@blamejs/blamejs-shop 0.5.23 → 0.5.24

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.24 (2026-08-11) — **A supervisor can see every operator currently inside a customer's account and end any of them, and admin responses are no longer served to a shared cache without instruction.** The support session added in the previous release could be started, watched by the customer it concerned, and left — but there was nowhere an operator could see all of them at once. That is the surface a capability like this is supervised from, so it now exists: every live session, whose account, since when, the reason the operator gave, and one control to end any of them. Separately, every response the admin console produces carried no cache directive at all. That is signed-in operator data — customer rosters, order detail, the audit chain — and a shared proxy was left to make its own decision about storing it; all of it is now marked private and must-revalidate, and framed with a content length. **Added:** *A screen showing who is inside a customer's account right now* — `/admin/impersonation` lists every live support session across all operators: who is in, whose account, when it started, when it expires on its own, and the reason they gave for opening it. Each row carries a control to end that session, which also requires a reason. Ending one stops that operator on their very next request rather than whenever their cookie would have expired. Reading the screen needs no special permission — seeing that a session is running is oversight, and restricting oversight to the same role that can start sessions is how a capability stops being watched. Ending one takes the same owner-only authority as starting one. **Fixed:** *The release pipeline no longer reports a healthy publish as unfinished* — The publish step looked up the most recent run of the publish workflow rather than the run for the tag it had just pushed. GitHub takes a few seconds to register a run, so within that window it watched the PREVIOUS release's run — already finished, already green — and then reported that the registry did not have the new version yet. It now matches the run by tag, waits for it to appear, and polls the registry for a bounded interval before concluding anything, so a slow propagation is waited out rather than announced as a problem. · *A transient Cloudflare error no longer stops a deploy* — Applying database migrations occasionally fails with an authorization error that clears on its own moments later with the same credentials. It reads exactly like a broken token and is not one. The step now retries with backoff, and if it still fails the message says how to tell the two apart: a token that lists database write access was the transient case, while one narrowed to read-only genuinely needs re-authenticating. · *Five copies of the same control-byte scanner became one call* — Business hours, carrier rates, delivery estimates, shipping labels and shipping zones each carried a character-for-character copy of the same six-line loop. All five now call the framework's own predicate. The accepted and rejected sets are unchanged — verified codepoint by codepoint before the change, which is how the one difference that mattered was caught: the framework's default permits a tab, and these fields do not. · *Comments describing the outbound TLS posture match the code again* — Four comments still described payment-processor connections as pinning a hand-built handshake configuration. That was removed when the framework's own offer gained a classical option, at which point the pin had become the downgrade it was meant to avoid. The comments said the opposite of what the code did, in the place an operator reading about outbound TLS would look. **Security:** *Admin responses are no longer cacheable by a shared proxy* — Every JSON and HTML response from the admin console was served with no `Cache-Control` header whatsoever, which leaves an intermediary free to decide for itself whether to store it. The content is signed-in operator data: customer rosters, order detail, the audit chain, captured error text. All of it now carries `private, no-cache, must-revalidate` and a `Content-Length`, so a response is framed and an intermediary is told plainly not to keep it. The console keeps its existing `noindex`.
+
 - v0.5.23 (2026-08-11) — **An operator can open the storefront as a customer to see what they are seeing — for an hour, with everything they do recorded, and with no way to take the account over.** Support work routinely needs the operator to see the store the way one specific customer sees it: to reproduce a cart total that looks wrong, a delivery estimate that will not appear, a discount that should apply and does not. Signing in as the customer is the obvious way to do that and the worst one — every action then reads as the customer's own, nothing tells the customer it happened, and a forgotten session stays open indefinitely. This is that capability built so none of those are true. An owner opens a customer's page, states a reason, and browses as them for an hour. The session shows as a banner on every page, ends the moment it is left, and appears on the customer's own account page with the reason the operator gave. The operator can act — fix the cart, correct an address, place the order — but everything that decides who owns the account is closed to them, so a support visit cannot become a takeover and cannot lock the customer out. **Added:** *View the storefront as a customer, from their page in the console* — A "View as customer" panel on each customer's admin page opens a support session. A reason is required, and it is not decoration: it is stored with the session and shown to the customer. Following the link lands on a confirmation naming the account and the stated reason before anything begins — so a link that is prefetched, previewed by a chat client, or fetched by a scanner cannot start a session on the operator's behalf, and the operator sees whose account they are entering before they are in it. The session lasts an hour. · *The customer is told, on their own account page* — An "Account access by our support team" section lists every session opened on the account: when, the reason the operator gave, and whether one is in progress right now. It is delivered this way rather than by email deliberately. This store keeps customer email as a hash, so there is no address to write to, and a notice that cannot be sent is not a notice — recording one as sent would put a line in an audit trail that never happened. Rendered on the account page it needs no address and cannot silently fail. A store that has wired its own plaintext-address store and a notification dispatcher can additionally pass the notifications handle to the primitive and get the out-of-band message as well. · *A banner on every page, and one control to leave* — While a session is live every storefront page carries a banner naming the customer and a button that ends it. It is filled in by the same small script that corrects the cart count, which is what lets it appear on cached pages too — those are served as one identical body to every visitor, so nothing about who is looking can be baked into them. Browsing the catalog during a support session therefore looks like a support session, not like an ordinary visit. **Security:** *A support session cannot become a takeover* — Everything that decides who owns the account is refused for the duration: enrolling or revoking a passkey, linking an identity provider, mailing a sign-in link, changing the email address, deleting the account, and exporting the whole record. The refusals are enforced at one point ahead of every route rather than inside each handler, so a route added under one of those paths later is closed by where it lives rather than by its author remembering. Each attempt is recorded against the session. · *Signing out ends the session, and does not sign the customer out* — The account page's own sign-out control revokes every session the customer has, on every device, and invalidates their pending sign-in links. An operator reaching for it means "get me out of here". Left alone it would have signed the customer out of their phone and laptop because someone helped them — the precise lock-out this feature promises an operator cannot cause. It ends the impersonation instead. · *Ending a session takes effect on the next request* — The session behind the cookie is re-read on every request made under it, so ending or revoking one stops the operator on their very next click rather than whenever the cookie would have expired. That check fails closed: where the equivalent gate for ordinary shoppers deliberately fails open so a database blip cannot sign everyone out, here a blip must not extend one person's authority over someone else's account. · *The handoff link is single-use* — The link is spent by being used. It remains in browser history and anywhere it was pasted, so a second holder must not be able to mint their own session from it — and cannot: the session's authority moves into a cookie bound to the browser that redeemed it. Two holders racing the same link resolve to exactly one, because the claim is a conditional write rather than a check followed by a write. · *Opening a session is its own permission* — `customers.impersonate` is separate from `customers.write`. A manager who can edit a customer record cannot become one; only the owner role holds it. A refusal names the missing authority in the audit record rather than reporting a generic write denial.
 
 - v0.5.22 (2026-08-11) — **A postal address written in Arabic or Hebrew can be saved again, a pixel event whose provider replied with a control byte stops re-sending forever, and the vendored framework moves to 0.18.24.** The previous release began refusing Unicode bidirectional characters in stored text, to stop a value being made to display as something other than what it says. It refused too many. The bidirectional set contains two groups that do not carry the same risk: the overrides and isolates, which reverse the display order of a whole run and have no legitimate use in a shop's stored text, and the direction marks, which resolve the direction of neighbouring characters and are simply how a Latin house number inside an Arabic street name is written. Refusing the marks turned away ordinary right-to-left addresses, names and messages at the point of sale. Only the overrides and isolates are refused now, and the marks are accepted wherever prose is accepted. Separately, a marketing pixel whose provider replied with a control byte could never record that reply, so the event stayed queued and the same request was re-sent on every scheduler tick indefinitely. **Changed:** *Vendored framework refreshed to 0.18.24* — Advances the vendored framework from 0.18.21 to 0.18.24, and the store inherits the following without application changes. A certificate revocation response that declared one signature algorithm while carrying another was accepted: the field the verifier reads to choose its digest was never checked against the key it verified with. Nothing was forgeable through it — a response signed by any other key was still refused — but what a response claimed and what was actually checked could differ silently, and a mismatch is now refused. In Certificate Transparency, a consistency proof was rebuilt against the log's new tree but not against the tree the operator had pinned, except when the pinned size happened to be a power of two; a log that quietly rewrote history before the pinned point would still have passed at eleven of the sixteen smallest sizes. Both roots are now rebuilt and both are checked. A tree is also consistent with itself, which the walk previously refused at most sizes — an operator re-checking a log that had not grown was told it was inconsistent. The bundled certificate toolkit additionally clears every key-establishment secret and password copy it allocates once the derivation has consumed it. **Fixed:** *A right-to-left address, name or message is accepted again* — U+200E, U+200F and U+061C are direction marks. They carry no text of their own; they tell the renderer which way to run the characters beside them, which is what makes a Latin house number inside an Arabic street name, or a Latin brand inside a Hebrew sentence, display in the right order. A correctly written Saudi or Israeli address routinely contains one. The previous release folded them in with the bidirectional overrides and refused both, so those addresses were rejected at checkout — and the refusal said the value contained control bytes, sending the customer to look for something that was not there. Every field that takes prose accepts the marks again: shipping and billing addresses, recipient and company names, gift messages, review titles and bodies, customer notes, support tickets, knowledge-base articles. The overrides and isolates — U+202A to U+202E and U+2066 to U+2069, the half that reverses a run — stay refused, and a refusal now names the character class it actually found. · *A pixel event whose provider replied with a control byte no longer re-sends forever* — Recording a dispatch validates the provider's response body before it marks the event delivered. The previous release tightened that validation to refuse control characters, which the surrounding contract explicitly permits — a provider's reply is captured for an operator to read, and it is not the shop's to reject. The validation threw, the event was never marked delivered, and the scheduler re-sent the identical request on every tick from then on. The response body is screened only for invisible characters now, which is what it was ever meant to catch, so a reply the shop dislikes is stored rather than retried. · *A failed broadcast's reason is fully scrubbed before it reaches the ledger* — When a message in an email campaign fails, the mailer's error is folded onto one line and stored against that recipient. The expression doing the folding replaced only the first control character it found, so a multi-line error left the rest in the stored row. All of them are removed now. · *A category's hero image URL is held to the same rule as a blog post's* — Both are an operator-supplied image URL emitted into a single attribute, and a line break in one is never legitimate. The blog article's field refused them; the category navigation's did not. It does now. **Security:** *Refusing a bidirectional override still holds, and now says what it found* — The protection the previous release added is unchanged where it matters: a value carrying U+202A to U+202E or U+2066 to U+2069 is still refused everywhere it was, including a link URL inside a marketing email, where the plain-text part of the message prints that URL for the recipient to read. What changed is the blast radius. A URL, a slug or an identifier is machine-plain and now refuses the direction marks as well; prose does not, because prose in a right-to-left script needs them. The two substrates that parse search filters are held to the same set by a test that compares them across every character in the basic multilingual plane, so the edge and the container cannot come apart on it.

package/SECURITY.md

@@ -296,7 +296,12 @@ node -e "
   closed. The handoff link is single-use and cannot be spent by a prefetch.
   Every request made under the session lands in an append-only log, and the
   customer sees each session — with the reason the operator gave — on their
-  own account page.
+  own account page. Operators get the other half of that view at
+  `/admin/impersonation`: every live session at once, with one control to end
+  any of them. Reading it needs no special permission, because restricting
+  oversight to the role that can start sessions is how a capability stops
+  being watched; ending one takes the same owner-only authority as starting
+  one, and takes effect on that operator's next request.
 - **Text one person writes and another reads is screened for invisible
   characters.** A Unicode bidirectional override reverses the display
   order of everything after it while itself rendering as nothing, so

package/lib/admin.js

@@ -691,19 +691,22 @@ function _problem(res, status, code, detail) {
   });
 }
 
+// Console HTML through the framework renderer — see `_json` for why. The
+// `x-robots-tag` rides `opts.headers`, which merges OVER the renderer's
+// defaults, so the admin console keeps its noindex while gaining the
+// Cache-Control and Content-Length the hand-rolled version omitted.
 function _sendHtml(res, status, html) {
-  res.status(status);
-  if (res.setHeader) {
-    res.setHeader("content-type", "text/html; charset=utf-8");
-    res.setHeader("x-robots-tag", "noindex, nofollow");
-  }
-  if (res.end) res.end(html); else res.send(html);
+  b.render.htmlString(res, html, {
+    status:  status,
+    headers: { "X-Robots-Tag": "noindex, nofollow" },
+  });
 }
 
 function _redirect(res, location) {
-  res.status(303);
-  if (res.setHeader) res.setHeader("location", location);
-  if (res.end) res.end(); else res.send("");
+  // `b.render.redirect` additionally validates the 3xx range and refuses an
+  // empty location — a redirect to nowhere is a blank page an operator has to
+  // debug from the network tab.
+  b.render.redirect(res, location, { status: 303 });
 }
 
 // Single classifier for a thrown admin error → an operator-safe outcome,
@@ -983,7 +986,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { analytics: !!deps.analytics, returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, promoBanners: !!deps.promoBanners, suggestionBox: !!deps.suggestionBox, sidebarWidgets: !!deps.sidebarWidgets, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, deliveryEstimate: !!deps.deliveryEstimate, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, searchSuggestions: !!searchSuggestions, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog, errorLog: !!errorLog, carts: !!cart, inventoryLocations: !!inventoryLocations, inventoryReceive: !!inventoryReceive, stockTransfers: !!stockTransfers, inventoryWriteoffs: !!inventoryWriteoffs, quotes: !!deps.quotes, emailCampaigns: !!emailCampaigns, winback: !!winback, operators: !!operatorAccounts, inbox: !!operatorInbox };
+  var navAvailable = { analytics: !!deps.analytics, returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, promoBanners: !!deps.promoBanners, suggestionBox: !!deps.suggestionBox, sidebarWidgets: !!deps.sidebarWidgets, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, deliveryEstimate: !!deps.deliveryEstimate, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, clickAndCollect: !!clickAndCollect, giftOptions: !!giftOptions, searchRanking: !!searchRanking, searchSuggestions: !!searchSuggestions, trustBadges: !!trustBadges, orderExport: !!orderExport, auditLog: auditLog, errorLog: !!errorLog, carts: !!cart, inventoryLocations: !!inventoryLocations, inventoryReceive: !!inventoryReceive, stockTransfers: !!stockTransfers, inventoryWriteoffs: !!inventoryWriteoffs, quotes: !!deps.quotes, emailCampaigns: !!emailCampaigns, winback: !!winback, operators: !!operatorAccounts, inbox: !!operatorInbox, impersonation: !!customerImpersonation };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -1117,11 +1120,18 @@ function mount(router, deps) {
     };
   }
 
+  // Every admin JSON response goes through the framework renderer rather than
+  // a hand-rolled stringify-and-end. Composing it here rather than at the 300+
+  // call sites means the whole surface gains what the helper was missing:
+  //
+  //   Cache-Control: private, no-cache, must-revalidate — this is signed-in
+  //     OPERATOR data (customer rosters, order detail, audit rows) and it was
+  //     being served with no cache directive at all, which leaves a shared
+  //     proxy free to make its own decision about storing it.
+  //   Content-Length — a framed response, so a client can tell a truncated
+  //     body from a complete one.
   function _json(res, status, obj) {
-    res.status(status);
-    if (res.setHeader) res.setHeader("content-type", "application/json; charset=utf-8");
-    var body = JSON.stringify(obj);
-    if (res.end) res.end(body); else res.send(body);
+    b.render.json(res, obj, { status: status });
   }
 
   // ---- products -------------------------------------------------------
@@ -1706,11 +1716,10 @@ function mount(router, deps) {
   // ML-KEM hybrid group answers with a handshake_failure (TLS alert 40);
   // that surfaces below as the same clean 502 `source-fetch-failed`
   // (`e.message` carries the alert) the operator already retries by
-  // re-submitting. We do NOT pin a classical-downgrade agent here the
-  // way the PSP adapters do for their two fixed endpoints — an arbitrary
-  // operator-supplied URL is not a fixed processor edge, so holding the
-  // PQC default is the deliberate posture. Operators sourcing from a
-  // host that can't meet the PQC list upload the file directly instead.
+  // re-submitting. No caller-supplied TLS agent is pinned here, and none
+  // is pinned on the processor dials either — every outbound dial in the
+  // shop holds the framework's PQC-first default. Operators sourcing from
+  // a host that can't meet the PQC list upload the file directly instead.
   if (r2) {
     // Fetch → store → attach, shared by the JSON upload route and the
     // browser POST alias. Throws TypeError on bad input (mapped to 400);
@@ -3991,6 +4000,94 @@ function mount(router, deps) {
         }));
     }
 
+    // ---- who is in someone's account right now --------------------------
+    //
+    // A capability that lets one person browse as another needs a place where
+    // ALL of its live uses are visible at once. Per-customer history answers
+    // "was my account opened"; this answers the operator-side question —
+    // who is inside an account at this moment, whose, since when, and why —
+    // and gives a supervisor one control to end any of them.
+    //
+    // Read gate: `R` admits any authenticated operator. Seeing that a session
+    // is running is oversight, and restricting oversight to the role that can
+    // start sessions is how a capability stops being watched. Ending one is a
+    // `W` and takes the same owner-only permission as starting one.
+    if (customerImpersonation) {
+      router.get("/admin/impersonation", _pageOrApi(true,
+        R(async function (req, res) {
+          // A failed lookup is NOT an empty list. The HTML page can degrade to
+          // a notice, but a machine reading this endpoint would take
+          // `200 { rows: [] }` as "nobody is in anyone's account" at exactly
+          // the moment oversight is unavailable — the one answer this surface
+          // must never give wrongly. Say unavailable instead.
+          var rows;
+          try { rows = await customerImpersonation.currentlyImpersonating(); }
+          catch (_e) {
+            return _problem(res, 503, "sessions-unavailable",
+              "The live session list could not be read. This is not a report that no sessions are active.");
+          }
+          _json(res, 200, { rows: rows });
+        }),
+        async function (req, res) {
+          var rows = [];
+          var notice = null;
+          // Read-only oversight screen: a lookup failure degrades to an empty
+          // table with a notice rather than a 500, so the page an operator
+          // checks during an incident is never the page that is down.
+          try { rows = await customerImpersonation.currentlyImpersonating(); }
+          catch (_e) { rows = []; notice = "The session list is temporarily unavailable."; }
+          var url = req.url ? new URL(req.url, "http://localhost") : null;
+          _sendHtml(res, 200, renderAdminImpersonation({
+            shop_name: deps.shop_name, nav_available: navAvailable,
+            rows: rows, notice: notice,
+            ended: url && url.searchParams.get("ended") === "1",
+            error: url && url.searchParams.get("imp_err"),
+          }));
+        },
+      ));
+
+      router.post("/admin/impersonation/:id/revoke", _pageOrApi(false,
+        W("impersonation.revoke", async function (req, res) {
+          var reason = (req.body && req.body.reason) || "";
+          if (typeof reason !== "string" || !reason.trim().length) {
+            return _problem(res, 400, "bad-request", "A reason is required to end another operator's session.");
+          }
+          var out;
+          try {
+            out = await customerImpersonation.revoke({
+              impersonation_id: req.params.id, reason: reason.trim(),
+              // WHO revoked it. Without this the audit row names the operator
+              // being removed as the one who removed themselves.
+              revoked_by: req.operatorActor && req.operatorActor.operator_id,
+            });
+          } catch (e) {
+            if (e && e.code === "IMPERSONATION_NOT_FOUND") return _problem(res, 404, "not-found");
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            throw e;
+          }
+          _json(res, 200, out);
+          return { id: req.params.id };
+        }),
+        async function (req, res) {
+          var reason = (req.body && req.body.reason) || "";
+          if (typeof reason !== "string" || !reason.trim().length) {
+            return _redirect(res, "/admin/impersonation?imp_err=" +
+              encodeURIComponent("Give a reason before ending someone else's session."));
+          }
+          try {
+            await customerImpersonation.revoke({
+              impersonation_id: req.params.id, reason: reason.trim(),
+              revoked_by: req.operatorActor && req.operatorActor.operator_id,
+            });
+          } catch (e) {
+            var n = _safeNotice(e, "impersonation.revoke");
+            return _redirect(res, "/admin/impersonation?imp_err=" +
+              encodeURIComponent(n.message.replace(/^admin[.:]\s*/, "")));
+          }
+          return _redirect(res, "/admin/impersonation?ended=1");
+        }));
+    }
+
     // ---- customer notes (add) ------------------------------------------
     // Scoped to the :id customer — the note attaches to the path customer.
     // Composes customerNotes.addNote (the body is required + length-capped by
@@ -15107,6 +15204,9 @@ var ADMIN_NAV_ITEMS = [
   { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "analytics",    href: "/admin/analytics",    label: "Analytics",    requires: "analytics" },
   { key: "audit",        href: "/admin/audit",        label: "Audit",        requires: "auditLog" },
+  // Sits beside Audit rather than under Customers on purpose: it is an
+  // oversight surface, not a customer-management one.
+  { key: "impersonation", href: "/admin/impersonation", label: "Customer sessions", requires: "impersonation" },
   { key: "errors",       href: "/admin/errors",       label: "Errors",       requires: "errorLog" },
   { key: "exports",      href: "/admin/exports",      label: "Exports",      requires: "orderExport" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
@@ -15757,6 +15857,62 @@ var AUDIT_OUTCOME_FILTERS = ["success", "failure", "denied"];
 // class is un-lintable (no detector can tell a render-concat apart from a
 // string-build), so the XSS-payload regression test is the guarantee — see
 // test/layer-2-integration/admin-audit-console.test.js.
+// Who is inside a customer's account right now.
+//
+// The per-customer history answers "was my account opened". This is the other
+// half, and it is the one a supervisor needs: every live session at once, with
+// one control to end any of them. A capability that lets one person browse as
+// another is only as accountable as the place you can watch it from.
+function renderAdminImpersonation(opts) {
+  opts = opts || {};
+  var rows = opts.rows || [];
+  var notice = opts.notice
+    ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  if (opts.error) {
+    notice += "<div class=\"banner banner--warn\">" + _htmlEscape(String(opts.error)) + "</div>";
+  }
+  if (opts.ended) {
+    notice += "<div class=\"banner\">Session ended. The operator is refused on their next request.</div>";
+  }
+
+  var body = notice +
+    "<h2 class=\"subhead\">Active customer sessions</h2>" +
+    "<p class=\"meta\">Operators currently viewing the storefront as a customer. A session " +
+    "ends on its own after an hour, when the operator leaves it, or when you end it here — " +
+    "in every case the operator is refused on their next request rather than at cookie " +
+    "expiry. Each customer also sees their own visits on their account page.</p>";
+
+  if (!rows.length) {
+    body += "<p class=\"empty\">Nobody is viewing a customer account right now.</p>";
+    return _renderAdminShell(opts.shop_name, "Customer sessions", body, "impersonation", opts.nav_available);
+  }
+
+  var trs = rows.map(function (r) {
+    var enc = encodeURIComponent(String(r.id));
+    return "<tr>" +
+      "<td><code>" + _htmlEscape(String(r.operator_id || "—")) + "</code></td>" +
+      "<td><a href=\"/admin/customers/" + _htmlEscape(encodeURIComponent(String(r.customer_id))) +
+        "\"><code>" + _htmlEscape(String(r.customer_id)) + "</code></a></td>" +
+      "<td>" + _htmlEscape(_fmtTs(r.started_at)) + "</td>" +
+      "<td>" + _htmlEscape(_fmtTs(r.expires_at)) + "</td>" +
+      "<td>" + _htmlEscape(String(r.reason || "—")) + "</td>" +
+      "<td><form method=\"post\" action=\"/admin/impersonation/" + _htmlEscape(enc) + "/revoke\">" +
+        "<input type=\"text\" name=\"reason\" required maxlength=\"200\" placeholder=\"Why end it?\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">End session</button>" +
+      "</form></td>" +
+    "</tr>";
+  }).join("");
+
+  body +=
+    "<table class=\"table\"><thead><tr>" +
+      "<th scope=\"col\">Operator</th><th scope=\"col\">Customer</th>" +
+      "<th scope=\"col\">Started</th><th scope=\"col\">Expires</th>" +
+      "<th scope=\"col\">Stated reason</th><th scope=\"col\">End</th>" +
+    "</tr></thead><tbody>" + trs + "</tbody></table>";
+
+  return _renderAdminShell(opts.shop_name, "Customer sessions", body, "impersonation", opts.nav_available);
+}
+
 function renderAdminAudit(opts) {
   opts = opts || {};
   var rows = opts.rows || [];
@@ -24365,6 +24521,7 @@ module.exports = {
   renderAdminLoyaltyReward:     renderAdminLoyaltyReward,
   renderAdminConfirm:      renderAdminConfirm,
   renderAdminAudit:        renderAdminAudit,
+  renderAdminImpersonation: renderAdminImpersonation,
   renderAdminPickupLocations: renderAdminPickupLocations,
   renderAdminPickups:      renderAdminPickups,
   renderAdminGiftWraps:    renderAdminGiftWraps,

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.23",
+  "version": "0.5.24",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/business-hours.js

@@ -89,12 +89,11 @@ var SEARCH_DAYS      = 366 * 2;  // worst-case "find next open" walk — 2 calen
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _slug(s) {

package/lib/carrier-rates.js

@@ -77,12 +77,11 @@ var b = require("./vendor/blamejs");
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _slug(s) {

package/lib/customer-impersonation.js

@@ -635,11 +635,22 @@ function create(opts) {
     // The operator dashboard's "who's currently impersonating whom"
     // surface. Returns every `active` row across all operators,
     // newest-first.
-    currentlyImpersonating: async function () {
+    // Filters on the CLOCK as well as the status column.
+    //
+    // Authority expires by timestamp — `verifyImpersonationToken` and the
+    // per-request liveness read both refuse an elapsed row immediately — while
+    // the `status` column only catches up when `cleanupExpired` next runs. A
+    // query on status alone therefore reports sessions as live in the window
+    // between those two, and longer if the sweep is delayed or was never
+    // scheduled. On an oversight screen that is the wrong direction to be
+    // wrong in: it shows a supervisor people inside accounts who are not,
+    // which is the fastest way to teach them the screen is noise.
+    currentlyImpersonating: async function (listOpts) {
+      var now = (listOpts && listOpts.now != null) ? listOpts.now : _now();
       var r = await query(
-        "SELECT * FROM impersonations WHERE status = 'active' " +
+        "SELECT * FROM impersonations WHERE status = 'active' AND expires_at > ?1 " +
         "ORDER BY started_at DESC, id DESC",
-        [],
+        [now],
       );
       return r.rows.map(_projectRow);
     },
@@ -807,6 +818,12 @@ function create(opts) {
       }
       var id     = _uuid(input.impersonation_id, "impersonation_id");
       var reason = _requiredString(input.reason, "reason", MAX_END_REASON_LEN);
+      // Optional so an existing caller keeps working; when present it is the
+      // operator performing the revocation, and it is what the audit row
+      // records as the actor.
+      var revokedBy = input.revoked_by == null
+        ? null
+        : _operatorId(input.revoked_by, "revoked_by");
       var existing = await _getRow(id);
       if (!existing) {
         var miss = new Error("customer-impersonation.revoke: impersonation not found");
@@ -825,12 +842,25 @@ function create(opts) {
       );
       var revoked = Number(r.rowCount || 0) > 0;
       if (revoked) {
+        // The actor is whoever DID the revoking, which is usually not the
+        // operator being removed. Attributing it to `existing.operator_id`
+        // wrote an audit row saying they ended their own session — on the one
+        // feature whose entire justification is an accurate record of who did
+        // what to whose account, that is a falsified line. `revoked_by` falls
+        // back to the session's own operator so a self-revoke still reads
+        // correctly and an older caller keeps working.
         await _audit(
           "revoke",
-          existing.operator_id,
+          revokedBy || existing.operator_id,
           id,
           { status: "active" },
-          { status: "revoked", ended_at: now, end_reason: reason },
+          {
+            status: "revoked", ended_at: now, end_reason: reason,
+            revoked_by: revokedBy || existing.operator_id,
+            // Named explicitly so an auditor reading the row can tell a
+            // supervisor's intervention from an operator closing their own.
+            self_revoked: !revokedBy || revokedBy === existing.operator_id,
+          },
         );
       }
       return { revoked: revoked };

package/lib/delivery-estimate.js

@@ -132,12 +132,11 @@ var DAY_MS                = b.constants.TIME.days(1);
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _zone(s, label) {

package/lib/payment.js

@@ -176,9 +176,11 @@ function _formEncode(obj, prefix) {
 //
 // b.httpClient already routes every dial through b.ssrfGuard (private /
 // loopback / link-local / reserved / cloud-metadata IP classes refused) and
-// pins the TCP connect to the guard's resolved IP set even on the PSP path's
-// caller-supplied TLS agent, so DNS rebinding can't flip the answer between
-// check and connect. The remaining gap is a HOST allowlist: nothing today
+// pins the TCP connect to the guard's resolved IP set, so DNS rebinding can't
+// flip the answer between check and connect. (These dials no longer supply a
+// caller-built TLS agent at all — see the note at the head of this file — so
+// the pinning applies to the framework's own client.) The remaining gap is a
+// HOST allowlist: nothing today
 // stops an `opts.apiBase` pointed at an unexpected public host (config
 // injection, or a future code path that derives the base from request data)
 // from reaching a non-PSP upstream. We pin `allowedHosts` to the configured

package/lib/shipping-labels.js

@@ -136,12 +136,11 @@ function _currency(c) {
 
 // C0 + DEL refusal — same pattern orderTracking uses, kept as a
 // charCodeAt walk so the `no-control-regex` ESLint rule stays clean.
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _shortText(s, label, max) {

package/lib/shipping-zones.js

@@ -93,12 +93,11 @@ var b = require("./vendor/blamejs");
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _slug(s) {

package/lib/storefront.js

@@ -12107,6 +12107,20 @@ function mount(router, deps) {
   _hasCollections = !!deps.collections;
   _hasCategoryNav = !!deps.categoryNavigation;
 
+  // Deliberately NOT routed through `b.render.htmlString`, unlike the admin
+  // console's equivalent helper.
+  //
+  // The renderer's default is `Cache-Control: private, no-cache,
+  // must-revalidate`, which is right for the admin console — every response
+  // there is signed-in operator data. This helper is not the same shape: it
+  // serves anonymous, edge-cacheable pages (category, collection, help
+  // article, opening hours) from the SAME function as the account pages.
+  // Stamping `private` on all of them would tell the CDN not to cache exactly
+  // the pages the edge exists to serve, trading a real performance loss for no
+  // security gain on a page a logged-out visitor can already fetch.
+  //
+  // The per-route cache directives that do exist are set by the routes that
+  // own them, which is where the public/private decision actually lives.
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");

package/lib/webhooks.js

@@ -46,9 +46,11 @@
  *   backoff retry schedule, and — if the endpoint never negotiates a
  *   supported group — lands in `webhook_dlq` after the fifth attempt.
  *   This is a deliberate posture choice, NOT a silent classical
- *   downgrade: the PSP adapters (lib/payment.js) pin a downgraded agent
- *   for their two FIXED endpoints, but a webhook receiver URL is
- *   operator-arbitrary, so the framework's PQC-first default is held.
+ *   downgrade: every outbound dial in the shop — this one and the payment
+ *   processors alike — now runs on the framework's PQC-first default. The
+ *   processor adapters used to pin a hand-built agent for their two fixed
+ *   endpoints; that was removed once the framework's offer ended with a
+ *   classical option, because by then the pin was the downgrade.
  *   An operator whose receiver can't meet the PQC list terminates TLS
  *   for it on a fronting proxy (Cloudflare, a load balancer) that does,
  *   or upgrades the receiver's TLS stack.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.23",
+  "version": "0.5.24",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {