@blamejs/blamejs-shop 0.2.9 → 0.2.11

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.11 (2026-05-27) — **A clearer checkout — itemised order summary, honest pricing, and recoverable errors.** Reworks the checkout and cart experience. Checkout now uses the same two-column layout as the cart, with a sticky order-summary rail that lists the actual items being bought (thumbnail, title, quantity, line total) rather than a bare number in a lonely column. The summary no longer shows a misleading 'Total' equal to the subtotal — it shows the subtotal plus an honest note that tax and shipping are calculated at the payment step, matching the cart. Adding an item now confirms it and offers to keep shopping, checkout and cart failures render as proper pages you can recover from instead of a blank error string, required fields announce themselves to screen readers, and the header 'Framework' link works from every page. **Changed:** *Checkout shows an itemised, sticky order summary* — The checkout page adopts the cart's two-column layout: the shipping form on the left and a sticky order summary on the right that lists each item (thumbnail, title, quantity, line total) with an 'Edit cart' link back to the cart. Previously the form was a narrow column with a bare subtotal box and no way back. · *Honest checkout pricing* — The order summary no longer renders a 'Total (plus tax + shipping)' line bound to the subtotal value (which read as the final price but wasn't). It now shows the subtotal and the same honest note the cart uses — tax and shipping are calculated at the payment step. · *Add-to-cart confirmation + continue shopping* — Adding an item lands on the cart with a dismissible 'Added to cart' confirmation, and the cart now has a 'Continue shopping' link so multi-item shoppers aren't dead-ended. **Fixed:** *Checkout and cart errors are recoverable, not blank pages* — A declined gift card, an invalid input, or a checkout failure previously dumped an unstyled plain-text error. These now render as styled pages with the reason and a way back — gift-card and loyalty errors re-display the checkout form with the message inline so the shopper can correct it without losing their place. · *Required fields announce to screen readers* — Required form fields kept only a red asterisk (color-only); they now include a visually-hidden '(required)' so assistive technology conveys it. · *Header 'Framework' link works on every page* — It pointed at an on-page anchor that only existed on the home page (a no-op elsewhere); it now resolves from any page.
+
+- v0.2.10 (2026-05-27) — **Accessibility and mobile polish — the cookie bar stops covering the page, and forms behave on phones.** A round of default-theme refinements focused on the cookie consent bar, mobile ergonomics, and accessibility. The consent bar previously floated over page content — on a product page or checkout it could sit on top of the price, variant picker, and the add-to-cart / continue-to-payment button on a first visit. It is now a compact bottom bar that reserves its own space (so nothing important is ever hidden under it), scrolls within itself if the text is long, and receives keyboard focus when it appears. Alongside it: mobile form inputs no longer trigger iOS zoom-on-focus, the header touch targets meet the 44px minimum, inline text links are underlined, and a consistency pass tightened button shapes, table-label typography, and small-screen layout. **Changed:** *Visual consistency pass* — Action buttons share a single corner radius (primary and secondary no longer differ in shape), uppercase micro-labels use the monospace face consistently across tables and forms, the catalog grid shows two columns on small phones instead of one, the hero stat row breathes on narrow screens, and a few dark-theme borders/placeholders that read muddy were moved onto the semantic token palette. **Fixed:** *Cookie consent bar no longer covers page content* — On a first visit the consent bar could overlap the product buy box and the checkout form (the price, variant selector, and primary button). It is now a compact bottom-docked bar that reserves matching space at the foot of the page until a choice is made, caps its height and scrolls internally for long text, and moves keyboard focus to its first control when shown — so the page's primary action is never hidden and the bar is reachable without tabbing the whole page. · *Mobile form inputs no longer zoom on iOS* — Text inputs, selects, and textareas render at a 16px minimum on touch devices, so mobile Safari no longer zooms the viewport when a field is focused (which previously left the page zoomed-in and pannable mid-checkout). · *Header touch targets meet the 44px minimum on mobile* — The account and cart controls in the header — the two primary controls on a phone — are now at least 44×44px. · *Clearer link and prompt-glyph affordances* — Inline text links in body copy are underlined (no longer distinguished by color alone), and the terminal prompt glyph on the dark accent bands renders in full contrast.
+
 - v0.2.9 (2026-05-27) — **Storefront read pages stay fast for every visitor — the cart badge updates client-side.** Restores full edge-render speed for returning and signed-in shoppers. Every storefront read page (home, product listing, search, blog) now renders at the edge for all visitors again; the nav cart badge renders server-side and a tiny client island corrects the number from a new lightweight endpoint. The result: the fast cached page AND an accurate cart count, without sending a shopper-with-a-cart through the slower origin on every page. **Added:** *`GET /cart/count` + a cart-count island* — A new endpoint returns the current session's cart line count as JSON (`{"count": N}`), cached `no-store`, with no product hydration. A small deferred same-origin script (`assets/js/cart-count.js`) reads it on load and updates the nav badge text and its aria-label. A visitor with JavaScript off keeps the server-rendered badge. The script is a same-origin external file, so the existing `script-src 'self'` policy already permits it — no CSP change required. **Fixed:** *Fast read pages for shoppers who have a session* — A visitor carrying a cart or sign-in cookie is once again served the edge-rendered storefront pages instead of being routed to the origin container, so the home page and other read pages load quickly for returning visitors, not just first-time guests. The nav cart count stays correct via the island below.
 
 - v0.2.8 (2026-05-27) — **A complete shipping address at checkout, and an accurate cart count on every page.** Two storefront fixes. Checkout now collects a real, shippable address — a street line, an optional apt/suite line, and a city — alongside the region, postal code, and country it already took; a signed-in customer's default saved address pre-fills the form, the address shows on the order confirmation, and the order export carries it so fulfilment has everything it needs. Separately, the navigation cart badge now shows the correct item count on the catalog, product, search, and blog pages — not only on the cart and account pages — by rendering those pages for a shopper-with-a-cart on the path that can read their session. **Changed:** *Checkout collects a complete shipping address* — The shipping step now takes a street address (line 1, plus an optional apartment / suite / unit line) and a city in addition to the region, postal code, and country it already collected, so a placed order carries an address you can actually ship to. Street line and city are marked required for the common physical-goods path; the server treats them as optional so a digital-only order still completes. A signed-in customer's default saved address pre-fills the form. · *Shipping address on the confirmation page and in the order export* — The order confirmation now shows the ship-to address, and the order CSV / NDJSON export gains `shipping_line1`, `shipping_line2`, and `shipping_city` columns (inserted after `customer_name`) so a fulfilment handoff has the full address. Consumers that key on the header name are unaffected; a consumer that keys on absolute column position should re-map to the 27-column layout. **Fixed:** *Cart count is correct on every page* — The nav cart badge previously read zero on edge-rendered pages (home, product, search, blog) for a shopper who had items in their cart, while the cart and account pages showed the real count. A request that carries a session cookie is now rendered on the path that can unseal the session and read the cart, so the badge is consistent everywhere. Guests — who have no cart — still get the fast cached render with a count of zero, which is correct for them.

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.2.9",
+  "version": "0.2.11",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-6aJfYezHHWR7kgX0foRedjqZg90PP6xrD7oXFim5X2gzV3E3gzZaQTzqgZuCP9eU",
-      "fingerprinted": "css/main.d428a281f9f583d8.css"
+      "integrity": "sha384-8sqFG/ZiALsYtuuzk8cAlSI1exfg9l2UOFs/EmWacVW83DGwOI4g+r29MUCGlKSE",
+      "fingerprinted": "css/main.7f09021a222915e6.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
@@ -18,8 +18,8 @@
       "fingerprinted": "js/cart-count.bfc2eb434b19c00a.js"
     },
     "js/consent.js": {
-      "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",
-      "fingerprinted": "js/consent.517d6ad1fbf106a1.js"
+      "integrity": "sha384-XY3GHA5QDj/Nri03ZO1t7nsr9RGepZuanY45CTpFQnnTorQnygbtAVG4vVGfkNIP",
+      "fingerprinted": "js/consent.59060d7723d050b2.js"
     },
     "js/passkey-login.js": {
       "integrity": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",

package/lib/storefront.js

@@ -186,7 +186,7 @@ var LAYOUT =
   "      </form>\n" +
   "      <nav class=\"site-nav\" aria-label=\"Primary\">\n" +
   "        <a class=\"site-nav__link\" href=\"/\">{{nav_shop}}</a>\n" +
-  "        <a class=\"site-nav__link\" href=\"#framework\">{{nav_framework}}</a>\n" +
+  "        <a class=\"site-nav__link\" href=\"/#framework\">{{nav_framework}}</a>\n" +
   "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"{{nav_account}}\"><svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg></a>\n" +
   "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"{{nav_cart_aria}}\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg><span class=\"cart-pill__count\">{{cart_count}}</span></a>\n" +
   "      </nav>\n" +
@@ -2150,7 +2150,9 @@ function _addrField(name, labelText, value, opts) {
   if (opts.maxlength) attrs += " maxlength=\"" + opts.maxlength + "\"";
   if (opts.pattern) attrs += " pattern=\"" + esc(opts.pattern) + "\"";
   if (opts.autocomplete) attrs += " autocomplete=\"" + esc(opts.autocomplete) + "\"";
-  var req = opts.required ? " <span class=\"form-field__req\" aria-hidden=\"true\">*</span>" : "";
+  // The `*` is a color-only visual cue; pair it with a visually-hidden
+  // "(required)" so a screen reader announces the field's requiredness.
+  var req = opts.required ? " <span class=\"form-field__req\" aria-hidden=\"true\">*</span><span class=\"sr-only\">(required)</span>" : "";
   return "<label class=\"form-field\">" +
            "<span class=\"form-field__label\">" + esc(labelText) + req + "</span>" +
            "<input type=\"text\" name=\"" + esc(name) + "\" value=\"" + esc(value == null ? "" : String(value)) + "\"" + attrs + ">" +
@@ -3382,7 +3384,7 @@ function _checkoutShippingFields(p) {
   var esc = b.template.escapeHtml;
   var email =
     "<label class=\"form-field\">" +
-      "<span class=\"form-field__label\">Email <span class=\"form-field__req\" aria-hidden=\"true\">*</span></span>" +
+      "<span class=\"form-field__label\">Email <span class=\"form-field__req\" aria-hidden=\"true\">*</span><span class=\"sr-only\">(required)</span></span>" +
       "<input type=\"email\" name=\"email\" value=\"" + esc(p.email == null ? "" : String(p.email)) + "\" required autocomplete=\"email\">" +
     "</label>";
   return email +
@@ -3417,6 +3419,12 @@ function _shipToFromBody(body) {
   };
 }
 
+// Checkout mirrors the cart's two-column shell: the shipping form on the
+// left, a sticky order-summary rail on the right. The summary lists the
+// cart line items + the Subtotal, then the cart's exact honest microcopy
+// — tax + shipping can't be computed until the address is entered, so no
+// fabricated "Total" is shown. An "Edit cart" link near the summary lets
+// the shopper change quantities without losing form data.
 var CHECKOUT_PAGE =
   "<section class=\"checkout-page\">\n" +
   "  <header class=\"section-head\">\n" +
@@ -3424,20 +3432,54 @@ var CHECKOUT_PAGE =
   "    <h1 class=\"section-head__title\">Shipping details</h1>\n" +
   "    <p class=\"section-head__lede\">Enter where the order should ship. Payment runs through Stripe on the next step.</p>\n" +
   "  </header>\n" +
-  "  <form method=\"post\" action=\"/checkout\" class=\"form-stack\">\n" +
-  "    RAW_SHIPPING_FIELDS" +
-  "    <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Gift card code <span class=\"small\">(optional)</span></span><input type=\"text\" name=\"gift_card_code\" autocomplete=\"off\" placeholder=\"XXXX-XXXX-XXXX-XXXX\" maxlength=\"24\"></label></div>\n" +
-  "    <div class=\"checkout-summary\">\n" +
-  "      <h3>Order summary</h3>\n" +
-  "      <dl>\n" +
-  "        <div><dt>Subtotal</dt><dd>{{subtotal}}</dd></div>\n" +
-  "        <div class=\"checkout-summary__total\"><dt>Total <span class=\"small\">(plus tax + shipping)</span></dt><dd>{{subtotal}}</dd></div>\n" +
-  "      </dl>\n" +
+  "  <div class=\"cart-page__grid\">\n" +
+  "    <div class=\"checkout-page__form-col\">\n" +
+  "      <form method=\"post\" action=\"/checkout\" class=\"form-stack\">\n" +
+  "        RAW_INLINE_ERROR" +
+  "        RAW_SHIPPING_FIELDS" +
+  "        <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Gift card code <span class=\"small\">(optional)</span></span><input type=\"text\" name=\"gift_card_code\" autocomplete=\"off\" placeholder=\"XXXX-XXXX-XXXX-XXXX\" maxlength=\"24\"></label></div>\n" +
+  "        <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary\">Continue to payment <span aria-hidden=\"true\">→</span></button></div>\n" +
+  "      </form>\n" +
   "    </div>\n" +
-  "    <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary\">Continue to payment <span aria-hidden=\"true\">→</span></button></div>\n" +
-  "  </form>\n" +
+  "    <aside class=\"cart-page__summary\">\n" +
+  "      <div class=\"checkout-page__summary-head\">\n" +
+  "        <h2 class=\"pdp__variants-title\">Order summary</h2>\n" +
+  "        <a href=\"/cart\" class=\"checkout-page__edit-cart\">Edit cart</a>\n" +
+  "      </div>\n" +
+  "      <ul class=\"checkout-page__lines\">RAW_SUMMARY_LINES</ul>\n" +
+  "      <dl class=\"totals-list\">\n" +
+  "        <div class=\"totals-list__grand\"><dt>Subtotal</dt><dd>{{subtotal}}</dd></div>\n" +
+  "      </dl>\n" +
+  "      <p class=\"cart-page__note\">Tax and shipping are calculated on the next step. Payment runs through Stripe.</p>\n" +
+  "    </aside>\n" +
+  "  </div>\n" +
   "</section>\n";
 
+// One order-summary line item in the checkout rail: thumbnail + title +
+// qty + line total, mirroring the cart row but compact. `l` is the raw
+// cart line; `lookup` is the variant_id → { product, hero_media } map the
+// route passes (same shape renderCart uses). Missing lookup entries fall
+// back to the SKU title + a dashed placeholder tile.
+function _checkoutSummaryLine(l, lookup, assetPrefix, fmt) {
+  var esc = b.template.escapeHtml;
+  var match = lookup[l.variant_id] || null;
+  var prod  = match && match.product;
+  var hero  = match && match.hero_media;
+  var title = (prod && prod.title) || l.sku;
+  var lineTotal = fmt(l.line_total_minor || (l.qty * l.unit_amount_minor), l.unit_currency);
+  var thumb = (hero && hero.r2_key)
+    ? "<span class=\"checkout-line__thumb\"><img src=\"" + esc(assetPrefix + hero.r2_key) + "\" alt=\"" + esc(hero.alt_text || title) + "\" loading=\"lazy\"></span>"
+    : "<span class=\"checkout-line__thumb checkout-line__thumb--empty\" aria-hidden=\"true\"></span>";
+  return "<li class=\"checkout-line\">" +
+    thumb +
+    "<span class=\"checkout-line__meta\">" +
+      "<span class=\"checkout-line__title\">" + esc(title) + "</span>" +
+      "<span class=\"checkout-line__qty\">Qty " + esc(String(l.qty)) + "</span>" +
+    "</span>" +
+    "<span class=\"checkout-line__total price\">" + esc(lineTotal) + "</span>" +
+  "</li>";
+}
+
 // Redeem-points-at-checkout field — appended to the checkout form for a
 // signed-in customer with a spendable balance. The customer types how
 // many points to spend; the server caps the credit at the order total
@@ -3465,6 +3507,8 @@ function renderCheckoutForm(opts) {
   var lines  = opts.lines  || [];
   var totals = opts.totals || { subtotal_minor: 0, currency: "USD" };
   var shopName = opts.shop_name || "blamejs.shop";
+  var assetPrefix = opts.asset_prefix || "/assets/";
+  var lookup = opts.product_lookup || {};
   var subtotal = pricing.format(totals.subtotal_minor, totals.currency);
   if (opts.theme) {
     return opts.theme.render("checkout", {
@@ -3475,8 +3519,23 @@ function renderCheckoutForm(opts) {
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
   }
+  // Order-summary line items in the sticky rail — same thumbnail + title
+  // pattern as the cart, compact. Formatted in the order's own currency
+  // (the checkout total is computed server-side; no display-currency
+  // conversion happens at this step).
+  var summaryLines = lines.map(function (l) {
+    return _checkoutSummaryLine(l, lookup, assetPrefix, pricing.format);
+  }).join("");
+  // A coded gift-card / loyalty error from a rejected POST re-renders the
+  // form with the message inline (role="alert") rather than dead-ending on
+  // a separate error page — the shopper fixes the bad code in place.
+  var inlineError = opts.inline_error
+    ? "<p class=\"auth-form__message auth-form__message--err\" role=\"alert\">" + b.template.escapeHtml(String(opts.inline_error)) + "</p>"
+    : "";
   var body = _render(CHECKOUT_PAGE, { subtotal: subtotal })
-    .replace("RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill));
+    .replace("RAW_INLINE_ERROR", inlineError)
+    .replace("RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill))
+    .replace("RAW_SUMMARY_LINES", summaryLines);
   // Signed-in customer with a spendable points balance — surface a
   // redeem-at-checkout field. The block is appended as raw HTML (the
   // balance + value are numbers we control, the conversion ratio is the
@@ -3839,6 +3898,7 @@ var CART_PAGE =
   "      <li aria-current=\"page\">Cart</li>\n" +
   "    </ol>\n" +
   "  </nav>\n" +
+  "RAW_CART_NOTICE" +
   "  <header class=\"section-head\">\n" +
   "    <p class=\"eyebrow\">Your cart</p>\n" +
   "    <h1 class=\"section-head__title\">Review your items</h1>\n" +
@@ -3851,6 +3911,7 @@ var CART_PAGE =
   "          <tbody>{{line_rows}}</tbody>\n" +
   "        </table>\n" +
   "      </div>\n" +
+  "      <a href=\"/\" class=\"btn-ghost cart-page__continue\">← Continue shopping</a>\n" +
   "    </div>\n" +
   "    <aside class=\"cart-page__summary\">\n" +
   "      <h2 class=\"pdp__variants-title\">Order summary</h2>\n" +
@@ -3863,6 +3924,16 @@ var CART_PAGE =
   "  </div>\n" +
   "</section>\n";
 
+// The "added to cart" status banner shown after a POST /cart/lines
+// redirect (`?added=1`). role="status" so a screen reader announces it
+// without stealing focus; the dismiss link drops the query param so a
+// refresh doesn't re-announce. Container-only — the edge serves the
+// cookie-less empty-cart view, never a post-add render.
+var CART_ADDED_NOTICE =
+  "  <p class=\"cart-page__added\" role=\"status\">\n" +
+  "    <span>Added to cart.</span> <a href=\"/cart\">Dismiss</a>\n" +
+  "  </p>\n";
+
 var CART_EMPTY_PAGE =
   "<section class=\"cart-page cart-page--empty\">\n" +
   "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
@@ -3885,6 +3956,40 @@ var CART_EMPTY_PAGE =
   "  </div>\n" +
   "</section>\n";
 
+// Styled, recoverable error page for a cart/checkout dead-end (a bad add,
+// a session that vanished, a non-coded checkout failure). Reuses the
+// cart-empty card so the failure reads as a designed state, not raw text —
+// with the human-readable reason + a recovery link. `opts.reason` is the
+// message, `opts.back_href`/`opts.back_label` the recovery action (default
+// "Back to cart"), and `opts.eyebrow` the kicker (default "Cart").
+function renderCheckoutError(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var shopName  = opts.shop_name || "blamejs.shop";
+  var eyebrow   = opts.eyebrow   || "Cart";
+  var title     = opts.title_text || "Something went wrong";
+  var reason    = opts.reason    || "We couldn't process that request. Your cart is saved — please try again.";
+  var backHref  = opts.back_href  || "/cart";
+  var backLabel = opts.back_label || "Back to cart";
+  var secondary = opts.secondary_href
+    ? " <a href=\"" + esc(opts.secondary_href) + "\" class=\"btn-ghost\">" + esc(opts.secondary_label || "Keep browsing") + "</a>"
+    : " <a href=\"/\" class=\"btn-ghost\">Keep browsing</a>";
+  var body =
+    "<section class=\"cart-page cart-page--empty\"><div class=\"cart-empty\"><div class=\"cart-empty__card\">" +
+      "<p class=\"eyebrow cart-empty__eyebrow\">" + esc(eyebrow) + "</p>" +
+      "<h1 class=\"cart-empty__title\">" + esc(title) + "</h1>" +
+      "<p class=\"cart-empty__lede\">" + esc(reason) + "</p>" +
+      "<div class=\"cart-empty__cta\"><a class=\"btn-primary\" href=\"" + esc(backHref) + "\">" + esc(backLabel) + "</a>" + secondary + "</div>" +
+    "</div></div></section>";
+  return _wrap({
+    title:      opts.title || "Checkout",
+    shop_name:  shopName,
+    theme_css:  opts.theme_css,
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    body:       body,
+  });
+}
+
 function renderCart(opts) {
   if (!opts) throw new TypeError("storefront.renderCart: opts required");
   var lines  = opts.lines  || [];
@@ -3965,11 +4070,15 @@ function renderCart(opts) {
         "      <p class=\"cart-page__note\">Tax and shipping are calculated on the next step. Payment runs through Stripe.</p>\n"
       : "      <button type=\"button\" class=\"btn-primary cart-page__checkout\" disabled aria-disabled=\"true\">Checkout unavailable</button>\n" +
         "      <p class=\"cart-page__note cart-page__note--warn\" role=\"status\">Online checkout isn't set up for this store yet — payments aren't configured. Your cart is saved; please check back soon.</p>\n";
+    // Post-add confirmation banner — rendered only on the `?added=1`
+    // redirect from POST /cart/lines so the shopper gets explicit feedback
+    // their item landed (the audit found the silent 303 left no cue).
+    var notice = opts.added ? CART_ADDED_NOTICE : "";
     body = _render(CART_PAGE, {
       line_rows: "RAW_LINES",
       subtotal:  subtotal,
       total:     total,
-    }).replace("RAW_LINES", rows).replace("RAW_CHECKOUT_CTA", checkoutCta);
+    }).replace("RAW_LINES", rows).replace("RAW_CHECKOUT_CTA", checkoutCta).replace("RAW_CART_NOTICE", notice);
   }
   return _wrap(Object.assign({
     title:      "Cart",
@@ -6302,6 +6411,12 @@ function mount(router, deps) {
   router.get("/cart", async function (req, res) {
     var ccy = await _currencyForReq(req);
     var sid = _readSidCookie(req);
+    // `?added=1` after a POST /cart/lines redirect — drives the
+    // "Added to cart" status banner. Read from the parsed query when the
+    // router populated it, else from the raw URL.
+    var cartUrl = req.url ? new URL(req.url, "http://localhost") : null;
+    var added = (req.query && req.query.added === "1") ||
+      (cartUrl && cartUrl.searchParams.get("added") === "1") || false;
     if (!sid) {
       return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
@@ -6346,6 +6461,7 @@ function mount(router, deps) {
       product_lookup:  productLookup,
       can_save:        !!(deps.saveForLater && deps.customers),
       checkout_available: !!(deps.checkout && deps.order),
+      added:           added,
       shop_name:       shopName,
       theme:           theme,
     }, ccy)));
@@ -6387,20 +6503,26 @@ function mount(router, deps) {
   }
 
   if (deps.checkout && deps.order) {
-    router.get("/checkout", async function (req, res) {
-      var sid = _readSidCookie(req);
-      if (!sid) return _send(res, 303, "<a href=\"/cart\">Cart is empty</a>"), res.setHeader && res.setHeader("location", "/cart");
-      var c = await deps.cart.bySession(sid);
-      if (!c) {
-        res.status(303); res.setHeader && res.setHeader("location", "/cart");
-        return res.end ? res.end() : res.send("");
-      }
-      var lines = await deps.cart.listLines(c.id);
-      if (!lines.length) {
-        res.status(303); res.setHeader && res.setHeader("location", "/cart");
-        return res.end ? res.end() : res.send("");
-      }
+    // Build the renderCheckoutForm() opts for an active cart `c`: repriced
+    // lines, totals, the thumbnail lookup, and the signed-in customer's
+    // loyalty balance + prefill. Shared by the GET handler and the POST
+    // catch (so a rejected gift-card / loyalty code re-renders the same
+    // form inline instead of dead-ending). `inlineError` is the optional
+    // message to surface at the top of the form.
+    async function _checkoutRenderOpts(req, c, lines, inlineError) {
       var totals = pricing.totals(c, lines, {});
+      // variant_id → { product, hero_media } lookup for the summary
+      // thumbnails + titles — same shape (and caching) the cart route uses.
+      var checkoutLookup = {};
+      for (var li = 0; li < lines.length; li += 1) {
+        var lvId = lines[li].variant_id;
+        if (checkoutLookup[lvId]) continue;
+        var lv = await deps.catalog.variants.get(lvId);
+        if (!lv) { checkoutLookup[lvId] = null; continue; }
+        var lprod = await deps.catalog.products.get(lv.product_id);
+        var lmedia = await deps.catalog.media.listForProduct(lv.product_id);
+        checkoutLookup[lvId] = { product: lprod, hero_media: lmedia.length ? lmedia[0] : null };
+      }
       // A signed-in customer drives two best-effort lookups, both keyed
       // off the same auth env: the loyalty balance (for the redeem field)
       // and the default shipping address (to pre-fill the form). Either
@@ -6438,24 +6560,54 @@ function mount(router, deps) {
           }
         } catch (_e) { prefill = null; }
       }
-      _send(res, 200, renderCheckoutForm({
+      return {
         lines: lines, totals: totals, shop_name: shopName, theme: theme,
+        product_lookup: checkoutLookup,
         paypal_client_id: deps.paypal ? deps.paypal_client_id : null,
         loyalty_balance: loyaltyBalance,
         loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
         prefill: prefill,
-      }));
+        inline_error: inlineError || null,
+      };
+    }
+
+    router.get("/checkout", async function (req, res) {
+      var sid = _readSidCookie(req);
+      if (!sid) return _send(res, 303, "<a href=\"/cart\">Cart is empty</a>"), res.setHeader && res.setHeader("location", "/cart");
+      var c = await deps.cart.bySession(sid);
+      if (!c) {
+        res.status(303); res.setHeader && res.setHeader("location", "/cart");
+        return res.end ? res.end() : res.send("");
+      }
+      var rawLines = await deps.cart.listLines(c.id);
+      if (!rawLines.length) {
+        res.status(303); res.setHeader && res.setHeader("location", "/cart");
+        return res.end ? res.end() : res.send("");
+      }
+      // Reprice the lines through the active quantity-break (same as the
+      // cart page) so the summary's per-line totals + subtotal match what
+      // the shopper saw on /cart.
+      var lines = await _repriceCartLines(rawLines);
+      _send(res, 200, renderCheckoutForm(await _checkoutRenderOpts(req, c, lines, null)));
     });
 
     router.post("/checkout", async function (req, res) {
       var body = req.body || {};
       var sid = _readSidCookie(req);
       if (!sid) {
-        res.status(400); return res.end ? res.end("No session") : res.send("No session");
+        return _send(res, 400, renderCheckoutError({
+          shop_name: shopName, theme: theme, eyebrow: "Checkout",
+          title_text: "Your session expired",
+          reason: "We couldn't find an active cart session. Open your cart and continue from there.",
+        }));
       }
       var c = await deps.cart.bySession(sid);
       if (!c) {
-        res.status(400); return res.end ? res.end("No cart") : res.send("No cart");
+        return _send(res, 400, renderCheckoutError({
+          shop_name: shopName, theme: theme, eyebrow: "Checkout",
+          title_text: "Your cart couldn't be found",
+          reason: "We couldn't find an active cart for this session. Open your cart and continue from there.",
+        }));
       }
       // Defensive cart-state guard — if the cart has already been
       // converted (e.g. duplicate-submit on POST refresh), redirect
@@ -6509,10 +6661,33 @@ function mount(router, deps) {
         // GIFTCARD_* code and the loyalty errors a LOYALTY_* code so a
         // fat-fingered value re-prompts rather than 500-ing checkout.
         var code = (e && typeof e.code === "string") ? e.code : "";
-        var clientErr = (e instanceof TypeError) || code.indexOf("GIFTCARD_") === 0 || code.indexOf("LOYALTY_") === 0;
-        res.status(clientErr ? 400 : 500);
         var msg = (e && e.message) || "checkout failed";
-        return res.end ? res.end(msg) : res.send(msg);
+        // A coded gift-card / loyalty error is something the shopper can
+        // fix in place — re-render the checkout form with the message
+        // inline (preserving the cart + their prefilled fields where
+        // possible) rather than dead-ending on a separate page.
+        if (code.indexOf("GIFTCARD_") === 0 || code.indexOf("LOYALTY_") === 0) {
+          try {
+            var coLines = await _repriceCartLines(await deps.cart.listLines(c.id));
+            if (coLines.length) {
+              return _send(res, 400, renderCheckoutForm(await _checkoutRenderOpts(req, c, coLines, msg)));
+            }
+          } catch (_re) { /* fall through to the styled error page */ }
+        }
+        // A malformed address shape (TypeError) is still the shopper's to
+        // fix; anything else is a server-side failure. Either way, render a
+        // styled, recoverable page rather than raw text — back to the cart,
+        // or back to the shipping form to re-enter the address.
+        var clientErr = (e instanceof TypeError);
+        return _send(res, clientErr ? 400 : 500, renderCheckoutError({
+          shop_name: shopName, theme: theme, eyebrow: "Checkout",
+          title_text: clientErr ? "We couldn't process your shipping details" : "Checkout didn't go through",
+          reason: clientErr
+            ? "Some shipping details couldn't be read: " + msg + " Go back and check the address fields."
+            : "Something went wrong completing your order. Your cart is saved — please try again. (" + msg + ")",
+          back_href: "/checkout", back_label: "Edit shipping",
+          secondary_href: "/cart", secondary_label: "Back to cart",
+        }));
       }
     });
 
@@ -8510,18 +8685,32 @@ function mount(router, deps) {
     var qtyRaw    = body.qty;
     var qty       = parseInt(qtyRaw, 10);
     if (!variantId || !Number.isFinite(qty) || qty < 1 || qty > 99) {
-      res.status(400);
-      return res.end ? res.end("Invalid request") : res.send("Invalid request");
+      return _send(res, 400, renderCheckoutError({
+        shop_name: shopName, theme: theme,
+        title_text: "We couldn't add that item",
+        reason: "The product or quantity in that request wasn't valid. Pick the item again from its page.",
+        back_href: "/cart", back_label: "Back to cart",
+      }));
     }
     var resolved = await _getOrCreateCart(req, res, "USD");
     try {
       await deps.cart.addLine(resolved.cart.id, { variant_id: variantId, qty: qty });
     } catch (e) {
-      res.status(e instanceof TypeError ? 400 : 500);
-      return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+      var addMsg = (e && e.message) || "Error";
+      return _send(res, e instanceof TypeError ? 400 : 500, renderCheckoutError({
+        shop_name: shopName, theme: theme,
+        title_text: "We couldn't add that item",
+        reason: (e instanceof TypeError)
+          ? "That item couldn't be added: " + addMsg
+          : "Something went wrong adding that item to your cart. Please try again.",
+        back_href: "/cart", back_label: "Back to cart",
+      }));
     }
+    // `?added=1` so the cart page can confirm the item landed (the page
+    // surfaces an "Added to cart" status banner). Still a 303 so a refresh
+    // re-issues the GET, not the POST.
     res.status(303);
-    res.setHeader && res.setHeader("location", "/cart");
+    res.setHeader && res.setHeader("location", "/cart?added=1");
     res.end ? res.end() : res.send("");
   });
 
@@ -8985,6 +9174,7 @@ module.exports = {
   renderProduct:         renderProduct,
   renderCart:            renderCart,
   renderCheckoutForm:    renderCheckoutForm,
+  renderCheckoutError:   renderCheckoutError,
   renderGiftCardBalance: renderGiftCardBalance,
   renderPayPage:         renderPayPage,
   renderOrder:           renderOrder,

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.19",
-      "tag": "v0.13.19",
+      "version": "0.13.22",
+      "tag": "v0.13.22",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-27"
+      "bundledAt": "2026-05-28"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,12 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.22 (2026-05-27) — **`b.archive.read.zip.fromTrustedStream` reads a ZIP from a Readable — no longer an experimental stub.** fromTrustedStream was an experimental stub whose inspect / entries / extract methods threw, forcing callers to buffer the stream themselves and use the random-access reader. It now works, with the same shape as the tar trusted-stream reader: pass b.archive.adapters.trustedStream(readable) and the bytes are collected into a size-capped buffer (1 GiB hard ceiling) and read through the same bomb-cap, path-traversal, and entry-type decode as the random-access reader — so bombPolicy, guardProfile, entryTypePolicy, and audit all apply, and inspect / entries / extract / extractEntries all return data. This is a bounded-memory reader (the archive is held in memory under the ceiling), not zero-buffer streaming; a future forward-inflate walker shared with the tar reader would lift the ceiling. **Added:** *`b.archive.read.zip.fromTrustedStream` now reads — `inspect` / `entries` / `extract` / `extractEntries`* — The ZIP trusted-stream reader is implemented (was an experimental stub that threw). Pass `b.archive.adapters.trustedStream(readable)` to read a ZIP straight from a Node Readable without buffering it yourself. The stream is collected into a size-capped buffer (1 GiB ceiling, matching `b.archive.read.tar`'s trusted-stream reader) and decoded through the same adversarial-safe path as the random-access reader, so `bombPolicy` / `guardProfile` / `entryTypePolicy` / `audit` are honored on decode. Adversarial archives remain fully bomb-capped; "trusted" refers only to the source-size bound. A non-trusted-stream adapter is refused with `archive-read/bad-adapter`.
+
+- v0.13.21 (2026-05-27) — **`b.cose.exportKey` — serialize a public key as a COSE_Key, the inverse of `b.cose.importKey`.** b.cose could import a COSE_Key (RFC 9052 §7) into a node:crypto key for verification, but had no way to produce one — so a key used with b.cose.sign could not be shipped to a verifier in COSE form without hand-building the CBOR map. b.cose.exportKey(keyObject, opts?) closes the round-trip: it serializes an EC2 (P-256 / P-384 / P-521) or OKP (Ed25519) public key as the CBOR-encoded COSE_Key map, with optional alg and kid common parameters. A private key has its public half exported; unsupported curves / key types are refused rather than emitting a COSE_Key no verifier here would accept. The bytes round-trip through b.cose.importKey, and feed the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths. **Added:** *`b.cose.exportKey(keyObject, { alg?, kid? })` — KeyObject → COSE_Key (RFC 9052 §7)* — Serialize a `node:crypto` public key as the CBOR-encoded COSE_Key map — the inverse of `b.cose.importKey`. Supports EC2 (P-256 / P-384 / P-521) and OKP (Ed25519), the same key types `b.cose.verify` accepts; `opts.alg` (e.g. `"ES256"`) and `opts.kid` populate the COSE_Key alg (label 3) and kid (label 2) common parameters. A private key exports its public half; unsupported curves / key types throw rather than producing a COSE_Key no verifier would accept. `b.cose.importKey(b.cbor.decode(exportKey(k)))` round-trips, so a key signed with `b.cose.sign` can be shipped to a verifier as bytes — the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths.
+
+- v0.13.20 (2026-05-27) — **`b.archive.wrap` can seal an archive for a tenant with no key-pair to manage — `recipient: "tenant"`.** b.archive.wrap previously sealed only to an explicit hybrid-PQC key-pair or a peer certificate; the documented recipient: "tenant" strategy threw. It now works: pass { recipient: "tenant", tenantId } and the archive is sealed under a deterministic per-tenant key derived from the vault root (SHAKE256 KDF) with XChaCha20-Poly1305, the tenant id mixed into the AEAD additional-authenticated-data so one tenant's envelope cannot be opened under another tenant's key. There is no recipient key-pair for the operator to generate, store, or rotate — b.archive.unwrap re-derives the key from the same tenantId. Rotating the vault re-keys every tenant (rotation intent is re-seal). The derivation is exposed directly as b.agent.tenant.derivedKey(tenantId, purpose) for operators who need the raw per-tenant key for their own AEAD. Requires an initialized vault. **Added:** *`b.archive.wrap` / `b.archive.unwrap` `recipient: "tenant"` — per-tenant archive sealing, no key-pair* — `b.archive.wrap(bytes, { recipient: "tenant", tenantId })` seals under a deterministic per-tenant key derived from the vault root with XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha-03) and a SHAKE256 KDF (FIPS 202); the tenant id is bound into the AEAD AAD so a tenant-A envelope cannot decrypt under tenant-B's key even if an attacker swaps envelope headers. `b.archive.unwrap(sealed, { recipient: "tenant", tenantId })` (or just `{ tenantId }`) re-derives the key and recovers the bytes — no recipient key-pair to manage. The tenant envelope carries a distinct version byte so it is never fed to the hybrid-KEM decrypt path. The static-key and peer-cert recipient strategies are unchanged. · *`b.agent.tenant.derivedKey(tenantId, purpose)` — direct per-tenant key derivation* — The deterministic, domain-separated per-tenant key derivation (vault root + tenantId + purpose, SHAKE256, NUL-separated) is now exported at the module level, returning a 64-char hex key. Previously reachable only as a method on a created tenant manager; operators who need the raw key for their own AEAD can now call it directly. Throws if the vault is not initialized.
+
 - v0.13.19 (2026-05-27) — **`auditTools` export / archive / forensic-snapshot can return the bundle as bytes — no output directory for serverless / read-only filesystems.** b.auditTools.exportSlice, b.auditTools.archive, and b.auditTools.forensicSnapshot required an `out` directory to write the encrypted bundle (rows.enc + optional checkpoint.enc + manifest.json), which is unusable on a read-only or ephemeral serverless filesystem. Each now accepts `returnBytes: true` instead of `out` and returns the bundle as an in-memory `{ filename: Buffer }` map — ready to stream to object storage or over the wire with no filesystem access. `out` and `returnBytes` are mutually exclusive. The on-disk path is unchanged. The bundle's encryption (XChaCha20-Poly1305 + Argon2id), chain-proof material, and manifest checksums are identical to the written bundle, so an in-memory bundle written to disk verifies exactly as one produced by the `out` path. **Added:** *`returnBytes` on `auditTools.exportSlice` / `archive` / `forensicSnapshot` — in-memory bundles* — Pass `returnBytes: true` (and omit `out`) to get the encrypted audit bundle as an in-memory `{ filename: Buffer }` map instead of a directory write — the read-only / serverless path. `exportSlice` / `archive` return `{ manifest, files, rowCount, range }`; `forensicSnapshot` returns `{ ...manifest, files }` where `files` carries the slice's `rows.enc` + `manifest.json` plus the `forensic-snapshot.json` incident wrapper. The encryption, chain proof, and manifest checksums match the on-disk bundle byte-for-byte, so the bytes verify with `verifyBundle` once written out. `out` and `returnBytes` are mutually exclusive (passing both throws). **Fixed:** *`auditTools.forensicSnapshot` now honors the `since` window instead of capturing the entire audit history* — `forensicSnapshot` passed its `since` bound to the slice exporter under the wrong option name, so the time filter was silently dropped and the snapshot bundled every audit row regardless of `since`. The window is now applied — a snapshot scoped to an incident window contains only that window's rows. The snapshot manifest's `auditSliceFile` field, previously always undefined, now records the slice location.
 
 - v0.13.18 (2026-05-27) — **`bodyParser` multipart can buffer uploads in memory — no tmp directory for serverless / read-only filesystems.** The multipart/form-data sub-parser previously streamed every file part to a tmp directory on disk (os.tmpdir() by default), which fails on a read-only or ephemeral serverless filesystem. A new multipart.storage option selects where file parts land: "disk" (default, unchanged — req.files[].path points at a tmp file cleaned up on response end) or "memory" (req.files[].buffer holds the assembled bytes, with no filesystem access at all). Both modes enforce the same per-file (fileSize), per-field, and total-request (totalSize) caps, so memory mode adds no new memory-exhaustion surface. The file object shape is stable across both modes — disk sets path with buffer null, memory sets buffer with path null — so a handler branches on whichever is non-null. An invalid storage value is rejected when the middleware is constructed. **Added:** *`bodyParser` multipart `storage: "memory"` — buffer uploads in RAM instead of a tmp directory* — `b.middleware.bodyParser({ multipart: { storage: "memory" } })` buffers each uploaded file part in memory and exposes it as `req.files[].buffer` (a Buffer), with no `os.tmpdir()` write and no tmp-file cleanup — the read-only / serverless path. The default `storage: "disk"` is unchanged: file parts stream to a tmp file, `req.files[].path` points at it, and it is removed when the response finishes. Both modes apply the existing `fileSize` / per-field `maxBytes` / `totalSize` caps and SHA3-512 hash each part during streaming, so memory mode is bounded by the same limits and adds no new DoS surface. The `req.files[]` shape is stable across modes (disk: `path` set, `buffer` null; memory: `buffer` set, `path` null). A `storage` value other than `"disk"` or `"memory"` throws a `TypeError` at construction.

package/lib/vendor/blamejs/README.md

@@ -141,7 +141,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **JSON / SQL / schema** — `b.safeJson` (with `maxKeys` cap defending CVE-2026-21717 V8 HashDoS), `b.safeBuffer`, `b.safeSql`, `b.safeSchema`
 - **URL + path** — `b.safeUrl` (IDN mixed-script / homograph refuse); `b.safeJsonPath` (refuses filter `?(...)`, deep-scan `$..`, script-shape `(@.x)` for safe Postgres JSONB ops)
 - **Binary codec** — `b.cbor` bounded deterministic CBOR (RFC 8949 §4.2): depth/size caps, indefinite-length + reserved-info + tag + duplicate-key refusal, `requireDeterministic` canonical-form check; the in-tree substrate under COSE / CWT / SCITT / WebAuthn attestation
-- **COSE messages** — `b.cose` the full RFC 9052 message-type set over `b.cbor`: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus `importKey` (COSE_Key → KeyObject). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PA
+- **COSE messages** — `b.cose` the full RFC 9052 message-type set over `b.cbor`: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus `importKey` (COSE_Key → KeyObject) and `exportKey` (KeyObject → COSE_Key, the inverse — ship a verification key as RFC 9052 §7 bytes). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PA
 - **CBOR Web Token** — `b.cwt` CWT sign/verify (RFC 8392) over `b.cose`: standard-claim mapping (iss/sub/aud/exp/nbf/iat/cti) + `exp`/`nbf` clock-skew enforcement + `iss`/`aud` matching; the CBOR-native JWT for constrained / IoT / FIDO / verifiable-credential contexts
 - **Entity Attestation Token** — `b.eat` EAT sign/verify (RFC 9711) over `b.cwt`: device + software attestation claims (ueid / oemid / hwmodel / measurements / submods) with verifier-nonce freshness binding, `dbgstat` debug-status policy, and `eat_profile` pinning
 - **SCITT signed statements** — `b.scitt` sign/verify a signed, attributable claim about an artifact (signed SBOM, build attestation, release approval) over `b.cose`: the issuer + subject bind in the integrity-protected CWT_Claims header (RFC 9597); verification refuses any statement missing the iss/sub binding. The issuer side, on finalized RFCs; the transparency receipt (COSE Receipts draft) opts in on publication
@@ -228,7 +228,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`)
 - **CSV** — RFC 4180 with Excel formula-injection prevention (`b.csv`)
 - **IDs + slugs** — RFC 9562 UUID v4 + v7 (`b.uuid`); URL-safe slugs (`b.slug`)
-- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
+- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`); recipient-sealed envelopes — hybrid-PQC key-pair, peer certificate, or per-tenant key with no key-pair to manage (`b.archive.wrap({ recipient: "tenant", tenantId })`)
 - **Pagination + forms** — HMAC-signed cursor pagination (`b.pagination`); HTML form rendering + validation + CSRF (`b.forms`)
 
 ### Production

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.19",
-  "createdAt": "2026-05-27T20:32:29.864Z",
+  "frameworkVersion": "0.13.22",
+  "createdAt": "2026-05-27T23:32:55.833Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -992,6 +992,10 @@
               "type": "function",
               "arity": 1
             },
+            "derivedKey": {
+              "type": "function",
+              "arity": 2
+            },
             "guards": {
               "type": "object",
               "members": {
@@ -13663,6 +13667,10 @@
           "type": "function",
           "arity": 2
         },
+        "exportKey": {
+          "type": "function",
+          "arity": 2
+        },
         "importKey": {
           "type": "function",
           "arity": 1