@blamejs/blamejs-shop 0.3.58 → 0.3.60

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.60 (2026-06-04) — **Exact integer math for percentage discounts and insurance premiums, and an honest Add-a-card state under partial Stripe configuration.** Every place that computes a percentage of a money amount — automatic percent-off discounts, bundle discounts and their per-line allocation, partial-refund policy amounts, and shipping-insurance premiums — now uses exact integer arithmetic instead of a floating-point intermediate. On very large amounts the float product loses precision past 2^53 and can drift the rounded result by a minor unit; charged totals were never affected (the charge path was already integer end-to-end), but displayed and clamped values now match exact math everywhere, with each site's rounding direction preserved. Separately, the account Payment-methods screen no longer links into a 503 when the Stripe publishable key is missing: the Add-a-card affordance now renders as a disabled control with an explanatory note until the configuration is complete, matching how the unconfigured checkout behaves. **Fixed:** *Percentage-of-amount math is exact integer arithmetic* — Automatic percent-off discounts, bundle discounts, the cart's per-line bundle allocation, partial-refund policy amounts, and shipping-insurance premiums all computed `amount × basis_points / 10000` through a floating-point multiply. Amounts and rates are both integers, so the computation is now exact integer arithmetic with each site's rounding direction unchanged — half-away-from-zero for discounts, floor for allocations and refunds, ceiling for insurance premiums (the insurer is never short). The drift was only reachable on very large amounts (products beyond 2^53) and never touched a charged total, which was already integer end-to-end; tests now pin exact results on amounts past the float-precision boundary. · *Add a card renders honestly when Stripe configuration is incomplete* — Saving a card needs the Stripe publishable key in addition to the server-side API keys. With the server keys set but the publishable key missing, the Payment-methods screen rendered a live "Add a card" link that dead-ended on a 503. The link now gates on the same condition the add route enforces: when the publishable key is absent it renders as a disabled control with a note explaining the missing configuration, while listing, choosing a default, and removing saved cards keep working. The route's own 503 remains as defense in depth for a directly typed URL.
+
+- v0.3.59 (2026-06-04) — **Back-in-stock subscribe rate-limited, payment-method metadata in privacy exports, and accessible wishlist alert toggles.** The anonymous back-in-stock "notify me" endpoint sends a confirmation email to the address the request supplies; it now sits in the same tight per-IP rate budget as login, checkout, and the newsletter, closing a victim-addressed email-flooding vector. Privacy (GDPR/CCPA) data exports now include saved-payment-method display metadata — card brand, last four, expiry — which is personal data the export was silently omitting. The wishlist alert and digest toggle buttons gain accessible names that include the alert they control, so a screen reader no longer announces a list of identical "Turn on" buttons. Internal housekeeping rides along: module imports hoisted to file tops, a per-test wall-clock-ceiling helper backing an existing test gate, and stale comments corrected. **Fixed:** *Back-in-stock subscribe joins the tight rate limit* — POST /stock-alert/subscribe is anonymous and sends a double-opt-in confirmation email to the request-supplied address. It previously sat only behind the loose global token bucket, so a script could direct a burst of confirmation emails at an arbitrary victim address — an email-flooding and sender-reputation risk. The route now shares the tight per-IP, per-path budget that already covers login, registration, checkout, gift-card balance, and the newsletter; the integration suite pins the throttle. · *Privacy exports include saved-payment-method metadata* — The subject-access (GDPR/CCPA) export composed every reader except saved payment methods, which was wired to an empty handle — an export silently omitted the card brand, last-four digits, and expiry the shop stores alongside the opaque processor token. The reader now receives the live handle, so a customer's export reflects everything held about them. Only display metadata is stored or exported — never card numbers. · *Wishlist alert toggles are screen-reader distinguishable* — The account wishlist-alerts screen rendered visually identical "Turn on" / "Turn off" / "Subscribe" buttons whose accessible names did not say which alert or digest they control. Each toggle now carries an accessible name that includes its alert label (for example "Turn off Price-drop alerts"), satisfying WCAG 2.4.6 for assistive-technology users walking the button list.
+
 - v0.3.58 (2026-06-04) — **Browser form submissions no longer refused as cross-origin, server-side shipping-address validation, and a repaired checkout layout.** Every navigational form POST served by the container — checkout, magic-link sign-in, product reviews, returns, the account area, and the admin console — was refused with a 403 in real browsers. Pages shipped Referrer-Policy: no-referrer, which makes browsers send Origin: null on same-origin form submissions, and the CSRF gate's origin pre-check refuses a null Origin before the token is read. Both the edge and the container now send Referrer-Policy: same-origin: referrer information still never leaves the site, while same-origin posts carry the real Origin the gate verifies. Cross-site and sandboxed-iframe submissions are still refused. Checkout additionally gains backend shipping-address validation with accessible per-field errors that preserve everything the shopper typed, and the checkout page's layout is repaired — fields fill the form column instead of collapsing to its center, and the gift, store-pickup, and loyalty options render inside the form above the submit button. **Added:** *Server-side shipping-address validation with per-field errors* — The checkout POST validates the shipping address on the backend and, on rejection, re-renders the form with the one bad field marked (aria-invalid plus an adjacent role="alert" message) and every typed value preserved — replacing the previous dead-end error page. Country must be a real ISO 3166-1 alpha-2 code, validated against the platform's Intl region data (no new dependencies). US and Canadian destinations validate the state or province code and the ZIP (12345 or 12345-6789) / postal (A1A 1A1) format, and require street, city, region, and postal — the figures that feed destination tax. Every other country keeps lenient length-bounded checks, so international addresses are never over-validated. Email gains a shape check alongside the existing content-safety gate, and the customer name is length-bounded. Headless callers of checkout.confirm keep the presence-optional contract for digital-only orders; malformed values are now refused everywhere. **Fixed:** *Form posts from real browsers were refused as cross-origin (403)* — Pages were served with Referrer-Policy: no-referrer, which per the Fetch specification makes browsers serialize the Origin header as the literal string "null" on same-origin navigational POSTs. The CSRF gate's origin pre-check refuses a null Origin before the double-submit token is validated, so every container-rendered form returned {"error":"CSRF cross-origin request refused."} on submit — checkout, magic-link sign-in, reviews, returns, account self-service, and the admin console. JSON fetch() calls (passkeys, saved cards, the cart-count island) carry a real Origin and were unaffected. Both substrates now send Referrer-Policy: same-origin: no referrer information ever leaves the site (matching the previous policy's intent), same-origin posts carry a real Origin verified against the configured public origins, and cross-site or sandboxed-iframe posts still arrive as null and are still refused. The integration suite now drives the full Origin matrix — same-origin accepted, null and cross-origin refused — closing the gap between loopback tests (which send no Origin header) and real browsers. Operators composing their own securityHeaders options should not reinstate no-referrer: it re-breaks every tokened form post. · *Checkout layout: fields fill the column; gift and pickup options join the form* — A global form rule leaked align-items: center into the checkout's stacked form, collapsing every field to its content width in the middle of a wide column; the stacked form now stretches its rows. The gift-options, store-pickup, and loyalty-redeem blocks were spliced in after the submit button, rendering as an unstyled run of fields below the call to action — they now render inside the form above the submit row, framed as cards consistent with the order summary, with labels matching the shipping fields.
 
 - v0.3.57 (2026-06-02) — **Vendored blamejs framework refreshed from v0.14.16 to v0.14.19.** The storefront runs on a vendored copy of the blamejs framework. This refreshes it across three upstream patch releases (v0.14.16 to v0.14.19), picking up framework fixes and hardening. The most operator-relevant is a PKCE-downgrade defense in the OAuth/OIDC client, which the storefront composes for Sign in with Google and Apple, so the federated sign-in flow inherits it. The remaining upstream changes are in framework areas the storefront does not expose (archive writing, SCIM, verifiable-credential issuance, SPF/DMARC tooling, OpenAPI), and the storefront's own behavior is unchanged — verified by the full test suite and the vendored-tree integrity gate against the new tree. **Changed:** *Updated the vendored framework to blamejs v0.14.19* — The vendored framework moves from v0.14.16 to v0.14.19 (three upstream patch releases of fixes and additive, opt-in changes). Notably, the OAuth/OIDC client now refuses an identity provider that advertises PKCE methods without S256 — a stripped-S256 downgrade defense — which hardens the storefront's Sign in with Google and Apple. The integrity manifest over the vendored tree was re-stamped as part of the refresh.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.58",
+  "version": "0.3.60",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/auto-discount.js

@@ -954,9 +954,16 @@ function create(opts) {
             }
           }
         }
-        // Half-away-from-zero round to integer minor.
-        var raw = (base * rule.value.basis_points) / 10000;
-        savingsMinor = raw >= 0 ? Math.floor(raw + 0.5) : -Math.floor(-raw + 0.5);
+        // Half-away-from-zero round to integer minor. Exact BigInt
+        // math — base and basis_points are integers, so a JS float
+        // multiply would drift on large carts; the round happens once
+        // on the integer numerator. base is non-negative here (subtotal
+        // or a sum of unit_price*qty), so half-away equals half-up:
+        // floor((base*bps + 5000) / 10000).
+        var num = BigInt(base) * BigInt(rule.value.basis_points);
+        savingsMinor = num >= 0n
+          ? Number((num + 5000n) / 10000n)
+          : -Number((-num + 5000n) / 10000n);
         if (savingsMinor > base) savingsMinor = base;
       } else if (rule.value.kind === "amount_off_total") {
         savingsMinor = rule.value.minor;

package/lib/bundles.js

@@ -467,8 +467,11 @@ function create(opts) {
       // Integer floor — basis points are 1/100 of a percent (10000 =
       // 100%). The floor keeps the customer from paying a fractional
       // cent and matches the rounding convention the pricing
-      // primitive uses for line totals.
-      discountMinor = Math.floor((listTotal * discountBps) / 10000);
+      // primitive uses for line totals. Exact BigInt math (listTotal
+      // and discountBps are integers) so the multiply can't drift on a
+      // large bundle; BigInt division truncates toward zero, which is
+      // floor for the non-negative inputs here.
+      discountMinor = Number((BigInt(listTotal) * BigInt(discountBps)) / 10000n);
     }
     var grandTotal = listTotal - discountMinor;
     return {

package/lib/email.js

@@ -27,6 +27,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var pricing = require("./pricing");
 
 function _htmlEscape(s) {
   if (s == null) return "";
@@ -60,7 +61,7 @@ function _formatMoney(amountMinor, currency) {
   // Delegate to pricing.format so locale + zero-decimal currency
   // handling stays consistent across surfaces. pricing is required
   // — the email module ships with it as a peer in lib/index.js.
-  return b && require("./pricing").format(amountMinor, currency);
+  return b && pricing.format(amountMinor, currency);
 }
 
 // ---- templates ----------------------------------------------------------
@@ -369,7 +370,7 @@ function create(opts) {
   function _orderVars(order, customer) {
     if (!order || typeof order !== "object")     throw new TypeError("email: order object required");
     if (!customer || typeof customer !== "object") throw new TypeError("email: customer object required");
-    var format = require("./pricing").format;
+    var format = pricing.format;
     return {
       order_id:               order.id,
       customer_name:          customer.name || "there",
@@ -409,7 +410,7 @@ function create(opts) {
       if (!Number.isInteger(input.amount_minor) || input.amount_minor < 0) {
         throw new TypeError("email.refundConfirmation: amount_minor must be a non-negative integer");
       }
-      var format = require("./pricing").format;
+      var format = pricing.format;
       var vars = {
         order_id:         input.order.id,
         customer_name:    input.customer.name || "there",

package/lib/refund-policy.js

@@ -736,10 +736,12 @@ function create(opts) {
         if (p.refund_kind === "full" || p.refund_kind === "store_credit_only") {
           maxRefundMinor = input.order_total_minor;
         } else if (p.refund_kind === "partial") {
-          // floor(total * bps / 10000) — integer math, no float
-          // drift. The bps gate (1..9999) guarantees the result is
-          // strictly less than the order total.
-          maxRefundMinor = Math.floor((input.order_total_minor * p.partial_refund_bps) / 10000);
+          // floor(total * bps / 10000) — exact BigInt math, no float
+          // drift on a large order. order_total_minor and bps are
+          // integers; BigInt division truncates toward zero (floor for
+          // these non-negative inputs). The bps gate (1..9999)
+          // guarantees the result is strictly less than the order total.
+          maxRefundMinor = Number((BigInt(input.order_total_minor) * BigInt(p.partial_refund_bps)) / 10000n);
         } else /* no_refund */ {
           maxRefundMinor = 0;
         }

package/lib/security-middleware.js

@@ -85,6 +85,11 @@ var HEALTH_PATH = "/_/health";
 //   /survey/                  -> /survey/:token (GET form + POST submit)
 //   /orders/                  -> /orders/:id/cancel|rate|reorder (gated to POST below;
 //                                the /orders/:id confirmation GET a shopper hits freely is NOT throttled)
+//   /stock-alert/             -> subscribe + unsubscribe. Subscribe is anonymous,
+//                                CSRF-exempt (EDGE_POST_PATHS), and emails the
+//                                request-supplied address — without the tight
+//                                budget it is a victim-addressed mail cannon on
+//                                the loose global bucket alone.
 var TIGHT_PREFIXES = [
   "/account/login",
   "/account/register",
@@ -96,6 +101,7 @@ var TIGHT_PREFIXES = [
   "/products/",
   "/survey/",
   "/orders/",
+  "/stock-alert/",
 ];
 
 // Edge-served state-changing POST endpoints. These forms are rendered at

package/lib/shipping-insurance.js

@@ -221,9 +221,13 @@ function _epochMs(n, label) {
 // Integer-only; rounds up on half-cent so the insurer is never short.
 
 function _computePremium(declaredValueMinor, premiumRateBps, premiumMinMinor) {
-  var product = declaredValueMinor * premiumRateBps;
-  var quotient = Math.floor(product / 10000);
-  if (quotient * 10000 < product) { quotient += 1; }
+  // Exact BigInt ceil — declaredValueMinor and premiumRateBps are
+  // integers, so a JS Number multiply would lose precision once the
+  // product exceeds 2^53 (a large declared value at a high rate).
+  // ceil(product / 10000) = floor((product + 9999) / 10000) for the
+  // non-negative inputs here.
+  var product = BigInt(declaredValueMinor) * BigInt(premiumRateBps);
+  var quotient = Number((product + 9999n) / 10000n);
   if (quotient < premiumMinMinor) { quotient = premiumMinMinor; }
   return quotient;
 }

package/lib/storefront.js

@@ -2965,7 +2965,10 @@ function _wishlistPrefsPanel(opts) {
         "<input type=\"hidden\" name=\"on\" value=\"" + (on ? "" : "1") + "\">" +
         "<span class=\"wishlist-prefs__label\">" + esc(a.label || a.trigger) + "</span>" +
         "<span class=\"wishlist-prefs__state\">" + (on ? "On" : "Off") + "</span>" +
-        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (on ? "Turn off" : "Turn on") + "</button>" +
+        // aria-label carries the trigger name — the visible "Turn off"/"Turn
+        // on" alone is ambiguous to a screen reader walking a list of
+        // identically-named buttons.
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\" aria-label=\"" + (on ? "Turn off " : "Turn on ") + esc(a.label || a.trigger) + "\">" + (on ? "Turn off" : "Turn on") + "</button>" +
       "</form>";
   }
   var alertsBlock = alertRows
@@ -2982,7 +2985,7 @@ function _wishlistPrefsPanel(opts) {
         "<input type=\"hidden\" name=\"on\" value=\"" + (enrolled ? "" : "1") + "\">" +
         "<span class=\"wishlist-prefs__label\">" + esc(d.label || d.slug) + "</span>" +
         "<span class=\"wishlist-prefs__state\">" + (enrolled ? "Subscribed" : "Not subscribed") + "</span>" +
-        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (enrolled ? "Unsubscribe" : "Subscribe") + "</button>" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\" aria-label=\"" + (enrolled ? "Unsubscribe from " : "Subscribe to ") + esc(d.label || d.slug) + "\">" + (enrolled ? "Unsubscribe" : "Subscribe") + "</button>" +
       "</form>";
   }
   var digestBlock = digestRows
@@ -9237,6 +9240,16 @@ function renderPaymentMethods(opts) {
   var inner = rowsHtml
     ? "<ul class=\"pm-list\">" + rowsHtml + "</ul>"
     : "<div class=\"account-empty\"><p class=\"account-empty__lede\">No saved cards yet. Add one for faster checkout.</p></div>";
+  // "Add a card" CTA — only a live link when the add flow can actually
+  // complete (the Stripe publishable key drives the SetupIntent Payment
+  // Element on the add page). Absent it, render a disabled control + an
+  // honest note instead of a link that dead-ends on the add page's 503.
+  // Back-compat: callers that don't pass the flag keep the live link.
+  var addCardAvailable = opts.add_card_available !== false;
+  var ctaHtml = addCardAvailable
+    ? "<a class=\"btn-primary\" href=\"/account/payment-methods/add\">Add a card</a>"
+    : "<button type=\"button\" class=\"btn-primary\" disabled aria-disabled=\"true\">Add a card</button>" +
+      "<p class=\"form-notice form-notice--warn\" role=\"status\">Adding a card isn't available on this store yet — card storage isn't fully configured. Your saved cards still work for checkout.</p>";
   var body =
     "<section class=\"account-payment-methods\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -9247,7 +9260,7 @@ function renderPaymentMethods(opts) {
       success + notice +
       inner +
       "<div class=\"account-payment-methods__cta\">" +
-        "<a class=\"btn-primary\" href=\"/account/payment-methods/add\">Add a card</a>" +
+        ctaHtml +
       "</div>" +
     "</section>";
   return _wrap({
@@ -13606,11 +13619,16 @@ function mount(router, deps) {
         if (okKind === "archived") successCopy = "Card removed.";
         if (okKind === "exists")   successCopy = "That card is already on file.";
         _send(res, code || 200, renderPaymentMethods({
-          payment_methods: rows,
-          notice:          notice || null,
-          success:         successCopy,
-          shop_name:       shopName,
-          cart_count:      cartCount,
+          payment_methods:   rows,
+          notice:            notice || null,
+          success:           successCopy,
+          // The add-card page needs the Stripe publishable key for the
+          // SetupIntent Payment Element; without it the add route 503s,
+          // so render the disabled "Add a card" state rather than a link
+          // into that dead end.
+          add_card_available: !!deps.stripe_publishable_key,
+          shop_name:         shopName,
+          cart_count:        cartCount,
         }));
       }
 
@@ -17460,7 +17478,11 @@ function mount(router, deps) {
       for (var m = 0; m < members.length; m += 1) {
         var mem = members[m];
         var share = listTotal > 0
-          ? Math.floor((bundleTotal * mem.list_line) / listTotal)
+          // Exact BigInt floor — bundleTotal and list_line are integer
+          // minor units; their product can exceed 2^53 on a large
+          // bundle, so a JS float multiply would drift. BigInt division
+          // truncates toward zero (floor for these non-negative values).
+          ? Number((BigInt(bundleTotal) * BigInt(mem.list_line)) / BigInt(listTotal))
           : Math.floor(bundleTotal / members.length);
         mem.alloc_line = share;
         allocated += share;

package/lib/wishlist-sharing.js

@@ -63,6 +63,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var wishlistModule = require("./wishlist");
 
 // ---- constants ----------------------------------------------------------
 
@@ -256,7 +257,7 @@ function create(opts) {
   var wishlistInstance = opts.wishlist || null;
   function _wishlist() {
     if (!wishlistInstance) {
-      wishlistInstance = require("./wishlist").create({ query: query });
+      wishlistInstance = wishlistModule.create({ query: query });
     }
     return wishlistInstance;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.58",
+  "version": "0.3.60",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {