@blamejs/blamejs-shop 0.3.48 → 0.3.50

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.50 (2026-06-02) — **Installable PWA manifest, hreflang for multilingual stores, complete sitemap and robots coverage, localized edge pages, and product Q&A rich results.** Several search-engine and internationalization signals were missing or inconsistent between the cached (edge) and dynamically rendered pages. This release serves an installable web-app manifest and a service worker, emits hreflang alternates when a store runs path- or subdomain-based locales, localizes the blog, CMS, and policy pages on the cached path (they were always English), brings the robots.txt and sitemap into agreement across both render paths with collections, categories, and CMS pages now included, and emits Q&A structured data on product pages. It also fixes a bug that dropped every product from the dynamically rendered sitemap. **Added:** *Installable web-app manifest and service worker* — The store now serves a web-app manifest at /manifest.webmanifest and a service worker at /sw.js, and links the manifest from every page, so the storefront can be installed as a progressive web app. A working default is served out of the box; an operator who configures a custom manifest overrides it. · *hreflang alternates for multilingual stores* — When a store runs locales via URL prefixes (e.g. /de/) or subdomains, each page now emits rel=alternate hreflang links (plus x-default) so search engines map the equivalent localized URLs instead of treating them as duplicate content. Stores on a single locale, or locale-by-cookie, emit none. · *Product Q&A rich results* — A product page with answered customer questions now emits QAPage structured data so the questions and answers are eligible for rich results in search. **Fixed:** *Localized blog, CMS, and policy pages on the cached path* — The cached (edge-rendered) blog articles, CMS pages, and privacy/terms pages now carry the correct document language and direction for the active locale, matching the dynamically rendered pages. Previously they were always marked English and left-to-right, which harmed screen readers and search indexing and broke right-to-left layout. · *Consistent robots.txt and complete sitemap* — robots.txt now disallows the admin, cart, checkout, order, and account paths consistently on both render paths, and the sitemap now includes collection, category, and CMS-page URLs alongside products and blog posts. A bug that made the dynamically rendered sitemap omit every product (a list limit overflow) is fixed so the full catalog is listed.
+
+- v0.3.49 (2026-06-02) — **Real collection tiles on the home page, a working mobile nav, Collections/Categories in the header, and From-price on multi-variant products.** The home page's 'Featured collections' band linked to fixed keyword searches that landed on empty results unless a product happened to contain those words, the header navigation disappeared entirely on phones with no menu to replace it, and the two real catalog-browse surfaces (Collections and Categories) were reachable only from the footer. This release resolves those: the home tiles now render the store's actual collections with real links, the header gains a no-JavaScript mobile menu, and Collections and Categories appear in the primary nav. Multi-variant products now show a 'From <lowest price>' headline instead of always showing the first variant's price, the non-functional 'New arrivals'/'On sale' sort links are removed, and two small accessibility fixes land (the survey required-field marker and a dark color-scheme hint for native form controls). **Changed:** *Home 'Featured collections' tiles render real collections* — The featured-collections band on the home page now lists the store's actual collections with links to each collection page, instead of fixed keyword searches that could land on an empty results page. If no collections are defined, the band is omitted rather than shown empty. Both the cached and dynamically rendered home pages produce identical markup. · *Mobile navigation menu (no JavaScript required)* — On narrow screens the header now offers a disclosure menu that reveals the navigation links, which previously vanished entirely below a tablet width. It is a pure-CSS menu, so it works with JavaScript disabled. · *Collections and Categories in the header navigation* — The two catalog-browse surfaces — Collections and Categories — are now in the primary header navigation (and inside the mobile menu), not only in the footer. · *Multi-variant products show a 'From' price* — A product whose variants differ in price now shows a 'From <lowest price>' headline so the prominent price is no longer misleading when a shopper selects a different variant; each variant chip still shows its own exact price. · *Removed non-functional sort links* — The 'New arrivals' and 'On sale' links did nothing — the home page does not yet support sorting — so they have been removed rather than left as dead controls. They will return if and when catalog sorting is added. · *Accessibility: survey required marker and dark color-scheme* — The survey form's required-field marker is now announced correctly to screen readers, and the theme declares a dark color-scheme so native form controls, scrollbars, and autofill render correctly on the dark surface.
+
 - v0.3.48 (2026-06-02) — **Customers can export or request deletion of their personal data, and the admin console gets a privacy-request queue to fulfil it.** The framework had a complete data-subject-request engine but nothing reached it, so a store handling EU/California personal data had no way for a shopper to exercise their right of access or erasure and no operator path to fulfil one. A signed-in customer can now request a full export of their data — account, addresses, orders, subscriptions, loyalty, and support history, streamed as a downloadable JSON bundle — and can file a deletion request. The admin console gets a Privacy requests screen where an operator reviews each request, downloads the export, previews a deletion (a dry run that changes nothing), and then executes it. Erasure anonymizes the customer's account and archives their addresses and subscriptions while retaining orders, loyalty ledger, and support tickets that must be kept for tax and legal records. A customer can only ever see or act on their own requests; deletion is always filed by the customer and carried out by an operator. **Added:** *Customer data export and deletion requests* — A signed-in customer gets a Privacy & data area under their account where they can request a full export of their personal data and file a deletion request. The export is streamed as a downloadable JSON bundle covering their account, addresses, orders, subscriptions, loyalty balance and ledger, and support history. A customer can only access their own requests and downloads; a request belonging to anyone else returns not-found. · *Privacy-request queue in the admin console* — A new Privacy requests screen lists every data-subject request with its status. An operator can download a request's export, preview a deletion as a dry run that reports what would change without modifying anything, and then execute the deletion behind a confirmation step. Deletion anonymizes the customer's account and archives their addresses and subscriptions, while orders, the loyalty ledger, and support tickets are retained for tax and legal record-keeping. Every customer- and operator-entered field shown in either console is HTML-escaped.
 
 - v0.3.47 (2026-06-01) — **Admin product detail, collections list, and order shipment panels load with fewer database round trips.** Three admin-console screens re-derived data with one database query per item: the product-detail screen ran a query per variant per currency for current and historical prices, the collections list pulled up to 200 member rows for each collection just to count them, and the order-detail shipment panel hydrated each shipment and its labels sequentially. These now read in batched or parallel queries. The displayed data is unchanged, with one correctness improvement: a manual collection with more than 200 members now shows its true product count instead of a number capped at 200. **Changed:** *Batched admin product-detail price hydration* — The admin product-detail screen now loads every variant's current and historical prices across all currencies in a single batched query instead of one query per variant per currency. The screen renders identically. · *Collections list counts without pulling member rows* — The admin collections list now counts a manual collection's members with a COUNT query instead of fetching up to 200 member rows per collection. A manual collection with more than 200 members now shows its true count (previously the displayed count was capped at 200); rule-based collections keep their existing bounded preview count. · *Parallel shipment hydration on order detail* — The order-detail shipment panel now hydrates each shipment and its labels in parallel rather than one after another, so an order with several shipments opens faster.

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.48",
+  "version": "0.3.50",
   "assets": {
     "css/admin.css": {
-      "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",
-      "fingerprinted": "css/admin.72c808274ebcefd9.css"
+      "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
+      "fingerprinted": "css/admin.f028b2e410387546.css"
     },
     "css/main.css": {
-      "integrity": "sha384-kbtcIsmD7X/DDsTJIYQ49JexBKXkz/GU1aQ8430XEyHHW/hcOPMWqbgZ7wRqvsbT",
-      "fingerprinted": "css/main.37860144b12a94fe.css"
+      "integrity": "sha384-9rtEz2wKJbpfALccIipRdo/BWVQZi5O4IufqaLO/7jFyLK1xxCaDc/65Apjy8dbs",
+      "fingerprinted": "css/main.1a1a379d6f58e2c0.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/locale-router.js

@@ -1042,11 +1042,50 @@ function create(opts) {
     return out;
   }
 
+  // Build the hreflang alternate set for `path` on `host` under the
+  // active policy. Returns
+  //   { default_locale, x_default_url, alternates: [{ tag, href }, …] }
+  // when an active `url_prefix` / `subdomain` policy exists — one entry per
+  // supported locale, each `href` the `_canonicalForUrl` for that tag, plus
+  // the `x_default_url` for the default locale. Returns null for a non-URL
+  // strategy (cookie / accept-language), a single-locale policy, no active
+  // policy, or a malformed host/path. Request-shape reader: never throws on
+  // bad input (a hostile Host header must not 500 a page render) — it
+  // returns null so callers emit no hreflang.
+  async function alternateUrls(host, path) {
+    var h, p;
+    try { h = _host(host, "host"); } catch (_e) { return null; }
+    try { p = _path(path, "path"); } catch (_e) { return null; }
+    var policy;
+    try { policy = await activePolicy(); } catch (_e) { return null; }
+    if (!policy) return null;
+    var strategy = policy.strategy;
+    if (strategy !== "url_prefix" && strategy !== "subdomain") return null;
+    var supported = policy.supported_locales;
+    if (!Array.isArray(supported) || supported.length < 2) return null;
+    var defaultLocale = policy.default_locale;
+    var alternates = [];
+    for (var i = 0; i < supported.length; i += 1) {
+      var tag  = supported[i];
+      var href = _canonicalForUrl(h, p, tag, strategy);
+      if (href === undefined) continue;
+      alternates.push({ tag: tag, href: href });
+    }
+    if (!alternates.length) return null;
+    var xDefault = _canonicalForUrl(h, p, defaultLocale, strategy);
+    return {
+      default_locale: defaultLocale,
+      x_default_url:  xDefault === undefined ? null : xDefault,
+      alternates:     alternates,
+    };
+  }
+
   return {
     KINDS:               KINDS.slice(),
     STRATEGIES:          STRATEGIES.slice(),
     LOCALE_RE:           LOCALE_RE,
     CURRENCY_RE:         CURRENCY_RE,
+    alternateUrls:       alternateUrls,
     defineLocale:        defineLocale,
     getLocale:           getLocale,
     listLocales:         listLocales,

package/lib/storefront.js

@@ -267,9 +267,11 @@ var LAYOUT =
   "  <meta name=\"description\" content=\"{{og_description}}\">\n" +
   "  <link rel=\"canonical\" href=\"{{canonical_url}}\">\n" +
   "RAW_ROBOTS_META" +
+  "RAW_HREFLANG" +
   "  <link rel=\"icon\" type=\"image/svg+xml\" href=\"/assets/brand/favicon.svg\">\n" +
   "  <link rel=\"icon\" type=\"image/png\" href=\"/assets/brand/favicon.png\">\n" +
   "  <link rel=\"apple-touch-icon\" href=\"/assets/brand/favicon.png\">\n" +
+  "  <link rel=\"manifest\" href=\"/manifest.webmanifest\">\n" +
   "  <meta name=\"theme-color\" content=\"#08080a\">\n" +
   "  <link rel=\"stylesheet\" href=\"{{theme_css}}\"RAW_CSS_INTEGRITY>\n" +
   "  <meta property=\"og:type\" content=\"{{og_type}}\">\n" +
@@ -306,12 +308,7 @@ var LAYOUT =
   "          <button type=\"submit\">{{search_submit}}</button>\n" +
   "        </div>\n" +
   "      </form>\n" +
-  "      <nav class=\"site-nav\" aria-label=\"Primary\">\n" +
-  "        <a class=\"site-nav__link\" href=\"/\">{{nav_shop}}</a>\n" +
-  "        <a class=\"site-nav__link\" href=\"/#framework\">{{nav_framework}}</a>\n" +
-  "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"{{nav_account}}\"><svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg></a>\n" +
-  "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"{{nav_cart_aria}}\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg><span class=\"cart-pill__count\">{{cart_count}}</span></a>\n" +
-  "      </nav>\n" +
+  "      RAW_PRIMARY_NAV\n" +
   "    </div>\n" +
   "  </header>\n" +
   "\n" +
@@ -349,8 +346,6 @@ var LAYOUT =
   "          <li><a href=\"/\">{{footer_shop_all}}</a></li>\n" +
   "          <li><a href=\"/collections\">{{footer_shop_collections}}</a></li>\n" +
   "          <li><a href=\"/categories\">{{footer_shop_categories}}</a></li>\n" +
-  "          <li><a href=\"/?sort=new\">{{footer_shop_new}}</a></li>\n" +
-  "          <li><a href=\"/?sort=sale\">{{footer_shop_sale}}</a></li>\n" +
   "          <li><a href=\"/compare\">{{footer_shop_compare}}</a></li>\n" +
   "          <li><a href=\"/cart\">{{footer_shop_cart}}</a></li>\n" +
   "          <li><a href=\"/terms\">{{footer_shop_shipping}}</a></li>\n" +
@@ -683,6 +678,57 @@ function _requestUrls(req) {
   return { canonical_url: origin + path, og_url: origin + path + search };
 }
 
+// Whether the Collections / Categories routes are mounted (deps wired).
+// The header links + the mobile-disclosure entries render only when their
+// route exists, so a store that hasn't wired the primitive never shows a
+// link that 404s. Set once at mount (alongside `_ccyEnabled`), read in the
+// nav builder. Default true so a pure render of a page (a unit test calling
+// `renderHome` without mounting) shows the full nav; the route-level
+// conditional only suppresses a link when the mount explicitly lacks the dep.
+var _hasCollections = true;
+var _hasCategoryNav = true;
+
+// The account-icon + cart-pill SVGs, lifted verbatim from the prior LAYOUT
+// nav so the builder emits the same chrome. Kept byte-identical to the edge
+// headers (worker/render/*.js).
+var _NAV_ACCOUNT_SVG = "<svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg>";
+var _NAV_CART_SVG    = "<svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg>";
+var _NAV_MENU_SVG    = "<svg viewBox=\"0 0 24 24\" width=\"22\" height=\"22\" aria-hidden=\"true\"><path d=\"M4 7h16M4 12h16M4 17h16\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg>";
+
+// Primary nav builder — a desktop link row (`.site-nav__links`) PLUS a
+// CSP-safe <details>/<summary> disclosure (`.site-nav__menu`) carrying the
+// same links for narrow viewports. The CSS shows one or the other by
+// breakpoint (the inline row hides at <=48rem; the disclosure hides above
+// it). No JS — the browser drives open/close. Collections / Categories
+// render only when `hasCollections` / `hasCategories` (their routes mounted).
+// All labels are chrome strings, escaped at the sink. Kept byte-identical to
+// the static nav in every worker/render/*.js header (the edge renders the
+// two extra links unconditionally — accepted divergence; the byte-compare
+// test wires both container deps so the markup matches).
+function _buildNavLinks(chrome, hasCollections, hasCategories, indent) {
+  var esc = b.template.escapeHtml;
+  return indent + "<a class=\"site-nav__link\" href=\"/\">" + esc(chrome.nav_shop) + "</a>\n" +
+    (hasCollections ? indent + "<a class=\"site-nav__link\" href=\"/collections\">" + esc(chrome.nav_collections) + "</a>\n" : "") +
+    (hasCategories ? indent + "<a class=\"site-nav__link\" href=\"/categories\">" + esc(chrome.nav_categories) + "</a>\n" : "") +
+    indent + "<a class=\"site-nav__link\" href=\"/#framework\">" + esc(chrome.nav_framework) + "</a>\n";
+}
+function _buildPrimaryNav(chrome, cartCount, cartAria, hasCollections, hasCategories) {
+  var esc = b.template.escapeHtml;
+  return "<nav class=\"site-nav\" aria-label=\"Primary\">\n" +
+    "        <div class=\"site-nav__links\">\n" +
+    _buildNavLinks(chrome, hasCollections, hasCategories, "          ") +
+    "        </div>\n" +
+    "        <details class=\"site-nav__menu\">\n" +
+    "          <summary class=\"site-nav__menu-toggle\" aria-label=\"" + esc(chrome.nav_menu) + "\">" + _NAV_MENU_SVG + "<span class=\"site-nav__menu-label\">" + esc(chrome.nav_menu) + "</span></summary>\n" +
+    "          <div class=\"site-nav__drawer\">\n" +
+    _buildNavLinks(chrome, hasCollections, hasCategories, "            ") +
+    "          </div>\n" +
+    "        </details>\n" +
+    "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"" + esc(chrome.nav_account) + "\">" + _NAV_ACCOUNT_SVG + "</a>\n" +
+    "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"" + esc(cartAria) + "\">" + _NAV_CART_SVG + "<span class=\"cart-pill__count\">" + esc(String(cartCount)) + "</span></a>\n" +
+    "      </nav>";
+}
+
 function _wrap(opts) {
   var themeCss = (opts && typeof opts.theme_css === "string" && opts.theme_css.length)
     ? opts.theme_css
@@ -758,7 +804,6 @@ function _wrap(opts) {
   var vars = {
     title:          opts.title,
     shop_name:      shopName,
-    cart_count:     cartCount,
     year:           _COPYRIGHT_YEAR,
     search_q:       opts.search_q == null ? "" : opts.search_q,
     theme_css:           themeCss,
@@ -770,19 +815,24 @@ function _wrap(opts) {
     canonical_url:  canonicalUrl,
     lang:           localeCtx.lang || "en",
     dir:            localeCtx.dir  || "ltr",
-    nav_cart_aria:  cartAria,
     body:           "RAW_BODY_PLACEHOLDER",
   };
-  // Layer in every chrome string the LAYOUT references. `nav_cart_aria`
-  // is handled above (it needs the count interpolated); the two
-  // `locale_switcher_*` strings live only inside the switcher form
-  // (spliced via RAW_LOCALE_SWITCHER), not in the LAYOUT body — the
-  // strict `_render` refuses an unused placeholder, so they're skipped
-  // here.
+  // Layer in every chrome string the LAYOUT references. The nav chrome
+  // strings (`nav_shop` / `nav_collections` / `nav_categories` /
+  // `nav_framework` / `nav_account` / `nav_menu` / `nav_cart_aria`) are
+  // NOT referenced by the LAYOUT const — the nav is raw-spliced via
+  // `RAW_PRIMARY_NAV` from `_buildPrimaryNav` so the Collections/Categories
+  // links can render conditionally. The strict `_render` refuses an unused
+  // placeholder, so those keys are skipped here. Likewise the two
+  // `locale_switcher_*` strings live only inside the switcher form (spliced
+  // via RAW_LOCALE_SWITCHER).
   var chromeKeys = Object.keys(chrome);
   for (var ci = 0; ci < chromeKeys.length; ci += 1) {
     var ck = chromeKeys[ci];
-    if (ck === "nav_cart_aria" || ck === "locale_switcher_label" || ck === "locale_switcher_submit") continue;
+    if (ck === "nav_shop" || ck === "nav_collections" || ck === "nav_categories" ||
+        ck === "nav_framework" || ck === "nav_account" || ck === "nav_menu" ||
+        ck === "nav_cart_aria" ||
+        ck === "locale_switcher_label" || ck === "locale_switcher_submit") continue;
     vars[ck] = chrome[ck];
   }
 
@@ -806,9 +856,20 @@ function _wrap(opts) {
       ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
       : "";
 
+  // hreflang alternates — pre-rendered HTML seeded onto the locale ALS
+  // store by `localeMiddleware` (kept synchronous so it reaches the
+  // handler), or threaded explicitly by a renderer/unit test. Empty for a
+  // single-locale store or a cookie/accept-language strategy (no URL-shaped
+  // alternates to emit). Byte-identical to the edge's `alternateLinks`
+  // output for the same (host, path, supported, default, strategy) — a
+  // parity test pins the two.
+  var hreflangHtml = (typeof opts.alternate_links === "string")
+    ? opts.alternate_links
+    : ((storeCtx && typeof storeCtx.alternate_links === "string") ? storeCtx.alternate_links : "");
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_ROBOTS_META", robotsMeta)
+    .replace("RAW_HREFLANG", hreflangHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
@@ -821,6 +882,14 @@ function _wrap(opts) {
   // Matches the edge renderers' `spliceRaw` so the dual-render stays
   // byte-consistent under a `$`-bearing announcement. See `_spliceRaw`.
   assembled = _spliceRaw(assembled, "RAW_ANNOUNCEMENT_BAR", announcementBarHtml);
+  // Primary nav — a raw splice (post strict-render) so the chrome strings
+  // it consumes (nav_shop / nav_collections / nav_categories /
+  // nav_framework / nav_account / nav_menu / nav_cart_aria) need no LAYOUT
+  // `{{}}` placeholder, and the Collections/Categories links render only
+  // when their routes are mounted. Escaped values are spliced via the
+  // replacer-function helper so a `$`-sequence lands literally.
+  assembled = _spliceRaw(assembled, "RAW_PRIMARY_NAV",
+    _buildPrimaryNav(chrome, cartCount, cartAria, _hasCollections, _hasCategoryNav));
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
@@ -905,6 +974,60 @@ function _buildRelatedProducts(related) {
          "</section>";
 }
 
+// Home "Featured collections" band — the six decorative card-art SVGs
+// lifted verbatim from the prior static band, indexed 1..6. The dynamic
+// builder rotates through them by position so an operator's collections
+// keep the band's designed look without per-collection iconography. Kept
+// byte-identical to worker/render/home.js#COLLECTION_BAND_ART so the dual
+// render agrees.
+var COLLECTION_BAND_ART = [
+  "<div class=\"collection-card__art collection-card__art--1\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M70 38 C74 44 86 44 90 38 L104 44 L112 58 L100 64 L96 58 L96 92 L64 92 L64 58 L60 64 L48 58 L56 44 Z\"/><path d=\"M71 40 C75 47 85 47 89 40\" stroke=\"#732A8D\" stroke-width=\"2\"/><path d=\"M73 76 H87\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-dasharray=\"2 3\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--2\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"58\" y=\"38\" width=\"44\" height=\"44\" rx=\"4\"/><rect x=\"70\" y=\"50\" width=\"20\" height=\"20\" rx=\"2\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"3\" fill=\"#AD38DB\" stroke=\"none\"/><path d=\"M66 38 V30 M76 38 V30 M86 38 V30 M96 38 V30\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M66 82 V90 M76 82 V90 M86 82 V90 M96 82 V90\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M58 48 H50 M58 60 H50 M58 72 H50\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M102 48 H110 M102 60 H110 M102 72 H110\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--3\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M60 74 C50 74 48 62 57 59 C56 47 73 43 79 53 C88 47 100 54 97 64 C107 65 107 74 99 74 Z\" stroke=\"#732A8D\"/><path d=\"M78 60 V86\"/><path d=\"M70 78 L78 88 L86 78\"/><path d=\"M64 98 H92\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--4\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M56 50 A26 26 0 0 1 104 56\"/><path d=\"M104 70 A26 26 0 0 1 56 64\"/><path d=\"M104 42 L106 57 L91 55\" stroke=\"#AD38DB\"/><path d=\"M56 78 L54 63 L69 65\" stroke=\"#AD38DB\"/><circle cx=\"80\" cy=\"60\" r=\"6\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"1.6\" fill=\"currentColor\" stroke=\"none\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--5\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M86 36 L106 44 L106 64 L86 72 L66 64 L66 44 Z\" stroke=\"#732A8D\"/><path d=\"M66 44 L86 52 L106 44 M86 52 V72\" stroke=\"#732A8D\"/><path d=\"M70 56 L90 64 L90 88 L70 96 L50 88 L50 64 Z\"/><path d=\"M50 64 L70 72 L90 64 M70 72 V96\"/><path d=\"M70 72 V96\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>",
+  "<div class=\"collection-card__art collection-card__art--6\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"48\" y=\"48\" width=\"64\" height=\"42\" rx=\"6\"/><path d=\"M80 48 V90\" stroke=\"#732A8D\"/><path d=\"M80 48 C71 36 56 39 62 49 C57 52 61 57 71 53 C76 51 80 50 80 48 Z\"/><path d=\"M80 48 C89 36 104 39 98 49 C103 52 99 57 89 53 C84 51 80 50 80 48 Z\"/><circle cx=\"80\" cy=\"48\" r=\"2.4\" fill=\"#AD38DB\" stroke=\"none\"/><rect x=\"56\" y=\"70\" width=\"11\" height=\"8\" rx=\"1.6\" stroke=\"currentColor\" stroke-width=\"1.8\"/></svg></div>",
+];
+
+// Home "Featured collections" band builder — operator collections (active,
+// newest-curated first via collections.list, capped at 6) rendered as the
+// existing collection-card grid. Each card links to /collections/<slug>;
+// the decorative per-card art rotates through COLLECTION_BAND_ART by index.
+// Returns "" when there are no collections to show — the caller drops the
+// whole section, so a store with no collections shows hero → catalog with
+// no empty band. Operator slug/title/description are escaped at the sink
+// (escape-by-default; cross-customer free-text rendered to every visitor).
+// A theme that owns its own home template never reaches this band; the
+// data is still threaded so a theme can add a collections slot later.
+// Kept byte-identical to worker/render/home.js#_buildCollectionsBand.
+function _buildCollectionsBand(collections) {
+  var esc = b.template.escapeHtml;
+  var cols = Array.isArray(collections) ? collections.slice(0, 6) : [];
+  if (cols.length === 0) return "";
+  var cards = "";
+  for (var i = 0; i < cols.length; i += 1) {
+    var c = cols[i];
+    var art = COLLECTION_BAND_ART[i % COLLECTION_BAND_ART.length];
+    cards +=
+      "    <a class=\"collection-card\" href=\"/collections/" + esc(c.slug) + "\">\n" +
+      "      " + art + "\n" +
+      "      <div class=\"collection-card__meta\">\n" +
+      "        <h3>" + esc(c.title) + "</h3>\n" +
+      (c.description ? "        <p>" + esc(c.description) + "</p>\n" : "") +
+      "      </div>\n" +
+      "    </a>\n";
+  }
+  return "<section class=\"collections\" aria-labelledby=\"collections-title\">\n" +
+    "  <header class=\"section-head\">\n" +
+    "    <p class=\"eyebrow\">Featured collections</p>\n" +
+    "    <h2 id=\"collections-title\" class=\"section-head__title\">Browse the catalog by collection.</h2>\n" +
+    "  </header>\n" +
+    "  <div class=\"collections__grid\">\n" +
+    cards +
+    "  </div>\n" +
+    "</section>\n";
+}
+
 var HOME_HERO =
   "<section class=\"hero hero--dark\">\n" +
   "  <div class=\"hero__bg\" aria-hidden=\"true\">\n" +
@@ -983,57 +1106,7 @@ var HOME_HERO =
   "\n" +
   "RAW_FEATURED_CALLOUT\n" +
   "\n" +
-  "<section class=\"collections\" aria-labelledby=\"collections-title\">\n" +
-  "  <header class=\"section-head\">\n" +
-  "    <p class=\"eyebrow\">Featured collections</p>\n" +
-  "    <h2 id=\"collections-title\" class=\"section-head__title\">Shaped for a storefront that ships from day one.</h2>\n" +
-  "    <p class=\"section-head__lede\">Drop products into any of these starting categories — or define your own taxonomy through the catalog admin and the framework will server-render the grids, filters, and PDP routes for free.</p>\n" +
-  "  </header>\n" +
-  "  <div class=\"collections__grid\">\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=tee\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--1\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M70 38 C74 44 86 44 90 38 L104 44 L112 58 L100 64 L96 58 L96 92 L64 92 L64 58 L60 64 L48 58 L56 44 Z\"/><path d=\"M71 40 C75 47 85 47 89 40\" stroke=\"#732A8D\" stroke-width=\"2\"/><path d=\"M73 76 H87\" stroke=\"currentColor\" stroke-width=\"1.8\" stroke-dasharray=\"2 3\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Apparel</h3>\n" +
-  "        <p>Sized, colored, inventoried.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=edge\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--2\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"58\" y=\"38\" width=\"44\" height=\"44\" rx=\"4\"/><rect x=\"70\" y=\"50\" width=\"20\" height=\"20\" rx=\"2\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"3\" fill=\"#AD38DB\" stroke=\"none\"/><path d=\"M66 38 V30 M76 38 V30 M86 38 V30 M96 38 V30\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M66 82 V90 M76 82 V90 M86 82 V90 M96 82 V90\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M58 48 H50 M58 60 H50 M58 72 H50\" stroke=\"currentColor\" stroke-width=\"2\"/><path d=\"M102 48 H110 M102 60 H110 M102 72 H110\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Hardware</h3>\n" +
-  "        <p>Serialized, warranty-tracked.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=license\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--3\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M60 74 C50 74 48 62 57 59 C56 47 73 43 79 53 C88 47 100 54 97 64 C107 65 107 74 99 74 Z\" stroke=\"#732A8D\"/><path d=\"M78 60 V86\"/><path d=\"M70 78 L78 88 L86 78\"/><path d=\"M64 98 H92\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Digital</h3>\n" +
-  "        <p>License-key fulfillment.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=subscription\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--4\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M56 50 A26 26 0 0 1 104 56\"/><path d=\"M104 70 A26 26 0 0 1 56 64\"/><path d=\"M104 42 L106 57 L91 55\" stroke=\"#AD38DB\"/><path d=\"M56 78 L54 63 L69 65\" stroke=\"#AD38DB\"/><circle cx=\"80\" cy=\"60\" r=\"6\" stroke=\"#732A8D\"/><circle cx=\"80\" cy=\"60\" r=\"1.6\" fill=\"currentColor\" stroke=\"none\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Subscriptions</h3>\n" +
-  "        <p>Stripe-backed recurring.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=bundle\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--5\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><path d=\"M86 36 L106 44 L106 64 L86 72 L66 64 L66 44 Z\" stroke=\"#732A8D\"/><path d=\"M66 44 L86 52 L106 44 M86 52 V72\" stroke=\"#732A8D\"/><path d=\"M70 56 L90 64 L90 88 L70 96 L50 88 L50 64 Z\"/><path d=\"M50 64 L70 72 L90 64 M70 72 V96\"/><path d=\"M70 72 V96\" stroke=\"currentColor\" stroke-width=\"2\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Bundles</h3>\n" +
-  "        <p>Composite SKUs, atomic stock.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "    <a class=\"collection-card\" href=\"/search?q=gift\">\n" +
-  "      <div class=\"collection-card__art collection-card__art--6\" aria-hidden=\"true\"><svg class=\"collection-card__icon\" viewBox=\"0 0 160 120\" fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\" aria-hidden=\"true\"><rect x=\"48\" y=\"48\" width=\"64\" height=\"42\" rx=\"6\"/><path d=\"M80 48 V90\" stroke=\"#732A8D\"/><path d=\"M80 48 C71 36 56 39 62 49 C57 52 61 57 71 53 C76 51 80 50 80 48 Z\"/><path d=\"M80 48 C89 36 104 39 98 49 C103 52 99 57 89 53 C84 51 80 50 80 48 Z\"/><circle cx=\"80\" cy=\"48\" r=\"2.4\" fill=\"#AD38DB\" stroke=\"none\"/><rect x=\"56\" y=\"70\" width=\"11\" height=\"8\" rx=\"1.6\" stroke=\"currentColor\" stroke-width=\"1.8\"/></svg></div>\n" +
-  "      <div class=\"collection-card__meta\">\n" +
-  "        <h3>Gift cards</h3>\n" +
-  "        <p>PQC-signed redemption codes.</p>\n" +
-  "      </div>\n" +
-  "    </a>\n" +
-  "  </div>\n" +
-  "</section>\n" +
+  "RAW_COLLECTIONS_BAND\n" +
   "\n" +
   "<section id=\"framework\" class=\"framework-band\" aria-labelledby=\"framework-title\">\n" +
   "  <div class=\"framework-band__inner\">\n" +
@@ -1092,13 +1165,12 @@ var CATALOG_EMPTY =
 
 var CATALOG_HEAD =
   "<section id=\"catalog\" class=\"catalog-section\">\n" +
-  "  <header class=\"section-head section-head--with-link\">\n" +
+  "  <header class=\"section-head\">\n" +
   "    <div>\n" +
   "      <p class=\"eyebrow\">Catalog</p>\n" +
   "      <h2 class=\"section-head__title\">Products in store</h2>\n" +
   "      <p class=\"section-head__lede\">Server-rendered listings — every card, price, and link arrived on the wire as complete HTML.</p>\n" +
   "    </div>\n" +
-  "    <a class=\"link-arrow\" href=\"/?sort=new\">New arrivals <span aria-hidden=\"true\">→</span></a>\n" +
   "  </header>\n" +
   "  <div class=\"grid\">{{cards}}</div>\n" +
   "</section>\n";
@@ -1181,8 +1253,15 @@ function renderHome(opts) {
       "</section>";
   }
 
-  var hero = _render(HOME_HERO, { product_count: heroProductCount })
-    .replace("RAW_FEATURED_CALLOUT", featuredHtml);
+  // Featured-collections band — operator collections (active, newest
+  // first, capped at 6); the band is dropped entirely when there are
+  // none. Spliced raw (replacer-function form, $-safe) since the
+  // operator slug/title/description are escaped at the band's own sink.
+  var collectionsBand = _buildCollectionsBand(opts.collections || []);
+  var hero = _spliceRaw(
+    _render(HOME_HERO, { product_count: heroProductCount })
+      .replace("RAW_FEATURED_CALLOUT", featuredHtml),
+    "RAW_COLLECTIONS_BAND", collectionsBand);
   // The hero + value band + catalog section give the home page a
   // designed surface even when no products are loaded yet —
   // visitors land on the storefront shell, not a tech demo.
@@ -1754,7 +1833,40 @@ var VARIANT_ROW =
 // worker/render/product.js#_buildBuyBox.
 var BUYBOX_CHIP_LIMIT = 12;
 
-function _buildBuyBox(variants, escAttr, availability) {
+// Compute the PDP buy-box headline price string. `rendered` is the
+// formatted-variant list ([{ id, sku, title, price }]); `variants` + the
+// `prices` map ({ variant_id: { currency, amount_minor } }) carry the
+// integer minor-units. Multi-variant products with >1 distinct price read
+// "From <lowest>" (min over amount_minor, formatted once via `fmt`); a
+// single-variant, no-price, or all-equal-price product keeps the lead
+// variant's exact formatted price. Money discipline: the minimum is taken
+// over integers, never over formatted strings; the result is formatted once.
+// Kept byte-identical to worker/render/product.js#_buildHeadlinePrice.
+function _buildHeadlinePrice(rendered, variants, prices, fmt) {
+  var leadPrice = (rendered[0] && rendered[0].price) || "—";
+  if (!Array.isArray(rendered) || rendered.length <= 1) return leadPrice;
+  var lowMinor = null;
+  var lowCurrency = null;
+  for (var i = 0; i < variants.length; i += 1) {
+    var p = prices && prices[variants[i].id];
+    if (!p || !Number.isInteger(p.amount_minor)) continue;
+    if (lowMinor === null || p.amount_minor < lowMinor) {
+      lowMinor = p.amount_minor;
+      lowCurrency = p.currency || "USD";
+    }
+  }
+  if (lowMinor === null) return leadPrice;
+  // All variants share one price → keep the exact figure (no "From").
+  var allEqual = true;
+  for (var j = 0; j < variants.length; j += 1) {
+    var pj = prices && prices[variants[j].id];
+    if (pj && Number.isInteger(pj.amount_minor) && pj.amount_minor !== lowMinor) { allEqual = false; break; }
+  }
+  if (allEqual) return leadPrice;
+  return "From " + fmt(lowMinor, lowCurrency);
+}
+
+function _buildBuyBox(variants, escAttr, availability, headlinePrice) {
   var inStock = !availability || availability.in_stock !== false;
   if (!variants || variants.length === 0) {
     return "<div class=\"pdp__variants\">\n" +
@@ -1835,8 +1947,9 @@ function _buildBuyBox(variants, escAttr, availability) {
     ? "<button type=\"submit\" class=\"btn-primary cart-page__checkout\">$ add to cart</button>"
     : soldOutBtn;
 
+  var headline = (headlinePrice != null && headlinePrice !== "") ? headlinePrice : lead.price;
   return "<div class=\"pdp__buybox\">\n" +
-         "        <p class=\"featured-product__price\">" + escAttr(lead.price) + "</p>\n" +
+         "        <p class=\"featured-product__price\">" + escAttr(headline) + "</p>\n" +
          "        <form method=\"post\" action=\"/cart/lines\">\n" +
          "          " + variantBlock + "\n" +
          "          <label class=\"pdp__variants-title\" for=\"buybox-qty\">Quantity</label>\n" +
@@ -5613,6 +5726,143 @@ function _jsonLdScript(data) {
   return "<script type=\"application/ld+json\">" + serialised + "</script>";
 }
 
+// PWA default manifest + service worker — the shipped fallback served at
+// /manifest.webmanifest + /sw.js when the operator has not defined an
+// active pwaManifest row. BOTH substrates serve these exact bytes (the
+// edge has no DB-backed primitive; the container's DB-backed pwaManifest is
+// the override), so the `<link rel="manifest">` in every layout never 404s
+// on a fresh deploy. The byte-identical twin of
+// worker/render/_lib.js's PWA_DEFAULT_MANIFEST / PWA_DEFAULT_SW — a parity
+// test pins them. An operator customizes via pwaManifest.defineManifest +
+// setActive on the container path.
+var _PWA_DEFAULT_MANIFEST_OBJ = {
+  name:             "blamejs.shop",
+  short_name:       "blamejs.shop",
+  description:      "Open-source ecommerce framework built on blamejs — server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.",
+  start_url:        "/",
+  scope:            "/",
+  display:          "standalone",
+  orientation:      "portrait",
+  theme_color:      "#08080a",
+  background_color: "#08080a",
+  lang:             "en",
+  dir:              "ltr",
+  icons: [
+    { src: "/assets/brand/favicon.png", sizes: "192x192", type: "image/png", purpose: "any" },
+    { src: "/assets/brand/favicon.png", sizes: "512x512", type: "image/png", purpose: "any maskable" },
+    { src: "/assets/brand/favicon.svg", sizes: "any",     type: "image/svg+xml", purpose: "any" }
+  ]
+};
+var PWA_DEFAULT_MANIFEST = JSON.stringify(_PWA_DEFAULT_MANIFEST_OBJ, null, 2);
+
+var PWA_DEFAULT_SW =
+  "// service worker — shipped default (pass-through navigation fallback)\n" +
+  "\"use strict\";\n" +
+  "var CACHE_NAME = \"blamejs-shop-default-v1\";\n" +
+  "self.addEventListener(\"install\", function (e) { self.skipWaiting(); });\n" +
+  "self.addEventListener(\"activate\", function (e) {\n" +
+  "  e.waitUntil(caches.keys().then(function (keys) {\n" +
+  "    return Promise.all(keys.map(function (k) { if (k !== CACHE_NAME) return caches.delete(k); }));\n" +
+  "  }).then(function () { return self.clients.claim(); }));\n" +
+  "});\n" +
+  "self.addEventListener(\"fetch\", function (e) {\n" +
+  "  if (e.request.method !== \"GET\") return;\n" +
+  "  if (e.request.mode === \"navigate\") {\n" +
+  "    e.respondWith(fetch(e.request).catch(function () { return caches.match(\"/\"); }));\n" +
+  "  }\n" +
+  "});\n";
+
+// QAPage JSON-LD from the PDP's published Q&A threads. Surfaces the
+// question + its answers in Google's Q&A rich result. Emitted only when at
+// least one question has at least one answer — Google rejects a QAPage
+// whose Question carries neither an `acceptedAnswer` nor a
+// `suggestedAnswer`. The first answer is the `acceptedAnswer`; the rest are
+// `suggestedAnswer`. `q.body` / `a.body` are operator/customer free text —
+// `_jsonLdScript` JSON.stringify's them (neutralizing quotes + the
+// `</script` breakout), so they are NOT additionally HTML-escaped (JSON-LD
+// is not HTML, by the documented `_jsonLdScript` contract — the same trust
+// model as the Product JSON-LD `description`). The byte-identical twin of
+// the edge's `worker/render/product.js#_buildQaPageJsonLd`; a parity test
+// pins the two. Returns "" when there is nothing rich-result-eligible.
+function _buildQaPageJsonLd(questions) {
+  questions = questions || [];
+  var mainEntity = [];
+  for (var i = 0; i < questions.length; i += 1) {
+    var q = questions[i];
+    var answers = (q && q.answers) || [];
+    if (answers.length === 0) continue;
+    var question = {
+      "@type":       "Question",
+      "name":        String(q.body),
+      "answerCount": answers.length,
+      "acceptedAnswer": { "@type": "Answer", "text": String(answers[0].body) },
+    };
+    if (answers.length > 1) {
+      var suggested = [];
+      for (var j = 1; j < answers.length; j += 1) {
+        suggested.push({ "@type": "Answer", "text": String(answers[j].body) });
+      }
+      question.suggestedAnswer = suggested;
+    }
+    mainEntity.push(question);
+  }
+  if (mainEntity.length === 0) return "";
+  return _jsonLdScript({
+    "@context":   "https://schema.org",
+    "@type":      "QAPage",
+    "mainEntity": mainEntity,
+  });
+}
+
+// ---- hreflang alternates (URL-shaped locale policies) ------------------
+//
+// The href math + validation envelopes below are the byte-identical twin
+// of worker/render/chrome-i18n.js's `alternateLinks` so the edge + the
+// container emit the same `<link rel="alternate" hreflang>` block for the
+// same (host, path, supported, default, strategy). A parity test pins the
+// two. Both mirror lib/locale-router.js#_canonicalForUrl's prefix /
+// subdomain substitution.
+var _HREFLANG_TAG_RE  = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+var _HREFLANG_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+
+function _hreflangStripLeadingSegment(path) {
+  var rest = path.charAt(0) === "/" ? path.slice(1) : path;
+  if (!rest.length) return null;
+  var slash = rest.indexOf("/");
+  var seg = slash === -1 ? rest : rest.slice(0, slash);
+  if (!seg.length || seg.length > 35 || !_HREFLANG_TAG_RE.test(seg)) return null;
+  return seg;
+}
+
+function _hreflangStripLeadingSubdomain(host) {
+  if (host.indexOf(".") === -1) return null;
+  var first = host.slice(0, host.indexOf("."));
+  if (!first.length || first.length > 35 || !_HREFLANG_TAG_RE.test(first)) return null;
+  return first;
+}
+
+function _canonicalForLocaleUrl(host, path, locale, strategy) {
+  var lc = String(locale).toLowerCase();
+  if (strategy === "url_prefix") {
+    var prefix = _hreflangStripLeadingSegment(path);
+    var rest;
+    if (prefix) {
+      rest = path.slice(1 + prefix.length);
+      if (rest.length === 0) rest = "/";
+    } else {
+      rest = path;
+    }
+    if (rest.charAt(0) !== "/") rest = "/" + rest;
+    return "https://" + host + "/" + lc + (rest === "/" ? "" : rest);
+  }
+  if (strategy === "subdomain") {
+    var sub = _hreflangStripLeadingSubdomain(host);
+    var apex = sub ? host.slice(sub.length + 1) : host;
+    return "https://" + lc + "." + apex + path;
+  }
+  return null;
+}
+
 function renderProduct(opts) {
   if (!opts || !opts.product) throw new TypeError("storefront.renderProduct: opts.product required");
   var variants = opts.variants || [];
@@ -5689,9 +5939,18 @@ function renderProduct(opts) {
   var preorderShape = opts.preorder_campaign
     ? preorderCtaShape(opts.preorder_campaign.campaign, { remaining_units: opts.preorder_campaign.remaining_units }, fmt, opts.product.slug)
     : null;
+  // Multi-variant headline price — "From <lowest>" so the buy box never
+  // advertises a price that isn't the cheapest buyable variant (variants[0]
+  // may not be the cheapest). The minimum is computed over the integer
+  // amount_minor map and formatted ONCE via the page's own `fmt` (never by
+  // comparing formatted strings — "$9.99" < "$10.00" sorts wrong as text).
+  // Single-variant, no-price, and all-equal-price products keep the lead
+  // variant's exact price string ("From X" when there's only one X is
+  // noise). Kept byte-identical to worker/render/product.js. See UX-5.
+  var headlinePrice = _buildHeadlinePrice(rendered, variants, prices, fmt);
   var buyboxHtml = preorderShape
     ? _buildPreorderCta(preorderShape, b.template.escapeHtml)
-    : _buildBuyBox(rendered, b.template.escapeHtml, availability);
+    : _buildBuyBox(rendered, b.template.escapeHtml, availability, headlinePrice);
   // The reserve PRG lands the shopper back on the PDP with a fixed
   // ?preorder=<reserved|unavailable|closed> marker; the banner prepends the
   // buy box. The marker set is closed (built from a lookup, never the raw
@@ -5793,7 +6052,10 @@ function renderProduct(opts) {
       { "@type": "ListItem", "position": 2, "name": opts.product.title, "item": absoluteBase + "/products/" + opts.product.slug },
     ],
   });
-  jsonLd = (jsonLd || "") + breadcrumbJsonLd;
+  // QAPage JSON-LD from the published Q&A (empty string when no question is
+  // answered — Google rejects an answerless QAPage). Mirrors the edge.
+  var qaPageJsonLd = _buildQaPageJsonLd(opts.qa_questions);
+  jsonLd = (jsonLd || "") + breadcrumbJsonLd + qaPageJsonLd;
 
   return _wrap(Object.assign({
     title:          opts.product.title,
@@ -8300,7 +8562,9 @@ function renderOrderList(opts) {
 function _surveyQuestion(q) {
   var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
   var name = "q_" + esc(q.id);
-  var req  = q.required ? " <abbr class=\"survey-req\" title=\"Required\">*</abbr>" : "";
+  var req  = q.required
+    ? " <span class=\"survey-req\" aria-hidden=\"true\">*</span><span class=\"sr-only\">(required)</span>"
+    : "";
   var control = "";
   if (q.kind === "rating") {
     var lo = (q.max >= 9) ? 0 : 1; // 0..10 for NPS-scale, else 1..max
@@ -8630,6 +8894,14 @@ function mount(router, deps) {
   }
   _liveConsentPolicy();
 
+  // Header nav gating — the Collections / Categories links + their mobile-
+  // disclosure entries render only when the matching routes are mounted
+  // (deps wired). Module-scoped so `_buildPrimaryNav` (called from the
+  // module-level `_wrap`, which doesn't close over `deps`) can read them,
+  // matching the `_ccyEnabled` / `_activeConsentPolicy` pattern.
+  _hasCollections = !!deps.collections;
+  _hasCategoryNav = !!deps.categoryNavigation;
+
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");
@@ -8909,20 +9181,64 @@ function mount(router, deps) {
       "    </form>\n";
   }
 
+  // hreflang `<link rel="alternate">` block for a URL-shaped locale policy.
+  // The byte-identical twin of the edge's `chrome-i18n.js#alternateLinks` —
+  // an edge↔container parity test pins the two so they never drift. Returns
+  // "" for a non-URL strategy (cookie / accept-language / single-locale) or
+  // a malformed host/path, so most stores emit nothing. Synchronous so the
+  // locale middleware can seed it onto the ALS store within one tick (an
+  // `await` would scope the store to the awaited frame, not the request).
+  function _alternateLinksHtml(host, path) {
+    var strategy = localeOptions.strategy;
+    if (strategy !== "url_prefix" && strategy !== "subdomain") return "";
+    if (supportedTags.length < 2) return "";
+    if (typeof defaultLocale !== "string" || !_HREFLANG_TAG_RE.test(defaultLocale)) return "";
+    if (typeof host !== "string" || typeof path !== "string") return "";
+    var h = host.toLowerCase();
+    var colon = h.indexOf(":");
+    if (colon !== -1) h = h.slice(0, colon);
+    if (!h.length || h.length > 253 || !_HREFLANG_HOST_RE.test(h)) return "";
+    if (!path.length || path.length > 2048 || path.charAt(0) !== "/") return "";
+    if (/[\x00-\x1f\x7f]/.test(path)) return "";
+    var esc = b.template.escapeHtml;
+    var out = "";
+    for (var i = 0; i < supportedTags.length; i += 1) {
+      var tag = supportedTags[i];
+      if (typeof tag !== "string" || !_HREFLANG_TAG_RE.test(tag)) continue;
+      var href = _canonicalForLocaleUrl(h, path, tag, strategy);
+      if (href == null) continue;
+      out += "  <link rel=\"alternate\" hreflang=\"" + esc(tag) +
+        "\" href=\"" + esc(href) + "\">\n";
+    }
+    if (!out) return "";
+    var xDefault = _canonicalForLocaleUrl(h, path, defaultLocale, strategy);
+    if (xDefault != null) {
+      out += "  <link rel=\"alternate\" hreflang=\"x-default\" href=\"" +
+        esc(xDefault) + "\">\n";
+    }
+    return out;
+  }
+
   // The per-request locale context the layout reads via the async-local
   // store. Resolved SYNCHRONOUSLY so the middleware can seed the store
-  // within one tick. Shape: { locale, lang, dir, chrome, switcher_html }.
-  // Never throws — any failure falls back to the default locale.
+  // within one tick. Shape: { locale, lang, dir, chrome, switcher_html,
+  // alternate_links }. Never throws — any failure falls back to the
+  // default locale.
   function _localeCtx(req) {
     var locale = defaultLocale;
     try { locale = _resolveRequestLocale(req); } catch (_e) { locale = defaultLocale; }
     var chrome = _chromeFor(locale);
+    var hostHeader = (req.headers && (req.headers.host || req.headers.Host)) || "";
+    var reqPath = req.pathname || (String(req.url || "/").split("?")[0]) || "/";
+    var alternateLinks = "";
+    try { alternateLinks = _alternateLinksHtml(String(hostHeader), reqPath); } catch (_e) { alternateLinks = ""; }
     return {
-      locale:        locale,
-      lang:          locale,
-      dir:           _dirFor(locale),
-      chrome:        chrome,
-      switcher_html: _switcherHtml(req, locale, chrome),
+      locale:          locale,
+      lang:            locale,
+      dir:             _dirFor(locale),
+      chrome:          chrome,
+      switcher_html:   _switcherHtml(req, locale, chrome),
+      alternate_links: alternateLinks,
     };
   }
 
@@ -9902,8 +10218,19 @@ function mount(router, deps) {
     // id DESC) matches the prior `products.list` order.
     var decorated = await deps.catalog.batch.decoratedActive({ currency: "USD", limit: 24 });
     var products = decorated.rows;
+    // Featured-collections band data — active collections, newest-curated
+    // first (collections.list orders updated_at DESC, slug DESC; the band
+    // caps to 6). Best-effort: a band read failure degrades to no band, it
+    // never blocks the home page. The band itself drops when the list is
+    // empty, so an unwired collections dep also yields hero → catalog.
+    var collections = [];
+    if (deps.collections && typeof deps.collections.list === "function") {
+      try {
+        collections = await deps.collections.list({ active_only: true });
+      } catch (_e) { collections = []; }
+    }
     var ccy = await _currencyForReq(req);
-    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, _requestUrls(req), ccy));
+    var html = renderHome(Object.assign({ products: products, collections: collections, shop_name: shopName, theme: theme }, _requestUrls(req), ccy));
     _send(res, 200, html);
   });
 
@@ -15686,17 +16013,23 @@ function mount(router, deps) {
   // robots.txt — minimal crawl policy. Allow everything except
   // the admin API + cart + account + checkout / pay / orders (these
   // are session-scoped or operator-only, no crawl value), and
-  // point at the sitemap. Operators with stricter requirements
-  // replace the file at the same path via R2 (the Worker's
-  // static-asset bridge would serve it ahead of this route if a
+  // point at the sitemap. When the operator has defined per-bot rules
+  // via robotsConfig, those drive the body instead; absent any rules
+  // the hardcoded Disallow set is kept (robotsConfig's empty-table
+  // branch emits `Allow: /` only, which would silently drop the
+  // /admin disallow on a fresh deploy). Operators with stricter
+  // requirements also replace the file at the same path via R2 (the
+  // Worker's static-asset bridge serves it ahead of this route if a
   // `robots.txt` key exists in the bucket).
-  router.get("/robots.txt", function (req, res) {
+  router.get("/robots.txt", async function (req, res) {
     res.status(200);
     res.setHeader && res.setHeader("content-type", "text/plain; charset=utf-8");
     res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
     var hostHeader = req.headers && (req.headers.host || req.headers.Host) || "";
     var origin = hostHeader ? ("https://" + hostHeader) : "";
-    var body =
+    // The shipped fallback — the same Disallow set the edge robots.txt
+    // emits, kept as the fresh-deploy default.
+    var fallback =
       "User-agent: *\n" +
       "Allow: /\n" +
       "Disallow: /admin\n" +
@@ -15706,6 +16039,57 @@ function mount(router, deps) {
       "Disallow: /orders/\n" +
       "Disallow: /account\n" +
       (origin ? ("Sitemap: " + origin + "/sitemap.xml\n") : "");
+    var body = fallback;
+    // robotsConfig.render THROWS on a bad origin (no Host header) / bad
+    // state; the route must never let that reach the response. Only honor
+    // the operator's config when it actually carries rules — an empty
+    // robots_rules table renders `Allow: /` only, weaker than the
+    // hardcoded Disallow set. A read/render failure degrades to the
+    // shipped fallback (drop-to-default), never a 500.
+    if (deps.robotsConfig && origin) {
+      try {
+        var rules = await deps.robotsConfig.listRules({});
+        if (Array.isArray(rules) && rules.length > 0) {
+          body = await deps.robotsConfig.render({ origin_url: origin });
+        }
+      } catch (_e) { body = fallback; }
+    }
+    res.end ? res.end(body) : res.send(body);
+  });
+
+  // PWA web app manifest — served at /manifest.webmanifest (the
+  // `<link rel="manifest">` every layout carries). When the operator has an
+  // active pwaManifest row, its bytes serve; absent one (or on any read /
+  // render failure — renderManifestJson THROWS PWA_NO_ACTIVE_MANIFEST when
+  // no row is active) the shipped default serves (drop-to-default), so the
+  // manifest link never 404s. The default bytes are byte-identical to the
+  // edge's, so a cached edge read and a container read agree.
+  router.get("/manifest.webmanifest", async function (req, res) {
+    var body = PWA_DEFAULT_MANIFEST;
+    if (deps.pwaManifest && typeof deps.pwaManifest.renderManifestJson === "function") {
+      try { body = await deps.pwaManifest.renderManifestJson(); }
+      catch (_e) { body = PWA_DEFAULT_MANIFEST; }
+    }
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "application/manifest+json; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
+    res.end ? res.end(body) : res.send(body);
+  });
+
+  // PWA service worker — served at /sw.js. Same drop-to-default discipline
+  // as the manifest: the operator's active SW config serves when present,
+  // else the shipped pass-through default (renderServiceWorkerJs THROWS
+  // PWA_NO_ACTIVE_SW when none is active). Served same-origin under the
+  // strict `script-src 'self'` CSP, so no CSP change is needed.
+  router.get("/sw.js", async function (req, res) {
+    var body = PWA_DEFAULT_SW;
+    if (deps.pwaManifest && typeof deps.pwaManifest.renderServiceWorkerJs === "function") {
+      try { body = await deps.pwaManifest.renderServiceWorkerJs(); }
+      catch (_e) { body = PWA_DEFAULT_SW; }
+    }
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "text/javascript; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
     res.end ? res.end(body) : res.send(body);
   });
 
@@ -15729,17 +16113,29 @@ function mount(router, deps) {
     urls.push({ loc: origin + "/privacy", changefreq: "yearly",  priority: "0.3" });
     urls.push({ loc: origin + "/terms",   changefreq: "yearly",  priority: "0.3" });
     try {
-      var page = await deps.catalog.products.list({ status: "active", limit: 1000 });
-      for (var i = 0; i < page.rows.length; i += 1) {
-        var p = page.rows[i];
-        var lastmod = new Date(p.updated_at || p.created_at || Date.now()).toISOString().slice(0, 10);
-        urls.push({
-          loc:        origin + "/products/" + p.slug,
-          lastmod:    lastmod,
-          changefreq: "weekly",
-          priority:   "0.8",
-        });
-      }
+      // Page through the catalog via the cursor — `products.list` caps a
+      // single page at the catalog's MAX_LIMIT (200), so a single
+      // `limit: 1000` call would throw and silently drop EVERY product from
+      // the sitemap. Walk pages until exhausted or the sitemap's per-file
+      // 50k-URL ceiling, matching the edge sitemap's 50k cap.
+      var SITEMAP_PRODUCT_CAP = 50000;
+      var productCursor = null;
+      var productCount = 0;
+      do {
+        var page = await deps.catalog.products.list({ status: "active", limit: 200, cursor: productCursor });
+        for (var i = 0; i < page.rows.length && productCount < SITEMAP_PRODUCT_CAP; i += 1) {
+          var p = page.rows[i];
+          var lastmod = new Date(p.updated_at || p.created_at || Date.now()).toISOString().slice(0, 10);
+          urls.push({
+            loc:        origin + "/products/" + p.slug,
+            lastmod:    lastmod,
+            changefreq: "weekly",
+            priority:   "0.8",
+          });
+          productCount += 1;
+        }
+        productCursor = page.next_cursor;
+      } while (productCursor && productCount < SITEMAP_PRODUCT_CAP);
     } catch (_e) { /* drop-silent — catalog unreachable means sitemap drops product rows */ }
     // Active category browse pages, when the categoryNavigation primitive
     // is wired. `tree({})` returns the full nested active tree (archived
@@ -15773,6 +16169,22 @@ function mount(router, deps) {
         }
       } catch (_e) { /* drop-silent — collections unreachable drops those rows */ }
     }
+    // Published CMS pages (/pages/<slug>), when the storefrontPages
+    // primitive is wired. `monthly` / 0.5 — operator content changes less
+    // often than the catalog; the edge sitemap emits the same values.
+    // Best-effort: a read failure drops the page rows rather than 500-ing.
+    if (deps.storefrontPages && typeof deps.storefrontPages.listPublished === "function") {
+      try {
+        var cmsPages = await deps.storefrontPages.listPublished();
+        for (var pgi = 0; pgi < cmsPages.length; pgi += 1) {
+          var pg = cmsPages[pgi];
+          if (pg && pg.slug) {
+            var pgLast = new Date(pg.updated_at || pg.created_at || Date.now()).toISOString().slice(0, 10);
+            urls.push({ loc: origin + "/pages/" + pg.slug, lastmod: pgLast, changefreq: "monthly", priority: "0.5" });
+          }
+        }
+      } catch (_e) { /* drop-silent — CMS pages unreachable drops those rows */ }
+    }
     var body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
                "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n";
     for (var u = 0; u < urls.length; u += 1) {
@@ -15847,6 +16259,7 @@ module.exports = {
   renderProfile:         renderProfile,
   renderAccountSubscriptions: renderAccountSubscriptions,
   renderCookiePreferences: renderCookiePreferences,
+  renderSurveyPage:      renderSurveyPage,
   renderNewsletterError: renderNewsletterError,
   renderNotFound:        renderNotFound,
   // Layout exposed so operators forking the framework can override.

package/lib/translations.js

@@ -571,8 +571,12 @@ var CHROME_DEFAULTS = Object.freeze({
   search_submit:      "Search",
 
   nav_shop:           "Shop",
+  nav_collections:    "Collections",
+  nav_categories:     "Categories",
   nav_framework:      "Framework",
   nav_account:        "Account",
+  // The narrow-viewport disclosure's <summary> label.
+  nav_menu:           "Menu",
   // The cart aria-label carries the live item count; `{count}` is
   // interpolated by b.i18n at render time.
   nav_cart_aria:      "Cart, {count} items",
@@ -589,8 +593,6 @@ var CHROME_DEFAULTS = Object.freeze({
   footer_shop_all:        "All products",
   footer_shop_collections: "Collections",
   footer_shop_categories: "Categories",
-  footer_shop_new:        "New arrivals",
-  footer_shop_sale:       "On sale",
   footer_shop_compare:    "Compare",
   footer_shop_cart:       "Cart",
   footer_shop_shipping:   "Shipping & returns",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.48",
+  "version": "0.3.50",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {