@blamejs/blamejs-shop 0.3.47 → 0.3.49

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.49 (2026-06-02) — **Real collection tiles on the home page, a working mobile nav, Collections/Categories in the header, and From-price on multi-variant products.** The home page's 'Featured collections' band linked to fixed keyword searches that landed on empty results unless a product happened to contain those words, the header navigation disappeared entirely on phones with no menu to replace it, and the two real catalog-browse surfaces (Collections and Categories) were reachable only from the footer. This release resolves those: the home tiles now render the store's actual collections with real links, the header gains a no-JavaScript mobile menu, and Collections and Categories appear in the primary nav. Multi-variant products now show a 'From <lowest price>' headline instead of always showing the first variant's price, the non-functional 'New arrivals'/'On sale' sort links are removed, and two small accessibility fixes land (the survey required-field marker and a dark color-scheme hint for native form controls). **Changed:** *Home 'Featured collections' tiles render real collections* — The featured-collections band on the home page now lists the store's actual collections with links to each collection page, instead of fixed keyword searches that could land on an empty results page. If no collections are defined, the band is omitted rather than shown empty. Both the cached and dynamically rendered home pages produce identical markup. · *Mobile navigation menu (no JavaScript required)* — On narrow screens the header now offers a disclosure menu that reveals the navigation links, which previously vanished entirely below a tablet width. It is a pure-CSS menu, so it works with JavaScript disabled. · *Collections and Categories in the header navigation* — The two catalog-browse surfaces — Collections and Categories — are now in the primary header navigation (and inside the mobile menu), not only in the footer. · *Multi-variant products show a 'From' price* — A product whose variants differ in price now shows a 'From <lowest price>' headline so the prominent price is no longer misleading when a shopper selects a different variant; each variant chip still shows its own exact price. · *Removed non-functional sort links* — The 'New arrivals' and 'On sale' links did nothing — the home page does not yet support sorting — so they have been removed rather than left as dead controls. They will return if and when catalog sorting is added. · *Accessibility: survey required marker and dark color-scheme* — The survey form's required-field marker is now announced correctly to screen readers, and the theme declares a dark color-scheme so native form controls, scrollbars, and autofill render correctly on the dark surface.
+
+- v0.3.48 (2026-06-02) — **Customers can export or request deletion of their personal data, and the admin console gets a privacy-request queue to fulfil it.** The framework had a complete data-subject-request engine but nothing reached it, so a store handling EU/California personal data had no way for a shopper to exercise their right of access or erasure and no operator path to fulfil one. A signed-in customer can now request a full export of their data — account, addresses, orders, subscriptions, loyalty, and support history, streamed as a downloadable JSON bundle — and can file a deletion request. The admin console gets a Privacy requests screen where an operator reviews each request, downloads the export, previews a deletion (a dry run that changes nothing), and then executes it. Erasure anonymizes the customer's account and archives their addresses and subscriptions while retaining orders, loyalty ledger, and support tickets that must be kept for tax and legal records. A customer can only ever see or act on their own requests; deletion is always filed by the customer and carried out by an operator. **Added:** *Customer data export and deletion requests* — A signed-in customer gets a Privacy & data area under their account where they can request a full export of their personal data and file a deletion request. The export is streamed as a downloadable JSON bundle covering their account, addresses, orders, subscriptions, loyalty balance and ledger, and support history. A customer can only access their own requests and downloads; a request belonging to anyone else returns not-found. · *Privacy-request queue in the admin console* — A new Privacy requests screen lists every data-subject request with its status. An operator can download a request's export, preview a deletion as a dry run that reports what would change without modifying anything, and then execute the deletion behind a confirmation step. Deletion anonymizes the customer's account and archives their addresses and subscriptions, while orders, the loyalty ledger, and support tickets are retained for tax and legal record-keeping. Every customer- and operator-entered field shown in either console is HTML-escaped.
+
 - v0.3.47 (2026-06-01) — **Admin product detail, collections list, and order shipment panels load with fewer database round trips.** Three admin-console screens re-derived data with one database query per item: the product-detail screen ran a query per variant per currency for current and historical prices, the collections list pulled up to 200 member rows for each collection just to count them, and the order-detail shipment panel hydrated each shipment and its labels sequentially. These now read in batched or parallel queries. The displayed data is unchanged, with one correctness improvement: a manual collection with more than 200 members now shows its true product count instead of a number capped at 200. **Changed:** *Batched admin product-detail price hydration* — The admin product-detail screen now loads every variant's current and historical prices across all currencies in a single batched query instead of one query per variant per currency. The screen renders identically. · *Collections list counts without pulling member rows* — The admin collections list now counts a manual collection's members with a COUNT query instead of fetching up to 200 member rows per collection. A manual collection with more than 200 members now shows its true count (previously the displayed count was capped at 200); rule-based collections keep their existing bounded preview count. · *Parallel shipment hydration on order detail* — The order-detail shipment panel now hydrates each shipment and its labels in parallel rather than one after another, so an order with several shipments opens faster.
 
 - v0.3.46 (2026-06-01) — **Storefront pages render in far fewer database round trips, and the search collection filter is consistent across cache tiers.** The dynamically rendered storefront (the path that serves returning, signed-in, or non-default-currency shoppers) re-derived product data with one database query per item — a home or search page could issue dozens to hundreds of round trips, where the cached edge already did the same work in a single batched query. The home grid, search results, product page, related-products rail, and cart now read product, variant, price, inventory, and media data in batched queries that mirror the edge exactly, so those pages render with far fewer round trips and identical output. As part of this, the search 'collection' filter now reflects manual collection membership consistently whether a page is served from the cache or rendered dynamically. **Changed:** *Batched product reads on storefront pages* — The home grid, search results, product detail, related-products rail, and cart now load product/variant/price/inventory/media data in batched database queries instead of one query per item. On a cache miss, a signed-in session, or a non-default currency the dynamic render path previously issued a query per product (and per variant); these pages now match the single-query shape the cached edge already used. Rendered pages are unchanged. · *Consistent search collection filter across cache tiers* — The 'collection' filter on the search page now reflects manual collection membership on both the cached and the dynamically rendered paths. Previously the dynamic path could additionally surface smart-collection rule matches in that filter, so a shopper could see different collection filter options depending on which path served the page. If you relied on smart (rule-based) collections appearing as search filters, they now appear only where a product is an explicit member; this aligns the two render paths.

package/lib/admin.js

@@ -511,6 +511,7 @@ function mount(router, deps) {
   var splitShipments = deps.splitShipments || null;  // order split-shipment planner disabled when absent
   var salesTaxFilings = deps.salesTaxFilings || null; // sales-tax-filing remittance console disabled when absent
   var supportTickets  = deps.supportTickets  || null; // support-ticket queue + thread console disabled when absent
+  var complianceExport = deps.complianceExport || null; // DSR queue (export/erasure) disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
   var orderRatings    = deps.orderRatings    || null; // per-order rating moderation queue (flag/clear + public reply) disabled when absent
   var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
@@ -521,7 +522,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4101,6 +4102,211 @@ function mount(router, deps) {
     _supportTransition("reopen",           "reopened");
   }
 
+  // ---- subject-access-request (DSR) queue -----------------------------
+  // The operator side of the GDPR / CCPA / LGPD lifecycle: list + detail +
+  // fulfil/dispatch/preview/execute/dismiss + a streaming export download.
+  // Content-negotiated like the other screens: bearer → JSON; signed-in
+  // browser → the HTML console. The primitive throws TypeError ONLY (no
+  // `.code`-bearing FSM error — confirmed across lib/compliance-export.js):
+  // a malformed id, a not-found row, and a bad-status transition are ALL
+  // TypeError, so the catch maps TypeError → a 4xx notice and there is no
+  // `.code` branch to order. If a future status-conflict error gains a
+  // `.code`, add the branch BEFORE the TypeError catch so it isn't collapsed.
+  if (complianceExport) {
+    var dsr         = complianceExport;
+    var dsrReaders  = deps.complianceExportReaders || {};
+    var dsrSections = deps.complianceExportSections || {};
+    var streamDsr   = deps.streamDsrBundle;
+
+    // Resolve the ?status= chip into a list. "all" / a bad chip → the whole
+    // board; a real status → the filtered list.
+    async function _dsrRows(filter) {
+      if (filter && filter !== "all" && DSR_STATUS_FILTERS.indexOf(filter) !== -1) {
+        return { rows: await dsr.listRequests({ status: filter, limit: 200 }), filter: filter };
+      }
+      return { rows: await dsr.listRequests({ limit: 200 }), filter: "all" };
+    }
+
+    router.get("/admin/dsr", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _dsrRows(filter);
+        _json(res, 200, { rows: resolved.rows, status: resolved.filter });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _dsrRows(filter);
+        _sendHtml(res, 200, renderAdminDsr({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          requests: resolved.rows, status: resolved.filter,
+        }));
+      },
+    ));
+
+    // Resolve a request by :id, surfacing a malformed / unknown id as a 404
+    // (defensive request-shape reader, never a 500). getRequest throws
+    // TypeError on a bad uuid → 404; a null row → 404.
+    async function _dsrOr404(req, res, isJson) {
+      var row;
+      try { row = await dsr.getRequest(req.params.id); }
+      catch (e) {
+        if (e instanceof TypeError) {
+          if (isJson) { _problem(res, 404, "dsr-request-not-found"); return null; }
+          _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Request not found." }));
+          return null;
+        }
+        throw e;
+      }
+      if (!row) {
+        if (isJson) { _problem(res, 404, "dsr-request-not-found"); return null; }
+        _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Request not found." }));
+        return null;
+      }
+      return row;
+    }
+
+    router.get("/admin/dsr/:id", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await _dsrOr404(req, res, true); if (!row) return;
+        var history = await dsr.auditForCustomer(row.customer_id);
+        _json(res, 200, { request: row, history: history });
+      }),
+      async function (req, res) {
+        var row = await _dsrOr404(req, res, false); if (!row) return;
+        var history = await dsr.auditForCustomer(row.customer_id);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        // A deletion request's ?preview=1 renders the dry-run blast radius —
+        // processDeletion({ dry_run: true }) NEVER mutates (the primitive's
+        // only safety net). A bad-status row (already terminal) throws
+        // TypeError → drop the preview, render the detail without it.
+        var preview = null;
+        if (url && url.searchParams.get("preview") === "1" && row.request_kind === "deletion") {
+          try { preview = await dsr.processDeletion({ request_id: row.id, dry_run: true }); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; preview = null; }
+        }
+        _sendHtml(res, 200, renderAdminDsrDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          request: row, history: history, preview: preview,
+          moved:  url && url.searchParams.get("moved"),
+          notice: url && url.searchParams.get("err") ? "That action couldn't be completed for this request." : null,
+        }));
+      },
+    ));
+
+    // Streaming export download. Gated: the row must be an export in status
+    // fulfilled / delivered (an un-fulfilled / deletion / unknown row → 404).
+    // Status + ownership are validated BEFORE the first write (the bundle
+    // streams header-first; status can't change mid-stream). The route
+    // re-reads the readers rather than re-running fulfillRequest (which would
+    // re-flip status on every download).
+    router.get("/admin/dsr/:id/export.json", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await _dsrOr404(req, res, true); if (!row) return;
+        if (row.request_kind !== "export" || (row.status !== "fulfilled" && row.status !== "delivered")) {
+          return _problem(res, 404, "dsr-export-not-ready");
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      }),
+      async function (req, res) {
+        var row = await _dsrOr404(req, res, false); if (!row) return;
+        if (row.request_kind !== "export" || (row.status !== "fulfilled" && row.status !== "delivered")) {
+          return _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Export not ready for download." }));
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      },
+    ));
+
+    // Per-request action helper: run `opFn(id, body)`, then PRG back to the
+    // detail. The primitive throws TypeError for not-found / bad-status / bad
+    // input — all become an ?err=1 notice, never a 500. There is no
+    // `.code`-bearing error to branch on (see the block-head comment).
+    function _dsrAction(jsonHandler, auditEvent, opFn) {
+      return _pageOrApi(false, jsonHandler, async function (req, res) {
+        var id = req.params.id;
+        try { await opFn(id, req.body || {}); }
+        catch (e) {
+          if (e instanceof TypeError) {
+            return _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?err=1");
+          }
+          throw e;
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + "." + auditEvent, outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?moved=1");
+      });
+    }
+
+    router.post("/admin/dsr/:id/fulfill", _dsrAction(
+      R(async function (req, res) {
+        try { var bundle = await dsr.fulfillRequest({ request_id: req.params.id }); _json(res, 200, bundle); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.fulfill",
+      function (id) { return dsr.fulfillRequest({ request_id: id }); },
+    ));
+
+    router.post("/admin/dsr/:id/dispatch", _dsrAction(
+      R(async function (req, res) {
+        var body = req.body || {};
+        try { var row = await dsr.dispatchExport({ request_id: req.params.id, delivery_method: body.delivery_method, delivery_address: body.delivery_address }); _json(res, 200, row); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.dispatch",
+      function (id, body) { return dsr.dispatchExport({ request_id: id, delivery_method: body.delivery_method, delivery_address: body.delivery_address }); },
+    ));
+
+    router.post("/admin/dsr/:id/dismiss", _dsrAction(
+      R(async function (req, res) {
+        var body = req.body || {};
+        try { var row = await dsr.dismissRequest({ request_id: req.params.id, dismiss_reason: body.dismiss_reason }); _json(res, 200, row); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.dismiss",
+      function (id, body) { return dsr.dismissRequest({ request_id: id, dismiss_reason: body.dismiss_reason }); },
+    ));
+
+    // Execute erasure — irreversible, so it routes through the confirm
+    // interstitial. The detail's "Execute erasure…" button POSTs here; this
+    // browser handler renders renderAdminConfirm, whose Confirm button POSTs
+    // back here too (now carrying the confirmed flag via a hidden field), at
+    // which point processDeletion runs for real (dry_run: false). The bearer
+    // JSON path executes directly (tooling has no interstitial).
+    router.post("/admin/dsr/:id/delete/confirm", _pageOrApi(false,
+      R(async function (req, res) {
+        try { var result = await dsr.processDeletion({ request_id: req.params.id, dry_run: false }); _json(res, 200, result); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      async function (req, res) {
+        var id = req.params.id;
+        var body = req.body || {};
+        if (body.confirmed !== "1") {
+          // First POST (from the detail button) — render the consequence.
+          return _sendHtml(res, 200, renderAdminConfirm({
+            shop_name: deps.shop_name, nav_available: navAvailable, active: "dsr",
+            heading: "Execute erasure",
+            consequence: "This permanently anonymizes the customer and archives their addresses + subscriptions. It cannot be undone.",
+            detail: "Orders, the loyalty ledger, and support tickets are retained for legal/accounting reasons. Continue?",
+            action: "/admin/dsr/" + encodeURIComponent(id) + "/delete/confirm",
+            fields: { confirmed: "1" },
+            confirm_label: "Execute erasure",
+            cancel_href: "/admin/dsr/" + encodeURIComponent(id),
+          }));
+        }
+        // Confirmed — run it for real, then PRG to the detail.
+        try { await dsr.processDeletion({ request_id: id, dry_run: false }); }
+        catch (e) {
+          if (e instanceof TypeError) return _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?err=1");
+          throw e;
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".dsr.delete", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?moved=1");
+      },
+    ));
+  }
+
   // ---- order exchanges ------------------------------------------------
   //
   // The operator side of a customer-requested item swap: the FIFO queue of
@@ -9700,6 +9906,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "segments",     href: "/admin/segments",     label: "Segments",     requires: "customerSegments" },
   { key: "returns",      href: "/admin/returns",      label: "Returns",      requires: "returns" },
   { key: "support",      href: "/admin/support",      label: "Support",      requires: "supportTickets" },
+  { key: "dsr",          href: "/admin/dsr",          label: "Privacy requests", requires: "complianceExport" },
   { key: "exchanges",    href: "/admin/exchanges",    label: "Exchanges",    requires: "orderExchanges" },
   { key: "ratings",      href: "/admin/ratings",      label: "Ratings",      requires: "orderRatings" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
@@ -11617,6 +11824,182 @@ function renderAdminSupportTicket(opts) {
   return _renderAdminShell(opts.shop_name, "Ticket", body, "support", opts.nav_available);
 }
 
+// ---- subject-access-request (DSR) queue --------------------------------
+//
+// The operator side of the GDPR / CCPA / LGPD request lifecycle: a
+// status-filterable list of export + deletion requests, one request's
+// detail with its per-customer audit history + the action forms (fulfil +
+// download an export, mark delivered, preview a deletion dry-run, execute
+// the erasure behind a confirm interstitial, dismiss). Models the support
+// console shape. Every dynamic value — including operator/customer free
+// text (reason / dismiss_reason / delivery_address) — is _htmlEscape'd:
+// the primitive bounds length + strips control bytes but does NOT strip
+// HTML, so escape-at-render is the XSS gate.
+var DSR_STATUS_FILTERS = ["all", "received", "processing", "fulfilled", "delivered", "dismissed"];
+
+function _dsrPillClass(status) {
+  if (status === "fulfilled" || status === "delivered") return "paid";
+  if (status === "dismissed") return "cancelled";
+  return "pending";   // received / processing
+}
+
+// Operator queue. Status chips filter the board; each row links to the
+// request detail. Renders the customer (short id), kind, jurisdiction,
+// scope, status pill, and when it was requested.
+function renderAdminDsr(opts) {
+  opts = opts || {};
+  var requests = opts.requests || [];
+  var active = opts.status || "all";
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var chips = "<div class=\"order-filters\">" +
+    DSR_STATUS_FILTERS.map(function (s) {
+      return "<a class=\"chip" + (active === s ? " chip--on" : "") + "\" href=\"/admin/dsr?status=" + encodeURIComponent(s) + "\">" + _htmlEscape(s) + "</a>";
+    }).join("") +
+    "</div>";
+
+  var rows = requests.map(function (r) {
+    return "<tr>" +
+      "<td><a class=\"order-id\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "\">" + _htmlEscape(String(r.customer_id).slice(0, 8)) + "</a></td>" +
+      "<td>" + _htmlEscape(r.request_kind) + "</td>" +
+      "<td>" + _htmlEscape(r.jurisdiction) + "</td>" +
+      "<td>" + _htmlEscape(r.scope || "—") + "</td>" +
+      "<td><span class=\"status-pill " + _dsrPillClass(r.status) + "\">" + _htmlEscape(r.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(r.requested_at)) + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = requests.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Customer</th><th scope=\"col\">Kind</th><th scope=\"col\">Jurisdiction</th><th scope=\"col\">Scope</th><th scope=\"col\">Status</th><th scope=\"col\">Requested</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No “" + _htmlEscape(active) + "” privacy requests.</p>";
+
+  var body = "<section><h2>Privacy requests</h2>" +
+    "<p class=\"meta\">Subject-access requests (data export) and erasure requests under GDPR / CCPA / LGPD.</p>" +
+    notice + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Privacy requests", body, "dsr", opts.nav_available);
+}
+
+// Request detail — the lifecycle, the customer's full request history, and
+// the action forms gated on kind + status. A deletion dry-run preview
+// (?preview=1) renders the per-domain blast-radius counts WITHOUT mutating.
+function renderAdminDsrDetail(opts) {
+  opts = opts || {};
+  var r = opts.request;
+  var history = opts.history || [];
+  var preview = opts.preview || null;   // processDeletion dry-run result
+  var moved  = opts.moved  ? "<div class=\"banner banner--ok\">Request updated.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  function _field(label, value) {
+    return "<p><span class=\"meta\">" + _htmlEscape(label) + "</span><br>" + (value ? _htmlEscape(String(value)) : "<span class=\"meta\">—</span>") + "</p>";
+  }
+
+  var isExport   = r.request_kind === "export";
+  var isDeletion = r.request_kind === "deletion";
+  var openState  = r.status === "received" || r.status === "processing";
+
+  // Action forms.
+  var actions = "";
+  if (isExport && openState) {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/fulfill\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Fulfil request</button>" +
+      "</form>";
+  }
+  if (isExport && (r.status === "fulfilled" || r.status === "delivered")) {
+    actions +=
+      "<a class=\"btn\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "/export.json\">Download export</a>";
+  }
+  if (isExport && r.status === "fulfilled") {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/dispatch\" class=\"return-action\">" +
+        "<h4>Mark delivered</h4>" +
+        _setupField("Delivery method", "delivery_method", r.delivery_method || "", "text", "How the bundle reached the requester (e.g. email, secure-link).", " maxlength=\"64\" required") +
+        _setupField("Delivery address", "delivery_address", r.delivery_address || "", "text", "Where it was sent (email address / link / postal address).", " maxlength=\"1000\" required") +
+        "<button class=\"btn\" type=\"submit\">Mark delivered</button>" +
+      "</form>";
+  }
+  if (isDeletion && openState) {
+    actions +=
+      "<a class=\"btn\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "?preview=1\">Preview erasure (dry run)</a>";
+    // Execute routes through the confirm interstitial (irreversible; the CSP
+    // forbids a client confirm()). The button POSTs to /delete/confirm which
+    // renders renderAdminConfirm; that page's Confirm POSTs the real execute.
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/delete/confirm\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Execute erasure…</button>" +
+      "</form>";
+  }
+  if (r.status !== "delivered" && r.status !== "dismissed") {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/dismiss\" class=\"return-action\">" +
+        "<h4>Dismiss</h4>" +
+        "<label class=\"form-field\"><span>Reason</span><textarea name=\"dismiss_reason\" rows=\"3\" maxlength=\"4000\" required></textarea></label>" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Dismiss request</button>" +
+      "</form>";
+  }
+  var actionsHtml = actions
+    ? "<div class=\"return-actions\">" + actions + "</div>"
+    : "<span class=\"meta\">This request is in a terminal state — no further actions.</span>";
+
+  // Deletion dry-run preview panel (per-domain counts; never mutates).
+  var previewHtml = "";
+  if (preview) {
+    var dRows = (preview.domains || []).map(function (d) {
+      var note = d.note ? " <span class=\"meta\">(" + _htmlEscape(d.note) + ")</span>" : "";
+      return "<tr><td>" + _htmlEscape(d.table || d.domain) + "</td><td>" + _htmlEscape(String(d.deleted)) + note + "</td></tr>";
+    }).join("");
+    var absent = (preview.domains_absent || []).map(function (n) { return _htmlEscape(n); }).join(", ");
+    previewHtml =
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Erasure preview (dry run — nothing was changed)</h3>" +
+        (dRows
+          ? "<table><thead><tr><th scope=\"col\">Table</th><th scope=\"col\">Affected</th></tr></thead><tbody>" + dRows + "</tbody></table>"
+          : "<p class=\"empty\">No per-domain handlers wired.</p>") +
+        (absent ? "<p class=\"meta\">Domains without a deletion handler: " + absent + "</p>" : "") +
+        "<p class=\"meta\">Total affected: " + _htmlEscape(String(preview.total_affected)) + "</p>" +
+      "</div>";
+  }
+
+  var histRows = history.map(function (h) {
+    return "<tr>" +
+      "<td>" + _htmlEscape(String(h.id).slice(0, 8)) + "</td>" +
+      "<td>" + _htmlEscape(h.request_kind) + "</td>" +
+      "<td><span class=\"status-pill " + _dsrPillClass(h.status) + "\">" + _htmlEscape(h.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(h.requested_at)) + "</td>" +
+      "</tr>";
+  }).join("");
+  var historyHtml = history.length
+    ? "<table><thead><tr><th scope=\"col\">Request</th><th scope=\"col\">Kind</th><th scope=\"col\">Status</th><th scope=\"col\">Requested</th></tr></thead><tbody>" + histRows + "</tbody></table>"
+    : "<p class=\"empty\">No prior requests.</p>";
+
+  var body =
+    "<section class=\"mw-48\">" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/dsr\">&larr; Privacy requests</a></div>" +
+      "<h2>" + _htmlEscape(r.request_kind === "export" ? "Data export" : "Erasure") + " request " +
+        "<span class=\"status-pill " + _dsrPillClass(r.status) + "\">" + _htmlEscape(r.status) + "</span></h2>" +
+      "<p class=\"meta\">Requested " + _htmlEscape(_fmtDate(r.requested_at)) +
+        " · by " + _htmlEscape(r.requested_by) +
+        " · customer <code>" + _htmlEscape(String(r.customer_id).slice(0, 8)) + "</code></p>" +
+      moved + notice +
+      "<div class=\"two-col\">" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Details</h3>" +
+          _field("Jurisdiction", r.jurisdiction) +
+          _field("Scope", r.scope) +
+          _field("Reason", r.reason) +
+          _field("Dismiss reason", r.dismiss_reason) +
+          _field("Delivery method", r.delivery_method) +
+          _field("Delivery address", r.delivery_address) +
+          _field("Fulfilled", r.fulfilled_at ? _fmtDate(r.fulfilled_at) : null) +
+          _field("Delivered", r.delivered_at ? _fmtDate(r.delivered_at) : null) +
+        "</div>" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Customer request history</h3>" + historyHtml + "</div>" +
+      "</div>" +
+      previewHtml +
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Actions</h3>" + actionsHtml + "</div>" +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Privacy request", body, "dsr", opts.nav_available);
+}
+
 // The non-terminal exchange states the operator can filter the queue by —
 // lifecycle order (the terminal closed / rejected don't appear in the open
 // queue, so they're not filter chips).

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.47",
+  "version": "0.3.49",
   "assets": {
     "css/admin.css": {
-      "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",
-      "fingerprinted": "css/admin.72c808274ebcefd9.css"
+      "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
+      "fingerprinted": "css/admin.f028b2e410387546.css"
     },
     "css/main.css": {
-      "integrity": "sha384-kbtcIsmD7X/DDsTJIYQ49JexBKXkz/GU1aQ8430XEyHHW/hcOPMWqbgZ7wRqvsbT",
-      "fingerprinted": "css/main.37860144b12a94fe.css"
+      "integrity": "sha384-9rtEz2wKJbpfALccIipRdo/BWVQZi5O4IufqaLO/7jFyLK1xxCaDc/65Apjy8dbs",
+      "fingerprinted": "css/main.1a1a379d6f58e2c0.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/storefront.js

@@ -306,12 +306,7 @@ var LAYOUT =
   "          <button type=\"submit\">{{search_submit}}</button>\n" +
   "        </div>\n" +
   "      </form>\n" +
-  "      <nav class=\"site-nav\" aria-label=\"Primary\">\n" +
-  "        <a class=\"site-nav__link\" href=\"/\">{{nav_shop}}</a>\n" +
-  "        <a class=\"site-nav__link\" href=\"/#framework\">{{nav_framework}}</a>\n" +
-  "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"{{nav_account}}\"><svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg></a>\n" +
-  "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"{{nav_cart_aria}}\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg><span class=\"cart-pill__count\">{{cart_count}}</span></a>\n" +
-  "      </nav>\n" +
+  "      RAW_PRIMARY_NAV\n" +
   "    </div>\n" +
   "  </header>\n" +
   "\n" +
@@ -349,8 +344,6 @@ var LAYOUT =
   "          <li><a href=\"/\">{{footer_shop_all}}</a></li>\n" +
   "          <li><a href=\"/collections\">{{footer_shop_collections}}</a></li>\n" +
   "          <li><a href=\"/categories\">{{footer_shop_categories}}</a></li>\n" +
-  "          <li><a href=\"/?sort=new\">{{footer_shop_new}}</a></li>\n" +
-  "          <li><a href=\"/?sort=sale\">{{footer_shop_sale}}</a></li>\n" +
   "          <li><a href=\"/compare\">{{footer_shop_compare}}</a></li>\n" +
   "          <li><a href=\"/cart\">{{footer_shop_cart}}</a></li>\n" +
   "          <li><a href=\"/terms\">{{footer_shop_shipping}}</a></li>\n" +
@@ -683,6 +676,57 @@ function _requestUrls(req) {
   return { canonical_url: origin + path, og_url: origin + path + search };
 }
 
+// Whether the Collections / Categories routes are mounted (deps wired).
+// The header links + the mobile-disclosure entries render only when their
+// route exists, so a store that hasn't wired the primitive never shows a
+// link that 404s. Set once at mount (alongside `_ccyEnabled`), read in the
+// nav builder. Default true so a pure render of a page (a unit test calling
+// `renderHome` without mounting) shows the full nav; the route-level
+// conditional only suppresses a link when the mount explicitly lacks the dep.
+var _hasCollections = true;
+var _hasCategoryNav = true;
+
+// The account-icon + cart-pill SVGs, lifted verbatim from the prior LAYOUT
+// nav so the builder emits the same chrome. Kept byte-identical to the edge
+// headers (worker/render/*.js).
+var _NAV_ACCOUNT_SVG = "<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg>";
+var _NAV_CART_SVG    = "<svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg>";
+var _NAV_MENU_SVG    = "<svg viewBox=\"0 0 24 24\" width=\"22\" height=\"22\" aria-hidden=\"true\"><path d=\"M4 7h16M4 12h16M4 17h16\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg>";
+
+// Primary nav builder — a desktop link row (`.site-nav__links`) PLUS a
+// CSP-safe <details>/<summary> disclosure (`.site-nav__menu`) carrying the
+// same links for narrow viewports. The CSS shows one or the other by
+// breakpoint (the inline row hides at <=48rem; the disclosure hides above
+// it). No JS — the browser drives open/close. Collections / Categories
+// render only when `hasCollections` / `hasCategories` (their routes mounted).
+// All labels are chrome strings, escaped at the sink. Kept byte-identical to
+// the static nav in every worker/render/*.js header (the edge renders the
+// two extra links unconditionally — accepted divergence; the byte-compare
+// test wires both container deps so the markup matches).
+function _buildNavLinks(chrome, hasCollections, hasCategories, indent) {
+  var esc = b.template.escapeHtml;
+  return indent + "<a class=\"site-nav__link\" href=\"/\">" + esc(chrome.nav_shop) + "</a>\n" +
+    (hasCollections ? indent + "<a class=\"site-nav__link\" href=\"/collections\">" + esc(chrome.nav_collections) + "</a>\n" : "") +
+    (hasCategories ? indent + "<a class=\"site-nav__link\" href=\"/categories\">" + esc(chrome.nav_categories) + "</a>\n" : "") +
+    indent + "<a class=\"site-nav__link\" href=\"/#framework\">" + esc(chrome.nav_framework) + "</a>\n";
+}
+function _buildPrimaryNav(chrome, cartCount, cartAria, hasCollections, hasCategories) {
+  var esc = b.template.escapeHtml;
+  return "<nav class=\"site-nav\" aria-label=\"Primary\">\n" +
+    "        <div class=\"site-nav__links\">\n" +
+    _buildNavLinks(chrome, hasCollections, hasCategories, "          ") +
+    "        </div>\n" +
+    "        <details class=\"site-nav__menu\">\n" +
+    "          <summary class=\"site-nav__menu-toggle\" aria-label=\"" + esc(chrome.nav_menu) + "\">" + _NAV_MENU_SVG + "<span class=\"site-nav__menu-label\">" + esc(chrome.nav_menu) + "</span></summary>\n" +
+    "          <div class=\"site-nav__drawer\">\n" +
+    _buildNavLinks(chrome, hasCollections, hasCategories, "            ") +
+    "          </div>\n" +
+    "        </details>\n" +
+    "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"" + esc(chrome.nav_account) + "\">" + _NAV_ACCOUNT_SVG + "</a>\n" +
+    "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"" + esc(cartAria) + "\">" + _NAV_CART_SVG + "<span class=\"cart-pill__count\">" + esc(String(cartCount)) + "</span></a>\n" +
+    "      </nav>";
+}
+
 function _wrap(opts) {
   var themeCss = (opts && typeof opts.theme_css === "string" && opts.theme_css.length)
     ? opts.theme_css
@@ -758,7 +802,6 @@ function _wrap(opts) {
   var vars = {
     title:          opts.title,
     shop_name:      shopName,
-    cart_count:     cartCount,
     year:           _COPYRIGHT_YEAR,
     search_q:       opts.search_q == null ? "" : opts.search_q,
     theme_css:           themeCss,
@@ -770,19 +813,24 @@ function _wrap(opts) {
     canonical_url:  canonicalUrl,
     lang:           localeCtx.lang || "en",
     dir:            localeCtx.dir  || "ltr",
-    nav_cart_aria:  cartAria,
     body:           "RAW_BODY_PLACEHOLDER",
   };
-  // Layer in every chrome string the LAYOUT references. `nav_cart_aria`
-  // is handled above (it needs the count interpolated); the two
-  // `locale_switcher_*` strings live only inside the switcher form
-  // (spliced via RAW_LOCALE_SWITCHER), not in the LAYOUT body — the
-  // strict `_render` refuses an unused placeholder, so they're skipped
-  // here.
+  // Layer in every chrome string the LAYOUT references. The nav chrome
+  // strings (`nav_shop` / `nav_collections` / `nav_categories` /
+  // `nav_framework` / `nav_account` / `nav_menu` / `nav_cart_aria`) are
+  // NOT referenced by the LAYOUT const — the nav is raw-spliced via
+  // `RAW_PRIMARY_NAV` from `_buildPrimaryNav` so the Collections/Categories
+  // links can render conditionally. The strict `_render` refuses an unused
+  // placeholder, so those keys are skipped here. Likewise the two
+  // `locale_switcher_*` strings live only inside the switcher form (spliced
+  // via RAW_LOCALE_SWITCHER).
   var chromeKeys = Object.keys(chrome);
   for (var ci = 0; ci < chromeKeys.length; ci += 1) {
     var ck = chromeKeys[ci];
-    if (ck === "nav_cart_aria" || ck === "locale_switcher_label" || ck === "locale_switcher_submit") continue;
+    if (ck === "nav_shop" || ck === "nav_collections" || ck === "nav_categories" ||
+        ck === "nav_framework" || ck === "nav_account" || ck === "nav_menu" ||
+        ck === "nav_cart_aria" ||
+        ck === "locale_switcher_label" || ck === "locale_switcher_submit") continue;
     vars[ck] = chrome[ck];
   }
 
@@ -821,6 +869,14 @@ function _wrap(opts) {
   // Matches the edge renderers' `spliceRaw` so the dual-render stays
   // byte-consistent under a `$`-bearing announcement. See `_spliceRaw`.
   assembled = _spliceRaw(assembled, "RAW_ANNOUNCEMENT_BAR", announcementBarHtml);
+  // Primary nav — a raw splice (post strict-render) so the chrome strings
+  // it consumes (nav_shop / nav_collections / nav_categories /
+  // nav_framework / nav_account / nav_menu / nav_cart_aria) need no LAYOUT
+  // `{{}}` placeholder, and the Collections/Categories links render only
+  // when their routes are mounted. Escaped values are spliced via the
+  // replacer-function helper so a `$`-sequence lands literally.
+  assembled = _spliceRaw(assembled, "RAW_PRIMARY_NAV",
+    _buildPrimaryNav(chrome, cartCount, cartAria, _hasCollections, _hasCategoryNav));
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
@@ -905,6 +961,60 @@ function _buildRelatedProducts(related) {
          "</section>";
 }
 
+// Home "Featured collections" band — the six decorative card-art SVGs
+// lifted verbatim from the prior static band, indexed 1..6. The dynamic
+// builder rotates through them by position so an operator's collections
+// keep the band's designed look without per-collection iconography. Kept
+// byte-identical to worker/render/home.js#COLLECTION_BAND_ART so the dual
+// render agrees.
+var COLLECTION_BAND_ART = [
+  "<div class=\"collection-card__art collection-card__art--1\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M70 38 C74 44 86 44 90 38 L104 44 L112 58 L100 64 L96 58 L96 92 L64 92 L64 58 L60 64 L48 58 L56 44 Z\"/><path d=\"M71 40 C75 47 85 47 89 40\" stroke=\"#732A8D\" stroke-width=\"2\"/><path d=\"M73 76 H87\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-dasharray=\"2 3\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--2\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"58\" y=\"38\" width=\"44\" height=\"44\" rx=\"4\"/><rect x=\"70\" y=\"50\" width=\"20\" height=\"20\" rx=\"2\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"3\" fill=\"#AD38DB\" stroke=\"none\"/><path d=\"M66 38 V30 M76 38 V30 M86 38 V30 M96 38 V30\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M66 82 V90 M76 82 V90 M86 82 V90 M96 82 V90\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M58 48 H50 M58 60 H50 M58 72 H50\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M102 48 H110 M102 60 H110 M102 72 H110\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--3\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M60 74 C50 74 48 62 57 59 C56 47 73 43 79 53 C88 47 100 54 97 64 C107 65 107 74 99 74 Z\" stroke=\"#732A8D\"/><path d=\"M78 60 V86\"/><path d=\"M70 78 L78 88 L86 78\"/><path d=\"M64 98 H92\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--4\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M56 50 A26 26 0 0 1 104 56\"/><path d=\"M104 70 A26 26 0 0 1 56 64\"/><path d=\"M104 42 L106 57 L91 55\" stroke=\"#AD38DB\"/><path d=\"M56 78 L54 63 L69 65\" stroke=\"#AD38DB\"/><circle cx=\"80\" cy=\"60\" r=\"6\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"1.6\" fill=\"currentColor\" stroke=\"none\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--5\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M86 36 L106 44 L106 64 L86 72 L66 64 L66 44 Z\" stroke=\"#732A8D\"/><path d=\"M66 44 L86 52 L106 44 M86 52 V72\" stroke=\"#732A8D\"/><path d=\"M70 56 L90 64 L90 88 L70 96 L50 88 L50 64 Z\"/><path d=\"M50 64 L70 72 L90 64 M70 72 V96\"/><path d=\"M70 72 V96\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--6\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"48\" y=\"48\" width=\"64\" height=\"42\" rx=\"6\"/><path d=\"M80 48 V90\" stroke=\"#732A8D\"/><path d=\"M80 48 C71 36 56 39 62 49 C57 52 61 57 71 53 C76 51 80 50 80 48 Z\"/><path d=\"M80 48 C89 36 104 39 98 49 C103 52 99 57 89 53 C84 51 80 50 80 48 Z\"/><circle cx=\"80\" cy=\"48\" r=\"2.4\" fill=\"#AD38DB\" stroke=\"none\"/><rect x=\"56\" y=\"70\" width=\"11\" height=\"8\" rx=\"1.6\" stroke=\"currentColor\" stroke-width=\"1.8\"/></svg></div>",
+];
+
+// Home "Featured collections" band builder — operator collections (active,
+// newest-curated first via collections.list, capped at 6) rendered as the
+// existing collection-card grid. Each card links to /collections/<slug>;
+// the decorative per-card art rotates through COLLECTION_BAND_ART by index.
+// Returns "" when there are no collections to show — the caller drops the
+// whole section, so a store with no collections shows hero → catalog with
+// no empty band. Operator slug/title/description are escaped at the sink
+// (escape-by-default; cross-customer free-text rendered to every visitor).
+// A theme that owns its own home template never reaches this band; the
+// data is still threaded so a theme can add a collections slot later.
+// Kept byte-identical to worker/render/home.js#_buildCollectionsBand.
+function _buildCollectionsBand(collections) {
+  var esc = b.template.escapeHtml;
+  var cols = Array.isArray(collections) ? collections.slice(0, 6) : [];
+  if (cols.length === 0) return "";
+  var cards = "";
+  for (var i = 0; i < cols.length; i += 1) {
+    var c = cols[i];
+    var art = COLLECTION_BAND_ART[i % COLLECTION_BAND_ART.length];
+    cards +=
+      "    <a class=\"collection-card\" href=\"/collections/" + esc(c.slug) + "\">\n" +
+      "      " + art + "\n" +
+      "      <div class=\"collection-card__meta\">\n" +
+      "        <h3>" + esc(c.title) + "</h3>\n" +
+      (c.description ? "        <p>" + esc(c.description) + "</p>\n" : "") +
+      "      </div>\n" +
+      "    </a>\n";
+  }
+  return "<section class=\"collections\" aria-labelledby=\"collections-title\">\n" +
+    "  <header class=\"section-head\">\n" +
+    "    <p class=\"eyebrow\">Featured collections</p>\n" +
+    "    <h2 id=\"collections-title\" class=\"section-head__title\">Browse the catalog by collection.</h2>\n" +
+    "  </header>\n" +
+    "  <div class=\"collections__grid\">\n" +
+    cards +
+    "  </div>\n" +
+    "</section>\n";
+}
+
 var HOME_HERO =
   "<section class=\"hero hero--dark\">\n" +
   "  <div class=\"hero__bg\" aria-hidden=\"true\">\n" +
@@ -983,57 +1093,7 @@ var HOME_HERO =
   "\n" +
   "RAW_FEATURED_CALLOUT\n" +
   "\n" +
-  "<section class=\"collections\" aria-labelledby=\"collections-title\">\n" +
-  "  <header class=\"section-head\">\n" +
-  "    <p class=\"eyebrow\">Featured collections</p>\n" +
-  "    <h2 id=\"collections-title\" class=\"section-head__title\">Shaped for a storefront that ships from day one.</h2>\n" +
-  "    <p class=\"section-head__lede\">Drop products into any of these starting categories — or define your own taxonomy through the catalog admin and the framework will server-render the grids, filters, and PDP routes for free.</p>\n" +
-  "  </header>\n" +
-  "  <div class=\"collections__grid\">\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=tee\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--1\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M70 38 C74 44 86 44 90 38 L104 44 L112 58 L100 64 L96 58 L96 92 L64 92 L64 58 L60 64 L48 58 L56 44 Z\"/><path d=\"M71 40 C75 47 85 47 89 40\" stroke=\"#732A8D\" stroke-width=\"2\"/><path d=\"M73 76 H87\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-dasharray=\"2 3\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Apparel</h3>\n" +
-  "        <p>Sized, colored, inventoried.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=edge\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--2\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"58\" y=\"38\" width=\"44\" height=\"44\" rx=\"4\"/><rect x=\"70\" y=\"50\" width=\"20\" height=\"20\" rx=\"2\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"3\" fill=\"#AD38DB\" stroke=\"none\"/><path d=\"M66 38 V30 M76 38 V30 M86 38 V30 M96 38 V30\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M66 82 V90 M76 82 V90 M86 82 V90 M96 82 V90\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M58 48 H50 M58 60 H50 M58 72 H50\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M102 48 H110 M102 60 H110 M102 72 H110\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Hardware</h3>\n" +
-  "        <p>Serialized, warranty-tracked.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=license\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--3\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M60 74 C50 74 48 62 57 59 C56 47 73 43 79 53 C88 47 100 54 97 64 C107 65 107 74 99 74 Z\" stroke=\"#732A8D\"/><path d=\"M78 60 V86\"/><path d=\"M70 78 L78 88 L86 78\"/><path d=\"M64 98 H92\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Digital</h3>\n" +
-  "        <p>License-key fulfillment.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=subscription\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--4\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M56 50 A26 26 0 0 1 104 56\"/><path d=\"M104 70 A26 26 0 0 1 56 64\"/><path d=\"M104 42 L106 57 L91 55\" stroke=\"#AD38DB\"/><path d=\"M56 78 L54 63 L69 65\" stroke=\"#AD38DB\"/><circle cx=\"80\" cy=\"60\" r=\"6\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"1.6\" fill=\"currentColor\" stroke=\"none\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Subscriptions</h3>\n" +
-  "        <p>Stripe-backed recurring.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=bundle\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--5\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M86 36 L106 44 L106 64 L86 72 L66 64 L66 44 Z\" stroke=\"#732A8D\"/><path d=\"M66 44 L86 52 L106 44 M86 52 V72\" stroke=\"#732A8D\"/><path d=\"M70 56 L90 64 L90 88 L70 96 L50 88 L50 64 Z\"/><path d=\"M50 64 L70 72 L90 64 M70 72 V96\"/><path d=\"M70 72 V96\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Bundles</h3>\n" +
-  "        <p>Composite SKUs, atomic stock.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=gift\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--6\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"48\" y=\"48\" width=\"64\" height=\"42\" rx=\"6\"/><path d=\"M80 48 V90\" stroke=\"#732A8D\"/><path d=\"M80 48 C71 36 56 39 62 49 C57 52 61 57 71 53 C76 51 80 50 80 48 Z\"/><path d=\"M80 48 C89 36 104 39 98 49 C103 52 99 57 89 53 C84 51 80 50 80 48 Z\"/><circle cx=\"80\" cy=\"48\" r=\"2.4\" fill=\"#AD38DB\" stroke=\"none\"/><rect x=\"56\" y=\"70\" width=\"11\" height=\"8\" rx=\"1.6\" stroke=\"currentColor\" stroke-width=\"1.8\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Gift cards</h3>\n" +
-  "        <p>PQC-signed redemption codes.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "  </div>\n" +
-  "</section>\n" +
+  "RAW_COLLECTIONS_BAND\n" +
   "\n" +
   "<section id=\"framework\" class=\"framework-band\" aria-labelledby=\"framework-title\">\n" +
   "  <div class=\"framework-band__inner\">\n" +
@@ -1092,13 +1152,12 @@ var CATALOG_EMPTY =
 
 var CATALOG_HEAD =
   "<section id=\"catalog\" class=\"catalog-section\">\n" +
-  "  <header class=\"section-head section-head--with-link\">\n" +
+  "  <header class=\"section-head\">\n" +
   "    <div>\n" +
   "      <p class=\"eyebrow\">Catalog</p>\n" +
   "      <h2 class=\"section-head__title\">Products in store</h2>\n" +
   "      <p class=\"section-head__lede\">Server-rendered listings — every card, price, and link arrived on the wire as complete HTML.</p>\n" +
   "    </div>\n" +
-  "    <a class=\"link-arrow\" href=\"/?sort=new\">New arrivals <span aria-hidden=\"true\">→</span></a>\n" +
   "  </header>\n" +
   "  <div class=\"grid\">{{cards}}</div>\n" +
   "</section>\n";
@@ -1181,8 +1240,15 @@ function renderHome(opts) {
       "</section>";
   }
 
-  var hero = _render(HOME_HERO, { product_count: heroProductCount })
-    .replace("RAW_FEATURED_CALLOUT", featuredHtml);
+  // Featured-collections band — operator collections (active, newest
+  // first, capped at 6); the band is dropped entirely when there are
+  // none. Spliced raw (replacer-function form, $-safe) since the
+  // operator slug/title/description are escaped at the band's own sink.
+  var collectionsBand = _buildCollectionsBand(opts.collections || []);
+  var hero = _spliceRaw(
+    _render(HOME_HERO, { product_count: heroProductCount })
+      .replace("RAW_FEATURED_CALLOUT", featuredHtml),
+    "RAW_COLLECTIONS_BAND", collectionsBand);
   // The hero + value band + catalog section give the home page a
   // designed surface even when no products are loaded yet —
   // visitors land on the storefront shell, not a tech demo.
@@ -1754,7 +1820,40 @@ var VARIANT_ROW =
 // worker/render/product.js#_buildBuyBox.
 var BUYBOX_CHIP_LIMIT = 12;
 
-function _buildBuyBox(variants, escAttr, availability) {
+// Compute the PDP buy-box headline price string. `rendered` is the
+// formatted-variant list ([{ id, sku, title, price }]); `variants` + the
+// `prices` map ({ variant_id: { currency, amount_minor } }) carry the
+// integer minor-units. Multi-variant products with >1 distinct price read
+// "From <lowest>" (min over amount_minor, formatted once via `fmt`); a
+// single-variant, no-price, or all-equal-price product keeps the lead
+// variant's exact formatted price. Money discipline: the minimum is taken
+// over integers, never over formatted strings; the result is formatted once.
+// Kept byte-identical to worker/render/product.js#_buildHeadlinePrice.
+function _buildHeadlinePrice(rendered, variants, prices, fmt) {
+  var leadPrice = (rendered[0] && rendered[0].price) || "—";
+  if (!Array.isArray(rendered) || rendered.length <= 1) return leadPrice;
+  var lowMinor = null;
+  var lowCurrency = null;
+  for (var i = 0; i < variants.length; i += 1) {
+    var p = prices && prices[variants[i].id];
+    if (!p || !Number.isInteger(p.amount_minor)) continue;
+    if (lowMinor === null || p.amount_minor < lowMinor) {
+      lowMinor = p.amount_minor;
+      lowCurrency = p.currency || "USD";
+    }
+  }
+  if (lowMinor === null) return leadPrice;
+  // All variants share one price → keep the exact figure (no "From").
+  var allEqual = true;
+  for (var j = 0; j < variants.length; j += 1) {
+    var pj = prices && prices[variants[j].id];
+    if (pj && Number.isInteger(pj.amount_minor) && pj.amount_minor !== lowMinor) { allEqual = false; break; }
+  }
+  if (allEqual) return leadPrice;
+  return "From " + fmt(lowMinor, lowCurrency);
+}
+
+function _buildBuyBox(variants, escAttr, availability, headlinePrice) {
   var inStock = !availability || availability.in_stock !== false;
   if (!variants || variants.length === 0) {
     return "<div class=\"pdp__variants\">\n" +
@@ -1835,8 +1934,9 @@ function _buildBuyBox(variants, escAttr, availability) {
     ? "<button type=\"submit\" class=\"btn-primary cart-page__checkout\">$ add to cart</button>"
     : soldOutBtn;
 
+  var headline = (headlinePrice != null && headlinePrice !== "") ? headlinePrice : lead.price;
   return "<div class=\"pdp__buybox\">\n" +
-         "        <p class=\"featured-product__price\">" + escAttr(lead.price) + "</p>\n" +
+         "        <p class=\"featured-product__price\">" + escAttr(headline) + "</p>\n" +
          "        <form method=\"post\" action=\"/cart/lines\">\n" +
          "          " + variantBlock + "\n" +
          "          <label class=\"pdp__variants-title\" for=\"buybox-qty\">Quantity</label>\n" +
@@ -4515,6 +4615,163 @@ function renderSupportTicket(opts) {
   });
 }
 
+// ---- privacy & data (customer self-service DSR) ------------------------
+//
+// The signed-in customer files an export request (a copy of their data) OR
+// a deletion request (erasure), sees their own request history, and
+// downloads a fulfilled export bundle. Self-service FILES the request; an
+// operator reviews + executes it from the admin queue (identity
+// verification is a controller obligation under every jurisdiction). Every
+// dynamic value — including the customer's own free-text deletion reason
+// replayed in the history — is escaped (b.template.escapeHtml); the
+// primitive bounds length but does NOT strip HTML.
+var _DSR_JURISDICTIONS = [
+  ["gdpr", "GDPR (EU / UK)"],
+  ["ccpa", "CCPA (California)"],
+  ["lgpd", "LGPD (Brazil)"],
+  ["other", "Other"],
+];
+var _DSR_SCOPES = [
+  ["full", "Everything we hold on you"],
+  ["orders_only", "Orders only"],
+  ["identity_only", "Profile + addresses only"],
+];
+
+function _dsrStatusBadge(status) {
+  var esc = b.template.escapeHtml;
+  return "<span class=\"pdp__badge dsr-status--" + esc(String(status)) + "\">" + esc(String(status)) + "</span>";
+}
+
+function renderAccountPrivacy(opts) {
+  var esc = b.template.escapeHtml;
+  var history = opts.history || [];
+  var notice = "";
+  if (opts.ok === "export") {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Your data export request has been filed. We'll prepare it and let you know when it's ready to download.</p>";
+  } else if (opts.ok === "deletion") {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Your erasure request has been filed. We'll verify your identity and confirm once it's complete.</p>";
+  } else if (opts.notice) {
+    notice = "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>";
+  }
+
+  var jurisdictionOpts = _DSR_JURISDICTIONS.map(function (j) {
+    return "<option value=\"" + esc(j[0]) + "\">" + esc(j[1]) + "</option>";
+  }).join("");
+  var scopeOpts = _DSR_SCOPES.map(function (s) {
+    return "<option value=\"" + esc(s[0]) + "\">" + esc(s[1]) + "</option>";
+  }).join("");
+
+  var rowsHtml = "";
+  for (var i = 0; i < history.length; i += 1) {
+    var r = history[i];
+    var date = r.requested_at ? new Date(Number(r.requested_at)).toISOString().slice(0, 10) : "";
+    var kindLabel = r.request_kind === "export" ? "Data export" : "Erasure";
+    var download = (r.request_kind === "export" && (r.status === "fulfilled" || r.status === "delivered"))
+      ? " &middot; <a href=\"/account/privacy/" + esc(String(r.id)) + "/export.json\">Download</a>"
+      : "";
+    var reason = r.reason
+      ? "<p class=\"return-card__meta\">Reason: " + esc(String(r.reason)) + "</p>"
+      : "";
+    rowsHtml +=
+      "<li class=\"return-card\">" +
+        "<div class=\"return-card__head\">" +
+          "<span class=\"return-card__rma\">" + esc(kindLabel) + "</span>" +
+          _dsrStatusBadge(r.status) +
+        "</div>" +
+        "<p class=\"return-card__meta\">" + esc(String(r.jurisdiction).toUpperCase()) +
+          (date ? " &middot; <time datetime=\"" + esc(date) + "\">" + esc(date) + "</time>" : "") +
+          download +
+        "</p>" +
+        reason +
+      "</li>";
+  }
+  var historyInner = rowsHtml
+    ? "<ul class=\"return-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\"><p class=\"account-empty__lede\">You haven't filed any privacy requests yet.</p></div>";
+
+  var body =
+    "<section class=\"account-returns\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Privacy &amp; data</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-returns__title\">Privacy &amp; data</h1>" +
+      "<p class=\"section-head__lede\">Request a copy of the personal data we hold on you, or ask us to erase it. " +
+        "Most requests are completed within the statutory window (GDPR: one month; CCPA: 45 days; LGPD: 15 days).</p>" +
+      notice +
+      "<div class=\"panel\">" +
+        "<h2 class=\"pdp__variants-title\">Request a copy of your data</h2>" +
+        "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/privacy/export\">" +
+          "<label class=\"form-field\"><span class=\"form-field__label\">Applicable law</span>" +
+            "<select name=\"jurisdiction\" required>" + jurisdictionOpts + "</select></label>" +
+          "<label class=\"form-field\"><span class=\"form-field__label\">What to include</span>" +
+            "<select name=\"scope\" required>" + scopeOpts + "</select></label>" +
+          "<button type=\"submit\" class=\"btn-primary\">Request my data</button>" +
+        "</form>" +
+      "</div>" +
+      "<div class=\"panel\">" +
+        "<h2 class=\"pdp__variants-title\">Erase your data</h2>" +
+        "<p class=\"return-card__meta\">This files a request to permanently erase your personal data. " +
+          "We'll verify your identity before acting on it.</p>" +
+        "<a class=\"btn-secondary\" href=\"/account/delete\">Request erasure</a>" +
+      "</div>" +
+      "<h2 class=\"pdp__variants-title\">Your requests</h2>" +
+      historyInner +
+    "</section>";
+  return _wrap({
+    title:      "Privacy & data",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Server-rendered erasure-confirm interstitial (the CSP forbids a client
+// confirm()). Filing requires a non-empty reason + a jurisdiction. A Cancel
+// link returns to the privacy page.
+function renderAccountDelete(opts) {
+  var esc = b.template.escapeHtml;
+  var v = opts.values || {};
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var jurisdictionOpts = _DSR_JURISDICTIONS.map(function (j) {
+    var sel = v.jurisdiction === j[0] ? " selected" : "";
+    return "<option value=\"" + esc(j[0]) + "\"" + sel + ">" + esc(j[1]) + "</option>";
+  }).join("");
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/privacy\">Privacy &amp; data</a></li>" +
+        "<li aria-current=\"page\">Erase my data</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"return-form-page__title\">Request data erasure</h1>" +
+      "<p class=\"form-notice\" role=\"note\">Filing this request asks us to permanently erase the personal data we hold on you. " +
+        "Orders and other records we're legally required to keep are retained but de-linked from your identity. " +
+        "We'll verify your identity before acting on it. This cannot be undone.</p>" +
+      notice +
+      "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/delete\">" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Applicable law</span>" +
+          "<select name=\"jurisdiction\" required>" + jurisdictionOpts + "</select></label>" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Reason for your request</span>" +
+          "<textarea name=\"reason\" required maxlength=\"4000\" rows=\"4\">" + esc(v.reason == null ? "" : String(v.reason)) + "</textarea></label>" +
+        "<div class=\"actions-row\">" +
+          "<button type=\"submit\" class=\"btn-primary\">File erasure request</button>" +
+          "<a class=\"btn-secondary\" href=\"/account/privacy\">Cancel</a>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Erase my data",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Loyalty transaction-type pill — reuses the `pdp__badge` class the
 // theme already styles. The type is one of the ledger's closed enum
 // (earn / redeem / expire / adjust / tier-bonus).
@@ -5532,9 +5789,18 @@ function renderProduct(opts) {
   var preorderShape = opts.preorder_campaign
     ? preorderCtaShape(opts.preorder_campaign.campaign, { remaining_units: opts.preorder_campaign.remaining_units }, fmt, opts.product.slug)
     : null;
+  // Multi-variant headline price — "From <lowest>" so the buy box never
+  // advertises a price that isn't the cheapest buyable variant (variants[0]
+  // may not be the cheapest). The minimum is computed over the integer
+  // amount_minor map and formatted ONCE via the page's own `fmt` (never by
+  // comparing formatted strings — "$9.99" < "$10.00" sorts wrong as text).
+  // Single-variant, no-price, and all-equal-price products keep the lead
+  // variant's exact price string ("From X" when there's only one X is
+  // noise). Kept byte-identical to worker/render/product.js. See UX-5.
+  var headlinePrice = _buildHeadlinePrice(rendered, variants, prices, fmt);
   var buyboxHtml = preorderShape
     ? _buildPreorderCta(preorderShape, b.template.escapeHtml)
-    : _buildBuyBox(rendered, b.template.escapeHtml, availability);
+    : _buildBuyBox(rendered, b.template.escapeHtml, availability, headlinePrice);
   // The reserve PRG lands the shopper back on the PDP with a fixed
   // ?preorder=<reserved|unavailable|closed> marker; the banner prepends the
   // buy box. The marker set is closed (built from a lookup, never the raw
@@ -7736,6 +8002,7 @@ var ACCOUNT_DASH_PAGE =
   "      RAW_PREORDER_LINK\n" +
   // begin: profile + passkey management actions
   "      <a class=\"btn-secondary\" href=\"/account/profile\">Edit profile</a>\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/privacy\">Privacy &amp; data</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/passkeys\">Manage passkeys</a>\n" +
   // end: profile + passkey management actions
   "      <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
@@ -8142,7 +8409,9 @@ function renderOrderList(opts) {
 function _surveyQuestion(q) {
   var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
   var name = "q_" + esc(q.id);
-  var req  = q.required ? " <abbr class=\"survey-req\" title=\"Required\">*</abbr>" : "";
+  var req  = q.required
+    ? " <span class=\"survey-req\" aria-hidden=\"true\">*</span><span class=\"sr-only\">(required)</span>"
+    : "";
   var control = "";
   if (q.kind === "rating") {
     var lo = (q.max >= 9) ? 0 : 1; // 0..10 for NPS-scale, else 1..max
@@ -8472,6 +8741,14 @@ function mount(router, deps) {
   }
   _liveConsentPolicy();
 
+  // Header nav gating — the Collections / Categories links + their mobile-
+  // disclosure entries render only when the matching routes are mounted
+  // (deps wired). Module-scoped so `_buildPrimaryNav` (called from the
+  // module-level `_wrap`, which doesn't close over `deps`) can read them,
+  // matching the `_ccyEnabled` / `_activeConsentPolicy` pattern.
+  _hasCollections = !!deps.collections;
+  _hasCategoryNav = !!deps.categoryNavigation;
+
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");
@@ -9744,8 +10021,19 @@ function mount(router, deps) {
     // id DESC) matches the prior `products.list` order.
     var decorated = await deps.catalog.batch.decoratedActive({ currency: "USD", limit: 24 });
     var products = decorated.rows;
+    // Featured-collections band data — active collections, newest-curated
+    // first (collections.list orders updated_at DESC, slug DESC; the band
+    // caps to 6). Best-effort: a band read failure degrades to no band, it
+    // never blocks the home page. The band itself drops when the list is
+    // empty, so an unwired collections dep also yields hero → catalog.
+    var collections = [];
+    if (deps.collections && typeof deps.collections.list === "function") {
+      try {
+        collections = await deps.collections.list({ active_only: true });
+      } catch (_e) { collections = []; }
+    }
     var ccy = await _currencyForReq(req);
-    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, _requestUrls(req), ccy));
+    var html = renderHome(Object.assign({ products: products, collections: collections, shop_name: shopName, theme: theme }, _requestUrls(req), ccy));
     _send(res, 200, html);
   });
 
@@ -14144,6 +14432,128 @@ function mount(router, deps) {
       });
     }
 
+    // Privacy & data — the signed-in customer's self-service DSR surface.
+    // Filing an export or deletion request pins customer_id to the SESSION
+    // (never the form); requested_by is the fixed "customer-self-service"
+    // string (the session env carries no email — _currentCustomerEnv returns
+    // { customer_id, exp } only — and the primitive requires a non-empty
+    // requested_by). Self-service FILES the request; an operator reviews +
+    // executes it from /admin/dsr (PD-3). The export download is
+    // ownership-scoped (a stranger → 404) and streams the bundle.
+    if (deps.complianceExport && deps.customers) {
+      var dsr         = deps.complianceExport;
+      var dsrReaders  = deps.complianceExportReaders || {};
+      var dsrSections = deps.complianceExportSections || {};
+      var streamDsr   = deps.streamDsrBundle;
+
+      router.get("/account/privacy", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var history = [];
+        try { history = await dsr.auditForCustomer(auth.customer_id); } catch (_e) { history = []; }
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderAccountPrivacy({
+          history:    history,
+          ok:         url && url.searchParams.get("ok"),
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      // File a data-export request. customer_id is pinned to the session.
+      // A bad enum (jurisdiction / scope) throws TypeError → a 400 re-render
+      // with a notice, never a 500. No row is created on a bad enum (the
+      // primitive validates before INSERT).
+      router.post("/account/privacy/export", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var body = req.body || {};
+        try {
+          await dsr.requestExport({
+            customer_id:  auth.customer_id,
+            requested_by: "customer-self-service",
+            jurisdiction: body.jurisdiction,
+            scope:        body.scope,
+          });
+        } catch (e) {
+          if (e instanceof TypeError) {
+            var history = [];
+            try { history = await dsr.auditForCustomer(auth.customer_id); } catch (_e2) { history = []; }
+            var cc = await _cartCountForReq(req);
+            return _send(res, 400, renderAccountPrivacy({
+              history:    history,
+              notice:     "Please choose a valid law and scope and try again.",
+              shop_name:  shopName,
+              cart_count: cc,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/privacy?ok=export");
+        return res.end ? res.end() : res.send("");
+      });
+
+      router.get("/account/delete", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var cartCount = await _cartCountForReq(req);
+        _send(res, 200, renderAccountDelete({ shop_name: shopName, cart_count: cartCount }));
+      });
+
+      // File a deletion request. customer_id is pinned to the session; this
+      // FILES the request (status received) — it does NOT execute the erasure
+      // (the operator reviews identity + runs processDeletion from the admin
+      // queue). A bad enum / empty reason throws TypeError → a 400 re-render.
+      router.post("/account/delete", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var body = req.body || {};
+        try {
+          await dsr.requestDeletion({
+            customer_id:  auth.customer_id,
+            requested_by: "customer-self-service",
+            jurisdiction: body.jurisdiction,
+            reason:       body.reason,
+          });
+        } catch (e) {
+          if (e instanceof TypeError) {
+            var cc = await _cartCountForReq(req);
+            return _send(res, 400, renderAccountDelete({
+              values:     body,
+              notice:     "Please choose a valid law and give a reason, then try again.",
+              shop_name:  shopName,
+              cart_count: cc,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/privacy?ok=deletion");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Ownership-scoped streaming export download. Resolve the row, verify
+      // it belongs to THIS session customer (IDOR gate — a stranger / unknown
+      // / malformed id → 404, never another customer's bundle), confirm it's
+      // a fulfilled/delivered export, then stream. Status + ownership are
+      // validated BEFORE the first write (the bundle streams header-first).
+      router.get("/account/privacy/:id/export.json", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var row;
+        try { row = await dsr.getRequest(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return; }
+          throw e;
+        }
+        if (!row || row.customer_id !== auth.customer_id ||
+            row.request_kind !== "export" ||
+            (row.status !== "fulfilled" && row.status !== "delivered")) {
+          _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+          return;
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      });
+    }
+
     // Loyalty — the signed-in customer's points balance + tier, the
     // earn/redeem ledger, how points are earned, and (when a reward
     // catalog + redemption primitive are wired) a redeem-a-reward
@@ -15567,6 +15977,7 @@ module.exports = {
   renderProfile:         renderProfile,
   renderAccountSubscriptions: renderAccountSubscriptions,
   renderCookiePreferences: renderCookiePreferences,
+  renderSurveyPage:      renderSurveyPage,
   renderNewsletterError: renderNewsletterError,
   renderNotFound:        renderNotFound,
   // Layout exposed so operators forking the framework can override.

package/lib/translations.js

@@ -571,8 +571,12 @@ var CHROME_DEFAULTS = Object.freeze({
   search_submit:      "Search",
 
   nav_shop:           "Shop",
+  nav_collections:    "Collections",
+  nav_categories:     "Categories",
   nav_framework:      "Framework",
   nav_account:        "Account",
+  // The narrow-viewport disclosure's <summary> label.
+  nav_menu:           "Menu",
   // The cart aria-label carries the live item count; `{count}` is
   // interpolated by b.i18n at render time.
   nav_cart_aria:      "Cart, {count} items",
@@ -589,8 +593,6 @@ var CHROME_DEFAULTS = Object.freeze({
   footer_shop_all:        "All products",
   footer_shop_collections: "Collections",
   footer_shop_categories: "Categories",
-  footer_shop_new:        "New arrivals",
-  footer_shop_sale:       "On sale",
   footer_shop_compare:    "Compare",
   footer_shop_cart:       "Cart",
   footer_shop_shipping:   "Shipping & returns",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.47",
+  "version": "0.3.49",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {