@blamejs/blamejs-shop 0.3.59 → 0.3.62

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.62 (2026-06-04) — **Live card payments work, and back-in-stock unsubscribe is token-gated.** Checkout failed at the charge step on Stripe-configured deploys: the framework's outbound HTTP client offers only post-quantum hybrid TLS key-exchange groups, and the Stripe and PayPal API edges do not negotiate any of them yet, so every processor call died with a TLS handshake failure (alert 40) and checkout rendered a server error. The payment module now dials the processors through an explicitly constructed agent — TLS 1.3 minimum, the platform's default key-exchange groups — which is the framework's prescribed pattern for a peer that cannot meet the post-quantum list: the downgrade is visible in the code, scoped to the processor connections only, and every other outbound connection keeps the post-quantum-first default. Verified against the live Stripe API. The downgrade reverts when the processor edges add hybrid key-exchange support. Separately, the checkout error page no longer echoes upstream failure detail (such as TLS library internals) to the customer — that detail goes to the audit log, and the page states plainly that nothing was charged. This release also token-gates back-in-stock unsubscribe: cancelling a back-in-stock alert previously took only the subscriber's email address and the product SKU — guessable values, so a third party could silently cancel someone else's restock notification. Unsubscribe is now authorized by an opaque per-subscription token, carried in the confirmation and notification emails as a one-click link, exactly like the newsletter's unsubscribe. Tokens are stored only as keyed hashes, compared in constant time, and unknown tokens get the same response as valid ones, so the endpoint is not a subscription-existence oracle. A schema migration adds the token column; it applies automatically on deploy. **Changed:** *Back-in-stock unsubscribe requires the emailed token* — POST /stock-alert/unsubscribe no longer accepts an email + SKU pair; it requires the per-subscription token from the unsubscribe link in the confirmation or back-in-stock email. The token is minted at subscribe time for the confirmation mail and rotated per notification send, stored only as a keyed hash, and verified with a constant-time compare; bad or unknown tokens return the same uniform response as valid ones. The one-click link works without cookies or a signed-in session, so mail clients can fire it directly; each email carries the token that is current for its send. Operators upgrading: migration 0207 adds the token column and applies with the normal deploy. **Fixed:** *Stripe and PayPal connections complete their TLS handshake* — The outbound HTTP client's default TLS posture offers exclusively post-quantum hybrid key-exchange groups. Processor API edges currently answer that ClientHello with handshake_failure (TLS alert 40), so the first real charge attempt on a Stripe-configured deploy failed checkout with a server error. The payment module now passes its own connection agent on every processor call — TLS 1.3 minimum is kept, key exchange falls back to the platform defaults — while the client's SSRF pinning, retries, and response caps stay in force. The agent is scoped to the payment-processor dials; all other outbound traffic keeps the post-quantum-first posture. A regression test pins the agent's presence and configuration on the charge path. · *Checkout server errors no longer echo upstream detail to the customer* — When the charge step failed, the checkout error page interpolated the underlying error string — in this case raw TLS library internals — into the customer-facing message. Server-side failure detail now goes to the audit log; the customer sees a plain recoverable message that confirms nothing was charged. Field-validation messages, which are written for customers, are unaffected.
+
+- v0.3.60 (2026-06-04) — **Exact integer math for percentage discounts and insurance premiums, and an honest Add-a-card state under partial Stripe configuration.** Every place that computes a percentage of a money amount — automatic percent-off discounts, bundle discounts and their per-line allocation, partial-refund policy amounts, and shipping-insurance premiums — now uses exact integer arithmetic instead of a floating-point intermediate. On very large amounts the float product loses precision past 2^53 and can drift the rounded result by a minor unit; charged totals were never affected (the charge path was already integer end-to-end), but displayed and clamped values now match exact math everywhere, with each site's rounding direction preserved. Separately, the account Payment-methods screen no longer links into a 503 when the Stripe publishable key is missing: the Add-a-card affordance now renders as a disabled control with an explanatory note until the configuration is complete, matching how the unconfigured checkout behaves. **Fixed:** *Percentage-of-amount math is exact integer arithmetic* — Automatic percent-off discounts, bundle discounts, the cart's per-line bundle allocation, partial-refund policy amounts, and shipping-insurance premiums all computed `amount × basis_points / 10000` through a floating-point multiply. Amounts and rates are both integers, so the computation is now exact integer arithmetic with each site's rounding direction unchanged — half-away-from-zero for discounts, floor for allocations and refunds, ceiling for insurance premiums (the insurer is never short). The drift was only reachable on very large amounts (products beyond 2^53) and never touched a charged total, which was already integer end-to-end; tests now pin exact results on amounts past the float-precision boundary. · *Add a card renders honestly when Stripe configuration is incomplete* — Saving a card needs the Stripe publishable key in addition to the server-side API keys. With the server keys set but the publishable key missing, the Payment-methods screen rendered a live "Add a card" link that dead-ended on a 503. The link now gates on the same condition the add route enforces: when the publishable key is absent it renders as a disabled control with a note explaining the missing configuration, while listing, choosing a default, and removing saved cards keep working. The route's own 503 remains as defense in depth for a directly typed URL.
+
 - v0.3.59 (2026-06-04) — **Back-in-stock subscribe rate-limited, payment-method metadata in privacy exports, and accessible wishlist alert toggles.** The anonymous back-in-stock "notify me" endpoint sends a confirmation email to the address the request supplies; it now sits in the same tight per-IP rate budget as login, checkout, and the newsletter, closing a victim-addressed email-flooding vector. Privacy (GDPR/CCPA) data exports now include saved-payment-method display metadata — card brand, last four, expiry — which is personal data the export was silently omitting. The wishlist alert and digest toggle buttons gain accessible names that include the alert they control, so a screen reader no longer announces a list of identical "Turn on" buttons. Internal housekeeping rides along: module imports hoisted to file tops, a per-test wall-clock-ceiling helper backing an existing test gate, and stale comments corrected. **Fixed:** *Back-in-stock subscribe joins the tight rate limit* — POST /stock-alert/subscribe is anonymous and sends a double-opt-in confirmation email to the request-supplied address. It previously sat only behind the loose global token bucket, so a script could direct a burst of confirmation emails at an arbitrary victim address — an email-flooding and sender-reputation risk. The route now shares the tight per-IP, per-path budget that already covers login, registration, checkout, gift-card balance, and the newsletter; the integration suite pins the throttle. · *Privacy exports include saved-payment-method metadata* — The subject-access (GDPR/CCPA) export composed every reader except saved payment methods, which was wired to an empty handle — an export silently omitted the card brand, last-four digits, and expiry the shop stores alongside the opaque processor token. The reader now receives the live handle, so a customer's export reflects everything held about them. Only display metadata is stored or exported — never card numbers. · *Wishlist alert toggles are screen-reader distinguishable* — The account wishlist-alerts screen rendered visually identical "Turn on" / "Turn off" / "Subscribe" buttons whose accessible names did not say which alert or digest they control. Each toggle now carries an accessible name that includes its alert label (for example "Turn off Price-drop alerts"), satisfying WCAG 2.4.6 for assistive-technology users walking the button list.
 
 - v0.3.58 (2026-06-04) — **Browser form submissions no longer refused as cross-origin, server-side shipping-address validation, and a repaired checkout layout.** Every navigational form POST served by the container — checkout, magic-link sign-in, product reviews, returns, the account area, and the admin console — was refused with a 403 in real browsers. Pages shipped Referrer-Policy: no-referrer, which makes browsers send Origin: null on same-origin form submissions, and the CSRF gate's origin pre-check refuses a null Origin before the token is read. Both the edge and the container now send Referrer-Policy: same-origin: referrer information still never leaves the site, while same-origin posts carry the real Origin the gate verifies. Cross-site and sandboxed-iframe submissions are still refused. Checkout additionally gains backend shipping-address validation with accessible per-field errors that preserve everything the shopper typed, and the checkout page's layout is repaired — fields fill the form column instead of collapsing to its center, and the gift, store-pickup, and loyalty options render inside the form above the submit button. **Added:** *Server-side shipping-address validation with per-field errors* — The checkout POST validates the shipping address on the backend and, on rejection, re-renders the form with the one bad field marked (aria-invalid plus an adjacent role="alert" message) and every typed value preserved — replacing the previous dead-end error page. Country must be a real ISO 3166-1 alpha-2 code, validated against the platform's Intl region data (no new dependencies). US and Canadian destinations validate the state or province code and the ZIP (12345 or 12345-6789) / postal (A1A 1A1) format, and require street, city, region, and postal — the figures that feed destination tax. Every other country keeps lenient length-bounded checks, so international addresses are never over-validated. Email gains a shape check alongside the existing content-safety gate, and the customer name is length-bounded. Headless callers of checkout.confirm keep the presence-optional contract for digital-only orders; malformed values are now refused everywhere. **Fixed:** *Form posts from real browsers were refused as cross-origin (403)* — Pages were served with Referrer-Policy: no-referrer, which per the Fetch specification makes browsers serialize the Origin header as the literal string "null" on same-origin navigational POSTs. The CSRF gate's origin pre-check refuses a null Origin before the double-submit token is validated, so every container-rendered form returned {"error":"CSRF cross-origin request refused."} on submit — checkout, magic-link sign-in, reviews, returns, account self-service, and the admin console. JSON fetch() calls (passkeys, saved cards, the cart-count island) carry a real Origin and were unaffected. Both substrates now send Referrer-Policy: same-origin: no referrer information ever leaves the site (matching the previous policy's intent), same-origin posts carry a real Origin verified against the configured public origins, and cross-site or sandboxed-iframe posts still arrive as null and are still refused. The integration suite now drives the full Origin matrix — same-origin accepted, null and cross-origin refused — closing the gap between loopback tests (which send no Origin header) and real browsers. Operators composing their own securityHeaders options should not reinstate no-referrer: it re-breaks every tokened form post. · *Checkout layout: fields fill the column; gift and pickup options join the form* — A global form rule leaked align-items: center into the checkout's stacked form, collapsing every field to its content width in the middle of a wide column; the stacked form now stretches its rows. The gift-options, store-pickup, and loyalty-redeem blocks were spliced in after the submit button, rendering as an unstyled run of fields below the call to action — they now render inside the form above the submit row, framed as cards consistent with the order summary, with labels matching the shipping fields.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.59",
+  "version": "0.3.62",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/auto-discount.js

@@ -954,9 +954,16 @@ function create(opts) {
             }
           }
         }
-        // Half-away-from-zero round to integer minor.
-        var raw = (base * rule.value.basis_points) / 10000;
-        savingsMinor = raw >= 0 ? Math.floor(raw + 0.5) : -Math.floor(-raw + 0.5);
+        // Half-away-from-zero round to integer minor. Exact BigInt
+        // math — base and basis_points are integers, so a JS float
+        // multiply would drift on large carts; the round happens once
+        // on the integer numerator. base is non-negative here (subtotal
+        // or a sum of unit_price*qty), so half-away equals half-up:
+        // floor((base*bps + 5000) / 10000).
+        var num = BigInt(base) * BigInt(rule.value.basis_points);
+        savingsMinor = num >= 0n
+          ? Number((num + 5000n) / 10000n)
+          : -Number((-num + 5000n) / 10000n);
         if (savingsMinor > base) savingsMinor = base;
       } else if (rule.value.kind === "amount_off_total") {
         savingsMinor = rule.value.minor;

package/lib/bundles.js

@@ -467,8 +467,11 @@ function create(opts) {
       // Integer floor — basis points are 1/100 of a percent (10000 =
       // 100%). The floor keeps the customer from paying a fractional
       // cent and matches the rounding convention the pricing
-      // primitive uses for line totals.
-      discountMinor = Math.floor((listTotal * discountBps) / 10000);
+      // primitive uses for line totals. Exact BigInt math (listTotal
+      // and discountBps are integers) so the multiply can't drift on a
+      // large bundle; BigInt division truncates toward zero, which is
+      // floor for the non-negative inputs here.
+      discountMinor = Number((BigInt(listTotal) * BigInt(discountBps)) / 10000n);
     }
     var grandTotal = listTotal - discountMinor;
     return {

package/lib/email.js

@@ -303,6 +303,7 @@ var STOCK_ALERT_CONFIRM_HTML =
   "  <p style=\"margin:0 0 16px;\">You asked to be emailed when <strong>{{product_title}}</strong> (SKU {{sku}}) is back in stock. Confirm below and we'll email you once, the moment it returns.</p>\n" +
   "  <p style=\"margin:24px 0;\"><a href=\"{{confirm_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Confirm my alert</a></p>\n" +
   "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If you didn't request this, ignore this email — no alert is set until you confirm. Link: {{confirm_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">Changed your mind? Cancel this alert: {{unsubscribe_url}}</p>\n" +
   "</div>\n" +
   "</body></html>\n";
 
@@ -311,7 +312,8 @@ var STOCK_ALERT_CONFIRM_TEXT =
   "You asked to be emailed when {{product_title}} (SKU {{sku}}) is back in stock.\n" +
   "Confirm to set the alert — we'll email you once, the moment it returns.\n\n" +
   "Confirm: {{confirm_url}}\n\n" +
-  "If you didn't request this, ignore this email — no alert is set until you confirm.\n";
+  "If you didn't request this, ignore this email — no alert is set until you confirm.\n" +
+  "Changed your mind? Cancel this alert: {{unsubscribe_url}}\n";
 
 var BACK_IN_STOCK_HTML =
   "<!DOCTYPE html>\n" +
@@ -664,8 +666,9 @@ function create(opts) {
       );
     },
 
-    // Back-in-stock double-opt-in confirmation. `confirm_url` is built by
-    // the route from SHOP_ORIGIN + the plaintext token returned once by
+    // Back-in-stock double-opt-in confirmation. `confirm_url` +
+    // `unsubscribe_url` are built by the route from SHOP_ORIGIN + the
+    // plaintext confirm/unsubscribe tokens returned once by
     // stockAlerts.subscribe. product_title / sku are catalog data; the
     // strict renderer escapes every field anyway (escape-by-default).
     sendStockAlertConfirmation: async function (input) {
@@ -677,9 +680,10 @@ function create(opts) {
         throw new TypeError("email.sendStockAlertConfirmation: confirm_url required");
       }
       var vars = {
-        product_title: input.product_title == null ? input.sku || "this item" : String(input.product_title),
-        sku:           input.sku == null ? "—" : String(input.sku),
-        confirm_url:   input.confirm_url,
+        product_title:   input.product_title == null ? input.sku || "this item" : String(input.product_title),
+        sku:             input.sku == null ? "—" : String(input.sku),
+        confirm_url:     input.confirm_url,
+        unsubscribe_url: input.unsubscribe_url == null ? "" : String(input.unsubscribe_url),
       };
       var html = _render(STOCK_ALERT_CONFIRM_HTML, vars);
       var text = _render(STOCK_ALERT_CONFIRM_TEXT, vars);

package/lib/payment.js

@@ -23,9 +23,26 @@
  *   token can't smuggle unsigned events into the order pipeline.
  */
 
+var nodeHttps = require("node:https");   // allow:non-shop-require — the PSP TLS agent must be a real node https.Agent for the vendored httpClient's caller-agent (h1) path; no b.* primitive constructs one, and the framework's downgrade prescription is an explicitly-built agent in the consumer's diff
+
 var b = require("./vendor/blamejs");
 var C = b.constants;
 
+// External payment processors do not negotiate the framework's PQC-hybrid
+// TLS groups yet: the vendored httpClient offers ONLY ML-KEM hybrid groups
+// (constants.TLS_GROUP_PREFERENCE), and api.stripe.com / api-m.paypal.com
+// answer that ClientHello with handshake_failure (TLS alert 40) — which
+// surfaced as a checkout failure the moment a charge was attempted. The
+// framework's own prescription for a peer that can't meet the PQC list is
+// an explicitly-constructed agent so the downgrade is visible in this
+// diff: TLS 1.3 minimum stays pinned, the key-exchange groups fall back to
+// Node's defaults (classical X25519 / P-256 today). The vendored client
+// honors a caller agent per request (h1 path) while keeping its SSRF-
+// pinned DNS lookup, retries, and response caps. Scoped to the PSP dials
+// only — every other outbound keeps the PQC-first default. Revisit when
+// the processor edges negotiate ML-KEM hybrid groups.
+var _PSP_TLS_AGENT = new nodeHttps.Agent({ keepAlive: true, minVersion: "TLSv1.3" });
+
 var STRIPE_API_BASE_DEFAULT  = "https://api.stripe.com/v1";
 var STRIPE_WEBHOOK_TOLERANCE = 300;   // ± 5 minutes (Stripe default)
 var STRIPE_HTTP_TIMEOUT_MS   = 15000;
@@ -185,6 +202,7 @@ async function _stripeCall(opts, method, path, params, idempotencyKey) {
     headers:   headers,
     body:      body || undefined,
     timeoutMs: opts.timeoutMs || STRIPE_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json = null;
@@ -641,6 +659,7 @@ async function _paypalToken(opts, state) {
     },
     body:      "grant_type=client_credentials",
     timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = {}; }
@@ -675,6 +694,7 @@ async function _paypalCall(opts, state, method, path, bodyObj, requestId) {
     headers:   headers,
     body:      body,
     timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = { _raw: text }; }

package/lib/refund-policy.js

@@ -736,10 +736,12 @@ function create(opts) {
         if (p.refund_kind === "full" || p.refund_kind === "store_credit_only") {
           maxRefundMinor = input.order_total_minor;
         } else if (p.refund_kind === "partial") {
-          // floor(total * bps / 10000) — integer math, no float
-          // drift. The bps gate (1..9999) guarantees the result is
-          // strictly less than the order total.
-          maxRefundMinor = Math.floor((input.order_total_minor * p.partial_refund_bps) / 10000);
+          // floor(total * bps / 10000) — exact BigInt math, no float
+          // drift on a large order. order_total_minor and bps are
+          // integers; BigInt division truncates toward zero (floor for
+          // these non-negative inputs). The bps gate (1..9999)
+          // guarantees the result is strictly less than the order total.
+          maxRefundMinor = Number((BigInt(input.order_total_minor) * BigInt(p.partial_refund_bps)) / 10000n);
         } else /* no_refund */ {
           maxRefundMinor = 0;
         }

package/lib/security-middleware.js

@@ -141,6 +141,13 @@ var EDGE_POST_PATHS = [
   // the `edge-form-csrf-exempt` detector lookahead in
   // test/layer-0-primitives/codebase-patterns.test.js.
   "/stock-alert/subscribe",
+  // Back-in-stock one-click unsubscribe — same bearer-token model as
+  // /unsubscribe above. The opaque, per-row token in the `?token=` link IS
+  // the authorization; the POST a mail client fires carries no cookies and no
+  // session CSRF token, so the path is exempt from the double-submit check
+  // (it keeps SameSite + fetch-metadata defense and is enumeration-safe +
+  // timing-safe at the token layer).
+  "/stock-alert/unsubscribe",
 ];
 
 // The TLS-terminated public origin(s) the storefront is served on. Behind

package/lib/shipping-insurance.js

@@ -221,9 +221,13 @@ function _epochMs(n, label) {
 // Integer-only; rounds up on half-cent so the insurer is never short.
 
 function _computePremium(declaredValueMinor, premiumRateBps, premiumMinMinor) {
-  var product = declaredValueMinor * premiumRateBps;
-  var quotient = Math.floor(product / 10000);
-  if (quotient * 10000 < product) { quotient += 1; }
+  // Exact BigInt ceil — declaredValueMinor and premiumRateBps are
+  // integers, so a JS Number multiply would lose precision once the
+  // product exceeds 2^53 (a large declared value at a high rate).
+  // ceil(product / 10000) = floor((product + 9999) / 10000) for the
+  // non-negative inputs here.
+  var product = BigInt(declaredValueMinor) * BigInt(premiumRateBps);
+  var quotient = Number((product + 9999n) / 10000n);
   if (quotient < premiumMinMinor) { quotient = premiumMinMinor; }
   return quotient;
 }

package/lib/stock-alerts.js

@@ -36,9 +36,14 @@
  *   Composes:
  *     - `b.crypto.namespaceHash` — email hash + token hash.
  *     - `b.crypto.generateBytes` — 24 random bytes →
- *       base64url-encoded to a 32-character plaintext token. The
- *       plaintext is returned ONCE from `subscribe`; only the hash
- *       persists.
+ *       base64url-encoded to a 32-character plaintext token, used for
+ *       BOTH the double-opt-in confirmation token and the unsubscribe
+ *       bearer token. Each plaintext is returned ONCE (confirm + unsub
+ *       tokens from `subscribe`; a fresh unsub token per fired row from
+ *       `scanAndNotify`); only the hashes persist.
+ *     - `b.crypto.timingSafeEqual` — constant-time re-comparison of the
+ *       stored unsubscribe-token hash against the recomputed hash so the
+ *       unknown-token miss path can't be distinguished by latency.
  *     - `b.guardEmail` — strict-profile email validation +
  *       sanitization before normalisation.
  *     - `b.guardUuid` — optional customer_id / variant_id shape gate.
@@ -49,11 +54,13 @@
  *
  * @primitive stockAlerts
  * @related   b.crypto.namespaceHash, b.crypto.generateBytes,
- *            b.guardEmail, b.guardUuid, notifications
+ *            b.crypto.timingSafeEqual, b.guardEmail, b.guardUuid,
+ *            notifications
  */
 
 var EMAIL_NAMESPACE = "stock-alert-email";
 var TOKEN_NAMESPACE = "stock-alert-token";
+var UNSUB_NAMESPACE = "stock-alert-unsub-token";
 var TOKEN_BYTES     = 24;                // 24 raw bytes → 32 base64url chars
 var TOKEN_LEN       = 32;
 var TOKEN_RE        = /^[A-Za-z0-9_-]{32}$/;
@@ -146,6 +153,10 @@ function _hashToken(plaintext) {
   return b.crypto.namespaceHash(TOKEN_NAMESPACE, plaintext);
 }
 
+function _hashUnsubToken(plaintext) {
+  return b.crypto.namespaceHash(UNSUB_NAMESPACE, plaintext);
+}
+
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -180,6 +191,7 @@ function create(opts) {
   return {
     EMAIL_NAMESPACE: EMAIL_NAMESPACE,
     TOKEN_NAMESPACE: TOKEN_NAMESPACE,
+    UNSUB_NAMESPACE: UNSUB_NAMESPACE,
     TOKEN_LEN:       TOKEN_LEN,
     EVENT_TYPE:      EVENT_TYPE,
 
@@ -193,12 +205,14 @@ function create(opts) {
     // Subscribe to the back-in-stock alert for a SKU (and optionally
     // a specific variant). Returns:
     //   { id, status: "subscribed" | "already-pending" |
-    //     "already-confirmed", confirmation_token?, email_hash,
-    //     expires_at }
-    // The plaintext `confirmation_token` is returned ONLY on a
-    // brand-new subscription. Re-subscriptions surface the existing
-    // row's status — operators that want to re-send the confirmation
-    // email mint a fresh subscription by calling `unsubscribe` first.
+    //     "already-confirmed", confirmation_token?, unsubscribe_token?,
+    //     email_hash, expires_at }
+    // The plaintext `confirmation_token` and `unsubscribe_token` are
+    // returned ONLY on a brand-new subscription — the confirmation email
+    // carries both (the confirm link + a one-click unsubscribe link). Only
+    // their hashes persist. Re-subscriptions surface the existing row's
+    // status — operators that want to re-send the confirmation email mint
+    // a fresh subscription by calling `unsubscribeByToken` first.
     subscribe: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("stockAlerts.subscribe: input object required");
@@ -237,23 +251,26 @@ function create(opts) {
         await query("DELETE FROM stock_alerts WHERE id = ?1", [existing.id]);
       }
 
-      var token     = _mintToken();
-      var tokenHash = _hashToken(token);
-      var id        = b.uuid.v7();
-      var expiresAt = now + ttlMs;
+      var token      = _mintToken();
+      var tokenHash  = _hashToken(token);
+      var unsubToken = _mintToken();
+      var unsubHash  = _hashUnsubToken(unsubToken);
+      var id         = b.uuid.v7();
+      var expiresAt  = now + ttlMs;
 
       await query(
         "INSERT INTO stock_alerts " +
         "(id, email_hash, email_normalised, sku, variant_id, customer_id, " +
-        " confirmation_token_hash, confirmed_at, notified_at, expires_at, created_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, NULL, ?8, ?9)",
-        [id, emailHash, emailNorm, sku, variantId, customerId, tokenHash, expiresAt, now],
+        " confirmation_token_hash, unsubscribe_token_hash, confirmed_at, notified_at, expires_at, created_at) " +
+        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, NULL, ?9, ?10)",
+        [id, emailHash, emailNorm, sku, variantId, customerId, tokenHash, unsubHash, expiresAt, now],
       );
       return {
         id:                 id,
         status:             "subscribed",
         email_hash:         emailHash,
         confirmation_token: token,
+        unsubscribe_token:  unsubToken,
         expires_at:         expiresAt,
       };
     },
@@ -293,23 +310,45 @@ function create(opts) {
       return row;
     },
 
-    // Unsubscribe by (email, sku, variant?) — the storefront's
-    // unsubscribe link from the notification email lands here.
-    // Returns `{ removed: boolean }`. Idempotent: a missing row is
-    // not an error.
-    unsubscribe: async function (input) {
-      if (!input || typeof input !== "object") {
-        throw new TypeError("stockAlerts.unsubscribe: input object required");
+    // Unsubscribe by the per-row bearer token carried in the email's
+    // unsubscribe link. The token IS the authorization — knowing a
+    // victim's email + a SKU is no longer enough to cancel their alert,
+    // only the opaque token the shop emailed them is. Resolves the row by
+    // the token's namespaceHash and deletes it.
+    //
+    // Enumeration-safe by construction: a bad-shape, empty, or unknown
+    // token returns the SAME `{ removed: false }` shape a valid-but-
+    // already-removed token does (idempotent re-click), and the miss path
+    // burns the same constant-time comparison as the hit path so the
+    // unknown-vs-known distinction doesn't leak through response latency.
+    // Never throws on a token argument — the public route renders a
+    // uniform "you're unsubscribed" page for every outcome.
+    unsubscribeByToken: async function (plaintext) {
+      if (typeof plaintext !== "string" || !TOKEN_RE.test(plaintext)) {
+        // Bad shape can't match any stored hash — short-circuit to the
+        // same no-op the unknown-token path returns. No oracle.
+        return { removed: false };
       }
-      var emailNorm = _normaliseEmail(input.email);
-      var sku       = _validateSku(input.sku);
-      var variantId = _optUuid(input.variant_id, "variant_id");
-      var emailHash = _hashEmail(emailNorm);
-      var r = await query(
-        "DELETE FROM stock_alerts WHERE email_hash = ?1 AND sku = ?2 " +
-        "AND COALESCE(variant_id, '') = COALESCE(?3, '')",
-        [emailHash, sku, variantId],
-      );
+      var unsubHash = _hashUnsubToken(plaintext);
+      var row = (await query(
+        "SELECT id, unsubscribe_token_hash FROM stock_alerts " +
+        "WHERE unsubscribe_token_hash = ?1 LIMIT 1",
+        [unsubHash],
+      )).rows[0];
+      if (!row) {
+        // Miss path — burn the same comparison work as the hit path so
+        // the latency profile matches (the compared values are equal by
+        // construction; the result is discarded).
+        b.crypto.timingSafeEqual(unsubHash, unsubHash);
+        return { removed: false };
+      }
+      // Constant-time check of the stored hash against the recomputed
+      // hash — belt-and-braces against any future change to the index
+      // lookup. A mismatch reads as a miss (uniform no-op).
+      if (!b.crypto.timingSafeEqual(row.unsubscribe_token_hash, unsubHash)) {
+        return { removed: false };
+      }
+      var r = await query("DELETE FROM stock_alerts WHERE id = ?1", [row.id]);
       return { removed: Number(r.rowCount || 0) > 0 };
     },
 
@@ -391,11 +430,18 @@ function create(opts) {
     // Operator-driven sweeper. Walks every pending (confirmed +
     // un-notified + un-expired) subscription whose SKU now has
     // catalog.inventory.stock_on_hand - stock_held > 0 and:
-    //   1. stamps notified_at on the row, and
-    //   2. (if notifications is wired) enqueues an in-app message
+    //   1. mints a fresh unsubscribe bearer token, rotating the row's
+    //      unsubscribe_token_hash so the notification email's one-click
+    //      unsubscribe link is a live, single-purpose handle (the prior
+    //      confirmation-email token is superseded — a notified row is
+    //      terminal so its older link is moot anyway),
+    //   2. stamps notified_at on the row, and
+    //   3. (if notifications is wired) enqueues an in-app message
     //      keyed by the recipient's email_hash.
     // Returns `{ scanned, notified, enqueued, rows }` — `rows` is the
-    // shape that fired, post-update. The sweeper is idempotent at the
+    // shape that fired, post-update, each carrying the plaintext
+    // `unsubscribe_token` (returned ONCE here, for the email builder to
+    // embed; only the hash persists). The sweeper is idempotent at the
     // row level: a row that's already been notified is skipped.
     scanAndNotify: async function (sweepOpts) {
       sweepOpts = sweepOpts || {};
@@ -453,11 +499,23 @@ function create(opts) {
         var rows = bySku[skuKey];
         for (var k = 0; k < rows.length; k += 1) {
           var row = rows[k];
-          await query(
-            "UPDATE stock_alerts SET notified_at = ?1 WHERE id = ?2 AND notified_at IS NULL",
-            [now, row.id],
+          // Mint + rotate a fresh unsubscribe bearer for this fired row.
+          // The plaintext rides out on the row object (the email builder
+          // embeds it); only the hash is durable. The `notified_at IS
+          // NULL` guard makes the update a claim: when two sweeps race
+          // the same pending row, exactly one wins. The loser MUST skip
+          // the row — its freshly minted token never persisted, so an
+          // email built from it would carry a dead unsubscribe link, and
+          // pushing the row would double-notify the subscriber.
+          var rowUnsubToken = _mintToken();
+          var claim = await query(
+            "UPDATE stock_alerts SET notified_at = ?1, unsubscribe_token_hash = ?2 " +
+            "WHERE id = ?3 AND notified_at IS NULL",
+            [now, _hashUnsubToken(rowUnsubToken), row.id],
           );
+          if (!claim || Number(claim.rowCount) !== 1) continue;
           row.notified_at = now;
+          row.unsubscribe_token = rowUnsubToken;
           fired.push(row);
           if (notifications) {
             try {
@@ -541,5 +599,6 @@ module.exports = {
   create:          create,
   EMAIL_NAMESPACE: EMAIL_NAMESPACE,
   TOKEN_NAMESPACE: TOKEN_NAMESPACE,
+  UNSUB_NAMESPACE: UNSUB_NAMESPACE,
   TOKEN_LEN:       TOKEN_LEN,
 };

package/lib/storefront.js

@@ -8156,17 +8156,17 @@ function renderStockAlertConfirm(opts) {
   });
 }
 
-// The unsubscribe confirm page (GET). A no-JS form POSTs the (email, sku,
-// variant) tuple back to /stock-alert/unsubscribe — a deliberate "yes,
-// stop these alerts" step (no link-prefetcher unsubscribe). The tuple
-// rides in hidden fields (HTML-escaped). This page is container-rendered
-// from a GET, so it CAN carry the `_csrf` token — the action is NOT in
-// EDGE_POST_PATHS, so `_injectCsrfFields` tokens it automatically.
+// The unsubscribe confirm page (GET). A no-JS form POSTs the opaque,
+// single-purpose bearer token back to /stock-alert/unsubscribe — a
+// deliberate "yes, stop these alerts" step (no link-prefetcher
+// unsubscribe). The token rides in a hidden field (HTML-escaped) and is
+// the only handle — no email address or SKU is shown or carried, so the
+// page reveals nothing about the subscription. The token IS the
+// authorization (the action is in EDGE_POST_PATHS — CSRF-exempt — exactly
+// like the newsletter one-click unsubscribe), so no session is needed.
 function renderStockAlertUnsubscribeConfirm(opts) {
   opts = opts || {};
-  var email     = typeof opts.email === "string" ? opts.email : "";
-  var sku       = typeof opts.sku === "string" ? opts.sku : "";
-  var variantId = typeof opts.variant_id === "string" ? opts.variant_id : "";
+  var token = typeof opts.token === "string" ? opts.token : "";
   var body =
     "<section class=\"newsletter-thanks\">" +
       "<div class=\"newsletter-thanks__card\">" +
@@ -8174,9 +8174,7 @@ function renderStockAlertUnsubscribeConfirm(opts) {
         "<h1 class=\"newsletter-thanks__title\">Stop this alert?</h1>" +
         "<p class=\"newsletter-thanks__lede\">Confirm below and we'll cancel your back-in-stock alert for this item. You can set it again any time from the product page.</p>" +
         "<form class=\"newsletter-unsub__form\" method=\"post\" action=\"/stock-alert/unsubscribe\">" +
-          "<input type=\"hidden\" name=\"email\" value=\"" + _escAttr(email) + "\">" +
-          "<input type=\"hidden\" name=\"sku\" value=\"" + _escAttr(sku) + "\">" +
-          (variantId ? "<input type=\"hidden\" name=\"variant_id\" value=\"" + _escAttr(variantId) + "\">" : "") +
+          "<input type=\"hidden\" name=\"token\" value=\"" + _escAttr(token) + "\">" +
           "<div class=\"newsletter-thanks__cta\">" +
             "<button type=\"submit\" class=\"btn-primary\">Stop this alert</button>" +
             "<a href=\"/\" class=\"btn-ghost\">Keep me subscribed</a>" +
@@ -9240,6 +9238,16 @@ function renderPaymentMethods(opts) {
   var inner = rowsHtml
     ? "<ul class=\"pm-list\">" + rowsHtml + "</ul>"
     : "<div class=\"account-empty\"><p class=\"account-empty__lede\">No saved cards yet. Add one for faster checkout.</p></div>";
+  // "Add a card" CTA — only a live link when the add flow can actually
+  // complete (the Stripe publishable key drives the SetupIntent Payment
+  // Element on the add page). Absent it, render a disabled control + an
+  // honest note instead of a link that dead-ends on the add page's 503.
+  // Back-compat: callers that don't pass the flag keep the live link.
+  var addCardAvailable = opts.add_card_available !== false;
+  var ctaHtml = addCardAvailable
+    ? "<a class=\"btn-primary\" href=\"/account/payment-methods/add\">Add a card</a>"
+    : "<button type=\"button\" class=\"btn-primary\" disabled aria-disabled=\"true\">Add a card</button>" +
+      "<p class=\"form-notice form-notice--warn\" role=\"status\">Adding a card isn't available on this store yet — card storage isn't fully configured. Your saved cards still work for checkout.</p>";
   var body =
     "<section class=\"account-payment-methods\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -9250,7 +9258,7 @@ function renderPaymentMethods(opts) {
       success + notice +
       inner +
       "<div class=\"account-payment-methods__cta\">" +
-        "<a class=\"btn-primary\" href=\"/account/payment-methods/add\">Add a card</a>" +
+        ctaHtml +
       "</div>" +
     "</section>";
   return _wrap({
@@ -12415,13 +12423,24 @@ function mount(router, deps) {
         // fix; anything else is a server-side failure. Either way, render a
         // styled, recoverable page rather than raw text — back to the cart,
         // or back to the shipping form to re-enter the address.
+        // Server-side failure detail (a PSP / TLS / upstream error string)
+        // is operator material, not customer copy — it goes to the audit
+        // sink; the page gets the generic recoverable message. TypeError
+        // messages are this module's own validator prose and stay inline.
         var clientErr = (e instanceof TypeError);
+        if (!clientErr) {
+          b.audit.safeEmit({
+            action:   "storefront.checkout.confirm.error",
+            outcome:  "failure",
+            metadata: { message: msg },
+          });
+        }
         return _send(res, clientErr ? 400 : 500, renderCheckoutError({
           shop_name: shopName, theme: theme, eyebrow: "Checkout",
           title_text: clientErr ? "We couldn't process your shipping details" : "Checkout didn't go through",
           reason: clientErr
             ? "Some shipping details couldn't be read: " + msg + " Go back and check the address fields."
-            : "Something went wrong completing your order. Your cart is saved — please try again. (" + msg + ")",
+            : "Something went wrong completing your order. Your cart is saved and nothing was charged — please try again in a moment.",
           back_href: "/checkout", back_label: "Edit shipping",
           secondary_href: "/cart", secondary_label: "Back to cart",
         }));
@@ -13609,11 +13628,16 @@ function mount(router, deps) {
         if (okKind === "archived") successCopy = "Card removed.";
         if (okKind === "exists")   successCopy = "That card is already on file.";
         _send(res, code || 200, renderPaymentMethods({
-          payment_methods: rows,
-          notice:          notice || null,
-          success:         successCopy,
-          shop_name:       shopName,
-          cart_count:      cartCount,
+          payment_methods:   rows,
+          notice:            notice || null,
+          success:           successCopy,
+          // The add-card page needs the Stripe publishable key for the
+          // SetupIntent Payment Element; without it the add route 503s,
+          // so render the disabled "Add a card" state rather than a link
+          // into that dead end.
+          add_card_available: !!deps.stripe_publishable_key,
+          shop_name:         shopName,
+          cart_count:        cartCount,
         }));
       }
 
@@ -17463,7 +17487,11 @@ function mount(router, deps) {
       for (var m = 0; m < members.length; m += 1) {
         var mem = members[m];
         var share = listTotal > 0
-          ? Math.floor((bundleTotal * mem.list_line) / listTotal)
+          // Exact BigInt floor — bundleTotal and list_line are integer
+          // minor units; their product can exceed 2^53 on a large
+          // bundle, so a JS float multiply would drift. BigInt division
+          // truncates toward zero (floor for these non-negative values).
+          ? Number((BigInt(bundleTotal) * BigInt(mem.list_line)) / BigInt(listTotal))
           : Math.floor(bundleTotal / members.length);
         mem.alloc_line = share;
         allocated += share;
@@ -17723,6 +17751,9 @@ function mount(router, deps) {
         if (result && result.status === "subscribed" && result.confirmation_token && deps.email) {
           var origin = _stockAlertOrigin(req);
           var confirmUrl = origin + "/stock-alert/confirm/" + encodeURIComponent(result.confirmation_token);
+          // One-click unsubscribe link — the per-row bearer token IS the
+          // authorization (no email/sku tuple in the URL to guess).
+          var unsubscribeUrl = origin + "/stock-alert/unsubscribe?token=" + encodeURIComponent(result.unsubscribe_token);
           // Resolve the product title for the SKU (cheap indexed read; drop-
           // silent → fall back to the SKU as the title).
           var titleForSku = body.sku;
@@ -17734,10 +17765,11 @@ function mount(router, deps) {
           } catch (_e) { /* drop-silent — fall back to the SKU as the title */ }
           try {
             await deps.email.sendStockAlertConfirmation({
-              to:            body.email,
-              product_title: titleForSku,
-              sku:           body.sku,
-              confirm_url:   confirmUrl,
+              to:              body.email,
+              product_title:   titleForSku,
+              sku:             body.sku,
+              confirm_url:     confirmUrl,
+              unsubscribe_url: unsubscribeUrl,
             });
           } catch (_mailErr) { /* drop-silent — the row is written; the cron still fires on confirm */ }
         }
@@ -17782,9 +17814,13 @@ function mount(router, deps) {
       }));
     });
 
-    // Unsubscribe — by (email, sku, variant) tuple carried in the link query
-    // (stockAlerts has no unsubscribe-token API). GET renders a friendly
-    // confirm page (token-carrying container form); POST consumes it.
+    // Unsubscribe — by the opaque, single-purpose bearer token carried in
+    // the email's `?token=` link (the same shape as the newsletter
+    // one-click unsubscribe). The token IS the authorization, so knowing a
+    // victim's email + a SKU is no longer enough to cancel their alert.
+    // GET renders a friendly confirm page (no link-prefetcher unsubscribe);
+    // POST validates the token and deletes the row. The route is CSRF-exempt
+    // (EDGE_POST_PATHS) — the token is the bearer, there's no session.
     router.get("/stock-alert/unsubscribe", async function (req, res) {
       var q = (req.query && typeof req.query === "object") ? req.query : {};
       var cartCount = 0;
@@ -17792,36 +17828,32 @@ function mount(router, deps) {
       return _send(res, 200, renderStockAlertUnsubscribeConfirm({
         shop_name:  shopName,
         cart_count: cartCount,
-        email:      typeof q.email === "string" ? q.email : "",
-        sku:        typeof q.sku === "string" ? q.sku : "",
-        variant_id: typeof q.variant_id === "string" ? q.variant_id : "",
+        token:      typeof q.token === "string" ? q.token : "",
       }));
     });
 
     router.post("/stock-alert/unsubscribe", async function (req, res) {
       var body = req.body || {};
+      var token = typeof body.token === "string" ? body.token : "";
       var cartCount = 0;
       try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
       var outcome;
       try {
-        // Idempotent — a missing row returns { removed: false }, which still
-        // reads as "you're unsubscribed" (clicking the link twice is fine).
-        await deps.stockAlerts.unsubscribe({
-          email:      body.email,
-          sku:        body.sku,
-          variant_id: (body.variant_id != null && body.variant_id !== "") ? body.variant_id : null,
-        });
+        // `unsubscribeByToken` never throws on a token argument and returns
+        // a uniform `{ removed }` for valid / unknown / bad-shape tokens —
+        // no subscription-existence oracle. Every outcome renders the same
+        // "you're unsubscribed" copy (re-clicking the link twice is fine).
+        await deps.stockAlerts.unsubscribeByToken(token);
         outcome = "unsubscribed";
       } catch (e) {
-        // A bad-shape tuple throws TypeError → generic non-leaking page; a
-        // real fault degrades the same way rather than 500-ing a public route.
+        // Only a real infrastructure fault (D1 unreachable) lands here —
+        // record it and render the generic non-leaking page rather than a
+        // 500 that exposes internals on a public, unauthenticated route.
         outcome = "invalid";
-        if (!(e instanceof TypeError)) {
-          _log.error("storefront stock-alert unsubscribe failed", {
-            route: "/stock-alert/unsubscribe", request_id: (req && req.requestId) || null,
-            err: (e && e.message) || String(e),
-          });
-        }
+        _log.error("storefront stock-alert unsubscribe failed", {
+          route: "/stock-alert/unsubscribe", request_id: (req && req.requestId) || null,
+          err: (e && e.message) || String(e),
+        });
       }
       return _send(res, 200, renderStockAlertUnsubscribeResult({
         shop_name: shopName, cart_count: cartCount, outcome: outcome,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.59",
+  "version": "0.3.62",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {