@blamejs/blamejs-shop 0.3.15 → 0.3.17

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.17 (2026-05-30) — **Search results paginate with an accurate count, and collection pages get canonical URLs.** Two customer-facing storefront fixes. Search no longer stops at the first 24 products: the result count now reports the true number of matches instead of the page size, and numbered page links (with prev/next) make every matching product reachable while preserving the active query and filters. Separately, collection pages now emit a correct canonical and og:url so search engines and shared links resolve to one address, while the cart and account pages — which should not be indexed — are explicitly marked noindex. **Fixed:** *Search shows the real match count and paginates* — The search results page previously capped at 24 products, discarded the real total, and reported the page size as the match count — so anything past the first 24 was unreachable and the count was wrong. It now computes the true total, shows it in the "Showing N matches" summary, and adds no-JavaScript numbered page links (with prev/next) that carry the active query and facet filters, so every matching product can be reached. · *Collection pages have canonical URLs; cart and account are noindex* — Collection pages now emit an absolute canonical and og:url derived from the request host, so indexers and shared links resolve to a single address instead of an empty tag. The cart and account pages, which are not meant to be indexed, now carry a noindex robots tag in their markup, consistent on both the edge and container render paths.
+
+- v0.3.16 (2026-05-30) — **Uploaded SVGs are sanitized, and product images can be reordered with a chosen primary.** Two things for product media in the admin console. First, when an SVG image is uploaded it now passes through a strict sanitizer: an SVG that carries script or other active content is repaired, or refused outright when it can't be made safe, so a stored image can't become a script-execution vector. Second, a product's images can now be reordered and any image promoted to the primary (hero) slot directly from the console — previously the order was fixed at attach time and the first-attached image was always the hero. The primary image is the one shown first on the product page. **Added:** *Reorder product images and set the primary from the console* — Each image on a product now has a "Make primary" control that moves it to the hero slot shown first on the product page, and a reorder control sets the full order. Both are no-JavaScript form actions. The product page renders images in this order, so changing it here changes what shoppers see first. **Changed:** *Vendored runtime updated to v0.14.8* — The vendored blamejs runtime is updated to v0.14.8, an internal source-comment and lint-hygiene release with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Uploaded SVG images are sanitized or refused* — An uploaded SVG is now checked by a strict sanitizer before it is stored: active content (scripts, event handlers, external references) is stripped, and an SVG that cannot be made safe is rejected with a clear error and never written. This closes the path where a crafted SVG, once stored and served, could execute script. Raster image uploads (PNG, JPEG, WebP, GIF) are unaffected.
+
 - v0.3.15 (2026-05-30) — **Product image galleries are interactive — click a thumbnail to view that image full size.** A product page's image gallery now lets a shopper switch between the product's images: clicking a thumbnail swaps the main image, with no JavaScript required. Previously the thumbnail strip was decorative — the additional images were unreachable, a single-image product showed empty placeholder slots, and only the first four images were shown. Now the main image stacks the product's images and the thumbnails are real, keyboard-accessible controls that select which one is shown; a product with one image shows just that image (no empty slots), and the four-image cap is raised to twelve so far more images are reachable. The picker is pure HTML and CSS, so it works without scripting and degrades cleanly. **Fixed:** *The product image gallery actually switches images now* — Thumbnails on the product page are now interactive: selecting one shows that image as the main image, using a no-JavaScript radio/label control. The empty placeholder slots a single-image product used to show are gone, the four-image cap is raised to twelve so far more images are reachable, and the strip is keyboard-navigable with accessible labels. The edge and container renderers emit identical markup.
 
 - v0.3.14 (2026-05-30) — **Drop the inert Document-Policy header that only produced browser warnings.** Container-rendered pages were sending a Document-Policy response header whose feature tokens (document-write, unsized-media, oversized-images) are no longer recognized by current browsers — so it enforced nothing while making the browser log a warning for each token on every page. The header is now omitted; every other security header (Content-Security-Policy, Permissions-Policy, HSTS, X-Frame-Options, the COOP/CORP set, and the rest) is unchanged. The edge and container paths now agree — neither sends Document-Policy — closing a header-parity gap. **Fixed:** *No more Document-Policy console warnings* — The Document-Policy header is no longer emitted on container-rendered pages. Its tokens were rejected by current browsers (the policy applied nothing and logged a warning per token on every page), so the header is dropped rather than shipped inert; the full set of other security headers is retained unchanged. Edge and container responses are now consistent.

package/lib/admin.js

@@ -1200,6 +1200,43 @@ function mount(router, deps) {
     // caller renders the problem.
     async function _storeAndAttach(buf, contentType, body) {
       var declared = String(contentType).split(";")[0].trim().toLowerCase();
+      // SVG is text — magic-byte sniffing can't classify it, so the type
+      // gate trusts the declared `image/svg+xml`. An SVG served same-origin
+      // from the media bucket is a stored-XSS vector on direct navigation
+      // (embedded <script>, on* handlers, javascript: URLs, foreignObject
+      // namespace escapes). Run the bytes through the framework's SVG guard
+      // before they reach the bucket: `refuse` (an unrepairable threat —
+      // <script>, DOCTYPE/XXE, SVGZ) is an operational failure the caller
+      // renders as a clean 4xx with no row written; `sanitize` stores the
+      // repaired bytes; `serve` stores the (clean) original. Composes the
+      // vendored b.guardSvg — never a hand-rolled SVG allowlist.
+      if (declared === "image/svg+xml") {
+        var verdict;
+        try {
+          verdict = await b.guardSvg.gate({ profile: "strict" }).check({ bytes: buf });
+        } catch (_e) {
+          return { status: 422, code: "svg-unsafe",
+            detail: "the uploaded SVG could not be validated as safe to serve" };
+        }
+        if (!verdict || verdict.action === "refuse") {
+          return { status: 422, code: "svg-unsafe",
+            detail: "the uploaded SVG carries active content that can't be served safely (scripts, external entities, or a compressed payload)" };
+        }
+        if (verdict.action === "sanitize") {
+          // The guard hands back the repaired bytes as a Buffer (the gate
+          // contract) — or, defensively, a string. Anything else is a guard
+          // malfunction; fail closed rather than store unvalidated bytes.
+          var clean = verdict.sanitized;
+          if (Buffer.isBuffer(clean)) {
+            buf = clean;
+          } else if (typeof clean === "string") {
+            buf = Buffer.from(clean, "utf8");
+          } else {
+            return { status: 422, code: "svg-unsafe",
+              detail: "the uploaded SVG could not be sanitized into safe-to-serve bytes" };
+          }
+        }
+      }
       var ext = _extFromContentType(declared);
       var id  = b.uuid.v7();
       var key = "media/" + id + (ext ? "." + ext : "");
@@ -1432,6 +1469,76 @@ function mount(router, deps) {
     },
   ));
 
+  // Reorder a product's media. The PDP gallery renders the media in list
+  // order with the first row as the hero, so this is "rearrange the gallery
+  // + choose which image leads." Browser form posts the full ordered id set
+  // as a comma-joined `ordered_media_ids` string (same convention as the
+  // collections-members reorder); the JSON API accepts an array. The
+  // primitive rewrites `position` to 0..N-1 and refuses a partial / foreign
+  // set (TypeError → clean 400 / ?err=1). DB-only — no R2 bridge needed.
+  router.post("/admin/products/:id/media/reorder", _pageOrApi(false,
+    W("media.reorder", async function (req, res) {
+      var body = req.body || {};
+      var ids = Array.isArray(body.ordered_media_ids) ? body.ordered_media_ids : null;
+      if (!ids || ids.length === 0) return _problem(res, 400, "bad-request", "ordered_media_ids array required");
+      try { await catalog.media.reorder(req.params.id, ids); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      // The reorder form posts a single comma-joined id field; also accept
+      // repeated ordered_media_id rows for parity with the collections form.
+      var ids;
+      if (body.ordered_media_ids != null && typeof body.ordered_media_ids === "string") {
+        ids = body.ordered_media_ids.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+      } else {
+        var raw = body.ordered_media_id;
+        var rows = raw == null ? [] : (Array.isArray(raw) ? raw : [raw]);
+        ids = rows.map(function (s) { return String(s).trim(); }).filter(Boolean);
+      }
+      if (!ids.length) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      try { await catalog.media.reorder(id, ids); }
+      catch (e) {
+        _safeNotice(e, "media.reorder");
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.reorder", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
+  // Promote one media row to the hero slot (position 0). No body — the media
+  // id is in the path, the product id only used to PRG back to the detail.
+  // A malformed id throws TypeError (→ 400 / ?err=1); an unknown or
+  // variant-only row returns false (→ 404 / ?err=1). DB-only.
+  router.post("/admin/products/:id/media/:mid/primary", _pageOrApi(false,
+    W("media.set_primary", async function (req, res) {
+      var ok;
+      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!ok) return _problem(res, 404, "media-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.mid };
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var ok = false;
+      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      catch (e) {
+        _safeNotice(e, "media.set_primary");
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      if (!ok) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.set_primary", outcome: "success", metadata: { id: req.params.mid } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   // ---- bulk catalog import --------------------------------------------
 
   // POST /admin/catalog/import — Content-Type: text/csv body. The CSV
@@ -9658,24 +9765,50 @@ function renderAdminProduct(opts) {
   var variantsSection = "<section class=\"mt\"><h3 class=\"fs-105\">Variants</h3>" + variantsBody + addVariant + "</section>";
 
   // ---- media -----------------------------------------------------------
-  var mediaCards = mediaRows.map(function (m) {
+  var mediaCards = mediaRows.map(function (m, idx) {
     var mid = _htmlEscape(m.id);
     var url = assetPrefix + m.r2_key;
     var isImage = /^image\//.test(m.content_type || "");
     var thumb = isImage
       ? "<img class=\"media-thumb\" src=\"" + _htmlEscape(url) + "\" alt=\"" + _htmlEscape(m.alt_text || "") + "\" loading=\"lazy\">"
       : "<span class=\"media-thumb media-thumb--file\">" + _htmlEscape((m.content_type || "file").split("/")[0]) + "</span>";
+    // The first row is the hero shown on the product page — mark it with a
+    // pill; every other row offers a "Make primary" form that promotes it to
+    // position 0 (the CSRF field is injected into the form by the shell).
+    var makePrimary = (idx === 0)
+      ? "<span class=\"status-pill paid\">Primary</span>"
+      : "<form method=\"post\" action=\"/admin/products/" + pid + "/media/" + mid + "/primary\" class=\"form-inline\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Make primary</button></form>";
     return "<div class=\"media-card\">" +
       thumb +
       "<code class=\"order-id\">" + _htmlEscape(m.r2_key) + "</code>" +
       "<span class=\"u-mute\">" + _htmlEscape(m.content_type || "") + (m.alt_text ? " · " + _htmlEscape(m.alt_text) : "") + "</span>" +
-      "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+      "<div class=\"actions-row mt-0\">" + makePrimary +
+        "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+      "</div>" +
     "</div>";
   }).join("");
   var mediaGrid = mediaRows.length
     ? "<div class=\"media-grid\">" + mediaCards + "</div>"
     : "<p class=\"empty\">No media attached yet.</p>";
 
+  // Reorder: a single field of the current media ids, comma-joined, that the
+  // operator rewrites into the new order. No-JS-required and v1-defensible
+  // — the primitive normalises positions to 0..N-1 and the first row is the
+  // hero. Only shown when there's more than one image to order.
+  var currentMediaIds = mediaRows.map(function (m) { return m.id; }).join(",");
+  var mediaReorderForm = mediaRows.length > 1
+    ? "<div class=\"panel mt-1 mw-40\">" +
+        "<h3 class=\"subhead\">Reorder images</h3>" +
+        "<p class=\"meta\">The first image is the hero shown on the product page. Rewrite the comma-separated id list into the order you want — list every current image.</p>" +
+        "<form method=\"post\" action=\"/admin/products/" + pid + "/media/reorder\">" +
+          "<label class=\"form-field\"><span>Ordered media ids</span>" +
+            "<input type=\"text\" name=\"ordered_media_ids\" value=\"" + _htmlEscape(currentMediaIds) + "\"></label>" +
+          "<div class=\"actions-row\"><button class=\"btn btn--ghost\" type=\"submit\">Apply order</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
   var attachForm =
     "<div class=\"panel mt-1 mw-40\">" +
       "<h3 class=\"subhead\">Attach media by R2 key</h3>" +
@@ -9716,7 +9849,7 @@ function renderAdminProduct(opts) {
       "</div>"
     : "";
 
-  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + fileUploadForm + attachForm + uploadForm + "</section>";
+  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + mediaReorderForm + fileUploadForm + attachForm + uploadForm + "</section>";
 
   // ---- head + assembly -------------------------------------------------
   var statusCls = p.status === "active" ? "paid" : (p.status === "archived" ? "refunded" : "pending");

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.15",
+  "version": "0.3.17",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/catalog.js

@@ -8,10 +8,11 @@
  *   Five sub-modules:
  *
  *   - `products`   — create, get, bySlug, list, update, archive, restore
- *   - `variants`   — create, get, listForProduct, update, delete, reorder
+ *   - `variants`   — create, get, listForProduct, update, delete
  *   - `prices`     — set (versioned), current, history
  *   - `inventory`  — create, get, decrement, release, restock
- *   - `media`      — attach, listForProduct, listForVariant, delete, reorder
+ *   - `media`      — attach, get, listForProduct, listForVariant, delete,
+ *                    reorder, setPrimary
  *
  *   Every write validates input at entry; bad input throws TypeError
  *   with a descriptive message so the calling route handler can
@@ -789,6 +790,64 @@ function _mediaModule(query) {
       var r = await query("DELETE FROM media WHERE id = ?1", [id]);
       return r.rowCount > 0;
     },
+
+    // Reorder a product's media. `orderedIds` is the FULL set of this
+    // product's media ids in the desired order; `position` is rewritten to
+    // 0..N-1 to match. Throws TypeError on a non-array / id-shape error or
+    // when the set doesn't exactly match the product's current media (a
+    // missing / extra / foreign id) — a partial reorder would silently drop
+    // a row's ordering. D1 has no cross-statement transaction over the HTTP
+    // bridge, so positions are written one UPDATE per row, each scoped by
+    // product_id so a crafted id list can never reposition another product's
+    // row out of band. Returns the count written.
+    reorder: async function (productId, orderedIds) {
+      _id(productId, "product_id");
+      if (!Array.isArray(orderedIds) || orderedIds.length === 0) {
+        throw new TypeError("catalog.media.reorder: orderedIds must be a non-empty array");
+      }
+      orderedIds.forEach(function (id) { _id(id, "media id"); });
+      var existing = await query("SELECT id FROM media WHERE product_id = ?1", [productId]);
+      var have = existing.rows.map(function (r) { return r.id; }).sort();
+      var want = orderedIds.slice().sort();
+      if (have.length !== want.length ||
+          have.some(function (id, i) { return id !== want[i]; })) {
+        throw new TypeError("catalog.media.reorder: orderedIds must list exactly this product's current media");
+      }
+      for (var i = 0; i < orderedIds.length; i += 1) {
+        await query(
+          "UPDATE media SET position = ?1 WHERE id = ?2 AND product_id = ?3",
+          [i, orderedIds[i], productId],
+        );
+      }
+      return orderedIds.length;
+    },
+
+    // Promote one media row to the hero slot (position 0) and push every
+    // other row of the same product down by one, preserving their relative
+    // order. The PDP gallery renders media[0] as the hero, so this is the
+    // "set primary image" operation. Throws TypeError on a malformed id;
+    // returns false when the id doesn't resolve to a product-scoped row
+    // (an unknown id, or a variant-only row that has no product_id). Every
+    // UPDATE is scoped by product_id — same cross-product-IDOR guard as
+    // reorder.
+    setPrimary: async function (mediaId) {
+      _id(mediaId, "media id");
+      var row = (await query("SELECT id, product_id FROM media WHERE id = ?1", [mediaId])).rows[0];
+      if (!row || !row.product_id) return false;
+      var ordered = (await query(
+        "SELECT id FROM media WHERE product_id = ?1 ORDER BY position ASC, created_at ASC",
+        [row.product_id],
+      )).rows.map(function (r) { return r.id; });
+      var without = ordered.filter(function (id) { return id !== mediaId; });
+      var next = [mediaId].concat(without);
+      for (var i = 0; i < next.length; i += 1) {
+        await query(
+          "UPDATE media SET position = ?1 WHERE id = ?2 AND product_id = ?3",
+          [i, next[i], row.product_id],
+        );
+      }
+      return true;
+    },
   };
 }
 

package/lib/search-facets.js

@@ -36,10 +36,12 @@
  *        the facet registry portable across whichever search
  *        backend the operator chooses.
  *
- *   `previewQuery({ query, filters })` returns the product count +
- *   a sample of matching products for a candidate filter
- *   combination — used by the storefront to render "Show 23 results"
- *   before the shopper commits the click.
+ *   `previewQuery({ query, filters, sample?, offset? })` returns the
+ *   product count + a window of matching products for a candidate
+ *   filter combination — used by the storefront to render "Show 23
+ *   results" before the shopper commits the click, and to page the
+ *   results grid (`offset`/`sample` window the matches; `total` stays
+ *   the full passing count so the result-count copy is page-independent).
  *
  *   `recordFacetUse({ key, value, session_id })` appends an
  *   analytics row. The session id is namespaceHashed under
@@ -66,7 +68,7 @@
  *     - updateFacet(key, patch)
  *     - archiveFacet(key)
  *     - getFacets({ query?, applied_filters?, scope? })
- *     - previewQuery({ query?, filters })
+ *     - previewQuery({ query?, filters, sample?, offset? })
  *     - recordFacetUse({ key, value, session_id })
  *
  *   Catalog contract — the operator passes a `catalog` to the
@@ -768,6 +770,13 @@ function create(opts) {
       var qStr    = _optQuery(input.query, "searchFacets.previewQuery");
       var filters = _appliedFilters(input.filters, "searchFacets.previewQuery");
       var sample  = _sampleSize(input.sample, "searchFacets.previewQuery");
+      // `offset` pages the returned window over the full passing set so a
+      // caller can request page N of the matches (storefront search
+      // pagination) without re-running the in-memory filter walk. The
+      // `total` is always the REAL passing count — the page window never
+      // changes it — so the result-count copy stays honest regardless of
+      // which page is requested. Defaults to 0 (the first window).
+      var offset  = _offset(input.offset, "searchFacets.previewQuery");
 
       var facets = await _loadFacets();
       var facetsByKey = {};
@@ -790,7 +799,7 @@ function create(opts) {
       }
       return {
         total:   passing.length,
-        sample:  passing.slice(0, sample),
+        sample:  passing.slice(offset, offset + sample),
       };
     },
 

package/lib/storefront.js

@@ -243,6 +243,7 @@ var LAYOUT =
   "  <title>{{title}} — {{shop_name}}</title>\n" +
   "  <meta name=\"description\" content=\"{{og_description}}\">\n" +
   "  <link rel=\"canonical\" href=\"{{canonical_url}}\">\n" +
+  "RAW_ROBOTS_META" +
   "  <link rel=\"icon\" type=\"image/svg+xml\" href=\"/assets/brand/favicon.svg\">\n" +
   "  <link rel=\"icon\" type=\"image/png\" href=\"/assets/brand/favicon.png\">\n" +
   "  <link rel=\"apple-touch-icon\" href=\"/assets/brand/favicon.png\">\n" +
@@ -755,8 +756,21 @@ function _wrap(opts) {
     vars[ck] = chrome[ck];
   }
 
+  // Per-page robots directive. Indexable pages (the default) emit no
+  // robots meta — the absence means "index, follow". Pages the storefront
+  // keeps out of search (cart / account / any session-scoped surface)
+  // pass `robots: "noindex"`, which stamps a noindex,nofollow meta in the
+  // <head> — a belt-and-suspenders pairing with the robots.txt Disallow +
+  // the edge `x-robots-tag` header, so a directly-fetched page is also
+  // self-describing. A noindex page needs no canonical (a crawler won't
+  // index it to dedupe), so these pages don't thread a canonical_url.
+  var robotsMeta = (opts.robots === "noindex")
+    ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
+    : "";
+
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_ROBOTS_META", robotsMeta)
     .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
@@ -1331,6 +1345,87 @@ function _renderSearchChips(facets, filters, q) {
   return "<div class=\"search-active-filters\" aria-label=\"Active filters\">\n" + chips + clearAll + "</div>\n";
 }
 
+// The fixed search page size — the number of result cards one page of
+// `/search` shows. Pages beyond the first are reached via `?page=N`
+// links the pagination nav emits (the real total drives how many pages
+// exist). Mirrors the edge renderer's SEARCH_PAGE_SIZE.
+var SEARCH_PAGE_SIZE = 24;
+
+// `/search?...` URL for a specific results page — the query + active
+// filters carried forward (so paging preserves the facet state) with a
+// `page` param appended for any page past the first. Page 1 omits the
+// param so the canonical first page has one URL. Mirrors the edge
+// renderer's `_searchPageUrl` byte-for-byte.
+function _searchPageUrl(q, filters, page) {
+  var base = _searchUrl(q, filters);
+  if (page <= 1) return base;
+  return base + (base.indexOf("?") === -1 ? "?" : "&") + "page=" + page;
+}
+
+var SEARCH_PAGE_LINK =
+  "<li class=\"search-pagination__page\"><a class=\"search-pagination__link\" href=\"{{href}}\"{{aria_current}}>{{n}}</a></li>\n";
+
+// Numbered prev/next pagination for the result grid. No-JS + SEO-
+// friendly: every page is a real `?page=N` link carrying the active
+// query + facets, `rel="prev"/"next"` mark the sequence, and the current
+// page is `aria-current="page"`. Renders nothing for a single page (the
+// default when a caller threads no total — keeps the unpaginated render
+// byte-identical). `total` is the REAL match count (not the page slice
+// length); `page` is the 1-based current page. Mirrors the edge
+// renderer's `_renderSearchPagination` byte-for-byte.
+function _renderSearchPagination(q, filters, total, page, pageSize) {
+  var size = pageSize > 0 ? pageSize : SEARCH_PAGE_SIZE;
+  var totalPages = Math.max(1, Math.ceil(total / size));
+  if (totalPages <= 1) return "";
+  var cur = page < 1 ? 1 : (page > totalPages ? totalPages : page);
+  var prev = cur > 1
+    ? _render("<a class=\"search-pagination__link search-pagination__prev\" href=\"{{href}}\" rel=\"prev\">Previous</a>\n",
+        { href: _searchPageUrl(q, filters, cur - 1) })
+    : "<span class=\"search-pagination__link search-pagination__prev is-disabled\" aria-disabled=\"true\">Previous</span>\n";
+  var next = cur < totalPages
+    ? _render("<a class=\"search-pagination__link search-pagination__next\" href=\"{{href}}\" rel=\"next\">Next</a>\n",
+        { href: _searchPageUrl(q, filters, cur + 1) })
+    : "<span class=\"search-pagination__link search-pagination__next is-disabled\" aria-disabled=\"true\">Next</span>\n";
+  var pagesHtml = "";
+  for (var n = 1; n <= totalPages; n += 1) {
+    pagesHtml += _render(SEARCH_PAGE_LINK, {
+      href:         _searchPageUrl(q, filters, n),
+      aria_current: n === cur ? "RAW_ARIA" : "",
+      n:            String(n),
+    }).replace("RAW_ARIA", n === cur ? " aria-current=\"page\"" : "");
+  }
+  return "<nav class=\"search-pagination\" aria-label=\"Search results pages\">\n" +
+    prev +
+    "<ol class=\"search-pagination__pages\">\n" + pagesHtml + "</ol>\n" +
+    next +
+    "</nav>\n";
+}
+
+// Read the 1-based `?page=N` results page off a parsed URL. A missing,
+// non-integer, or sub-1 value reads as page 1 (the canonical first page);
+// the upper bound is clamped against the real page count by `_clampPage`
+// once the total is known. Defensive request-shape reader — returns the
+// safe default for any garbage rather than throwing.
+function _parsePageParam(url) {
+  if (!url || !url.searchParams) return 1;
+  var raw = url.searchParams.get("page");
+  if (raw == null) return 1;
+  if (!/^[0-9]{1,9}$/.test(raw)) return 1;
+  var n = parseInt(raw, 10);
+  return n >= 1 ? n : 1;
+}
+
+// Clamp a 1-based page to `[1, lastPage]` for a given total + page size.
+// A `?page` past the end serves the last page (a stable, link-followable
+// result) rather than an empty grid; a zero-result query stays on page 1.
+function _clampPage(page, total, pageSize) {
+  var size = pageSize > 0 ? pageSize : SEARCH_PAGE_SIZE;
+  var lastPage = Math.max(1, Math.ceil(total / size));
+  if (page < 1) return 1;
+  if (page > lastPage) return lastPage;
+  return page;
+}
+
 // Hard caps mirroring `lib/search-facets.js`'s applied-filter
 // validators so a hostile / stale URL can't blow the in-memory facet
 // walk. Garbage values and unknown facet keys are dropped (not
@@ -1377,6 +1472,14 @@ function renderSearch(opts) {
   var facets   = Array.isArray(opts.facets) ? opts.facets : [];
   var filters  = (opts.filters && typeof opts.filters === "object") ? opts.filters : {};
   var hasFilters = Object.keys(filters).length > 0;
+  // The result count copy + the page math run off the REAL match total —
+  // the count of every product the query matched, not the length of the
+  // page slice the renderer was handed. A caller that doesn't thread a
+  // total (a unit test rendering one page directly) falls back to the page
+  // length so the unpaginated render is unchanged.
+  var pageSize    = (typeof opts.page_size === "number" && opts.page_size > 0) ? opts.page_size : SEARCH_PAGE_SIZE;
+  var totalCount  = (typeof opts.total === "number" && opts.total >= 0) ? opts.total : products.length;
+  var page        = (typeof opts.page === "number" && opts.page >= 1) ? Math.floor(opts.page) : 1;
   var qTrim = opts.q.trim();
   var title, summary, emptyHeading, emptyCopy;
   if (qTrim.length === 0) {
@@ -1384,14 +1487,14 @@ function renderSearch(opts) {
     summary      = "Use the search box in the header to look for a product by title, SKU, or description.";
     emptyHeading = "What are you looking for?";
     emptyCopy    = "Type a query in the header search to find products by title, SKU, or description.";
-  } else if (products.length === 0) {
+  } else if (totalCount === 0) {
     title        = "No matches";
     summary      = "Nothing in the catalog matched “" + qTrim + "”.";
     emptyHeading = "We don't carry that yet";
     emptyCopy    = "Try a broader term, or browse every product on the home page.";
   } else {
     title   = "“" + qTrim + "”";
-    summary = "Showing " + products.length + " match" + (products.length === 1 ? "" : "es") + " for your query.";
+    summary = "Showing " + totalCount + " match" + (totalCount === 1 ? "" : "es") + " for your query.";
   }
 
   var correctionHtml = "";
@@ -1424,6 +1527,14 @@ function renderSearch(opts) {
     }).join("\n");
     resultsInner = "<section class=\"search-grid\"><div class=\"grid\">" + cards + "</div></section>";
   }
+  // Pagination nav under the grid — `?page=N` links carrying the active
+  // query + facets so paging never drops the filter state. Renders nothing
+  // for a single page (the result count fits one page) or the empty / no-
+  // query states. Driven by the real total, not the page slice length.
+  var paginationHtml = (qTrim.length > 0 && totalCount > 0)
+    ? _renderSearchPagination(opts.q, filters, totalCount, page, pageSize)
+    : "";
+  resultsInner += paginationHtml;
   var body;
   if (facetsHtml.length > 0) {
     body = header + correctionHtml + chipsHtml +
@@ -2689,6 +2800,7 @@ function renderCollectionList(opts) {
   return _wrap({
     title: "Collections", shop_name: opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
   });
 }
 
@@ -2719,6 +2831,7 @@ function renderCollection(opts) {
   return _wrap({
     title: col.title, shop_name: opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
   });
 }
 
@@ -4969,6 +5082,11 @@ function renderCart(opts) {
     shop_name:  shopName,
     cart_count: lines.length,
     theme_css: opts.theme_css,
+    // The cart is session-scoped and robots.txt-disallowed — keep it out
+    // of the index with a noindex meta (matches the edge x-robots-tag on
+    // the guest cart render), so a directly-crawled cart URL is self-
+    // describing rather than relying on robots.txt alone.
+    robots:     "noindex",
     body:       body,
   }, _currencyWrapOpts(opts)));
 }
@@ -5808,6 +5926,10 @@ function renderAccount(opts) {
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     theme_css: opts.theme_css,
+    // The account dashboard is per-customer + robots.txt-disallowed — keep
+    // it out of the index with a noindex meta rather than relying on the
+    // crawl policy alone.
+    robots:     "noindex",
     body:       body,
   });
 }
@@ -7396,10 +7518,17 @@ function mount(router, deps) {
     // otherwise round-trip through the LIKE escape function.
     if (q.length > 200) q = q.slice(0, 200);
 
+    // 1-based results page from `?page=N`. A missing / non-numeric /
+    // out-of-low-range value reads as page 1; the upper bound is clamped
+    // to the real page count once the total is known (below) so a `?page`
+    // past the end serves the last page rather than an empty grid.
+    var page = _parsePageParam(url);
+
     var products    = [];
     var facetGroups = [];
     var filters     = {};
     var correctedQ  = "";
+    var totalCount  = 0;
 
     if (q.trim().length > 0) {
       // Synonym + typo rewrite expands the typed query into the
@@ -7434,11 +7563,28 @@ function mount(router, deps) {
         var facetDefs = await sfInstance.listFacets({});
         filters = _parseSearchFilters(url, facetDefs);
         facetGroups = await sfInstance.getFacets({ query: q, applied_filters: filters });
-        var preview = await sfInstance.previewQuery({ query: q, filters: filters, sample: 24 });
+        // First pass reads the REAL total so the result-count copy is
+        // honest and the page can be clamped to the last page. The second
+        // pass windows that page (offset/sample) over the full passing set
+        // — pages past the first are reachable, not discarded at 24.
+        var totalPreview = await sfInstance.previewQuery({ query: q, filters: filters, sample: 0 });
+        totalCount = totalPreview.total;
+        page = _clampPage(page, totalCount, SEARCH_PAGE_SIZE);
+        var preview = await sfInstance.previewQuery({
+          query:  q,
+          filters: filters,
+          sample:  SEARCH_PAGE_SIZE,
+          offset:  (page - 1) * SEARCH_PAGE_SIZE,
+        });
         products = preview.sample;
       } else {
-        // No facet dep — flat search over the expanded terms.
-        products = (await _facetableUniverse(terms)).slice(0, 24);
+        // No facet dep — flat search over the expanded terms. The full
+        // matched universe gives the honest total; the page is the
+        // windowed slice (the same page size the faceted path uses).
+        var flatUniverse = await _facetableUniverse(terms);
+        totalCount = flatUniverse.length;
+        page = _clampPage(page, totalCount, SEARCH_PAGE_SIZE);
+        products = flatUniverse.slice((page - 1) * SEARCH_PAGE_SIZE, page * SEARCH_PAGE_SIZE);
       }
     }
 
@@ -7450,6 +7596,9 @@ function mount(router, deps) {
       facets:          facetGroups,
       filters:         filters,
       corrected_query: correctedQ,
+      total:           totalCount,
+      page:            page,
+      page_size:       SEARCH_PAGE_SIZE,
       shop_name:       shopName,
       cart_count:      cartCount,
     }, _requestUrls(req), ccy)));
@@ -7809,9 +7958,9 @@ function mount(router, deps) {
     router.get("/collections", async function (req, res) {
       var cols = await deps.collections.list({ active_only: true });
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCollectionList({
+      _send(res, 200, renderCollectionList(Object.assign({
         collections: cols, shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
-      }));
+      }, _requestUrls(req))));
     });
 
     router.get("/collections/:slug", async function (req, res) {
@@ -7835,9 +7984,9 @@ function mount(router, deps) {
         if (card) products.push(card);
       }
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCollection({
+      _send(res, 200, renderCollection(Object.assign({
         collection: col, products: products, shop_name: shopName, cart_count: cartCount,
-      }));
+      }, _requestUrls(req))));
     });
   }
 

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.7",
-      "tag": "v0.14.7",
+      "version": "0.14.8",
+      "tag": "v0.14.8",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",