProductSearchService`** — locale-aware full-text product search.
+- **`Modules\Core\Catalog\ProductService`** — listing/filtering (by collection, brand, price
+  range) and single-product lookup by id or slug, reading directly from the Meilisearch index
+  rather than the database.
+
+Both are backed by `Modules\Core\Search\ProductIndexer`, which extends Lunar's own indexer with
+collections, price, variants, media, tags, and reviews — everything needed for both a listing
+page and a full product detail page from one index.
+
+See [`docs/product-search.md`](docs/product-search.md) and
+[`docs/product-listing.md`](docs/product-listing.md).
+
+### Product Reviews
+
+`Modules\Core\Review\ProductReview` — ratings/reviews with staff replies, a Filament sub-navigation
+page on the product edit screen, and automatic re-indexing (via `ReviewServiceProvider`) whenever
+a review is created, updated, or deleted, so a product's Meilisearch document never goes stale.
+
+### Privacy / GDPR Data-Subject Requests
+
+Right of access (export) and right of erasure, built as an extensible contract
+(`Modules\Core\Privacy\Contracts\PersonalDataProvider`) rather than a fixed table list — any
+module can register its own data without core knowing it exists.
+
+- **Two independent scopes**: erasing/exporting a Lunar `Customer` (business account) is never
+  the same operation as erasing/exporting a `User` (individual login) — a `Customer` erasure
+  never touches any linked `User`'s login, and a `User` erasure never touches a `Customer`
+  account's own data. See `docs/privacy.md` "User-scope vs Customer-scope".
+- **Cancellable grace period** (default 30 days, configurable) before anything is actually
+  erased — logging back in during the window automatically reverts the request, mirroring
+  Shopify's own account-deletion flow. Immediate erasure exists but is staff-only by type, never
+  reachable from a self-service flow.
+- **Sole-owner cascade**: erasing the last remaining `User` on a `Customer` also opens a (grace
+  period) erasure request for that now-orphaned `Customer`, so its PII doesn't sit unreachable
+  forever — traced back to the triggering request so login-reactivation can revert exactly that
+  cascade.
+- **Queued export**: gathering data and writing a CSV-per-provider zip (via the generic,
+  reusable `Modules\Core\Export\CsvWriter`) runs as a background job; a consuming app hooks its
+  own notification onto the completion event via the Notification Registry (below).
+
+See [`docs/privacy.md`](docs/privacy.md).
+
+### Shopify Migration
+
+`Modules\Core\MigrateImport\Shopify\ShopifyExportImporter` — imports a Shopify CSV product export
+(products, variants, images, collections, tags, prices) into Lunar, idempotently re-runnable via
+an `import_mappings` table. Part of a source-agnostic import framework
+(`boboko:migrate:import`) designed to support additional sources later.
+
+See [`docs/shopify-import.md`](docs/shopify-import.md).
+
 ### Notification Registry
 
-An event-driven notification system. Each notification class declares which event it listens to and who to notify — the registry wires up the listener automatically. All notifications extend `BaseNotification` which implements `ShouldQueue`, so delivery is async. Supports optional delays.
+An event-driven notification system. Each notification class declares which event it listens to
+and who to notify — the registry wires up the listener automatically. All notifications extend
+`BaseNotification`, which implements `ShouldQueue`, so delivery is async. Supports optional
+delays.
 
 **Creating a notification:**
 
@@ -33,9 +106,13 @@ class MyNotification extends BaseNotification
 NotificationRegistry::get()->register([MyNotification::class]);
 ```
 
+See [`docs/notifications.md`](docs/notifications.md).
+
 ### Activity Logging
 
-Thin wrapper around [Spatie Laravel Activity Log](https://github.com/spatie/laravel-activitylog). Four standardized methods: `created()`, `updated()`, `failed()`, `deleted()`. Logs to the `lunar` channel and auto-resolves the actor from the staff session.
+Thin wrapper around [Spatie Laravel Activity Log](https://github.com/spatie/laravel-activitylog).
+Four standardized methods: `created()`, `updated()`, `failed()`, `deleted()`. Logs to the `lunar`
+channel and auto-resolves the actor from the staff session.
 
 See [`docs/activity-log.md`](docs/activity-log.md).
 
@@ -43,8 +120,11 @@ See [`docs/activity-log.md`](docs/activity-log.md).
 
 - Custom OTP login page replacing the default Lunar panel login
 - `StaffResourceExtension` — removes password field from Lunar's staff resource
-- `CustomerResourceExtension` — replaces default address relation manager with a custom implementation
-- `CorePlugin` — configures panel path, branding, logos, navigation items, and activity log field exclusions for staff
+- `CustomerResourceExtension` — replaces default address relation manager with a custom
+  implementation
+- Table-rate shipping (`ShippingPlugin`) registered by default
+- `CorePlugin` — configures panel path, branding, logos, navigation items, and activity log
+  field exclusions for staff
 
 Register the plugin in your Lunar panel provider:
 
@@ -52,30 +132,36 @@ Register the plugin in your Lunar panel provider:
 ->plugin(\Modules\Core\CorePlugin::make())
 ```
 
+See [`docs/lunar.md`](docs/lunar.md) for the full Lunar reference and non-obvious gotchas hit
+while building against it.
+
 ### CLI Commands
 
 | Command | Description |
 |---|---|
-| `core:create-admin` | Create a Lunar admin user |
-| `core:anonymize` | GDPR anonymization of users and customers (local only) |
-| `core:export` | Dump database + storage files to a timestamped zip |
-| `core:import` | Restore from a zip export (runs anonymize automatically, local only) |
-| `core:export-cleanup` | Delete old export zips, keep N most recent |
+| `boboko:anonymize` | Dummy-scrub personal data in `users`/`lunar_customers` for local dev safety (local environment only — **not** the GDPR erasure tool; see Privacy above for that) |
+| `boboko:export` | Dump database + storage files to a timestamped zip |
+| `boboko:import` | Restore from a `boboko:export` zip archive |
+| `boboko:export:cleanup` | Delete old export zips, keep N most recent |
+| `boboko:migrate:import` | Import a vendor product catalog (Shopify, etc.) into Lunar |
+| `boboko:privacy:process-erasure-requests` | Dispatch an erasure job for every due GDPR erasure request (wire into your own scheduler) |
+| `lunar:create-admin` | Create a Lunar admin user (overrides Lunar's own command) |
+| `lunar:install` | Seed default Lunar store data — countries, channel, currency, tax zone, attributes, product type (overrides Lunar's own command) |
 
 ### Functional Types
 
-Result and Option monads for explicit error handling without exceptions.
+Result and Option types for explicit error handling without exceptions.
 
 ```php
 // Result<T, E>
-$result = Success::of($value);
-$result = Error::of('something went wrong');
+$result = Success::create($value);
+$result = Error::create('something went wrong');
 $result->map(fn($v) => ...)->flatMap(fn($v) => ...);
 
 // Option<T>
-$option = Option::fromValue($nullableValue);
-$option->getOrElse('default');
-$option->map(fn($v) => ...)->filter(fn($v) => $v > 0);
+$option = Some::create($value);
+$option = None::create();
+$option->map(fn($v) => ...);
 ```
 
 ---
@@ -102,17 +188,22 @@ Then run:
 
 ```bash
 composer require boboko/core
+php artisan vendor:publish --tag=core-config
 php artisan vendor:publish --tag=core-assets
 php artisan migrate
 ```
 
+For local core development alongside a consuming app (path-repo symlink + Docker mount), see
+[`docs/modules.md`](docs/modules.md) "Docker Compose: the local-core mount".
+
 ---
 
 ## Requirements
 
-- PHP 8.2+
-- Laravel 11+
-- Lunar (lunarphp/lunar + lunarphp/admin)
+- PHP 8.5+
+- Laravel 12+
+- Lunar 1.3 (`lunarphp/lunar`)
+- Meilisearch (for product search/listing/catalog)
 - Spatie Laravel Activity Log
 
 ---
@@ -120,7 +211,12 @@ php artisan migrate
 ## Documentation
 
 - [`docs/otp-auth.md`](docs/otp-auth.md) — OTP authentication flow
+- [`docs/localization.md`](docs/localization.md) — Locale-prefixed routing and storefront translations
+- [`docs/product-search.md`](docs/product-search.md) — Full-text product search
+- [`docs/product-listing.md`](docs/product-listing.md) — Product listing/filtering/detail catalog service
+- [`docs/privacy.md`](docs/privacy.md) — GDPR right of access/erasure, User-scope vs Customer-scope
+- [`docs/shopify-import.md`](docs/shopify-import.md) — Shopify CSV → Lunar field mapping and import design
 - [`docs/activity-log.md`](docs/activity-log.md) — Activity logging
-- [`docs/lunar.md`](docs/lunar.md) — Lunar framework reference
 - [`docs/notifications.md`](docs/notifications.md) — Notification registry
+- [`docs/lunar.md`](docs/lunar.md) — Lunar framework reference and gotchas
 - [`docs/modules.md`](docs/modules.md) — Module architecture, Customer/User pairing, provider registration pitfalls

composer.json

@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.16.0",
+  "version": "0.22.0",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"
@@ -18,7 +18,7 @@
     "lunarphp/search": "*",
     "lunarphp/meilisearch": "*",
     "spatie/laravel-translation-loader": "^2.8",
-    "lunarphp/stripe": "^1.5"
+    "stripe/stripe-php": "^16.6"
   },
   "require-dev": {
     "fakerphp/faker": "^1.23",
@@ -38,13 +38,16 @@
         "Modules\\Core\\Providers\\AuthServiceProvider",
         "Modules\\Core\\Providers\\CustomerServiceProvider",
         "Modules\\Core\\Providers\\CheckoutServiceProvider",
+        "Modules\\Core\\Providers\\CheckoutModuleServiceProvider",
         "Modules\\Core\\Providers\\PaymentServiceProvider",
         "Modules\\Core\\Providers\\LocalizationServiceProvider",
         "Modules\\Core\\Providers\\CatalogServiceProvider",
         "Modules\\Core\\Providers\\CartServiceProvider",
         "Modules\\Core\\Providers\\ReviewServiceProvider",
+        "Modules\\Core\\Providers\\FileServiceProvider",
         "Modules\\Core\\Providers\\ShippingServiceProvider",
-        "Modules\\Core\\Providers\\OrderServiceProvider"
+        "Modules\\Core\\Providers\\OrderServiceProvider",
+        "Modules\\Core\\Providers\\PrivacyServiceProvider"
       ]
     }
   },

config/checkout.php

@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Per-site settings for the cart + checkout module (see
+ * Modules\Core\Providers\CheckoutModuleServiceProvider). Publishable —
+ * artisan vendor:publish --tag=core-config.
+ */
+return [
+
+    /*
+     * Name of the storefront's login route. The checkout's login tab and the
+     * confirmation page link to it with `?redirect=<checkout path>`, so the
+     * login page must send the shopper back there afterwards. null: no login
+     * offered in checkout at all.
+     */
+    'login_route' => 'login',
+
+    /*
+     * Name of the storefront's product-listing route — where confirmation()
+     * redirects a visit with no placed order to look at (session expired,
+     * direct navigation, a bookmark). route($this, $locale) must resolve.
+     */
+    'products_route' => 'products',
+
+    /*
+     * ISO 3166-1 alpha-3 code fixing checkout to a single country (a hidden
+     * field, forced server-side — no country picker shown at all). null (the
+     * default) gives the full country/region picker, for a multi-country
+     * store.
+     */
+    'store_country_iso3' => null,
+
+    /*
+     * The `purpose` tag CartController expects a product custom field's
+     * `file` answer to already carry (see Modules\Core\File\Models\File) —
+     * matches whatever purpose string the host's own upload endpoint
+     * (extending Modules\Core\File\Http\Controllers\UploadFileController)
+     * tags its stored files with. This module never reaches into that
+     * host controller directly; this config value is the one shared
+     * source of truth between the two.
+     */
+    'custom_field_upload_purpose' => 'custom-field-upload',
+
+];

config/core.php

@@ -16,6 +16,43 @@ return [
 
     'auto_create_customer_for_user' => true,
 
+    /*
+    |--------------------------------------------------------------------------
+    | Privacy / GDPR data-subject requests
+    |--------------------------------------------------------------------------
+    |
+    | 'providers' lists every Modules\Core\Privacy\Contracts\PersonalDataProvider
+    | that should be consulted for right-of-access/right-of-erasure requests. A
+    | module never needs to be known to core in advance — it just adds its own
+    | provider class here, the same way config('lunar.search.indexers') maps a
+    | model to its indexer. See docs/privacy.md.
+    |
+    | 'grace_period_days' is how long an erasure request stays cancellable
+    | (account deactivated, not yet erased) before it's actually processed by
+    | the privacy:process-erasure-requests scheduled command.
+    |
+    */
+
+    'privacy' => [
+        'providers' => [
+            // ActivityLogDataProvider MUST run before AddressDataProvider —
+            // it resolves which activity_log rows belong to this customer
+            // (including ones keyed by an Address id) before
+            // AddressDataProvider hard-deletes those Address rows. See that
+            // provider's own class docblock.
+            \Modules\Core\Logging\Privacy\ActivityLogDataProvider::class,
+            \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+            \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+            \Modules\Core\Order\Privacy\OrderDataProvider::class,
+            \Modules\Core\Cart\Privacy\CartDataProvider::class,
+            \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+            \Modules\Core\Payment\Privacy\PaymentDataProvider::class,
+            \Modules\Core\Auth\Privacy\UserSessionDataProvider::class,
+        ],
+
+        'grace_period_days' => 30,
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Cart Abandonment Threshold
@@ -30,6 +67,75 @@ return [
 
     'cart' => [
         'abandoned_after' => '1 hour',
+
+        /*
+        |----------------------------------------------------------------------
+        | Unrecoverable Cap
+        |----------------------------------------------------------------------
+        |
+        | Beyond this age, a stale cart stops being treated as an active
+        | "Abandoned Cart"/"Abandoned Checkout" (Modules\Core\Cart\Services\
+        | CartLifecycleService) — too old to be a realistic recovery target
+        | (pricing/stock/tax likely stale by then). This is about the
+        | abandoned-cart pipeline only, not data retention — no rows are
+        | deleted or pruned based on this value.
+        |
+        */
+
+        'unrecoverable_after' => '90 days',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Order Return Window
+    |--------------------------------------------------------------------------
+    |
+    | How many days after a carrier order is delivered (Order::fulfillment_status
+    | becomes 'return_window_open') before Modules\Core\Order\Commands\
+    | CloseExpiredReturnWindows auto-completes it, if no return was requested.
+    | Store-pickup orders have no return-window step and are unaffected by
+    | this value (see Modules\Core\Order\Listeners\CompleteOrderOnPickedUp).
+    |
+    */
+
+    'order' => [
+        'return_window_days' => 14,
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Storefront OTP Login
+    |--------------------------------------------------------------------------
+    |
+    | Modules\Core\Auth\Services\UserOtpService's passwordless login.
+    | max_attempts caps how many wrong codes a shopper can guess against ONE
+    | generated code before it's invalidated outright. generation_limit/
+    | generation_decay_minutes cap how often a NEW code can be requested for
+    | the same email — independent of max_attempts, since generating a fresh
+    | code also resets the guess count, so an attempt cap alone doesn't stop
+    | an attacker from just requesting a new code every few tries. This same
+    | limit is also what stands between a malicious/careless caller and
+    | mail-bombing one inbox.
+    |
+    */
+
+    'auth' => [
+        'otp' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+        ],
+
+        // Modules\Core\Customer\Services\CustomerEmailChangeService — same
+        // shape/reasoning as auth.otp above, independent limits since this
+        // is a separate flow (changing an existing account's login email,
+        // not logging in).
+        'email_change' => [
+            'max_attempts' => 5,
+            'generation_limit' => 3,
+            'generation_decay_minutes' => 10,
+            'expiry_minutes' => 10,
+        ],
     ],
 
 ];

config/payment.php

@@ -1,6 +1,6 @@
 <?php
 
-use Modules\Core\Payment\Pipelines\Cart\ApplyCashOnDeliveryFee;
+use Modules\Core\Payment\Pipelines\Cart\ApplyPaymentMethodFee;
 
 return [
     /*
@@ -9,8 +9,8 @@ return [
     |--------------------------------------------------------------------------
     |
     | Appended to config('lunar.cart.pipelines.cart') after ApplyShipping so
-    | the cash-on-delivery fee is added to the shipping total before the
-    | final Calculate step sums everything up.
+    | the selected payment method's own fee (if any) is added to the
+    | shipping total before the final Calculate step sums everything up.
     |
     | This is the one thing left in this file — everything about WHICH
     | payment methods exist (driver mapping, capture_mode, statuses) moved
@@ -23,6 +23,6 @@ return [
     |
     */
     'cart_pipeline' => [
-        ApplyCashOnDeliveryFee::class,
+        ApplyPaymentMethodFee::class,
     ],
 ];

config/shippingCarriers/boxnow.php

@@ -13,12 +13,25 @@
 |
 | Set these via environment variables — never commit real values.
 |
+| Box Now has two environments (see their Partner API manual, section 2):
+| Stage/Sandbox for testing, Production once live. Each has its own
+| client_id/client_secret pair and its own base_url/location_api_url —
+| there is no shared "switch an env var" flag, since stage credentials
+| don't work against the production host or vice versa.
+|
 | BOXNOW_BASE_URL         Root REST endpoint for delivery-requests/parcels.
 | BOXNOW_LOCATION_API_URL Separate, faster endpoint for origins/destinations
 |                         lookups (Box Now recommends this over the main
 |                         base URL for those two calls specifically).
 | BOXNOW_CLIENT_ID        OAuth2 client id.
 | BOXNOW_CLIENT_SECRET    OAuth2 client secret.
+| BOXNOW_PARTNER_ID       Numeric partnerId Box Now issues alongside your
+|                         credentials. NOT used for REST API authentication
+|                         (BoxNowClient authenticates with client_id/
+|                         client_secret alone) — this is only consumed by
+|                         the client-side Destination Map widget config
+|                         (_bn_map_widget_config.partnerId), confirmed
+|                         against Box Now's own WooCommerce plugin source.
 | BOXNOW_ORIGIN_LOCATION_ID  Your warehouse's Box Now locationId, used as
 |                            the pickup origin on every delivery request.
 | BOXNOW_SENDER_*         Static sender contact details reused on every
@@ -33,6 +46,7 @@ return [
 
     'client_id' => env('BOXNOW_CLIENT_ID'),
     'client_secret' => env('BOXNOW_CLIENT_SECRET'),
+    'partner_id' => env('BOXNOW_PARTNER_ID'),
 
     'origin_location_id' => env('BOXNOW_ORIGIN_LOCATION_ID'),
 

database/migrations/2026_08_24_000001_add_deactivated_at_to_users_table.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->timestamp('deactivated_at')->nullable()->after('otp_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('deactivated_at');
+        });
+    }
+};

database/migrations/2026_08_24_000002_create_data_erasure_requests_table.php

@@ -0,0 +1,56 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('data_erasure_requests', function (Blueprint $table) {
+            $table->id();
+            // Polymorphic, not a fixed customer_id — a request targets either a
+            // Lunar Customer (business account) or a User (individual), never
+            // both at once. See docs/privacy.md "User-scope vs Customer-scope".
+            $table->string('subject_type');
+            $table->unsignedBigInteger('subject_id');
+            // Snapshot, not a live-looked-up value — the subject's email may
+            // change or the record may be gone by the time this is read.
+            $table->string('email')->nullable();
+            // Who asked for this: the subject themselves (self-service deletion)
+            // or a staff member acting on their behalf. Plain nullable type+id
+            // columns rather than morphs() — only ever one of two concrete actor
+            // types, not an open-ended polymorphic set.
+            $table->string('requested_by_type');
+            $table->unsignedBigInteger('requested_by_id');
+            $table->string('status')->default('pending');
+            // Set only on a Customer-scoped request that was auto-created because
+            // erasing a User left them as the sole remaining user on that Customer
+            // (see Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener).
+            // Null for every normal, directly-requested erasure. Lets login-
+            // reactivation find and revert exactly the Customer request THIS
+            // User's cancellation caused, without touching an unrelated,
+            // independently-requested Customer erasure the User happens to be
+            // linked to.
+            $table->foreignId('caused_by_request_id')->nullable()->constrained('data_erasure_requests')->nullOnDelete();
+            // now() + config('core.privacy.grace_period_days') at creation time —
+            // when privacy:process-erasure-requests will actually run this.
+            $table->timestamp('scheduled_for');
+            $table->timestamp('cancelled_at')->nullable();
+            $table->timestamp('completed_at')->nullable();
+            // Every provider's outcome, written once the request completes —
+            // see Modules\Core\Privacy\ErasureReport. Null until then.
+            $table->json('report')->nullable();
+            $table->timestamps();
+
+            $table->index(['status', 'scheduled_for']);
+            $table->index(['subject_type', 'subject_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('data_erasure_requests');
+    }
+};

database/migrations/2026_08_24_000003_create_data_export_requests_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('data_export_requests', function (Blueprint $table) {
+            $table->id();
+            // Polymorphic, not a fixed customer_id — see data_erasure_requests
+            // for the same shape and reasoning.
+            $table->string('subject_type');
+            $table->unsignedBigInteger('subject_id');
+            // Snapshot, not a live lookup — same reasoning as
+            // data_erasure_requests.email (see that migration).
+            $table->string('email')->nullable();
+            $table->string('status')->default('pending');
+            // Storage path of the assembled export .zip, set once the queued job
+            // finishes. Null while pending.
+            $table->string('file_path')->nullable();
+            $table->timestamp('completed_at')->nullable();
+            $table->timestamps();
+
+            $table->index('status');
+            $table->index(['subject_type', 'subject_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('data_export_requests');
+    }
+};

database/migrations/2026_09_03_000001_create_stripe_payment_intents_table.php

@@ -0,0 +1,46 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Lunar\Base\Migration;
+
+/**
+ * First-party copy of lunarphp/stripe's own create_stripe_payment_intents_table
+ * migration (package removed in favour of depending on stripe/stripe-php
+ * directly — see Modules\Core\Payment\Support\StripeManager and
+ * Modules\Core\Payment\Models\StripePaymentIntent, which replace the
+ * package's own classes over this same table). Timestamped to run just
+ * before this app's own add_context_to_stripe_payment_intents migration,
+ * which already alters this table.
+ *
+ * Guarded with hasTable(): on any environment that already ran
+ * lunarphp/stripe's own copy of this migration before the package was
+ * removed, the table already exists — this migration is only the one that
+ * actually creates it on a fresh install/database from now on.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable($this->prefix.'stripe_payment_intents')) {
+            return;
+        }
+
+        Schema::create($this->prefix.'stripe_payment_intents', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('cart_id')->constrained($this->prefix.'carts');
+            $table->foreignId('order_id')->nullable()->constrained($this->prefix.'orders');
+            $table->string('intent_id')->index();
+            $table->string('status')->nullable();
+            $table->string('event_id')->index()->nullable();
+            $table->timestamp('processing_at')->nullable();
+            $table->timestamp('processed_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists($this->prefix.'stripe_payment_intents');
+    }
+};

database/migrations/2026_09_11_000001_add_status_axes_to_orders_table.php

@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Splits Lunar's single flat `status` column into three independently
+ * tracked axes — payment, fulfillment, return — so a payment refund and a
+ * fulfillment dispatch stop racing to write the same field, and each axis
+ * can be filtered/queried directly instead of overloading one string for
+ * three unrelated concerns. See Modules\Core\Order\Enums\OrderPaymentStatus/
+ * OrderFulfillmentStatus/OrderReturnStatus for the value vocabularies, and
+ * Modules\Core\Order\Listeners\ApplyResolvedPaymentStatus and friends for
+ * where these columns actually get written. `status` itself is left in
+ * place, unchanged — Lunar core still reads/writes it in places this
+ * package doesn't own — but nothing in this package's business logic keys
+ * off it anymore after this migration's consumers land.
+ *
+ * lunar_customers already has a direct precedent for a boboko-core
+ * migration altering a Lunar-owned table (see
+ * 2026_07_02_000002_drop_otp_from_lunar_customers_table.php) — this is not
+ * a new pattern for this codebase, just the first time it's applied to
+ * lunar_orders.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->string('payment_status')->default('awaiting_payment')->after('status')->index();
+            $table->string('fulfillment_status')->default('unfulfilled')->after('payment_status')->index();
+            $table->string('return_status')->default('none')->after('fulfillment_status')->index();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['payment_status', 'fulfillment_status', 'return_status']);
+        });
+    }
+};

database/migrations/2026_09_11_000002_create_order_status_transitions_table.php

@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Append-only audit trail for Order's three status axes (see
+ * 2026_09_11_000001_add_status_axes_to_orders_table.php) — the thing
+ * `Lunar\Models\Order::getDefaultLogExcept()` explicitly denies (`status`
+ * is excluded from Lunar's own Spatie activity log), so this is a
+ * from-scratch mechanism, not a gap in an existing one.
+ *
+ * No `updated_at` — a row is never edited after it's written, only ever
+ * inserted. `event_class` is the FQCN of whatever business event/action
+ * caused the write (e.g. Modules\Core\Order\Events\OrderDispatched, or a
+ * plain string like 'Modules\Core\Shipping\Extensions\OrderViewExtension::
+ * markDispatchedAction' for a manual Filament action that has no backing
+ * event class of its own) — see Modules\Core\Order\Services\
+ * OrderStatusTransitionRecorder.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('order_status_transitions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('order_id')->constrained('lunar_orders')->cascadeOnDelete();
+            $table->string('axis');
+            $table->string('from_status')->nullable();
+            $table->string('to_status');
+            $table->string('event_class');
+            $table->timestamp('created_at')->useCurrent();
+            $table->index(['order_id', 'axis']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('order_status_transitions');
+    }
+};

database/migrations/2026_09_11_000003_backfill_order_status_axes.php

@@ -0,0 +1,79 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Support\OrderStatus;
+
+/**
+ * Maps every existing order's flat `status` (as it stood before
+ * 2026_09_11_000001_add_status_axes_to_orders_table.php) onto the new
+ * payment_status/fulfillment_status/return_status columns. A separate
+ * migration from the schema change so the schema migration stays simply
+ * reversible via down(), and this data pass can be independently re-run.
+ *
+ * The flat status never captured refunds at all (no 'refunded' value was
+ * ever added to config('lunar.orders.statuses')), so the table-driven
+ * mapping below is corrected per-order by re-deriving
+ * Modules\Core\Order\Support\OrderStatus::payment() — the existing,
+ * unchanged derived-enum logic — and overriding payment_status to
+ * refunded/partially_refunded wherever it disagrees with the flat-status
+ * mapping. This is the one place the "keep the old derived enums" design
+ * decision earns its keep: refund-fraction math isn't reimplemented here,
+ * just reused.
+ */
+return new class extends Migration
+{
+    private const MAP = [
+        'awaiting-payment' => ['payment_status' => 'awaiting_payment', 'fulfillment_status' => 'unfulfilled'],
+        'payment-offline' => ['payment_status' => 'awaiting_payment', 'fulfillment_status' => 'unfulfilled'],
+        'payment-received' => ['payment_status' => 'paid', 'fulfillment_status' => 'unfulfilled'],
+        'ready-for-dispatch' => ['payment_status' => 'paid', 'fulfillment_status' => 'ready'],
+        'ready-for-pickup' => ['payment_status' => 'paid', 'fulfillment_status' => 'ready'],
+        'dispatched' => ['payment_status' => 'paid', 'fulfillment_status' => 'in_transit'],
+        'completed' => ['payment_status' => 'paid', 'fulfillment_status' => 'completed'],
+    ];
+
+    public function up(): void
+    {
+        Order::query()->with('transactions')->chunkById(200, function ($orders) {
+            foreach ($orders as $order) {
+                $mapped = self::MAP[$order->status] ?? null;
+
+                if ($mapped === null) {
+                    Log::warning('Order status axis backfill: unmapped status, leaving column defaults', [
+                        'order_id' => $order->id,
+                        'status' => $order->status,
+                    ]);
+
+                    continue;
+                }
+
+                $paymentStatus = $mapped['payment_status'];
+
+                $derived = OrderStatus::payment($order);
+
+                if ($derived === PaymentStatus::Refunded) {
+                    $paymentStatus = 'refunded';
+                } elseif ($derived === PaymentStatus::PartialRefund) {
+                    $paymentStatus = 'partially_refunded';
+                }
+
+                DB::table('lunar_orders')->where('id', $order->id)->update([
+                    'payment_status' => $paymentStatus,
+                    'fulfillment_status' => $mapped['fulfillment_status'],
+                    'return_status' => 'none',
+                ]);
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        // Column defaults (set in the schema migration) are the correct
+        // "undo" — no need to reverse-map back to the flat status, since
+        // `status` itself was never touched by this migration.
+    }
+};

database/migrations/2026_09_11_000004_drop_status_columns_from_payment_methods_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * captured_status/authorized_status/refunded_status let a merchant pick
+ * which per-method Order::status label a payment outcome resulted in — a
+ * mechanism that only made sense while Order.status was the single field
+ * carrying that meaning. Modules\Core\Order\Listeners\
+ * ApplyResolvedPaymentStatus now writes a fixed 3-value payment_status
+ * column instead (see 2026_09_11_000001_add_status_axes_to_orders_table.php);
+ * there is no longer any per-method flexibility to preserve — "paid" is
+ * "paid" regardless of which method captured it. Dropped rather than left
+ * vestigial: keeping them visible in the admin would let a merchant
+ * configure something that silently does nothing.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->dropColumn(['captured_status', 'authorized_status', 'refunded_status']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('payment_methods', function (Blueprint $table) {
+            $table->string('captured_status')->nullable();
+            $table->string('authorized_status')->nullable();
+            $table->string('refunded_status')->nullable();
+        });
+    }
+};

database/migrations/2026_09_12_000001_add_paid_to_orders_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Order::paid/paid_at — entirely independent of the `status` column (see
+ * Modules\Core\Order\Services\OrderStatusFlow's own docblock for why
+ * payment timing, especially for cash-on-delivery, cannot be modeled as a
+ * status-sequence step). `paid` is the fast-filter boolean; `paid_at` is
+ * when it actually happened.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->boolean('paid')->default(false)->after('status')->index();
+            $table->timestamp('paid_at')->nullable()->after('paid');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['paid', 'paid_at']);
+        });
+    }
+};

database/migrations/2026_09_12_000002_backfill_single_order_status_and_paid.php

@@ -0,0 +1,116 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Lunar\Models\Order;
+use Modules\Core\Order\Enums\PaymentStatus;
+use Modules\Core\Order\Support\OrderStatus;
+
+/**
+ * Collapses the 3-axis (payment_status/fulfillment_status/return_status)
+ * model this session briefly built — abandoned before shipping — back
+ * onto a single `status` column plus the new independent `paid`/`paid_at`
+ * fields. Must run after 2026_09_12_000001 (adds paid/paid_at) and before
+ * 2026_09_12_000003 (drops the axis columns this migration still reads).
+ *
+ * Priority rule: axis data where it's genuinely non-default (this order
+ * was really moved through the axis system during this session's manual
+ * testing); the legacy `status` column (which may still hold pre-session
+ * hyphenated values) as fallback everywhere else.
+ */
+return new class extends Migration
+{
+    private const LEGACY_MAP = [
+        'awaiting-payment' => 'awaiting_payment',
+        'payment-offline' => 'awaiting_payment',
+        'payment-received' => 'processing',
+        'ready-for-dispatch' => 'ready_for_dispatch',
+        'ready-for-pickup' => 'ready_for_pickup',
+        'dispatched' => 'dispatched',
+        'completed' => 'completed',
+    ];
+
+    /**
+     * Axis fulfillment_status -> new single status, given branch. Axis
+     * 'delivered' folds into 'return_window_open' (same combined-value
+     * decision the going-forward design makes). Axis payment_status is
+     * used only to decide whether a fully-unfulfilled order should read
+     * as 'awaiting_payment' or 'processing'.
+     */
+    private function mapFromAxes(string $payment, string $fulfillment, string $return, bool $isPickup): ?string
+    {
+        if ($return === 'returned') {
+            return 'returned';
+        }
+        if ($return === 'requested') {
+            return 'return_requested';
+        }
+
+        return match ($fulfillment) {
+            'unfulfilled' => $payment === 'paid' ? 'processing' : 'awaiting_payment',
+            'processing' => 'processing',
+            'ready' => $isPickup ? 'ready_for_pickup' : 'ready_for_dispatch',
+            'in_transit' => 'dispatched',
+            'delivered', 'return_window_open' => 'return_window_open',
+            'picked_up' => 'picked_up',
+            'completed' => 'completed',
+            default => null,
+        };
+    }
+
+    public function up(): void
+    {
+        Order::query()->with('transactions')->chunkById(200, function ($orders) {
+            foreach ($orders as $order) {
+                $isPickup = $order->isStorePickupOrder();
+
+                $axisIsDefault = $order->payment_status === 'awaiting_payment'
+                    && $order->fulfillment_status === 'unfulfilled'
+                    && $order->return_status === 'none';
+
+                $status = $axisIsDefault
+                    ? (self::LEGACY_MAP[$order->status] ?? null)
+                    : $this->mapFromAxes($order->payment_status, $order->fulfillment_status, $order->return_status, $isPickup);
+
+                if ($status === null) {
+                    Log::warning('Single-status backfill: unmapped order, defaulting to awaiting_payment', [
+                        'order_id' => $order->id,
+                        'status' => $order->status,
+                        'payment_status' => $order->payment_status,
+                        'fulfillment_status' => $order->fulfillment_status,
+                        'return_status' => $order->return_status,
+                    ]);
+                    $status = 'awaiting_payment';
+                }
+
+                $derived = OrderStatus::payment($order);
+                $paid = $order->payment_status === 'paid'
+                    || in_array($derived, [PaymentStatus::Captured, PaymentStatus::Refunded, PaymentStatus::PartialRefund], true);
+
+                // A refund implies the order concluded via a return —
+                // even one backfilled to an early status (e.g. an order
+                // refunded before fulfillment ever started) is corrected
+                // to refunded/partially_refunded here, not left stuck
+                // pre-fulfillment with no sign a refund ever happened.
+                if ($derived === PaymentStatus::Refunded) {
+                    $status = 'refunded';
+                } elseif ($derived === PaymentStatus::PartialRefund) {
+                    $status = 'partially_refunded';
+                }
+
+                DB::table('lunar_orders')->where('id', $order->id)->update([
+                    'status' => $status,
+                    'paid' => $paid,
+                    'paid_at' => $paid ? ($order->placed_at ?? now()) : null,
+                ]);
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        // No reverse mapping — column defaults (post-rollback of the
+        // schema migrations) are the correct "undo".
+    }
+};

database/migrations/2026_09_12_000003_drop_status_axes_from_orders_table.php

@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Reverses 2026_09_11_000001_add_status_axes_to_orders_table.php — the
+ * 3-axis model was abandoned before shipping in favor of a single
+ * `status` column plus independent `paid`/`paid_at` (see
+ * 2026_09_12_000001/000002). Must run after 2026_09_12_000002, which
+ * still reads these columns for the backfill.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->dropColumn(['payment_status', 'fulfillment_status', 'return_status']);
+        });
+    }
+
+    public function down(): void
+    {
+        // Mirrors 2026_09_11_000001's own down() — restores columns
+        // empty/defaulted, does not attempt to resurrect real per-order
+        // values.
+        Schema::table('lunar_orders', function (Blueprint $table) {
+            $table->string('payment_status')->default('awaiting_payment')->after('paid_at')->index();
+            $table->string('fulfillment_status')->default('unfulfilled')->after('payment_status')->index();
+            $table->string('return_status')->default('none')->after('fulfillment_status')->index();
+        });
+    }
+};

database/migrations/2026_09_12_000004_drop_axis_from_order_status_transitions_table.php

@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * There is only one status column left to audit (plus the synthetic
+ * 'paid' entry — see Modules\Core\Order\Listeners\RecordStatusTransition),
+ * so the `axis` column this table was created with
+ * (2026_09_11_000002_create_order_status_transitions_table.php) no longer
+ * means anything.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('order_status_transitions', function (Blueprint $table) {
+            $table->dropIndex(['order_id', 'axis']);
+            $table->dropColumn('axis');
+            $table->index('order_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('order_status_transitions', function (Blueprint $table) {
+            $table->dropIndex(['order_id']);
+            $table->string('axis')->default('status')->after('order_id');
+            $table->index(['order_id', 'axis']);
+        });
+    }
+};

database/migrations/2026_09_12_000005_correct_cash_on_delivery_payment_method_driver.php

@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * The seeded 'cash-on-delivery' PaymentMethod row
+ * (Modules\Core\Command\InstallLunarCommand::seedPaymentMethods()) was
+ * wired to driver => 'offline' — the same immediate-capture driver as
+ * cash-in-hand. That's the bug that made COD "pay immediately" instead of
+ * waiting for staff to confirm cash was actually received. Repoints
+ * already-seeded environments to the new dedicated
+ * Modules\Core\Payment\Drivers\CashOnDeliveryPaymentDriver; the seeder
+ * itself is fixed separately for fresh installs.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('payment_methods')->where('type', 'cash-on-delivery')->update(['driver' => 'cash-on-delivery']);
+    }
+
+    public function down(): void
+    {
+        DB::table('payment_methods')->where('type', 'cash-on-delivery')->update(['driver' => 'offline']);
+    }
+};

database/migrations/2026_09_13_000001_rename_return_window_open_status_to_delivered.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * 'return_window_open' is renamed to 'delivered' — same status value,
+ * same meaning (the parcel arrived AND the return window is now open,
+ * still one combined moment — see Modules\Core\Order\Listeners\
+ * AdvanceFulfillmentOnDelivered), just a name a merchant expects to read
+ * on the order page rather than an internal mechanic. Also renames it in
+ * order_status_transitions' audit rows so the history stays consistent
+ * with `status` going forward.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('lunar_orders')->where('status', 'return_window_open')->update(['status' => 'delivered']);
+        DB::table('order_status_transitions')->where('from_status', 'return_window_open')->update(['from_status' => 'delivered']);
+        DB::table('order_status_transitions')->where('to_status', 'return_window_open')->update(['to_status' => 'delivered']);
+    }
+
+    public function down(): void
+    {
+        DB::table('lunar_orders')->where('status', 'delivered')->update(['status' => 'return_window_open']);
+        DB::table('order_status_transitions')->where('from_status', 'delivered')->update(['from_status' => 'return_window_open']);
+        DB::table('order_status_transitions')->where('to_status', 'delivered')->update(['to_status' => 'return_window_open']);
+    }
+};

database/migrations/2026_09_13_000002_create_manifests_table.php

@@ -0,0 +1,43 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A real record of "a manifest was issued", not just a loose
+ * manifest_reference string stamped onto each Shipment row — ACS's own
+ * ACS_Issue_Pickup_List call returns nothing beyond a PickupList_No (see
+ * Modules\Core\Shipping\Carriers\Acs\AcsFulfillmentService::issueManifest()),
+ * so this table is entirely our own bookkeeping: when the manifest was
+ * issued and how many shipments it included, not something re-derivable
+ * from the carrier later. `shipment_count` is denormalized (also
+ * countable via shipments()->count()) purely so the manifests list can
+ * render without an extra query per row.
+ *
+ * carrier-agnostic by design — see Modules\Core\Shipping\Contracts\
+ * SupportsManifestBatching, the same contract any future carrier
+ * (Speedex, etc.) implements to get manifest batching at all; this table
+ * has no ACS-specific columns.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('manifests', function (Blueprint $table) {
+            $table->id();
+            $table->string('carrier');
+            $table->string('reference');
+            $table->unsignedInteger('shipment_count')->default(0);
+            $table->timestamp('issued_at');
+            $table->timestamps();
+
+            $table->unique(['carrier', 'reference']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('manifests');
+    }
+};

database/migrations/2026_09_13_000003_add_manifest_id_to_shipments_table.php

@@ -0,0 +1,82 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Replaces the loose manifest_reference string with a real manifests
+ * relation — see 2026_09_13_000002_create_manifests_table.php. Backfills
+ * one Manifest row per distinct (carrier, manifest_reference) pair
+ * already present in shipments, using the earliest label_printed_at (or
+ * updated_at as a fallback) among that group as a best-effort issued_at,
+ * since the exact original issue time was never recorded anywhere.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->foreignId('manifest_id')->nullable()->after('manifest_reference')->constrained()->nullOnDelete();
+        });
+
+        $groups = DB::table('shipments')
+            ->select('carrier', 'manifest_reference')
+            ->whereNotNull('manifest_reference')
+            ->distinct()
+            ->get();
+
+        foreach ($groups as $group) {
+            $shipments = DB::table('shipments')
+                ->where('carrier', $group->carrier)
+                ->where('manifest_reference', $group->manifest_reference)
+                ->get();
+
+            $issuedAt = $shipments->pluck('label_printed_at')->filter()->min()
+                ?? $shipments->pluck('updated_at')->min();
+
+            $manifestId = DB::table('manifests')->insertGetId([
+                'carrier' => $group->carrier,
+                'reference' => $group->manifest_reference,
+                'shipment_count' => $shipments->count(),
+                'issued_at' => $issuedAt,
+                'created_at' => $issuedAt,
+                'updated_at' => $issuedAt,
+            ]);
+
+            DB::table('shipments')
+                ->where('carrier', $group->carrier)
+                ->where('manifest_reference', $group->manifest_reference)
+                ->update(['manifest_id' => $manifestId]);
+        }
+
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->dropColumn('manifest_reference');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->string('manifest_reference')->nullable()->after('parent_reference');
+        });
+
+        DB::table('shipments')
+            ->whereNotNull('manifest_id')
+            ->orderBy('id')
+            ->each(function ($shipment) {
+                $manifest = DB::table('manifests')->find($shipment->manifest_id);
+
+                if ($manifest) {
+                    DB::table('shipments')->where('id', $shipment->id)->update([
+                        'manifest_reference' => $manifest->reference,
+                    ]);
+                }
+            });
+
+        Schema::table('shipments', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('manifest_id');
+        });
+    }
+};

database/migrations/2026_09_14_000001_add_otp_attempts_to_users_table.php

@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Caps brute-forcing a 6-digit OTP code (1M combinations, 10-minute
+ * window, previously uncapped) — see Modules\Core\Auth\Services\
+ * UserOtpService::validate(), which now invalidates the code entirely
+ * (forcing a fresh generateAndSend()) once otp_attempts reaches its max,
+ * rather than leaving a live code guessable indefinitely within its
+ * expiry window.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->unsignedTinyInteger('otp_attempts')->default(0)->after('otp_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('otp_attempts');
+        });
+    }
+};

database/migrations/2026_09_15_000001_create_user_sessions_table.php

@@ -0,0 +1,41 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A per-login session registry, independent of the actual session store
+ * driver (SESSION_DRIVER=redis in this app — no "sessions" table to
+ * purge by user_id the way the database driver would allow). Each
+ * successful OTP login (Modules\Core\Auth\Services\UserOtpService::
+ * validate()) records one row here and stamps the token into the
+ * Laravel session payload; Modules\Core\Auth\Http\Middleware\
+ * EnsureSessionNotRevoked checks it on every request. "Logout
+ * everywhere" (Modules\Core\Auth\Services\UserSessionService::
+ * revokeOtherSessions()) is then just marking every OTHER row
+ * revoked_at, no session-store-specific logic anywhere.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('user_sessions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('token', 64)->unique();
+            $table->string('user_agent')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->timestamp('last_used_at');
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+
+            $table->index(['user_id', 'revoked_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('user_sessions');
+    }
+};

database/migrations/2026_09_15_000001_make_payment_methods_name_translatable.php

@@ -0,0 +1,65 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Language;
+
+/**
+ * PaymentMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Cash On Delivery", "el": "Αντικαταβολή"}), rendered in Filament
+ * via Lunar's own Lunar\Admin\Support\Forms\Components\TranslatedText —
+ * the same reusable component/data-shape Product/Collection names already
+ * use (Lunar\Base\Traits\HasTranslations), just applied directly to a
+ * plain column here rather than through attribute_data, since
+ * PaymentMethod is a merchant-configured settings row, not a translatable
+ * catalog attribute.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet — this
+ * migration can run before lunar:install seeds one) rather than dropped,
+ * so an already-configured payment method's name isn't blanked out.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (which requires doctrine/dbal — not installed in this project) —
+ * Postgres-specific (this project runs on `pgsql`, per its own docker
+ * setup), with an explicit USING clause since json isn't implicitly
+ * castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name DROP DEFAULT');
+        DB::statement("ALTER TABLE payment_methods ALTER COLUMN name TYPE json USING NULL");
+
+        foreach ($existing as $id => $name) {
+            if ($name === null) {
+                continue;
+            }
+
+            DB::table('payment_methods')
+                ->where('id', $id)
+                ->update(['name' => json_encode([$defaultLocale => $name])]);
+        }
+    }
+
+    public function down(): void
+    {
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        $existing = DB::table('payment_methods')->pluck('name', 'id');
+
+        DB::statement('ALTER TABLE payment_methods ALTER COLUMN name TYPE varchar(255) USING NULL');
+
+        foreach ($existing as $id => $name) {
+            $decoded = json_decode((string) $name, true);
+            $flat = is_array($decoded) ? ($decoded[$defaultLocale] ?? reset($decoded) ?: null) : $name;
+
+            DB::table('payment_methods')->where('id', $id)->update(['name' => $flat]);
+        }
+    }
+};

database/migrations/2026_09_15_000002_make_shipping_methods_name_translatable.php

@@ -0,0 +1,74 @@
+<?php
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Base\Migration;
+use Lunar\Models\Language;
+
+/**
+ * ShippingMethod.name becomes a locale-keyed JSON array (e.g.
+ * {"en": "Standard Delivery", "el": "Κανονική Παράδοση"}), rendered in
+ * Filament via Lunar's own Lunar\Admin\Support\Forms\Components\
+ * TranslatedText (Modules\Core\Shipping\Extensions\
+ * ShippingMethodResourceExtension::replaceNameField()) — same shape/
+ * resolution as PaymentMethod.name (see its own migration,
+ * 2026_09_15_000001_make_payment_methods_name_translatable.php) and
+ * Product/Collection names (Lunar\Base\Traits\HasTranslations).
+ *
+ * ShippingMethod is a vendor (lunarphp/table-rate-shipping) table, but
+ * converting a vendor column's type via a migration is no different from
+ * any other schema change this project already makes against a vendor
+ * table (see database/migrations/2026_08_31_000001_create_payment_methods_table.php's
+ * sibling migrations for the same pattern against PaymentMethod) — there
+ * was no good reason to route this through `data.name` instead, unlike
+ * `data.fulfillment_type` which is a genuinely NEW field the vendor table
+ * never had at all.
+ *
+ * Existing plain-string rows are preserved under the store's default
+ * Language code (falls back to 'en' if no Language row exists yet)
+ * rather than dropped.
+ *
+ * Uses a raw `ALTER COLUMN ... TYPE` rather than Blueprint::change()
+ * (requires doctrine/dbal — not installed in this project) — Postgres-
+ * specific (this project runs on `pgsql`), with an explicit USING clause
+ * since json isn't implicitly castable from varchar.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // The column is NOT NULL (vendor migration never marked it
+        // nullable) — converting via `USING NULL` first, then
+        // backfilling with a second UPDATE, violates that constraint
+        // before the backfill ever runs. json_build_object() converts
+        // each existing string in place, in the same statement, so the
+        // column is never transiently NULL. $defaultLocale is inlined
+        // (not bound) — parameter binding inside an ALTER TABLE ... USING
+        // expression isn't reliable across drivers; it's a Language::code
+        // value we control, not user input, so quote_literal-safe
+        // interpolation here is fine.
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement("ALTER TABLE {$table} ALTER COLUMN name TYPE json USING json_build_object({$quotedLocale}, name)");
+    }
+
+    public function down(): void
+    {
+        $table = $this->prefix.'shipping_methods';
+        $defaultLocale = Language::where('default', true)->value('code') ?? 'en';
+
+        // Same NOT NULL constraint applies going back — ->>'{locale}'
+        // extracts the default locale's text value directly in the
+        // USING clause, falling back to the first key present via
+        // COALESCE for any row missing that locale (e.g. one only ever
+        // filled in via a non-default language).
+        $quotedLocale = DB::getPdo()->quote($defaultLocale);
+
+        DB::statement(
+            "ALTER TABLE {$table} ALTER COLUMN name TYPE varchar(255) ".
+            "USING COALESCE(name->>{$quotedLocale}, (SELECT value FROM json_each_text(name) LIMIT 1))"
+        );
+    }
+};

database/migrations/2026_09_22_000001_add_custom_fields_to_products_table.php

@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Per-product, customer-authored input fields — a personalized-statue
+ * product needing a reference photo upload and an optional engraving
+ * textarea, for example. Deliberately NOT modeled as a Lunar ProductOption
+ * (see Modules\Core\Catalog\Contracts\ProductOptionTypeInterface's own
+ * docblock): an option's values are a fixed, admin-authored list that
+ * define variants (Red/Green/Blue) — a photo upload has no such list, it's
+ * unique per order, and creates no variant at all. This is a genuinely
+ * different concept that happens to configure on the same product page.
+ *
+ * Array of {key, type: 'text'|'textarea'|'file', label, required} — `key`
+ * is what a submitted answer is keyed by in CartLine/OrderLine.meta (both
+ * already have a `meta` json column — see Modules\Core\Cart\Services\
+ * CartService::addLine()'s own $meta parameter), not a new table, since
+ * this is small, rarely-queried per-product config, the same reasoning
+ * ShippingMethod.data/PaymentMethod.data already follow for their own
+ * per-row settings.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table(config('lunar.database.table_prefix').'products', function (Blueprint $table) {
+            $table->json('custom_fields')->nullable()->after('attribute_data');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table(config('lunar.database.table_prefix').'products', function (Blueprint $table) {
+            $table->dropColumn('custom_fields');
+        });
+    }
+};

database/migrations/2026_09_25_000001_create_files_table.php

@@ -0,0 +1,50 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * A generic, storage-backend-agnostic file registry — Modules\Core\File\
+ * Services\FileService's own backing table. `disk`/`path` are whatever
+ * Laravel's Storage facade already understands (local, s3, ...); this
+ * table adds what Flysystem itself has no concept of: who a file
+ * belongs to, why it was uploaded, and whether anything still needs it.
+ *
+ * `owner_type`/`owner_id` are nullable — a file can (and, for a product
+ * custom-field photo, always does) exist before anything owns it yet: a
+ * shopper picks a photo on the product page and it's uploaded immediately
+ * (see 3dealer's CustomFieldUploadController), well before add-to-cart
+ * gives it a CartLine to belong to. FileService::attachOwner() re-points
+ * these columns once an owner exists, rather than creating a second row
+ * for the same physical file.
+ *
+ * `purpose` (e.g. 'custom-field-upload') lets one table serve unrelated
+ * future features without collision — FileService itself has no
+ * knowledge of what a purpose means, callers scope their own queries by
+ * it.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('files', function (Blueprint $table) {
+            $table->id();
+            $table->string('disk');
+            $table->string('path');
+            $table->string('original_name')->nullable();
+            $table->string('mime')->nullable();
+            $table->unsignedBigInteger('size')->nullable();
+            $table->string('purpose');
+            $table->nullableMorphs('owner');
+            $table->timestamps();
+
+            $table->index(['purpose', 'owner_type', 'owner_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('files');
+    }
+};

database/migrations/2026_09_25_000002_add_legal_acceptance_to_users_table.php

@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Which terms/privacy policy version an account was created under — the
+ * storefront login page shows a notice ("By continuing, you accept the
+ * Terms of Use and have read the Privacy Policy") that a new signup
+ * implicitly agrees to just by requesting an OTP code, so this is
+ * recorded the moment Modules\Core\Auth\Services\UserOtpService::
+ * generateAndSend()'s firstOrCreate() actually creates the row — never
+ * for an existing user, whose original acceptance (whatever version was
+ * live at the time) must not be silently overwritten by a later config
+ * value. Nullable: every user created before this migration has none of
+ * the three, which is the honest answer ("we don't know what they saw"),
+ * not something to backfill with today's config values.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->timestamp('terms_accepted_at')->nullable()->after('otp_attempts');
+            $table->string('terms_version')->nullable()->after('terms_accepted_at');
+            $table->string('privacy_policy_version')->nullable()->after('terms_version');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn(['terms_accepted_at', 'terms_version', 'privacy_policy_version']);
+        });
+    }
+};

database/migrations/2026_09_25_000003_add_pending_email_change_to_users_table.php

@@ -0,0 +1,39 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Backs Modules\Core\Customer\Services\CustomerEmailChangeService — the
+ * pending new-email change lives on the user's own row, same convention
+ * as the existing otp_code/otp_expires_at/otp_attempts columns (Auth\
+ * Services\UserOtpService), rather than the session: a change requested
+ * on one device/session must still be confirmable from another (a code
+ * arrives by email, which is often opened somewhere else entirely), and
+ * a request-scoped session can't survive that.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->string('pending_email')->nullable()->after('privacy_policy_version');
+            $table->string('pending_email_code_hash')->nullable()->after('pending_email');
+            $table->timestamp('pending_email_expires_at')->nullable()->after('pending_email_code_hash');
+            $table->unsignedTinyInteger('pending_email_attempts')->default(0)->after('pending_email_expires_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn([
+                'pending_email',
+                'pending_email_code_hash',
+                'pending_email_expires_at',
+                'pending_email_attempts',
+            ]);
+        });
+    }
+};

docs/cart.md

@@ -1,28 +1,34 @@
 # Cart Admin Visibility
 
 `Modules\Core\Cart\Filament\Resources\CartResource` gives staff read-only visibility into
-customer/user carts in the Filament admin panel. Lunar itself ships no cart admin view at
-all — no Filament resource for `Cart`/`CartLine` exists anywhere in `lunarphp/lunar` or
-`lunarphp/core` — this is a from-scratch addition, not an extension of something Lunar
-half-built. See `docs/lunar.md`'s "Cart and Checkout" section for the underlying Lunar cart
-mechanics this resource reads from.
+every cart in the Filament admin panel, guest carts included. Lunar itself ships no cart
+admin view at all — no Filament resource for `Cart`/`CartLine` exists anywhere in
+`lunarphp/lunar` or `lunarphp/core` — this is a from-scratch addition, not an extension of
+something Lunar half-built. See `docs/lunar.md`'s "Cart and Checkout" section for the
+underlying Lunar cart mechanics this resource reads from.
 
 ---
 
-## Scope: only carts with a known customer or user
+## Scope: every cart, identified or not
 
-`CartResource::getEloquentQuery()` filters to `Cart::whereNotNull('user_id')->orWhereNotNull('customer_id')`
-— an anonymous guest's session cart is excluded entirely.
+`CartResource` lists every cart the four lifecycle states (below) cover, with no
+`user_id`/`customer_id` filter — an anonymous guest's session cart is included.
 
-This was a deliberate call, not an oversight: an anonymous cart carries no identity a staff
-member could act on — no name, no email, nothing to follow up with — so listing every guest
-session cart would be noise, not a real admin capability. This does **not** mirror Shopify's
-admin (Shopify has no "all carts" view at all — only "Abandoned checkouts," gated on a
-shopper reaching checkout and entering contact info, a later/narrower stage than Lunar's
-`Cart`). Lunar's own `Cart` model already gets `user_id`/`customer_id` set the moment a
-shopper is authenticated (via `Lunar\Listeners\CartSessionAuthListener` on login), with no
-checkout step required — so scoping to "identifiable" here is broader than Shopify's
-equivalent, not a copy of it.
+This was a reversal of an earlier, deliberate call to exclude guest carts entirely (on the
+reasoning that an anonymous cart carries no identity a staff member could act on — no name, no
+email, nothing to follow up with — so listing every guest session cart would be noise, not a
+real admin capability). That reasoning holds for "can I click through to a Customer record,"
+but not for the resource's other real use — seeing how many carts are ongoing/abandoned right
+now regardless of who's shopping. Most real storefront traffic never reaches an identified
+user/customer, so excluding it silently undercounts exactly the thing `ListCarts`'s tabs (and
+`CartLifecycleService`, which they and `DetectAbandonedCarts` both build on) exist to report
+on. The `Customer`/`User` columns on a guest row just render "—" (Filament's `placeholder()`)
+instead of a link — nothing to click into, but the row and its contents are still visible via
+`ViewCart`.
+
+This does **not** mirror Shopify's admin (Shopify has no "all carts" view at all — only
+"Abandoned checkouts," gated on a shopper reaching checkout and entering contact info, a
+later/narrower stage than Lunar's `Cart`).
 
 ---
 
@@ -40,28 +46,29 @@ distinct states together: no order ever started, vs. a draft order exists
 different purchase-intent signals (see "Abandoned Cart vs Abandoned Checkout" below) and
 different reachability (checkout usually captures an email even for a guest), so
 `ListCarts::getTabs()` splits them into four tabs instead of `scopeActive()`'s two-state
-split:
+split.
 
-- **Ongoing** — `scopeActive()` and recent `updated_at` (within `abandonedCutoff()`). Default
-  active tab on page load.
-- **Abandoned Cart** — `whereDoesntHave('orders')` and stale `updated_at`.
-- **Abandoned Checkout** — has an order with `placed_at IS NULL`, and stale `updated_at`.
-- **Completed** — has an order with `placed_at IS NOT NULL`.
+`Modules\Core\Cart\Services\CartLifecycleService` is the single source of truth for these four
+query shapes — both `ListCarts::getTabs()` (staff browsing) and `DetectAbandonedCarts`
+(abandonment-event dispatch) build on it, rather than each reimplementing the same split
+independently (which is what happened before this service existed, and is exactly the kind of
+drift that lets the admin panel and the recovery-email pipeline quietly disagree about what
+"abandoned" means):
 
-```php
-// Ongoing
-$query->active()->where('updated_at', '>', CartResource::abandonedCutoff());
+- **Ongoing** (`ongoing()`) — `scopeActive()` and recent `updated_at` (within
+  `abandonedCutoff()`). Default active tab on page load.
+- **Abandoned Cart** (`abandonedCarts()`) — `whereDoesntHave('orders')` and stale
+  `updated_at`.
+- **Abandoned Checkout** (`abandonedCheckouts()`) — has an order with `placed_at IS NULL`,
+  and stale `updated_at`.
+- **Completed** (`completed()`) — has an order with `placed_at IS NOT NULL`.
 
-// Abandoned Cart
-$query->whereDoesntHave('orders')->where('updated_at', '<=', CartResource::abandonedCutoff());
-
-// Abandoned Checkout
-$query->whereHas('orders', fn ($q) => $q->whereNull('placed_at'))
-    ->where('updated_at', '<=', CartResource::abandonedCutoff());
-
-// Completed
-$query->whereHas('orders', fn ($q) => $q->whereNotNull('placed_at'));
-```
+Each method takes a `Builder` and returns it further scoped, so callers compose it onto
+whatever base query they already have (`CartResource::getEloquentQuery()` for the Filament
+tabs, a bare `Cart::query()` for the command). Deliberately query-shape-only: consent
+(`meta->recovery_consent`) and non-empty-lines filtering stay in `DetectAbandonedCarts`, not on
+the service — those gate whether a recovery *event* should fire, not what "abandoned" means to
+a staff member browsing the list.
 
 There is deliberately **no "All" tab.** Every row shown is always scoped to one of the four
 states above — the list never runs an unfiltered `Cart::query()->get()` over the whole
@@ -111,7 +118,7 @@ runs once per admin page load, not once per cart row.
 ```php
 public static function getNavigationBadge(): ?string
 {
-    return (string) static::getEloquentQuery()->active()->count();
+    return (string) static::getEloquentQuery()->active()->where('updated_at', '<=', static::abandonedCutoff())->count();
 }
 ```
 
@@ -235,9 +242,10 @@ just upper-cases the code; `Lunar\Managers\DiscountManager::validateCoupon()` (v
 via a normal Eloquent write, so there's no model-event hook to dispatch from directly.
 `Modules\Core\Cart\Commands\DetectAbandonedCarts` (registered on an hourly schedule by
 `Modules\Core\Providers\CartServiceProvider`) is the only place that moment gets detected: it
-queries the same two branches `ListCarts::getTabs()` uses (no order at all vs. draft order
-never placed) and dispatches `Modules\Core\Recovery\Events\CartAbandoned`/`CheckoutAbandoned`
-for anything currently stale.
+builds on the same `CartLifecycleService::abandonedCarts()`/`abandonedCheckouts()` queries
+`ListCarts::getTabs()` uses (no order at all vs. draft order never placed) and dispatches
+`Modules\Core\Recovery\Events\CartAbandoned`/`CheckoutAbandoned` for anything currently stale
+that also has `meta->recovery_consent = true`.
 
 ### Cart/Checkout have zero abandonment-related writes — by design
 

docs/modules.md

@@ -49,7 +49,8 @@ boboko-test/
   app/
     Models/
       Customer.php      ← app-level model, extends Modules\Core\Customer\Models\Customer
-      User.php           ← app-level model, dispatches Modules\Core\Auth\Events\UserCreated
+      User.php           ← app-level model, no $dispatchesEvents needed — core dispatches
+                            UserCreated itself (Modules\Core\Auth\Services\UserOtpService)
       Staff.php          ← app-level model, extends Modules\Core\Auth\Models\Staff
     Lunar/
       Extensions/        ← app's own Filament resource extensions (source of truth, wired in PanelServiceProvider)
@@ -264,7 +265,14 @@ php artisan vendor:publish --tag=core-config
 'auto_create_customer_for_user' => false,
 ```
 
-Both listeners guard against the other direction re-triggering: they call `User::withoutEvents(...)` around `firstOrCreate`/save, so pairing a `Customer` never spuriously fires `UserCreated` (and vice versa) even if both directions are somehow active at once.
+A guard against the other direction re-triggering is only needed where a real risk exists:
+`App\Listeners\CreateUserForCustomerListener` (`boboko-test`, app-level) wraps its
+`firstOrCreate` in `User::withoutEvents(...)`, since finding-or-creating a `User` there could
+itself fire `UserCreated` and loop back into `CreateCustomerForUser`. `Modules\Core\Customer\
+Listeners\CreateCustomerForUser` (core) needs no such guard — it calls a plain
+`$model::create([])` on `Customer`, which has no `$dispatchesEvents`/model hooks of its own in
+core that could re-trigger anything; the guard belongs only on the side that actually creates a
+`User`.
 
 ---
 

docs/payments.md

@@ -145,23 +145,20 @@ produced had it resolved synchronously.
 with no memory of the request that started the payment. Something has to persist enough to
 answer "which order/cart does gateway reference X belong to?" between the two calls.
 
-**Read directly from `lunarphp/stripe`'s own source** (`StripePaymentType::authorize()`,
-`ProcessStripeWebhook`, `WebhookController`) to see how Lunar itself solves this — confirmed
-it does **not** stash a generic opaque blob. It writes the correlating ids as real, typed
-columns on `Lunar\Stripe\Models\StripePaymentIntent` (`cart_id`, `order_id`) at the moment the
-intent is created/first seen, then reads them back the same way when the webhook arrives:
+The precedent for this originally came from reading `lunarphp/stripe`'s own source
+(`StripePaymentType::authorize()`, `ProcessStripeWebhook`, `WebhookController`) — that package
+solved this the same way, writing the correlating ids as real, typed columns on its own
+`StripePaymentIntent` model rather than a generic opaque blob. **`lunarphp/stripe` has since
+been removed from this project** in favour of depending on `stripe/stripe-php` directly (see
+CHANGELOG.md) — `Modules\Core\Payment\Models\StripePaymentIntent` is now a first-party model
+over the same table shape, kept for exactly the same reason.
 
-```php
-// ProcessStripeWebhook::handle() — falls back through two real lookups,
-// neither of them a generic context blob:
-$cart = StripePaymentIntent::where('intent_id', $this->paymentIntentId)->first()?->cart
-    ?: Cart::where('meta->payment_intent', '=', $this->paymentIntentId)->first();
-```
-
-**`StripePaymentDriver` follows this exact precedent**: it reads `cart_id`/`order_id` out of
-`$context` at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent`
-row (a table already owned by `lunarphp/stripe`, already shaped for exactly this), then reads
-them back the same way in `handleCallback()`. No generic `context` json column, no new table.
+**`StripePaymentDriver` follows this pattern**: it reads `cart_id`/`order_id` out of `$context`
+at `pay()`/`authorize()` time and writes them onto its own `StripePaymentIntent` row (`src/
+Payment/Models/StripePaymentIntent.php`, table `stripe_payment_intents`), then reads them back
+the same way in `handleCallback()`. No generic `context` json column beyond what that table
+already carries (`context`, added for a different purpose — see that migration's own
+docblock), no new table.
 
 ### This pattern is per-driver, not a shared table
 
@@ -176,6 +173,48 @@ a shared generic one.
 
 ---
 
+## Reconciliation — a charge that succeeds on Stripe but is never written locally
+
+This app never creates or reuses a Stripe **Customer** object — every PaymentIntent is a
+one-off (`StripePaymentDriver::createAndConfirm()`'s own `$params` never includes a `customer`
+key), and nothing calls Stripe's Customer API anywhere in this codebase. That's a deliberate
+choice, not an oversight: a Customer object only earns its keep if something actually needs it
+(saved/reusable payment methods, subscriptions, Stripe-side lifetime-value grouping across
+orders) — none of which exist in this checkout flow today. Creating one anyway would just be
+more PII sitting on a third party's servers for no functional benefit, and it would become
+another cross-reference a future Payment privacy provider has to account for (detaching/
+deleting the Customer on erasure, not just the local PaymentIntent row). If a real feature
+needs it later (e.g. "save my card"), add it then, scoped to that feature.
+
+The gap this creates: with no Customer object and no other identifying field previously sent
+to Stripe, a PaymentIntent that succeeds on Stripe's side but is never written to our own DB
+(e.g. a database outage at exactly the wrong moment, between Stripe confirming the charge and
+`rememberIntent()`'s insert) would be **untraceable** back to a cart or order — nothing to
+search Stripe's dashboard by except amount, timestamp, and card last-4.
+
+**Fix**: `createAndConfirm()` now sets `metadata: ['cart_id' => ..., 'order_id' => ...]`
+(`array_filter()`-ed, since `order_id` isn't known yet at initial `pay()`/`authorize()` time —
+same null-coalesce `rememberIntent()` already does) on every PaymentIntent. This is metadata
+only, visible on Stripe's own dashboard/API for manual reconciliation — it does not create a
+Customer object and does not change anything about how `handleCallback()`/webhook correlation
+works (that still goes through `stripe_payment_intents`, per "Async resolution" above). It's
+purely a recovery aid for the case where our own write never happened at all.
+
+---
+
+## GDPR erasure/export
+
+`Modules\Core\Payment\Privacy\PaymentDataProvider` covers `lunar_transactions`
+(`card_type`/`last_four`) and `stripe_payment_intents` — see `docs/privacy.md` for the full
+right-of-erasure/right-of-access design. Pseudonymizes card metadata on erasure (same
+tax/accounting retention reasoning `Order`'s own provider uses) and deletes the Stripe
+correlation rows outright, since their only purpose — resolving an async webhook callback, see
+"Async resolution" above — has already been served by the time an erasure request runs. No
+Stripe Customer object exists anywhere in this app (see "Reconciliation" above) for this
+provider to also request deletion of.
+
+---
+
 ## Explicitly out of scope for this pass
 
 - **`Checkout`/`Order` wiring** — how `Checkout` calls into `Payment`, how `Order`/`Checkout`

docs/privacy.md

@@ -0,0 +1,417 @@
+# Privacy / GDPR Data-Subject Requests
+
+`Modules\Core\Privacy` implements the right of access (export) and right of erasure for
+customers, as an extensible contract rather than a fixed list of tables — any module (core,
+or a future ERP/banking/etc. module) can register its own data without core knowing it exists.
+
+---
+
+## User-scope vs Customer-scope — two genuinely different operations
+
+A Lunar `Customer` (business account: orders, addresses, buyer record) and a `User` (individual
+login identity) are linked many-to-many via the `customer_user` pivot (see `docs/modules.md`
+"Customer/User Pairing") — **one User can belong to many Customer accounts, and one Customer
+account can have many linked Users.** This is the real shape of B2B multi-seat access: a person
+can have login access to several separate business accounts, and a business account can have
+several employees each with their own login.
+
+That means "delete my personal data" and "delete this business account" are not the same request,
+and conflating them is actively wrong:
+
+- **Erasing a Customer must never touch any linked User's login or identity.** Erasing "Acme
+  Corp" must not deactivate or destroy access for the employees who work there — and must not
+  touch any *other* Customer account, even one sharing some of the same Users.
+- **Erasing a User must never touch any Customer account's own data.** John asking to delete
+  *his* account must clear his name/email/login wherever it appears — and correctly end his
+  membership on every Customer he's linked to (detach the pivot) — but must not erase Acme Corp's
+  orders or addresses, and must not affect any other employee still linked to Acme Corp.
+
+Every part of this module is split along that line — a `PersonalDataProvider`, a `PrivacyService`
+method, a request record — is always explicitly **for a Customer** or **for a User**, never both
+at once, and never one with an implicit cascade into the other.
+
+---
+
+## Why an extensible contract, not a hardcoded script
+
+A GDPR erasure/export request has to touch every module that holds personal data, but core can't
+know in advance what future modules will exist or what data they'll hold — and different data
+needs fundamentally different handling (freely erasable PII vs. financial records that must be
+pseudonymized-not-deleted for legal retention vs. data that must be retained outright). There's
+deliberately no central taxonomy for this in the contract — each module owns its own retention
+judgment, since only the module that owns a table actually knows its legal requirements.
+
+`Modules\Core\Privacy\Contracts\PersonalDataProvider` is the whole contract:
+
+```php
+interface PersonalDataProvider
+{
+    public function name(): string;
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult;
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult;
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult;
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult;
+}
+```
+
+Every provider implements all four methods. A provider with nothing relevant to one scope
+implements that method as a no-op — `ErasureOutcome::Skipped` with a reason for erase, an empty
+payload for export (e.g. `AddressDataProvider::eraseForUser()`, since addresses belong to a
+Customer, not an individual).
+
+A provider implementation lives inside the module that owns the data it erases/exports, under
+that module's own `Privacy/` subdirectory (e.g. `Modules\Core\Order\Privacy\OrderDataProvider`,
+`Modules\Core\Customer\Privacy\CustomerDataProvider`) — never inside `Modules\Core\Privacy`
+itself, which only owns the shared contract (`Contracts\PersonalDataProvider`), the request
+lifecycle (`Services\PrivacyManager`/`PrivacyService`), and the DTOs/enums every provider
+returns. This mirrors how this codebase already handles other cross-cutting-but-domain-specific
+code (e.g. a resource's own `Filament/Extensions/` subdirectory) — and matters concretely if a
+module is ever extracted into its own composer package (see `docs/modules.md`): the provider
+that knows how to erase that module's data must travel with it, not get stranded in `Privacy`
+depending on a package that no longer ships in this repo.
+
+A module registers by adding its provider class to `config('core.privacy.providers')` — the
+same shape as Lunar's own `config('lunar.search.indexers')` model→indexer map:
+
+```php
+// config/core.php
+'privacy' => [
+    'providers' => [
+        \Modules\Core\Customer\Privacy\CustomerDataProvider::class,
+        \Modules\Core\Customer\Privacy\AddressDataProvider::class,
+        \Modules\Core\Order\Privacy\OrderDataProvider::class,
+        \Modules\Core\Cart\Privacy\CartDataProvider::class,
+        \Modules\Core\Review\Privacy\ReviewDataProvider::class,
+        // A future module just adds its own provider here.
+    ],
+],
+```
+
+`PrivacyManager` resolves each class via the container and asserts every `name()` is unique —
+two providers registering the same name throws, so a naming collision fails loudly at
+resolution time rather than silently overwriting one provider's data in an export/report.
+
+---
+
+## `UserSubject` and `CustomerSubject` — identifying "the person" vs "the account"
+
+Two separate value objects, not one — each deliberately carries only what its own scope needs, so
+a provider can't accidentally reach across the boundary:
+
+```php
+class CustomerSubject
+{
+    public readonly int $customerId;
+    // No userIds, no email — Customer-scope has no business knowing about logins.
+}
+
+class UserSubject
+{
+    public readonly int $userId;
+    public readonly ?string $email;
+    // No customerId — one User can be linked to many Customers; a provider that
+    // needs to know which ones looks that up itself (e.g. to detach the pivot),
+    // rather than this value object assuming or privileging any single one.
+}
+```
+
+`CustomerSubject::forCustomer(Customer $customer)` and `UserSubject::forUser($user)` build one
+from the record staff (or the person themselves) look up.
+
+---
+
+## Providers shipped in core
+
+| Provider | `name()` | Lives in | Covers | Customer-scope | User-scope |
+|---|---|---|---|---|---|
+| `ActivityLogDataProvider` | `activity_log` | `Modules\Core\Logging\Privacy` | `activity_log` (Spatie) for subject types `Customer`/`Address`/`CartAddress`/`OrderAddress`/`Transaction` | **Pseudonymized** — `properties` redacted, who/what/when metadata kept | Skipped — `causer_id` is an actor reference, not PII content; see below |
+| `CustomerDataProvider` | `customer` | `Modules\Core\Customer\Privacy` | `lunar_customers`, and separately the `User`'s own name/email/OTP fields | Erases the account's own fields only | Erases that User's name/email/OTP fields only, and detaches them from every linked Customer |
+| `AddressDataProvider` | `addresses` | `Modules\Core\Customer\Privacy` | `lunar_addresses` | Erased (deleted outright) | Skipped — belongs to a Customer, not an individual |
+| `OrderDataProvider` | `orders` | `Modules\Core\Order\Privacy` | `lunar_orders`, `lunar_order_addresses`, and their `meta` (`terms_accepted*`, `payment_method`, `box_now_locker`) | **Pseudonymized, not erased** — see below | Skipped — belongs to a Customer, not an individual |
+| `CartDataProvider` | `carts` | `Modules\Core\Cart\Privacy` | `lunar_cart_addresses`, and `lunar_carts.meta` (`recovery_consent*`, `payment_method`, `checkout_fingerprint`) | Erased | Skipped — belongs to a Customer, not an individual |
+| `ReviewDataProvider` | `reviews` | `Modules\Core\Review\Privacy` | `product_reviews` | Skipped — authored by an individual, not a business account | Pseudonymized by matching `reviewer_email`; rating/title/body text kept |
+| `PaymentDataProvider` | `payments` | `Modules\Core\Payment\Privacy` | `lunar_transactions` (`card_type`/`last_four`), `stripe_payment_intents` | **Pseudonymized** — card metadata cleared, correlation rows deleted, amounts/statuses kept | Skipped — belongs to Customer-owned orders, not individual users |
+| `UserSessionDataProvider` | `sessions` | `Modules\Core\Auth\Privacy` | `user_sessions` (`ip_address`, `user_agent`) | Skipped — belongs to an individual User, not a business account | Erased (deleted outright) |
+
+`CustomerDataProvider` is the one provider that implements both scopes meaningfully, and keeps
+them from touching each other — see the class docblock for the full reasoning.
+
+### `activity_log` is redacted by subject, never by causer
+
+`Modules\Core\Logging\ActivityLogService` (plus several Lunar models' own native `use
+LogsActivity` — `Customer`, `CartAddress`, `OrderAddress`, `Transaction`) durably retains a full
+snapshot of whatever it logged in `properties`, completely independent of the real row it
+describes — erasing/pseudonymizing a `Customer`/`Address`/`Order`/etc. elsewhere does nothing to
+this table on its own. `ActivityLogDataProvider::eraseForCustomer()` redacts `properties` on
+every row whose **subject** (not causer) resolves back to that customer, across all five
+PII-bearing subject types.
+
+It deliberately never touches `causer_id` — the causer is "who performed this action," not PII
+content, and erasing it would defeat the audit trail's own purpose. `eraseForUser()` is
+therefore a no-op: a `User` appears in this table only as a causer, never as subject content, so
+there's nothing to redact from the User side alone.
+
+**Ordering dependency**: `ActivityLogDataProvider` must run *before* `AddressDataProvider` in
+`config('core.privacy.providers')` — it resolves which `activity_log` rows are keyed by an
+`Address` id while those Address rows still exist; `AddressDataProvider` then hard-deletes them.
+Reversing the order would make matching those rows impossible once the addresses are gone.
+
+**`ReviewDataProvider` needs review.** It moved from Customer-scope to User-scope on the
+reasoning that authorship is a personal attribute, not a business-account attribute — but this
+hasn't been fully validated against how reviews are actually attributed in this codebase. The
+class carries a `NEEDS REVIEW` note; revisit before relying on it for a real request.
+
+### Orders are pseudonymized, not deleted
+
+GDPR Art. 17(3)(b) explicitly allows retaining data an erasure request would otherwise cover,
+when a legal obligation requires it — tax/accounting law generally requires invoices be kept for
+several years. `OrderDataProvider::eraseForCustomer()` clears the free-text PII fields on `Order`/
+`OrderAddress` (`customer_reference`, `notes`, name/address/contact fields) but leaves the order
+row, totals, line items, and tax data fully intact. Its `ProviderErasureResult` reports
+`ErasureOutcome::Pseudonymized`, not `Erased` — a compliance report or admin UI can see exactly
+why an order wasn't deleted without reading `OrderDataProvider`'s source.
+
+### Reviews are matched by email — a real, documented limitation
+
+`ProductReview` has no FK to Customer/User at all (see `docs/product-listing.md` "Reviews") —
+it's deliberately anonymous, just free-text `reviewer_name`/`reviewer_email`. `ReviewDataProvider`
+matches by `reviewer_email` against `UserSubject::$email`; a review submitted under a different
+email than the one on file simply won't be found. There's no stronger signal available without
+changing `ProductReview`'s schema.
+
+### Staff/employee data is out of scope
+
+`Staff` (admin/panel employees) is never a `UserSubject`/`CustomerSubject` at all — this feature
+is scoped to customer-initiated and staff-initiated-on-a-customer's-behalf requests. An employee's
+own data (a different HR/access-management concern) isn't reachable through this flow.
+
+---
+
+## Erasure isn't immediate — a cancellable grace period
+
+`PrivacyService` has parallel methods for each scope: `requestErasureForCustomer()` /
+`requestErasureForUser()`. Neither erases anything immediately. Each opens a `DataErasureRequest`
+(`pending`, `scheduled_for` = now + `config('core.privacy.grace_period_days')`, default 30). This
+mirrors Shopify's own account-deletion flow: a window where the subject can change their mind
+before anything is actually erased.
+
+**Only the User-scoped request deactivates a login.** `requestErasureForCustomer()` deactivates
+no one — a business-account erasure must never block anyone's access.
+`requestErasureForUser()` deactivates that one User's login (blocks it — see
+`Modules\Core\Auth\Services\UserOtpService` — nothing else changes).
+
+```php
+use Modules\Core\Privacy\Services\PrivacyService;
+
+$service = app(PrivacyService::class);
+
+// Customer-scoped: either the Customer itself (self-service) or a Staff member.
+$request = $service->requestErasureForCustomer($customer, $requestedBy);
+
+// User-scoped: either the User itself (self-service) or a Staff member.
+$request = $service->requestErasureForUser($user, $requestedBy);
+
+// Cancel before scheduled_for — for a User-scoped request, reactivates the
+// account. A Customer-scoped request never deactivated anything, so there's
+// nothing to reactivate for it.
+$service->cancelErasure($request);
+```
+
+### Logging back in during the grace period cancels the request automatically
+
+Authentication is never blocked by deactivation — `UserOtpService::validate()` still requires
+the correct OTP code. Once validated, it dispatches `Modules\Core\Auth\Events\UserAuthenticated`;
+`Modules\Core\Privacy\Listeners\CancelErasureOnLoginListener` (registered in
+`PrivacyServiceProvider`, **queued** — see below) looks for a pending request keyed on *that
+User's own id* — never a Customer-scoped one, since Customer-scope never deactivates a login in
+the first place — and calls `cancelErasure()` on it, then reverts every Customer erasure request
+it caused (see "The sole-owner cascade" below). Logging back in **is** the "I changed my mind"
+action — no separate UI/flow needed for reactivation.
+
+This listener is queued rather than synchronous, so login returns to the browser without waiting
+on the bookkeeping. Nothing else in this codebase currently reads `deactivated_at` besides this
+listener and `PrivacyService` itself — `UserOtpService::validate()` never gates the login on it —
+so the brief window between the login response and the job actually running has no other consumer
+to observe it as stale.
+
+### The sole-owner cascade — erasing the last User on a Customer also erases the Customer
+
+If a User is erased and they were the **only** User linked to a given Customer, that Customer's
+data (orders, addresses, buyer record) becomes permanently unreachable through any login the
+moment the User's identity is gone — nobody could ever again log in to exercise a data-subject
+right over it. GDPR's data minimization principle (Art. 5(1)(c)) means it shouldn't just sit
+there indefinitely with no legitimate purpose.
+
+`requestErasureForUser()` and `requestImmediateErasureForUser()` both fire
+`Modules\Core\Privacy\Events\UserErasureRequested` right after the request is created (and, for
+the immediate path, before `completeErasure()` runs — see below).
+`Modules\Core\Privacy\Listeners\CascadeCustomerErasureListener` (**queued**, registered in
+`PrivacyServiceProvider`) handles it: for every Customer the User is linked to, if that User is
+currently the *sole* linked User (count is 1, and that one User is this one — not just count ===
+1, to be explicit rather than relying on an assumption), it opens a second, independent
+grace-period request via `requestErasureForCustomer($customer, $user, causedByRequestId: ...)`.
+Both requests then run through their own separate 30-day windows.
+
+```
+User erasure requested
+   │
+   ▼
+UserErasureRequested event ──▶ CascadeCustomerErasureListener (queued)
+                                    │
+                                    ▼
+                    for each linked Customer: sole owner?
+                                    │ yes
+                                    ▼
+                    requestErasureForCustomer(..., causedByRequestId: <user request id>)
+```
+
+**Tracing the cascade — `caused_by_request_id`.** A cascade-created Customer request's
+`caused_by_request_id` points back at the User request that triggered it. This is what lets
+`CancelErasureOnLoginListener` revert *exactly* the cascade a User's own cancellation should
+undo (via `DataErasureRequest::caused()`) without ever touching an unrelated, independently
+staff-requested Customer erasure the User happens to still be linked to.
+
+**Why this is queued, not synchronous.** `CascadeCustomerErasureListener` runs as an independent,
+separately-retryable job rather than inline inside `requestErasureForUser()` — a failure in the
+cascade check never rolls back or blocks the User's own request, and there's no
+`DB::transaction()` wrapping needed, since the two writes (the User's request, and any cascaded
+Customer request) aren't required to be atomic with each other.
+
+**A known, accepted race on the immediate-erasure path only.** Because the listener is queued,
+Eloquent re-fetches its models fresh when the job actually runs (see
+`Illuminate\Queue\SerializesModels`) — so `$event->request->subject->customers` reflects the
+*real* state at execution time, not a stale snapshot from dispatch time. For
+`requestImmediateErasureForUser()`, that job may run before or after `completeErasure()` detaches
+the User's memberships in the same call. If the detach happens first, the User is simply no
+longer linked to anything by the time the cascade job runs, and nothing cascades — an accepted
+race for that rare, staff-only path (see "Immediate erasure" below), not a concern for the
+everyday `requestErasureForUser()` grace-period path, where nothing detaches until its own later,
+separate `completeErasure()` run — well after the cascade job has had time to fire.
+
+### Processing due requests — one job per request
+
+`php artisan boboko:privacy:process-erasure-requests` finds every `pending` request whose
+`scheduled_for` has passed and dispatches one `Modules\Core\Privacy\Jobs\EraseDataSubjectJob` per
+request — it does not run `completeErasure()` inline itself. Each job independently calls
+`PrivacyService::completeErasure()`, which checks the request's polymorphic `subject` and calls
+either every registered provider's `eraseForCustomer()` or `eraseForUser()`, writing the full
+per-provider outcome onto the request's `report` column and marking it `completed`. One job per
+request means one request's failure (a provider throwing, a DB error) doesn't block or crash
+processing of the others, and Laravel's normal per-job retry/failure handling applies to each
+request independently. This package doesn't register a schedule itself; each consuming app wires
+the command into its own scheduler (daily is reasonable), the same way it owns any other
+scheduled task.
+
+### Immediate erasure — staff-only, not self-service
+
+`requestImmediateErasureForCustomer(Customer $customer, Staff $requestedBy): ErasureReport` and
+`requestImmediateErasureForUser($user, Staff $requestedBy): ErasureReport` bypass the grace
+period entirely and erase right away. Both are `Staff`-only **by type**, not just by convention —
+their signatures take `Staff $requestedBy` specifically (not the union type the grace-period
+methods accept), so a self-service/customer-facing code path can't reach either one even by
+accident; calling with a `Customer`/`User` actor is a compile-time type error, not a runtime
+check to remember.
+
+This exists for a formal legal request or regulator inquiry that genuinely requires immediate
+action, not as a convenience for an impatient customer. GDPR Art. 17 requires erasure "without
+undue delay," but doesn't set a maximum number of days for a grace period, and a short, disclosed,
+cancellable hold before executing a self-service request is a widely-used, generally accepted
+pattern (the same one Shopify and most major platforms use) — it is **not** offered as a
+same-click alternative on the self-service deletion flow, since doing so would mostly defeat the
+grace period's purpose (protecting an impulsive requester from themselves). If a subject
+explicitly insists on immediate deletion, that's a staff/support decision to make on the record
+via one of these methods, not a checkbox exposed to every customer.
+
+```php
+$report = $service->requestImmediateErasureForCustomer($customer, $staffMember);
+$report = $service->requestImmediateErasureForUser($user, $staffMember);
+// Both run synchronously — no queueing, no grace period. $report is the same
+// ErasureReport completeErasure() would produce.
+```
+
+---
+
+## Export — queued, not synchronous
+
+Export gathers real data across every registered provider — potentially slow, and there's no
+reason to block whatever request triggered it (a customer clicking "export my data," an API
+call). `requestExportForCustomer()`/`requestExportForUser()` are fast synchronous calls that only
+create a `DataExportRequest` row and dispatch the actual work:
+
+```php
+$request = $service->requestExportForCustomer($customer);
+$request = $service->requestExportForUser($user);
+// $request->status is 'pending'; nothing has been gathered yet.
+```
+
+### The event chain
+
+1. **`ExportDataSubjectJob`** (queued) checks the request's polymorphic `subject` and calls every
+   registered provider's `exportForCustomer()` or `exportForUser()` — all sequentially, in this
+   one job, not fanned out into one job per provider. Per-subject export work is small (a handful
+   of indexed queries per provider), so there's no real parallelism win, and one job means
+   "finished" is just "`handle()` returned," with no `Bus::batch()`/completion-counting needed. If
+   a future provider ever does something genuinely slow (an external API call, a generated PDF),
+   that's the point to reconsider a per-provider batch — not before.
+2. Once every provider's data is gathered, the job fires **`PersonalDataGathered`**
+   (carries the request and the assembled `ExportReport`) — no file exists yet.
+3. **`Modules\Core\Privacy\Listeners\WriteExportToCsvListener`** (registered in
+   `PrivacyServiceProvider`) handles that event: turns each provider's data into its own CSV (via
+   the generic `Modules\Core\Export\CsvWriter` — see below), zips them together, writes the zip to
+   `storage/app/exports/privacy/`, and updates the request (`status: completed`, `file_path`).
+   This is its own listener — not inline in the job — so the export *format* is swappable (an app
+   could unregister this and register a JSON-only listener instead) without touching how data is
+   gathered.
+4. Once the file exists, that listener fires **`PersonalDataExportFileWritten`**.
+5. Core has no opinion on how the subject is told. A consuming app registers its own notification
+   against `PersonalDataExportFileWritten` via `Modules\Core\Notification\NotificationRegistry` —
+   the same pattern as `App\Notifications\QuestionnaireResultsSentNotification` listening on
+   `App\Events\QuestionnaireResultsSent` (see `boboko-test` for a working example). Core
+   deliberately does not send an email itself.
+
+### CSV shape
+
+Every provider's `data` is either a list of associative arrays (addresses, orders, reviews — each
+item becomes a row) or a single associative array (customer — becomes one row). Any nested array
+value within a row (e.g. an order's `addresses` sub-array) is JSON-encoded into that one cell
+rather than exploded into further columns — a generic, provider-agnostic rule in
+`WriteExportToCsvListener`, not something each provider has to think about.
+
+### `Modules\Core\Export\CsvWriter` — a generic, reusable piece
+
+`CsvWriter::write(array $columns, iterable $rows, string $path)` has no knowledge of GDPR,
+customers, or Lunar at all — a caller supplies a schema (`CsvColumn[]`, each just a header plus a
+closure that pulls that column's value out of one record) and any iterable data source. It's used
+here by `WriteExportToCsvListener`, but is equally usable for an unrelated future need — an admin
+bulk catalog export, an accounting handoff — by supplying a different schema and row source;
+nothing about it is GDPR-specific.
+
+---
+
+## Audit trail
+
+`DataErasureRequest` (`data_erasure_requests`) and `DataExportRequest` (`data_export_requests`)
+are the audit records for erasure and export respectively. Both have a polymorphic `subject`
+(`subject_type`/`subject_id`, pointing at either a Lunar `Customer` or a `User` — never both) —
+`subject_type`/`subject_id`/`email` are stored as a **snapshot**, not looked up live, since the
+whole point is for these tables to remain readable after the record they're about has been
+erased. `DataErasureRequest::isForCustomer()` tells you which scope a given request is.
+
+`DataErasureRequest.requested_by_type`/`requested_by_id` capture who asked for it (the subject
+themselves, self-service; `Staff` acting on their behalf; or, for a cascade-created Customer
+request, the User whose erasure caused it — see "The sole-owner cascade") at request time.
+`DataErasureRequest.caused_by_request_id` is set only on a cascade-created Customer request,
+pointing back at the User request that triggered it; null on every normal, directly-requested
+erasure — see `DataErasureRequest::causedBy()`/`::caused()`.
+`DataErasureRequest.report` holds the full per-provider outcome once `completeErasure()` runs;
+`DataExportRequest.file_path` points at the generated zip once `WriteExportToCsvListener`
+finishes.
+
+**Not yet built**: a standalone "leave/remove from a Customer account" action — unlinking a User
+from a Customer without any erasure involved (e.g. a teammate leaving a project, or an account
+admin removing someone) — is a related but separate, smaller feature, deliberately out of scope
+for this module so far. It shares the same pivot-detach primitive `CustomerDataProvider::
+eraseForUser()` already uses as part of a full erasure, but as a standalone action it doesn't
+exist yet.

lang/el/countries.php

@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\Country::name, keyed by the exact
+ * English spelling Lunar's own installer seeds (`lunar:import:address-data`
+ * fetches http://data.lunarphp.io/countries+states.json — see
+ * vendor/lunarphp/core/src/Console/Commands/Import/AddressData.php).
+ * `Country`/`State` have no i18n support of their own (plain string
+ * columns, no translatable trait) — this is a plain Laravel lang file, not
+ * Modules\Core\Localization's DB-backed TranslationService, since these
+ * names are fixed reference data seeded once, not editable UI copy (see
+ * docs/localization.md). A consuming app's storefront looks this up
+ * itself, e.g. __('core::countries.'.$country->name) — core has no
+ * storefront UI of its own to wire this into (see docs/lunar.md).
+ *
+ * Only Greece is covered — this store operates within Greece; add further
+ * countries here as needed.
+ */
+return [
+    'Greece' => 'Ελλάδα',
+];

lang/el/states.php

@@ -0,0 +1,52 @@
+<?php
+
+/**
+ * Greek translations for Lunar\Models\State::name, keyed by the exact
+ * English spelling Lunar's own installer seeds for Greece
+ * (`lunar:import:address-data` — see lang/el/countries.php's own docblock
+ * for the full explanation of why this is a plain lang file, not
+ * Modules\Core\Localization's TranslationService).
+ *
+ * Covers every Greek state/regional-unit row in Lunar's seed dataset —
+ * scoped to Greece only, matching this store's operating country.
+ */
+return [
+    'Achaea Regional Unit' => 'Περιφερειακή Ενότητα Αχαΐας',
+    'Aetolia-Acarnania Regional Unit' => 'Περιφερειακή Ενότητα Αιτωλοακαρνανίας',
+    'Arcadia Prefecture' => 'Νομός Αρκαδίας',
+    'Argolis Regional Unit' => 'Περιφερειακή Ενότητα Αργολίδας',
+    'Attica Region' => 'Περιφέρεια Αττικής',
+    'Boeotia Regional Unit' => 'Περιφερειακή Ενότητα Βοιωτίας',
+    'Central Greece Region' => 'Περιφέρεια Στερεάς Ελλάδας',
+    'Central Macedonia' => 'Κεντρική Μακεδονία',
+    'Chania Regional Unit' => 'Περιφερειακή Ενότητα Χανίων',
+    'Corfu Prefecture' => 'Νομός Κέρκυρας',
+    'Corinthia Regional Unit' => 'Περιφερειακή Ενότητα Κορινθίας',
+    'Crete Region' => 'Περιφέρεια Κρήτης',
+    'Drama Regional Unit' => 'Περιφερειακή Ενότητα Δράμας',
+    'East Attica Regional Unit' => 'Περιφερειακή Ενότητα Ανατολικής Αττικής',
+    'East Macedonia and Thrace' => 'Ανατολική Μακεδονία και Θράκη',
+    'Epirus Region' => 'Περιφέρεια Ηπείρου',
+    'Euboea' => 'Εύβοια',
+    'Grevena Prefecture' => 'Νομός Γρεβενών',
+    'Imathia Regional Unit' => 'Περιφερειακή Ενότητα Ημαθίας',
+    'Ioannina Regional Unit' => 'Περιφερειακή Ενότητα Ιωαννίνων',
+    'Ionian Islands Region' => 'Περιφέρεια Ιονίων Νήσων',
+    'Karditsa Regional Unit' => 'Περιφερειακή Ενότητα Καρδίτσας',
+    'Kastoria Regional Unit' => 'Περιφερειακή Ενότητα Καστοριάς',
+    'Kefalonia Prefecture' => 'Νομός Κεφαλληνίας',
+    'Kilkis Regional Unit' => 'Περιφερειακή Ενότητα Κιλκίς',
+    'Kozani Prefecture' => 'Νομός Κοζάνης',
+    'Laconia' => 'Λακωνία',
+    'Larissa Prefecture' => 'Νομός Λάρισας',
+    'Lefkada Regional Unit' => 'Περιφερειακή Ενότητα Λευκάδας',
+    'Pella Regional Unit' => 'Περιφερειακή Ενότητα Πέλλας',
+    'Peloponnese Region' => 'Περιφέρεια Πελοποννήσου',
+    'Phthiotis Prefecture' => 'Νομός Φθιώτιδας',
+    'Preveza Prefecture' => 'Νομός Πρέβεζας',
+    'Serres Prefecture' => 'Νομός Σερρών',
+    'South Aegean' => 'Νότιο Αιγαίο',
+    'Thessaloniki Regional Unit' => 'Περιφερειακή Ενότητα Θεσσαλονίκης',
+    'West Greece Region' => 'Περιφέρεια Δυτικής Ελλάδας',
+    'West Macedonia Region' => 'Περιφέρεια Δυτικής Μακεδονίας',
+];

resources/css/checkout.css

@@ -0,0 +1,856 @@
+/*
+ * Cart + checkout module — generic default styling.
+ *
+ * Deliberately NOT wrapped in a Tailwind-style `@layer`. An earlier version
+ * put these rules in `@layer bbk-checkout`, positioned (via a cross-file
+ * @layer ordering statement) to sit between Tailwind's `base` and
+ * `components` — in theory enough to beat Preflight's element resets while
+ * still losing to a host override. In practice a build tool processing each
+ * CSS file in isolation (Vite/Lightning CSS here) optimizes away exactly the
+ * cross-file ordering information that trick depends on, so it silently
+ * didn't work: Preflight's `button { background-color: transparent }`,
+ * `* { border-width: 0 }` etc. (layered, in `base`) were beating every
+ * `.bbk-*` rule below regardless of specificity — buttons with no
+ * background, no border, wrong font-size.
+ *
+ * Plain, unlayered CSS sidesteps the whole problem: an unlayered rule always
+ * beats ANY layered rule (Preflight included), full stop, no ordering tricks,
+ * nothing a bundler can silently invalidate. This file is loaded BEFORE the
+ * host's own stylesheet (see the @vite call in the layout <head>), so:
+ *
+ *   - a later PLAIN (unlayered) `.bbk-*` rule in the host stylesheet wins —
+ *     same specificity, later in source order
+ *   - a later host rule with a MORE specific selector wins regardless
+ *   - a host rule inside `@layer components`/`@layer utilities` does NOT
+ *     win — unlayered always beats layered. Theme this module from plain
+ *     rules in app.css, not from inside a Tailwind layer.
+ *
+ * Two ways to theme this, cheapest first:
+ *
+ *   1. Redefine the --bbk-* custom properties below (from :root, or scoped to
+ *      .bbk-cart for a cart-only override) — covers colour, radius, shadow,
+ *      font without touching a single selector below.
+ *
+ *        :root { --bbk-color-accent: var(--color-brand); --bbk-radius: 0; }
+ *
+ *   2. Override individual `.bbk-*` rules directly (as plain rules, per
+ *      above) for anything structural (spacing, layout) the variables don't
+ *      cover.
+ *
+ * This file's own look is a deliberately neutral placeholder — inoffensive,
+ * not "designed" — so a project always has something reasonable before it
+ * themes; it is not meant to be edited per project.
+ */
+
+:root {
+    --bbk-font: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+
+    --bbk-color-text: #18181b;
+    --bbk-color-muted: #71717a;
+    --bbk-color-bg: #ffffff;
+    --bbk-color-bg-muted: #f4f4f5;
+    --bbk-color-border: #e4e4e7;
+    --bbk-color-accent: #18181b;
+    --bbk-color-accent-text: #ffffff;
+    --bbk-color-danger: #dc2626;
+
+    --bbk-radius: 8px;
+    --bbk-radius-sm: 4px;
+    --bbk-shadow: 0 12px 32px rgba(0, 0, 0, 0.16);
+}
+
+.bbk-cart[hidden] { display: none; }
+
+.bbk-cart {
+    position: fixed;
+    inset: 0;
+    z-index: 1000;
+    font-family: var(--bbk-font);
+    font-size: 0.9375rem;
+    line-height: 1.4;
+    color: var(--bbk-color-text);
+}
+
+.bbk-cart-backdrop {
+    position: absolute;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.4);
+    opacity: 0;
+    transition: opacity 0.25s ease;
+}
+
+.bbk-cart[data-bbk-cart-state="open"] .bbk-cart-backdrop { opacity: 1; }
+
+.bbk-cart-panel {
+    position: absolute;
+    top: 0;
+    right: 0;
+    display: flex;
+    flex-direction: column;
+    width: min(420px, 100vw);
+    height: 100%;
+    background: var(--bbk-color-bg);
+    box-shadow: var(--bbk-shadow);
+    transform: translateX(100%);
+    transition: transform 0.25s ease;
+}
+
+.bbk-cart[data-bbk-cart-state="open"] .bbk-cart-panel { transform: translateX(0); }
+
+.bbk-cart-panel-header {
+    flex: 0 0 auto;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 1rem;
+    padding: 1.5rem 1.5rem 1.25rem;
+    border-bottom: 1px solid var(--bbk-color-border);
+}
+
+.bbk-cart-heading {
+    margin: 0;
+    font-size: 1.375rem;
+    font-weight: 700;
+}
+
+.bbk-cart-dismiss,
+.bbk-cart-item-remove,
+.bbk-cart-qty-btn {
+    cursor: pointer;
+    background: none;
+    border: 0;
+    padding: 0;
+    font: inherit;
+    line-height: 1;
+    color: var(--bbk-color-muted);
+    transition: color 0.15s ease, background-color 0.15s ease, border-color 0.15s ease;
+}
+
+.bbk-cart-dismiss {
+    font-size: 1.75rem;
+    width: 2.5rem;
+    height: 2.5rem;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: var(--bbk-radius-sm);
+    flex-shrink: 0;
+}
+
+.bbk-cart-dismiss:hover { color: var(--bbk-color-text); background: var(--bbk-color-bg-muted); }
+
+.bbk-cart-item-remove:hover { color: var(--bbk-color-danger); }
+
+.bbk-cart-dismiss:focus-visible,
+.bbk-cart-item-remove:focus-visible,
+.bbk-cart-qty-btn:focus-visible,
+.bbk-cart-qty-input:focus-visible,
+.bbk-cart-checkout:focus-visible,
+.bbk-cart-coupon-input:focus-visible,
+.bbk-cart-coupon-submit:focus-visible,
+.bbk-cart-coupon-remove:focus-visible {
+    outline: 2px solid var(--bbk-color-accent);
+    outline-offset: 2px;
+}
+
+.bbk-visually-hidden {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+}
+
+.bbk-cart-panel-body {
+    flex: 1 1 auto;
+    overflow-y: auto;
+    overscroll-behavior: contain;
+    padding: 1.5rem;
+}
+
+.bbk-cart-items {
+    list-style: none;
+    margin: 0 0 2rem;
+    padding: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 1.5rem;
+}
+
+.bbk-cart-item {
+    display: grid;
+    grid-template-columns: 72px 1fr auto;
+    gap: 0.875rem;
+    align-items: start;
+}
+
+.bbk-cart-item-media img {
+    display: block;
+    width: 72px;
+    height: 72px;
+    object-fit: cover;
+    border-radius: var(--bbk-radius-sm);
+    background: var(--bbk-color-bg-muted);
+}
+
+.bbk-cart-item-detail { min-width: 0; }
+
+.bbk-cart-item-title {
+    display: block;
+    margin: 0 0 0.25rem;
+    font-weight: 600;
+    color: inherit;
+    text-decoration: none;
+}
+
+a.bbk-cart-item-title:hover { text-decoration: underline; }
+
+.bbk-cart-item-variant {
+    margin: 0 0 0.25rem;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+/* A line's custom-field answers (checkout::partials.line-custom-fields). */
+.bbk-line-fields {
+    display: grid;
+    gap: 0.25rem;
+    margin: 0 0 0.5rem;
+    font-size: 0.8125rem;
+}
+
+.bbk-line-field dt {
+    color: var(--bbk-color-muted);
+}
+
+.bbk-line-field dd {
+    margin: 0;
+    white-space: pre-line;
+    overflow-wrap: anywhere;
+}
+
+.bbk-line-field-file {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    color: inherit;
+}
+
+.bbk-line-field-file img {
+    width: 40px;
+    height: 40px;
+    object-fit: cover;
+    border-radius: 0;
+}
+
+.bbk-cart-item-unit {
+    margin: 0 0 0.625rem;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-cart-item-aside {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-end;
+    gap: 0.5rem;
+}
+
+.bbk-cart-item-total { margin: 0; font-weight: 600; }
+
+.bbk-cart-item-remove {
+    font-size: 1.125rem;
+    width: 1.5rem;
+    height: 1.5rem;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.bbk-cart-qty {
+    display: inline-flex;
+    align-items: center;
+    gap: 0;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    overflow: hidden;
+}
+
+.bbk-cart-qty-btn {
+    width: 1.75rem;
+    height: 1.75rem;
+    background: var(--bbk-color-bg-muted);
+}
+
+.bbk-cart-qty-btn:hover { background: var(--bbk-color-border); color: var(--bbk-color-text); }
+
+.bbk-cart-qty-input {
+    width: 2.25rem;
+    height: 1.75rem;
+    border: 0;
+    border-left: 1px solid var(--bbk-color-border);
+    border-right: 1px solid var(--bbk-color-border);
+    text-align: center;
+    font: inherit;
+    color: inherit;
+    background: var(--bbk-color-bg);
+    appearance: textfield;
+    -moz-appearance: textfield;
+}
+
+.bbk-cart-qty-input::-webkit-outer-spin-button,
+.bbk-cart-qty-input::-webkit-inner-spin-button {
+    -webkit-appearance: none;
+    margin: 0;
+}
+
+.bbk-cart-summary {
+    padding-top: 1.25rem;
+    border-top: 1px solid var(--bbk-color-border);
+    display: flex;
+    flex-direction: column;
+    gap: 0.625rem;
+}
+
+.bbk-cart-summary-row {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+}
+
+.bbk-cart-summary-row--discount { color: var(--bbk-color-danger); }
+
+.bbk-cart-summary-pending {
+    color: var(--bbk-color-muted);
+    font-size: 0.8125rem;
+}
+
+.bbk-cart-summary-row--total {
+    margin-top: 0.375rem;
+    padding-top: 0.875rem;
+    border-top: 1px solid var(--bbk-color-border);
+    font-size: 1.0625rem;
+    font-weight: 700;
+}
+
+.bbk-cart-coupon-form {
+    display: flex;
+    gap: 0.5rem;
+}
+
+.bbk-cart-coupon-input {
+    flex: 1 1 auto;
+    min-width: 0;
+    padding: 0.5rem 0.75rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    font: inherit;
+    color: inherit;
+    background: var(--bbk-color-bg);
+}
+
+.bbk-cart-coupon-submit {
+    flex: 0 0 auto;
+    padding: 0.5rem 0.875rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    background: var(--bbk-color-bg-muted);
+    font: inherit;
+    font-weight: 600;
+    cursor: pointer;
+    transition: background-color 0.15s ease, border-color 0.15s ease;
+}
+
+.bbk-cart-coupon-submit:hover { background: var(--bbk-color-border); }
+
+.bbk-cart-coupon-applied {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 0.75rem;
+    padding: 0.625rem 0.875rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    background: var(--bbk-color-bg-muted);
+}
+
+.bbk-cart-coupon-code {
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.02em;
+}
+
+.bbk-cart-coupon-remove {
+    flex: 0 0 auto;
+    background: none;
+    border: 0;
+    padding: 0;
+    font: inherit;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+    text-decoration: underline;
+    cursor: pointer;
+    transition: color 0.15s ease;
+}
+
+.bbk-cart-coupon-remove:hover { color: var(--bbk-color-danger); }
+
+.bbk-cart-coupon-error {
+    margin: 0.5rem 0 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+.bbk-cart-error {
+    margin: 0;
+    padding: 0.75rem 1.5rem 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+.bbk-add-to-cart-error {
+    margin: 0.375rem 0 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+.bbk-cart-checkout {
+    display: block;
+    width: 100%;
+    padding: 0.875rem 1.25rem;
+    border: 1px solid var(--bbk-color-accent);
+    border-radius: var(--bbk-radius);
+    background: var(--bbk-color-accent);
+    color: var(--bbk-color-accent-text);
+    font: inherit;
+    font-weight: 600;
+    text-align: center;
+    text-decoration: none;
+    cursor: pointer;
+    transition: opacity 0.15s ease;
+}
+
+.bbk-cart-checkout:hover { opacity: 0.85; }
+
+.bbk-cart-checkout:disabled {
+    cursor: not-allowed;
+    opacity: 0.4;
+}
+
+.bbk-cart-empty {
+    text-align: center;
+    color: var(--bbk-color-muted);
+    padding: 2.5rem 0;
+}
+
+/* ───────────────────────────────────────────────────────────────────
+   Checkout page — two columns: fields on the left, order summary (the
+   same cart-body partial the drawer uses) on the right.
+   ─────────────────────────────────────────────────────────────────── */
+
+.bbk-checkout-page {
+    max-width: 1100px;
+    margin: 0 auto;
+    padding: 2.5rem 1.5rem 5rem;
+    font-family: var(--bbk-font);
+    font-size: 0.9375rem;
+    line-height: 1.4;
+    color: var(--bbk-color-text);
+}
+
+.bbk-checkout-heading {
+    margin: 0 0 2rem;
+    font-size: 1.75rem;
+    font-weight: 700;
+}
+
+.bbk-checkout {
+    display: grid;
+    grid-template-columns: 1fr 380px;
+    gap: 3rem;
+    align-items: start;
+}
+
+@media (max-width: 860px) {
+    .bbk-checkout { grid-template-columns: 1fr; }
+}
+
+.bbk-checkout-main {
+    display: flex;
+    flex-direction: column;
+    gap: 2rem;
+}
+
+.bbk-checkout-section {
+    padding-bottom: 2rem;
+    border-bottom: 1px solid var(--bbk-color-border);
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+}
+
+.bbk-checkout-section-heading {
+    margin: 0;
+    font-size: 1.125rem;
+    font-weight: 700;
+}
+
+.bbk-checkout-note {
+    margin: 0;
+    color: var(--bbk-color-muted);
+    font-size: 0.875rem;
+}
+
+/* Contact: "logged in as" line, or the guest login prompt */
+
+.bbk-checkout-logged-in,
+.bbk-checkout-login-prompt { margin: 0; }
+
+.bbk-checkout-login-prompt a { color: inherit; font-weight: 600; }
+
+/* Fields */
+
+.bbk-field { display: flex; flex-direction: column; gap: 0.375rem; }
+
+.bbk-field-row {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 1rem;
+}
+
+@media (max-width: 480px) {
+    .bbk-field-row { grid-template-columns: 1fr; }
+}
+
+.bbk-field-label {
+    font-size: 0.8125rem;
+    font-weight: 600;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-field-input {
+    padding: 0.625rem 0.75rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    font: inherit;
+    color: inherit;
+    background: var(--bbk-color-bg);
+}
+
+.bbk-field-input:focus-visible {
+    outline: 2px solid var(--bbk-color-accent);
+    outline-offset: 2px;
+}
+
+.bbk-field-input:disabled {
+    background: var(--bbk-color-bg-muted);
+    color: var(--bbk-color-muted);
+}
+
+.bbk-field-input--error { border-color: var(--bbk-color-danger); }
+
+.bbk-field-error {
+    margin: 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-danger);
+}
+
+/* A fixed, non-editable field value (e.g. the store's single country). */
+.bbk-field-static {
+    margin: 0;
+    padding: 0.625rem 0.75rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    background: var(--bbk-color-bg-muted);
+    color: var(--bbk-color-muted);
+}
+
+textarea.bbk-field-input { resize: vertical; }
+
+.bbk-checkbox {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    font-size: 0.875rem;
+    cursor: pointer;
+}
+
+/* For a full-sentence label that can wrap — align the box to the first line. */
+/* "I want an invoice": company/ΑΦΜ only while ticked */
+
+.bbk-invoice { display: flex; flex-direction: column; gap: 1rem; }
+
+.bbk-invoice:not(:has(input[name="wants_invoice"]:checked)) .bbk-invoice-fields { display: none; }
+
+.bbk-checkbox--stacked {
+    display: flex;
+    align-items: flex-start;
+    margin-top: 0.75rem;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-checkbox--stacked input { margin-top: 0.15rem; flex-shrink: 0; }
+
+.bbk-checkout-shipping-fields {
+    display: flex;
+    flex-direction: column;
+    gap: 1rem;
+}
+
+/* Shipping method */
+
+.bbk-checkout-shipping-options {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.bbk-checkout-shipping-option {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.875rem 1rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    cursor: pointer;
+    transition: border-color 0.15s ease;
+}
+
+.bbk-checkout-shipping-option:has(input:checked) { border-color: var(--bbk-color-accent); }
+
+.bbk-checkout-shipping-option-detail {
+    flex: 1 1 auto;
+    display: flex;
+    flex-direction: column;
+    gap: 0.125rem;
+}
+
+.bbk-checkout-shipping-option-name { font-weight: 600; }
+
+.bbk-checkout-shipping-option-description {
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-checkout-shipping-option-price { font-weight: 600; }
+
+/* The single auto-selected option — a fixed line, not a choosable radio. */
+.bbk-checkout-shipping-confirmed {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.875rem 1rem;
+    border: 1px solid var(--bbk-color-accent);
+    border-radius: var(--bbk-radius-sm);
+}
+
+/* Autosave status line under the address form. */
+.bbk-checkout-status {
+    margin: 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-checkout-status[data-state="error"] { color: var(--bbk-color-danger); }
+
+/* Continue / submit buttons — same look as the drawer's checkout CTA */
+
+.bbk-checkout-continue {
+    display: block;
+    width: 100%;
+    padding: 0.875rem 1.25rem;
+    border: 1px solid var(--bbk-color-accent);
+    border-radius: var(--bbk-radius);
+    background: var(--bbk-color-accent);
+    color: var(--bbk-color-accent-text);
+    font: inherit;
+    font-weight: 600;
+    text-align: center;
+    text-decoration: none;
+    box-sizing: border-box;
+    cursor: pointer;
+    transition: opacity 0.15s ease;
+}
+
+.bbk-checkout-continue:hover { opacity: 0.85; }
+
+.bbk-checkout-continue:disabled {
+    cursor: not-allowed;
+    opacity: 0.4;
+}
+
+/* Order summary column */
+
+.bbk-checkout-aside { position: sticky; top: 1.5rem; }
+
+.bbk-checkout-summary {
+    padding: 1.5rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius);
+    background: var(--bbk-color-bg);
+}
+
+.bbk-checkout-summary-heading {
+    margin: 0 0 1.25rem;
+    font-size: 1.125rem;
+    font-weight: 700;
+}
+
+/* Already on the checkout page — the drawer's own "go to checkout" CTA has
+   nowhere further to send you from here. */
+.bbk-checkout-summary .bbk-cart-checkout { display: none; }
+
+/* ── Payment ───────────────────────────────────────────────────────── */
+
+.bbk-checkout-payment-options {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.bbk-checkout-payment-option {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.875rem 1rem;
+    border: 1px solid var(--bbk-color-border);
+    border-radius: var(--bbk-radius-sm);
+    cursor: pointer;
+    transition: border-color 0.15s ease;
+}
+
+.bbk-checkout-payment-option:has(input:checked) { border-color: var(--bbk-color-accent); }
+
+.bbk-checkout-payment-option-name { font-weight: 600; }
+
+.bbk-payment-element { margin: 0.25rem 0; }
+
+.bbk-checkout-withdrawal {
+    margin: 0;
+    font-size: 0.8125rem;
+    color: var(--bbk-color-muted);
+}
+
+.bbk-checkout-withdrawal a { color: inherit; }
+
+.bbk-checkout-error {
+    margin: 0;
+    font-size: 0.875rem;
+    color: var(--bbk-color-danger);
+}
+
+/* Processing overlay — fixed, covers the page while a payment confirms. */
+.bbk-checkout-processing {
+    position: fixed;
+    inset: 0;
+    z-index: 1100;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 1rem;
+    background: color-mix(in srgb, var(--bbk-color-bg) 92%, transparent);
+    text-align: center;
+    padding: 1.5rem;
+}
+
+.bbk-spinner {
+    width: 2rem;
+    height: 2rem;
+    border: 3px solid var(--bbk-color-border);
+    border-top-color: var(--bbk-color-accent);
+    border-radius: 50%;
+    animation: bbk-spin 0.8s linear infinite;
+}
+
+@keyframes bbk-spin {
+    to { transform: rotate(360deg); }
+}
+
+/* ── Confirmation page ─────────────────────────────────────────────── */
+
+.bbk-confirmation {
+    max-width: 720px;
+    margin: 0 auto;
+    padding: 3rem 1.5rem 5rem;
+    font-family: var(--bbk-font);
+    color: var(--bbk-color-text);
+}
+
+.bbk-confirmation-heading {
+    margin: 0 0 1rem;
+    font-size: 1.75rem;
+    font-weight: 700;
+}
+
+.bbk-confirmation-ref { margin: 0 0 0.25rem; }
+
+.bbk-confirmation-meta {
+    margin: 0 0 1rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+}
+
+.bbk-confirmation-meta-row {
+    display: flex;
+    justify-content: space-between;
+    gap: 1rem;
+    font-size: 0.9375rem;
+}
+
+.bbk-confirmation-meta-row dt { color: var(--bbk-color-muted); }
+.bbk-confirmation-meta-row dd { margin: 0; font-weight: 600; }
+
+.bbk-confirmation-body {
+    margin: 2rem 0;
+    display: grid;
+    gap: 2.5rem;
+}
+
+@media (min-width: 640px) {
+    .bbk-confirmation-body { grid-template-columns: 1fr 1fr; }
+}
+
+.bbk-confirmation-lines {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.bbk-confirmation-line {
+    display: grid;
+    grid-template-columns: 72px 1fr auto;
+    align-items: start;
+    gap: 0.875rem;
+}
+
+.bbk-confirmation-line-detail { min-width: 0; }
+
+.bbk-confirmation-line-qty { color: var(--bbk-color-muted); }
+
+.bbk-confirmation-lines .bbk-cart-summary { margin-top: 0.75rem; }
+
+.bbk-confirmation-addresses {
+    display: flex;
+    flex-direction: column;
+    gap: 1.5rem;
+}
+
+.bbk-confirmation-address-heading {
+    margin: 0 0 0.5rem;
+    font-size: 0.9375rem;
+    font-weight: 700;
+}
+
+.bbk-address-lines {
+    font-style: normal;
+    display: flex;
+    flex-direction: column;
+    gap: 0.125rem;
+    font-size: 0.875rem;
+    color: var(--bbk-color-muted);
+}

resources/js/checkout/bbk-add-to-cart-controller.js

@@ -0,0 +1,57 @@
+import { Controller } from '@hotwired/stimulus'
+import { csrfToken } from './csrf'
+
+// Sits on an <x-checkout::add-to-cart> <form>. Submits the line to the cart
+// via fetch and hands the server-rendered cart body to the drawer through the
+// `bbk-cart:changed` window event. No DOM building here — the drawer
+// (bbk-cart-controller) owns rendering.
+export default class extends Controller {
+    static targets = ['error']
+
+    async add(event) {
+        event.preventDefault()
+
+        const form = this.element
+        const submit = form.querySelector('[type="submit"]')
+
+        this.clearError()
+        form.setAttribute('data-bbk-add-to-cart-state', 'loading')
+        if (submit) submit.disabled = true
+
+        try {
+            const response = await fetch(form.action, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body: new FormData(form),
+            })
+
+            if (!response.ok) {
+                const data = await response.json().catch(() => null)
+                this.showError(data?.error)
+                return
+            }
+
+            window.dispatchEvent(new CustomEvent('bbk-cart:changed', {
+                detail: { html: await response.text() },
+            }))
+        } finally {
+            form.removeAttribute('data-bbk-add-to-cart-state')
+            if (submit) submit.disabled = false
+        }
+    }
+
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
+}

resources/js/checkout/bbk-cart-controller.js

@@ -0,0 +1,161 @@
+import { Controller } from '@hotwired/stimulus'
+import { csrfToken } from './csrf'
+
+// Drives the slide-in cart drawer. One instance, on the drawer root in
+// checkout/drawer.blade.php.
+//
+// - listens on window for `bbk-cart:changed` (from bbk-add-to-cart and from
+//   this drawer's own line forms) and swaps in the server-rendered cart body
+// - handles the in-drawer quantity / remove forms (fetch + method spoofing)
+// - re-emits `bbk-cart:updated` {count, total} after every render so the host
+//   (e.g. the header bag icon) can react
+//
+// Appearance is entirely CSS-driven: open state is the data-bbk-cart-state
+// attribute on the root, nothing here touches styles or class lists.
+export default class extends Controller {
+    static targets = ['panel', 'body', 'error']
+
+    connect() {
+        this.onChanged = this.onChanged.bind(this)
+        this.onKeydown = this.onKeydown.bind(this)
+        this.updateTimers = new Map() // line id -> pending debounce timer
+
+        window.addEventListener('bbk-cart:changed', this.onChanged)
+        window.addEventListener('bbk-cart:open', this.open.bind(this))
+        document.addEventListener('keydown', this.onKeydown)
+
+        // Prime the host with the count rendered server-side on page load.
+        this.emitUpdated(this.element.querySelector('[data-bbk-cart-count]'))
+    }
+
+    disconnect() {
+        window.removeEventListener('bbk-cart:changed', this.onChanged)
+        document.removeEventListener('keydown', this.onKeydown)
+        this.updateTimers.forEach((timer) => clearTimeout(timer))
+    }
+
+    onChanged(event) {
+        if (event.detail?.html) this.replaceBody(event.detail.html)
+        this.open()
+    }
+
+    onKeydown(event) {
+        if (event.key === 'Escape' && !this.element.hidden) this.close()
+    }
+
+    open() {
+        if (!this.element.hidden) return
+        this.element.hidden = false
+        // Next frame, so the panel transitions from its off-canvas start.
+        requestAnimationFrame(() => this.element.setAttribute('data-bbk-cart-state', 'open'))
+    }
+
+    close() {
+        this.element.removeAttribute('data-bbk-cart-state')
+
+        const panel = this.panelTarget
+        const done = () => {
+            this.element.hidden = true
+            panel.removeEventListener('transitionend', done)
+        }
+        panel.addEventListener('transitionend', done)
+    }
+
+    // change on a line quantity input, or submit of a line's remove form
+    submit(event) {
+        event.preventDefault()
+        const form = event.target.closest('form')
+        if (!form) return
+
+        // A remove is a deliberate, one-shot action — only the quantity form
+        // (typing, or the +/- stepper below) benefits from debouncing.
+        form.classList.contains('bbk-cart-qty') ? this.scheduleSend(form) : this.send(form)
+    }
+
+    // +/- stepper buttons inside a line
+    step(event) {
+        event.preventDefault()
+        const form = event.target.closest('form')
+        const input = form.querySelector('input[type="number"]')
+        const next = Math.max(0, parseInt(input.value || '0', 10) + Number(event.params.dir))
+        input.value = String(next)
+        this.scheduleSend(form)
+    }
+
+    // Repeated clicks (or spinner nudges) update the input instantly but only
+    // send once they settle for 300ms — sending on every single click was
+    // firing overlapping requests that raced each other and made the drawer
+    // visibly flicker/lag under quick clicking.
+    scheduleSend(form) {
+        const lineId = form.closest('[data-bbk-line-id]')?.dataset.bbkLineId
+        if (!lineId) return this.send(form)
+
+        clearTimeout(this.updateTimers.get(lineId))
+        this.updateTimers.set(lineId, setTimeout(() => {
+            this.updateTimers.delete(lineId)
+            this.send(form)
+        }, 300))
+    }
+
+    async send(form) {
+        this.bodyTarget.setAttribute('aria-busy', 'true')
+        this.clearError()
+
+        try {
+            const response = await fetch(form.action, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body: new FormData(form),
+            })
+
+            if (response.ok) {
+                this.replaceBody(await response.text())
+                return
+            }
+
+            const data = await response.json().catch(() => null)
+            this.showError(data?.error)
+
+            // The rejected quantity (typed, or from a +/- click) is left
+            // sitting in the input with nothing to correct it — the update
+            // never reached the cart, so the input must be put back to what
+            // the cart actually still holds, not just left showing whatever
+            // was rejected.
+            const input = form.querySelector('[data-bbk-cart-confirmed-quantity]')
+            if (input) input.value = input.dataset.bbkCartConfirmedQuantity
+        } finally {
+            this.bodyTarget.removeAttribute('aria-busy')
+        }
+    }
+
+    showError(message) {
+        if (!this.hasErrorTarget || !message) return
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+    }
+
+    clearError() {
+        if (!this.hasErrorTarget) return
+        this.errorTarget.hidden = true
+    }
+
+    replaceBody(html) {
+        this.bodyTarget.innerHTML = html
+        this.emitUpdated(this.bodyTarget.querySelector('[data-bbk-cart-count]'))
+    }
+
+    emitUpdated(node) {
+        if (!node) return
+
+        window.dispatchEvent(new CustomEvent('bbk-cart:updated', {
+            detail: {
+                count: parseInt(node.dataset.bbkCartCount || '0', 10),
+                total: parseInt(node.dataset.bbkCartTotal || '0', 10),
+            },
+        }))
+    }
+}

resources/js/checkout/bbk-checkout-form-controller.js

@@ -0,0 +1,204 @@
+import { Controller } from '@hotwired/stimulus'
+import { csrfToken } from './csrf'
+
+// Drives the checkout page's left column: contact tabs, the same-as-billing
+// toggle, and — the bulk of it — autosaving the address form and the shipping
+// method with no submit buttons.
+//
+// Flow: any `change` in the address form is debounced ~400ms, then the whole
+// form is POSTed to saveUrl. The server persists leniently and returns
+// { errors, shippingOptionsHtml, summaryHtml }. We swap the shipping-options
+// block in place and hand the summary fragment to the drawer's bbk-cart
+// controller via the `bbk-cart:changed` window event (same mechanism the drawer
+// already uses). Shipping-method radios post to selectShippingUrl the same way.
+export default class extends Controller {
+    static targets = [
+        'sameAsBilling', 'shippingFields',
+        'form', 'shippingOptions', 'status',
+    ]
+
+    static values = {
+        saveUrl: String,
+        selectShippingUrl: String,
+        statusSaving: String,
+        statusSaved: String,
+        statusError: String,
+    }
+
+    connect() {
+        this.saveTimer = null
+        this.saveController = null
+        this.statusTimer = null
+        this.shippingPromise = null
+
+        if (this.hasSameAsBillingTarget) this.applySameAsBilling()
+    }
+
+    disconnect() {
+        clearTimeout(this.saveTimer)
+        clearTimeout(this.statusTimer)
+        this.saveController?.abort()
+    }
+
+    // ── Same as billing ────────────────────────────────────────────────
+
+    toggleSameAsBilling() {
+        this.applySameAsBilling()
+    }
+
+    applySameAsBilling() {
+        const on = this.sameAsBillingTarget.checked
+
+        // Checked: shipping *is* billing — copy every value across, then hide +
+        // disable so the browser doesn't submit them; the server reuses billing.
+        // Unchecked: reveal them pre-filled from billing wherever still empty.
+        this.element.querySelectorAll('[name^="billing_"]').forEach((billingField) => {
+            const shippingField = this.element.querySelector(
+                `[name="${billingField.name.replace(/^billing_/, 'shipping_')}"]`,
+            )
+            if (shippingField && (on || !shippingField.value)) {
+                shippingField.value = billingField.value
+            }
+        })
+
+        this.shippingFieldsTarget.hidden = on
+        this.shippingFieldsTarget.querySelectorAll('input, select, textarea').forEach((field) => {
+            field.disabled = on
+        })
+    }
+
+    // ── Autosave ───────────────────────────────────────────────────────
+
+    scheduleSave(event) {
+        // The shipping-method and payment radios live inside this controller's
+        // element too, and this action is bound on .bbk-checkout-main to also
+        // catch the contact email/consent that sit outside the <form>. Only
+        // react to fields that actually belong to the address form.
+        const el = event.target
+        const belongsToForm = el.form?.id === 'bbk-address-form'
+        if (!belongsToForm) return
+
+        // No status during the wait — it only shows once the request is in flight,
+        // so the indicator isn't flickering "saving" on every keystroke.
+        clearTimeout(this.saveTimer)
+        this.saveTimer = setTimeout(() => this.save(), 700)
+    }
+
+    // Called by bbk-payment right before place-order — a debounced save (and
+    // the shipping-option auto-select that happens as part of it) might still
+    // be pending when the shopper clicks "place order"; this guarantees the
+    // server has processed the current form state first.
+    async flush() {
+        clearTimeout(this.saveTimer)
+        await this.save()
+        // A shipping-method radio click fires its own (undebounced) request —
+        // still async, still racy against an immediate "place order" click.
+        if (this.shippingPromise) await this.shippingPromise
+    }
+
+    async save() {
+        this.saveController?.abort()
+        this.saveController = new AbortController()
+        this.setStatus('saving')
+
+        try {
+            const response = await fetch(this.saveUrlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body: new FormData(this.formTarget),
+                signal: this.saveController.signal,
+            })
+
+            if (!response.ok) return this.setStatus('error')
+
+            this.applyResult(await response.json())
+            this.setStatus('saved')
+        } catch (error) {
+            if (error.name !== 'AbortError') this.setStatus('error')
+        }
+    }
+
+    async selectShipping(event) {
+        // Tracked so flush() can await it — nothing else stops "place order"
+        // (a separate, unrelated click) from racing ahead of this request.
+        this.shippingPromise = this.doSelectShipping(event.target.value)
+        await this.shippingPromise
+    }
+
+    async doSelectShipping(value) {
+        this.saveController?.abort()
+        this.setStatus('saving')
+
+        const body = new FormData()
+        body.append('shipping_option', value)
+
+        try {
+            const response = await fetch(this.selectShippingUrlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body,
+            })
+
+            if (!response.ok) return this.setStatus('error')
+
+            this.applyResult(await response.json())
+            this.setStatus('saved')
+        } catch {
+            this.setStatus('error')
+        } finally {
+            this.shippingPromise = null
+        }
+    }
+
+    applyResult(data) {
+        this.applyErrors(data.errors || {})
+
+        if (data.shippingOptionsHtml != null) {
+            this.shippingOptionsTarget.innerHTML = data.shippingOptionsHtml
+        }
+
+        if (data.summaryHtml != null) {
+            window.dispatchEvent(new CustomEvent('bbk-cart:changed', {
+                detail: { html: data.summaryHtml },
+            }))
+        }
+    }
+
+    applyErrors(errors) {
+        this.element.querySelectorAll('[data-bbk-field-error]').forEach((el) => {
+            const message = errors[el.dataset.bbkFieldError]
+            el.textContent = message || ''
+            el.hidden = !message
+
+            const field = this.element.querySelector(`[name="${el.dataset.bbkFieldError}"]`)
+            field?.classList.toggle('bbk-field-input--error', Boolean(message))
+        })
+    }
+
+    setStatus(state) {
+        if (!this.hasStatusTarget) return
+
+        const text = {
+            saving: this.statusSavingValue,
+            saved: this.statusSavedValue,
+            error: this.statusErrorValue,
+        }[state]
+
+        this.statusTarget.textContent = text
+        this.statusTarget.hidden = false
+        this.statusTarget.dataset.state = state
+
+        clearTimeout(this.statusTimer)
+        if (state === 'saved') {
+            this.statusTimer = setTimeout(() => { this.statusTarget.hidden = true }, 2000)
+        }
+    }
+}

resources/js/checkout/bbk-payment-controller.js

@@ -0,0 +1,289 @@
+import { Controller } from '@hotwired/stimulus'
+import { csrfToken } from './csrf'
+
+const STRIPE_JS = 'https://js.stripe.com/v3/'
+const POLL_INTERVAL = 1500
+const POLL_TIMEOUT = 30000
+
+// The payment step of the checkout page. Sits alongside bbk-checkout-form on
+// .bbk-checkout-main.
+//
+// - selectMethod: radio change -> persist via /payment-method, refresh the
+//   summary (COD fee), mount/unmount the Stripe Payment Element
+// - placeOrder: the real submit. For Stripe, builds a PaymentMethod client-side
+//   and POSTs it to /place-order, then routes on the JSON result:
+//     { redirect }                 -> order placed, go to confirmation
+//     { status:'pending', clientSecret } -> 3-D Secure: handleNextAction, then
+//                                    poll /order-status until the webhook places it
+//     { status:'failed'|'invalid'|'stale', message } -> show inline, re-enable
+export default class extends Controller {
+    static targets = ['element', 'terms', 'error', 'submit', 'processing', 'processingText']
+
+    static values = {
+        selectUrl: String,
+        placeOrderUrl: String,
+        orderStatusUrl: String,
+        stripeKey: String,
+        amount: Number,
+        currency: String,
+        termsRequired: String,
+        chooseMethod: String,
+        genericError: String,
+        processingSlow: String,
+    }
+
+    connect() {
+        this.stripe = null
+        this.elements = null
+        this.paymentElement = null
+
+        this.onSummaryUpdate = (event) => {
+            const total = event.detail?.total
+            if (typeof total === 'number' && this.elements) {
+                this.amountValue = total
+                this.elements.update({ amount: Math.max(total, 1) })
+            }
+
+            // Removing the last line while sitting on the checkout page (via
+            // the order summary's own remove form) must not leave "place
+            // order" clickable with nothing left to charge for — this fires
+            // from both the drawer and the checkout page's own summary
+            // instance, whichever the shopper actually used.
+            const count = event.detail?.count
+            if (typeof count === 'number' && this.hasSubmitTarget) {
+                this.submitTarget.disabled = count === 0
+            }
+        }
+        window.addEventListener('bbk-cart:updated', this.onSummaryUpdate)
+
+        if (this.selectedIsStripe()) this.mountStripe()
+    }
+
+    disconnect() {
+        window.removeEventListener('bbk-cart:updated', this.onSummaryUpdate)
+        this.unmountStripe()
+    }
+
+    // ── Method selection ──────────────────────────────────────────────
+
+    async selectMethod(event) {
+        const isStripe = event.target.dataset.paymentDriver === 'stripe'
+
+        try {
+            const response = await fetch(this.selectUrlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body: new URLSearchParams({ payment_type: event.target.value }),
+            })
+            if (response.ok) {
+                const data = await response.json()
+                if (data.summaryHtml != null) {
+                    window.dispatchEvent(new CustomEvent('bbk-cart:changed', { detail: { html: data.summaryHtml } }))
+                }
+            }
+        } catch {
+            // summary just won't refresh — non-fatal
+        }
+
+        isStripe ? this.mountStripe() : this.unmountStripe()
+    }
+
+    selectedRadio() {
+        return this.element.querySelector('input[name="payment_type"]:checked')
+    }
+
+    selectedIsStripe() {
+        return this.selectedRadio()?.dataset.paymentDriver === 'stripe'
+    }
+
+    // ── Stripe Payment Element ────────────────────────────────────────
+
+    async loadStripe() {
+        if (window.Stripe) return window.Stripe
+
+        await new Promise((resolve, reject) => {
+            const existing = document.querySelector(`script[src="${STRIPE_JS}"]`)
+            if (existing) {
+                existing.addEventListener('load', resolve)
+                existing.addEventListener('error', reject)
+                return
+            }
+            const script = document.createElement('script')
+            script.src = STRIPE_JS
+            script.onload = resolve
+            script.onerror = reject
+            document.head.appendChild(script)
+        })
+
+        return window.Stripe
+    }
+
+    async mountStripe() {
+        if (this.paymentElement || !this.stripeKeyValue) return
+
+        const Stripe = await this.loadStripe()
+        this.stripe = this.stripe || Stripe(this.stripeKeyValue)
+
+        this.elements = this.stripe.elements({
+            mode: 'payment',
+            amount: Math.max(this.amountValue, 1),
+            currency: this.currencyValue,
+            paymentMethodCreation: 'manual',
+            // Card only — matches the server confirming with
+            // automatic_payment_methods.allow_redirects = 'never' (no
+            // return_url in our flow: 3-D Secure resolves in-page via
+            // handleNextAction, never a full-page redirect).
+            paymentMethodTypes: ['card'],
+        })
+        this.paymentElement = this.elements.create('payment')
+        this.paymentElement.mount(this.elementTarget)
+        this.elementTarget.hidden = false
+    }
+
+    unmountStripe() {
+        this.paymentElement?.unmount()
+        this.paymentElement = null
+        this.elements = null
+
+        if (this.hasElementTarget) {
+            this.elementTarget.innerHTML = ''
+            this.elementTarget.hidden = true
+        }
+    }
+
+    // ── Place order ──────────────────────────────────────────────────
+
+    // Sibling controller on the same element (.bbk-checkout-main) — used to
+    // flush a pending debounced address autosave before placing the order.
+    get checkoutForm() {
+        return this.application.getControllerForElementAndIdentifier(this.element, 'bbk-checkout-form')
+    }
+
+    async placeOrder() {
+        this.clearError()
+        this.submitTarget.disabled = true
+
+        // A debounced address save (and the shipping-option auto-select that
+        // happens as part of it) might still be pending — make sure the
+        // server has the latest state before we ask it to place the order.
+        await this.checkoutForm?.flush()
+
+        if (!this.termsTarget.checked) {
+            this.submitTarget.disabled = false
+            this.showError(this.termsRequiredValue)
+            return
+        }
+
+        const radio = this.selectedRadio()
+        if (!radio) {
+            this.submitTarget.disabled = false
+            this.showError(this.chooseMethodValue)
+            return
+        }
+
+        let paymentMethodId = null
+        if (radio.dataset.paymentDriver === 'stripe') {
+            const { error: submitError } = await this.elements.submit()
+            if (submitError) return this.fail(submitError.message)
+
+            const { error: pmError, paymentMethod } = await this.stripe.createPaymentMethod({ elements: this.elements })
+            if (pmError) return this.fail(pmError.message)
+            paymentMethodId = paymentMethod.id
+        }
+
+        let data
+        try {
+            const response = await fetch(this.placeOrderUrlValue, {
+                method: 'POST',
+                headers: {
+                    'X-CSRF-TOKEN': csrfToken(),
+                    'X-Requested-With': 'XMLHttpRequest',
+                    Accept: 'application/json',
+                },
+                body: new URLSearchParams({
+                    payment_type: radio.value,
+                    payment_method: paymentMethodId ?? '',
+                    terms_accepted: '1',
+                }),
+            })
+            data = await response.json()
+        } catch {
+            return this.fail(this.genericErrorValue)
+        }
+
+        if (data.redirect) {
+            window.location.assign(data.redirect)
+            return
+        }
+
+        if (data.status === 'pending' && data.clientSecret) {
+            await this.resolvePending(data.clientSecret)
+            return
+        }
+
+        // Points at the section that actually needs attention, rather than
+        // leaving a generic error and making the shopper hunt for it — e.g. a
+        // region with 2+ shipping methods needs an explicit pick, easy to miss.
+        if (data.field === 'shipping_option') {
+            document.getElementById('bbk-shipping-options')?.scrollIntoView({ block: 'center', behavior: 'smooth' })
+            this.fail(data.message || data.error || this.genericErrorValue, { scroll: false })
+            return
+        }
+
+        this.fail(data.message || data.error || this.genericErrorValue)
+    }
+
+    async resolvePending(clientSecret) {
+        this.processingTarget.hidden = false
+
+        const { error } = await this.stripe.handleNextAction({ clientSecret })
+        if (error) {
+            this.processingTarget.hidden = true
+            return this.fail(error.message)
+        }
+
+        // 3-D Secure cleared client-side — the webhook places the order. Poll.
+        const startedAt = Date.now()
+        const tick = async () => {
+            try {
+                const response = await fetch(this.orderStatusUrlValue, { headers: { Accept: 'application/json' } })
+                const data = await response.json()
+                if (data.placed && data.redirect) {
+                    window.location.assign(data.redirect)
+                    return
+                }
+            } catch {
+                // keep polling
+            }
+
+            if (Date.now() - startedAt > POLL_TIMEOUT) {
+                this.processingTextTarget.textContent = this.processingSlowValue
+                return
+            }
+            setTimeout(tick, POLL_INTERVAL)
+        }
+        tick()
+    }
+
+    // ── helpers ──────────────────────────────────────────────────────
+
+    fail(message, { scroll = true } = {}) {
+        this.showError(message, { scroll })
+        this.submitTarget.disabled = false
+    }
+
+    showError(message, { scroll = true } = {}) {
+        this.errorTarget.textContent = message
+        this.errorTarget.hidden = false
+        if (scroll) this.errorTarget.scrollIntoView({ block: 'center', behavior: 'smooth' })
+    }
+
+    clearError() {
+        this.errorTarget.textContent = ''
+        this.errorTarget.hidden = true
+    }
+}

resources/js/checkout/csrf.js

@@ -0,0 +1,6 @@
+// Reads the CSRF token from the standard <meta name="csrf-token"> tag every
+// boboko host renders in its layout <head>. Kept as its own module so both
+// checkout controllers share one source.
+export function csrfToken() {
+    return document.querySelector('meta[name="csrf-token"]')?.getAttribute('content') || ''
+}

resources/js/checkout/index.js

@@ -0,0 +1,19 @@
+import BbkAddToCartController from './bbk-add-to-cart-controller'
+import BbkCartController from './bbk-cart-controller'
+import BbkCheckoutFormController from './bbk-checkout-form-controller'
+import BbkPaymentController from './bbk-payment-controller'
+
+// Registers the checkout module's Stimulus controllers onto the host app's
+// Stimulus application. Call once from the host's JS entry point:
+//
+//     import { registerCheckout } from './checkout'
+//     registerCheckout(application)
+//
+// When this module moves to boboko-core this file ships with it unchanged;
+// only that one import line in the host entry point differs per project.
+export function registerCheckout(application) {
+    application.register('bbk-add-to-cart', BbkAddToCartController)
+    application.register('bbk-cart', BbkCartController)
+    application.register('bbk-checkout-form', BbkCheckoutFormController)
+    application.register('bbk-payment', BbkPaymentController)
+}

resources/views/auth/filament/pages/login.blade.php

@@ -2,7 +2,7 @@
 
     @if (! $otpSent)
         <form wire:submit="requestOtp">
-            <div class="grid gap-y-4">
+            <div style="display: flex; flex-direction: column; row-gap: 1rem;">
                 <x-filament::input.wrapper>
                     <x-filament::input
                         type="email"
@@ -24,7 +24,7 @@
         </form>
     @else
         <form wire:submit="authenticate">
-            <div class="grid gap-y-4">
+            <div style="display: flex; flex-direction: column; row-gap: 1rem;">
                 <p class="text-sm text-gray-500">
                     A login code was sent to <strong>{{ $email }}</strong>.
                 </p>

resources/views/auth/mail/email-change-code.blade.php

@@ -0,0 +1,17 @@
+@extends('emails.layout')
+
+@section('content')
+<p style="margin: 0 0 24px 0;">Use the code below to confirm this address as your account's new email.</p>
+
+<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="margin: 0 0 24px 0; background-color: #f7f6f5; border-radius: 8px;">
+    <tr>
+        <td style="padding: 16px 20px; text-align: center; font-size: 28px; font-weight: bold; letter-spacing: 0.25rem;">
+            {{ $code }}
+        </td>
+    </tr>
+</table>
+
+<p style="margin: 0 0 16px 0;">This code expires in 10 minutes.</p>
+
+<p style="margin: 0;">If you didn't request this change, you can ignore this email — nothing will change.</p>
+@endsection

resources/views/auth/mail/email-changed-notice.blade.php

@@ -0,0 +1,9 @@
+@extends('emails.layout')
+
+@section('content')
+<p style="margin: 0 0 16px 0;">Your account's login email was changed to <strong>{{ $maskedEmail }}</strong>.</p>
+
+<p style="margin: 0 0 24px 0;">From now on, login codes will be sent to the new address.</p>
+
+<p style="margin: 0;">If you didn't make this change, please contact us right away.</p>
+@endsection

resources/views/auth/mail/otp.blade.php

@@ -1,5 +1,5 @@
 <p>Hi {{ $name }},</p>
 
-<p>Your login code is:</p>
+<p>{{ $intro }}</p>
 
 <p style="font-size: 2rem; font-weight: bold; letter-spacing: 0.25rem;">{{ $code }}</p>

resources/views/checkout/components/add-to-cart.blade.php

@@ -0,0 +1,44 @@
+{{--
+    <x-checkout::add-to-cart :purchasable="$variantId" />
+
+    A self-contained add-to-cart form. Posts the line via bbk-add-to-cart-controller
+    (fetch) and hands the rendered cart body to the drawer over the
+    `bbk-cart:changed` window event.
+
+    Props:
+      purchasable  ProductVariant id. Omit to render no hidden id field — the host
+                   must then supply [data-bbk-purchasable-input] itself (e.g. a
+                   variant picker writing the selected id into it).
+      quantity     Integer for the hidden quantity field, or false to omit it
+                   (the host then puts its own name="quantity" control in the slot).
+
+    The button and any quantity control come from the slot, so the host owns all
+    appearance. Extra attributes (class, etc.) land on the <form>.
+--}}
+@props([
+    'purchasable' => null,
+    'quantity' => 1,
+    'action' => null,
+])
+
+<form
+    method="POST"
+    action="{{ $action ?? route('checkout.cart.add', app()->getLocale()) }}"
+    data-controller="bbk-add-to-cart"
+    data-action="bbk-add-to-cart#add"
+    {{ $attributes->class('bbk-add-to-cart') }}
+>
+    @csrf
+
+    @if (! is_null($purchasable))
+        <input type="hidden" name="purchasable_id" value="{{ $purchasable }}" data-bbk-purchasable-input>
+    @endif
+
+    @if ($quantity !== false)
+        <input type="hidden" name="quantity" value="{{ $quantity }}">
+    @endif
+
+    {{ $slot }}
+
+    <p class="bbk-add-to-cart-error" data-bbk-add-to-cart-target="error" hidden role="alert"></p>
+</form>

resources/views/checkout/components/address-lines.blade.php

@@ -0,0 +1,15 @@
+{{--
+    Read-only formatted address. $address is any Lunar address model
+    (OrderAddress / CartAddress) — same column names on both.
+--}}
+@props(['address'])
+
+<address class="bbk-address-lines">
+    <span>{{ trim(($address->first_name ?? '') . ' ' . ($address->last_name ?? '')) }}</span>
+    @if ($address->company_name)<span>{{ $address->company_name }}</span>@endif
+    <span>{{ $address->line_one }}</span>
+    @if ($address->line_two)<span>{{ $address->line_two }}</span>@endif
+    <span>{{ trim(($address->postcode ?? '') . ' ' . ($address->city ?? '')) }}</span>
+    @if ($address->state)<span>{{ $address->state }}</span>@endif
+    @if ($address->contact_phone)<span>{{ $address->contact_phone }}</span>@endif
+</address>

resources/views/checkout/components/field.blade.php

@@ -0,0 +1,29 @@
+{{--
+    <x-checkout::field name="billing_first_name" label="First name" required />
+
+    Generic labelled text input with old-input repopulation and validation
+    error display — the module's own equivalent of a host x-ui.field, used
+    instead of it per the module's independence rule. All styling is .bbk-field*
+    (resources/css/checkout.css); no host classes.
+--}}
+@props([
+    'name',
+    'label',
+    'type' => 'text',
+    'value' => null,
+    'required' => false,
+])
+
+<div class="bbk-field">
+    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
+    <input
+        type="{{ $type }}"
+        name="{{ $name }}"
+        id="bbk-{{ $name }}"
+        value="{{ old($name, $value) }}"
+        @if ($required) required @endif
+        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
+    >
+    {{-- Always present so bbk-checkout-form can fill it live on an autosave. --}}
+    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
+</div>

resources/views/checkout/components/region-country.blade.php

@@ -0,0 +1,52 @@
+{{--
+    The state/region + country pair for one address (billing or shipping).
+
+    Single-country store ($storeCountry set): region is a <select> of that
+    country's Lunar states, submitting `->name` (table-rate-shipping resolves
+    zones with State::whereName()), and country is a fixed hidden field + label.
+    Otherwise: free-text region + full country <select>, as before.
+--}}
+@props([
+    'prefix',
+    'storeCountry' => null,
+    'regions' => [],
+    'countries' => [],
+    'address' => null,
+])
+
+<div class="bbk-field-row">
+    @if ($storeCountry)
+        <x-checkout::select
+            :name="$prefix . '_state'"
+            label="{{ __('checkout.page.state') }}"
+            :options="$regions"
+            value-field="name"
+            translation-group="states"
+            :value="$address?->state"
+            placeholder="{{ __('checkout.page.state_placeholder') }}"
+            required
+        />
+
+        <div class="bbk-field">
+            <span class="bbk-field-label">{{ __('checkout.page.country') }}</span>
+            <p class="bbk-field-static">
+                {{ \Illuminate\Support\Facades\Lang::has("core::countries.{$storeCountry->name}")
+                    ? __("core::countries.{$storeCountry->name}")
+                    : $storeCountry->name }}
+            </p>
+            <input type="hidden" name="{{ $prefix }}_country_id" value="{{ $storeCountry->id }}">
+        </div>
+    @else
+        <x-checkout::field :name="$prefix . '_state'" label="{{ __('checkout.page.state') }}" :value="$address?->state" />
+
+        <x-checkout::select
+            :name="$prefix . '_country_id'"
+            label="{{ __('checkout.page.country') }}"
+            :options="$countries"
+            translation-group="countries"
+            :value="$address?->country_id"
+            placeholder="{{ __('checkout.page.country_placeholder') }}"
+            required
+        />
+    @endif
+</div>

resources/views/checkout/components/select.blade.php

@@ -0,0 +1,62 @@
+{{--
+    <x-checkout::select name="billing_country_id" label="Country" :options="$countries" required />
+    <x-checkout::select name="shipping_state" label="Region" :options="$regions" value-field="name" translation-group="states" required />
+
+    `options` is an iterable of models/objects; `label` is always read from
+    `->name`, the submitted value from `->{$valueField}` (default `id`, but e.g.
+    `name` for Lunar states — table-rate-shipping resolves those with
+    State::whereName(), so the address must carry the exact name string).
+
+    `translationGroup` (optional, e.g. "countries"/"states") looks the raw
+    `->name` up in boboko-core's `core::{group}.{name}` lang file (see
+    boboko-core's lang/el/countries.php, lang/el/states.php) for the
+    DISPLAYED label only — the submitted `value` is always the untranslated
+    `->{$valueField}`, since table-rate-shipping/Lunar's Country lookups key
+    off the original English name. Falls back to the raw name when no
+    translation exists for the current locale (e.g. English, or a country
+    outside the covered set).
+--}}
+@props([
+    'name',
+    'label',
+    'options' => [],
+    'value' => null,
+    'placeholder' => null,
+    'required' => false,
+    'valueField' => 'id',
+    'translationGroup' => null,
+])
+
+@php
+    $optionLabel = function ($option) use ($translationGroup) {
+        if (! $translationGroup) {
+            return $option->name;
+        }
+
+        $key = "core::{$translationGroup}.{$option->name}";
+
+        return \Illuminate\Support\Facades\Lang::has($key) ? __($key) : $option->name;
+    };
+@endphp
+
+@php($selected = old($name, $value))
+
+<div class="bbk-field">
+    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
+    <select
+        name="{{ $name }}"
+        id="bbk-{{ $name }}"
+        @if ($required) required @endif
+        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
+    >
+        @if ($placeholder)
+            <option value="" @selected(! $selected)>{{ $placeholder }}</option>
+        @endif
+        @foreach ($options as $option)
+            <option value="{{ $option->{$valueField} }}" @selected((string) $selected === (string) $option->{$valueField})>
+                {{ $optionLabel($option) }}
+            </option>
+        @endforeach
+    </select>
+    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
+</div>

resources/views/checkout/components/textarea.blade.php

@@ -0,0 +1,18 @@
+@props([
+    'name',
+    'label',
+    'value' => null,
+    'required' => false,
+])
+
+<div class="bbk-field">
+    <label class="bbk-field-label" for="bbk-{{ $name }}">{{ $label }}</label>
+    <textarea
+        name="{{ $name }}"
+        id="bbk-{{ $name }}"
+        rows="3"
+        @if ($required) required @endif
+        {{ $attributes->class(['bbk-field-input', 'bbk-field-input--error' => $errors->has($name)]) }}
+    >{{ old($name, $value) }}</textarea>
+    <p class="bbk-field-error" data-bbk-field-error="{{ $name }}" @unless ($errors->has($name)) hidden @endunless>{{ $errors->first($name) }}</p>
+</div>

resources/views/checkout/confirmation.blade.php

@@ -0,0 +1,132 @@
+{{--
+    Order confirmation. Reached only via a session flash of the placed order id
+    (CheckoutController::confirmation) — not deep-linkable. $order is a
+    Lunar\Models\Order with lines + shipping/billing addresses eager-loaded.
+--}}
+@extends('layouts.app')
+
+@section('title', __('checkout.page.confirmation_title') . ' — ' . config('app.name'))
+
+@section('content')
+    <div class="bbk-confirmation">
+        <h1 class="bbk-confirmation-heading">{{ __('checkout.page.confirmation_heading') }}</h1>
+
+        <dl class="bbk-confirmation-meta">
+            <div class="bbk-confirmation-meta-row">
+                <dt>{{ __('checkout.page.confirmation_order_number') }}</dt>
+                <dd>{{ $order->reference }}</dd>
+            </div>
+
+            @if ($order->billingAddress?->contact_email)
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.email_label') }}</dt>
+                    <dd>{{ $order->billingAddress->contact_email }}</dd>
+                </div>
+            @endif
+
+            @if ($paymentMethodName)
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.payment_heading') }}</dt>
+                    <dd>{{ $paymentMethodName }}</dd>
+                </div>
+            @endif
+
+            @if ($shippingLine = $order->lines->firstWhere('type', 'shipping'))
+                <div class="bbk-confirmation-meta-row">
+                    <dt>{{ __('checkout.page.shipping_method_heading') }}</dt>
+                    <dd>{{ $shippingLine->description }}</dd>
+                </div>
+            @endif
+        </dl>
+
+        <p class="bbk-checkout-note">{{ __('checkout.page.confirmation_email_note') }}</p>
+
+        {{-- Guests: logging in with the order's email attaches it to an account
+             (boboko-core's Modules\Core\Customer\Listeners\ClaimGuestOrdersOnLogin),
+             so it shows in their history. --}}
+        @guest
+            @if ($loginRoute = config('checkout.login_route'))
+                <p class="bbk-checkout-note">
+                    {{ __('checkout.page.confirmation_login_hint') }}
+                    <a href="{{ route($loginRoute) }}">{{ __('checkout.page.login_link') }}</a>
+                </p>
+            @endif
+        @endguest
+
+        <div class="bbk-confirmation-body">
+            <div class="bbk-confirmation-lines">
+                @foreach ($order->lines->where('type', '!=', 'shipping') as $line)
+                    <div class="bbk-confirmation-line">
+                        <div class="bbk-cart-item-media">
+                            @if ($thumb = $line->purchasable?->getThumbnailImage())
+                                <img src="{{ $thumb }}" alt="{{ $line->description }}" width="72" height="72" loading="lazy">
+                            @endif
+                        </div>
+
+                        <div class="bbk-confirmation-line-detail">
+                            <span class="bbk-confirmation-line-name">
+                                {{ $line->description }}
+                                <span class="bbk-confirmation-line-qty">&times; {{ $line->quantity }}</span>
+                            </span>
+
+                            @if ($line->option)
+                                <p class="bbk-cart-item-variant">{{ $line->option }}</p>
+                            @endif
+
+                            @include('checkout::partials.line-custom-fields', ['line' => $line])
+                        </div>
+
+                        <span class="bbk-confirmation-line-total">{{ $line->sub_total?->formatted() }}</span>
+                    </div>
+                @endforeach
+
+                <div class="bbk-cart-summary">
+                    <div class="bbk-cart-summary-row">
+                        <span>{{ __('checkout.cart.subtotal') }}</span>
+                        <span>{{ $order->sub_total?->formatted() }}</span>
+                    </div>
+
+                    @if ($order->discount_total?->value > 0)
+                        <div class="bbk-cart-summary-row bbk-cart-summary-row--discount">
+                            <span>{{ __('checkout.cart.discount') }}</span>
+                            <span>&minus;{{ $order->discount_total->formatted() }}</span>
+                        </div>
+                    @endif
+
+                    <div class="bbk-cart-summary-row">
+                        <span>{{ __('checkout.cart.shipping') }}</span>
+                        <span>{{ $order->shipping_total?->formatted() }}</span>
+                    </div>
+
+                    @if ($order->tax_total?->value > 0)
+                        <div class="bbk-cart-summary-row">
+                            <span>{{ __('checkout.cart.tax') }}</span>
+                            <span>{{ $order->tax_total->formatted() }}</span>
+                        </div>
+                    @endif
+
+                    <div class="bbk-cart-summary-row bbk-cart-summary-row--total">
+                        <span>{{ __('checkout.cart.total') }}</span>
+                        <span>{{ $order->total?->formatted() }}</span>
+                    </div>
+                </div>
+            </div>
+
+            <div class="bbk-confirmation-addresses">
+                @if ($order->shippingAddress)
+                    <div class="bbk-confirmation-address">
+                        <h2 class="bbk-confirmation-address-heading">{{ __('checkout.page.confirmation_shipping_to') }}</h2>
+                        <x-checkout::address-lines :address="$order->shippingAddress" />
+                    </div>
+                @endif
+
+                @if ($order->billingAddress)
+                    <div class="bbk-confirmation-address">
+                        <h2 class="bbk-confirmation-address-heading">{{ __('checkout.page.confirmation_billing') }}</h2>
+                        <x-checkout::address-lines :address="$order->billingAddress" />
+                    </div>
+                @endif
+            </div>
+        </div>
+    </div>
+@endsection

resources/views/checkout/drawer.blade.php

@@ -0,0 +1,33 @@
+{{--
+    Slide-in cart drawer. Rendered once, globally, from the app layout
+    (@include('checkout::drawer')). Structure only — all styling lives in
+    resources/css/checkout.css under @layer bbk-checkout; the host restyles the
+    .bbk-* classes from its own stylesheet. No host components, no Tailwind.
+--}}
+<div class="bbk-cart" data-controller="bbk-cart" hidden>
+    <div class="bbk-cart-backdrop" data-action="click->bbk-cart#close"></div>
+
+    <aside
+        class="bbk-cart-panel"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="bbk-cart-heading"
+        data-bbk-cart-target="panel"
+    >
+        <header class="bbk-cart-panel-header">
+            <h2 class="bbk-cart-heading" id="bbk-cart-heading">{{ __('checkout.cart.title') }}</h2>
+            <button
+                type="button"
+                class="bbk-cart-dismiss"
+                data-action="bbk-cart#close"
+                aria-label="{{ __('checkout.cart.close') }}"
+            >&times;</button>
+        </header>
+
+        @include('checkout::partials.cart-error')
+
+        <div class="bbk-cart-panel-body" data-bbk-cart-target="body" aria-live="polite">
+            @include('checkout::partials.cart-body')
+        </div>
+    </aside>
+</div>

resources/views/checkout/page.blade.php

@@ -0,0 +1,279 @@
+{{--
+    The checkout page. Two columns: left is contact + billing + shipping +
+    shipping method, right is the order summary (the same cart-body partial the
+    drawer uses, minus its own "Checkout" CTA — see .bbk-checkout-summary in
+    checkout.css). Stops short of payment for this slice — see
+    CheckoutController's class docblock.
+
+    $cart, $lines, $billingAddress, $shippingAddress, $shippingOptions,
+    $countries come from CheckoutController::show().
+--}}
+@extends('layouts.app')
+
+@section('title', __('checkout.page.title') . ' — ' . config('app.name'))
+
+@section('content')
+    <div class="bbk-checkout-page">
+        <h1 class="bbk-checkout-heading">{{ __('checkout.page.title') }}</h1>
+
+        <div class="bbk-checkout">
+            <div
+                class="bbk-checkout-main"
+                data-controller="bbk-checkout-form bbk-payment"
+                data-action="input->bbk-checkout-form#scheduleSave"
+                data-bbk-checkout-form-save-url-value="{{ route('checkout.address.save', app()->getLocale()) }}"
+                data-bbk-checkout-form-select-shipping-url-value="{{ route('checkout.shipping-option.select', app()->getLocale()) }}"
+                data-bbk-checkout-form-status-saving-value="{{ __('checkout.page.saving') }}"
+                data-bbk-checkout-form-status-saved-value="{{ __('checkout.page.saved') }}"
+                data-bbk-checkout-form-status-error-value="{{ __('checkout.page.save_error') }}"
+                data-bbk-payment-select-url-value="{{ route('checkout.payment-method.select', app()->getLocale()) }}"
+                data-bbk-payment-place-order-url-value="{{ route('checkout.place-order', app()->getLocale()) }}"
+                data-bbk-payment-order-status-url-value="{{ route('checkout.order-status', app()->getLocale()) }}"
+                data-bbk-payment-stripe-key-value="{{ config('services.stripe.public_key') }}"
+                data-bbk-payment-amount-value="{{ $cart?->total?->value ?? 0 }}"
+                data-bbk-payment-currency-value="{{ strtolower($cart?->total?->currency?->code ?? 'eur') }}"
+                data-bbk-payment-terms-required-value="{{ __('checkout.page.terms_required') }}"
+                data-bbk-payment-choose-method-value="{{ __('checkout.page.choose_payment_method') }}"
+                data-bbk-payment-generic-error-value="{{ __('checkout.page.payment_failed') }}"
+                data-bbk-payment-processing-slow-value="{{ __('checkout.page.payment_processing_slow') }}"
+            >
+
+                {{-- Contact. Logged in: the order email is the account's (forced
+                     server-side in saveAddress()), so there's no field. Guests type
+                     their email, plus a login link when config('checkout.login_route')
+                     is set; the storefront's login page sends them back here and Lunar
+                     merges the guest cart into the account. --}}
+                @php($loginRoute = config('checkout.login_route'))
+                <section class="bbk-checkout-section">
+                    @auth
+                        <p class="bbk-checkout-logged-in">
+                            {{ __('checkout.page.logged_in_as') }} <strong>{{ auth()->user()->email }}</strong>
+                        </p>
+                    @else
+                        @if ($loginRoute)
+                            <p class="bbk-checkout-login-prompt">
+                                {{ __('checkout.page.login_prompt') }}
+                                <a href="{{ route($loginRoute, ['redirect' => route('checkout.show', app()->getLocale(), false)]) }}">{{ __('checkout.page.login_link') }}</a>
+                            </p>
+                        @endif
+
+                        <x-checkout::field
+                            name="contact_email"
+                            label="{{ __('checkout.page.email_label') }}"
+                            type="email"
+                            :value="$shippingAddress?->contact_email ?? $billingAddress?->contact_email"
+                            required
+                            form="bbk-address-form"
+                        />
+                    @endauth
+
+                    {{-- Abandoned-cart-recovery opt-in. Optional, unticked, never
+                         required — direct marketing under ePrivacy (GR L. 3471/2006
+                         art. 11), so it needs an explicit opt-in and checkout can't be
+                         gated on it. Narrow scope by design (boboko-core's
+                         setRecoveryConsent) — a general newsletter opt-in, if wanted,
+                         is a separate checkbox. --}}
+                    <label class="bbk-checkbox bbk-checkbox--stacked">
+                        <input
+                            type="checkbox"
+                            name="recovery_consent"
+                            value="1"
+                            form="bbk-address-form"
+                            {{ old('recovery_consent', data_get($cart, 'meta.recovery_consent')) ? 'checked' : '' }}
+                        >
+                        {{ __('checkout.page.recovery_consent') }}
+                    </label>
+                </section>
+
+                {{-- Autosaves — no submit button. Any `change` inside .bbk-checkout-main
+                     (this form, plus the contact email/consent which sit outside it but
+                     link via form="bbk-address-form") is debounced and POSTed as the whole
+                     form; the shipping-method radios are excluded in scheduleSave(). --}}
+                <form
+                    id="bbk-address-form"
+                    method="POST"
+                    action="{{ route('checkout.address.save', app()->getLocale()) }}"
+                    data-bbk-checkout-form-target="form"
+                >
+                    @csrf
+
+                    {{-- Billing --}}
+                    <section class="bbk-checkout-section">
+                        <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.billing_heading') }}</h2>
+
+                        <div class="bbk-field-row">
+                            <x-checkout::field name="billing_first_name" label="{{ __('checkout.page.first_name') }}" :value="$billingAddress?->first_name" required />
+                            <x-checkout::field name="billing_last_name" label="{{ __('checkout.page.last_name') }}" :value="$billingAddress?->last_name" required />
+                        </div>
+
+                        {{-- Company/ΑΦΜ only when an invoice is wanted. Revealed by CSS
+                             (:has on the checkbox), saved/cleared by saveAddress(), and
+                             required at place-order. --}}
+                        <div class="bbk-invoice">
+                            <label class="bbk-checkbox">
+                                <input
+                                    type="checkbox"
+                                    name="wants_invoice"
+                                    value="1"
+                                    aria-controls="bbk-invoice-fields"
+                                    @checked($wantsInvoice)
+                                >
+                                {{ __('checkout.page.wants_invoice') }}
+                            </label>
+
+                            <div class="bbk-field-row bbk-invoice-fields" id="bbk-invoice-fields">
+                                <x-checkout::field name="billing_company_name" label="{{ __('checkout.page.company_name') }}" :value="$billingAddress?->company_name" />
+                                <x-checkout::field name="billing_tax_identifier" label="{{ __('checkout.page.tax_identifier') }}" :value="$billingAddress?->tax_identifier" />
+                            </div>
+                        </div>
+
+                        <x-checkout::field name="billing_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$billingAddress?->line_one" required />
+
+                        <div class="bbk-field-row">
+                            <x-checkout::field name="billing_city" label="{{ __('checkout.page.city') }}" :value="$billingAddress?->city" required />
+                            <x-checkout::field name="billing_postcode" label="{{ __('checkout.page.postcode') }}" :value="$billingAddress?->postcode" required />
+                        </div>
+
+                        <x-checkout::region-country
+                            prefix="billing"
+                            :store-country="$storeCountry"
+                            :regions="$regions"
+                            :countries="$countries"
+                            :address="$billingAddress"
+                        />
+
+                        <x-checkout::field name="billing_contact_phone" label="{{ __('checkout.page.phone') }}" type="tel" :value="$billingAddress?->contact_phone" />
+                    </section>
+
+                    {{-- Shipping --}}
+                    <section class="bbk-checkout-section">
+                        <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.shipping_heading') }}</h2>
+
+                        <label class="bbk-checkbox">
+                            <input
+                                type="checkbox"
+                                name="same_as_billing"
+                                value="1"
+                                data-bbk-checkout-form-target="sameAsBilling"
+                                data-action="bbk-checkout-form#toggleSameAsBilling"
+                                @checked($shipToBilling)
+                            >
+                            {{ __('checkout.page.same_as_billing') }}
+                        </label>
+
+                        <div class="bbk-checkout-shipping-fields" data-bbk-checkout-form-target="shippingFields">
+                            <div class="bbk-field-row">
+                                <x-checkout::field name="shipping_first_name" label="{{ __('checkout.page.first_name') }}" :value="$shippingAddress?->first_name" required />
+                                <x-checkout::field name="shipping_last_name" label="{{ __('checkout.page.last_name') }}" :value="$shippingAddress?->last_name" required />
+                            </div>
+
+                            <x-checkout::field name="shipping_line_one" label="{{ __('checkout.page.address_line_one') }}" :value="$shippingAddress?->line_one" required />
+
+                            <div class="bbk-field-row">
+                                <x-checkout::field name="shipping_city" label="{{ __('checkout.page.city') }}" :value="$shippingAddress?->city" required />
+                                <x-checkout::field name="shipping_postcode" label="{{ __('checkout.page.postcode') }}" :value="$shippingAddress?->postcode" required />
+                            </div>
+
+                            <x-checkout::region-country
+                                prefix="shipping"
+                                :store-country="$storeCountry"
+                                :regions="$regions"
+                                :countries="$countries"
+                                :address="$shippingAddress"
+                            />
+
+                            <x-checkout::field name="shipping_contact_phone" label="{{ __('checkout.page.phone') }}" type="tel" :value="$shippingAddress?->contact_phone" />
+                        </div>
+
+                        <x-checkout::textarea
+                            name="shipping_delivery_instructions"
+                            label="{{ __('checkout.page.delivery_instructions') }}"
+                            :value="$shippingAddress?->delivery_instructions"
+                        />
+                    </section>
+                </form>
+
+                <p
+                    class="bbk-checkout-status"
+                    data-bbk-checkout-form-target="status"
+                    role="status"
+                    aria-live="polite"
+                    hidden
+                ></p>
+
+                {{-- Shipping method — resolves from the saved shipping address;
+                     re-rendered as a fragment by bbk-checkout-form after each
+                     autosave / option change. --}}
+                <section class="bbk-checkout-section">
+                    <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.shipping_method_heading') }}</h2>
+
+                    <div id="bbk-shipping-options" data-bbk-checkout-form-target="shippingOptions">
+                        @include('checkout::partials.shipping-options', [
+                            'shippingAddress' => $shippingAddress,
+                            'shippingOptions' => $shippingOptions,
+                        ])
+                    </div>
+                </section>
+
+                {{-- Payment --}}
+                <section class="bbk-checkout-section">
+                    <h2 class="bbk-checkout-section-heading">{{ __('checkout.page.payment_heading') }}</h2>
+
+                    <div id="bbk-payment-methods">
+                        @include('checkout::partials.payment-methods', [
+                            'paymentMethods' => $paymentMethods,
+                            'cart' => $cart,
+                        ])
+                    </div>
+
+                    {{-- Stripe Payment Element mounts here when a Stripe method is picked. --}}
+                    <div class="bbk-payment-element" data-bbk-payment-target="element" hidden></div>
+
+                    <label class="bbk-checkbox bbk-checkbox--stacked">
+                        <input type="checkbox" data-bbk-payment-target="terms">
+                        {!! __('checkout.page.terms_accept', [
+                            'terms' => route('legal.terms', app()->getLocale()),
+                            'privacy' => route('legal.privacy', app()->getLocale()),
+                        ]) !!}
+                    </label>
+
+                    <p class="bbk-checkout-withdrawal">
+                        {!! __('checkout.page.withdrawal_notice', [
+                            'link' => route('legal.shipping-returns', app()->getLocale()),
+                        ]) !!}
+                    </p>
+
+                    <p class="bbk-checkout-error" data-bbk-payment-target="error" role="alert" hidden></p>
+
+                    <button
+                        type="button"
+                        class="bbk-checkout-continue"
+                        data-bbk-payment-target="submit"
+                        data-action="bbk-payment#placeOrder"
+                        @disabled($lines->isEmpty())
+                    >
+                        {{ __('checkout.page.place_order') }}
+                    </button>
+                </section>
+
+                {{-- Fixed overlay while a payment is confirming (3-D Secure / webhook
+                     poll). Inside .bbk-checkout-main so bbk-payment can target it. --}}
+                <div class="bbk-checkout-processing" data-bbk-payment-target="processing" hidden>
+                    <span class="bbk-spinner" aria-hidden="true"></span>
+                    <p data-bbk-payment-target="processingText">{{ __('checkout.page.payment_processing') }}</p>
+                </div>
+
+            </div>
+
+            <aside class="bbk-checkout-aside">
+                <div class="bbk-checkout-summary" data-controller="bbk-cart">
+                    <h2 class="bbk-checkout-summary-heading">{{ __('checkout.page.order_summary_heading') }}</h2>
+                    @include('checkout::partials.cart-error')
+                    <div data-bbk-cart-target="body" aria-live="polite">
+                        @include('checkout::partials.cart-body')
+                    </div>
+                </div>
+            </aside>
+        </div>
+    </div>
+@endsection

resources/views/checkout/partials/cart-body.blade.php

@@ -0,0 +1,121 @@
+{{--
+    Server-rendered cart contents. Rendered inline on first page load inside
+    checkout/drawer.blade.php, and re-fetched + swapped into the drawer by
+    bbk-cart-controller after every mutation. $cart / $lines come from the view
+    composer in CheckoutModuleServiceProvider.
+
+    The data-bbk-cart-* attributes on the root are the module's read API for the
+    host (e.g. the header bag-icon count) — bbk-cart-controller reads them after
+    each swap and re-emits them on the `bbk-cart:updated` window event.
+--}}
+@php($count = $lines->sum('quantity'))
+
+{{-- @dump($lines) --}}
+
+<div
+    class="bbk-cart-content"
+    data-bbk-cart-count="{{ $count }}"
+    data-bbk-cart-total="{{ $cart?->total?->value ?? 0 }}"
+>
+    @if ($lines->isEmpty())
+        <p class="bbk-cart-empty">{{ __('checkout.cart.empty') }}</p>
+    @else
+        <ul class="bbk-cart-items">
+            @each('checkout::partials.cart-line', $lines, 'line')
+        </ul>
+
+        <div class="bbk-cart-summary">
+            <div class="bbk-cart-coupon">
+                @if ($cart?->coupon_code)
+                    <div class="bbk-cart-coupon-applied">
+                        <span class="bbk-cart-coupon-code">{{ $cart->coupon_code }}</span>
+
+                        <form
+                            method="POST"
+                            action="{{ route('checkout.cart.coupon.remove', app()->getLocale()) }}"
+                            data-action="submit->bbk-cart#submit"
+                        >
+                            @csrf
+                            @method('DELETE')
+                            <button type="submit" class="bbk-cart-coupon-remove">
+                                {{ __('checkout.cart.coupon_remove') }}
+                            </button>
+                        </form>
+                    </div>
+                @else
+                    <form
+                        class="bbk-cart-coupon-form"
+                        method="POST"
+                        action="{{ route('checkout.cart.coupon.apply', app()->getLocale()) }}"
+                        data-action="submit->bbk-cart#submit"
+                    >
+                        @csrf
+                        <label class="bbk-visually-hidden" for="bbk-coupon-code">
+                            {{ __('checkout.cart.coupon_label') }}
+                        </label>
+                        <input
+                            type="text"
+                            name="code"
+                            id="bbk-coupon-code"
+                            class="bbk-cart-coupon-input"
+                            placeholder="{{ __('checkout.cart.coupon_placeholder') }}"
+                            autocomplete="off"
+                            required
+                        >
+                        <button type="submit" class="bbk-cart-coupon-submit">
+                            {{ __('checkout.cart.coupon_apply') }}
+                        </button>
+                    </form>
+
+                    @if ($couponError ?? false)
+                        <p class="bbk-cart-coupon-error" role="alert">{{ __('checkout.cart.coupon_invalid') }}</p>
+                    @endif
+                @endif
+            </div>
+
+            <div class="bbk-cart-summary-row">
+                <span>{{ __('checkout.cart.subtotal') }}</span>
+                <span>{{ $cart?->subTotal?->formatted() }}</span>
+            </div>
+
+            @if ($cart?->discountTotal?->value > 0)
+                <div class="bbk-cart-summary-row bbk-cart-summary-row--discount">
+                    <span>{{ __('checkout.cart.discount') }}</span>
+                    <span>&minus;{{ $cart->discountTotal->formatted() }}</span>
+                </div>
+            @endif
+
+            {{-- Shipping + tax appear once the shopper has a shipping address
+                 (i.e. they're on the checkout page). In the drawer, where no
+                 address is set yet, only subtotal + total show. --}}
+            @if ($cart?->shippingAddress)
+                <div class="bbk-cart-summary-row">
+                    <span>{{ __('checkout.cart.shipping') }}</span>
+                    @if ($cart->shippingAddress->shipping_option)
+                        <span>{{ $cart->shippingTotal?->formatted() }}</span>
+                    @else
+                        <span class="bbk-cart-summary-pending">{{ __('checkout.cart.shipping_pending') }}</span>
+                    @endif
+                </div>
+            @endif
+
+            @if ($cart?->taxTotal?->value > 0)
+                <div class="bbk-cart-summary-row">
+                    <span>{{ __('checkout.cart.tax') }}</span>
+                    <span>{{ $cart->taxTotal->formatted() }}</span>
+                </div>
+            @endif
+
+            {{-- Always shown — equals subtotal with nothing else applied,
+                 diverges as discount / shipping / tax come in. --}}
+            <div class="bbk-cart-summary-row bbk-cart-summary-row--total">
+                <span>{{ __('checkout.cart.total') }}</span>
+                <span>{{ $cart?->total?->formatted() }}</span>
+            </div>
+
+            <a class="bbk-cart-checkout" href="{{ route('checkout.show', app()->getLocale()) }}">
+                {{ __('checkout.cart.checkout') }}
+            </a>
+        </div>
+    @endif
+</div>

resources/views/checkout/partials/cart-error.blade.php

@@ -0,0 +1,9 @@
+{{--
+    Shared error slot for any host wrapping cart-body in a bbk-cart controller
+    instance (the drawer, and the checkout page's own order summary) —
+    bbk-cart-controller.js#showError() writes into whichever one is present.
+    Without this element in a given host, a rejected quantity update (e.g.
+    over stock) still gets rejected server-side, but the shopper never sees
+    why.
+--}}
+<p class="bbk-cart-error" data-bbk-cart-target="error" hidden role="alert"></p>

resources/views/checkout/partials/cart-line.blade.php

@@ -0,0 +1,103 @@
+{{--
+    One cart line. $line is a Lunar\Models\CartLine (iteration var set by
+    @each in cart-body). The two forms post through bbk-cart-controller
+    (fetch + method spoofing) and the response re-renders cart-body.
+--}}
+@php
+    $variant = $line->purchasable;
+    $product = $variant?->product;
+    $name = $product?->translateAttribute('name') ?? $variant?->sku ?? '—';
+    // The variant's own image (falls back to the product's thumbnail
+    // internally — see ProductVariant::getThumbnail()) — the specific option
+    // the shopper picked, not just the product in general.
+    $thumb = $variant?->getThumbnailImage() ?: null;
+    $variantLabel = $variant?->getOption();
+    // Not routed through checkout::'s own locale-explicit convention — this
+    // is a storefront route, so it follows the storefront's own (implicit
+    // locale) call shape, same as App\Catalog\ProductCard. Carries the
+    // variant id along so the product page can restore the same option the
+    // shopper actually has in their cart, not just default to the first one
+    // (see product-form-controller.js reading ?variant= on connect()).
+    $productUrl = $product ? route('product.show', ['id' => $product->id, 'variant' => $variant?->id]) : null;
+@endphp
+
+<li class="bbk-cart-item" data-bbk-line-id="{{ $line->id }}">
+    <div class="bbk-cart-item-media">
+        @if ($thumb)
+            @if ($productUrl)
+                <a href="{{ $productUrl }}" aria-hidden="true" tabindex="-1">
+                    <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
+                </a>
+            @else
+                <img src="{{ $thumb }}" alt="{{ $name }}" width="72" height="72" loading="lazy">
+            @endif
+        @endif
+    </div>
+
+    <div class="bbk-cart-item-detail">
+        @if ($productUrl)
+            <a href="{{ $productUrl }}" class="bbk-cart-item-title">{{ $name }}</a>
+        @else
+            <p class="bbk-cart-item-title">{{ $name }}</p>
+        @endif
+        @if ($variantLabel)
+            <p class="bbk-cart-item-variant">{{ $variantLabel }}</p>
+        @endif
+        @include('checkout::partials.line-custom-fields', ['line' => $line])
+        <p class="bbk-cart-item-unit">{{ $line->unitPrice?->formatted() }}</p>
+
+        <form
+            class="bbk-cart-qty"
+            method="POST"
+            action="{{ route('checkout.cart.update', ['locale' => app()->getLocale(), 'line' => $line->id]) }}"
+        >
+            @csrf
+            @method('PATCH')
+            <button
+                type="button"
+                class="bbk-cart-qty-btn"
+                data-action="bbk-cart#step"
+                data-bbk-cart-dir-param="-1"
+                aria-label="{{ __('checkout.cart.decrease') }}"
+            >&minus;</button>
+
+            <input
+                type="number"
+                name="quantity"
+                value="{{ $line->quantity }}"
+                min="0"
+                inputmode="numeric"
+                class="bbk-cart-qty-input"
+                data-action="change->bbk-cart#submit"
+                data-bbk-cart-confirmed-quantity="{{ $line->quantity }}"
+                aria-label="{{ __('checkout.cart.quantity') }}"
+            >
+
+            <button
+                type="button"
+                class="bbk-cart-qty-btn"
+                data-action="bbk-cart#step"
+                data-bbk-cart-dir-param="1"
+                aria-label="{{ __('checkout.cart.increase') }}"
+            >+</button>
+        </form>
+    </div>
+
+    <div class="bbk-cart-item-aside">
+        <p class="bbk-cart-item-total">{{ $line->subTotal?->formatted() }}</p>
+
+        <form
+            method="POST"
+            action="{{ route('checkout.cart.remove', ['locale' => app()->getLocale(), 'line' => $line->id]) }}"
+            data-action="submit->bbk-cart#submit"
+        >
+            @csrf
+            @method('DELETE')
+            <button
+                type="submit"
+                class="bbk-cart-item-remove"
+                aria-label="{{ __('checkout.cart.remove') }}"
+            >&times;</button>
+        </form>
+    </div>
+</li>

resources/views/checkout/partials/line-custom-fields.blade.php

@@ -0,0 +1,50 @@
+{{--
+    @include('checkout::partials.line-custom-fields', ['line' => $line])
+
+    A cart or order line's custom-field answers (meta.custom_fields, written by
+    Cart\Http\Controllers\CartController::customFieldsMeta()). A file answer
+    only carries a File id (Modules\Core\File\Models\File is the source of
+    truth for name/mime/disk/path — never duplicated into meta), resolved
+    here and linked through the signed download route (files.download),
+    minted fresh on every render, with a thumbnail when the browser can
+    display the format (HEIC can't be shown outside Safari, so it gets the
+    name only).
+--}}
+@php
+    $fields = $line->meta['custom_fields'] ?? [];
+    $previewable = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+@endphp
+
+@if (! empty($fields))
+    <dl class="bbk-line-fields">
+        @foreach ($fields as $field)
+            <div class="bbk-line-field">
+                <dt>{{ $field['label'] }}</dt>
+                <dd>
+                    @if ($field['type'] === 'file')
+                        @php
+                            $file = \Modules\Core\File\Models\File::find($field['file_id'] ?? null);
+                        @endphp
+                        @if ($file)
+                            @php
+                                $fileUrl = \Illuminate\Support\Facades\URL::temporarySignedRoute(
+                                    'files.download',
+                                    now()->addHours(2),
+                                    ['file' => $file->id],
+                                );
+                            @endphp
+                            <a href="{{ $fileUrl }}" class="bbk-line-field-file" target="_blank" rel="noopener">
+                                @if (in_array($file->mime, $previewable, true))
+                                    <img src="{{ $fileUrl }}" alt="" width="40" height="40" loading="lazy">
+                                @endif
+                                <span>{{ $file->original_name }}</span>
+                            </a>
+                        @endif
+                    @else
+                        {{ $field['value'] }}
+                    @endif
+                </dd>
+            </div>
+        @endforeach
+    </dl>
+@endif

resources/views/checkout/partials/payment-methods.blade.php

@@ -0,0 +1,30 @@
+{{--
+    Payment method radios. $paymentMethods is Collection<Modules\Core\Payment\
+    Models\PaymentMethod> from CheckoutService::getPaymentMethods() (already
+    filtered to enabled + driver-resolves + isConfigured()). Selecting one
+    autosaves via bbk-payment#selectMethod; `data-payment-driver` tells the
+    controller whether to mount the Stripe Element.
+
+    $paymentMethods, $cart come from the page / controller.
+--}}
+@php($selected = $cart?->meta['payment_method'] ?? null)
+
+@if ($paymentMethods->isEmpty())
+    <p class="bbk-checkout-note">{{ __('checkout.page.payment_method_none') }}</p>
+@else
+    <div class="bbk-checkout-payment-options">
+        @foreach ($paymentMethods as $method)
+            <label class="bbk-checkout-payment-option">
+                <input
+                    type="radio"
+                    name="payment_type"
+                    value="{{ $method->type }}"
+                    data-payment-driver="{{ $method->driver }}"
+                    @checked($selected === $method->type)
+                    data-action="change->bbk-payment#selectMethod"
+                >
+                <span class="bbk-checkout-payment-option-name">{{ $method->translate('name') }}</span>
+            </label>
+        @endforeach
+    </div>
+@endif

resources/views/checkout/partials/shipping-options.blade.php

@@ -0,0 +1,50 @@
+{{--
+    Shipping methods for the checkout page. Rendered inline by page.blade.php on
+    load, and re-rendered as a fragment by CheckoutController after every
+    address save / option change (bbk-checkout-form swaps it in). Radios
+    autosave via bbk-checkout-form#selectShipping — no submit button. A single
+    resolved option is auto-selected server-side and shown as a fixed line.
+
+    $shippingAddress, $shippingOptions come from the controller / page scope.
+--}}
+@php($selected = $shippingAddress?->shipping_option)
+
+{{-- Rate resolution needs country (always Greece here) + postcode; until a
+     postcode is saved there's nothing to quote against yet. --}}
+@if (! $shippingAddress?->postcode)
+    <p class="bbk-checkout-note">{{ __('checkout.page.shipping_method_empty') }}</p>
+@elseif ($shippingOptions->isEmpty())
+    <p class="bbk-checkout-note">{{ __('checkout.page.shipping_method_none') }}</p>
+@elseif ($shippingOptions->count() === 1)
+    @php($only = $shippingOptions->first())
+    <div class="bbk-checkout-shipping-confirmed">
+        <span class="bbk-checkout-shipping-option-detail">
+            <span class="bbk-checkout-shipping-option-name">{{ $only->name }}</span>
+            @if ($only->description)
+                <span class="bbk-checkout-shipping-option-description">{{ strip_tags($only->description) }}</span>
+            @endif
+        </span>
+        <span class="bbk-checkout-shipping-option-price">{{ $only->price->formatted() }}</span>
+    </div>
+@else
+    <div class="bbk-checkout-shipping-options">
+        @foreach ($shippingOptions as $option)
+            <label class="bbk-checkout-shipping-option">
+                <input
+                    type="radio"
+                    name="shipping_option"
+                    value="{{ $option->identifier }}"
+                    @checked($selected === $option->identifier)
+                    data-action="change->bbk-checkout-form#selectShipping"
+                >
+                <span class="bbk-checkout-shipping-option-detail">
+                    <span class="bbk-checkout-shipping-option-name">{{ $option->name }}</span>
+                    @if ($option->description)
+                        <span class="bbk-checkout-shipping-option-description">{{ strip_tags($option->description) }}</span>
+                    @endif
+                </span>
+                <span class="bbk-checkout-shipping-option-price">{{ $option->price->formatted() }}</span>
+            </label>
+        @endforeach
+    </div>
+@endif

resources/views/order/notifications/completed.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is complete. Thanks for shopping with us!</p>

resources/views/order/notifications/dispatched.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is on its way.</p>

resources/views/order/notifications/pickup-ready.blade.php

@@ -0,0 +1,3 @@
+<p>Hi,</p>
+
+<p>Your order <strong>{{ $reference }}</strong> is ready for pickup in store.</p>

resources/views/order/notifications/placed.blade.php

@@ -0,0 +1,11 @@
+<p>Hi,</p>
+
+<p>Thanks for your order! Your order <strong>{{ $reference }}</strong> is confirmed.</p>
+
+<ul>
+    @foreach ($lines as $line)
+        <li>{{ $line->quantity }} &times; {{ $line->description }} — {{ $line->total?->formatted }}</li>
+    @endforeach
+</ul>
+
+<p>Total: <strong>{{ $total }}</strong></p>

resources/views/shipping/filament/pages/manage-pickup-manifests.blade.php

@@ -1,3 +0,0 @@
-<x-filament-panels::page>
-    {{ $this->table }}
-</x-filament-panels::page>

src/Auth/Events/UserAuthenticated.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Modules\Core\Auth\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Base\LunarUser;
+
+/**
+ * Dispatched by UserOtpService::validate() on every successful OTP login, not just
+ * a first-time one. Modules\Core\Privacy listens on this to auto-cancel a pending
+ * DataErasureRequest — logging back in during the grace period is the "I changed
+ * my mind" action (see Modules\Core\Privacy\Listeners\CancelErasureOnLoginListener),
+ * which needs $user->customers to resolve any pending request. Typed as
+ * Authenticatable&LunarUser rather than plain Authenticatable (unlike the sibling
+ * UserCreated event) specifically because that listener depends on it — every real
+ * User in this codebase implements LunarUser (see docs/lunar.md "LunarUser trait"),
+ * and User is the only Authenticatable entity in this project (Customer is not —
+ * see docs/modules.md "Customer/User Pairing").
+ */
+class UserAuthenticated
+{
+    public function __construct(
+        public readonly Authenticatable&LunarUser $user,
+    ) {}
+}

src/Auth/Events/UserEmailChanged.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace Modules\Core\Auth\Events;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+
+/**
+ * Dispatched by Customer\Services\CustomerEmailChangeService::confirm()
+ * once a login-email change actually takes effect — $oldEmail is what the
+ * account's login used to be, already overwritten on $user by the time
+ * this fires.
+ */
+class UserEmailChanged
+{
+    public function __construct(
+        public readonly Authenticatable $user,
+        public readonly string $oldEmail,
+    ) {}
+}

src/Auth/Exceptions/OtpThrottledException.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Modules\Core\Auth\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by Modules\Core\Auth\Services\UserOtpService::generateAndSend()
+ * when an email has requested too many codes too quickly — caps both
+ * mail-bombing one inbox and the "just request a fresh code to reset my
+ * guess count" loophole a per-code attempt cap alone doesn't close.
+ */
+class OtpThrottledException extends RuntimeException
+{
+    public function __construct(
+        public readonly int $availableInSeconds,
+    ) {
+        parent::__construct("Too many code requests. Try again in {$availableInSeconds} second(s).");
+    }
+}

src/Auth/Http/Middleware/EnsureSessionNotRevoked.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Modules\Core\Auth\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Modules\Core\Auth\Services\UserSessionService;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * The enforcement half of the session registry — see
+ * Modules\Core\Auth\Services\UserSessionService's own docblock. Not
+ * auto-registered anywhere (no routes/kernel wiring exist in this
+ * package — see Modules\Core\Customer\Services\CustomerAccountService's
+ * own docblock for why this branch stops at services); a consuming app
+ * adds this to its `web` middleware group (after `auth`) to actually get
+ * "logout everywhere" enforcement.
+ *
+ * A request with no recorded UserSession at all (see
+ * UserSessionService::currentSession()'s own docblock) is let through —
+ * only an EXPLICITLY revoked session is rejected.
+ */
+class EnsureSessionNotRevoked
+{
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $session = $this->sessions->currentSession();
+
+        if ($session && $session->isRevoked()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            abort(401, 'Your session has been revoked. Please log in again.');
+        }
+
+        $session?->update(['last_used_at' => now()]);
+
+        return $next($request);
+    }
+}

src/Auth/Listeners/RecordLegalAcceptanceForNewUser.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Auth\Listeners;
+
+use Modules\Core\Auth\Events\UserCreated;
+
+/**
+ * The storefront login page shows a terms/privacy notice ("By continuing,
+ * you accept the Terms of Use and have read the Privacy Policy") that
+ * requesting an OTP code implicitly accepts — recorded once, right here,
+ * for a genuinely new signup only (UserCreated fires exactly once per
+ * user, from Auth\Services\UserOtpService::generateAndSend()'s own
+ * wasRecentlyCreated check). An existing user's original acceptance
+ * (whatever version was live when THEY signed up) must never be
+ * overwritten by whatever config('legal.*') says today, which is exactly
+ * why this only ever runs from UserCreated and nowhere else.
+ */
+class RecordLegalAcceptanceForNewUser
+{
+    public function handle(UserCreated $event): void
+    {
+        $event->user->forceFill([
+            'terms_accepted_at' => now(),
+            'terms_version' => config('legal.terms_version'),
+            'privacy_policy_version' => config('legal.privacy_policy_version'),
+        ])->save();
+    }
+}

src/Auth/Mail/EmailChangeCodeMail.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Modules\Core\Auth\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * Sent to the NEW address a shopper is trying to switch their login email
+ * to (Customer\Services\CustomerEmailChangeService::request()) — proves
+ * they can actually receive mail there before the switch takes effect.
+ * View overridable per-app the same way UserOtpMail's is (resources/
+ * views/vendor/core/auth/mail/email-change-code.blade.php).
+ */
+class EmailChangeCodeMail extends Mailable
+{
+    public function __construct(
+        public readonly string $code,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: 'Confirm your new email address');
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'core::auth.mail.email-change-code');
+    }
+}

src/Auth/Mail/EmailChangedNoticeMail.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Modules\Core\Auth\Mail;
+
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+
+/**
+ * Sent to the OLD address once a login-email change actually takes
+ * effect (Customer\Services\CustomerEmailChangeService::confirm()) — lets
+ * the previous owner notice if someone else changed it from a hijacked
+ * session. Shows the new address masked (first character + domain only),
+ * never the full new address — this notice's whole point is alerting the
+ * OLD owner, not handing them the new address outright. View overridable
+ * per-app the same way UserOtpMail's is (resources/views/vendor/core/
+ * auth/mail/email-changed-notice.blade.php).
+ */
+class EmailChangedNoticeMail extends Mailable
+{
+    public readonly string $maskedEmail;
+
+    public function __construct(string $newEmail)
+    {
+        [$local, $domain] = explode('@', $newEmail, 2);
+
+        $this->maskedEmail = mb_substr($local, 0, 1).'•••@'.$domain;
+    }
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(subject: 'Your account email was changed');
+    }
+
+    public function content(): Content
+    {
+        return new Content(view: 'core::auth.mail.email-changed-notice');
+    }
+}

src/Auth/Mail/OtpMail.php

@@ -6,20 +6,47 @@ use Illuminate\Mail\Mailable;
 use Illuminate\Mail\Mailables\Content;
 use Illuminate\Mail\Mailables\Envelope;
 
+/**
+ * The one OTP email template for every use of Auth\Services\OtpService —
+ * not just admin login. A code confirming a destructive Artisan command
+ * (e.g. Command\WipeCatalogCommand) reuses the exact same generation/
+ * validation mechanism as login, but "Your login code" as the subject
+ * would be actively misleading for that — the recipient never initiated a
+ * login. $purpose is a small, fixed set of known keys (see
+ * COPY_BY_PURPOSE), not free text — a typo'd/unknown purpose falls back
+ * to 'login' rather than rendering a blank subject/intro.
+ */
 class OtpMail extends Mailable
 {
+    private const COPY_BY_PURPOSE = [
+        'login' => [
+            'subject' => 'Your login code',
+            'intro' => 'Your login code is:',
+        ],
+        'wipe-catalog' => [
+            'subject' => 'Confirm: Wipe Catalog',
+            'intro' => 'Someone requested to permanently delete every product in the catalog. If this was you, enter this code to confirm:',
+        ],
+    ];
+
     public function __construct(
         public readonly string $name,
         public readonly string $code,
+        public readonly string $purpose = 'login',
     ) {}
 
     public function envelope(): Envelope
     {
-        return new Envelope(subject: 'Your login code');
+        return new Envelope(subject: $this->copy()['subject']);
     }
 
     public function content(): Content
     {
-        return new Content(view: 'core::auth.mail.otp');
+        return new Content(view: 'core::auth.mail.otp', with: ['intro' => $this->copy()['intro']]);
+    }
+
+    private function copy(): array
+    {
+        return self::COPY_BY_PURPOSE[$this->purpose] ?? self::COPY_BY_PURPOSE['login'];
     }
 }

src/Auth/Models/UserSession.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Core\Auth\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * One row per login (see Modules\Core\Auth\Services\UserOtpService::
+ * validate()) — see that table's own migration docblock for why this
+ * exists independent of the actual session-store driver.
+ */
+class UserSession extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'last_used_at' => 'datetime',
+        'revoked_at' => 'datetime',
+    ];
+
+    public function user(): BelongsTo
+    {
+        $model = config('auth.providers.users.model');
+
+        return $this->belongsTo($model);
+    }
+
+    public function isRevoked(): bool
+    {
+        return $this->revoked_at !== null;
+    }
+}

src/Auth/Privacy/UserSessionDataProvider.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Modules\Core\Auth\Privacy;
+
+use Modules\Core\Auth\Models\UserSession;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Login-session device/location metadata (user_sessions) — ip_address and
+ * user_agent are device/location fingerprinting data tied 1:1 to a User via
+ * user_id, never to a Customer (business account), so this is User-scope
+ * only. No legal retention requirement applies to session metadata the way
+ * it does to Order (there's no tax/accounting reason to keep old login IPs
+ * around), so rows are deleted outright rather than pseudonymized.
+ *
+ * A hard delete here is safe regardless of whether the User row itself has
+ * already been erased — CustomerDataProvider::eraseForUser() nulls the
+ * User's own name/email but never touches user_sessions, and the table's
+ * own user_id FK is cascadeOnDelete() only if the User row itself were
+ * hard-deleted, which it never is (erasure here means "identity nulled,"
+ * not "row removed" — see docs/modules.md "Customer/User Pairing").
+ */
+class UserSessionDataProvider implements PersonalDataProvider
+{
+    public function name(): string
+    {
+        return 'sessions';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('sessions', []);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        $sessions = UserSession::where('user_id', $subject->userId)->get();
+
+        return new ProviderExportResult('sessions', $sessions->map(fn (UserSession $session) => [
+            'id' => $session->id,
+            'ip_address' => $session->ip_address,
+            'user_agent' => $session->user_agent,
+            'last_used_at' => $session->last_used_at?->toIso8601String(),
+            'revoked_at' => $session->revoked_at?->toIso8601String(),
+        ])->all());
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'Login sessions belong to individual Users, not Customer accounts.');
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        $deleted = UserSession::where('user_id', $subject->userId)->delete();
+
+        if ($deleted === 0) {
+            return new ProviderErasureResult('sessions', ErasureOutcome::Skipped, 'No login sessions for this user.');
+        }
+
+        return new ProviderErasureResult('sessions', ErasureOutcome::Erased);
+    }
+}

src/Auth/Services/OtpService.php

@@ -11,7 +11,13 @@ class OtpService
     private const EXPIRY_MINUTES = 10;
     private const CODE_LENGTH = 6;
 
-    public function generateAndSend(string $email): bool
+    /**
+     * $purpose is forwarded as-is to OtpMail, which only recognizes a
+     * fixed set of keys (see its own COPY_BY_PURPOSE) — an unrecognized
+     * value there just falls back to 'login' rather than failing here, so
+     * this method has nothing of its own to validate.
+     */
+    public function generateAndSend(string $email, string $purpose = 'login'): bool
     {
         $staff = Staff::where('email', $email)->first();
 
@@ -25,7 +31,7 @@ class OtpService
         $staff->otp_expires_at = now()->addMinutes(self::EXPIRY_MINUTES);
         $staff->save();
 
-        Mail::to($staff->email)->send(new OtpMail($staff->first_name, $code));
+        Mail::to($staff->email)->send(new OtpMail($staff->first_name, $code, $purpose));
 
         return true;
     }

src/Auth/Services/UserOtpService.php

@@ -2,47 +2,241 @@
 
 namespace Modules\Core\Auth\Services;
 
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Auth\Events\UserCreated;
+use Modules\Core\Auth\Exceptions\OtpThrottledException;
 use Modules\Core\Auth\Mail\UserOtpMail;
 
+/**
+ * The storefront's passwordless login — a shopper supplies only an email
+ * (Shopify-style), gets a 6-digit code, and validate() authenticates the
+ * `web` guard via Auth::login().
+ *
+ * That alone is enough to merge/associate any active guest cart into the
+ * now-known customer — Auth::login() fires Illuminate\Auth\Events\Login,
+ * which Lunar's own Lunar\Listeners\CartSessionAuthListener (registered
+ * unconditionally in LunarServiceProvider::boot(), no opt-in needed)
+ * already listens to, calling CartSession::associate() with
+ * config('lunar.cart.auth_policy') — 'merge' by default, 'override' if a
+ * consumer changes that config. Deliberately no cart-association call
+ * here: doing our own on top would run a SECOND merge attempt with a
+ * hardcoded policy that ignores whatever the consumer configured.
+ *
+ * generateAndSend() does NOT create a User row for an email it hasn't
+ * seen before — it used to (firstOrCreate() ran unconditionally), which
+ * meant this login FORM was effectively a registration form: anyone could
+ * create a real User (and, via UserCreated's own cascade, a paired
+ * Customer) for any email address they liked, whether or not a single
+ * correct code was ever entered. A genuinely new email's pending code now
+ * lives in the cache (see pendingKey()), keyed by email, with no DB row
+ * at all — firstOrCreate() and UserCreated only fire from validate(), and
+ * only once the code has actually been proven correct. An email that
+ * already has a User row is unaffected: its OTP state still lives on that
+ * row's own otp_code/otp_expires_at/otp_attempts columns exactly as
+ * before, so a returning shopper's login is unchanged.
+ *
+ * Two independent throttles, both configured under core.auth.otp — see
+ * config/core.php's own comment for why they're separate: max_attempts
+ * caps wrong guesses against ONE code; generation_limit caps how often a
+ * NEW code can be requested for the same email at all (closes both the
+ * "regenerate to reset my guess count" loophole and mail-bombing one
+ * inbox). Both apply identically whether or not a User row exists yet.
+ *
+ * validate() also records a UserSessionService entry for the new login —
+ * see that class's own docblock for the "logout everywhere" registry
+ * this feeds (Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked
+ * is the enforcement half; a consuming app must add it to its own
+ * middleware stack). $request is optional purely so this service stays
+ * callable from a context with no HTTP request at all (a console
+ * command, a test) — user-agent/ip are simply not recorded when omitted.
+ */
 class UserOtpService
 {
     private const EXPIRY_MINUTES = 10;
     private const CODE_LENGTH = 6;
 
+    public function __construct(
+        private readonly UserSessionService $sessions,
+    ) {}
+
+    /**
+     * @throws OtpThrottledException if this email has requested too many
+     *   codes within core.auth.otp.generation_decay_minutes
+     */
     public function generateAndSend(string $email): bool
     {
-        $model = config('auth.providers.users.model');
-        $user = $model::firstOrCreate(['email' => $email]);
+        $limiterKey = $this->generationLimiterKey($email);
+        $maxGenerations = (int) config('core.auth.otp.generation_limit', 3);
 
+        if (RateLimiter::tooManyAttempts($limiterKey, $maxGenerations)) {
+            throw new OtpThrottledException(RateLimiter::availableIn($limiterKey));
+        }
+
+        RateLimiter::hit($limiterKey, (int) config('core.auth.otp.generation_decay_minutes', 10) * 60);
+
+        $model = config('auth.providers.users.model');
+        $user = $model::where('email', $email)->first();
         $code = str_pad((string) random_int(0, 999999), self::CODE_LENGTH, '0', STR_PAD_LEFT);
 
-        $user->otp_code = $code;
-        $user->otp_expires_at = now()->addMinutes(self::EXPIRY_MINUTES);
-        $user->save();
+        if ($user) {
+            $user->otp_code = $code;
+            $user->otp_expires_at = now()->addMinutes(self::EXPIRY_MINUTES);
+            $user->otp_attempts = 0;
+            $user->save();
+        } else {
+            // No row yet — deliberately not created here. See this
+            // class's own docblock for why: creating one on every
+            // generateAndSend() call let anyone mint real User/Customer
+            // rows for an email nobody proved they owned.
+            Cache::put($this->pendingKey($email), [
+                'code' => $code,
+                'expires_at' => now()->addMinutes(self::EXPIRY_MINUTES)->timestamp,
+                'attempts' => 0,
+            ], now()->addMinutes(self::EXPIRY_MINUTES));
+        }
 
-        Mail::to($user->email)->send(new UserOtpMail($user->name ?? $user->email, $code));
+        Mail::to($email)->send(new UserOtpMail($user->name ?? $email, $code));
 
         return true;
     }
 
-    public function validate(string $email, string $code)
+    /**
+     * A wrong code counts against core.auth.otp.max_attempts and, once
+     * reached, invalidates the code entirely — the shopper must request
+     * a fresh one via generateAndSend() (itself throttled independently
+     * — see this class's own docblock) rather than being able to keep
+     * guessing against a still-live code for the rest of its 10-minute
+     * expiry window. Applies identically to the cache-backed (no User row
+     * yet) and DB-backed (existing User row) paths.
+     */
+    public function validate(string $email, string $code, ?Request $request = null): ?Authenticatable
     {
         $model = config('auth.providers.users.model');
-        $user = $model::where('email', $email)->first();
+        $existing = $model::where('email', $email)->exists();
 
-        if (! $user) {
+        $result = $existing
+            ? $this->validateExisting($model, $email, $code)
+            : $this->validatePending($model, $email, $code);
+
+        if (! $result) {
             return null;
         }
 
-        if (! $user->otp_expires_at || $user->otp_code != $code || now()->isAfter($user->otp_expires_at)) {
-            return null;
-        }
+        RateLimiter::clear($this->generationLimiterKey($email));
 
-        $user->otp_code = null;
-        $user->otp_expires_at = null;
-        $user->save();
+        Auth::login($result);
 
-        return $user;
+        $this->sessions->record($result, $request);
+
+        Event::dispatch(new UserAuthenticated($result));
+
+        return $result;
+    }
+
+    /**
+     * lockForUpdate() + a transaction make the read-check-increment-save
+     * atomic across concurrent requests for the same user — without it,
+     * two guesses fired in parallel can each read the same pre-increment
+     * otp_attempts value and both save past max_attempts, letting an
+     * attacker exceed the lockout by parallelizing requests instead of
+     * sending them serially.
+     */
+    private function validateExisting(string $model, string $email, string $code): ?Authenticatable
+    {
+        return DB::transaction(function () use ($model, $email, $code) {
+            $user = $model::where('email', $email)->lockForUpdate()->first();
+
+            if (! $user || ! $user->otp_expires_at || now()->isAfter($user->otp_expires_at)) {
+                return null;
+            }
+
+            if (! hash_equals((string) $user->otp_code, $code)) {
+                $user->otp_attempts++;
+
+                if ($user->otp_attempts >= (int) config('core.auth.otp.max_attempts', 5)) {
+                    $user->otp_code = null;
+                    $user->otp_expires_at = null;
+                    $user->otp_attempts = 0;
+                }
+
+                $user->save();
+
+                return null;
+            }
+
+            $user->otp_code = null;
+            $user->otp_expires_at = null;
+            $user->otp_attempts = 0;
+            $user->save();
+
+            return $user;
+        });
+    }
+
+    /**
+     * No User row exists yet, so there's nothing to lockForUpdate() —
+     * Cache::lock() is the equivalent guard against two parallel guesses
+     * against the same pending signup both reading the same pre-increment
+     * attempts count. The User (and, via UserCreated, its paired Customer)
+     * is only ever created here, once the code has actually been proven
+     * correct — never from generateAndSend().
+     */
+    private function validatePending(string $model, string $email, string $code): ?Authenticatable
+    {
+        $key = $this->pendingKey($email);
+
+        return Cache::lock("{$key}:lock", 10)->block(5, function () use ($model, $email, $code, $key) {
+            $pending = Cache::get($key);
+
+            if (! $pending || now()->timestamp > $pending['expires_at']) {
+                return null;
+            }
+
+            if (! hash_equals((string) $pending['code'], $code)) {
+                $pending['attempts']++;
+
+                if ($pending['attempts'] >= (int) config('core.auth.otp.max_attempts', 5)) {
+                    Cache::forget($key);
+                } else {
+                    Cache::put($key, $pending, now()->addMinutes(self::EXPIRY_MINUTES));
+                }
+
+                return null;
+            }
+
+            Cache::forget($key);
+
+            $user = $model::firstOrCreate(['email' => $email]);
+
+            // wasRecentlyCreated is Eloquent's own "did firstOrCreate()
+            // just INSERT, or did it find an existing row" flag. Always
+            // true here in practice (validatePending() only runs when no
+            // row existed moments ago), but checked anyway rather than
+            // assumed, in case of an extremely unlikely race with a
+            // signup completed through some other path in between.
+            if ($user->wasRecentlyCreated) {
+                Event::dispatch(new UserCreated($user));
+            }
+
+            return $user;
+        });
+    }
+
+    private function generationLimiterKey(string $email): string
+    {
+        return 'otp-generate:'.strtolower($email);
+    }
+
+    private function pendingKey(string $email): string
+    {
+        return 'otp-pending:'.strtolower($email);
     }
 }

src/Auth/Services/UserSessionService.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Modules\Core\Auth\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Modules\Core\Auth\Models\UserSession;
+
+/**
+ * The record/revoke half of the session registry — see
+ * database/migrations/2026_09_15_000001_create_user_sessions_table.php's
+ * own docblock for why this exists (SESSION_DRIVER=redis in this app has
+ * no "sessions" table to purge by user_id). The enforcement half is
+ * Modules\Core\Auth\Http\Middleware\EnsureSessionNotRevoked, which reads
+ * the token this class stamps into the session payload.
+ */
+class UserSessionService
+{
+    private const SESSION_TOKEN_KEY = 'user_session_token';
+
+    /**
+     * Called once, right after Auth::login() succeeds (see
+     * UserOtpService::validate()) — generates a fresh token, records it,
+     * and stamps it into the CURRENT session payload so
+     * EnsureSessionNotRevoked can look it up on later requests.
+     */
+    public function record(Authenticatable $user, ?Request $request = null): UserSession
+    {
+        $token = Str::random(64);
+
+        $session = UserSession::create([
+            'user_id' => $user->getAuthIdentifier(),
+            'token' => $token,
+            'user_agent' => $request?->userAgent(),
+            'ip_address' => $request?->ip(),
+            'last_used_at' => now(),
+        ]);
+
+        session([self::SESSION_TOKEN_KEY => $token]);
+
+        return $session;
+    }
+
+    /**
+     * Revokes every OTHER active session for $user — the current one
+     * (matched by the token in the CURRENT session payload) is left
+     * alone, matching Laravel's own logoutOtherDevices() semantics
+     * (there just isn't a password to re-verify against here — this is a
+     * passwordless account, so revocation is simply "every row that
+     * isn't the one making this request").
+     *
+     * Known, deliberately accepted gap: this requires only a currently
+     * valid session, not a freshly-completed login — so anyone holding
+     * an already-authenticated session (e.g. someone who sits down at an
+     * account left logged in on a shared/public PC) can use this to
+     * evict the real owner's OTHER sessions just as easily as the real
+     * owner could use it to evict an intruder's. A stricter version would
+     * require a fresh OTP re-verification (e.g. within the last few
+     * minutes) before allowing this call. Left as-is for now — revisit if
+     * this turns out to matter in practice, rather than building
+     * abuse-resistance against a threat model nobody's confirmed is real
+     * for this storefront.
+     */
+    public function revokeOtherSessions(Authenticatable $user): int
+    {
+        $currentToken = session(self::SESSION_TOKEN_KEY);
+
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->when($currentToken, fn ($query) => $query->where('token', '!=', $currentToken))
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * Revokes EVERY session for $user, current one included — for a
+     * "this account may be compromised" response, not a routine logout.
+     */
+    public function revokeAllSessions(Authenticatable $user): int
+    {
+        return UserSession::query()
+            ->where('user_id', $user->getAuthIdentifier())
+            ->whereNull('revoked_at')
+            ->update(['revoked_at' => now()]);
+    }
+
+    /**
+     * @return UserSession|null null if the CURRENT session has no
+     *   recorded token at all (e.g. a session predating this feature, or
+     *   one Auth::login() established outside UserOtpService) — treated
+     *   as valid by EnsureSessionNotRevoked rather than rejected, since
+     *   there's nothing to have been revoked.
+     */
+    public function currentSession(): ?UserSession
+    {
+        $token = session(self::SESSION_TOKEN_KEY);
+
+        if (! $token) {
+            return null;
+        }
+
+        return UserSession::where('token', $token)->first();
+    }
+}

src/Cart/Commands/DetectAbandonedCarts.php

@@ -5,7 +5,7 @@ namespace Modules\Core\Cart\Commands;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Event;
 use Lunar\Models\Cart;
-use Modules\Core\Cart\Filament\Resources\CartResource;
+use Modules\Core\Cart\Services\CartLifecycleService;
 use Modules\Core\Recovery\Events\CartAbandoned;
 use Modules\Core\Recovery\Events\CheckoutAbandoned;
 
@@ -37,7 +37,14 @@ use Modules\Core\Recovery\Events\CheckoutAbandoned;
  * sends (Checkout\Services\CheckoutService::setRecoveryConsent() is where
  * that consent is actually recorded), and a non-consenting cart's
  * abandonment must never be dispatched at all, not merely filtered later
- * at send time — see docs referenced above for the legal reasoning.
+ * at send time — see docs referenced above for the legal reasoning. This
+ * consent filter stays here rather than on Modules\Core\Cart\Services\
+ * CartLifecycleService, whose two "abandoned" queries this command builds
+ * on — dispatch eligibility is this command's own concern, not part of
+ * what "abandoned" means to a staff member browsing the admin panel. (The
+ * non-empty-lines requirement, by contrast, IS part of what "abandoned"
+ * means either way, so it lives on CartLifecycleService::abandonedCarts()
+ * itself, not here.)
  */
 class DetectAbandonedCarts extends Command
 {
@@ -45,33 +52,22 @@ class DetectAbandonedCarts extends Command
 
     protected $description = 'Dispatch CartAbandoned/CheckoutAbandoned for carts that just crossed the abandonment threshold.';
 
-    public function handle(): void
+    public function handle(CartLifecycleService $lifecycle): void
     {
-        $cutoff = CartResource::abandonedCutoff();
-
         $cartsAbandoned = 0;
         $checkoutsAbandoned = 0;
 
-        Cart::query()
-            ->whereDoesntHave('orders')
-            ->where('updated_at', '<=', $cutoff)
+        $lifecycle->abandonedCarts(Cart::query())
             ->where('meta->recovery_consent', true)
-            ->with('lines')
             ->chunkById(200, function ($carts) use (&$cartsAbandoned) {
                 foreach ($carts as $cart) {
-                    if ($cart->lines->isEmpty()) {
-                        continue;
-                    }
-
                     Event::dispatch(new CartAbandoned($cart));
 
                     $cartsAbandoned++;
                 }
             });
 
-        Cart::query()
-            ->whereHas('orders', fn ($query) => $query->whereNull('placed_at'))
-            ->where('updated_at', '<=', $cutoff)
+        $lifecycle->abandonedCheckouts(Cart::query())
             ->where('meta->recovery_consent', true)
             ->with(['orders' => fn ($query) => $query->whereNull('placed_at')])
             ->chunkById(200, function ($carts) use (&$checkoutsAbandoned) {

src/Cart/Filament/Resources/CartResource.php

@@ -9,20 +9,22 @@ use Modules\Core\Cart\Filament\Resources\CartResource\Pages\ViewCart;
 use Filament\Resources\Resource;
 use Filament\Tables;
 use Filament\Tables\Table;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Carbon;
 use Lunar\Admin\Filament\Resources\CustomerResource;
 use Lunar\Models\Cart;
 use Modules\Core\Cart\Filament\Resources\CartResource\Pages;
+use Modules\Core\Cart\Services\CartLifecycleService;
 
 /**
  * Read-only — a cart is managed entirely through the storefront (add/update/remove
- * line, checkout), never hand-edited by staff. Scoped to carts with a known
- * `user_id`/`customer_id` only: an anonymous guest's session cart carries no
- * identity a staff member could act on (no name, no email, nothing to follow up
- * with), so listing every such row would be noise, not a real admin capability —
- * see docs/cart.md for the reasoning (Lunar itself ships no cart admin view at all
- * to follow a precedent from).
+ * line, checkout), never hand-edited by staff. Lists every cart, guest carts
+ * included — see docs/cart.md ("Scope: every cart, identified or not"). An
+ * anonymous cart's Customer/User columns just render "—" (see table() below)
+ * rather than the row being hidden outright: most real traffic never reaches
+ * an identified user/customer, and "how many carts are ongoing/abandoned
+ * right now" is a real reporting need regardless of identity — excluding
+ * anonymous carts would silently undercount it. Lunar itself ships no cart
+ * admin view at all to follow a precedent from.
  */
 class CartResource extends Resource
 {
@@ -36,12 +38,6 @@ class CartResource extends Resource
 
     protected static ?string $pluralModelLabel = 'Carts';
 
-    public static function getEloquentQuery(): Builder
-    {
-        return parent::getEloquentQuery()
-            ->where(fn (Builder $query) => $query->whereNotNull('user_id')->orWhereNotNull('customer_id'));
-    }
-
     /**
      * Count only, not a fetch — no rows are loaded. Combines BOTH abandoned
      * states (`active()` already covers "no order at all" and "draft order,
@@ -56,6 +52,11 @@ class CartResource extends Resource
         return (string) static::getEloquentQuery()->active()->where('updated_at', '<=', static::abandonedCutoff())->count();
     }
 
+    public static function lifecycle(): CartLifecycleService
+    {
+        return app(CartLifecycleService::class);
+    }
+
     /**
      * `Cart::scopeActive()` (not-yet-converted-to-an-order carts) mixes two very
      * different things together: a cart someone is actively shopping in right now,
@@ -67,7 +68,7 @@ class CartResource extends Resource
      */
     public static function abandonedCutoff(): Carbon
     {
-        return now()->sub(config('core.cart.abandoned_after', '1 hour'));
+        return static::lifecycle()->abandonedCutoff();
     }
 
     public static function table(Table $table): Table

src/Cart/Filament/Resources/CartResource/Pages/ListCarts.php

@@ -6,6 +6,7 @@ use Filament\Schemas\Components\Tabs\Tab;
 use Filament\Resources\Pages\ListRecords;
 use Illuminate\Database\Eloquent\Builder;
 use Modules\Core\Cart\Filament\Resources\CartResource;
+use Modules\Core\Cart\Services\CartLifecycleService;
 
 class ListCarts extends ListRecords
 {
@@ -27,30 +28,24 @@ class ListCarts extends ListRecords
      * bucket — same distinction Modules\Core\Recovery\Events\CartAbandoned /
      * Modules\Core\Recovery\Events\CheckoutAbandoned draw.
      *
-     * "Ongoing" vs the two abandoned tabs all split on `updated_at` against
-     * `CartResource::abandonedCutoff()` — Lunar has no time-based staleness
-     * signal of its own, so recent activity is the only thing distinguishing a
-     * cart someone is shopping in right now from one genuinely left behind.
+     * The four query shapes below live on Modules\Core\Cart\Services\
+     * CartLifecycleService, shared with Modules\Core\Cart\Commands\
+     * DetectAbandonedCarts — see that service's docblock for why duplicating
+     * them independently in both places was worth centralizing.
      */
     public function getTabs(): array
     {
+        $lifecycle = app(CartLifecycleService::class);
+
         return [
             'abandoned_cart' => Tab::make('Abandoned Cart')
-                ->modifyQueryUsing(fn(Builder $query) => $query
-                    ->whereDoesntHave('orders')
-                    ->where('updated_at', '<=', CartResource::abandonedCutoff())),
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->abandonedCarts($query)),
             'abandoned_checkout' => Tab::make('Abandoned Checkout')
-                ->modifyQueryUsing(fn(Builder $query) => $query
-                    ->whereHas('orders', fn(Builder $query) => $query->whereNull('placed_at'))
-                    ->where('updated_at', '<=', CartResource::abandonedCutoff())),
-
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->abandonedCheckouts($query)),
             'ongoing' => Tab::make('Ongoing')
-                ->modifyQueryUsing(fn(Builder $query) => $query->active()->where('updated_at', '>', CartResource::abandonedCutoff())),
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->ongoing($query)),
             'completed' => Tab::make('Completed')
-                ->modifyQueryUsing(fn(Builder $query) => $query->whereHas(
-                    'orders',
-                    fn(Builder $query) => $query->whereNotNull('placed_at'),
-                )),
+                ->modifyQueryUsing(fn (Builder $query) => $lifecycle->completed($query)),
         ];
     }
 }

src/Cart/Filament/Resources/CartResource/Pages/ViewCart.php

@@ -5,12 +5,19 @@ namespace Modules\Core\Cart\Filament\Resources\CartResource\Pages;
 use Filament\Schemas\Schema;
 use Filament\Schemas\Components\Section;
 use Filament\Actions\Action;
+use Filament\Infolists\Components\ImageEntry;
 use Filament\Infolists\Components\RepeatableEntry;
 use Filament\Infolists\Components\TextEntry;
 use Filament\Resources\Pages\ViewRecord;
+use Filament\Support\Colors\Color;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Support\Facades\Blade;
 use Lunar\Admin\Filament\Resources\CustomerResource;
+use Lunar\Admin\Filament\Resources\ProductResource\Pages\EditProduct;
+use Lunar\Exceptions\MissingCurrencyPriceException;
 use Lunar\Models\Cart;
 use Lunar\Models\CartLine;
+use Lunar\Models\ProductVariant;
 use Modules\Core\Cart\Filament\Resources\CartResource;
 
 class ViewCart extends ViewRecord
@@ -35,13 +42,39 @@ class ViewCart extends ViewRecord
      * (a single view page load), not per-row in the list table, since running the
      * full pipeline for every row of a paginated table would be expensive for no
      * real benefit — see docs/lunar.md's Cart gotchas.
+     *
+     * Eager-loads what the Lines section (below) reads off each line's
+     * purchasable — name, thumbnail, options — the same relations Lunar's
+     * own OrderItemsTable loads for an order's line items (`with(['purchasable'])`,
+     * see vendor/lunarphp/lunar/.../OrderItemsTable::getDefaultTable()) — so
+     * rendering the product grid doesn't N+1 per line.
+     *
+     * calculate() throws Lunar\Exceptions\MissingCurrencyPriceException
+     * (vendor PricingManager) the moment ANY line's purchasable has no
+     * price row for the cart's currency — including a line whose
+     * purchasable no longer exists at all (a deleted ProductVariant still
+     * referenced by cart_lines.purchasable_id), which 500'd this whole
+     * page rather than just leaving that one line unpriced. The Lines
+     * section below already guards every purchasable-derived field with
+     * `instanceof ProductVariant` and renders fine with $cart left
+     * uncalculated — subTotal/total/etc. simply won't be populated, which
+     * reads as a stale/pending state rather than a broken page.
      */
     protected function resolveRecord(int|string $key): Cart
     {
         /** @var Cart $cart */
         $cart = parent::resolveRecord($key);
 
-        return $cart->calculate();
+        $cart->load('lines.purchasable', 'shippingAddress.country');
+
+        EloquentCollection::make($cart->lines->pluck('purchasable')->filter(fn ($p) => $p instanceof ProductVariant))
+            ->loadMissing(['product.thumbnail', 'images', 'values']);
+
+        try {
+            return $cart->calculate();
+        } catch (MissingCurrencyPriceException) {
+            return $cart;
+        }
     }
 
     public function infolist(Schema $schema): Schema
@@ -77,6 +110,37 @@ class ViewCart extends ViewRecord
                         RepeatableEntry::make('lines')
                             ->hiddenLabel()
                             ->schema([
+                                ImageEntry::make('image')
+                                    ->hiddenLabel()
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? $record->purchasable->getThumbnail()?->getUrl('small')
+                                        : null)
+                                    ->defaultImageUrl(fn () => 'data:image/svg+xml;base64,'.base64_encode(
+                                        Blade::render('<x-filament::icon icon="heroicon-o-photo" style="color:rgb('.Color::Gray[400].');"/>')
+                                    ))
+                                    ->imageSize(48),
+                                TextEntry::make('description')
+                                    ->label('Product')
+                                    // ProductVariant::getDescription()/getOption() are typed
+                                    // string but internally read translateAttribute()/
+                                    // translate(), which return null for a product/option
+                                    // with no attribute data set for the active locale —
+                                    // reading the underlying relations directly here avoids
+                                    // that TypeError rather than calling through them.
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? ($record->purchasable->product?->translateAttribute('name') ?? '—')
+                                        : '—')
+                                    ->url(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? EditProduct::getUrl(['record' => $record->purchasable->product_id])
+                                        : null)
+                                    ->weight('bold'),
+                                TextEntry::make('options')
+                                    ->label('Options')
+                                    ->state(fn (CartLine $record) => $record->purchasable instanceof ProductVariant
+                                        ? ($record->purchasable->values->map(fn ($value) => $value->translate('name'))->filter()->join(', ') ?: null)
+                                        : null)
+                                    ->placeholder('—')
+                                    ->badge(),
                                 TextEntry::make('purchasable.sku')
                                     ->label('SKU')
                                     ->placeholder('—'),
@@ -90,6 +154,53 @@ class ViewCart extends ViewRecord
                             ])
                             ->columns(4),
                     ]),
+                Section::make('Shipping')
+                    ->columns(3)
+                    ->schema([
+                        TextEntry::make('shippingAddress.shipping_option')
+                            ->label('Shipping method')
+                            // The raw identifier (e.g. "acs") is all a
+                            // CartAddress row stores — the human-readable
+                            // name only exists on the resolved
+                            // Lunar\DataTypes\ShippingOption, which is what
+                            // shippingBreakdown's items are keyed/named
+                            // from below, so fall back to that name rather
+                            // than showing the bare identifier.
+                            ->formatStateUsing(fn (Cart $record, ?string $state) => $state
+                                ? ($record->shippingBreakdown?->items->get($state)?->name ?? $state)
+                                : null)
+                            ->placeholder('Not selected'),
+                        TextEntry::make('shippingAddress.country.name')
+                            ->label('Shipping to')
+                            ->placeholder('—'),
+                        TextEntry::make('shippingTotal')
+                            ->label('Shipping total')
+                            ->formatStateUsing(fn (Cart $record) => $record->shippingTotal?->formatted() ?? '—')
+                            ->weight('bold'),
+                        RepeatableEntry::make('shippingBreakdownItems')
+                            ->label('Breakdown')
+                            ->columnSpanFull()
+                            // shippingBreakdown->items is a plain (non-Eloquent)
+                            // Collection of Lunar\Base\ValueObjects\Cart\
+                            // ShippingBreakdownItem — e.g. the carrier rate and,
+                            // separately, Modules\Core\Payment\Pipelines\Cart\
+                            // ApplyPaymentMethodFee's own line item when the
+                            // selected payment method carries a fee (see
+                            // CHANGELOG 0.16.3) — both show up here individually
+                            // rather than only as the summed shippingTotal above.
+                            ->state(fn (Cart $record) => $record->shippingBreakdown?->items->values() ?? [])
+                            ->schema([
+                                TextEntry::make('name')
+                                    ->hiddenLabel(),
+                                TextEntry::make('price')
+                                    ->hiddenLabel()
+                                    ->formatStateUsing(fn ($state) => $state?->formatted() ?? '—')
+                                    ->alignEnd(),
+                            ])
+                            ->columns(2)
+                            ->visible(fn (Cart $record) => (bool) $record->shippingBreakdown?->items->isNotEmpty()),
+                    ])
+                    ->visible(fn (Cart $record) => $record->shippingAddress !== null),
                 Section::make('Totals')
                     ->columns(3)
                     ->schema([

src/Cart/Http/Controllers/CartController.php

@@ -0,0 +1,253 @@
+<?php
+
+namespace Modules\Core\Cart\Http\Controllers;
+
+use Closure;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\App;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+use Lunar\Exceptions\Carts\CartException;
+use Lunar\Models\CartLine;
+use Lunar\Models\ProductVariant;
+use Modules\Core\Cart\Exceptions\InvalidCouponException;
+use Modules\Core\Cart\Services\CartService;
+use Modules\Core\File\Models\File;
+use Modules\Core\File\Services\FileService;
+use Modules\Core\Localization\Services\LanguageCache;
+
+/**
+ * Thin storefront cart endpoints for the checkout module. Every action mutates
+ * the session cart via CartService and returns the same server-rendered
+ * `cart-body` partial — the drawer's Stimulus controller swaps that fragment
+ * in place (no JSON, no client-side templating). $cart / $lines for the
+ * partial come from the view composer in Providers\CheckoutModuleServiceProvider.
+ */
+class CartController extends Controller
+{
+    public function __construct(
+        private readonly CartService $cart,
+    ) {}
+
+    /**
+     * CartException here is Lunar's own add_to_cart validation pipeline
+     * (CartLineQuantity/CartLineStock) rejecting the line — most commonly
+     * "not enough stock at this quantity" for a tracked (purchasable =
+     * in_stock) variant. Its own message is an untranslated, hardcoded
+     * English string not meant for storefront display, so this returns our
+     * own translated one instead rather than passing it through — a
+     * storefront.* key rather than checkout.*, since this is a catalog/stock
+     * concern the storefront owns, not something specific to the portable
+     * checkout module.
+     */
+    public function add(string $locale, Request $request): View|JsonResponse
+    {
+        $data = $request->validate([
+            'purchasable_id' => ['required', 'integer'],
+            'quantity' => ['nullable', 'integer', 'min:1'],
+            'custom_fields' => ['nullable', 'array'],
+        ]);
+
+        $variant = ProductVariant::findOrFail($data['purchasable_id']);
+
+        try {
+            $meta = $this->customFieldsMeta($variant, $data['custom_fields'] ?? []);
+        } catch (ValidationException $e) {
+            return response()->json(['error' => collect($e->errors())->flatten()->first()], 422);
+        }
+
+        try {
+            $this->cart->addLine($variant, $data['quantity'] ?? 1, $meta);
+        } catch (CartException) {
+            return $this->stockError($variant);
+        }
+
+        return view('checkout::partials.cart-body');
+    }
+
+    /**
+     * The shopper's answers to the product's custom fields (Catalog\Models\
+     * Product::$custom_fields — {key, type: text|textarea|file, label,
+     * required}), as cart line meta. Lunar copies CartLine.meta onto the
+     * OrderLine at order creation, so this is also what the order keeps.
+     *
+     * Only keys the product actually defines are kept, nested under
+     * `custom_fields` — line meta also carries behavior flags (core's
+     * `saved_for_later` zeroes the line's price), so shopper input must never
+     * be merged into it directly. Label and type are snapshotted alongside
+     * each value so the cart/order still reads correctly if the product's
+     * fields are edited later.
+     *
+     * A `file` answer is the id of a File row the host's own upload endpoint
+     * already created via FileService — never the file's bytes, disk, or
+     * path, all of which FileService alone is the source of truth for. A
+     * shopper can't point this at someone else's file: the id must resolve
+     * to a File that is BOTH unowned (isFileAnswerValid()) and tagged with
+     * config('checkout.custom_field_upload_purpose') — the host's own
+     * upload endpoint sets its File rows to this same purpose string, so
+     * this stays a single source of truth without this module reaching
+     * into a host controller class directly (an inverted dependency this
+     * module can't have — a host app's upload endpoint is deliberately its
+     * own concern, see config/checkout.php's own comment). Attaching the
+     * File to the real CartLine it belongs to happens afterward, in File\
+     * Listeners\AttachCustomFieldFileToCartLine (listening for Cart\Events\
+     * CartLineAdded) — not here, since this method only builds the meta
+     * $this->cart->addLine() is about to receive, before any CartLine
+     * actually exists to own anything.
+     *
+     * Two adds with identical answers merge into one line (Lunar matches
+     * existing lines on meta); different answers stay separate lines.
+     */
+    private function customFieldsMeta(ProductVariant $variant, array $input): array
+    {
+        $fields = collect($variant->product?->custom_fields ?? [])
+            ->keyBy('key')
+            ->map(fn (array $field) => [...$field, 'label' => $this->resolveLabel($field['label'])]);
+
+        if ($fields->isEmpty()) {
+            return [];
+        }
+
+        $validated = Validator::make(
+            $input,
+            $fields->map(fn (array $field) => [
+                ($field['required'] ?? false) ? 'required' : 'nullable',
+                ...match ($field['type']) {
+                    'textarea' => ['string', 'max:2000'],
+                    'file' => [function (string $attribute, mixed $value, Closure $fail) {
+                        if (! $this->isFileAnswerValid($value)) {
+                            $fail('validation.uploaded')->translate();
+                        }
+                    }],
+                    default => ['string', 'max:255'],
+                },
+            ])->all(),
+            [],
+            $fields->map(fn (array $field) => $field['label'])->all(),
+        )->validate();
+
+        $answers = $fields
+            ->filter(fn (array $field) => filled($validated[$field['key']] ?? null))
+            ->map(fn (array $field) => [
+                'key' => $field['key'],
+                'label' => $field['label'],
+                'type' => $field['type'],
+                ...($field['type'] === 'file'
+                    ? ['file_id' => (int) $validated[$field['key']]]
+                    : ['value' => $validated[$field['key']]]),
+            ])
+            ->values()
+            ->all();
+
+        return $answers === [] ? [] : ['custom_fields' => $answers];
+    }
+
+    /**
+     * Product::$custom_fields stores `label` as {locale: string} (see
+     * Catalog\Filament\Pages\ManageProductCustomFields) — this resolves it
+     * to the single current-locale string cart/order line meta actually
+     * needs, the same filled()-over-?? fallback ProductDocumentLocalizer
+     * uses for every other translated field (an empty string for the
+     * current locale still falls through to the store's default language,
+     * rather than showing blank). A product saved before labels became
+     * translatable still has a plain string here, returned as-is.
+     */
+    private function resolveLabel(mixed $label): string
+    {
+        if (! is_array($label)) {
+            return (string) $label;
+        }
+
+        $locale = App::getLocale();
+        $fallbackLocale = app(LanguageCache::class)->defaultLocale();
+
+        return filled($label[$locale] ?? null)
+            ? $label[$locale]
+            : ($label[$fallbackLocale] ?? '');
+    }
+
+    private function isFileAnswerValid(mixed $fileId): bool
+    {
+        $file = File::find($fileId);
+
+        return $file !== null
+            && $file->purpose === config('checkout.custom_field_upload_purpose')
+            && $file->owner_id === null
+            && app(FileService::class)->exists($file);
+    }
+
+    public function updateLine(string $locale, Request $request, int $line): View|JsonResponse
+    {
+        $quantity = (int) $request->validate([
+            'quantity' => ['required', 'integer', 'min:0'],
+        ])['quantity'];
+
+        try {
+            $quantity === 0
+                ? $this->cart->removeLine($line)
+                : $this->cart->updateLine($line, $quantity);
+        } catch (CartException) {
+            $variant = CartLine::find($line)?->purchasable;
+
+            return $this->stockError($variant instanceof ProductVariant ? $variant : null);
+        }
+
+        return view('checkout::partials.cart-body');
+    }
+
+    /**
+     * getTotalInventory() is the same number canBeFulfilledAtQuantity()
+     * checked against (stock, for a tracked in_stock variant) — telling the
+     * shopper how many are actually left beats a generic "not enough stock"
+     * they'd otherwise have to guess around by trial and error.
+     */
+    private function stockError(?ProductVariant $variant): JsonResponse
+    {
+        $available = $variant?->getTotalInventory() ?? 0;
+
+        return response()->json([
+            'error' => trans_choice('storefront.product.add_to_cart_failed', $available, ['count' => $available]),
+        ], 422);
+    }
+
+    public function remove(string $locale, int $line): View
+    {
+        $this->cart->removeLine($line);
+
+        return view('checkout::partials.cart-body');
+    }
+
+    /**
+     * A bad code is a normal, expected outcome here (typo, expired code), not
+     * an error state for the request — it re-renders the same cart-body
+     * partial with $couponError set, rather than a 4xx/redirect, so the fetch
+     * + swap in bbk-cart-controller stays the one code path for every cart
+     * mutation.
+     */
+    public function applyCoupon(string $locale, Request $request): View
+    {
+        $code = $request->validate([
+            'code' => ['required', 'string'],
+        ])['code'];
+
+        $couponError = false;
+
+        try {
+            $this->cart->applyCoupon($code);
+        } catch (InvalidCouponException) {
+            $couponError = true;
+        }
+
+        return view('checkout::partials.cart-body', ['couponError' => $couponError]);
+    }
+
+    public function removeCoupon(string $locale): View
+    {
+        $this->cart->removeCoupon();
+
+        return view('checkout::partials.cart-body');
+    }
+}

src/Cart/Privacy/CartDataProvider.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace Modules\Core\Cart\Privacy;
+
+use Lunar\Models\Cart;
+use Lunar\Models\CartAddress;
+use Modules\Core\Privacy\Contracts\PersonalDataProvider;
+use Modules\Core\Privacy\DTOs\CustomerSubject;
+use Modules\Core\Privacy\Enums\ErasureOutcome;
+use Modules\Core\Privacy\DTOs\ProviderErasureResult;
+use Modules\Core\Privacy\DTOs\ProviderExportResult;
+use Modules\Core\Privacy\DTOs\UserSubject;
+
+/**
+ * Carts and cart addresses (lunar_carts, lunar_cart_addresses) belong to the
+ * Customer (business account) via customer_id, not to an individual User, so this
+ * is Customer-scope only. Unlike Order/OrderAddress, an abandoned cart has no
+ * legal retention requirement, so its addresses are freely deleted. The Cart row
+ * itself is left alone (any completed order it produced is handled separately by
+ * OrderDataProvider, which is what retention law actually cares about) — only its
+ * address PII is removed.
+ *
+ * Also covers Cart.meta's own PII-adjacent keys — Modules\Core\Checkout\Services\
+ * CheckoutService::setRecoveryConsent()/selectPaymentMethod() write
+ * recovery_consent/recovery_consent_at/recovery_consent_policy_version and
+ * payment_method/checkout_fingerprint directly onto this same Cart row, which the
+ * address-only erase above never touched. Kept Customer-scope, consistent with
+ * how Cart itself is already classified — see docs/privacy.md for the
+ * User-vs-Customer discussion this raised.
+ */
+class CartDataProvider implements PersonalDataProvider
+{
+    private const META_KEYS = [
+        'recovery_consent',
+        'recovery_consent_at',
+        'recovery_consent_policy_version',
+        'payment_method',
+        'checkout_fingerprint',
+    ];
+
+    public function name(): string
+    {
+        return 'carts';
+    }
+
+    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        $addresses = CartAddress::whereIn('cart_id', $carts->pluck('id'))->get();
+
+        return new ProviderExportResult('carts', [
+            'addresses' => $addresses->map(fn (CartAddress $address) => [
+                'type' => $address->type,
+                'first_name' => $address->first_name,
+                'last_name' => $address->last_name,
+                'line_one' => $address->line_one,
+                'city' => $address->city,
+                'postcode' => $address->postcode,
+                'contact_email' => $address->contact_email,
+                'contact_phone' => $address->contact_phone,
+            ])->all(),
+            'carts' => $carts->map(fn (Cart $cart) => [
+                'id' => $cart->id,
+                'meta' => $this->metaOnly($cart),
+            ])->all(),
+        ]);
+    }
+
+    public function exportForUser(UserSubject $subject): ProviderExportResult
+    {
+        return new ProviderExportResult('carts', []);
+    }
+
+    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
+    {
+        $carts = Cart::where('customer_id', $subject->customerId)->get();
+
+        CartAddress::whereIn('cart_id', $carts->pluck('id'))->delete();
+
+        foreach ($carts as $cart) {
+            $meta = (array) $cart->meta;
+
+            foreach (self::META_KEYS as $key) {
+                unset($meta[$key]);
+            }
+
+            $cart->update(['meta' => $meta]);
+        }
+
+        return new ProviderErasureResult('carts', ErasureOutcome::Erased);
+    }
+
+    public function eraseForUser(UserSubject $subject): ProviderErasureResult
+    {
+        return new ProviderErasureResult('carts', ErasureOutcome::Skipped, 'Carts belong to Customer accounts, not individual users.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function metaOnly(Cart $cart): array
+    {
+        $meta = (array) $cart->meta;
+
+        return array_intersect_key($meta, array_flip(self::META_KEYS));
+    }
+}

src/Cart/Services/CartLifecycleService.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace Modules\Core\Cart\Services;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Carbon;
+use Lunar\Models\Cart;
+
+/**
+ * The single source of truth for the four cart lifecycle states documented in
+ * docs/cart.md ("Four states, not two — and not Cart::completed_at"). Both
+ * Modules\Core\Cart\Filament\Resources\CartResource/ListCarts (staff-facing
+ * browsing/tabs) and Modules\Core\Cart\Commands\DetectAbandonedCarts
+ * (abandonment-event dispatch) build on these same four query shapes — before
+ * this existed, each reimplemented them independently, which is exactly the
+ * kind of drift that lets the admin panel and the recovery-email pipeline
+ * quietly disagree about what "abandoned" means.
+ *
+ * `Cart::completed_at` is declared/cast on the model but never actually
+ * written anywhere in Lunar core — not a real signal, not used here.
+ * `Cart::scopeActive()` (Lunar's own "not yet converted to an order" scope)
+ * mixes two distinct states together (no order at all vs. a draft order that
+ * was never placed) — see docs/cart.md for why they're kept apart as
+ * different purchase-intent/reachability signals rather than folded into one
+ * "not converted" bucket.
+ *
+ * Query shape only: consent (`meta->recovery_consent`) and non-empty-lines
+ * filtering stay in DetectAbandonedCarts, not here — those are specific to
+ * whether a recovery event should fire, not to what "abandoned" means. Staff
+ * browsing the admin panel should see every abandoned cart, consenting or
+ * not.
+ *
+ * `unrecoverableCutoff()` is a second, older threshold
+ * (`core.cart.unrecoverable_after`, default 90 days) applied as a lower
+ * bound on both abandoned*() methods below: a cart past it is too old to be
+ * a realistic recovery target (pricing/stock/tax have likely moved on), so
+ * it drops out of "Abandoned Cart"/"Abandoned Checkout" entirely rather than
+ * staying flagged as an actionable abandonment forever. It does not appear
+ * in `ongoing()`/`completed()` either — this is about the abandoned-cart
+ * pipeline specifically, not a retention/deletion policy (no rows are
+ * touched here).
+ */
+class CartLifecycleService
+{
+    public function abandonedCutoff(): Carbon
+    {
+        return now()->sub(config('core.cart.abandoned_after', '1 hour'));
+    }
+
+    public function unrecoverableCutoff(): Carbon
+    {
+        return now()->sub(config('core.cart.unrecoverable_after', '90 days'));
+    }
+
+    /**
+     * Not yet converted to an order (scopeActive()), with recent activity —
+     * someone plausibly shopping right now, not (yet) left behind.
+     */
+    public function ongoing(Builder $query): Builder
+    {
+        return $query->active()->where('updated_at', '>', $this->abandonedCutoff());
+    }
+
+    /**
+     * No order started at all, stale, not yet past the unrecoverable cap, and
+     * actually has something in it — the weaker of the two abandoned states
+     * (see docs/cart.md's "Abandoned Cart vs Abandoned Checkout"). An empty
+     * cart (created but nothing ever added — e.g. a bot, or a session that
+     * never shopped) was never really "abandoned"; there's nothing to
+     * recover, so it's excluded rather than counted as a false positive.
+     */
+    public function abandonedCarts(Builder $query): Builder
+    {
+        return $query->whereDoesntHave('orders')
+            ->whereHas('lines')
+            ->where('updated_at', '<=', $this->abandonedCutoff())
+            ->where('updated_at', '>', $this->unrecoverableCutoff());
+    }
+
+    /**
+     * A draft order exists (checkout was started) but was never placed,
+     * stale, and not yet past the unrecoverable cap — the stronger of the
+     * two abandoned states.
+     */
+    public function abandonedCheckouts(Builder $query): Builder
+    {
+        return $query->whereHas('orders', fn (Builder $query) => $query->whereNull('placed_at'))
+            ->where('updated_at', '<=', $this->abandonedCutoff())
+            ->where('updated_at', '>', $this->unrecoverableCutoff());
+    }
+
+    /**
+     * Has an order that was actually placed, not just drafted.
+     */
+    public function completed(Builder $query): Builder
+    {
+        return $query->whereHas('orders', fn (Builder $query) => $query->whereNotNull('placed_at'));
+    }
+}

src/Catalog/Enums/ProductSort.php

@@ -14,6 +14,7 @@ enum ProductSort: string
     case PriceAsc = 'price_asc';
     case PriceDesc = 'price_desc';
     case Newest = 'newest';
+    case Popularity = 'popularity';
 
     public function toMeilisearchSort(): string
     {
@@ -21,6 +22,12 @@ enum ProductSort: string
             self::PriceAsc => 'price:asc',
             self::PriceDesc => 'price:desc',
             self::Newest => 'created_at:desc',
+            // order_count — see Modules\Core\Catalog\Services\
+            // ProductIndexer::toSearchableArray()'s own docblock: the same
+            // trailing-year, physical-order-line-count definition Lunar's
+            // own admin dashboard "Popular Products" widget already uses,
+            // aggregated per product rather than per variant.
+            self::Popularity => 'order_count:desc',
         };
     }
 }

src/Catalog/Filament/Pages/ManageProductCustomFields.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace Modules\Core\Catalog\Filament\Pages;
+
+use Filament\Forms\Components\Repeater;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Group;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Str;
+use Lunar\Admin\Filament\Resources\ProductResource;
+use Lunar\Admin\Support\Pages\BaseEditRecord;
+use Lunar\Models\Language;
+
+/**
+ * Own sub-page for Product::$custom_fields (see that column's own docblock
+ * on Modules\Core\Catalog\Models\Product) — used to be a collapsible
+ * Section inline on the main product edit form (Review\Filament\
+ * Extensions\ProductResourceExtension::extendForm()), moved out to match
+ * how Reviews already gets its own sub-page (ManageProductReviews) rather
+ * than crowding the main form with a second unrelated concern.
+ *
+ * Deliberately no ->statePath('') override, no custom mount()/
+ * handleRecordUpdate() — EditRecord::mount() already fills the form from
+ * $record->attributesToArray() (which includes custom_fields, a real cast
+ * + fillable column) onto the default 'data' statePath, and save() reads
+ * it straight back off via $this->form->getState(). An earlier version of
+ * this page used ->statePath('') to bind the repeater directly to the
+ * record's attributes (copying ManageProductPricing) — that repointed the
+ * Repeater at $this->data['custom_fields'] AS THE ROOT state path itself,
+ * so every "add item" click re-filled the whole form from the record's
+ * still-unsaved value and immediately discarded the new row before it
+ * ever reached the page. Reverting to the plain default form/statePath is
+ * both simpler and is what actually works — same as the original inline
+ * repeater on the main product form did before this became its own page.
+ *
+ * Registered from Review\Filament\Extensions\ProductResourceExtension, not
+ * here — CorePlugin only allows one extension class per Lunar resource,
+ * and Review's already owns ProductResource's extension slot (see that
+ * class's own docblock).
+ *
+ * `label`/`help_text` are each stored as {locale: string} (e.g. {en: "...",
+ * el: "..."}) — see translatedField()'s own docblock for why that's a
+ * hand-rolled TextInput per language rather than Lunar's TranslatedText
+ * component. A product saved before this change still has a plain string
+ * `label` and no `help_text` at all; itemLabel() below tolerates both
+ * shapes, and the storefront/cart resolve either shape the same way (see
+ * product-custom-fields.blade.php and CartController::
+ * customFieldsMeta()). `key`/`type`/`required` stay plain, single values —
+ * only shopper-facing copy needs a translation, not the field's own
+ * machine-facing configuration.
+ */
+class ManageProductCustomFields extends BaseEditRecord
+{
+    protected static string $resource = ProductResource::class;
+
+    public static function getNavigationIcon(): ?string
+    {
+        return 'heroicon-o-adjustments-horizontal';
+    }
+
+    public function getTitle(): string
+    {
+        return 'Custom Fields';
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return 'Custom Fields';
+    }
+
+    /**
+     * Without this, Filament's EditRecord defaults to every relation
+     * manager the WHOLE ProductResource defines (see HasRelationManagers::
+     * getAllRelationManagers(), which reads ProductResource::getRelations()
+     * regardless of which sub-page is rendering) — Channels, Customer
+     * Groups, Media, Pricing tabs all bleeding onto this page alongside the
+     * repeater below. This page has no relations of its own.
+     */
+    public function getRelationManagers(): array
+    {
+        return [];
+    }
+
+    /**
+     * A plain TextInput per configured language, named "{$field}.{locale}"
+     * so it resolves to a normal nested array under the repeater item
+     * (custom_fields.{item}.label.en, .label.el, ...) — NOT Lunar's
+     * TranslatedText component. That component's per-locale sub-fields
+     * set their own statePath to just the locale code itself
+     * (TranslatedText::prepareTranslateLocaleComponent()), which only
+     * resolves correctly when TranslatedText is used as a single
+     * top-level named field directly on a form's root state (exactly how
+     * every existing usage in this codebase uses it — Lunar's own
+     * product name/description). Nested inside a Repeater item here, that
+     * same statePath resolution silently failed to nest under the item's
+     * own label/help_text key at all, and every typed value was lost on
+     * save. Hand-rolling the per-locale inputs sidesteps that assumption
+     * entirely.
+     */
+    private function translatedField(string $field, string $label, string $helperText, bool $required): Group
+    {
+        $languages = Language::orderBy('default', 'desc')->get(['code', 'name', 'default']);
+
+        return Group::make(
+            $languages->map(fn (Language $language, int $index) => TextInput::make("{$field}.{$language->code}")
+                ->label($index === 0 ? $label : null)
+                ->hiddenLabel($index !== 0)
+                ->helperText($index === 0 ? $helperText : null)
+                ->prefix(Str::upper($language->code))
+                ->required($required && $language->default))->values()->all(),
+        )
+            ->columnSpanFull();
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Section::make('Custom Fields')
+                    ->description('Extra input the shopper fills in on this product\'s page before adding it to their cart — a reference photo, personalization text, etc.')
+                    ->schema([
+                        Repeater::make('custom_fields')
+                            ->hiddenLabel()
+                            ->schema([
+                                $this->translatedField('label', 'Label', 'Shown to the shopper above the field. Only the current storefront locale is shown on the cart and checkout.', required: true),
+                                $this->translatedField('help_text', 'Help text', 'Optional — shown under the label on the product page only, not on the cart or checkout.', required: false),
+                                Select::make('type')
+                                    ->label('Field type')
+                                    ->options([
+                                        'text' => 'Short text',
+                                        'textarea' => 'Long text',
+                                        'file' => 'File upload',
+                                    ])
+                                    ->default('text')
+                                    ->native(false)
+                                    ->live()
+                                    ->required(),
+                                TextInput::make('key')
+                                    ->label('Key')
+                                    ->helperText('Machine-facing identifier — stored on the order/cart line, used to look up this answer elsewhere. Cannot be changed once orders reference it.')
+                                    ->required()
+                                    ->alphaDash()
+                                    ->maxLength(64),
+                                Toggle::make('required')
+                                    ->label('Required')
+                                    ->helperText('Shopper cannot add this product to their cart without answering.')
+                                    ->default(false),
+                            ])
+                            ->columns(2)
+                            ->addActionLabel('Add a custom field')
+                            ->reorderable()
+                            ->collapsible()
+                            ->itemLabel(fn (array $state): ?string => is_array($state['label'] ?? null)
+                                ? collect($state['label'])->first(fn ($value) => filled($value))
+                                : ($state['label'] ?? null)),
+                    ]),
+            ]);
+    }
+}

src/Catalog/Listeners/ReindexProductsRecommendingProduct.php

@@ -2,11 +2,17 @@
 
 namespace Modules\Core\Catalog\Listeners;
 
+use Illuminate\Contracts\Queue\ShouldQueue;
 use Lunar\Models\Product;
 use Modules\Core\Catalog\Events\ProductDeleted;
 use Modules\Core\Catalog\Events\ProductSaved;
 
 /**
+ * Queued — a Meilisearch filter query plus N reindex calls with no
+ * same-request reader; a few seconds of stale `recommendations` on a
+ * referencing product's storefront page is a cosmetic, not correctness,
+ * concern (see the class's own docblock below).
+ *
  * Keeps every product's embedded `recommendations` field (see
  * ProductIndexer) in sync when a product they recommend changes or is
  * removed. Unlike Modules\Core\Catalog\Observers\ProductOptionReindexObserver's
@@ -27,7 +33,7 @@ use Modules\Core\Catalog\Events\ProductSaved;
  * SCOUT_QUEUE is configured) reindex job per matched product — this
  * listener itself does no synchronous Meilisearch writing.
  */
-class ReindexProductsRecommendingProduct
+class ReindexProductsRecommendingProduct implements ShouldQueue
 {
     public function handleSaved(ProductSaved $event): void
     {

src/Catalog/Models/Product.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Modules\Core\Catalog\Models;
+
+/**
+ * Registered via Lunar\Facades\ModelManifest::replace(Lunar\Models\
+ * Product::class, self::class) — see Providers\CatalogServiceProvider —
+ * purely to add a cast AND fillable entry for `custom_fields` (see the
+ * migration adding that column: database/migrations/
+ * ..._add_custom_fields_to_products_table.php). Without the fillable
+ * entry, Lunar\Models\Product's own $fillable allowlist (attribute_data,
+ * product_type_id, status, brand_id — custom_fields isn't in it) silently
+ * drops the field on every mass-assignment save (Filament's own
+ * $record->update($data)) — no error, no exception, the admin form shows
+ * the repeater's rows as saved right up until the next page load, when
+ * they're simply gone. Caught in practice.
+ *
+ * ModelManifest::replace() only changes what code resolving Product
+ * through the CONTRACT (app(Contracts\Product::class), Filament's own
+ * ProductResource — its $model is ProductContract::class, not the
+ * concrete class) or the morph map receives — it does NOT retroactively
+ * change what a hardcoded `Lunar\Models\Product::query()`/`::find()`
+ * elsewhere in this codebase (or Lunar's own internals, e.g. the
+ * scheduled Meilisearch reindex command — see CatalogServiceProvider,
+ * which references this subclass by name specifically so that path picks
+ * it up too) resolves to. Most of this codebase's existing Product
+ * references are plain type-hints (they accept whichever instance is
+ * handed to them, subclass included) or don't touch `custom_fields` at
+ * all, so they're unaffected either way.
+ */
+class Product extends \Lunar\Models\Product
+{
+    // NOT `protected $casts = [...]` — that property assignment REPLACES
+    // the parent's own $casts array wholesale rather than merging with
+    // it (PHP class property redeclaration has no merge semantics), which
+    // would silently drop every cast Lunar\Models\Product already
+    // defines (attribute_data, status, etc.). mergeCasts() is Eloquent's
+    // own documented mechanism for a subclass adding to, not replacing,
+    // its parent's casts.
+    public function __construct(array $attributes = [])
+    {
+        parent::__construct($attributes);
+
+        $this->mergeCasts([
+            'custom_fields' => 'array',
+        ]);
+
+        $this->mergeFillable([
+            'custom_fields',
+        ]);
+    }
+}

src/Catalog/Services/ProductIndexer.php

@@ -5,6 +5,7 @@ namespace Modules\Core\Catalog\Services;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Lunar\Models\Currency;
+use Lunar\Models\OrderLine;
 use Lunar\Models\Price;
 use Lunar\Models\Product;
 use Lunar\Models\ProductVariant;
@@ -47,8 +48,12 @@ use Spatie\MediaLibrary\MediaCollections\Models\Media;
  *     quantity 1, via ProductVariant::canBeFulfilledAtQuantity() (Lunar's own
  *     purchasability rule: `purchasable === 'always'` is always true regardless of
  *     stock, `in_stock` checks stock alone, anything else checks stock+backorder).
- *     Reflects stock as of the last reindex only — nothing currently reindexes a
- *     product when an order decrements its stock (see docs/product-listing.md).
+ *     Modules\Core\Order\Listeners\DecrementStockOnOrderPlaced reindexes a product
+ *     the moment an order placed against it decrements its stock — see that
+ *     class's own docblock for why only `purchasable === 'in_stock'`
+ *     variants are ever touched. Any other stock edit (a manual admin
+ *     change, a future inventory-sync integration) still only reflects here
+ *     as of the next reindex (see docs/product-listing.md).
  *
  *   - recommendations (recommendations.id filterable): [{id, name, price, image}, ...]
  *     up to 4 other products to show alongside this one (a "related products"
@@ -99,6 +104,7 @@ class ProductIndexer extends BaseProductIndexer
         return [
             ...parent::getSortableFields(),
             'price',
+            'order_count',
         ];
     }
 
@@ -135,6 +141,12 @@ class ProductIndexer extends BaseProductIndexer
             ->all();
         $data['slugs'] = $model->urls->pluck('slug')->unique()->values()->all();
         $data['skus'] = $model->variants->pluck('sku')->filter()->unique()->values()->all();
+        // Only decoded correctly when $model is an instance of
+        // Modules\Core\Catalog\Models\Product (the custom_fields cast
+        // lives there, not on the base Lunar\Models\Product) — see
+        // CatalogServiceProvider's own comment on why the scheduled
+        // reindex command references that subclass by name specifically.
+        $data['custom_fields'] = $model->custom_fields ?? [];
         $data['tags'] = $model->tags->pluck('value')->all();
         $data['media'] = $model->media->map(fn (Media $media) => $this->mapMedia($media))->all();
         $data['variants'] = $model->variants->map(fn (ProductVariant $variant) => $this->mapVariant($variant, $currency))->all();
@@ -151,6 +163,24 @@ class ProductIndexer extends BaseProductIndexer
         $data['in_stock'] = $model->variants->contains(
             fn (ProductVariant $variant) => $variant->canBeFulfilledAtQuantity(1)
         );
+        // Same "popular" definition as Lunar's own admin dashboard widget
+        // (Lunar\Admin\Filament\Widgets\Dashboard\Orders\
+        // PopularProductsTable) — order-line COUNT, not summed quantity,
+        // over the trailing year, physical lines only — just aggregated
+        // per PRODUCT here (across all its variants) rather than per
+        // variant/identifier, since a storefront "sort by popularity"
+        // ranks products, not individual variant SKUs. Necessarily as
+        // stale as any other reindex-time field here (in_stock, price) —
+        // there's no live equivalent without a query per page load.
+        $data['order_count'] = OrderLine::query()
+            ->whereIn('purchasable_id', $model->variants->pluck('id'))
+            ->where('purchasable_type', 'product_variant')
+            ->where('type', 'physical')
+            ->whereHas('order', fn ($query) => $query->whereBetween('placed_at', [
+                now()->subYear()->startOfDay(),
+                now()->endOfDay(),
+            ]))
+            ->count();
         $data['recommendations'] = app(RecommendationService::class)
             ->recommend($model)
             ->load(['media', 'variants.prices'])

src/Catalog/Services/ProductService.php

@@ -254,7 +254,10 @@ class ProductService
     public function random(int $limit): array
     {
         $raw = Product::search('')
-            ->options(['attributesToRetrieve' => ['id']])
+            ->options([
+                'attributesToRetrieve' => ['id'],
+                'filter' => $this->filterBuilder->withVisibility(),
+            ])
             ->raw();
 
         $ids = collect($raw['hits'] ?? [])->pluck('id')->shuffle()->take($limit)->values();
@@ -287,7 +290,7 @@ class ProductService
     private function findAllWhere(string $filter, int $limit = 1000): array
     {
         $paginator = Product::search('')
-            ->options(['filter' => $filter])
+            ->options(['filter' => $this->filterBuilder->withVisibility($filter)])
             ->paginateRaw(perPage: $limit, page: 1);
 
         return collect($this->localizer->hitsFrom($paginator))

src/Catalog/Services/SkuBackfillService.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Lunar\Models\ProductVariant;
+
+/**
+ * Generates a SKU for every ProductVariant missing one — extracted out of
+ * Command\BackfillMissingSkusCommand (which becomes a thin CLI wrapper
+ * around this, keeping --dry-run/progress-bar concerns out of the
+ * reusable logic) so MigrateImport\Shopify\Services\ShopifyExportImporter can
+ * also call it directly, once every product job in its import batch has
+ * finished (see that class's own import()), with no CLI concerns at all.
+ *
+ * Format is "SKU-P{product_id}-V{variant_id}": deterministic and
+ * guaranteed unique without a uniqueness check, since product_id/
+ * variant_id already are. Only variants with a null `sku` are touched —
+ * not an importer bug when one shows up after a Shopify import, the
+ * source CSV rows genuinely had no `Variant SKU` value (see
+ * MigrateImport\Shopify\Services\ShopifyExportImporter).
+ */
+class SkuBackfillService
+{
+    /**
+     * @param  ?callable(ProductVariant, string): void  $onEach  invoked
+     *   once per variant with the sku about to be written (or, when
+     *   $dryRun is true, that WOULD be written) — the command's own
+     *   --dry-run listing and progress bar hook in here without this
+     *   service knowing anything about console output.
+     * @return int the number of variants processed
+     */
+    public function backfill(bool $dryRun = false, ?callable $onEach = null): int
+    {
+        $query = ProductVariant::query()->whereNull('sku');
+        $total = $query->count();
+
+        if ($total === 0) {
+            return 0;
+        }
+
+        $query->chunkById(500, function ($variants) use ($dryRun, $onEach) {
+            foreach ($variants as $variant) {
+                $sku = "SKU-P{$variant->product_id}-V{$variant->id}";
+
+                if (! $dryRun) {
+                    $variant->update(['sku' => $sku]);
+                }
+
+                if ($onEach !== null) {
+                    $onEach($variant, $sku);
+                }
+            }
+        });
+
+        return $total;
+    }
+}

src/Catalog/Services/StockService.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace Modules\Core\Catalog\Services;
+
+use Illuminate\Support\Facades\DB;
+use Lunar\Models\Order;
+use Lunar\Models\Product;
+use Lunar\Models\ProductVariant;
+
+/**
+ * The one place ProductVariant::stock is written as a result of an order —
+ * previously this lived entirely inside Modules\Core\Order\Listeners\
+ * DecrementStockOnOrderPlaced, a listener with no Service behind it at
+ * all, even though stock (the column, its invariants — "never negative",
+ * "only in_stock variants") is fundamentally a Catalog concern, not an
+ * Order one. That listener is now a thin caller of this class, matching
+ * how every other module's event reaction delegates its actual write to
+ * a Service (e.g. Modules\Core\Order\Listeners\RecordPaymentTransaction
+ * -> Modules\Core\Order\Services\TransactionRecorder).
+ *
+ * Only decrements for `purchasable === 'in_stock'` variants — 'always' and
+ * 'backorder' variants are deliberately allowed to sell past (or without
+ * regard to) their stock count already (see ProductVariant::
+ * canBeFulfilledAtQuantity()), so decrementing their stock would just make
+ * that column an inaccurate, decreasingly-negative number with no purchasing
+ * consequence. Only `OrderLine::type === 'physical'` lines are considered —
+ * a digital line has no stock to decrement (ProductVariant::getType()).
+ *
+ * A single UPDATE per variant (`DB::table(...)->update()` with a raw
+ * expression), not a read-then-write on the Eloquent model — avoids a
+ * lost-update race between two orders decrementing the same variant
+ * concurrently, and skips Modules\Core\Catalog\Services\ProductIndexer::
+ * stock's staleness gap for the DB value itself even though the search
+ * index still only refreshes on the next reindex event/nightly job (see
+ * that class's own docblock).
+ *
+ * Never lets stock go negative (`GREATEST(stock - qty, 0)` via a raw
+ * expression) — an order can still be placed against a variant whose stock
+ * was already fully consumed by another concurrent order (Lunar has no
+ * stock-reservation step at cart/checkout time), so this is a best-effort
+ * count, not a hard inventory guarantee.
+ */
+class StockService
+{
+    public function decrementForOrder(Order $order): void
+    {
+        $lines = $order->lines()
+            ->where('type', 'physical')
+            ->where('purchasable_type', ProductVariant::morphName())
+            ->get(['purchasable_id', 'quantity']);
+
+        if ($lines->isEmpty()) {
+            return;
+        }
+
+        foreach ($lines as $line) {
+            DB::table((new ProductVariant())->getTable())
+                ->where('id', $line->purchasable_id)
+                ->where('purchasable', 'in_stock')
+                ->update([
+                    'stock' => DB::raw('GREATEST(stock - '.(int) $line->quantity.', 0)'),
+                ]);
+        }
+
+        $productIds = ProductVariant::whereIn('id', $lines->pluck('purchasable_id'))
+            ->pluck('product_id')
+            ->unique();
+
+        Product::whereIn('id', $productIds)->get()->each->searchable();
+    }
+}

src/Catalog/Support/ProductDocumentLocalizer.php

@@ -51,16 +51,62 @@ class ProductDocumentLocalizer
         $availableLocales = $this->languages->availableLocales();
 
         foreach ($this->translatedAttributeHandles() as $handle) {
-            $product[$handle] = $product[$handle.'_'.$locale] ?? $product[$handle.'_'.$fallbackLocale] ?? null;
+            // filled(), not ?? - a translated attribute saved blank for
+            // the current locale still has that {handle}_{locale} key in
+            // the document, just set to '' rather than absent. ?? only
+            // falls back on a missing/null key, so it kept the empty
+            // string instead of falling through to a locale that actually
+            // has content.
+            $product[$handle] = filled($product[$handle.'_'.$locale] ?? null)
+                ? $product[$handle.'_'.$locale]
+                : ($product[$handle.'_'.$fallbackLocale] ?? null);
 
             foreach ($availableLocales as $availableLocale) {
                 unset($product[$handle.'_'.$availableLocale]);
             }
         }
 
+        if (! empty($product['custom_fields'])) {
+            $product['custom_fields'] = $this->localizeCustomFields($product['custom_fields'], $locale, $fallbackLocale);
+        }
+
         return $product;
     }
 
+    /**
+     * Product::$custom_fields isn't an AttributeManifest attribute (it's a
+     * plain JSON column, see Catalog\Models\Product's own docblock), so it
+     * never goes through the {handle}_{locale} explosion above — the
+     * indexer copies it straight through (see ProductIndexer), meaning
+     * each item's `label`/`help_text` still arrives here as a raw
+     * {locale: string} object (or, for a product saved before those
+     * became translatable, a plain string). Resolved the same filled()-
+     * over-?? way as every other translated field above, to the same
+     * single current-locale string the storefront/cart already expect
+     * (see product-custom-fields.blade.php and CartController::
+     * customFieldsMeta()) — a repeater item has no other reason to reach
+     * the storefront untouched.
+     *
+     * @param  array<int, array<string, mixed>>  $fields
+     * @return array<int, array<string, mixed>>
+     */
+    private function localizeCustomFields(array $fields, string $locale, ?string $fallbackLocale): array
+    {
+        return array_map(function (array $field) use ($locale, $fallbackLocale) {
+            foreach (['label', 'help_text'] as $key) {
+                if (! is_array($field[$key] ?? null)) {
+                    continue;
+                }
+
+                $field[$key] = filled($field[$key][$locale] ?? null)
+                    ? $field[$key][$locale]
+                    : ($field[$key][$fallbackLocale] ?? null);
+            }
+
+            return $field;
+        }, $fields);
+    }
+
     /**
      * For the Meilisearch driver, Scout's paginateRaw() puts the whole raw response
      * (hits, query, processingTimeMs, ...) in items(), not a plain list of hits - the

src/Catalog/Support/ProductFilterBuilder.php

@@ -10,6 +10,13 @@ use Modules\Core\Catalog\DTOs\ProductFilters;
  * out of ProductService (where it originated, scoped to browsing/filtering
  * without a search term) so ProductSearchService can apply the exact same
  * filter semantics to a text query too, rather than reimplementing it.
+ *
+ * Also the single place that composes the draft-visibility clause (see
+ * withVisibility()) — every Meilisearch `filter` string ProductService
+ * constructs, including the handful of ad-hoc ones that don't call build()
+ * at all (getById()/getBySlug()'s id lookup, random()'s id-only fetch),
+ * goes through this class so none of them can silently omit it the way a
+ * status filter was missing everywhere until now.
  */
 class ProductFilterBuilder
 {
@@ -19,10 +26,10 @@ class ProductFilterBuilder
      *   ProductService::priceRange() excludes 'price' so a price slider's own
      *   bounds don't shrink to whatever range is already selected on it.
      */
-    public function build(?ProductFilters $filters, array $exclude = []): ?string
+    public function build(?ProductFilters $filters, array $exclude = []): string
     {
         if ($filters === null) {
-            return null;
+            return $this->withVisibility();
         }
 
         $clauses = Collection::make([
@@ -36,6 +43,27 @@ class ProductFilterBuilder
             'inStockOnly' => $filters->inStockOnly ? 'in_stock = true' : null,
         ])->except($exclude)->filter();
 
-        return $clauses->isEmpty() ? null : $clauses->join(' AND ');
+        return $this->withVisibility($clauses->isEmpty() ? null : $clauses->join(' AND '));
+    }
+
+    /**
+     * A draft product (status = 'draft', see Lunar\Filament\Resources\
+     * ProductResource's own status Select) is only ever visible while
+     * APP_DEBUG is true — a merchant/developer previewing an unfinished
+     * product locally or on a staging box, never a real storefront
+     * visitor. Every ProductService method that builds a Meilisearch
+     * `filter` string, build() included, calls this rather than passing
+     * $rawClause straight to Product::search() — the one seam that
+     * guarantees none of them can omit the visibility rule.
+     *
+     * Always returns a non-empty string (never null) — a bare
+     * 'status = "published"' is itself a complete, valid Meilisearch
+     * filter on its own when $rawClause is null.
+     */
+    public function withVisibility(?string $rawClause = null): string
+    {
+        $visibility = config('app.debug') ? null : 'status = "published"';
+
+        return Collection::make([$visibility, $rawClause])->filter()->join(' AND ');
     }
 }

src/Checkout/Database/Seeders/CheckoutTranslationsSeeder.php

@@ -0,0 +1,185 @@
+<?php
+
+namespace Modules\Core\Checkout\Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Modules\Core\Localization\Services\TranslationService;
+use Spatie\TranslationLoader\LanguageLine;
+
+/**
+ * Default `checkout` translation lines for the cart drawer and the checkout
+ * page (see the checkout module under resources/views/checkout).
+ *
+ * Additive and idempotent: a group/key that already exists is left untouched,
+ * so anything edited in the Filament Language Lines UI wins on a re-run. Runs
+ * explicitly — `php artisan db:seed --class="Modules\Core\Checkout\Database\
+ * Seeders\CheckoutTranslationsSeeder"` — it is not wired into any app's own
+ * DatabaseSeeder.
+ *
+ * Greek copy uses an informal register (εσύ/σου) — a consuming app with a
+ * different house style overrides individual lines from the Filament
+ * Language Lines UI same as any other translation, rather than forking
+ * this class.
+ */
+class CheckoutTranslationsSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $translations = app(TranslationService::class);
+
+        foreach ($this->lines() as $key => [$en, $el]) {
+            $exists = LanguageLine::query()
+                ->where('group', 'checkout')
+                ->where('key', $key)
+                ->exists();
+
+            if ($exists) {
+                $this->command?->warn("checkout.{$key} already exists — skipped");
+
+                continue;
+            }
+
+            $translations->create('checkout', $key, ['en' => $en, 'el' => $el]);
+            $this->command?->info("checkout.{$key} added");
+        }
+    }
+
+    /**
+     * key => [English, Greek].
+     *
+     * @return array<string, array{0: string, 1: string}>
+     */
+    private function lines(): array
+    {
+        return [
+            // ── Cart drawer + order summary ──────────────────────────────
+            'cart.title' => ['Your cart', 'Το καλάθι σου'],
+            'cart.close' => ['Close', 'Κλείσιμο'],
+            'cart.empty' => ['Your cart is empty', 'Το καλάθι σου είναι άδειο'],
+            'cart.quantity' => ['Quantity', 'Ποσότητα'],
+            'cart.increase' => ['Increase quantity', 'Αύξηση ποσότητας'],
+            'cart.decrease' => ['Decrease quantity', 'Μείωση ποσότητας'],
+            'cart.remove' => ['Remove', 'Αφαίρεση'],
+            'cart.subtotal' => ['Subtotal', 'Υποσύνολο'],
+            'cart.discount' => ['Discount', 'Έκπτωση'],
+            'cart.shipping' => ['Shipping', 'Μεταφορικά'],
+            'cart.shipping_pending' => ['Not selected yet', 'Δεν έχει επιλεγεί ακόμη'],
+            'cart.tax' => ['VAT', 'ΦΠΑ'],
+            'cart.total' => ['Total', 'Σύνολο'],
+            'cart.checkout' => ['Checkout', 'Ολοκλήρωση παραγγελίας'],
+            'cart.coupon_label' => ['Coupon code', 'Κωδικός κουπονιού'],
+            'cart.coupon_placeholder' => ['Coupon code', 'Κωδικός κουπονιού'],
+            'cart.coupon_apply' => ['Apply', 'Εφαρμογή'],
+            'cart.coupon_remove' => ['Remove', 'Αφαίρεση'],
+            'cart.coupon_invalid' => ["That coupon code isn't valid", 'Ο κωδικός κουπονιού δεν είναι έγκυρος'],
+
+            // ── Checkout page ────────────────────────────────────────────
+            'page.title' => ['Checkout', 'Ολοκλήρωση παραγγελίας'],
+            'page.contact_heading' => ['Contact', 'Στοιχεία επικοινωνίας'],
+            'page.guest_tab' => ['Guest', 'Ως επισκέπτης'],
+            'page.login_tab' => ['Log in', 'Σύνδεση'],
+            'page.email_label' => ['Email', 'Email'],
+            'page.recovery_consent' => [
+                "Email me a reminder if I don't finish my order",
+                'Στείλε μου μια υπενθύμιση αν δεν ολοκληρώσω την παραγγελία μου',
+            ],
+            'page.login_email_label' => ['Email', 'Email'],
+            'page.send_code' => ['Send code', 'Αποστολή κωδικού'],
+            'page.login_coming_soon' => [
+                'Login is coming soon — continue as a guest for now.',
+                'Η σύνδεση θα είναι διαθέσιμη σύντομα — προς το παρόν συνέχισε ως επισκέπτης.',
+            ],
+            'page.billing_heading' => ['Billing information', 'Στοιχεία τιμολόγησης'],
+            'page.shipping_heading' => ['Shipping information', 'Στοιχεία αποστολής'],
+            'page.same_as_billing' => ['Same as billing address', 'Ίδια με τη διεύθυνση τιμολόγησης'],
+            'page.first_name' => ['First name', 'Όνομα'],
+            'page.last_name' => ['Last name', 'Επώνυμο'],
+            'page.company_name' => ['Company name', 'Επωνυμία εταιρείας'],
+            'page.tax_identifier' => ['Tax ID', 'ΑΦΜ'],
+            'page.address_line_one' => ['Address', 'Διεύθυνση'],
+            'page.address_line_two' => ['Address line 2', 'Διεύθυνση (γραμμή 2)'],
+            'page.city' => ['City', 'Πόλη'],
+            'page.state' => ['Region / Prefecture', 'Νομός / Περιοχή'],
+            'page.state_placeholder' => ['Select a region', 'Επίλεξε νομό'],
+            'page.postcode' => ['Postcode', 'Ταχυδρομικός κώδικας'],
+            'page.country' => ['Country', 'Χώρα'],
+            'page.country_placeholder' => ['Select a country', 'Επίλεξε χώρα'],
+            'page.phone' => ['Phone', 'Τηλέφωνο'],
+            'page.delivery_instructions' => ['Delivery notes', 'Σχόλια για την παράδοση'],
+            'page.save_address' => ['Save and continue', 'Αποθήκευση και συνέχεια'],
+            'page.saving' => ['Saving…', 'Αποθήκευση…'],
+            'page.saved' => ['Saved', 'Αποθηκεύτηκε'],
+            'page.save_error' => ["Couldn't save — check your connection", 'Δεν αποθηκεύτηκε — έλεγξε τη σύνδεσή σου'],
+            'page.shipping_method_heading' => ['Shipping method', 'Τρόπος αποστολής'],
+            'page.shipping_method_empty' => [
+                'Add your shipping address to see delivery options.',
+                'Συμπλήρωσε τη διεύθυνση αποστολής για να δεις τις διαθέσιμες επιλογές.',
+            ],
+            'page.shipping_method_none' => [
+                'No delivery options are available for this address.',
+                'Δεν υπάρχουν διαθέσιμες επιλογές αποστολής για αυτή τη διεύθυνση.',
+            ],
+            'page.select_shipping_method' => ['Continue', 'Συνέχεια'],
+            'page.shipping_option_invalid' => [
+                'That shipping option is no longer available.',
+                'Αυτός ο τρόπος αποστολής δεν είναι πλέον διαθέσιμος.',
+            ],
+            'page.continue_to_payment' => ['Continue to payment', 'Συνέχεια στην πληρωμή'],
+            'page.order_summary_heading' => ['Order summary', 'Σύνοψη παραγγελίας'],
+
+            // ── Payment step ────────────────────────────────────────────
+            'page.payment_heading' => ['Payment', 'Πληρωμή'],
+            'page.payment_method_none' => [
+                'No payment methods are available right now.',
+                'Δεν υπάρχουν διαθέσιμοι τρόποι πληρωμής αυτή τη στιγμή.',
+            ],
+            'page.terms_accept' => [
+                "I accept the <a href=':terms' target='_blank'>Terms of Sale</a> and the <a href=':privacy' target='_blank'>Privacy Policy</a>",
+                "Αποδέχομαι τους <a href=':terms' target='_blank'>Όρους Πώλησης</a> και την <a href=':privacy' target='_blank'>Πολιτική Απορρήτου</a>",
+            ],
+            'page.terms_required' => [
+                'You must accept the terms to place your order.',
+                'Πρέπει να αποδεχτείς τους όρους για να ολοκληρώσεις την παραγγελία.',
+            ],
+            'page.withdrawal_notice' => [
+                "You have a 14-day right of withdrawal. <a href=':link' target='_blank'>See details</a>.",
+                "Έχεις δικαίωμα υπαναχώρησης εντός 14 ημερών. <a href=':link' target='_blank'>Δες λεπτομέρειες</a>.",
+            ],
+            'page.place_order' => ['Place order — payment obligation', 'Παραγγελία με υποχρέωση πληρωμής'],
+            'page.choose_payment_method' => ['Choose a payment method.', 'Επίλεξε τρόπο πληρωμής.'],
+            'page.shipping_method_required' => [
+                'Choose a shipping method below to continue.',
+                'Επίλεξε τρόπο αποστολής παρακάτω για να συνεχίσεις.',
+            ],
+            'page.payment_failed' => ['Payment failed. Please try again.', 'Η πληρωμή απέτυχε. Δοκίμασε ξανά.'],
+            'page.payment_incomplete_details' => [
+                'Complete your billing and shipping details above.',
+                'Συμπλήρωσε τα στοιχεία χρέωσης και αποστολής παραπάνω.',
+            ],
+            'page.payment_cart_changed' => [
+                'Your cart changed. Refresh the page and place your order again.',
+                'Το καλάθι σου άλλαξε. Ανανέωσε τη σελίδα και ολοκλήρωσε ξανά.',
+            ],
+            'page.payment_processing' => ['Confirming your payment…', 'Επιβεβαίωση πληρωμής…'],
+            'page.payment_processing_slow' => [
+                "Your payment is still processing. You'll get an email once it's confirmed.",
+                'Η πληρωμή σου επεξεργάζεται ακόμη. Θα λάβεις email μόλις επιβεβαιωθεί.',
+            ],
+
+            // ── Confirmation page ──────────────────────────────────────
+            'page.confirmation_title' => ['Your order', 'Η παραγγελία σου'],
+            'page.confirmation_heading' => [
+                'Thank you! Your order is confirmed.',
+                'Ευχαριστούμε! Η παραγγελία σου καταχωρήθηκε.',
+            ],
+            'page.confirmation_order_number' => ['Order number', 'Αριθμός παραγγελίας'],
+            'page.confirmation_email_note' => [
+                'A confirmation email will follow shortly.',
+                'Θα λάβεις email επιβεβαίωσης σύντομα.',
+            ],
+            'page.confirmation_shipping_to' => ['Shipping to', 'Αποστολή σε'],
+            'page.confirmation_billing' => ['Billing', 'Χρέωση'],
+            'page.confirmation_continue' => ['Continue shopping', 'Συνέχεια αγορών'],
+        ];
+    }
+}

src/Checkout/Exceptions/NoShippingAddressException.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Modules\Core\Checkout\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Thrown by CheckoutService::selectBoxNowLocker() when the cart has no
+ * shipping address yet to attach the chosen locker's meta to — the
+ * storefront must call setShippingAddress() first.
+ */
+class NoShippingAddressException extends RuntimeException
+{
+    public function __construct()
+    {
+        parent::__construct('Cannot select a Box Now locker before a shipping address is set.');
+    }
+}