@blamejs/blamejs-shop 0.3.51 → 0.3.53

package/lib/storefront.js

@@ -1894,16 +1894,35 @@ function _buildBuyBox(variants, escAttr, availability, headlinePrice) {
   var soldOutRowBtn =
     "<button type=\"submit\" class=\"btn-primary btn-primary--sm\" disabled aria-disabled=\"true\">Out of stock</button>";
 
+  // "Notify me when back in stock" — a cookie-less, edge-cache-safe form
+  // posting to the DISTINCT CSRF-exempt action `/stock-alert/subscribe`
+  // (NOT /products/:slug/notify — that would over-exempt the token-required
+  // review + question POSTs). The action is in EDGE_POST_PATHS, so the
+  // container's `_injectCsrfFields` leaves it un-tokened, keeping this markup
+  // byte-identical to the worker twin. sku/variant are catalog data; escape
+  // anyway (escape-by-default). DUAL-RENDER: this helper is byte-identical to
+  // worker/render/product.js#_buildBuyBox._notifyForm.
+  function _notifyForm(sku, variantId) {
+    return "<form class=\"pdp__notify\" method=\"post\" action=\"/stock-alert/subscribe\">\n" +
+           "          <input type=\"hidden\" name=\"sku\" value=\"" + escAttr(sku) + "\">\n" +
+           (variantId ? "          <input type=\"hidden\" name=\"variant_id\" value=\"" + escAttr(variantId) + "\">\n" : "") +
+           "          <label class=\"pdp__notify-label\" for=\"notify-email-" + escAttr(sku) + "\">Email me when this is back in stock</label>\n" +
+           "          <input id=\"notify-email-" + escAttr(sku) + "\" type=\"email\" name=\"email\" required placeholder=\"you@example.com\" autocomplete=\"email\">\n" +
+           "          <button type=\"submit\" class=\"btn-secondary btn-primary--sm\">Notify me</button>\n" +
+           "        </form>";
+  }
+
   // Many variants → keep the compact table (still a per-row add form).
   if (variants.length > BUYBOX_CHIP_LIMIT) {
     var rows = variants.map(function (v) {
       var row = _render(VARIANT_ROW, { title: v.title, sku: v.sku, price: v.price, variant_id: v.id });
       // When the product is out of stock, swap each per-row add button for
-      // the disabled control so no row offers an active purchase.
+      // the disabled control + a per-row notify form so no row offers an
+      // active purchase but every sold-out SKU offers the alert.
       if (!inStock) {
         row = row.replace(
           "<button type=\"submit\" class=\"btn-primary btn-primary--sm\">Add to cart</button>",
-          soldOutRowBtn);
+          soldOutRowBtn + _notifyForm(v.sku, v.id));
       }
       return row;
     }).join("");
@@ -1947,6 +1966,13 @@ function _buildBuyBox(variants, escAttr, availability, headlinePrice) {
     ? "<button type=\"submit\" class=\"btn-primary cart-page__checkout\">$ add to cart</button>"
     : soldOutBtn;
 
+  // Out-of-stock chip/single buy box → the notify form sits OUTSIDE the
+  // add-to-cart form (its own form element, distinct action), after the
+  // sold-out control. Keyed to the LEAD variant's SKU — the chip radio does
+  // not JS-swap the hidden field (Trusted Types / no innerHTML island), so a
+  // shopper subscribes against the lead SKU. Documented limitation.
+  var notifyBlock = inStock ? "" : ("\n        " + _notifyForm(lead.sku, lead.id));
+
   var headline = (headlinePrice != null && headlinePrice !== "") ? headlinePrice : lead.price;
   return "<div class=\"pdp__buybox\">\n" +
          "        <p class=\"featured-product__price\">" + escAttr(headline) + "</p>\n" +
@@ -1955,7 +1981,7 @@ function _buildBuyBox(variants, escAttr, availability, headlinePrice) {
          "          <label class=\"pdp__variants-title\" for=\"buybox-qty\">Quantity</label>\n" +
          "          <input id=\"buybox-qty\" type=\"number\" name=\"qty\" value=\"1\" min=\"1\" max=\"99\" class=\"variant-row__qty\" aria-label=\"Quantity\">\n" +
          "          " + addControl + "\n" +
-         "        </form>\n" +
+         "        </form>" + notifyBlock + "\n" +
          "      </div>\n" +
          "      " + trustLine;
 }
@@ -6552,12 +6578,16 @@ function renderPayPage(opts) {
     pk:                 opts.publishable_key,
     client_secret:      opts.client_secret,
   }).replace("RAW_PAY_SCRIPT", _islandScript("pay.js"));
+  // Operator trust badges at the checkout placement (container-only — the pay
+  // page isn't edge-cached). Pre-resolved + sanitized by the route; appended
+  // after the pay card. Empty string when no badges / no dep.
+  var payTrustBadges = typeof opts.trust_badges_html === "string" ? opts.trust_badges_html : "";
   return _wrap({
     title:      "Pay",
     shop_name:  shopName,
     cart_count: cartCount,
     theme_css: opts.theme_css,
-    body:       body,
+    body:       body + payTrustBadges,
   });
 }
 
@@ -7046,12 +7076,18 @@ function renderOrder(opts) {
         "<div class=\"grid\">" + railCards + "</div>" +
       "</section>";
   }
+  // Operator-authored trust badges at the order_confirmation placement
+  // (container-only — this page isn't edge-cached). Pre-resolved + escaped by
+  // the route (via _trustBadgesHtml); spliced raw so a `$` in a sanitized SVG
+  // can't trip String.replace dollar substitution. Empty string when no badges
+  // / no dep.
+  var trustBadgesHtml = typeof opts.trust_badges_html === "string" ? opts.trust_badges_html : "";
   return _wrap({
     title:      "Order " + o.id,
     shop_name:  shopName,
     cart_count: cartCount,
     theme_css: opts.theme_css,
-    body:       body + railHtml,
+    body:       body + railHtml + trustBadgesHtml,
   });
 }
 
@@ -7562,6 +7598,171 @@ function renderUnsubscribeResult(opts) {
   });
 }
 
+// ---- back-in-stock "Notify me" pages -----------------------------------
+//
+// Container-only (no edge twin) — these aren't edge-cached. Every page is
+// server-rendered, no auth, escape-by-default. The thank-you page renders
+// the SAME copy for new / already-pending / already-confirmed so the page
+// never reveals whether the address was already subscribed beyond friendly
+// copy. The confirm/unsubscribe pages render a clean outcome on a null/
+// invalid result rather than a leak or a 500.
+
+function renderStockAlertThanks(opts) {
+  opts = opts || {};
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Back-in-stock alert</p>" +
+        "<h1 class=\"newsletter-thanks__title\">Check your email.</h1>" +
+        "<p class=\"newsletter-thanks__lede\">If that address can receive mail, we've sent a confirmation link. Click it and we'll email you once — the moment this item is back in stock. Already confirmed? You're all set.</p>" +
+        "<div class=\"newsletter-thanks__cta\">" +
+          "<a href=\"/\" class=\"btn-primary\">Back to the shop <span aria-hidden=\"true\">→</span></a>" +
+        "</div>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Back-in-stock alert",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+function renderStockAlertError(opts) {
+  opts = opts || {};
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Back-in-stock alert</p>" +
+        "<h1 class=\"newsletter-thanks__title\">Couldn't set that alert.</h1>" +
+        "<p class=\"newsletter-thanks__lede\">" + b.template.escapeHtml(String(opts.message || "Check the email address and try again — only RFC-shape email addresses are accepted.")) + "</p>" +
+        "<div class=\"newsletter-thanks__cta\">" +
+          "<a href=\"/\" class=\"btn-primary\">Back to the shop <span aria-hidden=\"true\">→</span></a>" +
+        "</div>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Back-in-stock alert",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+// The confirm-link landing page. `opts.outcome` is one of: "confirmed"
+// (we just stamped confirmed_at), "already-notified" (the alert already
+// fired — terminal), "invalid" (null / expired / unknown token). No token
+// is echoed back; the outcome page reveals nothing beyond friendly copy.
+function renderStockAlertConfirm(opts) {
+  opts = opts || {};
+  var heading, lede;
+  if (opts.outcome === "confirmed") {
+    heading = "You're all set.";
+    lede    = "Your back-in-stock alert is confirmed. We'll email you once — the moment this item returns. Nothing else.";
+  } else if (opts.outcome === "already-notified") {
+    heading = "You've already been notified.";
+    lede    = "This item was already back in stock and we emailed you about it. There's nothing more to do.";
+  } else {
+    heading = "This link is no longer valid.";
+    lede    = "We couldn't match this confirmation link to an alert. It may have expired, or the link may be incomplete. You can set a fresh alert from the product page.";
+  }
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Back-in-stock alert</p>" +
+        "<h1 class=\"newsletter-thanks__title\">" + heading + "</h1>" +
+        "<p class=\"newsletter-thanks__lede\">" + lede + "</p>" +
+        "<div class=\"newsletter-thanks__cta\">" +
+          "<a href=\"/\" class=\"btn-primary\">Back to the shop <span aria-hidden=\"true\">→</span></a>" +
+        "</div>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Back-in-stock alert",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+// The unsubscribe confirm page (GET). A no-JS form POSTs the (email, sku,
+// variant) tuple back to /stock-alert/unsubscribe — a deliberate "yes,
+// stop these alerts" step (no link-prefetcher unsubscribe). The tuple
+// rides in hidden fields (HTML-escaped). This page is container-rendered
+// from a GET, so it CAN carry the `_csrf` token — the action is NOT in
+// EDGE_POST_PATHS, so `_injectCsrfFields` tokens it automatically.
+function renderStockAlertUnsubscribeConfirm(opts) {
+  opts = opts || {};
+  var email     = typeof opts.email === "string" ? opts.email : "";
+  var sku       = typeof opts.sku === "string" ? opts.sku : "";
+  var variantId = typeof opts.variant_id === "string" ? opts.variant_id : "";
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Back-in-stock alert</p>" +
+        "<h1 class=\"newsletter-thanks__title\">Stop this alert?</h1>" +
+        "<p class=\"newsletter-thanks__lede\">Confirm below and we'll cancel your back-in-stock alert for this item. You can set it again any time from the product page.</p>" +
+        "<form class=\"newsletter-unsub__form\" method=\"post\" action=\"/stock-alert/unsubscribe\">" +
+          "<input type=\"hidden\" name=\"email\" value=\"" + _escAttr(email) + "\">" +
+          "<input type=\"hidden\" name=\"sku\" value=\"" + _escAttr(sku) + "\">" +
+          (variantId ? "<input type=\"hidden\" name=\"variant_id\" value=\"" + _escAttr(variantId) + "\">" : "") +
+          "<div class=\"newsletter-thanks__cta\">" +
+            "<button type=\"submit\" class=\"btn-primary\">Stop this alert</button>" +
+            "<a href=\"/\" class=\"btn-ghost\">Keep me subscribed</a>" +
+          "</div>" +
+        "</form>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Unsubscribe",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
+// The unsubscribe outcome page (POST). Idempotent — a missing row reads as
+// "you're unsubscribed" (re-clicking the link twice is not an error). A bad
+// shape reads as the generic non-leaking copy.
+function renderStockAlertUnsubscribeResult(opts) {
+  opts = opts || {};
+  var heading, lede;
+  if (opts.outcome === "invalid") {
+    heading = "This link isn't valid.";
+    lede    = "We couldn't match this unsubscribe link to an alert. It may already have been used, or the link may be incomplete.";
+  } else {
+    heading = "You're unsubscribed.";
+    lede    = "We won't email you about this item coming back in stock. Changed your mind? Set a fresh alert from the product page.";
+  }
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Back-in-stock alert</p>" +
+        "<h1 class=\"newsletter-thanks__title\">" + heading + "</h1>" +
+        "<p class=\"newsletter-thanks__lede\">" + lede + "</p>" +
+        "<div class=\"newsletter-thanks__cta\">" +
+          "<a href=\"/\" class=\"btn-primary\">Back to the shop <span aria-hidden=\"true\">→</span></a>" +
+        "</div>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Unsubscribe",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
 // ---- cookie preference center ------------------------------------------
 
 // The four toggleable categories + their operator-facing copy, mirroring
@@ -9065,6 +9266,42 @@ function mount(router, deps) {
     return lines.length;
   }
 
+  // Resolve the active trust badges for a container-only placement and
+  // concatenate each one's sanitized renderHtml. Fires an impression per
+  // rendered badge (fire-and-forget — the counter is drop-silent on the hot
+  // path; never await it into the response). Drop-silent on ANY read failure
+  // (returns "") — badges are supplementary; an absent dep / unmigrated table
+  // / read error must never 500 a checkout or order page. Placements wired
+  // today: "checkout", "order_confirmation". The svg_payload was sanitized at
+  // define time via b.guardSvg, so renderHtml's inline emit is safe.
+  async function _trustBadgesHtml(placement, req) {
+    if (!deps.trustBadges) return "";
+    try {
+      var active = await deps.trustBadges.activeForPlacement({ placement: placement });
+      if (!Array.isArray(active) || active.length === 0) return "";
+      var sid = null;
+      try { sid = _readSidCookie(req); } catch (_e) { sid = null; }
+      var parts = [];
+      for (var i = 0; i < active.length; i += 1) {
+        var slug = active[i].slug;
+        var html;
+        try { html = await deps.trustBadges.renderHtml({ slug: slug }); }
+        catch (_e) { continue; /* drop-silent — skip a badge that fails to render */ }
+        parts.push(html);
+        // Fire-and-forget impression — the method is already drop-silent.
+        try {
+          var imp = deps.trustBadges.recordImpression({ slug: slug, placement: placement, session_id: sid || undefined });
+          if (imp && typeof imp.then === "function") imp.then(function () {}, function () {});
+        } catch (_e) { /* drop-silent — impression bump must not affect render */ }
+      }
+      if (!parts.length) return "";
+      return "<section class=\"trust-badges trust-badges--" + b.template.escapeHtml(placement) +
+             "\" aria-label=\"Trust badges\">" + parts.join("") + "</section>";
+    } catch (_e) {
+      return "";   // drop-silent — supplementary; never 500 the page
+    }
+  }
+
   // ---- multi-currency display -------------------------------------------
   //
   // Opt-in: wired only when the operator supplies `deps.currencyDisplay`
@@ -10381,6 +10618,54 @@ function mount(router, deps) {
     return (await deps.catalog.batch.searchDecorate({ terms: terms, currency: "USD" })).rows;
   }
 
+  // Operator-tunable rerank of the matched search universe through
+  // searchRanking.applyToResults (pins first, then weighted score DESC).
+  // The decorated rows carry `id` + `in_stock` (bool) + `price_minor` but NOT
+  // `product_id`, which applyToResults requires — project each row with
+  // `product_id: row.id` + a `signals` bag built from the decorated fields.
+  // applyToResults returns rows that preserve every original field plus
+  // product_id/_score/_pinned, so the returned array IS the reranked universe
+  // (the renderer reads its existing fields; the extra keys are inert).
+  //
+  // NEVER-500: ranking is supplementary to search. A missing dep, no active
+  // weight set, a bad/archived weight slug, or any throw → return the
+  // original universe unchanged (drop-silent defensive read). applyToResults
+  // with no active set + no slug is a safe no-op that preserves input order,
+  // so the common "operator hasn't configured ranking" path is inert.
+  //
+  // NOT dual-render — the edge /search (worker/render/search.js) does NOT
+  // rerank. Edge-cached search serves the default order; the container path
+  // serves the ranked order. This deliberate non-parity matches the
+  // synonyms/facets precedent (both container-only at the edge) — search order
+  // is not a price/legal contract, so order differences are acceptable.
+  async function _rerankUniverse(universe, query) {
+    if (!deps.searchRanking || !Array.isArray(universe) || universe.length === 0) {
+      return universe;
+    }
+    try {
+      var projected = universe.map(function (r) {
+        return Object.assign({}, r, {
+          product_id: r.id,
+          signals: {
+            in_stock:  r.in_stock === true,
+            // price_minor is a pass-through integer signal (never divided —
+            // no money arithmetic); a null price contributes nothing.
+            price_minor: (typeof r.price_minor === "number" && isFinite(r.price_minor)) ? r.price_minor : 0,
+          },
+        });
+      });
+      var ranked = await deps.searchRanking.applyToResults({
+        query:   (typeof query === "string" && query.trim().length) ? query : null,
+        results: projected,
+      });
+      return Array.isArray(ranked) && ranked.length === universe.length ? ranked : universe;
+    } catch (_e) {
+      // Bad weight slug, archived set, or any ranking failure → un-ranked
+      // fallback. Never 500 the search page.
+      return universe;
+    }
+  }
+
   router.get("/search", async function (req, res) {
     var url = req.url ? new URL(req.url, "http://localhost") : null;
     var qRaw = url && url.searchParams.get("q");
@@ -10425,6 +10710,12 @@ function mount(router, deps) {
         // in server.js (the searchFacets primitive's `create`, with
         // the DB query handle pre-bound).
         var universe = await _facetableUniverse(terms);
+        // Operator-tunable rerank — applied to the FULL matched universe
+        // BEFORE the facet adapter windows it, so pins + weights reorder
+        // across ALL pages (searchFacets.previewQuery filters in input order
+        // and slices, preserving the reranked order). Container-only; never
+        // 500s the search page (see _rerankUniverse).
+        universe = await _rerankUniverse(universe, q);
         var facetCatalog = {
           // The primitive narrows in-memory and drops the focal facet
           // per option, so the adapter ignores applied_filters and
@@ -10454,6 +10745,8 @@ function mount(router, deps) {
         // matched universe gives the honest total; the page is the
         // windowed slice (the same page size the faceted path uses).
         var flatUniverse = await _facetableUniverse(terms);
+        // Operator-tunable rerank before windowing — full control of order.
+        flatUniverse = await _rerankUniverse(flatUniverse, q);
         totalCount = flatUniverse.length;
         page = _clampPage(page, totalCount, SEARCH_PAGE_SIZE);
         products = flatUniverse.slice((page - 1) * SEARCH_PAGE_SIZE, page * SEARCH_PAGE_SIZE);
@@ -11453,12 +11746,16 @@ function mount(router, deps) {
       // governs every OTHER route. setHeader OVERWRITES the app-level header
       // for this response only.
       res.setHeader && res.setHeader("content-security-policy", securityMiddleware.scopedCsp(["stripe"]));
+      // Operator trust badges at the checkout placement (container-only;
+      // drop-silent → "" on any failure).
+      var payTrustBadges = await _trustBadgesHtml("checkout", req);
       _send(res, 200, renderPayPage({
         order:           o,
         client_secret:   clientSecret,
         publishable_key: pk,
         shop_name:       shopName,
         theme:           theme,
+        trust_badges_html: payTrustBadges,
       }));
     });
 
@@ -11570,11 +11867,15 @@ function mount(router, deps) {
         } catch (_e) { ratingRow = null; ratingEligible = false; }
       }
       var ordUrl = req.url ? new URL(req.url, "http://localhost") : null;
+      // Operator trust badges at the order_confirmation placement (container-
+      // only; drop-silent → "" on any failure).
+      var ordTrustBadges = await _trustBadgesHtml("order_confirmation", req);
       _send(res, 200, renderOrder({
         order:           o,
         product_lookup:  productLookup,
         recommendations: recommendations,
         shipments:       shipments,
+        trust_badges_html: ordTrustBadges,
         rating:          ratingRow,
         rating_eligible: ratingEligible,
         rating_notice:   ordUrl ? _ratingNoticeFor(ordUrl.searchParams.get("rate_err")) : null,
@@ -16081,6 +16382,150 @@ function mount(router, deps) {
     });
   }
 
+  // ---- back-in-stock "Notify me" ------------------------------------------
+  //
+  // The PDP buy box shows a "Notify me when back in stock" form on every
+  // sold-out SKU (dual-rendered, edge-cache-safe). It posts to the distinct
+  // CSRF-exempt action /stock-alert/subscribe (in EDGE_POST_PATHS). Double
+  // opt-in: subscribe writes a pending row + returns a one-time plaintext
+  // token, the confirmation email carries /stock-alert/confirm/<token>, and
+  // the Worker cron sweep emails once when stock returns. Mount only when the
+  // stockAlerts primitive is wired.
+  if (deps.stockAlerts) {
+    // Confirm-link base — SHOP_ORIGIN when present (set into sfDeps as
+    // shop_origin in server.js), else the request Host (the email is best-
+    // effort anyway; a relative path still resolves in a browser).
+    function _stockAlertOrigin(req) {
+      if (typeof deps.shop_origin === "string" && deps.shop_origin) {
+        return deps.shop_origin.replace(/\/$/, "");
+      }
+      var host = req && req.headers && req.headers.host;
+      return host ? "https://" + host : "";
+    }
+
+    router.post("/stock-alert/subscribe", async function (req, res) {
+      var body = req.body || {};
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      try {
+        var result = await deps.stockAlerts.subscribe({
+          email:      body.email,
+          sku:        body.sku,
+          variant_id: (body.variant_id != null && body.variant_id !== "") ? body.variant_id : null,
+        });
+        // Only a brand-new subscription carries a plaintext token. Send the
+        // confirmation email best-effort; a mailer hiccup must not 500 the
+        // form (the row is already written). already-pending / already-
+        // confirmed render the SAME thank-you copy — never reveal prior state.
+        if (result && result.status === "subscribed" && result.confirmation_token && deps.email) {
+          var origin = _stockAlertOrigin(req);
+          var confirmUrl = origin + "/stock-alert/confirm/" + encodeURIComponent(result.confirmation_token);
+          // Resolve the product title for the SKU (cheap indexed read; drop-
+          // silent → fall back to the SKU as the title).
+          var titleForSku = body.sku;
+          try {
+            if (deps.catalog && deps.catalog.products && typeof deps.catalog.products.bySku === "function") {
+              var prodForSku = await deps.catalog.products.bySku(body.sku);
+              if (prodForSku && prodForSku.title) titleForSku = prodForSku.title;
+            }
+          } catch (_e) { /* drop-silent — fall back to the SKU as the title */ }
+          try {
+            await deps.email.sendStockAlertConfirmation({
+              to:            body.email,
+              product_title: titleForSku,
+              sku:           body.sku,
+              confirm_url:   confirmUrl,
+            });
+          } catch (_mailErr) { /* drop-silent — the row is written; the cron still fires on confirm */ }
+        }
+        return _send(res, 200, renderStockAlertThanks({ shop_name: shopName, cart_count: cartCount }));
+      } catch (e) {
+        // TypeError == operator/customer-fault input refusal (bad email / sku
+        // shape) → 400 friendly page; everything else (D1 unreachable) → 500
+        // non-leaking page.
+        var isInputError = e instanceof TypeError;
+        return _send(res, isInputError ? 400 : 500, renderStockAlertError({
+          shop_name:  shopName,
+          cart_count: cartCount,
+          message:    isInputError ? "That doesn't look like a valid email address. Check the format and try again." : null,
+        }));
+      }
+    });
+
+    router.get("/stock-alert/confirm/:token", async function (req, res) {
+      var token = req.params && req.params.token;
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      var outcome;
+      try {
+        var row = await deps.stockAlerts.confirm({ token: token });
+        if (!row) outcome = "invalid";
+        else if (row.notified_at != null) outcome = "already-notified";
+        else outcome = "confirmed";
+      } catch (e) {
+        // A bad-shape token throws TypeError — render the generic non-leaking
+        // "invalid" page rather than a 500 on a public, unauthenticated route.
+        if (e instanceof TypeError) outcome = "invalid";
+        else {
+          _log.error("storefront stock-alert confirm failed", {
+            route: "/stock-alert/confirm", request_id: (req && req.requestId) || null,
+            err: (e && e.message) || String(e),
+          });
+          outcome = "invalid";
+        }
+      }
+      return _send(res, 200, renderStockAlertConfirm({
+        shop_name: shopName, cart_count: cartCount, outcome: outcome,
+      }));
+    });
+
+    // Unsubscribe — by (email, sku, variant) tuple carried in the link query
+    // (stockAlerts has no unsubscribe-token API). GET renders a friendly
+    // confirm page (token-carrying container form); POST consumes it.
+    router.get("/stock-alert/unsubscribe", async function (req, res) {
+      var q = (req.query && typeof req.query === "object") ? req.query : {};
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      return _send(res, 200, renderStockAlertUnsubscribeConfirm({
+        shop_name:  shopName,
+        cart_count: cartCount,
+        email:      typeof q.email === "string" ? q.email : "",
+        sku:        typeof q.sku === "string" ? q.sku : "",
+        variant_id: typeof q.variant_id === "string" ? q.variant_id : "",
+      }));
+    });
+
+    router.post("/stock-alert/unsubscribe", async function (req, res) {
+      var body = req.body || {};
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      var outcome;
+      try {
+        // Idempotent — a missing row returns { removed: false }, which still
+        // reads as "you're unsubscribed" (clicking the link twice is fine).
+        await deps.stockAlerts.unsubscribe({
+          email:      body.email,
+          sku:        body.sku,
+          variant_id: (body.variant_id != null && body.variant_id !== "") ? body.variant_id : null,
+        });
+        outcome = "unsubscribed";
+      } catch (e) {
+        // A bad-shape tuple throws TypeError → generic non-leaking page; a
+        // real fault degrades the same way rather than 500-ing a public route.
+        outcome = "invalid";
+        if (!(e instanceof TypeError)) {
+          _log.error("storefront stock-alert unsubscribe failed", {
+            route: "/stock-alert/unsubscribe", request_id: (req && req.requestId) || null,
+            err: (e && e.message) || String(e),
+          });
+        }
+      }
+      return _send(res, 200, renderStockAlertUnsubscribeResult({
+        shop_name: shopName, cart_count: cartCount, outcome: outcome,
+      }));
+    });
+  }
+
   // ---- cookie consent -----------------------------------------------------
   //
   // GDPR (EU 2016/679 art. 6 + 7) + ePrivacy (2002/58/EC art. 5(3)) opt-in