@blamejs/blamejs-shop 0.4.51 → 0.4.52

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.52 (2026-06-14) — **Consent records now carry the GDPR Article 6 lawful basis they rest on.** Each decision in the durable per-customer consent ledger now records the GDPR Article 6(1) lawful basis it is processed under — consent, contract, legal obligation, vital interests, public task, or legitimate interests — alongside what was decided and when. The basis defaults from the consent kind (cookie categories, marketing email/SMS, and data-sharing opt-ins are all consent-based), and a caller may pass an explicit, validated basis for a record that rests on another. The basis is surfaced in the subject-access and supervisory-authority exports, so a consent audit now shows not just the decision but the legal ground for it. A migration adds a nullable, constrained lawful_basis column; pre-existing rows keep a null basis rather than being assigned one retroactively. Apply the pending migration on upgrade. **Added:** *Lawful basis on consent-ledger records* — The consent ledger now stamps the GDPR Article 6(1) lawful basis on every recorded decision. The basis defaults from the consent kind — every category the ledger tracks (cookie functional/analytics/marketing/preferences, marketing email, marketing SMS, partner and analytics data-sharing, and general data processing) is consent-based — and an explicit basis can be supplied and is validated against the six Article 6(1) values. Withdrawal records carry the same basis as the grant they revoke. The basis is included in the subject-access export (CSV and JSON) and the jurisdiction bulk export, so a consent audit shows the legal ground each decision rests on. **Changed:** *Migration: lawful_basis column on consent_ledger* — A new migration adds a nullable lawful_basis column to consent_ledger, constrained to the six Article 6(1) bases. The column is nullable and the constraint applies only to rows written after the migration, so existing records keep a null basis (not retroactively assigned) while every new record carries one. Apply the pending migration on upgrade.
+
 - v0.4.51 (2026-06-14) — **The order page now shows a dated activity timeline of the order's lifecycle.** A customer viewing their order now sees a chronological activity feed of what has happened to it — placed, payment received, shipped, delivered, cancelled, and refunds — newest first, each with its date and the relevant detail. A shipped event shows the carrier and tracking number when one was recorded; a refund shows its amount (and marks a partial refund as such); a click-and-collect delivery shows the pickup location. The feed is built from the order's own transition history and is scoped to the order being viewed, so it appears only to the order's owner or a guest holding the order's access link. Internal fulfillment bookkeeping and operator-process detail are not surfaced — only customer-meaningful milestones. The order page renders this server-side with no client JavaScript. No migration to apply. **Added:** *Order activity timeline on the order page* — The order detail page renders a dated, newest-first timeline of the order's lifecycle events: placed, payment received, shipped (with carrier and tracking number when present), delivered (with pickup location for click-and-collect), cancelled, and refunds (with the refunded amount, labelled partial when applicable). Events are drawn from the order's transition history and filtered to customer-meaningful milestones — internal fulfillment steps, raw state transitions, operator-process reasons, and payment-provider identifiers are never shown. Every rendered value is HTML-escaped, and the feed is shown only within the order's existing access scope (the signed-in owner or a guest order's access link).
 
 - v0.4.50 (2026-06-14) — **Refresh the vendored blamejs framework to 0.15.11.** Refreshes the vendored blamejs framework from 0.15.9 to 0.15.11 (through 0.15.10). 0.15.11 replaces a family of quadratic-time regexes that hostile input could exploit to stall a worker with linear-time scans, refuses a relocatable sealed-cell downgrade on the read side, fails closed when row-level security is enabled behind a non-native driver, and verifies the vendored crypto against a reviewed pin. 0.15.10 makes S3 Object-Lock versioned erasure reachable through the object store — a versioned delete that targets a specific object version (refused under an active retention rather than silently writing a delete-marker), plus version enumeration for right-to-erasure workflows — and pins the build toolchain's native bundler binary to a reviewed hash. This refresh carries no shop-facing API change and applies no migration; it keeps the bundled framework current and the security posture aligned with the latest release. **Changed:** *Vendored blamejs refreshed to 0.15.11* — The bundled framework is updated to blamejs 0.15.11. Across 0.15.10 and 0.15.11 it hardens a family of regular expressions against quadratic-time blow-up on hostile input (linear-time scans), refuses a relocatable sealed-cell downgrade when reading, fails closed when row-level security is enabled behind a driver that can't enforce it, adds versioned object erasure for S3 Object-Lock buckets (a versioned delete that refuses an active retention instead of leaving the data behind a delete-marker, plus version enumeration), and pins the build toolchain's native binary to a reviewed hash. Storefront and admin behaviour is unchanged by the refresh; the framework's PQC-first crypto, security middleware, and request lifecycle are carried forward as-is.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.51",
+  "version": "0.4.52",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/consent-ledger.js

@@ -131,6 +131,7 @@ var CSV_COLUMNS = Object.freeze([
   "consent_kind",
   "state",
   "source",
+  "lawful_basis",
   "jurisdiction",
   "evidence_ref",
   "occurred_at",
@@ -138,6 +139,32 @@ var CSV_COLUMNS = Object.freeze([
 
 var b = require("./vendor/blamejs");
 
+// The GDPR Art. 6(1) lawful bases, sourced from the framework's
+// consent primitive so this ledger's vocabulary tracks the
+// primitive's ground truth instead of re-listing the six strings.
+var LAWFUL_BASES = b.consent.LAWFUL_BASES;
+
+// Every consent kind this ledger records is consent-gated: cookies
+// are non-essential under ePrivacy Art. 5(3) (the strictly-necessary
+// set lives in cookieConsent, never here), marketing email / SMS rest
+// on Art. 6(1)(a), and third-party data sharing is not a contract
+// necessity. data_processing is the opt-in catch-all — contract /
+// legal-obligation processing is recorded by the domain table that
+// owns it, not by this opt-in ledger. So each kind maps to "consent".
+// A caller may still pass an explicit, validated lawful_basis to
+// override the default for a row that genuinely rests on another basis.
+var KIND_TO_LAWFUL_BASIS = Object.freeze({
+  cookies_functional:     "consent",
+  cookies_analytics:      "consent",
+  cookies_marketing:      "consent",
+  cookies_preferences:    "consent",
+  marketing_email:        "consent",
+  marketing_sms:          "consent",
+  data_sharing_partners:  "consent",
+  data_sharing_analytics: "consent",
+  data_processing:        "consent",
+});
+
 // ---- monotonic clock ----------------------------------------------------
 //
 // Operator-driven writes can land in the same millisecond on fast
@@ -195,6 +222,16 @@ function _source(s) {
   return s;
 }
 
+function _lawfulBasis(s) {
+  if (typeof s !== "string" || LAWFUL_BASES.indexOf(s) === -1) {
+    throw new TypeError(
+      "consentLedger: lawful_basis must be one of " + LAWFUL_BASES.join(", ") +
+      ", got " + JSON.stringify(s)
+    );
+  }
+  return s;
+}
+
 function _optJurisdiction(s) {
   if (s == null || s === "") return null;
   if (typeof s !== "string") {
@@ -282,6 +319,7 @@ function _rowToRecord(row) {
     consent_kind:  row.consent_kind,
     state:         row.state,
     source:        row.source,
+    lawful_basis:  row.lawful_basis == null ? null : row.lawful_basis,
     jurisdiction:  row.jurisdiction == null ? null : row.jurisdiction,
     evidence_ref:  row.evidence_ref == null ? null : row.evidence_ref,
     occurred_at:   Number(row.occurred_at),
@@ -327,15 +365,23 @@ function create(opts) {
     var source       = _source(input.source);
     var jurisdiction = _optJurisdiction(input.jurisdiction);
     var evidenceRef  = _optEvidenceRef(input.evidence_ref);
+    // Lawful basis defaults from the kind (every kind here is
+    // consent-gated; the basis is state-agnostic so a withdrawal row
+    // carries the same basis as its grant). An explicit lawful_basis is
+    // validated and overrides the default for a row that rests on a
+    // different Art. 6 basis.
+    var lawfulBasis  = input.lawful_basis == null
+      ? KIND_TO_LAWFUL_BASIS[consentKind]
+      : _lawfulBasis(input.lawful_basis);
 
     var id = b.uuid.v7();
     var ts = _now();
 
     await query(
       "INSERT INTO consent_ledger " +
-      "(id, customer_id, consent_kind, state, source, jurisdiction, evidence_ref, occurred_at) " +
-      "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
-      [id, customerId, consentKind, state, source, jurisdiction, evidenceRef, ts],
+      "(id, customer_id, consent_kind, state, source, lawful_basis, jurisdiction, evidence_ref, occurred_at) " +
+      "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+      [id, customerId, consentKind, state, source, lawfulBasis, jurisdiction, evidenceRef, ts],
     );
 
     return {
@@ -344,6 +390,7 @@ function create(opts) {
       consent_kind:  consentKind,
       state:         state,
       source:        source,
+      lawful_basis:  lawfulBasis,
       jurisdiction:  jurisdiction,
       evidence_ref:  evidenceRef,
       occurred_at:   ts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.51",
+  "version": "0.4.52",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {