@blamejs/blamejs-shop 0.3.65 → 0.3.67

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.67 (2026-06-05) — **Digital orders no longer require a shipping address, and search ranking shrugs off malformed weights.** A cart containing only digital goods completes checkout since 0.3.63, but the shipping form still demanded a street address and city the order would never use. For an all-digital cart, the form now marks the address fields optional with an honest note — email stays required for the receipt and country for tax — and the backend enforces exactly the same relaxed set, while any value the shopper does supply is still format-validated. Carts with any shippable item keep the full requirements. Separately, the search ranker now skips a non-numeric weight in a hand-edited weight set instead of letting it poison every score into NaN and garble the result order; the edge and container rankers apply the identical filter, keeping their orders locked together even on malformed configuration. **Fixed:** *Digital-only carts check out without a street address* — When no line in the cart requires shipping, the checkout form renders the address block as optional — the required markers move off street and city, a note explains that a digital order ships nothing and country is kept for tax, and the backend requires exactly email, name, and country. Values the shopper supplies anyway are still format-validated, including the per-field error rendering. A cart with any physical item keeps the full address requirements, and a missing variant record counts as physical, so the relaxation can never trigger on incomplete data. · *Search ranking ignores non-numeric weights instead of corrupting the order* — A weight set carrying a non-numeric value — possible through a hand-edited database row — multiplied into every product's score as NaN, making the result order effectively random on the container while the edge filtered the bad weight and produced a different order. Both rankers now skip non-numeric weights identically, so a malformed entry degrades to "that signal contributes nothing" with edge and container orders staying byte-identical.
+
+- v0.3.66 (2026-06-05) — **Production server errors are readable from the admin console and the CLI.** When a server-side failure was scrubbed to a clean customer-facing page — a payment-processor rejection at checkout, a public-API failure, an admin-action error — the underlying detail was only visible in the hosting dashboard's container log viewer. The error-log primitive now captures those failures into the database: route, method, status, a length-bounded message, and a timestamp, ring-buffered to the newest five hundred entries, written fire-and-forget so a logging failure can never affect a customer request, and carrying no customer or session data. A new Errors screen in the admin console lists them newest-first, and the same route answers a bearer-token request with JSON, so operators and tooling can read production errors with one curl. A schema migration adds the message column and applies on deploy. **Added:** *Server-error capture with an admin Errors screen and JSON API* — Scrubbed 500-class failures — the checkout confirm step, the public catalog API, and admin console actions — now also record route, method, status, and a truncated error message into the error-log table (newest five hundred kept; writes are drop-silent and never awaited in the request path; no customer, session, or header data is stored). GET /admin/errors renders the newest entries in the console with every cell escaped, and the same path with an Authorization: Bearer admin token returns JSON for command-line and tooling access. Migration 0208 adds the message column plus an index and applies with the normal deploy.
+
 - v0.3.65 (2026-06-04) — **Operator-tuned search ranking applies to edge-served visitors.** Search-ranking weight sets and manual pins applied only on container-served search — anonymous visitors, who are served from the edge cache and make up most traffic, got unranked results no matter what the operator tuned. The edge search path now applies the identical ranking: pinned products lead in their configured positions, the rest order by the active weight set, with byte-identical scoring pinned by a parity test in the same style as the existing faceting and synonym parity guards. Ranking and pin changes reach edge visitors within the same sixty-second cache window as every other operator-tunable edge surface. If the ranking tables are absent or unconfigured, edge search degrades to its previous unranked order rather than failing. **Fixed:** *Edge search results honor ranking weights and manual pins* — The /search route served from the edge ordered results by filter match alone, ignoring the active search weight set and any merchandiser pins, so ranking tuning was visible only to signed-in (container-served) visitors. The edge now loads the active weight set and pins on each cache fill and applies the same scoring as the container — pins first in position order, then weighted score descending, with identical tie-breaking. The two implementations are locked together by a parity test that runs the same fixtures through both. Changes the operator makes take effect for edge visitors within the standard sixty-second cache freshness window; a missing or unconfigured ranking table degrades to the unranked order, never an error.
 
 - v0.3.64 (2026-06-04) — **Google Pay and Apple Pay express buttons can run on the payment page.** The app-level Permissions-Policy denies the Payment Request API everywhere — including the payment page, the one surface whose job is payment — so Stripe's express wallet buttons (Google Pay, Apple Pay) could not operate and the browser console filled with policy violations. The payment page now sends a route-scoped Permissions-Policy that grants the payment feature to the page itself, Stripe, and Google Pay, while every other feature stays denied and every other route keeps the fully strict header — the same route-scoping pattern the payment pages already use for their Content-Security-Policy. Card payments and 3-D Secure challenges were verified live before and after; a remaining cosmetic Trusted-Types console message from Stripe's loader is documented in code with the test recipe for future verification, and does not affect card, wallet, or 3-D Secure flows. **Fixed:** *Payment page grants the Payment Request API to Stripe and Google Pay* — The default Permissions-Policy sets payment=() sitewide, which blocks the Payment Request API that Stripe's express wallet buttons need. The /pay route now emits the same policy with exactly one change — payment=(self "https://js.stripe.com" "https://pay.google.com") — derived from the same source as the default header so the two can never drift apart. Camera, microphone, geolocation, and every other feature remain denied on the payment page, and all other routes keep payment=(). Tests pin the scoped header on the payment route, the strict header elsewhere, and that exactly one feature differs from the default.

package/README.md

@@ -96,7 +96,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/giftcards.js`** | Prepaid bearer gift cards. `issue({ amount_minor, currency })` generates a 16-char code (32-glyph alphabet, no ambiguous letters) via `b.crypto.generateBytes`, stores only its `namespaceHash` digest + a 4-char hint, and returns the plaintext code once. `balance(code)` / `lookup(code)` resolve a code to its live balance (constant-time hash compare); `redeem({ code, order_id, amount_minor })` decrements the balance with an atomic `balance >= amount` SQL guard so concurrent spends can't overdraw. Redeemed at checkout as a credit against the order grand total: the amount due drops by the applied balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order — a card that fully covers the order is marked paid with no Stripe charge. Customers check a balance at `GET /gift-cards`; the page is not a code-existence oracle (unknown / malformed / expired all return the same generic not-found). |
 | **`lib/gift-card-ledger.js`** | Append-only credit / debit / expire history per gift card, with a denormalized `balance_after_minor` snapshot for O(1) balance reads. `credit` / `debit` / `expire` write one row each; `history(id)` paginates a card's transactions; `transactionsForOrder(id)` lists a card's movements for one order. The audit trail behind the admin gift-card ledger console; overdraft is refused at the primitive layer. |
 | **`lib/newsletter.js`** | Operator-collected email broadcast list — `signup({ email, source })` composes `b.guardEmail` for shape validation, `b.crypto.namespaceHash` for the dedup key, and `INSERT OR IGNORE` for idempotency. Storefront POST `/newsletter` route renders a designed thank-you card with separate copy for the `new` vs `dedup` branches. |
-| **`lib/admin.js`** | Bearer-token-gated CRUD over catalog + orders + refunds + bulk CSV import + subscription plans + review moderation + return moderation. Token compared via `b.crypto.timingSafeEqual`. Errors as RFC 9457 problem documents via `b.problemDetails`. Audit emission on every mutation. Also serves a **browser admin console**: sign in at `/admin` by pasting the API key (sealed `shop_admin` session cookie, SameSite=Strict, /admin-scoped), with a persistent nav across every signed-in page. A guided **setup wizard** at `/admin/setup` writes shop identity to config; **Products** (`/admin/products`) browses the catalog and creates / archives / restores, and each product opens a management screen that edits its fields, adds / edits / removes variants, sets a variant's price and shows its price history, and attaches / uploads / removes images — the full path to a sellable product; **Inventory** (`/admin/inventory`) lists stock per SKU (on-hand / held / available) with a low-stock filter, restocks, sets per-SKU thresholds, and tracks new SKUs; **Orders** (`/admin/orders`) lists recent orders with status filters, opens an order's items, totals, and shipping address, and drives the lifecycle (mark paid → fulfil → ship → deliver, cancel — Refund goes through the payment provider) through the order FSM, and attaches a shipment (carrier + tracking number) with recorded shipment events that surface a public tracking link to the customer; **Customers** (`/admin/customers`) is a read-only roster, newest first — display name, short id, join date, sign-in method (passkey count + linked OAuth providers), and order count, with the count and sign-in methods resolved by bounded aggregate queries so a page of customers costs no per-row trips (email addresses aren't stored in the clear, so they're not shown); **Returns** (`/admin/returns`) is the RMA moderation queue — filter by status, open a request's items and reason, and approve (with refund amount) → mark received → refund, or reject with a reason, over the return FSM; **Reviews** (`/admin/reviews`) is the review moderation queue — filter by status and publish, reject (with a reason), or take down each submission inline; **Q&A** (`/admin/questions`) is the question moderation queue — filter by status, open a question to its full answer thread, approve / reject the question, post the seller answer, and approve / reject / pin individual answers; **Subscriptions** (`/admin/subscription-plans`) is the recurring-offer catalog — filter active / archived, create a plan (Stripe price id, interval, amount, trial), and archive one, with archiving terminal because the mirrored Stripe price can go stale; **Collections** (`/admin/collections`) manages manual + smart product collections — filter active / archived, create a collection (manual or smart with a starter rule), and per collection edit title / description / sort strategy, manage manual members (add by product id, remove, reorder) or edit a smart collection's rule set with a live preview of the products the rules currently match, and archive; **Gift cards** (`/admin/gift-cards`) is the gift-card ledger — list issued cards (masked code, original + remaining balance, status, issued date) filtered by lifecycle status, issue a new card (the bearer code shown once, right after creation), open a card to see its full credit / debit / expire ledger, and void an active card through a confirmation step; **Webhooks** (`/admin/webhooks`) registers outbound endpoints (https:// only) with a one-time signing-secret reveal, enables / disables / deletes them, and opens an endpoint's delivery feed to retry a failed delivery — the signing secret is shown once on create and never in the list, and order transitions fan out signed deliveries to subscribed endpoints. **Tax** (`/admin/tax-rates`), **Shipping** (`/admin/shipping`), and **Discounts** (`/admin/discounts`) configure tax rates per jurisdiction, shipping zones + rates, and automatic-discount rules + coupon-stacking policies — create / edit / archive each. **Audit** (`/admin/audit`) is a read-only activity log of every privileged action — filtered by outcome (success / failure / denied) and paginated — composed on the framework's tamper-evident `b.audit` chain; opening it is itself recorded as an `audit.read` event. The Customers, Returns, Reviews, Q&A, Subscriptions, Collections, Gift cards, Webhooks, Tax, Shipping, and Discounts links appear only when those primitives are wired. Each console path content-negotiates: a bearer-token client still gets the JSON API unchanged, a signed-in browser gets HTML. Reachable by the cookie or the bearer token. The console's styling is an external, integrity-pinned stylesheet (`themes/default/assets/css/admin.css`) with the same self-hosted typeface — no inline styles and no third-party font host, so it renders correctly under the strict `style-src 'self'` / `font-src 'self'` CSP that governs the route. |
+| **`lib/admin.js`** | Bearer-token-gated CRUD over catalog + orders + refunds + bulk CSV import + subscription plans + review moderation + return moderation. Token compared via `b.crypto.timingSafeEqual`. Errors as RFC 9457 problem documents via `b.problemDetails`. Audit emission on every mutation. Also serves a **browser admin console**: sign in at `/admin` by pasting the API key (sealed `shop_admin` session cookie, SameSite=Strict, /admin-scoped), with a persistent nav across every signed-in page. A guided **setup wizard** at `/admin/setup` writes shop identity to config; **Products** (`/admin/products`) browses the catalog and creates / archives / restores, and each product opens a management screen that edits its fields, adds / edits / removes variants, sets a variant's price and shows its price history, and attaches / uploads / removes images — the full path to a sellable product; **Inventory** (`/admin/inventory`) lists stock per SKU (on-hand / held / available) with a low-stock filter, restocks, sets per-SKU thresholds, and tracks new SKUs; **Orders** (`/admin/orders`) lists recent orders with status filters, opens an order's items, totals, and shipping address, and drives the lifecycle (mark paid → fulfil → ship → deliver, cancel — Refund goes through the payment provider) through the order FSM, and attaches a shipment (carrier + tracking number) with recorded shipment events that surface a public tracking link to the customer; **Customers** (`/admin/customers`) is a read-only roster, newest first — display name, short id, join date, sign-in method (passkey count + linked OAuth providers), and order count, with the count and sign-in methods resolved by bounded aggregate queries so a page of customers costs no per-row trips (email addresses aren't stored in the clear, so they're not shown); **Returns** (`/admin/returns`) is the RMA moderation queue — filter by status, open a request's items and reason, and approve (with refund amount) → mark received → refund, or reject with a reason, over the return FSM; **Reviews** (`/admin/reviews`) is the review moderation queue — filter by status and publish, reject (with a reason), or take down each submission inline; **Q&A** (`/admin/questions`) is the question moderation queue — filter by status, open a question to its full answer thread, approve / reject the question, post the seller answer, and approve / reject / pin individual answers; **Subscriptions** (`/admin/subscription-plans`) is the recurring-offer catalog — filter active / archived, create a plan (Stripe price id, interval, amount, trial), and archive one, with archiving terminal because the mirrored Stripe price can go stale; **Collections** (`/admin/collections`) manages manual + smart product collections — filter active / archived, create a collection (manual or smart with a starter rule), and per collection edit title / description / sort strategy, manage manual members (add by product id, remove, reorder) or edit a smart collection's rule set with a live preview of the products the rules currently match, and archive; **Gift cards** (`/admin/gift-cards`) is the gift-card ledger — list issued cards (masked code, original + remaining balance, status, issued date) filtered by lifecycle status, issue a new card (the bearer code shown once, right after creation), open a card to see its full credit / debit / expire ledger, and void an active card through a confirmation step; **Webhooks** (`/admin/webhooks`) registers outbound endpoints (https:// only) with a one-time signing-secret reveal, enables / disables / deletes them, and opens an endpoint's delivery feed to retry a failed delivery — the signing secret is shown once on create and never in the list, and order transitions fan out signed deliveries to subscribed endpoints. **Tax** (`/admin/tax-rates`), **Shipping** (`/admin/shipping`), and **Discounts** (`/admin/discounts`) configure tax rates per jurisdiction, shipping zones + rates, and automatic-discount rules + coupon-stacking policies — create / edit / archive each. **Audit** (`/admin/audit`) is a read-only activity log of every privileged action — filtered by outcome (success / failure / denied) and paginated — composed on the framework's tamper-evident `b.audit` chain; opening it is itself recorded as an `audit.read` event. **Errors** (`/admin/errors`) lists captured server-error detail — time, status, route, and a truncated message for scrubbed 500-class failures (checkout confirm, public API, admin actions) — newest-first, with the same path answering a bearer-token request with JSON so the log is one `curl` away. The Customers, Returns, Reviews, Q&A, Subscriptions, Collections, Gift cards, Webhooks, Tax, Shipping, Discounts, and Errors links appear only when those primitives are wired. Each console path content-negotiates: a bearer-token client still gets the JSON API unchanged, a signed-in browser gets HTML. Reachable by the cookie or the bearer token. The console's styling is an external, integrity-pinned stylesheet (`themes/default/assets/css/admin.css`) with the same self-hosted typeface — no inline styles and no third-party font host, so it renders correctly under the strict `style-src 'self'` / `font-src 'self'` CSP that governs the route. |
 | **`lib/catalog-import.js`** | Bulk CSV import — `POST /admin/catalog/import` accepts a `text/csv` body, parses via `b.csv`, content-safety-filters every cell through `b.guardCsv` (formula-injection / bidi / control / dangerous-function denylist), validates exact header order, de-dupes rows by `product_slug`, returns per-row errors without aborting. Default 1 MiB / 10000 rows caps. |
 | **`lib/theme.js`** | File-backed templates with fallback chain. Operators register a named theme under `<themesDir>/<name>/*.html` and the storefront dispatches every renderer through it. `assetUrl(path)` resolves to `/assets/themes/<name>/<path>`. The shipped `default` theme is the fallback. |
 

package/lib/admin.js

@@ -43,6 +43,15 @@ var b = require("./vendor/blamejs");
 
 var AUDIT_NAMESPACE = "shop_admin";
 
+// Operator-readable error-log sink (lib/error-log.js), set by mount()
+// when the deployment wires `deps.errorLog`. `_safeNotice` records the
+// scrubbed message of a genuine 5xx here so the failure is reachable
+// from /admin/errors + the admin JSON API, not just the framework
+// audit sink. Module-level (like the `b.audit` _safeNotice already
+// uses) because admin.mount runs once per process; null until wired,
+// and every write is drop-silent / fire-and-forget.
+var _errorLogSink = null;
+
 // Per-request store for the double-submit CSRF token. The admin console is
 // container-only and has no locale ALS (unlike the storefront), so it gets
 // its own: a sync middleware in `mount()` seeds the request's `req.csrfToken`
@@ -444,11 +453,26 @@ function _safeNotice(e, auditAction) {
   // Genuine unknown error — record it server-side via the framework audit
   // (drop-silent) so operators can correlate, then hand back a generic
   // message + a 500. The raw message never reaches the client.
+  var detail = msg || String(e);
   b.audit.safeEmit({
     action:   AUDIT_NAMESPACE + "." + (auditAction || "request") + ".error",
     outcome:  "failure",
-    metadata: { message: msg || String(e) },
+    metadata: { message: detail },
   });
+  // ALSO record into the operator-readable error log when wired, so an
+  // admin-console 500 surfaces at /admin/errors + the admin JSON API.
+  // The route is the audit action namespace (the handler path isn't
+  // threaded here); drop-silent + fire-and-forget, never blocks the
+  // response. captureServerError can't throw, but guard the dispatch.
+  if (_errorLogSink) {
+    try {
+      _errorLogSink.captureServerError({
+        route:   "admin:" + (auditAction || "request"),
+        message: detail,
+        status:  500,
+      });
+    } catch (_capErr) { /* drop-silent — never let recording crash the catch */ }
+  }
   return { status: 500, code: "internal-error", message: "Something went wrong — please try again." };
 }
 
@@ -536,6 +560,12 @@ function mount(router, deps) {
   // An operator who wants the console surface minimized can pass
   // `auditLog: false` to hide both the route and the nav link.
   var auditLog        = deps.auditLog !== false;
+  // Operator-readable error feed at /admin/errors. The route + nav link
+  // mount only when the deployment wires `deps.errorLog` (the
+  // lib/error-log.js handle backed by D1). Also published to the
+  // module-level sink so `_safeNotice` records admin-console 500s here.
+  var errorLog        = deps.errorLog || null;
+  _errorLogSink       = errorLog;
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -543,7 +573,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog, errorLog: !!errorLog };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -1838,6 +1868,55 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- captured server errors (operator-readable error feed) ----------
+  //
+  // Surfaces the scrubbed messages of server-side 5xx-class failures
+  // (checkout-confirm 500, the catalog-API scrub, the admin
+  // unknown-error path) that lib/error-log.js captured into D1. The
+  // problem this solves: those messages otherwise reach only the
+  // container's LOCAL audit sink, which `wrangler tail` doesn't carry —
+  // so an operator (or tooling) had no CLI/HTTP way to read production
+  // errors. Both surfaces share one read:
+  //
+  //   * `GET /admin/errors` with a bearer token → JSON
+  //     ({ rows, limit }) for CLI/tooling:
+  //       curl -H "Authorization: Bearer $ADMIN_API_KEY" https://…/admin/errors
+  //   * `GET /admin/errors` with the admin browser cookie → the HTML
+  //     console screen (newest-first, time + route + message, monospace,
+  //     escaped).
+  //
+  // Read-only observability view: any read failure degrades to an empty
+  // table + notice, never a 500.
+  if (errorLog) {
+    function _errorsLimit(req) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var n = parseInt((url && url.searchParams.get("limit")) || "", 10);
+      // Clamp into the primitive's [1, 500] read bound; default 100.
+      if (!Number.isFinite(n) || n < 1) return 100;
+      return n > 500 ? 500 : n;
+    }
+    router.get("/admin/errors", _pageOrApi(true,
+      R(async function (req, res) {            // bearer → JSON
+        var limit = _errorsLimit(req);
+        var rows = [];
+        try { rows = await errorLog.recentServerErrors({ limit: limit }); }
+        catch (_e) { rows = []; }
+        _json(res, 200, { rows: rows, limit: limit });
+      }),
+      async function (req, res) {              // browser cookie → HTML
+        var limit = _errorsLimit(req);
+        var rows = [];
+        var notice = null;
+        try { rows = await errorLog.recentServerErrors({ limit: limit }); }
+        catch (_e) { rows = []; notice = "The error log is temporarily unavailable."; }
+        _sendHtml(res, 200, renderAdminErrors({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          rows: rows, notice: notice,
+        }));
+      },
+    ));
+  }
+
   // ---- shipment tracking (operator-managed) ---------------------------
   //
   // Attach a shipment to an order (carrier + optional tracking number) and
@@ -10605,6 +10684,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "orders",       href: "/admin/orders",       label: "Orders" },
   { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "audit",        href: "/admin/audit",        label: "Audit",        requires: "auditLog" },
+  { key: "errors",       href: "/admin/errors",       label: "Errors",       requires: "errorLog" },
   { key: "exports",      href: "/admin/exports",      label: "Exports",      requires: "orderExport" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "segments",     href: "/admin/segments",     label: "Segments",     requires: "customerSegments" },
@@ -11005,6 +11085,52 @@ function renderAdminAudit(opts) {
   return _renderAdminShell(opts.shop_name, "Audit", body, "audit", opts.nav_available);
 }
 
+// epoch-ms → "YYYY-MM-DD HH:MM:SS" (UTC). The error feed needs
+// to-the-second precision (multiple 500s a minute aren't unusual), so
+// this is finer-grained than `_fmtDate`. Guards a bad value to an em
+// dash so the template never throws.
+function _fmtTs(v) {
+  var n = typeof v === "number" ? v : Date.parse(v);
+  if (!isFinite(n)) return "—";
+  return new Date(n).toISOString().slice(0, 19).replace("T", " ") + " UTC";
+}
+
+// Captured-server-error feed — newest-first list of the scrubbed 5xx
+// messages lib/error-log.js recorded, so an operator reads production
+// failures from the console (and, via the bearer JSON contract, the
+// CLI) instead of only the container's local logs. Every cell is
+// escaped at the builder: `route` and `message` are operator/system
+// strings that could in principle carry markup, so a captured payload
+// is neutralized before it reaches the DOM (the message column escapes
+// THEN renders inside <code> — no truncation, the whole captured
+// message is the point of the feed).
+function renderAdminErrors(opts) {
+  opts = opts || {};
+  var rows = opts.rows || [];
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var bodyRows = rows.map(function (row) {
+    return "<tr>" +
+      "<td>" + _htmlEscape(_fmtTs(row.occurred_at)) + "</td>" +
+      "<td><code>" + _htmlEscape(String(row.status)) + "</code></td>" +
+      "<td><code>" + _htmlEscape(String(row.method || "")) + "</code></td>" +
+      "<td><code>" + _htmlEscape(String(row.route || "")) + "</code></td>" +
+      "<td class=\"audit-meta\"><code>" + _htmlEscape(String(row.message == null ? "" : row.message)) + "</code></td>" +
+      "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\">" + _tableWrap("<table><thead><tr><th scope=\"col\">Time</th><th scope=\"col\">Status</th><th scope=\"col\">Method</th><th scope=\"col\">Route</th><th scope=\"col\">Message</th></tr></thead><tbody>" + bodyRows + "</tbody></table>") + "</div>"
+    : "<p class=\"empty\">No server errors recorded.</p>";
+
+  var lede = "<p class=\"meta\">Server-side 5xx failures captured from the request lifecycle — newest first. " +
+    "The same feed is available as JSON for tooling: " +
+    "<code>GET /admin/errors</code> with an <code>Authorization: Bearer</code> token.</p>";
+
+  var body = "<section><h2>Errors</h2>" + notice + lede + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Errors", body, "errors", opts.nav_available);
+}
+
 // epoch-ms → "YYYY-MM-DD" for a date <input>'s value. Mirrors `_fmtDate`'s
 // guard so a bad value never throws inside the template.
 function _dateInputValue(v) {

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.65",
+  "version": "0.3.67",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",
       "fingerprinted": "css/admin.44eb97700c660798.css"
     },
     "css/main.css": {
-      "integrity": "sha384-pEf1nxijlK9mXs8LacGqzNmr+WzjMR7c17Gsx24YS1PharS/BWa62RU/fUL8XSa6",
-      "fingerprinted": "css/main.bb97cd4c4b867440.css"
+      "integrity": "sha384-fzlpYGSv30HHY+ir9ym4VxwwgwzXQ9Sn153QMXLVKOPJ02eDNO/cI6Ww3rPluQ8R",
+      "fingerprinted": "css/main.15dfd64f4536314d.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/error-log.js

@@ -58,6 +58,29 @@
  *     errorLog.metrics({ from, to })
  *       → { total, by_status_class, p50_ms, p95_ms, p99_ms }
  *
+ *   Captured-error surface (the operator-readable error feed):
+ *
+ *     errorLog.captureServerError({ route, message, status?, method?, occurred_at? })
+ *       → { id, occurred_at }        on success
+ *       → { dropped: true, reason }  on bad input / write failure (no throw)
+ *
+ *     errorLog.recentServerErrors({ limit? })
+ *       → [{ id, status, route, method, message, occurred_at }]
+ *         newest-first
+ *
+ *   `captureServerError` records the scrubbed MESSAGE of a server-side
+ *   5xx-class failure (the detail a catch would otherwise lose to the
+ *   container's local audit sink) into the `error_log` table's
+ *   `message` column. It is drop-silent on bad input AND on write
+ *   failure — wired into request catch blocks, it must never turn one
+ *   failed request into two. The feed is a ring buffer: each capture
+ *   trims to the newest SERVER_ERROR_CAP message-bearing rows. The
+ *   message is length-bounded (truncated to MAX_MESSAGE, not dropped —
+ *   the head of a failure is the useful part). `recentServerErrors`
+ *   (read-side, THROWS on bad input) backs the admin console screen +
+ *   the admin JSON API so operators read production errors from the
+ *   CLI.
+ *
  *   Percentile math: response_time_ms is collected, sorted, and a
  *   simple index-into-sorted-array is read off (no streaming
  *   estimator — operators on a single-shard D1 dataset hit modest
@@ -87,6 +110,19 @@ var MAX_SESSION_ID   = 512;
 var MAX_CUSTOMER_ID  = 512;
 var MAX_ERROR_ID     = 128;
 
+// Captured server-error message bound. Unlike `path` (where an
+// over-long value is a caller bug and drops), the message is the whole
+// reason the row exists — a long stack/PSP string is TRUNCATED to this
+// bound rather than dropped, so the operator still sees the head of the
+// failure. The tail is the least useful part of a scrubbed message.
+var MAX_MESSAGE      = 1024;
+
+// Ring-buffer cap on the captured-server-error feed. Each capture
+// trims rows beyond the newest N (message-bearing rows only — the
+// high-volume response-metadata rows are untouched), so the feed is
+// self-trimming and never grows unbounded on a single-shard D1.
+var SERVER_ERROR_CAP = 500;
+
 // ---- read-side validators (THROW — dashboard queries) ------------------
 
 function _epochMs(n, label) {
@@ -252,6 +288,158 @@ function create(opts) {
       }
     },
 
+    // Capture a server-side 5xx-class failure's MESSAGE for the
+    // operator console + the admin JSON API. **Drop-silent on bad
+    // input AND on write failure — by design.** This is wired into the
+    // catch blocks of failing requests (checkout confirm, the public
+    // API 500 scrub, the admin unknown-error path); an error-log write
+    // that threw would turn one failed request into two, so every
+    // refusal resolves to a silent drop.
+    //
+    // The captured row reuses the `error_log` table with the `message`
+    // column set — that's what distinguishes a captured-error row from
+    // a response-metadata row. Only the route + method + status +
+    // message + timestamp are stored; NO session/customer/referrer/UA
+    // PII rides this path (the message is operator-supplied and already
+    // scrubbed by the caller — this primitive bounds its length, it
+    // does not re-scrub content).
+    //
+    //   captureServerError({
+    //     route,                 // required — request path, query stripped
+    //     message,               // required — scrubbed error text (truncated to MAX_MESSAGE)
+    //     status?,               // optional — defaults to 500; clamped to [500, 599]
+    //     method?,               // optional — defaults to "GET"; must be a known method
+    //     occurred_at?,          // optional — defaults to Date.now()
+    //   })
+    //     → { id, occurred_at }        on success
+    //     → { dropped: true, reason }  on bad input / write failure (no throw)
+    //
+    // After a successful insert the feed is trimmed to the newest
+    // SERVER_ERROR_CAP message-bearing rows (the ring buffer). The trim
+    // is best-effort: a trim failure never propagates (the row already
+    // landed; an over-cap feed self-corrects on the next capture).
+    captureServerError: async function (input) {
+      try {
+        if (!input || typeof input !== "object") {
+          return { dropped: true, reason: "input must be an object" };
+        }
+
+        // route — required, bounded string (query string stripped by
+        // the caller, same contract as recordError's `path`).
+        var route = input.route;
+        if (!_isBoundedString(route, MAX_PATH)) {
+          return { dropped: true, reason: "route must be a non-empty string ≤ " + MAX_PATH + " chars" };
+        }
+
+        // message — required, non-empty. Over-long is TRUNCATED (the
+        // head of a scrubbed failure is the useful part), not dropped.
+        var rawMessage = input.message;
+        if (typeof rawMessage !== "string" || rawMessage.length === 0) {
+          return { dropped: true, reason: "message must be a non-empty string" };
+        }
+        var message = rawMessage.length > MAX_MESSAGE
+          ? rawMessage.slice(0, MAX_MESSAGE)
+          : rawMessage;
+
+        // status — optional, defaults to 500. Clamp into the 5xx band:
+        // this surface is for server-side failures, and a caller that
+        // hands a 4xx is misclassifying (the 4xx observability rows go
+        // through recordError, not here).
+        var status;
+        if (input.status == null) {
+          status = 500;
+        } else if (_isInt(input.status) && input.status >= 500 && input.status <= 599) {
+          status = input.status;
+        } else {
+          return { dropped: true, reason: "status must be an integer in [500, 599] when provided" };
+        }
+
+        // method — optional, defaults to GET, must be a known method.
+        var method;
+        if (input.method == null) {
+          method = "GET";
+        } else if (typeof input.method === "string" && METHODS.indexOf(input.method) !== -1) {
+          method = input.method;
+        } else {
+          return { dropped: true, reason: "method must be one of " + METHODS.join(", ") + " when provided" };
+        }
+
+        // occurred_at — optional, defaults to Date.now().
+        var occurredAt;
+        if (input.occurred_at == null) {
+          occurredAt = Date.now();
+        } else if (_isNonNegative(input.occurred_at)) {
+          occurredAt = input.occurred_at;
+        } else {
+          return { dropped: true, reason: "occurred_at must be a non-negative integer when provided" };
+        }
+
+        // user_agent_class is NOT NULL on the table — captured errors
+        // carry no UA classification (the catch has no UA context worth
+        // persisting), so they land under the neutral "other" bucket.
+        var id = b.uuid.v7();
+        await query(
+          "INSERT INTO error_log " +
+          "(id, status, path, method, user_agent_class, message, occurred_at) " +
+          "VALUES (?1, ?2, ?3, ?4, 'other', ?5, ?6)",
+          [id, status, route, method, message, occurredAt],
+        );
+
+        // Ring-buffer trim — keep the newest SERVER_ERROR_CAP captured
+        // rows, delete the rest. Scoped to message-bearing rows so the
+        // response-metadata feed is never touched. Best-effort: a trim
+        // failure leaves an over-cap feed that the next capture corrects.
+        try {
+          await query(
+            "DELETE FROM error_log " +
+            " WHERE message IS NOT NULL " +
+            "   AND id NOT IN ( " +
+            "     SELECT id FROM error_log " +
+            "      WHERE message IS NOT NULL " +
+            "      ORDER BY occurred_at DESC, id DESC " +
+            "      LIMIT ?1 " +
+            "   )",
+            [SERVER_ERROR_CAP],
+          );
+        } catch (_trimErr) { /* best-effort — feed self-corrects next capture */ }
+
+        return { id: id, occurred_at: occurredAt };
+      } catch (_e) {
+        // Drop-silent on any unexpected failure — an error-log write
+        // mid-request must never crash the response it observes.
+        return { dropped: true, reason: "internal" };
+      }
+    },
+
+    // Newest-first page of captured server errors for the operator
+    // console + the admin JSON API. Read-side surface — THROWS on bad
+    // input (an operator's on the other end of the stack trace). Only
+    // the message-bearing rows are returned; the response-metadata rows
+    // recordError writes never surface here.
+    recentServerErrors: async function (opts) {
+      opts = opts || {};
+      var limit = opts.limit == null ? 100 : opts.limit;
+      _limit(limit, "limit", 500);
+      var r = await query(
+        "SELECT id, status, path, method, message, occurred_at " +
+        "  FROM error_log " +
+        " WHERE message IS NOT NULL " +
+        " ORDER BY occurred_at DESC, id DESC " +
+        " LIMIT ?1",
+        [limit],
+      );
+      return r.rows.map(function (row) {
+        return {
+          id:          row.id,
+          status:      Number(row.status) || 0,
+          route:       row.path,
+          method:      row.method,
+          message:     row.message,
+          occurred_at: Number(row.occurred_at) || 0,
+        };
+      });
+    },
+
     // Top-N 404 paths within the window. GROUP BY path, ORDER BY
     // count DESC. The aggregate strips query strings at the write
     // site so a single dead link surfaces as one row regardless of
@@ -518,4 +706,6 @@ module.exports = {
   ONE_YEAR_MS:       ONE_YEAR_MS,
   DEFAULT_WINDOW_MS: DEFAULT_WINDOW_MS,
   SESSION_NAMESPACE: SESSION_NAMESPACE,
+  MAX_MESSAGE:       MAX_MESSAGE,
+  SERVER_ERROR_CAP:  SERVER_ERROR_CAP,
 };

package/lib/search-ranking.js

@@ -401,7 +401,14 @@ function create(opts) {
       if (typeof raw === "boolean") n = raw ? 1 : 0;
       else if (typeof raw === "number" && isFinite(raw)) n = raw;
       else continue;
-      score += weights[k] * n;
+      // Defensive: a hand-edited weights_json row can carry a non-numeric
+      // weight; multiplying by it would NaN-poison the score and garble
+      // the sort. Skip it — the edge mirror (worker/data/search-ranking.js)
+      // applies the same filter, keeping the two rankers order-identical
+      // on malformed config.
+      var w = weights[k];
+      if (typeof w !== "number" || !isFinite(w)) continue;
+      score += w * n;
     }
     return score;
   }

package/lib/storefront.js

@@ -6412,12 +6412,19 @@ var CART_LINE_EDITABLE =
 // `p` pre-fills each field (from a signed-in customer's default shipping
 // address, or the shopper's own typed values on a validation re-render);
 // every value is escaped by `_addrField` / the email builder.
-// Street line 1 + city are marked required for the common physical-goods
-// path, and the POST handler enforces the same set server-side via
-// _requireCheckoutFields (backend validates, frontend displays). The
-// service tier (checkout._shipTo) stays presence-optional so a non-form
+//
+// `allDigital` flips the address block to optional: when every cart line
+// is a no-shipment good (variant requires_shipping = 0), street line 1 +
+// city drop their `required` attr + `*` marker and a short note explains
+// the order needs no shipping address. Country stays required because the
+// tax quote keys off it (checkout._shipTo validates a country on every
+// quote, digital included). For a cart with ANY shippable line, line1 +
+// city stay required for the common physical-goods path. The POST handler
+// enforces the SAME contract server-side via _requireCheckoutFields with
+// the same flag (backend validates, frontend displays). The service tier
+// (checkout._shipTo) stays presence-optional regardless so a non-form
 // caller can still complete a digital-only order with a bare country.
-function _checkoutShippingFields(p, inv) {
+function _checkoutShippingFields(p, inv, allDigital) {
   p = p || {};
   var esc = b.template.escapeHtml;
   // Merge the per-field invalid marker (a { field, message } from
@@ -6439,12 +6446,20 @@ function _checkoutShippingFields(p, inv) {
         _fieldAriaAttr("co-err-", "email", inv) + ">" +
       _fieldErrorSpan("co-err-", "email", inv) +
     "</label>";
+  // For an all-digital cart the address is optional — line1 + city lose
+  // the `required` attr/marker and a note says so. A mixed/physical cart
+  // keeps them required (the un-flagged default).
+  var addrRequired = !allDigital;
+  var digitalNote = allDigital
+    ? "<p class=\"checkout-page__digital-note\">This is a digital order — no shipping address needed. Just confirm your country below for tax.</p>"
+    : "";
   return email +
     _addrField("name",  "Full name",      p.name,  _mark("name",  { required: true, maxlength: 120, autocomplete: "name" })) +
-    _addrField("line1", "Street address", p.line1, _mark("line1", { required: true, maxlength: 200, autocomplete: "address-line1" })) +
+    digitalNote +
+    _addrField("line1", "Street address", p.line1, _mark("line1", { required: addrRequired, maxlength: 200, autocomplete: "address-line1" })) +
     _addrField("line2", "Apt / suite / unit (optional)", p.line2, _mark("line2", { maxlength: 200, autocomplete: "address-line2" })) +
     "<div class=\"form-row form-row--inline\">" +
-      _addrField("city",  "City", p.city, _mark("city", { required: true, maxlength: 120, autocomplete: "address-level2" })) +
+      _addrField("city",  "City", p.city, _mark("city", { required: addrRequired, maxlength: 120, autocomplete: "address-level2" })) +
       _addrField("state", "State / province code", p.state, _mark("state", { maxlength: 5, pattern: "[A-Za-z0-9]{1,5}", autocomplete: "address-level1" })) +
     "</div>" +
     "<div class=\"form-row form-row--inline\">" +
@@ -6483,13 +6498,23 @@ function _shipToFromBody(body) {
 // _checkoutFieldFromError maps each to its input. The PayPal create route
 // shares _shipToFromBody but not this gate — its format errors surface
 // through the same service-tier validators.
-function _requireCheckoutFields(body, shipTo) {
+//
+// `allDigital` (every cart line is a no-shipment good) drops the line1 +
+// city + region/postal presence gates: the order ships nothing, so only
+// email + name + a country (for the tax quote) are required. The country
+// itself is still validated for shape downstream by checkout._shipTo. Any
+// region/postal values the shopper DID supply still get format-validated
+// there — relaxing presence never relaxes format. A cart with ANY
+// shippable line keeps the full requirement set (the un-flagged default),
+// matching the form the GET path renders.
+function _requireCheckoutFields(body, shipTo, allDigital) {
   if (!body.email || !String(body.email).trim()) {
     throw new TypeError("checkout: customer.email — Enter your email address.");
   }
   if (!body.name || !String(body.name).trim()) {
     throw new TypeError("checkout: customer.name — Enter the recipient's full name.");
   }
+  if (allDigital) return;   // digital order — no shipping address required (country shape is validated downstream)
   if (!shipTo.line1) throw new TypeError("checkout: ship_to.line1 — Enter a street address.");
   if (!shipTo.city)  throw new TypeError("checkout: ship_to.city — Enter a city.");
   if (shipTo.country === "US" || shipTo.country === "CA") {
@@ -6712,7 +6737,7 @@ function renderCheckoutForm(opts) {
   body = _spliceRaw(body, "RAW_TOTALS_ROWS", totalsRows);
   body = _spliceRaw(body, "RAW_SUMMARY_NOTE", summaryNote);
   body = _spliceRaw(body, "RAW_INLINE_ERROR", inlineError);
-  body = _spliceRaw(body, "RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill, opts.invalid_field));
+  body = _spliceRaw(body, "RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill, opts.invalid_field, !!opts.all_digital));
   body = _spliceRaw(body, "RAW_SUMMARY_LINES", summaryLines);
   // Pick-up-in-store picker, gift personalization, loyalty redeem, and the
   // CAPTCHA widget are spliced in ABOVE the submit action row — inside the
@@ -9775,6 +9800,15 @@ function mount(router, deps) {
   // launch flow converts the reservation into a Stripe-gated order).
   var preorder = deps.preorder || null;
 
+  // Operator-readable error log (lib/error-log.js). When wired, the
+  // server-side catches below ALSO record their scrubbed failure
+  // message here so it's reachable from the admin console + JSON API,
+  // not just the container-local audit sink. Optional — absent it, the
+  // catches behave exactly as before (audit-emit only). Every call is
+  // drop-silent + fire-and-forget: captureServerError can never throw,
+  // and a failing response must not wait on (or be undone by) the write.
+  var errorLog = deps.errorLog || null;
+
   // CAPTCHA gate (bot challenge at signup / login / checkout). Active ONLY
   // when the operator has registered a provider AND set CAPTCHA_PROVIDER_SLUG
   // (server.js resolves the provider row at boot into captchaKind +
@@ -12068,6 +12102,35 @@ function mount(router, deps) {
   }
 
   if (deps.checkout && deps.order) {
+    // True when EVERY cart line is a no-shipment good (its variant's
+    // requires_shipping is 0) — the cart ships nothing, so the checkout
+    // form drops the address requirement and the POST gate requires only
+    // email + name + country (for the tax quote). A missing variant row,
+    // a null/absent column, or an empty cart all read as "needs an
+    // address" (shippable) — relaxing the gate is the exception, never the
+    // default, so a lookup gap can't hide a required field. Mirrors
+    // checkout._buildQuote's per-line `!!v.requires_shipping` enrichment.
+    // The GET render path computes this inline from the variant rows it
+    // already fetches for the order-summary lookup (no second query pass);
+    // the POST gate has no such lookup, so it resolves here.
+    async function _cartAllDigital(lines) {
+      if (!lines || !lines.length) return false;
+      if (!deps.catalog || !deps.catalog.variants || typeof deps.catalog.variants.get !== "function") {
+        return false;   // can't prove all-digital → keep the address gate
+      }
+      var shipByVariant = {};
+      for (var i = 0; i < lines.length; i += 1) {
+        var vid = lines[i].variant_id;
+        if (shipByVariant[vid] !== undefined) continue;
+        var v = await deps.catalog.variants.get(vid);
+        shipByVariant[vid] = !v || v.requires_shipping == null || Number(v.requires_shipping) === 1;
+      }
+      for (var j = 0; j < lines.length; j += 1) {
+        if (shipByVariant[lines[j].variant_id] !== false) return false;   // a shippable line
+      }
+      return true;
+    }
+
     // Build the renderCheckoutForm() opts for an active cart `c`: repriced
     // lines, totals, the thumbnail lookup, and the signed-in customer's
     // loyalty balance + prefill. Shared by the GET handler and the POST
@@ -12088,16 +12151,41 @@ function mount(router, deps) {
       var totals = totalsDetail.totals;
       // variant_id → { product, hero_media } lookup for the summary
       // thumbnails + titles — same shape (and caching) the cart route uses.
+      // The SAME variant row (catalog returns SELECT * — requires_shipping
+      // is on it) feeds the all-digital determination below, so the form
+      // can drop the address requirement on a no-shipment cart without a
+      // second query pass. `shipBySku` caches requires_shipping per variant
+      // so a duplicate cart line never re-fetches. A line whose variant row
+      // is missing is treated as shippable (the never-relax-on-missing-data
+      // stance), so a lookup gap can never accidentally hide a required
+      // address.
       var checkoutLookup = {};
+      var shipByVariant = {};
       for (var li = 0; li < lines.length; li += 1) {
         var lvId = lines[li].variant_id;
-        if (checkoutLookup[lvId]) continue;
+        if (checkoutLookup[lvId] !== undefined) continue;
         var lv = await deps.catalog.variants.get(lvId);
-        if (!lv) { checkoutLookup[lvId] = null; continue; }
+        if (!lv) {
+          checkoutLookup[lvId] = null;
+          shipByVariant[lvId] = true;   // missing variant → treat as shippable
+          continue;
+        }
         var lprod = await deps.catalog.products.get(lv.product_id);
         var lmedia = await deps.catalog.media.listForProduct(lv.product_id);
         checkoutLookup[lvId] = { product: lprod, hero_media: lmedia.length ? lmedia[0] : null };
+        // requires_shipping defaults to 1 (shippable) when the column is
+        // absent — mirrors checkout._buildQuote's `!!v.requires_shipping`
+        // with a null-safe default of shippable.
+        shipByVariant[lvId] = lv.requires_shipping == null || Number(lv.requires_shipping) === 1;
+      }
+      // All-digital = a non-empty cart where NO line needs shipping. The
+      // service tier already completes such an order (checkout's
+      // digital_none fallback); this lets the form drop the address gate.
+      var anyShippable = false;
+      for (var si = 0; si < lines.length; si += 1) {
+        if (shipByVariant[lines[si].variant_id] !== false) { anyShippable = true; break; }
       }
+      var allDigital = lines.length > 0 && !anyShippable;
       // A signed-in customer drives two best-effort lookups, both keyed
       // off the same auth env: the loyalty balance (for the redeem field)
       // and the default shipping address (to pre-fill the form). Either
@@ -12161,6 +12249,9 @@ function mount(router, deps) {
         lines: lines, totals: totals, totals_detail: totalsDetail,
         shop_name: shopName, theme: theme,
         product_lookup: checkoutLookup,
+        // Every cart line is a no-shipment good → the form drops the
+        // address requirement (and the POST gate mirrors the flag).
+        all_digital: allDigital,
         paypal_client_id: deps.paypal ? deps.paypal_client_id : null,
         loyalty_balance: loyaltyBalance,
         loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
@@ -12325,7 +12416,13 @@ function mount(router, deps) {
       }
       var shipTo = _shipToFromBody(body);
       try {
-        _requireCheckoutFields(body, shipTo);
+        // A cart whose every line is a no-shipment good needs no shipping
+        // address — only email + name + a country for the tax quote. The
+        // form rendered the address block optional (all_digital); the gate
+        // here mirrors that so the two never disagree. A mixed/physical
+        // cart keeps the full requirement set.
+        var coAllDigital = await _cartAllDigital(await deps.cart.listLines(c.id));
+        _requireCheckoutFields(body, shipTo, coAllDigital);
         // default_shipping_id may be a literal string or an
         // operator-supplied async resolver (e.g. backed by the
         // config primitive) so re-reads happen per request without
@@ -12437,6 +12534,14 @@ function mount(router, deps) {
             outcome:  "failure",
             metadata: { message: msg },
           });
+          // ALSO record into the operator-readable error log so this
+          // 500's detail is reachable from /admin/errors + the admin
+          // JSON API, not just the container-local audit sink. Drop-
+          // silent + fire-and-forget — never blocks or breaks the
+          // styled error page the customer gets.
+          if (errorLog) {
+            errorLog.captureServerError({ route: "/checkout", message: msg, method: "POST", status: 500 });
+          }
         }
         return _send(res, clientErr ? 400 : 500, renderCheckoutError({
           shop_name: shopName, theme: theme, eyebrow: "Checkout",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.65",
+  "version": "0.3.67",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {