@blamejs/blamejs-shop 0.3.60 → 0.3.63

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.63 (2026-06-04) — **Digital-only carts can check out, and the outbound TLS posture is documented end to end.** A cart containing only digital goods could never complete checkout: the shipping resolver correctly filters physical services out for a cart that ships nothing, but checkout then demanded the configured default physical service resolve anyway and refused the order. Digital-only carts now select the operator's digital-shipping service when one is configured, and otherwise complete with a synthesized zero-cost no-shipping selection; a physical cart with a misconfigured service id still fails loudly, since that is a real configuration error. Separately, every outbound TLS connection has been audited against the framework's post-quantum-first key-exchange posture: of all fixed external hosts, only the Stripe API edge refuses the post-quantum groups (already handled by the payment module's explicit agent) — the CAPTCHA providers, PayPal, and Cloudflare all negotiate hybrids cleanly. Operator-supplied destinations — webhook receiver URLs and admin media source URLs — deliberately keep the post-quantum-first default, with the failure mode documented where operators will look for it: a receiver that cannot negotiate a hybrid group sees deliveries fail with a TLS handshake failure, retry on the backoff schedule, and land in the dead-letter queue; a media source URL that cannot fails as the existing clean fetch error. A regression test pins that these dials never silently downgrade. **Changed:** *Outbound TLS posture audited and documented* — Every outbound connection was audited against the framework's post-quantum-first TLS key-exchange list. Fixed external hosts: the Stripe API edge is the only one that refuses the post-quantum groups, and the payment module's explicitly scoped agent already covers it (PayPal currently negotiates hybrids; the agent remains as defense). Operator-supplied destinations keep the post-quantum-first default deliberately: an outbound-webhook receiver that cannot negotiate a hybrid group sees deliveries fail with a TLS handshake failure (alert 40), retry on the backoff schedule, and reach the dead-letter queue after the fifth attempt — front such a receiver with a post-quantum-capable proxy or upgrade its TLS stack; an admin media source URL that cannot negotiate fails as the existing clean fetch error, and the file can be uploaded directly instead. Module documentation now states this where the integrations are configured, and a regression test pins that these dials never silently downgrade. **Fixed:** *Digital-only carts complete checkout* — Shipping rate resolution offers only digital-shipping services to a cart in which no line requires shipping — so the configured default physical service id could never resolve, and checkout refused every all-digital order. Checkout now falls back for all-digital carts: the operator's digital-shipping service is selected when configured, and a zero-cost "No shipping required" selection is synthesized otherwise, so the order completes and records zero shipping. Physical carts are unchanged: an unresolvable service id still fails at the boundary, because that is a real configuration typo.
+
+- v0.3.62 (2026-06-04) — **Live card payments work, and back-in-stock unsubscribe is token-gated.** Checkout failed at the charge step on Stripe-configured deploys: the framework's outbound HTTP client offers only post-quantum hybrid TLS key-exchange groups, and the Stripe and PayPal API edges do not negotiate any of them yet, so every processor call died with a TLS handshake failure (alert 40) and checkout rendered a server error. The payment module now dials the processors through an explicitly constructed agent — TLS 1.3 minimum, the platform's default key-exchange groups — which is the framework's prescribed pattern for a peer that cannot meet the post-quantum list: the downgrade is visible in the code, scoped to the processor connections only, and every other outbound connection keeps the post-quantum-first default. Verified against the live Stripe API. The downgrade reverts when the processor edges add hybrid key-exchange support. Separately, the checkout error page no longer echoes upstream failure detail (such as TLS library internals) to the customer — that detail goes to the audit log, and the page states plainly that nothing was charged. This release also token-gates back-in-stock unsubscribe: cancelling a back-in-stock alert previously took only the subscriber's email address and the product SKU — guessable values, so a third party could silently cancel someone else's restock notification. Unsubscribe is now authorized by an opaque per-subscription token, carried in the confirmation and notification emails as a one-click link, exactly like the newsletter's unsubscribe. Tokens are stored only as keyed hashes, compared in constant time, and unknown tokens get the same response as valid ones, so the endpoint is not a subscription-existence oracle. A schema migration adds the token column; it applies automatically on deploy. **Changed:** *Back-in-stock unsubscribe requires the emailed token* — POST /stock-alert/unsubscribe no longer accepts an email + SKU pair; it requires the per-subscription token from the unsubscribe link in the confirmation or back-in-stock email. The token is minted at subscribe time for the confirmation mail and rotated per notification send, stored only as a keyed hash, and verified with a constant-time compare; bad or unknown tokens return the same uniform response as valid ones. The one-click link works without cookies or a signed-in session, so mail clients can fire it directly; each email carries the token that is current for its send. Operators upgrading: migration 0207 adds the token column and applies with the normal deploy. **Fixed:** *Stripe and PayPal connections complete their TLS handshake* — The outbound HTTP client's default TLS posture offers exclusively post-quantum hybrid key-exchange groups. Processor API edges currently answer that ClientHello with handshake_failure (TLS alert 40), so the first real charge attempt on a Stripe-configured deploy failed checkout with a server error. The payment module now passes its own connection agent on every processor call — TLS 1.3 minimum is kept, key exchange falls back to the platform defaults — while the client's SSRF pinning, retries, and response caps stay in force. The agent is scoped to the payment-processor dials; all other outbound traffic keeps the post-quantum-first posture. A regression test pins the agent's presence and configuration on the charge path. · *Checkout server errors no longer echo upstream detail to the customer* — When the charge step failed, the checkout error page interpolated the underlying error string — in this case raw TLS library internals — into the customer-facing message. Server-side failure detail now goes to the audit log; the customer sees a plain recoverable message that confirms nothing was charged. Field-validation messages, which are written for customers, are unaffected.
+
 - v0.3.60 (2026-06-04) — **Exact integer math for percentage discounts and insurance premiums, and an honest Add-a-card state under partial Stripe configuration.** Every place that computes a percentage of a money amount — automatic percent-off discounts, bundle discounts and their per-line allocation, partial-refund policy amounts, and shipping-insurance premiums — now uses exact integer arithmetic instead of a floating-point intermediate. On very large amounts the float product loses precision past 2^53 and can drift the rounded result by a minor unit; charged totals were never affected (the charge path was already integer end-to-end), but displayed and clamped values now match exact math everywhere, with each site's rounding direction preserved. Separately, the account Payment-methods screen no longer links into a 503 when the Stripe publishable key is missing: the Add-a-card affordance now renders as a disabled control with an explanatory note until the configuration is complete, matching how the unconfigured checkout behaves. **Fixed:** *Percentage-of-amount math is exact integer arithmetic* — Automatic percent-off discounts, bundle discounts, the cart's per-line bundle allocation, partial-refund policy amounts, and shipping-insurance premiums all computed `amount × basis_points / 10000` through a floating-point multiply. Amounts and rates are both integers, so the computation is now exact integer arithmetic with each site's rounding direction unchanged — half-away-from-zero for discounts, floor for allocations and refunds, ceiling for insurance premiums (the insurer is never short). The drift was only reachable on very large amounts (products beyond 2^53) and never touched a charged total, which was already integer end-to-end; tests now pin exact results on amounts past the float-precision boundary. · *Add a card renders honestly when Stripe configuration is incomplete* — Saving a card needs the Stripe publishable key in addition to the server-side API keys. With the server keys set but the publishable key missing, the Payment-methods screen rendered a live "Add a card" link that dead-ended on a 503. The link now gates on the same condition the add route enforces: when the publishable key is absent it renders as a disabled control with a note explaining the missing configuration, while listing, choosing a default, and removing saved cards keep working. The route's own 503 remains as defense in depth for a directly typed URL.
 
 - v0.3.59 (2026-06-04) — **Back-in-stock subscribe rate-limited, payment-method metadata in privacy exports, and accessible wishlist alert toggles.** The anonymous back-in-stock "notify me" endpoint sends a confirmation email to the address the request supplies; it now sits in the same tight per-IP rate budget as login, checkout, and the newsletter, closing a victim-addressed email-flooding vector. Privacy (GDPR/CCPA) data exports now include saved-payment-method display metadata — card brand, last four, expiry — which is personal data the export was silently omitting. The wishlist alert and digest toggle buttons gain accessible names that include the alert they control, so a screen reader no longer announces a list of identical "Turn on" buttons. Internal housekeeping rides along: module imports hoisted to file tops, a per-test wall-clock-ceiling helper backing an existing test gate, and stale comments corrected. **Fixed:** *Back-in-stock subscribe joins the tight rate limit* — POST /stock-alert/subscribe is anonymous and sends a double-opt-in confirmation email to the request-supplied address. It previously sat only behind the loose global token bucket, so a script could direct a burst of confirmation emails at an arbitrary victim address — an email-flooding and sender-reputation risk. The route now shares the tight per-IP, per-path budget that already covers login, registration, checkout, gift-card balance, and the newsletter; the integration suite pins the throttle. · *Privacy exports include saved-payment-method metadata* — The subject-access (GDPR/CCPA) export composed every reader except saved payment methods, which was wired to an empty handle — an export silently omitted the card brand, last-four digits, and expiry the shop stores alongside the opaque processor token. The reader now receives the live handle, so a customer's export reflects everything held about them. Only display metadata is stored or exported — never card numbers. · *Wishlist alert toggles are screen-reader distinguishable* — The account wishlist-alerts screen rendered visually identical "Turn on" / "Turn off" / "Subscribe" buttons whose accessible names did not say which alert or digest they control. Each toggle now carries an accessible name that includes its alert label (for example "Turn off Price-drop alerts"), satisfying WCAG 2.4.6 for assistive-technology users walking the button list.

package/lib/admin.js

@@ -1172,6 +1172,18 @@ function mount(router, deps) {
   // records the media row. Endpoint is omitted entirely when no
   // r2_bridge is wired (operator hasn't set D1_BRIDGE_URL +
   // D1_BRIDGE_SECRET).
+  //
+  // TLS posture — `source_url` is operator-pasted and arbitrary, so the
+  // fetch keeps b.httpClient's PQC-first default (ML-KEM hybrid groups,
+  // TLS 1.3 minimum). A `source_url` host that doesn't negotiate an
+  // ML-KEM hybrid group answers with a handshake_failure (TLS alert 40);
+  // that surfaces below as the same clean 502 `source-fetch-failed`
+  // (`e.message` carries the alert) the operator already retries by
+  // re-submitting. We do NOT pin a classical-downgrade agent here the
+  // way the PSP adapters do for their two fixed endpoints — an arbitrary
+  // operator-supplied URL is not a fixed processor edge, so holding the
+  // PQC default is the deliberate posture. Operators sourcing from a
+  // host that can't meet the PQC list upload the file directly instead.
   if (r2) {
     // Fetch → store → attach, shared by the JSON upload route and the
     // browser POST alias. Throws TypeError on bad input (mapped to 400);

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.60",
+  "version": "0.3.63",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/checkout.js

@@ -631,8 +631,25 @@ function create(deps) {
         }
       }
       if (!selected) {
-        throw new TypeError("checkout: selected_shipping_id " + JSON.stringify(input.selected_shipping_id) +
-                            " not available for ship_to");
+        // All-digital cart: shipping.rates() deliberately filters the
+        // physical services out, so the caller's default (a physical
+        // service id like "std") can never resolve — that is the cart's
+        // shape, not a config error. Prefer the operator's digital_only
+        // offering when one is configured; otherwise synthesize the
+        // zero-cost no-shipping selection so a digital-only order
+        // completes. A physical cart with an unresolvable id still
+        // throws — that IS a config typo and must surface.
+        var anyShippable = enrichedLines.some(function (l) {
+          return l.requires_shipping === undefined ? true : !!l.requires_shipping;
+        });
+        if (!anyShippable) {
+          selected = ratesRow.services.length
+            ? ratesRow.services[0]
+            : { id: "digital_none", label: "No shipping required", amount_minor: 0, digital_only: true };
+        } else {
+          throw new TypeError("checkout: selected_shipping_id " + JSON.stringify(input.selected_shipping_id) +
+                              " not available for ship_to");
+        }
       }
     }
 

package/lib/email.js

@@ -303,6 +303,7 @@ var STOCK_ALERT_CONFIRM_HTML =
   "  <p style=\"margin:0 0 16px;\">You asked to be emailed when <strong>{{product_title}}</strong> (SKU {{sku}}) is back in stock. Confirm below and we'll email you once, the moment it returns.</p>\n" +
   "  <p style=\"margin:24px 0;\"><a href=\"{{confirm_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Confirm my alert</a></p>\n" +
   "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If you didn't request this, ignore this email — no alert is set until you confirm. Link: {{confirm_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">Changed your mind? Cancel this alert: {{unsubscribe_url}}</p>\n" +
   "</div>\n" +
   "</body></html>\n";
 
@@ -311,7 +312,8 @@ var STOCK_ALERT_CONFIRM_TEXT =
   "You asked to be emailed when {{product_title}} (SKU {{sku}}) is back in stock.\n" +
   "Confirm to set the alert — we'll email you once, the moment it returns.\n\n" +
   "Confirm: {{confirm_url}}\n\n" +
-  "If you didn't request this, ignore this email — no alert is set until you confirm.\n";
+  "If you didn't request this, ignore this email — no alert is set until you confirm.\n" +
+  "Changed your mind? Cancel this alert: {{unsubscribe_url}}\n";
 
 var BACK_IN_STOCK_HTML =
   "<!DOCTYPE html>\n" +
@@ -664,8 +666,9 @@ function create(opts) {
       );
     },
 
-    // Back-in-stock double-opt-in confirmation. `confirm_url` is built by
-    // the route from SHOP_ORIGIN + the plaintext token returned once by
+    // Back-in-stock double-opt-in confirmation. `confirm_url` +
+    // `unsubscribe_url` are built by the route from SHOP_ORIGIN + the
+    // plaintext confirm/unsubscribe tokens returned once by
     // stockAlerts.subscribe. product_title / sku are catalog data; the
     // strict renderer escapes every field anyway (escape-by-default).
     sendStockAlertConfirmation: async function (input) {
@@ -677,9 +680,10 @@ function create(opts) {
         throw new TypeError("email.sendStockAlertConfirmation: confirm_url required");
       }
       var vars = {
-        product_title: input.product_title == null ? input.sku || "this item" : String(input.product_title),
-        sku:           input.sku == null ? "—" : String(input.sku),
-        confirm_url:   input.confirm_url,
+        product_title:   input.product_title == null ? input.sku || "this item" : String(input.product_title),
+        sku:             input.sku == null ? "—" : String(input.sku),
+        confirm_url:     input.confirm_url,
+        unsubscribe_url: input.unsubscribe_url == null ? "" : String(input.unsubscribe_url),
       };
       var html = _render(STOCK_ALERT_CONFIRM_HTML, vars);
       var text = _render(STOCK_ALERT_CONFIRM_TEXT, vars);

package/lib/payment.js

@@ -23,9 +23,26 @@
  *   token can't smuggle unsigned events into the order pipeline.
  */
 
+var nodeHttps = require("node:https");   // allow:non-shop-require — the PSP TLS agent must be a real node https.Agent for the vendored httpClient's caller-agent (h1) path; no b.* primitive constructs one, and the framework's downgrade prescription is an explicitly-built agent in the consumer's diff
+
 var b = require("./vendor/blamejs");
 var C = b.constants;
 
+// External payment processors do not negotiate the framework's PQC-hybrid
+// TLS groups yet: the vendored httpClient offers ONLY ML-KEM hybrid groups
+// (constants.TLS_GROUP_PREFERENCE), and api.stripe.com / api-m.paypal.com
+// answer that ClientHello with handshake_failure (TLS alert 40) — which
+// surfaced as a checkout failure the moment a charge was attempted. The
+// framework's own prescription for a peer that can't meet the PQC list is
+// an explicitly-constructed agent so the downgrade is visible in this
+// diff: TLS 1.3 minimum stays pinned, the key-exchange groups fall back to
+// Node's defaults (classical X25519 / P-256 today). The vendored client
+// honors a caller agent per request (h1 path) while keeping its SSRF-
+// pinned DNS lookup, retries, and response caps. Scoped to the PSP dials
+// only — every other outbound keeps the PQC-first default. Revisit when
+// the processor edges negotiate ML-KEM hybrid groups.
+var _PSP_TLS_AGENT = new nodeHttps.Agent({ keepAlive: true, minVersion: "TLSv1.3" });
+
 var STRIPE_API_BASE_DEFAULT  = "https://api.stripe.com/v1";
 var STRIPE_WEBHOOK_TOLERANCE = 300;   // ± 5 minutes (Stripe default)
 var STRIPE_HTTP_TIMEOUT_MS   = 15000;
@@ -185,6 +202,7 @@ async function _stripeCall(opts, method, path, params, idempotencyKey) {
     headers:   headers,
     body:      body || undefined,
     timeoutMs: opts.timeoutMs || STRIPE_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json = null;
@@ -641,6 +659,7 @@ async function _paypalToken(opts, state) {
     },
     body:      "grant_type=client_credentials",
     timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = {}; }
@@ -675,6 +694,7 @@ async function _paypalCall(opts, state, method, path, bodyObj, requestId) {
     headers:   headers,
     body:      body,
     timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+    agent:     _PSP_TLS_AGENT,
   });
   var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
   var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = { _raw: text }; }

package/lib/security-middleware.js

@@ -141,6 +141,13 @@ var EDGE_POST_PATHS = [
   // the `edge-form-csrf-exempt` detector lookahead in
   // test/layer-0-primitives/codebase-patterns.test.js.
   "/stock-alert/subscribe",
+  // Back-in-stock one-click unsubscribe — same bearer-token model as
+  // /unsubscribe above. The opaque, per-row token in the `?token=` link IS
+  // the authorization; the POST a mail client fires carries no cookies and no
+  // session CSRF token, so the path is exempt from the double-submit check
+  // (it keeps SameSite + fetch-metadata defense and is enumeration-safe +
+  // timing-safe at the token layer).
+  "/stock-alert/unsubscribe",
 ];
 
 // The TLS-terminated public origin(s) the storefront is served on. Behind

package/lib/stock-alerts.js

@@ -36,9 +36,14 @@
  *   Composes:
  *     - `b.crypto.namespaceHash` — email hash + token hash.
  *     - `b.crypto.generateBytes` — 24 random bytes →
- *       base64url-encoded to a 32-character plaintext token. The
- *       plaintext is returned ONCE from `subscribe`; only the hash
- *       persists.
+ *       base64url-encoded to a 32-character plaintext token, used for
+ *       BOTH the double-opt-in confirmation token and the unsubscribe
+ *       bearer token. Each plaintext is returned ONCE (confirm + unsub
+ *       tokens from `subscribe`; a fresh unsub token per fired row from
+ *       `scanAndNotify`); only the hashes persist.
+ *     - `b.crypto.timingSafeEqual` — constant-time re-comparison of the
+ *       stored unsubscribe-token hash against the recomputed hash so the
+ *       unknown-token miss path can't be distinguished by latency.
  *     - `b.guardEmail` — strict-profile email validation +
  *       sanitization before normalisation.
  *     - `b.guardUuid` — optional customer_id / variant_id shape gate.
@@ -49,11 +54,13 @@
  *
  * @primitive stockAlerts
  * @related   b.crypto.namespaceHash, b.crypto.generateBytes,
- *            b.guardEmail, b.guardUuid, notifications
+ *            b.crypto.timingSafeEqual, b.guardEmail, b.guardUuid,
+ *            notifications
  */
 
 var EMAIL_NAMESPACE = "stock-alert-email";
 var TOKEN_NAMESPACE = "stock-alert-token";
+var UNSUB_NAMESPACE = "stock-alert-unsub-token";
 var TOKEN_BYTES     = 24;                // 24 raw bytes → 32 base64url chars
 var TOKEN_LEN       = 32;
 var TOKEN_RE        = /^[A-Za-z0-9_-]{32}$/;
@@ -146,6 +153,10 @@ function _hashToken(plaintext) {
   return b.crypto.namespaceHash(TOKEN_NAMESPACE, plaintext);
 }
 
+function _hashUnsubToken(plaintext) {
+  return b.crypto.namespaceHash(UNSUB_NAMESPACE, plaintext);
+}
+
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -180,6 +191,7 @@ function create(opts) {
   return {
     EMAIL_NAMESPACE: EMAIL_NAMESPACE,
     TOKEN_NAMESPACE: TOKEN_NAMESPACE,
+    UNSUB_NAMESPACE: UNSUB_NAMESPACE,
     TOKEN_LEN:       TOKEN_LEN,
     EVENT_TYPE:      EVENT_TYPE,
 
@@ -193,12 +205,14 @@ function create(opts) {
     // Subscribe to the back-in-stock alert for a SKU (and optionally
     // a specific variant). Returns:
     //   { id, status: "subscribed" | "already-pending" |
-    //     "already-confirmed", confirmation_token?, email_hash,
-    //     expires_at }
-    // The plaintext `confirmation_token` is returned ONLY on a
-    // brand-new subscription. Re-subscriptions surface the existing
-    // row's status — operators that want to re-send the confirmation
-    // email mint a fresh subscription by calling `unsubscribe` first.
+    //     "already-confirmed", confirmation_token?, unsubscribe_token?,
+    //     email_hash, expires_at }
+    // The plaintext `confirmation_token` and `unsubscribe_token` are
+    // returned ONLY on a brand-new subscription — the confirmation email
+    // carries both (the confirm link + a one-click unsubscribe link). Only
+    // their hashes persist. Re-subscriptions surface the existing row's
+    // status — operators that want to re-send the confirmation email mint
+    // a fresh subscription by calling `unsubscribeByToken` first.
     subscribe: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("stockAlerts.subscribe: input object required");
@@ -237,23 +251,26 @@ function create(opts) {
         await query("DELETE FROM stock_alerts WHERE id = ?1", [existing.id]);
       }
 
-      var token     = _mintToken();
-      var tokenHash = _hashToken(token);
-      var id        = b.uuid.v7();
-      var expiresAt = now + ttlMs;
+      var token      = _mintToken();
+      var tokenHash  = _hashToken(token);
+      var unsubToken = _mintToken();
+      var unsubHash  = _hashUnsubToken(unsubToken);
+      var id         = b.uuid.v7();
+      var expiresAt  = now + ttlMs;
 
       await query(
         "INSERT INTO stock_alerts " +
         "(id, email_hash, email_normalised, sku, variant_id, customer_id, " +
-        " confirmation_token_hash, confirmed_at, notified_at, expires_at, created_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, NULL, ?8, ?9)",
-        [id, emailHash, emailNorm, sku, variantId, customerId, tokenHash, expiresAt, now],
+        " confirmation_token_hash, unsubscribe_token_hash, confirmed_at, notified_at, expires_at, created_at) " +
+        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, NULL, ?9, ?10)",
+        [id, emailHash, emailNorm, sku, variantId, customerId, tokenHash, unsubHash, expiresAt, now],
       );
       return {
         id:                 id,
         status:             "subscribed",
         email_hash:         emailHash,
         confirmation_token: token,
+        unsubscribe_token:  unsubToken,
         expires_at:         expiresAt,
       };
     },
@@ -293,23 +310,45 @@ function create(opts) {
       return row;
     },
 
-    // Unsubscribe by (email, sku, variant?) — the storefront's
-    // unsubscribe link from the notification email lands here.
-    // Returns `{ removed: boolean }`. Idempotent: a missing row is
-    // not an error.
-    unsubscribe: async function (input) {
-      if (!input || typeof input !== "object") {
-        throw new TypeError("stockAlerts.unsubscribe: input object required");
+    // Unsubscribe by the per-row bearer token carried in the email's
+    // unsubscribe link. The token IS the authorization — knowing a
+    // victim's email + a SKU is no longer enough to cancel their alert,
+    // only the opaque token the shop emailed them is. Resolves the row by
+    // the token's namespaceHash and deletes it.
+    //
+    // Enumeration-safe by construction: a bad-shape, empty, or unknown
+    // token returns the SAME `{ removed: false }` shape a valid-but-
+    // already-removed token does (idempotent re-click), and the miss path
+    // burns the same constant-time comparison as the hit path so the
+    // unknown-vs-known distinction doesn't leak through response latency.
+    // Never throws on a token argument — the public route renders a
+    // uniform "you're unsubscribed" page for every outcome.
+    unsubscribeByToken: async function (plaintext) {
+      if (typeof plaintext !== "string" || !TOKEN_RE.test(plaintext)) {
+        // Bad shape can't match any stored hash — short-circuit to the
+        // same no-op the unknown-token path returns. No oracle.
+        return { removed: false };
       }
-      var emailNorm = _normaliseEmail(input.email);
-      var sku       = _validateSku(input.sku);
-      var variantId = _optUuid(input.variant_id, "variant_id");
-      var emailHash = _hashEmail(emailNorm);
-      var r = await query(
-        "DELETE FROM stock_alerts WHERE email_hash = ?1 AND sku = ?2 " +
-        "AND COALESCE(variant_id, '') = COALESCE(?3, '')",
-        [emailHash, sku, variantId],
-      );
+      var unsubHash = _hashUnsubToken(plaintext);
+      var row = (await query(
+        "SELECT id, unsubscribe_token_hash FROM stock_alerts " +
+        "WHERE unsubscribe_token_hash = ?1 LIMIT 1",
+        [unsubHash],
+      )).rows[0];
+      if (!row) {
+        // Miss path — burn the same comparison work as the hit path so
+        // the latency profile matches (the compared values are equal by
+        // construction; the result is discarded).
+        b.crypto.timingSafeEqual(unsubHash, unsubHash);
+        return { removed: false };
+      }
+      // Constant-time check of the stored hash against the recomputed
+      // hash — belt-and-braces against any future change to the index
+      // lookup. A mismatch reads as a miss (uniform no-op).
+      if (!b.crypto.timingSafeEqual(row.unsubscribe_token_hash, unsubHash)) {
+        return { removed: false };
+      }
+      var r = await query("DELETE FROM stock_alerts WHERE id = ?1", [row.id]);
       return { removed: Number(r.rowCount || 0) > 0 };
     },
 
@@ -391,11 +430,18 @@ function create(opts) {
     // Operator-driven sweeper. Walks every pending (confirmed +
     // un-notified + un-expired) subscription whose SKU now has
     // catalog.inventory.stock_on_hand - stock_held > 0 and:
-    //   1. stamps notified_at on the row, and
-    //   2. (if notifications is wired) enqueues an in-app message
+    //   1. mints a fresh unsubscribe bearer token, rotating the row's
+    //      unsubscribe_token_hash so the notification email's one-click
+    //      unsubscribe link is a live, single-purpose handle (the prior
+    //      confirmation-email token is superseded — a notified row is
+    //      terminal so its older link is moot anyway),
+    //   2. stamps notified_at on the row, and
+    //   3. (if notifications is wired) enqueues an in-app message
     //      keyed by the recipient's email_hash.
     // Returns `{ scanned, notified, enqueued, rows }` — `rows` is the
-    // shape that fired, post-update. The sweeper is idempotent at the
+    // shape that fired, post-update, each carrying the plaintext
+    // `unsubscribe_token` (returned ONCE here, for the email builder to
+    // embed; only the hash persists). The sweeper is idempotent at the
     // row level: a row that's already been notified is skipped.
     scanAndNotify: async function (sweepOpts) {
       sweepOpts = sweepOpts || {};
@@ -453,11 +499,23 @@ function create(opts) {
         var rows = bySku[skuKey];
         for (var k = 0; k < rows.length; k += 1) {
           var row = rows[k];
-          await query(
-            "UPDATE stock_alerts SET notified_at = ?1 WHERE id = ?2 AND notified_at IS NULL",
-            [now, row.id],
+          // Mint + rotate a fresh unsubscribe bearer for this fired row.
+          // The plaintext rides out on the row object (the email builder
+          // embeds it); only the hash is durable. The `notified_at IS
+          // NULL` guard makes the update a claim: when two sweeps race
+          // the same pending row, exactly one wins. The loser MUST skip
+          // the row — its freshly minted token never persisted, so an
+          // email built from it would carry a dead unsubscribe link, and
+          // pushing the row would double-notify the subscriber.
+          var rowUnsubToken = _mintToken();
+          var claim = await query(
+            "UPDATE stock_alerts SET notified_at = ?1, unsubscribe_token_hash = ?2 " +
+            "WHERE id = ?3 AND notified_at IS NULL",
+            [now, _hashUnsubToken(rowUnsubToken), row.id],
           );
+          if (!claim || Number(claim.rowCount) !== 1) continue;
           row.notified_at = now;
+          row.unsubscribe_token = rowUnsubToken;
           fired.push(row);
           if (notifications) {
             try {
@@ -541,5 +599,6 @@ module.exports = {
   create:          create,
   EMAIL_NAMESPACE: EMAIL_NAMESPACE,
   TOKEN_NAMESPACE: TOKEN_NAMESPACE,
+  UNSUB_NAMESPACE: UNSUB_NAMESPACE,
   TOKEN_LEN:       TOKEN_LEN,
 };

package/lib/storefront.js

@@ -8156,17 +8156,17 @@ function renderStockAlertConfirm(opts) {
   });
 }
 
-// The unsubscribe confirm page (GET). A no-JS form POSTs the (email, sku,
-// variant) tuple back to /stock-alert/unsubscribe — a deliberate "yes,
-// stop these alerts" step (no link-prefetcher unsubscribe). The tuple
-// rides in hidden fields (HTML-escaped). This page is container-rendered
-// from a GET, so it CAN carry the `_csrf` token — the action is NOT in
-// EDGE_POST_PATHS, so `_injectCsrfFields` tokens it automatically.
+// The unsubscribe confirm page (GET). A no-JS form POSTs the opaque,
+// single-purpose bearer token back to /stock-alert/unsubscribe — a
+// deliberate "yes, stop these alerts" step (no link-prefetcher
+// unsubscribe). The token rides in a hidden field (HTML-escaped) and is
+// the only handle — no email address or SKU is shown or carried, so the
+// page reveals nothing about the subscription. The token IS the
+// authorization (the action is in EDGE_POST_PATHS — CSRF-exempt — exactly
+// like the newsletter one-click unsubscribe), so no session is needed.
 function renderStockAlertUnsubscribeConfirm(opts) {
   opts = opts || {};
-  var email     = typeof opts.email === "string" ? opts.email : "";
-  var sku       = typeof opts.sku === "string" ? opts.sku : "";
-  var variantId = typeof opts.variant_id === "string" ? opts.variant_id : "";
+  var token = typeof opts.token === "string" ? opts.token : "";
   var body =
     "<section class=\"newsletter-thanks\">" +
       "<div class=\"newsletter-thanks__card\">" +
@@ -8174,9 +8174,7 @@ function renderStockAlertUnsubscribeConfirm(opts) {
         "<h1 class=\"newsletter-thanks__title\">Stop this alert?</h1>" +
         "<p class=\"newsletter-thanks__lede\">Confirm below and we'll cancel your back-in-stock alert for this item. You can set it again any time from the product page.</p>" +
         "<form class=\"newsletter-unsub__form\" method=\"post\" action=\"/stock-alert/unsubscribe\">" +
-          "<input type=\"hidden\" name=\"email\" value=\"" + _escAttr(email) + "\">" +
-          "<input type=\"hidden\" name=\"sku\" value=\"" + _escAttr(sku) + "\">" +
-          (variantId ? "<input type=\"hidden\" name=\"variant_id\" value=\"" + _escAttr(variantId) + "\">" : "") +
+          "<input type=\"hidden\" name=\"token\" value=\"" + _escAttr(token) + "\">" +
           "<div class=\"newsletter-thanks__cta\">" +
             "<button type=\"submit\" class=\"btn-primary\">Stop this alert</button>" +
             "<a href=\"/\" class=\"btn-ghost\">Keep me subscribed</a>" +
@@ -12425,13 +12423,24 @@ function mount(router, deps) {
         // fix; anything else is a server-side failure. Either way, render a
         // styled, recoverable page rather than raw text — back to the cart,
         // or back to the shipping form to re-enter the address.
+        // Server-side failure detail (a PSP / TLS / upstream error string)
+        // is operator material, not customer copy — it goes to the audit
+        // sink; the page gets the generic recoverable message. TypeError
+        // messages are this module's own validator prose and stay inline.
         var clientErr = (e instanceof TypeError);
+        if (!clientErr) {
+          b.audit.safeEmit({
+            action:   "storefront.checkout.confirm.error",
+            outcome:  "failure",
+            metadata: { message: msg },
+          });
+        }
         return _send(res, clientErr ? 400 : 500, renderCheckoutError({
           shop_name: shopName, theme: theme, eyebrow: "Checkout",
           title_text: clientErr ? "We couldn't process your shipping details" : "Checkout didn't go through",
           reason: clientErr
             ? "Some shipping details couldn't be read: " + msg + " Go back and check the address fields."
-            : "Something went wrong completing your order. Your cart is saved — please try again. (" + msg + ")",
+            : "Something went wrong completing your order. Your cart is saved and nothing was charged — please try again in a moment.",
           back_href: "/checkout", back_label: "Edit shipping",
           secondary_href: "/cart", secondary_label: "Back to cart",
         }));
@@ -17742,6 +17751,9 @@ function mount(router, deps) {
         if (result && result.status === "subscribed" && result.confirmation_token && deps.email) {
           var origin = _stockAlertOrigin(req);
           var confirmUrl = origin + "/stock-alert/confirm/" + encodeURIComponent(result.confirmation_token);
+          // One-click unsubscribe link — the per-row bearer token IS the
+          // authorization (no email/sku tuple in the URL to guess).
+          var unsubscribeUrl = origin + "/stock-alert/unsubscribe?token=" + encodeURIComponent(result.unsubscribe_token);
           // Resolve the product title for the SKU (cheap indexed read; drop-
           // silent → fall back to the SKU as the title).
           var titleForSku = body.sku;
@@ -17753,10 +17765,11 @@ function mount(router, deps) {
           } catch (_e) { /* drop-silent — fall back to the SKU as the title */ }
           try {
             await deps.email.sendStockAlertConfirmation({
-              to:            body.email,
-              product_title: titleForSku,
-              sku:           body.sku,
-              confirm_url:   confirmUrl,
+              to:              body.email,
+              product_title:   titleForSku,
+              sku:             body.sku,
+              confirm_url:     confirmUrl,
+              unsubscribe_url: unsubscribeUrl,
             });
           } catch (_mailErr) { /* drop-silent — the row is written; the cron still fires on confirm */ }
         }
@@ -17801,9 +17814,13 @@ function mount(router, deps) {
       }));
     });
 
-    // Unsubscribe — by (email, sku, variant) tuple carried in the link query
-    // (stockAlerts has no unsubscribe-token API). GET renders a friendly
-    // confirm page (token-carrying container form); POST consumes it.
+    // Unsubscribe — by the opaque, single-purpose bearer token carried in
+    // the email's `?token=` link (the same shape as the newsletter
+    // one-click unsubscribe). The token IS the authorization, so knowing a
+    // victim's email + a SKU is no longer enough to cancel their alert.
+    // GET renders a friendly confirm page (no link-prefetcher unsubscribe);
+    // POST validates the token and deletes the row. The route is CSRF-exempt
+    // (EDGE_POST_PATHS) — the token is the bearer, there's no session.
     router.get("/stock-alert/unsubscribe", async function (req, res) {
       var q = (req.query && typeof req.query === "object") ? req.query : {};
       var cartCount = 0;
@@ -17811,36 +17828,32 @@ function mount(router, deps) {
       return _send(res, 200, renderStockAlertUnsubscribeConfirm({
         shop_name:  shopName,
         cart_count: cartCount,
-        email:      typeof q.email === "string" ? q.email : "",
-        sku:        typeof q.sku === "string" ? q.sku : "",
-        variant_id: typeof q.variant_id === "string" ? q.variant_id : "",
+        token:      typeof q.token === "string" ? q.token : "",
       }));
     });
 
     router.post("/stock-alert/unsubscribe", async function (req, res) {
       var body = req.body || {};
+      var token = typeof body.token === "string" ? body.token : "";
       var cartCount = 0;
       try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
       var outcome;
       try {
-        // Idempotent — a missing row returns { removed: false }, which still
-        // reads as "you're unsubscribed" (clicking the link twice is fine).
-        await deps.stockAlerts.unsubscribe({
-          email:      body.email,
-          sku:        body.sku,
-          variant_id: (body.variant_id != null && body.variant_id !== "") ? body.variant_id : null,
-        });
+        // `unsubscribeByToken` never throws on a token argument and returns
+        // a uniform `{ removed }` for valid / unknown / bad-shape tokens —
+        // no subscription-existence oracle. Every outcome renders the same
+        // "you're unsubscribed" copy (re-clicking the link twice is fine).
+        await deps.stockAlerts.unsubscribeByToken(token);
         outcome = "unsubscribed";
       } catch (e) {
-        // A bad-shape tuple throws TypeError → generic non-leaking page; a
-        // real fault degrades the same way rather than 500-ing a public route.
+        // Only a real infrastructure fault (D1 unreachable) lands here —
+        // record it and render the generic non-leaking page rather than a
+        // 500 that exposes internals on a public, unauthenticated route.
         outcome = "invalid";
-        if (!(e instanceof TypeError)) {
-          _log.error("storefront stock-alert unsubscribe failed", {
-            route: "/stock-alert/unsubscribe", request_id: (req && req.requestId) || null,
-            err: (e && e.message) || String(e),
-          });
-        }
+        _log.error("storefront stock-alert unsubscribe failed", {
+          route: "/stock-alert/unsubscribe", request_id: (req && req.requestId) || null,
+          err: (e && e.message) || String(e),
+        });
       }
       return _send(res, 200, renderStockAlertUnsubscribeResult({
         shop_name: shopName, cart_count: cartCount, outcome: outcome,

package/lib/webhooks.js

@@ -34,6 +34,23 @@
  *   `b.uuid.v7()` per delivery — re-deliveries (manual retry) carry a
  *   new id so the consumer's nonce store doesn't reject the replay as
  *   a duplicate.
+ *
+ *   TLS posture — outbound deliveries dial through `b.httpClient`,
+ *   which offers ONLY the framework's PQC-hybrid key-exchange groups
+ *   (ML-KEM hybrid, `constants.TLS_GROUP_PREFERENCE`) with a TLS 1.3
+ *   minimum. A receiver whose TLS stack does not yet negotiate an
+ *   ML-KEM hybrid group answers the ClientHello with a
+ *   handshake_failure (TLS alert 40); the framework surfaces that as a
+ *   transport error, so the delivery row records `last_error`, runs the
+ *   backoff retry schedule, and — if the endpoint never negotiates a
+ *   supported group — lands in `webhook_dlq` after the fifth attempt.
+ *   This is a deliberate posture choice, NOT a silent classical
+ *   downgrade: the PSP adapters (lib/payment.js) pin a downgraded agent
+ *   for their two FIXED endpoints, but a webhook receiver URL is
+ *   operator-arbitrary, so the framework's PQC-first default is held.
+ *   An operator whose receiver can't meet the PQC list terminates TLS
+ *   for it on a fronting proxy (Cloudflare, a load balancer) that does,
+ *   or upgrades the receiver's TLS stack.
  */
 
 var b = require("./vendor/blamejs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.60",
+  "version": "0.3.63",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {