@blamejs/blamejs-shop 0.3.9 → 0.3.11

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.11 (2026-05-30) — **Webhook endpoints reject internal addresses; admin errors stay clean and typed.** Outbound webhook endpoints can no longer be pointed at loopback, private, link-local, or cloud-metadata addresses, closing a server-side request forgery path from operator-supplied URLs. Several admin endpoints that previously returned a 500 on bad input now return the correct 4xx — a duplicate slug or SKU is a 409 Conflict, a missing referenced record and malformed JSON are a 400 — and none of them echo internal database or parser text back in the response. Gift cards now reject a currency that isn't a real ISO 4217 code, and the returns refund action reports a malformed id the same way its sibling actions do. No configuration change is required; upgrading picks these up automatically. **Fixed:** *Admin errors return the right status and don't leak internals* — Creating a product, variant, or inventory row with a duplicate key now returns 409 Conflict instead of 500; attaching media to a missing product, and pasting malformed JSON into the shipping-zone editor, now return 400. None of these responses include raw database or JSON-parser text — the detail is a generic, operator-facing message and the underlying error is recorded server-side. The same applies to the receipt and packing-slip routes. · *Gift cards validate the currency* — Issuing a gift card with a currency that isn't a real ISO 4217 code is now rejected with a 400 instead of creating a card in a non-existent currency. · *Consistent error status for refunds* — The returns refund action reports a malformed return id with the same 400 its approve, receive, and reject siblings use; a well-formed id that doesn't exist is still a 404. **Security:** *Webhook endpoints can't target internal addresses* — A webhook endpoint URL that points at a loopback, private (RFC 1918), link-local, reserved, or cloud-metadata address — by IP literal or by a known name such as localhost, metadata.google.internal, or any *.internal host — is now refused when the subscription is created, on both the delivery and outbound-registration paths. A trailing-dot form of those hosts (for example localhost. or 169.254.169.254.) is normalized before the check so it can't slip past. Public https endpoints are unaffected.
+
+- v0.3.10 (2026-05-30) — **Order discounts are split across lines for accurate partial refunds.** When an order carries a cart-level discount, the admin console now records how that discount split across the order's lines — proportional to each line's value — so a later partial refund of one line knows that line's discounted share rather than the whole-order amount. A new read-only Discount splits screen shows the per-line breakdown for an order. This is back-office bookkeeping recorded after the order is placed; it has no effect on what the shopper is charged, and an order with no discount records nothing. **Added:** *Per-line discount allocation + admin view* — An order that carried an automatic cart discount now gets a recorded breakdown of how that discount split across its lines — proportional to each line's subtotal, summing exactly to the discount. A read-only Discount splits admin screen shows the breakdown for an order. The recording runs after the order is placed and never affects the charged amount; an order with no discount records nothing.
+
 - v0.3.9 (2026-05-30) — **Automatic discounts now apply at checkout.** The automatic-discount rules you define in the admin console — an amount or percentage off a cart that meets a threshold — now reduce the order total at checkout. When a rule matches, the discount is applied (capped so it never exceeds the order subtotal) and shown in the quote the shopper pays; when no rule matches, or none are defined, the total is exactly as before, so a store that has not set up rules is unaffected. The admin screen for managing rules already shipped; this wires it through to the checkout quote and the charge. **Added:** *Automatic cart discounts at checkout* — When a cart matches a configured automatic-discount rule, the checkout reduces the order total by the rule's saving — capped to the order subtotal so the total is never negative — and the reduced amount is what the shopper is charged. With no matching rule, or no rules defined, the order total is unchanged, so the change stays invisible until you set rules up; any rule-engine error degrades to no discount rather than blocking checkout.
 
 - v0.3.8 (2026-05-30) — **Update the vendored blamejs runtime to v0.14.6.** Refreshes the vendored blamejs runtime from v0.14.5 to v0.14.6, a maintenance update. The createApp request-lifecycle security stack the shop composes — CSRF, fetch-metadata, body-parser, cookies, rate limiting — is unchanged in default behavior. v0.14.6 adds opt-in RFC 9457 problem+json and onDeny response hooks to the access-refusal middleware (defaults unchanged, so nothing the shop relies on shifts) and corrects a few internal export and bearer-scope paths. No operator action is required. **Changed:** *Vendored blamejs runtime updated to v0.14.6* — The pinned blamejs runtime moves from v0.14.5 to v0.14.6. The middleware the storefront and admin compose keeps its current default behavior; the release adds opt-in problem-details / onDeny response hooks to the refusal middleware and fixes internal export and bearer-scope paths. No behavior change for the shop.

package/lib/admin.js

@@ -411,7 +411,34 @@ function _wrap(handler, opts) {
       return result;
     } catch (e) {
       if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
-      return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+      // Malformed JSON body — the body parser raises a SyntaxError whose
+      // message echoes the parser's position ("...JSON at position 1").
+      // Surface a clean 400 with a generic detail rather than leaking the
+      // parser internals (also the defense-in-depth net for any call site
+      // that JSON.parses an operator-supplied field without its own guard).
+      if (e instanceof SyntaxError) return _problem(res, 400, "bad-request", "Invalid JSON in request.");
+      // Storage-engine constraint violations reach here as plain Errors
+      // whose message names the table/column/SQL ("UNIQUE constraint
+      // failed: products.slug"). Map the class to a clean 4xx with a
+      // GENERIC operator-facing detail — never echo the table/column/SQL.
+      var msg = (e && e.message) || "";
+      if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
+        return _problem(res, 409, "conflict",
+          /FOREIGN KEY/i.test(msg) ? "A referenced record does not exist." : "That value is already in use.");
+      }
+      if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
+        return _problem(res, 400, "bad-request", "A required value is missing or invalid.");
+      }
+      // Genuine unknown error — record it server-side via the framework
+      // audit (drop-silent) so operators can correlate, then return a
+      // generic 500 with NO detail. The raw message never reaches the
+      // client.
+      b.audit.safeEmit({
+        action:   AUDIT_NAMESPACE + "." + (opts.audit || "request") + ".error",
+        outcome:  "failure",
+        metadata: { message: msg || String(e) },
+      });
+      return _problem(res, 500, "internal-error");
     }
   };
 }
@@ -451,7 +478,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -2455,6 +2482,7 @@ function mount(router, deps) {
         try {
           result = await _refundOrder(o, req.body || {});
         } catch (e) {
+          // allow:admin-5xx-echoes-raw-error-message — 502 surfaces the PAYMENT PROVIDER's refund-failure reason (e.g. "charge already refunded"), an operator-actionable upstream message, not a server/storage internal.
           return _problem(res, 502, "stripe-refund-failed", (e && e.message) || String(e));
         }
         _json(res, 200, result);
@@ -3017,12 +3045,11 @@ function mount(router, deps) {
     router.post("/admin/returns/:id/refund", _pageOrApi(false,
       W("return.refund", async function (req, res) {
         var body = req.body || {};
-        var rma;
-        try { rma = await returns.get(req.params.id); }
-        catch (e) {
-          if (e instanceof TypeError) return _problem(res, 404, "return-not-found", e.message);
-          throw e;
-        }
+        // A malformed rma id is a bad request, not a missing record — let
+        // the guardUuid TypeError surface as a clean 400 via _wrap, matching
+        // the approve/received/reject siblings. Only a well-formed id that
+        // resolves to no row (rma === null) is a genuine 404.
+        var rma = await returns.get(req.params.id);
         if (!rma) return _problem(res, 404, "return-not-found");
         var rmaCtx = await _rmaProviderContext(rma);
         // Provider-backed path: move money first, then record the RMA.
@@ -3032,6 +3059,7 @@ function mount(router, deps) {
           catch (e) {
             var ce = _returnsClientError(e);
             if (ce) return _problem(res, ce.status, ce.slug, e.message);
+            // allow:admin-5xx-echoes-raw-error-message — 502 surfaces the PAYMENT PROVIDER's refund-failure reason, an operator-actionable upstream message, not a server/storage internal.
             return _problem(res, 502, "provider-refund-failed", (e && e.message) || String(e));
           }
           _json(res, 200, result.rma);
@@ -3741,6 +3769,59 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- discount allocations -------------------------------------------
+
+  // Read-only console for the per-line discount-allocation audit trail.
+  // When a placed order carried a cart-level discount, checkout records
+  // (post-commit) how that discount split across the order's lines, so a
+  // later partial refund knows each line's discounted share. Allocations
+  // are SYSTEM-WRITTEN — there's no create/edit here; the operator looks
+  // up an order id and reads back the recorded breakdown. Endpoints are
+  // omitted entirely when no discountAllocation primitive is wired.
+  var discountAllocation = deps.discountAllocation || null;
+  if (discountAllocation) {
+    // Look an order's recorded allocations up by id. Content-negotiates:
+    // bearer → JSON (the raw rows, unchanged for tooling); signed-in
+    // browser → the lookup form plus the rendered breakdown tables.
+    //
+    // The order id is a defensive request-shape reader — an empty / over-
+    // long / control-byte id makes allocationsForOrder throw a TypeError,
+    // which surfaces as an empty result + a notice, never a 500.
+    async function _lookupAllocations(orderId) {
+      if (typeof orderId !== "string" || orderId === "") return [];
+      try {
+        return await discountAllocation.allocationsForOrder(orderId);
+      } catch (e) {
+        if (e instanceof TypeError) return [];   // malformed id — treat as "nothing recorded"
+        throw e;
+      }
+    }
+
+    router.get("/admin/discount-allocation", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var orderId = (url && url.searchParams.get("order_id")) || "";
+        var rows = await _lookupAllocations(orderId);
+        _json(res, 200, { order_id: orderId, rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var orderId = (url && url.searchParams.get("order_id")) || "";
+        var rows = orderId ? await _lookupAllocations(orderId) : [];
+        var notice = (orderId && rows.length === 0)
+          ? "No discount allocations recorded for that order."
+          : null;
+        _sendHtml(res, 200, renderAdminDiscountAllocation({
+          shop_name:     deps.shop_name,
+          nav_available: navAvailable,
+          order_id:      orderId,
+          allocations:   rows,
+          notice:        notice,
+        }));
+      },
+    ));
+  }
+
   // ---- announcements --------------------------------------------------
   // Sitewide promo/notice strip. Content-negotiated like the other console
   // screens: bearer → the JSON contract; signed-in browser → the HTML
@@ -4261,7 +4342,10 @@ function mount(router, deps) {
             shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
           }));
         }
-        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+        // Record the real error server-side; return a generic 500 with no
+        // detail so a renderer fault never echoes its internals to the client.
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".order.receipt.error", outcome: "failure", metadata: { message: (e && e.message) || String(e) } });
+        return _problem(res, 500, "internal-error");
       }
       _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
     });
@@ -4282,7 +4366,10 @@ function mount(router, deps) {
             shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
           }));
         }
-        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+        // Record the real error server-side; return a generic 500 with no
+        // detail so a renderer fault never echoes its internals to the client.
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".order.packing_slip.error", outcome: "failure", metadata: { message: (e && e.message) || String(e) } });
+        return _problem(res, 500, "internal-error");
       }
       _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
     });
@@ -4676,6 +4763,16 @@ function mount(router, deps) {
   // the amount; the giftcards primitive enforces the rest.
   async function _issueGiftCard(body) {
     var input = { currency: typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency };
+    // The giftcards primitive only shape-checks the currency (/^[A-Z]{3}$/),
+    // so a well-formed-but-nonexistent code like "ZZZ" would issue a card in
+    // a currency the rest of the shop can't price. Validate against the
+    // framework's ISO 4217 catalog (the same b.money.CURRENCIES surface the
+    // currency-rounding + display primitives compose) and refuse unknown
+    // codes with a clean 400.
+    if (typeof input.currency === "string" && /^[A-Z]{3}$/.test(input.currency) &&
+        !Object.prototype.hasOwnProperty.call(b.money.CURRENCIES, input.currency)) {
+      throw new TypeError("giftcards: currency " + JSON.stringify(input.currency) + " is not a known ISO 4217 code");
+    }
     if (body.amount_minor != null && body.amount_minor !== "") {
       input.amount_minor = _strictMinorInt(body.amount_minor, "giftcards", "amount_minor (minor units)");
     }
@@ -5293,12 +5390,18 @@ function mount(router, deps) {
     // via the hidden marker so a partial JSON edit doesn't flip active.
     if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
     if (typeof body.regions_json === "string" && body.regions_json.trim() !== "") {
-      patch.regions = JSON.parse(body.regions_json);
+      // A pasted JSON blob that doesn't parse is operator input, not a
+      // server fault — throw a TypeError so both surfaces (bearer via
+      // _wrap, cookie via the htmlHandler's TypeError catch) degrade to a
+      // clean 400 instead of a 500 that echoes the parser's position.
+      try { patch.regions = JSON.parse(body.regions_json); }
+      catch (_e) { throw new TypeError("shippingZones: regions_json must be valid JSON"); }
     } else if (Array.isArray(body.regions)) {
       patch.regions = body.regions;
     }
     if (typeof body.rates_json === "string" && body.rates_json.trim() !== "") {
-      patch.rates = JSON.parse(body.rates_json);
+      try { patch.rates = JSON.parse(body.rates_json); }
+      catch (_e) { throw new TypeError("shippingZones: rates_json must be valid JSON"); }
     } else if (Array.isArray(body.rates)) {
       patch.rates = body.rates;
     }
@@ -6135,6 +6238,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
   { key: "discounts",    href: "/admin/discounts",    label: "Discounts",    requires: "autoDiscount" },
+  { key: "discount-allocation", href: "/admin/discount-allocation", label: "Discount splits", requires: "discountAllocation" },
   { key: "quantity-discounts", href: "/admin/quantity-discounts", label: "Quantity breaks", requires: "quantityDiscounts" },
   { key: "tax",          href: "/admin/tax-rates",    label: "Tax",          requires: "taxRates" },
   { key: "tax-filings",  href: "/admin/tax-filings",  label: "Tax filings",  requires: "salesTaxFilings" },
@@ -8674,6 +8778,60 @@ function renderAdminCollections(opts) {
   return _renderAdminShell(opts.shop_name, "Collections", bodyHtml, "collections", opts.nav_available);
 }
 
+// Read-only view of the per-line discount-allocation audit trail for one
+// order. The operator looks an order up by id; each recorded allocation
+// renders as a header (source, kind, total, recorded-at) plus a table of
+// the per-line breakdown. Allocations are system-written by checkout —
+// there's no create/edit affordance here. Amounts are exact minor-unit
+// integers (the audit row carries no currency; the figures are the same
+// integers the refund math reads back), so the operator sees the precise
+// recorded split rather than a rounded display value.
+function renderAdminDiscountAllocation(opts) {
+  opts = opts || {};
+  var orderId = typeof opts.order_id === "string" ? opts.order_id : "";
+  var allocations = opts.allocations || [];
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var lookupForm =
+    "<div class=\"panel mw-40\">" +
+      "<h3 class=\"subhead\">Look up an order</h3>" +
+      "<p class=\"meta\">When an order carried a cart-level discount, the split across its lines is recorded here for refund precision. Enter an order id to see its recorded allocations.</p>" +
+      "<form method=\"get\" action=\"/admin/discount-allocation\">" +
+        _setupField("Order id", "order_id", orderId, "text", "The order's id (shown on the order detail page).", " maxlength=\"200\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Look up</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var results = "";
+  if (allocations.length) {
+    results = allocations.map(function (a) {
+      var breakdown = Array.isArray(a.breakdown) ? a.breakdown : [];
+      var lineRows = breakdown.map(function (l) {
+        return "<tr>" +
+          "<td><code class=\"order-id\">" + _htmlEscape(String(l.line_id)) + "</code></td>" +
+          "<td class=\"num\">" + _htmlEscape(String(l.allocated_minor)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(l.remaining_minor)) + "</td>" +
+        "</tr>";
+      }).join("");
+      var lineTable = breakdown.length
+        ? "<table><thead><tr><th scope=\"col\">Line</th><th scope=\"col\" class=\"num\">Allocated (minor)</th><th scope=\"col\" class=\"num\">Remaining (minor)</th></tr></thead><tbody>" + lineRows + "</tbody></table>"
+        : "<p class=\"empty\">This allocation has no recorded lines.</p>";
+      return "<div class=\"panel mt\">" +
+        "<h3 class=\"subhead\">" + _htmlEscape(a.source || "—") + "</h3>" +
+        "<p class=\"meta\">" +
+          "Split: <strong>" + _htmlEscape(a.kind || "—") + "</strong>" +
+          " &middot; Total: <strong>" + _htmlEscape(String(a.total_minor)) + "</strong> minor units" +
+          " &middot; Recorded: " + _htmlEscape(_fmtDate(a.applied_at)) +
+        "</p>" +
+        lineTable +
+      "</div>";
+    }).join("");
+  }
+
+  var bodyHtml = "<section><h2>Discount splits</h2>" + notice + lookupForm + results + "</section>";
+  return _renderAdminShell(opts.shop_name, "Discount splits", bodyHtml, "discount-allocation", opts.nav_available);
+}
+
 // A <datetime-local> form value → epoch ms (integer) for the lib's
 // starts_at/expires_at, or null when blank/unparseable (open-ended). The
 // announcement primitive validates the result; a blank schedule field just
@@ -9564,6 +9722,7 @@ module.exports = {
   renderAdminShipping:     renderAdminShipping,
   renderAdminShippingZone: renderAdminShippingZone,
   renderAdminDiscounts:    renderAdminDiscounts,
+  renderAdminDiscountAllocation: renderAdminDiscountAllocation,
   renderAdminQuantityDiscounts: renderAdminQuantityDiscounts,
   renderAdminQuantityDiscount:  renderAdminQuantityDiscount,
   renderAdminConfirm:      renderAdminConfirm,

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.9",
+  "version": "0.3.11",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/checkout.js

@@ -157,6 +157,16 @@ function create(deps) {
   // rule's savings are a shipping concern and are left to the shipping
   // primitive, not folded into the subtotal discount here.
   var autoDiscount  = deps.autoDiscount || null;
+  // Optional discount-allocation recorder. When wired, a placed order
+  // that carried a cart-level discount gets a per-line breakdown of how
+  // that discount split across the order lines, recorded as a back-office
+  // audit row so a later partial refund knows each line's discounted
+  // share. POST-COMMIT + drop-silent: it runs after the order exists, in
+  // its own try/catch, so a recording failure can never fail, reverse, or
+  // change the charge of a placed order. No discount -> nothing recorded.
+  // Disabled when absent — the buy path is byte-identical to the un-wired
+  // flow.
+  var discountAllocation = deps.discountAllocation || null;
 
   // Reprice a list of cart lines through the quantity-discount engine.
   // Returns a shallow copy with `unit_amount_minor` overwritten by the
@@ -440,6 +450,72 @@ function create(deps) {
     }
   }
 
+  // Record HOW a cart-level order discount split across the order lines,
+  // for accounting + partial-refund precision. The recorded breakdown's
+  // per-line `allocated_minor` values sum exactly to the discount, so a
+  // later partial refund of one line can remove that line's share rather
+  // than the whole-order amount.
+  //
+  // POST-COMMIT + drop-silent — by design: the order is already placed
+  // (and, in the charged path, the PaymentIntent already exists) by the
+  // time this runs. The entire body is wrapped in one try/catch so a
+  // recording failure (bad input, DB error, an unmigrated table) can
+  // NEVER fail, reverse, or change the charge of a placed order. This is
+  // pure back-office bookkeeping with zero impact on the charged amount.
+  //
+  // No-op when: the recorder isn't wired, the order carried no discount
+  // (discount_minor <= 0), or the order has no lines to split across.
+  // The default split is `proportional` (by line subtotal) — the
+  // operator-readable "each line absorbs its share of the savings"
+  // distribution.
+  async function _recordDiscountAllocation(quote, orderLines, orderId) {
+    if (!discountAllocation ||
+        typeof discountAllocation.allocate !== "function" ||
+        typeof discountAllocation.recordAllocation !== "function") return;
+    try {
+      var discount = quote && quote.totals ? quote.totals.discount_minor : 0;
+      if (!Number.isInteger(discount) || discount <= 0) return;   // no discount -> record nothing
+      if (!Array.isArray(orderLines) || orderLines.length === 0) return;
+
+      // Build the allocate() line shape from the placed order lines. The
+      // line_id is the PERSISTED order-line id, so a later partial refund —
+      // which operates on order lines — can apply the breakdown directly
+      // without re-mapping by (variant, sku). The per-line subtotal is
+      // unit_amount_minor * qty — the same per-line
+      // figure pricing.subtotal summed into quote.totals.subtotal_minor,
+      // so the discount (clamped to <= subtotal upstream) never exceeds
+      // the total line weight.
+      var lines = [];
+      for (var i = 0; i < orderLines.length; i += 1) {
+        var l = orderLines[i];
+        var lineId = l.line_id != null ? l.line_id : l.id;
+        if (lineId == null) return;                                 // no stable id to key the breakdown on
+        lines.push({
+          line_id:        String(lineId),
+          subtotal_minor: l.unit_amount_minor * l.qty,
+          quantity:       l.qty,
+        });
+      }
+
+      var breakdown = discountAllocation.allocate({
+        lines:          lines,
+        discount_minor: discount,
+        kind:           "proportional",
+      });
+      await discountAllocation.recordAllocation({
+        order_id:        orderId,
+        discount_source: "auto_discount",
+        kind:            "proportional",
+        breakdown:       breakdown,
+        total_minor:     discount,
+      });
+    } catch (_e) {
+      // drop-silent — by design: the order is already placed; a failed
+      // allocation record is back-office bookkeeping and must never
+      // surface to the buyer or affect the charge.
+    }
+  }
+
   // Compose a quote from a cart + ship-to + (optional) selected
   // shipping service. Pure read — no DB writes.
   async function _buildQuote(input) {
@@ -619,6 +695,10 @@ function create(deps) {
         // placed order. Runs post-commit so a recording failure can't
         // reverse an order that's already paid.
         await _recordAutoDiscounts(quote, paidOrder.id, cartRow.customer_id || null);
+        // Best-effort: record how the cart-level discount split across the
+        // order lines (accounting + refund precision). Post-commit +
+        // drop-silent — no impact on the already-settled order.
+        await _recordDiscountAllocation(quote, paidOrder.lines, paidOrder.id);
         await cart.setStatus(quote.cart_id, "converted");
         var settled = await order.transition(paidOrder.id, "mark_paid", {
           reason: loy && !gc ? "loyalty:full" : "gift_card:full",
@@ -676,6 +756,11 @@ function create(deps) {
       // placed order. Runs post-commit so a recording failure can't
       // reverse or fail an order whose PaymentIntent already exists.
       await _recordAutoDiscounts(quote, createdOrder.id, cartRow.customer_id || null);
+      // Best-effort: record how the cart-level discount split across the
+      // order lines (accounting + refund precision). Post-commit +
+      // drop-silent — the PaymentIntent already exists; this never
+      // changes the charged amount.
+      await _recordDiscountAllocation(quote, createdOrder.lines, createdOrder.id);
 
       // Mark the cart converted so a refresh of the storefront
       // doesn't accidentally re-quote the same cart.

package/lib/webhook-subscriptions.js

@@ -116,6 +116,15 @@ function _ownerId(s) {
   return s;
 }
 
+// Hostnames that name an internal/metadata destination by name rather
+// than by IP literal — the same denylist the delivery primitive
+// (lib/webhooks.js) applies. A literal-IP host is classified directly via
+// b.ssrfGuard.classify (no DNS); these names cover the by-name reach.
+var SUBSCRIPTION_BLOCKED_HOSTS = Object.freeze({
+  "localhost":                1,
+  "metadata.google.internal": 1,
+});
+
 function _endpointUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhookSubscriptions: endpoint_url must be a non-empty string");
@@ -125,12 +134,32 @@ function _endpointUrl(url) {
   }
   // safeUrl.parse defaults to ALLOW_HTTP_TLS (https only). The framework
   // refuses http:// + non-http schemes + user:pass@ userinfo + bracketed
-  // raw-IP forms at this gate — no separate validation needed here.
+  // raw-IP forms at this gate.
+  var parsed;
   try {
-    b.safeUrl.parse(url);
+    parsed = b.safeUrl.parse(url);
   } catch (e) {
     throw new TypeError("webhookSubscriptions: endpoint_url — " + (e && e.message || "rejected"));
   }
+  // SSRF: refuse internal / loopback / link-local / cloud-metadata
+  // destinations so a registered subscription can't probe the host's own
+  // network or the instance-credential metadata service. A literal-IP host
+  // is classified via b.ssrfGuard.classify (no DNS); a hostname is matched
+  // against the by-name metadata/loopback denylist plus *.internal.
+  // DNS-rebinding (a public name resolving to a private IP) is out of scope
+  // here by design — resolving the name would add a DNS dependency the
+  // registration path avoids; the resolving guard belongs on the delivery
+  // dial.
+  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
+  // trailing dot is semantically the same host but otherwise evades both the
+  // by-name denylist ("localhost." / "metadata.google.internal.") and the
+  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
+  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
+  if (b.ssrfGuard.classify(host) ||
+      SUBSCRIPTION_BLOCKED_HOSTS[host] ||
+      host === "internal" || /\.internal$/.test(host)) {
+    throw new TypeError("webhookSubscriptions: endpoint_url host is not allowed (internal/loopback/metadata address)");
+  }
   return url;
 }
 

package/lib/webhooks.js

@@ -85,17 +85,56 @@ var RATE_WINDOW_MS = C.TIME.minutes(1);
 
 function _now() { return Date.now(); }
 
+// Hostnames that name an internal/metadata destination by name rather
+// than by IP literal. The cloud-metadata services answer on a hostname
+// as well as the 169.254.169.254 link-local IP; localhost resolves to
+// loopback. A literal-IP host is classified directly via b.ssrfGuard
+// (no DNS); these names cover the by-name reach of the same targets.
+var WEBHOOK_BLOCKED_HOSTS = Object.freeze({
+  "localhost":                1,
+  "metadata.google.internal": 1,
+});
+
 function _validateUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhooks: url must be a non-empty string");
   }
   // Refuse http:// outright for outbound — the framework's safe-url
   // parser carries the ALLOW_HTTP_TLS preset that admits only https.
+  var parsed;
   try {
-    b.safeUrl.parse(url, { allowedProtocols: ["https:"] });
+    parsed = b.safeUrl.parse(url, { allowedProtocols: ["https:"] });
   } catch (e) {
     throw new TypeError("webhooks: url must be https:// — " + (e && e.message || "rejected"));
   }
+  // SSRF: refuse any internal / loopback / link-local / cloud-metadata
+  // destination so a registered receiver can't be turned into a probe of
+  // the host's own network or the instance-credential metadata service.
+  // A literal-IP host is classified directly via b.ssrfGuard.classify
+  // (loopback / private / link-local / reserved / cloud-metadata all
+  // refused, IPv4 + IPv6 + IPv4-mapped); a hostname is matched against
+  // the by-name metadata/loopback denylist plus the *.internal suffix.
+  // DNS-rebinding (a public name that resolves to a private IP) is OUT OF
+  // SCOPE here by design — resolving the name would add a DNS dependency
+  // the outbound path otherwise avoids, and the delivery send path is the
+  // place a resolving guard belongs. This gate stops the literal-IP and
+  // known-name SSRF reachable directly from operator-supplied input.
+  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
+  // trailing dot is semantically the same host but otherwise evades both the
+  // by-name denylist ("localhost." / "metadata.google.internal.") and the
+  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
+  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
+  var isBlocked = false;
+  if (b.ssrfGuard.classify(host)) {
+    isBlocked = true;                                   // literal IP in a refused range
+  } else if (WEBHOOK_BLOCKED_HOSTS[host]) {
+    isBlocked = true;                                   // localhost / metadata.google.internal
+  } else if (host === "internal" || /\.internal$/.test(host)) {
+    isBlocked = true;                                   // any *.internal cloud-private name
+  }
+  if (isBlocked) {
+    throw new TypeError("webhooks: url host is not allowed (internal/loopback/metadata address)");
+  }
 }
 
 function _validateEvents(events) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {