@blamejs/blamejs-shop 0.4.62 → 0.4.64

package/lib/split-shipments.js

@@ -603,26 +603,67 @@ function create(opts) {
       }
 
       var hydrated = _hydratePlan(row);
+      var ts = _now();
+      // Atomic claim BEFORE any shipment is created. The JS status
+      // check above is racy: two concurrent callers both read a
+      // `proposed` row and both fall through to createShipment,
+      // double-creating shipments. The conditional UPDATE is the real
+      // gate — SQLite serializes writers, so exactly one caller flips
+      // proposed → executed and gets rowCount === 1; the loser sees 0
+      // and refuses without touching orderTracking.
+      var claim = await query(
+        "UPDATE split_shipment_plans SET status = 'executed', executed_at = ?1 " +
+        "WHERE id = ?2 AND status = 'proposed'",
+        [ts, input.plan.id],
+      );
+      if (Number(claim.rowCount || 0) !== 1) {
+        // Lost the race (or the row was concurrently cancelled/executed
+        // between the read above and the claim). Re-read so the message
+        // reflects the row's actual current status.
+        var lost = await _getPlanRow(input.plan.id);
+        throw new TypeError("split-shipments.executeSplit: plan " + input.plan.id +
+          " is " + ((lost && lost.status) || "gone") +
+          ", only proposed plans can be executed");
+      }
+
       var shipmentIds = [];
-      for (var i = 0; i < hydrated.shipments.length; i += 1) {
-        var parcel = hydrated.shipments[i];
-        var notes = "split:" + parcel.rationale + " (" + (i + 1) + "/" + hydrated.shipments.length + ")";
-        var createInput = {
-          order_id: input.order_id,
-          carrier:  carrier,
-          notes:    notes,
-        };
-        if (carrier === "other") {
-          createInput.carrier_other_name = carrierOtherName;
+      try {
+        for (var i = 0; i < hydrated.shipments.length; i += 1) {
+          var parcel = hydrated.shipments[i];
+          var notes = "split:" + parcel.rationale + " (" + (i + 1) + "/" + hydrated.shipments.length + ")";
+          var createInput = {
+            order_id: input.order_id,
+            carrier:  carrier,
+            notes:    notes,
+          };
+          if (carrier === "other") {
+            createInput.carrier_other_name = carrierOtherName;
+          }
+          var s = await orderTracking.createShipment(createInput);
+          shipmentIds.push(s.id);
         }
-        var s = await orderTracking.createShipment(createInput);
-        shipmentIds.push(s.id);
+      } catch (e) {
+        // A createShipment throw after the claim would strand the plan
+        // in `executed` with a partial shipment set. Revert the claim
+        // (self-targeting WHERE so it only fires on the row WE claimed)
+        // and rethrow so the operator can retry once the underlying
+        // failure clears. Any shipment rows already written by earlier
+        // parcels are reconciled via the orderTracking primitive's own
+        // per-shipment flow — the plan returns to `proposed`.
+        await query(
+          "UPDATE split_shipment_plans SET status = 'proposed', executed_at = NULL " +
+          "WHERE id = ?1 AND status = 'executed'",
+          [input.plan.id],
+        );
+        throw e;
       }
-      var ts = _now();
+
+      // Second UPDATE persists the shipment-id list now that every
+      // parcel landed. Self-targeting WHERE id keyed off the row we
+      // already claimed — the status gate was the first UPDATE.
       await query(
-        "UPDATE split_shipment_plans SET status = 'executed', executed_shipment_ids_json = ?1, " +
-        "executed_at = ?2 WHERE id = ?3",
-        [JSON.stringify(shipmentIds), ts, input.plan.id],
+        "UPDATE split_shipment_plans SET executed_shipment_ids_json = ?1 WHERE id = ?2",
+        [JSON.stringify(shipmentIds), input.plan.id],
       );
       return _hydratePlan(await _getPlanRow(input.plan.id));
     },

package/lib/suggestion-box.js

@@ -754,11 +754,44 @@ function create(opts) {
     var ts        = _now();
     var srcVotes  = Number(src.vote_count) || 0;
 
-    await query(
+    // Atomic claim: flip the source to 'duplicate' under a WHERE that
+    // re-asserts the JS preconditions (not already a duplicate, not
+    // archived). SQLite/D1 serializes writers, so this conditional
+    // UPDATE is the exactly-once gate — two concurrent linkers both
+    // pass the read-time checks above, but only one wins this claim.
+    // The loser (rowCount === 0) did NOT transition the row, so it
+    // must NOT migrate votes a second time (which would double-count
+    // srcVotes onto the canonical); it returns the already-linked row.
+    var claim = await query(
       "UPDATE suggestions SET status = 'duplicate', canonical_id = ?1, " +
-      "vote_count = 0, updated_at = ?2 WHERE id = ?3",
+      "vote_count = 0, updated_at = ?2 " +
+      "WHERE id = ?3 AND status <> 'duplicate' AND archived_at IS NULL",
       [cid, ts, sid],
     );
+    if (Number(claim.rowCount || 0) !== 1) {
+      // Lost the race (a concurrent linkDuplicates already flipped the
+      // source) — or it was archived between the read and the claim.
+      // Re-read to distinguish: a row now in 'duplicate' is the
+      // expected concurrent-link outcome, so return it idempotently;
+      // anything else means the precondition genuinely no longer holds.
+      var current = await _getRaw(sid);
+      if (current && current.status === "duplicate") {
+        return {
+          suggestion_id:    sid,
+          canonical_id:     current.canonical_id,
+          migrated_votes:   0,
+          source:           _decode(current),
+          canonical:        _decode(await _getRaw(current.canonical_id)),
+        };
+      }
+      var lost = new Error("suggestionBox.linkDuplicates: source could not be claimed for linking");
+      lost.code = "SUGGESTION_ALREADY_DUPLICATE";
+      throw lost;
+    }
+
+    // Only the claim winner reaches here — migrate the source's net
+    // vote_count (captured from the row this claim transitioned) onto
+    // the canonical exactly once.
     if (srcVotes !== 0) {
       await query(
         "UPDATE suggestions SET vote_count = vote_count + ?1, updated_at = ?2 WHERE id = ?3",

package/lib/wishlist-digest.js

@@ -941,10 +941,19 @@ function create(opts) {
       // the cursor back to observedNext, guarded on the value we claimed
       // so a concurrent winner's advance is never clobbered.
       var _unclaim = async function () {
+        // Roll the cursor to a value DISTINCT from the one this tick
+        // observed (observedNext + 1ms), NOT back to the exact observed
+        // value: a concurrent overlapping tick that read the same cursor
+        // is waiting to claim `next_dispatch_at = observedNext`, and
+        // restoring the exact value would let it match and re-send the
+        // digest in the same overlap. observedNext+1 stays due, so a LATER
+        // tick re-attempts (deferred, not re-fired in this overlap); the
+        // guard on the claimed value means a concurrent winner's advance
+        // is never clobbered.
         await query(
           "UPDATE wishlist_digest_enrollments SET next_dispatch_at = ?1 " +
           "WHERE id = ?2 AND next_dispatch_at = ?3",
-          [observedNext, enrollment.id, nextDispatchAt],
+          [observedNext + 1, enrollment.id, nextDispatchAt],
         );
       };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.62",
+  "version": "0.4.64",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {