Add the printedparts plugin: 3D-printed parts storefront and kiosk

Catalog with photos and append-only print-file revisions, a stock
ledger attributing every take/restock/adjust to a badge-resolved
employee, a touch kiosk (scan bin, scan badge, keypad quantity) with a
deliberately open decrement-only take endpoint, 1x0.5in CODE128 bin
labels, low-stock email alerts to selected users, roles, or addresses,
and stock/consumption/by-person reports with a cache-vs-ledger
reconcile. Ships disabled; enable per site. Contract 0.13.0 adds the
mailer and the User/Role models to the plugin surface.

plugins/printedparts/README.md

@@ -0,0 +1,59 @@
+# Printedparts plugin
+
+3D-printed parts inventory + kiosk checkout
+
+This plugin was generated by `flask plugin new printedparts`. It satisfies the framework contract out of the box. Replace the example model and routes with your domain.
+
+## What's here
+
+- `plugin.py` - the `PrintedpartsPlugin` class extending `BasePlugin`. Edit `init_app` for custom setup, `on_install` to seed reference data.
+- `models/printedparts.py` - example Asset extension table. Replace `examplefield` with your domain fields.
+- `api/routes.py` - example list and detail endpoints. Add CRUD as needed.
+- `schemas/__init__.py` - marshmallow schema stub for request/response validation.
+- `tests/test_plugin.py` - smoke tests asserting contract compliance.
+- `manifest.json` - plugin metadata. Bump `version` on changes; keep `core_version` range broad.
+
+## Common edits
+
+| You want to... | Do this |
+|---|---|
+| Add a hook (search, navigation, dashboard widget) | Override the method in `PrintedpartsPlugin`. See the PLUGIN-HOOKS wiki page. |
+| Accept external collector data | Override `get_collector_schema()` to return a JSON Schema. See ADR-006. |
+| Add another model | Create `models/<other>.py`, export it in `models/__init__.py`, return it in `get_models()`. |
+| Add a CLI command | Override `get_cli_commands()` returning a list of Click commands. |
+
+## Frontend
+
+Vue components for this plugin live under `frontend/src/views/printedparts/` (per project convention). Backend scaffolding does not generate frontend yet; copy from an existing plugin's view files (e.g., `frontend/src/views/network/`) as a starting point.
+
+## Install and run
+
+```bash
+flask plugin install printedparts
+flask db migrate -m "Add printedparts plugin tables"
+flask db upgrade
+pytest plugins/printedparts/tests/
+```
+
+## References
+
+- the PLUGIN-HOOKS wiki page - canonical hook reference
+- the PLUGIN-QUICKSTART wiki page - 30-minute walkthrough
+- `migrations/adr/ADR-001-asset-as-platform-contract.md` - the platform contract
+- `migrations/adr/ADR-002-plugin-versioning.md` - versioning rules
+
+## Why the kiosk take endpoint is unauthenticated
+
+`POST /api/printedparts/kiosk/take` is the product's first open WRITE (every
+other kiosk endpoint is a read). Accepted deliberately, against the criteria
+in docs/proposals/printedparts-plugin.md:
+
+1. Decrement-only: it can reduce stock of an active item, nothing else.
+2. Fully attributed: it refuses to act without a badge that resolves under
+   the site policy; every action lands in the ledger with SSO + name + time.
+3. Bounded blast radius: worst case is stock counts driven low - visible in
+   the ledger and reversible with an adjust.
+4. Physically rate-limited: it serves a touch screen on the shop floor;
+   nothing enumerable, nothing worth scraping.
+
+Any future open-write endpoint must clear the same bar.

plugins/printedparts/__init__.py

@@ -0,0 +1,5 @@
+"""Printedparts plugin package."""
+
+from .plugin import PrintedpartsPlugin
+
+__all__ = ['PrintedpartsPlugin']

plugins/printedparts/api/__init__.py

@@ -0,0 +1,5 @@
+"""Printedparts plugin API package."""
+
+from .routes import printedparts_bp
+
+__all__ = ['printedparts_bp']

plugins/printedparts/api/routes.py

@@ -0,0 +1,679 @@
+"""Printedparts plugin API routes.
+
+Access model: browsing the catalog (items, detail, file listings) requires
+the printedparts.view permission; every mutation carries its own permission.
+Deliberately open: the kiosk endpoints (decision record in the proposal),
+the image serve and file download (fetched by <img> tags and anchor
+downloads, which cannot carry a JWT header), and the reports (jwt-optional
+like every other report in the product).
+"""
+
+from flask import Blueprint, request
+from flask_jwt_extended import jwt_required
+from sqlalchemy import or_
+
+from shopdb.api import (
+    db,
+    success_response,
+    error_response,
+    paginated_response,
+    ErrorCodes,
+    get_pagination_params,
+    paginate_query,
+    require_permission,
+)
+
+from ..models import PrintedItem
+
+printedparts_bp = Blueprint('printedparts', __name__)
+
+
+@printedparts_bp.route('/items', methods=['GET'])
+@jwt_required()
+@require_permission('printedparts.view')
+def list_items():
+    """List printed items, paginated; search + low-stock filter."""
+    page, per_page = get_pagination_params(request)
+    query = PrintedItem.query
+    if request.args.get('active', 'true').lower() != 'false':
+        query = query.filter(PrintedItem.isactive == True)
+    if search := request.args.get('search'):
+        like = f'%{search}%'
+        query = query.filter(or_(
+            PrintedItem.itemcode.ilike(like),
+            PrintedItem.itemname.ilike(like),
+            PrintedItem.itemdescription.ilike(like),
+            PrintedItem.binlocation.ilike(like),
+        ))
+    if request.args.get('lowstock', '').lower() == 'true':
+        query = query.filter(
+            PrintedItem.quantityonhand <= PrintedItem.lowstockthreshold)
+    query = query.order_by(PrintedItem.itemname)
+    items, total = paginate_query(query, page, per_page)
+    return paginated_response(
+        [item.to_dict() for item in items], page, per_page, total)
+
+
+@printedparts_bp.route('/items/<int:item_id>', methods=['GET'])
+@jwt_required()
+@require_permission('printedparts.view')
+def get_item(item_id: int):
+    """Get one printed item with its recent transactions."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found',
+                              http_code=404)
+    data = item.to_dict()
+    recent = (item.transactions
+              .order_by(db.desc('transactiondate'))
+              .limit(25).all())
+    data['recenttransactions'] = [t.to_dict() for t in recent]
+    return success_response(data)
+
+
+# --- catalog mutations (stage 6 adds permission gates on top of jwt) --------
+
+import glob
+import os
+
+from flask import current_app
+from werkzeug.utils import secure_filename
+
+from shopdb.api import Setting
+
+IMAGE_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.webp'}
+IMAGE_URL_PREFIX = '/api/printedparts/image/'
+
+EDITABLE_FIELDS = ('itemname', 'itemdescription', 'lowstockthreshold',
+                   'binlocation', 'printnotes')
+
+
+def _imagedir():
+    return os.path.join(current_app.instance_path, 'printedpartsimages')
+
+
+def _mint_itemcode(item):
+    """Set itemcode from the configured prefix + the flushed row id."""
+    prefix = Setting.get('printedparts_code_prefix') or '3DP'
+    item.itemcode = f'{prefix}{item.printeditemid:04d}'
+
+
+@printedparts_bp.route('/items', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.create')
+def create_item():
+    """Create a printed item; the itemcode is minted from the row id."""
+    data = request.get_json() or {}
+    itemname = (data.get('itemname') or '').strip()
+    if not itemname:
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'itemname is required')
+
+    threshold = data.get('lowstockthreshold')
+    if threshold is None:
+        threshold = int(Setting.get('printedparts_default_threshold') or 5)
+
+    item = PrintedItem(
+        itemname=itemname,
+        itemdescription=data.get('itemdescription'),
+        lowstockthreshold=threshold,
+        binlocation=data.get('binlocation'),
+        printnotes=data.get('printnotes'),
+        quantityonhand=0,
+    )
+    db.session.add(item)
+    db.session.flush()          # assigns printeditemid
+    _mint_itemcode(item)
+    db.session.commit()
+    return success_response(item.to_dict(), message='Printed item created',
+                            http_code=201)
+
+
+@printedparts_bp.route('/items/<int:item_id>', methods=['PUT'])
+@jwt_required()
+@require_permission('printedparts.edit')
+def update_item(item_id: int):
+    """Update catalog fields. Quantity moves ONLY through the ledger."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    data = request.get_json() or {}
+    if 'quantityonhand' in data:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            'quantityonhand is ledger-managed; use restock or adjust')
+    for field in EDITABLE_FIELDS:
+        if field in data:
+            setattr(item, field, data[field])
+    db.session.commit()
+    return success_response(item.to_dict(), message='Printed item updated')
+
+
+@printedparts_bp.route('/items/<int:item_id>', methods=['DELETE'])
+@jwt_required()
+@require_permission('printedparts.delete')
+def delete_item(item_id: int):
+    """Soft-retire an item; its ledger history stays."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    item.isactive = False
+    db.session.commit()
+    return success_response(message='Printed item retired')
+
+
+@printedparts_bp.route('/items/<int:item_id>/restore', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.delete')
+def restore_item(item_id: int):
+    """Bring a retired item back; code, photo, and history are intact."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    item.isactive = True
+    db.session.commit()
+    return success_response(item.to_dict(), message='Printed item restored')
+
+
+# --- item image: the models.py upload/serve/delete trio ---------------------
+
+@printedparts_bp.route('/items/<int:item_id>/image', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.edit')
+def upload_item_image(item_id: int):
+    """Upload (or replace) the photo for an item (multipart file=<image>)."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    upload = request.files.get('file')
+    if not upload or not upload.filename:
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'No file provided')
+    ext = os.path.splitext(upload.filename)[1].lower()
+    if ext not in IMAGE_EXTENSIONS:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              f'Unsupported image type {ext}')
+
+    imagedir = _imagedir()
+    os.makedirs(imagedir, exist_ok=True)
+    for old in glob.glob(os.path.join(
+            imagedir, secure_filename(f'printeditem-{item_id}') + '.*')):
+        os.remove(old)
+
+    filename = secure_filename(f'printeditem-{item_id}{ext}')
+    upload.save(os.path.join(imagedir, filename))
+    item.imageurl = f'{IMAGE_URL_PREFIX}{filename}'
+    db.session.commit()
+    return success_response(item.to_dict(), message='Item image uploaded')
+
+
+@printedparts_bp.route('/image/<path:filename>', methods=['GET'])
+def serve_item_image(filename):
+    """Serve an uploaded item image (public - kiosk and list read it)."""
+    from flask import send_from_directory
+    return send_from_directory(_imagedir(), filename)
+
+
+@printedparts_bp.route('/items/<int:item_id>/image', methods=['DELETE'])
+@jwt_required()
+@require_permission('printedparts.delete')
+def delete_item_image(item_id: int):
+    """Clear an item image; delete the file only if this plugin owns it."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    url = item.imageurl or ''
+    if url.startswith(IMAGE_URL_PREFIX):
+        filename = secure_filename(url[len(IMAGE_URL_PREFIX):])
+        path = os.path.join(_imagedir(), filename)
+        if os.path.exists(path):
+            os.remove(path)
+    item.imageurl = None
+    db.session.commit()
+    return success_response(item.to_dict(), message='Item image removed')
+
+
+# --- the ledger: restock and adjust (stage 6 gates with printedparts.restock)
+
+from ..models import PrintedItemTransaction
+from ..services.badges import BadgeError, resolve_badge
+
+
+def _ledger_write(item, transactiontype, quantitychange, sso, name, reason=None):
+    """Append a ledger row and move the cached quantity in ONE commit.
+
+    The single-commit invariant is what keeps quantityonhand equal to the
+    ledger sum; every write path must go through here. Fires the low-stock
+    alert when this write CROSSES the item's threshold downward - crossing
+    (not being below) is the natural debounce: one alert per depletion, and
+    restocking above the threshold rearms it.
+    """
+    quantitybefore = item.quantityonhand
+    item.quantityonhand += quantitychange
+    db.session.add(PrintedItemTransaction(
+        printeditemid=item.printeditemid,
+        transactiontype=transactiontype,
+        quantitychange=quantitychange,
+        employeesso=sso,
+        employeename=name,
+        reason=reason,
+    ))
+    db.session.commit()
+    if (quantitychange < 0
+            and quantitybefore > item.lowstockthreshold
+            and item.quantityonhand <= item.lowstockthreshold):
+        _send_lowstock_alert(item)
+
+
+def _alert_recipients():
+    """Merge selected shopdb users' account emails with the free-text list.
+
+    Empty result means fall back to the site-wide alert_recipients."""
+    from shopdb.api import User, Role
+    recipients = []
+    userids = (Setting.get('printedparts_alert_userids') or '').strip()
+    for rawid in userids.split(','):
+        rawid = rawid.strip()
+        if not rawid.isdigit():
+            continue
+        user = db.session.get(User, int(rawid))
+        if user and user.isactive and user.email:
+            recipients.append(user.email)
+    roleids = (Setting.get('printedparts_alert_roleids') or '').strip()
+    for rawid in roleids.split(','):
+        rawid = rawid.strip()
+        if not rawid.isdigit():
+            continue
+        role = db.session.get(Role, int(rawid))
+        if role:
+            recipients.extend(member.email for member in role.users
+                              if member.isactive and member.email)
+    extra = (Setting.get('printedparts_alert_email') or '').strip()
+    recipients.extend(address.strip() for address in extra.split(',')
+                      if address.strip())
+    # dedupe, order-preserving
+    return list(dict.fromkeys(recipients))
+
+
+def _send_lowstock_alert(item):
+    """Best-effort email when an item crosses its low-stock threshold.
+
+    Recipients: Setting printedparts_alert_email (comma-separated), falling
+    back to the site's alert_recipients. Never fails the transaction - the
+    ledger write already committed."""
+    from shopdb.api import send_email, send_alert
+    subject = (f'Low stock: {item.itemname} ({item.itemcode}) - '
+               f'{item.quantityonhand} left')
+    html = (f'<p><strong>{item.itemname}</strong> ({item.itemcode}) is down '
+            f'to <strong>{item.quantityonhand}</strong> '
+            f'(threshold {item.lowstockthreshold}).</p>'
+            f'<p>Bin: {item.binlocation or "-"}</p>'
+            f'<p>Time to print more.</p>')
+    try:
+        recipients = _alert_recipients()
+        if recipients:
+            send_email(recipients, subject, html)
+        else:
+            send_alert(subject, html)
+    except Exception:
+        import logging
+        logging.getLogger(__name__).exception(
+            'Low-stock alert failed for %s', item.itemcode)
+
+
+@printedparts_bp.route('/items/<int:item_id>/restock', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.restock')
+def restock_item(item_id: int):
+    """Add freshly printed stock. Body: {quantity, badge}."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item or not item.isactive:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    data = request.get_json() or {}
+    quantity = data.get('quantity')
+    if not isinstance(quantity, int) or quantity < 1:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'quantity must be a positive integer')
+    try:
+        sso, name = resolve_badge(data.get('badge'))
+    except BadgeError as badge_error:
+        return error_response(ErrorCodes.VALIDATION_ERROR, str(badge_error),
+                              http_code=422)
+    _ledger_write(item, 'restock', quantity, sso, name)
+    return success_response(item.to_dict(), message='Stock added')
+
+
+@printedparts_bp.route('/items/<int:item_id>/adjust', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.restock')
+def adjust_item(item_id: int):
+    """Correct the count (damage, recount). Body: {quantitychange, reason, badge}."""
+    item = db.session.get(PrintedItem, item_id)
+    if not item or not item.isactive:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    data = request.get_json() or {}
+    quantitychange = data.get('quantitychange')
+    if not isinstance(quantitychange, int) or quantitychange == 0:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'quantitychange must be a non-zero integer')
+    reason = (data.get('reason') or '').strip()
+    if not reason:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'reason is required for an adjustment')
+    if item.quantityonhand + quantitychange < 0:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            f'Adjustment would drive stock below zero '
+            f'(on hand: {item.quantityonhand})')
+    try:
+        sso, name = resolve_badge(data.get('badge'))
+    except BadgeError as badge_error:
+        return error_response(ErrorCodes.VALIDATION_ERROR, str(badge_error),
+                              http_code=422)
+    _ledger_write(item, 'adjust', quantitychange, sso, name, reason=reason)
+    return success_response(item.to_dict(), message='Stock adjusted')
+
+
+# --- kiosk: UNauthenticated by decision record --------------------------------
+# The take endpoint is the product's first open WRITE. The proposal's decision
+# record sets the bar it must meet: decrement-only, badge-attributed, bounded,
+# physically rate-limited. It can reduce stock of an active item and nothing
+# else; identity comes from the badge resolved server-side, never the client.
+
+def _kiosk_find_item(itemcode):
+    """Resolve a scanned or typed code to an active item.
+
+    Accepts the full code (WJRP0042) or bare digits from the touch keypad
+    (42 -> prefix + zero-pad), so manual entry never needs letters."""
+    itemcode = (itemcode or '').strip()
+    item = PrintedItem.query.filter(
+        PrintedItem.itemcode == itemcode,
+        PrintedItem.isactive == True).first()
+    if not item and itemcode.isdigit():
+        # The digits in a minted code ARE the row id, so id lookup keeps
+        # working even for labels printed under an older prefix.
+        candidate = db.session.get(PrintedItem, int(itemcode))
+        if candidate and candidate.isactive:
+            item = candidate
+    return item
+
+
+@printedparts_bp.route('/kiosk/item/<itemcode>', methods=['GET'])
+def kiosk_item(itemcode):
+    """Item summary for a scanned bin barcode (open read for the kiosk)."""
+    item = _kiosk_find_item(itemcode)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              'No part matches that barcode', http_code=404)
+    return success_response(item.to_dict())
+
+
+@printedparts_bp.route('/kiosk/take', methods=['POST'])
+def kiosk_take():
+    """Take parts from a bin. Body: {itemcode, badge, quantity}."""
+    data = request.get_json() or {}
+
+    item = _kiosk_find_item(data.get('itemcode'))
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              'No part matches that barcode', http_code=404)
+
+    quantity = data.get('quantity')
+    if not isinstance(quantity, int) or quantity < 1:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'Enter how many you are taking')
+    if quantity > item.quantityonhand:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            f'Only {item.quantityonhand} on hand - take fewer or see the '
+            f'parts team')
+
+    try:
+        sso, name = resolve_badge(data.get('badge'))
+    except BadgeError as badge_error:
+        return error_response(ErrorCodes.VALIDATION_ERROR, str(badge_error),
+                              http_code=422)
+
+    _ledger_write(item, 'take', -quantity, sso, name)
+    return success_response(item.to_dict(),
+                            message=f'Took {quantity}, {item.quantityonhand} left')
+
+
+# --- reports (merged into GET /api/reports while the plugin is enabled) ------
+
+import csv
+import io
+
+from flask import Response
+from sqlalchemy import func
+
+
+def _csv_response(rows, columns, filename):
+    """CSV download; local helper because generate_csv is not on the
+    contract surface (shopdb.api)."""
+    output = io.StringIO()
+    writer = csv.writer(output)
+    writer.writerow(columns)
+    for row in rows:
+        writer.writerow([row.get(column, '') for column in columns])
+    return Response(
+        output.getvalue(), mimetype='text/csv',
+        headers={'Content-Disposition': f'attachment; filename={filename}'})
+
+
+@printedparts_bp.route('/reports/stock', methods=['GET'])
+@jwt_required(optional=True)
+def report_stock():
+    """Stock levels with low-stock flags and the cache-vs-ledger reconcile.
+
+    ledgerdelta should always be 0; anything else means a write path
+    bypassed the single-commit rule and needs finding.
+    """
+    # int() the sums: MySQL SUM returns Decimal, which JSON-serializes as a
+    # string and breaks the delta arithmetic's type.
+    ledger = {itemid: int(total) for itemid, total in
+              db.session.query(
+                  PrintedItemTransaction.printeditemid,
+                  func.coalesce(func.sum(PrintedItemTransaction.quantitychange), 0))
+              .group_by(PrintedItemTransaction.printeditemid).all()}
+    rows = []
+    for item in PrintedItem.query.filter_by(isactive=True).order_by(
+            PrintedItem.itemname).all():
+        rows.append({
+            'itemcode': item.itemcode,
+            'itemname': item.itemname,
+            'binlocation': item.binlocation or '',
+            'quantityonhand': item.quantityonhand,
+            'lowstockthreshold': item.lowstockthreshold,
+            'islowstock': item.islowstock,
+            'ledgerdelta': item.quantityonhand - ledger.get(item.printeditemid, 0),
+        })
+    columns = ['itemcode', 'itemname', 'binlocation', 'quantityonhand',
+               'lowstockthreshold', 'islowstock', 'ledgerdelta']
+    if request.args.get('format') == 'csv':
+        return _csv_response(rows, columns, 'printedparts-stock.csv')
+    return success_response({'columns': columns, 'rows': rows})
+
+
+@printedparts_bp.route('/reports/consumption', methods=['GET'])
+@jwt_required(optional=True)
+def report_consumption():
+    """Takes per item, optionally bounded by ?days=<n> (default 30)."""
+    days = request.args.get('days', 30, type=int)
+    query = (db.session.query(
+                PrintedItem.itemcode,
+                PrintedItem.itemname,
+                func.count(PrintedItemTransaction.transactionid),
+                func.coalesce(func.sum(-PrintedItemTransaction.quantitychange), 0))
+             .join(PrintedItemTransaction,
+                   PrintedItemTransaction.printeditemid == PrintedItem.printeditemid)
+             .filter(PrintedItemTransaction.transactiontype == 'take'))
+    if days > 0:
+        from datetime import datetime, timedelta, timezone
+        cutoff = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(days=days)
+        query = query.filter(PrintedItemTransaction.transactiondate >= cutoff)
+    query = query.group_by(PrintedItem.itemcode, PrintedItem.itemname)
+    rows = [{'itemcode': code, 'itemname': name, 'takes': takes,
+             'quantitytaken': int(taken)}
+            for code, name, takes, taken in query.all()]
+    rows.sort(key=lambda row: row['quantitytaken'], reverse=True)
+    columns = ['itemcode', 'itemname', 'takes', 'quantitytaken']
+    if request.args.get('format') == 'csv':
+        return _csv_response(rows, columns, 'printedparts-consumption.csv')
+    return success_response({'columns': columns, 'rows': rows, 'days': days})
+
+
+@printedparts_bp.route('/reports/by-person', methods=['GET'])
+@jwt_required(optional=True)
+def report_by_person():
+    """Takes grouped by employee, optionally bounded by ?days=<n> (default 30)."""
+    days = request.args.get('days', 30, type=int)
+    query = (db.session.query(
+                PrintedItemTransaction.employeesso,
+                func.max(PrintedItemTransaction.employeename),
+                func.count(PrintedItemTransaction.transactionid),
+                func.coalesce(func.sum(-PrintedItemTransaction.quantitychange), 0))
+             .filter(PrintedItemTransaction.transactiontype == 'take'))
+    if days > 0:
+        from datetime import datetime, timedelta, timezone
+        cutoff = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(days=days)
+        query = query.filter(PrintedItemTransaction.transactiondate >= cutoff)
+    query = query.group_by(PrintedItemTransaction.employeesso)
+    rows = [{'employeesso': sso, 'employeename': name or '', 'takes': takes,
+             'quantitytaken': int(taken)}
+            for sso, name, takes, taken in query.all()]
+    rows.sort(key=lambda row: row['quantitytaken'], reverse=True)
+    columns = ['employeesso', 'employeename', 'takes', 'quantitytaken']
+    if request.args.get('format') == 'csv':
+        return _csv_response(rows, columns, 'printedparts-by-person.csv')
+    return success_response({'columns': columns, 'rows': rows, 'days': days})
+
+
+# --- print files: append-only revisions per item ------------------------------
+
+from flask_jwt_extended import get_jwt_identity
+
+from ..models import PrintedItemFile
+
+FILE_EXTENSIONS = {'.stl', '.3mf', '.gcode', '.gco', '.bgcode', '.step',
+                   '.stp', '.obj', '.amf'}
+MAX_FILE_BYTES = 100 * 1024 * 1024
+
+
+def _filedir():
+    return os.path.join(current_app.instance_path, 'printedpartsfiles')
+
+
+def _uploader_name():
+    from shopdb.api import User
+    identity = get_jwt_identity()
+    try:
+        user = db.session.get(User, int(identity))
+        if user:
+            return user.username
+    except (TypeError, ValueError):
+        pass
+    return str(identity)
+
+
+@printedparts_bp.route('/items/<int:item_id>/files', methods=['GET'])
+@jwt_required()
+@require_permission('printedparts.view')
+def list_item_files(item_id: int):
+    """Revision history, newest first."""
+    files = (PrintedItemFile.query.filter_by(printeditemid=item_id)
+             .order_by(PrintedItemFile.revision.desc()).all())
+    return success_response([f.to_dict() for f in files])
+
+
+@printedparts_bp.route('/items/<int:item_id>/files', methods=['POST'])
+@jwt_required()
+@require_permission('printedparts.edit')
+def upload_item_file(item_id: int):
+    """Upload the next revision of the item's print file.
+
+    multipart/form-data: file=<stl/3mf/gcode/...>, note=<what changed>.
+    Revisions are append-only; nothing is replaced.
+    """
+    item = db.session.get(PrintedItem, item_id)
+    if not item:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Printed item {item_id} not found', http_code=404)
+    upload = request.files.get('file')
+    if not upload or not upload.filename:
+        return error_response(ErrorCodes.VALIDATION_ERROR, 'No file provided')
+    ext = os.path.splitext(upload.filename)[1].lower()
+    if ext not in FILE_EXTENSIONS:
+        return error_response(
+            ErrorCodes.VALIDATION_ERROR,
+            f'Unsupported file type {ext}; allowed: '
+            + ', '.join(sorted(FILE_EXTENSIONS)))
+
+    upload.stream.seek(0, os.SEEK_END)
+    filesize = upload.stream.tell()
+    upload.stream.seek(0)
+    if filesize > MAX_FILE_BYTES:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'File exceeds the 100 MB limit')
+
+    latest = (db.session.query(db.func.max(PrintedItemFile.revision))
+              .filter_by(printeditemid=item_id).scalar()) or 0
+    revision = latest + 1
+
+    filedir = _filedir()
+    os.makedirs(filedir, exist_ok=True)
+    storedfilename = secure_filename(
+        f'printeditem-{item_id}-rev{revision}{ext}')
+    upload.save(os.path.join(filedir, storedfilename))
+
+    record = PrintedItemFile(
+        printeditemid=item_id,
+        revision=revision,
+        filename=secure_filename(upload.filename),
+        storedfilename=storedfilename,
+        filesize=filesize,
+        uploadnote=(request.form.get('note') or '').strip() or None,
+        uploadedby=_uploader_name(),
+    )
+    db.session.add(record)
+    db.session.commit()
+    return success_response(record.to_dict(),
+                            message=f'Revision {revision} uploaded',
+                            http_code=201)
+
+
+@printedparts_bp.route('/files/<int:file_id>/download', methods=['GET'])
+@jwt_required(optional=True)
+def download_item_file(file_id: int):
+    """Download a revision under its original filename."""
+    from flask import send_from_directory
+    record = db.session.get(PrintedItemFile, file_id)
+    if not record:
+        return error_response(ErrorCodes.NOT_FOUND, 'File not found',
+                              http_code=404)
+    return send_from_directory(_filedir(), record.storedfilename,
+                               as_attachment=True,
+                               download_name=record.filename)
+
+
+@printedparts_bp.route('/files/<int:file_id>', methods=['DELETE'])
+@jwt_required()
+@require_permission('printedparts.delete')
+def delete_item_file(file_id: int):
+    """Remove a bad revision (wrong file uploaded). History otherwise stays."""
+    record = db.session.get(PrintedItemFile, file_id)
+    if not record:
+        return error_response(ErrorCodes.NOT_FOUND, 'File not found',
+                              http_code=404)
+    path = os.path.join(_filedir(), record.storedfilename)
+    if os.path.exists(path):
+        os.remove(path)
+    db.session.delete(record)
+    db.session.commit()
+    return success_response(message='Revision removed')

plugins/printedparts/frontend-api-snippet.js

@@ -0,0 +1,35 @@
+/*
+ * Printedparts API client snippet.
+ *
+ * Paste this printedpartsApi block into frontend/src/api/index.js (next to the
+ * other per-resource blocks). Then, in the generated PrintedpartsList, PrintedpartsDetail,
+ * and PrintedpartsForm views, delete the local printedpartsApi const and import the shared
+ * one instead:
+ *
+ *   import { printedpartsApi } from '../../api'
+ *
+ * The scaffolded views ship with an identical inline client so they build and
+ * run before you touch the shared api module. This file is NOT auto-merged into
+ * api/index.js on purpose; that module is hand-maintained and shared.
+ *
+ * The create/update/delete calls assume matching POST/PUT/DELETE routes exist
+ * on the backend. The scaffolded api/routes.py only ships list and get; add the
+ * write endpoints when you wire up the form.
+ */
+export const printedpartsApi = {
+  list(params = {}) {
+    return api.get('/printedparts', { params })
+  },
+  get(itemId) {
+    return api.get(`/printedparts/${itemId}`)
+  },
+  create(data) {
+    return api.post('/printedparts', data)
+  },
+  update(itemId, data) {
+    return api.put(`/printedparts/${itemId}`, data)
+  },
+  remove(itemId) {
+    return api.delete(`/printedparts/${itemId}`)
+  }
+}

plugins/printedparts/manifest.json

@@ -0,0 +1,11 @@
+{
+    "name": "printedparts",
+    "version": "0.1.0",
+    "description": "3D-printed parts inventory + kiosk checkout",
+    "display_name": "3D Printed Parts",
+    "author": "",
+    "dependencies": ["employees"],
+    "core_version": ">=0.12.0,<1.0.0",
+    "api_prefix": "/api/printedparts",
+    "default_enabled": false
+}

plugins/printedparts/migrations/env.py

@@ -0,0 +1,14 @@
+"""Alembic environment for the printedparts plugin migration chain.
+
+Delegates to the shared runner in shopdb.plugins.alembic_template, which
+filters the metadata to this plugin's tables and drives Alembic against the
+per-plugin version table alembic_version_printedparts (ADR-008). This plugin
+is NEW (post-cutover): its 0001 baseline really CREATES its tables.
+"""
+import os
+
+os.environ['PLUGIN_NAME'] = 'printedparts'
+
+from shopdb.plugins.alembic_template import run_migrations  # noqa: E402
+
+run_migrations()

plugins/printedparts/migrations/script.py.mako

@@ -0,0 +1,24 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+
+"""
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision = ${repr(up_revision)}
+down_revision = ${repr(down_revision)}
+branch_labels = ${repr(branch_labels)}
+depends_on = ${repr(depends_on)}
+
+
+def upgrade():
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade():
+    ${downgrades if downgrades else "pass"}

plugins/printedparts/migrations/versions/0001_printedparts_baseline.py

@@ -0,0 +1,71 @@
+"""printedparts plugin baseline (real create).
+
+Post-ADR-008 plugin: this per-plugin chain is the sole authoritative creator
+of printeditems and printeditemtransactions - the core chain never knew them.
+Runs from `flask plugin install printedparts` (and `flask plugin upgrade-all`)
+after `flask db upgrade` builds the core schema.
+
+Both tables are self-contained (the only FK is transactions -> items inside
+the plugin), so the shared create_plugin_tables helper would work here; the
+ops are written out explicitly anyway to match the measuringtools exemplar
+and keep the baseline reviewable.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'printedparts0001baseline'
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'printeditems',
+        sa.Column('printeditemid', sa.Integer(), nullable=False),
+        sa.Column('itemcode', sa.String(length=20), nullable=True),
+        sa.Column('itemname', sa.String(length=120), nullable=False),
+        sa.Column('itemdescription', sa.String(length=500), nullable=True),
+        sa.Column('imageurl', sa.String(length=255), nullable=True),
+        sa.Column('quantityonhand', sa.Integer(), nullable=False),
+        sa.Column('lowstockthreshold', sa.Integer(), nullable=False),
+        sa.Column('binlocation', sa.String(length=100), nullable=True),
+        sa.Column('printnotes', sa.Text(), nullable=True),
+        sa.Column('createddate', sa.DateTime(), nullable=False),
+        sa.Column('modifieddate', sa.DateTime(), nullable=False),
+        sa.Column('isactive', sa.Boolean(), nullable=False),
+        sa.PrimaryKeyConstraint('printeditemid'),
+        sa.UniqueConstraint('itemcode'),
+    )
+    op.create_index('ix_printeditems_itemcode', 'printeditems', ['itemcode'])
+
+    op.create_table(
+        'printeditemtransactions',
+        sa.Column('transactionid', sa.Integer(), nullable=False),
+        sa.Column('printeditemid', sa.Integer(), nullable=False),
+        sa.Column('transactiontype', sa.String(length=10), nullable=False),
+        sa.Column('quantitychange', sa.Integer(), nullable=False),
+        sa.Column('employeesso', sa.String(length=20), nullable=False),
+        sa.Column('employeename', sa.String(length=120), nullable=True),
+        sa.Column('reason', sa.String(length=255), nullable=True),
+        sa.Column('transactiondate', sa.DateTime(), nullable=False),
+        sa.Column('createddate', sa.DateTime(), nullable=False),
+        sa.Column('modifieddate', sa.DateTime(), nullable=False),
+        sa.Column('isactive', sa.Boolean(), nullable=False),
+        sa.ForeignKeyConstraint(['printeditemid'], ['printeditems.printeditemid'],
+                                ondelete='CASCADE'),
+        sa.PrimaryKeyConstraint('transactionid'),
+    )
+    op.create_index('ix_printeditemtransactions_printeditemid',
+                    'printeditemtransactions', ['printeditemid'])
+    op.create_index('ix_printeditemtransactions_employeesso',
+                    'printeditemtransactions', ['employeesso'])
+    op.create_index('ix_printeditemtransactions_transactiondate',
+                    'printeditemtransactions', ['transactiondate'])
+
+
+def downgrade():
+    op.drop_table('printeditemtransactions')
+    op.drop_table('printeditems')

plugins/printedparts/migrations/versions/0002_printeditemfiles.py

@@ -0,0 +1,43 @@
+"""Add printeditemfiles: append-only print-file revisions per item.
+
+The plugin's first incremental migration on top of its 0001 baseline -
+the ADR-008 payoff: the plugin evolves its own schema without touching
+the core chain. Applied by `flask plugin upgrade-all`.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'printedparts0002files'
+down_revision = 'printedparts0001baseline'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'printeditemfiles',
+        sa.Column('fileid', sa.Integer(), nullable=False),
+        sa.Column('printeditemid', sa.Integer(), nullable=False),
+        sa.Column('revision', sa.Integer(), nullable=False),
+        sa.Column('filename', sa.String(length=255), nullable=False),
+        sa.Column('storedfilename', sa.String(length=191), nullable=False),
+        sa.Column('filesize', sa.Integer(), nullable=False),
+        sa.Column('uploadnote', sa.String(length=255), nullable=True),
+        sa.Column('uploadedby', sa.String(length=80), nullable=False),
+        sa.Column('createddate', sa.DateTime(), nullable=False),
+        sa.Column('modifieddate', sa.DateTime(), nullable=False),
+        sa.Column('isactive', sa.Boolean(), nullable=False),
+        sa.ForeignKeyConstraint(['printeditemid'],
+                                ['printeditems.printeditemid'],
+                                ondelete='CASCADE'),
+        sa.PrimaryKeyConstraint('fileid'),
+        sa.UniqueConstraint('storedfilename'),
+    )
+    op.create_index('ix_printeditemfiles_printeditemid',
+                    'printeditemfiles', ['printeditemid'])
+
+
+def downgrade():
+    op.drop_table('printeditemfiles')

plugins/printedparts/models/__init__.py

@@ -0,0 +1,11 @@
+"""Printedparts plugin models."""
+
+from .printeditem import (
+    PrintedItem,
+    PrintedItemTransaction,
+    PrintedItemFile,
+    TRANSACTION_TYPES,
+)
+
+__all__ = ['PrintedItem', 'PrintedItemTransaction', 'PrintedItemFile',
+           'TRANSACTION_TYPES']

plugins/printedparts/models/printeditem.py

@@ -0,0 +1,135 @@
+"""Printedparts models.
+
+PrintedItem is a KIND of 3D-printed part with a quantity on hand - a
+consumable, not an ADR-001 asset (which is one row per physical thing).
+PrintedItemTransaction is the ledger: every take, restock, and adjust as a
+signed quantity change attributed to a badge-resolved employee. The ledger is
+the source of truth; quantityonhand is a cache moved in the same commit as
+each ledger write, and the stock report reconciles the two.
+"""
+
+from datetime import datetime, timezone
+
+from shopdb.api import db, BaseModel
+
+
+def _utcnow():
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+TRANSACTION_TYPES = ('take', 'restock', 'adjust')
+
+
+class PrintedItem(BaseModel):
+    """A printable part the engineers stock in bins."""
+
+    __tablename__ = 'printeditems'
+
+    printeditemid = db.Column(db.Integer, primary_key=True)
+    itemcode = db.Column(db.String(20), unique=True, index=True,
+                         comment='Generated bin-label code, e.g. 3DP-0042')
+    itemname = db.Column(db.String(120), nullable=False)
+    itemdescription = db.Column(db.String(500))
+    imageurl = db.Column(db.String(255))
+    quantityonhand = db.Column(db.Integer, nullable=False, default=0)
+    lowstockthreshold = db.Column(db.Integer, nullable=False, default=5)
+    binlocation = db.Column(db.String(100))
+    printnotes = db.Column(db.Text, comment='Material, print time, slicer file')
+
+    transactions = db.relationship(
+        'PrintedItemTransaction', backref='printeditem',
+        cascade='all, delete-orphan', passive_deletes=True, lazy='dynamic')
+
+    @property
+    def islowstock(self):
+        return self.quantityonhand <= self.lowstockthreshold
+
+    def to_dict(self):
+        return {
+            'printeditemid': self.printeditemid,
+            'itemcode': self.itemcode,
+            'itemname': self.itemname,
+            'itemdescription': self.itemdescription,
+            'imageurl': self.imageurl,
+            'quantityonhand': self.quantityonhand,
+            'lowstockthreshold': self.lowstockthreshold,
+            'islowstock': self.islowstock,
+            'binlocation': self.binlocation,
+            'printnotes': self.printnotes,
+            'isactive': self.isactive,
+            'createddate': self.createddate.isoformat() + 'Z' if self.createddate else None,
+            'modifieddate': self.modifieddate.isoformat() + 'Z' if self.modifieddate else None,
+        }
+
+
+class PrintedItemTransaction(BaseModel):
+    """One signed stock movement, always attributed to an employee."""
+
+    __tablename__ = 'printeditemtransactions'
+
+    transactionid = db.Column(db.Integer, primary_key=True)
+    printeditemid = db.Column(
+        db.Integer,
+        db.ForeignKey('printeditems.printeditemid', ondelete='CASCADE'),
+        nullable=False, index=True)
+    transactiontype = db.Column(db.String(10), nullable=False,
+                                comment='take, restock, or adjust')
+    quantitychange = db.Column(db.Integer, nullable=False,
+                               comment='Negative for take, signed for adjust')
+    employeesso = db.Column(db.String(20), nullable=False, index=True)
+    employeename = db.Column(db.String(120))
+    reason = db.Column(db.String(255))
+    transactiondate = db.Column(db.DateTime, nullable=False, default=_utcnow,
+                                index=True)
+
+    def to_dict(self):
+        return {
+            'transactionid': self.transactionid,
+            'printeditemid': self.printeditemid,
+            'transactiontype': self.transactiontype,
+            'quantitychange': self.quantitychange,
+            'employeesso': self.employeesso,
+            'employeename': self.employeename,
+            'reason': self.reason,
+            'transactiondate': self.transactiondate.isoformat() + 'Z' if self.transactiondate else None,
+        }
+
+
+class PrintedItemFile(BaseModel):
+    """One uploaded revision of an item's print file (STL/3MF/gcode/...).
+
+    Revisions are append-only per item: uploading assigns the next revision
+    number and never replaces earlier files, so the history of what was
+    actually printed stays reconstructible. The current file is simply the
+    highest revision.
+    """
+
+    __tablename__ = 'printeditemfiles'
+
+    fileid = db.Column(db.Integer, primary_key=True)
+    printeditemid = db.Column(
+        db.Integer,
+        db.ForeignKey('printeditems.printeditemid', ondelete='CASCADE'),
+        nullable=False, index=True)
+    revision = db.Column(db.Integer, nullable=False)
+    filename = db.Column(db.String(255), nullable=False,
+                         comment='Original upload name, used for download')
+    storedfilename = db.Column(db.String(191), nullable=False, unique=True,
+                               comment='191: unique index fits the 767-byte MySQL prefix')
+    filesize = db.Column(db.Integer, nullable=False)
+    uploadnote = db.Column(db.String(255),
+                           comment='What changed in this revision')
+    uploadedby = db.Column(db.String(80), nullable=False,
+                           comment='Username of the uploader')
+
+    def to_dict(self):
+        return {
+            'fileid': self.fileid,
+            'printeditemid': self.printeditemid,
+            'revision': self.revision,
+            'filename': self.filename,
+            'filesize': self.filesize,
+            'uploadnote': self.uploadnote,
+            'uploadedby': self.uploadedby,
+            'uploadeddate': self.createddate.isoformat() + 'Z' if self.createddate else None,
+        }

plugins/printedparts/plugin.py

@@ -0,0 +1,147 @@
+"""Printedparts plugin main class.
+
+3D-printed parts inventory + kiosk checkout. Quantity-based consumables:
+one row is a KIND of part with a count, not an individually tracked asset,
+so unlike most plugins this one seeds NO AssetType (ADR-001 assets are
+one-row-per-physical-thing). See docs/proposals/printedparts-plugin.md.
+"""
+
+import json
+import logging
+from pathlib import Path
+from typing import List, Optional, Type
+
+from flask import Flask, Blueprint
+
+from shopdb.plugins.base import BasePlugin, PluginMeta
+from shopdb.api import db, Setting
+
+from .models import PrintedItem, PrintedItemTransaction, PrintedItemFile
+from .api import printedparts_bp
+
+logger = logging.getLogger(__name__)
+
+
+class PrintedpartsPlugin(BasePlugin):
+    """3D-printed parts inventory + kiosk checkout."""
+
+    def __init__(self):
+        manifest_path = Path(__file__).parent / 'manifest.json'
+        with open(manifest_path) as f:
+            self._manifest = json.load(f)
+
+    @property
+    def meta(self) -> PluginMeta:
+        return PluginMeta(
+            name=self._manifest['name'],
+            version=self._manifest['version'],
+            description=self._manifest['description'],
+            author=self._manifest.get('author', ''),
+            dependencies=self._manifest.get('dependencies', []),
+            core_version=self._manifest.get('core_version', '>=0.1.0'),
+            api_prefix=self._manifest.get('api_prefix'),
+        )
+
+    def get_blueprint(self) -> Optional[Blueprint]:
+        return printedparts_bp
+
+    def get_models(self) -> List[Type]:
+        return [PrintedItem, PrintedItemTransaction, PrintedItemFile]
+
+    def init_app(self, app: Flask, db_instance) -> None:
+        logger.info(f'Printedparts plugin initialized (v{self.meta.version})')
+
+    def get_permissions(self) -> List:
+        """RBAC permissions this plugin owns (seeded on install/enable)."""
+        return [
+            ('printedparts.view', 'View 3D printed parts', 'printedparts'),
+            ('printedparts.create', 'Create printed parts', 'printedparts'),
+            ('printedparts.edit', 'Edit printed parts', 'printedparts'),
+            ('printedparts.delete', 'Retire printed parts', 'printedparts'),
+            ('printedparts.restock', 'Restock and adjust stock counts',
+             'printedparts'),
+        ]
+
+    def get_settings_cards(self) -> List[dict]:
+        return [
+            {
+                'group': '3D Printed Parts',
+                'to': '/settings/printedparts',
+                'icon': 'box',
+                'title': '3D Parts Settings',
+                'description': 'Item code prefix, default threshold, kiosk '
+                               'badge policy, low-stock alert recipients',
+                'position': 47,
+            },
+        ]
+
+    def get_reports(self) -> List[dict]:
+        return [
+            {
+                'id': 'printedparts-stock',
+                'name': '3D Parts Stock',
+                'description': 'Stock levels with low-stock flags and the '
+                               'cache-vs-ledger reconcile check',
+                'category': 'inventory',
+                'endpoint': '/api/printedparts/reports/stock',
+            },
+            {
+                'id': 'printedparts-consumption',
+                'name': '3D Parts Consumption',
+                'description': 'Takes per item over a date range',
+                'category': 'usage',
+                'endpoint': '/api/printedparts/reports/consumption',
+            },
+            {
+                'id': 'printedparts-by-person',
+                'name': '3D Parts by Person',
+                'description': 'Takes grouped by employee',
+                'category': 'usage',
+                'endpoint': '/api/printedparts/reports/by-person',
+            },
+        ]
+
+    def get_navigation_items(self) -> List[dict]:
+        return [
+            {
+                'name': '3D Parts',
+                'icon': 'box',
+                'route': '/printedparts',
+                'position': 46,
+            },
+        ]
+
+    def on_install(self, app: Flask) -> None:
+        with app.app_context():
+            self._seed_settings()
+            logger.info('Printedparts plugin installed')
+
+    def on_enable(self, app: Flask) -> None:
+        # Idempotent re-seed so settings added in later versions reach sites
+        # that installed earlier (enable runs on every upgrade cycle).
+        with app.app_context():
+            self._seed_settings()
+
+    def _seed_settings(self) -> None:
+        defaults = [
+            ('printedparts_code_prefix', '3DP', 'string',
+             'Prefix for generated item codes'),
+            ('printedparts_default_threshold', '5', 'integer',
+             'Default low-stock threshold for new items'),
+            ('printedparts_unknown_badge', 'deny', 'string',
+             'Kiosk policy when a badge resolves to no employee: allow or deny'),
+            ('printedparts_alert_email', '', 'string',
+             'Comma-separated low-stock alert recipients; empty uses the '
+             'site alert_recipients'),
+            ('printedparts_alert_userids', '', 'string',
+             'Comma-separated shopdb user ids whose account emails receive '
+             'low-stock alerts'),
+            ('printedparts_alert_roleids', '', 'string',
+             'Comma-separated role ids; every active member of these roles '
+             'receives low-stock alerts'),
+        ]
+        for key, value, valuetype, description in defaults:
+            if Setting.get(key) is None:
+                Setting.set(key, value, valuetype=valuetype,
+                            category='printedparts', description=description)
+        db.session.commit()

plugins/printedparts/schemas/__init__.py

@@ -0,0 +1,6 @@
+"""Printedparts plugin schemas (marshmallow).
+
+Add schema classes here when you need request/response validation
+beyond the simple to_dict() output. The framework wires marshmallow
+into the response helpers; see the PLUGIN-HOOKS wiki page for details.
+"""

plugins/printedparts/services/__init__.py

@@ -0,0 +1 @@
+"""Printedparts plugin services."""

plugins/printedparts/services/badges.py

@@ -0,0 +1,69 @@
+"""Badge resolution for the printedparts plugin.
+
+Same input contract as the USB plugin (deliberately copied, not imported -
+cross-plugin imports break the shopdb.api-only contract):
+
+- all digits            -> an SSO typed or scanned directly
+- 0<digits>BZ           -> a physical badge wrapping a PayNo (keyboard-wedge
+                           scanners emit this shape)
+- anything else         -> unresolvable
+
+Names come from the employees plugin's self-hosted directory, looked up by
+SSO. The directory carries no PayNo column, so PayNo badges resolve only when
+the wrapped digits are themselves the SSO (true at sites whose badges encode
+the SSO); otherwise they fall to the unknown-badge policy.
+
+Policy (Setting printedparts_unknown_badge): 'deny' (default) rejects a badge
+with no directory match; 'allow' records the SSO with an empty name.
+"""
+
+import re
+
+from shopdb.api import Setting
+
+_PAYNO_BADGE = re.compile(r'^0(\d+)BZ$', re.IGNORECASE)
+
+
+class BadgeError(ValueError):
+    """Raised when a badge cannot be accepted under the site policy."""
+
+
+def _directory_name(sso):
+    """Best-effort display name from the employees plugin directory."""
+    try:
+        from plugins.employees.models import DirectoryEmployee
+        from shopdb.api import db
+        if sso and str(sso).isdigit():
+            employee = db.session.get(DirectoryEmployee, int(sso))
+            if employee:
+                return f'{employee.firstname} {employee.lastname}'.strip()
+    except Exception:
+        pass
+    return None
+
+
+def resolve_badge(badge):
+    """Return (sso, name) for a scanned badge, enforcing the site policy.
+
+    Raises BadgeError with a kiosk-displayable message when the badge shape is
+    unrecognized or the policy denies an unmatched badge.
+    """
+    badge = (badge or '').strip()
+    if not badge:
+        raise BadgeError('Scan or enter a badge')
+
+    if badge.isdigit():
+        sso = badge
+    else:
+        match = _PAYNO_BADGE.match(badge)
+        if not match:
+            raise BadgeError('Unrecognized badge format')
+        sso = match.group(1)
+
+    name = _directory_name(sso)
+    if name is None:
+        policy = (Setting.get('printedparts_unknown_badge') or 'deny').lower()
+        if policy != 'allow':
+            raise BadgeError('Badge not recognized - see the parts team')
+        return sso, ''
+    return sso, name

plugins/printedparts/tests/test_plugin.py

@@ -0,0 +1,30 @@
+"""Printedparts plugin smoke tests.
+
+Asserts the plugin loads cleanly and satisfies the framework contract.
+Replace and extend with domain tests as you build the plugin out.
+"""
+
+from plugins.printedparts.plugin import PrintedpartsPlugin
+
+
+def test_printedparts_plugin_meta_is_valid():
+    """PrintedpartsPlugin.meta returns a PluginMeta with the expected name."""
+    plugin = PrintedpartsPlugin()
+    assert plugin.meta.name == 'printedparts'
+    assert plugin.meta.api_prefix == '/api/printedparts'
+
+
+def test_printedparts_plugin_get_blueprint_returns_blueprint():
+    """get_blueprint returns a Flask Blueprint, not None."""
+    from flask import Blueprint
+    plugin = PrintedpartsPlugin()
+    assert isinstance(plugin.get_blueprint(), Blueprint)
+
+
+def test_printedparts_plugin_get_models_returns_a_model():
+    """get_models returns a list with at least one SQLAlchemy model."""
+    plugin = PrintedpartsPlugin()
+    models = plugin.get_models()
+    assert len(models) >= 1
+    for model in models:
+        assert hasattr(model, '__tablename__')