@blamejs/blamejs-shop 0.4.123 → 0.4.124

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.124 (2026-06-27) — **Adding the same item to a cart from two requests at once always sums the quantity, and the manager role can configure delivery cutoffs and postal zones.** Two correctness fixes. First, adding the same product to a cart from two requests at once — a double-click, or two open tabs — could drop one of the quantity increases: the cart line's quantity was read and then written back as an absolute value, so the second write overwrote the first instead of adding to it. Adding to the cart now sums the quantity in a single atomic database statement, so simultaneous adds of the same item always total correctly; the same atomic write covers applying a bundle's units onto an existing line and merging a guest cart into a signed-in cart at login. Second, an operator with the manager role was wrongly denied the delivery-estimate cutoff-time and postal-zone screens — those two actions were not mapped to the catalog-write permission and fell through to the owner-only fallback, so only the owner could reach them; managers can now manage them alongside the other delivery-estimate settings. **Fixed:** *Simultaneous add-to-cart requests for the same item sum the quantity instead of losing one* — Adding a line to a cart read the existing quantity and then wrote back the absolute sum, so two requests adding the same item to the same cart at the same time (a rapid double-click, or two tabs) could each read the same starting quantity and overwrite each other — one increase was lost. The add is now a single atomic upsert that increments the stored quantity in the database (`qty = qty + added`), so concurrent adds of the same item always total correctly and a concurrent first-add no longer fails on the cart's unique-line constraint. A plain re-add still keeps the line's existing price. The same atomic write applies to placing a bundle's units onto an existing line (the per-unit price re-blends to the combined value, rounded up so it never charges below it) and to merging a guest cart into a signed-in cart at login. · *The manager role can configure delivery cutoff times and postal zones* — The delivery-estimate cutoff-time and postal-zone actions were not mapped to the catalog-write permission, so they fell through to the owner-only fallback and an operator with the manager role was denied access to those two screens while being allowed the adjacent transit-time and holiday screens. Both actions now require catalog-write, matching the rest of the delivery-estimate settings, so managers can configure them.
+
 - v0.4.123 (2026-06-26) — **Vendored framework refreshed to 0.15.33.** Updates the vendored blamejs framework to 0.15.33. The upstream release is internal test-suite tooling only: it re-verifies three more of the framework's guard-suite suppression classes from scratch and renames their markers to descriptive tokens, recording the old names as retired so a re-verified class cannot inherit a stale approval. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.33* — Refreshes the vendored blamejs framework to 0.15.33, an upstream release scoped to test-suite tooling — three more guard-suite suppression classes re-verified and their markers renamed to descriptive tokens, with the old names retired. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.
 
 - v0.4.122 (2026-06-26) — **Loyalty points are clawed back against the goods subtotal they were earned on, not the order's grand total.** Loyalty points are earned on an order's goods value. When an order was refunded, the points clawback was computed as a proportion of the GRAND total instead — so refunding the full goods value while keeping non-refundable shipping or tax clawed back less than all of the earned points, letting a customer keep loyalty points on goods they had fully returned (a buy-then-return rewards-farming gap). The clawback now ratios against the DISCOUNTED goods value (the subtotal minus any order discount — the cash the customer actually paid for the goods), so returning the full goods value reverses all earned points even when shipping or tax is retained; the refund is applied goods-first (capped at the goods value). Separately, the clawback's points-times-amount product is now computed in BigInt, so a very large order can no longer drift the floored result by a point. Loyalty-tender restoration (returning points that were spent at checkout) still ratios against the cash refund and is unchanged. **Fixed:** *Earned-points clawback ratios against the discounted goods value, not the grand total* — Points are awarded on an order's goods value, but the refund clawback divided the refunded amount by the order's grand total. On an order carrying tax or shipping the grand total is larger than the goods value, so refunding the full goods value never reached a 100% clawback — the customer kept a slice of points on goods they fully returned. The refund path now passes the DISCOUNTED goods value — the subtotal minus any order discount, i.e. the cash actually paid for the goods — as the clawback base (the refund is treated goods-first and capped at that value), so a full goods return reverses all earned points even when non-refundable shipping or tax is kept, and a discounted order is no longer under-clawed. The terminal full-refund edge still claws 100%, and loyalty points spent as a checkout tender are still restored against the cash refunded. · *The proportional clawback computes points-times-amount in BigInt* — The clawback's points-awarded times refunded-amount product was computed with floating-point arithmetic. On a sufficiently large order the product can exceed the exact-integer range and drift the floored clawback by a point. It is now computed in BigInt — matching the framework's convention for money-by-quantity products — so the clawed amount is exact at any order size.

package/lib/admin.js

@@ -159,7 +159,8 @@ var _ACTION_PERMISSION = Object.freeze({
   email_campaign: "catalog.write", winback_campaign: "catalog.write", suggestion: "catalog.write", sidebar_widget: "catalog.write",
   page: "catalog.write", help: "catalog.write", survey: "catalog.write",
   hours: "catalog.write", delivery_holiday: "catalog.write",
-  delivery_transit: "catalog.write", tax_rate: "catalog.write",
+  delivery_transit: "catalog.write", delivery_cutoff: "catalog.write",
+  delivery_postal_zone: "catalog.write", tax_rate: "catalog.write",
   shipping_zone: "catalog.write", payment_domain: "catalog.write",
   webhook: "catalog.write", subscription_plan: "catalog.write", loyalty: "catalog.write",
   // orders / fulfilment / post-purchase

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.123",
+  "version": "0.4.124",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/cart.js

@@ -207,30 +207,33 @@ function create(opts) {
       // Fetch variant SKU for the line snapshot.
       var variantRow = (await query("SELECT sku FROM variants WHERE id = ?1", [input.variant_id])).rows[0];
       if (!variantRow) throw new TypeError("cart.addLine: variant " + input.variant_id + " not found");
-      // Upsert: if a line for this (cart, variant) exists, bump qty.
+      // Pre-read the existing line ONLY to preserve the over-cap TypeError UX
+      // (best-effort under concurrency — MAX_QTY is a sanity bound, not a money
+      // invariant). The write itself is a SINGLE atomic upsert: a pre-existing
+      // line bumps qty by the added amount in-DB (`qty = qty + excluded.qty`),
+      // so two concurrent adds of the same (cart, variant) sum exactly. The prior
+      // read-then-write-absolute lost an increment when two adds raced, and the
+      // bare INSERT could throw on the UNIQUE(cart_id, variant_id) constraint when
+      // a concurrent add created the line first. A qty-bump KEEPS the existing
+      // line's price (DO UPDATE never touches unit_amount_minor).
       var existing = (await query(
-        "SELECT * FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
+        "SELECT qty FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
         [cartId, input.variant_id],
       )).rows[0];
+      if (existing) _qty(existing.qty + input.qty);
       var ts = _now();
-      if (existing) {
-        var newQty = existing.qty + input.qty;
-        _qty(newQty);
-        await query(
-          "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3",
-          [newQty, ts, existing.id],
-        );
-        await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
-        return Object.assign({}, existing, { qty: newQty, updated_at: ts });
-      }
       var id = b.uuid.v7();
       await query(
         "INSERT INTO cart_lines (id, cart_id, variant_id, sku, qty, unit_amount_minor, unit_currency, added_at, updated_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8)",
+        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8) " +
+        "ON CONFLICT (cart_id, variant_id) DO UPDATE SET qty = cart_lines.qty + excluded.qty, updated_at = excluded.updated_at",
         [id, cartId, input.variant_id, variantRow.sku, input.qty, unitAmount, unitCurrency, ts],
       );
       await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
-      return { id: id, cart_id: cartId, variant_id: input.variant_id, sku: variantRow.sku, qty: input.qty, unit_amount_minor: unitAmount, unit_currency: unitCurrency, added_at: ts, updated_at: ts };
+      return (await query(
+        "SELECT * FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
+        [cartId, input.variant_id],
+      )).rows[0];
     },
 
     // Add a bundle member's units at the bundle's allocated price. addLine is a
@@ -270,42 +273,41 @@ function create(opts) {
       if (cartRow.status !== "active") throw new TypeError("cart.setBundleLine: cart status is " + cartRow.status + ", cannot modify");
       var variantRow = (await query("SELECT sku FROM variants WHERE id = ?1", [input.variant_id])).rows[0];
       if (!variantRow) throw new TypeError("cart.setBundleLine: variant " + input.variant_id + " not found");
+      // Pre-read the existing line ONLY to preserve the over-cap TypeError UX
+      // (best-effort under concurrency). The write is a SINGLE atomic upsert.
       var existing = (await query(
-        "SELECT * FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
+        "SELECT qty FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
         [cartId, input.variant_id],
       )).rows[0];
+      if (existing) _qty(existing.qty + input.qty);
       var ts = _now();
-      if (existing) {
-        var mergedQty = existing.qty + input.qty;
-        _qty(mergedQty);
-        // Combined value of the units already on the line plus the bundle's
-        // units at the bundle price, expressed as one integer per-unit price.
-        // Round up so a non-divisible blend never charges below the combined
-        // value (a sub-unit residual, never the standalone list price).
-        var mergedTotal = (existing.qty * existing.unit_amount_minor) + (input.qty * input.unit_amount_minor);
-        var blendedUnit = Math.ceil(mergedTotal / mergedQty);
-        await query(
-          "UPDATE cart_lines SET qty = ?1, unit_amount_minor = ?2, unit_currency = ?3, updated_at = ?4 WHERE id = ?5",
-          [mergedQty, blendedUnit, input.unit_currency, ts, existing.id],
-        );
-        await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
-        return Object.assign({}, existing, {
-          qty: mergedQty, unit_amount_minor: blendedUnit,
-          unit_currency: input.unit_currency, updated_at: ts,
-        });
-      }
       var id = b.uuid.v7();
+      // Atomic upsert: on a fresh line the bundle's allocated price stands; on a
+      // pre-existing line the per-unit price is re-blended to the COMBINED value
+      // (existing qty x existing price + bundle qty x bundle price), rounded UP via
+      // integer `(total + qty - 1) / qty` so a non-divisible blend never charges
+      // below the combined value (a sub-unit residual, never the standalone list
+      // price). Computing the blend in SQL keeps it a single atomic statement, so
+      // two bundle adds racing the same (cart, variant) can't lose an increment or
+      // mis-blend (the prior read-then-write-absolute could), and the fresh-line
+      // INSERT can't throw on the UNIQUE(cart_id, variant_id) constraint. SQLite
+      // evaluates every DO UPDATE right-hand side against the ORIGINAL row, so the
+      // blend reads the pre-bump qty/price even though `qty` is reassigned too.
       await query(
         "INSERT INTO cart_lines (id, cart_id, variant_id, sku, qty, unit_amount_minor, unit_currency, added_at, updated_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8)",
+        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8) " +
+        "ON CONFLICT (cart_id, variant_id) DO UPDATE SET " +
+        "unit_amount_minor = (cart_lines.qty * cart_lines.unit_amount_minor + excluded.qty * excluded.unit_amount_minor + (cart_lines.qty + excluded.qty) - 1) / (cart_lines.qty + excluded.qty), " +
+        "qty = cart_lines.qty + excluded.qty, " +
+        "unit_currency = excluded.unit_currency, " +
+        "updated_at = excluded.updated_at",
         [id, cartId, input.variant_id, variantRow.sku, input.qty, input.unit_amount_minor, input.unit_currency, ts],
       );
       await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
-      return {
-        id: id, cart_id: cartId, variant_id: input.variant_id, sku: variantRow.sku,
-        qty: input.qty, unit_amount_minor: input.unit_amount_minor,
-        unit_currency: input.unit_currency, added_at: ts, updated_at: ts,
-      };
+      return (await query(
+        "SELECT * FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2 LIMIT 1",
+        [cartId, input.variant_id],
+      )).rows[0];
     },
 
     // Scope the mutation to (lineId, cartId): a caller who learns
@@ -360,24 +362,16 @@ function create(opts) {
       var ts = _now();
       for (var i = 0; i < fromLines.length; i += 1) {
         var l = fromLines[i];
-        var existing = (await query(
-          "SELECT * FROM cart_lines WHERE cart_id = ?1 AND variant_id = ?2",
-          [toCartId, l.variant_id],
-        )).rows[0];
-        if (existing) {
-          var newQty = Math.min(existing.qty + l.qty, MAX_QTY);
-          await query(
-            "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3",
-            [newQty, ts, existing.id],
-          );
-        } else {
-          var newId = b.uuid.v7();
-          await query(
-            "INSERT INTO cart_lines (id, cart_id, variant_id, sku, qty, unit_amount_minor, unit_currency, added_at, updated_at) " +
-            "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8)",
-            [newId, toCartId, l.variant_id, l.sku, l.qty, l.unit_amount_minor, l.unit_currency, ts],
-          );
-        }
+        // Atomic upsert: a variant already on the surviving cart sums qty in-DB
+        // (clamped to MAX_QTY), collapsing the prior read-then-write-absolute so a
+        // concurrent write to the destination line can't lose a merged increment.
+        var newId = b.uuid.v7();
+        await query(
+          "INSERT INTO cart_lines (id, cart_id, variant_id, sku, qty, unit_amount_minor, unit_currency, added_at, updated_at) " +
+          "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8) " +
+          "ON CONFLICT (cart_id, variant_id) DO UPDATE SET qty = MIN(cart_lines.qty + excluded.qty, ?9), updated_at = excluded.updated_at",
+          [newId, toCartId, l.variant_id, l.sku, l.qty, l.unit_amount_minor, l.unit_currency, ts, MAX_QTY],
+        );
       }
       // Carry the anonymous cart's applied discount codes onto the
       // surviving cart so a code typed before sign-in isn't silently

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.123",
+  "version": "0.4.124",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {