@blamejs/blamejs-shop 0.3.55 → 0.3.57

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.57 (2026-06-02) — **Vendored blamejs framework refreshed from v0.14.16 to v0.14.19.** The storefront runs on a vendored copy of the blamejs framework. This refreshes it across three upstream patch releases (v0.14.16 to v0.14.19), picking up framework fixes and hardening. The most operator-relevant is a PKCE-downgrade defense in the OAuth/OIDC client, which the storefront composes for Sign in with Google and Apple, so the federated sign-in flow inherits it. The remaining upstream changes are in framework areas the storefront does not expose (archive writing, SCIM, verifiable-credential issuance, SPF/DMARC tooling, OpenAPI), and the storefront's own behavior is unchanged — verified by the full test suite and the vendored-tree integrity gate against the new tree. **Changed:** *Updated the vendored framework to blamejs v0.14.19* — The vendored framework moves from v0.14.16 to v0.14.19 (three upstream patch releases of fixes and additive, opt-in changes). Notably, the OAuth/OIDC client now refuses an identity provider that advertises PKCE methods without S256 — a stripped-S256 downgrade defense — which hardens the storefront's Sign in with Google and Apple. The integrity manifest over the vendored tree was re-stamped as part of the refresh.
+
+- v0.3.56 (2026-06-02) — **Opt-in wishlist alert and digest emails, passwordless magic-link sign-in, and a documented list of planned integrations.** Two opt-in capabilities are wired, and the operator docs now state plainly which integrations are planned-but-not-yet-available so nothing reads as silently missing. A customer can opt in to wishlist price-drop and back-in-stock alerts and a periodic wishlist digest; and a passwordless email magic-link offers an account sign-in path alongside passkeys and OAuth. Both stay inert until an operator configures email sending, so a store with no mailer behaves exactly as before. **Added:** *Opt-in wishlist alert and digest emails* — A customer can opt in, from their wishlist, to price-drop and back-in-stock alerts and to a periodic wishlist digest. Scheduled sweeps send them. The feature is off until an operator configures email sending and an email resolver; with no mailer it is a no-op. Digest emails are rendered field-by-field with output escaping. · *Passwordless magic-link sign-in* — When a mailer is configured, a customer can request a single-use, time-limited sign-in link by email, in addition to passkeys and OAuth. The request response is identical whether or not the email matches an account (no account enumeration), and the link establishes a sealed session on use. **Changed:** *Documented planned integrations* — The README and SECURITY docs now list the integrations that are intentionally not yet available — address validation, live chat, web-push notifications, in-console payment-key configuration, an age gate, and per-page promo banners — each with the condition under which it would be built, so operators know what is and isn't supported rather than discovering a gap.
+
 - v0.3.55 (2026-06-02) — **Accessibility: field-level form-error messages and horizontally scrollable admin tables.** Two accessibility improvements. When a storefront form is rejected, the specific field at fault is now marked for assistive technology with an inline error message tied to that input, in addition to the existing summary at the top of the form. And wide tables in the admin console now scroll horizontally inside their own container instead of overflowing the page on a narrow or zoomed viewport. **Fixed:** *Field-level error messages on storefront forms* — When the address, review, product-question, or support-ticket form is rejected, the offending field is now marked aria-invalid with an inline error message associated to it (aria-describedby), so a screen-reader user is taken to the exact field to fix rather than only hearing a top-of-form summary. The server remains the only validator; this only changes how a rejected field is presented. Forms that fail on a whole-form condition continue to show the summary message. · *Admin tables reflow on narrow screens* — Wide data tables in the admin console (orders, products, inventory, and the rest) are now wrapped in a horizontal-scroll container, so columns stay reachable on a smaller laptop window, a split screen, or at high zoom instead of overflowing the layout. Column header semantics are preserved.
 
 - v0.3.54 (2026-06-02) — **In-store pickup, saved payment methods, and gift wrapping at checkout.** Three more built-but-unreachable capabilities are now wired end to end. Operators can offer in-store pickup with managed pickup locations and a fulfilment queue; signed-in customers can save a card and reuse it at checkout; and operators can offer gift wrapping with a per-order gift message. The gift-wrap fee is added as a real cart line so it is included in the charged total. **Added:** *In-store pickup (click and collect)* — Operators can define pickup locations and work a pickup queue in the admin console (filtered by location), and shoppers can choose 'Pick up in store' at checkout. The order page and a new account pickups view show the pickup status. A not-found pickup or location returns a clear not-found rather than a generic error. · *Saved payment methods* — When Stripe is configured, a signed-in customer can save a card via a secure setup flow (loaded through a route-scoped policy and a same-origin script, with no inline script), manage their saved cards under their account, set a default, and reuse a saved card at checkout. A customer can only ever see or change their own saved cards. · *Gift wrapping at checkout* — Operators can define gift-wrap options (with a fee) in the admin console, and shoppers can add a wrap plus a gift message and recipient at checkout. The wrap fee is added as a real cart line, so it is included in the order total and the amount charged — never applied after the charge.

package/README.md

@@ -69,12 +69,12 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/payment.js`** | Payment adapters — **Stripe** (verify webhook HMAC-SHA256 via upstream `b.webhook.verify`, create / retrieve / confirm / cancel PaymentIntent, refund, register / list payment-method domains for Apple/Google Pay) and **PayPal** (`adapter: "paypal"` — OAuth2 client-credentials token, create / capture / get / refund Orders v2, webhook verify via PayPal's verify-webhook-signature API). No `stripe` / `paypal` npm dep — outbound through `b.httpClient` (SSRF-gated, retried, circuit-broken). |
 | **`lib/order.js`** | FSM-driven post-checkout record via upstream `b.fsm`. States: pending → paid → fulfilling → shipped → delivered (+ refunded / cancelled). Every transition appends to `order_transitions`. |
 | **`lib/checkout.js`** | Orchestrator. `quote()` returns priced quote; `confirm()` creates a Stripe PaymentIntent + persists order pending; `handleStripeEvent()` verifies webhook + fires the FSM transition. PayPal path: `createPaypalOrder()` opens a PayPal order + persists pending, `capturePaypalOrder()` captures → paid, `handlePaypalEvent()` is the webhook backstop. All idempotent on re-delivery. |
-| **`lib/email.js`** | Transactional templates — order receipt, ship notification, refund confirmation. Strict `{{var}}` renderer with HTML escape + refusal of unknown / unused placeholders. Composed on `b.mail` (DKIM/SPF/DMARC/BIMI upstream). |
+| **`lib/email.js`** | Transactional templates — order receipt, ship notification, refund confirmation, wishlist price-drop, abandoned-cart, review request, back-in-stock, **wishlist digest** (the periodic saved-items rollup, rendered per-line from the structured digest so every title / price is independently escaped), and **email magic-link sign-in**. Strict `{{var}}` renderer with HTML escape + refusal of unknown / unused placeholders. Composed on `b.mail` (DKIM/SPF/DMARC/BIMI upstream). |
 | **`lib/storefront.js`** | Server-rendered HTML — utility bar + sticky header + dark hero with code-preview card + primitives marquee + featured-product callout + collections grid + framework feature band + designed catalog grid + newsletter band + four-column footer. Designed surfaces also for PDP, cart, checkout, pay, order, account login / register / dashboard, search results, `/admin` API landing, 404. Image-bearing cards on the home + search grids pull from `catalog.media`. The default theme stylesheet is external (R2-served `themes/default/assets/css/main.css`) and CSP-compliant; the typeface (Inter / Inter Tight) is self-hosted from `themes/default/assets/fonts`, so no page loads a cross-origin font. Operators override by uploading a replacement at the same key, by passing `opts.theme_css` to renderers, or by registering a named theme through the `theme` primitive. |
 | **`lib/customers.js`** | Customer accounts — passkey (WebAuthn) + **Sign in with Google / Apple** (OIDC). Email is stored hash-only (`b.crypto.namespaceHash` namespace `customer-email`); the raw address never lands in D1. Passkey credentials carry CBOR-encoded public keys, transport hints, and SHA3-512-fingerprinted attestation. `signInWithOIDC` keys federated accounts on the provider `(provider, subject)` and links an existing account only on a provider-verified email (never on an unverified one). `mintAppleClientSecret` produces Apple's required ES256 client-secret JWT from a Services-ID `.p8` key (the one classical signature the protocol mandates; the PQC default doesn't apply to an external IdP's wire format). Account routes (`/account/login`, `/account/register`, `/account`, `/account/login/google`, `/account/login/apple`) ship as designed cards on the storefront; signed-in customers manage their own passkeys (`/account/passkeys` — list, add another, confirm-gated revoke scoped to the account with a last-sign-in-method guard) and edit their profile (`/account/profile`). |
 | **`lib/reviews.js`** | Operator-moderated product ratings. Submission requires a signed-in customer **and** a verified purchase — `/products/:slug/review` confirms a completed order for the product (via `order.hasPurchasedProduct`) before accepting, re-checked on POST; reviews land `pending`. Author identity is hash-only (`b.crypto.namespaceHash`); the raw email is never stored. The PDP renders the average, per-star distribution, and published reviews with `AggregateRating` JSON-LD. `/admin/reviews` is the moderation queue (`listByStatus` → publish / reject). |
 | **`lib/product-qa.js`** | Customer questions and operator/customer answers per product, operator-moderated, distinct from the rating-based reviews. A signed-in shopper asks at `/products/:slug/question`; questions land `pending` and surface only after approval. Author identity is the customer id (verified against the customers primitive) or a hash-only email — the raw address is never stored. The product page renders approved questions with their approved answers (seller / customer / system badge, pinned 'top answer' first) in both the edge and container paths. `/admin/questions` is the moderation console: the cross-product queue (`listQuestionsByStatus`), and a per-question detail to approve / reject the question, post the seller answer (`submitAnswer`), approve / reject / pin answers. |
-| **`lib/wishlist.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. UUID-shape-validated ids, `b.pagination` HMAC cursors. |
+| **`lib/wishlist.js`** + **`lib/wishlist-alerts.js`** + **`lib/wishlist-digest.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived) and carries a per-customer opt-in panel for **sale + restock alerts** (price-drop / back-in-stock, event-driven) and the **periodic digest** (the saved-items rollup on a weekly / monthly schedule). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. Both notification paths are off by default and require a configured mailer plus an email-address resolver to actually send (the customer store keeps only an email hash) — see *Optional integrations*. UUID-shape-validated ids, `b.pagination` HMAC cursors; prices rendered through `pricing.format` (locale + zero-decimal-currency correct). |
 | **`lib/save-for-later.js`** | Per-customer cart holding list. Each cart line gets a login-gated "Save for later" control (`POST /cart/lines/:id/save` → `moveFromCart`); `/account/saved` lists items with Move-to-cart / Remove. `moveToCart` reprices to the current catalog price and stock-gates (out-of-stock + non-backorderable is refused). Composes `catalog.inventory` + `catalog.prices` + `catalog.variants`. |
 | **`lib/addresses.js`** | Per-customer address book at `/account/addresses` — add / edit / set default shipping or billing / remove. One-default-per-role invariant (promoting clears the prior). Every by-id route confirms the address belongs to the signed-in customer before acting (a guessed id returns 404). `b.guardUuid` ids, 2-char ISO country. |
 | **`lib/returns.js`** | Self-serve RMAs. Customer requests a return against their own order at `/account/orders/:id/return` (items + reason, ownership-checked, lines built from the order's own records) and tracks status at `/account/returns`. Operators work `/admin/returns` — approve (refund amount) / mark received / refund / reject — over the pending → approved → received → refunded FSM; illegal transitions are 409, bad ids 404. |
@@ -198,12 +198,49 @@ variables. A signed-in operator can see the live on/off status of each at
 | **Sign in with Google** | A *Continue with Google* button on `/account/login` (OIDC). | `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, `SHOP_ORIGIN` (e.g. `https://shop.example.com`) | Create a Google Cloud **OAuth 2.0 Web** client; add `<SHOP_ORIGIN>/account/auth/google/callback` as an Authorized redirect URI; consent-screen scopes `openid email profile`. The button appears only when all three are set. |
 | **Sign in with Apple** | A *Continue with Apple* button on `/account/login` (OIDC). | `APPLE_TEAM_ID`, `APPLE_KEY_ID`, `APPLE_CLIENT_ID` (your **Services ID**), `APPLE_PRIVATE_KEY` (the `.p8` key contents), `SHOP_ORIGIN` | Needs an **Apple Developer Program** membership. Create a Services ID, enable Sign in with Apple, add `<SHOP_ORIGIN>/account/auth/apple/callback` as a Return URL, and create a Sign-in-with-Apple key (`.p8`). The shop mints Apple's ES256 client secret from the key at boot (re-minted each deploy, inside Apple's 6-month window). The button appears only when all five are set. |
 | **PayPal checkout** | A native PayPal button on `/checkout` (PayPal Orders v2 — create / approve / capture), distinct from PayPal-through-Stripe. | `PAYPAL_CLIENT_ID`, `PAYPAL_SECRET` (a PayPal REST app), `PAYPAL_WEBHOOK_ID`, `PAYPAL_ENV` (`sandbox`\|`live`); Stripe checkout must also be live | The shop exchanges the OAuth2 token and creates / captures orders server-side; the button drives `/checkout/paypal/create` + `/checkout/paypal/capture`. Point a PayPal webhook at `/api/webhooks/paypal` (verified through PayPal's API). Allow `www.paypal.com` in your CSP `script-src` / `frame-src` (as you would `js.stripe.com`). |
+| **Transactional email (SMTP)** | Order/ship/refund mail, abandoned-cart recovery, back-in-stock alerts, **wishlist sale + restock alerts and the periodic wishlist digest** (opt-in per customer on `/account/wishlist`), and **email magic-link sign-in** (a *Email me a sign-in link* option on `/account/login` for shoppers without a passkey or social login). | `SMTP_HOST`, `MAIL_FROM` (plus optional `SMTP_PORT` / `SMTP_USER` / `SMTP_PASS`) | Without a mailer these surfaces stay inert — the wishlist crons scan nothing, the magic-link page reports email sign-in unavailable, and passkey / social login are unchanged. **Wishlist alerts + digests are additionally gated on an email-address resolver:** the customer store keeps only a salted email *hash* (never the plaintext), so out of the box there is no deliverable address and the crons send nothing even with SMTP set. They begin sending once you supply a resolver that maps a customer id to a deliverable address from your own plaintext-address store — the same hook abandoned-cart recovery uses. |
 
 **Planned / not available:**
 
 - **Shop Pay / "Sign in with Shop"** — **not available** to a self-hosted,
   non-Shopify store: the credentials only issue from a Shopify Admin and payment
   flows through Shopify Payments. There is no path to enable it here.
+- **Address verification at checkout** — the address cache/record layer ships,
+  but no verification provider is bundled (verifying a postal address requires a
+  paid third-party lookup). *Re-opens* when you supply a provider adapter (USPS,
+  Smarty, Lob, Google, Melissa, …); the checkout address step then validates
+  against it. No provider, no behavior change.
+- **Live chat** — a synchronous chat widget is not wired. The strict storefront
+  CSP (`script-src 'self'`, no inline script) means a chat island must be served
+  first-party from the container, and a realtime transport is a deployment-cost
+  decision. *Re-opens* on operator demand: a container-served polling island
+  (poll endpoint, admin queue, idle-session cleanup) is the minimal path;
+  WebSocket is a later upgrade.
+- **Web push notifications** — the device registry + consent matrix + dispatcher
+  ship, and a PWA manifest + service worker are served, but no push subscription
+  endpoint or VAPID send is wired. *Re-opens* once you generate a VAPID keypair
+  (stored as a deployment secret, like the Stripe keys) and enable a subscribe
+  endpoint; a registered service worker is the prerequisite.
+- **Payment keys are deployment secrets, by design** — Stripe / PayPal keys are
+  set as deployment secrets (`STRIPE_API_KEY`, …), **not** entered through the
+  admin console. A console wizard that wrote payment secrets into the database
+  would widen the blast radius (a database dump or a leaked bridge secret would
+  then expose payment keys; deployment secret bindings never sit in the
+  database). This is deliberate and is not planned to change for a single-store
+  deploy; a multi-tenant model with per-tenant operator-self-service keys would
+  be a separate build.
+- **Age-restricted catalogs / age gate** — **not supported.** The catalog has no
+  age-restricted product class and the storefront enforces no age interstitial.
+  *Re-opens* as a real build (a `requires_age_check` product attribute + a
+  server-enforced edge + container interstitial) if an age-restricted category
+  enters the catalog.
+- **Placement-specific promo banners** — the sitewide promo/notice strip is the
+  **announcement bar** (managed at `/admin/announcements`); it is the single
+  source for the top-of-page strip. Additional marketing *placements*
+  (homepage hero, PDP-side, cart-side, empty-search, footer) are a future
+  additive surface. *Re-opens* when you want placement-specific marketing beyond
+  the sitewide strip; the top strip stays the announcement bar's (running two
+  competing sitewide strips is avoided by design).
 
 ## Vendoring blamejs
 

package/SECURITY.md

@@ -198,6 +198,20 @@ node -e "
   emails are stored hash-only (`b.crypto.namespaceHash`), and the
   account leaderboard exposes rank plus initials only, never an email or
   account id.
+- **Email magic-link sign-in is single-use and hashed-at-rest.** The
+  optional *Email me a sign-in link* path (mounts only when a mailer is
+  configured) mints a 256-bit token whose plaintext is emailed once and
+  never persisted — only its `namespaceHash` digest is stored. Redemption
+  re-hashes the submitted token, compares in constant time, and flips the
+  row to `consumed` under a `status = 'issued'` guard, so a token works
+  exactly once (a replayed link bounces to login). Tokens carry a short
+  default lifetime (15 minutes) re-checked at redeem time, and a
+  background tick durably expires stale rows. The request form is not an
+  account-existence oracle: a known and an unknown address return the
+  identical "if an account exists we've emailed a link" confirmation, and
+  an unknown / expired / reused token bounces to login identically. On
+  success the sealed `shop_auth` session cookie is set the same way the
+  passkey and OAuth paths set it; passkey and social login are unchanged.
 - **Privileged actions are recorded and reviewable.** Every mutating
   admin action and every catalog-API error is appended to a
   tamper-evident, hash-chained audit log (the framework's `b.audit`

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.55",
+  "version": "0.3.57",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/email.js

@@ -187,6 +187,75 @@ var ABANDONED_CART_TEXT_AFTER_LINES =
   "{{notes}}\n\n" +
   "Return to cart: {{cart_url}}\n";
 
+// Wishlist digest — the periodic rollup of the customer's saved items
+// (price + in/out-of-stock marker per line). The line set is rendered
+// through the strict renderer once per line so each line's `title` /
+// `price` / `stock` is HTML-escaped independently, then concatenated
+// between the BEFORE/AFTER halves. The structured `lines[]` from
+// composeDigest is the source — the pre-built `digest.html` is NEVER
+// spliced in (that would double-handle escaping); rendering from the
+// structured array keeps the escape-by-default path owning escaping
+// end-to-end (the <script>-in-title XSS guard).
+
+var WISHLIST_DIGEST_HTML_BEFORE_LINES =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your wishlist update</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Your wishlist this period</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Here's where your saved items stand right now:</p>\n" +
+  "  <ul style=\"padding-left:20px;margin:0 0 16px;color:#0d0d0d;\">\n";
+
+var WISHLIST_DIGEST_HTML_LINE =
+  "    <li><a href=\"{{product_url}}\" style=\"color:#fa4f09;\">{{title}}</a> — {{price}}{{stock}}</li>\n";
+
+var WISHLIST_DIGEST_HTML_EMPTY =
+  "    <li>No items in your wishlist right now.</li>\n";
+
+var WISHLIST_DIGEST_HTML_AFTER_LINES =
+  "  </ul>\n" +
+  "  <p style=\"margin:16px 0;color:#0d0d0d;font-size:13px;\">You're receiving this because you opted into the wishlist digest.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var WISHLIST_DIGEST_TEXT_BEFORE_LINES =
+  "Your wishlist this period\n=========================\n\n" +
+  "Here's where your saved items stand right now:\n\n";
+
+var WISHLIST_DIGEST_TEXT_LINE =
+  "  {{title}} — {{price}}{{stock}}\n  {{product_url}}\n";
+
+var WISHLIST_DIGEST_TEXT_EMPTY =
+  "  No items in your wishlist right now.\n";
+
+var WISHLIST_DIGEST_TEXT_AFTER_LINES =
+  "\nYou're receiving this because you opted into the wishlist digest.\n";
+
+// Magic-link sign-in — a single-use, time-limited link a customer
+// follows to sign in without a passkey or password. The `link_url`
+// carries the plaintext portal token; it's HTML-escaped through the
+// strict renderer like every other value (the URL is built server-side
+// but escape-by-default still applies).
+
+var MAGIC_LINK_HTML =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your sign-in link</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Sign in to your account</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Use the button below to sign in. This link works once and expires shortly.</p>\n" +
+  "  <p style=\"margin:24px 0;\"><a href=\"{{link_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Sign in</a></p>\n" +
+  "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If the button doesn't work, paste this link into your browser: {{link_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">If you didn't request this, you can ignore this email — no one can sign in without the link.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var MAGIC_LINK_TEXT =
+  "Sign in to your account\n\n" +
+  "Use this single-use link to sign in (it expires shortly):\n" +
+  "{{link_url}}\n\n" +
+  "If you didn't request this, you can ignore this email.\n";
+
 // Review request — sent ~7 days after ship. Per-product review
 // links use the same before/lines/after split as the abandoned
 // cart so the strict renderer keeps its escape-everything property.
@@ -443,6 +512,96 @@ function create(opts) {
       );
     },
 
+    // Wishlist digest — the periodic rollup of the customer's saved
+    // items. The caller (the wishlistDigest dispatcher) passes the
+    // structured `lines[]` composeDigest built; this renders each line
+    // through the strict renderer once so every `title` / `price` is
+    // HTML-escaped independently, then concatenates between the
+    // BEFORE/AFTER halves. The pre-built `digest.html` / `digest.text`
+    // are accepted by the caller's shape but NEVER spliced in raw —
+    // rendering from the structured array keeps the escape-by-default
+    // path owning escaping end-to-end (the <script>-in-title XSS guard).
+    // `lines` MAY be empty (the "no items" digest); validation is
+    // entry-point tier (throw TypeError so the cron caller's try/catch
+    // drops the row silently).
+    sendWishlistDigest: async function (input) {
+      if (!input) throw new TypeError("email.sendWishlistDigest: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendWishlistDigest: customer_email required");
+      }
+      if (!Array.isArray(input.lines)) {
+        throw new TypeError("email.sendWishlistDigest: lines array required (may be empty)");
+      }
+      var i;
+      for (i = 0; i < input.lines.length; i += 1) {
+        var ln = input.lines[i];
+        if (!ln || typeof ln !== "object") {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "] must be an object");
+        }
+        if (typeof ln.title !== "string" || !ln.title) {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "].title required");
+        }
+      }
+      var htmlLines = "";
+      var textLines = "";
+      if (input.lines.length === 0) {
+        htmlLines = WISHLIST_DIGEST_HTML_EMPTY;
+        textLines = WISHLIST_DIGEST_TEXT_EMPTY;
+      } else {
+        for (i = 0; i < input.lines.length; i += 1) {
+          var line = input.lines[i];
+          // The in/out-of-stock marker is derived here (not trusted from
+          // the caller as raw HTML) so it rides the strict renderer like
+          // every other field.
+          var stockMarker = line.in_stock === true  ? " (in stock)"
+                          : line.in_stock === false ? " (out of stock)"
+                          :                            "";
+          var lineVars = {
+            title:       line.title,
+            price:       line.price == null ? "—" : String(line.price),
+            stock:       stockMarker,
+            product_url: typeof line.product_url === "string" && line.product_url
+              ? line.product_url
+              : "#",
+          };
+          htmlLines += _render(WISHLIST_DIGEST_HTML_LINE, lineVars);
+          textLines += _render(WISHLIST_DIGEST_TEXT_LINE, lineVars);
+        }
+      }
+      var html =
+        WISHLIST_DIGEST_HTML_BEFORE_LINES +
+        htmlLines +
+        WISHLIST_DIGEST_HTML_AFTER_LINES;
+      var text =
+        WISHLIST_DIGEST_TEXT_BEFORE_LINES +
+        textLines +
+        WISHLIST_DIGEST_TEXT_AFTER_LINES;
+      return await _send(
+        input.customer_email,
+        "Your wishlist update",
+        html, text, input.replyTo
+      );
+    },
+
+    // Magic-link sign-in — emails a single-use portal link. The
+    // `link_url` carries the plaintext token; it's escaped through the
+    // strict renderer like every other value. Entry-point tier: throw
+    // TypeError on a bad shape so the caller's try/catch keeps the
+    // surface enumeration-safe (the generic confirmation shows either way).
+    sendMagicLink: async function (input) {
+      if (!input) throw new TypeError("email.sendMagicLink: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendMagicLink: customer_email required");
+      }
+      if (typeof input.link_url !== "string" || !input.link_url) {
+        throw new TypeError("email.sendMagicLink: link_url required");
+      }
+      var vars = { link_url: input.link_url };
+      var html = _render(MAGIC_LINK_HTML, vars);
+      var text = _render(MAGIC_LINK_TEXT, vars);
+      return await _send(input.customer_email, "Your sign-in link", html, text, input.replyTo);
+    },
+
     // Review request — sent ~7 days after ship. Per-product review
     // links are derived from review_base_url + "/" + slug + "/review",
     // then HTML-escaped through the strict renderer with the rest of
@@ -575,6 +734,16 @@ module.exports = {
     ABANDONED_CART_TEXT_BEFORE_LINES: ABANDONED_CART_TEXT_BEFORE_LINES,
     ABANDONED_CART_TEXT_LINE:         ABANDONED_CART_TEXT_LINE,
     ABANDONED_CART_TEXT_AFTER_LINES:  ABANDONED_CART_TEXT_AFTER_LINES,
+    WISHLIST_DIGEST_HTML_BEFORE_LINES: WISHLIST_DIGEST_HTML_BEFORE_LINES,
+    WISHLIST_DIGEST_HTML_LINE:         WISHLIST_DIGEST_HTML_LINE,
+    WISHLIST_DIGEST_HTML_EMPTY:        WISHLIST_DIGEST_HTML_EMPTY,
+    WISHLIST_DIGEST_HTML_AFTER_LINES:  WISHLIST_DIGEST_HTML_AFTER_LINES,
+    WISHLIST_DIGEST_TEXT_BEFORE_LINES: WISHLIST_DIGEST_TEXT_BEFORE_LINES,
+    WISHLIST_DIGEST_TEXT_LINE:         WISHLIST_DIGEST_TEXT_LINE,
+    WISHLIST_DIGEST_TEXT_EMPTY:        WISHLIST_DIGEST_TEXT_EMPTY,
+    WISHLIST_DIGEST_TEXT_AFTER_LINES:  WISHLIST_DIGEST_TEXT_AFTER_LINES,
+    MAGIC_LINK_HTML:                  MAGIC_LINK_HTML,
+    MAGIC_LINK_TEXT:                  MAGIC_LINK_TEXT,
     REVIEW_REQUEST_HTML_BEFORE_LINES: REVIEW_REQUEST_HTML_BEFORE_LINES,
     REVIEW_REQUEST_HTML_LINE:         REVIEW_REQUEST_HTML_LINE,
     REVIEW_REQUEST_HTML_AFTER_LINES:  REVIEW_REQUEST_HTML_AFTER_LINES,