@blamejs/blamejs-shop 0.4.119 → 0.4.120

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.120 (2026-06-26) — **Splitting a discount across order lines no longer rounds a line's share negative.** When an order-level discount is allocated across the order's lines (proportionally, equally, or by quantity), each line's share was rounded independently with half-even rounding. Independently rounded shares can sum to MORE than the discount, which drove the leftover remainder negative and produced a negative discount on one line — and the checkout recorder, which rejects a negative share, then dropped the whole allocation breakdown, leaving nothing for a later per-line partial refund to draw on. Reversing an allocation for a refund had the same flaw and could persist a negative per-line refund (a charge-back on that line). The split now composes the framework's largest-remainder allocator: it floors each share and hands out the non-negative leftover one minor unit at a time, so every line's share is non-negative, the shares sum to the discount (or the refund) exactly, and no breakdown is dropped. The only visible change is which line absorbs a leftover cent — now the line with the largest fractional remainder rather than the highest subtotal. **Fixed:** *Per-line discount and refund shares are floored and distributed, never rounded negative* — The per-line discount split rounded each share half-even and independently, so the rounded shares could sum above the discount, send the remainder negative, and assign a negative discount to one line; the checkout path then dropped the breakdown (its recorder refuses a negative share), so a subsequent per-line refund had no recorded allocation to subtract. The reverse path likewise could persist a negative per-line refund. Both now compose the framework's largest-remainder allocator, which floors each share and distributes the non-negative leftover one minor unit at a time to the largest remainders — every share is non-negative, the shares sum exactly to the total, and the allocation is recorded. The leftover cent now lands on the largest-remainder line instead of the highest-subtotal line.
+
 - v0.4.119 (2026-06-26) — **Vendored framework refreshed to 0.15.32.** Updates the vendored blamejs framework to 0.15.32, taking in the 0.15.31 and 0.15.32 upstream releases. Both are internal test-suite tooling only: they extend the framework's guard suite with a re-verification gate that retires renamed suppression-marker tokens (so a re-verified suppression class can't inherit a stale approval) and update the matching in-source marker comments. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.32* — Refreshes the vendored blamejs framework to 0.15.32 (taking in 0.15.31 and 0.15.32), upstream releases scoped to test-suite tooling — a re-verification gate for renamed suppression markers and the matching marker-comment updates. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.
 
 - v0.4.118 (2026-06-26) — **Changing an affiliate's commission kind now revalidates the commission value against the new kind's cap.** An affiliate's commission value is validated against its kind's ceiling when it is set: a percentage commission is capped at 100% (10000 basis points), while a flat per-order amount may be far larger. Changing only the commission kind — without resupplying the value — skipped that revalidation. Switching a flat per-order amount to a percentage therefore left the large flat value in place as a percentage rate: a $500-per-order flat amount became a 5,000,000% rate that computes a runaway commission on the next recorded order and feeds it straight into the pending-payout total. Updating the commission kind now revalidates the effective commission value (the resupplied one, or the stored one) against the new kind, so a change that would push the value over the new kind's cap is rejected with the same error as setting it directly, instead of being silently persisted. **Fixed:** *An affiliate commission-kind change revalidates the stored value against the new kind's cap* — Updating an affiliate re-checked the commission value against the (possibly new) kind's cap only when the value itself was part of the same update. A kind-only change left the stored value untouched and unvalidated, so switching a flat per-order amount to a percentage kept a value that is legal as a flat amount (up to the large flat ceiling) but thousands of times over the 100%-basis-point percentage cap — producing a grossly inflated commission on the next order and an inflated pending payout. The update path now revalidates the effective commission value against the effective kind whenever either the kind or the value changes, rejecting an over-cap combination rather than persisting it.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.119",
+  "version": "0.4.120",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/discount-allocation.js

@@ -181,18 +181,18 @@ function _validateLines(lines) {
 
 // ---- allocation math (pure) --------------------------------------------
 
-// Compute the per-line share via b.money's half-even rounded multiply.
-// Given total `T`, weights `[w0, w1, ...]` summing to `W`, each share
-// is `floor_half_even(T * wi / W)`. The shares may sum to slightly
-// less than `T` (rounding gives back fractions); the remainder is
-// applied to the line with the highest subtotal so the audit row's
-// `allocated_minor` values sum exactly to `T`.
+// Compute the per-line share of `total` via b.money's largest-remainder
+// allocator. Each share is `floor(total * wi / W)`, and the non-negative
+// leftover is handed out one minor unit at a time to the lines with the
+// largest fractional remainders, so the `allocated_minor` values sum to
+// `total` EXACTLY and none is ever negative.
 //
-// "By quantity" weights use quantity; "equal" weights every line by
-// `1` (so the share is `T / N` rounded); "by_subtotal" /
-// "proportional" weight by subtotal. The remainder placement is
-// always by highest subtotal — the operator's "the biggest line
-// absorbs the cent" mental model holds for every kind.
+// "By quantity" weights use quantity; "equal" weights every line by `1`
+// (so each gets `total / N` floored, leftover spread); "by_subtotal" /
+// "proportional" weight by subtotal. Composing the framework allocator
+// instead of independently rounding each share is what keeps the split
+// conservation-safe — a per-line half-even round can sum above `total`
+// and force a negative share, which this avoids by construction.
 function _shares(total, lines, kind) {
   var weights = new Array(lines.length);
   var sumWeight = 0n;
@@ -220,32 +220,18 @@ function _shares(total, lines, kind) {
     }
   }
 
-  var money = b.money;
-  var totalMoney = money.fromMinorUnits(BigInt(total), ROUNDING_CURRENCY);
+  // Compose b.money's largest-remainder allocator: it floors each share and
+  // distributes the (always non-negative) leftover one minor unit at a time
+  // to the largest fractional remainders, so the shares sum to `total`
+  // EXACTLY and none is ever negative. The prior hand-rolled half-even
+  // multiply rounded each share independently and could push their sum ABOVE
+  // `total` — driving the remainder negative and a line's share below zero.
+  var allocated = b.money
+    .fromMinorUnits(BigInt(total), ROUNDING_CURRENCY)
+    .allocate(weights);
   var shares = new Array(lines.length);
-  var allocated = 0n;
   for (var j = 0; j < lines.length; j += 1) {
-    var share = totalMoney
-      .multiply([BigInt(weights[j]), sumWeight])
-      .toMinorUnits();
-    shares[j] = share;
-    allocated += share;
-  }
-
-  // Place the rounding remainder (positive or negative) on the line
-  // with the highest subtotal_minor. Ties broken by original index so
-  // the placement is deterministic across runtimes.
-  var remainder = BigInt(total) - allocated;
-  if (remainder !== 0n) {
-    var bestIdx = 0;
-    var bestSubtotal = lines[0].subtotal_minor;
-    for (var m = 1; m < lines.length; m += 1) {
-      if (lines[m].subtotal_minor > bestSubtotal) {
-        bestSubtotal = lines[m].subtotal_minor;
-        bestIdx = m;
-      }
-    }
-    shares[bestIdx] = shares[bestIdx] + remainder;
+    shares[j] = allocated[j].toMinorUnits();
   }
   return shares;
 }
@@ -409,10 +395,9 @@ function create(opts) {
 
   // Reverse-walk an allocation: given a refund amount, distribute it
   // across the original breakdown proportional to each line's
-  // `allocated_minor`. Half-even rounding via b.money; the rounding
-  // remainder lands on the line with the largest original allocation
-  // (the same "biggest line absorbs the cent" rule applied to the
-  // reverse direction).
+  // `allocated_minor`, via the same b.money largest-remainder allocator
+  // as the forward split — so the per-line refund shares sum to `refund`
+  // exactly and none is negative.
   function _reverseShares(refund, breakdown) {
     var weights = new Array(breakdown.length);
     var sumWeight = 0n;
@@ -430,28 +415,17 @@ function create(opts) {
         sumWeight += 1n;
       }
     }
-    var money = b.money;
-    var refundMoney = money.fromMinorUnits(BigInt(refund), ROUNDING_CURRENCY);
+    // Same largest-remainder allocator as the forward split: floors each
+    // share and hands out the non-negative leftover unit-by-unit, so the
+    // per-line refund shares sum to `refund` exactly and none is negative
+    // (the prior half-even multiply could overshoot and persist a negative
+    // per-line refund — effectively a charge-back on that line).
+    var allocated = b.money
+      .fromMinorUnits(BigInt(refund), ROUNDING_CURRENCY)
+      .allocate(weights);
     var shares = new Array(breakdown.length);
-    var allocated = 0n;
     for (var j = 0; j < breakdown.length; j += 1) {
-      var share = refundMoney
-        .multiply([BigInt(weights[j]), sumWeight])
-        .toMinorUnits();
-      shares[j] = share;
-      allocated += share;
-    }
-    var remainder = BigInt(refund) - allocated;
-    if (remainder !== 0n) {
-      var bestIdx = 0;
-      var bestAlloc = breakdown[0].allocated_minor;
-      for (var m = 1; m < breakdown.length; m += 1) {
-        if (breakdown[m].allocated_minor > bestAlloc) {
-          bestAlloc = breakdown[m].allocated_minor;
-          bestIdx = m;
-        }
-      }
-      shares[bestIdx] = shares[bestIdx] + remainder;
+      shares[j] = allocated[j].toMinorUnits();
     }
     return shares;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.119",
+  "version": "0.4.120",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {