@blamejs/blamejs-shop 0.1.37 → 0.1.38

package/lib/storefront.js

@@ -865,8 +865,8 @@ var FACET_GROUP_HEAD =
 
 var FACET_OPTION =
   "<li class=\"facet-option\">\n" +
-  "  <a class=\"facet-option__link{{selected_class}}\" href=\"{{href}}\" rel=\"nofollow\"{{aria_pressed}}>\n" +
-  "    <span class=\"facet-option__box\" aria-hidden=\"true\">{{box}}</span>\n" +
+  "  <a class=\"facet-option__link{{selected_class}}\" href=\"{{href}}\" rel=\"nofollow\"{{aria_current}}>\n" +
+  "    <span class=\"facet-option__box\" aria-hidden=\"true\">{{box}}</span>{{selected_cue}}\n" +
   "    <span class=\"facet-option__label\">{{label}}</span>\n" +
   "    <span class=\"facet-option__count\">{{count}}</span>\n" +
   "  </a>\n" +
@@ -921,11 +921,13 @@ function _renderSearchFacets(facets, filters, q) {
       optionsHtml += _render(FACET_OPTION, {
         href:           _searchUrl(q, _toggleFilter(filters, facet.key, opt.value)),
         selected_class: opt.selected ? " is-selected" : "",
-        aria_pressed:   "RAW_ARIA",
+        aria_current:   "RAW_ARIA",
         box:            opt.selected ? "✓" : "",
+        selected_cue:   "RAW_CUE",
         label:          opt.label,
         count:          String(opt.count),
-      }).replace("RAW_ARIA", opt.selected ? " aria-pressed=\"true\"" : " aria-pressed=\"false\"");
+      }).replace("RAW_ARIA", opt.selected ? " aria-current=\"true\"" : "")
+        .replace("RAW_CUE", opt.selected ? "<span class=\"sr-only\">Selected: </span>" : "");
       rendered += 1;
     }
     if (rendered === 0) continue;
@@ -1635,7 +1637,19 @@ function renderWishlist(opts) {
   }
   var inner = rowsHtml
     ? "<ul class=\"wishlist-list\">" + rowsHtml + "</ul>"
-    : "<p class=\"wishlist-empty\">You haven't saved anything yet. Browse the shop and tap <strong>Save to wishlist</strong> on products you want to keep an eye on.</p>";
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__icon\" aria-hidden=\"true\">♡</p>" +
+        "<p class=\"account-empty__lede\">You haven't saved anything yet. Browse the shop and tap <strong>Save to wishlist</strong> on products you want to keep an eye on.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
+  // Success confirmation after a wishlist toggle, surfaced via
+  // role="status". Driven by the ?ok=<kind> redirect marker; unknown
+  // keys render nothing so a forged query can't inject copy.
+  var WISHLIST_OK = { added: "Saved to your wishlist.", removed: "Removed from your wishlist." };
+  var okMsg = WISHLIST_OK[opts.notice];
+  var notice = okMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(okMsg) + "</p>"
+    : "";
   var body =
     "<section class=\"account-wishlist\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -1643,6 +1657,7 @@ function renderWishlist(opts) {
         "<li aria-current=\"page\">Saved items</li>" +
       "</ol></nav>" +
       "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
+      notice +
       inner +
     "</section>";
   return _wrap({
@@ -1871,7 +1886,19 @@ function renderSaved(opts) {
   }
   var inner = rowsHtml
     ? "<ul class=\"saved-list\">" + rowsHtml + "</ul>"
-    : "<p class=\"saved-empty\">Nothing saved for later. Use <strong>Save for later</strong> on a cart item to move it here without losing it.</p>";
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__icon\" aria-hidden=\"true\">🔖</p>" +
+        "<p class=\"account-empty__lede\">Nothing saved for later. Use <strong>Save for later</strong> on a cart item to move it here without losing it.</p>" +
+        "<a class=\"btn-secondary\" href=\"/cart\">View your cart →</a>" +
+      "</div>";
+  // Success confirmation after a saved-list mutation (currently the
+  // Remove action), surfaced via role="status". Unknown ?ok=<kind> keys
+  // render nothing so a forged query can't inject copy.
+  var SAVED_OK = { removed: "Removed from your saved items.", moved: "Moved to your cart." };
+  var savedMsg = SAVED_OK[opts.notice];
+  var notice = savedMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(savedMsg) + "</p>"
+    : "";
   var body =
     "<section class=\"account-saved\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -1879,6 +1906,7 @@ function renderSaved(opts) {
         "<li aria-current=\"page\">Saved for later</li>" +
       "</ol></nav>" +
       "<h1 class=\"account-saved__title\">Saved for later</h1>" +
+      notice +
       inner +
     "</section>";
   return _wrap({
@@ -1958,16 +1986,32 @@ function renderAddresses(opts) {
           "<a class=\"btn-ghost btn-ghost--sm\" href=\"/account/addresses/" + esc(a.id) + "/edit\">Edit</a>" +
           (Number(a.is_default_shipping) === 1 ? "" : "<form method=\"post\" action=\"/account/addresses/" + esc(a.id) + "/default-shipping\"><button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Set default shipping</button></form>") +
           (Number(a.is_default_billing) === 1 ? "" : "<form method=\"post\" action=\"/account/addresses/" + esc(a.id) + "/default-billing\"><button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Set default billing</button></form>") +
-          "<form method=\"post\" action=\"/account/addresses/" + esc(a.id) + "/archive\"><button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Remove</button></form>" +
+          "<a class=\"btn-ghost btn-ghost--sm\" href=\"/account/addresses/" + esc(a.id) + "/remove\">Remove</a>" +
         "</div>" +
       "</li>";
   }
   var listHtml = rowsHtml
     ? "<ul class=\"address-list\">" + rowsHtml + "</ul>"
-    : "<p class=\"address-empty\">No saved addresses yet. Add one below to speed up checkout.</p>";
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__icon\" aria-hidden=\"true\">🏠</p>" +
+        "<p class=\"account-empty__lede\">No saved addresses yet. Add one below to speed up checkout.</p>" +
+      "</div>";
   var notice = opts.notice
     ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
     : "";
+  // Success confirmation after an address mutation (add / edit / remove /
+  // set-default), surfaced at the top of the list via role="status" so a
+  // screen reader announces it without stealing focus. Driven by the
+  // ?ok=<kind> redirect the POST handlers set on success. A remove also
+  // threads ?undo=<id> so the notice can offer a one-click un-archive.
+  var undoForm = opts.undo_id
+    ? " <form class=\"form-notice__undo\" method=\"post\" action=\"/account/addresses/" + esc(String(opts.undo_id)) + "/unarchive\">" +
+        "<button type=\"submit\" class=\"btn-link\">Undo</button>" +
+      "</form>"
+    : "";
+  var success = opts.success
+    ? "<div class=\"form-notice form-notice--ok\" role=\"status\"><span>" + esc(String(opts.success)) + "</span>" + undoForm + "</div>"
+    : "";
   var editing = opts.edit || null;
   var formHeading = editing ? "Edit address" : "Add an address";
   var formAction  = editing ? ("/account/addresses/" + editing.id) : "/account/addresses";
@@ -1978,6 +2022,7 @@ function renderAddresses(opts) {
         "<li aria-current=\"page\">Addresses</li>" +
       "</ol></nav>" +
       "<h1 class=\"account-addresses__title\">Addresses</h1>" +
+      success +
       listHtml +
       "<h2 class=\"account-addresses__form-title\">" + esc(formHeading) + "</h2>" +
       notice +
@@ -1992,6 +2037,45 @@ function renderAddresses(opts) {
   });
 }
 
+// Server-rendered confirmation step for removing a saved address. CSP
+// forbids an inline confirm() dialog, so the destructive action is gated
+// by a second page: a POST form that actually archives, plus a Cancel
+// link back to the list. JS-off-native — no client script involved.
+function renderAddressRemoveConfirm(opts) {
+  var esc = b.template.escapeHtml;
+  var a = opts.address || {};
+  var lines = [a.recipient_name, a.company, a.street_line1, a.street_line2,
+    [a.city, a.region, a.postal_code].filter(Boolean).join(", "), a.country, a.phone]
+    .filter(function (x) { return x != null && String(x).length; })
+    .map(function (x) { return "<span>" + esc(String(x)) + "</span>"; }).join("");
+  var body =
+    "<section class=\"account-confirm\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/addresses\">Addresses</a></li>" +
+        "<li aria-current=\"page\">Remove address</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-confirm__title\">Remove this address?</h1>" +
+      (a.label ? "<p class=\"address-card__label\">" + esc(a.label) + "</p>" : "") +
+      "<address class=\"address-card__body\">" + lines + "</address>" +
+      "<p class=\"account-confirm__lede\">This removes the address from your address book. " +
+        "You can add it again later.</p>" +
+      "<div class=\"account-confirm__actions\">" +
+        "<form method=\"post\" action=\"/account/addresses/" + esc(a.id) + "/archive\">" +
+          "<button type=\"submit\" class=\"btn-primary\">Remove address</button>" +
+        "</form>" +
+        "<a class=\"btn-ghost\" href=\"/account/addresses\">Cancel</a>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Remove address",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Storefront collection index — operator-curated + smart product lists.
 function renderCollectionList(opts) {
   var esc = b.template.escapeHtml;
@@ -2302,7 +2386,21 @@ function renderReturns(opts) {
   }
   var inner = rowsHtml
     ? "<ul class=\"return-list\">" + rowsHtml + "</ul>"
-    : "<p class=\"return-empty\">No returns yet. Start one from an order in your account.</p>";
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__icon\" aria-hidden=\"true\">↩</p>" +
+        "<p class=\"account-empty__lede\">No returns yet. Start one from an order in your account.</p>" +
+        "<a class=\"btn-secondary\" href=\"/account/orders\">View your orders →</a>" +
+      "</div>";
+  // Success confirmation after submitting a return request. The RMA code
+  // round-trips on the ?ok=<code> redirect so the notice can echo it back
+  // — the operator-readable handle the customer references in support.
+  // Validate the shape (RMA-YYMMDD-AAAAA) so a forged query can't inject
+  // arbitrary copy into the status message.
+  var notice = "";
+  if (opts.rma_code && /^RMA-\d{6}-[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{5}$/.test(String(opts.rma_code))) {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Return request received — RMA " +
+      esc(String(opts.rma_code)) + ". We'll email you when it's reviewed.</p>";
+  }
   var body =
     "<section class=\"account-returns\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2310,6 +2408,7 @@ function renderReturns(opts) {
         "<li aria-current=\"page\">Returns</li>" +
       "</ol></nav>" +
       "<h1 class=\"account-returns__title\">Returns</h1>" +
+      notice +
       inner +
     "</section>";
   return _wrap({
@@ -2692,13 +2791,12 @@ function renderAccountSubscriptions(opts) {
     }
     var cancelControl = "";
     if (canCancel && _subscriptionIsCancelable(s)) {
+      // The cancel decision (and its "immediate vs. at period end"
+      // consequence) is confirmed on a dedicated page — CSP forbids an
+      // inline confirm() dialog, so the destructive step is a second
+      // server-rendered screen rather than a one-click POST.
       cancelControl =
-        "<form class=\"subscription-card__cancel\" method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/cancel\">" +
-          "<label class=\"subscription-card__when\">" +
-            "<input type=\"checkbox\" name=\"immediate\" value=\"1\"> Cancel immediately (skip the rest of the period)" +
-          "</label>" +
-          "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Cancel subscription</button>" +
-        "</form>";
+        "<a class=\"btn-ghost btn-ghost--sm subscription-card__cancel-link\" href=\"/account/subscriptions/" + esc(s.id) + "/cancel\">Cancel subscription</a>";
     }
     rowsHtml +=
       "<li class=\"subscription-card\">" +
@@ -2715,7 +2813,11 @@ function renderAccountSubscriptions(opts) {
     : "<p class=\"subscription-note\">Cancellation isn't available on this store yet. Contact support to make changes.</p>";
   var inner = rowsHtml
     ? note + "<ul class=\"subscription-list\">" + rowsHtml + "</ul>"
-    : "<p class=\"subscription-empty\">You have no active subscriptions.</p>";
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__icon\" aria-hidden=\"true\">↻</p>" +
+        "<p class=\"account-empty__lede\">You have no active subscriptions.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
   var body =
     "<section class=\"account-subscriptions\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2735,6 +2837,79 @@ function renderAccountSubscriptions(opts) {
   });
 }
 
+// Server-rendered confirmation step for canceling a subscription. CSP
+// forbids an inline confirm() dialog, so the destructive choice is gated
+// by this page: it spells out the period-end date and, for the
+// "cancel immediately" path, the days of access forfeited. Two POST
+// forms (at-period-end / immediate) plus a Cancel link back to the list.
+// JS-off-native.
+function renderSubscriptionCancelConfirm(opts) {
+  var esc = b.template.escapeHtml;
+  var s = opts.subscription || {};
+  var plan = s.plan || null;
+  var planSummary = "this subscription";
+  if (plan) {
+    var ccy = String(plan.currency || "usd").toUpperCase();
+    var every = Number(plan.interval_count) > 1
+      ? "every " + Number(plan.interval_count) + " " + String(plan.interval) + "s"
+      : "per " + String(plan.interval);
+    var priceStr = "";
+    try { priceStr = pricing.format(Number(plan.amount_minor), ccy) + " "; } catch (_e) { priceStr = ""; }
+    planSummary = priceStr + every;
+  }
+  var periodEndMs = Number(s.current_period_end) || 0;
+  var periodEnd = periodEndMs ? new Date(periodEndMs).toISOString().slice(0, 10) : "";
+  // Days of paid access forfeited if canceled immediately rather than at
+  // period end — computed from now to the period boundary, floored at 0.
+  var forfeitDays = 0;
+  if (periodEndMs) {
+    forfeitDays = Math.max(0, Math.ceil((periodEndMs - Date.now()) / b.constants.TIME.days(1)));
+  }
+  var periodLine = periodEnd
+    ? "<p class=\"account-confirm__lede\">Your current period is paid through " +
+        "<time datetime=\"" + esc(periodEnd) + "\">" + esc(periodEnd) + "</time>.</p>"
+    : "";
+  var atPeriodEndForm =
+    "<form method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/cancel\">" +
+      "<p class=\"account-confirm__option\">Cancel at period end" +
+        (periodEnd ? " — keep access until <time datetime=\"" + esc(periodEnd) + "\">" + esc(periodEnd) + "</time>, then it won't renew." : ", so it won't renew.") +
+      "</p>" +
+      "<button type=\"submit\" class=\"btn-primary\">Cancel at period end</button>" +
+    "</form>";
+  var immediateForm =
+    "<form method=\"post\" action=\"/account/subscriptions/" + esc(s.id) + "/cancel\">" +
+      "<input type=\"hidden\" name=\"immediate\" value=\"1\">" +
+      "<p class=\"account-confirm__option\">Cancel immediately" +
+        (forfeitDays > 0
+          ? " — access ends now and you forfeit the remaining " + forfeitDays + " day" + (forfeitDays === 1 ? "" : "s") + " of this period."
+          : " — access ends now.") +
+      "</p>" +
+      "<button type=\"submit\" class=\"btn-ghost\">Cancel immediately</button>" +
+    "</form>";
+  var body =
+    "<section class=\"account-confirm\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/subscriptions\">Subscriptions</a></li>" +
+        "<li aria-current=\"page\">Cancel</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-confirm__title\">Cancel " + esc(planSummary) + "?</h1>" +
+      periodLine +
+      "<div class=\"account-confirm__actions\">" +
+        atPeriodEndForm +
+        immediateForm +
+        "<a class=\"btn-ghost\" href=\"/account/subscriptions\">Keep my subscription</a>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Cancel subscription",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Product-level "Save to wishlist" control + social-proof count.
 // Byte-compatible with the edge renderer (`worker/render/product.js`)
 // so both paths emit identical markup. Action-only label — the toggle
@@ -5801,6 +5976,20 @@ function mount(router, deps) {
       if (!orderId) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
       var o = await deps.order.get(orderId);
       if (!o) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+      // Ownership gate against IDOR: an order's confirmation page exposes
+      // the customer's name, address, and line items by UUID alone. An order
+      // that BELONGS to a customer (customer_id set) is viewable only by that
+      // signed-in customer — anyone else (a different customer OR an
+      // unauthenticated request) 404s rather than leaking it. A guest order
+      // carries no customer_id and remains reachable via its unguessable URL
+      // (the capability-URL model), so BOTH the just-placed-as-guest path AND
+      // the signed-in-shopper-with-an-anonymous-cart path (checkout.confirm
+      // derives the order from a cart that has no customer_id) still render
+      // their own confirmation here.
+      var orderAuth = _currentCustomerEnv(req);
+      if (o.customer_id && (!orderAuth || o.customer_id !== orderAuth.customer_id)) {
+        return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+      }
       // Same variant_id → {product, hero_media} lookup pattern as the
       // cart route, applied to the order's frozen line items so the
       // post-checkout page shows what the customer bought visually.
@@ -6557,22 +6746,26 @@ function mount(router, deps) {
           return res.end ? res.end() : res.send("");
         }
         var productId = (req.body || {}).product_id;
+        var removed = false;
         try {
           var already = await deps.wishlist.isWishlisted({ customer_id: auth.customer_id, product_id: productId });
-          if (already) await deps.wishlist.remove({ customer_id: auth.customer_id, product_id: productId });
+          if (already) { await deps.wishlist.remove({ customer_id: auth.customer_id, product_id: productId }); removed = true; }
           else         await deps.wishlist.add({ customer_id: auth.customer_id, product_id: productId });
         } catch (e) {
           res.status(e instanceof TypeError ? 400 : 500);
           return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
         }
+        var okKind = removed ? "removed" : "added";
         var rt = (req.body || {}).return_to;
         var dest;
         if (typeof rt === "string" && /^\/[^/]/.test(rt)) {
-          dest = rt;
+          // Only thread the success marker when returning to the wishlist
+          // page (the PDP heart toggle is its own visible cue).
+          dest = rt.indexOf("/account/wishlist") === 0 ? "/account/wishlist?ok=" + okKind : rt;
         } else {
           var product = null;
           try { product = await deps.catalog.products.get(productId); } catch (_e) { product = null; }
-          dest = product ? ("/products/" + encodeURIComponent(product.slug)) : "/account/wishlist";
+          dest = product ? ("/products/" + encodeURIComponent(product.slug)) : ("/account/wishlist?ok=" + okKind);
         }
         res.status(303); res.setHeader && res.setHeader("location", dest);
         return res.end ? res.end() : res.send("");
@@ -6603,8 +6796,10 @@ function mount(router, deps) {
           items.push({ product: product, hero_media: media.length ? media[0] : null });
         }
         var cartCount = await _cartCountForReq(req);
+        var wlUrl = req.url ? new URL(req.url, "http://localhost") : null;
         _send(res, 200, renderWishlist({
           items:        items,
+          notice:       wlUrl ? wlUrl.searchParams.get("ok") : null,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
@@ -6675,8 +6870,10 @@ function mount(router, deps) {
           items.push({ save: row, product: product, hero_media: media.length ? media[0] : null });
         }
         var cartCount = await _cartCountForReq(req);
+        var savedUrl = req.url ? new URL(req.url, "http://localhost") : null;
         _send(res, 200, renderSaved({
           items:        items,
+          notice:       savedUrl ? savedUrl.searchParams.get("ok") : null,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
@@ -6734,7 +6931,7 @@ function mount(router, deps) {
           res.status(e instanceof TypeError ? 400 : 500);
           return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
         }
-        res.status(303); res.setHeader && res.setHeader("location", "/account/saved");
+        res.status(303); res.setHeader && res.setHeader("location", "/account/saved?ok=removed");
         return res.end ? res.end() : res.send("");
       });
     }
@@ -6774,13 +6971,33 @@ function mount(router, deps) {
         }
         return addr;
       }
+      // Map the ?ok=<kind> redirect marker the POST handlers set on
+      // success to the human confirmation copy rendered (role="status")
+      // at the top of the list. Unknown markers degrade to no notice.
+      function _addrSuccessCopy(kind) {
+        if (kind === "added")    return "Address saved.";
+        if (kind === "updated")  return "Address updated.";
+        if (kind === "removed")  return "Address removed.";
+        if (kind === "restored") return "Address restored.";
+        if (kind === "default-shipping") return "Default shipping address updated.";
+        if (kind === "default-billing")  return "Default billing address updated.";
+        return null;
+      }
       async function _renderAddrPage(req, res, auth, editAddr, notice, code) {
         var rows = await deps.addresses.listForCustomer(auth.customer_id, { limit: 50 });
         var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var okKind = url ? url.searchParams.get("ok") : null;
+        var success = _addrSuccessCopy(okKind);
+        // An Undo control is only offered for a just-removed row, and only
+        // when the ?undo=<id> marker round-trips a real owned address id.
+        var undoId = (okKind === "removed" && url) ? url.searchParams.get("undo") : null;
         _send(res, code || 200, renderAddresses({
           addresses:  rows,
           edit:       editAddr || null,
           notice:     notice || null,
+          success:    success,
+          undo_id:    undoId || null,
           shop_name:  shopName,
           cart_count: cartCount,
         }));
@@ -6824,7 +7041,7 @@ function mount(router, deps) {
           if (e instanceof TypeError) return _renderAddrPage(req, res, auth, null, (e && e.message) || "Please check the address.", 400);
           throw e;
         }
-        res.status(303); res.setHeader && res.setHeader("location", "/account/addresses");
+        res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=added");
         return res.end ? res.end() : res.send("");
       });
 
@@ -6840,11 +7057,11 @@ function mount(router, deps) {
           }
           throw e;
         }
-        res.status(303); res.setHeader && res.setHeader("location", "/account/addresses");
+        res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=updated");
         return res.end ? res.end() : res.send("");
       });
 
-      function _addrAction(verb, fn) {
+      function _addrAction(verb, okKind, fn) {
         router.post("/account/addresses/:id/" + verb, async function (req, res) {
           var auth = _addrAuth(req, res); if (!auth) return;
           var addr = await _ownedAddress(req, res, auth); if (!addr) return;
@@ -6853,13 +7070,64 @@ function mount(router, deps) {
             res.status(e instanceof TypeError ? 400 : 500);
             return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
           }
-          res.status(303); res.setHeader && res.setHeader("location", "/account/addresses");
+          res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=" + okKind);
           return res.end ? res.end() : res.send("");
         });
       }
-      _addrAction("default-shipping", function (id) { return deps.addresses.setDefaultShipping(id); });
-      _addrAction("default-billing",  function (id) { return deps.addresses.setDefaultBilling(id); });
-      _addrAction("archive",          function (id) { return deps.addresses.archive(id); });
+      _addrAction("default-shipping", "default-shipping", function (id) { return deps.addresses.setDefaultShipping(id); });
+      _addrAction("default-billing",  "default-billing",  function (id) { return deps.addresses.setDefaultBilling(id); });
+
+      // Remove is destructive and CSP forbids a confirm() dialog, so it
+      // routes through a server-rendered confirm page first; the POST that
+      // actually archives lives behind that page. The list then surfaces a
+      // success notice with an Undo (unarchive) control.
+      router.get("/account/addresses/:id/remove", async function (req, res) {
+        var auth = _addrAuth(req, res); if (!auth) return;
+        var addr = await _ownedAddress(req, res, auth); if (!addr) return;
+        var cartCount = await _cartCountForReq(req);
+        _send(res, 200, renderAddressRemoveConfirm({
+          address:    addr,
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      router.post("/account/addresses/:id/archive", async function (req, res) {
+        var auth = _addrAuth(req, res); if (!auth) return;
+        var addr = await _ownedAddress(req, res, auth); if (!addr) return;
+        try { await deps.addresses.archive(addr.id); }
+        catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/addresses?ok=removed&undo=" + encodeURIComponent(addr.id));
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Undo path for a just-removed address. Unlike the by-id routes
+      // above, this one resolves the row WITH archived rows included (the
+      // address is archived by definition here) but still enforces
+      // customer ownership before un-archiving.
+      router.post("/account/addresses/:id/unarchive", async function (req, res) {
+        var auth = _addrAuth(req, res); if (!auth) return;
+        var addr;
+        try { addr = await deps.addresses.get(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return; }
+          throw e;
+        }
+        if (!addr || addr.customer_id !== auth.customer_id) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        }
+        try { await deps.addresses.unarchive(addr.id); }
+        catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=restored");
+        return res.end ? res.end() : res.send("");
+      });
     }
 
     // Subscription self-management — the signed-in customer views their
@@ -6950,6 +7218,31 @@ function mount(router, deps) {
       // Cancel mounts only when payment is wired (cancel composes Stripe).
       // Without payment the list above stays read-only with a note.
       if (deps.payment) {
+        // Confirmation step (GET) ahead of the destructive POST. Renders
+        // the period-end date + the days-forfeited consequence of an
+        // immediate cancel. A subscription that isn't cancelable
+        // (already canceled / winding down) redirects back to the list.
+        router.get("/account/subscriptions/:id/cancel", async function (req, res) {
+          var auth = _subsAuth(req, res); if (!auth) return;
+          var sub = await _ownedSubscription(req, res, auth); if (!sub) return;
+          if (!_subscriptionIsCancelable(sub)) {
+            res.status(303); res.setHeader && res.setHeader("location", "/account/subscriptions");
+            return res.end ? res.end() : res.send("");
+          }
+          // Join the plan for the confirm-page summary (best-effort — a
+          // missing plan degrades the heading to a generic phrase).
+          if (sub.plan_id != null) {
+            try { sub.plan = await subscriptions.plans.get(sub.plan_id); }
+            catch (_e) { sub.plan = null; }
+          }
+          var cartCount = await _cartCountForReq(req);
+          _send(res, 200, renderSubscriptionCancelConfirm({
+            subscription: sub,
+            shop_name:    shopName,
+            cart_count:   cartCount,
+          }));
+        });
+
         router.post("/account/subscriptions/:id/cancel", async function (req, res) {
           var auth = _subsAuth(req, res); if (!auth) return;
           var sub = await _ownedSubscription(req, res, auth); if (!sub) return;
@@ -7016,7 +7309,13 @@ function mount(router, deps) {
         var auth = _returnsAuth(req, res); if (!auth) return;
         var page = await deps.returns.listForCustomer(auth.customer_id, { limit: 50 });
         var cartCount = await _cartCountForReq(req);
-        _send(res, 200, renderReturns({ rmas: page.rows, shop_name: shopName, cart_count: cartCount }));
+        var retUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderReturns({
+          rmas:       page.rows,
+          rma_code:   retUrl ? retUrl.searchParams.get("ok") : null,
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
       });
 
       router.get("/account/orders/:order_id/return", async function (req, res) {
@@ -7049,8 +7348,9 @@ function mount(router, deps) {
             shop_name: shopName, cart_count: cartCount,
           }));
         }
+        var requested;
         try {
-          await deps.returns.request({
+          requested = await deps.returns.request({
             order_id:       order.id,
             customer_id:    auth.customer_id,
             reason:         body.reason,
@@ -7066,7 +7366,11 @@ function mount(router, deps) {
           }
           throw e;
         }
-        res.status(303); res.setHeader && res.setHeader("location", "/account/returns");
+        // Round-trip the RMA code on the redirect so the list page can
+        // confirm the request and echo the operator-readable handle.
+        var rmaCode = requested && requested.rma_code ? requested.rma_code : "";
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/returns?ok=" + encodeURIComponent(rmaCode));
         return res.end ? res.end() : res.send("");
       });
     }

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.6",
-      "tag": "v0.13.6",
+      "version": "0.13.8",
+      "tag": "v0.13.8",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.8 (2026-05-26) — **In-memory archive extraction for read-only / serverless filesystems.** Archive readers gain an in-memory extraction path so an uploaded archive can be opened and its contents read without writing anything to disk — the case a read-only or ephemeral serverless filesystem requires. b.archive.read.zip(...).extractEntries() and b.archive.read.tar(...).extractEntries() are async generators that yield each regular file entry as { name, bytes, size }, applying the same bomb-policy caps, b.guardArchive metadata cascade (which refuses a Zip-Slip / traversal archive wholesale), and entry-type-policy refusals as the disk extract() — only the disk realpath agreement check is omitted, since nothing is written and the caller owns where the returned bytes land. Directory and link entries carry no content and are not yielded. The guard cascade is factored into one shared path so disk and in-memory extraction refuse identically. Also a documentation fix: b.archive.gz no longer claims a b.archive.zip().toGzip() convenience exists — a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it gains nothing; gzip the uncompressed tar stream (the canonical .tar.gz) instead. **Added:** *`extractEntries()` — in-memory archive extraction (ZIP + tar)* — `b.archive.read.zip(source).extractEntries(opts?)` and `b.archive.read.tar(source).extractEntries(opts?)` are async generators yielding `{ name, bytes, size }` per regular file entry, never touching disk — for serverless / read-only filesystems where the disk `extract({ destination })` path cannot run. Same bomb-policy, guard-archive cascade, and entry-type-policy refusals as disk extraction; the bytes are byte-identical to what `extract()` writes. **Fixed:** *Removed the inaccurate `b.archive.zip().toGzip()` doc claim* — The `b.archive.gz` documentation described a `b.archive.zip().toGzip()` convenience method that does not (and should not) exist: a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it would compress already-compressed data for no benefit. `b.archive.tar().toGzip()` (the real `.tar.gz`) is unchanged.
+
+- v0.13.7 (2026-05-26) — **Documentation accuracy — several primitives described shipped features as deferred.** A documentation sweep corrected primitive descriptions that still called features deferred after they shipped, so the wiki and inline docs now match the code. b.mdoc documents that device authentication (the ISO 18013-5 §9.1.3 signature variant, verifyDeviceAuth) is verified, not deferred — only the COSE_Mac0 device-auth variant remains refused. b.network.dns.dnssec documents that the root-to-zone chain walk against the IANA trust anchors (verifyChain) and NSEC / NSEC3 denial of existence (verifyDenial / nsec3Hash) ship, where the card previously said they were deferred. b.cose lists COSE_Mac0 and COSE_Encrypt0 among what it ships. The JMAP server documents its push channel, blob upload/download, and EmailSubmission handlers as present, and the submission server documents CHUNKING / BDAT as supported. A new test detector keeps this class of drift from recurring: it fails the build when a comment promises a feature lands in a version that has already shipped. **Fixed:** *Corrected `deferred`/`does-not-ship` docs for features that have shipped* — `b.mdoc` (device authentication, §9.1.3), `b.network.dns.dnssec` (chain walk + NSEC/NSEC3), `b.cose` (COSE_Mac0 + COSE_Encrypt0), the JMAP server (push, blob, EmailSubmission), and the submission server (BDAT/CHUNKING) all carried `@card`/`@intro` text describing shipped capabilities as deferred or not-shipped. The descriptions now match the implemented surface; genuinely-deferred items (the mdoc MAC variant, DNSSEC in-RDATA name canonicalization, COSE multi-signer/multi-recipient) remain documented as such. **Detectors:** *Overdue-defer detector in the codebase-pattern gate* — A new check fails the build when a comment promises a feature "lands in" / is "deferred to" / is "not supported in" a version that the package has already reached — catching stale deferral notes (a feature that shipped but whose comment still says otherwise, or a missed deadline) before they reach a release. An allowlist records the deliberate defer-with-condition exceptions.
+
 - v0.13.6 (2026-05-26) — **`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations.** b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog. **Added:** *`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting* — `b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input.
 
 - v0.13.5 (2026-05-26) — **`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit.** b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog. **Added:** *`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios* — `b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `"selection"` (group entries `{ selected, total }`) or `"scoring"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input.

package/lib/vendor/blamejs/README.md

@@ -228,7 +228,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`)
 - **CSV** — RFC 4180 with Excel formula-injection prevention (`b.csv`)
 - **IDs + slugs** — RFC 9562 UUID v4 + v7 (`b.uuid`); URL-safe slugs (`b.slug`)
-- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
+- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
 - **Pagination + forms** — HMAC-signed cursor pagination (`b.pagination`); HTML form rendering + validation + CSRF (`b.forms`)
 
 ### Production