@blamejs/blamejs-shop 0.3.26 → 0.3.27

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.27 (2026-05-31) — **Shared product and page links now show a preview image, and category pages get breadcrumb rich results.** Social-share previews and search rich results were emitting relative image paths, which Facebook, Slack, Twitter, iMessage, and Google all drop — so a shared product or page link showed no preview image, and product rich results had no image. Every og:image, twitter:image, and Product/Article structured-data image is now a fully-qualified URL built from the page's own origin. Collection and category pages, which already showed an on-page breadcrumb, now also emit BreadcrumbList structured data so the trail can appear in search results, matching what product pages already did. And operator-supplied page keywords or announcement text containing a dollar-sign sequence now render literally instead of being garbled. **Fixed:** *Share and rich-result images are now absolute URLs* — The og:image, twitter:image, and the image in Product and blog-article structured data were relative paths, so social platforms and Google could not load them — a shared link showed no preview image. They are now fully-qualified against the page's origin on every page, in both the edge and container renderers, so shares unfurl with the right image and product rich results carry one. Images an operator already hosts at an absolute URL pass through unchanged. · *Breadcrumb structured data on collection and category pages* — Collection and category pages showed a breadcrumb trail on the page but did not expose it as BreadcrumbList structured data, so search engines could not render the trail in results. They now emit it with absolute URLs, the same way product pages already do. · *Dollar-sign sequences in page metadata render literally* — Page meta-keywords and announcement-bar text containing a dollar-sign sequence (for example a price written with a special character) could be garbled in the page head because of how the value was substituted into the template. The substitution now treats the value as literal text, so it renders exactly as entered.
+
 - v0.3.26 (2026-05-31) — **Customers can raise support tickets and operators work them from a queue.** The support-ticket system had a complete backend — threaded messages, assignment, tags, and a status workflow — but no way in or out: a shopper could not open a ticket and an operator could not see one. Both sides are now wired. A logged-in customer can raise a ticket from their account (with an optional link to one of their own orders), see the thread, and reply while it is open. Operators get a Support queue in the console with an unassigned-triage view, the full thread for each ticket, and controls to reply (with an internal-note option that the customer never sees), assign, tag, and move the ticket through its status workflow. A customer only ever sees their own tickets, and replying to a closed ticket is refused. **Added:** *Customer support tickets* — A Support section in the account area lets a signed-in customer open a ticket (subject, message, category, and an optional reference to one of their own orders), list their tickets with status, read the full message thread, and reply while the ticket is open. Internal operator notes are never shown to the customer, a customer can only see and reply to their own tickets, and a reply to a closed ticket is refused. · *Support queue in the admin console* — A Support screen lists inbound tickets by status with an unassigned-triage view. Opening a ticket shows the full thread, the requester, the current status, the assignee, and tags. From there an operator can reply (optionally as an internal note), assign the ticket, tag it, and move it through its status workflow — in progress, waiting on the customer, resolved, closed, or reopened.
 
 - v0.3.25 (2026-05-30) — **Open an individual customer to see their orders and manage store credit, notes, and loyalty.** The customers list was view-only — there was no way to open a single customer. Each customer now has a detail screen showing their identity, recent orders (linked), store-credit balance with a grant/deduct control, loyalty balance and tier (with a link to adjust points), internal operator notes, and the segments they belong to. A store-credit grant or deduction requires a reason and is written to the store-credit ledger, an over-deduction is refused, and segment membership is shown read-only because it is computed from purchase behavior rather than set by hand. **Added:** *Customer detail screen* — Opening a customer from the roster now shows their record, recent orders, store-credit balance with a reason-gated grant/deduct (recorded in the store-credit ledger; an over-deduction is refused), their loyalty balance and tier with a link to adjust points, and an internal notes log you can add to. The segments a customer belongs to are listed read-only, since membership is derived from their behavior. Customer identity fields remain read-only by design.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.26",
+  "version": "0.3.27",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -693,7 +693,6 @@ function _wrap(opts) {
   var ogType        = opts.og_type        || "website";
   var ogTitle       = opts.og_title       || (opts.title ? opts.title + " — " + shopName : shopName);
   var ogDescription = opts.og_description || "Open-source ecommerce framework built on blamejs. Server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.";
-  var ogImage       = opts.og_image       || "/assets/brand/logo.png";
   // Absolute request URL drives both `og:url` (full URL incl. query) and
   // the canonical link (query stripped — the canonical names the page,
   // not the filtered/sorted view). Renderers thread `opts.canonical_url`
@@ -702,6 +701,14 @@ function _wrap(opts) {
   // rather than emit a bogus host-less URL.
   var canonicalUrl = opts.canonical_url || "";
   var ogUrl         = opts.og_url       || canonicalUrl;
+  // og:image / twitter:image carry a FULLY-QUALIFIED URL — a relative
+  // `/assets/...` (the brand-logo default, or a product hero) is dropped by
+  // every social-share crawler (Facebook / Slack / Twitter / iMessage) and
+  // by Google's rich result. Absolutize against the page origin so the
+  // share preview resolves; an operator-hosted `http(s)://` image passes
+  // through unchanged. Every container page funnels through `_wrap`, so
+  // this is the single absolutization site for the storefront's meta tags.
+  var ogImage       = _absolutizeOgImage(opts.og_image || "/assets/brand/logo.png", canonicalUrl, shopName);
   // Multi-currency display switcher — populated only when the operator
   // configured >1 display currency (opts.currency_options). The block is
   // empty otherwise, so a single-currency store renders unchanged.
@@ -796,12 +803,18 @@ function _wrap(opts) {
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_ROBOTS_META", robotsMeta)
-    .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "");
+  // The announcement bar carries operator-supplied message text (HTML-
+  // escaped, but `$` is not an escaped character), so splice it via the
+  // replacer-function helper — a `$&` / `` $` `` / `$N` in the message must
+  // land literally, not trigger `String.replace`'s dollar substitution.
+  // Matches the edge renderers' `spliceRaw` so the dual-render stays
+  // byte-consistent under a `$`-bearing announcement. See `_spliceRaw`.
+  assembled = _spliceRaw(assembled, "RAW_ANNOUNCEMENT_BAR", announcementBarHtml);
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
@@ -1204,6 +1217,30 @@ function _absoluteBase(canonicalUrl, shopName) {
   return "https://" + String(shopName || "blamejs.shop").replace(/^https?:\/\//, "");
 }
 
+// Absolutize an og:image / twitter:image / JSON-LD image value against the
+// page origin. A relative `/assets/...` path (the brand-logo default, or a
+// hero R2 key joined onto the asset prefix) becomes `<origin>/assets/...`
+// so every social-share crawler and rich-result fetch resolves it — a
+// relative path is dropped by Facebook / Slack / Twitter / iMessage and by
+// Google's product rich result. An already-absolute `http(s)://` value is
+// left unchanged (an operator-hosted image), and a value that is neither a
+// `/`-rooted path nor an absolute URL is returned as-is (nothing safe to
+// prefix). Absolutizes only against a reliable origin: with a canonical URL
+// the request origin is used; without one, the shop-name host is used ONLY
+// when it is usable as a host (no whitespace) — a display-name shop such as
+// "Test Shop" would otherwise emit an invalid "https://Test Shop/..." URL,
+// so the path is left relative (it still resolves against the page on a
+// crawler fetch). Mirrors the edge's worker/render/_lib.js `absolutizeOgImage`
+// so the two substrates emit identical absolute image URLs.
+function _absolutizeOgImage(value, canonicalUrl, shopName) {
+  var v = (value == null) ? "" : String(value);
+  if (/^https?:\/\//i.test(v)) return v;
+  if (v.charAt(0) !== "/") return v;
+  var hasCanonical = typeof canonicalUrl === "string" && canonicalUrl.length > 0;
+  if (!hasCanonical && /\s/.test(String(shopName == null ? "" : shopName))) return v;
+  return _absoluteBase(canonicalUrl, shopName) + v;
+}
+
 // Schema.org Organization + WebSite JSON-LD for the home page. Shared by
 // the container `renderHome` and mirrored by the edge
 // `worker/render/home.js` — keep the two byte-identical. The base URL is
@@ -2860,9 +2897,25 @@ function renderCollection(opts) {
       "</header>" +
       grid +
     "</section>";
+  // BreadcrumbList JSON-LD mirroring the on-page `<nav class="breadcrumb">`
+  // trail (Shop → Collections → this collection). Google's result panel
+  // renders the trail above the title; the `item` URLs are absolute so the
+  // structured data is fully-qualified. Mirrors the PDP's breadcrumb shape.
+  var shopName = opts.shop_name || "blamejs.shop";
+  var absoluteBase = _absoluteBase(opts.canonical_url, shopName);
+  var breadcrumbJsonLd = _jsonLdScript({
+    "@context":        "https://schema.org",
+    "@type":           "BreadcrumbList",
+    "itemListElement": [
+      { "@type": "ListItem", "position": 1, "name": "Shop", "item": absoluteBase + "/" },
+      { "@type": "ListItem", "position": 2, "name": "Collections", "item": absoluteBase + "/collections" },
+      { "@type": "ListItem", "position": 3, "name": col.title, "item": absoluteBase + "/collections/" + col.slug },
+    ],
+  });
   return _wrap({
-    title: col.title, shop_name: opts.shop_name || "blamejs.shop",
-    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+    title: col.title, shop_name: shopName,
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css,
+    body: body + breadcrumbJsonLd,
     canonical_url: opts.canonical_url, og_url: opts.og_url,
   });
 }
@@ -2971,15 +3024,40 @@ function renderCategory(opts) {
     "</section>";
   // Per-page meta description: the category's own description when set,
   // otherwise a "Shop {category}…" pitch.
+  var shopName = opts.shop_name || "blamejs.shop";
   var catMetaDescription = (cat.description && String(cat.description).trim().length)
     ? String(cat.description)
-    : ("Shop " + cat.title + " at " + (opts.shop_name || "blamejs.shop") + ".");
+    : ("Shop " + cat.title + " at " + shopName + ".");
+  // BreadcrumbList JSON-LD mirroring the on-page `<nav class="breadcrumb">`
+  // chain (Shop → Categories → …root→current). Google's result panel
+  // renders the trail above the title; the `item` URLs are absolute so the
+  // structured data is fully-qualified. The breadcrumb chain's last entry
+  // is the current category (rendered as plain text on-page), included here
+  // as the trailing list item with its own URL. Mirrors the PDP shape.
+  var absoluteBase = _absoluteBase(opts.canonical_url, shopName);
+  var crumbItems = [
+    { "@type": "ListItem", "position": 1, "name": "Shop", "item": absoluteBase + "/" },
+    { "@type": "ListItem", "position": 2, "name": "Categories", "item": absoluteBase + "/categories" },
+  ];
+  for (var bi = 0; bi < crumbs.length; bi += 1) {
+    crumbItems.push({
+      "@type":    "ListItem",
+      "position": bi + 3,
+      "name":     crumbs[bi].title,
+      "item":     absoluteBase + "/categories/" + crumbs[bi].slug,
+    });
+  }
+  var breadcrumbJsonLd = _jsonLdScript({
+    "@context":        "https://schema.org",
+    "@type":           "BreadcrumbList",
+    "itemListElement": crumbItems,
+  });
   return _wrap({
-    title: cat.title, shop_name: opts.shop_name || "blamejs.shop",
+    title: cat.title, shop_name: shopName,
     cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css,
     og_description: catMetaDescription,
     canonical_url: opts.canonical_url, og_url: opts.og_url,
-    body: body,
+    body: body + breadcrumbJsonLd,
   });
 }
 
@@ -4191,12 +4269,21 @@ function renderProduct(opts) {
   // unfurl as "Operator Tee — blamejs.shop" with the SVG hero, not
   // the default shop-level description + brand logo.
   var heroMedia = (opts.media && opts.media[0]) || null;
-  var ogImage   = heroMedia ? ((opts.asset_prefix || "/assets/") + heroMedia.r2_key) : "/assets/brand/logo.png";
   // Absolute base for the BreadcrumbList `item` URLs — derived from the
   // PDP's own canonical (origin stripped of the /products/slug path) so
   // the structured-data trail carries fully-qualified URLs. Falls back to
   // the shop-name host when the renderer is called without a request URL.
   var absoluteBase = _absoluteBase(opts.canonical_url, shopName);
+  // og:image / twitter:image / the Product JSON-LD `image` all carry a
+  // FULLY-QUALIFIED URL — a relative hero path (or the brand-logo default)
+  // is dropped by social-share crawlers and by Google's product rich
+  // result. Absolutize once here so the JSON-LD `image` (built below,
+  // before `_wrap`) and the meta tags (`_wrap` re-runs the idempotent
+  // absolutizer) both carry the resolved URL.
+  var ogImage   = _absolutizeOgImage(
+    heroMedia ? ((opts.asset_prefix || "/assets/") + heroMedia.r2_key) : "/assets/brand/logo.png",
+    opts.canonical_url, shopName
+  );
 
   // Product + AggregateOffer JSON-LD, with AggregateRating folded in
   // when published reviews exist. Kept byte-compatible with the edge
@@ -12166,6 +12253,10 @@ module.exports = {
   renderHome:            renderHome,
   renderSearch:          renderSearch,
   renderProduct:         renderProduct,
+  renderCollectionList:  renderCollectionList,
+  renderCollection:      renderCollection,
+  renderCategoryIndex:   renderCategoryIndex,
+  renderCategory:        renderCategory,
   renderCart:            renderCart,
   renderCheckoutForm:    renderCheckoutForm,
   renderCheckoutError:   renderCheckoutError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.26",
+  "version": "0.3.27",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {