@blamejs/blamejs-shop 0.3.65 → 0.3.66

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.66 (2026-06-05) — **Production server errors are readable from the admin console and the CLI.** When a server-side failure was scrubbed to a clean customer-facing page — a payment-processor rejection at checkout, a public-API failure, an admin-action error — the underlying detail was only visible in the hosting dashboard's container log viewer. The error-log primitive now captures those failures into the database: route, method, status, a length-bounded message, and a timestamp, ring-buffered to the newest five hundred entries, written fire-and-forget so a logging failure can never affect a customer request, and carrying no customer or session data. A new Errors screen in the admin console lists them newest-first, and the same route answers a bearer-token request with JSON, so operators and tooling can read production errors with one curl. A schema migration adds the message column and applies on deploy. **Added:** *Server-error capture with an admin Errors screen and JSON API* — Scrubbed 500-class failures — the checkout confirm step, the public catalog API, and admin console actions — now also record route, method, status, and a truncated error message into the error-log table (newest five hundred kept; writes are drop-silent and never awaited in the request path; no customer, session, or header data is stored). GET /admin/errors renders the newest entries in the console with every cell escaped, and the same path with an Authorization: Bearer admin token returns JSON for command-line and tooling access. Migration 0208 adds the message column plus an index and applies with the normal deploy.
+
 - v0.3.65 (2026-06-04) — **Operator-tuned search ranking applies to edge-served visitors.** Search-ranking weight sets and manual pins applied only on container-served search — anonymous visitors, who are served from the edge cache and make up most traffic, got unranked results no matter what the operator tuned. The edge search path now applies the identical ranking: pinned products lead in their configured positions, the rest order by the active weight set, with byte-identical scoring pinned by a parity test in the same style as the existing faceting and synonym parity guards. Ranking and pin changes reach edge visitors within the same sixty-second cache window as every other operator-tunable edge surface. If the ranking tables are absent or unconfigured, edge search degrades to its previous unranked order rather than failing. **Fixed:** *Edge search results honor ranking weights and manual pins* — The /search route served from the edge ordered results by filter match alone, ignoring the active search weight set and any merchandiser pins, so ranking tuning was visible only to signed-in (container-served) visitors. The edge now loads the active weight set and pins on each cache fill and applies the same scoring as the container — pins first in position order, then weighted score descending, with identical tie-breaking. The two implementations are locked together by a parity test that runs the same fixtures through both. Changes the operator makes take effect for edge visitors within the standard sixty-second cache freshness window; a missing or unconfigured ranking table degrades to the unranked order, never an error.
 
 - v0.3.64 (2026-06-04) — **Google Pay and Apple Pay express buttons can run on the payment page.** The app-level Permissions-Policy denies the Payment Request API everywhere — including the payment page, the one surface whose job is payment — so Stripe's express wallet buttons (Google Pay, Apple Pay) could not operate and the browser console filled with policy violations. The payment page now sends a route-scoped Permissions-Policy that grants the payment feature to the page itself, Stripe, and Google Pay, while every other feature stays denied and every other route keeps the fully strict header — the same route-scoping pattern the payment pages already use for their Content-Security-Policy. Card payments and 3-D Secure challenges were verified live before and after; a remaining cosmetic Trusted-Types console message from Stripe's loader is documented in code with the test recipe for future verification, and does not affect card, wallet, or 3-D Secure flows. **Fixed:** *Payment page grants the Payment Request API to Stripe and Google Pay* — The default Permissions-Policy sets payment=() sitewide, which blocks the Payment Request API that Stripe's express wallet buttons need. The /pay route now emits the same policy with exactly one change — payment=(self "https://js.stripe.com" "https://pay.google.com") — derived from the same source as the default header so the two can never drift apart. Camera, microphone, geolocation, and every other feature remain denied on the payment page, and all other routes keep payment=(). Tests pin the scoped header on the payment route, the strict header elsewhere, and that exactly one feature differs from the default.

package/lib/admin.js

@@ -43,6 +43,15 @@ var b = require("./vendor/blamejs");
 
 var AUDIT_NAMESPACE = "shop_admin";
 
+// Operator-readable error-log sink (lib/error-log.js), set by mount()
+// when the deployment wires `deps.errorLog`. `_safeNotice` records the
+// scrubbed message of a genuine 5xx here so the failure is reachable
+// from /admin/errors + the admin JSON API, not just the framework
+// audit sink. Module-level (like the `b.audit` _safeNotice already
+// uses) because admin.mount runs once per process; null until wired,
+// and every write is drop-silent / fire-and-forget.
+var _errorLogSink = null;
+
 // Per-request store for the double-submit CSRF token. The admin console is
 // container-only and has no locale ALS (unlike the storefront), so it gets
 // its own: a sync middleware in `mount()` seeds the request's `req.csrfToken`
@@ -444,11 +453,26 @@ function _safeNotice(e, auditAction) {
   // Genuine unknown error — record it server-side via the framework audit
   // (drop-silent) so operators can correlate, then hand back a generic
   // message + a 500. The raw message never reaches the client.
+  var detail = msg || String(e);
   b.audit.safeEmit({
     action:   AUDIT_NAMESPACE + "." + (auditAction || "request") + ".error",
     outcome:  "failure",
-    metadata: { message: msg || String(e) },
+    metadata: { message: detail },
   });
+  // ALSO record into the operator-readable error log when wired, so an
+  // admin-console 500 surfaces at /admin/errors + the admin JSON API.
+  // The route is the audit action namespace (the handler path isn't
+  // threaded here); drop-silent + fire-and-forget, never blocks the
+  // response. captureServerError can't throw, but guard the dispatch.
+  if (_errorLogSink) {
+    try {
+      _errorLogSink.captureServerError({
+        route:   "admin:" + (auditAction || "request"),
+        message: detail,
+        status:  500,
+      });
+    } catch (_capErr) { /* drop-silent — never let recording crash the catch */ }
+  }
   return { status: 500, code: "internal-error", message: "Something went wrong — please try again." };
 }
 
@@ -536,6 +560,12 @@ function mount(router, deps) {
   // An operator who wants the console surface minimized can pass
   // `auditLog: false` to hide both the route and the nav link.
   var auditLog        = deps.auditLog !== false;
+  // Operator-readable error feed at /admin/errors. The route + nav link
+  // mount only when the deployment wires `deps.errorLog` (the
+  // lib/error-log.js handle backed by D1). Also published to the
+  // module-level sink so `_safeNotice` records admin-console 500s here.
+  var errorLog        = deps.errorLog || null;
+  _errorLogSink       = errorLog;
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -543,7 +573,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog, errorLog: !!errorLog };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -1838,6 +1868,55 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- captured server errors (operator-readable error feed) ----------
+  //
+  // Surfaces the scrubbed messages of server-side 5xx-class failures
+  // (checkout-confirm 500, the catalog-API scrub, the admin
+  // unknown-error path) that lib/error-log.js captured into D1. The
+  // problem this solves: those messages otherwise reach only the
+  // container's LOCAL audit sink, which `wrangler tail` doesn't carry —
+  // so an operator (or tooling) had no CLI/HTTP way to read production
+  // errors. Both surfaces share one read:
+  //
+  //   * `GET /admin/errors` with a bearer token → JSON
+  //     ({ rows, limit }) for CLI/tooling:
+  //       curl -H "Authorization: Bearer $ADMIN_API_KEY" https://…/admin/errors
+  //   * `GET /admin/errors` with the admin browser cookie → the HTML
+  //     console screen (newest-first, time + route + message, monospace,
+  //     escaped).
+  //
+  // Read-only observability view: any read failure degrades to an empty
+  // table + notice, never a 500.
+  if (errorLog) {
+    function _errorsLimit(req) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var n = parseInt((url && url.searchParams.get("limit")) || "", 10);
+      // Clamp into the primitive's [1, 500] read bound; default 100.
+      if (!Number.isFinite(n) || n < 1) return 100;
+      return n > 500 ? 500 : n;
+    }
+    router.get("/admin/errors", _pageOrApi(true,
+      R(async function (req, res) {            // bearer → JSON
+        var limit = _errorsLimit(req);
+        var rows = [];
+        try { rows = await errorLog.recentServerErrors({ limit: limit }); }
+        catch (_e) { rows = []; }
+        _json(res, 200, { rows: rows, limit: limit });
+      }),
+      async function (req, res) {              // browser cookie → HTML
+        var limit = _errorsLimit(req);
+        var rows = [];
+        var notice = null;
+        try { rows = await errorLog.recentServerErrors({ limit: limit }); }
+        catch (_e) { rows = []; notice = "The error log is temporarily unavailable."; }
+        _sendHtml(res, 200, renderAdminErrors({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          rows: rows, notice: notice,
+        }));
+      },
+    ));
+  }
+
   // ---- shipment tracking (operator-managed) ---------------------------
   //
   // Attach a shipment to an order (carrier + optional tracking number) and
@@ -10605,6 +10684,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "orders",       href: "/admin/orders",       label: "Orders" },
   { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "audit",        href: "/admin/audit",        label: "Audit",        requires: "auditLog" },
+  { key: "errors",       href: "/admin/errors",       label: "Errors",       requires: "errorLog" },
   { key: "exports",      href: "/admin/exports",      label: "Exports",      requires: "orderExport" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "segments",     href: "/admin/segments",     label: "Segments",     requires: "customerSegments" },
@@ -11005,6 +11085,52 @@ function renderAdminAudit(opts) {
   return _renderAdminShell(opts.shop_name, "Audit", body, "audit", opts.nav_available);
 }
 
+// epoch-ms → "YYYY-MM-DD HH:MM:SS" (UTC). The error feed needs
+// to-the-second precision (multiple 500s a minute aren't unusual), so
+// this is finer-grained than `_fmtDate`. Guards a bad value to an em
+// dash so the template never throws.
+function _fmtTs(v) {
+  var n = typeof v === "number" ? v : Date.parse(v);
+  if (!isFinite(n)) return "—";
+  return new Date(n).toISOString().slice(0, 19).replace("T", " ") + " UTC";
+}
+
+// Captured-server-error feed — newest-first list of the scrubbed 5xx
+// messages lib/error-log.js recorded, so an operator reads production
+// failures from the console (and, via the bearer JSON contract, the
+// CLI) instead of only the container's local logs. Every cell is
+// escaped at the builder: `route` and `message` are operator/system
+// strings that could in principle carry markup, so a captured payload
+// is neutralized before it reaches the DOM (the message column escapes
+// THEN renders inside <code> — no truncation, the whole captured
+// message is the point of the feed).
+function renderAdminErrors(opts) {
+  opts = opts || {};
+  var rows = opts.rows || [];
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var bodyRows = rows.map(function (row) {
+    return "<tr>" +
+      "<td>" + _htmlEscape(_fmtTs(row.occurred_at)) + "</td>" +
+      "<td><code>" + _htmlEscape(String(row.status)) + "</code></td>" +
+      "<td><code>" + _htmlEscape(String(row.method || "")) + "</code></td>" +
+      "<td><code>" + _htmlEscape(String(row.route || "")) + "</code></td>" +
+      "<td class=\"audit-meta\"><code>" + _htmlEscape(String(row.message == null ? "" : row.message)) + "</code></td>" +
+      "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\">" + _tableWrap("<table><thead><tr><th scope=\"col\">Time</th><th scope=\"col\">Status</th><th scope=\"col\">Method</th><th scope=\"col\">Route</th><th scope=\"col\">Message</th></tr></thead><tbody>" + bodyRows + "</tbody></table>") + "</div>"
+    : "<p class=\"empty\">No server errors recorded.</p>";
+
+  var lede = "<p class=\"meta\">Server-side 5xx failures captured from the request lifecycle — newest first. " +
+    "The same feed is available as JSON for tooling: " +
+    "<code>GET /admin/errors</code> with an <code>Authorization: Bearer</code> token.</p>";
+
+  var body = "<section><h2>Errors</h2>" + notice + lede + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Errors", body, "errors", opts.nav_available);
+}
+
 // epoch-ms → "YYYY-MM-DD" for a date <input>'s value. Mirrors `_fmtDate`'s
 // guard so a bad value never throws inside the template.
 function _dateInputValue(v) {

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.65",
+  "version": "0.3.66",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/error-log.js

@@ -58,6 +58,29 @@
  *     errorLog.metrics({ from, to })
  *       → { total, by_status_class, p50_ms, p95_ms, p99_ms }
  *
+ *   Captured-error surface (the operator-readable error feed):
+ *
+ *     errorLog.captureServerError({ route, message, status?, method?, occurred_at? })
+ *       → { id, occurred_at }        on success
+ *       → { dropped: true, reason }  on bad input / write failure (no throw)
+ *
+ *     errorLog.recentServerErrors({ limit? })
+ *       → [{ id, status, route, method, message, occurred_at }]
+ *         newest-first
+ *
+ *   `captureServerError` records the scrubbed MESSAGE of a server-side
+ *   5xx-class failure (the detail a catch would otherwise lose to the
+ *   container's local audit sink) into the `error_log` table's
+ *   `message` column. It is drop-silent on bad input AND on write
+ *   failure — wired into request catch blocks, it must never turn one
+ *   failed request into two. The feed is a ring buffer: each capture
+ *   trims to the newest SERVER_ERROR_CAP message-bearing rows. The
+ *   message is length-bounded (truncated to MAX_MESSAGE, not dropped —
+ *   the head of a failure is the useful part). `recentServerErrors`
+ *   (read-side, THROWS on bad input) backs the admin console screen +
+ *   the admin JSON API so operators read production errors from the
+ *   CLI.
+ *
  *   Percentile math: response_time_ms is collected, sorted, and a
  *   simple index-into-sorted-array is read off (no streaming
  *   estimator — operators on a single-shard D1 dataset hit modest
@@ -87,6 +110,19 @@ var MAX_SESSION_ID   = 512;
 var MAX_CUSTOMER_ID  = 512;
 var MAX_ERROR_ID     = 128;
 
+// Captured server-error message bound. Unlike `path` (where an
+// over-long value is a caller bug and drops), the message is the whole
+// reason the row exists — a long stack/PSP string is TRUNCATED to this
+// bound rather than dropped, so the operator still sees the head of the
+// failure. The tail is the least useful part of a scrubbed message.
+var MAX_MESSAGE      = 1024;
+
+// Ring-buffer cap on the captured-server-error feed. Each capture
+// trims rows beyond the newest N (message-bearing rows only — the
+// high-volume response-metadata rows are untouched), so the feed is
+// self-trimming and never grows unbounded on a single-shard D1.
+var SERVER_ERROR_CAP = 500;
+
 // ---- read-side validators (THROW — dashboard queries) ------------------
 
 function _epochMs(n, label) {
@@ -252,6 +288,158 @@ function create(opts) {
       }
     },
 
+    // Capture a server-side 5xx-class failure's MESSAGE for the
+    // operator console + the admin JSON API. **Drop-silent on bad
+    // input AND on write failure — by design.** This is wired into the
+    // catch blocks of failing requests (checkout confirm, the public
+    // API 500 scrub, the admin unknown-error path); an error-log write
+    // that threw would turn one failed request into two, so every
+    // refusal resolves to a silent drop.
+    //
+    // The captured row reuses the `error_log` table with the `message`
+    // column set — that's what distinguishes a captured-error row from
+    // a response-metadata row. Only the route + method + status +
+    // message + timestamp are stored; NO session/customer/referrer/UA
+    // PII rides this path (the message is operator-supplied and already
+    // scrubbed by the caller — this primitive bounds its length, it
+    // does not re-scrub content).
+    //
+    //   captureServerError({
+    //     route,                 // required — request path, query stripped
+    //     message,               // required — scrubbed error text (truncated to MAX_MESSAGE)
+    //     status?,               // optional — defaults to 500; clamped to [500, 599]
+    //     method?,               // optional — defaults to "GET"; must be a known method
+    //     occurred_at?,          // optional — defaults to Date.now()
+    //   })
+    //     → { id, occurred_at }        on success
+    //     → { dropped: true, reason }  on bad input / write failure (no throw)
+    //
+    // After a successful insert the feed is trimmed to the newest
+    // SERVER_ERROR_CAP message-bearing rows (the ring buffer). The trim
+    // is best-effort: a trim failure never propagates (the row already
+    // landed; an over-cap feed self-corrects on the next capture).
+    captureServerError: async function (input) {
+      try {
+        if (!input || typeof input !== "object") {
+          return { dropped: true, reason: "input must be an object" };
+        }
+
+        // route — required, bounded string (query string stripped by
+        // the caller, same contract as recordError's `path`).
+        var route = input.route;
+        if (!_isBoundedString(route, MAX_PATH)) {
+          return { dropped: true, reason: "route must be a non-empty string ≤ " + MAX_PATH + " chars" };
+        }
+
+        // message — required, non-empty. Over-long is TRUNCATED (the
+        // head of a scrubbed failure is the useful part), not dropped.
+        var rawMessage = input.message;
+        if (typeof rawMessage !== "string" || rawMessage.length === 0) {
+          return { dropped: true, reason: "message must be a non-empty string" };
+        }
+        var message = rawMessage.length > MAX_MESSAGE
+          ? rawMessage.slice(0, MAX_MESSAGE)
+          : rawMessage;
+
+        // status — optional, defaults to 500. Clamp into the 5xx band:
+        // this surface is for server-side failures, and a caller that
+        // hands a 4xx is misclassifying (the 4xx observability rows go
+        // through recordError, not here).
+        var status;
+        if (input.status == null) {
+          status = 500;
+        } else if (_isInt(input.status) && input.status >= 500 && input.status <= 599) {
+          status = input.status;
+        } else {
+          return { dropped: true, reason: "status must be an integer in [500, 599] when provided" };
+        }
+
+        // method — optional, defaults to GET, must be a known method.
+        var method;
+        if (input.method == null) {
+          method = "GET";
+        } else if (typeof input.method === "string" && METHODS.indexOf(input.method) !== -1) {
+          method = input.method;
+        } else {
+          return { dropped: true, reason: "method must be one of " + METHODS.join(", ") + " when provided" };
+        }
+
+        // occurred_at — optional, defaults to Date.now().
+        var occurredAt;
+        if (input.occurred_at == null) {
+          occurredAt = Date.now();
+        } else if (_isNonNegative(input.occurred_at)) {
+          occurredAt = input.occurred_at;
+        } else {
+          return { dropped: true, reason: "occurred_at must be a non-negative integer when provided" };
+        }
+
+        // user_agent_class is NOT NULL on the table — captured errors
+        // carry no UA classification (the catch has no UA context worth
+        // persisting), so they land under the neutral "other" bucket.
+        var id = b.uuid.v7();
+        await query(
+          "INSERT INTO error_log " +
+          "(id, status, path, method, user_agent_class, message, occurred_at) " +
+          "VALUES (?1, ?2, ?3, ?4, 'other', ?5, ?6)",
+          [id, status, route, method, message, occurredAt],
+        );
+
+        // Ring-buffer trim — keep the newest SERVER_ERROR_CAP captured
+        // rows, delete the rest. Scoped to message-bearing rows so the
+        // response-metadata feed is never touched. Best-effort: a trim
+        // failure leaves an over-cap feed that the next capture corrects.
+        try {
+          await query(
+            "DELETE FROM error_log " +
+            " WHERE message IS NOT NULL " +
+            "   AND id NOT IN ( " +
+            "     SELECT id FROM error_log " +
+            "      WHERE message IS NOT NULL " +
+            "      ORDER BY occurred_at DESC, id DESC " +
+            "      LIMIT ?1 " +
+            "   )",
+            [SERVER_ERROR_CAP],
+          );
+        } catch (_trimErr) { /* best-effort — feed self-corrects next capture */ }
+
+        return { id: id, occurred_at: occurredAt };
+      } catch (_e) {
+        // Drop-silent on any unexpected failure — an error-log write
+        // mid-request must never crash the response it observes.
+        return { dropped: true, reason: "internal" };
+      }
+    },
+
+    // Newest-first page of captured server errors for the operator
+    // console + the admin JSON API. Read-side surface — THROWS on bad
+    // input (an operator's on the other end of the stack trace). Only
+    // the message-bearing rows are returned; the response-metadata rows
+    // recordError writes never surface here.
+    recentServerErrors: async function (opts) {
+      opts = opts || {};
+      var limit = opts.limit == null ? 100 : opts.limit;
+      _limit(limit, "limit", 500);
+      var r = await query(
+        "SELECT id, status, path, method, message, occurred_at " +
+        "  FROM error_log " +
+        " WHERE message IS NOT NULL " +
+        " ORDER BY occurred_at DESC, id DESC " +
+        " LIMIT ?1",
+        [limit],
+      );
+      return r.rows.map(function (row) {
+        return {
+          id:          row.id,
+          status:      Number(row.status) || 0,
+          route:       row.path,
+          method:      row.method,
+          message:     row.message,
+          occurred_at: Number(row.occurred_at) || 0,
+        };
+      });
+    },
+
     // Top-N 404 paths within the window. GROUP BY path, ORDER BY
     // count DESC. The aggregate strips query strings at the write
     // site so a single dead link surfaces as one row regardless of
@@ -518,4 +706,6 @@ module.exports = {
   ONE_YEAR_MS:       ONE_YEAR_MS,
   DEFAULT_WINDOW_MS: DEFAULT_WINDOW_MS,
   SESSION_NAMESPACE: SESSION_NAMESPACE,
+  MAX_MESSAGE:       MAX_MESSAGE,
+  SERVER_ERROR_CAP:  SERVER_ERROR_CAP,
 };

package/lib/storefront.js

@@ -9775,6 +9775,15 @@ function mount(router, deps) {
   // launch flow converts the reservation into a Stripe-gated order).
   var preorder = deps.preorder || null;
 
+  // Operator-readable error log (lib/error-log.js). When wired, the
+  // server-side catches below ALSO record their scrubbed failure
+  // message here so it's reachable from the admin console + JSON API,
+  // not just the container-local audit sink. Optional — absent it, the
+  // catches behave exactly as before (audit-emit only). Every call is
+  // drop-silent + fire-and-forget: captureServerError can never throw,
+  // and a failing response must not wait on (or be undone by) the write.
+  var errorLog = deps.errorLog || null;
+
   // CAPTCHA gate (bot challenge at signup / login / checkout). Active ONLY
   // when the operator has registered a provider AND set CAPTCHA_PROVIDER_SLUG
   // (server.js resolves the provider row at boot into captchaKind +
@@ -12437,6 +12446,14 @@ function mount(router, deps) {
             outcome:  "failure",
             metadata: { message: msg },
           });
+          // ALSO record into the operator-readable error log so this
+          // 500's detail is reachable from /admin/errors + the admin
+          // JSON API, not just the container-local audit sink. Drop-
+          // silent + fire-and-forget — never blocks or breaks the
+          // styled error page the customer gets.
+          if (errorLog) {
+            errorLog.captureServerError({ route: "/checkout", message: msg, method: "POST", status: 500 });
+          }
         }
         return _send(res, clientErr ? 400 : 500, renderCheckoutError({
           shop_name: shopName, theme: theme, eyebrow: "Checkout",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.65",
+  "version": "0.3.66",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {