@blamejs/blamejs-shop 0.2.11 → 0.2.13

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.13 (2026-05-28) — **Product-grid and product-page visual polish.** Small visual refinements to the catalog grid and product page. Product tiles previously all carried the same fixed corner glow, so a grid of them read as one card stamped repeatedly; the glow position now rotates per tile so the grid looks like a designed set. The product page's buy box gets clearer elevation so it reads as a distinct purchase surface, and the fallback placeholder shown for a product with no image is now legible on the dark theme instead of a near-invisible mark. **Changed:** *Product tiles no longer share one identical glow* — Each product card's media glow now rotates through a set of positions per tile (matching the collection cards) instead of every tile glowing in the exact same corner, so a full grid reads as a designed set rather than a single card repeated. · *Clearer product-page buy box* — The product page's buy box gains a stronger border and a soft shadow so it stands out from the page as the purchase surface. · *Legible image-less placeholder* — The fallback artwork shown when a product has no image was nearly invisible on the dark canvas; its contrast is lifted (grid lines, shield detail, and caption) so it reads as an intentional placeholder. Applied identically on the edge and container render paths.
+
+- v0.2.12 (2026-05-28) — **Truthful product availability and real SEO metadata — canonical URLs, structured data, and per-page descriptions.** Two related improvements to the storefront's honesty and discoverability. Product pages now report real availability from inventory (instead of a hardcoded 'In stock') and reflect it in their structured data, and the shipping line is suppressed for digital products. Separately, every page now emits a canonical URL and a populated Open Graph URL (previously empty — which broke social-share unfurls and let sort/currency query parameters fork into duplicate indexed pages), the home page emits the same Organization/Website structured data the edge already did, breadcrumb structured data uses absolute URLs, and the home, category, and search pages get their own meta descriptions instead of one shared default. The footer's account links are regrouped and a shipping-and-returns link was added. **Changed:** *Product availability is truthful* — The product page's stock badge and its `Product`/`AggregateOffer` structured-data `availability` are now driven by real per-SKU inventory (`InStock` / `OutOfStock`) rather than a hardcoded value, so a sold-out item reads as sold out everywhere and structured data no longer mismatches reality. The shipping-time line is suppressed for all-digital products (shown as delivered on purchase). Identical across the edge and container render paths. · *Footer account links regrouped* — The footer's operator-oriented column is now a customer 'Your account' grouping (Account / Orders / Contact), the public Admin link was removed, and a 'Shipping & returns' link was added to the policy area. · *Form fields are legible on the dark theme* — Text inputs, selects, and textareas (checkout, address book, search, sign-in) previously rendered with a 10%-opacity hairline that disappeared against the near-black canvas — fields read as empty voids. They now have a clearly-bounded outline and a lifted fill, stretch to fill their column, and the rule covers `tel`/`url`/`password` inputs it previously missed. **Fixed:** *Canonical + Open Graph URLs on every page* — Every page now includes `<link rel="canonical">` and a populated `og:url` (both were absent/empty before). This fixes social-share previews that unfurled with no link target and prevents tracking/sort/currency query-string variants from being indexed as duplicate pages. Emitted on both render paths, derived from the request's own origin. · *Consistent structured data + unique page descriptions* — The home page now emits the `Organization` and `WebSite` (search-action) structured data that previously only appeared on the edge render, breadcrumb structured-data item URLs are absolute (so the breadcrumb rich result is eligible), and the home, category, and search pages each carry their own meta/OG description instead of sharing one generic string.
+
 - v0.2.11 (2026-05-27) — **A clearer checkout — itemised order summary, honest pricing, and recoverable errors.** Reworks the checkout and cart experience. Checkout now uses the same two-column layout as the cart, with a sticky order-summary rail that lists the actual items being bought (thumbnail, title, quantity, line total) rather than a bare number in a lonely column. The summary no longer shows a misleading 'Total' equal to the subtotal — it shows the subtotal plus an honest note that tax and shipping are calculated at the payment step, matching the cart. Adding an item now confirms it and offers to keep shopping, checkout and cart failures render as proper pages you can recover from instead of a blank error string, required fields announce themselves to screen readers, and the header 'Framework' link works from every page. **Changed:** *Checkout shows an itemised, sticky order summary* — The checkout page adopts the cart's two-column layout: the shipping form on the left and a sticky order summary on the right that lists each item (thumbnail, title, quantity, line total) with an 'Edit cart' link back to the cart. Previously the form was a narrow column with a bare subtotal box and no way back. · *Honest checkout pricing* — The order summary no longer renders a 'Total (plus tax + shipping)' line bound to the subtotal value (which read as the final price but wasn't). It now shows the subtotal and the same honest note the cart uses — tax and shipping are calculated at the payment step. · *Add-to-cart confirmation + continue shopping* — Adding an item lands on the cart with a dismissible 'Added to cart' confirmation, and the cart now has a 'Continue shopping' link so multi-item shoppers aren't dead-ended. **Fixed:** *Checkout and cart errors are recoverable, not blank pages* — A declined gift card, an invalid input, or a checkout failure previously dumped an unstyled plain-text error. These now render as styled pages with the reason and a way back — gift-card and loyalty errors re-display the checkout form with the message inline so the shopper can correct it without losing their place. · *Required fields announce to screen readers* — Required form fields kept only a red asterisk (color-only); they now include a visually-hidden '(required)' so assistive technology conveys it. · *Header 'Framework' link works on every page* — It pointed at an on-page anchor that only existed on the home page (a no-op elsewhere); it now resolves from any page.
 
 - v0.2.10 (2026-05-27) — **Accessibility and mobile polish — the cookie bar stops covering the page, and forms behave on phones.** A round of default-theme refinements focused on the cookie consent bar, mobile ergonomics, and accessibility. The consent bar previously floated over page content — on a product page or checkout it could sit on top of the price, variant picker, and the add-to-cart / continue-to-payment button on a first visit. It is now a compact bottom bar that reserves its own space (so nothing important is ever hidden under it), scrolls within itself if the text is long, and receives keyboard focus when it appears. Alongside it: mobile form inputs no longer trigger iOS zoom-on-focus, the header touch targets meet the 44px minimum, inline text links are underlined, and a consistency pass tightened button shapes, table-label typography, and small-screen layout. **Changed:** *Visual consistency pass* — Action buttons share a single corner radius (primary and secondary no longer differ in shape), uppercase micro-labels use the monospace face consistently across tables and forms, the catalog grid shows two columns on small phones instead of one, the hero stat row breathes on narrow screens, and a few dark-theme borders/placeholders that read muddy were moved onto the semantic token palette. **Fixed:** *Cookie consent bar no longer covers page content* — On a first visit the consent bar could overlap the product buy box and the checkout form (the price, variant selector, and primary button). It is now a compact bottom-docked bar that reserves matching space at the foot of the page until a choice is made, caps its height and scrolls internally for long text, and moves keyboard focus to its first control when shown — so the page's primary action is never hidden and the bar is reachable without tabbing the whole page. · *Mobile form inputs no longer zoom on iOS* — Text inputs, selects, and textareas render at a 16px minimum on touch devices, so mobile Safari no longer zooms the viewport when a field is focused (which previously left the page zoomed-in and pannable mid-checkout). · *Header touch targets meet the 44px minimum on mobile* — The account and cart controls in the header — the two primary controls on a phone — are now at least 44×44px. · *Clearer link and prompt-glyph affordances* — Inline text links in body copy are underlined (no longer distinguished by color alone), and the terminal prompt glyph on the dark accent bands renders in full contrast.

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.11",
+  "version": "0.2.13",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-8sqFG/ZiALsYtuuzk8cAlSI1exfg9l2UOFs/EmWacVW83DGwOI4g+r29MUCGlKSE",
-      "fingerprinted": "css/main.7f09021a222915e6.css"
+      "integrity": "sha384-E56XcvNC5nbTWyHJJcepF6sVA1KjRNo/MWFL5F5w2PDN10JNaHdzIAP9a46m2Md8",
+      "fingerprinted": "css/main.a76d36ac566703d6.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/storefront.js

@@ -145,6 +145,7 @@ var LAYOUT =
   "  <meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n" +
   "  <title>{{title}} — {{shop_name}}</title>\n" +
   "  <meta name=\"description\" content=\"{{og_description}}\">\n" +
+  "  <link rel=\"canonical\" href=\"{{canonical_url}}\">\n" +
   "  <link rel=\"icon\" type=\"image/svg+xml\" href=\"/assets/brand/favicon.svg\">\n" +
   "  <link rel=\"icon\" type=\"image/png\" href=\"/assets/brand/favicon.png\">\n" +
   "  <link rel=\"apple-touch-icon\" href=\"/assets/brand/favicon.png\">\n" +
@@ -231,6 +232,7 @@ var LAYOUT =
   "          <li><a href=\"/?sort=sale\">{{footer_shop_sale}}</a></li>\n" +
   "          <li><a href=\"/compare\">{{footer_shop_compare}}</a></li>\n" +
   "          <li><a href=\"/cart\">{{footer_shop_cart}}</a></li>\n" +
+  "          <li><a href=\"/terms\">{{footer_shop_shipping}}</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
   "      <div class=\"site-footer__col\">\n" +
@@ -247,7 +249,6 @@ var LAYOUT =
   "        <ul>\n" +
   "          <li><a href=\"/account\">{{footer_operators_account}}</a></li>\n" +
   "          <li><a href=\"/orders\">{{footer_operators_orders}}</a></li>\n" +
-  "          <li><a href=\"/admin\">{{footer_operators_admin}}</a></li>\n" +
   "          <li><a href=\"mailto:hello@blamejs.shop\">{{footer_operators_contact}}</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
@@ -530,6 +531,37 @@ var _DEFAULT_LOCALE_CTX = {
   switcher_html: "",
 };
 
+// Derive the absolute canonical + og:url for a request. Origin comes from
+// the `Host` header the same way robots.txt/sitemap.xml resolve it (https
+// is the only scheme the storefront serves on); the path is the request
+// path. `canonical_url` strips the query (the canonical names the page,
+// not a filtered/sorted view); `og_url` keeps the full URL so a share of
+// a filtered listing unfurls to that exact view. A request with no Host
+// header yields empty strings — the renderer then omits the absolute URLs
+// rather than emit a host-less one. Defensive request-shape reader:
+// returns defaults on any malformed input.
+function _requestUrls(req) {
+  var host = (req && req.headers && (req.headers.host || req.headers.Host)) || "";
+  if (!host) return { canonical_url: "", og_url: "" };
+  var origin = "https://" + host;
+  var rawUrl = (req && typeof req.url === "string" && req.url.length) ? req.url : "/";
+  // req.url may be path-only ("/products/x?y=1") or absolute; normalise
+  // through URL with the derived origin as the base so either shape works.
+  var path = "/";
+  var search = "";
+  try {
+    var parsed = new URL(rawUrl, origin);
+    path = parsed.pathname || "/";
+    search = parsed.search || "";
+  } catch (_e) {
+    var qIdx = rawUrl.indexOf("?");
+    path = qIdx === -1 ? rawUrl : rawUrl.slice(0, qIdx);
+    search = qIdx === -1 ? "" : rawUrl.slice(qIdx);
+    if (path.charCodeAt(0) !== 47 /* "/" */) path = "/";
+  }
+  return { canonical_url: origin + path, og_url: origin + path + search };
+}
+
 function _wrap(opts) {
   var themeCss = (opts && typeof opts.theme_css === "string" && opts.theme_css.length)
     ? opts.theme_css
@@ -547,7 +579,14 @@ function _wrap(opts) {
   var ogTitle       = opts.og_title       || (opts.title ? opts.title + " — " + shopName : shopName);
   var ogDescription = opts.og_description || "Open-source ecommerce framework built on blamejs. Server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.";
   var ogImage       = opts.og_image       || "/assets/brand/logo.png";
-  var ogUrl         = opts.og_url         || "";
+  // Absolute request URL drives both `og:url` (full URL incl. query) and
+  // the canonical link (query stripped — the canonical names the page,
+  // not the filtered/sorted view). Renderers thread `opts.canonical_url`
+  // + `opts.og_url` (built by `_requestUrls` in the route handler); absent
+  // them (a unit test calling the renderer directly), both stay empty
+  // rather than emit a bogus host-less URL.
+  var canonicalUrl = opts.canonical_url || "";
+  var ogUrl         = opts.og_url       || canonicalUrl;
   // Multi-currency display switcher — populated only when the operator
   // configured >1 display currency (opts.currency_options). The block is
   // empty otherwise, so a single-currency store renders unchanged.
@@ -600,6 +639,7 @@ function _wrap(opts) {
     og_description: ogDescription,
     og_image:       ogImage,
     og_url:         ogUrl,
+    canonical_url:  canonicalUrl,
     lang:           localeCtx.lang || "en",
     dir:            localeCtx.dir  || "ltr",
     nav_cart_aria:  cartAria,
@@ -656,7 +696,7 @@ var PRODUCT_CARD_IMAGE =
 var PRODUCT_CARD =
   "<a class=\"product-card\" href=\"/products/{{slug}}\">\n" +
   "  <figure class=\"product-card__media product-card__media--placeholder\">\n" +
-  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.10\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#732A8D\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#6b6b78\">no image yet</text></svg>\n" +
+  "    <svg class=\"media-ph__svg\" viewBox=\"0 0 160 120\" aria-hidden=\"true\"><rect width=\"160\" height=\"120\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.18\" stroke-width=\"1\"><path d=\"M0 30 H160 M0 60 H160 M0 90 H160 M40 0 V120 M80 0 V120 M120 0 V120\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M80 38 L104 50 L104 76 L80 88 L56 76 L56 50 Z\"/><path d=\"M56 50 L80 62 L104 50 M80 62 V88\" stroke=\"#C75BE8\"/><path d=\"M70 47 L74 50 L70 53\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M77 54 H86\" stroke=\"currentColor\" stroke-width=\"2\"/></g><text x=\"80\" y=\"106\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"9\" letter-spacing=\"1.5\" fill=\"#9b9ba7\">no image yet</text></svg>\n" +
   "  </figure>\n" +
   "  <div class=\"product-card__meta\">\n" +
   "    <h3 class=\"product-card__title\">{{title}}</h3>\n" +
@@ -966,16 +1006,71 @@ function renderHome(opts) {
   // The hero + value band + catalog section give the home page a
   // designed surface even when no products are loaded yet —
   // visitors land on the storefront shell, not a tech demo.
-  var body = hero + catalog;
+  // Organization + WebSite JSON-LD — surfaces the storefront in Google's
+  // knowledge-panel (logo + social) and registers the sitelinks search
+  // box pointing at `/search?q=`. Mirrors the edge renderer
+  // (`worker/render/home.js`) byte-for-byte so the structured data is
+  // identical whichever substrate serves the home page. `_orgWebsiteJsonLd`
+  // resolves the absolute base from the shop name (a bare host or a full
+  // URL both normalise to `https://<host>`).
+  var homeJsonLd = _orgWebsiteJsonLd(shopName);
+  var body = hero + catalog + homeJsonLd;
   return _wrap(Object.assign({
     title:      title,
     shop_name:  shopName,
     cart_count: cartCount,
     theme_css: opts.theme_css,
+    canonical_url: opts.canonical_url,
+    og_url:        opts.og_url,
+    og_description: "Shop the blamejs.shop catalog — an open-source, server-rendered storefront with post-quantum crypto and zero npm runtime dependencies.",
     body:       body,
   }, _currencyWrapOpts(opts)));
 }
 
+// Absolute origin (scheme + host, no trailing slash) for building
+// fully-qualified structured-data URLs. Prefers the request-derived
+// canonical URL's origin (matches the host the visitor reached); falls
+// back to the shop-name host when the renderer is called without one (a
+// unit test, or a theme path). A bare host shop name and a full `https://`
+// value both normalise to `https://<host>`.
+function _absoluteBase(canonicalUrl, shopName) {
+  if (typeof canonicalUrl === "string" && canonicalUrl.length) {
+    try {
+      var parsed = new URL(canonicalUrl);
+      return parsed.origin;
+    } catch (_e) { /* fall through to the shop-name base */ }
+  }
+  return "https://" + String(shopName || "blamejs.shop").replace(/^https?:\/\//, "");
+}
+
+// Schema.org Organization + WebSite JSON-LD for the home page. Shared by
+// the container `renderHome` and mirrored by the edge
+// `worker/render/home.js` — keep the two byte-identical. The base URL is
+// derived from the shop name (operators set SHOP_NAME to their host); a
+// bare host and a full `https://` value both normalise to `https://<host>`.
+function _orgWebsiteJsonLd(shopName) {
+  var base = "https://" + String(shopName).replace(/^https?:\/\//, "");
+  return _jsonLdScript({
+    "@context": "https://schema.org",
+    "@type":    "Organization",
+    "name":     shopName,
+    "url":      base,
+    "logo":     base + "/assets/brand/logo.png",
+    "sameAs":   ["https://github.com/blamejs/blamejs.shop"],
+  }) +
+  _jsonLdScript({
+    "@context": "https://schema.org",
+    "@type":    "WebSite",
+    "name":     shopName,
+    "url":      base,
+    "potentialAction": {
+      "@type":       "SearchAction",
+      "target":      base + "/search?q={search_term_string}",
+      "query-input": "required name=search_term_string",
+    },
+  });
+}
+
 // ---- search results -----------------------------------------------------
 
 var SEARCH_HEADER =
@@ -1218,12 +1313,20 @@ function renderSearch(opts) {
   } else {
     body = header + correctionHtml + chipsHtml + resultsInner;
   }
+  var searchShopName = opts.shop_name || "blamejs.shop";
+  // Per-page meta description — mirrors the edge renderer.
+  var searchMetaDescription = qTrim.length > 0
+    ? ("Results for “" + qTrim + "” in the " + searchShopName + " catalog.")
+    : ("Search the " + searchShopName + " catalog by title, SKU, or description.");
   return _wrap(Object.assign({
     title:      "Search",
-    shop_name:  opts.shop_name || "blamejs.shop",
+    shop_name:  searchShopName,
     cart_count: opts.cart_count,
     search_q:   opts.q,
     theme_css: opts.theme_css,
+    og_description: searchMetaDescription,
+    canonical_url: opts.canonical_url,
+    og_url:        opts.og_url,
     body:       body,
   }, _currencyWrapOpts(opts)));
 }
@@ -1335,6 +1438,78 @@ function _buildBuyBox(variants, escAttr) {
          "      " + trustLine;
 }
 
+// Resolve a product's availability + shipping shape from the variant
+// list + (optional) inventory map the route loads. `in_stock` is true if
+// ANY variant is buyable; a SKU with no inventory row counts as available
+// (the never-block-on-missing-inventory stance the cart-hold path already
+// takes). `requires_shipping` is true if ANY variant ships physically —
+// an all-digital product (`requires_shipping = 0` on every variant)
+// suppresses the "Ships in 1–2 business days" line. Returns a normalised
+// `{ in_stock, requires_shipping }` so the two render paths drive the
+// badge + JSON-LD from the same shape. Defensive request-shape reader:
+// missing/garbage inputs resolve to the available + physical default.
+function _resolveAvailability(variants, inventoryBySku) {
+  variants = Array.isArray(variants) ? variants : [];
+  var inv = (inventoryBySku && typeof inventoryBySku === "object") ? inventoryBySku : null;
+  var anyTracked = false;
+  var anyInStock = false;
+  var requiresShipping = false;
+  for (var i = 0; i < variants.length; i += 1) {
+    var v = variants[i] || {};
+    // requires_shipping defaults to physical (true) unless the column is
+    // explicitly 0/false — matches the catalog default for tangible goods.
+    if (v.requires_shipping === undefined || v.requires_shipping === null ||
+        Number(v.requires_shipping) !== 0) {
+      requiresShipping = true;
+    }
+    if (inv && Object.prototype.hasOwnProperty.call(inv, v.sku)) {
+      anyTracked = true;
+      var row = inv[v.sku];
+      var available = row ? (Number(row.stock_on_hand) - Number(row.stock_held)) : 0;
+      if (available > 0) anyInStock = true;
+    }
+  }
+  return {
+    // No tracked variant → the operator hasn't opted into stock tracking,
+    // so the product reads as in stock (never-block stance).
+    in_stock:          anyTracked ? anyInStock : true,
+    requires_shipping: variants.length === 0 ? true : requiresShipping,
+  };
+}
+
+// PDP availability badges, driven by the resolved availability shape so
+// the displayed state matches the JSON-LD `availability`. Mirrored byte-
+// for-byte by worker/render/product.js#_buildAvailability.
+function _buildAvailability(availability) {
+  var a = availability || { in_stock: true, requires_shipping: true };
+  var stockBadge = a.in_stock
+    ? "<span class=\"pdp__badge pdp__badge--ok\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> In stock</span>"
+    : "<span class=\"pdp__badge pdp__badge--out\">Out of stock</span>";
+  // The "Ships in 1–2 business days" line only applies to a physical good;
+  // an all-digital product suppresses it (nothing ships).
+  var shipBadge = a.requires_shipping
+    ? "<span class=\"pdp__badge\">Ships in 1–2 business days</span>"
+    : "<span class=\"pdp__badge\">Digital — delivered on purchase</span>";
+  return "<div class=\"pdp__meta\">\n" +
+         "        " + stockBadge + "\n" +
+         "        " + shipBadge + "\n" +
+         "        <span class=\"pdp__badge\">Stripe-secured checkout</span>\n" +
+         "      </div>";
+}
+
+// Short shipping/returns line under the buy box pointing shoppers at the
+// public policy page. Physical goods get a shipping-and-returns line; a
+// digital-only product drops the shipping half (no parcel to return).
+// Mirrored byte-for-byte by worker/render/product.js#_pdpShippingNote.
+function _pdpShippingNote(availability) {
+  var a = availability || { in_stock: true, requires_shipping: true };
+  var copy = a.requires_shipping
+    ? "Free returns within 30 days. "
+    : "";
+  return "<p class=\"pdp__shipping-note\">" + copy +
+         "See our <a href=\"/terms\">shipping &amp; returns policy</a>.</p>";
+}
+
 var PRODUCT_PAGE =
   "<section class=\"pdp\">\n" +
   "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
@@ -1349,12 +1524,9 @@ var PRODUCT_PAGE =
   "      <p class=\"eyebrow\">Catalog product</p>\n" +
   "      <h1 class=\"pdp__title\">{{title}}</h1>\n" +
   "      <p class=\"pdp__description\">{{description}}</p>\n" +
-  "      <div class=\"pdp__meta\">\n" +
-  "        <span class=\"pdp__badge pdp__badge--ok\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> In stock</span>\n" +
-  "        <span class=\"pdp__badge\">Ships in 1–2 business days</span>\n" +
-  "        <span class=\"pdp__badge\">Stripe-secured checkout</span>\n" +
-  "      </div>\n" +
+  "      RAW_AVAILABILITY_PLACEHOLDER\n" +
   "      RAW_BUYBOX_PLACEHOLDER\n" +
+  "      RAW_SHIPPING_NOTE_PLACEHOLDER\n" +
   "      RAW_QTYBREAK_PLACEHOLDER\n" +
   "      RAW_WISHLIST_PLACEHOLDER\n" +
   "      RAW_COMPARE_PLACEHOLDER\n" +
@@ -2398,7 +2570,10 @@ function renderCategoryIndex(opts) {
     "</section>";
   return _wrap({
     title: "Categories", shop_name: opts.shop_name || "blamejs.shop",
-    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css,
+    og_description: "Browse every product category in the " + (opts.shop_name || "blamejs.shop") + " catalog.",
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
+    body: body,
   });
 }
 
@@ -2463,9 +2638,17 @@ function renderCategory(opts) {
       hero +
       grid +
     "</section>";
+  // Per-page meta description: the category's own description when set,
+  // otherwise a "Shop {category}…" pitch.
+  var catMetaDescription = (cat.description && String(cat.description).trim().length)
+    ? String(cat.description)
+    : ("Shop " + cat.title + " at " + (opts.shop_name || "blamejs.shop") + ".");
   return _wrap({
     title: cat.title, shop_name: opts.shop_name || "blamejs.shop",
-    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css,
+    og_description: catMetaDescription,
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
+    body: body,
   });
 }
 
@@ -3218,7 +3401,15 @@ function renderProduct(opts) {
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
   }
+  // Truthful availability + shipping shape — drives the on-page badges
+  // AND the JSON-LD `availability` from the same resolved values so the
+  // two never disagree. `opts.inventory` is the per-SKU map the route
+  // loads ({ sku: { stock_on_hand, stock_held } }); absent it, the
+  // product reads as in stock (never-block-on-missing-inventory stance).
+  var availability = _resolveAvailability(variants, opts.inventory);
   var buyboxHtml = _buildBuyBox(rendered, b.template.escapeHtml);
+  var availabilityHtml = _buildAvailability(availability);
+  var shippingNoteHtml = _pdpShippingNote(availability);
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
   var qaHtml = _buildProductQa(opts.qa_questions, opts.qa_cta);
@@ -3231,7 +3422,9 @@ function renderProduct(opts) {
     description:  description,
   })
     .replace("RAW_GALLERY_PLACEHOLDER", galleryHtml)
+    .replace("RAW_AVAILABILITY_PLACEHOLDER", availabilityHtml)
     .replace("RAW_BUYBOX_PLACEHOLDER", buyboxHtml)
+    .replace("RAW_SHIPPING_NOTE_PLACEHOLDER", shippingNoteHtml)
     .replace("RAW_QTYBREAK_PLACEHOLDER", qtyBreaksHtml)
     .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
     .replace("RAW_COMPARE_PLACEHOLDER", compareHtml)
@@ -3243,6 +3436,11 @@ function renderProduct(opts) {
   // the default shop-level description + brand logo.
   var heroMedia = (opts.media && opts.media[0]) || null;
   var ogImage   = heroMedia ? ((opts.asset_prefix || "/assets/") + heroMedia.r2_key) : "/assets/brand/logo.png";
+  // Absolute base for the BreadcrumbList `item` URLs — derived from the
+  // PDP's own canonical (origin stripped of the /products/slug path) so
+  // the structured-data trail carries fully-qualified URLs. Falls back to
+  // the shop-name host when the renderer is called without a request URL.
+  var absoluteBase = _absoluteBase(opts.canonical_url, shopName);
 
   // Product + AggregateOffer JSON-LD, with AggregateRating folded in
   // when published reviews exist. Kept byte-compatible with the edge
@@ -3282,7 +3480,9 @@ function renderProduct(opts) {
         "lowPrice":      (lowMinor / divisor).toFixed(divisor === 1 ? 0 : 2),
         "highPrice":     (hiMinor  / divisor).toFixed(divisor === 1 ? 0 : 2),
         "offerCount":    variants.length,
-        "availability":  "https://schema.org/InStock",
+        "availability":  availability.in_stock
+          ? "https://schema.org/InStock"
+          : "https://schema.org/OutOfStock",
       },
     });
   }
@@ -3290,8 +3490,8 @@ function renderProduct(opts) {
     "@context":        "https://schema.org",
     "@type":           "BreadcrumbList",
     "itemListElement": [
-      { "@type": "ListItem", "position": 1, "name": "Shop", "item": "/" },
-      { "@type": "ListItem", "position": 2, "name": opts.product.title, "item": "/products/" + opts.product.slug },
+      { "@type": "ListItem", "position": 1, "name": "Shop", "item": absoluteBase + "/" },
+      { "@type": "ListItem", "position": 2, "name": opts.product.title, "item": absoluteBase + "/products/" + opts.product.slug },
     ],
   });
   jsonLd = (jsonLd || "") + breadcrumbJsonLd;
@@ -3305,6 +3505,8 @@ function renderProduct(opts) {
     og_title:       opts.product.title + " — " + shopName,
     og_description: description || ("Browse " + opts.product.title + " on " + shopName + "."),
     og_image:       ogImage,
+    canonical_url:  opts.canonical_url,
+    og_url:         opts.og_url,
     body:           body + jsonLd,
   }, _currencyWrapOpts(opts)));
 }
@@ -5838,7 +6040,7 @@ function mount(router, deps) {
       }));
     }
     var ccy = await _currencyForReq(req);
-    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, ccy));
+    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, _requestUrls(req), ccy));
     _send(res, 200, html);
   });
 
@@ -5969,7 +6171,7 @@ function mount(router, deps) {
       corrected_query: correctedQ,
       shop_name:       shopName,
       cart_count:      cartCount,
-    }, ccy)));
+    }, _requestUrls(req), ccy)));
   });
 
   router.get("/products/:slug", async function (req, res) {
@@ -5979,9 +6181,22 @@ function mount(router, deps) {
     if (!product) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
     var variants = await deps.catalog.variants.listForProduct(product.id);
     var prices = {};
+    // Per-SKU inventory map driving the truthful availability badge +
+    // JSON-LD. Best-effort: a SKU with no inventory row (or a read
+    // failure) is omitted from the map, which the renderer treats as
+    // available — the never-block-on-missing-inventory stance the
+    // cart-hold path already takes. Only populated when the operator has
+    // wired the inventory primitive.
+    var inventory = {};
     for (var i = 0; i < variants.length; i += 1) {
       var p = await deps.catalog.prices.current(variants[i].id, "USD");
       if (p) prices[variants[i].id] = p;
+      if (deps.catalog.inventory && typeof deps.catalog.inventory.get === "function") {
+        try {
+          var invRow = await deps.catalog.inventory.get(variants[i].sku);
+          if (invRow) inventory[variants[i].sku] = invRow;
+        } catch (_e) { /* drop-silent — missing inventory reads as available */ }
+      }
     }
     // Media — first row drives the hero image, the next three feed
     // the thumbnail strip. `listForProduct` is product-level only;
@@ -6068,6 +6283,7 @@ function mount(router, deps) {
       variants:       variants,
       prices:         prices,
       media:          media,
+      inventory:      inventory,
       review_summary: reviewSummary,
       reviews:        reviewRows,
       review_cta:     reviewCta,
@@ -6079,7 +6295,7 @@ function mount(router, deps) {
       shop_name:      shopName,
       cart_count:     cartCount,
       theme:          theme,
-    }, ccy));
+    }, _requestUrls(req), ccy));
     _send(res, 200, html);
   });
 
@@ -6354,9 +6570,9 @@ function mount(router, deps) {
         if (cats[i].active) active.push(cats[i]);
       }
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCategoryIndex({
+      _send(res, 200, renderCategoryIndex(Object.assign({
         categories: active, shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
-      }));
+      }, _requestUrls(req))));
     });
 
     router.get("/categories/:slug", async function (req, res) {
@@ -6386,10 +6602,10 @@ function mount(router, deps) {
         if (children[i].active) activeChildren.push(children[i]);
       }
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCategory({
+      _send(res, 200, renderCategory(Object.assign({
         category: cat, breadcrumbs: crumbs, children: activeChildren,
         shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
-      }));
+      }, _requestUrls(req))));
     });
   }
 
@@ -9103,8 +9319,12 @@ function mount(router, deps) {
     var hostHeader = req.headers && (req.headers.host || req.headers.Host) || "";
     var origin = hostHeader ? ("https://" + hostHeader) : "";
     var urls = [];
-    urls.push({ loc: origin + "/",      changefreq: "daily",   priority: "1.0" });
-    urls.push({ loc: origin + "/admin", changefreq: "monthly", priority: "0.3" });
+    // The home page + the public legal pages. `/admin` is intentionally
+    // omitted — robots.txt disallows it, so listing it in the sitemap
+    // would contradict the crawl policy.
+    urls.push({ loc: origin + "/",        changefreq: "daily",   priority: "1.0" });
+    urls.push({ loc: origin + "/privacy", changefreq: "yearly",  priority: "0.3" });
+    urls.push({ loc: origin + "/terms",   changefreq: "yearly",  priority: "0.3" });
     try {
       var page = await deps.catalog.products.list({ status: "active", limit: 1000 });
       for (var i = 0; i < page.rows.length; i += 1) {
@@ -9118,6 +9338,38 @@ function mount(router, deps) {
         });
       }
     } catch (_e) { /* drop-silent — catalog unreachable means sitemap drops product rows */ }
+    // Active category browse pages, when the categoryNavigation primitive
+    // is wired. `tree({})` returns the full nested active tree (archived
+    // rows already dropped); we flatten it to one URL per category. Best-
+    // effort — a read failure drops the category rows rather than 500-ing
+    // the sitemap.
+    if (deps.categoryNavigation && typeof deps.categoryNavigation.tree === "function") {
+      try {
+        var catTree = await deps.categoryNavigation.tree({});
+        var stack = Array.isArray(catTree) ? catTree.slice() : [];
+        while (stack.length) {
+          var node = stack.pop();
+          if (node && node.active && node.slug) {
+            urls.push({ loc: origin + "/categories/" + node.slug, changefreq: "weekly", priority: "0.6" });
+          }
+          if (node && Array.isArray(node.children)) {
+            for (var cj = 0; cj < node.children.length; cj += 1) stack.push(node.children[cj]);
+          }
+        }
+      } catch (_e) { /* drop-silent — categories unreachable drops those rows */ }
+    }
+    // Active collection browse pages, when the collections primitive is
+    // wired. Same best-effort discipline.
+    if (deps.collections && typeof deps.collections.list === "function") {
+      try {
+        var cols = await deps.collections.list({ active_only: true });
+        for (var coi = 0; coi < cols.length; coi += 1) {
+          if (cols[coi] && cols[coi].slug) {
+            urls.push({ loc: origin + "/collections/" + cols[coi].slug, changefreq: "weekly", priority: "0.6" });
+          }
+        }
+      } catch (_e) { /* drop-silent — collections unreachable drops those rows */ }
+    }
     var body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
                "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n";
     for (var u = 0; u < urls.length; u += 1) {

package/lib/translations.js

@@ -593,6 +593,7 @@ var CHROME_DEFAULTS = Object.freeze({
   footer_shop_sale:       "On sale",
   footer_shop_compare:    "Compare",
   footer_shop_cart:       "Cart",
+  footer_shop_shipping:   "Shipping & returns",
 
   footer_framework_heading: "Framework",
   footer_framework_source:  "Source on GitHub",
@@ -600,10 +601,9 @@ var CHROME_DEFAULTS = Object.freeze({
   footer_framework_security: "Security policy",
   footer_framework_changelog: "Changelog",
 
-  footer_operators_heading: "Operators",
+  footer_operators_heading: "Your account",
   footer_operators_account: "Account",
   footer_operators_orders:  "Orders",
-  footer_operators_admin:   "Admin",
   footer_operators_contact: "Contact",
 
   footer_copy_suffix:  "built on blamejs · Apache 2.0 licensed.",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.22",
-      "tag": "v0.13.22",
+      "version": "0.13.24",
+      "tag": "v0.13.24",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",