@blamejs/blamejs-shop 0.2.5 → 0.2.6

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.6 (2026-05-27) — **Business-hours page, a graceful unconfigured-checkout state, and the brand shield on the product page.** Three storefront changes. Operators can publish their open hours: define schedules (timezone + per-weekday open/close) from a new Hours screen in the admin console, and a public /hours page renders each as a weekly grid with a live open/closed status computed per request in the schedule's timezone. The cart now degrades gracefully when no payment provider is configured — instead of a checkout button that leads to a dead route, it shows a clear, disabled 'checkout isn't set up yet' notice, and a direct visit to /checkout returns a tidy 'unavailable' page rather than a 404. And the product page's post-quantum-checkout trust badge now uses the real brand shield mark (the site favicon) in place of a CSS approximation. **Added:** *Public /hours page* — A server-rendered page listing every active schedule as a weekday grid (closed days marked), with a live open/closed pill and the next transition ("Opens Monday at 09:00" / "Closes at 17:00"). Timezone-aware and computed per request, so it isn't cached stale. · *Admin console: Hours* — A new Hours screen (and matching JSON API) to create a schedule with a timezone and per-weekday open/close times (a blank day is closed), list schedules, and archive ones no longer in use. Holiday closures and one-off date exceptions — which override the weekly base — are available through the API. The screen appears only when the business-hours primitive is wired. **Changed:** *Cart and /checkout degrade gracefully without a payment provider* — When checkout isn't configured (no payment provider), the cart no longer shows a checkout button that leads nowhere — it shows a disabled control with a clear note that online checkout isn't set up yet and the cart is saved. A direct visit to /checkout now returns a tidy 503 'checkout unavailable' page instead of a 404. Configuring a payment provider restores the full cart → shipping → payment → confirmation flow with no other change. · *Product-page trust badge uses the brand shield* — The post-quantum-secured-checkout badge on the product page now renders the actual brand shield mark (the site icon) rather than a CSS-drawn hex approximation, so the badge matches the brand identity used elsewhere.
+
 - v0.2.5 (2026-05-27) — **Customer surveys — token-gated NPS / CSAT / CES feedback with an admin rollup.** Operators can now collect structured post-experience feedback. Define a survey (NPS, CSAT, CES, or a custom open-ended prompt) from a new Surveys screen in the admin console, then issue a single-use invitation for a customer — the console shows the survey link once for you to send. The customer opens the link and answers without signing in; the token itself is the access. Responses roll up on the survey's detail page with the kind-appropriate score (NPS index, CSAT positive-rate, CES mean) plus a per-question breakdown. Surveys can be archived when a campaign ends; existing invitation links keep working. **Added:** *Token-gated survey page* — A `/survey/:token` page renders the survey's questions — a rating scale, single-select options, or a free-text box — and accepts one response per invitation. The single-use token is the access (no login), and the page degrades cleanly to a clear notice when a link is already used, expired, closed, or invalid. The required-answer check re-renders the form with a message rather than losing the visitor's work. · *Admin console: Surveys* — A new Surveys screen (and matching JSON API) to create a survey for the chosen kind (the console seeds the standard question set; fully custom question lists go through the API), issue a single-use invitation for a customer id (the link is revealed exactly once), read the response rollup with the kind's headline score and per-question results, and archive finished surveys. The screen appears only when the surveys primitive is wired.
 
 - v0.2.4 (2026-05-27) — **Announcement bar — publish a sitewide promo or notice strip from the admin console.** Operators can now publish a sitewide announcement bar — a strip at the very top of every storefront page for a sale, a shipping notice, or an urgent alert. Manage it from a new Announcements screen in the admin console: set the message, an optional call-to-action link, a theme (urgency, promo, info, or success), the audience (everyone, signed-out visitors, or signed-in customers), an optional start/expiry schedule, and whether visitors can dismiss it. The highest-priority active announcement shows automatically (urgency outranks promo outranks info outranks success). The bar renders on both the edge and container paths so it appears on every page including the cached ones, and a dismissed bar stays hidden across navigation. Until an announcement is published, nothing changes. **Added:** *Sitewide announcement bar* — A page-top strip rendered on every storefront page (home, search, product, cart, blog, and the storefront chrome) in one of four themes. The single highest-priority active announcement for the viewer is shown, chosen by theme rank (urgency > promo > info > success). Audience targeting covers everyone, signed-out visitors, and signed-in customers, with an optional scheduled start and expiry. An optional call-to-action link is included; its URL is restricted to https:// or a site-relative path. · *Admin console: Announcements* — A new Announcements screen (and matching JSON API) to create announcements, filter the list to those active right now, and archive ones that are done. The screen appears in the console only when the announcement primitive is wired. · *Dismiss without a round-trip* — Dismissible announcements carry a close control. With JavaScript it's hidden in place and remembered in a local cookie so it doesn't reappear as you browse; with JavaScript off, a form submission records the dismissal and returns you to the page. The bar is always server-rendered identically for everyone, so a dismissed bar never leaks back in from a cached page — it's hidden per-visitor on the client.

package/lib/admin.js

@@ -300,7 +300,7 @@ function mount(router, deps) {
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -2296,6 +2296,73 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- business hours -------------------------------------------------
+  // Define open/close schedules surfaced on the public /hours page. The
+  // console create form takes a per-weekday open/close pair (blank = closed
+  // that day); holidays + one-off exceptions are managed via the JSON API.
+  // Content-negotiated like the other screens.
+  if (deps.businessHours) {
+    var hours = deps.businessHours;
+
+    router.get("/admin/hours", _pageOrApi(true,
+      R(async function (req, res) {
+        _json(res, 200, { rows: await hours.listSchedules() });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rows = await hours.listSchedules();
+        _sendHtml(res, 200, renderAdminHours({
+          shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the schedule." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/hours", _pageOrApi(false,
+      W("hours.define", async function (req, res) {
+        var row = await hours.defineSchedule(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await hours.defineSchedule(_scheduleFromForm(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          var rows = await hours.listSchedules();
+          return _sendHtml(res, 400, renderAdminHours({
+            shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
+            notice: (e.message || "Couldn't save that schedule.").replace(/^businessHours[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.define", outcome: "success" });
+        _redirect(res, "/admin/hours?created=1");
+      },
+    ));
+
+    router.post("/admin/hours/:slug/archive", _pageOrApi(false,
+      W("hours.archive", async function (req, res) {
+        var row;
+        try { row = await hours.archiveSchedule(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "schedule-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var row = null;
+        try { row = await hours.archiveSchedule(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/hours?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/hours?archived=1");
+      },
+    ));
+  }
+
   // ---- analytics ------------------------------------------------------
 
   var analytics = deps.analytics || null;
@@ -2972,6 +3039,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
+  { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
   { key: "giftcards",    href: "/admin/gift-cards",    label: "Gift cards",   requires: "giftcards" },
   { key: "webhooks",     href: "/admin/webhooks",     label: "Webhooks",     requires: "webhooks" },
   { key: "integrations", href: "/admin/integrations", label: "Integrations" },
@@ -4345,6 +4413,80 @@ function renderAdminSurveyDetail(opts) {
   return _renderAdminShell(opts.shop_name, survey.title, bodyHtml, "surveys", opts.nav_available);
 }
 
+// Build a defineSchedule input from the per-weekday open/close form fields
+// (d0_open/d0_close .. d6_open/d6_close). A day with both a start and end
+// time becomes a weekly_hours entry; a blank day is closed. Sun=0.
+function _scheduleFromForm(body) {
+  body = body || {};
+  var weekly = [];
+  for (var d = 0; d < 7; d += 1) {
+    var open  = body["d" + d + "_open"];
+    var close = body["d" + d + "_close"];
+    if (typeof open === "string" && open.trim() && typeof close === "string" && close.trim()) {
+      weekly.push({ day: d, open: open.trim(), close: close.trim() });
+    }
+  }
+  return {
+    slug:         typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    timezone:     body.timezone,
+    weekly_hours: weekly,
+  };
+}
+
+function renderAdminHours(opts) {
+  opts = opts || {};
+  var rows = opts.schedules || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Schedule saved.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Schedule archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var DOW = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+
+  var bodyRows = rows.map(function (s) {
+    var isArchived = s.archived_at != null;
+    var enc = _htmlEscape(encodeURIComponent(s.slug));
+    var openDays = ((s.weekly_hours || []).reduce(function (set, w) { set[w.day] = 1; return set; }, {}));
+    var dayCount = Object.keys(openDays).length;
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(s.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(s.timezone) + "</td>" +
+      "<td class=\"num\">" + dayCount + " open day(s)</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/hours/" + enc + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Schedule</th><th scope=\"col\">Timezone</th><th scope=\"col\" class=\"num\">Days</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No schedules yet.</p>";
+
+  var dayFields = DOW.map(function (label, d) {
+    return "<div class=\"actions-row\">" +
+      "<span class=\"u-mute\">" + label + "</span>" +
+      "<input type=\"time\" name=\"d" + d + "_open\" aria-label=\"" + label + " open\">" +
+      "<input type=\"time\" name=\"d" + d + "_close\" aria-label=\"" + label + " close\">" +
+    "</div>";
+  }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-42\">" +
+      "<h3 class=\"subhead\">Create a schedule</h3>" +
+      "<p class=\"meta\">Set an open + close time per weekday (leave a day blank to mark it closed). Times are in the schedule's timezone. Holidays + one-off exceptions are managed via the API.</p>" +
+      "<form method=\"post\" action=\"/admin/hours\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — e.g. support or store.", " maxlength=\"64\" required") +
+        _setupField("Timezone", "timezone", "", "text", "IANA name, e.g. America/New_York.", " maxlength=\"64\" required") +
+        "<fieldset class=\"box\"><legend class=\"legend-sm\">Weekly hours (open / close)</legend>" + dayFields + "</fieldset>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create schedule</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Business hours</h2>" + created + archived + notice + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Hours", bodyHtml, "hours", opts.nav_available);
+}
+
 function renderAdminCollection(opts) {
   opts = opts || {};
   var col = opts.collection;

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.5",
+  "version": "0.2.6",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-G7yMuGZ4ojVoEpiRX70qcuR+YcQU4A1K/jRhRE/yPD7PXkqUH4LruBlu6MPCv+R8",
-      "fingerprinted": "css/main.b99ea24f442deef8.css"
+      "integrity": "sha384-rjXOXDbgXWPBR/7YqM07j7oAN9Gx9SIY31GUdViVAFG/Tw4HD519zbVvXmYEpUrz",
+      "fingerprinted": "css/main.6825424436cea4c0.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/storefront.js

@@ -1274,7 +1274,7 @@ function _buildBuyBox(variants, escAttr) {
 
   var trustLine =
     "<div class=\"pdp__meta\">\n" +
-    "        <span class=\"pdp__badge\"><span class=\"shield\" aria-hidden=\"true\"><span class=\"shield__glyph\">&gt;_</span></span> Post-quantum secured checkout · ML-KEM-1024 key agreement · ML-DSA-65 receipt signature.</span>\n" +
+    "        <span class=\"pdp__badge\"><img class=\"pdp__badge-mark\" src=\"/assets/brand/favicon.svg\" alt=\"\" aria-hidden=\"true\" width=\"22\" height=\"22\"> Post-quantum secured checkout · ML-KEM-1024 key agreement · ML-DSA-65 receipt signature.</span>\n" +
     "      </div>";
 
   // Many variants → keep the compact table (still a per-row add form).
@@ -3788,8 +3788,7 @@ var CART_PAGE =
   "        <div><dt>Subtotal</dt><dd>{{subtotal}}</dd></div>\n" +
   "        <div class=\"totals-list__grand\"><dt>Total</dt><dd>{{total}}</dd></div>\n" +
   "      </dl>\n" +
-  "      <a href=\"/checkout\" class=\"btn-primary cart-page__checkout\">Continue to checkout <span aria-hidden=\"true\">→</span></a>\n" +
-  "      <p class=\"cart-page__note\">Tax and shipping are calculated on the next step. Payment runs through Stripe.</p>\n" +
+  "RAW_CHECKOUT_CTA" +
   "    </aside>\n" +
   "  </div>\n" +
   "</section>\n";
@@ -3886,11 +3885,21 @@ function renderCart(opts) {
         product_url:    l.product_url,
       }).replace("RAW_CART_LINE_THUMB", thumb).replace("RAW_CART_LINE_SAVE", saveBtn);
     }).join("");
+    // Checkout CTA — only a live button when checkout is actually wired
+    // (Stripe configured). Absent that, render a clear, disabled "not set
+    // up" notice instead of a link that 404s. Backward-compatible: callers
+    // that don't pass the flag (older tests) keep the button.
+    var checkoutAvailable = opts.checkout_available !== false;
+    var checkoutCta = checkoutAvailable
+      ? "      <a href=\"/checkout\" class=\"btn-primary cart-page__checkout\">Continue to checkout <span aria-hidden=\"true\">→</span></a>\n" +
+        "      <p class=\"cart-page__note\">Tax and shipping are calculated on the next step. Payment runs through Stripe.</p>\n"
+      : "      <button type=\"button\" class=\"btn-primary cart-page__checkout\" disabled aria-disabled=\"true\">Checkout unavailable</button>\n" +
+        "      <p class=\"cart-page__note cart-page__note--warn\" role=\"status\">Online checkout isn't set up for this store yet — payments aren't configured. Your cart is saved; please check back soon.</p>\n";
     body = _render(CART_PAGE, {
       line_rows: "RAW_LINES",
       subtotal:  subtotal,
       total:     total,
-    }).replace("RAW_LINES", rows);
+    }).replace("RAW_LINES", rows).replace("RAW_CHECKOUT_CTA", checkoutCta);
   }
   return _wrap(Object.assign({
     title:      "Cart",
@@ -4735,6 +4744,67 @@ function renderSurveyPage(opts) {
   });
 }
 
+// ---- business-hours page -----------------------------------------------
+
+var _DOW_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+
+// The public /hours page. `opts.schedules` is an array of resolved
+// schedules: { summary: { slug, timezone, days[7] }, is_open, next_open,
+// next_close }. Renders each as a card with a live open/closed pill, the
+// next transition, and the weekly grid. An empty list renders a friendly
+// "not published yet" notice.
+function renderHoursPage(opts) {
+  opts = opts || {};
+  var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
+  var schedules = opts.schedules || [];
+  var body;
+  if (!schedules.length) {
+    body =
+      "<section class=\"hours-page\"><div class=\"hours-page__inner hours-page__inner--msg\">" +
+        "<h1 class=\"hours-page__title\">Hours</h1>" +
+        "<p class=\"hours-page__lede\">Our hours haven't been published yet.</p>" +
+        "<a class=\"btn-ghost\" href=\"/\">Back to the shop</a>" +
+      "</div></section>";
+  } else {
+    var cards = schedules.map(function (s) {
+      var pill = s.is_open
+        ? "<span class=\"hours-status hours-status--open\">Open now</span>"
+        : "<span class=\"hours-status hours-status--closed\">Closed</span>";
+      var next = "";
+      if (s.is_open && s.next_close) next = "Closes at " + esc(s.next_close.close);
+      else if (!s.is_open && s.next_open) next = "Opens " + esc(s.next_open.date) + " at " + esc(s.next_open.open);
+      var rows = "";
+      var days = (s.summary && s.summary.days) || [];
+      for (var d = 0; d < 7; d += 1) {
+        var wins = days[d] || [];
+        var hrs = wins.length
+          ? wins.map(function (w) { return esc(w.open) + "–" + esc(w.close); }).join(", ")
+          : "<span class=\"hours-table__closed\">Closed</span>";
+        rows += "<tr><th scope=\"row\">" + _DOW_NAMES[d] + "</th><td>" + hrs + "</td></tr>";
+      }
+      return "<div class=\"hours-card\">" +
+               "<div class=\"hours-card__head\"><h2>" + esc(s.summary.slug) + "</h2>" + pill + "</div>" +
+               (next ? "<p class=\"hours-card__next\">" + next + "</p>" : "") +
+               "<table class=\"hours-table\"><tbody>" + rows + "</tbody></table>" +
+               "<p class=\"hours-card__tz\">Times shown in " + esc(s.summary.timezone) + ".</p>" +
+             "</div>";
+    }).join("");
+    body =
+      "<section class=\"hours-page\"><div class=\"hours-page__inner\">" +
+        "<p class=\"eyebrow\">When we're around</p>" +
+        "<h1 class=\"hours-page__title\">Hours</h1>" +
+        "<div class=\"hours-grid\">" + cards + "</div>" +
+      "</div></section>";
+  }
+  return _wrap({
+    title:      "Hours",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 function mount(router, deps) {
   if (!router || typeof router.get !== "function") throw new TypeError("storefront.mount: router with .get() required");
   if (!deps || !deps.catalog || !deps.cart) throw new TypeError("storefront.mount: deps.catalog + deps.cart required");
@@ -5212,6 +5282,34 @@ function mount(router, deps) {
     });
   }
 
+  // ---- business hours (public /hours page) ----------------------------
+  // Lists every active schedule with its weekly grid + a live open/closed
+  // status computed at request time in the schedule's timezone. Container-
+  // rendered (the status is time-of-day dependent, so it isn't edge-cached).
+  // Resilient: a missing table / no schedules renders the "not published"
+  // notice, never a 500.
+  if (deps.businessHours) {
+    router.get("/hours", async function (req, res) {
+      var themeCss = (deps.theme && deps.theme.assetUrl) ? deps.theme.assetUrl("css/main.css") : DEFAULT_THEME_CSS_URL;
+      var shopName = (deps.config && deps.config.shop_name) || "blamejs.shop";
+      var resolved = [];
+      try {
+        var schedules = await deps.businessHours.listSchedules();
+        var active = (schedules || []).filter(function (s) { return s.archived_at == null; });
+        var now = Date.now();
+        for (var i = 0; i < active.length; i += 1) {
+          var slug = active[i].slug;
+          var summary   = await deps.businessHours.weekSummary({ slug: slug });
+          var isOpen    = await deps.businessHours.isOpenAt({ slug: slug, when: now });
+          var nextOpen  = isOpen ? null : await deps.businessHours.nextOpenAt({ slug: slug, when: now });
+          var nextClose = isOpen ? await deps.businessHours.nextCloseAt({ slug: slug, when: now }) : null;
+          if (summary) resolved.push({ summary: summary, is_open: isOpen, next_open: nextOpen, next_close: nextClose });
+        }
+      } catch (_e) { resolved = []; /* table absent / read failure → "not published" */ }
+      _send(res, 200, renderHoursPage({ schedules: resolved, shop_name: shopName, theme_css: themeCss }));
+    });
+  }
+
   // Persist a locale choice. A GET form (works with JS off) from the
   // footer switcher submits `lang` (the chosen tag) + `to` (the path to
   // return to). We validate the tag against the active locale set, set
@@ -6178,6 +6276,7 @@ function mount(router, deps) {
       totals:          totals,
       product_lookup:  productLookup,
       can_save:        !!(deps.saveForLater && deps.customers),
+      checkout_available: !!(deps.checkout && deps.order),
       shop_name:       shopName,
       theme:           theme,
     }, ccy)));
@@ -6194,6 +6293,30 @@ function mount(router, deps) {
   // routes only register when supplied. This lets the framework boot
   // in pure-storefront mode (catalog + cart only) for stores that
   // are still configuring payment.
+  //
+  // When checkout ISN'T wired (no payment provider configured), mount a
+  // graceful placeholder at /checkout so the cart link or a direct hit
+  // renders a clear "not set up yet" page instead of a 404. The cart CTA
+  // is already gated to a disabled notice (renderCart checkout_available),
+  // but a direct navigation still needs a real response. GET + POST both
+  // land here (a stale form POST shouldn't 404 either).
+  if (!(deps.checkout && deps.order)) {
+    var _checkoutUnavailable = function (req, res) {
+      var body =
+        "<section class=\"cart-page cart-page--empty\"><div class=\"cart-empty\"><div class=\"cart-empty__card\">" +
+          "<p class=\"eyebrow cart-empty__eyebrow\">Checkout</p>" +
+          "<h1 class=\"cart-empty__title\">Checkout isn't available yet</h1>" +
+          "<p class=\"cart-empty__lede\">Online payments aren't set up for this store yet, so orders can't be completed right now. Your cart is saved — please check back soon.</p>" +
+          "<div class=\"cart-empty__cta\"><a class=\"btn-primary\" href=\"/cart\">Back to cart</a> <a class=\"btn-ghost\" href=\"/\">Keep browsing</a></div>" +
+        "</div></div></section>";
+      // 503: the capability is unconfigured, not the request's fault — keeps
+      // the page out of search indexes + signals "temporarily unavailable".
+      _send(res, 503, _wrap({ title: "Checkout", shop_name: shopName, theme: theme, cart_count: 0, body: body }));
+    };
+    router.get("/checkout", _checkoutUnavailable);
+    router.post("/checkout", _checkoutUnavailable);
+  }
+
   if (deps.checkout && deps.order) {
     router.get("/checkout", async function (req, res) {
       var sid = _readSidCookie(req);

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.16",
-      "tag": "v0.13.16",
+      "version": "0.13.18",
+      "tag": "v0.13.18",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.18 (2026-05-27) — **`bodyParser` multipart can buffer uploads in memory — no tmp directory for serverless / read-only filesystems.** The multipart/form-data sub-parser previously streamed every file part to a tmp directory on disk (os.tmpdir() by default), which fails on a read-only or ephemeral serverless filesystem. A new multipart.storage option selects where file parts land: "disk" (default, unchanged — req.files[].path points at a tmp file cleaned up on response end) or "memory" (req.files[].buffer holds the assembled bytes, with no filesystem access at all). Both modes enforce the same per-file (fileSize), per-field, and total-request (totalSize) caps, so memory mode adds no new memory-exhaustion surface. The file object shape is stable across both modes — disk sets path with buffer null, memory sets buffer with path null — so a handler branches on whichever is non-null. An invalid storage value is rejected when the middleware is constructed. **Added:** *`bodyParser` multipart `storage: "memory"` — buffer uploads in RAM instead of a tmp directory* — `b.middleware.bodyParser({ multipart: { storage: "memory" } })` buffers each uploaded file part in memory and exposes it as `req.files[].buffer` (a Buffer), with no `os.tmpdir()` write and no tmp-file cleanup — the read-only / serverless path. The default `storage: "disk"` is unchanged: file parts stream to a tmp file, `req.files[].path` points at it, and it is removed when the response finishes. Both modes apply the existing `fileSize` / per-field `maxBytes` / `totalSize` caps and SHA3-512 hash each part during streaming, so memory mode is bounded by the same limits and adds no new DoS surface. The `req.files[]` shape is stable across modes (disk: `path` set, `buffer` null; memory: `buffer` set, `path` null). A `storage` value other than `"disk"` or `"memory"` throws a `TypeError` at construction.
+
+- v0.13.17 (2026-05-27) — **Template engine can render from a string with no views directory — for serverless / read-only filesystems.** b.template.create previously required a viewsDir that exists on disk, and rendering always read the template (and its layout/partials) from that directory — unusable on a read-only or ephemeral serverless filesystem where the templates aren't on disk. The engine now accepts a source string directly: viewsDir is optional, and the returned engine exposes renderString(source, data?, opts?) and compileString(source, opts?) that compile and render from a string with no disk read. {% extends %} and {{> partial}} in a string source resolve through an operator-supplied opts.resolve(name) -> string callback (without it, an extends throws a clear error and a missing partial inlines empty, matching the file path). The same HTML-escaping, expression grammar, and extends/partial-depth caps apply. The file-backed render / compile / precompileAll still work exactly as before when a viewsDir is configured, and now refuse with a clear error when one isn't. **Added:** *`engine.renderString` / `engine.compileString` — render templates from a string, no viewsDir* — `b.template.create({})` (no `viewsDir`) returns a string-only engine; `renderString(source, data?, { resolve })` and `compileString(source, { resolve })` compile and render from a source string with zero filesystem access — the read-only / serverless path. `{% extends %}` and `{{> partial}}` resolve through `opts.resolve(name) -> string`. The HTML escaping, grammar, and depth caps are identical to the file path. When a `viewsDir` IS configured, `render`/`compile`/`precompileAll` behave exactly as before; without one they refuse with `viewsDir not configured`. `renderString(source, { resolve })` may omit the data argument — an opts object carrying a function `resolve` is recognized as opts, not data. **Security:** *Vendored `@simplewebauthn/server` refreshed 13.3.0 → 13.3.1* — The vendored WebAuthn server bundle (`b.auth.passkey`'s registration/authentication verification) is refreshed to the latest upstream patch, with the MANIFEST version, CPE, and SHA-256 integrity hashes updated and the bundle re-verified.
+
 - v0.13.16 (2026-05-27) — **`b.mail.agent` docs now describe the facade accurately, and not-yet-wired verbs point to the primitive to use.** b.mail.agent's module documentation claimed it was "the standardization contract for every mail protocol" that JMAP / IMAP / POP3 all route through — but no protocol server actually dispatches through the agent (the framework's own JMAP EmailSubmission handler composes b.mail.send.deliver directly), and the compose / send / reply / forward, sieve.list / sieve.activate, identity / vacation / mdn.* and export / job / import verbs throw mail-agent/not-implemented. The docs are corrected to describe what the agent is: a mailbox-access facade (RBAC + posture + audit + dispatch around a mail store) whose read surface plus the mailbox-mutation and Sieve-upload methods are wired, with the remaining verbs not yet routed through it. Those verbs' error message now names the underlying primitive to compose directly (b.mail.send.deliver, b.mail.sieve, b.mailMdn, …) instead of citing a version tag that had long passed. The public WIRED_AT export (a method→version map that no longer reflected reality) is replaced by COMPOSE_HINT (a method→primitive-to-compose map). No behaviour change: the same methods are wired or throw exactly as before. **Changed:** *`b.mail.agent` documentation corrected; not-implemented errors point to the primitive to compose* — The `@module` / `@card` no longer claim the agent is the universal protocol-dispatch contract — it's documented as a mailbox-access facade with a wired read + mutation + Sieve-upload surface, and the compose/send/identity/vacation/MDN/export verbs documented as not yet routed through it (compose the underlying primitive directly until a protocol server adopts the agent). The `mail-agent/not-implemented` error now names that primitive (e.g. `b.mail.send.deliver`) rather than a passed version tag. **Removed:** *`b.mail.agent.WIRED_AT` export replaced by `COMPOSE_HINT`* — The `WIRED_AT` export mapped each method to a framework version that was supposed to "light it up" — versions that have all shipped without the wiring, so the map was misleading. It is replaced by `COMPOSE_HINT`, mapping each not-yet-wired method to the primitive an operator composes directly. Operators reading `b.mail.agent.WIRED_AT` should read `b.mail.agent.COMPOSE_HINT` instead (pre-1.0: no compatibility shim).
 
 - v0.13.15 (2026-05-27) — **Corrected more source citations and made deferred/reserved options honest in their docs.** A second accuracy pass over source threat-annotations and option docs. Three citation corrections: the base64url strict-decode guard cited CVE-2022-0235 (which is actually a node-fetch cookie-leak, unrelated) — it now names the weakness class it defends (CWE-347 / CWE-1286 signature canonicalization); the glob consecutive-wildcard ReDoS cap cited the wrong library (the CVE-2026-26996 ReDoS is minimatch, not picomatch — the adjacent picomatch one is CVE-2026-33671); and CVE-2026-32178 is reframed to the CWE-138 header-injection-spoofing class the public record actually documents (and dropped from the end-of-data SMTP-smuggling list, which is a different class). Several options/statuses are now honest about not-yet-implemented surface: b.archive.read.zip.fromTrustedStream is marked experimental (its methods throw and its options aren't honored yet — the example now shows the supported buffer-then-random-access path); b.acme revokeCert's useCertKey / certPrivateKey are marked reserved (the cert-key path throws; account-key signing is the supported default); and a stale message claiming passkey break-glass factors were a future feature is removed (passkeys are a live allowed factor). No runtime behaviour changes beyond message/doc text. **Changed:** *Deferred / reserved surface now documented honestly* — `b.archive.read.zip.fromTrustedStream` is marked `experimental` — its `inspect`/`entries`/`extract` throw and its `bombPolicy`/`audit` options aren't honored yet; the documented example now shows the supported path (buffer the stream, then use the random-access reader). `b.acme` `revokeCert`'s `useCertKey` / `certPrivateKey` options are marked reserved (the cert-key-signed-revocation path throws; account-key signing, the default, covers mainstream CAs). A `b.breakGlass` policy error and comment that called passkey factors a future feature are corrected — passkeys are a live allowed factor. **Fixed:** *Corrected misattributed CVE citations in source threat-annotations* — `b.crypto.fromBase64Url`'s strict-decode guard cited CVE-2022-0235 (a node-fetch header-leak, unrelated to base64/JWT decoding); it now cites the weakness class it actually defends — CWE-347 / CWE-1286 signature canonicalization. `b.guardRegex`'s consecutive-`*` cap attributed CVE-2026-26996 to picomatch; that ReDoS is in minimatch (the picomatch ReDoS it also defends is CVE-2026-33671) — the library name is corrected. CVE-2026-32178 is reframed to the CWE-138 header-injection spoofing class the public advisory documents, and removed from the end-of-data SMTP-smuggling trio (a distinct class). No behaviour change — the defenses are unchanged.

package/lib/vendor/blamejs/README.md

@@ -125,7 +125,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - Rate-limit
   - Security headers with `Permissions-Policy` defaults denying storage-access / browsing-topics / private-aggregation / controlled-frame
   - CSP nonce
-  - Body parser
+  - Body parser — JSON / urlencoded / text / multipart; multipart file parts stream to a tmp dir or buffer in memory (`storage: "memory"`) for read-only / serverless filesystems
   - Compression
   - SSE
   - Request log

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.16",
-  "createdAt": "2026-05-27T16:55:42.429Z",
+  "frameworkVersion": "0.13.18",
+  "createdAt": "2026-05-27T19:22:43.399Z",
   "exports": {
     "a2a": {
       "type": "object",