v0.2.0

The short version: the storefront became swappable, and fulfillment
became real.

Themes

The storefront is now a selectable theme: compiled source chosen at build
time, not a package installed at runtime. Three ship in the box: the original
(default), Studio, and Market, a dense utilitarian layout. Every
theme is verified in CI, not just the one you selected. Under the hood, the
catalog, product detail, header/footer, and product card moved into
store-owned templates, each extraction gated by an equivalence test that
renders .astro components under Vitest (via AstroContainer) and proves the
output a customer sees didn't change.

Shipping labels (Shippo)

Add a Shippo token in Admin and a Buy shipping label card appears on
unfulfilled paid delivery orders, prefilled with the recorded address and
shipment weight. Buying a label records tracking, fulfills the order, emails
the customer, and keeps the label PDF on the order. Purchases are single-shot
and fenced with claim tokens: concurrent clicks can't double-buy, an in-flight
purchase locks out manual fulfillment, and an ambiguous outcome parks the
attempt until Reconcile with Shippo asks the provider what actually
happened. Domestic labels only for now. Test tokens buy fake labels.

Shipping and refunds

• Weight-based shipping rates, with the weight unit defaulted from the store's
  time zone and editable in Settings
• Local pickup as a third pricing mode
• Checkout pins the Stripe session to the quoted destination and never
  substitutes an address
• Refunds wired through Stripe, Admin, and customer email; reconciliation
  fails closed

Storefront caching

Opt-in Workers Caching for single-hostname deployments: tag-based invalidation
(shell, catalog, per-product tags), stock purges only when the
customer-visible state crosses In stock / Low stock / Sold out, and an
optional cross-version cache carried across deploys via an HMAC-authenticated
purge endpoint. Documented in the README's Caching section.

Also

• Prefixed public IDs everywhere: no database row ID crosses an application
  boundary
• Demo checkout is one click; checkout country defaults from GeoIP
• Integration tests moved to test/, every request bounded, dependency
  audits clean
• README: badges, screenshots, and an engineering-highlights section
• CONTRIBUTING.md and SECURITY.md, with private vulnerability reporting
  enabled on the repo

Full changelog: v0.1.1...v0.2.0

create-minshop v0.1.1

What's Changed

• Bump the minor-and-patch group across 1 directory with 4 updates by @dependabot[bot] in #3

New Contributors

• @dependabot[bot] made their first contribution in #3

Full Changelog: v0.1.0...v0.1.1