@blamejs/blamejs-shop 0.3.50 → 0.3.52

package/lib/storefront.js

@@ -6287,8 +6287,14 @@ function renderCheckoutForm(opts) {
   var grandTotal = pricing.format(
     dTotals.grand_total_minor == null ? dTotals.subtotal_minor : dTotals.grand_total_minor,
     dTotals.currency);
+  // CAPTCHA widget block (no-op unless a provider is active for checkout).
+  // Computed BEFORE the themed early-return so a themed checkout gets the
+  // same challenge as the default render — otherwise a configured provider
+  // would render a themed form with no widget yet have POST /checkout fail
+  // closed on the missing token, breaking every themed-store checkout.
+  var checkoutCaptcha = _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, true);
   if (opts.theme) {
-    return opts.theme.render("checkout", {
+    var themed = opts.theme.render("checkout", {
       title:          "Checkout",
       shop_name:      shopName,
       cart_count:     lines.length,
@@ -6296,6 +6302,8 @@ function renderCheckoutForm(opts) {
       total:          grandTotal,
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
+    if (checkoutCaptcha) themed = themed.replace("</form>", checkoutCaptcha + "</form>");
+    return themed;
   }
   // Order-summary line items in the sticky rail — same thumbnail + title
   // pattern as the cart, compact. Formatted in the order's own currency
@@ -6322,6 +6330,15 @@ function renderCheckoutForm(opts) {
     .replace("RAW_INLINE_ERROR", inlineError)
     .replace("RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill))
     .replace("RAW_SUMMARY_LINES", summaryLines);
+  // CAPTCHA challenge inside the form — when the operator has an active
+  // provider (opts.captcha_kind + opts.captcha_public_key set), the widget
+  // renders just above the submit button so its hidden token field rides the
+  // form POST. Absent a provider this is "" — the checkout is byte-identical
+  // to the unconfigured store. The route-scoped CSP that admits the provider
+  // SDK host is set by the GET/POST /checkout handlers.
+  if (checkoutCaptcha) {
+    body = body.replace("</form>", checkoutCaptcha + "</form>");
+  }
   // Signed-in customer with a spendable points balance — surface a
   // redeem-at-checkout field. The block is appended as raw HTML (the
   // balance + value are numbers we control, the conversion ratio is the
@@ -6410,35 +6427,78 @@ function renderGiftCardBalance(opts) {
   });
 }
 
+// PayPal Smart Buttons block, appended to the checkout form when PayPal is
+// configured. The SDK `<script src>` is admitted by the checkout page's
+// route-scoped CSP (the handler adds the "paypal" host set when
+// deps.paypal_client_id is set); the create/capture glue lives in the
+// external same-origin `paypal-checkout.js` island — NO inline `<script>`.
+// client-id + currency ride attribute-escaped `data-*` attributes the island
+// reads, never interpolated into executable script.
 function _paypalCheckoutBlock(clientId, currency) {
   var esc = b.template.escapeHtml;
   var cid = esc(String(clientId));
   var cur = esc(String(currency || "USD"));
-  return "\n<div class=\"checkout-paypal\" style=\"max-width:32rem;margin:1.5rem auto 0;\">" +
+  return "\n<div class=\"checkout-paypal\" id=\"paypal-island\" data-paypal-client-id=\"" + cid + "\" data-currency=\"" + cur + "\" style=\"max-width:32rem;margin:1.5rem auto 0;\">" +
     "<div class=\"pay-card__divider\"><span>or pay with PayPal</span></div>" +
     "<div id=\"paypal-button-container\"></div>" +
     "<p id=\"paypal-error\" class=\"auth-form__message auth-form__message--err\" hidden></p>" +
     "</div>" +
     "<script src=\"https://www.paypal.com/sdk/js?client-id=" + cid + "&currency=" + cur + "&intent=capture\"></script>" +
-    "<script>(function(){" +
-    "if(!window.paypal){return;}" +
-    "var form=document.querySelector('.checkout-page form');" +
-    "var errEl=document.getElementById('paypal-error');" +
-    "function vals(){var d={};['email','name','line1','line2','city','country','state','postal'].forEach(function(k){var el=form&&form.elements[k];if(el){d[k]=el.value;}});return d;}" +
-    "function showErr(m){if(errEl){errEl.hidden=false;errEl.textContent=m||'PayPal checkout could not be completed.';}}" +
-    "paypal.Buttons({" +
-    "onClick:function(_d,actions){if(form&&form.reportValidity&&!form.reportValidity()){return actions.reject();}return actions.resolve();}," +
-    "createOrder:function(){return fetch('/checkout/paypal/create',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(vals())}).then(function(r){return r.json();}).then(function(d){if(!d.id){throw new Error(d.error||'create failed');}return d.id;});}," +
-    "onApprove:function(data){return fetch('/checkout/paypal/capture',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({paypal_order_id:data.orderID})}).then(function(r){return r.json();}).then(function(d){if(d.redirect){window.location.href=d.redirect;}else{showErr(d.error);}});}," +
-    "onError:function(){showErr();}" +
-    "}).render('#paypal-button-container');" +
-    "})();</script>\n";
-}
-
-// Stripe Elements payment page — embeds Stripe.js + a minimal
-// mount block. The publishable key is operator-supplied (env
-// `STRIPE_PUBLISHABLE_KEY` → forwarded into the rendered HTML).
-// The client_secret is per-order; never logged, never persisted.
+    _islandScript("paypal-checkout.js") + "\n";
+}
+
+// CAPTCHA provider host the provider's challenge SDK is loaded from. The
+// kind→URL map mirrors the well-known siteverify/api.js endpoints. Only the
+// `api.js` SDK is rendered here; the siteverify call is server-side egress
+// (server.js captchaVerify). All four kinds are covered so any operator-
+// registered provider renders without a code change.
+var _CAPTCHA_SDK = {
+  turnstile:    "https://challenges.cloudflare.com/turnstile/v0/api.js",
+  hcaptcha:     "https://js.hcaptcha.com/1/api.js",
+  recaptcha_v2: "https://www.google.com/recaptcha/api.js?render=explicit",
+  recaptcha_v3: "https://www.google.com/recaptcha/api.js?render=explicit",
+};
+
+// Map a captcha kind to the CSP_HOSTS key that admits its SDK host.
+function _captchaCspKey(kind) {
+  if (kind === "recaptcha_v2" || kind === "recaptcha_v3") return "recaptcha";
+  return kind;  // turnstile | hcaptcha
+}
+
+// The CAPTCHA widget block: a mount div carrying the (escaped) kind +
+// sitekey, the provider SDK `<script src>` (admitted by the route-scoped
+// CSP the handler sets when a provider is active), the external `captcha.js`
+// island that renders the widget + exposes the token, and a hidden field so
+// the token rides a plain form POST (checkout). `withField` is false for the
+// JSON-ceremony pages (login/register), which read the token via
+// window.__captchaToken() instead. Returns "" when no provider is active —
+// the unconfigured-store no-op.
+function _captchaWidgetBlock(kind, sitekey, withField) {
+  if (!kind || !sitekey) return "";
+  var esc = b.template.escapeHtml;
+  var sdk = _CAPTCHA_SDK[kind];
+  if (!sdk) return "";
+  var hidden = withField
+    ? "<input type=\"hidden\" name=\"captcha_token\" id=\"captcha-token-field\" value=\"\">"
+    : "";
+  return "\n<div class=\"captcha-block\">" +
+    "<div id=\"captcha-widget\" data-captcha-kind=\"" + esc(String(kind)) + "\" data-sitekey=\"" + esc(String(sitekey)) + "\"></div>" +
+    hidden +
+    "</div>" +
+    "<script src=\"" + esc(sdk) + "\" async defer></script>" +
+    _islandScript("captcha.js") + "\n";
+}
+
+// Stripe Elements payment page — loads Stripe.js (the only third-party
+// script, admitted by the route-scoped CSP set on GET /pay/:order_id) and
+// an external same-origin island (`pay.js`) that mounts the Payment Element.
+// No inline `<script>`: the strict default CSP's
+// `require-trusted-types-for 'script'` + the absence of `'unsafe-inline'`
+// would block one. The publishable key (operator-supplied env
+// `STRIPE_PUBLISHABLE_KEY`) and the per-order PaymentIntent client_secret
+// ride HTML-attribute-escaped `data-*` attributes on the mount div — read
+// by the island, never interpolated into executable script. The
+// client_secret is per-order; never logged, never persisted.
 var PAY_PAGE =
   "<section class=\"pay-page\">\n" +
   "  <header class=\"section-head\">\n" +
@@ -6446,7 +6506,7 @@ var PAY_PAGE =
   "    <h1 class=\"section-head__title\">Pay {{grand_total}}</h1>\n" +
   "    <p class=\"section-head__lede\">Order <code class=\"inline-code\">{{order_id}}</code> · the Stripe Payment Element is mounted below in a same-origin form.</p>\n" +
   "  </header>\n" +
-  "  <div class=\"pay-card\">\n" +
+  "  <div class=\"pay-card\" id=\"pay-island\" data-pk=\"{{pk}}\" data-cs=\"{{client_secret}}\" data-order=\"{{order_id}}\">\n" +
   "    <div id=\"express-checkout\" class=\"pay-card__express\" hidden>\n" +
   "      <div id=\"express-checkout-element\"></div>\n" +
   "      <div class=\"pay-card__divider\"><span>or pay with card</span></div>\n" +
@@ -6456,35 +6516,7 @@ var PAY_PAGE =
   "    <p id=\"payment-message\" class=\"pay-card__message\"></p>\n" +
   "  </div>\n" +
   "  <script src=\"https://js.stripe.com/v3/\"></script>\n" +
-  "  <script>\n" +
-  "    (function () {\n" +
-  "      var stripe = Stripe({{pk_json}});\n" +
-  "      var elements = stripe.elements({ clientSecret: {{client_secret_json}}, appearance: { theme: \"stripe\" } });\n" +
-  "      var returnUrl = window.location.origin + \"/orders/{{order_id}}\";\n" +
-  "      var message = document.getElementById(\"payment-message\");\n" +
-  "      function confirm() {\n" +
-  "        message.textContent = \"Processing...\";\n" +
-  "        return stripe.confirmPayment({ elements: elements, confirmParams: { return_url: returnUrl } }).then(function (result) {\n" +
-  "          if (result.error) { message.textContent = result.error.message || \"Payment failed.\"; }\n" +
-  "        });\n" +
-  "      }\n" +
-  "      // Express Checkout Element — renders Apple Pay / Google Pay /\n" +
-  "      // Link wallet buttons when the device + the shop's registered\n" +
-  "      // payment-method domain make them available. It confirms the\n" +
-  "      // same PaymentIntent as the card form, so the webhook + order\n" +
-  "      // FSM are identical. Hidden until Stripe reports an available\n" +
-  "      // wallet so the divider never sits over an empty box.\n" +
-  "      var ece = elements.create(\"expressCheckout\");\n" +
-  "      ece.on(\"ready\", function (ev) {\n" +
-  "        if (ev && ev.availablePaymentMethods) { document.getElementById(\"express-checkout\").hidden = false; }\n" +
-  "      });\n" +
-  "      ece.on(\"confirm\", function () { confirm(); });\n" +
-  "      ece.mount(\"#express-checkout-element\");\n" +
-  "      var paymentElement = elements.create(\"payment\");\n" +
-  "      paymentElement.mount(\"#payment-element\");\n" +
-  "      document.getElementById(\"submit\").addEventListener(\"click\", function () { confirm(); });\n" +
-  "    })();\n" +
-  "  </script>\n" +
+  "  RAW_PAY_SCRIPT\n" +
   "</section>\n";
 
 function renderPayPage(opts) {
@@ -6494,13 +6526,10 @@ function renderPayPage(opts) {
   var shopName    = opts.shop_name || "blamejs.shop";
   var cartCount   = opts.cart_count == null ? 0 : opts.cart_count;
   var grandTotal  = pricing.format(opts.order.grand_total_minor, opts.order.currency);
-  // Stripe.js and client_secret values must be JSON-encoded so the
-  // template engine treats them as raw expressions (`{{{ }}}` /
-  // post-render replace) rather than HTML-escaping the quotes. The
-  // values are otherwise opaque to the renderer — no string
-  // concatenation possible at this layer.
-  var pkJson      = JSON.stringify(opts.publishable_key);
-  var secretJson  = JSON.stringify(opts.client_secret);
+  // The publishable key + per-order client_secret ride HTML-attribute-
+  // escaped `data-*` attributes on the mount div, read by the external
+  // `pay.js` island — no inline `<script>`, no JS-literal interpolation. The
+  // route-scoped CSP set on GET /pay/:order_id admits js.stripe.com.
   if (opts.theme) {
     return opts.theme.render("pay", {
       title:               "Pay",
@@ -6508,18 +6537,21 @@ function renderPayPage(opts) {
       cart_count:          cartCount,
       order_id:            opts.order.id,
       grand_total:         grandTotal,
-      pk_json:             pkJson,
-      client_secret_json:  secretJson,
+      pk:                  opts.publishable_key,
+      client_secret:       opts.client_secret,
+      pay_script:          opts.theme.assetUrl("js/pay.js"),
       asset_css_main:      opts.theme.assetUrl("css/main.css"),
     });
   }
+  // {{pk}} / {{client_secret}} / {{order_id}} go through _render's
+  // escape-by-default path (HTML-attribute-escaped), NOT the old RAW_*
+  // JS-literal splice — they're attribute values now, not script literals.
   var body = _render(PAY_PAGE, {
     order_id:           opts.order.id,
     grand_total:        grandTotal,
-    pk_json:            "RAW_PK",
-    client_secret_json: "RAW_SECRET",
-  }).replace("RAW_PK",     pkJson)
-    .replace("RAW_SECRET", secretJson);
+    pk:                 opts.publishable_key,
+    client_secret:      opts.client_secret,
+  }).replace("RAW_PAY_SCRIPT", _islandScript("pay.js"));
   return _wrap({
     title:      "Pay",
     shop_name:  shopName,
@@ -8059,6 +8091,7 @@ var ACCOUNT_LOGIN_PAGE =
   "    RAW_LOGIN_ERROR\n" +
   "    <form id=\"login-form\" method=\"post\" class=\"form-stack auth-form\">\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" id=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
+  "      RAW_LOGIN_CAPTCHA\n" +
   "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Sign in with passkey</button></div>\n" +
   "      <p id=\"login-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
@@ -8094,6 +8127,11 @@ function renderAccountLogin(opts) {
   var body = ACCOUNT_LOGIN_PAGE
     .replace("RAW_LOGIN_OAUTH", oauthHtml)
     .replace("RAW_LOGIN_ERROR", errHtml)
+    // Login captcha is gated separately (CAPTCHA_GATE_LOGIN): the widget
+    // renders only when the operator has a provider active AND opted login
+    // in (opts.captcha_kind set). For the JSON ceremony the token is read by
+    // passkey-login.js via window.__captchaToken() — no hidden field.
+    .replace("RAW_LOGIN_CAPTCHA", _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, false))
     .replace("RAW_LOGIN_SCRIPT", _islandScript("passkey-login.js"));
   return _wrap({
     title:      "Sign in",
@@ -8113,6 +8151,7 @@ var ACCOUNT_REGISTER_PAGE =
   "    <form id=\"reg-form\" method=\"post\" class=\"form-stack auth-form\">\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" id=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
   "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Display name</span><input type=\"text\" name=\"display_name\" id=\"display_name\" maxlength=\"128\" required autocomplete=\"name\"></label></div>\n" +
+  "      RAW_REGISTER_CAPTCHA\n" +
   "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Create account &amp; enroll passkey</button></div>\n" +
   "      <p id=\"reg-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
@@ -8123,12 +8162,19 @@ var ACCOUNT_REGISTER_PAGE =
 
 function renderAccountRegister(opts) {
   opts = opts || {};
+  // Signup captcha renders whenever the operator has an active provider
+  // (opts.captcha_kind + opts.captcha_public_key). The token is read by
+  // passkey-register.js via window.__captchaToken() — no hidden field on
+  // the JSON ceremony. Absent a provider this is "" (unconfigured no-op).
+  var body = ACCOUNT_REGISTER_PAGE
+    .replace("RAW_REGISTER_CAPTCHA", _captchaWidgetBlock(opts.captcha_kind, opts.captcha_public_key, false))
+    .replace("RAW_REGISTER_SCRIPT", _islandScript("passkey-register.js"));
   return _wrap({
     title:      "Create account",
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     theme_css: opts.theme_css,
-    body:       ACCOUNT_REGISTER_PAGE.replace("RAW_REGISTER_SCRIPT", _islandScript("passkey-register.js")),
+    body:       body,
   });
 }
 
@@ -8880,6 +8926,89 @@ function mount(router, deps) {
   // launch flow converts the reservation into a Stripe-gated order).
   var preorder = deps.preorder || null;
 
+  // CAPTCHA gate (bot challenge at signup / login / checkout). Active ONLY
+  // when the operator has registered a provider AND set CAPTCHA_PROVIDER_SLUG
+  // (server.js resolves the provider row at boot into captchaKind +
+  // captchaPublicKey). Absent any of that, every helper below is a no-op:
+  // no widget renders, no token is verified, and the flows behave EXACTLY as
+  // an unconfigured store. Signup + checkout challenge whenever a provider is
+  // active; login challenges only when the operator also opts in
+  // (deps.captchaLoginEnabled, the CAPTCHA_GATE_LOGIN flag) — passkey login
+  // is already phishing-resistant.
+  var captchaGate    = deps.captchaGate || null;
+  var captchaSlug    = deps.captchaProviderSlug || "";
+  var captchaKind    = deps.captchaKind || "";
+  var captchaPubKey  = deps.captchaPublicKey || "";
+  var captchaVerify  = (typeof deps.captchaVerify === "function") ? deps.captchaVerify : null;
+  var captchaActive  = !!(captchaGate && captchaSlug && captchaKind && captchaPubKey && captchaVerify);
+  var captchaLoginOn = captchaActive && !!deps.captchaLoginEnabled;
+
+  // The CSP_HOSTS key (turnstile / hcaptcha / recaptcha) that admits the
+  // active provider's SDK host on the scoped CSP, or null when inactive.
+  var captchaCspKey  = captchaActive ? _captchaCspKey(captchaKind) : null;
+
+  // Verify a submitted captcha token for a gate, recording the outcome.
+  // Returns { ok, status, message } — ok=true means proceed; ok=false means
+  // refuse with the given status + clean message. A no-op pass-through
+  // (ok=true) when the gate is inactive for this flow, so callers wrap the
+  // verify unconditionally and the unconfigured store never changes. The
+  // session/ip hashing is the primitive's expectation (pre-hashed values);
+  // we pass the raw session id (recordOutcome hashes it) + a hashed ip.
+  async function _verifyCaptcha(req, gate, token) {
+    if (!captchaActive) return { ok: true };
+    // Inactive for login unless the operator opted in.
+    if (gate === "other" && !captchaLoginOn) return { ok: true };
+    var raw = (typeof token === "string") ? token.trim() : "";
+    // Defensive request-shape reader: a missing / blank token fails CLOSED at
+    // the caller — never hand a placeholder to the provider (whose acceptance
+    // we don't control). Recorded as a failed outcome, refused with a clean
+    // message. This is independent of provider behavior.
+    var outcome;
+    if (!raw) {
+      outcome = { ok: false, score: null, reasons: ["missing_token"] };
+    } else {
+      try {
+        outcome = await captchaGate.verifyToken({
+          provider_slug: captchaSlug,
+          token:         raw,
+          verify:        captchaVerify,
+        });
+      } catch (_e) {
+        // A bad provider-slug shape / config fault → "unavailable", same
+        // posture as vault/not-initialized (503) rather than a raw leak.
+        return { ok: false, status: 503, message: "Verification is temporarily unavailable. Please try again." };
+      }
+    }
+    // Best-effort audit row; never blocks the request on a write failure.
+    try {
+      var ipHash = b.crypto.namespaceHash("captcha-ip", securityMiddleware.clientKey(req));
+      await captchaGate.recordOutcome({
+        provider_slug: captchaSlug,
+        gate:          gate,
+        ok:            !!outcome.ok,
+        score:         outcome.score == null ? undefined : outcome.score,
+        ip_hash:       ipHash,
+      });
+    } catch (_re) { /* drop-silent — audit write must never break the flow */ }
+    if (!outcome.ok) {
+      return { ok: false, status: 400, message: "Please complete the verification challenge and try again." };
+    }
+    return { ok: true };
+  }
+
+  // Set the route-scoped CSP that admits the active captcha provider host on
+  // the auth pages — ONLY when the gate is active for that flow. When
+  // inactive the strict default app-level CSP stays (no setHeader), so the
+  // unconfigured store's auth pages are unchanged. `flow` is "signup" |
+  // "login": login only admits the host when login is opted in.
+  function _setAuthCaptchaCsp(res, flow) {
+    if (!captchaCspKey) return;
+    if (flow === "login" && !captchaLoginOn) return;
+    if (res && res.setHeader) {
+      res.setHeader("content-security-policy", securityMiddleware.scopedCsp([captchaCspKey]));
+    }
+  }
+
   // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
   // from the consent primitive per request so a runtime `policyVersion`
   // bump takes effect on the gate immediately, and refreshes the module
@@ -11049,9 +11178,27 @@ function mount(router, deps) {
         loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
         prefill: prefill,
         inline_error: inlineError || null,
+        // CAPTCHA widget props — set only when a provider is active, so the
+        // unconfigured checkout renders no widget (renderCheckoutForm treats
+        // an absent kind/key as no-op).
+        captcha_kind:        captchaActive ? captchaKind   : null,
+        captcha_public_key:  captchaActive ? captchaPubKey : null,
       };
     }
 
+    // Route-scoped CSP for the checkout pages: always admits Stripe; adds
+    // PayPal when configured (the block only renders then) and the active
+    // CAPTCHA provider host when the gate is active. Set per response so the
+    // app-level strict CSP governs every other route untouched. When nothing
+    // beyond Stripe applies it still scopes to ["stripe"] (the pay step needs
+    // it). Computed from the SAME conditions that gate what the page renders.
+    function _setCheckoutCsp(res) {
+      var keys = ["stripe"];
+      if (deps.paypal && deps.paypal_client_id) keys.push("paypal");
+      if (captchaActive && captchaCspKey) keys.push(captchaCspKey);
+      res.setHeader && res.setHeader("content-security-policy", securityMiddleware.scopedCsp(keys));
+    }
+
     router.get("/checkout", async function (req, res) {
       var sid = _readSidCookie(req);
       if (!sid) return _send(res, 303, "<a href=\"/cart\">Cart is empty</a>"), res.setHeader && res.setHeader("location", "/cart");
@@ -11069,6 +11216,7 @@ function mount(router, deps) {
       // cart page) so the summary's per-line totals + subtotal match what
       // the shopper saw on /cart.
       var lines = await _repriceCartLines(rawLines);
+      _setCheckoutCsp(res);
       _send(res, 200, renderCheckoutForm(await _checkoutRenderOpts(req, c, lines, null)));
     });
 
@@ -11097,6 +11245,27 @@ function mount(router, deps) {
         res.status(303); res.setHeader && res.setHeader("location", "/cart");
         return res.end ? res.end() : res.send("");
       }
+      // CAPTCHA gate (no-op unless a provider is active for checkout). Verify
+      // BEFORE the cart is converted — a failed challenge re-renders the form
+      // with an inline correction, never starts the order. The form field is
+      // `captcha_token` (rendered inside the checkout form).
+      var coCaptcha = await _verifyCaptcha(req, "checkout_coupon", body.captcha_token);
+      if (!coCaptcha.ok) {
+        try {
+          var capLines = await _repriceCartLines(await deps.cart.listLines(c.id));
+          if (capLines.length && coCaptcha.status === 400) {
+            _setCheckoutCsp(res);
+            return _send(res, 400, renderCheckoutForm(await _checkoutRenderOpts(req, c, capLines, coCaptcha.message)));
+          }
+        } catch (_ce) { /* fall through to the styled error page */ }
+        return _send(res, coCaptcha.status || 400, renderCheckoutError({
+          shop_name: shopName, theme: theme, eyebrow: "Checkout",
+          title_text: "Couldn't verify your request",
+          reason: coCaptcha.message,
+          back_href: "/checkout", back_label: "Back to checkout",
+          secondary_href: "/cart", secondary_label: "Back to cart",
+        }));
+      }
       var shipTo = _shipToFromBody(body);
       try {
         // default_shipping_id may be a literal string or an
@@ -11155,6 +11324,7 @@ function mount(router, deps) {
               // the summary against it (exact, not estimated) so the inline
               // re-render shows the same total the confirm path computed.
               var confirmedTo = (shipTo && /^[A-Z]{2}$/.test(shipTo.country)) ? shipTo : null;
+              _setCheckoutCsp(res);
               return _send(res, 400, renderCheckoutForm(await _checkoutRenderOpts(req, c, coLines, msg, confirmedTo)));
             }
           } catch (_re) { /* fall through to the styled error page */ }
@@ -11195,6 +11365,11 @@ function mount(router, deps) {
         if (!sid) return _json(400, { error: "no-session" });
         var c = await deps.cart.bySession(sid);
         if (!c || c.status !== "active") return _json(409, { error: "no-active-cart" });
+        // CAPTCHA gate — the same challenge POST /checkout runs (gate
+        // "checkout_coupon"). Without it, a bot could bypass the card-checkout
+        // challenge via the PayPal path. No-op when no provider is configured.
+        var ppCaptcha = await _verifyCaptcha(req, "checkout_coupon", body.captcha_token);
+        if (!ppCaptcha.ok) return _json(ppCaptcha.status || 400, { error: ppCaptcha.message || "captcha-required" });
         var shipTo = _shipToFromBody(body);
         try {
           var defaultShipId = typeof deps.default_shipping_id === "function"
@@ -11272,6 +11447,12 @@ function mount(router, deps) {
         res.status(503);
         return res.end ? res.end("Stripe publishable key not configured") : res.send("Stripe publishable key not configured");
       }
+      // Route-scoped CSP that admits js.stripe.com on script/connect/frame-src
+      // (and Trusted Types stays on) so the Stripe SDK + the same-origin
+      // pay.js island load — without relaxing the app-level strict CSP that
+      // governs every OTHER route. setHeader OVERWRITES the app-level header
+      // for this response only.
+      res.setHeader && res.setHeader("content-security-policy", securityMiddleware.scopedCsp(["stripe"]));
       _send(res, 200, renderPayPage({
         order:           o,
         client_secret:   clientSecret,
@@ -11569,23 +11750,44 @@ function mount(router, deps) {
     router.get("/account/login", async function (req, res) {
       var cartCount = await _cartCountForReq(req);
       var url = req.url ? new URL(req.url, "http://localhost") : null;
+      // Login captcha is opt-in (CAPTCHA_GATE_LOGIN). The widget + the scoped
+      // CSP that admits the provider host render only when login is opted in.
+      _setAuthCaptchaCsp(res, "login");
       _send(res, 200, renderAccountLogin({
         shop_name:      shopName,
         cart_count:     cartCount,
         google_enabled: !!deps.oauthGoogle,
         apple_enabled:  !!deps.oauthApple,
         error:          url && url.searchParams.get("error"),
+        captcha_kind:        captchaLoginOn ? captchaKind   : null,
+        captcha_public_key:  captchaLoginOn ? captchaPubKey : null,
       }));
     });
 
     router.get("/account/register", async function (req, res) {
       var cartCount = await _cartCountForReq(req);
-      _send(res, 200, renderAccountRegister({ shop_name: shopName, cart_count: cartCount }));
+      // Signup captcha renders whenever a provider is active; the scoped CSP
+      // admits the provider host only then (no setHeader otherwise).
+      _setAuthCaptchaCsp(res, "signup");
+      _send(res, 200, renderAccountRegister({
+        shop_name: shopName,
+        cart_count: cartCount,
+        captcha_kind:        captchaActive ? captchaKind   : null,
+        captcha_public_key:  captchaActive ? captchaPubKey : null,
+      }));
     });
 
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
+        // CAPTCHA gate (no-op unless a provider is active). Verify the token
+        // BEFORE creating the customer / minting a challenge — a failed
+        // challenge refuses with a clean message and writes no customer row.
+        var regCaptcha = await _verifyCaptcha(req, "signup", body.captcha_token);
+        if (!regCaptcha.ok) {
+          res.status(regCaptcha.status || 400);
+          return res.end ? res.end(regCaptcha.message) : res.send(regCaptcha.message);
+        }
         // Persist the customer row up-front. The address is the
         // registration's natural identifier — if enrollment fails
         // the customer can re-attempt with the same email; the
@@ -11701,6 +11903,15 @@ function mount(router, deps) {
     router.post("/account/passkey/login-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
+        // CAPTCHA gate (no-op unless a provider is active AND login is opted
+        // in via CAPTCHA_GATE_LOGIN — passkey login is already phishing-
+        // resistant). Recorded under gate "other" (the GATES enum has no
+        // dedicated login member). Verified before any challenge is minted.
+        var loginCaptcha = await _verifyCaptcha(req, "other", body.captcha_token);
+        if (!loginCaptcha.ok) {
+          res.status(loginCaptcha.status || 400);
+          return res.end ? res.end(loginCaptcha.message) : res.send(loginCaptcha.message);
+        }
         var hash = deps.customers.hashEmail(body.email);
         var customer = await deps.customers.byEmailHash(hash);
         // Even when the customer doesn't exist, return a valid-shaped