@blamejs/blamejs-shop 0.3.16 → 0.3.18

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.18 (2026-05-30) — **Write and publish blog posts from the admin console.** The storefront already served a blog — the index at /blog, individual posts at /blog/:slug, an RSS feed, and sitemap entries — but there was no way to write a post, so it rendered empty. The admin console now has a Blog screen with the full lifecycle: create a draft, edit its title, body (Markdown), tags, hero image, and meta fields, publish it, unpublish it, and archive or restore it. A post is created as a draft and stays off the storefront until it is explicitly published, so work in progress is never visible to shoppers. **Added:** *Blog authoring in the admin console* — A new Blog screen lists posts by status and lets an operator create, edit, publish, unpublish, archive, and restore them. New posts start as drafts and do not appear on the storefront /blog, its RSS feed, or the sitemap until published; archiving removes a published post from the storefront and is reversible. This wires the admin over the blog backend that was already serving the customer-facing pages.
+
+- v0.3.17 (2026-05-30) — **Search results paginate with an accurate count, and collection pages get canonical URLs.** Two customer-facing storefront fixes. Search no longer stops at the first 24 products: the result count now reports the true number of matches instead of the page size, and numbered page links (with prev/next) make every matching product reachable while preserving the active query and filters. Separately, collection pages now emit a correct canonical and og:url so search engines and shared links resolve to one address, while the cart and account pages — which should not be indexed — are explicitly marked noindex. **Fixed:** *Search shows the real match count and paginates* — The search results page previously capped at 24 products, discarded the real total, and reported the page size as the match count — so anything past the first 24 was unreachable and the count was wrong. It now computes the true total, shows it in the "Showing N matches" summary, and adds no-JavaScript numbered page links (with prev/next) that carry the active query and facet filters, so every matching product can be reached. · *Collection pages have canonical URLs; cart and account are noindex* — Collection pages now emit an absolute canonical and og:url derived from the request host, so indexers and shared links resolve to a single address instead of an empty tag. The cart and account pages, which are not meant to be indexed, now carry a noindex robots tag in their markup, consistent on both the edge and container render paths.
+
 - v0.3.16 (2026-05-30) — **Uploaded SVGs are sanitized, and product images can be reordered with a chosen primary.** Two things for product media in the admin console. First, when an SVG image is uploaded it now passes through a strict sanitizer: an SVG that carries script or other active content is repaired, or refused outright when it can't be made safe, so a stored image can't become a script-execution vector. Second, a product's images can now be reordered and any image promoted to the primary (hero) slot directly from the console — previously the order was fixed at attach time and the first-attached image was always the hero. The primary image is the one shown first on the product page. **Added:** *Reorder product images and set the primary from the console* — Each image on a product now has a "Make primary" control that moves it to the hero slot shown first on the product page, and a reorder control sets the full order. Both are no-JavaScript form actions. The product page renders images in this order, so changing it here changes what shoppers see first. **Changed:** *Vendored runtime updated to v0.14.8* — The vendored blamejs runtime is updated to v0.14.8, an internal source-comment and lint-hygiene release with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Uploaded SVG images are sanitized or refused* — An uploaded SVG is now checked by a strict sanitizer before it is stored: active content (scripts, event handlers, external references) is stripped, and an SVG that cannot be made safe is rejected with a clear error and never written. This closes the path where a crafted SVG, once stored and served, could execute script. Raster image uploads (PNG, JPEG, WebP, GIF) are unaffected.
 
 - v0.3.15 (2026-05-30) — **Product image galleries are interactive — click a thumbnail to view that image full size.** A product page's image gallery now lets a shopper switch between the product's images: clicking a thumbnail swaps the main image, with no JavaScript required. Previously the thumbnail strip was decorative — the additional images were unreachable, a single-image product showed empty placeholder slots, and only the first four images were shown. Now the main image stacks the product's images and the thumbnails are real, keyboard-accessible controls that select which one is shown; a product with one image shows just that image (no empty slots), and the four-image cap is raised to twelve so far more images are reachable. The picker is pure HTML and CSS, so it works without scripting and degrades cleanly. **Fixed:** *The product image gallery actually switches images now* — Thumbnails on the product page are now interactive: selecting one shows that image as the main image, using a no-JavaScript radio/label control. The empty placeholder slots a single-image product used to show are gone, the four-image cap is raised to twelve so far more images are reachable, and the strip is keyboard-navigable with accessible labels. The edge and container renderers emit identical markup.

package/lib/admin.js

@@ -510,7 +510,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4026,6 +4026,245 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- blog -----------------------------------------------------------
+  // Author the operator's editorial blog. The edge Worker serves the
+  // customer-facing /blog index + /blog/:slug posts + the RSS feed,
+  // reading ONLY published rows; this console writes them. A post is
+  // created as a draft and stays invisible to the storefront until it's
+  // published — publish / unpublish / archive / restore move it through
+  // the lifecycle (draft → published → archived, with restore back to
+  // draft). Content-negotiated like the other screens: bearer → the JSON
+  // contract; signed-in browser → the HTML list + author forms.
+  if (deps.blog) {
+    var blog = deps.blog;
+
+    // The list pulls each lifecycle state separately (the primitive has
+    // listDrafts / listArchived + listPublished) and merges them for the
+    // console table. The published set is the first page of the cursor-
+    // paginated feed — an editorial corpus that the console doesn't page
+    // (operators have tens of posts); the storefront's /blog is the
+    // paginated reader.
+    async function _blogRows(filter) {
+      var drafts    = await blog.listDrafts();
+      var archived  = await blog.listArchived();
+      var published = (await blog.listPublished({ limit: blog.MAX_LIST_LIMIT })).rows;
+      if (filter === "draft")     return drafts;
+      if (filter === "published") return published;
+      if (filter === "archived")  return archived;
+      // All: published first (newest-live), then drafts, then archived.
+      return published.concat(drafts).concat(archived);
+    }
+
+    router.get("/admin/blog", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status = (url && url.searchParams.get("status")) || null;
+        _json(res, 200, { rows: await _blogRows(status) });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status = (url && url.searchParams.get("status")) || null;
+        var rows = await _blogRows(status);
+        _sendHtml(res, 200, renderAdminBlog({
+          shop_name: deps.shop_name, nav_available: navAvailable, articles: rows,
+          status_filter: status,
+          created:   url && url.searchParams.get("created"),
+          updated:   url && url.searchParams.get("updated"),
+          published: url && url.searchParams.get("published"),
+          archived:  url && url.searchParams.get("archived"),
+          notice:    (url && url.searchParams.get("err")) ? "That action couldn't be completed for the post." : null,
+        }));
+      },
+    ));
+
+    // The new-post form. A standalone GET so the "New post" button on the
+    // list has a target; the create POST lives at /admin/blog.
+    router.get("/admin/blog/new", _pageOrApi(true,
+      R(async function (_req, res) {
+        return _problem(res, 405, "use-canonical-endpoint", "POST /admin/blog with a JSON body to create a post");
+      }),
+      async function (_req, res) {
+        _sendHtml(res, 200, renderAdminBlogDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable, article: null,
+        }));
+      },
+    ));
+
+    // Create content-negotiates: bearer → JSON 201 (a draft row); browser
+    // form → createDraft, then PRG to the post's detail screen to keep
+    // authoring. Every post is born a DRAFT — never published on create —
+    // so it can't reach the storefront before the operator publishes it.
+    router.post("/admin/blog", _pageOrApi(false,
+      W("blog.create", async function (req, res) {
+        var row = await blog.createDraft(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var made;
+        try {
+          made = await blog.createDraft(_blogFromForm(req.body || {}));
+        } catch (e) {
+          var n = _safeNotice(e, "blog.create");
+          return _sendHtml(res, n.status, renderAdminBlogDetail({
+            shop_name: deps.shop_name, nav_available: navAvailable, article: null,
+            form_values: req.body || {},
+            notice: n.message.replace(/^blogArticles[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog.create", outcome: "success", metadata: { slug: made.slug } });
+        _redirect(res, "/admin/blog/" + encodeURIComponent(made.slug) + "?created=1");
+      },
+    ));
+
+    // Detail content-negotiates: bearer → JSON (the row, any status);
+    // browser → the edit form + the lifecycle action buttons. A bad /
+    // unknown slug is a 404 page, never a 500.
+    router.get("/admin/blog/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row;
+        try { row = await blog.get(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "blog-post-not-found", e.message); throw e; }
+        if (!row) return _problem(res, 404, "blog-post-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row;
+        try { row = await blog.get(req.params.slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; row = null; }
+        if (!row) return _sendHtml(res, 404, renderAdminBlog({
+          shop_name: deps.shop_name, nav_available: navAvailable, articles: [], notice: "Post not found.",
+        }));
+        _sendHtml(res, 200, renderAdminBlogDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable, article: row,
+          updated:   url && url.searchParams.get("updated"),
+          published: url && url.searchParams.get("published"),
+          notice:    (url && url.searchParams.get("err")) ? "That action couldn't be completed for the post." : null,
+        }));
+      },
+    ));
+
+    // Edit content-negotiates: bearer PATCH (the JSON contract) + browser
+    // POST /edit (HTML forms can't PATCH). Both patch the editable columns
+    // (title / body / author / tags / meta / hero image). Status is NOT
+    // editable here — it moves via the lifecycle routes below.
+    router.patch("/admin/blog/:slug", W("blog.update", async function (req, res) {
+      var row;
+      try { row = await blog.update(req.params.slug, req.body || {}); }
+      catch (e) {
+        if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+        if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+        throw e;
+      }
+      _json(res, 200, row);
+      return { id: row.slug };
+    }));
+
+    router.post("/admin/blog/:slug/edit", _pageOrApi(false,
+      W("blog.update", async function (req, res) {
+        var row;
+        try { row = await blog.update(req.params.slug, req.body || {}); }
+        catch (e) {
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+          throw e;
+        }
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc  = encodeURIComponent(slug);
+        try {
+          await blog.update(slug, _blogPatchFromForm(req.body || {}));
+        } catch (e) {
+          if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _redirect(res, "/admin/blog?err=1");
+          var n = _safeNotice(e, "blog.update");
+          var current = null;
+          try { current = await blog.get(slug); } catch (_e) { current = null; }
+          if (!current) return _redirect(res, "/admin/blog?err=1");
+          return _sendHtml(res, n.status, renderAdminBlogDetail({
+            shop_name: deps.shop_name, nav_available: navAvailable, article: current,
+            notice: n.message.replace(/^blogArticles[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/blog/" + enc + "?updated=1");
+      },
+    ));
+
+    // Lifecycle transitions — each PRGs back to the detail. publish takes
+    // a draft live (now visible on the storefront); unpublish pulls it
+    // back to draft (gone from the storefront); restore returns an
+    // archived post to draft. An illegal transition (wrong from-state) or
+    // a missing slug is a ?err=1 notice, never a 500.
+    function _blogTransition(action, fn) {
+      router.post("/admin/blog/:slug/" + action, _pageOrApi(false,
+        W("blog." + action, async function (req, res) {
+          var row;
+          try { row = await fn(req.params.slug); }
+          catch (e) {
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            if (e && e.code === "BLOG_ARTICLE_NOT_FOUND") return _problem(res, 404, "blog-post-not-found");
+            if (e && e.code === "BLOG_ARTICLE_BAD_STATE") return _problem(res, 409, "conflict", e.message);
+            throw e;
+          }
+          _json(res, 200, row);
+          return { id: row.slug };
+        }),
+        async function (req, res) {
+          var slug = req.params.slug;
+          var enc  = encodeURIComponent(slug);
+          try {
+            await fn(slug);
+          } catch (e) {
+            if (e instanceof TypeError || (e && (e.code === "BLOG_ARTICLE_NOT_FOUND" || e.code === "BLOG_ARTICLE_BAD_STATE"))) {
+              return _redirect(res, "/admin/blog/" + enc + "?err=1");
+            }
+            throw e;
+          }
+          b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".blog." + action, outcome: "success", metadata: { slug: slug } });
+          // archive lands back on the list (the post left the editable
+          // set); the others stay on the detail with a status banner.
+          if (action === "archive") return _redirect(res, "/admin/blog?archived=1");
+          _redirect(res, "/admin/blog/" + enc + (action === "publish" ? "?published=1" : "?updated=1"));
+        },
+      ));
+    }
+    _blogTransition("publish",   function (s) { return blog.publish(s); });
+    _blogTransition("unpublish", function (s) { return blog.unpublish(s); });
+    _blogTransition("restore",   function (s) { return blog.restore(s); });
+
+    // Archive is destructive-ish (the post leaves the live storefront and
+    // the editable set), so the browser path confirms first — the CSP
+    // forbids a client confirm() dialog. Reached by a GET link from the
+    // detail screen; bearer clients POST /archive directly.
+    router.get("/admin/blog/:slug/archive/confirm-page", _pageOrApi(true,
+      R(async function (_req, res) {
+        return _problem(res, 405, "use-canonical-endpoint", "POST /admin/blog/:slug/archive directly for the JSON API");
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc  = encodeURIComponent(slug);
+        var row = null;
+        try { row = await blog.get(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/blog?err=1");
+        _sendHtml(res, 200, renderAdminConfirm({
+          shop_name: deps.shop_name, nav_available: navAvailable, active: "blog",
+          heading: "Archive this post?",
+          consequence: "Archiving removes the post from the live storefront blog. You can restore it to a draft later.",
+          detail: "Post: " + (row.title || slug) + ".",
+          action: "/admin/blog/" + _htmlEscape(enc) + "/archive",
+          confirm_label: "Archive post",
+          cancel_href: "/admin/blog/" + enc,
+        }));
+      },
+    ));
+    _blogTransition("archive", function (s) { return blog.archive(s); });
+  }
+
   // ---- customer surveys -----------------------------------------------
   // Define NPS/CSAT/CES/custom surveys, issue token invitations (the
   // plaintext link is shown once on issue), and read the rollup. The
@@ -6393,6 +6632,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "shipping-labels", href: "/admin/shipping-labels", label: "Shipping labels", requires: "shippingLabels" },
   { key: "pick-lists",   href: "/admin/pick-lists",   label: "Pick lists",   requires: "pickLists" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
+  { key: "blog",         href: "/admin/blog",         label: "Blog",         requires: "blog" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
   { key: "hours",        href: "/admin/hours",        label: "Hours",        requires: "businessHours" },
   { key: "giftcards",    href: "/admin/gift-cards",    label: "Gift cards",   requires: "giftcards" },
@@ -9071,6 +9311,209 @@ function renderAdminAnnouncements(opts) {
   return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
 }
 
+// ---- blog form coercion + render --------------------------------------
+
+// A comma- or newline-separated tag field → the normalized string array
+// the blog primitive validates. Empty entries are dropped; the primitive
+// enforces the per-tag shape + the dedupe + the count cap, so this only
+// splits and trims.
+function _csvTags(v) {
+  if (typeof v !== "string" || !v.trim()) return [];
+  return v.split(/[,\n]/).map(function (s) { return s.trim(); }).filter(Boolean);
+}
+
+// Coerce the create form into blogArticles.createDraft's shape: trimmed
+// slug, the required title/body/author, the optional tags array, and the
+// optional hero-image + meta fields (a blank optional field is omitted so
+// the primitive's null default applies). The primitive validates every
+// field — this only shapes the form strings.
+function _blogFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:      typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    title:     body.title,
+    body:      body.body,
+    author_id: typeof body.author_id === "string" ? body.author_id.trim() : body.author_id,
+  };
+  var tags = _csvTags(body.tags);
+  if (tags.length) out.tags = tags;
+  var hero = typeof body.hero_image_url === "string" ? body.hero_image_url.trim() : "";
+  if (hero) out.hero_image_url = hero;
+  var md = typeof body.meta_description === "string" ? body.meta_description.trim() : "";
+  if (md) out.meta_description = md;
+  var mk = typeof body.meta_keywords === "string" ? body.meta_keywords.trim() : "";
+  if (mk) out.meta_keywords = mk;
+  return out;
+}
+
+// Coerce the edit form into a blogArticles.update patch. Only the columns
+// the form actually carries are included; an empty optional field is sent
+// as "" so the operator can clear a previously-set meta line / hero image
+// (the primitive accepts an empty string for the nullable meta columns).
+// Tags always ride (an empty list clears them). Status is NOT here — it
+// moves via the lifecycle routes.
+function _blogPatchFromForm(body) {
+  body = body || {};
+  var patch = { tags: _csvTags(body.tags) };
+  if (typeof body.title === "string")           patch.title = body.title;
+  if (typeof body.body === "string")            patch.body = body.body;
+  if (typeof body.author_id === "string")       patch.author_id = body.author_id.trim();
+  if (typeof body.hero_image_url === "string")  patch.hero_image_url = body.hero_image_url.trim() || null;
+  if (typeof body.meta_description === "string") patch.meta_description = body.meta_description.trim();
+  if (typeof body.meta_keywords === "string")   patch.meta_keywords = body.meta_keywords.trim();
+  return patch;
+}
+
+// One status pill class per lifecycle state, reusing the order-status pill
+// palette: published = paid (green), draft = pending (amber), archived =
+// cancelled (grey).
+function _blogStatusPill(status) {
+  var cls = status === "published" ? "paid" : status === "archived" ? "cancelled" : "pending";
+  return "<span class=\"status-pill " + cls + "\">" + _htmlEscape(status) + "</span>";
+}
+
+function renderAdminBlog(opts) {
+  opts = opts || {};
+  var rows = opts.articles || [];
+  var created   = opts.created   ? "<div class=\"banner banner--ok\">Post created as a draft.</div>" : "";
+  var updated   = opts.updated   ? "<div class=\"banner banner--ok\">Post saved.</div>" : "";
+  var published = opts.published ? "<div class=\"banner banner--ok\">Post published — it's live on the storefront blog.</div>" : "";
+  var archived  = opts.archived  ? "<div class=\"banner banner--ok\">Post archived.</div>" : "";
+  var notice    = opts.notice    ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var sf = opts.status_filter;
+  var chips = "<div class=\"order-filters\">" +
+    "<a class=\"chip" + (sf == null ? " chip--on" : "") + "\" href=\"/admin/blog\">All</a>" +
+    "<a class=\"chip" + (sf === "published" ? " chip--on" : "") + "\" href=\"/admin/blog?status=published\">Published</a>" +
+    "<a class=\"chip" + (sf === "draft" ? " chip--on" : "") + "\" href=\"/admin/blog?status=draft\">Drafts</a>" +
+    "<a class=\"chip" + (sf === "archived" ? " chip--on" : "") + "\" href=\"/admin/blog?status=archived\">Archived</a>" +
+    "</div>";
+
+  var bodyRows = rows.map(function (a) {
+    var enc = encodeURIComponent(a.slug);
+    var date = a.published_at != null ? _fmtDate(a.published_at) : "—";
+    // Per-row lifecycle actions match the post's current state: a draft
+    // can publish; a published post can unpublish or archive; an archived
+    // post can restore. Edit + the storefront link are always offered.
+    var actions = "<a class=\"btn btn--ghost\" href=\"/admin/blog/" + _htmlEscape(enc) + "\">Edit</a>";
+    if (a.status === "draft") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/publish\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Publish</button></form>";
+    } else if (a.status === "published") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/unpublish\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Unpublish</button></form>" +
+        "<a class=\"btn btn--danger\" href=\"/admin/blog/" + _htmlEscape(enc) + "/archive/confirm-page\">Archive</a>";
+    } else if (a.status === "archived") {
+      actions += "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/restore\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>";
+    }
+    return "<tr>" +
+      "<td><a href=\"/admin/blog/" + _htmlEscape(enc) + "\"><strong>" + _htmlEscape(a.title) + "</strong></a></td>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(a.slug) + "</code></td>" +
+      "<td>" + _blogStatusPill(a.status) + "</td>" +
+      "<td>" + _htmlEscape(date) + "</td>" +
+      "<td><div class=\"actions-row\">" + actions + "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Status</th><th scope=\"col\">Published</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No posts" + (sf ? " " + _htmlEscape(sf) : " yet") + ". Write your first one.</p>";
+
+  var newBtn = "<div class=\"actions-row\"><a class=\"btn\" href=\"/admin/blog/new\">New post</a></div>";
+
+  var bodyHtml = "<section><h2>Blog</h2>" +
+    created + updated + published + archived + notice +
+    "<p class=\"meta\">Editorial posts shown on the storefront blog (/blog). A post is created as a draft and stays hidden until you publish it.</p>" +
+    newBtn + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Blog", bodyHtml, "blog", opts.nav_available);
+}
+
+// New-post form (article: null) or edit form (article set) for a single
+// blog post, plus the lifecycle action row when editing an existing post.
+// `form_values` re-fills a failed create so the operator doesn't retype.
+function renderAdminBlogDetail(opts) {
+  opts = opts || {};
+  var a = opts.article || null;
+  var isNew = !a;
+  var fv = opts.form_values || {};
+  var updated   = opts.updated   ? "<div class=\"banner banner--ok\">Post saved.</div>" : "";
+  var published = opts.published ? "<div class=\"banner banner--ok\">Post published — it's live on the storefront blog.</div>" : "";
+  var notice    = opts.notice    ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // Field values: the existing row when editing, else the failed-create
+  // form values, else blank.
+  function _val(col) {
+    if (a && a[col] != null) return a[col];
+    if (fv[col] != null) return fv[col];
+    return "";
+  }
+  var tagsVal = a && Array.isArray(a.tags) ? a.tags.join(", ")
+              : (typeof fv.tags === "string" ? fv.tags : "");
+
+  var action = isNew ? "/admin/blog" : "/admin/blog/" + encodeURIComponent(a.slug) + "/edit";
+  // Slug is the PK — editable only on create (the primitive keys update on
+  // it). On edit it shows read-only so the operator sees the storefront URL.
+  var slugField = isNew
+    ? _setupField("Slug", "slug", _val("slug"), "text", "Lowercase letters, digits, and hyphens — appears in /blog/<slug>.", " maxlength=\"120\" required")
+    : "<label class=\"form-field\"><span>Slug</span><input type=\"text\" value=\"" + _htmlEscape(a.slug) + "\" readonly>" +
+        "<small>The storefront URL: <code>/blog/" + _htmlEscape(a.slug) + "</code></small></label>";
+
+  var form =
+    "<div class=\"panel mw-40\">" +
+      "<h3 class=\"subhead\">" + (isNew ? "New post" : "Post details") + "</h3>" +
+      "<form method=\"post\" action=\"" + _htmlEscape(action) + "\">" +
+        slugField +
+        _setupField("Title", "title", _val("title"), "text", "", " maxlength=\"200\" required") +
+        _setupField("Author", "author_id", _val("author_id"), "text", "An author id (your editorial team's handle).", " maxlength=\"80\" required") +
+        "<label class=\"form-field\"><span>Body (Markdown)</span>" +
+          "<textarea name=\"body\" rows=\"16\" maxlength=\"200000\" required>" + _htmlEscape(_val("body")) + "</textarea>" +
+          "<small>Headings, lists, links, bold/italic. Raw HTML is escaped — links are https-only.</small></label>" +
+        _setupField("Tags (optional)", "tags", tagsVal, "text", "Comma-separated, e.g. guides, buying-tips.", " maxlength=\"1000\"") +
+        _setupField("Hero image URL (optional)", "hero_image_url", _val("hero_image_url"), "text", "https:// or a /-rooted path.", " maxlength=\"2048\"") +
+        _setupField("Meta description (optional)", "meta_description", _val("meta_description"), "text", "Shown in search results + the post's <head>.", " maxlength=\"320\"") +
+        _setupField("Meta keywords (optional)", "meta_keywords", _val("meta_keywords"), "text", "", " maxlength=\"320\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">" + (isNew ? "Create draft" : "Save") + "</button>" +
+          "<a class=\"btn btn--ghost\" href=\"/admin/blog\">Back</a></div>" +
+      "</form>" +
+    "</div>";
+
+  var lifecycle = "";
+  if (!isNew) {
+    var enc = encodeURIComponent(a.slug);
+    var btns = "";
+    if (a.status === "draft") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/publish\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Publish</button></form>" +
+        "<span class=\"meta\">Publishing makes the post live on the storefront blog.</span>";
+    } else if (a.status === "published") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/unpublish\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Unpublish</button></form>" +
+        "<a class=\"btn btn--danger\" href=\"/admin/blog/" + _htmlEscape(enc) + "/archive/confirm-page\">Archive</a>" +
+        "<span class=\"meta\">Unpublish pulls it back to a draft; archive removes it from the storefront.</span>";
+    } else if (a.status === "archived") {
+      btns = "<form method=\"post\" action=\"/admin/blog/" + _htmlEscape(enc) + "/restore\" class=\"form-inline\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">Restore to draft</button></form>";
+    }
+    lifecycle = "<div class=\"panel mt-1 mw-40\"><h3 class=\"subhead\">Status</h3>" +
+      "<p class=\"meta\">Current state: " + _blogStatusPill(a.status) + "</p>" +
+      "<div class=\"actions-row\">" + btns + "</div></div>";
+  }
+
+  var head = isNew
+    ? "<p class=\"meta\"><a href=\"/admin/blog\">&larr; Blog</a></p>"
+    : "<p class=\"meta\"><a href=\"/admin/blog\">&larr; Blog</a> · " +
+        _blogStatusPill(a.status) +
+        (a.status === "published"
+          ? " · <a href=\"/blog/" + _htmlEscape(encodeURIComponent(a.slug)) + "\" target=\"_blank\" rel=\"noreferrer\">View on storefront &rarr;</a>"
+          : "") +
+      "</p>";
+
+  var title = isNew ? "New post" : (a.title || a.slug);
+  var body = "<section><h2>" + _htmlEscape(title) + "</h2>" + updated + published + notice + head + form + "</section>" + lifecycle;
+  return _renderAdminShell(opts.shop_name, isNew ? "New post" : "Post " + a.slug, body, "blog", opts.nav_available);
+}
+
 // Standard question set per survey kind, so the console can create the
 // common surveys without a dynamic question builder (fully custom question
 // lists go through the JSON defineSurvey API). Each question carries a
@@ -9889,6 +10332,8 @@ module.exports = {
   renderAdminQuestion:     renderAdminQuestion,
   renderAdminCollections:  renderAdminCollections,
   renderAdminCollection:   renderAdminCollection,
+  renderAdminBlog:         renderAdminBlog,
+  renderAdminBlogDetail:   renderAdminBlogDetail,
   renderAdminGiftCards:    renderAdminGiftCards,
   renderAdminGiftCard:     renderAdminGiftCard,
   renderAdminTaxRates:     renderAdminTaxRates,

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.16",
+  "version": "0.3.18",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/search-facets.js

@@ -36,10 +36,12 @@
  *        the facet registry portable across whichever search
  *        backend the operator chooses.
  *
- *   `previewQuery({ query, filters })` returns the product count +
- *   a sample of matching products for a candidate filter
- *   combination — used by the storefront to render "Show 23 results"
- *   before the shopper commits the click.
+ *   `previewQuery({ query, filters, sample?, offset? })` returns the
+ *   product count + a window of matching products for a candidate
+ *   filter combination — used by the storefront to render "Show 23
+ *   results" before the shopper commits the click, and to page the
+ *   results grid (`offset`/`sample` window the matches; `total` stays
+ *   the full passing count so the result-count copy is page-independent).
  *
  *   `recordFacetUse({ key, value, session_id })` appends an
  *   analytics row. The session id is namespaceHashed under
@@ -66,7 +68,7 @@
  *     - updateFacet(key, patch)
  *     - archiveFacet(key)
  *     - getFacets({ query?, applied_filters?, scope? })
- *     - previewQuery({ query?, filters })
+ *     - previewQuery({ query?, filters, sample?, offset? })
  *     - recordFacetUse({ key, value, session_id })
  *
  *   Catalog contract — the operator passes a `catalog` to the
@@ -768,6 +770,13 @@ function create(opts) {
       var qStr    = _optQuery(input.query, "searchFacets.previewQuery");
       var filters = _appliedFilters(input.filters, "searchFacets.previewQuery");
       var sample  = _sampleSize(input.sample, "searchFacets.previewQuery");
+      // `offset` pages the returned window over the full passing set so a
+      // caller can request page N of the matches (storefront search
+      // pagination) without re-running the in-memory filter walk. The
+      // `total` is always the REAL passing count — the page window never
+      // changes it — so the result-count copy stays honest regardless of
+      // which page is requested. Defaults to 0 (the first window).
+      var offset  = _offset(input.offset, "searchFacets.previewQuery");
 
       var facets = await _loadFacets();
       var facetsByKey = {};
@@ -790,7 +799,7 @@ function create(opts) {
       }
       return {
         total:   passing.length,
-        sample:  passing.slice(0, sample),
+        sample:  passing.slice(offset, offset + sample),
       };
     },
 

package/lib/storefront.js

@@ -243,6 +243,7 @@ var LAYOUT =
   "  <title>{{title}} — {{shop_name}}</title>\n" +
   "  <meta name=\"description\" content=\"{{og_description}}\">\n" +
   "  <link rel=\"canonical\" href=\"{{canonical_url}}\">\n" +
+  "RAW_ROBOTS_META" +
   "  <link rel=\"icon\" type=\"image/svg+xml\" href=\"/assets/brand/favicon.svg\">\n" +
   "  <link rel=\"icon\" type=\"image/png\" href=\"/assets/brand/favicon.png\">\n" +
   "  <link rel=\"apple-touch-icon\" href=\"/assets/brand/favicon.png\">\n" +
@@ -755,8 +756,21 @@ function _wrap(opts) {
     vars[ck] = chrome[ck];
   }
 
+  // Per-page robots directive. Indexable pages (the default) emit no
+  // robots meta — the absence means "index, follow". Pages the storefront
+  // keeps out of search (cart / account / any session-scoped surface)
+  // pass `robots: "noindex"`, which stamps a noindex,nofollow meta in the
+  // <head> — a belt-and-suspenders pairing with the robots.txt Disallow +
+  // the edge `x-robots-tag` header, so a directly-fetched page is also
+  // self-describing. A noindex page needs no canonical (a crawler won't
+  // index it to dedupe), so these pages don't thread a canonical_url.
+  var robotsMeta = (opts.robots === "noindex")
+    ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
+    : "";
+
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_ROBOTS_META", robotsMeta)
     .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
@@ -1331,6 +1345,87 @@ function _renderSearchChips(facets, filters, q) {
   return "<div class=\"search-active-filters\" aria-label=\"Active filters\">\n" + chips + clearAll + "</div>\n";
 }
 
+// The fixed search page size — the number of result cards one page of
+// `/search` shows. Pages beyond the first are reached via `?page=N`
+// links the pagination nav emits (the real total drives how many pages
+// exist). Mirrors the edge renderer's SEARCH_PAGE_SIZE.
+var SEARCH_PAGE_SIZE = 24;
+
+// `/search?...` URL for a specific results page — the query + active
+// filters carried forward (so paging preserves the facet state) with a
+// `page` param appended for any page past the first. Page 1 omits the
+// param so the canonical first page has one URL. Mirrors the edge
+// renderer's `_searchPageUrl` byte-for-byte.
+function _searchPageUrl(q, filters, page) {
+  var base = _searchUrl(q, filters);
+  if (page <= 1) return base;
+  return base + (base.indexOf("?") === -1 ? "?" : "&") + "page=" + page;
+}
+
+var SEARCH_PAGE_LINK =
+  "<li class=\"search-pagination__page\"><a class=\"search-pagination__link\" href=\"{{href}}\"{{aria_current}}>{{n}}</a></li>\n";
+
+// Numbered prev/next pagination for the result grid. No-JS + SEO-
+// friendly: every page is a real `?page=N` link carrying the active
+// query + facets, `rel="prev"/"next"` mark the sequence, and the current
+// page is `aria-current="page"`. Renders nothing for a single page (the
+// default when a caller threads no total — keeps the unpaginated render
+// byte-identical). `total` is the REAL match count (not the page slice
+// length); `page` is the 1-based current page. Mirrors the edge
+// renderer's `_renderSearchPagination` byte-for-byte.
+function _renderSearchPagination(q, filters, total, page, pageSize) {
+  var size = pageSize > 0 ? pageSize : SEARCH_PAGE_SIZE;
+  var totalPages = Math.max(1, Math.ceil(total / size));
+  if (totalPages <= 1) return "";
+  var cur = page < 1 ? 1 : (page > totalPages ? totalPages : page);
+  var prev = cur > 1
+    ? _render("<a class=\"search-pagination__link search-pagination__prev\" href=\"{{href}}\" rel=\"prev\">Previous</a>\n",
+        { href: _searchPageUrl(q, filters, cur - 1) })
+    : "<span class=\"search-pagination__link search-pagination__prev is-disabled\" aria-disabled=\"true\">Previous</span>\n";
+  var next = cur < totalPages
+    ? _render("<a class=\"search-pagination__link search-pagination__next\" href=\"{{href}}\" rel=\"next\">Next</a>\n",
+        { href: _searchPageUrl(q, filters, cur + 1) })
+    : "<span class=\"search-pagination__link search-pagination__next is-disabled\" aria-disabled=\"true\">Next</span>\n";
+  var pagesHtml = "";
+  for (var n = 1; n <= totalPages; n += 1) {
+    pagesHtml += _render(SEARCH_PAGE_LINK, {
+      href:         _searchPageUrl(q, filters, n),
+      aria_current: n === cur ? "RAW_ARIA" : "",
+      n:            String(n),
+    }).replace("RAW_ARIA", n === cur ? " aria-current=\"page\"" : "");
+  }
+  return "<nav class=\"search-pagination\" aria-label=\"Search results pages\">\n" +
+    prev +
+    "<ol class=\"search-pagination__pages\">\n" + pagesHtml + "</ol>\n" +
+    next +
+    "</nav>\n";
+}
+
+// Read the 1-based `?page=N` results page off a parsed URL. A missing,
+// non-integer, or sub-1 value reads as page 1 (the canonical first page);
+// the upper bound is clamped against the real page count by `_clampPage`
+// once the total is known. Defensive request-shape reader — returns the
+// safe default for any garbage rather than throwing.
+function _parsePageParam(url) {
+  if (!url || !url.searchParams) return 1;
+  var raw = url.searchParams.get("page");
+  if (raw == null) return 1;
+  if (!/^[0-9]{1,9}$/.test(raw)) return 1;
+  var n = parseInt(raw, 10);
+  return n >= 1 ? n : 1;
+}
+
+// Clamp a 1-based page to `[1, lastPage]` for a given total + page size.
+// A `?page` past the end serves the last page (a stable, link-followable
+// result) rather than an empty grid; a zero-result query stays on page 1.
+function _clampPage(page, total, pageSize) {
+  var size = pageSize > 0 ? pageSize : SEARCH_PAGE_SIZE;
+  var lastPage = Math.max(1, Math.ceil(total / size));
+  if (page < 1) return 1;
+  if (page > lastPage) return lastPage;
+  return page;
+}
+
 // Hard caps mirroring `lib/search-facets.js`'s applied-filter
 // validators so a hostile / stale URL can't blow the in-memory facet
 // walk. Garbage values and unknown facet keys are dropped (not
@@ -1377,6 +1472,14 @@ function renderSearch(opts) {
   var facets   = Array.isArray(opts.facets) ? opts.facets : [];
   var filters  = (opts.filters && typeof opts.filters === "object") ? opts.filters : {};
   var hasFilters = Object.keys(filters).length > 0;
+  // The result count copy + the page math run off the REAL match total —
+  // the count of every product the query matched, not the length of the
+  // page slice the renderer was handed. A caller that doesn't thread a
+  // total (a unit test rendering one page directly) falls back to the page
+  // length so the unpaginated render is unchanged.
+  var pageSize    = (typeof opts.page_size === "number" && opts.page_size > 0) ? opts.page_size : SEARCH_PAGE_SIZE;
+  var totalCount  = (typeof opts.total === "number" && opts.total >= 0) ? opts.total : products.length;
+  var page        = (typeof opts.page === "number" && opts.page >= 1) ? Math.floor(opts.page) : 1;
   var qTrim = opts.q.trim();
   var title, summary, emptyHeading, emptyCopy;
   if (qTrim.length === 0) {
@@ -1384,14 +1487,14 @@ function renderSearch(opts) {
     summary      = "Use the search box in the header to look for a product by title, SKU, or description.";
     emptyHeading = "What are you looking for?";
     emptyCopy    = "Type a query in the header search to find products by title, SKU, or description.";
-  } else if (products.length === 0) {
+  } else if (totalCount === 0) {
     title        = "No matches";
     summary      = "Nothing in the catalog matched “" + qTrim + "”.";
     emptyHeading = "We don't carry that yet";
     emptyCopy    = "Try a broader term, or browse every product on the home page.";
   } else {
     title   = "“" + qTrim + "”";
-    summary = "Showing " + products.length + " match" + (products.length === 1 ? "" : "es") + " for your query.";
+    summary = "Showing " + totalCount + " match" + (totalCount === 1 ? "" : "es") + " for your query.";
   }
 
   var correctionHtml = "";
@@ -1424,6 +1527,14 @@ function renderSearch(opts) {
     }).join("\n");
     resultsInner = "<section class=\"search-grid\"><div class=\"grid\">" + cards + "</div></section>";
   }
+  // Pagination nav under the grid — `?page=N` links carrying the active
+  // query + facets so paging never drops the filter state. Renders nothing
+  // for a single page (the result count fits one page) or the empty / no-
+  // query states. Driven by the real total, not the page slice length.
+  var paginationHtml = (qTrim.length > 0 && totalCount > 0)
+    ? _renderSearchPagination(opts.q, filters, totalCount, page, pageSize)
+    : "";
+  resultsInner += paginationHtml;
   var body;
   if (facetsHtml.length > 0) {
     body = header + correctionHtml + chipsHtml +
@@ -2689,6 +2800,7 @@ function renderCollectionList(opts) {
   return _wrap({
     title: "Collections", shop_name: opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
   });
 }
 
@@ -2719,6 +2831,7 @@ function renderCollection(opts) {
   return _wrap({
     title: col.title, shop_name: opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    canonical_url: opts.canonical_url, og_url: opts.og_url,
   });
 }
 
@@ -4969,6 +5082,11 @@ function renderCart(opts) {
     shop_name:  shopName,
     cart_count: lines.length,
     theme_css: opts.theme_css,
+    // The cart is session-scoped and robots.txt-disallowed — keep it out
+    // of the index with a noindex meta (matches the edge x-robots-tag on
+    // the guest cart render), so a directly-crawled cart URL is self-
+    // describing rather than relying on robots.txt alone.
+    robots:     "noindex",
     body:       body,
   }, _currencyWrapOpts(opts)));
 }
@@ -5808,6 +5926,10 @@ function renderAccount(opts) {
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     theme_css: opts.theme_css,
+    // The account dashboard is per-customer + robots.txt-disallowed — keep
+    // it out of the index with a noindex meta rather than relying on the
+    // crawl policy alone.
+    robots:     "noindex",
     body:       body,
   });
 }
@@ -7396,10 +7518,17 @@ function mount(router, deps) {
     // otherwise round-trip through the LIKE escape function.
     if (q.length > 200) q = q.slice(0, 200);
 
+    // 1-based results page from `?page=N`. A missing / non-numeric /
+    // out-of-low-range value reads as page 1; the upper bound is clamped
+    // to the real page count once the total is known (below) so a `?page`
+    // past the end serves the last page rather than an empty grid.
+    var page = _parsePageParam(url);
+
     var products    = [];
     var facetGroups = [];
     var filters     = {};
     var correctedQ  = "";
+    var totalCount  = 0;
 
     if (q.trim().length > 0) {
       // Synonym + typo rewrite expands the typed query into the
@@ -7434,11 +7563,28 @@ function mount(router, deps) {
         var facetDefs = await sfInstance.listFacets({});
         filters = _parseSearchFilters(url, facetDefs);
         facetGroups = await sfInstance.getFacets({ query: q, applied_filters: filters });
-        var preview = await sfInstance.previewQuery({ query: q, filters: filters, sample: 24 });
+        // First pass reads the REAL total so the result-count copy is
+        // honest and the page can be clamped to the last page. The second
+        // pass windows that page (offset/sample) over the full passing set
+        // — pages past the first are reachable, not discarded at 24.
+        var totalPreview = await sfInstance.previewQuery({ query: q, filters: filters, sample: 0 });
+        totalCount = totalPreview.total;
+        page = _clampPage(page, totalCount, SEARCH_PAGE_SIZE);
+        var preview = await sfInstance.previewQuery({
+          query:  q,
+          filters: filters,
+          sample:  SEARCH_PAGE_SIZE,
+          offset:  (page - 1) * SEARCH_PAGE_SIZE,
+        });
         products = preview.sample;
       } else {
-        // No facet dep — flat search over the expanded terms.
-        products = (await _facetableUniverse(terms)).slice(0, 24);
+        // No facet dep — flat search over the expanded terms. The full
+        // matched universe gives the honest total; the page is the
+        // windowed slice (the same page size the faceted path uses).
+        var flatUniverse = await _facetableUniverse(terms);
+        totalCount = flatUniverse.length;
+        page = _clampPage(page, totalCount, SEARCH_PAGE_SIZE);
+        products = flatUniverse.slice((page - 1) * SEARCH_PAGE_SIZE, page * SEARCH_PAGE_SIZE);
       }
     }
 
@@ -7450,6 +7596,9 @@ function mount(router, deps) {
       facets:          facetGroups,
       filters:         filters,
       corrected_query: correctedQ,
+      total:           totalCount,
+      page:            page,
+      page_size:       SEARCH_PAGE_SIZE,
       shop_name:       shopName,
       cart_count:      cartCount,
     }, _requestUrls(req), ccy)));
@@ -7809,9 +7958,9 @@ function mount(router, deps) {
     router.get("/collections", async function (req, res) {
       var cols = await deps.collections.list({ active_only: true });
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCollectionList({
+      _send(res, 200, renderCollectionList(Object.assign({
         collections: cols, shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
-      }));
+      }, _requestUrls(req))));
     });
 
     router.get("/collections/:slug", async function (req, res) {
@@ -7835,9 +7984,9 @@ function mount(router, deps) {
         if (card) products.push(card);
       }
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderCollection({
+      _send(res, 200, renderCollection(Object.assign({
         collection: col, products: products, shop_name: shopName, cart_count: cartCount,
-      }));
+      }, _requestUrls(req))));
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {