@blamejs/blamejs-shop 0.4.70 → 0.4.71

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.71 (2026-06-21) — **SMS dispatch and shipping-insurance adjudication now claim their state transition atomically.** Two exactly-once state transitions advanced their row with a primary-key UPDATE that was not gated on the expected prior status, so two concurrent callers could both win the transition. The scheduled SMS dispatch tick flipped a queued message to sent without an `AND status = 'queued'` guard, so two overlapping ticks could both hand the same message to the provider send hook — a duplicate text and a duplicate carrier charge. The shipping-insurance claim adjudication flipped a filed claim to approved or denied the same way, so a double-submitted approval (or an approval racing a denial) could record two different payout amounts as THE payout, or let a denial clobber an approval. Both transitions now gate the UPDATE on the prior status and act only on the row the UPDATE actually claimed (rowCount === 1); the loser is skipped or refused, matching the atomic-claim shape already used by the push-notification dispatch tick and the affiliate-commission payout. **Fixed:** *SMS dispatch tick advances each message exactly once under concurrent ticks* — The queued→sent (and the no-provider queued→failed) transition in the SMS dispatch tick now gates its UPDATE on `AND status = 'queued'` and hands a message to the operator's send hook only when the UPDATE actually claimed the row. Two overlapping ticks can no longer both dispatch the same message, so a customer is never double-texted and the carrier is never billed twice for one message. · *Shipping-insurance claim adjudication records exactly one outcome under concurrent callers* — markClaimApproved and markClaimDenied now gate their transition on `AND status = 'filed'` and refuse the caller whose UPDATE claimed no row. A double-submitted approval can no longer record two different payout amounts as the approved payout, and an approval can no longer clobber a denial (or vice-versa) — exactly one adjudication outcome sticks.
+
 - v0.4.70 (2026-06-21) — **Bundled framework refreshed to blamejs 0.15.14, with the proxy-trust hardening wired through.** Refreshes the vendored blamejs to 0.15.14 — a broad security-hardening release that peer-gates every request-IP and protocol trust decision against the connecting socket, fails closed on a set of authentication and signature verifiers, bounds pre-authentication parsers against algorithmic-complexity denial of service, makes the framework's own file writes atomic and symlink-refusing, and adds a JSON serializer safe to embed in an inline script. The one behavior change that touches a deployment behind a TLS-terminating edge is how the client protocol is trusted: a bare trust-the-forwarded-header flag is no longer accepted for the HSTS and CSRF decisions, because a caller able to reach the origin socket could forge it. The storefront resolves the forwarded protocol through one owned model that the HSTS header, the CSRF origin check, and both session-cookie Secure decisions now share — so HSTS on container responses and authenticated forms behind the Cloudflare edge keep working with no operator action. **Changed:** *Bundled blamejs refreshed to 0.15.14* — Picks up the upstream security-hardening release: client-IP and protocol trust resolved by a peer-gated walk anchored at the connecting socket; SAML, electronic-signature, SD-JWT, DPoP, CIBA, mdoc, and COSE verifiers that could accept a malformed or unsigned credential now refuse it; pre-authentication parsers (CBOR, JSONPath, tar, gzip, YAML, ASN.1 DER) bounded against quadratic-time and frame-desync denial of service; allowlist and posture lookups keyed by untrusted input can no longer reach the prototype chain; the framework's predictable-temp and symlink-following writes go through atomic, symlink-refusing primitives; and several lost-update races (login lockout, bot-challenge, inline webhook delivery) are serialized. · *HSTS and CSRF protocol trust resolved through one owned model behind the edge* — The framework retired the bare forwarded-header trust flag for the decisions that depend on the client protocol (whether to emit HSTS, whether to set the Secure cookie attribute, and the CSRF origin pre-check), since a caller that can reach the origin socket could forge the header. The storefront now resolves the protocol through a single function shared by the security-headers middleware, the CSRF gate, and both the storefront and admin session-cookie paths. Behind the Cloudflare edge the resolver honours the worker-forwarded scheme; a direct connection with no forwarded header resolves to the socket scheme. HSTS on container-served responses and authenticated forms behind the CDN are unchanged; no configuration is required.
 
 - v0.4.69 (2026-06-20) — **A gift-card redemption that can't record its audit row no longer loses the balance.** Redeeming a gift card debits the card's balance in one atomic conditional update, then writes a redemption record in a separate statement. Because the bridge runs each statement on its own, a transient failure writing that record left the balance already debited with no redemption row — and the reversal path keys on that row, so the spent balance could never be returned. Redemption is now all-or-nothing: if the record can't be written, the card is re-credited for the amount (and moved back to active if the debit had zeroed it and closed it) before the error is surfaced, so a failed redemption never silently consumes a customer's balance. No API change. **Fixed:** *Redemption re-credits the card if its audit row can't be written* — After the atomic balance debit, the redemption record insert is wrapped so a transient write failure re-credits the card by the redeemed amount and restores it to active if that debit had zeroed and closed it. The customer keeps the balance and the card stays usable, instead of losing the spend to a redemption that left no row for the reversal path to act on.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.70",
+  "version": "0.4.71",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/shipping-insurance.js

@@ -603,11 +603,26 @@ function create(opts) {
         ins.declared_value_minor + " on the parent insurance");
     }
     var now = _now();
-    await query(
+    // Atomic claim: the `AND status = 'filed'` predicate is the
+    // serialization point. The JS check above only refuses a SEQUENTIAL
+    // re-adjudication; two concurrent approve calls (a double-clicked
+    // operator action, a retried insurer callback) would both read
+    // 'filed' and both stamp a payout last-write-wins — two different
+    // payout_minor amounts could each be recorded as THE approved payout,
+    // or an approve could clobber a deny. Gating the UPDATE on the status
+    // means exactly one caller transitions the row; the loser sees zero
+    // rows and is refused, so one adjudication outcome sticks.
+    var approvedUpd = await query(
       "UPDATE insurance_claims SET status = 'approved', payout_minor = ?1, " +
-      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3",
+      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3 AND status = 'filed'",
       [input.payout_minor, now, claimId],
     );
+    if (Number(approvedUpd.rowCount || 0) !== 1) {
+      var racedApprove = await _getClaimRow(claimId);
+      throw new TypeError("shippingInsurance.markClaimApproved: claim " + claimId +
+        " is " + (racedApprove ? racedApprove.status : "gone") +
+        ", only filed claims can move to approved");
+    }
     return _hydrateClaim(await _getClaimRow(claimId));
   }
 
@@ -630,11 +645,21 @@ function create(opts) {
         " is " + claim.status + ", only filed claims can move to denied");
     }
     var now = _now();
-    await query(
+    // Atomic claim — same race, same guard as markClaimApproved: the
+    // `AND status = 'filed'` predicate serializes the two concurrent
+    // callers so exactly one adjudication outcome (approve XOR deny)
+    // transitions the row; the loser is refused.
+    var deniedUpd = await query(
       "UPDATE insurance_claims SET status = 'denied', denial_reason = ?1, " +
-      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3",
+      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3 AND status = 'filed'",
       [denialReason, now, claimId],
     );
+    if (Number(deniedUpd.rowCount || 0) !== 1) {
+      var racedDeny = await _getClaimRow(claimId);
+      throw new TypeError("shippingInsurance.markClaimDenied: claim " + claimId +
+        " is " + (racedDeny ? racedDeny.status : "gone") +
+        ", only filed claims can move to denied");
+    }
     return _hydrateClaim(await _getClaimRow(claimId));
   }
 

package/lib/sms-dispatcher.js

@@ -867,19 +867,32 @@ function create(opts) {
           if (resolved) providerSlug = resolved.slug;
         }
         if (!providerSlug) {
-          await query(
+          // Atomic claim. The snapshot SELECT above is read without a
+          // lock, so two concurrent ticks can both pull this same
+          // `queued` row. The `AND status = 'queued'` guard makes the
+          // transition the claim: SQLite/D1 serialises writers, so
+          // exactly one tick's UPDATE matches the row (rowCount === 1)
+          // and the other sees rowCount === 0. Only the winner hands the
+          // row to the operator's send hook (via `advanced`), so the
+          // terminal failure is recorded — and surfaced — exactly once.
+          var lostFail = await query(
             "UPDATE sms_messages SET status = 'failed', failure_reason = ?1, " +
-            "failed_at = ?2 WHERE id = ?3",
+            "failed_at = ?2 WHERE id = ?3 AND status = 'queued'",
             ["no_provider_at_dispatch", now, row.id],
           );
+          if (Number(lostFail.rowCount || 0) !== 1) continue;
           advanced.push(await _getMessage(row.id));
           continue;
         }
-        await query(
+        // Atomic claim on the advance to `sent` — same race, same guard.
+        // The loser skips so the operator's send hook (the real provider
+        // POST) fires once per row, never twice for one message.
+        var claimed = await query(
           "UPDATE sms_messages SET status = 'sent', provider_slug = ?1, " +
-          "sent_at = ?2 WHERE id = ?3",
+          "sent_at = ?2 WHERE id = ?3 AND status = 'queued'",
           [providerSlug, now, row.id],
         );
+        if (Number(claimed.rowCount || 0) !== 1) continue;
         advanced.push(await _getMessage(row.id));
       }
       return advanced;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.70",
+  "version": "0.4.71",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {