@blamejs/blamejs-shop 0.4.22 → 0.4.23

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.23 (2026-06-06) — **A stolen sign-in cookie stops working on another device, payment-provider outages fail fast and recover, replayed payment webhooks are refused, and the staff audit log is rewrite-evident.** A security-hardening release. The signed-in session cookie now carries a device fingerprint — a cookie lifted from one browser softly signs out instead of working anywhere for two weeks. Payment-provider calls run behind a circuit breaker, so a provider brown-out fails fast into the existing payment-unavailable page and recovers automatically instead of hanging every checkout. A captured payment-webhook payload can no longer be replayed inside the signature tolerance window. And the staff-activity audit log is anchored with post-quantum checkpoint signatures, with a verification endpoint that detects any rewrite of its history. **Security:** *The sign-in cookie is pinned to the device that signed in* — The signed-in session cookie was tamper-proof but portable — exfiltrated once, it worked from any device until expiry. Signing in now embeds a fingerprint of the signing-in browser inside the sealed cookie, and every authenticated request re-checks it in constant time. A mismatch signs the visitor out gently to the sign-in page rather than failing the request mid-page; network changes don't trip it (the fingerprint deliberately excludes the IP address), and sessions issued before this release continue to work until they expire naturally. · *Payment-provider calls are circuit-broken and retried where safe* — A payment-provider brown-out previously failed every checkout serially, each waiting out the full network timeout. Provider calls now run behind a circuit breaker: repeated failures trip it, subsequent checkouts fail fast into the existing payment-unavailable page, and the circuit closes again when the provider recovers. Idempotent calls — reads and writes carrying an idempotency key — retry through brief blips; non-idempotent calls never retry. The TLS configuration for provider connections is unchanged. · *Replayed payment webhooks are refused* — A captured, validly-signed payment-webhook payload could be replayed within the signature timestamp tolerance and re-drive order transitions. Each event is now recorded on first receipt and a replay of the same event answers as an already-processed no-op — enforced with a single atomic write, so two concurrent deliveries of the same event also collapse to one. Replay records expire with the signature tolerance window. · *The staff audit log detects history rewrites* — Staff-activity audit rows were hash-linked, which catches tampering with a single row but not a consistent rewrite of the whole chain. The chain is now anchored with periodic checkpoint signatures (ML-DSA, the same signing the framework audit chain uses), and `/admin/operators/audit/verify` reports both link integrity and checkpoint verification — a rewritten history fails the check. Stores that disable destructive operations behind a second approver were also evaluated: with one active operator the gate would deadlock the store, so gift-card voids, refunds, and operator disables remain single-approver — role-gated, bounded, reversible, and audited — with the stance and its revisit condition documented in the module.
+
 - v0.4.22 (2026-06-06) — **Privacy export covers every table, erasure revokes the login, one-click unsubscribe actually works, and bounces feed the suppression list.** A privacy and email-integrity release. The data-subject export now includes reviews, consent history, wishlist, surveys, and recently-viewed data — with a manifest that makes any absent section visible. Erasing a customer also deletes their passkeys and social-login links and revokes live sessions, so a deleted account can no longer sign in. The one-click unsubscribe that mail clients invoke from their native button now works (it pointed at a route that didn't exist), a new intake endpoint feeds provider bounce and complaint webhooks into the marketing suppression list, support-ticket edge cases are fixed, and the CSV exports share one complete injection-neutralizer. **Added:** *Bounce and complaint webhook intake* — A new `POST /api/webhooks/mail-bounce` endpoint accepts bounce and complaint webhooks from Postmark, SES, or Resend (selectable per request). Spam complaints and permanently-dead addresses land on the marketing suppression list — transactional mail still flows — and campaign metrics gain the bounce events they were built to read. The endpoint is armed only when `MAIL_BOUNCE_SECRET` is set and the provider presents it in the `x-mail-bounce-secret` header; unconfigured, it answers 503 and accepts nothing. **Fixed:** *The data-subject export includes every table that holds the customer* — The export bundle silently omitted reviews, consent history, wishlist items, survey responses, and recently-viewed data. All five are now included, and the bundle carries a completeness manifest listing every section as exported, empty, or absent — an omission is visible rather than silent. · *Erasure revokes the customer's ability to sign in* — Deleting a customer scrubbed their profile but left passkeys, Google/Apple login links, and live sessions intact — the "deleted" account could sign right back in. Erasure now deletes the passkeys and social-login links, revokes live portal sessions, and tombstones the email lookup hash irreversibly, while the anonymized record survives for order-history integrity. · *One-click unsubscribe works from the mail client's native button* — The unsubscribe headers stamped on every campaign pointed at a route that didn't exist, and the unsubscribe endpoint read its token from the form body — which a mail client's native one-click POST never carries. The header now points at the real endpoint and the token rides the URL, so the RFC 8058 one-click flow a mail client fires actually unsubscribes. The browser confirmation page is unchanged. · *Support tickets: reopen on customer reply, atomic tags, honest first-response time* — A customer reply to a resolved ticket silently disappeared from every operator queue — it now reopens the ticket with a fresh activity timestamp. Concurrent tag edits no longer overwrite each other (tag changes are single-statement updates). And an internal-only operator note no longer counts as the first response — only a reply the customer can actually see stamps the first-response time. · *CSV exports share one complete injection neutralizer* — The order-export and segment-members CSV exports each carried their own formula-injection defense, and both missed the tab, carriage-return, newline, and pipe vectors. Both now compose the framework's CSV cell guard, which covers the full vector set — including signed numerics, which the previous neutralizers deliberately exempted.
 
 - v0.4.21 (2026-06-06) — **Subscription changes reach the payment processor, smart collections match real products, refunds claw back earned points, and the remaining balance races are closed.** A correctness release across the commerce surfaces. Changing a subscription's quantity now updates the processor before the local record — what the customer sees is what they're billed — and a cadence change on a processor-backed plan is honestly refused rather than silently ignored. Smart collections, which matched zero products in production because their rules read fields the catalog rows never carried, now evaluate against the real product data. Loyalty points earned on a purchase are reversed when the order is refunded or cancelled. And the loyalty, store-credit, gift-registry, and gift-card-ledger write paths that could lose updates or oversell under concurrency now use atomic guards. **Fixed:** *Subscription quantity changes reach the payment processor* — Changing a subscription's quantity updated the local record and showed a success message while the processor kept billing the original amount. The change is now pushed to the processor first — a processor failure leaves the local record untouched and surfaces the error, so the customer-visible state and the billed state can no longer diverge. Changing delivery frequency on a processor-backed subscription is refused with honest guidance (the billing cadence is bound to the plan's price and cannot be re-cadenced in place); self-managed local subscriptions keep their frequency controls. Self-manage controls also now respect the processor's status — a subscription the processor reports as cancelled or expired shows its state instead of live controls. · *Smart collections match real catalog products* — Smart-collection rules read fields like tags, price, and stock from each product row — fields the real catalog listing never carried, so every smart collection matched zero products in production even though admin previews built on richer mock rows looked right. Rule evaluation now joins the real tag, category, vendor, price, and inventory data onto each product page, and the admin preview routes through the same path the storefront uses. Smart-collection pages also stop re-walking the entire catalog on every paginated request — the matched set is briefly cached and a rule edit invalidates it. · *Refunds and cancellations reverse the loyalty points the order earned* — Points awarded when an order was paid survived a refund or cancellation — buying, earning, and refunding farmed points indefinitely. The earn record is now claimed atomically on the order's refund or cancel transition and the awarded points are clawed back from the balance, floored at zero when some were already spent. The reversal is idempotent (a re-delivered payment webhook reverses exactly once) and lifetime points — which drive tier — are deliberately untouched. · *Balance and inventory-adjacent races closed across loyalty, store credit, gift registry, and gift-card ledger* — Loyalty earn and adjust used read-then-write absolute updates that could lose concurrent updates; the gift-registry purchase check could oversell a registry item under two simultaneous purchases; and the gift-card ledger's overdraft check could let two concurrent debits both pass. All of these now use single-statement conditional writes that refuse cleanly when the guard fails. Store-credit expiry sweeps also stop under-expiring when operator-initiated deductions exist — the sweep now keys on its own prior output rather than netting all expiry rows together. · *Search-ranking click-through metrics are bounded and attributed* — The ranking metrics screen could show click-through rates above 100%, and clicks were attributed from the query string alone — trivially spoofable. A click now only counts when the same session recorded a real impression for that query, and displayed rates are bounded at 100%.

package/lib/admin.js

@@ -12909,6 +12909,51 @@ function mount(router, deps) {
       },
     ));
 
+    // Operator audit-chain integrity check (ops/tooling, bearer JSON).
+    // Walks the hash linkage (verifyChain) AND re-derives every signed
+    // checkpoint (verifyCheckpoints) so an operator can confirm the chain
+    // is both internally consistent AND anchored — the checkpoint layer is
+    // what catches a full-chain rewrite the hash linkage alone can't.
+    // Read-only: any failure to read degrades to an unavailable verdict,
+    // never a 500. Mounts only when the audit log is wired.
+    if (operatorAuditLog && typeof operatorAuditLog.verifyChain === "function") {
+      router.get("/admin/operators/audit/verify", _pageOrApi(true,
+        R(async function (req, res) {
+          var chain = null;
+          var checkpoints = null;
+          try { chain = await operatorAuditLog.verifyChain(); }
+          catch (_e) { chain = { ok: false, reason: "verify-unavailable" }; }
+          if (typeof operatorAuditLog.verifyCheckpoints === "function") {
+            try { checkpoints = await operatorAuditLog.verifyCheckpoints(); }
+            catch (_e) { checkpoints = { ok: false, reason: "verify-unavailable" }; }
+          }
+          _json(res, 200, {
+            chain:           chain,
+            checkpoints:     checkpoints,
+            signing_available: !!(operatorAuditLog.signingAvailable && operatorAuditLog.signingAvailable()),
+          });
+          return false;
+        }),
+        // No dedicated console screen — the operators page links here for
+        // tooling; a browser hit gets the same JSON verdict.
+        async function (req, res) {
+          var chain = null;
+          var checkpoints = null;
+          try { chain = await operatorAuditLog.verifyChain(); }
+          catch (_e) { chain = { ok: false, reason: "verify-unavailable" }; }
+          if (typeof operatorAuditLog.verifyCheckpoints === "function") {
+            try { checkpoints = await operatorAuditLog.verifyCheckpoints(); }
+            catch (_e) { checkpoints = { ok: false, reason: "verify-unavailable" }; }
+          }
+          _json(res, 200, {
+            chain:           chain,
+            checkpoints:     checkpoints,
+            signing_available: !!(operatorAuditLog.signingAvailable && operatorAuditLog.signingAvailable()),
+          });
+        },
+      ));
+    }
+
     // Create an operator. The first operator is created by the ADMIN_API_KEY
     // owner; thereafter any owner can. `created_by` is the acting operator's
     // id (or the "owner" sentinel for the break-glass key).

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.22",
+  "version": "0.4.23",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",

package/lib/checkout.js

@@ -246,6 +246,60 @@ function create(deps) {
   var backorder = deps.backorder || null;
   var preorder  = deps.preorder  || null;
 
+  // Optional inbound-webhook replay defense. A validly-signed Stripe event
+  // can be replayed verbatim inside the ±5-minute signature tolerance: the
+  // signature still verifies, so signature-checking alone does not stop a
+  // replay, and the downstream order-state idempotency is keyed on order
+  // state (not event identity) so a refund/cancel replay or a replay that
+  // races the first delivery slips past it. When `webhookReplayQuery` (a
+  // D1 query fn) is wired, every verified Stripe event id is atomically
+  // recorded with an INSERT ... ON CONFLICT DO NOTHING; a replay loses the
+  // PRIMARY-KEY race and is treated as an already-processed no-op. The
+  // store composes b.nonceStore over a D1-backed atomic backend rather
+  // than a hand-rolled has/set (which would race). Absent — the handler is
+  // byte-identical to the un-wired flow (order-state idempotency still
+  // covers the common re-delivery), so this is additive, never required.
+  var webhookReplayQuery = (typeof deps.webhookReplayQuery === "function")
+    ? deps.webhookReplayQuery : null;
+  var STRIPE_REPLAY_TTL_MS = b.constants.TIME.minutes(5); // matches the signature tolerance window
+  var _stripeReplayStore = null;
+  function _stripeReplay() {
+    if (!webhookReplayQuery) return null;
+    if (!_stripeReplayStore) {
+      // Custom b.nonceStore backend: the atomicity lives in the D1
+      // INSERT ... ON CONFLICT DO NOTHING (the PRIMARY KEY race decides
+      // first-seen vs replay), so the check + insert can never interleave.
+      _stripeReplayStore = b.nonceStore.create({
+        backend: {
+          checkAndInsert: async function (eventId, expireAt) {
+            var nowMs = Date.now();
+            var r = await webhookReplayQuery(
+              "INSERT INTO stripe_webhook_events (event_id, first_seen_at, expires_at) " +
+              "VALUES (?1, ?2, ?3) ON CONFLICT (event_id) DO NOTHING",
+              [eventId, nowMs, expireAt],
+            );
+            // rowCount/changes === 1 → first sighting (recorded); 0 → replay.
+            var changes = (r && r.meta && typeof r.meta.changes === "number") ? r.meta.changes
+              : (r && typeof r.rowCount === "number") ? r.rowCount
+              : (r && typeof r.changes === "number") ? r.changes : 0;
+            return changes > 0;
+          },
+          purgeExpired: async function () {
+            var r = await webhookReplayQuery(
+              "DELETE FROM stripe_webhook_events WHERE expires_at < ?1",
+              [Date.now()],
+            );
+            if (r && r.meta && typeof r.meta.changes === "number") return r.meta.changes;
+            if (r && typeof r.rowCount === "number") return r.rowCount;
+            if (r && typeof r.changes === "number") return r.changes;
+            return 0;
+          },
+        },
+      });
+    }
+    return _stripeReplayStore;
+  }
+
   // Reprice a list of cart lines through the quantity-discount engine.
   // Returns a shallow copy with `unit_amount_minor` overwritten by the
   // discounted unit for each line's SKU at its quantity. A line whose
@@ -1261,6 +1315,22 @@ function create(deps) {
       var event = v.event;
       var eventType = event && event.type;
 
+      // Replay defense — atomically claim this event id the moment the
+      // signature verifies, BEFORE any subscription routing or state
+      // transition. A replayed (already-seen) event id loses the
+      // PRIMARY-KEY race and short-circuits to a processed no-op so no
+      // transition, refund-mirror, or subscription update runs twice. A
+      // store error fails CLOSED inside the nonceStore (returns
+      // not-fresh) — a replay is indistinguishable from a wiped store, so
+      // refusing is the safe default. No-op when the store isn't wired.
+      var replay = _stripeReplay();
+      if (replay && event && typeof event.id === "string" && event.id.length > 0) {
+        var fresh = await replay.checkAndInsert(event.id, Date.now() + STRIPE_REPLAY_TTL_MS);
+        if (!fresh) {
+          return { handled: true, event_type: eventType || null, skipped: "replay", event_id: event.id };
+        }
+      }
+
       // Subscription events route to the subscriptions primitive
       // (if wired). The one-time-order PaymentIntent path below
       // stays unchanged.

package/lib/operator-accounts.js

@@ -87,9 +87,60 @@
  *
  *   Storage: `migrations-d1/0213_operator_accounts.sql`.
  *
+ *   Dual-control (two-operator approval) — evaluated, deliberately NOT
+ *   wired in v1:
+ *
+ *     `b.dualControl` raises a destructive op to "two distinct named
+ *     operators must approve before it runs." It is the right control for
+ *     a store run by a TEAM, but it is structurally a two-actor M-of-N
+ *     gate — `create()` hard-validates `minApprovers >= 2`, and there is
+ *     no auto-satisfy-on-single-operator path. The dominant deployment of
+ *     this storefront is a SINGLE owner; on such a store a dual-control
+ *     gate would DEADLOCK the destructive op forever — there is no second
+ *     operator to approve, so the op can never consume its grant. Wiring
+ *     it unconditionally is therefore a worse failure than the
+ *     single-operator risk it would close. It is also a two-request async
+ *     workflow (request → a different actor approves → consume), which
+ *     does not fit the synchronous single-POST shape these admin actions
+ *     have today.
+ *
+ *     Per destructive op, the v1 stance:
+ *
+ *       - gift-card void (POST /admin/gift-cards/:id/void): recoverable —
+ *         void is a status flip that PRESERVES the balance (it burns no
+ *         value), so re-issuing or restoring the card's status makes a
+ *         mistaken void recoverable, and the giftcard ledger records the
+ *         acting operator. The cost of a deadlock-on-single-owner
+ *         outweighs the benefit. Stance: role-gate (`orders.write`) +
+ *         audit, no dual-control.
+ *
+ *       - refunds (POST /admin/orders/:id/refund, /admin/returns/:id/
+ *         refund): real money out, but bounded by the order's captured
+ *         amount (the payment primitive refuses to over-refund a PI), and
+ *         every refund is idempotency-keyed + audited with the operator
+ *         id. The damage ceiling is one order's total, not the whole
+ *         book. Stance: role-gate (`orders.write`) + audit, no
+ *         dual-control.
+ *
+ *       - operator disable (POST /admin/operators/:id/disable): the
+ *         highest-blast-radius op (it can revoke a co-owner), but it is
+ *         REVERSIBLE in one click (`/enable`), gated on `operators.manage`
+ *         (owner-only), and audited. A malicious self-lockout still leaves
+ *         the `ADMIN_API_KEY` break-glass owner credential working.
+ *         Stance: role-gate + audit, no dual-control.
+ *
+ *     Re-open condition: when a store carries TWO OR MORE active `owner`/
+ *     `manager` operators, dual-control becomes wire-able WITHOUT the
+ *     deadlock risk — gate the approval flow on `listAccounts({ status:
+ *     "active" })` length >= 2, auto-satisfy below that, and move the
+ *     destructive POST to a request/approve/consume sequence keyed off a
+ *     b.cache grant. That is the natural follow-up the moment a real
+ *     multi-operator store exists; it is not defensible to ship a control
+ *     that bricks the single-operator common case to pre-empt it.
+ *
  * @primitive operatorAccounts
  * @related   operatorRoles, operatorSessions, operatorAuditLog,
- *            b.password, b.crypto, b.guardEmail, b.uuid
+ *            b.password, b.crypto, b.guardEmail, b.uuid, b.dualControl
  */
 
 var EMAIL_NAMESPACE   = "operator-email";

package/lib/operator-audit-log.js

@@ -84,6 +84,11 @@ var SHA3_512_HEX_LEN      = 128;
 
 var ZERO_HASH = "0".repeat(SHA3_512_HEX_LEN);
 
+// Canonical prefix for the bytes a checkpoint signs. Stable forever —
+// changing it invalidates every prior checkpoint signature. Mirrors the
+// framework audit chain's "blamejs-audit-checkpoint-v1" format.
+var CHECKPOINT_FORMAT = "blamejs-operator-audit-checkpoint-v1";
+
 var ALLOWED_ACTOR_TYPES = Object.freeze(["operator", "system", "app"]);
 var ALLOWED_UA_CLASSES  = Object.freeze([
   "browser",
@@ -581,6 +586,152 @@ function create(opts) {
     return { ok: true, rows_verified: rows.length, last_hash: prevHash };
   }
 
+  // -- checkpoint anchoring ----------------------------------------------
+  //
+  // The hash chain is tamper-EVIDENT against a single edited/deleted row,
+  // but an attacker who can rewrite the whole table can re-hash from a
+  // forged genesis and leave the chain internally consistent. Anchoring
+  // the tip with a post-quantum signature over the head row_hash — keyed
+  // off the framework's b.auditSign keypair, whose private half never
+  // touches D1 — closes that hole: a full-chain rewrite can't reproduce a
+  // valid checkpoint signature over the rewritten tip.
+  //
+  // checkpoint() signs the CURRENT head and inserts an anchor row.
+  // verifyCheckpoints() re-derives every anchor's signature and confirms
+  // the anchored row still carries the signed hash. Both no-op gracefully
+  // when b.auditSign isn't initialized (the chain stays hash-linked; the
+  // signature layer is simply absent) so a deployment without the
+  // audit-signing keypair still records + verifies the linkage.
+
+  function _auditSignReady() {
+    try { b.auditSign.getPublicKeyFingerprint(); return true; }
+    catch (_e) { return false; }
+  }
+
+  // Canonical signed bytes for a checkpoint. STABLE FOREVER — changing
+  // this layout invalidates every prior checkpoint signature.
+  function _checkpointPayload(atRowId, atOccurredAt, atRowHash, createdAt) {
+    return Buffer.from(
+      CHECKPOINT_FORMAT + "\n" +
+      atRowId + "\n" +
+      String(atOccurredAt) + "\n" +
+      atRowHash + "\n" +
+      String(createdAt),
+      "utf8",
+    );
+  }
+
+  // Anchor the current chain tip with a fresh PQC signature. Returns the
+  // inserted checkpoint row, or null when the chain is empty (nothing to
+  // anchor) or `skipIfUnchanged` and the tip hasn't advanced since the
+  // last checkpoint. Throws OperatorAuditCheckpointSigningUnavailable-
+  // shaped TypeError only if asked to checkpoint without a signing key —
+  // callers that want a soft skip check `signingAvailable()` first.
+  async function checkpoint(checkpointOpts) {
+    checkpointOpts = checkpointOpts || {};
+    if (!_auditSignReady()) {
+      throw new TypeError("operatorAuditLog.checkpoint: b.auditSign is not initialized — " +
+        "no signing key to anchor the chain with");
+    }
+    var head = await _currentHead();
+    if (head.id === null) return null;  // empty chain — nothing to anchor
+
+    if (checkpointOpts.skipIfUnchanged) {
+      var last = await query(
+        "SELECT at_row_hash FROM operator_audit_checkpoints " +
+        "ORDER BY created_at DESC, id DESC LIMIT 1",
+        [],
+      );
+      if (last.rows.length && last.rows[0].at_row_hash === head.row_hash) {
+        return null;  // already anchored at this exact tip
+      }
+    }
+
+    var createdAt = _now();
+    var payload   = _checkpointPayload(head.id, head.occurred_at, head.row_hash, createdAt);
+    var signature = b.auditSign.sign(payload).toString("base64");
+    var pubFp     = b.auditSign.getPublicKeyFingerprint();
+    var id        = b.uuid.v7();
+
+    await query(
+      "INSERT INTO operator_audit_checkpoints " +
+      "(id, created_at, at_row_id, at_occurred_at, at_row_hash, signature, public_key_fingerprint) " +
+      "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+      [id, createdAt, head.id, head.occurred_at, head.row_hash, signature, pubFp],
+    );
+
+    return {
+      id:                     id,
+      created_at:             createdAt,
+      at_row_id:              head.id,
+      at_occurred_at:         head.occurred_at,
+      at_row_hash:            head.row_hash,
+      public_key_fingerprint: pubFp,
+    };
+  }
+
+  // Walk every checkpoint oldest-first, re-derive its signature, and
+  // confirm the anchored row still carries the signed hash. Reports the
+  // first divergence — a forged signature, a key-rotation fingerprint
+  // mismatch, a vanished anchor row, or a rewritten tip whose hash no
+  // longer matches what was signed.
+  async function verifyCheckpoints() {
+    if (!_auditSignReady()) {
+      return { ok: true, checkpoints_verified: 0, reason: "audit-sign-unavailable" };
+    }
+    var r = await query(
+      "SELECT * FROM operator_audit_checkpoints ORDER BY created_at ASC, id ASC",
+      [],
+    );
+    var rows = r.rows;
+    if (!rows.length) return { ok: true, checkpoints_verified: 0 };
+
+    var currentFp  = b.auditSign.getPublicKeyFingerprint();
+    var currentPub = b.auditSign.getPublicKey();
+
+    for (var i = 0; i < rows.length; i += 1) {
+      var c = rows[i];
+      // Only the current key verifies (no key-history table). A rotation
+      // without re-signing surfaces here rather than silently failing.
+      if (c.public_key_fingerprint !== currentFp) {
+        return {
+          ok: false, checkpoints_verified: i, break_at: i, checkpoint_id: c.id,
+          reason: "public key fingerprint mismatch (key rotated without re-signing?)",
+          expected: currentFp, actual: c.public_key_fingerprint,
+        };
+      }
+      var payload = _checkpointPayload(c.at_row_id, Number(c.at_occurred_at), c.at_row_hash, Number(c.created_at));
+      var sigBuf;
+      try { sigBuf = Buffer.from(c.signature, "base64"); }
+      catch (_e) {
+        return { ok: false, checkpoints_verified: i, break_at: i, checkpoint_id: c.id,
+          reason: "checkpoint signature not decodable" };
+      }
+      if (!b.auditSign.verify(payload, sigBuf, currentPub)) {
+        return { ok: false, checkpoints_verified: i, break_at: i, checkpoint_id: c.id,
+          reason: "post-quantum signature failed" };
+      }
+      // The anchored row must still exist AND still carry the signed hash.
+      // A full-chain rewrite changes row_hash → this mismatch is the catch.
+      var anchored = await query(
+        "SELECT row_hash FROM operator_audit_events WHERE id = ?1 LIMIT 1",
+        [c.at_row_id],
+      );
+      if (!anchored.rows.length) {
+        return { ok: false, checkpoints_verified: i, break_at: i, checkpoint_id: c.id,
+          reason: "anchored audit row missing (id=" + c.at_row_id + ")" };
+      }
+      if (anchored.rows[0].row_hash !== c.at_row_hash) {
+        return {
+          ok: false, checkpoints_verified: i, break_at: i, checkpoint_id: c.id,
+          reason: "anchored row_hash mismatch — operator_audit_events was rewritten",
+          expected: c.at_row_hash, actual: anchored.rows[0].row_hash,
+        };
+      }
+    }
+    return { ok: true, checkpoints_verified: rows.length };
+  }
+
   return {
     MAX_ACTOR_ID_LEN:      MAX_ACTOR_ID_LEN,
     MAX_ACTION_LEN:        MAX_ACTION_LEN,
@@ -593,12 +744,20 @@ function create(opts) {
     ALLOWED_UA_CLASSES:    ALLOWED_UA_CLASSES,
     ZERO_HASH:             ZERO_HASH,
 
-    record:         record,
-    listByActor:    listByActor,
-    listByResource: listByResource,
-    searchAction:   searchAction,
-    chainHead:      chainHead,
-    verifyChain:    verifyChain,
+    record:            record,
+    listByActor:       listByActor,
+    listByResource:    listByResource,
+    searchAction:      searchAction,
+    chainHead:         chainHead,
+    verifyChain:       verifyChain,
+    // Checkpoint anchoring — sign the chain tip out-of-band so a
+    // full-chain rewrite (which verifyChain alone can't catch) becomes
+    // detectable. `signingAvailable()` lets callers soft-skip when the
+    // audit-signing key isn't initialized.
+    checkpoint:        checkpoint,
+    verifyCheckpoints: verifyCheckpoints,
+    signingAvailable:  _auditSignReady,
+    CHECKPOINT_FORMAT: CHECKPOINT_FORMAT,
   };
 }
 
@@ -614,4 +773,5 @@ module.exports = {
   ALLOWED_ACTOR_TYPES:   ALLOWED_ACTOR_TYPES,
   ALLOWED_UA_CLASSES:    ALLOWED_UA_CLASSES,
   ZERO_HASH:             ZERO_HASH,
+  CHECKPOINT_FORMAT:     CHECKPOINT_FORMAT,
 };

package/lib/payment.js

@@ -8,9 +8,15 @@
  *   verification (HMAC-SHA256 over `<timestamp>.<body>` with
  *   `whsec_...` secret, ±5 min tolerance, constant-time compare) and
  *   outbound API calls (PaymentIntent create / retrieve / confirm /
- *   cancel + Refund) composed on `b.httpClient` (SSRF-gated, retried,
- *   circuit-broken, ALPN HTTP/2). No `stripe` npm dep — every byte is
- *   either node built-in or vendored blamejs primitive.
+ *   cancel + Refund) on `b.httpClient` (SSRF-gated, response-capped,
+ *   ALPN HTTP/2). Each adapter instance wraps its dials in a per-upstream
+ *   `b.circuitBreaker` plus a bounded `b.retry` (the latter only on
+ *   idempotent dials — GET reads + idempotency-keyed writes — so a
+ *   transient blip never re-sends a one-shot charge). While the breaker is
+ *   open the dial fast-fails with `code: "CIRCUIT_OPEN"` BEFORE the
+ *   request, so checkout renders the recoverable payment-unavailable page
+ *   rather than stranding an order mid-charge. No `stripe` npm dep — every
+ *   byte is either node built-in or vendored blamejs primitive.
  *
  *   Future Adyen / Mollie / Paddle adapters land as additional
  *   factory functions returning the same `{ verifyWebhook,
@@ -48,6 +54,59 @@ var STRIPE_WEBHOOK_TOLERANCE = 300;   // ± 5 minutes (Stripe default)
 var STRIPE_HTTP_TIMEOUT_MS   = 15000;
 var CURRENCY_RE              = /^[a-z]{3}$/;   // Stripe wants lowercase ISO 4217
 
+// ---- PSP dial resilience (circuit breaker + bounded retry) ----------------
+//
+// b.httpClient does NOT itself circuit-break or retry — it SSRF-gates, caps,
+// and pools, but the failure-threshold breaker + backoff retry are separate
+// primitives a consumer composes around it. Each adapter instance owns ONE
+// breaker per upstream (Stripe / PayPal): per-target is the only correct
+// scope — sharing a breaker across unrelated peers defeats the
+// failure-threshold semantic.
+//
+// Open-circuit posture: while the breaker is open every dial fast-fails with
+// a plain Error carrying `code: "CIRCUIT_OPEN"` (NOT a TypeError), so the
+// storefront's checkout handler renders it through the existing recoverable
+// "checkout didn't go through" page — the same structured payment-unavailable
+// surface a raw upstream 5xx already produces — rather than charging or
+// 400-ing a field. Nothing is captured: the breaker fails BEFORE the dial, so
+// no order is stranded mid-charge.
+//
+// Retry rides ONLY on idempotent dials — GET reads and writes carrying an
+// idempotency key (Stripe Idempotency-Key / PayPal-Request-Id). A
+// keyless POST is sent exactly once: re-driving it could double-charge.
+var BREAKER_FAILURE_THRESHOLD = 5;                 // consecutive failures before opening
+var BREAKER_COOLDOWN_MS       = C.TIME.seconds(30); // open → half-open probe delay
+var BREAKER_SUCCESS_THRESHOLD = 2;                 // half-open probes to re-close
+var DIAL_RETRY_MAX_ATTEMPTS   = 3;                 // total tries incl. first (idempotent only)
+var DIAL_RETRY_BASE_DELAY_MS  = 200;
+var DIAL_RETRY_MAX_DELAY_MS   = C.TIME.seconds(2);
+
+// One breaker per adapter instance. `idempotent` selects whether the dial
+// also rides the bounded backoff retry — the breaker counts the retry loop's
+// FINAL outcome as a single call (b.retry.withBreaker), so a transient blip
+// that the retry rides out never inflates the failure counter.
+function _makeBreaker(name) {
+  return b.circuitBreaker.create({
+    name:             name,
+    failureThreshold: BREAKER_FAILURE_THRESHOLD,
+    cooldownMs:       BREAKER_COOLDOWN_MS,
+    successThreshold: BREAKER_SUCCESS_THRESHOLD,
+  });
+}
+
+function _dial(breaker, idempotent, fn) {
+  if (!breaker) return fn();
+  if (!idempotent) return breaker.wrap(fn);
+  return b.retry.withBreaker(fn, {
+    breaker: breaker,
+    retry:   {
+      maxAttempts: DIAL_RETRY_MAX_ATTEMPTS,
+      baseDelayMs: DIAL_RETRY_BASE_DELAY_MS,
+      maxDelayMs:  DIAL_RETRY_MAX_DELAY_MS,
+    },
+  });
+}
+
 // Stripe holds idempotency keys for 24h, so the local cache row
 // expires on the same window — operators who run `cleanupExpired()`
 // on a daily schedule keep the table small without ever shortening
@@ -196,33 +255,47 @@ async function _stripeCall(opts, method, path, params, idempotencyKey) {
     headers["idempotency-key"] = idempotencyKey;
   }
   var httpClient = opts.httpClient || b.httpClient;
-  var res = await httpClient.request({
-    method:    method,
-    url:       url,
-    headers:   headers,
-    body:      body || undefined,
-    timeoutMs: opts.timeoutMs || STRIPE_HTTP_TIMEOUT_MS,
-    agent:     _PSP_TLS_AGENT,
+  // A GET read is always idempotent; a write is idempotent only when it
+  // carries an Idempotency-Key (Stripe dedupes a replay of the SAME key
+  // server-side). A keyless POST rides the breaker but NOT the retry, so
+  // a transient blip never re-sends it (double-charge guard).
+  var idempotent = method === "GET" || !!idempotencyKey;
+  // The HTTP request AND the non-2xx → throw both run INSIDE the dialed
+  // closure so the breaker counts a 5xx / transport error as a failure
+  // (and the idempotent-path retry retries it). A 4xx is the request's
+  // fault, not the peer's health — `err.statusCode` makes the retry
+  // classifier skip it, and a 4xx still increments the breaker, which is
+  // acceptable since a sustained stream of 4xx is itself a degraded state.
+  var json = await _dial(opts._breaker, idempotent, async function () {
+    var res = await httpClient.request({
+      method:    method,
+      url:       url,
+      headers:   headers,
+      body:      body || undefined,
+      timeoutMs: opts.timeoutMs || STRIPE_HTTP_TIMEOUT_MS,
+      agent:     _PSP_TLS_AGENT,
+    });
+    var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
+    var parsed = null;
+    try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
+    if (res.statusCode < 200 || res.statusCode >= 300) {
+      var err = new Error("stripe: " + method + " " + path + " → HTTP " + res.statusCode +
+                          (parsed && parsed.error && parsed.error.message ? " — " + parsed.error.message : ""));
+      err.code = (parsed && parsed.error && parsed.error.code) || "STRIPE_HTTP_" + res.statusCode;
+      err.statusCode = res.statusCode;
+      err.stripe = parsed && parsed.error || null;
+      err._stripeRawText   = text;
+      err._stripeStatus    = res.statusCode;
+      throw err;
+    }
+    // Carry the raw status + serialised body alongside the parsed JSON
+    // so the idempotency layer can persist them verbatim for replay
+    // without re-stringifying (preserves byte-for-byte fidelity with
+    // what Stripe returned, including field ordering).
+    Object.defineProperty(parsed, "_stripeStatus",  { value: res.statusCode, enumerable: false });
+    Object.defineProperty(parsed, "_stripeRawText", { value: text,           enumerable: false });
+    return parsed;
   });
-  var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-  var json = null;
-  try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = { _raw: text }; }
-  if (res.statusCode < 200 || res.statusCode >= 300) {
-    var err = new Error("stripe: " + method + " " + path + " → HTTP " + res.statusCode +
-                        (json && json.error && json.error.message ? " — " + json.error.message : ""));
-    err.code = (json && json.error && json.error.code) || "STRIPE_HTTP_" + res.statusCode;
-    err.statusCode = res.statusCode;
-    err.stripe = json && json.error || null;
-    err._stripeRawText   = text;
-    err._stripeStatus    = res.statusCode;
-    throw err;
-  }
-  // Carry the raw status + serialised body alongside the parsed JSON
-  // so the idempotency layer can persist them verbatim for replay
-  // without re-stringifying (preserves byte-for-byte fidelity with
-  // what Stripe returned, including field ordering).
-  Object.defineProperty(json, "_stripeStatus",  { value: res.statusCode, enumerable: false });
-  Object.defineProperty(json, "_stripeRawText", { value: text,           enumerable: false });
   return json;
 }
 
@@ -330,6 +403,13 @@ function stripe(opts) {
     throw new TypeError("payment: now must be a function returning current epoch ms");
   }
 
+  // One circuit breaker per adapter instance, guarding every Stripe dial.
+  // Stashed on opts so the module-level `_stripeCall` reaches it without a
+  // signature change. Skippable in tests via `breaker: false`.
+  if (opts._breaker === undefined) {
+    opts._breaker = opts.breaker === false ? null : _makeBreaker("psp-stripe");
+  }
+
   // Idempotency state shared across every mutating call. When `query`
   // is not supplied the primitive runs in legacy mode — every
   // mutating call goes straight to Stripe, no cache writes, no
@@ -349,6 +429,11 @@ function stripe(opts) {
   return {
     name: "stripe",
 
+    // The per-adapter circuit breaker (or null when disabled). Exposed so
+    // an operator dashboard can read `breaker.getState()` ("closed" /
+    // "open" / "half") and reset it after a confirmed recovery.
+    breaker: opts._breaker,
+
     verifyWebhook: function (headers, rawBody, vOpts) {
       return _verifyWebhook(headers, rawBody, opts.webhookSecret, vOpts);
     },
@@ -648,28 +733,33 @@ async function _paypalToken(opts, state) {
   if (state.token && now < state.tokenExpiresAt) return state.token;
   var httpClient = opts.httpClient || b.httpClient;
   var basic = Buffer.from(opts.clientId + ":" + opts.secret).toString("base64");
-  var res = await httpClient.request({
-    method:  "POST",
-    url:     _paypalApiBase(opts) + "/v1/oauth2/token",
-    headers: {
-      "authorization":  "Basic " + basic,
-      "accept":         "application/json",
-      "content-type":   "application/x-www-form-urlencoded",
-      "user-agent":     "blamejs-shop (zero-dep)",
-    },
-    body:      "grant_type=client_credentials",
-    timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
-    agent:     _PSP_TLS_AGENT,
+  // The client-credentials token exchange is idempotent (re-asking for a
+  // token is always safe), so it rides the breaker AND the bounded retry.
+  var json = await _dial(opts._breaker, true, async function () {
+    var res = await httpClient.request({
+      method:  "POST",
+      url:     _paypalApiBase(opts) + "/v1/oauth2/token",
+      headers: {
+        "authorization":  "Basic " + basic,
+        "accept":         "application/json",
+        "content-type":   "application/x-www-form-urlencoded",
+        "user-agent":     "blamejs-shop (zero-dep)",
+      },
+      body:      "grant_type=client_credentials",
+      timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+      agent:     _PSP_TLS_AGENT,
+    });
+    var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
+    var parsed; try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = {}; }
+    if (res.statusCode < 200 || res.statusCode >= 300 || !parsed.access_token) {
+      var err = new Error("paypal: OAuth2 token exchange failed → HTTP " + res.statusCode +
+                          (parsed && parsed.error_description ? " — " + parsed.error_description : ""));
+      err.code = "PAYPAL_AUTH_" + res.statusCode;
+      err.statusCode = res.statusCode;
+      throw err;
+    }
+    return parsed;
   });
-  var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-  var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = {}; }
-  if (res.statusCode < 200 || res.statusCode >= 300 || !json.access_token) {
-    var err = new Error("paypal: OAuth2 token exchange failed → HTTP " + res.statusCode +
-                        (json && json.error_description ? " — " + json.error_description : ""));
-    err.code = "PAYPAL_AUTH_" + res.statusCode;
-    err.statusCode = res.statusCode;
-    throw err;
-  }
   state.token = json.access_token;
   var ttlMs = (typeof json.expires_in === "number" ? json.expires_in : 0) * 1000; // allow:raw-time-literal — PayPal expires_in is a runtime seconds value; *1000 → ms
   state.tokenExpiresAt = now + Math.max(0, ttlMs - PAYPAL_TOKEN_SKEW_MS);
@@ -688,26 +778,34 @@ async function _paypalCall(opts, state, method, path, bodyObj, requestId) {
   var body = bodyObj != null ? JSON.stringify(bodyObj) : undefined;
   if (body) headers["content-length"] = Buffer.byteLength(body, "utf8");
   var httpClient = opts.httpClient || b.httpClient;
-  var res = await httpClient.request({
-    method:    method,
-    url:       _paypalApiBase(opts) + path,
-    headers:   headers,
-    body:      body,
-    timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
-    agent:     _PSP_TLS_AGENT,
+  // A GET is idempotent; a write is idempotent only when it carries a
+  // PayPal-Request-Id (PayPal dedupes a replay of the SAME id, and the
+  // same id rides every retry attempt within one call). A keyless write
+  // rides the breaker but not the retry.
+  var idempotent = method === "GET" || !!requestId;
+  var json = await _dial(opts._breaker, idempotent, async function () {
+    var res = await httpClient.request({
+      method:    method,
+      url:       _paypalApiBase(opts) + path,
+      headers:   headers,
+      body:      body,
+      timeoutMs: opts.timeoutMs || PAYPAL_HTTP_TIMEOUT_MS,
+      agent:     _PSP_TLS_AGENT,
+    });
+    var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
+    var parsed; try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
+    if (res.statusCode < 200 || res.statusCode >= 300) {
+      var detail = parsed && (parsed.message || (parsed.details && parsed.details[0] && parsed.details[0].description)) || "";
+      var err = new Error("paypal: " + method + " " + path + " → HTTP " + res.statusCode + (detail ? " — " + detail : ""));
+      err.code = (parsed && parsed.name) || "PAYPAL_HTTP_" + res.statusCode;
+      err.statusCode = res.statusCode;
+      err.paypal = parsed || null;
+      throw err;
+    }
+    Object.defineProperty(parsed, "_paypalStatus",  { value: res.statusCode, enumerable: false });
+    Object.defineProperty(parsed, "_paypalRawText", { value: text,           enumerable: false });
+    return parsed;
   });
-  var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-  var json; try { json = text.length ? JSON.parse(text) : {}; } catch (_e) { json = { _raw: text }; }
-  if (res.statusCode < 200 || res.statusCode >= 300) {
-    var detail = json && (json.message || (json.details && json.details[0] && json.details[0].description)) || "";
-    var err = new Error("paypal: " + method + " " + path + " → HTTP " + res.statusCode + (detail ? " — " + detail : ""));
-    err.code = (json && json.name) || "PAYPAL_HTTP_" + res.statusCode;
-    err.statusCode = res.statusCode;
-    err.paypal = json || null;
-    throw err;
-  }
-  Object.defineProperty(json, "_paypalStatus",  { value: res.statusCode, enumerable: false });
-  Object.defineProperty(json, "_paypalRawText", { value: text,           enumerable: false });
   return json;
 }
 
@@ -721,6 +819,13 @@ function paypal(opts) {
   if (opts.now != null && typeof opts.now !== "function") {
     throw new TypeError("payment: now must be a function returning current epoch ms");
   }
+  // One circuit breaker per adapter instance, guarding every PayPal dial
+  // (the token exchange + every Orders-v2 call). Skippable in tests via
+  // `breaker: false`.
+  if (opts._breaker === undefined) {
+    opts._breaker = opts.breaker === false ? null : _makeBreaker("psp-paypal");
+  }
+
   var state = {
     query:          opts.query || null,
     now:            typeof opts.now === "function" ? opts.now : function () { return Date.now(); },
@@ -744,6 +849,10 @@ function paypal(opts) {
   return {
     name: "paypal",
 
+    // The per-adapter circuit breaker (or null when disabled). Same
+    // operator-dashboard surface as the Stripe adapter's.
+    breaker: opts._breaker,
+
     // Create an Orders-v2 order (intent CAPTURE). The returned `id` is the
     // PayPal order id the buyer approves; `captureOrder` finalizes it.
     createOrder: function (input, idempotencyKey) {

package/lib/storefront.js

@@ -9085,13 +9085,70 @@ function _setSidCookie(req, res, sid) {
   });
 }
 
+// Store-free device-fingerprint binding for the sealed auth cookie. The
+// sealed envelope is tamper-proof but device-PORTABLE: a cookie lifted
+// off one device replays for the full 14-day life on any other. We bind
+// it softly to a SHAKE256 fingerprint of the device shape (User-Agent +
+// sorted Accept-Language / Accept-Encoding) carried INSIDE the sealed
+// envelope, recomputed + constant-time-compared on read. No external
+// store: `binding.fingerprint(req)` is a pure function of the request, so
+// the fingerprint lives in the cookie itself rather than a session table.
+//
+// The IP component is deliberately disabled (`ipPrefixBits {v4:0, v6:0}`):
+// a mobile or VPN visitor roams networks constantly, and signing them out
+// on a network hop is a worse outcome than the residual portability a
+// UA+Accept-only fingerprint leaves. Drift in the device shape is the
+// signal; a network change is not.
+//
+// `b.sessionDeviceBinding.create()` refuses to construct without either a
+// bindingStore or storeInSession — neither of which the store-free
+// `fingerprint()` path touches. Pass a b.cache-shaped no-op so the
+// constructor's opt-shape gate is satisfied; its methods are never called.
+var _NOOP_BINDING_STORE = {
+  get: function () { return undefined; },
+  set: function () { return undefined; },
+  del: function () { return undefined; },
+};
+var _deviceBinding = null;
+function _deviceBindingInstance() {
+  if (!_deviceBinding) {
+    _deviceBinding = b.sessionDeviceBinding.create({
+      bindingStore: _NOOP_BINDING_STORE,
+      ipPrefixBits: { v4: 0, v6: 0 },
+    });
+  }
+  return _deviceBinding;
+}
+
+// The hex device fingerprint for THIS request, or null when it can't be
+// computed (a request shape the primitive refuses). A null fingerprint is
+// stored as "no binding" — the read side skips the check rather than
+// signing the visitor out over a missing signal.
+function _authDeviceFingerprint(req) {
+  try {
+    var fp = _deviceBindingInstance().fingerprint(req);
+    return fp ? fp.toString("hex") : null;
+  } catch (_e) {
+    return null;
+  }
+}
+
 // Auth + WebAuthn-challenge cookies carry a vault-sealed JSON envelope.
 // writeSealed/readSealed handle the seal + the on-wire prefix; the
 // caller works in plain objects.
 function _setAuthCookie(req, res, env) {
   var T = b.constants.TIME;
   var secure = _secureForReq(req);
-  _cookieJar().writeSealed(res, _authCookieName(secure), JSON.stringify(env), {
+  // Stash the device fingerprint inside the sealed envelope at mint time
+  // so a later read can detect a cookie that has moved to a different
+  // device shape. Additive: an env handed in WITHOUT `fp` (a caller that
+  // doesn't know about binding) just gets it filled here.
+  var sealed = env;
+  if (env && env.fp == null) {
+    var fp = _authDeviceFingerprint(req);
+    if (fp) sealed = Object.assign({}, env, { fp: fp });
+  }
+  _cookieJar().writeSealed(res, _authCookieName(secure), JSON.stringify(sealed), {
     expires: new Date(Date.now() + T.days(14)),
     secure:  secure,
   });
@@ -9570,6 +9627,14 @@ var LOGIN_ERROR_MESSAGES = {
   link:            "That sign-in link is invalid or has expired. Request a fresh one.",
 };
 
+// Neutral (non-error) notices surfaced on the sign-in screen. The
+// device-binding soft sign-out lands here: a reassuring "sign in again"
+// message, never an alarming error, and it discloses nothing about WHY
+// (no "your session looked suspicious" — the visitor just signs in again).
+var LOGIN_NOTICE_MESSAGES = {
+  device: "You've been signed out for your security. Please sign in again.",
+};
+
 function renderAccountLogin(opts) {
   opts = opts || {};
   var oauthButtons = "";
@@ -9588,6 +9653,12 @@ function renderAccountLogin(opts) {
   var errHtml = (opts.error && LOGIN_ERROR_MESSAGES[opts.error])
     ? "<p class=\"auth-form__message auth-form__message--err\">" + b.template.escapeHtml(LOGIN_ERROR_MESSAGES[opts.error]) + "</p>"
     : "";
+  // Neutral notice (e.g. the device-binding soft sign-out) renders in the
+  // same slot with non-error styling. Error wins if both are somehow set.
+  if (!errHtml && opts.notice && LOGIN_NOTICE_MESSAGES[opts.notice]) {
+    errHtml = "<p class=\"auth-form__message\" role=\"status\">" +
+      b.template.escapeHtml(LOGIN_NOTICE_MESSAGES[opts.notice]) + "</p>";
+  }
   // Render the email-link path INLINE (a working no-JS form), not as a link
   // to a separate page, so both passwordless paths live on one screen.
   var magicHtml = opts.magic_link_enabled ? LOGIN_MAGIC_INLINE : "";
@@ -11910,9 +11981,28 @@ function mount(router, deps) {
   // block) and the account routes inside it, so there's one auth-cookie
   // reader rather than a copy per call site. A missing / malformed /
   // expired cookie returns null — never throws.
+  //
+  // Device-binding (soft): an envelope carrying a stashed `fp` is checked
+  // against THIS request's recomputed fingerprint with a constant-time
+  // compare. On drift the visitor reads as signed-out (return null) and a
+  // one-shot `req._authDeviceDrift` flag is set so the page-level gates
+  // clear the now-stale cookie and bounce to a neutral sign-in — never a
+  // hard 401 mid-page. A pre-binding envelope (no `fp`, minted before this
+  // shipped) passes through unchanged until its natural expiry, so a
+  // deploy never mass-signs-out live sessions.
   function _currentCustomerEnv(req) {
     var env = _readAuthEnv(req);
     if (!env || !env.customer_id || !env.exp || env.exp < Date.now()) return null;
+    if (typeof env.fp === "string" && env.fp.length > 0) {
+      var current = _authDeviceFingerprint(req);
+      // A request whose fingerprint can't be recomputed (current === null)
+      // is NOT treated as drift — absence of signal is not evidence of a
+      // moved cookie. Only a present-but-mismatching fingerprint signs out.
+      if (current !== null && !b.crypto.timingSafeEqual(env.fp, current)) {
+        if (req) req._authDeviceDrift = true;
+        return null;
+      }
+    }
     return env;
   }
 
@@ -14808,6 +14898,9 @@ function mount(router, deps) {
         res.status(303); res.setHeader && res.setHeader("location", "/account");
         return res.end ? res.end() : res.send("");
       }
+      // A drifted cookie that reached the sign-in screen directly still gets
+      // cleared so the next request carries no stale envelope.
+      if (req && req._authDeviceDrift) _clearAuthCookie(req, res);
       var cartCount = await _cartCountForReq(req);
       var url = req.url ? new URL(req.url, "http://localhost") : null;
       // Login captcha is opt-in (CAPTCHA_GATE_LOGIN). The widget + the scoped
@@ -14827,6 +14920,7 @@ function mount(router, deps) {
         apple_enabled:  !!deps.oauthApple,
         magic_link_enabled: !!(deps.customerPortal && deps.customerPortalEmail),
         error:          url && url.searchParams.get("error"),
+        notice:         url && url.searchParams.get("signed_out"),
         captcha_kind:        captchaLoginOn ? captchaKind   : null,
         captcha_public_key:  captchaLoginOn ? captchaPubKey : null,
       }));
@@ -15247,7 +15341,12 @@ function mount(router, deps) {
         throw e;
       }
       if (!auth) {
-        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        // On device-binding drift, clear the stale cookie + surface a
+        // neutral sign-in notice (matches _accountAuth's soft sign-out).
+        if (req && req._authDeviceDrift) _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location",
+          (req && req._authDeviceDrift) ? "/account/login?signed_out=device" : "/account/login");
         return res.end ? res.end() : res.send("");
       }
       var customer = await deps.customers.get(auth.customer_id);
@@ -15505,7 +15604,14 @@ function mount(router, deps) {
         throw e;
       }
       if (!auth) {
-        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        // Device-binding drift: clear the now-stale cookie and bounce to a
+        // neutral sign-in notice (never a hard 401 mid-page). Any other
+        // not-signed-in case (no cookie, expired) bounces to the plain
+        // login with no notice.
+        if (req && req._authDeviceDrift) _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location",
+          (req && req._authDeviceDrift) ? "/account/login?signed_out=device" : "/account/login");
         res.end ? res.end() : res.send("");
         return null;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.22",
+  "version": "0.4.23",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {