@blamejs/blamejs-shop 0.3.33 → 0.3.35

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.35 (2026-05-31) — **Share a wishlist with a private link.** A customer's wishlist could only be viewed by the customer themselves. From the wishlist page a shopper can now create a shareable link and send it to someone — a friend buying a gift, for example — who opens it without needing an account and sees the wishlist's products. The link can be revoked at any time, after which it stops working. The shared page shows only the products: it does not reveal who owns the wishlist or any private notes on it, and it is not indexed by search engines. **Added:** *Shareable wishlist links* — The wishlist page now has a Share control that creates a private link to the wishlist. The full link is shown once, to copy and send; anyone with it can open the shared wishlist without an account and see its products, each linking to the product page. The owner sees their active links and can revoke any of them, which immediately stops the link from working. The shared view shows only the products — never the owner's identity or private notes — and is marked not to be indexed by search engines, so a personal wishlist stays private to whoever holds the link.
+
+- v0.3.34 (2026-05-31) — **Edit, pin, and archive the internal notes on a customer.** Internal notes on a customer could only be added — a note with a typo or one that was no longer true could not be corrected or removed, which is a liability for notes like "do not ship to this address" or "allergic to X". The customer detail screen now lets you edit a note's text, pin important notes to the top, and archive notes that no longer apply (and restore them). Each action is limited to notes that belong to the customer being viewed. **Added:** *Edit, pin, and archive customer notes* — The notes panel on a customer's detail screen now supports the full lifecycle: edit a note's text to fix or update it, pin the notes that matter so they sort to the top, and archive notes that no longer apply, with a toggle to show archived notes and restore them. Previously notes were append-only, so a wrong or stale note could not be corrected or retired. Every edit, pin, and archive action is scoped to the customer being viewed, so a note can only be changed from the record it belongs to.
+
 - v0.3.33 (2026-05-31) — **Create and manage customer segments from the admin console.** Customer segments could be shown on a customer's profile but there was no way to define or manage them, so the feature could not actually be used. A new Segments screen in the admin console creates rule-based segments from recency, frequency, lifetime-order, spend, average-order-value, and refund-rate criteria, edits their rules, archives and restores them, and recomputes membership on demand — showing how many customers each segment now contains. Segment membership stays rule-derived: it is recalculated from order history, not assigned by hand. **Added:** *Customer segments administration* — A Segments screen in the admin console manages rule-based customer segments. Each segment is defined by RFM-style criteria — how recently and how often a customer orders, their lifetime order count and spend, average order value, and refund rate — and a list shows every segment with its rules, current member count, and status, filterable by active or archived. You can create and edit segments, archive and restore them, and recompute membership on demand, which re-evaluates the rules against order history and reports how many customers match. Membership is always derived from the rules, never assigned per customer.
 
 - v0.3.32 (2026-05-31) — **Collection pages now page through every product instead of stopping at 24.** A collection page showed only its first 24 products and provided no way to reach the rest, so any product past the 24th in a collection was silently unreachable. Collection pages now have previous/next pagination, matching the search results, so a collection of any size can be browsed in full. A shared link to a specific page keeps its position, while the page's canonical URL stays the plain collection address. **Fixed:** *Collection pages paginate* — A collection with more than 24 products was truncated at the first 24 with no way to see the others. Collection pages now carry previous/next pagination — the same control used on search results — so every product in a collection is reachable. The canonical URL remains the bare collection address on every page (so search engines see one collection page, not duplicates), while a shared link to a deeper page preserves its position.

package/lib/admin.js

@@ -2674,8 +2674,13 @@ function mount(router, deps) {
       }
 
       var notes = [];
+      var showArchivedNotes = flags.show_archived_notes === true;
       if (customerNotes) {
-        try { notes = (await customerNotes.notesForCustomer({ customer_id: customer.id, limit: 20 })).rows || []; }
+        try {
+          notes = (await customerNotes.notesForCustomer({
+            customer_id: customer.id, limit: 50, include_archived: showArchivedNotes,
+          })).rows || [];
+        }
         catch (_e) { notes = []; }
       }
 
@@ -2698,6 +2703,7 @@ function mount(router, deps) {
         loyalty_link:   !!deps.loyalty,
         can_notes:      !!customerNotes,
         notes:          notes,
+        show_archived_notes: showArchivedNotes,
         can_segments:   !!customerSegments,
         segments:       segments,
       }, flags);
@@ -2716,8 +2722,13 @@ function mount(router, deps) {
       R(async function (req, res) {
         var c = await _resolveCustomer(req.params.id);
         if (!c) return _problem(res, 404, "customer-not-found");
-        // Bearer JSON: the customer record + its satellites (no HTML).
-        var model = await _customerDetailModel(c, {});
+        // Bearer JSON: the customer record + its satellites (no HTML). A
+        // tooling client can opt into the archived notes via
+        // ?notes_archived=1, matching the browser detail-screen toggle.
+        var apiUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        var model = await _customerDetailModel(c, {
+          show_archived_notes: !!(apiUrl && apiUrl.searchParams.get("notes_archived") === "1"),
+        });
         _json(res, 200, {
           customer:             c,
           recent_orders:        model.recent_orders,
@@ -2738,6 +2749,7 @@ function mount(router, deps) {
           saved:        url && url.searchParams.get("saved"),
           credit_notice: url && url.searchParams.get("credit_err") ? url.searchParams.get("credit_err") : null,
           note_notice:   url && url.searchParams.get("note_err") ? url.searchParams.get("note_err") : null,
+          show_archived_notes: !!(url && url.searchParams.get("notes_archived") === "1"),
         };
         _sendHtml(res, 200, renderAdminCustomerDetail(await _customerDetailModel(c, flags)));
       },
@@ -2870,6 +2882,104 @@ function mount(router, deps) {
           _redirect(res, "/admin/customers/" + encodeURIComponent(c.id) + "?saved=1");
         },
       ));
+
+      // ---- customer notes (edit / pin / archive lifecycle) ---------------
+      // A note belongs to a customer. customerNotes' update / pin / archive
+      // methods move a row by note id alone — they carry no notion of which
+      // customer the operator is acting on — so every per-note write route
+      // under :id MUST first assert the note belongs to THAT customer before
+      // mutating it, or an operator on customer A's screen could edit / pin /
+      // retire customer B's note by guessing its id (an IDOR). This mirrors
+      // the media setPrimary (_mediaBelongsToProduct) + support thread
+      // (_ownedTicket) scoping: load the note, refuse it unless its
+      // customer_id matches the path id. A malformed note id throws a
+      // TypeError inside getNote's UUID guard → a clean 400; a well-formed
+      // unknown id (or one owned by a different customer) returns null /
+      // false → a clean 404, with nothing written either way.
+      async function _noteBelongsToCustomer(noteId, customerId) {
+        var note;
+        try { note = await customerNotes.getNote(noteId); }
+        catch (e) { if (e instanceof TypeError) throw e; return false; }
+        return (note && note.customer_id === customerId) ? note : false;
+      }
+
+      // Map a per-note write to a content-negotiated outcome. `mutate(note)`
+      // performs the customerNotes call (already ownership-checked); on the
+      // bearer path it returns the updated note as JSON, on the browser path
+      // it PRGs back to the detail screen with a saved / note_err banner.
+      // A malformed note id is a clean 400 (bearer) / note_err redirect
+      // (browser); a missing / cross-customer note is a clean 404 (bearer) /
+      // note_err redirect (browser). Nothing is mutated on any refusal.
+      function _noteWriteRoute(routePath, audit, mutate) {
+        router.post(routePath, _pageOrApi(false,
+          W(audit, async function (req, res) {
+            var c = await _resolveCustomer(req.params.id);
+            if (!c) return _problem(res, 404, "customer-not-found");
+            var owned;
+            try { owned = await _noteBelongsToCustomer(req.params.noteId, c.id); }
+            catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+            if (!owned) return _problem(res, 404, "note-not-found");
+            var updated;
+            try { updated = await mutate(owned, req.body || {}); }
+            catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+            _json(res, 200, updated);
+            return { id: c.id };
+          }),
+          async function (req, res) {
+            var c = await _resolveCustomer(req.params.id);
+            if (!c) return _sendHtml(res, 404, renderAdminCustomers({
+              shop_name: deps.shop_name, nav_available: navAvailable, customers: [], notice: "Customer not found.",
+            }));
+            var enc = encodeURIComponent(c.id);
+            var owned;
+            try { owned = await _noteBelongsToCustomer(req.params.noteId, c.id); }
+            catch (e) {
+              var nm = _safeNotice(e, audit);
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent(nm.message.replace(/^(?:admin|customerNotes)[.:]\s*/, "")));
+            }
+            if (!owned) {
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent("That note was not found on this customer."));
+            }
+            try { await mutate(owned, req.body || {}); }
+            catch (e) {
+              var n = _safeNotice(e, audit);
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent(n.message.replace(/^(?:admin|customerNotes)[.:]\s*/, "")));
+            }
+            b.audit.safeEmit({ action: AUDIT_NAMESPACE + "." + audit, outcome: "success", metadata: { id: c.id } });
+            _redirect(res, "/admin/customers/" + enc + "?saved=1");
+          },
+        ));
+      }
+
+      // Edit the note body / kind. The new text is required + length-capped by
+      // the primitive's validator (empty / over-long body, bad kind → a clean
+      // 4xx with nothing written); the kind is left unchanged when the form
+      // omits it.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/edit", "customer.note.edit",
+        function (owned, body) {
+          var patch = { body: body.body };
+          if (body.kind != null && body.kind !== "") patch.kind = body.kind;
+          return customerNotes.updateNote(owned.id, patch);
+        });
+
+      // Pin / unpin — a pinned note floats to the top of the customer's note
+      // list (notesForCustomer orders pinned DESC). Idempotent at the
+      // primitive.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/pin", "customer.note.pin",
+        function (owned) { return customerNotes.pinNote(owned.id); });
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/unpin", "customer.note.unpin",
+        function (owned) { return customerNotes.unpinNote(owned.id); });
+
+      // Archive / unarchive — a soft-retire that drops the note from the
+      // default (active) listing; unarchive brings it back. Both idempotent at
+      // the primitive.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/archive", "customer.note.archive",
+        function (owned) { return customerNotes.archiveNote(owned.id); });
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/unarchive", "customer.note.unarchive",
+        function (owned) { return customerNotes.unarchiveNote(owned.id); });
     }
   }
 
@@ -9925,25 +10035,56 @@ function renderAdminCustomerDetail(opts) {
       "<p class=\"empty\">Customer notes aren't wired in this deployment.</p></div>";
   } else {
     var noteNotice = opts.note_notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.note_notice) + "</div>" : "";
+    var showArchived = opts.show_archived_notes === true;
+    // A <select name="kind"> with the active kind preselected. Reused by the
+    // add form and each note's inline edit form.
+    function _noteKindSelect(active) {
+      return ["general", "preference", "escalation", "warning", "billing"].map(function (k) {
+        return "<option value=\"" + k + "\"" + (k === active ? " selected" : "") + ">" + k + "</option>";
+      }).join("");
+    }
     var noteRows = (opts.notes || []).map(function (n) {
-      return "<li><div class=\"note-meta\">" + _htmlEscape(n.kind) + " · " + _htmlEscape(_fmtDate(n.created_at)) + "</div>" +
-        "<div class=\"note-body\">" + _htmlEscape(n.body) + "</div></li>";
+      var nenc = _htmlEscape(encodeURIComponent(n.id));
+      var base = "/admin/customers/" + _htmlEscape(enc) + "/notes/" + nenc;
+      var isPinned   = Number(n.pinned) === 1;
+      var isArchived = n.archived_at != null;
+      var pills =
+        (isPinned ? "<span class=\"status-pill paid\">Pinned</span>" : "") +
+        (isArchived ? "<span class=\"status-pill cancelled\">Archived</span>" : "");
+      // Inline edit form — kind + body, prefilled with the note's current
+      // values; the primitive re-validates an empty / over-long body.
+      var editForm = "<details class=\"note-edit\"><summary class=\"btn btn--ghost\">Edit</summary>" +
+        "<form method=\"post\" action=\"" + base + "/edit\">" +
+          "<label class=\"form-field\"><span>Kind</span>" +
+            "<select name=\"kind\">" + _noteKindSelect(n.kind) + "</select></label>" +
+          "<label class=\"form-field\"><span>Note</span>" +
+            "<textarea name=\"body\" required maxlength=\"8000\" rows=\"3\">" + _htmlEscape(n.body) + "</textarea></label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save note</button></div>" +
+        "</form></details>";
+      var pinForm = "<form method=\"post\" action=\"" + base + (isPinned ? "/unpin" : "/pin") + "\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">" + (isPinned ? "Unpin" : "Pin") + "</button></form>";
+      var archiveForm = "<form method=\"post\" action=\"" + base + (isArchived ? "/unarchive" : "/archive") + "\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">" + (isArchived ? "Unarchive" : "Archive") + "</button></form>";
+      return "<li class=\"note-item\">" +
+        "<div class=\"note-meta\">" + _htmlEscape(n.kind) + " · " + _htmlEscape(_fmtDate(n.created_at)) +
+          (pills ? " " + pills : "") + "</div>" +
+        "<div class=\"note-body\">" + _htmlEscape(n.body) + "</div>" +
+        "<div class=\"actions-row\">" + editForm + pinForm + archiveForm + "</div>" +
+      "</li>";
     }).join("");
-    notesPanel = "<div class=\"panel\"><h3 class=\"subhead\">Notes</h3>" +
+    var archivedToggle = showArchived
+      ? "<a class=\"btn btn--ghost\" href=\"/admin/customers/" + _htmlEscape(enc) + "\">Hide archived</a>"
+      : "<a class=\"btn btn--ghost\" href=\"/admin/customers/" + _htmlEscape(enc) + "?notes_archived=1\">Show archived</a>";
+    notesPanel = "<div class=\"panel\"><div class=\"actions-row\"><h3 class=\"subhead\">Notes</h3>" + archivedToggle + "</div>" +
       noteNotice +
-      "<p class=\"meta\">Operator-only annotations on this customer. Never shown to the customer.</p>" +
+      "<p class=\"meta\">Operator-only annotations on this customer. Never shown to the customer. " +
+        "Pin the notes every shift should see first; archive a stale or wrong note to retire it from the active list.</p>" +
       ((opts.notes || []).length
         ? "<ul class=\"note-list\">" + noteRows + "</ul>"
-        : "<p class=\"empty\">No notes yet.</p>") +
+        : "<p class=\"empty\">" + (showArchived ? "No notes (including archived)." : "No notes yet.") + "</p>") +
       "<form method=\"post\" action=\"/admin/customers/" + _htmlEscape(enc) + "/notes\">" +
         "<label class=\"form-field\"><span>Kind</span>" +
-          "<select name=\"kind\">" +
-            "<option value=\"general\">general</option>" +
-            "<option value=\"preference\">preference</option>" +
-            "<option value=\"escalation\">escalation</option>" +
-            "<option value=\"warning\">warning</option>" +
-            "<option value=\"billing\">billing</option>" +
-          "</select></label>" +
+          "<select name=\"kind\">" + _noteKindSelect("general") + "</select></label>" +
         "<label class=\"form-field\"><span>Note</span>" +
           "<textarea name=\"body\" required maxlength=\"8000\" rows=\"3\" placeholder=\"e.g. VIP — comp shipping where possible\"></textarea></label>" +
         "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add note</button></div>" +

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.33",
+  "version": "0.3.35",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -2488,6 +2488,12 @@ function renderWishlist(opts) {
   var notice = okMsg
     ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(okMsg) + "</p>"
     : "";
+  // The owner's share panel — a "Share this wishlist" control plus the
+  // list of active share links each with a Revoke action. The route
+  // builds the panel HTML (it owns the share-link reads); absent it (the
+  // sharing primitive isn't wired, or a unit test calling the renderer
+  // directly) the panel is empty so the page renders unchanged.
+  var sharePanel = opts.share_panel || "";
   var body =
     "<section class=\"account-wishlist\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2496,6 +2502,7 @@ function renderWishlist(opts) {
       "</ol></nav>" +
       "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
       notice +
+      sharePanel +
       inner +
     "</section>";
   return _wrap({
@@ -2507,6 +2514,136 @@ function renderWishlist(opts) {
   });
 }
 
+// The owner-side wishlist share panel (mounts on /account/wishlist). It
+// renders a "Create a share link" control plus the owner's active share
+// links, each with a status + view count and a Revoke form. `opts.shares`
+// is the owner's links from `listSharesForOwner` (already scoped to the
+// session customer by the route). A revoked / expired link still appears
+// (greyed, no Revoke) so the owner sees the history; only an active link
+// carries a Revoke control.
+//
+// The plaintext share token is surfaced EXACTLY ONCE — at create time, via
+// `opts.fresh_url` (the full public URL of the just-minted link). The list
+// rows never carry the URL because the token isn't persisted; the owner
+// copies the link from this one-time confirmation. `opts.notice` surfaces a
+// created/revoked confirmation via role="status".
+var WISHLIST_SHARE_NOTICES = {
+  created: "Share link created. Copy it below — it's shown only once.",
+  revoked: "Share link revoked. The link no longer works.",
+};
+function _wishlistSharePanel(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var shares = opts.shares || [];
+  var nowTs = Date.now();
+  var rows = "";
+  for (var i = 0; i < shares.length; i += 1) {
+    var s = shares[i];
+    var revoked = s.revoked_at != null;
+    var expired = !revoked && s.expires_at != null && Number(s.expires_at) < nowTs;
+    var inactive = revoked || expired;
+    var statusLabel = revoked ? "Revoked" : (expired ? "Expired" : "Active");
+    var statusCls = revoked ? "wishlist-share__status--revoked"
+                  : (expired ? "wishlist-share__status--expired" : "wishlist-share__status--active");
+    var revokeForm = inactive
+      ? ""
+      : "<form class=\"wishlist-share__revoke\" method=\"post\" action=\"/wishlist/share/" + esc(s.id) + "/revoke\">" +
+          "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Revoke</button>" +
+        "</form>";
+    var viewN = Number(s.view_count) || 0;
+    rows +=
+      "<li class=\"wishlist-share" + (inactive ? " wishlist-share--inactive" : "") + "\">" +
+        "<div class=\"wishlist-share__head\">" +
+          "<span class=\"wishlist-share__status " + statusCls + "\">" + esc(statusLabel) + "</span>" +
+          "<span class=\"wishlist-share__views\">" + esc(String(viewN)) + " view" + (viewN === 1 ? "" : "s") + "</span>" +
+        "</div>" +
+        revokeForm +
+      "</li>";
+  }
+  var list = rows ? "<ul class=\"wishlist-share__list\">" + rows + "</ul>" : "";
+  var noticeMsg = WISHLIST_SHARE_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+  // The one-time URL block — present only on the create confirmation. A
+  // read-only text field the owner can copy; it never re-renders after the
+  // owner navigates away (the token isn't persisted).
+  var freshUrl = opts.fresh_url
+    ? "<div class=\"wishlist-share__fresh\">" +
+        "<label class=\"wishlist-share__fresh-label\" for=\"wishlist-share-url\">Your share link</label>" +
+        "<input id=\"wishlist-share-url\" class=\"wishlist-share__url\" type=\"text\" readonly value=\"" + esc(opts.fresh_url) + "\" " +
+          "aria-label=\"Shareable wishlist link\" onfocus=\"this.select()\">" +
+      "</div>"
+    : "";
+  return "<section class=\"wishlist-share-panel\" aria-labelledby=\"wishlist-share-heading\">" +
+           "<h2 id=\"wishlist-share-heading\" class=\"wishlist-share-panel__title\">Share this wishlist</h2>" +
+           "<p class=\"wishlist-share-panel__lede\">Create a link so friends and family can see what you're hoping for. The link shows your saved products only — it never reveals your account.</p>" +
+           notice +
+           freshUrl +
+           "<form class=\"wishlist-share-panel__create\" method=\"post\" action=\"/wishlist/share\">" +
+             "<button type=\"submit\" class=\"btn-secondary\">Create a share link</button>" +
+           "</form>" +
+           list +
+         "</section>";
+}
+
+// Public, no-auth shared-wishlist page (`GET /wishlist/shared/:token`). It
+// renders ONLY the shared product cards (title, image, link to each PDP) —
+// the owner's identity, the per-entry private notes, and the owner customer
+// id are NEVER emitted, mirroring what the primitive's `viewShared` is
+// trusted to surface to a giver. `opts.entries` is the `viewShared` entry
+// list resolved to products; `opts.title` is the share's display title.
+// Carries a noindex robots directive — a personal shared wishlist is not a
+// page search engines should index. An unknown / revoked / expired token
+// never reaches this renderer (the route 404s first via renderNotFound).
+function renderSharedWishlist(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var items = opts.items || [];
+  var prefix = opts.asset_prefix || "/assets/";
+  var heading = (opts.title && String(opts.title).length) ? opts.title : "A shared wishlist";
+  var rowsHtml = "";
+  for (var i = 0; i < items.length; i += 1) {
+    var it = items[i];
+    if (!it.product) continue;   // archived/deleted product → drop the card (no owner data to leak)
+    var slug = esc(it.product.slug);
+    var thumb = it.hero_media
+      ? "<img src=\"" + esc(prefix + it.hero_media.r2_key) + "\" alt=\"" + esc(it.hero_media.alt_text || it.product.title) + "\" loading=\"lazy\">"
+      : "<span class=\"wishlist-item__mark\" aria-hidden=\"true\">" + esc((it.product.title || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    rowsHtml +=
+      "<li class=\"wishlist-item\">" +
+        "<a class=\"wishlist-item__media\" href=\"/products/" + slug + "\">" + thumb + "</a>" +
+        "<div class=\"wishlist-item__body\">" +
+          "<a class=\"wishlist-item__title\" href=\"/products/" + slug + "\">" + esc(it.product.title) + "</a>" +
+          "<a class=\"wishlist-item__view card-link\" href=\"/products/" + slug + "\">View product →</a>" +
+        "</div>" +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"wishlist-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">This wishlist is empty right now — nothing's been saved yet.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
+  var body =
+    "<section class=\"account-wishlist\">" +
+      "<p class=\"eyebrow\">Shared with you</p>" +
+      "<h1 class=\"account-wishlist__title\">" + esc(heading) + "</h1>" +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      heading,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    // A personal shared wishlist is not search-index material — keep it
+    // out of the index. `noindex` maps to noindex,nofollow in _wrap; the
+    // page needs no canonical (a crawler won't index it to dedupe).
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
 // Compare page notice banner — surfaced after a toggle / a full-basket
 // refusal. The route passes a short message key; unknown keys render
 // nothing so a forged `?notice=` query can't inject arbitrary copy.
@@ -10695,13 +10832,221 @@ function mount(router, deps) {
         }
         var cartCount = await _cartCountForReq(req);
         var wlUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        // Owner share panel — only when the sharing primitive is wired.
+        // The share-link list read is SCOPED to the session customer's id,
+        // so the owner only ever sees their own links. A reads failure
+        // (missing table on a fresh deploy) degrades to no panel rather
+        // than 500-ing the page.
+        var sharePanel = "";
+        if (deps.wishlistSharing) {
+          // Scoped to the session customer — the panel read keys on the
+          // signed-in customer's id, so the owner only ever sees their own
+          // links (this list surface carries no path id, so no IDOR).
+          var sessionOwnerId = auth.customer_id;
+          var ownShares = [];
+          try { ownShares = await deps.wishlistSharing.listSharesForOwner(sessionOwnerId); }
+          catch (_e) { ownShares = []; }
+          sharePanel = _wishlistSharePanel({
+            shares: ownShares,
+            notice: wlUrl ? wlUrl.searchParams.get("share") : null,
+          });
+        }
         _send(res, 200, renderWishlist({
           items:        items,
           notice:       wlUrl ? wlUrl.searchParams.get("ok") : null,
+          share_panel:  sharePanel,
+          shop_name:    shopName,
+          cart_count:   cartCount,
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+    }
+
+    // ---- wishlist sharing -----------------------------------------------
+    //
+    // Owner-scoped share links on the customer's own wishlist, plus the
+    // public, no-auth shared view a giver opens. Mounts only when the
+    // sharing primitive is wired (it composes the wishlist primitive, so a
+    // store with sharing also has the solo wishlist above).
+    //
+    // Owner side (gated on the session customer, CSRF-protected by the
+    // container form chokepoint): create a share link, see active links,
+    // revoke a link. Every owner action is scoped to the session customer —
+    // the create keys on the signed-in customer's id; the revoke loads the
+    // session customer's links by their id and refuses a link that isn't
+    // the session customer's (clean 404, no IDOR).
+    //
+    // Public side (NO auth): `GET /wishlist/shared/:token` resolves the
+    // wishlist ONLY through `viewShared(token)` — never by a guessable
+    // wishlist/customer id — renders the saved products (redacting the
+    // owner's identity + private notes), records the view, and 404s an
+    // unknown / revoked / expired token. noindex (a personal wishlist isn't
+    // index material).
+    if (deps.wishlistSharing) {
+      // Build the owner's share panel from links scoped to the session
+      // customer. `opts.fresh_url` (the one-time URL of a just-created link)
+      // and `opts.notice` (created / revoked) thread through to the panel.
+      // A reads failure (missing table on a fresh deploy) degrades to a
+      // panel with no list rather than throwing.
+      async function _buildSharePanel(customerId, opts) {
+        opts = opts || {};
+        var shareRows = [];
+        try { shareRows = await deps.wishlistSharing.listSharesForOwner(customerId); }
+        catch (_e) { shareRows = []; }
+        return _wishlistSharePanel({
+          shares:    shareRows,
+          notice:    opts.notice || null,
+          fresh_url: opts.fresh_url || null,
+        });
+      }
+
+      // Re-render the /account/wishlist page (used by the create POST so the
+      // one-time share URL is shown inline, and on a revoke). Resolves the
+      // same saved-items list the GET route renders.
+      async function _renderWishlistWithPanel(req, res, customerId, panelOpts) {
+        var page = await deps.wishlist.listForCustomer(customerId, { limit: 50 });
+        var items = [];
+        for (var i = 0; i < page.rows.length; i += 1) {
+          var entry = page.rows[i];
+          var product = null;
+          try { product = await deps.catalog.products.get(entry.product_id); } catch (_e) { product = null; }
+          if (!product) { items.push({ product: null, product_id: entry.product_id }); continue; }
+          var media = await deps.catalog.media.listForProduct(product.id);
+          items.push({ product: product, hero_media: media.length ? media[0] : null });
+        }
+        var cartCount = await _cartCountForReq(req);
+        var panel = await _buildSharePanel(customerId, panelOpts || {});
+        _send(res, 200, renderWishlist({
+          items:        items,
+          share_panel:  panel,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
         }));
+      }
+
+      // POST /wishlist/share — mint a share link for the SESSION customer's
+      // wishlist. The link is owner-scoped (keyed on `auth.customer_id`);
+      // the plaintext token is returned once and surfaced inline as the
+      // public URL the owner copies (never persisted). `unlisted` is the
+      // default privacy: link-bearer access, no friends-graph requirement,
+      // not advertised. The page re-renders directly (200) rather than a
+      // redirect so the one-time URL is shown.
+      router.post("/wishlist/share", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var created;
+        try {
+          created = await deps.wishlistSharing.createShareLink({
+            owner_customer_id: auth.customer_id,
+            privacy:           "unlisted",
+          });
+        } catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        // The full public URL the giver opens. Built from this request's
+        // ORIGIN (scheme + host) so the one-time link is a correct absolute
+        // URL — this POST lands on /wishlist/share, so trimming a path off
+        // the canonical URL would mangle the link (and the token shows once).
+        var shareOrigin = "";
+        try { shareOrigin = new URL(_requestUrls(req).canonical_url).origin; }
+        catch (_e) { shareOrigin = ""; /* unparseable — fall back to a host-relative link */ }
+        var freshUrl = shareOrigin + "/wishlist/shared/" + encodeURIComponent(created.plaintext_token);
+        await _renderWishlistWithPanel(req, res, auth.customer_id, { notice: "created", fresh_url: freshUrl });
+      });
+
+      // POST /wishlist/share/:share_id/revoke — revoke one of the SESSION
+      // customer's share links. The primitive's revokeShareLink moves a link
+      // by id alone (no owner notion), so the route owns the ownership
+      // decision: it loads the session customer's own links and refuses a
+      // share_id that isn't among them (clean 404). Without that scope, any
+      // signed-in shopper could revoke another customer's link by guessing
+      // its id (IDOR).
+      router.post("/wishlist/share/:share_id/revoke", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var shareId = (req.params && req.params.share_id) || "";
+        // Ownership scope: the link must belong to the session customer.
+        var owned = [];
+        try { owned = await deps.wishlistSharing.listSharesForOwner(auth.customer_id); }
+        catch (_e) { owned = []; }
+        var match = null;
+        for (var i = 0; i < owned.length; i += 1) {
+          if (owned[i].id === shareId) { match = owned[i]; break; }
+        }
+        if (!match) {
+          // Unknown id, malformed id, or a link owned by someone else all
+          // resolve the same way — a clean 404, no act, no leak.
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        try {
+          await deps.wishlistSharing.revokeShareLink({ link_id: shareId, reason: "owner revoked from account" });
+        } catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?share=revoked");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET /wishlist/shared/:token — the public, no-auth shared view. The
+      // wishlist is resolved ONLY via viewShared(token); a giver with the
+      // link sees the saved products (with the owner identity + private
+      // notes redacted — the renderer emits product cards only). An unknown
+      // / revoked / expired token 404s exactly like an unknown route. The
+      // view is recorded best-effort (analytics for the owner) and never
+      // blocks the render. noindex.
+      router.get("/wishlist/shared/:token", async function (req, res) {
+        var token = (req.params && req.params.token) || "";
+        var view = null;
+        try {
+          view = await deps.wishlistSharing.viewShared({ token: token });
+        } catch (_e) {
+          // A malformed token (TypeError) and a not-found / revoked / expired
+          // token (coded errors) all render the same 404 — no oracle on why.
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        // Record the open for the owner's view counter. Best-effort: a
+        // record failure never breaks the giver's page.
+        try { await deps.wishlistSharing.recordView({ token: token }); }
+        catch (_e) { /* drop-silent — analytics, not the render path */ }
+        // Resolve each shared entry to its product + hero image. The entry's
+        // owner customer_id + private notes are NOT carried into the view
+        // (the renderer emits product cards only) so the giver never sees
+        // the owner's identity.
+        var items = [];
+        var entries = (view && view.entries) || [];
+        for (var i = 0; i < entries.length; i += 1) {
+          var product = null;
+          try { product = await deps.catalog.products.get(entries[i].product_id); } catch (_e) { product = null; }
+          if (!product) continue;
+          var media = await deps.catalog.media.listForProduct(product.id);
+          items.push({ product: product, hero_media: media.length ? media[0] : null });
+        }
+        _send(res, 200, renderSharedWishlist({
+          items:        items,
+          title:        (view && view.share && view.share.title) || "A shared wishlist",
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
       });
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.33",
+  "version": "0.3.35",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {