npm - @blamejs/blamejs-shop - Versions diffs - 0.1.34 → 0.1.36 - Mend

@blamejs/blamejs-shop 0.1.34 → 0.1.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (22) hide show

package/CHANGELOG.md +4 -0
package/README.md +2 -0
package/lib/asset-manifest.json +7 -3
package/lib/currency-display.js +201 -4
package/lib/storefront.js +672 -40
package/lib/vendor/MANIFEST.json +3 -3
package/lib/vendor/blamejs/CHANGELOG.md +6 -0
package/lib/vendor/blamejs/README.md +3 -0
package/lib/vendor/blamejs/api-snapshot.json +93 -2
package/lib/vendor/blamejs/examples/wiki/lib/source-comment-block-validator.js +1 -0
package/lib/vendor/blamejs/index.js +4 -0
package/lib/vendor/blamejs/lib/ai-aedt-bias-audit.js +180 -0
package/lib/vendor/blamejs/lib/crdt.js +453 -0
package/lib/vendor/blamejs/lib/crypto-xwing.js +213 -0
package/lib/vendor/blamejs/package.json +1 -1
package/lib/vendor/blamejs/release-notes/v0.13.3.json +18 -0
package/lib/vendor/blamejs/release-notes/v0.13.4.json +23 -0
package/lib/vendor/blamejs/release-notes/v0.13.5.json +18 -0
package/lib/vendor/blamejs/test/layer-0-primitives/ai-aedt-bias-audit.test.js +107 -0
package/lib/vendor/blamejs/test/layer-0-primitives/crdt.test.js +158 -0
package/lib/vendor/blamejs/test/layer-0-primitives/crypto-xwing.test.js +120 -0
package/package.json +2 -2

package/lib/storefront.js CHANGED Viewed

@@ -27,6 +27,7 @@
 var emailModule = require("./email");
 var pricing      = require("./pricing");
+var currencyDisplayModule = require("./currency-display");
 var b = require("./vendor/blamejs");
@@ -77,6 +78,52 @@ var _render = emailModule._render;
 // the bound R2 bucket. The 1536×1024 source PNG is committed
 // only to .template/ (local-only) and uploaded once via
 // `wrangler r2 object put`.
+// Cookie-consent banner — present in the chrome of every page (both
+// the container render below and each worker/render/*.js LAYOUT, kept
+// byte-identical). GDPR (EU 2016/679 art. 6 + 7) + ePrivacy (2002/58/EC
+// art. 5(3)) demand informed, specific, opt-in consent BEFORE any non-
+// strictly-necessary cookie / tracker is set, with default-deny on the
+// toggleable categories and a withdraw path. The banner is a plain
+// server-rendered form that POSTs to /consent — it works with no client
+// JS at all (essential-only browsing, accept, reject, and the granular
+// preference center are all reachable JS-off).
+//
+// Because the storefront's read pages are edge-cached for cookie-less
+// visitors (worker/index.js `_edgeRenderCached`), the banner can't be
+// server-conditionally omitted on a cached page — the cached HTML is one
+// document shared across visitors. So the banner ships in every document
+// and the dismissal is cookie-driven on the client: the consent island
+// (themes/default/assets/js/consent.js) reads the non-sealed
+// `shop_consent_set` flag cookie and hides the banner when a choice
+// already exists. The authoritative decision lives in the sealed
+// `shop_consent` cookie + the cookie-consent ledger (server-side); the
+// flag cookie is a non-authoritative "has decided" hint that only drives
+// banner visibility. Nothing in this block reflects a visitor-supplied
+// value, so there is no interpolation and no escape surface.
+//
+// `hidden` is the default visible state inversion: the dialog renders
+// visible for a visitor with no decision (JS-off included). The island
+// adds `data-consent-decided` to <html> and the CSS hides the dialog,
+// so a returning visitor never sees it. A visitor with JS disabled who
+// has already decided sees the banner again — but every control still
+// works server-side, so they re-confirm rather than hit a dead end.
+var CONSENT_BANNER =
+  "  <div class=\"consent-banner\" id=\"consent-banner\" role=\"dialog\" aria-modal=\"false\" aria-labelledby=\"consent-title\" aria-describedby=\"consent-desc\">\n" +
+  "    <div class=\"consent-banner__inner\">\n" +
+  "      <div class=\"consent-banner__copy\">\n" +
+  "        <h2 class=\"consent-banner__title\" id=\"consent-title\">Your privacy choices</h2>\n" +
+  "        <p class=\"consent-banner__desc\" id=\"consent-desc\">We use strictly-necessary cookies to run the shop (your session, security tokens, and this choice itself). Optional cookies — functional, analytics, marketing, and preferences — are off until you turn them on. You can change this any time from <a href=\"/cookies\">Manage cookies</a>.</p>\n" +
+  "      </div>\n" +
+  "      <form class=\"consent-banner__actions\" method=\"post\" action=\"/consent\">\n" +
+  "        <input type=\"hidden\" name=\"return_to\" value=\"/\" data-consent-return>\n" +
+  "        <button type=\"submit\" name=\"choice\" value=\"accept_all\" class=\"btn-primary consent-banner__btn\">Accept all</button>\n" +
+  "        <button type=\"submit\" name=\"choice\" value=\"reject\" class=\"btn-ghost consent-banner__btn\">Reject non-essential</button>\n" +
+  "        <a class=\"consent-banner__manage\" href=\"/cookies\">Manage preferences</a>\n" +
+  "      </form>\n" +
+  "    </div>\n" +
+  "  </div>\n";
 var LAYOUT =
   "<!DOCTYPE html>\n" +
   "<html lang=\"en\">\n" +
@@ -188,15 +235,19 @@ var LAYOUT =
   "        </ul>\n" +
   "      </div>\n" +
   "    </div>\n" +
+    "    RAW_CURRENCY_SWITCHER\n" +
   "    <div class=\"site-footer__copy\">\n" +
   "      <p>&copy; {{year}} {{shop_name}} — built on blamejs · Apache 2.0 licensed.</p>\n" +
   "      <ul>\n" +
   "        <li><a href=\"/SECURITY.md\">Security</a></li>\n" +
   "        <li><a href=\"/privacy\">Privacy</a></li>\n" +
   "        <li><a href=\"/terms\">Terms</a></li>\n" +
+  "        <li><a href=\"/cookies\">Manage cookies</a></li>\n" +
   "      </ul>\n" +
   "    </div>\n" +
   "  </footer>\n" +
+  CONSENT_BANNER +
+  "RAW_CONSENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
@@ -254,10 +305,73 @@ function _assetSri(relUnderThemeAssets) {
   var entry = _assetManifest.assets[relUnderThemeAssets];
   return (entry && entry.integrity) || null;
 }
-function _islandScript(name) {
+function _islandScript(name, opts) {
   var sri = _assetSri("js/" + name);
-  return "<script src=\"" + _assetUrl("js/" + name) + "\"" +
-    (sri ? " integrity=\"" + sri + "\"" : "") + " defer></script>";
+  // Optional `id` (so an island can find its own <script> at runtime) and
+  // `policy` (the active consent policy version, stamped for the consent
+  // island to compare against the flag cookie). Both are charset-safe by
+  // construction at the call site, so they go in without escaping.
+  var idAttr     = (opts && opts.id)     ? " id=\"" + opts.id + "\"" : "";
+  var policyAttr = (opts && opts.policy) ? " data-consent-policy=\"" + opts.policy + "\"" : "";
+  return "<script" + idAttr + " src=\"" + _assetUrl("js/" + name) + "\"" +
+    (sri ? " integrity=\"" + sri + "\"" : "") + " defer" + policyAttr + "></script>";
+}
+// Multi-currency display switcher — a GET form in the footer listing the
+// operator's display currencies. Selecting one POSTs to /currency, which
+// sets the sealed `shop_ccy` cookie and redirects back. The currently
+// selected currency is pre-checked. Absent a presenter (feature not
+// wired) the whole block is empty so older deploys render unchanged.
+// `currencies` is the operator's allow-list; `selected` is the active
+// display currency; `note` is the "charged in <base>" disclosure (present
+// only when a non-base currency is active).
+function _buildCurrencySwitcher(opts) {
+  if (!opts || !Array.isArray(opts.currencies) || opts.currencies.length < 2) return "";
+  var esc = function (s) { return b.template.escapeHtml(String(s)); };
+  var selected = opts.selected || opts.currencies[0];
+  var options = opts.currencies.map(function (c) {
+    var sel = c === selected ? " selected" : "";
+    return "<option value=\"" + esc(c) + "\"" + sel + ">" + esc(c) + "</option>";
+  }).join("");
+  // GET-action would expose the choice in the URL + cache key; a POST
+  // keeps it in the sealed cookie and bypasses the edge cache via the
+  // 303 redirect. `redirect_to` carries the current path so the visitor
+  // lands back where they were. The form auto-submits via the island
+  // script when present; without JS the explicit "Set" button submits.
+  var noteHtml = opts.note
+    ? "<p class=\"currency-switcher__note\">" + esc(opts.note) + "</p>"
+    : "";
+  return "<div class=\"currency-switcher\">\n" +
+    "      <form class=\"currency-switcher__form\" method=\"post\" action=\"/currency\">\n" +
+    "        <input type=\"hidden\" name=\"redirect_to\" value=\"" + esc(opts.redirect_to || "/") + "\">\n" +
+    "        <label class=\"currency-switcher__label\" for=\"currency-select\">Display currency</label>\n" +
+    "        <select id=\"currency-select\" name=\"currency\" class=\"currency-switcher__select\" data-currency-switcher>" + options + "</select>\n" +
+    "        <button type=\"submit\" class=\"currency-switcher__btn\">Set</button>\n" +
+    "      </form>\n" +
+    "      " + noteHtml + "\n" +
+    "    </div>";
+}
+// The per-request price formatter a renderer uses for every displayed
+// price. When the route handler resolved a display-currency presenter and
+// threaded it in as `opts.format_price`, that's used (it converts base →
+// display currency + applies the display rounding rule). Otherwise the
+// renderer falls back to `pricing.format` — identical to pre-feature
+// behaviour, so an un-wired store or any renderer the route handler
+// didn't thread keeps formatting in the catalog currency.
+function _priceFormatter(opts) {
+  return (opts && typeof opts.format_price === "function") ? opts.format_price : pricing.format;
+}
+// Lift the currency-switcher fields off a renderer's opts so they reach
+// `_wrap` unchanged. Keeps the per-renderer `_wrap` call sites short.
+function _currencyWrapOpts(opts) {
+  return {
+    currency_options:     opts.currency_options,
+    currency_selected:    opts.currency_selected,
+    currency_note:        opts.currency_note,
+    currency_redirect_to: opts.currency_redirect_to,
+  };
 }
 function _wrap(opts) {
@@ -278,6 +392,15 @@ function _wrap(opts) {
   var ogDescription = opts.og_description || "Open-source ecommerce framework built on blamejs. Server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.";
   var ogImage       = opts.og_image       || "/assets/brand/logo.png";
   var ogUrl         = opts.og_url         || "";
+  // Multi-currency display switcher — populated only when the operator
+  // configured >1 display currency (opts.currency_options). The block is
+  // empty otherwise, so a single-currency store renders unchanged.
+  var switcherHtml = _buildCurrencySwitcher({
+    currencies:  opts.currency_options,
+    selected:    opts.currency_selected,
+    note:        opts.currency_note,
+    redirect_to: opts.currency_redirect_to,
+  });
   return _render(LAYOUT, {
     title:          opts.title,
     shop_name:      shopName,
@@ -291,7 +414,10 @@ function _wrap(opts) {
     og_image:       ogImage,
     og_url:         ogUrl,
     body:           "RAW_BODY_PLACEHOLDER",
-  }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity).replace("RAW_BODY_PLACEHOLDER", opts.body);
+  }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
+    .replace("RAW_BODY_PLACEHOLDER", opts.body);
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
@@ -550,9 +676,10 @@ function renderHome(opts) {
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   var title     = opts.title || "Shop";
   var assetPrefix = opts.asset_prefix || "/assets/";
+  var fmt = _priceFormatter(opts);
   var products    = opts.products.map(function (p) {
     var priceStr = p.starting_price_minor != null
-      ? pricing.format(p.starting_price_minor, p.starting_price_currency || "USD")
+      ? fmt(p.starting_price_minor, p.starting_price_currency || "USD")
       : "—";
     // Hero image — first media row attached to the product (the
     // route handler bundles it in via `p.hero_media`). Image-less
@@ -627,13 +754,13 @@ function renderHome(opts) {
   // designed surface even when no products are loaded yet —
   // visitors land on the storefront shell, not a tech demo.
   var body = hero + catalog;
-  return _wrap({
+  return _wrap(Object.assign({
     title:      title,
     shop_name:  shopName,
     cart_count: cartCount,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 // ---- search results -----------------------------------------------------
@@ -857,9 +984,10 @@ function renderSearch(opts) {
       .replace("RAW_CLEAR", clearLink);
   } else {
     var assetPrefix = opts.asset_prefix || "/assets/";
+    var fmt = _priceFormatter(opts);
     var cards = products.map(function (p) {
       var priceStr = p.starting_price_minor != null
-        ? pricing.format(p.starting_price_minor, p.starting_price_currency || "USD")
+        ? fmt(p.starting_price_minor, p.starting_price_currency || "USD")
         : "—";
       var imageUrl = p.hero_media ? assetPrefix + p.hero_media.r2_key : null;
       var imageAlt = p.hero_media ? (p.hero_media.alt_text || p.title) : null;
@@ -875,14 +1003,14 @@ function renderSearch(opts) {
   } else {
     body = header + correctionHtml + chipsHtml + resultsInner;
   }
-  return _wrap({
+  return _wrap(Object.assign({
     title:      "Search",
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     search_q:   opts.q,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 // ---- product detail -----------------------------------------------------
@@ -2597,9 +2725,10 @@ function renderProduct(opts) {
   var shopName = opts.shop_name || "blamejs.shop";
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   var description = opts.product.description || "";
+  var fmt = _priceFormatter(opts);
   var rendered = variants.map(function (v) {
     var price = prices[v.id];
-    var priceStr = price ? pricing.format(price.amount_minor, price.currency) : "—";
+    var priceStr = price ? fmt(price.amount_minor, price.currency) : "—";
     var vTitle = v.title || (Object.keys(v.options || {}).map(function (k) { return v.options[k]; }).join(" / ") || "Default");
     return { id: v.id, sku: v.sku, title: vTitle, price: priceStr };
   });
@@ -2705,7 +2834,7 @@ function renderProduct(opts) {
   });
   jsonLd = (jsonLd || "") + breadcrumbJsonLd;
-  return _wrap({
+  return _wrap(Object.assign({
     title:          opts.product.title,
     shop_name:      shopName,
     cart_count:     cartCount,
@@ -2715,7 +2844,7 @@ function renderProduct(opts) {
     og_description: description || ("Browse " + opts.product.title + " on " + shopName + "."),
     og_image:       ogImage,
     body:           body + jsonLd,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 // ---- cart --------------------------------------------------------------
@@ -3242,6 +3371,7 @@ function renderCart(opts) {
   // route handler bundles it in. Lines without an entry render with
   // a dashed-placeholder tile + the SKU as the fallback title.
   var lookup  = opts.product_lookup || {};
+  var fmt = _priceFormatter(opts);
   var rendered = lines.map(function (l) {
     var match  = lookup[l.variant_id] || null;
     var prod   = match && match.product;
@@ -3252,16 +3382,16 @@ function renderCart(opts) {
       id:             l.id,
       sku:            l.sku,
       qty:            String(l.qty),
-      unit:           pricing.format(l.unit_amount_minor, l.unit_currency),
-      total:          pricing.format(l.qty * l.unit_amount_minor, l.unit_currency),
+      unit:           fmt(l.unit_amount_minor, l.unit_currency),
+      total:          fmt(l.qty * l.unit_amount_minor, l.unit_currency),
       product_title:  (prod && prod.title) || l.sku,
       product_url:    prod ? ("/products/" + prod.slug) : "#",
       image_url:      imageUrl,
       image_alt:      imageAlt,
     };
   });
-  var subtotal = pricing.format(totals.subtotal_minor,    totals.currency);
-  var total    = pricing.format(totals.grand_total_minor, totals.currency);
+  var subtotal = fmt(totals.subtotal_minor,    totals.currency);
+  var total    = fmt(totals.grand_total_minor, totals.currency);
   if (opts.theme) {
     return opts.theme.render("cart", {
       title:          "Cart",
@@ -3307,13 +3437,13 @@ function renderCart(opts) {
       total:     total,
     }).replace("RAW_LINES", rows);
   }
-  return _wrap({
+  return _wrap(Object.assign({
     title:      "Cart",
     shop_name:  shopName,
     cart_count: lines.length,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 // ---- admin landing (HTML — the rest of /admin/* is JSON API) ----------
@@ -3422,6 +3552,82 @@ function renderNewsletterError(opts) {
   });
 }
+// ---- cookie preference center ------------------------------------------
+// The four toggleable categories + their operator-facing copy, mirroring
+// lib/cookie-consent.js's category taxonomy. Order is fixed so the page
+// reads the same every render.
+var CONSENT_CATEGORY_COPY = [
+  { key: "functional",  name: "Functional",  desc: "Remember-me, locale, and currency-selector cookies that make the shop more convenient." },
+  { key: "analytics",   name: "Analytics",   desc: "Aggregate, privacy-respecting usage measurement so we can see which pages help and which don't." },
+  { key: "marketing",   name: "Marketing",   desc: "Advertising and retargeting pixels. Off unless you turn them on; a Do-Not-Track or Global Privacy Control signal keeps them off regardless." },
+  { key: "preferences", name: "Preferences", desc: "Your saved UI tweaks — dark mode, list density, and similar non-essential settings." },
+];
+// The /cookies manage page. Pre-checks each toggle from the visitor's
+// stored decision (all off when there's no decision yet — default-deny).
+// `decision` is the shape `_readConsentDecision` returns, or null.
+// `notice` is an optional operator-fixed confirmation string (e.g. after
+// a save) — never a reflected visitor value.
+function renderCookiePreferences(opts) {
+  opts = opts || {};
+  var decision = opts.decision || null;
+  var noticeHtml = "";
+  if (opts.notice === "saved") {
+    noticeHtml = "<p class=\"consent-page__notice\" role=\"status\">Your cookie preferences were saved. They take effect immediately and you can change them again any time on this page.</p>";
+  } else if (opts.notice === "invalid") {
+    noticeHtml = "<p class=\"consent-page__notice\" role=\"alert\">That submission wasn't understood, so nothing changed. Choose your categories below and save again.</p>";
+  }
+  var cats = "";
+  for (var i = 0; i < CONSENT_CATEGORY_COPY.length; i += 1) {
+    var c = CONSENT_CATEGORY_COPY[i];
+    var on = decision && decision.categories && decision.categories[c.key] === true;
+    cats +=
+      "<div class=\"consent-cat\">" +
+        "<div class=\"consent-cat__head\">" +
+          "<h2 class=\"consent-cat__name\">" + c.name + "</h2>" +
+          "<label class=\"consent-toggle\">" +
+            "<span class=\"skip-link\">Allow " + c.name + " cookies</span>" +
+            "<input type=\"checkbox\" name=\"cat_" + c.key + "\" value=\"1\"" + (on ? " checked" : "") + ">" +
+          "</label>" +
+        "</div>" +
+        "<p class=\"consent-cat__desc\">" + c.desc + "</p>" +
+      "</div>";
+  }
+  var body =
+    "<section class=\"consent-page\">" +
+      "<p class=\"eyebrow\">Privacy</p>" +
+      "<h1>Cookie preferences</h1>" +
+      "<p class=\"consent-page__lede\">Strictly-necessary cookies — your session, security tokens, and this choice itself — are always on because the shop can't run without them. Everything below is optional and off by default.</p>" +
+      noticeHtml +
+      "<form method=\"post\" action=\"/consent\">" +
+        "<input type=\"hidden\" name=\"return_to\" value=\"/cookies\">" +
+        "<div class=\"consent-cat\">" +
+          "<div class=\"consent-cat__head\">" +
+            "<h2 class=\"consent-cat__name\">Strictly necessary</h2>" +
+            "<span class=\"consent-cat__always\">Always on</span>" +
+          "</div>" +
+          "<p class=\"consent-cat__desc\">Session, CSRF protection, and your cookie choice. These can't be switched off.</p>" +
+        "</div>" +
+        cats +
+        "<div class=\"consent-page__actions\">" +
+          "<button type=\"submit\" name=\"choice\" value=\"granular\" class=\"btn-primary\">Save preferences</button>" +
+          "<button type=\"submit\" name=\"choice\" value=\"accept_all\" class=\"btn-ghost\">Accept all</button>" +
+          "<button type=\"submit\" name=\"choice\" value=\"reject\" class=\"btn-ghost\">Reject non-essential</button>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Cookie preferences",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
 // ---- 404 ---------------------------------------------------------------
 function renderNotFound(opts) {
@@ -3504,6 +3710,14 @@ var OAUTH_COOKIE_NAME = "shop_oauth";
 // Sealed so it can't be forged to mis-attribute a signup.
 var REFERRAL_COOKIE_NAME = "shop_ref";
+// Sealed cookie holding the visitor's chosen DISPLAY currency (ISO 4217).
+// Display-only: the cart / order / payment currency is unchanged — this
+// only selects which currency the price strings are rendered in. Sealed
+// so a tampered value can't smuggle a non-allow-listed code past the
+// reader; a garbage value reads as "unset" and the storefront renders in
+// the base currency. Path "/" so the choice persists across the catalog.
+var CURRENCY_COOKIE_NAME = "shop_ccy";
 // Shape of a valid session id — mirrors cart.js's SESSION_ID_RE.
 var SID_SHAPE_RE = /^[A-Za-z0-9_-]{16,64}$/;
@@ -3589,6 +3803,166 @@ function _readReferralEnv(req) {
   try { return JSON.parse(raw); } catch (_e) { return null; }
 }
+// ---- cookie-consent cookies --------------------------------------------
+//
+// Two cookies carry a visitor's cookie-consent decision:
+//
+//   * `shop_consent`     — the authoritative decision, vault-sealed +
+//                          HttpOnly. Holds { categories, policy_version,
+//                          ts }. Read server-side to gate non-essential
+//                          cookies/trackers and to pre-check the manage
+//                          page's toggles. A tampered / truncated / stale
+//                          value fails the seal and reads as "no decision"
+//                          (the banner reshows) rather than throwing.
+//   * `shop_consent_set` — a non-sealed, NON-HttpOnly "1" flag the consent
+//                          island reads to hide the banner on edge-cached
+//                          pages. Non-authoritative: it only drives banner
+//                          visibility, never the actual cookie/tracker gate.
+//
+// The four toggleable categories mirror lib/cookie-consent.js's
+// TOGGLEABLE_CATEGORIES; strictly-necessary is implicit-on and never
+// stored here.
+var CONSENT_COOKIE_NAME      = "shop_consent";
+var CONSENT_FLAG_COOKIE_NAME = "shop_consent_set";
+var CONSENT_TOGGLEABLE       = ["functional", "analytics", "marketing", "preferences"];
+// The consent policy version visitors are being asked to consent to. A
+// stored decision (sealed cookie) captured under an older version is no
+// longer authoritative: the gate stops honoring it and the banner re-
+// prompts, so an operator who materially changes their cookie policy and
+// bumps the version re-collects consent rather than coasting on stale
+// opt-ins. Mirrors lib/cookie-consent.js's `policy_version` charset so the
+// value is safe to stamp into a cookie value and an HTML attribute; an
+// out-of-charset / over-length / missing value falls back to "v1" (the
+// initial version, matching the edge worker's stamped default). The active
+// value is read live from `deps.cookieConsent.policyVersion` per request in
+// the server gate (so a runtime bump takes effect immediately); the module
+// snapshot drives the page-stamped value set once at mount.
+var _activeConsentPolicy = "v1";
+function _sanitizeConsentPolicy(v) {
+  return (typeof v === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(v)) ? v : "v1";
+}
+// Persist a decision: the sealed authoritative cookie + the non-sealed
+// flag. Both expire in 180 days — ICO / CNIL guidance treats ~6 months as
+// the upper bound before a consent re-prompt; the cookie-consent ledger
+// keeps the durable audit record regardless of cookie lifetime.
+function _setConsentCookies(res, decision) {
+  var T = b.constants.TIME;
+  var exp = new Date(Date.now() + T.days(180));
+  _cookieJar().writeSealed(res, CONSENT_COOKIE_NAME, JSON.stringify(decision), { expires: exp });
+  // Not HttpOnly — the consent island must read it from document.cookie to
+  // decide whether to hide the banner. Its value is the policy version the
+  // decision was captured under (charset-constrained, no decision detail),
+  // so the island can compare it to the active version stamped on its
+  // <script> tag and re-prompt when the operator has bumped the policy. A
+  // script-readable version string leaks nothing the server would act on.
+  var flagVal = _sanitizeConsentPolicy(decision && decision.policy_version);
+  _cookieJar().write(res, CONSENT_FLAG_COOKIE_NAME, flagVal, { expires: exp, httpOnly: false });
+}
+// The visitor's stored decision, or null when none / malformed / stale.
+// Shape-validates the unsealed payload so a forged-but-unsealable or schema-
+// drifted value reads as "no decision". `activePolicy` is the policy version
+// currently in force (defaults to the module snapshot; the server routes
+// pass the live `deps.cookieConsent.policyVersion`): a decision whose
+// `policy_version` doesn't match it — including an unversioned legacy value
+// — reads as "no decision" so the operator's policy bump re-collects consent
+// rather than the gate honoring opt-ins captured under a superseded policy.
+function _readConsentDecision(req, activePolicy) {
+  var raw = _cookieJar().readSealed(req, CONSENT_COOKIE_NAME);
+  if (raw === null) return null;
+  var parsed;
+  try { parsed = JSON.parse(raw); } catch (_e) { return null; }
+  if (!parsed || typeof parsed !== "object" || !parsed.categories || typeof parsed.categories !== "object") {
+    return null;
+  }
+  var active = (arguments.length > 1) ? _sanitizeConsentPolicy(activePolicy) : _activeConsentPolicy;
+  if (parsed.policy_version !== active) return null;
+  var cats = {};
+  for (var i = 0; i < CONSENT_TOGGLEABLE.length; i += 1) {
+    cats[CONSENT_TOGGLEABLE[i]] = parsed.categories[CONSENT_TOGGLEABLE[i]] === true;
+  }
+  return {
+    categories:     cats,
+    policy_version: parsed.policy_version,
+    ts:             Number.isFinite(parsed.ts) ? parsed.ts : null,
+  };
+}
+// Server-side gating hook. Returns true when `category` may emit a
+// cookie / tag / pixel byte for this request. Strictly-necessary is
+// always allowed; the four toggleable categories consult the stored
+// decision (default-deny when absent). DNT / Sec-GPC collapse analytics
+// + marketing to false regardless of the stored opt-in (browser-level
+// opt-out wins — same rule the cookie-consent ledger records and
+// honors). This is the single function a future analytics / marketing
+// island gates its render on:
+//
+//   if (_consentAllows(req, "analytics", _liveConsentPolicy())) body += _islandScript("analytics.js");
+//
+// so a tracker is never injected into the document unless the visitor
+// opted that category in.
+function _consentAllows(req, category, activePolicy) {
+  if (category === "strictly_necessary") return true;
+  if (CONSENT_TOGGLEABLE.indexOf(category) === -1) return false;
+  var decision = (arguments.length > 2)
+    ? _readConsentDecision(req, activePolicy)
+    : _readConsentDecision(req);
+  if (!decision) return false;
+  if ((category === "analytics" || category === "marketing") && _browserOptOut(req)) return false;
+  return decision.categories[category] === true;
+}
+// DNT (Do-Not-Track) header set to "1". Defensive read — missing /
+// garbage reads as "no signal".
+function _dntSignal(req) {
+  var h = (req && req.headers) || {};
+  return String(h["dnt"] || h["DNT"] || "") === "1";
+}
+// Sec-GPC (Global Privacy Control) header set to "1".
+function _gpcSignal(req) {
+  var h = (req && req.headers) || {};
+  return String(h["sec-gpc"] || h["Sec-GPC"] || "") === "1";
+}
+// Either DNT or GPC is an implicit deny for analytics + marketing.
+function _browserOptOut(req) {
+  return _dntSignal(req) || _gpcSignal(req);
+}
+// Coarse UA classifier for the consent ledger row — matches
+// lib/cookie-consent.js's UA_CLASS_VALUES. Defensive: unknown / missing
+// UA reads as "unknown".
+function _uaClass(req) {
+  var ua = String((req && req.headers && (req.headers["user-agent"] || req.headers["User-Agent"])) || "").toLowerCase();
+  if (!ua) return "unknown";
+  if (/bot|crawl|spider|slurp|bingpreview|headless/.test(ua)) return "bot";
+  if (/ipad|tablet|kindle|playbook|silk/.test(ua)) return "tablet";
+  if (/mobi|iphone|android.*mobile|phone/.test(ua)) return "mobile";
+  if (/windows|macintosh|linux|cros|x11/.test(ua)) return "desktop";
+  return "unknown";
+}
+var CCY_SHAPE_RE = /^[A-Z]{3}$/;
+// The visitor's chosen display currency, or null. Sealed so the value
+// can't be forged; a missing / malformed / mis-shaped value reads as null
+// (→ base-currency display), never throws.
+function _readCurrencyCookie(req) {
+  var raw = _cookieJar().readSealed(req, CURRENCY_COOKIE_NAME);
+  if (raw === null || !CCY_SHAPE_RE.test(raw)) return null;
+  return raw;
+}
+function _setCurrencyCookie(res, code) {
+  var T = b.constants.TIME;
+  _cookieJar().writeSealed(res, CURRENCY_COOKIE_NAME, code, { expires: new Date(Date.now() + T.days(180)) });
+}
+function _clearCurrencyCookie(res) {
+  _cookieJar().clear(res, CURRENCY_COOKIE_NAME);
+}
 // ---- account-page renderers --------------------------------------------
 var ACCOUNT_LOGIN_PAGE =
@@ -3808,6 +4182,20 @@ function mount(router, deps) {
   // Stripe via the primitive); without it the list stays read-only.
   var subscriptions = deps.subscriptions || null;
+  // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
+  // from the consent primitive per request so a runtime `policyVersion`
+  // bump takes effect on the gate immediately, and refreshes the module
+  // snapshot the page-stamp reads — the snapshot exists because the
+  // module-level renderers (`_wrap`) don't close over `deps`, so consulting
+  // the live version (every consent route does) keeps the stamped value in
+  // step without threading it through every render call. Set once here so
+  // the value is correct from the first render after boot.
+  function _liveConsentPolicy() {
+    _activeConsentPolicy = _sanitizeConsentPolicy(deps.cookieConsent && deps.cookieConsent.policyVersion);
+    return _activeConsentPolicy;
+  }
+  _liveConsentPolicy();
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");
@@ -3842,6 +4230,76 @@ function mount(router, deps) {
     return lines.length;
   }
+  // ---- multi-currency display -------------------------------------------
+  //
+  // Opt-in: wired only when the operator supplies `deps.currencyDisplay`
+  // (an FX-rate cache instance) AND `deps.currency_display_options` (the
+  // allow-list of display currencies, base first). Absent either, every
+  // render call gets an empty currency bundle and prices stay in the base
+  // currency exactly as before. `deps.currencyRounding` is optional —
+  // present, it applies the per-currency display-increment rule (CHF 0.05,
+  // SEK 0.10); absent, conversion uses banker's rounding only.
+  var _ccyBase    = (deps.currency_base || "USD").toUpperCase();
+  var _ccyOptions = Array.isArray(deps.currency_display_options)
+    ? deps.currency_display_options.map(function (c) { return String(c).toUpperCase(); })
+    : null;
+  // The feature mounts (the /currency route + the per-request bundle)
+  // whenever an FX instance is wired AND the boot-time allow-list names
+  // >1 currency. The per-request `currency_config` resolver can narrow /
+  // widen the live allow-list, but mounting is decided once at boot from
+  // the seed so a single-currency store never registers the route.
+  var _ccyEnabled = !!(deps.currencyDisplay && _ccyOptions && _ccyOptions.length > 1);
+  var _ccyConfig  = typeof deps.currency_config === "function" ? deps.currency_config : null;
+  // Per-request currency bundle merged into every render call's opts:
+  //   format_price          — sync base→display formatter (or pricing.format)
+  //   currency_options       — the switcher's option list
+  //   currency_selected      — the visitor's active display currency
+  //   currency_note          — "charged in <base>" disclosure (when converting)
+  //   currency_redirect_to   — the path the switcher returns the visitor to
+  // A read / conversion failure degrades to the base bundle (prices in the
+  // base currency) — a broken FX backend never breaks a priced page.
+  async function _currencyForReq(req) {
+    if (!_ccyEnabled) return {};
+    var path = String((req && req.url) || "/").split("?")[0] || "/";
+    // Resolve the live base + allow-list (config override, else the boot
+    // seed). A resolver failure falls back to the seed.
+    var base = _ccyBase;
+    var options = _ccyOptions;
+    if (_ccyConfig) {
+      try {
+        var cfg = await _ccyConfig();
+        if (cfg && cfg.base) base = cfg.base;
+        if (cfg && Array.isArray(cfg.options) && cfg.options.length) options = cfg.options;
+      } catch (_e) { /* keep the boot seed */ }
+    }
+    var bundle = {
+      currency_options:     options,
+      currency_selected:    base,
+      currency_redirect_to: path,
+    };
+    var chosen = _readCurrencyCookie(req);
+    try {
+      var presenter = await currencyDisplayModule.loadPresenter({
+        fx:              deps.currencyDisplay,
+        rounding:        deps.currencyRounding || null,
+        baseCurrency:    base,
+        displayCurrency: chosen,
+      });
+      // The presenter only activates when the chosen currency is in the
+      // live allow-list AND has a usable rate. A cookie naming a currency
+      // the operator since removed from the list resolves to base.
+      if (presenter && presenter.active && options.indexOf(presenter.displayCurrency) !== -1) {
+        bundle.format_price      = presenter.format;
+        bundle.currency_selected = presenter.displayCurrency;
+        if (presenter.note) bundle.currency_note = presenter.note;
+      }
+    } catch (_e) {
+      // FX / rounding backend unavailable — fall back to base display.
+    }
+    return bundle;
+  }
   // Absolute shareable referral link for a code. Prefers the operator's
   // configured origin (deps.shop_origin / SHOP_ORIGIN) so the link is
   // stable across the edge/container split; falls back to the request's
@@ -3965,8 +4423,9 @@ function mount(router, deps) {
   // reachable via multiple variant SKUs. Drop-silent on a primitive
   // error so a bundles read failure can't 500 the PDP — the rail just
   // doesn't render (mirrors the reviews/Q&A degrade-to-empty stance).
-  async function _resolveBundleOffers(variantSkus, currency) {
+  async function _resolveBundleOffers(variantSkus, currency, fmtPrice) {
     if (!deps.bundles) return [];
+    var fmt = typeof fmtPrice === "function" ? fmtPrice : pricing.format;
     var seen = Object.create(null);
     var offers = [];
     try {
@@ -4011,9 +4470,9 @@ function mount(router, deps) {
             bundle_sku:         bundle.bundle_sku,
             title:              bundle.title,
             components:         componentsOut,
-            list_total_str:     pricing.format(listMinor, cur),
-            amount_str:         pricing.format(amountMinor, cur),
-            discount_str:       discountMinor > 0 ? pricing.format(discountMinor, cur) : null,
+            list_total_str:     fmt(listMinor, cur),
+            amount_str:         fmt(amountMinor, cur),
+            discount_str:       discountMinor > 0 ? fmt(discountMinor, cur) : null,
             available:          available,
             unavailable_reason: available
               ? null
@@ -4037,8 +4496,9 @@ function mount(router, deps) {
   // that quantity. Rows read as ascending ranges ("1–4", "5–9",
   // "10+"). Returns [] when no active sku-scoped tier set exists.
   // Drop-silent on a read failure so the PDP still renders.
-  async function _resolveQtyBreaks(sku, unitMinor, currency) {
+  async function _resolveQtyBreaks(sku, unitMinor, currency, fmtPrice) {
     if (!deps.quantityDiscounts || unitMinor == null) return [];
+    var fmt = typeof fmtPrice === "function" ? fmtPrice : pricing.format;
     var breakdown;
     try {
       breakdown = await deps.quantityDiscounts.tierBreakdown({
@@ -4061,7 +4521,7 @@ function mount(router, deps) {
     if (sorted[0].min_quantity > 1) {
       out.push({
         label:    "1–" + (sorted[0].min_quantity - 1),
-        unit_str: pricing.format(unitMinor, currency),
+        unit_str: fmt(unitMinor, currency),
       });
     }
     for (var i = 0; i < sorted.length; i += 1) {
@@ -4069,7 +4529,7 @@ function mount(router, deps) {
       var next = sorted[i + 1];
       var label = next ? (t.min_quantity + "–" + (next.min_quantity - 1)) : (t.min_quantity + "+");
       var unit = t.sample_discounted_unit_minor != null ? t.sample_discounted_unit_minor : unitMinor;
-      out.push({ label: label, unit_str: pricing.format(unit, currency) });
+      out.push({ label: label, unit_str: fmt(unit, currency) });
     }
     return out;
   }
@@ -4109,7 +4569,35 @@ function mount(router, deps) {
     return out;
   }
-  router.get("/", async function (_req, res) {
+  // POST /currency — set (or clear) the visitor's display-currency choice.
+  // Registered only when multi-currency display is wired. Display-only:
+  // this NEVER touches the cart / order / payment currency — it sets the
+  // sealed `shop_ccy` cookie that selects which currency price strings are
+  // rendered in, then 303-redirects back so the new choice takes effect on
+  // the next render. A choice outside the operator's allow-list clears the
+  // cookie (→ base-currency display) rather than persisting a code the
+  // switcher would never offer.
+  if (_ccyEnabled) {
+    router.post("/currency", function (req, res) {
+      var body = req.body || {};
+      var chosen = typeof body.currency === "string" ? body.currency.toUpperCase() : "";
+      // `redirect_to` is constrained to a same-origin path (leading single
+      // slash, no scheme / host / protocol-relative `//`) so the switcher
+      // can't be turned into an open redirect.
+      var rawTo = typeof body.redirect_to === "string" ? body.redirect_to : "/";
+      var to = (/^\/(?!\/)/.test(rawTo)) ? rawTo : "/";
+      if (chosen === _ccyBase || _ccyOptions.indexOf(chosen) === -1) {
+        _clearCurrencyCookie(res);
+      } else {
+        _setCurrencyCookie(res, chosen);
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", to);
+      return res.end ? res.end() : res.send("");
+    });
+  }
+  router.get("/", async function (req, res) {
     var page = await deps.catalog.products.list({ status: "active", limit: 24 });
     // Best-effort "starting price" + "hero media" lookup. Each
     // product on the home grid carries its first variant's USD
@@ -4134,7 +4622,8 @@ function mount(router, deps) {
         hero_media:              heroMedia,
       }));
     }
-    var html = renderHome({ products: products, shop_name: shopName, theme: theme });
+    var ccy = await _currencyForReq(req);
+    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, ccy));
     _send(res, 200, html);
   });
@@ -4264,7 +4753,8 @@ function mount(router, deps) {
         cartCount = lines.length;
       }
     }
-    _send(res, 200, renderSearch({
+    var ccy = await _currencyForReq(req);
+    _send(res, 200, renderSearch(Object.assign({
       q:               q,
       products:        products,
       facets:          facetGroups,
@@ -4272,7 +4762,7 @@ function mount(router, deps) {
       corrected_query: correctedQ,
       shop_name:       shopName,
       cart_count:      cartCount,
-    }));
+    }, ccy)));
   });
   router.get("/products/:slug", async function (req, res) {
@@ -4365,14 +4855,16 @@ function mount(router, deps) {
     // so the buy path renders regardless. The quantity-break table is
     // built against the first variant's list price — the band a shopper
     // sees on the PDP matches what the cart charges at that quantity.
+    var ccy = await _currencyForReq(req);
+    var ccyFmt = ccy.format_price || null;
     var variantSkus = variants.map(function (v) { return v.sku; });
-    var bundleOffers = await _resolveBundleOffers(variantSkus, "USD");
+    var bundleOffers = await _resolveBundleOffers(variantSkus, "USD", ccyFmt);
     var firstVariant = variants[0] || null;
     var firstPrice = firstVariant ? prices[firstVariant.id] : null;
     var qtyBreaks = firstVariant && firstPrice
-      ? await _resolveQtyBreaks(firstVariant.sku, firstPrice.amount_minor, firstPrice.currency)
+      ? await _resolveQtyBreaks(firstVariant.sku, firstPrice.amount_minor, firstPrice.currency, ccyFmt)
       : [];
-    var html = renderProduct({
+    var html = renderProduct(Object.assign({
       product:        product,
       variants:       variants,
       prices:         prices,
@@ -4388,7 +4880,7 @@ function mount(router, deps) {
       shop_name:      shopName,
       cart_count:     cartCount,
       theme:          theme,
-    });
+    }, ccy));
     _send(res, 200, html);
   });
@@ -4703,19 +5195,20 @@ function mount(router, deps) {
   }
   router.get("/cart", async function (req, res) {
+    var ccy = await _currencyForReq(req);
     var sid = _readSidCookie(req);
     if (!sid) {
-      return _send(res, 200, renderCart({
+      return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
         shop_name: shopName, theme: theme,
-      }));
+      }, ccy)));
     }
     var c = await deps.cart.bySession(sid);
     if (!c) {
-      return _send(res, 200, renderCart({
+      return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
         shop_name: shopName, theme: theme,
-      }));
+      }, ccy)));
     }
     var rawLines = await deps.cart.listLines(c.id);
     // Reapply the active quantity-break for each line at its current
@@ -4742,14 +5235,14 @@ function mount(router, deps) {
         hero_media: media.length ? media[0] : null,
       };
     }
-    _send(res, 200, renderCart({
+    _send(res, 200, renderCart(Object.assign({
       lines:           lines,
       totals:          totals,
       product_lookup:  productLookup,
       can_save:        !!(deps.saveForLater && deps.customers),
       shop_name:       shopName,
       theme:           theme,
-    }));
+    }, ccy)));
   });
   // ---- checkout flow -------------------------------------------------
@@ -6966,6 +7459,144 @@ function mount(router, deps) {
     });
   }
+  // ---- cookie consent -----------------------------------------------------
+  //
+  // GDPR (EU 2016/679 art. 6 + 7) + ePrivacy (2002/58/EC art. 5(3)) opt-in
+  // for non-strictly-necessary cookies. The banner ships in the chrome of
+  // every page (see CONSENT_BANNER in the layout); these two routes back
+  // it. No auth, no client JS required — the banner form and the manage
+  // page both work server-rendered for a guest with scripting disabled.
+  //
+  // The decision is written to a sealed first-party cookie (the gate) AND
+  // recorded in the cookie-consent ledger (the audit trail) when the
+  // primitive is wired. CSRF / origin / fetch-metadata defenses are the
+  // framework middleware already on every POST — no per-route re-check.
+  // Same-origin path guard for `return_to`. Accepts a single leading slash
+  // followed by a non-slash (so `//evil.example` and absolute URLs are
+  // refused), capping length defensively. Anything else collapses to the
+  // safe default the caller passes.
+  function _consentReturnTo(raw, fallback) {
+    if (typeof raw === "string" && raw.length <= 512 && /^\/[^/]/.test(raw)) return raw;
+    return fallback;
+  }
+  // Translate a posted choice + per-category checkboxes into the four
+  // toggleable booleans. `accept_all` turns every category on; `reject`
+  // turns every category off; `granular` reads each `cat_<key>` checkbox
+  // (present + "1" == on, absent == off — the unchecked-by-default
+  // ePrivacy shape). Returns null for an unknown choice so the caller can
+  // 400 a malformed submit.
+  function _consentCategoriesFromBody(body) {
+    var choice = body && body.choice;
+    var cats = { functional: false, analytics: false, marketing: false, preferences: false };
+    if (choice === "accept_all") {
+      cats.functional = cats.analytics = cats.marketing = cats.preferences = true;
+      return cats;
+    }
+    if (choice === "reject") {
+      return cats;
+    }
+    if (choice === "granular") {
+      for (var i = 0; i < CONSENT_TOGGLEABLE.length; i += 1) {
+        var k = CONSENT_TOGGLEABLE[i];
+        cats[k] = body["cat_" + k] === "1";
+      }
+      return cats;
+    }
+    return null;
+  }
+  // Ensure a session id exists so the consent decision is keyed to a
+  // stable (hashed-at-the-ledger) session. Reuses the existing shop_sid
+  // cookie when present; mints one otherwise — consent is a guest-
+  // reachable flow, so it can't assume a cart already created the sid.
+  function _ensureSid(req, res) {
+    var sid = _readSidCookie(req);
+    if (!sid) {
+      sid = b.uuid.v7();
+      _setSidCookie(res, sid);
+    }
+    return sid;
+  }
+  // POST /consent — set the decision. Drives both the banner (Accept all /
+  // Reject) and the manage page's granular save. Writes the sealed gate
+  // cookie + the non-sealed flag cookie, records the decision in the
+  // cookie-consent ledger (best-effort — a ledger hiccup never blocks the
+  // decision from taking effect), then 303s back to a safe same-origin
+  // return_to.
+  router.post("/consent", async function (req, res) {
+    var body = req.body || {};
+    var cats = _consentCategoriesFromBody(body);
+    var fromManage = (typeof body.return_to === "string" && body.return_to.indexOf("/cookies") === 0);
+    // Malformed (unknown / missing choice) → 400. Re-render the manage
+    // page so the visitor lands somewhere actionable rather than on a
+    // bare error string.
+    if (!cats) {
+      var cartCount400 = 0;
+      try { cartCount400 = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      return _send(res, 400, renderCookiePreferences({
+        shop_name:  shopName,
+        cart_count: cartCount400,
+        theme:      theme,
+        decision:   _readConsentDecision(req, _liveConsentPolicy()),
+        notice:     "invalid",
+      }));
+    }
+    var sid = _ensureSid(req, res);
+    var decision = {
+      categories:     cats,
+      policy_version: _liveConsentPolicy(),
+      ts:             Date.now(),
+    };
+    _setConsentCookies(res, decision);
+    // Durable audit trail. The cookie-consent ledger hashes the session id
+    // itself; we pass the raw sid + the browser DNT / GPC signals + a
+    // coarse UA class so the operator can prove to a supervisory authority
+    // both what was chosen and that a browser-level opt-out was honored.
+    if (deps.cookieConsent) {
+      try {
+        await deps.cookieConsent.recordConsent({
+          session_id: sid,
+          categories: cats,
+          ua_class:   _uaClass(req),
+          dnt:        _dntSignal(req),
+          gpc:        _gpcSignal(req),
+        });
+      } catch (_e) { /* drop-silent — the gate cookie is authoritative; the ledger write is the audit trail and must not block the decision */ }
+    }
+    var dest = _consentReturnTo(body.return_to, "/");
+    res.status(303);
+    res.setHeader && res.setHeader("location", fromManage ? "/cookies?saved=1" : dest);
+    return res.end ? res.end() : res.send("");
+  });
+  // GET /cookies — the preference center. Linked from the footer's
+  // "Manage cookies" and the banner's "Manage preferences". Pre-checks
+  // each toggle from the stored decision (all off when none exists). The
+  // `?saved=1` query renders a confirmation notice after a save 303.
+  router.get("/cookies", async function (req, res) {
+    var cartCount = 0;
+    try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+    var saved = false;
+    try {
+      var u = new URL(req.url, "http://localhost");
+      saved = u.searchParams.get("saved") === "1";
+    } catch (_e) { saved = false; }
+    return _send(res, 200, renderCookiePreferences({
+      shop_name:  shopName,
+      cart_count: cartCount,
+      theme:      theme,
+      decision:   _readConsentDecision(req, _liveConsentPolicy()),
+      notice:     saved ? "saved" : null,
+    }));
+  });
   // robots.txt — minimal crawl policy. Allow everything except
   // the admin API + cart + account + checkout / pay / orders (these
   // are session-scoped or operator-only, no crawl value), and
@@ -7083,6 +7714,7 @@ module.exports = {
   renderAccountRegister: renderAccountRegister,
   renderAccount:         renderAccount,
   renderAccountSubscriptions: renderAccountSubscriptions,
+  renderCookiePreferences: renderCookiePreferences,
   renderNotFound:        renderNotFound,
   // Layout exposed so operators forking the framework can override.
   _wrap:                 _wrap,