@blamejs/blamejs-shop 0.2.15 → 0.2.17

package/CHANGELOG.md

@@ -8,7 +8,9 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
-- v0.2.15 (2026-05-28) — **Configure tax, shipping, and discounts from the admin console.** Three commerce-configuration areas that previously existed only behind the JSON API now have admin console screens, so an operator can run a real store from the UI without scripting. Tax rates (per jurisdiction), shipping zones and rates, and discounts (automatic-discount rules plus coupon-stacking policies) each get a list / create / edit / archive screen, content-negotiated like the rest of the console (a bearer-token client still gets JSON). Their nav links appear only when the feature is wired. **Added:** *Tax rates screen* — `/admin/tax-rates` — pick a jurisdiction to see its rate history, create a rate (category + rate in basis points + effective window + source), edit the rate, and archive it. Overlap/archived conflicts surface as inline notices rather than errors. · *Shipping screen* — `/admin/shipping` — create a shipping zone (country/region + a flat-rate service) and manage it on a per-zone screen that lists its rates, edits the title/active state, and archives it; richer multi-region/multi-rate shapes remain available on the JSON path. · *Discounts screen* — `/admin/discounts` — create automatic-discount rules (cart-total / item-count / SKU triggers; percent-off / amount-off / free-shipping / BOGO values; priority), edit and archive them, plus manage coupon-stacking policies (max codes, combine toggles, order minimum).
+- v0.2.17 (2026-05-29) — **Manage your passkeys and edit your profile from your account.** Signed-in customers can now manage their own passkeys and edit their profile, instead of only being able to enrol a passkey at registration. A new account screen lists each enrolled passkey (device transport + when it was added) with an add-another flow and a confirm-gated revoke; revocation is scoped to the signed-in account and refuses to remove your last sign-in method when no other (OAuth) method is linked, so you can't lock yourself out. A separate profile screen edits the display name. **Added:** *Passkey management* — `/account/passkeys` lists your enrolled passkeys, lets you register an additional one, and revoke one you no longer use (behind a confirmation step). Revocation only ever affects your own credentials, and the last remaining sign-in method is protected against removal. · *Profile editing* — `/account/profile` edits your display name with a confirmation notice. Account links for both screens were added to the account dashboard.
+
+- v0.2.16 (2026-05-29) — **Configure tax, shipping, and discounts from the admin console.** Three commerce-configuration areas that previously existed only behind the JSON API now have admin console screens, so an operator can run a real store from the UI without scripting. Tax rates (per jurisdiction), shipping zones and rates, and discounts (automatic-discount rules plus coupon-stacking policies) each get a list / create / edit / archive screen, content-negotiated like the rest of the console (a bearer-token client still gets JSON). Their nav links appear only when the feature is wired. **Added:** *Tax rates screen* — `/admin/tax-rates` — pick a jurisdiction to see its rate history, create a rate (category + rate in basis points + effective window + source), edit the rate, and archive it. Overlap/archived conflicts surface as inline notices rather than errors. · *Shipping screen* — `/admin/shipping` — create a shipping zone (country/region + a flat-rate service) and manage it on a per-zone screen that lists its rates, edits the title/active state, and archives it; richer multi-region/multi-rate shapes remain available on the JSON path. · *Discounts screen* — `/admin/discounts` — create automatic-discount rules (cart-total / item-count / SKU triggers; percent-off / amount-off / free-shipping / BOGO values; priority), edit and archive them, plus manage coupon-stacking policies (max codes, combine toggles, order minimum).
 
 - v0.2.14 (2026-05-28) — **Manage products end-to-end from the admin console — variants, prices, and images.** The admin console can now build a complete, sellable product without dropping to the JSON API. Previously creating a product only captured its name, slug, status, and description — there was no way to add a variant, set a price, or attach an image from the console, so a product made there was not sellable. Each product now has a management screen (reachable from the product list) with variant create/edit/delete, per-variant price setting plus price history, and media attach / upload / delete, with confirmation steps for deletes. The screen is content-negotiated: a bearer-token API client still gets JSON (now including the full product model), a signed-in browser gets the management UI. **Added:** *Product management screen in the admin console* — Each product's title in the admin product list now links to a detail screen where an operator can edit the product's fields, add/edit/remove variants, set a variant's price and see its price history, and attach/upload/remove product images — the full path to a sellable product, all from the console. Destructive actions (remove variant/image) go through a confirmation step. · *Catalog read helpers* — `prices.currencies(variantId)` (the distinct currencies a variant is priced in) and `media.get(id)` (single media row) were added to support the screen. **Changed:** *`GET /admin/products/:id` is content-negotiated* — It previously returned JSON only; it now returns the management screen to a signed-in browser and a fuller JSON model (product + variants + prices + media) to a bearer-token client. The existing variant/price/media write endpoints are unchanged in contract — the new browser forms route to the same handlers.
 

package/README.md

@@ -62,7 +62,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/checkout.js`** | Orchestrator. `quote()` returns priced quote; `confirm()` creates a Stripe PaymentIntent + persists order pending; `handleStripeEvent()` verifies webhook + fires the FSM transition. PayPal path: `createPaypalOrder()` opens a PayPal order + persists pending, `capturePaypalOrder()` captures → paid, `handlePaypalEvent()` is the webhook backstop. All idempotent on re-delivery. |
 | **`lib/email.js`** | Transactional templates — order receipt, ship notification, refund confirmation. Strict `{{var}}` renderer with HTML escape + refusal of unknown / unused placeholders. Composed on `b.mail` (DKIM/SPF/DMARC/BIMI upstream). |
 | **`lib/storefront.js`** | Server-rendered HTML — utility bar + sticky header + dark hero with code-preview card + primitives marquee + featured-product callout + collections grid + framework feature band + designed catalog grid + newsletter band + four-column footer. Designed surfaces also for PDP, cart, checkout, pay, order, account login / register / dashboard, search results, `/admin` API landing, 404. Image-bearing cards on the home + search grids pull from `catalog.media`. The default theme stylesheet is external (R2-served `themes/default/assets/css/main.css`) and CSP-compliant; the typeface (Inter / Inter Tight) is self-hosted from `themes/default/assets/fonts`, so no page loads a cross-origin font. Operators override by uploading a replacement at the same key, by passing `opts.theme_css` to renderers, or by registering a named theme through the `theme` primitive. |
-| **`lib/customers.js`** | Customer accounts — passkey (WebAuthn) + **Sign in with Google / Apple** (OIDC). Email is stored hash-only (`b.crypto.namespaceHash` namespace `customer-email`); the raw address never lands in D1. Passkey credentials carry CBOR-encoded public keys, transport hints, and SHA3-512-fingerprinted attestation. `signInWithOIDC` keys federated accounts on the provider `(provider, subject)` and links an existing account only on a provider-verified email (never on an unverified one). `mintAppleClientSecret` produces Apple's required ES256 client-secret JWT from a Services-ID `.p8` key (the one classical signature the protocol mandates; the PQC default doesn't apply to an external IdP's wire format). Account routes (`/account/login`, `/account/register`, `/account`, `/account/login/google`, `/account/login/apple`) ship as designed cards on the storefront. |
+| **`lib/customers.js`** | Customer accounts — passkey (WebAuthn) + **Sign in with Google / Apple** (OIDC). Email is stored hash-only (`b.crypto.namespaceHash` namespace `customer-email`); the raw address never lands in D1. Passkey credentials carry CBOR-encoded public keys, transport hints, and SHA3-512-fingerprinted attestation. `signInWithOIDC` keys federated accounts on the provider `(provider, subject)` and links an existing account only on a provider-verified email (never on an unverified one). `mintAppleClientSecret` produces Apple's required ES256 client-secret JWT from a Services-ID `.p8` key (the one classical signature the protocol mandates; the PQC default doesn't apply to an external IdP's wire format). Account routes (`/account/login`, `/account/register`, `/account`, `/account/login/google`, `/account/login/apple`) ship as designed cards on the storefront; signed-in customers manage their own passkeys (`/account/passkeys` — list, add another, confirm-gated revoke scoped to the account with a last-sign-in-method guard) and edit their profile (`/account/profile`). |
 | **`lib/reviews.js`** | Operator-moderated product ratings. Submission requires a signed-in customer **and** a verified purchase — `/products/:slug/review` confirms a completed order for the product (via `order.hasPurchasedProduct`) before accepting, re-checked on POST; reviews land `pending`. Author identity is hash-only (`b.crypto.namespaceHash`); the raw email is never stored. The PDP renders the average, per-star distribution, and published reviews with `AggregateRating` JSON-LD. `/admin/reviews` is the moderation queue (`listByStatus` → publish / reject). |
 | **`lib/product-qa.js`** | Customer questions and operator/customer answers per product, operator-moderated, distinct from the rating-based reviews. A signed-in shopper asks at `/products/:slug/question`; questions land `pending` and surface only after approval. Author identity is the customer id (verified against the customers primitive) or a hash-only email — the raw address is never stored. The product page renders approved questions with their approved answers (seller / customer / system badge, pinned 'top answer' first) in both the edge and container paths. `/admin/questions` is the moderation console: the cross-product queue (`listQuestionsByStatus`), and a per-question detail to approve / reject the question, post the seller answer (`submitAnswer`), approve / reject / pin answers. |
 | **`lib/wishlist.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. UUID-shape-validated ids, `b.pagination` HMAC cursors. |

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.15",
+  "version": "0.2.17",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",
@@ -21,6 +21,10 @@
       "integrity": "sha384-XY3GHA5QDj/Nri03ZO1t7nsr9RGepZuanY45CTpFQnnTorQnygbtAVG4vVGfkNIP",
       "fingerprinted": "js/consent.59060d7723d050b2.js"
     },
+    "js/passkey-add.js": {
+      "integrity": "sha384-HSi+w0ampPZWcfPnnpV2Dkn/oGdgnyLe7QykGM5Sregud4CbH2KsU5Hb1FQQxJTy",
+      "fingerprinted": "js/passkey-add.c4b7350f2cac5477.js"
+    },
     "js/passkey-login.js": {
       "integrity": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",
       "fingerprinted": "js/passkey-login.f3d6787bdd5e20df.js"

package/lib/customers.js

@@ -505,14 +505,81 @@ function create(opts) {
       return row;
     },
 
-    removePasskey: async function (passkeyId) {
+    // Revoke an enrolled credential, scoped to its owner. The customer
+    // id is part of the WHERE clause (not just the lookup) so a forged or
+    // guessed passkey id belonging to ANOTHER customer is a silent no-op
+    // rather than a cross-customer deletion — the route layer hands us the
+    // authed customer id, and a credential only disappears when both keys
+    // agree. Idempotent: returns true when a row was removed, false when
+    // nothing matched (already-removed id, or an id owned by someone else).
+    removePasskey: async function (customerId, passkeyId) {
+      _uuid(customerId, "customer id");
       _uuid(passkeyId, "passkey id");
-      var row = (await query("SELECT customer_id FROM customer_passkeys WHERE id = ?1", [passkeyId])).rows[0];
+      var row = (await query(
+        "SELECT id FROM customer_passkeys WHERE id = ?1 AND customer_id = ?2",
+        [passkeyId, customerId],
+      )).rows[0];
       if (!row) return false;
-      await query("DELETE FROM customer_passkeys WHERE id = ?1", [passkeyId]);
-      await query("UPDATE customers SET updated_at = ?1 WHERE id = ?2", [_now(), row.customer_id]);
+      await query(
+        "DELETE FROM customer_passkeys WHERE id = ?1 AND customer_id = ?2",
+        [passkeyId, customerId],
+      );
+      await query("UPDATE customers SET updated_at = ?1 WHERE id = ?2", [_now(), customerId]);
       return true;
     },
+
+    // Mutate a customer's editable profile fields. v1 covers display_name
+    // only — the one field a customer can safely change without a
+    // verification round trip.
+    //
+    // Email is deliberately NOT updatable here. The address is stored
+    // hash-only (raw never lands in D1) AND it's the OAuth account-linking
+    // key: signInWithOIDC links a federated identity to an existing
+    // customer ONLY on a provider-verified email match, so silently
+    // re-pointing email_hash would let a customer claim a federated login
+    // that belongs to a different address — an account-takeover vector.
+    // A correct email change needs a proof-of-control ceremony (mail a
+    // one-time code to the NEW address, confirm, only then re-derive the
+    // hash). No transactional-mail surface is wired into the storefront
+    // yet, so shipping an unverified email change would be the
+    // half-measure the no-MVP rule forbids. Re-open when an outbound-mail
+    // primitive lands: add `verifyEmailChange` (issue + confirm token) and
+    // let `update` accept `email` only behind a confirmed token. A caller
+    // that passes `email` today is refused with a typed error so the gap
+    // is loud, never silent.
+    update: async function (id, patch) {
+      _uuid(id, "customer id");
+      if (!patch || typeof patch !== "object") {
+        throw new TypeError("customers.update: patch object required");
+      }
+      if (Object.prototype.hasOwnProperty.call(patch, "email")) {
+        var emailErr = new Error("customers.update: email cannot be changed without a verification ceremony — not supported in this build");
+        emailErr.code = "EMAIL_CHANGE_UNSUPPORTED";
+        throw emailErr;
+      }
+      var sets = [];
+      var params = [];
+      var p = 1;
+      if (Object.prototype.hasOwnProperty.call(patch, "display_name")) {
+        var displayName = _displayName(patch.display_name);
+        sets.push("display_name = ?" + p); params.push(displayName); p += 1;
+      }
+      if (sets.length === 0) {
+        throw new TypeError("customers.update: nothing to update (display_name is the only mutable field)");
+      }
+      var owner = (await query("SELECT id FROM customers WHERE id = ?1", [id])).rows[0];
+      if (!owner) {
+        throw new TypeError("customers.update: customer " + id + " not found");
+      }
+      var ts = _now();
+      sets.push("updated_at = ?" + p); params.push(ts); p += 1;
+      params.push(id);
+      await query(
+        "UPDATE customers SET " + sets.join(", ") + " WHERE id = ?" + p,
+        params,
+      );
+      return (await query("SELECT * FROM customers WHERE id = ?1", [id])).rows[0];
+    },
   };
   return api;
 }

package/lib/storefront.js

@@ -4942,6 +4942,10 @@ var ACCOUNT_DASH_PAGE =
   "      <a class=\"btn-secondary\" href=\"/account/loyalty\">Rewards</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/referrals\">Refer a friend</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/subscriptions\">Subscriptions</a>\n" +
+  // begin: profile + passkey management actions
+  "      <a class=\"btn-secondary\" href=\"/account/profile\">Edit profile</a>\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/passkeys\">Manage passkeys</a>\n" +
+  // end: profile + passkey management actions
   "      <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
   "    </div>\n" +
   "  </header>\n" +
@@ -5046,6 +5050,200 @@ function renderAccount(opts) {
   });
 }
 
+// ---- passkey management ------------------------------------------------
+//
+// The signed-in customer's enrolled WebAuthn credentials, each with a
+// confirm-gated revoke, plus an "add another passkey" flow that reuses
+// the same begin/finish ceremony the registration page drives (here
+// bound to the AUTHED customer, so no email form is involved). Email is
+// stored hash-only and a passkey is the account's sign-in method, so the
+// list never leaks the address and the last-credential guard (enforced in
+// the route, surfaced here) keeps a customer from locking themselves out.
+
+// Map the WebAuthn transports hint to a short human label for the list.
+function _transportLabel(t) {
+  if (t === "internal") return "This device";
+  if (t === "hybrid")   return "Phone / nearby device";
+  if (t === "usb")      return "Security key (USB)";
+  if (t === "nfc")      return "Security key (NFC)";
+  if (t === "ble")      return "Security key (Bluetooth)";
+  return t;
+}
+
+function renderPasskeys(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var list = opts.passkeys || [];
+  // Only offer per-credential revoke when removing it still leaves the
+  // customer a way back in — another passkey, OR a linked OAuth identity.
+  // When this is the last credential and there's no federated fallback,
+  // the revoke control is replaced by a disabled note so the customer
+  // can't lock themselves out. The route enforces the same rule server-
+  // side; this is the matching display.
+  var canRevokeAny = list.length > 1 || (opts.has_oauth === true && list.length >= 1);
+  var rowsHtml = "";
+  for (var i = 0; i < list.length; i += 1) {
+    var p = list[i];
+    var transports = (p.transports ? String(p.transports).split(",") : [])
+      .filter(Boolean)
+      .map(function (t) { return "<span class=\"passkey-card__transport\">" + esc(_transportLabel(t)) + "</span>"; })
+      .join("");
+    var added = "";
+    if (p.created_at) {
+      added = "<p class=\"passkey-card__meta\">Added " + esc(new Date(p.created_at).toISOString().slice(0, 10)) + "</p>";
+    }
+    // The credential handle is opaque; show a short fingerprint so the
+    // customer can tell two devices apart without exposing the full key.
+    var fingerprint = p.credential_id ? esc(String(p.credential_id).slice(0, 12)) : esc(String(p.id).slice(0, 12));
+    var actionCell = canRevokeAny
+      ? "<a class=\"btn-ghost btn-ghost--sm\" href=\"/account/passkeys/" + esc(String(p.id)) + "/remove\">Revoke</a>"
+      : "<span class=\"passkey-card__last\" title=\"This is your only way to sign in\">Only sign-in method</span>";
+    rowsHtml +=
+      "<li class=\"passkey-card\">" +
+        "<div class=\"passkey-card__body\">" +
+          "<p class=\"passkey-card__id\"><code>" + fingerprint + "…</code></p>" +
+          (transports ? "<p class=\"passkey-card__transports\">" + transports + "</p>" : "") +
+          added +
+        "</div>" +
+        "<div class=\"passkey-card__actions\">" + actionCell + "</div>" +
+      "</li>";
+  }
+  var listHtml = rowsHtml
+    ? "<ul class=\"passkey-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">No passkeys enrolled. Add one below so you can sign in from this device.</p>" +
+      "</div>";
+  // Success / notice banners, driven by the ?ok=<kind> PRG redirect.
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var success = opts.success
+    ? "<div class=\"form-notice form-notice--ok\" role=\"status\"><span>" + esc(String(opts.success)) + "</span></div>"
+    : "";
+  // The "add another" control is an island-driven button (CSP forbids
+  // inline script): it runs navigator.credentials.create against the
+  // authed begin/finish endpoints. With JS off the button does nothing,
+  // so it's framed as an enhancement, not the only path (a JS-off
+  // customer who needs another device can re-register through the normal
+  // flow — same credential lands on the same account by email).
+  var addBlock =
+    "<section class=\"passkey-add\">" +
+      "<h2 class=\"account-addresses__form-title\">Add another passkey</h2>" +
+      "<p class=\"passkey-add__lede\">Enroll a passkey on another device or security key so you can sign in from more than one place.</p>" +
+      "<div class=\"form-actions\"><button type=\"button\" id=\"passkey-add-btn\" class=\"btn-primary\">Add a passkey</button></div>" +
+      "<p id=\"passkey-add-message\" class=\"auth-form__message\"></p>" +
+      "RAW_PASSKEY_ADD_SCRIPT" +
+    "</section>";
+  var body =
+    "<section class=\"account-passkeys\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Passkeys</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-addresses__title\">Passkeys</h1>" +
+      "<p class=\"section-head__lede\">Devices that can sign in to your account. Revoke any you no longer use.</p>" +
+      success +
+      notice +
+      listHtml +
+      addBlock +
+    "</section>";
+  body = body.replace("RAW_PASSKEY_ADD_SCRIPT", _islandScript("passkey-add.js"));
+  return _wrap({
+    title:      "Passkeys",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Server-rendered confirm step for revoking a passkey — CSP forbids an
+// inline confirm() dialog, so the destructive action is gated behind a
+// second page whose POST actually revokes. Mirrors renderAddressRemoveConfirm.
+function renderPasskeyRemoveConfirm(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var p = opts.passkey || {};
+  var fingerprint = p.credential_id ? esc(String(p.credential_id).slice(0, 12)) : esc(String(p.id).slice(0, 12));
+  var added = p.created_at
+    ? "<p class=\"passkey-card__meta\">Added " + esc(new Date(p.created_at).toISOString().slice(0, 10)) + "</p>"
+    : "";
+  var body =
+    "<section class=\"account-confirm\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/passkeys\">Passkeys</a></li>" +
+        "<li aria-current=\"page\">Revoke passkey</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-confirm__title\">Revoke this passkey?</h1>" +
+      "<p class=\"passkey-card__id\"><code>" + fingerprint + "…</code></p>" +
+      added +
+      "<p class=\"account-confirm__lede\">The device holding this passkey will no longer be able to sign in. " +
+        "Make sure you still have another way into your account before revoking.</p>" +
+      "<div class=\"account-confirm__actions\">" +
+        "<form method=\"post\" action=\"/account/passkeys/" + esc(String(p.id)) + "/revoke\">" +
+          "<button type=\"submit\" class=\"btn-primary\">Revoke passkey</button>" +
+        "</form>" +
+        "<a class=\"btn-ghost\" href=\"/account/passkeys\">Cancel</a>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Revoke passkey",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// ---- profile edit ------------------------------------------------------
+//
+// Display-name edit for the signed-in customer. Email is stored hash-only
+// and is the OAuth account-linking key, so it's shown read-only (masked)
+// and cannot be changed here — the primitive refuses an email patch until
+// a verification ceremony exists. The form is a plain server-rendered
+// POST with a PRG `?ok=updated` success notice, matching the addresses
+// pattern.
+function renderProfile(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var customer = opts.customer || {};
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var success = opts.success
+    ? "<div class=\"form-notice form-notice--ok\" role=\"status\"><span>" + esc(String(opts.success)) + "</span></div>"
+    : "";
+  var displayValue = esc(String(customer.display_name == null ? "" : customer.display_name));
+  var body =
+    "<section class=\"account-profile\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Profile</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-addresses__title\">Edit profile</h1>" +
+      success +
+      notice +
+      "<form method=\"post\" action=\"/account/profile\" class=\"form-stack\">" +
+        "<div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Display name</span>" +
+          "<input type=\"text\" name=\"display_name\" maxlength=\"128\" required autocomplete=\"name\" value=\"" + displayValue + "\"></label></div>" +
+        "<div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span>" +
+          "<input type=\"text\" value=\"Hidden for privacy — stored as a one-way hash\" disabled aria-describedby=\"email-note\"></label></div>" +
+        "<p id=\"email-note\" class=\"form-field__hint\">Your email address is never stored in readable form, so it can't be changed or shown here. " +
+          "Sign in with the address you registered.</p>" +
+        "<div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary\">Save changes</button> " +
+          "<a class=\"btn-ghost\" href=\"/account\">Cancel</a></div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Edit profile",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // ---- customer survey page ----------------------------------------------
 
 // Render one survey question as a fieldset. Rating → a 0/1..max radio
@@ -7551,6 +7749,267 @@ function mount(router, deps) {
       return res.end ? res.end() : res.send("");
     });
 
+    // ---- passkey self-management + profile edit ----------------------
+    //
+    // The signed-in customer manages their own credentials: list enrolled
+    // passkeys, revoke one (confirm-gated), or enroll another device. The
+    // revoke is guarded so a customer can't strip away their last sign-in
+    // method when they have no federated (OAuth) fallback — that would lock
+    // them out. The add flow reuses the WebAuthn begin/finish ceremony the
+    // registration page drives, but bound to the ALREADY-authed customer
+    // (no email form), so a new credential always lands on the right
+    // account.
+    function _accountAuth(req, res) {
+      var auth;
+      try { auth = _currentCustomer(req); }
+      catch (e) {
+        if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+        throw e;
+      }
+      if (!auth) {
+        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        res.end ? res.end() : res.send("");
+        return null;
+      }
+      return auth;
+    }
+
+    // Does this customer have a federated (OAuth) sign-in to fall back on?
+    // Used as the "is it safe to revoke the last passkey" gate. Composes
+    // the existing batched sign-in-methods aggregate (no bespoke query).
+    async function _hasOAuthFallback(customerId) {
+      var methods = await deps.customers.signInMethodsByCustomer([customerId]);
+      var providers = methods.oauth[customerId];
+      return Array.isArray(providers) && providers.length > 0;
+    }
+
+    function _passkeySuccessCopy(kind) {
+      if (kind === "revoked") return "Passkey revoked.";
+      if (kind === "added")   return "Passkey added.";
+      return null;
+    }
+
+    async function _renderPasskeysPage(req, res, auth, notice, code) {
+      var pks = await deps.customers.listPasskeys(auth.customer_id);
+      var hasOAuth = await _hasOAuthFallback(auth.customer_id);
+      var cartCount = await _cartCountForReq(req);
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var okKind = url ? url.searchParams.get("ok") : null;
+      _send(res, code || 200, renderPasskeys({
+        passkeys:   pks,
+        has_oauth:  hasOAuth,
+        notice:     notice || null,
+        success:    _passkeySuccessCopy(okKind),
+        shop_name:  shopName,
+        cart_count: cartCount,
+      }));
+    }
+
+    // Resolve a passkey by path id AND confirm it belongs to the authed
+    // customer. A non-UUID segment or a credential owned by someone else
+    // is a 404 — never a cross-customer reveal.
+    async function _ownedPasskey(req, res, auth) {
+      var pks;
+      try { pks = await deps.customers.listPasskeys(auth.customer_id); }
+      catch (e) { throw e; }
+      var id = req.params && req.params.id;
+      for (var i = 0; i < pks.length; i += 1) {
+        if (pks[i].id === id) return pks[i];
+      }
+      _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+      return null;
+    }
+
+    router.get("/account/passkeys", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      await _renderPasskeysPage(req, res, auth, null);
+    });
+
+    // Revoke is destructive + CSP forbids confirm(), so it routes through a
+    // server-rendered confirm page; the POST that actually revokes lives
+    // behind it.
+    router.get("/account/passkeys/:id/remove", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      var pk = await _ownedPasskey(req, res, auth); if (!pk) return;
+      var cartCount = await _cartCountForReq(req);
+      _send(res, 200, renderPasskeyRemoveConfirm({
+        passkey:    pk,
+        shop_name:  shopName,
+        cart_count: cartCount,
+      }));
+    });
+
+    router.post("/account/passkeys/:id/revoke", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      var pk = await _ownedPasskey(req, res, auth); if (!pk) return;
+      // Last-credential guard: refuse to remove the only sign-in method
+      // when there's no federated fallback — surface a clear notice rather
+      // than silently locking the customer out.
+      var pks = await deps.customers.listPasskeys(auth.customer_id);
+      if (pks.length <= 1 && !(await _hasOAuthFallback(auth.customer_id))) {
+        return _renderPasskeysPage(
+          req, res, auth,
+          "That's your only way to sign in — add another passkey (or link a Google / Apple account) before revoking this one.",
+          409,
+        );
+      }
+      try {
+        await deps.customers.removePasskey(auth.customer_id, pk.id);
+      } catch (e) {
+        if (e instanceof TypeError) return _renderPasskeysPage(req, res, auth, (e && e.message) || "Could not revoke that passkey.", 400);
+        throw e;
+      }
+      res.status(303); res.setHeader && res.setHeader("location", "/account/passkeys?ok=revoked");
+      return res.end ? res.end() : res.send("");
+    });
+
+    // Add-another-passkey ceremony — same begin/finish shape as
+    // registration, but for the AUTHED customer (no email form). The
+    // challenge cookie carries kind "add" + the customer id; finish gates
+    // on both so an add-finish can't be replayed against a register/login
+    // challenge.
+    router.post("/account/passkey/add-begin", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      try {
+        var customer = await deps.customers.get(auth.customer_id);
+        if (!customer) { res.status(401); return res.end ? res.end("unknown customer") : res.send("unknown customer"); }
+        // Exclude already-enrolled credentials so the authenticator won't
+        // create a duplicate on the same device.
+        var existing = await deps.customers.listPasskeys(customer.id);
+        var exclude = existing.map(function (p) {
+          return {
+            id:         p.credential_id,
+            type:       "public-key",
+            transports: p.transports ? p.transports.split(",") : undefined,
+          };
+        });
+        var startOpts = await b.auth.passkey.startRegistration({
+          rpName:           rpName,
+          rpId:             rpId,
+          userName:         customer.email_hash.slice(0, 16),
+          userDisplayName:  customer.display_name,
+          attestationType:  "none",
+          excludeCredentials: exclude,
+        });
+        _setChallengeCookie(res, {
+          kind:        "add",
+          customer_id: customer.id,
+          challenge:   startOpts.challenge,
+          created_at:  Date.now(),
+        });
+        res.status(200);
+        res.setHeader && res.setHeader("content-type", "application/json");
+        return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
+      } catch (e) {
+        if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+        res.status(e instanceof TypeError ? 400 : 500);
+        return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+      }
+    });
+
+    router.post("/account/passkey/add-finish", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      try {
+        var env = _readChallengeEnv(req);
+        if (!env) { res.status(400); return res.end ? res.end("missing challenge") : res.send("missing challenge"); }
+        if (env.kind !== "add") { res.status(400); return res.end ? res.end("bad challenge") : res.send("bad challenge"); }
+        // The challenge must belong to the customer driving this request —
+        // a stolen "add" challenge can't enroll a credential elsewhere.
+        if (env.customer_id !== auth.customer_id) {
+          res.status(403); return res.end ? res.end("challenge / account mismatch") : res.send("challenge / account mismatch");
+        }
+        var att = _readJsonBody(req);
+        var rv = await b.auth.passkey.verifyRegistration({
+          response:           att,
+          expectedChallenge:  env.challenge,
+          expectedOrigin:     expectedOrigin,
+          expectedRPID:       rpId,
+        });
+        if (!rv || !rv.verified) {
+          res.status(400); return res.end ? res.end("attestation refused") : res.send("attestation refused");
+        }
+        var info = rv.registrationInfo || {};
+        var credentialId = info.credentialID || att.rawId || att.id;
+        var publicKey    = info.credentialPublicKey;
+        if (credentialId && typeof credentialId !== "string") credentialId = _b64u(credentialId);
+        if (publicKey && typeof publicKey !== "string")       publicKey    = _b64u(publicKey);
+        var transports = "";
+        if (att.response && Array.isArray(att.response.transports)) {
+          transports = att.response.transports.filter(function (t) { return /^[a-z]+$/.test(t); }).join(",");
+        }
+        try {
+          await deps.customers.addPasskey(env.customer_id, {
+            credential_id: credentialId,
+            public_key:    publicKey,
+            counter:       info.counter || 0,
+            transports:    transports,
+          });
+        } catch (e) {
+          if (e && e.code === "PASSKEY_DUPLICATE") {
+            res.status(409); return res.end ? res.end("credential already registered") : res.send("credential already registered");
+          }
+          throw e;
+        }
+        _clearChallengeCookie(res);
+        res.status(200);
+        return res.end ? res.end("ok") : res.send("ok");
+      } catch (e) {
+        if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+        res.status(e instanceof TypeError ? 400 : 500);
+        return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+      }
+    });
+
+    // Profile edit — display-name only. Email is hash-only + the OAuth
+    // linking key, so the primitive refuses an email change without a
+    // verification ceremony; the form shows it read-only. PRG with a
+    // ?ok=updated success notice, matching the addresses pattern.
+    async function _renderProfilePage(req, res, auth, customer, notice, code) {
+      var cartCount = await _cartCountForReq(req);
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var okKind = url ? url.searchParams.get("ok") : null;
+      _send(res, code || 200, renderProfile({
+        customer:   customer,
+        notice:     notice || null,
+        success:    okKind === "updated" ? "Profile updated." : null,
+        shop_name:  shopName,
+        cart_count: cartCount,
+      }));
+    }
+
+    router.get("/account/profile", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      var customer = await deps.customers.get(auth.customer_id);
+      if (!customer) {
+        _clearAuthCookie(res);
+        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        return res.end ? res.end() : res.send("");
+      }
+      await _renderProfilePage(req, res, auth, customer, null);
+    });
+
+    router.post("/account/profile", async function (req, res) {
+      var auth = _accountAuth(req, res); if (!auth) return;
+      var customer = await deps.customers.get(auth.customer_id);
+      if (!customer) {
+        _clearAuthCookie(res);
+        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        return res.end ? res.end() : res.send("");
+      }
+      var body = req.body || {};
+      try {
+        await deps.customers.update(auth.customer_id, { display_name: body.display_name });
+      } catch (e) {
+        if (e instanceof TypeError) {
+          var merged = Object.assign({}, customer, { display_name: body.display_name });
+          return _renderProfilePage(req, res, auth, merged, (e && e.message) || "Please check the form.", 400);
+        }
+        throw e;
+      }
+      res.status(303); res.setHeader && res.setHeader("location", "/account/profile?ok=updated");
+      return res.end ? res.end() : res.send("");
+    });
+
     // Sign in with Google (OIDC). Mounts when the operator wires an
     // `oauthGoogle` adapter (b.auth.oauth, google preset). The framework
     // adapter owns discovery + PKCE + ID-token verification (signature,
@@ -9433,6 +9892,9 @@ module.exports = {
   renderAccountLogin:    renderAccountLogin,
   renderAccountRegister: renderAccountRegister,
   renderAccount:         renderAccount,
+  renderPasskeys:        renderPasskeys,
+  renderPasskeyRemoveConfirm: renderPasskeyRemoveConfirm,
+  renderProfile:         renderProfile,
   renderAccountSubscriptions: renderAccountSubscriptions,
   renderCookiePreferences: renderCookiePreferences,
   renderNotFound:        renderNotFound,

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.32",
-      "tag": "v0.13.32",
+      "version": "0.13.42",
+      "tag": "v0.13.42",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",