@blamejs/blamejs-shop 0.3.49 → 0.3.50

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.50 (2026-06-02) — **Installable PWA manifest, hreflang for multilingual stores, complete sitemap and robots coverage, localized edge pages, and product Q&A rich results.** Several search-engine and internationalization signals were missing or inconsistent between the cached (edge) and dynamically rendered pages. This release serves an installable web-app manifest and a service worker, emits hreflang alternates when a store runs path- or subdomain-based locales, localizes the blog, CMS, and policy pages on the cached path (they were always English), brings the robots.txt and sitemap into agreement across both render paths with collections, categories, and CMS pages now included, and emits Q&A structured data on product pages. It also fixes a bug that dropped every product from the dynamically rendered sitemap. **Added:** *Installable web-app manifest and service worker* — The store now serves a web-app manifest at /manifest.webmanifest and a service worker at /sw.js, and links the manifest from every page, so the storefront can be installed as a progressive web app. A working default is served out of the box; an operator who configures a custom manifest overrides it. · *hreflang alternates for multilingual stores* — When a store runs locales via URL prefixes (e.g. /de/) or subdomains, each page now emits rel=alternate hreflang links (plus x-default) so search engines map the equivalent localized URLs instead of treating them as duplicate content. Stores on a single locale, or locale-by-cookie, emit none. · *Product Q&A rich results* — A product page with answered customer questions now emits QAPage structured data so the questions and answers are eligible for rich results in search. **Fixed:** *Localized blog, CMS, and policy pages on the cached path* — The cached (edge-rendered) blog articles, CMS pages, and privacy/terms pages now carry the correct document language and direction for the active locale, matching the dynamically rendered pages. Previously they were always marked English and left-to-right, which harmed screen readers and search indexing and broke right-to-left layout. · *Consistent robots.txt and complete sitemap* — robots.txt now disallows the admin, cart, checkout, order, and account paths consistently on both render paths, and the sitemap now includes collection, category, and CMS-page URLs alongside products and blog posts. A bug that made the dynamically rendered sitemap omit every product (a list limit overflow) is fixed so the full catalog is listed.
+
 - v0.3.49 (2026-06-02) — **Real collection tiles on the home page, a working mobile nav, Collections/Categories in the header, and From-price on multi-variant products.** The home page's 'Featured collections' band linked to fixed keyword searches that landed on empty results unless a product happened to contain those words, the header navigation disappeared entirely on phones with no menu to replace it, and the two real catalog-browse surfaces (Collections and Categories) were reachable only from the footer. This release resolves those: the home tiles now render the store's actual collections with real links, the header gains a no-JavaScript mobile menu, and Collections and Categories appear in the primary nav. Multi-variant products now show a 'From <lowest price>' headline instead of always showing the first variant's price, the non-functional 'New arrivals'/'On sale' sort links are removed, and two small accessibility fixes land (the survey required-field marker and a dark color-scheme hint for native form controls). **Changed:** *Home 'Featured collections' tiles render real collections* — The featured-collections band on the home page now lists the store's actual collections with links to each collection page, instead of fixed keyword searches that could land on an empty results page. If no collections are defined, the band is omitted rather than shown empty. Both the cached and dynamically rendered home pages produce identical markup. · *Mobile navigation menu (no JavaScript required)* — On narrow screens the header now offers a disclosure menu that reveals the navigation links, which previously vanished entirely below a tablet width. It is a pure-CSS menu, so it works with JavaScript disabled. · *Collections and Categories in the header navigation* — The two catalog-browse surfaces — Collections and Categories — are now in the primary header navigation (and inside the mobile menu), not only in the footer. · *Multi-variant products show a 'From' price* — A product whose variants differ in price now shows a 'From <lowest price>' headline so the prominent price is no longer misleading when a shopper selects a different variant; each variant chip still shows its own exact price. · *Removed non-functional sort links* — The 'New arrivals' and 'On sale' links did nothing — the home page does not yet support sorting — so they have been removed rather than left as dead controls. They will return if and when catalog sorting is added. · *Accessibility: survey required marker and dark color-scheme* — The survey form's required-field marker is now announced correctly to screen readers, and the theme declares a dark color-scheme so native form controls, scrollbars, and autofill render correctly on the dark surface.
 
 - v0.3.48 (2026-06-02) — **Customers can export or request deletion of their personal data, and the admin console gets a privacy-request queue to fulfil it.** The framework had a complete data-subject-request engine but nothing reached it, so a store handling EU/California personal data had no way for a shopper to exercise their right of access or erasure and no operator path to fulfil one. A signed-in customer can now request a full export of their data — account, addresses, orders, subscriptions, loyalty, and support history, streamed as a downloadable JSON bundle — and can file a deletion request. The admin console gets a Privacy requests screen where an operator reviews each request, downloads the export, previews a deletion (a dry run that changes nothing), and then executes it. Erasure anonymizes the customer's account and archives their addresses and subscriptions while retaining orders, loyalty ledger, and support tickets that must be kept for tax and legal records. A customer can only ever see or act on their own requests; deletion is always filed by the customer and carried out by an operator. **Added:** *Customer data export and deletion requests* — A signed-in customer gets a Privacy & data area under their account where they can request a full export of their personal data and file a deletion request. The export is streamed as a downloadable JSON bundle covering their account, addresses, orders, subscriptions, loyalty balance and ledger, and support history. A customer can only access their own requests and downloads; a request belonging to anyone else returns not-found. · *Privacy-request queue in the admin console* — A new Privacy requests screen lists every data-subject request with its status. An operator can download a request's export, preview a deletion as a dry run that reports what would change without modifying anything, and then execute the deletion behind a confirmation step. Deletion anonymizes the customer's account and archives their addresses and subscriptions, while orders, the loyalty ledger, and support tickets are retained for tax and legal record-keeping. Every customer- and operator-entered field shown in either console is HTML-escaped.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.49",
+  "version": "0.3.50",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",

package/lib/locale-router.js

@@ -1042,11 +1042,50 @@ function create(opts) {
     return out;
   }
 
+  // Build the hreflang alternate set for `path` on `host` under the
+  // active policy. Returns
+  //   { default_locale, x_default_url, alternates: [{ tag, href }, …] }
+  // when an active `url_prefix` / `subdomain` policy exists — one entry per
+  // supported locale, each `href` the `_canonicalForUrl` for that tag, plus
+  // the `x_default_url` for the default locale. Returns null for a non-URL
+  // strategy (cookie / accept-language), a single-locale policy, no active
+  // policy, or a malformed host/path. Request-shape reader: never throws on
+  // bad input (a hostile Host header must not 500 a page render) — it
+  // returns null so callers emit no hreflang.
+  async function alternateUrls(host, path) {
+    var h, p;
+    try { h = _host(host, "host"); } catch (_e) { return null; }
+    try { p = _path(path, "path"); } catch (_e) { return null; }
+    var policy;
+    try { policy = await activePolicy(); } catch (_e) { return null; }
+    if (!policy) return null;
+    var strategy = policy.strategy;
+    if (strategy !== "url_prefix" && strategy !== "subdomain") return null;
+    var supported = policy.supported_locales;
+    if (!Array.isArray(supported) || supported.length < 2) return null;
+    var defaultLocale = policy.default_locale;
+    var alternates = [];
+    for (var i = 0; i < supported.length; i += 1) {
+      var tag  = supported[i];
+      var href = _canonicalForUrl(h, p, tag, strategy);
+      if (href === undefined) continue;
+      alternates.push({ tag: tag, href: href });
+    }
+    if (!alternates.length) return null;
+    var xDefault = _canonicalForUrl(h, p, defaultLocale, strategy);
+    return {
+      default_locale: defaultLocale,
+      x_default_url:  xDefault === undefined ? null : xDefault,
+      alternates:     alternates,
+    };
+  }
+
   return {
     KINDS:               KINDS.slice(),
     STRATEGIES:          STRATEGIES.slice(),
     LOCALE_RE:           LOCALE_RE,
     CURRENCY_RE:         CURRENCY_RE,
+    alternateUrls:       alternateUrls,
     defineLocale:        defineLocale,
     getLocale:           getLocale,
     listLocales:         listLocales,

package/lib/storefront.js

@@ -267,9 +267,11 @@ var LAYOUT =
   "  <meta name=\"description\" content=\"{{og_description}}\">\n" +
   "  <link rel=\"canonical\" href=\"{{canonical_url}}\">\n" +
   "RAW_ROBOTS_META" +
+  "RAW_HREFLANG" +
   "  <link rel=\"icon\" type=\"image/svg+xml\" href=\"/assets/brand/favicon.svg\">\n" +
   "  <link rel=\"icon\" type=\"image/png\" href=\"/assets/brand/favicon.png\">\n" +
   "  <link rel=\"apple-touch-icon\" href=\"/assets/brand/favicon.png\">\n" +
+  "  <link rel=\"manifest\" href=\"/manifest.webmanifest\">\n" +
   "  <meta name=\"theme-color\" content=\"#08080a\">\n" +
   "  <link rel=\"stylesheet\" href=\"{{theme_css}}\"RAW_CSS_INTEGRITY>\n" +
   "  <meta property=\"og:type\" content=\"{{og_type}}\">\n" +
@@ -854,9 +856,20 @@ function _wrap(opts) {
       ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
       : "";
 
+  // hreflang alternates — pre-rendered HTML seeded onto the locale ALS
+  // store by `localeMiddleware` (kept synchronous so it reaches the
+  // handler), or threaded explicitly by a renderer/unit test. Empty for a
+  // single-locale store or a cookie/accept-language strategy (no URL-shaped
+  // alternates to emit). Byte-identical to the edge's `alternateLinks`
+  // output for the same (host, path, supported, default, strategy) — a
+  // parity test pins the two.
+  var hreflangHtml = (typeof opts.alternate_links === "string")
+    ? opts.alternate_links
+    : ((storeCtx && typeof storeCtx.alternate_links === "string") ? storeCtx.alternate_links : "");
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_ROBOTS_META", robotsMeta)
+    .replace("RAW_HREFLANG", hreflangHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
@@ -5713,6 +5726,143 @@ function _jsonLdScript(data) {
   return "<script type=\"application/ld+json\">" + serialised + "</script>";
 }
 
+// PWA default manifest + service worker — the shipped fallback served at
+// /manifest.webmanifest + /sw.js when the operator has not defined an
+// active pwaManifest row. BOTH substrates serve these exact bytes (the
+// edge has no DB-backed primitive; the container's DB-backed pwaManifest is
+// the override), so the `<link rel="manifest">` in every layout never 404s
+// on a fresh deploy. The byte-identical twin of
+// worker/render/_lib.js's PWA_DEFAULT_MANIFEST / PWA_DEFAULT_SW — a parity
+// test pins them. An operator customizes via pwaManifest.defineManifest +
+// setActive on the container path.
+var _PWA_DEFAULT_MANIFEST_OBJ = {
+  name:             "blamejs.shop",
+  short_name:       "blamejs.shop",
+  description:      "Open-source ecommerce framework built on blamejs — server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.",
+  start_url:        "/",
+  scope:            "/",
+  display:          "standalone",
+  orientation:      "portrait",
+  theme_color:      "#08080a",
+  background_color: "#08080a",
+  lang:             "en",
+  dir:              "ltr",
+  icons: [
+    { src: "/assets/brand/favicon.png", sizes: "192x192", type: "image/png", purpose: "any" },
+    { src: "/assets/brand/favicon.png", sizes: "512x512", type: "image/png", purpose: "any maskable" },
+    { src: "/assets/brand/favicon.svg", sizes: "any",     type: "image/svg+xml", purpose: "any" }
+  ]
+};
+var PWA_DEFAULT_MANIFEST = JSON.stringify(_PWA_DEFAULT_MANIFEST_OBJ, null, 2);
+
+var PWA_DEFAULT_SW =
+  "// service worker — shipped default (pass-through navigation fallback)\n" +
+  "\"use strict\";\n" +
+  "var CACHE_NAME = \"blamejs-shop-default-v1\";\n" +
+  "self.addEventListener(\"install\", function (e) { self.skipWaiting(); });\n" +
+  "self.addEventListener(\"activate\", function (e) {\n" +
+  "  e.waitUntil(caches.keys().then(function (keys) {\n" +
+  "    return Promise.all(keys.map(function (k) { if (k !== CACHE_NAME) return caches.delete(k); }));\n" +
+  "  }).then(function () { return self.clients.claim(); }));\n" +
+  "});\n" +
+  "self.addEventListener(\"fetch\", function (e) {\n" +
+  "  if (e.request.method !== \"GET\") return;\n" +
+  "  if (e.request.mode === \"navigate\") {\n" +
+  "    e.respondWith(fetch(e.request).catch(function () { return caches.match(\"/\"); }));\n" +
+  "  }\n" +
+  "});\n";
+
+// QAPage JSON-LD from the PDP's published Q&A threads. Surfaces the
+// question + its answers in Google's Q&A rich result. Emitted only when at
+// least one question has at least one answer — Google rejects a QAPage
+// whose Question carries neither an `acceptedAnswer` nor a
+// `suggestedAnswer`. The first answer is the `acceptedAnswer`; the rest are
+// `suggestedAnswer`. `q.body` / `a.body` are operator/customer free text —
+// `_jsonLdScript` JSON.stringify's them (neutralizing quotes + the
+// `</script` breakout), so they are NOT additionally HTML-escaped (JSON-LD
+// is not HTML, by the documented `_jsonLdScript` contract — the same trust
+// model as the Product JSON-LD `description`). The byte-identical twin of
+// the edge's `worker/render/product.js#_buildQaPageJsonLd`; a parity test
+// pins the two. Returns "" when there is nothing rich-result-eligible.
+function _buildQaPageJsonLd(questions) {
+  questions = questions || [];
+  var mainEntity = [];
+  for (var i = 0; i < questions.length; i += 1) {
+    var q = questions[i];
+    var answers = (q && q.answers) || [];
+    if (answers.length === 0) continue;
+    var question = {
+      "@type":       "Question",
+      "name":        String(q.body),
+      "answerCount": answers.length,
+      "acceptedAnswer": { "@type": "Answer", "text": String(answers[0].body) },
+    };
+    if (answers.length > 1) {
+      var suggested = [];
+      for (var j = 1; j < answers.length; j += 1) {
+        suggested.push({ "@type": "Answer", "text": String(answers[j].body) });
+      }
+      question.suggestedAnswer = suggested;
+    }
+    mainEntity.push(question);
+  }
+  if (mainEntity.length === 0) return "";
+  return _jsonLdScript({
+    "@context":   "https://schema.org",
+    "@type":      "QAPage",
+    "mainEntity": mainEntity,
+  });
+}
+
+// ---- hreflang alternates (URL-shaped locale policies) ------------------
+//
+// The href math + validation envelopes below are the byte-identical twin
+// of worker/render/chrome-i18n.js's `alternateLinks` so the edge + the
+// container emit the same `<link rel="alternate" hreflang>` block for the
+// same (host, path, supported, default, strategy). A parity test pins the
+// two. Both mirror lib/locale-router.js#_canonicalForUrl's prefix /
+// subdomain substitution.
+var _HREFLANG_TAG_RE  = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+var _HREFLANG_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+
+function _hreflangStripLeadingSegment(path) {
+  var rest = path.charAt(0) === "/" ? path.slice(1) : path;
+  if (!rest.length) return null;
+  var slash = rest.indexOf("/");
+  var seg = slash === -1 ? rest : rest.slice(0, slash);
+  if (!seg.length || seg.length > 35 || !_HREFLANG_TAG_RE.test(seg)) return null;
+  return seg;
+}
+
+function _hreflangStripLeadingSubdomain(host) {
+  if (host.indexOf(".") === -1) return null;
+  var first = host.slice(0, host.indexOf("."));
+  if (!first.length || first.length > 35 || !_HREFLANG_TAG_RE.test(first)) return null;
+  return first;
+}
+
+function _canonicalForLocaleUrl(host, path, locale, strategy) {
+  var lc = String(locale).toLowerCase();
+  if (strategy === "url_prefix") {
+    var prefix = _hreflangStripLeadingSegment(path);
+    var rest;
+    if (prefix) {
+      rest = path.slice(1 + prefix.length);
+      if (rest.length === 0) rest = "/";
+    } else {
+      rest = path;
+    }
+    if (rest.charAt(0) !== "/") rest = "/" + rest;
+    return "https://" + host + "/" + lc + (rest === "/" ? "" : rest);
+  }
+  if (strategy === "subdomain") {
+    var sub = _hreflangStripLeadingSubdomain(host);
+    var apex = sub ? host.slice(sub.length + 1) : host;
+    return "https://" + lc + "." + apex + path;
+  }
+  return null;
+}
+
 function renderProduct(opts) {
   if (!opts || !opts.product) throw new TypeError("storefront.renderProduct: opts.product required");
   var variants = opts.variants || [];
@@ -5902,7 +6052,10 @@ function renderProduct(opts) {
       { "@type": "ListItem", "position": 2, "name": opts.product.title, "item": absoluteBase + "/products/" + opts.product.slug },
     ],
   });
-  jsonLd = (jsonLd || "") + breadcrumbJsonLd;
+  // QAPage JSON-LD from the published Q&A (empty string when no question is
+  // answered — Google rejects an answerless QAPage). Mirrors the edge.
+  var qaPageJsonLd = _buildQaPageJsonLd(opts.qa_questions);
+  jsonLd = (jsonLd || "") + breadcrumbJsonLd + qaPageJsonLd;
 
   return _wrap(Object.assign({
     title:          opts.product.title,
@@ -9028,20 +9181,64 @@ function mount(router, deps) {
       "    </form>\n";
   }
 
+  // hreflang `<link rel="alternate">` block for a URL-shaped locale policy.
+  // The byte-identical twin of the edge's `chrome-i18n.js#alternateLinks` —
+  // an edge↔container parity test pins the two so they never drift. Returns
+  // "" for a non-URL strategy (cookie / accept-language / single-locale) or
+  // a malformed host/path, so most stores emit nothing. Synchronous so the
+  // locale middleware can seed it onto the ALS store within one tick (an
+  // `await` would scope the store to the awaited frame, not the request).
+  function _alternateLinksHtml(host, path) {
+    var strategy = localeOptions.strategy;
+    if (strategy !== "url_prefix" && strategy !== "subdomain") return "";
+    if (supportedTags.length < 2) return "";
+    if (typeof defaultLocale !== "string" || !_HREFLANG_TAG_RE.test(defaultLocale)) return "";
+    if (typeof host !== "string" || typeof path !== "string") return "";
+    var h = host.toLowerCase();
+    var colon = h.indexOf(":");
+    if (colon !== -1) h = h.slice(0, colon);
+    if (!h.length || h.length > 253 || !_HREFLANG_HOST_RE.test(h)) return "";
+    if (!path.length || path.length > 2048 || path.charAt(0) !== "/") return "";
+    if (/[\x00-\x1f\x7f]/.test(path)) return "";
+    var esc = b.template.escapeHtml;
+    var out = "";
+    for (var i = 0; i < supportedTags.length; i += 1) {
+      var tag = supportedTags[i];
+      if (typeof tag !== "string" || !_HREFLANG_TAG_RE.test(tag)) continue;
+      var href = _canonicalForLocaleUrl(h, path, tag, strategy);
+      if (href == null) continue;
+      out += "  <link rel=\"alternate\" hreflang=\"" + esc(tag) +
+        "\" href=\"" + esc(href) + "\">\n";
+    }
+    if (!out) return "";
+    var xDefault = _canonicalForLocaleUrl(h, path, defaultLocale, strategy);
+    if (xDefault != null) {
+      out += "  <link rel=\"alternate\" hreflang=\"x-default\" href=\"" +
+        esc(xDefault) + "\">\n";
+    }
+    return out;
+  }
+
   // The per-request locale context the layout reads via the async-local
   // store. Resolved SYNCHRONOUSLY so the middleware can seed the store
-  // within one tick. Shape: { locale, lang, dir, chrome, switcher_html }.
-  // Never throws — any failure falls back to the default locale.
+  // within one tick. Shape: { locale, lang, dir, chrome, switcher_html,
+  // alternate_links }. Never throws — any failure falls back to the
+  // default locale.
   function _localeCtx(req) {
     var locale = defaultLocale;
     try { locale = _resolveRequestLocale(req); } catch (_e) { locale = defaultLocale; }
     var chrome = _chromeFor(locale);
+    var hostHeader = (req.headers && (req.headers.host || req.headers.Host)) || "";
+    var reqPath = req.pathname || (String(req.url || "/").split("?")[0]) || "/";
+    var alternateLinks = "";
+    try { alternateLinks = _alternateLinksHtml(String(hostHeader), reqPath); } catch (_e) { alternateLinks = ""; }
     return {
-      locale:        locale,
-      lang:          locale,
-      dir:           _dirFor(locale),
-      chrome:        chrome,
-      switcher_html: _switcherHtml(req, locale, chrome),
+      locale:          locale,
+      lang:            locale,
+      dir:             _dirFor(locale),
+      chrome:          chrome,
+      switcher_html:   _switcherHtml(req, locale, chrome),
+      alternate_links: alternateLinks,
     };
   }
 
@@ -15816,17 +16013,23 @@ function mount(router, deps) {
   // robots.txt — minimal crawl policy. Allow everything except
   // the admin API + cart + account + checkout / pay / orders (these
   // are session-scoped or operator-only, no crawl value), and
-  // point at the sitemap. Operators with stricter requirements
-  // replace the file at the same path via R2 (the Worker's
-  // static-asset bridge would serve it ahead of this route if a
+  // point at the sitemap. When the operator has defined per-bot rules
+  // via robotsConfig, those drive the body instead; absent any rules
+  // the hardcoded Disallow set is kept (robotsConfig's empty-table
+  // branch emits `Allow: /` only, which would silently drop the
+  // /admin disallow on a fresh deploy). Operators with stricter
+  // requirements also replace the file at the same path via R2 (the
+  // Worker's static-asset bridge serves it ahead of this route if a
   // `robots.txt` key exists in the bucket).
-  router.get("/robots.txt", function (req, res) {
+  router.get("/robots.txt", async function (req, res) {
     res.status(200);
     res.setHeader && res.setHeader("content-type", "text/plain; charset=utf-8");
     res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
     var hostHeader = req.headers && (req.headers.host || req.headers.Host) || "";
     var origin = hostHeader ? ("https://" + hostHeader) : "";
-    var body =
+    // The shipped fallback — the same Disallow set the edge robots.txt
+    // emits, kept as the fresh-deploy default.
+    var fallback =
       "User-agent: *\n" +
       "Allow: /\n" +
       "Disallow: /admin\n" +
@@ -15836,6 +16039,57 @@ function mount(router, deps) {
       "Disallow: /orders/\n" +
       "Disallow: /account\n" +
       (origin ? ("Sitemap: " + origin + "/sitemap.xml\n") : "");
+    var body = fallback;
+    // robotsConfig.render THROWS on a bad origin (no Host header) / bad
+    // state; the route must never let that reach the response. Only honor
+    // the operator's config when it actually carries rules — an empty
+    // robots_rules table renders `Allow: /` only, weaker than the
+    // hardcoded Disallow set. A read/render failure degrades to the
+    // shipped fallback (drop-to-default), never a 500.
+    if (deps.robotsConfig && origin) {
+      try {
+        var rules = await deps.robotsConfig.listRules({});
+        if (Array.isArray(rules) && rules.length > 0) {
+          body = await deps.robotsConfig.render({ origin_url: origin });
+        }
+      } catch (_e) { body = fallback; }
+    }
+    res.end ? res.end(body) : res.send(body);
+  });
+
+  // PWA web app manifest — served at /manifest.webmanifest (the
+  // `<link rel="manifest">` every layout carries). When the operator has an
+  // active pwaManifest row, its bytes serve; absent one (or on any read /
+  // render failure — renderManifestJson THROWS PWA_NO_ACTIVE_MANIFEST when
+  // no row is active) the shipped default serves (drop-to-default), so the
+  // manifest link never 404s. The default bytes are byte-identical to the
+  // edge's, so a cached edge read and a container read agree.
+  router.get("/manifest.webmanifest", async function (req, res) {
+    var body = PWA_DEFAULT_MANIFEST;
+    if (deps.pwaManifest && typeof deps.pwaManifest.renderManifestJson === "function") {
+      try { body = await deps.pwaManifest.renderManifestJson(); }
+      catch (_e) { body = PWA_DEFAULT_MANIFEST; }
+    }
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "application/manifest+json; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
+    res.end ? res.end(body) : res.send(body);
+  });
+
+  // PWA service worker — served at /sw.js. Same drop-to-default discipline
+  // as the manifest: the operator's active SW config serves when present,
+  // else the shipped pass-through default (renderServiceWorkerJs THROWS
+  // PWA_NO_ACTIVE_SW when none is active). Served same-origin under the
+  // strict `script-src 'self'` CSP, so no CSP change is needed.
+  router.get("/sw.js", async function (req, res) {
+    var body = PWA_DEFAULT_SW;
+    if (deps.pwaManifest && typeof deps.pwaManifest.renderServiceWorkerJs === "function") {
+      try { body = await deps.pwaManifest.renderServiceWorkerJs(); }
+      catch (_e) { body = PWA_DEFAULT_SW; }
+    }
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "text/javascript; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "public, max-age=3600");
     res.end ? res.end(body) : res.send(body);
   });
 
@@ -15859,17 +16113,29 @@ function mount(router, deps) {
     urls.push({ loc: origin + "/privacy", changefreq: "yearly",  priority: "0.3" });
     urls.push({ loc: origin + "/terms",   changefreq: "yearly",  priority: "0.3" });
     try {
-      var page = await deps.catalog.products.list({ status: "active", limit: 1000 });
-      for (var i = 0; i < page.rows.length; i += 1) {
-        var p = page.rows[i];
-        var lastmod = new Date(p.updated_at || p.created_at || Date.now()).toISOString().slice(0, 10);
-        urls.push({
-          loc:        origin + "/products/" + p.slug,
-          lastmod:    lastmod,
-          changefreq: "weekly",
-          priority:   "0.8",
-        });
-      }
+      // Page through the catalog via the cursor — `products.list` caps a
+      // single page at the catalog's MAX_LIMIT (200), so a single
+      // `limit: 1000` call would throw and silently drop EVERY product from
+      // the sitemap. Walk pages until exhausted or the sitemap's per-file
+      // 50k-URL ceiling, matching the edge sitemap's 50k cap.
+      var SITEMAP_PRODUCT_CAP = 50000;
+      var productCursor = null;
+      var productCount = 0;
+      do {
+        var page = await deps.catalog.products.list({ status: "active", limit: 200, cursor: productCursor });
+        for (var i = 0; i < page.rows.length && productCount < SITEMAP_PRODUCT_CAP; i += 1) {
+          var p = page.rows[i];
+          var lastmod = new Date(p.updated_at || p.created_at || Date.now()).toISOString().slice(0, 10);
+          urls.push({
+            loc:        origin + "/products/" + p.slug,
+            lastmod:    lastmod,
+            changefreq: "weekly",
+            priority:   "0.8",
+          });
+          productCount += 1;
+        }
+        productCursor = page.next_cursor;
+      } while (productCursor && productCount < SITEMAP_PRODUCT_CAP);
     } catch (_e) { /* drop-silent — catalog unreachable means sitemap drops product rows */ }
     // Active category browse pages, when the categoryNavigation primitive
     // is wired. `tree({})` returns the full nested active tree (archived
@@ -15903,6 +16169,22 @@ function mount(router, deps) {
         }
       } catch (_e) { /* drop-silent — collections unreachable drops those rows */ }
     }
+    // Published CMS pages (/pages/<slug>), when the storefrontPages
+    // primitive is wired. `monthly` / 0.5 — operator content changes less
+    // often than the catalog; the edge sitemap emits the same values.
+    // Best-effort: a read failure drops the page rows rather than 500-ing.
+    if (deps.storefrontPages && typeof deps.storefrontPages.listPublished === "function") {
+      try {
+        var cmsPages = await deps.storefrontPages.listPublished();
+        for (var pgi = 0; pgi < cmsPages.length; pgi += 1) {
+          var pg = cmsPages[pgi];
+          if (pg && pg.slug) {
+            var pgLast = new Date(pg.updated_at || pg.created_at || Date.now()).toISOString().slice(0, 10);
+            urls.push({ loc: origin + "/pages/" + pg.slug, lastmod: pgLast, changefreq: "monthly", priority: "0.5" });
+          }
+        }
+      } catch (_e) { /* drop-silent — CMS pages unreachable drops those rows */ }
+    }
     var body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
                "<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n";
     for (var u = 0; u < urls.length; u += 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.49",
+  "version": "0.3.50",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {