@blamejs/blamejs-shop 0.3.50 → 0.3.51

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.51 (2026-06-02) — **Payment scripts load under the strict CSP, an optional CAPTCHA gate guards signup and checkout, HSTS is preload-strength, and order actions are rate-limited.** The strict content-security-policy blocked the Stripe and PayPal scripts on the payment pages, so checkout would have failed even once payment keys were configured. Those pages now load the processor scripts through a route-scoped policy and same-origin script files, without relaxing the site-wide policy anywhere else. A CAPTCHA challenge can now be required on signup and checkout (and optionally login) once an operator configures a provider; it stays off until then. The edge now sends a two-year HSTS max-age so the domain qualifies for the preload list, and the order cancel, rate, and reorder actions are covered by the tighter per-route rate limit. **Added:** *Optional CAPTCHA gate on signup, checkout, and login* — When an operator configures a CAPTCHA provider (Cloudflare Turnstile, hCaptcha, or reCAPTCHA), a challenge is required on signup and checkout, with login behind an opt-in flag since passkey sign-in is already phishing-resistant. The token is verified server-side before the action proceeds. With no provider configured the gate is a no-op and every flow behaves exactly as before. **Changed:** *Preload-strength HSTS at the edge* — The edge now sends an HSTS max-age of two years (with includeSubDomains and preload), matching the container and meeting the one-year minimum required for HSTS preload-list inclusion. **Fixed:** *Payment pages load Stripe and PayPal under the strict CSP* — The pay and checkout pages now load the Stripe and PayPal scripts through a content-security-policy scoped to those routes plus same-origin script files, instead of inline script that the site-wide strict policy blocked. Checkout works once payment keys are set, and the site-wide policy — no inline script, Trusted Types required, restricted object and frame sources — is unchanged everywhere else. · *Order actions covered by the tighter rate limit* — Cancelling, rating, and reordering an order are now under the same strict per-route rate limit as other sensitive actions, rather than only the looser global limit.
+
 - v0.3.50 (2026-06-02) — **Installable PWA manifest, hreflang for multilingual stores, complete sitemap and robots coverage, localized edge pages, and product Q&A rich results.** Several search-engine and internationalization signals were missing or inconsistent between the cached (edge) and dynamically rendered pages. This release serves an installable web-app manifest and a service worker, emits hreflang alternates when a store runs path- or subdomain-based locales, localizes the blog, CMS, and policy pages on the cached path (they were always English), brings the robots.txt and sitemap into agreement across both render paths with collections, categories, and CMS pages now included, and emits Q&A structured data on product pages. It also fixes a bug that dropped every product from the dynamically rendered sitemap. **Added:** *Installable web-app manifest and service worker* — The store now serves a web-app manifest at /manifest.webmanifest and a service worker at /sw.js, and links the manifest from every page, so the storefront can be installed as a progressive web app. A working default is served out of the box; an operator who configures a custom manifest overrides it. · *hreflang alternates for multilingual stores* — When a store runs locales via URL prefixes (e.g. /de/) or subdomains, each page now emits rel=alternate hreflang links (plus x-default) so search engines map the equivalent localized URLs instead of treating them as duplicate content. Stores on a single locale, or locale-by-cookie, emit none. · *Product Q&A rich results* — A product page with answered customer questions now emits QAPage structured data so the questions and answers are eligible for rich results in search. **Fixed:** *Localized blog, CMS, and policy pages on the cached path* — The cached (edge-rendered) blog articles, CMS pages, and privacy/terms pages now carry the correct document language and direction for the active locale, matching the dynamically rendered pages. Previously they were always marked English and left-to-right, which harmed screen readers and search indexing and broke right-to-left layout. · *Consistent robots.txt and complete sitemap* — robots.txt now disallows the admin, cart, checkout, order, and account paths consistently on both render paths, and the sitemap now includes collection, category, and CMS-page URLs alongside products and blog posts. A bug that made the dynamically rendered sitemap omit every product (a list limit overflow) is fixed so the full catalog is listed.
 
 - v0.3.49 (2026-06-02) — **Real collection tiles on the home page, a working mobile nav, Collections/Categories in the header, and From-price on multi-variant products.** The home page's 'Featured collections' band linked to fixed keyword searches that landed on empty results unless a product happened to contain those words, the header navigation disappeared entirely on phones with no menu to replace it, and the two real catalog-browse surfaces (Collections and Categories) were reachable only from the footer. This release resolves those: the home tiles now render the store's actual collections with real links, the header gains a no-JavaScript mobile menu, and Collections and Categories appear in the primary nav. Multi-variant products now show a 'From <lowest price>' headline instead of always showing the first variant's price, the non-functional 'New arrivals'/'On sale' sort links are removed, and two small accessibility fixes land (the survey required-field marker and a dark color-scheme hint for native form controls). **Changed:** *Home 'Featured collections' tiles render real collections* — The featured-collections band on the home page now lists the store's actual collections with links to each collection page, instead of fixed keyword searches that could land on an empty results page. If no collections are defined, the band is omitted rather than shown empty. Both the cached and dynamically rendered home pages produce identical markup. · *Mobile navigation menu (no JavaScript required)* — On narrow screens the header now offers a disclosure menu that reveals the navigation links, which previously vanished entirely below a tablet width. It is a pure-CSS menu, so it works with JavaScript disabled. · *Collections and Categories in the header navigation* — The two catalog-browse surfaces — Collections and Categories — are now in the primary header navigation (and inside the mobile menu), not only in the footer. · *Multi-variant products show a 'From' price* — A product whose variants differ in price now shows a 'From <lowest price>' headline so the prominent price is no longer misleading when a shopper selects a different variant; each variant chip still shows its own exact price. · *Removed non-functional sort links* — The 'New arrivals' and 'On sale' links did nothing — the home page does not yet support sorting — so they have been removed rather than left as dead controls. They will return if and when catalog sorting is added. · *Accessibility: survey required marker and dark color-scheme* — The survey form's required-field marker is now announced correctly to screen readers, and the theme declares a dark color-scheme so native form controls, scrollbars, and autofill render correctly on the dark surface.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.50",
+  "version": "0.3.51",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
@@ -13,6 +13,10 @@
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
       "fingerprinted": "js/announcement.59eab4872d2f3b4c.js"
     },
+    "js/captcha.js": {
+      "integrity": "sha384-gsgNDf7cAOxXuZw5Fat4HiRUPCjKoU22W+3AIjNOx2l+i4lJXIHHNJdsXgarm3vy",
+      "fingerprinted": "js/captcha.2aab5803642f8ac5.js"
+    },
     "js/cart-count.js": {
       "integrity": "sha384-K/rkm//Dzg8nuOfpaeenJvLKKl+6DEuvuJi1LLgd46BK+dd1HYmU8R7/gHHjtEsr",
       "fingerprinted": "js/cart-count.bfc2eb434b19c00a.js"
@@ -26,12 +30,20 @@
       "fingerprinted": "js/passkey-add.b535e6a3eef4514e.js"
     },
     "js/passkey-login.js": {
-      "integrity": "sha384-iJ5mKqQ15N2dSCqvQRsez9SRgESaCX8CJD0mTZSYoQVhtxQz+DGdZPYe2+df/0VF",
-      "fingerprinted": "js/passkey-login.4482cca420479033.js"
+      "integrity": "sha384-AbMxT4s0paFnZsEfAHfcpbS2ZRSmZ9KPnttEBy9SvWErBX3U+LhoeYYN7Nm3Y8AX",
+      "fingerprinted": "js/passkey-login.90c13d7c0d8667e2.js"
     },
     "js/passkey-register.js": {
-      "integrity": "sha384-NB0gCF+Bpo6cJYkqfTdcvCMYBzpTJfzz/pYCx6iTykznRWVcBHKqidj+mMIv5qKV",
-      "fingerprinted": "js/passkey-register.537c8a0a0b70ddec.js"
+      "integrity": "sha384-BjuUhbPZ18pHFMyOwT+309BEXu+VAc54RSj8lvN93jfFGDydEgmapiAOKTQM1yma",
+      "fingerprinted": "js/passkey-register.02b0e196fb9608d8.js"
+    },
+    "js/pay.js": {
+      "integrity": "sha384-b9H7SuK6CdLZtcZbTouW6uZ2G99L5/joX5z2YyiL7Slg2ub69ZNw2rPZ/Pxw4qBG",
+      "fingerprinted": "js/pay.e174b69ddffbbfe4.js"
+    },
+    "js/paypal-checkout.js": {
+      "integrity": "sha384-LI6y/1z0Y9F8Kx8RhW4EwY2WqJPXLwJozCXqnhDT+dTckLHyvhly0SsRpH0bsdui",
+      "fingerprinted": "js/paypal-checkout.b05ab5572cc3728f.js"
     }
   }
 }

package/lib/security-middleware.js

@@ -46,6 +46,16 @@
 
 var b = require("./vendor/blamejs");
 
+// The vendored strict default CSP, as a string constant, so a route can
+// derive a SCOPED copy that admits a specific payment-processor / CAPTCHA-
+// provider host on script-src/connect-src/frame-src WITHOUT relaxing the
+// app-level default everywhere else (see scopedCsp). Required from the
+// vendored module path because the constant is exported on the module, not
+// hung off the `b.middleware.securityHeaders` factory function. This is a
+// top-of-domain composition read of a read-only constant, not a vendored-
+// tree edit.
+var _vendoredSecurityHeaders = require("./vendor/blamejs/lib/middleware/security-headers");
+
 var C = b.constants;
 
 // Payment webhooks are server-to-server POSTs from Stripe / PayPal:
@@ -73,6 +83,8 @@ var HEALTH_PATH = "/_/health";
 //   /account/passkey/         -> register-begin / register-finish / add-* begin+finish
 //   /products/                -> the review + question submit sub-paths (gated to POST below)
 //   /survey/                  -> /survey/:token (GET form + POST submit)
+//   /orders/                  -> /orders/:id/cancel|rate|reorder (gated to POST below;
+//                                the /orders/:id confirmation GET a shopper hits freely is NOT throttled)
 var TIGHT_PREFIXES = [
   "/account/login",
   "/account/register",
@@ -83,6 +95,7 @@ var TIGHT_PREFIXES = [
   "/newsletter",
   "/products/",
   "/survey/",
+  "/orders/",
 ];
 
 // Edge-served state-changing POST endpoints. These forms are rendered at
@@ -176,6 +189,150 @@ function securityHeadersOpts() {
   return { documentPolicy: false };
 }
 
+// ---- route-scoped CSP (payment processors + CAPTCHA providers) ----------
+//
+// The app-level CSP is the vendored strict default: `script-src 'self'`,
+// `require-trusted-types-for 'script'`, `object-src 'none'`,
+// `default-src 'self'`, `frame-ancestors 'none'` — no inline scripts, no
+// third-party hosts. A few WRITE-side pages legitimately load a third-
+// party SDK from a fixed host: the Stripe / PayPal payment pages, and the
+// auth + checkout pages when an operator has enabled a CAPTCHA provider.
+// Those SDK hosts can't be `'self'`, so the page needs a route-SCOPED CSP
+// that admits ONLY the specific provider origin on the directives that
+// provider needs (script-src / connect-src / frame-src). Every other
+// protection — Trusted Types, object-src, default-src, frame-ancestors —
+// stays exactly as the strict default. The inline glue that drives those
+// SDKs lives in external same-origin islands (themes/default/assets/js/*),
+// so `script-src` never needs `'unsafe-inline'` or a nonce.
+//
+// `scopedCsp(keys)` returns a CSP string for `res.setHeader(
+// "content-security-policy", ...)` on the route's response. Node's
+// setHeader OVERWRITES, so the route's header replaces the app-level
+// default for that one response only; no other route is affected.
+
+// The fixed, public host set per provider. Single source of truth —
+// every page that admits a provider names it here, never inline. Only the
+// directives the provider actually loads from are listed (Stripe needs all
+// three; PayPal needs script + frame + connect; a CAPTCHA widget needs all
+// three). Hosts are scheme-qualified https origins, never wildcards beyond
+// what the provider's own CDN requires.
+var CSP_HOSTS = {
+  stripe: {
+    script:  ["https://js.stripe.com"],
+    connect: ["https://api.stripe.com"],
+    frame:   ["https://js.stripe.com", "https://hooks.stripe.com"],
+  },
+  paypal: {
+    script:  ["https://www.paypal.com", "https://www.paypalobjects.com"],
+    frame:   ["https://www.paypal.com"],
+    connect: ["https://www.paypal.com"],
+  },
+  // CAPTCHA providers (only the active provider's host is added per request).
+  turnstile: {
+    script:  ["https://challenges.cloudflare.com"],
+    frame:   ["https://challenges.cloudflare.com"],
+    connect: ["https://challenges.cloudflare.com"],
+  },
+  hcaptcha: {
+    script:  ["https://js.hcaptcha.com", "https://hcaptcha.com"],
+    frame:   ["https://hcaptcha.com", "https://*.hcaptcha.com"],
+    connect: ["https://hcaptcha.com", "https://*.hcaptcha.com"],
+  },
+  recaptcha: {
+    script:  ["https://www.google.com", "https://www.gstatic.com"],
+    frame:   ["https://www.google.com"],
+    connect: ["https://www.google.com"],
+  },
+};
+
+// Directive name → the CSP_HOSTS sub-key that feeds it.
+var _SCOPED_DIRECTIVES = {
+  "script-src":  "script",
+  "connect-src": "connect",
+  "frame-src":   "frame",
+};
+
+// Directives the scoped builder MUST NOT touch — relaxing any of these
+// would weaken the page's defense, which is the whole point this group
+// guards against. Listed for the in-file invariant; the builder only ever
+// appends to the three _SCOPED_DIRECTIVES entries.
+//   default-src 'self', object-src 'none',
+//   require-trusted-types-for 'script', frame-ancestors 'none', base-uri 'self'
+
+// Parse the vendored default CSP into an ordered directive map ONCE at
+// module load. The default is a `name a b; name c;` string; split on `;`,
+// the first token of each clause is the directive name, the rest its
+// source list.
+function _parseCsp(cspString) {
+  var order = [];
+  var map = {};
+  String(cspString).split(";").forEach(function (clause) {
+    var trimmed = clause.trim();
+    if (!trimmed) return;
+    var parts = trimmed.split(/\s+/);
+    var name = parts[0];
+    order.push(name);
+    map[name] = parts.slice(1);
+  });
+  return { order: order, map: map };
+}
+
+var _DEFAULT_CSP_PARSED = _parseCsp(_vendoredSecurityHeaders.DEFAULT_CSP);
+
+/**
+ * Build a route-scoped CSP string from the vendored strict default plus the
+ * named providers' hosts. `keys` is an array of CSP_HOSTS keys
+ * ("stripe" / "paypal" / "turnstile" / "hcaptcha" / "recaptcha"); each
+ * adds its hosts to script-src / connect-src / frame-src (creating the
+ * directive from `'self'` if the default omits it, e.g. frame-src). Every
+ * other directive — including require-trusted-types-for, object-src,
+ * default-src, frame-ancestors — is carried through verbatim. Unknown keys
+ * are ignored (a defensive request-shape reader: a caller passing a
+ * mistyped key gets the strict default for that key, never a throw on the
+ * hot path of rendering a pay page). Returns the strict default unchanged
+ * when `keys` is empty / not an array.
+ *
+ * Config-time-ish but called per-response on a render path, so it returns
+ * defaults rather than throwing — a bad key degrades to the strict default,
+ * which fails safe (the SDK is refused, not admitted too broadly).
+ */
+function scopedCsp(keys) {
+  // Clone the parsed default so the per-call mutation never leaks into the
+  // module-level snapshot.
+  var order = _DEFAULT_CSP_PARSED.order.slice();
+  var map = {};
+  _DEFAULT_CSP_PARSED.order.forEach(function (name) {
+    map[name] = _DEFAULT_CSP_PARSED.map[name].slice();
+  });
+
+  if (Array.isArray(keys)) {
+    keys.forEach(function (key) {
+      var hostSet = CSP_HOSTS[key];
+      if (!hostSet) return;
+      Object.keys(_SCOPED_DIRECTIVES).forEach(function (directive) {
+        var subKey = _SCOPED_DIRECTIVES[directive];
+        var hosts = hostSet[subKey];
+        if (!hosts || !hosts.length) return;
+        if (!map[directive]) {
+          // The default omits frame-src (it relies on the default-src /
+          // fenced-frame-src pair); create it from 'self' so admitting a
+          // provider frame doesn't accidentally open it to everything.
+          map[directive] = ["'self'"];
+          order.push(directive);
+        }
+        hosts.forEach(function (h) {
+          if (map[directive].indexOf(h) === -1) map[directive].push(h);
+        });
+      });
+    });
+  }
+
+  return order.map(function (name) {
+    var srcs = map[name];
+    return srcs.length ? (name + " " + srcs.join(" ")) : name;
+  }).join("; ") + ";";
+}
+
 /**
  * Build the GLOBAL rate-limit options for createApp's
  * `middleware.rateLimit`. Token-bucket so a bursty-but-bounded browsing
@@ -298,15 +455,19 @@ function mountRouteGuards(r) {
     // Never throttle the webhook or health paths.
     if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
     if (!_hasPrefix(pathname, TIGHT_PREFIXES)) return next();
-    // `/products/` and `/gift-cards` carry GET reads (PDP, balance page
-    // render) that a shopper hits freely — only gate the state-changing
-    // / lookup POSTs there. Login / register / passkey / checkout /
-    // newsletter / survey are gated on every method (their GETs are the
-    // form render, which a spray would hammer just the same to harvest a
-    // fresh token, so the budget covers both).
+    // `/products/`, `/gift-cards`, and `/orders/` carry GET reads (PDP,
+    // balance page render, order confirmation page) that a shopper hits
+    // freely — only gate the state-changing / lookup POSTs there. For
+    // `/orders/` that's the cancel/rate/reorder mutations; the
+    // `GET /orders/:id` confirmation page (a customer reloads it
+    // repeatedly) is never throttled. Login / register / passkey /
+    // checkout / newsletter / survey are gated on every method (their
+    // GETs are the form render, which a spray would hammer just the same
+    // to harvest a fresh token, so the budget covers both).
     var method = (req.method || "GET").toUpperCase();
     var gateAllMethods = pathname.indexOf("/products/") !== 0 &&
-                         pathname.indexOf("/gift-cards") !== 0;
+                         pathname.indexOf("/gift-cards") !== 0 &&
+                         pathname.indexOf("/orders/") !== 0;
     if (!gateAllMethods && method !== "POST") return next();
     return tightLimiter(req, res, next);
   });
@@ -319,6 +480,8 @@ module.exports = {
   securityHeadersOpts:  securityHeadersOpts,
   globalRateLimitOpts:  globalRateLimitOpts,
   mountRouteGuards:     mountRouteGuards,
+  scopedCsp:            scopedCsp,
+  CSP_HOSTS:            CSP_HOSTS,
   WEBHOOK_PATHS:        WEBHOOK_PATHS,
   HEALTH_PATH:          HEALTH_PATH,
   TIGHT_PREFIXES:       TIGHT_PREFIXES,

package/lib/storefront.js

@@ -6287,8 +6287,14 @@ function renderCheckoutForm(opts) {
   var grandTotal = pricing.format(
     dTotals.grand_total_minor == null ? dTotals.subtotal_minor : dTotals.grand_total_minor,
     dTotals.currency);
+  // CAPTCHA widget block (no-op unless a provider is active for checkout).
+  // Computed BEFORE the themed early-return so a themed checkout gets the
+  // same challenge as the default render — otherwise a configured provider
+  // would render a themed form with no widget yet have POST /checkout fail
+  // closed on the missing token, breaking every themed-store checkout.
+  var checkoutCaptcha = _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, true);
   if (opts.theme) {
-    return opts.theme.render("checkout", {
+    var themed = opts.theme.render("checkout", {
       title:          "Checkout",
       shop_name:      shopName,
       cart_count:     lines.length,
@@ -6296,6 +6302,8 @@ function renderCheckoutForm(opts) {
       total:          grandTotal,
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
+    if (checkoutCaptcha) themed = themed.replace("</form>", checkoutCaptcha + "</form>");
+    return themed;
   }
   // Order-summary line items in the sticky rail — same thumbnail + title
   // pattern as the cart, compact. Formatted in the order's own currency
@@ -6322,6 +6330,15 @@ function renderCheckoutForm(opts) {
     .replace("RAW_INLINE_ERROR", inlineError)
     .replace("RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill))
     .replace("RAW_SUMMARY_LINES", summaryLines);
+  // CAPTCHA challenge inside the form — when the operator has an active
+  // provider (opts.captcha_kind + opts.captcha_public_key set), the widget
+  // renders just above the submit button so its hidden token field rides the
+  // form POST. Absent a provider this is "" — the checkout is byte-identical
+  // to the unconfigured store. The route-scoped CSP that admits the provider
+  // SDK host is set by the GET/POST /checkout handlers.
+  if (checkoutCaptcha) {
+    body = body.replace("</form>", checkoutCaptcha + "</form>");
+  }
   // Signed-in customer with a spendable points balance — surface a
   // redeem-at-checkout field. The block is appended as raw HTML (the
   // balance + value are numbers we control, the conversion ratio is the
@@ -6410,35 +6427,78 @@ function renderGiftCardBalance(opts) {
   });
 }
 
+// PayPal Smart Buttons block, appended to the checkout form when PayPal is
+// configured. The SDK `<script src>` is admitted by the checkout page's
+// route-scoped CSP (the handler adds the "paypal" host set when
+// deps.paypal_client_id is set); the create/capture glue lives in the
+// external same-origin `paypal-checkout.js` island — NO inline `<script>`.
+// client-id + currency ride attribute-escaped `data-*` attributes the island
+// reads, never interpolated into executable script.
 function _paypalCheckoutBlock(clientId, currency) {
   var esc = b.template.escapeHtml;
   var cid = esc(String(clientId));
   var cur = esc(String(currency || "USD"));
-  return "\n<div class=\"checkout-paypal\" style=\"max-width:32rem;margin:1.5rem auto 0;\">" +
+  return "\n<div class=\"checkout-paypal\" id=\"paypal-island\" data-paypal-client-id=\"" + cid + "\" data-currency=\"" + cur + "\" style=\"max-width:32rem;margin:1.5rem auto 0;\">" +
     "<div class=\"pay-card__divider\"><span>or pay with PayPal</span></div>" +
     "<div id=\"paypal-button-container\"></div>" +
     "<p id=\"paypal-error\" class=\"auth-form__message auth-form__message--err\" hidden></p>" +
     "</div>" +
     "<script src=\"https://www.paypal.com/sdk/js?client-id=" + cid + "&currency=" + cur + "&intent=capture\"></script>" +
-    "<script>(function(){" +
-    "if(!window.paypal){return;}" +
-    "var form=document.querySelector('.checkout-page form');" +
-    "var errEl=document.getElementById('paypal-error');" +
-    "function vals(){var d={};['email','name','line1','line2','city','country','state','postal'].forEach(function(k){var el=form&&form.elements[k];if(el){d[k]=el.value;}});return d;}" +
-    "function showErr(m){if(errEl){errEl.hidden=false;errEl.textContent=m||'PayPal checkout could not be completed.';}}" +
-    "paypal.Buttons({" +
-    "onClick:function(_d,actions){if(form&&form.reportValidity&&!form.reportValidity()){return actions.reject();}return actions.resolve();}," +
-    "createOrder:function(){return fetch('/checkout/paypal/create',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(vals())}).then(function(r){return r.json();}).then(function(d){if(!d.id){throw new Error(d.error||'create failed');}return d.id;});}," +
-    "onApprove:function(data){return fetch('/checkout/paypal/capture',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({paypal_order_id:data.orderID})}).then(function(r){return r.json();}).then(function(d){if(d.redirect){window.location.href=d.redirect;}else{showErr(d.error);}});}," +
-    "onError:function(){showErr();}" +
-    "}).render('#paypal-button-container');" +
-    "})();</script>\n";
-}
-
-// Stripe Elements payment page — embeds Stripe.js + a minimal
-// mount block. The publishable key is operator-supplied (env
-// `STRIPE_PUBLISHABLE_KEY` → forwarded into the rendered HTML).
-// The client_secret is per-order; never logged, never persisted.
+    _islandScript("paypal-checkout.js") + "\n";
+}
+
+// CAPTCHA provider host the provider's challenge SDK is loaded from. The
+// kind→URL map mirrors the well-known siteverify/api.js endpoints. Only the
+// `api.js` SDK is rendered here; the siteverify call is server-side egress
+// (server.js captchaVerify). All four kinds are covered so any operator-
+// registered provider renders without a code change.
+var _CAPTCHA_SDK = {
+  turnstile:    "https://challenges.cloudflare.com/turnstile/v0/api.js",
+  hcaptcha:     "https://js.hcaptcha.com/1/api.js",
+  recaptcha_v2: "https://www.google.com/recaptcha/api.js?render=explicit",
+  recaptcha_v3: "https://www.google.com/recaptcha/api.js?render=explicit",
+};
+
+// Map a captcha kind to the CSP_HOSTS key that admits its SDK host.
+function _captchaCspKey(kind) {
+  if (kind === "recaptcha_v2" || kind === "recaptcha_v3") return "recaptcha";
+  return kind;  // turnstile | hcaptcha
+}
+
+// The CAPTCHA widget block: a mount div carrying the (escaped) kind +
+// sitekey, the provider SDK `<script src>` (admitted by the route-scoped
+// CSP the handler sets when a provider is active), the external `captcha.js`
+// island that renders the widget + exposes the token, and a hidden field so
+// the token rides a plain form POST (checkout). `withField` is false for the
+// JSON-ceremony pages (login/register), which read the token via
+// window.__captchaToken() instead. Returns "" when no provider is active —
+// the unconfigured-store no-op.
+function _captchaWidgetBlock(kind, sitekey, withField) {
+  if (!kind || !sitekey) return "";
+  var esc = b.template.escapeHtml;
+  var sdk = _CAPTCHA_SDK[kind];
+  if (!sdk) return "";
+  var hidden = withField
+    ? "<input type=\"hidden\" name=\"captcha_token\" id=\"captcha-token-field\" value=\"\">"
+    : "";
+  return "\n<div class=\"captcha-block\">" +
+    "<div id=\"captcha-widget\" data-captcha-kind=\"" + esc(String(kind)) + "\" data-sitekey=\"" + esc(String(sitekey)) + "\"></div>" +
+    hidden +
+    "</div>" +
+    "<script src=\"" + esc(sdk) + "\" async defer></script>" +
+    _islandScript("captcha.js") + "\n";
+}
+
+// Stripe Elements payment page — loads Stripe.js (the only third-party
+// script, admitted by the route-scoped CSP set on GET /pay/:order_id) and
+// an external same-origin island (`pay.js`) that mounts the Payment Element.
+// No inline `<script>`: the strict default CSP's
+// `require-trusted-types-for 'script'` + the absence of `'unsafe-inline'`
+// would block one. The publishable key (operator-supplied env
+// `STRIPE_PUBLISHABLE_KEY`) and the per-order PaymentIntent client_secret
+// ride HTML-attribute-escaped `data-*` attributes on the mount div — read
+// by the island, never interpolated into executable script. The
+// client_secret is per-order; never logged, never persisted.
 var PAY_PAGE =
   "<section class=\"pay-page\">\n" +
   "  <header class=\"section-head\">\n" +
@@ -6446,7 +6506,7 @@ var PAY_PAGE =
   "    <h1 class=\"section-head__title\">Pay {{grand_total}}</h1>\n" +
   "    <p class=\"section-head__lede\">Order <code class=\"inline-code\">{{order_id}}</code> · the Stripe Payment Element is mounted below in a same-origin form.</p>\n" +
   "  </header>\n" +
-  "  <div class=\"pay-card\">\n" +
+  "  <div class=\"pay-card\" id=\"pay-island\" data-pk=\"{{pk}}\" data-cs=\"{{client_secret}}\" data-order=\"{{order_id}}\">\n" +
   "    <div id=\"express-checkout\" class=\"pay-card__express\" hidden>\n" +
   "      <div id=\"express-checkout-element\"></div>\n" +
   "      <div class=\"pay-card__divider\"><span>or pay with card</span></div>\n" +
@@ -6456,35 +6516,7 @@ var PAY_PAGE =
   "    <p id=\"payment-message\" class=\"pay-card__message\"></p>\n" +
   "  </div>\n" +
   "  <script src=\"https://js.stripe.com/v3/\"></script>\n" +
-  "  <script>\n" +
-  "    (function () {\n" +
-  "      var stripe = Stripe({{pk_json}});\n" +
-  "      var elements = stripe.elements({ clientSecret: {{client_secret_json}}, appearance: { theme: \"stripe\" } });\n" +
-  "      var returnUrl = window.location.origin + \"/orders/{{order_id}}\";\n" +
-  "      var message = document.getElementById(\"payment-message\");\n" +
-  "      function confirm() {\n" +
-  "        message.textContent = \"Processing...\";\n" +
-  "        return stripe.confirmPayment({ elements: elements, confirmParams: { return_url: returnUrl } }).then(function (result) {\n" +
-  "          if (result.error) { message.textContent = result.error.message || \"Payment failed.\"; }\n" +
-  "        });\n" +
-  "      }\n" +
-  "      // Express Checkout Element — renders Apple Pay / Google Pay /\n" +
-  "      // Link wallet buttons when the device + the shop's registered\n" +
-  "      // payment-method domain make them available. It confirms the\n" +
-  "      // same PaymentIntent as the card form, so the webhook + order\n" +
-  "      // FSM are identical. Hidden until Stripe reports an available\n" +
-  "      // wallet so the divider never sits over an empty box.\n" +
-  "      var ece = elements.create(\"expressCheckout\");\n" +
-  "      ece.on(\"ready\", function (ev) {\n" +
-  "        if (ev && ev.availablePaymentMethods) { document.getElementById(\"express-checkout\").hidden = false; }\n" +
-  "      });\n" +
-  "      ece.on(\"confirm\", function () { confirm(); });\n" +
-  "      ece.mount(\"#express-checkout-element\");\n" +
-  "      var paymentElement = elements.create(\"payment\");\n" +
-  "      paymentElement.mount(\"#payment-element\");\n" +
-  "      document.getElementById(\"submit\").addEventListener(\"click\", function () { confirm(); });\n" +
-  "    })();\n" +
-  "  </script>\n" +
+  "  RAW_PAY_SCRIPT\n" +
   "</section>\n";
 
 function renderPayPage(opts) {
@@ -6494,13 +6526,10 @@ function renderPayPage(opts) {
   var shopName    = opts.shop_name || "blamejs.shop";
   var cartCount   = opts.cart_count == null ? 0 : opts.cart_count;
   var grandTotal  = pricing.format(opts.order.grand_total_minor, opts.order.currency);
-  // Stripe.js and client_secret values must be JSON-encoded so the
-  // template engine treats them as raw expressions (`{{{ }}}` /
-  // post-render replace) rather than HTML-escaping the quotes. The
-  // values are otherwise opaque to the renderer — no string
-  // concatenation possible at this layer.
-  var pkJson      = JSON.stringify(opts.publishable_key);
-  var secretJson  = JSON.stringify(opts.client_secret);
+  // The publishable key + per-order client_secret ride HTML-attribute-
+  // escaped `data-*` attributes on the mount div, read by the external
+  // `pay.js` island — no inline `<script>`, no JS-literal interpolation. The
+  // route-scoped CSP set on GET /pay/:order_id admits js.stripe.com.
   if (opts.theme) {
     return opts.theme.render("pay", {
       title:               "Pay",
@@ -6508,18 +6537,21 @@ function renderPayPage(opts) {
       cart_count:          cartCount,
       order_id:            opts.order.id,
       grand_total:         grandTotal,
-      pk_json:             pkJson,
-      client_secret_json:  secretJson,
+      pk:                  opts.publishable_key,
+      client_secret:       opts.client_secret,
+      pay_script:          opts.theme.assetUrl("js/pay.js"),
       asset_css_main:      opts.theme.assetUrl("css/main.css"),
     });
   }
+  // {{pk}} / {{client_secret}} / {{order_id}} go through _render's
+  // escape-by-default path (HTML-attribute-escaped), NOT the old RAW_*
+  // JS-literal splice — they're attribute values now, not script literals.
   var body = _render(PAY_PAGE, {
     order_id:           opts.order.id,
     grand_total:        grandTotal,
-    pk_json:            "RAW_PK",
-    client_secret_json: "RAW_SECRET",
-  }).replace("RAW_PK",     pkJson)
-    .replace("RAW_SECRET", secretJson);
+    pk:                 opts.publishable_key,
+    client_secret:      opts.client_secret,
+  }).replace("RAW_PAY_SCRIPT", _islandScript("pay.js"));
   return _wrap({
     title:      "Pay",
     shop_name:  shopName,
@@ -8059,6 +8091,7 @@ var ACCOUNT_LOGIN_PAGE =
   "    RAW_LOGIN_ERROR\n" +
   "    <form id=\"login-form\" method=\"post\" class=\"form-stack auth-form\">\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" id=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
+  "      RAW_LOGIN_CAPTCHA\n" +
   "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Sign in with passkey</button></div>\n" +
   "      <p id=\"login-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
@@ -8094,6 +8127,11 @@ function renderAccountLogin(opts) {
   var body = ACCOUNT_LOGIN_PAGE
     .replace("RAW_LOGIN_OAUTH", oauthHtml)
     .replace("RAW_LOGIN_ERROR", errHtml)
+    // Login captcha is gated separately (CAPTCHA_GATE_LOGIN): the widget
+    // renders only when the operator has a provider active AND opted login
+    // in (opts.captcha_kind set). For the JSON ceremony the token is read by
+    // passkey-login.js via window.__captchaToken() — no hidden field.
+    .replace("RAW_LOGIN_CAPTCHA", _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, false))
     .replace("RAW_LOGIN_SCRIPT", _islandScript("passkey-login.js"));
   return _wrap({
     title:      "Sign in",
@@ -8113,6 +8151,7 @@ var ACCOUNT_REGISTER_PAGE =
   "    <form id=\"reg-form\" method=\"post\" class=\"form-stack auth-form\">\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" id=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Display name</span><input type=\"text\" name=\"display_name\" id=\"display_name\" maxlength=\"128\" required autocomplete=\"name\"></label></div>\n" +
+  "      RAW_REGISTER_CAPTCHA\n" +
   "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Create account &amp; enroll passkey</button></div>\n" +
   "      <p id=\"reg-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
@@ -8123,12 +8162,19 @@ var ACCOUNT_REGISTER_PAGE =
 
 function renderAccountRegister(opts) {
   opts = opts || {};
+  // Signup captcha renders whenever the operator has an active provider
+  // (opts.captcha_kind + opts.captcha_public_key). The token is read by
+  // passkey-register.js via window.__captchaToken() — no hidden field on
+  // the JSON ceremony. Absent a provider this is "" (unconfigured no-op).
+  var body = ACCOUNT_REGISTER_PAGE
+    .replace("RAW_REGISTER_CAPTCHA", _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, false))
+    .replace("RAW_REGISTER_SCRIPT", _islandScript("passkey-register.js"));
   return _wrap({
     title:      "Create account",
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     theme_css: opts.theme_css,
-    body:       ACCOUNT_REGISTER_PAGE.replace("RAW_REGISTER_SCRIPT", _islandScript("passkey-register.js")),
+    body:       body,
   });
 }
 
@@ -8880,6 +8926,89 @@ function mount(router, deps) {
   // launch flow converts the reservation into a Stripe-gated order).
   var preorder = deps.preorder || null;
 
+  // CAPTCHA gate (bot challenge at signup / login / checkout). Active ONLY
+  // when the operator has registered a provider AND set CAPTCHA_PROVIDER_SLUG
+  // (server.js resolves the provider row at boot into captchaKind +
+  // captchaPublicKey). Absent any of that, every helper below is a no-op:
+  // no widget renders, no token is verified, and the flows behave EXACTLY as
+  // an unconfigured store. Signup + checkout challenge whenever a provider is
+  // active; login challenges only when the operator also opts in
+  // (deps.captchaLoginEnabled, the CAPTCHA_GATE_LOGIN flag) — passkey login
+  // is already phishing-resistant.
+  var captchaGate    = deps.captchaGate || null;
+  var captchaSlug    = deps.captchaProviderSlug || "";
+  var captchaKind    = deps.captchaKind || "";
+  var captchaPubKey  = deps.captchaPublicKey || "";
+  var captchaVerify  = (typeof deps.captchaVerify === "function") ? deps.captchaVerify : null;
+  var captchaActive  = !!(captchaGate && captchaSlug && captchaKind && captchaPubKey && captchaVerify);
+  var captchaLoginOn = captchaActive && !!deps.captchaLoginEnabled;
+
+  // The CSP_HOSTS key (turnstile / hcaptcha / recaptcha) that admits the
+  // active provider's SDK host on the scoped CSP, or null when inactive.
+  var captchaCspKey  = captchaActive ? _captchaCspKey(captchaKind) : null;
+
+  // Verify a submitted captcha token for a gate, recording the outcome.
+  // Returns { ok, status, message } — ok=true means proceed; ok=false means
+  // refuse with the given status + clean message. A no-op pass-through
+  // (ok=true) when the gate is inactive for this flow, so callers wrap the
+  // verify unconditionally and the unconfigured store never changes. The
+  // session/ip hashing is the primitive's expectation (pre-hashed values);
+  // we pass the raw session id (recordOutcome hashes it) + a hashed ip.
+  async function _verifyCaptcha(req, gate, token) {
+    if (!captchaActive) return { ok: true };
+    // Inactive for login unless the operator opted in.
+    if (gate === "other" && !captchaLoginOn) return { ok: true };
+    var raw = (typeof token === "string") ? token.trim() : "";
+    // Defensive request-shape reader: a missing / blank token fails CLOSED at
+    // the caller — never hand a placeholder to the provider (whose acceptance
+    // we don't control). Recorded as a failed outcome, refused with a clean
+    // message. This is independent of provider behavior.
+    var outcome;
+    if (!raw) {
+      outcome = { ok: false, score: null, reasons: ["missing_token"] };
+    } else {
+      try {
+        outcome = await captchaGate.verifyToken({
+          provider_slug: captchaSlug,
+          token:         raw,
+          verify:        captchaVerify,
+        });
+      } catch (_e) {
+        // A bad provider-slug shape / config fault → "unavailable", same
+        // posture as vault/not-initialized (503) rather than a raw leak.
+        return { ok: false, status: 503, message: "Verification is temporarily unavailable. Please try again." };
+      }
+    }
+    // Best-effort audit row; never blocks the request on a write failure.
+    try {
+      var ipHash = b.crypto.namespaceHash("captcha-ip", securityMiddleware.clientKey(req));
+      await captchaGate.recordOutcome({
+        provider_slug: captchaSlug,
+        gate:          gate,
+        ok:            !!outcome.ok,
+        score:         outcome.score == null ? undefined : outcome.score,
+        ip_hash:       ipHash,
+      });
+    } catch (_re) { /* drop-silent — audit write must never break the flow */ }
+    if (!outcome.ok) {
+      return { ok: false, status: 400, message: "Please complete the verification challenge and try again." };
+    }
+    return { ok: true };
+  }
+
+  // Set the route-scoped CSP that admits the active captcha provider host on
+  // the auth pages — ONLY when the gate is active for that flow. When
+  // inactive the strict default app-level CSP stays (no setHeader), so the
+  // unconfigured store's auth pages are unchanged. `flow` is "signup" |
+  // "login": login only admits the host when login is opted in.
+  function _setAuthCaptchaCsp(res, flow) {
+    if (!captchaCspKey) return;
+    if (flow === "login" && !captchaLoginOn) return;
+    if (res && res.setHeader) {
+      res.setHeader("content-security-policy", securityMiddleware.scopedCsp([captchaCspKey]));
+    }
+  }
+
   // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
   // from the consent primitive per request so a runtime `policyVersion`
   // bump takes effect on the gate immediately, and refreshes the module
@@ -11049,9 +11178,27 @@ function mount(router, deps) {
         loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
         prefill: prefill,
         inline_error: inlineError || null,
+        // CAPTCHA widget props — set only when a provider is active, so the
+        // unconfigured checkout renders no widget (renderCheckoutForm treats
+        // an absent kind/key as no-op).
+        captcha_kind:        captchaActive ? captchaKind   : null,
+        captcha_public_key:  captchaActive ? captchaPubKey : null,
       };
     }
 
+    // Route-scoped CSP for the checkout pages: always admits Stripe; adds
+    // PayPal when configured (the block only renders then) and the active
+    // CAPTCHA provider host when the gate is active. Set per response so the
+    // app-level strict CSP governs every other route untouched. When nothing
+    // beyond Stripe applies it still scopes to ["stripe"] (the pay step needs
+    // it). Computed from the SAME conditions that gate what the page renders.
+    function _setCheckoutCsp(res) {
+      var keys = ["stripe"];
+      if (deps.paypal && deps.paypal_client_id) keys.push("paypal");
+      if (captchaActive && captchaCspKey) keys.push(captchaCspKey);
+      res.setHeader && res.setHeader("content-security-policy", securityMiddleware.scopedCsp(keys));
+    }
+
     router.get("/checkout", async function (req, res) {
       var sid = _readSidCookie(req);
       if (!sid) return _send(res, 303, "<a href=\"/cart\">Cart is empty</a>"), res.setHeader && res.setHeader("location", "/cart");
@@ -11069,6 +11216,7 @@ function mount(router, deps) {
       // cart page) so the summary's per-line totals + subtotal match what
       // the shopper saw on /cart.
       var lines = await _repriceCartLines(rawLines);
+      _setCheckoutCsp(res);
       _send(res, 200, renderCheckoutForm(await _checkoutRenderOpts(req, c, lines, null)));
     });
 
@@ -11097,6 +11245,27 @@ function mount(router, deps) {
         res.status(303); res.setHeader && res.setHeader("location", "/cart");
         return res.end ? res.end() : res.send("");
       }
+      // CAPTCHA gate (no-op unless a provider is active for checkout). Verify
+      // BEFORE the cart is converted — a failed challenge re-renders the form
+      // with an inline correction, never starts the order. The form field is
+      // `captcha_token` (rendered inside the checkout form).
+      var coCaptcha = await _verifyCaptcha(req, "checkout_coupon", body.captcha_token);
+      if (!coCaptcha.ok) {
+        try {
+          var capLines = await _repriceCartLines(await deps.cart.listLines(c.id));
+          if (capLines.length && coCaptcha.status === 400) {
+            _setCheckoutCsp(res);
+            return _send(res, 400, renderCheckoutForm(await _checkoutRenderOpts(req, c, capLines, coCaptcha.message)));
+          }
+        } catch (_ce) { /* fall through to the styled error page */ }
+        return _send(res, coCaptcha.status || 400, renderCheckoutError({
+          shop_name: shopName, theme: theme, eyebrow: "Checkout",
+          title_text: "Couldn't verify your request",
+          reason: coCaptcha.message,
+          back_href: "/checkout", back_label: "Back to checkout",
+          secondary_href: "/cart", secondary_label: "Back to cart",
+        }));
+      }
       var shipTo = _shipToFromBody(body);
       try {
         // default_shipping_id may be a literal string or an
@@ -11155,6 +11324,7 @@ function mount(router, deps) {
               // the summary against it (exact, not estimated) so the inline
               // re-render shows the same total the confirm path computed.
               var confirmedTo = (shipTo && /^[A-Z]{2}$/.test(shipTo.country)) ? shipTo : null;
+              _setCheckoutCsp(res);
               return _send(res, 400, renderCheckoutForm(await _checkoutRenderOpts(req, c, coLines, msg, confirmedTo)));
             }
           } catch (_re) { /* fall through to the styled error page */ }
@@ -11195,6 +11365,11 @@ function mount(router, deps) {
         if (!sid) return _json(400, { error: "no-session" });
         var c = await deps.cart.bySession(sid);
         if (!c || c.status !== "active") return _json(409, { error: "no-active-cart" });
+        // CAPTCHA gate — the same challenge POST /checkout runs (gate
+        // "checkout_coupon"). Without it, a bot could bypass the card-checkout
+        // challenge via the PayPal path. No-op when no provider is configured.
+        var ppCaptcha = await _verifyCaptcha(req, "checkout_coupon", body.captcha_token);
+        if (!ppCaptcha.ok) return _json(ppCaptcha.status || 400, { error: ppCaptcha.message || "captcha-required" });
         var shipTo = _shipToFromBody(body);
         try {
           var defaultShipId = typeof deps.default_shipping_id === "function"
@@ -11272,6 +11447,12 @@ function mount(router, deps) {
         res.status(503);
         return res.end ? res.end("Stripe publishable key not configured") : res.send("Stripe publishable key not configured");
       }
+      // Route-scoped CSP that admits js.stripe.com on script/connect/frame-src
+      // (and Trusted Types stays on) so the Stripe SDK + the same-origin
+      // pay.js island load — without relaxing the app-level strict CSP that
+      // governs every OTHER route. setHeader OVERWRITES the app-level header
+      // for this response only.
+      res.setHeader && res.setHeader("content-security-policy", securityMiddleware.scopedCsp(["stripe"]));
       _send(res, 200, renderPayPage({
         order:           o,
         client_secret:   clientSecret,
@@ -11569,23 +11750,44 @@ function mount(router, deps) {
     router.get("/account/login", async function (req, res) {
       var cartCount = await _cartCountForReq(req);
       var url = req.url ? new URL(req.url, "http://localhost") : null;
+      // Login captcha is opt-in (CAPTCHA_GATE_LOGIN). The widget + the scoped
+      // CSP that admits the provider host render only when login is opted in.
+      _setAuthCaptchaCsp(res, "login");
       _send(res, 200, renderAccountLogin({
         shop_name:      shopName,
         cart_count:     cartCount,
         google_enabled: !!deps.oauthGoogle,
         apple_enabled:  !!deps.oauthApple,
         error:          url && url.searchParams.get("error"),
+        captcha_kind:        captchaLoginOn ? captchaKind   : null,
+        captcha_public_key:  captchaLoginOn ? captchaPubKey : null,
       }));
     });
 
     router.get("/account/register", async function (req, res) {
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderAccountRegister({ shop_name: shopName, cart_count: cartCount }));
+      // Signup captcha renders whenever a provider is active; the scoped CSP
+      // admits the provider host only then (no setHeader otherwise).
+      _setAuthCaptchaCsp(res, "signup");
+      _send(res, 200, renderAccountRegister({
+        shop_name: shopName,
+        cart_count: cartCount,
+        captcha_kind:        captchaActive ? captchaKind   : null,
+        captcha_public_key:  captchaActive ? captchaPubKey : null,
+      }));
     });
 
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
+        // CAPTCHA gate (no-op unless a provider is active). Verify the token
+        // BEFORE creating the customer / minting a challenge — a failed
+        // challenge refuses with a clean message and writes no customer row.
+        var regCaptcha = await _verifyCaptcha(req, "signup", body.captcha_token);
+        if (!regCaptcha.ok) {
+          res.status(regCaptcha.status || 400);
+          return res.end ? res.end(regCaptcha.message) : res.send(regCaptcha.message);
+        }
         // Persist the customer row up-front. The address is the
         // registration's natural identifier — if enrollment fails
         // the customer can re-attempt with the same email; the
@@ -11701,6 +11903,15 @@ function mount(router, deps) {
     router.post("/account/passkey/login-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
+        // CAPTCHA gate (no-op unless a provider is active AND login is opted
+        // in via CAPTCHA_GATE_LOGIN — passkey login is already phishing-
+        // resistant). Recorded under gate "other" (the GATES enum has no
+        // dedicated login member). Verified before any challenge is minted.
+        var loginCaptcha = await _verifyCaptcha(req, "other", body.captcha_token);
+        if (!loginCaptcha.ok) {
+          res.status(loginCaptcha.status || 400);
+          return res.end ? res.end(loginCaptcha.message) : res.send(loginCaptcha.message);
+        }
         var hash = deps.customers.hashEmail(body.email);
         var customer = await deps.customers.byEmailHash(hash);
         // Even when the customer doesn't exist, return a valid-shaped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.50",
+  "version": "0.3.51",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {