@blamejs/blamejs-shop 0.4.70 → 0.4.72

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.72 (2026-06-21) — **Cycle counting no longer strands a finalized count when a shelf adjustment fails midway.** When a cycle count was finalized with shelf adjustments, it advanced the count to finalized first and then applied each per-location adjustment in an unguarded loop. If one adjustment failed partway — most plausibly a negative (shrinkage) variance that would drive a location below the units already held for paid orders — the lines before it stayed applied, the lines after it never applied, and the count was left stuck finalized: a retry was refused and the header's aggregate totals were never stamped, so a tool whose whole job is to close shelf-vs-record drift instead baked in an unrecoverable partial drift. finalizeCount now mirrors the inventory-audit finalize it diverged from: it computes every variance first, claims the finalize transition AND stamps the aggregate totals in one statement, then applies each shelf adjustment reconciling against what already landed under the count's own reason — so a retry lands only the remaining delta and never doubles — and passes the hold-aware guard so a shrinkage debit can't drop a shelf below its outstanding holds. On any failure the count re-opens to in_progress, so the operator clears the blocker and re-runs to completion. **Fixed:** *A failed shelf adjustment re-opens the count instead of stranding it finalized* — finalizeCount now computes and persists every line's variance before claiming the finalize transition, stamps the aggregate variance totals in the same statement as the status flip (so a finalized count is never left with empty totals), and applies the per-location adjustments in a guarded pass that reconciles each against the deltas already recorded under the count's reason. If an adjustment throws, the count re-opens to in_progress and the error surfaces; a re-run applies only the remaining delta, so the lines that already moved are never double-applied. · *Shrinkage adjustments respect outstanding holds* — A negative cycle-count variance now debits the shelf with the hold-aware guard, matching the inventory-audit and write-off paths, so a count that records less stock than the record believed can no longer drop a location below the units already held for paid orders and strand a later fulfilment.
+
+- v0.4.71 (2026-06-21) — **SMS dispatch and shipping-insurance adjudication now claim their state transition atomically.** Two exactly-once state transitions advanced their row with a primary-key UPDATE that was not gated on the expected prior status, so two concurrent callers could both win the transition. The scheduled SMS dispatch tick flipped a queued message to sent without an `AND status = 'queued'` guard, so two overlapping ticks could both hand the same message to the provider send hook — a duplicate text and a duplicate carrier charge. The shipping-insurance claim adjudication flipped a filed claim to approved or denied the same way, so a double-submitted approval (or an approval racing a denial) could record two different payout amounts as THE payout, or let a denial clobber an approval. Both transitions now gate the UPDATE on the prior status and act only on the row the UPDATE actually claimed (rowCount === 1); the loser is skipped or refused, matching the atomic-claim shape already used by the push-notification dispatch tick and the affiliate-commission payout. **Fixed:** *SMS dispatch tick advances each message exactly once under concurrent ticks* — The queued→sent (and the no-provider queued→failed) transition in the SMS dispatch tick now gates its UPDATE on `AND status = 'queued'` and hands a message to the operator's send hook only when the UPDATE actually claimed the row. Two overlapping ticks can no longer both dispatch the same message, so a customer is never double-texted and the carrier is never billed twice for one message. · *Shipping-insurance claim adjudication records exactly one outcome under concurrent callers* — markClaimApproved and markClaimDenied now gate their transition on `AND status = 'filed'` and refuse the caller whose UPDATE claimed no row. A double-submitted approval can no longer record two different payout amounts as the approved payout, and an approval can no longer clobber a denial (or vice-versa) — exactly one adjudication outcome sticks.
+
 - v0.4.70 (2026-06-21) — **Bundled framework refreshed to blamejs 0.15.14, with the proxy-trust hardening wired through.** Refreshes the vendored blamejs to 0.15.14 — a broad security-hardening release that peer-gates every request-IP and protocol trust decision against the connecting socket, fails closed on a set of authentication and signature verifiers, bounds pre-authentication parsers against algorithmic-complexity denial of service, makes the framework's own file writes atomic and symlink-refusing, and adds a JSON serializer safe to embed in an inline script. The one behavior change that touches a deployment behind a TLS-terminating edge is how the client protocol is trusted: a bare trust-the-forwarded-header flag is no longer accepted for the HSTS and CSRF decisions, because a caller able to reach the origin socket could forge it. The storefront resolves the forwarded protocol through one owned model that the HSTS header, the CSRF origin check, and both session-cookie Secure decisions now share — so HSTS on container responses and authenticated forms behind the Cloudflare edge keep working with no operator action. **Changed:** *Bundled blamejs refreshed to 0.15.14* — Picks up the upstream security-hardening release: client-IP and protocol trust resolved by a peer-gated walk anchored at the connecting socket; SAML, electronic-signature, SD-JWT, DPoP, CIBA, mdoc, and COSE verifiers that could accept a malformed or unsigned credential now refuse it; pre-authentication parsers (CBOR, JSONPath, tar, gzip, YAML, ASN.1 DER) bounded against quadratic-time and frame-desync denial of service; allowlist and posture lookups keyed by untrusted input can no longer reach the prototype chain; the framework's predictable-temp and symlink-following writes go through atomic, symlink-refusing primitives; and several lost-update races (login lockout, bot-challenge, inline webhook delivery) are serialized. · *HSTS and CSRF protocol trust resolved through one owned model behind the edge* — The framework retired the bare forwarded-header trust flag for the decisions that depend on the client protocol (whether to emit HSTS, whether to set the Secure cookie attribute, and the CSRF origin pre-check), since a caller that can reach the origin socket could forge the header. The storefront now resolves the protocol through a single function shared by the security-headers middleware, the CSRF gate, and both the storefront and admin session-cookie paths. Behind the Cloudflare edge the resolver honours the worker-forwarded scheme; a direct connection with no forwarded header resolves to the socket scheme. HSTS on container-served responses and authenticated forms behind the CDN are unchanged; no configuration is required.
 
 - v0.4.69 (2026-06-20) — **A gift-card redemption that can't record its audit row no longer loses the balance.** Redeeming a gift card debits the card's balance in one atomic conditional update, then writes a redemption record in a separate statement. Because the bridge runs each statement on its own, a transient failure writing that record left the balance already debited with no redemption row — and the reversal path keys on that row, so the spent balance could never be returned. Redemption is now all-or-nothing: if the record can't be written, the card is re-credited for the amount (and moved back to active if the debit had zeroed it and closed it) before the error is surfaced, so a failed redemption never silently consumes a customer's balance. No API change. **Fixed:** *Redemption re-credits the card if its audit row can't be written* — After the atomic balance debit, the redemption record insert is wrapped so a transient write failure re-credits the card by the redeemed amount and restores it to active if that debit had zeroed and closed it. The customer keeps the balance and the card stays usable, instead of losing the spend to a redemption that left no row for the reversal path to act on.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.70",
+  "version": "0.4.72",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/cycle-counting.js

@@ -576,29 +576,13 @@ function create(opts) {
         throw new TypeError("cycle-counting.finalizeCount: count is " + header.status +
           ", only scheduled or in_progress counts can be finalized");
       }
-      // Claim the (scheduled|in_progress) -> finalized transition atomically
-      // BEFORE computing variances or applying adjustments. Two concurrent
-      // finalizes both pass the read above, but only one UPDATE matches the
-      // expected status; the loser refuses, so the per-shelf adjustments are
-      // applied exactly once. (Without this guard both calls would write the
-      // variance adjustments through inventoryLocations.adjustStock, double-
-      // applying.) The final aggregate counts are stamped below once the loop
-      // has run.
-      var ts = _now();
-      var claim = await query(
-        "UPDATE cycle_counts SET status = 'finalized', finalized_at = ?1 " +
-        "WHERE slug = ?2 AND status IN ('scheduled', 'in_progress')",
-        [ts, input.slug],
-      );
-      if (Number(claim.rowCount || 0) !== 1) {
-        throw new TypeError("cycle-counting.finalizeCount: count " +
-          JSON.stringify(input.slug) + " is no longer scheduled or in_progress " +
-          "(finalized by a concurrent call)");
-      }
+      // PASS 1 — compute each line's variance, persist it (idempotent),
+      // and collect the shelf adjustments to apply. No shelf is touched
+      // yet: the atomic claim below decides who, if anyone, applies them.
       var lines = await _getLines(input.slug);
       var varianceCount = 0;
       var varianceValueMinor = 0;
-      var adjustmentsWritten = 0;
+      var adjustable = [];
       for (var i = 0; i < lines.length; i += 1) {
         var line = lines[i];
         // NULL actual_quantity = operator didn't count this line.
@@ -615,33 +599,94 @@ function create(opts) {
           varianceCount += 1;
           var unitValue = await _unitValueMinor(line.sku);
           varianceValueMinor += Math.abs(variance) * unitValue;
-          if (applyAdjustments) {
-            // Adjustments only land on lines that carry a location_code.
-            // A global count (no location_code on any line) computes
-            // variance for the operator's reconciliation report but
-            // does NOT write to inventory_locations — the operator's
-            // catalog-side correction (catalog.inventory.restock /
-            // release / setStock) is the right verb for the single-
-            // bucket inventory.
-            if (line.location_code) {
-              await inventoryLocations.adjustStock({
-                sku:           line.sku,
-                location_code: line.location_code,
-                delta:         variance,
-                reason:        "cycle-count:" + input.slug,
-              });
-              adjustmentsWritten += 1;
-            }
+          // Adjustments only land on lines that carry a location_code.
+          // A global count (no location_code on any line) computes
+          // variance for the operator's reconciliation report but does
+          // NOT write to inventory_locations — the operator's catalog-
+          // side correction (catalog.inventory.restock / release /
+          // setStock) is the right verb for the single-bucket inventory.
+          if (applyAdjustments && line.location_code) {
+            adjustable.push({ sku: line.sku, location_code: line.location_code, variance: variance });
           }
         }
       }
-      // Status + finalized_at were already claimed above; stamp the computed
-      // aggregate variance totals onto the (now-finalized) header.
-      await query(
-        "UPDATE cycle_counts SET variance_count = ?1, variance_value_minor = ?2 " +
-        "WHERE slug = ?3",
-        [varianceCount, varianceValueMinor, input.slug],
+
+      var ts = _now();
+      // ATOMIC CLAIM — advance the count out of scheduled/in_progress AND
+      // stamp the computed aggregate totals in a SINGLE statement BEFORE any
+      // shelf moves. On the D1 bridge there are no interactive transactions,
+      // so this UPDATE is the serialization point: two concurrent finalizes
+      // both reach here, but only one matches a row. The loser changes zero
+      // rows, applies NOTHING, and returns the deterministic totals — so a
+      // shelf can never be double-adjusted by overlapping finalizes. Stamping
+      // the aggregates in the SAME statement means a finalized count is never
+      // left with a NULL variance_count if PASS 2 below aborts midway.
+      var claim = await query(
+        "UPDATE cycle_counts SET status = 'finalized', variance_count = ?1, " +
+        "variance_value_minor = ?2, finalized_at = ?3 " +
+        "WHERE slug = ?4 AND status IN ('scheduled', 'in_progress')",
+        [varianceCount, varianceValueMinor, ts, input.slug],
       );
+      if (Number(claim.rowCount || 0) !== 1) {
+        // Lost the claim — a concurrent (or prior) finalize already advanced
+        // this count and owns the adjustment writes. Touch no shelves; return
+        // the totals computed from the now-frozen lines.
+        return {
+          variance_count:       varianceCount,
+          variance_value_minor: varianceValueMinor,
+          adjustments_written:  adjustable.length,
+        };
+      }
+
+      // PASS 2 (winner only) — apply each shelf adjustment, reconciling
+      // against what already landed under this count's reason. Applying only
+      // `variance - applied` makes a retry land exactly the remaining delta
+      // and never a double, and self-corrects if a recount changed the
+      // variance before the retry. The common abort is a respect_holds floor
+      // refusal on a negative variance; the catch re-opens the count so the
+      // operator can clear the blocker and retry — and because PASS 2 is
+      // reconciling, the retry never double-applies the lines that already
+      // landed.
+      var adjustmentsWritten = 0;
+      var adjReason = "cycle-count:" + input.slug;
+      try {
+        for (var j = 0; j < adjustable.length; j += 1) {
+          var adj = adjustable[j];
+          var appliedRow = await query(
+            "SELECT COALESCE(SUM(delta), 0) AS applied FROM inventory_adjustments " +
+            "WHERE sku = ?1 AND location_code = ?2 AND reason = ?3",
+            [adj.sku, adj.location_code, adjReason],
+          );
+          var alreadyApplied = Number((appliedRow.rows[0] || {}).applied || 0);
+          var needed = adj.variance - alreadyApplied;
+          if (needed !== 0) {
+            await inventoryLocations.adjustStock({
+              sku:           adj.sku,
+              location_code: adj.location_code,
+              delta:         needed,
+              reason:        adjReason,
+              // A negative variance shrinks the shelf — guard it from
+              // dropping below the outstanding paid holds for the SKU so a
+              // later commitHold can't be stranded. Positive variances
+              // (credits) ignore the flag. Mirrors inventory-audits and
+              // inventory-writeoffs, the other operator-shrinkage writers.
+              respect_holds: true,
+            });
+          }
+          adjustmentsWritten += 1;
+        }
+      } catch (applyErr) {
+        // Re-open the count so the operator can clear the blocker and retry.
+        // The reconciling apply above guarantees the retry lands only the
+        // remaining delta, so nothing double-counts.
+        await query(
+          "UPDATE cycle_counts SET status = 'in_progress', finalized_at = NULL " +
+          "WHERE slug = ?1 AND status = 'finalized'",
+          [input.slug],
+        );
+        throw applyErr;
+      }
+
       return {
         variance_count:       varianceCount,
         variance_value_minor: varianceValueMinor,

package/lib/shipping-insurance.js

@@ -603,11 +603,26 @@ function create(opts) {
         ins.declared_value_minor + " on the parent insurance");
     }
     var now = _now();
-    await query(
+    // Atomic claim: the `AND status = 'filed'` predicate is the
+    // serialization point. The JS check above only refuses a SEQUENTIAL
+    // re-adjudication; two concurrent approve calls (a double-clicked
+    // operator action, a retried insurer callback) would both read
+    // 'filed' and both stamp a payout last-write-wins — two different
+    // payout_minor amounts could each be recorded as THE approved payout,
+    // or an approve could clobber a deny. Gating the UPDATE on the status
+    // means exactly one caller transitions the row; the loser sees zero
+    // rows and is refused, so one adjudication outcome sticks.
+    var approvedUpd = await query(
       "UPDATE insurance_claims SET status = 'approved', payout_minor = ?1, " +
-      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3",
+      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3 AND status = 'filed'",
       [input.payout_minor, now, claimId],
     );
+    if (Number(approvedUpd.rowCount || 0) !== 1) {
+      var racedApprove = await _getClaimRow(claimId);
+      throw new TypeError("shippingInsurance.markClaimApproved: claim " + claimId +
+        " is " + (racedApprove ? racedApprove.status : "gone") +
+        ", only filed claims can move to approved");
+    }
     return _hydrateClaim(await _getClaimRow(claimId));
   }
 
@@ -630,11 +645,21 @@ function create(opts) {
         " is " + claim.status + ", only filed claims can move to denied");
     }
     var now = _now();
-    await query(
+    // Atomic claim — same race, same guard as markClaimApproved: the
+    // `AND status = 'filed'` predicate serializes the two concurrent
+    // callers so exactly one adjudication outcome (approve XOR deny)
+    // transitions the row; the loser is refused.
+    var deniedUpd = await query(
       "UPDATE insurance_claims SET status = 'denied', denial_reason = ?1, " +
-      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3",
+      "resolved_at = ?2, updated_at = ?2 WHERE id = ?3 AND status = 'filed'",
       [denialReason, now, claimId],
     );
+    if (Number(deniedUpd.rowCount || 0) !== 1) {
+      var racedDeny = await _getClaimRow(claimId);
+      throw new TypeError("shippingInsurance.markClaimDenied: claim " + claimId +
+        " is " + (racedDeny ? racedDeny.status : "gone") +
+        ", only filed claims can move to denied");
+    }
     return _hydrateClaim(await _getClaimRow(claimId));
   }
 

package/lib/sms-dispatcher.js

@@ -867,19 +867,32 @@ function create(opts) {
           if (resolved) providerSlug = resolved.slug;
         }
         if (!providerSlug) {
-          await query(
+          // Atomic claim. The snapshot SELECT above is read without a
+          // lock, so two concurrent ticks can both pull this same
+          // `queued` row. The `AND status = 'queued'` guard makes the
+          // transition the claim: SQLite/D1 serialises writers, so
+          // exactly one tick's UPDATE matches the row (rowCount === 1)
+          // and the other sees rowCount === 0. Only the winner hands the
+          // row to the operator's send hook (via `advanced`), so the
+          // terminal failure is recorded — and surfaced — exactly once.
+          var lostFail = await query(
             "UPDATE sms_messages SET status = 'failed', failure_reason = ?1, " +
-            "failed_at = ?2 WHERE id = ?3",
+            "failed_at = ?2 WHERE id = ?3 AND status = 'queued'",
             ["no_provider_at_dispatch", now, row.id],
           );
+          if (Number(lostFail.rowCount || 0) !== 1) continue;
           advanced.push(await _getMessage(row.id));
           continue;
         }
-        await query(
+        // Atomic claim on the advance to `sent` — same race, same guard.
+        // The loser skips so the operator's send hook (the real provider
+        // POST) fires once per row, never twice for one message.
+        var claimed = await query(
           "UPDATE sms_messages SET status = 'sent', provider_slug = ?1, " +
-          "sent_at = ?2 WHERE id = ?3",
+          "sent_at = ?2 WHERE id = ?3 AND status = 'queued'",
           [providerSlug, now, row.id],
         );
+        if (Number(claimed.rowCount || 0) !== 1) continue;
         advanced.push(await _getMessage(row.id));
       }
       return advanced;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.70",
+  "version": "0.4.72",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {