@blamejs/blamejs-shop 0.3.55 → 0.3.56

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.56 (2026-06-02) — **Opt-in wishlist alert and digest emails, passwordless magic-link sign-in, and a documented list of planned integrations.** Two opt-in capabilities are wired, and the operator docs now state plainly which integrations are planned-but-not-yet-available so nothing reads as silently missing. A customer can opt in to wishlist price-drop and back-in-stock alerts and a periodic wishlist digest; and a passwordless email magic-link offers an account sign-in path alongside passkeys and OAuth. Both stay inert until an operator configures email sending, so a store with no mailer behaves exactly as before. **Added:** *Opt-in wishlist alert and digest emails* — A customer can opt in, from their wishlist, to price-drop and back-in-stock alerts and to a periodic wishlist digest. Scheduled sweeps send them. The feature is off until an operator configures email sending and an email resolver; with no mailer it is a no-op. Digest emails are rendered field-by-field with output escaping. · *Passwordless magic-link sign-in* — When a mailer is configured, a customer can request a single-use, time-limited sign-in link by email, in addition to passkeys and OAuth. The request response is identical whether or not the email matches an account (no account enumeration), and the link establishes a sealed session on use. **Changed:** *Documented planned integrations* — The README and SECURITY docs now list the integrations that are intentionally not yet available — address validation, live chat, web-push notifications, in-console payment-key configuration, an age gate, and per-page promo banners — each with the condition under which it would be built, so operators know what is and isn't supported rather than discovering a gap.
+
 - v0.3.55 (2026-06-02) — **Accessibility: field-level form-error messages and horizontally scrollable admin tables.** Two accessibility improvements. When a storefront form is rejected, the specific field at fault is now marked for assistive technology with an inline error message tied to that input, in addition to the existing summary at the top of the form. And wide tables in the admin console now scroll horizontally inside their own container instead of overflowing the page on a narrow or zoomed viewport. **Fixed:** *Field-level error messages on storefront forms* — When the address, review, product-question, or support-ticket form is rejected, the offending field is now marked aria-invalid with an inline error message associated to it (aria-describedby), so a screen-reader user is taken to the exact field to fix rather than only hearing a top-of-form summary. The server remains the only validator; this only changes how a rejected field is presented. Forms that fail on a whole-form condition continue to show the summary message. · *Admin tables reflow on narrow screens* — Wide data tables in the admin console (orders, products, inventory, and the rest) are now wrapped in a horizontal-scroll container, so columns stay reachable on a smaller laptop window, a split screen, or at high zoom instead of overflowing the layout. Column header semantics are preserved.
 
 - v0.3.54 (2026-06-02) — **In-store pickup, saved payment methods, and gift wrapping at checkout.** Three more built-but-unreachable capabilities are now wired end to end. Operators can offer in-store pickup with managed pickup locations and a fulfilment queue; signed-in customers can save a card and reuse it at checkout; and operators can offer gift wrapping with a per-order gift message. The gift-wrap fee is added as a real cart line so it is included in the charged total. **Added:** *In-store pickup (click and collect)* — Operators can define pickup locations and work a pickup queue in the admin console (filtered by location), and shoppers can choose 'Pick up in store' at checkout. The order page and a new account pickups view show the pickup status. A not-found pickup or location returns a clear not-found rather than a generic error. · *Saved payment methods* — When Stripe is configured, a signed-in customer can save a card via a secure setup flow (loaded through a route-scoped policy and a same-origin script, with no inline script), manage their saved cards under their account, set a default, and reuse a saved card at checkout. A customer can only ever see or change their own saved cards. · *Gift wrapping at checkout* — Operators can define gift-wrap options (with a fee) in the admin console, and shoppers can add a wrap plus a gift message and recipient at checkout. The wrap fee is added as a real cart line, so it is included in the order total and the amount charged — never applied after the charge.

package/README.md

@@ -69,12 +69,12 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/payment.js`** | Payment adapters — **Stripe** (verify webhook HMAC-SHA256 via upstream `b.webhook.verify`, create / retrieve / confirm / cancel PaymentIntent, refund, register / list payment-method domains for Apple/Google Pay) and **PayPal** (`adapter: "paypal"` — OAuth2 client-credentials token, create / capture / get / refund Orders v2, webhook verify via PayPal's verify-webhook-signature API). No `stripe` / `paypal` npm dep — outbound through `b.httpClient` (SSRF-gated, retried, circuit-broken). |
 | **`lib/order.js`** | FSM-driven post-checkout record via upstream `b.fsm`. States: pending → paid → fulfilling → shipped → delivered (+ refunded / cancelled). Every transition appends to `order_transitions`. |
 | **`lib/checkout.js`** | Orchestrator. `quote()` returns priced quote; `confirm()` creates a Stripe PaymentIntent + persists order pending; `handleStripeEvent()` verifies webhook + fires the FSM transition. PayPal path: `createPaypalOrder()` opens a PayPal order + persists pending, `capturePaypalOrder()` captures → paid, `handlePaypalEvent()` is the webhook backstop. All idempotent on re-delivery. |
-| **`lib/email.js`** | Transactional templates — order receipt, ship notification, refund confirmation. Strict `{{var}}` renderer with HTML escape + refusal of unknown / unused placeholders. Composed on `b.mail` (DKIM/SPF/DMARC/BIMI upstream). |
+| **`lib/email.js`** | Transactional templates — order receipt, ship notification, refund confirmation, wishlist price-drop, abandoned-cart, review request, back-in-stock, **wishlist digest** (the periodic saved-items rollup, rendered per-line from the structured digest so every title / price is independently escaped), and **email magic-link sign-in**. Strict `{{var}}` renderer with HTML escape + refusal of unknown / unused placeholders. Composed on `b.mail` (DKIM/SPF/DMARC/BIMI upstream). |
 | **`lib/storefront.js`** | Server-rendered HTML — utility bar + sticky header + dark hero with code-preview card + primitives marquee + featured-product callout + collections grid + framework feature band + designed catalog grid + newsletter band + four-column footer. Designed surfaces also for PDP, cart, checkout, pay, order, account login / register / dashboard, search results, `/admin` API landing, 404. Image-bearing cards on the home + search grids pull from `catalog.media`. The default theme stylesheet is external (R2-served `themes/default/assets/css/main.css`) and CSP-compliant; the typeface (Inter / Inter Tight) is self-hosted from `themes/default/assets/fonts`, so no page loads a cross-origin font. Operators override by uploading a replacement at the same key, by passing `opts.theme_css` to renderers, or by registering a named theme through the `theme` primitive. |
 | **`lib/customers.js`** | Customer accounts — passkey (WebAuthn) + **Sign in with Google / Apple** (OIDC). Email is stored hash-only (`b.crypto.namespaceHash` namespace `customer-email`); the raw address never lands in D1. Passkey credentials carry CBOR-encoded public keys, transport hints, and SHA3-512-fingerprinted attestation. `signInWithOIDC` keys federated accounts on the provider `(provider, subject)` and links an existing account only on a provider-verified email (never on an unverified one). `mintAppleClientSecret` produces Apple's required ES256 client-secret JWT from a Services-ID `.p8` key (the one classical signature the protocol mandates; the PQC default doesn't apply to an external IdP's wire format). Account routes (`/account/login`, `/account/register`, `/account`, `/account/login/google`, `/account/login/apple`) ship as designed cards on the storefront; signed-in customers manage their own passkeys (`/account/passkeys` — list, add another, confirm-gated revoke scoped to the account with a last-sign-in-method guard) and edit their profile (`/account/profile`). |
 | **`lib/reviews.js`** | Operator-moderated product ratings. Submission requires a signed-in customer **and** a verified purchase — `/products/:slug/review` confirms a completed order for the product (via `order.hasPurchasedProduct`) before accepting, re-checked on POST; reviews land `pending`. Author identity is hash-only (`b.crypto.namespaceHash`); the raw email is never stored. The PDP renders the average, per-star distribution, and published reviews with `AggregateRating` JSON-LD. `/admin/reviews` is the moderation queue (`listByStatus` → publish / reject). |
 | **`lib/product-qa.js`** | Customer questions and operator/customer answers per product, operator-moderated, distinct from the rating-based reviews. A signed-in shopper asks at `/products/:slug/question`; questions land `pending` and surface only after approval. Author identity is the customer id (verified against the customers primitive) or a hash-only email — the raw address is never stored. The product page renders approved questions with their approved answers (seller / customer / system badge, pinned 'top answer' first) in both the edge and container paths. `/admin/questions` is the moderation console: the cross-product queue (`listQuestionsByStatus`), and a per-question detail to approve / reject the question, post the seller answer (`submitAnswer`), approve / reject / pin answers. |
-| **`lib/wishlist.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. UUID-shape-validated ids, `b.pagination` HMAC cursors. |
+| **`lib/wishlist.js`** + **`lib/wishlist-alerts.js`** + **`lib/wishlist-digest.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived) and carries a per-customer opt-in panel for **sale + restock alerts** (price-drop / back-in-stock, event-driven) and the **periodic digest** (the saved-items rollup on a weekly / monthly schedule). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. Both notification paths are off by default and require a configured mailer plus an email-address resolver to actually send (the customer store keeps only an email hash) — see *Optional integrations*. UUID-shape-validated ids, `b.pagination` HMAC cursors; prices rendered through `pricing.format` (locale + zero-decimal-currency correct). |
 | **`lib/save-for-later.js`** | Per-customer cart holding list. Each cart line gets a login-gated "Save for later" control (`POST /cart/lines/:id/save` → `moveFromCart`); `/account/saved` lists items with Move-to-cart / Remove. `moveToCart` reprices to the current catalog price and stock-gates (out-of-stock + non-backorderable is refused). Composes `catalog.inventory` + `catalog.prices` + `catalog.variants`. |
 | **`lib/addresses.js`** | Per-customer address book at `/account/addresses` — add / edit / set default shipping or billing / remove. One-default-per-role invariant (promoting clears the prior). Every by-id route confirms the address belongs to the signed-in customer before acting (a guessed id returns 404). `b.guardUuid` ids, 2-char ISO country. |
 | **`lib/returns.js`** | Self-serve RMAs. Customer requests a return against their own order at `/account/orders/:id/return` (items + reason, ownership-checked, lines built from the order's own records) and tracks status at `/account/returns`. Operators work `/admin/returns` — approve (refund amount) / mark received / refund / reject — over the pending → approved → received → refunded FSM; illegal transitions are 409, bad ids 404. |
@@ -198,12 +198,49 @@ variables. A signed-in operator can see the live on/off status of each at
 | **Sign in with Google** | A *Continue with Google* button on `/account/login` (OIDC). | `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, `SHOP_ORIGIN` (e.g. `https://shop.example.com`) | Create a Google Cloud **OAuth 2.0 Web** client; add `<SHOP_ORIGIN>/account/auth/google/callback` as an Authorized redirect URI; consent-screen scopes `openid email profile`. The button appears only when all three are set. |
 | **Sign in with Apple** | A *Continue with Apple* button on `/account/login` (OIDC). | `APPLE_TEAM_ID`, `APPLE_KEY_ID`, `APPLE_CLIENT_ID` (your **Services ID**), `APPLE_PRIVATE_KEY` (the `.p8` key contents), `SHOP_ORIGIN` | Needs an **Apple Developer Program** membership. Create a Services ID, enable Sign in with Apple, add `<SHOP_ORIGIN>/account/auth/apple/callback` as a Return URL, and create a Sign-in-with-Apple key (`.p8`). The shop mints Apple's ES256 client secret from the key at boot (re-minted each deploy, inside Apple's 6-month window). The button appears only when all five are set. |
 | **PayPal checkout** | A native PayPal button on `/checkout` (PayPal Orders v2 — create / approve / capture), distinct from PayPal-through-Stripe. | `PAYPAL_CLIENT_ID`, `PAYPAL_SECRET` (a PayPal REST app), `PAYPAL_WEBHOOK_ID`, `PAYPAL_ENV` (`sandbox`\|`live`); Stripe checkout must also be live | The shop exchanges the OAuth2 token and creates / captures orders server-side; the button drives `/checkout/paypal/create` + `/checkout/paypal/capture`. Point a PayPal webhook at `/api/webhooks/paypal` (verified through PayPal's API). Allow `www.paypal.com` in your CSP `script-src` / `frame-src` (as you would `js.stripe.com`). |
+| **Transactional email (SMTP)** | Order/ship/refund mail, abandoned-cart recovery, back-in-stock alerts, **wishlist sale + restock alerts and the periodic wishlist digest** (opt-in per customer on `/account/wishlist`), and **email magic-link sign-in** (a *Email me a sign-in link* option on `/account/login` for shoppers without a passkey or social login). | `SMTP_HOST`, `MAIL_FROM` (plus optional `SMTP_PORT` / `SMTP_USER` / `SMTP_PASS`) | Without a mailer these surfaces stay inert — the wishlist crons scan nothing, the magic-link page reports email sign-in unavailable, and passkey / social login are unchanged. **Wishlist alerts + digests are additionally gated on an email-address resolver:** the customer store keeps only a salted email *hash* (never the plaintext), so out of the box there is no deliverable address and the crons send nothing even with SMTP set. They begin sending once you supply a resolver that maps a customer id to a deliverable address from your own plaintext-address store — the same hook abandoned-cart recovery uses. |
 
 **Planned / not available:**
 
 - **Shop Pay / "Sign in with Shop"** — **not available** to a self-hosted,
   non-Shopify store: the credentials only issue from a Shopify Admin and payment
   flows through Shopify Payments. There is no path to enable it here.
+- **Address verification at checkout** — the address cache/record layer ships,
+  but no verification provider is bundled (verifying a postal address requires a
+  paid third-party lookup). *Re-opens* when you supply a provider adapter (USPS,
+  Smarty, Lob, Google, Melissa, …); the checkout address step then validates
+  against it. No provider, no behavior change.
+- **Live chat** — a synchronous chat widget is not wired. The strict storefront
+  CSP (`script-src 'self'`, no inline script) means a chat island must be served
+  first-party from the container, and a realtime transport is a deployment-cost
+  decision. *Re-opens* on operator demand: a container-served polling island
+  (poll endpoint, admin queue, idle-session cleanup) is the minimal path;
+  WebSocket is a later upgrade.
+- **Web push notifications** — the device registry + consent matrix + dispatcher
+  ship, and a PWA manifest + service worker are served, but no push subscription
+  endpoint or VAPID send is wired. *Re-opens* once you generate a VAPID keypair
+  (stored as a deployment secret, like the Stripe keys) and enable a subscribe
+  endpoint; a registered service worker is the prerequisite.
+- **Payment keys are deployment secrets, by design** — Stripe / PayPal keys are
+  set as deployment secrets (`STRIPE_API_KEY`, …), **not** entered through the
+  admin console. A console wizard that wrote payment secrets into the database
+  would widen the blast radius (a database dump or a leaked bridge secret would
+  then expose payment keys; deployment secret bindings never sit in the
+  database). This is deliberate and is not planned to change for a single-store
+  deploy; a multi-tenant model with per-tenant operator-self-service keys would
+  be a separate build.
+- **Age-restricted catalogs / age gate** — **not supported.** The catalog has no
+  age-restricted product class and the storefront enforces no age interstitial.
+  *Re-opens* as a real build (a `requires_age_check` product attribute + a
+  server-enforced edge + container interstitial) if an age-restricted category
+  enters the catalog.
+- **Placement-specific promo banners** — the sitewide promo/notice strip is the
+  **announcement bar** (managed at `/admin/announcements`); it is the single
+  source for the top-of-page strip. Additional marketing *placements*
+  (homepage hero, PDP-side, cart-side, empty-search, footer) are a future
+  additive surface. *Re-opens* when you want placement-specific marketing beyond
+  the sitewide strip; the top strip stays the announcement bar's (running two
+  competing sitewide strips is avoided by design).
 
 ## Vendoring blamejs
 

package/SECURITY.md

@@ -198,6 +198,20 @@ node -e "
   emails are stored hash-only (`b.crypto.namespaceHash`), and the
   account leaderboard exposes rank plus initials only, never an email or
   account id.
+- **Email magic-link sign-in is single-use and hashed-at-rest.** The
+  optional *Email me a sign-in link* path (mounts only when a mailer is
+  configured) mints a 256-bit token whose plaintext is emailed once and
+  never persisted — only its `namespaceHash` digest is stored. Redemption
+  re-hashes the submitted token, compares in constant time, and flips the
+  row to `consumed` under a `status = 'issued'` guard, so a token works
+  exactly once (a replayed link bounces to login). Tokens carry a short
+  default lifetime (15 minutes) re-checked at redeem time, and a
+  background tick durably expires stale rows. The request form is not an
+  account-existence oracle: a known and an unknown address return the
+  identical "if an account exists we've emailed a link" confirmation, and
+  an unknown / expired / reused token bounces to login identically. On
+  success the sealed `shop_auth` session cookie is set the same way the
+  passkey and OAuth paths set it; passkey and social login are unchanged.
 - **Privileged actions are recorded and reviewable.** Every mutating
   admin action and every catalog-API error is appended to a
   tamper-evident, hash-chained audit log (the framework's `b.audit`

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.55",
+  "version": "0.3.56",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/email.js

@@ -187,6 +187,75 @@ var ABANDONED_CART_TEXT_AFTER_LINES =
   "{{notes}}\n\n" +
   "Return to cart: {{cart_url}}\n";
 
+// Wishlist digest — the periodic rollup of the customer's saved items
+// (price + in/out-of-stock marker per line). The line set is rendered
+// through the strict renderer once per line so each line's `title` /
+// `price` / `stock` is HTML-escaped independently, then concatenated
+// between the BEFORE/AFTER halves. The structured `lines[]` from
+// composeDigest is the source — the pre-built `digest.html` is NEVER
+// spliced in (that would double-handle escaping); rendering from the
+// structured array keeps the escape-by-default path owning escaping
+// end-to-end (the <script>-in-title XSS guard).
+
+var WISHLIST_DIGEST_HTML_BEFORE_LINES =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your wishlist update</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Your wishlist this period</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Here's where your saved items stand right now:</p>\n" +
+  "  <ul style=\"padding-left:20px;margin:0 0 16px;color:#0d0d0d;\">\n";
+
+var WISHLIST_DIGEST_HTML_LINE =
+  "    <li><a href=\"{{product_url}}\" style=\"color:#fa4f09;\">{{title}}</a> — {{price}}{{stock}}</li>\n";
+
+var WISHLIST_DIGEST_HTML_EMPTY =
+  "    <li>No items in your wishlist right now.</li>\n";
+
+var WISHLIST_DIGEST_HTML_AFTER_LINES =
+  "  </ul>\n" +
+  "  <p style=\"margin:16px 0;color:#0d0d0d;font-size:13px;\">You're receiving this because you opted into the wishlist digest.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var WISHLIST_DIGEST_TEXT_BEFORE_LINES =
+  "Your wishlist this period\n=========================\n\n" +
+  "Here's where your saved items stand right now:\n\n";
+
+var WISHLIST_DIGEST_TEXT_LINE =
+  "  {{title}} — {{price}}{{stock}}\n  {{product_url}}\n";
+
+var WISHLIST_DIGEST_TEXT_EMPTY =
+  "  No items in your wishlist right now.\n";
+
+var WISHLIST_DIGEST_TEXT_AFTER_LINES =
+  "\nYou're receiving this because you opted into the wishlist digest.\n";
+
+// Magic-link sign-in — a single-use, time-limited link a customer
+// follows to sign in without a passkey or password. The `link_url`
+// carries the plaintext portal token; it's HTML-escaped through the
+// strict renderer like every other value (the URL is built server-side
+// but escape-by-default still applies).
+
+var MAGIC_LINK_HTML =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your sign-in link</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Sign in to your account</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Use the button below to sign in. This link works once and expires shortly.</p>\n" +
+  "  <p style=\"margin:24px 0;\"><a href=\"{{link_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Sign in</a></p>\n" +
+  "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If the button doesn't work, paste this link into your browser: {{link_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">If you didn't request this, you can ignore this email — no one can sign in without the link.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var MAGIC_LINK_TEXT =
+  "Sign in to your account\n\n" +
+  "Use this single-use link to sign in (it expires shortly):\n" +
+  "{{link_url}}\n\n" +
+  "If you didn't request this, you can ignore this email.\n";
+
 // Review request — sent ~7 days after ship. Per-product review
 // links use the same before/lines/after split as the abandoned
 // cart so the strict renderer keeps its escape-everything property.
@@ -443,6 +512,96 @@ function create(opts) {
       );
     },
 
+    // Wishlist digest — the periodic rollup of the customer's saved
+    // items. The caller (the wishlistDigest dispatcher) passes the
+    // structured `lines[]` composeDigest built; this renders each line
+    // through the strict renderer once so every `title` / `price` is
+    // HTML-escaped independently, then concatenates between the
+    // BEFORE/AFTER halves. The pre-built `digest.html` / `digest.text`
+    // are accepted by the caller's shape but NEVER spliced in raw —
+    // rendering from the structured array keeps the escape-by-default
+    // path owning escaping end-to-end (the <script>-in-title XSS guard).
+    // `lines` MAY be empty (the "no items" digest); validation is
+    // entry-point tier (throw TypeError so the cron caller's try/catch
+    // drops the row silently).
+    sendWishlistDigest: async function (input) {
+      if (!input) throw new TypeError("email.sendWishlistDigest: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendWishlistDigest: customer_email required");
+      }
+      if (!Array.isArray(input.lines)) {
+        throw new TypeError("email.sendWishlistDigest: lines array required (may be empty)");
+      }
+      var i;
+      for (i = 0; i < input.lines.length; i += 1) {
+        var ln = input.lines[i];
+        if (!ln || typeof ln !== "object") {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "] must be an object");
+        }
+        if (typeof ln.title !== "string" || !ln.title) {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "].title required");
+        }
+      }
+      var htmlLines = "";
+      var textLines = "";
+      if (input.lines.length === 0) {
+        htmlLines = WISHLIST_DIGEST_HTML_EMPTY;
+        textLines = WISHLIST_DIGEST_TEXT_EMPTY;
+      } else {
+        for (i = 0; i < input.lines.length; i += 1) {
+          var line = input.lines[i];
+          // The in/out-of-stock marker is derived here (not trusted from
+          // the caller as raw HTML) so it rides the strict renderer like
+          // every other field.
+          var stockMarker = line.in_stock === true  ? " (in stock)"
+                          : line.in_stock === false ? " (out of stock)"
+                          :                            "";
+          var lineVars = {
+            title:       line.title,
+            price:       line.price == null ? "—" : String(line.price),
+            stock:       stockMarker,
+            product_url: typeof line.product_url === "string" && line.product_url
+              ? line.product_url
+              : "#",
+          };
+          htmlLines += _render(WISHLIST_DIGEST_HTML_LINE, lineVars);
+          textLines += _render(WISHLIST_DIGEST_TEXT_LINE, lineVars);
+        }
+      }
+      var html =
+        WISHLIST_DIGEST_HTML_BEFORE_LINES +
+        htmlLines +
+        WISHLIST_DIGEST_HTML_AFTER_LINES;
+      var text =
+        WISHLIST_DIGEST_TEXT_BEFORE_LINES +
+        textLines +
+        WISHLIST_DIGEST_TEXT_AFTER_LINES;
+      return await _send(
+        input.customer_email,
+        "Your wishlist update",
+        html, text, input.replyTo
+      );
+    },
+
+    // Magic-link sign-in — emails a single-use portal link. The
+    // `link_url` carries the plaintext token; it's escaped through the
+    // strict renderer like every other value. Entry-point tier: throw
+    // TypeError on a bad shape so the caller's try/catch keeps the
+    // surface enumeration-safe (the generic confirmation shows either way).
+    sendMagicLink: async function (input) {
+      if (!input) throw new TypeError("email.sendMagicLink: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendMagicLink: customer_email required");
+      }
+      if (typeof input.link_url !== "string" || !input.link_url) {
+        throw new TypeError("email.sendMagicLink: link_url required");
+      }
+      var vars = { link_url: input.link_url };
+      var html = _render(MAGIC_LINK_HTML, vars);
+      var text = _render(MAGIC_LINK_TEXT, vars);
+      return await _send(input.customer_email, "Your sign-in link", html, text, input.replyTo);
+    },
+
     // Review request — sent ~7 days after ship. Per-product review
     // links are derived from review_base_url + "/" + slug + "/review",
     // then HTML-escaped through the strict renderer with the rest of
@@ -575,6 +734,16 @@ module.exports = {
     ABANDONED_CART_TEXT_BEFORE_LINES: ABANDONED_CART_TEXT_BEFORE_LINES,
     ABANDONED_CART_TEXT_LINE:         ABANDONED_CART_TEXT_LINE,
     ABANDONED_CART_TEXT_AFTER_LINES:  ABANDONED_CART_TEXT_AFTER_LINES,
+    WISHLIST_DIGEST_HTML_BEFORE_LINES: WISHLIST_DIGEST_HTML_BEFORE_LINES,
+    WISHLIST_DIGEST_HTML_LINE:         WISHLIST_DIGEST_HTML_LINE,
+    WISHLIST_DIGEST_HTML_EMPTY:        WISHLIST_DIGEST_HTML_EMPTY,
+    WISHLIST_DIGEST_HTML_AFTER_LINES:  WISHLIST_DIGEST_HTML_AFTER_LINES,
+    WISHLIST_DIGEST_TEXT_BEFORE_LINES: WISHLIST_DIGEST_TEXT_BEFORE_LINES,
+    WISHLIST_DIGEST_TEXT_LINE:         WISHLIST_DIGEST_TEXT_LINE,
+    WISHLIST_DIGEST_TEXT_EMPTY:        WISHLIST_DIGEST_TEXT_EMPTY,
+    WISHLIST_DIGEST_TEXT_AFTER_LINES:  WISHLIST_DIGEST_TEXT_AFTER_LINES,
+    MAGIC_LINK_HTML:                  MAGIC_LINK_HTML,
+    MAGIC_LINK_TEXT:                  MAGIC_LINK_TEXT,
     REVIEW_REQUEST_HTML_BEFORE_LINES: REVIEW_REQUEST_HTML_BEFORE_LINES,
     REVIEW_REQUEST_HTML_LINE:         REVIEW_REQUEST_HTML_LINE,
     REVIEW_REQUEST_HTML_AFTER_LINES:  REVIEW_REQUEST_HTML_AFTER_LINES,

package/lib/storefront.js

@@ -2805,6 +2805,11 @@ function renderWishlist(opts) {
   // sharing primitive isn't wired, or a unit test calling the renderer
   // directly) the panel is empty so the page renders unchanged.
   var sharePanel = opts.share_panel || "";
+  // Alert + digest opt-in panel (server-rendered, no client JS). The
+  // route builds it (it owns the per-trigger / per-schedule prefs reads);
+  // absent it (the alerts/digest primitives aren't wired, or a unit test
+  // calling the renderer directly) the panel is empty.
+  var prefsPanel = opts.prefs_panel || "";
   var body =
     "<section class=\"account-wishlist\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2813,6 +2818,7 @@ function renderWishlist(opts) {
       "</ol></nav>" +
       "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
       notice +
+      prefsPanel +
       sharePanel +
       inner +
     "</section>";
@@ -2898,6 +2904,81 @@ function _wishlistSharePanel(opts) {
          "</section>";
 }
 
+// The wishlist alert + digest opt-in panel (mounts on /account/wishlist
+// when the alerts / digest primitives are wired). Server-rendered, no
+// client JS: each toggle is a `<form method="post">` whose hidden `on`
+// field flips on submit (the submit button carries the new state). The
+// `_csrf` token is injected automatically by the `_wrap` form chokepoint
+// (_injectCsrfFields) like every other container POST form — the panel
+// emits no token itself.
+//
+//   opts.alerts   — [{ trigger, label, subscribed }] (subscribed drives
+//                   the button's on/off action)
+//   opts.digests  — [{ slug, label, enrolled, enrollment_id }]
+//   opts.notice   — "alerts" | "digest" → a saved confirmation
+//
+// Every operator-controlled string (a schedule slug used as a label) is
+// escaped via the storefront `esc()` path.
+var WISHLIST_PREFS_NOTICES = {
+  alerts: "Alert preferences saved.",
+  digest: "Digest subscription updated.",
+};
+function _wishlistPrefsPanel(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var alerts  = opts.alerts  || [];
+  var digests = opts.digests || [];
+  if (alerts.length === 0 && digests.length === 0) return "";
+  var noticeMsg = WISHLIST_PREFS_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+
+  var alertRows = "";
+  for (var i = 0; i < alerts.length; i += 1) {
+    var a = alerts[i];
+    var on = a.subscribed === true;
+    // Submitting flips the state: a subscribed trigger posts on="" (off);
+    // an unsubscribed one posts on="1".
+    alertRows +=
+      "<form class=\"wishlist-prefs__row\" method=\"post\" action=\"/account/wishlist/alerts\">" +
+        "<input type=\"hidden\" name=\"trigger\" value=\"" + esc(a.trigger) + "\">" +
+        "<input type=\"hidden\" name=\"on\" value=\"" + (on ? "" : "1") + "\">" +
+        "<span class=\"wishlist-prefs__label\">" + esc(a.label || a.trigger) + "</span>" +
+        "<span class=\"wishlist-prefs__state\">" + (on ? "On" : "Off") + "</span>" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (on ? "Turn off" : "Turn on") + "</button>" +
+      "</form>";
+  }
+  var alertsBlock = alertRows
+    ? "<h3 class=\"wishlist-prefs__subhead\">Price-drop &amp; back-in-stock alerts</h3>" + alertRows
+    : "";
+
+  var digestRows = "";
+  for (var j = 0; j < digests.length; j += 1) {
+    var d = digests[j];
+    var enrolled = d.enrolled === true;
+    digestRows +=
+      "<form class=\"wishlist-prefs__row\" method=\"post\" action=\"/account/wishlist/digest\">" +
+        "<input type=\"hidden\" name=\"schedule_slug\" value=\"" + esc(d.slug) + "\">" +
+        "<input type=\"hidden\" name=\"on\" value=\"" + (enrolled ? "" : "1") + "\">" +
+        "<span class=\"wishlist-prefs__label\">" + esc(d.label || d.slug) + "</span>" +
+        "<span class=\"wishlist-prefs__state\">" + (enrolled ? "Subscribed" : "Not subscribed") + "</span>" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (enrolled ? "Unsubscribe" : "Subscribe") + "</button>" +
+      "</form>";
+  }
+  var digestBlock = digestRows
+    ? "<h3 class=\"wishlist-prefs__subhead\">Periodic wishlist digest</h3>" + digestRows
+    : "";
+
+  return "<section class=\"wishlist-prefs-panel\" aria-labelledby=\"wishlist-prefs-heading\">" +
+           "<h2 id=\"wishlist-prefs-heading\" class=\"wishlist-prefs-panel__title\">Wishlist notifications</h2>" +
+           "<p class=\"wishlist-prefs-panel__lede\">Choose how you'd like to hear about your saved items. We'll only email you if your store has email delivery configured.</p>" +
+           notice +
+           alertsBlock +
+           digestBlock +
+         "</section>";
+}
+
 // Public, no-auth shared-wishlist page (`GET /wishlist/shared/:token`). It
 // renders ONLY the shared product cards (title, image, link to each PDP) —
 // the owner's identity, the per-entry private notes, and the owner customer
@@ -8602,6 +8683,7 @@ var ACCOUNT_LOGIN_PAGE =
   "      <p id=\"login-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
   "    RAW_LOGIN_OAUTH\n" +
+  "    RAW_LOGIN_MAGIC\n" +
   "    <p class=\"auth-card__alt\">New here? <a href=\"/account/register\">Create an account →</a></p>\n" +
   "  </div>\n" +
   "  RAW_LOGIN_SCRIPT\n" +
@@ -8610,6 +8692,7 @@ var ACCOUNT_LOGIN_PAGE =
 var LOGIN_ERROR_MESSAGES = {
   oauth:           "We couldn't complete that sign-in. Please try again.",
   "email-conflict": "That email already has an account — sign in with your passkey instead.",
+  link:            "That sign-in link is invalid or has expired. Request a fresh one.",
 };
 
 function renderAccountLogin(opts) {
@@ -8630,8 +8713,12 @@ function renderAccountLogin(opts) {
   var errHtml = (opts.error && LOGIN_ERROR_MESSAGES[opts.error])
     ? "<p class=\"auth-form__message auth-form__message--err\">" + b.template.escapeHtml(LOGIN_ERROR_MESSAGES[opts.error]) + "</p>"
     : "";
+  var magicHtml = opts.magic_link_enabled
+    ? "<p class=\"auth-card__alt\"><a href=\"/account/login/link\">Email me a sign-in link instead →</a></p>"
+    : "";
   var body = ACCOUNT_LOGIN_PAGE
     .replace("RAW_LOGIN_OAUTH", oauthHtml)
+    .replace("RAW_LOGIN_MAGIC", magicHtml)
     .replace("RAW_LOGIN_ERROR", errHtml)
     // Login captcha is gated separately (CAPTCHA_GATE_LOGIN): the widget
     // renders only when the operator has a provider active AND opted login
@@ -8648,6 +8735,50 @@ function renderAccountLogin(opts) {
   });
 }
 
+// Magic-link sign-in — a passwordless entry for shoppers without a
+// passkey or a social login. The page is a single email field that POSTs
+// to /account/login/link. The response is always the same enumeration-
+// safe confirmation ("if an account exists, we've emailed a link")
+// regardless of whether the address resolves — no account-existence
+// oracle. Server-rendered, no client JS.
+var ACCOUNT_MAGIC_LINK_PAGE =
+  "<section class=\"auth-page\">\n" +
+  "  <div class=\"auth-card\">\n" +
+  "    <p class=\"eyebrow\">Sign in by email</p>\n" +
+  "    <h1 class=\"auth-card__title\">Email me a sign-in link</h1>\n" +
+  "    <p class=\"auth-card__lede\">No passkey or social login? Enter your email and we'll send a single-use link that signs you in.</p>\n" +
+  "    RAW_MAGIC_LINK_NOTICE\n" +
+  "    <form method=\"post\" action=\"/account/login/link\" class=\"form-stack auth-form\">\n" +
+  "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
+  "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Email me a link</button></div>\n" +
+  "    </form>\n" +
+  "    <p class=\"auth-card__alt\"><a href=\"/account/login\">← Back to sign in</a></p>\n" +
+  "  </div>\n" +
+  "</section>\n";
+
+function renderMagicLinkPage(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  // The post-submit confirmation (sent=1) is the enumeration-safe message
+  // — identical whether or not the address matched an account. The
+  // unconfigured-mailer case carries its own honest notice.
+  var noticeHtml = "";
+  if (opts.sent) {
+    noticeHtml = "<p class=\"form-notice form-notice--ok\" role=\"status\">If an account exists for that email, we've sent a sign-in link. Check your inbox.</p>";
+  } else if (opts.unavailable) {
+    noticeHtml = "<p class=\"auth-form__message auth-form__message--err\">Email sign-in isn't available on this store. Use a passkey or social login instead.</p>";
+  }
+  var body = ACCOUNT_MAGIC_LINK_PAGE.replace("RAW_MAGIC_LINK_NOTICE", noticeHtml);
+  void esc;
+  return _wrap({
+    title:      "Email sign-in",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 var ACCOUNT_REGISTER_PAGE =
   "<section class=\"auth-page\">\n" +
   "  <div class=\"auth-card\">\n" +
@@ -12626,6 +12757,7 @@ function mount(router, deps) {
         cart_count:     cartCount,
         google_enabled: !!deps.oauthGoogle,
         apple_enabled:  !!deps.oauthApple,
+        magic_link_enabled: !!(deps.customerPortal && deps.customerPortalEmail),
         error:          url && url.searchParams.get("error"),
         captcha_kind:        captchaLoginOn ? captchaKind   : null,
         captcha_public_key:  captchaLoginOn ? captchaPubKey : null,
@@ -12645,6 +12777,105 @@ function mount(router, deps) {
       }));
     });
 
+    // ---- magic-link sign-in (passwordless email entry) ------------------
+    //
+    // A minimal passwordless login for shoppers without a passkey or a
+    // social login. Composes the customer-portal primitive: createSession
+    // mints a single-use, hashed-at-rest token; the link is emailed; the
+    // GET redemption verifies (single-use) and sets the sealed shop_auth
+    // cookie. The whole surface mounts only when BOTH the portal primitive
+    // AND a transactional mailer are wired — absent either, /account/login/
+    // link renders an "unavailable" state and passkey / OAuth are unchanged.
+    if (deps.customerPortal && deps.customerPortalEmail) {
+      // GET — the email-entry form.
+      router.get("/account/login/link", async function (req, res) {
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderMagicLinkPage({
+          shop_name:  shopName,
+          cart_count: cartCount,
+          sent:       url ? url.searchParams.get("sent") === "1" : false,
+        }));
+      });
+
+      // POST — resolve the email to a customer, mint a portal session,
+      // email the link. The response is ALWAYS the same enumeration-safe
+      // confirmation (sent=1) regardless of whether the address matched —
+      // no account-existence oracle. A bad-shaped email re-renders the
+      // form. Every send is best-effort: a mailer failure still shows the
+      // generic confirmation (the link simply doesn't arrive).
+      router.post("/account/login/link", async function (req, res) {
+        var body = req.body || {};
+        var emailRaw = typeof body.email === "string" ? body.email : "";
+        var customerId = null;
+        // Resolve the customer by email hash. A malformed address (hashEmail
+        // throws on bad shape) or a no-match both fall through to the
+        // generic confirmation — no oracle.
+        try {
+          var hash = deps.customers.hashEmail(emailRaw);
+          var cust = await deps.customers.byEmailHash(hash);
+          if (cust && cust.id) customerId = cust.id;
+        } catch (_e) { customerId = null; }
+
+        if (customerId) {
+          try {
+            var minted = await deps.customerPortal.createSession({
+              customer_id: customerId,
+              scope:       "full",
+            });
+            // Build the absolute redemption link from this request's origin.
+            var origin = "";
+            try { origin = new URL(_requestUrls(req).canonical_url).origin; }
+            catch (_e2) { origin = ""; }
+            var linkUrl = origin + "/account/portal/" + encodeURIComponent(minted.plaintext_token);
+            // The customer's plaintext address: the portal flow needs a
+            // deliverable address. The customers store keeps only the hash,
+            // so reuse the submitted address (the customer just typed it);
+            // the email handle validates the address shape.
+            await deps.customerPortalEmail.sendMagicLink({
+              customer_email: emailRaw,
+              link_url:       linkUrl,
+            });
+          } catch (_e3) { /* drop-silent — generic confirmation regardless */ }
+        }
+        // 303 to the GET with the generic confirmation flag.
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/login/link?sent=1");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET — redeem the magic-link token. verifyToken is single-use (flips
+      // the row to consumed) and re-checks expiry; on success set the sealed
+      // shop_auth cookie + 303 to /account. An unknown / expired / already-
+      // used token bounces to login with a soft error (no oracle on why).
+      router.get("/account/portal/:token", async function (req, res) {
+        var token = (req.params && req.params.token) || "";
+        var rv = null;
+        try { rv = await deps.customerPortal.verifyToken(token); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          rv = null;
+        }
+        if (!rv || !rv.customer_id) {
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/account/login?error=link");
+          return res.end ? res.end() : res.send("");
+        }
+        // Adopt the guest cart into the now-authenticated account, mirroring
+        // the OAuth / passkey login paths.
+        var sid = _readSidCookie(req);
+        if (sid) {
+          try {
+            var anonCart = await deps.cart.bySession(sid);
+            if (anonCart) await deps.cart.setCustomer(anonCart.id, rv.customer_id);
+          } catch (_e) { /* best-effort merge; sign-in itself succeeds */ }
+        }
+        _setAuthCookie(req, res, { customer_id: rv.customer_id, exp: Date.now() + b.constants.TIME.days(14) });
+        res.status(303); res.setHeader && res.setHeader("location", "/account");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
@@ -13754,15 +13985,152 @@ function mount(router, deps) {
             notice: wlUrl ? wlUrl.searchParams.get("share") : null,
           });
         }
+        // Alert + digest opt-in panel — only when those primitives are
+        // wired (a mailer-configured deploy). The current per-trigger
+        // opt-out + per-schedule enrollment state drives each toggle's
+        // checked/unchecked render. A reads failure degrades to no panel
+        // rather than 500-ing the page.
+        var prefsPanel = await _buildWishlistPrefsPanel(
+          auth.customer_id,
+          wlUrl ? wlUrl.searchParams.get("prefs") : null,
+        );
         _send(res, 200, renderWishlist({
           items:        items,
           notice:       wlUrl ? wlUrl.searchParams.get("ok") : null,
+          prefs_panel:  prefsPanel,
           share_panel:  sharePanel,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
         }));
       });
+
+      // Build the alert + digest opt-in panel for a signed-in customer.
+      // Reads the current per-trigger opt-out state (isUnsubscribedFrom
+      // Trigger, now exported) for each scannable alert trigger, and the
+      // active-enrollment state per live digest schedule. Each read is
+      // best-effort: a missing table / read error drops that section
+      // rather than throwing. Returns "" when neither primitive is wired.
+      async function _buildWishlistPrefsPanel(customerId, notice) {
+        var alerts  = [];
+        var digests = [];
+        if (deps.wishlistAlerts) {
+          var ALERT_TRIGGERS = [
+            { trigger: "price_drop",    label: "Email me when a saved item drops in price" },
+            { trigger: "back_in_stock", label: "Email me when a saved item is back in stock" },
+          ];
+          for (var i = 0; i < ALERT_TRIGGERS.length; i += 1) {
+            var t = ALERT_TRIGGERS[i];
+            var unsub = true;
+            try { unsub = await deps.wishlistAlerts.isUnsubscribedFromTrigger(customerId, t.trigger); }
+            catch (_e) { unsub = false; }
+            alerts.push({ trigger: t.trigger, label: t.label, subscribed: !unsub });
+          }
+        }
+        if (deps.wishlistDigest) {
+          var schedules = [];
+          try { schedules = await deps.wishlistDigest.listSchedules({ active_only: true }); }
+          catch (_e) { schedules = []; }
+          var enrollments = [];
+          try { enrollments = await deps.wishlistDigest.enrollmentsForCustomer(customerId); }
+          catch (_e) { enrollments = []; }
+          var activeBySlug = {};
+          for (var k = 0; k < enrollments.length; k += 1) {
+            var en = enrollments[k];
+            if (en.status === "active") activeBySlug[en.schedule_slug] = en.id;
+          }
+          for (var s = 0; s < schedules.length; s += 1) {
+            var sch = schedules[s];
+            var label = (sch.frequency === "weekly" ? "Weekly" : "Monthly") +
+                        " digest (" + sch.slug + ")";
+            digests.push({
+              slug:          sch.slug,
+              label:         label,
+              enrolled:      Object.prototype.hasOwnProperty.call(activeBySlug, sch.slug),
+              enrollment_id: activeBySlug[sch.slug] || null,
+            });
+          }
+        }
+        return _wishlistPrefsPanel({ alerts: alerts, digests: digests, notice: notice });
+      }
+
+      // POST /account/wishlist/alerts — flip a per-trigger alert opt-out.
+      // Body { trigger, on }: a falsey `on` unsubscribes (insert opt-out
+      // row); a truthy `on` re-subscribes (delete the opt-out row). Gated
+      // on the session customer; CSRF rides the container form chokepoint.
+      if (deps.wishlistAlerts) {
+        router.post("/account/wishlist/alerts", async function (req, res) {
+          var auth;
+          try { auth = _currentCustomer(req); }
+          catch (e) {
+            if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+            throw e;
+          }
+          if (!auth) {
+            res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+            return res.end ? res.end() : res.send("");
+          }
+          var body = req.body || {};
+          var trigger = body.trigger;
+          var on = body.on === "1" || body.on === "on" || body.on === true;
+          try {
+            if (on) {
+              await deps.wishlistAlerts.resubscribeToAlertKind({ customer_id: auth.customer_id, trigger: trigger });
+            } else {
+              await deps.wishlistAlerts.unsubscribeFromAlertKind({ customer_id: auth.customer_id, trigger: trigger });
+            }
+          } catch (e) {
+            res.status(e instanceof TypeError ? 400 : 500);
+            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          }
+          res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=alerts");
+          return res.end ? res.end() : res.send("");
+        });
+      }
+
+      // POST /account/wishlist/digest — enroll / pause a digest schedule.
+      // Body { schedule_slug, on }: a truthy `on` enrolls; a falsey `on`
+      // pauses the active enrollment for that slug (looked up via
+      // enrollmentsForCustomer). Gated on the session customer.
+      if (deps.wishlistDigest) {
+        router.post("/account/wishlist/digest", async function (req, res) {
+          var auth;
+          try { auth = _currentCustomer(req); }
+          catch (e) {
+            if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+            throw e;
+          }
+          if (!auth) {
+            res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+            return res.end ? res.end() : res.send("");
+          }
+          var body = req.body || {};
+          var scheduleSlug = body.schedule_slug;
+          var on = body.on === "1" || body.on === "on" || body.on === true;
+          try {
+            if (on) {
+              await deps.wishlistDigest.enrollCustomer({ customer_id: auth.customer_id, schedule_slug: scheduleSlug });
+            } else {
+              // Find the active enrollment for this slug and pause it.
+              var enrollments = await deps.wishlistDigest.enrollmentsForCustomer(auth.customer_id);
+              var target = null;
+              for (var i = 0; i < enrollments.length; i += 1) {
+                if (enrollments[i].schedule_slug === scheduleSlug && enrollments[i].status === "active") {
+                  target = enrollments[i]; break;
+                }
+              }
+              if (target) {
+                await deps.wishlistDigest.pauseEnrollment({ enrollment_id: target.id, reason: "customer opted out" });
+              }
+            }
+          } catch (e) {
+            res.status(e instanceof TypeError ? 400 : 500);
+            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          }
+          res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=digest");
+          return res.end ? res.end() : res.send("");
+        });
+      }
     }
 
     // ---- wishlist sharing -----------------------------------------------

package/lib/wishlist-alerts.js

@@ -404,6 +404,26 @@ function create(opts) {
     return r.rows.length > 0;
   }
 
+  // Customer re-opt-in lever — the inverse of unsubscribeFromAlertKind.
+  // DELETEs the (customer_id, trigger) opt-out row so the dispatcher
+  // resumes firing that trigger for the customer. Idempotent: deleting a
+  // row that isn't there returns `{ status: "already-subscribed" }`.
+  // Same input validation as the unsubscribe verb (UUID-shape customer,
+  // enum trigger) so a bad caller fails with a typed error the route
+  // turns into HTTP 400.
+  async function resubscribeToAlertKind(input) {
+    if (!input || typeof input !== "object") {
+      throw new TypeError("wishlistAlerts.resubscribeToAlertKind: input object required");
+    }
+    var customerId = _uuid(input.customer_id, "customer_id");
+    var trigger    = _trigger(input.trigger);
+    var r = await query(
+      "DELETE FROM wishlist_alert_unsubscribes WHERE customer_id = ?1 AND trigger = ?2",
+      [customerId, trigger],
+    );
+    return { status: Number(r.rowCount || 0) > 0 ? "resubscribed" : "already-subscribed" };
+  }
+
   // ---- ledger reads -----------------------------------------------------
 
   async function customerAlertHistory(input) {
@@ -830,6 +850,8 @@ function create(opts) {
     markAlertSent:            markAlertSent,
     customerAlertHistory:     customerAlertHistory,
     unsubscribeFromAlertKind: unsubscribeFromAlertKind,
+    resubscribeToAlertKind:   resubscribeToAlertKind,
+    isUnsubscribedFromTrigger: isUnsubscribedFromTrigger,
     metricsForPolicy:         metricsForPolicy,
   };
 }

package/lib/wishlist-digest.js

@@ -622,6 +622,23 @@ function create(opts) {
     return _shapeSchedule(await _getScheduleBySlug(slug));
   }
 
+  // List the defined schedules, newest-first by created_at. With
+  // `active_only` (default) only non-archived schedules are returned —
+  // the customer-portal toggle renders a digest opt-in per LIVE schedule
+  // slug; the admin console passes `active_only: false` to show archived
+  // rows too. Pure read; no writes.
+  async function listSchedules(listOpts) {
+    listOpts = listOpts || {};
+    var activeOnly = listOpts.active_only !== false;
+    var sql = "SELECT * FROM wishlist_digest_schedules ";
+    if (activeOnly) sql += "WHERE archived_at IS NULL ";
+    sql += "ORDER BY created_at DESC, slug ASC LIMIT ?1";
+    var r = await query(sql, [MAX_LIMIT]);
+    var out = [];
+    for (var i = 0; i < r.rows.length; i += 1) out.push(_shapeSchedule(r.rows[i]));
+    return out;
+  }
+
   // ---- enrollCustomer ----------------------------------------------
 
   async function enrollCustomer(input) {
@@ -1056,6 +1073,7 @@ function create(opts) {
 
     defineSchedule:        defineSchedule,
     getSchedule:           getSchedule,
+    listSchedules:         listSchedules,
     enrollCustomer:        enrollCustomer,
     pauseEnrollment:       pauseEnrollment,
     resumeEnrollment:      resumeEnrollment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.55",
+  "version": "0.3.56",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {