@blamejs/blamejs-shop 0.1.32 → 0.1.33

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.33 (2026-05-26) — **Search filters and synonyms — narrow results by facet, and match what shoppers mean, not just what they typed.** Search gains filters and smarter matching. A search result page now shows facet groups — collection, price range, and in-stock — as filter controls; choosing one narrows the results, the counts beside each option reflect the current result set, and choices combine across groups. Active filters show with a one-click clear and carry through pagination rather than dropping on page two. All filtering is server-side from query parameters, so it works with no client JavaScript. Separately, the query is expanded through an operator-curated synonym and typo vocabulary before the catalog is searched, so a search for "tee" matches "t-shirt" and a near-miss spelling still finds the product, with a "Showing results for" note when the query was corrected. Filters and synonym matching work identically whether the page is served from the edge or the container. This release also moves the shipped theme's stylesheets and island scripts to content-fingerprinted filenames so an asset and the page that references it can never fall out of sync. **Added:** *Faceted search filters* — A search result page shows facet groups — collection, price range, and in-stock availability — as server-rendered filter controls. Selecting a facet narrows the results and is reflected in the URL (for example `/search?q=shirt&collection=summer&in_stock=1`), the count beside each option reflects how many results it would yield against the current query, and facets combine across groups. Active filters render as removable chips with a clear-all path, and the active filters carry through result pagination so page two keeps the filter set. All filtering is server-side from the query string — no client JavaScript — and unknown facet keys, out-of-range price values, and garbage filter values are ignored rather than erroring. With filters applied and no matches, the page shows an empty state with a clear-filters link. · *Synonym and typo-tolerant query matching* — Before the catalog is searched, the query is expanded through an operator-curated vocabulary: synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal. When the query is corrected or expanded, the page shows a "Showing results for" note. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. **Changed:** *Search filters and synonyms render identically at the edge and the container* — The faceting and synonym logic runs in both the edge worker and the container search path, producing the same results and the same filter chrome whichever serves the page. The edge path reads the catalog and the facet/synonym vocabulary directly from the database, missing-table-resilient, so a shop without the optional facet configuration still searches normally. · *Theme stylesheets and scripts use content-fingerprinted filenames* — The shipped default theme's stylesheets and island scripts are now referenced by a content-hashed filename (`main.<hash>.css`) rather than a `?v=` query, emitted identically by the edge and container renderers and served from object storage under the fingerprinted key. Each URL maps to exactly one byte-content, so an asset and the page that references it can never disagree on a Subresource Integrity digest, and previously-served pages keep working across an asset change. The edge stylesheet link now also carries an integrity attribute, matching the container.
+
 - v0.1.32 (2026-05-26) — **Bundles and quantity discounts — sell products together at a set price, and reward buying more.** Two merchandising surfaces go live on the product page and in the cart, both priced authoritatively on the server. A product that belongs to a bundle shows a "Bundle & save" offer with its member products and the bundle price against the sum of the parts; one action adds the whole bundle to the cart at that price, all-or-nothing, and the discount is split across the member lines so the cart subtotal equals the quoted bundle price. Separately, a product with quantity breaks shows its price tiers ("1–2 / 3–5 / 6+") on the page, and the cart applies the right unit price for each line's quantity — recomputed on every cart render and again at checkout, so the line, cart, and order totals all reflect the break. The client never sends a price: it sends a bundle code or a quantity, and the server prices both from the live catalog. A bundle whose member is archived or out of stock is shown unavailable rather than adding a broken line, and a missing offer simply renders nothing. **Added:** *Bundles on the product page* — A product that is part of one or more bundles shows a "Bundle & save" offer listing the bundle's member products, the bundle price, and the saving against buying the parts separately. `POST /cart/bundle` adds the whole bundle to the cart in one action: the bundle price is recomputed from the live catalog and allocated across the member lines (proportional to each member's list price, with the rounding remainder on the last line) so the cart subtotal equals the quoted price. The add is atomic — if any member is archived or out of stock the bundle is shown unavailable and the action adds nothing rather than a partial set. A product in no bundle shows no offer; an unpriceable bundle (a missing member price or a currency mismatch) is shown unavailable, never a server error. The offer renders identically from the edge worker and the container. · *Quantity discounts on the product page and in the cart* — A product with quantity breaks shows its price tiers on the page (for example 1–2, 3–5, 6+ at descending unit prices). In the cart, each line is priced at the unit price for its quantity — applied server-side on every cart render so changing the quantity re-prices the line, and applied again at checkout so the per-line price and the order total written onto the order reflect the break, not the list price. A quantity below the first tier falls back to the base price; a quantity above the top tier takes the top tier. Stacks with the rest of the cart math. The tier table renders identically from the edge worker and the container. **Fixed:** *Themed product template carries the compare control* — The file-backed default product template now includes the Add-to-compare slot, matching the built-in render path so the comparison control appears on the product page whichever template is in use.
 
 - v0.1.31 (2026-05-26) — **Product compare — a side-by-side comparison table any shopper can build from the product pages.** Shoppers can now line products up against each other. Every product page gains an "Add to compare" control; a "Compare" link in the footer opens a side-by-side table of the chosen products — image, price, availability, and each product's attributes in aligned rows. No sign-in is required: the comparison basket rides the visitor's existing sealed session cookie, and a signed-in shopper's customer id is carried alongside. The basket holds up to four products (a fifth add is refused with a notice rather than quietly dropping one), the toggle is idempotent, and a product that goes archived or out of stock resolves out of the table with a remove control instead of breaking the page. The control and table render identically from the edge and the container, and the comparison page reuses the catalog grid styling, so no new stylesheet ships. **Added:** *Add to compare on the product page* — Each product page shows an "Add to compare" / "Remove from compare" control reflecting whether the product is already in the basket. `POST /compare/toggle` adds or removes it and redirects back to where the shopper was (the redirect target is validated, so a crafted `return_to` can't bounce the visitor off-site). Comparing needs no account — the basket is keyed on the visitor's existing sealed session cookie; a signed-in shopper's customer id is captured alongside. The basket is capped at four products: a fifth add is refused with a notice and the basket is left unchanged. · *The comparison table* — `GET /compare` renders the selected products side by side — image, title, price, availability, and the per-product attributes resolved through the catalog, in aligned rows. Each column has a remove control, and `POST /compare/clear` empties the whole basket. A product that has since been archived or sold out shows in a gone/out-of-stock state with a remove control rather than failing the render. An empty basket shows a friendly empty state and mints no cookie. A "Compare" link sits in the footer on every page.

package/README.md

@@ -78,6 +78,8 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/recommendations.js`** | Product-recommendation engine. Operator-curated override pins first (`setOverride` — "when viewing A, show B", kind-scoped + weight-ordered), then a signal-based fallback: co-purchase (products bought in the same orders), category-popular, and in-stock-random filler. `recommendForProduct` / `recommendForCart` / `recommendForCustomer` / `recommendForCategory` each return renderable picks (active + in-stock, source product excluded). The order confirmation page (`/orders/:id`) renders a "Customers also bought" rail from it — best-effort, anchored on the order's items, excluding what was just bought. |
 | **`lib/collections.js`** | Curated + smart product groupings. `GET /collections` lists the shop's active collections; `GET /collections/:slug` renders the grid — manual collections list hand-picked members, smart collections evaluate stored rules against the active catalog and apply the collection's sort strategy. Each product resolves fresh, so archived products drop out. Public, no sign-in; a bad or unknown slug is a 404 (never a 500). Linked from the footer on every page. |
 | **`lib/category-navigation.js`** | Hierarchical category tree surfaced as public browse pages. `GET /categories` lists the active top-level categories as a card grid; `GET /categories/:slug` renders one category — its title and optional description, a breadcrumb chain from the catalog root down to the current category, an optional hero image, and a grid of the category's direct child sub-categories. Each page reads fresh against the active tree, so archived / unpublished categories drop out of every surface. Public, no sign-in; an unknown, archived, or malformed slug is a 404 (never a 500), and a category with no children renders a graceful empty state. Linked from the footer on every page. The tree itself (define / move / reorder / archive, with cycle defense bounded by `MAX_TREE_DEPTH`) is operator-managed through the primitive's write API. |
+| **`lib/search-facets.js`** | Filterable search. A search result page renders facet groups — collection, price range, in-stock — as server-rendered controls; selecting one narrows the results and rides the URL query string (`?q=…&collection=…&in_stock=1`), counts beside each option reflect the current result set, facets combine across groups, and active filters show as removable chips with a clear-all path that survives result pagination. All filtering is server-side from the query string (no client JS); unknown facet keys, out-of-range prices, and garbage values are ignored rather than erroring; an empty filtered result shows a clear-filters state. Runs identically at the edge worker and the container — the edge reads the catalog and facet registry straight from D1, missing-table-resilient. |
+| **`lib/search-synonyms.js`** | Typo-tolerant, synonym-aware query matching. Before the catalog is searched, the query is expanded through an operator-curated vocabulary — synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal — and the page shows a "Showing results for" note when the query was corrected or expanded. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. Shared rewrite instance; runs identically at the edge and the container. |
 | **`lib/subscriptions.js`** | Stripe-backed recurring billing — `subscription_plans` (interval / amount / trial) + `subscriptions` (mirrors Stripe's object byte-for-byte). `subscriptions.create` POSTs to Stripe via the payment dep, then persists the returned object locally. `handleStripeEvent` replays `customer.subscription.*` events into the local row so the shop has an authoritative view without round-tripping. Customers view + cancel their own subscriptions at `/account/subscriptions` (ownership-checked; cancel mounts when the payment handle is wired). |
 | **`lib/giftcards.js`** | Prepaid bearer gift cards. `issue({ amount_minor, currency })` generates a 16-char code (32-glyph alphabet, no ambiguous letters) via `b.crypto.generateBytes`, stores only its `namespaceHash` digest + a 4-char hint, and returns the plaintext code once. `balance(code)` / `lookup(code)` resolve a code to its live balance (constant-time hash compare); `redeem({ code, order_id, amount_minor })` decrements the balance with an atomic `balance >= amount` SQL guard so concurrent spends can't overdraw. Redeemed at checkout as a credit against the order grand total: the amount due drops by the applied balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order — a card that fully covers the order is marked paid with no Stripe charge. Customers check a balance at `GET /gift-cards`; the page is not a code-existence oracle (unknown / malformed / expired all return the same generic not-found). |
 | **`lib/gift-card-ledger.js`** | Append-only credit / debit / expire history per gift card, with a denormalized `balance_after_minor` snapshot for O(1) balance reads. `credit` / `debit` / `expire` write one row each; `history(id)` paginates a card's transactions; `transactionsForOrder(id)` lists a card's movements for one order. The audit trail behind the admin gift-card ledger console; overdraft is refused at the primitive layer. |

package/lib/admin.js

@@ -41,22 +41,30 @@ var AUDIT_NAMESPACE = "shop_admin";
 // <style> block (or inline style="" attributes) is refused by the strict
 // `style-src 'self'` CSP that governs container-served routes, which is
 // why the console renders unstyled when those are inlined. `'self'`
-// allows this file; the deploy's R2 asset sync uploads it. The `?v=` is
-// the per-release cache-buster; the sha384 Subresource Integrity digest
+// allows this file; the deploy's R2 asset sync uploads it. The asset is
+// referenced by its content-fingerprinted name (`admin.<hash>.css`), so
+// the hash is the cache-buster — no `?v=` query — and the URL maps
+// one-to-one onto a byte-content. The sha384 Subresource Integrity digest
 // (b.crypto.sri, W3C SRI 1.0) makes the browser reject a tampered or
-// stale object. Same-origin, so no `crossorigin` is needed. The digest +
-// version come from the build-time manifest (lib/asset-manifest.json)
-// rather than hashing the file at render time, so they're present in the
-// container image too — which doesn't ship the theme asset files. A key
-// absent from the manifest yields no attribute.
+// mismatched object. Same-origin, so no `crossorigin` is needed. The
+// digest + fingerprinted path come from the build-time manifest
+// (lib/asset-manifest.json) rather than hashing the file at render time,
+// so they're present in the container image too — which doesn't ship the
+// theme asset files. A key absent from the manifest yields the plain path
+// and no integrity attribute.
 var _assetManifest = require("./asset-manifest.json");
-var _ASSET_VERSION = _assetManifest.version;
 function _assetSri(relUnderThemeAssets) {
-  return _assetManifest.assets[relUnderThemeAssets] || null;
+  var entry = _assetManifest.assets[relUnderThemeAssets];
+  return (entry && entry.integrity) || null;
+}
+function _assetUrl(relUnderThemeAssets) {
+  var entry = _assetManifest.assets[relUnderThemeAssets];
+  var fp    = (entry && entry.fingerprinted) || relUnderThemeAssets;
+  return "/assets/themes/default/" + fp;
 }
 function _adminStylesheetLink() {
   var sri = _assetSri("css/admin.css");
-  return "<link rel=\"stylesheet\" href=\"/assets/themes/default/css/admin.css?v=" + _ASSET_VERSION + "\"" +
+  return "<link rel=\"stylesheet\" href=\"" + _assetUrl("css/admin.css") + "\"" +
     (sri ? " integrity=\"" + sri + "\"" : "") + ">";
 }
 

package/lib/asset-manifest.json

@@ -1,9 +1,21 @@
 {
-  "version": "0.1.32",
+  "version": "0.1.33",
   "assets": {
-    "css/admin.css": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
-    "css/main.css": "sha384-A2m9cYLHIlIrFvTluTOaZz9r8F90yWIKd3SHOlyNwQwtaOBrzlsn/NDR1vso6dSF",
-    "js/passkey-login.js": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",
-    "js/passkey-register.js": "sha384-RaSkJbTpc6ClfPy5QyaY96doIqBqa9CLeIB1CzWnL05pSSJEA9IrIK0S7V7igRxY"
+    "css/admin.css": {
+      "integrity": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
+      "fingerprinted": "css/admin.4dc78dfc45d0736d.css"
+    },
+    "css/main.css": {
+      "integrity": "sha384-A2m9cYLHIlIrFvTluTOaZz9r8F90yWIKd3SHOlyNwQwtaOBrzlsn/NDR1vso6dSF",
+      "fingerprinted": "css/main.91c0dfab0198569c.css"
+    },
+    "js/passkey-login.js": {
+      "integrity": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",
+      "fingerprinted": "js/passkey-login.f3d6787bdd5e20df.js"
+    },
+    "js/passkey-register.js": {
+      "integrity": "sha384-RaSkJbTpc6ClfPy5QyaY96doIqBqa9CLeIB1CzWnL05pSSJEA9IrIK0S7V7igRxY",
+      "fingerprinted": "js/passkey-register.8f6ee49284ab4226.js"
+    }
   }
 }

package/lib/storefront.js

@@ -205,21 +205,31 @@ var LAYOUT =
 // each render call to override; absent that, every storefront page
 // references the shipped default theme — so a fresh install renders
 // styled out of the box without any wiring.
-// Asset integrity + version manifest — sha384 digests + the release
-// version, baked at build time (scripts/generate-asset-manifest.js) and
-// committed. Read here instead of hashing the files at render time so the
-// integrity attribute and the cache-buster are present in every runtime,
-// including the container image and the edge Worker, neither of which
-// ships the theme asset files to hash live. See lib/asset-manifest.json.
+// Asset integrity + fingerprint + version manifest — sha384 digests and
+// content-fingerprinted paths, baked at build time
+// (scripts/generate-asset-manifest.js) and committed. Read here instead of
+// hashing the files at render time so the integrity attribute and the
+// fingerprinted URL are present in every runtime, including the container
+// image and the edge Worker, neither of which ships the theme asset files
+// to hash live. See lib/asset-manifest.json.
 var _assetManifest = require("./asset-manifest.json");
 
-// The default theme stylesheet ships from R2 at this path. The
-// `?v=` query is a build-time cache-buster — operator uploads to R2
-// rewrite the bytes at the same path, and without the version
-// param browsers happily serve the previous cached CSS for the
-// five-minute default TTL. The manifest version bumps each release,
-// forcing every active session to re-fetch.
-var DEFAULT_THEME_CSS_URL = "/assets/themes/default/css/main.css?v=" + _assetManifest.version;
+// Content-fingerprinted asset URL — `/assets/themes/default/<fingerprinted>`,
+// where the fingerprint embeds a hash of the asset bytes (`main.<hash>.css`).
+// The hash IS the cache-buster, so no `?v=` query is appended: each URL maps
+// one-to-one onto a byte-content. This makes the Worker/R2 deploy order
+// irrelevant — a not-yet-synced asset 404s instead of poisoning SRI, and
+// pages already in flight keep loading the old fingerprinted object that
+// still exists in R2. An asset missing from the manifest (a custom operator
+// theme whose bytes aren't ours to hash) falls back to its plain path.
+function _assetUrl(relUnderThemeAssets) {
+  var entry = _assetManifest.assets[relUnderThemeAssets];
+  var fp    = (entry && entry.fingerprinted) || relUnderThemeAssets;
+  return "/assets/themes/default/" + fp;
+}
+
+// The default theme stylesheet ships from R2 at its fingerprinted path.
+var DEFAULT_THEME_CSS_URL = _assetUrl("css/main.css");
 
 // Footer copyright year — resolved once at module load. It's a near-static
 // value (changes once a year); a `new Date()` allocation on every page
@@ -227,12 +237,11 @@ var DEFAULT_THEME_CSS_URL = "/assets/themes/default/css/main.css?v=" + _assetMan
 // that a year-boundary staleness window doesn't matter for a copyright line.
 var _COPYRIGHT_YEAR = String(new Date().getUTCFullYear());
 
-// Client "island" scripts are served as external assets (same `?v=` cache-
-// bust as the CSS), never inline — the storefront's strict `script-src
-// 'self'` CSP blocks inline <script>, so an inline island silently fails
-// in production. `'self'` allows these /assets/ files; the R2 asset sync
+// Client "island" scripts are served as external assets (fingerprinted, same
+// as the CSS), never inline — the storefront's strict `script-src 'self'`
+// CSP blocks inline <script>, so an inline island silently fails in
+// production. `'self'` allows these /assets/ files; the R2 asset sync
 // (npm run sync-assets) uploads them alongside the stylesheets.
-var _ASSET_JS_VERSION = _assetManifest.version;
 
 // Subresource Integrity for the static assets — the browser refuses to
 // run/apply a resource whose served bytes don't match (defense against an
@@ -242,11 +251,12 @@ var _ASSET_JS_VERSION = _assetManifest.version;
 // whose bytes aren't ours to hash) yields no attribute. Same-origin, so
 // no `crossorigin` is required for the check to run.
 function _assetSri(relUnderThemeAssets) {
-  return _assetManifest.assets[relUnderThemeAssets] || null;
+  var entry = _assetManifest.assets[relUnderThemeAssets];
+  return (entry && entry.integrity) || null;
 }
 function _islandScript(name) {
   var sri = _assetSri("js/" + name);
-  return "<script src=\"/assets/themes/default/js/" + name + "?v=" + _ASSET_JS_VERSION + "\"" +
+  return "<script src=\"" + _assetUrl("js/" + name) + "\"" +
     (sri ? " integrity=\"" + sri + "\"" : "") + " defer></script>";
 }
 
@@ -646,13 +656,171 @@ var SEARCH_EMPTY =
   "    <p class=\"search-empty__icon\" aria-hidden=\"true\">⌕</p>\n" +
   "    <h2>{{heading}}</h2>\n" +
   "    <p>{{copy}}</p>\n" +
+  "    {{clear_link}}\n" +
   "    <a href=\"/\" class=\"btn-ghost\">Browse the full catalog</a>\n" +
   "  </div>\n" +
   "</section>\n";
 
+var SEARCH_CORRECTION =
+  "<p class=\"search-correction\">Showing results for <strong>{{correction}}</strong>.</p>\n";
+
+var FACET_GROUP_HEAD =
+  "<fieldset class=\"facet-group\">\n" +
+  "  <legend class=\"facet-group__title\">{{label}}</legend>\n" +
+  "  <ul class=\"facet-group__options\">\n";
+
+var FACET_OPTION =
+  "<li class=\"facet-option\">\n" +
+  "  <a class=\"facet-option__link{{selected_class}}\" href=\"{{href}}\" rel=\"nofollow\"{{aria_pressed}}>\n" +
+  "    <span class=\"facet-option__box\" aria-hidden=\"true\">{{box}}</span>\n" +
+  "    <span class=\"facet-option__label\">{{label}}</span>\n" +
+  "    <span class=\"facet-option__count\">{{count}}</span>\n" +
+  "  </a>\n" +
+  "</li>\n";
+
+var FACET_CHIP =
+  "<a class=\"facet-chip\" href=\"{{href}}\" rel=\"nofollow\">\n" +
+  "  <span class=\"facet-chip__label\">{{label}}</span>\n" +
+  "  <span class=\"facet-chip__x\" aria-hidden=\"true\">×</span>\n" +
+  "  <span class=\"skip-link\">Remove filter</span>\n" +
+  "</a>\n";
+
+// Build a `/search?...` URL from a query + applied-filters map. Mirrors
+// the edge renderer's `_searchUrl` so the container and worker emit
+// byte-identical filter links. `URLSearchParams` percent-encodes every
+// value; the strict `_render` HTML-escapes it again when it lands in an
+// `href` attribute.
+function _searchUrl(q, filters) {
+  var sp = new URLSearchParams();
+  if (typeof q === "string" && q.length) sp.set("q", q);
+  var keys = Object.keys(filters).sort();
+  for (var i = 0; i < keys.length; i += 1) {
+    var vals = (filters[keys[i]] || []).slice().sort();
+    for (var j = 0; j < vals.length; j += 1) sp.append(keys[i], vals[j]);
+  }
+  var qs = sp.toString();
+  return qs.length ? "/search?" + qs : "/search";
+}
+
+function _toggleFilter(filters, key, value) {
+  var next = {};
+  var keys = Object.keys(filters);
+  for (var i = 0; i < keys.length; i += 1) next[keys[i]] = filters[keys[i]].slice();
+  var cur = next[key] || [];
+  var at = cur.indexOf(value);
+  if (at === -1) cur = cur.concat([value]);
+  else cur = cur.slice(0, at).concat(cur.slice(at + 1));
+  if (cur.length) next[key] = cur;
+  else delete next[key];
+  return next;
+}
+
+function _renderSearchFacets(facets, filters, q) {
+  var groups = [];
+  for (var f = 0; f < facets.length; f += 1) {
+    var facet = facets[f];
+    var optionsHtml = "";
+    var rendered = 0;
+    for (var o = 0; o < facet.options.length; o += 1) {
+      var opt = facet.options[o];
+      if (opt.count === 0 && !opt.selected) continue;
+      optionsHtml += _render(FACET_OPTION, {
+        href:           _searchUrl(q, _toggleFilter(filters, facet.key, opt.value)),
+        selected_class: opt.selected ? " is-selected" : "",
+        aria_pressed:   "RAW_ARIA",
+        box:            opt.selected ? "✓" : "",
+        label:          opt.label,
+        count:          String(opt.count),
+      }).replace("RAW_ARIA", opt.selected ? " aria-pressed=\"true\"" : " aria-pressed=\"false\"");
+      rendered += 1;
+    }
+    if (rendered === 0) continue;
+    groups.push(_render(FACET_GROUP_HEAD, { label: facet.label }) + optionsHtml + "  </ul>\n</fieldset>\n");
+  }
+  if (!groups.length) return "";
+  return "<aside class=\"search-facets\" aria-label=\"Filter results\">\n" +
+    "<h2 class=\"search-facets__title\">Filter</h2>\n" +
+    groups.join("") +
+    "</aside>\n";
+}
+
+function _renderSearchChips(facets, filters, q) {
+  var labelFor = {};
+  for (var f = 0; f < facets.length; f += 1) {
+    var byVal = {};
+    for (var o = 0; o < facets[f].options.length; o += 1) byVal[facets[f].options[o].value] = facets[f].options[o].label;
+    labelFor[facets[f].key] = { group: facets[f].label, values: byVal };
+  }
+  var chips = "";
+  var any = false;
+  var keys = Object.keys(filters).sort();
+  for (var k = 0; k < keys.length; k += 1) {
+    var meta = labelFor[keys[k]];
+    var vals = filters[keys[k]] || [];
+    for (var v = 0; v < vals.length; v += 1) {
+      var valLabel = meta && meta.values[vals[v]] != null ? meta.values[vals[v]] : vals[v];
+      var groupLabel = meta ? meta.group : keys[k];
+      chips += _render(FACET_CHIP, {
+        href:  _searchUrl(q, _toggleFilter(filters, keys[k], vals[v])),
+        label: groupLabel + ": " + valLabel,
+      });
+      any = true;
+    }
+  }
+  if (!any) return "";
+  var clearAll = _render(
+    "<a class=\"facet-chip facet-chip--clear\" href=\"{{href}}\" rel=\"nofollow\">Clear all filters</a>\n",
+    { href: _searchUrl(q, {}) }
+  );
+  return "<div class=\"search-active-filters\" aria-label=\"Active filters\">\n" + chips + clearAll + "</div>\n";
+}
+
+// Hard caps mirroring `lib/search-facets.js`'s applied-filter
+// validators so a hostile / stale URL can't blow the in-memory facet
+// walk. Garbage values and unknown facet keys are dropped (not
+// refused): a shopper landing on a link with a removed-facet param
+// still gets a clean results page rather than a 500.
+var SEARCH_MAX_FACET_KEYS   = 32;
+var SEARCH_MAX_FACET_VALUES = 64;
+var SEARCH_MAX_VALUE_LEN    = 256;
+var SEARCH_CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
+
+// Parse `?key=value` repeats off a parsed URL into the
+// `{ facetKey: [value, ...] }` shape the searchFacets primitive
+// consumes, keeping only keys that match a loaded facet definition and
+// values that survive the length / control-byte guards. `facetDefs` is
+// the `listFacets()` result.
+function _parseSearchFilters(url, facetDefs) {
+  var out = {};
+  if (!url || !url.searchParams) return out;
+  var known = {};
+  for (var i = 0; i < facetDefs.length; i += 1) known[facetDefs[i].key] = true;
+  var keyCount = 0;
+  url.searchParams.forEach(function (rawVal, rawKey) {
+    if (rawKey === "q") return;
+    if (!Object.prototype.hasOwnProperty.call(known, rawKey)) return;
+    if (typeof rawVal !== "string") return;
+    if (!rawVal.length || rawVal.length > SEARCH_MAX_VALUE_LEN) return;
+    if (SEARCH_CONTROL_BYTE_RE.test(rawVal)) return;
+    if (!Object.prototype.hasOwnProperty.call(out, rawKey)) {
+      if (keyCount >= SEARCH_MAX_FACET_KEYS) return;
+      out[rawKey] = [];
+      keyCount += 1;
+    }
+    var arr = out[rawKey];
+    if (arr.length >= SEARCH_MAX_FACET_VALUES) return;
+    if (arr.indexOf(rawVal) !== -1) return;
+    arr.push(rawVal);
+  });
+  return out;
+}
+
 function renderSearch(opts) {
   if (!opts || typeof opts.q !== "string") throw new TypeError("storefront.renderSearch: opts.q (string) required");
   var products = Array.isArray(opts.products) ? opts.products : [];
+  var facets   = Array.isArray(opts.facets) ? opts.facets : [];
+  var filters  = (opts.filters && typeof opts.filters === "object") ? opts.filters : {};
+  var hasFilters = Object.keys(filters).length > 0;
   var qTrim = opts.q.trim();
   var title, summary, emptyHeading, emptyCopy;
   if (qTrim.length === 0) {
@@ -669,10 +837,24 @@ function renderSearch(opts) {
     title   = "“" + qTrim + "”";
     summary = "Showing " + products.length + " match" + (products.length === 1 ? "" : "es") + " for your query.";
   }
+
+  var correctionHtml = "";
+  if (qTrim.length > 0 && typeof opts.corrected_query === "string" &&
+      opts.corrected_query.length > 0 && opts.corrected_query !== qTrim) {
+    correctionHtml = _render(SEARCH_CORRECTION, { correction: opts.corrected_query });
+  }
+
+  var facetsHtml = (qTrim.length > 0) ? _renderSearchFacets(facets, filters, opts.q) : "";
+  var chipsHtml  = (qTrim.length > 0) ? _renderSearchChips(facets, filters, opts.q) : "";
+
   var header = _render(SEARCH_HEADER, { title: title, summary: summary });
-  var body;
+  var resultsInner;
   if (products.length === 0) {
-    body = header + _render(SEARCH_EMPTY, { heading: emptyHeading, copy: emptyCopy });
+    var clearLink = hasFilters
+      ? _render("<a href=\"{{href}}\" class=\"btn-ghost\">Clear filters</a>", { href: _searchUrl(opts.q, {}) })
+      : "";
+    resultsInner = _render(SEARCH_EMPTY, { heading: emptyHeading, copy: emptyCopy, clear_link: "RAW_CLEAR" })
+      .replace("RAW_CLEAR", clearLink);
   } else {
     var assetPrefix = opts.asset_prefix || "/assets/";
     var cards = products.map(function (p) {
@@ -683,7 +865,15 @@ function renderSearch(opts) {
       var imageAlt = p.hero_media ? (p.hero_media.alt_text || p.title) : null;
       return _buildProductCard({ title: p.title, price: priceStr, slug: p.slug, image_url: imageUrl, image_alt: imageAlt });
     }).join("\n");
-    body = header + "<section class=\"search-grid\"><div class=\"grid\">" + cards + "</div></section>";
+    resultsInner = "<section class=\"search-grid\"><div class=\"grid\">" + cards + "</div></section>";
+  }
+  var body;
+  if (facetsHtml.length > 0) {
+    body = header + correctionHtml + chipsHtml +
+      "<div class=\"search-layout\">" + facetsHtml +
+      "<div class=\"search-layout__results\">" + resultsInner + "</div></div>";
+  } else {
+    body = header + correctionHtml + chipsHtml + resultsInner;
   }
   return _wrap({
     title:      "Search",
@@ -3948,6 +4138,68 @@ function mount(router, deps) {
     _send(res, 200, html);
   });
 
+  // Decorate one product row with the display columns the search
+  // cards need (first variant's price, first media) AND the facet
+  // fields the searchFacets primitive computes against: `collection`
+  // (array of collection slugs the product belongs to), `price_minor`
+  // (the starting price), and `in_stock` (any variant with available
+  // stock). Composes the wired catalog / collections primitives; a
+  // collection facet only populates when `deps.collections` is present.
+  async function _decorateForSearch(p) {
+    var variants = await deps.catalog.variants.listForProduct(p.id);
+    var startingPrice = null;
+    var inStock = false;
+    for (var vi = 0; vi < variants.length; vi += 1) {
+      if (vi === 0) {
+        var price = await deps.catalog.prices.current(variants[0].id, "USD");
+        if (price) startingPrice = price;
+      }
+      var inv = await deps.catalog.inventory.get(variants[vi].sku);
+      if (inv && (Number(inv.stock_on_hand) - Number(inv.stock_held)) > 0) inStock = true;
+    }
+    var media = await deps.catalog.media.listForProduct(p.id);
+    var heroMedia = media.length ? media[0] : null;
+    var collectionSlugs = [];
+    if (deps.collections && typeof deps.collections.collectionsForProduct === "function") {
+      var cols = await deps.collections.collectionsForProduct(p.id);
+      for (var ci = 0; ci < cols.length; ci += 1) {
+        if (cols[ci] && cols[ci].slug) collectionSlugs.push(cols[ci].slug);
+      }
+    }
+    return Object.assign({}, p, {
+      starting_price_minor:    startingPrice ? startingPrice.amount_minor : null,
+      starting_price_currency: startingPrice ? startingPrice.currency      : "USD",
+      hero_media:              heroMedia,
+      collection:              collectionSlugs,
+      price_minor:             startingPrice ? startingPrice.amount_minor : null,
+      in_stock:                inStock,
+    });
+  }
+
+  // Pull the facetable universe for a set of search terms: every
+  // active product matching ANY term (canonical query + synonym
+  // expansions) on title / description, decorated once. The
+  // searchFacets primitive consumes this through a `catalog.list`
+  // adapter and walks the rows in-memory for counts; the route reuses
+  // the same rows for the narrowed result grid (one decoration pass,
+  // no double round trip).
+  async function _facetableUniverse(terms) {
+    var byId = {};
+    var rows = [];
+    for (var ti = 0; ti < terms.length; ti += 1) {
+      var term = typeof terms[ti] === "string" ? terms[ti].trim() : "";
+      if (!term.length) continue;
+      var page = await deps.catalog.products.search({ q: term, status: "active", limit: 100 });
+      for (var i = 0; i < page.rows.length; i += 1) {
+        var p = page.rows[i];
+        if (byId[p.id]) continue;
+        byId[p.id] = true;
+        rows.push(await _decorateForSearch(p));
+      }
+    }
+    return rows;
+  }
+
   router.get("/search", async function (req, res) {
     var url = req.url ? new URL(req.url, "http://localhost") : null;
     var qRaw = url && url.searchParams.get("q");
@@ -3956,26 +4208,53 @@ function mount(router, deps) {
     // primitive — defends against a 10 MiB `?q=...` mass that would
     // otherwise round-trip through the LIKE escape function.
     if (q.length > 200) q = q.slice(0, 200);
-    var products = [];
+
+    var products    = [];
+    var facetGroups = [];
+    var filters     = {};
+    var correctedQ  = "";
+
     if (q.trim().length > 0) {
-      var page = await deps.catalog.products.search({ q: q, status: "active", limit: 24 });
-      for (var i = 0; i < page.rows.length; i += 1) {
-        var p = page.rows[i];
-        var variants = await deps.catalog.variants.listForProduct(p.id);
-        var startingPrice = null;
-        if (variants.length) {
-          var price = await deps.catalog.prices.current(variants[0].id, "USD");
-          if (price) startingPrice = price;
-        }
-        var media = await deps.catalog.media.listForProduct(p.id);
-        var heroMedia = media.length ? media[0] : null;
-        products.push(Object.assign({}, p, {
-          starting_price_minor:    startingPrice ? startingPrice.amount_minor : null,
-          starting_price_currency: startingPrice ? startingPrice.currency      : "USD",
-          hero_media:              heroMedia,
-        }));
+      // Synonym + typo rewrite expands the typed query into the
+      // canonical term plus operator-curated expansions BEFORE the
+      // product query runs. Without the dep, the raw query is the
+      // only term.
+      var terms = [];
+      if (deps.searchSynonyms) {
+        var rewrite = await deps.searchSynonyms.rewrite(q);
+        correctedQ = rewrite.canonical;
+        if (rewrite.canonical.length) terms.push(rewrite.canonical);
+        for (var e = 0; e < rewrite.expansions.length; e += 1) terms.push(rewrite.expansions[e]);
+      }
+      if (!terms.length) terms.push(q.trim());
+
+      if (deps.searchFacets) {
+        // The universe is decorated once; the searchFacets catalog
+        // adapter and the narrowed result grid share it. The facet
+        // instance is created per-request bound to this request's
+        // universe so concurrent searches never share a catalog
+        // snapshot. `deps.searchFacets(catalog)` is the factory wired
+        // in server.js (the searchFacets primitive's `create`, with
+        // the DB query handle pre-bound).
+        var universe = await _facetableUniverse(terms);
+        var facetCatalog = {
+          // The primitive narrows in-memory and drops the focal facet
+          // per option, so the adapter ignores applied_filters and
+          // returns the full matched universe every call.
+          list: function () { return Promise.resolve({ rows: universe }); },
+        };
+        var sfInstance = deps.searchFacets(facetCatalog);
+        var facetDefs = await sfInstance.listFacets({});
+        filters = _parseSearchFilters(url, facetDefs);
+        facetGroups = await sfInstance.getFacets({ query: q, applied_filters: filters });
+        var preview = await sfInstance.previewQuery({ query: q, filters: filters, sample: 24 });
+        products = preview.sample;
+      } else {
+        // No facet dep — flat search over the expanded terms.
+        products = (await _facetableUniverse(terms)).slice(0, 24);
       }
     }
+
     var sid = _readSidCookie(req);
     var cartCount = 0;
     if (sid) {
@@ -3986,10 +4265,13 @@ function mount(router, deps) {
       }
     }
     _send(res, 200, renderSearch({
-      q:          q,
-      products:   products,
-      shop_name:  shopName,
-      cart_count: cartCount,
+      q:               q,
+      products:        products,
+      facets:          facetGroups,
+      filters:         filters,
+      corrected_query: correctedQ,
+      shop_name:       shopName,
+      cart_count:      cartCount,
     }));
   });
 

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.69",
-      "tag": "v0.12.69",
+      "version": "0.13.1",
+      "tag": "v0.13.1",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -6,8 +6,16 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.13.x
+
+- v0.13.1 (2026-05-26) — **`b.worm` — write-once-read-many retention.** Store records that cannot be altered or deleted before a retention period elapses — the immutable-storage discipline regulators require (SEC 17a-4(f), CFTC 1.31, FINRA 4511). b.worm.create(opts) returns a WORM store that enforces, on every mutating call, that a record is not overwritten or deleted while it is within its retainUntil window or under a legal hold. Two modes mirror cloud Object-Lock: compliance (the default — no one, including the operator, can delete before expiry) and governance (a privileged caller may override with an audited reason). Retention can only be extended, never shortened; every record carries a SHA3-512 digest that get verifies, so tampering with the underlying bytes is detected on read; every allow/refuse decision is audited. Storage is pluggable via a synchronous store adapter, so the policy layer sits over a sealed DB table, a filesystem, or any non-S3 backend — the store-agnostic, application-level companion to b.objectStore's S3 Object Lock, with content-integrity verification that native Object Lock does not provide. **Added:** *`b.worm.create` — write-once-read-many retention* — Returns a store with `put` / `get` / `delete` / `extendRetention` / `placeLegalHold` / `releaseLegalHold` / `list`. `put` is write-once (an overwrite of a retained or held record is refused); `delete` is gated by the retention window, legal holds, and the mode (`compliance` refuses any early delete; `governance` allows a privileged override with a required, audited reason); `extendRetention` is extend-only; `get` verifies the stored SHA3-512 digest and throws `worm/tampered` on a mismatch. Storage is a pluggable synchronous adapter (`get` / `set` / `delete` / `has` / `keys`), defaulting to in-memory for tests. Use it for SEC 17a-4 / CFTC / FINRA immutable records on backends without native Object Lock; `b.objectStore` remains the path for S3 Object Lock.
+
+- v0.13.0 (2026-05-26) — **`b.crypto.oprf` — RFC 9497 Oblivious PRFs.** Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency. **Added:** *`b.crypto.oprf` — RFC 9497 OPRF / VOPRF* — `suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream. · *Vendored `@noble/curves`* — `@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate.
+
 ## v0.12.x
 
+- v0.12.70 (2026-05-26) — **`b.network.dns.tsig` — RFC 8945 DNS transaction signatures.** Sign and verify DNS messages with RFC 8945 TSIG — the shared-key HMAC that authenticates a DNS transaction (zone transfers, dynamic updates, query/response pairs) and proves it was not altered in flight. b.network.dns.tsig.sign(message, opts) appends a TSIG resource record and returns the signed wire; b.network.dns.tsig.verify(message, opts) locates the TSIG record, recomputes the HMAC over the RFC 8945 §4.3.3 digest, compares it in constant time, and checks the time window (valid only within `fudge` seconds of `timeSigned`). HMAC-SHA-256 is the default; SHA-384 / SHA-512 are available and the broken HMAC-MD5 / HMAC-SHA-1 algorithms are refused unless allowLegacy is set. Signing a response chains the request MAC into the digest. Verified byte-for-byte against dnspython 2.8.0 reference signatures. TSIG completes the DNS-trust set alongside the existing DNSSEC (zone-data authentication) and DANE primitives — DNSSEC authenticates the data end-to-end, TSIG authenticates a single hop's transaction with a pre-shared key. **Added:** *`b.network.dns.tsig.sign` / `b.network.dns.tsig.verify`* — RFC 8945 TSIG transaction authentication. `sign(message, { keyName, secret, algorithm, fudge, time, requestMac })` appends a TSIG RR to a DNS wire message and returns `{ wire, mac }`; `verify(message, { keys, now, requestMac })` returns `{ valid, keyName, algorithm, timeSigned, error, macValid, timeValid, reason }`, with a constant-time MAC compare (via `b.crypto.timingSafeEqual`), a `fudge`-second time-window check, truncated-MAC handling per §5.2.2.1, and request-MAC chaining for responses (§5.4.1). HMAC-SHA-256 default; HMAC-SHA-384 / SHA-512 supported; HMAC-MD5 / HMAC-SHA-1 refused unless `allowLegacy: true`. The transaction-level companion to `b.network.dns.dnssec` and `b.network.dns.dane`.
+
 - v0.12.69 (2026-05-26) — **`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode.** b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:"tag" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that. **Fixed:** *`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari* — A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: "tag"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged. **Detectors:** *reserved-hostname trailing-dot detector recognizes regex strips* — The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\.$/, …)`), not only the `charAt` / `while`-loop forms.
 
 - v0.12.68 (2026-05-26) — **`b.jwk` — RFC 7638 JWK thumbprint.** Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: "sha384" | "sha512" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive. **Added:** *`b.jwk.thumbprint` / `b.jwk.canonicalize`* — RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash. **Changed:** *DPoP, ACME, and DBSC compose `b.jwk`* — `b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes.