@blamejs/blamejs-shop 0.3.53 → 0.3.55

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.53",
+  "version": "0.3.55",
   "assets": {
     "css/admin.css": {
-      "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
-      "fingerprinted": "css/admin.f028b2e410387546.css"
+      "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",
+      "fingerprinted": "css/admin.44eb97700c660798.css"
     },
     "css/main.css": {
-      "integrity": "sha384-9rtEz2wKJbpfALccIipRdo/BWVQZi5O4IufqaLO/7jFyLK1xxCaDc/65Apjy8dbs",
-      "fingerprinted": "css/main.1a1a379d6f58e2c0.css"
+      "integrity": "sha384-2nlE5YDlOjcnP/l1EY5kcYwvbV/TboHx+Hi6fAaDNyaau3nzQppJnNyXoLiFE8w1",
+      "fingerprinted": "css/main.59afbe779336867a.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
@@ -44,6 +44,10 @@
     "js/paypal-checkout.js": {
       "integrity": "sha384-LI6y/1z0Y9F8Kx8RhW4EwY2WqJPXLwJozCXqnhDT+dTckLHyvhly0SsRpH0bsdui",
       "fingerprinted": "js/paypal-checkout.b05ab5572cc3728f.js"
+    },
+    "js/saved-card.js": {
+      "integrity": "sha384-Kaj6n+Any4rwCH2lyREHoq30MrAZtEd/fTa+tDnIrMJ4zO01YWRhW5TTujcYyuVn",
+      "fingerprinted": "js/saved-card.d7fd750d746dbe4d.js"
     }
   }
 }

package/lib/click-and-collect.js

@@ -631,6 +631,21 @@ function create(opts) {
       return row;
     },
 
+    // Soft-delete a location: clears `active` and stamps `archived_at` so
+    // `availableLocations` filters it out while past pickup schedules still
+    // resolve the FK. Re-defining the same code via definePickupLocation
+    // clears `archived_at` (resurrects it). Returns the updated row, or null
+    // when the code matched no location (the route maps null → 404).
+    archiveLocation: async function (code) {
+      _code(code, "code");
+      var now = _now();
+      await query(
+        "UPDATE pickup_locations SET active = 0, archived_at = ?1, updated_at = ?1 WHERE code = ?2",
+        [now, code],
+      );
+      return await this.getLocation(code);
+    },
+
     // Read a hydrated schedule for an order. Returns null on miss.
     getScheduleByOrder: async function (orderId) {
       var id = _orderId(orderId);
@@ -678,18 +693,33 @@ function create(opts) {
         throw new TypeError("click-and-collect.customerSchedules: opts.order must be wired for " +
           "this read (the customer→order linkage lives on the order primitive)");
       }
-      var orderPage = await orderPrim.listForCustomer(id, { limit: MAX_LIST_LIMIT });
-      var orders = (orderPage && orderPage.rows) || [];
-      if (!orders.length) return [];
+      // Page through the customer's orders via the cursor. The order
+      // primitive caps a single page below MAX_LIST_LIMIT, so a single
+      // `limit: MAX_LIST_LIMIT` call would throw — request a conservative
+      // per-page size and walk pages until exhausted OR we've gathered
+      // MAX_LIST_LIMIT order ids (which bounds the IN-list below). A customer
+      // with more orders than that sees their most-recent MAX_LIST_LIMIT
+      // orders' pickups, which matches the order-list page model.
+      var orderIds = [];
+      var cursor = null;
+      do {
+        var orderPage = await orderPrim.listForCustomer(id, { limit: 100, cursor: cursor || undefined });
+        var rows0 = (orderPage && orderPage.rows) || [];
+        for (var oi = 0; oi < rows0.length && orderIds.length < MAX_LIST_LIMIT; oi += 1) {
+          orderIds.push(rows0[oi].id);
+        }
+        cursor = orderPage && orderPage.next_cursor;
+      } while (cursor && orderIds.length < MAX_LIST_LIMIT);
+      if (!orderIds.length) return [];
       // SQL IN-list construction — every value is a UUID that came
       // out of the order primitive (which itself validates UUIDs at
       // write time), so the placeholder fan-out is safe. We still
       // pass them as bound params rather than interpolating.
       var placeholders = [];
       var params = [];
-      for (var i = 0; i < orders.length; i += 1) {
+      for (var i = 0; i < orderIds.length; i += 1) {
         placeholders.push("?" + (i + 1));
-        params.push(orders[i].id);
+        params.push(orderIds[i]);
       }
       var sql = "SELECT * FROM pickup_schedules WHERE order_id IN (" +
                 placeholders.join(", ") + ") ORDER BY scheduled_window_start DESC, id DESC";

package/lib/payment.js

@@ -43,6 +43,8 @@ var IDEMPOTENT_OPERATIONS    = {
   "subscription.create":   true,
   "subscription.update":   true,
   "subscription.cancel":   true,
+  "customer.create":       true,
+  "setup_intent.create":   true,
   // PayPal adapter mutating operations (Orders v2).
   "paypal_order.create":   true,
   "paypal_capture.create": true,
@@ -348,6 +350,20 @@ function stripe(opts) {
       if (input.metadata) params.metadata  = input.metadata;
       if (input.description) params.description = input.description;
       if (input.receipt_email) params.receipt_email = input.receipt_email;
+      // Saved-card reuse: a stored payment_method drives an off-session
+      // (one-click) charge. Both are optional so the default Elements flow
+      // — no payment_method, automatic_payment_methods.enabled — is
+      // byte-identical. When a payment_method is supplied we confirm
+      // immediately (confirm:true) so the stored card is charged in the
+      // single create call rather than requiring a second client round trip.
+      if (input.payment_method) {
+        if (typeof input.payment_method !== "string" || !input.payment_method.length) {
+          throw new TypeError("payment.createPaymentIntent: payment_method must be a non-empty string");
+        }
+        params.payment_method = input.payment_method;
+        params.confirm = true;
+        if (input.off_session) params.off_session = true;
+      }
       return _maybeIdempotent("payment_intent.create", idempotencyKey, params, function () {
         return _stripeCall(opts, "POST", "/payment_intents", params, idempotencyKey);
       });
@@ -370,6 +386,67 @@ function stripe(opts) {
                           {}, idempotencyKey);
     },
 
+    // ---- Customer + SetupIntent (saved-card vaulting) ---------------------
+    //
+    // The card-on-file flow needs a Stripe Customer to attach the saved
+    // payment method to, plus a SetupIntent the browser confirms (off the
+    // Elements card form) to collect-without-charging. The shop persists
+    // only the resulting opaque `pm_…` token — never the PAN/CVV, which
+    // stay inside Stripe's PCI scope. `usage: "off_session"` so the saved
+    // card is reusable for a later one-click (off-session) charge.
+
+    // Create (or look up) a Stripe Customer for a shopper. `email` is the
+    // only field Stripe needs to dedupe; `metadata` carries the shop's own
+    // customer id so a Stripe-dashboard operator can correlate the two.
+    createCustomer: function (input, idempotencyKey) {
+      if (!input || typeof input !== "object") throw new TypeError("payment.createCustomer: input object required");
+      var params = {};
+      if (input.email != null) {
+        if (typeof input.email !== "string" || !input.email.length) {
+          throw new TypeError("payment.createCustomer: email must be a non-empty string when provided");
+        }
+        params.email = input.email;
+      }
+      if (input.name) params.name = input.name;
+      if (input.metadata) params.metadata = input.metadata;
+      return _maybeIdempotent("customer.create", idempotencyKey, params, function () {
+        return _stripeCall(opts, "POST", "/customers", params, idempotencyKey);
+      });
+    },
+
+    // Open a SetupIntent for the given Stripe Customer. The browser's
+    // Elements confirms it against the entered card; on success Stripe
+    // returns a `pm_…` the shop reads back via retrieveSetupIntent →
+    // retrievePaymentMethod and stores through paymentMethods.add.
+    createSetupIntent: function (input, idempotencyKey) {
+      if (!input || typeof input !== "object") throw new TypeError("payment.createSetupIntent: input object required");
+      _assertSecret(input.customer, "createSetupIntent.customer");
+      var params = {
+        customer: input.customer,
+        automatic_payment_methods: { enabled: true },
+        usage: "off_session",
+      };
+      if (input.metadata) params.metadata = input.metadata;
+      return _maybeIdempotent("setup_intent.create", idempotencyKey, params, function () {
+        return _stripeCall(opts, "POST", "/setup_intents", params, idempotencyKey);
+      });
+    },
+
+    // Read a SetupIntent back (after the browser confirmed it) to learn the
+    // resulting payment_method id. Read-only.
+    retrieveSetupIntent: function (id) {
+      _assertSecret(id, "setup_intent id");
+      return _stripeCall(opts, "GET", "/setup_intents/" + encodeURIComponent(id), null, null);
+    },
+
+    // Read a saved payment method's display fields (brand / last4 /
+    // exp_month / exp_year) so the shop can render "ending in 4242". The
+    // PAN/CVV are never in this payload. Read-only.
+    retrievePaymentMethod: function (id) {
+      _assertSecret(id, "payment_method id");
+      return _stripeCall(opts, "GET", "/payment_methods/" + encodeURIComponent(id), null, null);
+    },
+
     // Register a web domain so Stripe enables the wallet methods (Apple
     // Pay / Google Pay / Link / PayPal) for the Express Checkout Element
     // served from it. Stripe performs Apple merchant validation + hosts