@blamejs/blamejs-shop 0.4.88 → 0.4.90

package/lib/store-credit.js

@@ -89,6 +89,12 @@ var PRINTABLE_RE = /^[^\x00-\x1f\x7f]*$/;
 var MAX_BULK_IDS = 500;
 var MS_PER_DAY   = C.TIME.days(1);
 
+var SHA3_512_HEX_LEN = 128;
+// Genesis anchor for a customer's first ledger row. Each customer wallet
+// is its own independent chain — the first row links to ZERO, every
+// subsequent row links to the prior row's row_hash for the SAME customer.
+var ZERO_HASH = "0".repeat(SHA3_512_HEX_LEN);
+
 // ---- validators ---------------------------------------------------------
 
 function _uuid(s, label) {
@@ -137,6 +143,39 @@ function _epochMs(ts, label) {
 
 function _now() { return Date.now(); }
 
+// ---- chain hashing ------------------------------------------------------
+//
+// row_hash = SHA3-512(prev_hash || canonical-json(row-fields)), mirroring
+// shop.giftCardLedger / operator-audit-log. `b.auditChain.canonicalize`
+// (RFC 8785 walker, sorted keys, hash columns excluded) makes the preimage
+// byte-identical across deployments + node versions. Every persisted column
+// except the two hash columns participates, normalized so the write side
+// and `verifyChain` produce identical preimages for the same logical row.
+
+function _rowFieldsForHash(row) {
+  return {
+    id:                  row.id,
+    customer_id:         row.customer_id,
+    kind:                row.kind,
+    amount_minor:        Number(row.amount_minor),
+    source:              row.source == null ? null : row.source,
+    source_ref:          row.source_ref == null ? null : row.source_ref,
+    order_id:            row.order_id == null ? null : row.order_id,
+    balance_after_minor: Number(row.balance_after_minor),
+    expires_at:          row.expires_at == null ? null : Number(row.expires_at),
+    occurred_at:         Number(row.occurred_at),
+  };
+}
+
+function _computeRowHash(prevHash, rowFields) {
+  var canonical = b.auditChain.canonicalize(rowFields, ["prev_hash", "row_hash"]);
+  var preimage  = Buffer.concat([
+    Buffer.from(prevHash, "hex"),
+    Buffer.from(canonical, "utf8"),
+  ]);
+  return b.crypto.sha3Hash(preimage);
+}
+
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -151,16 +190,24 @@ function create(opts) {
   // aggregation at read time. Falls through to 0 when no rows exist
   // (a customer that has never had a ledger row has zero credit). The id
   // tie-break keeps any legacy same-millisecond rows deterministic; new
-  // writes can't tie — _writeRowAtomic computes a strictly-monotonic
-  // per-customer occurred_at inside the INSERT itself.
+  // writes can't tie — _resolveOccurredAt bumps a colliding timestamp to
+  // prior+1 app-side before the fenced INSERT. Also returns the tip's
+  // row_hash so the write path can chain off it (see _attemptChainedWrite).
   async function _readLatest(customerId) {
     var r = await query(
-      "SELECT balance_after_minor, occurred_at FROM store_credit_ledger " +
+      "SELECT balance_after_minor, occurred_at, row_hash FROM store_credit_ledger " +
       "WHERE customer_id = ?1 ORDER BY occurred_at DESC, id DESC LIMIT 1",
       [customerId],
     );
-    if (!r.rows.length) return { balance: 0, occurred_at: null };
-    return { balance: r.rows[0].balance_after_minor, occurred_at: r.rows[0].occurred_at };
+    if (!r.rows.length) return { balance: 0, occurred_at: null, row_hash: ZERO_HASH };
+    return {
+      balance:     r.rows[0].balance_after_minor,
+      occurred_at: r.rows[0].occurred_at,
+      // A legacy pre-chain row carries NULL row_hash — chain forward from
+      // ZERO so the first hashed row anchors the chain; verifyChain treats
+      // the unhashed legacy prefix as unverifiable rather than trusting it.
+      row_hash:    r.rows[0].row_hash == null ? ZERO_HASH : r.rows[0].row_hash,
+    };
   }
 
   async function _currentBalance(customerId) {
@@ -168,84 +215,101 @@ function create(opts) {
     return latest.balance;
   }
 
-  // Single-statement guarded write — the concurrency spine of the wallet.
-  // The live balance AND the strictly-monotonic per-customer occurred_at
-  // are computed by correlated subqueries INSIDE the INSERT, so two
-  // concurrent writes can never base off the same stale snapshot: the
-  // statements serialize at the database and the second sees the first's
-  // row. (A JS-side read-then-write here double-fulfilled concurrent
-  // debits and silently dropped one of two same-millisecond credits.)
-  // `kind` selects the guard + arithmetic:
-  //   credit — balance_after = live + amount, no balance gate (the in-SQL
-  //            occurred_at is what closes the same-millisecond tie);
-  //   debit  — balance_after = live - amount, gated on live >= amount
-  //            (zero rows = insufficient, or lost the race — same refusal);
-  //   expire — burns MIN(amount, live), gated on live > 0 (zero rows =
-  //            wallet already empty; callers degrade gracefully — by
-  //            design, never a throw).
-  //   sweep  — the scheduled expiry burn. `amount` carries the
-  //            customer's expired-credit total; the still-unburned
-  //            remainder (total minus the live SUM of prior
-  //            SWEEP_SOURCE_REF expire rows) is recomputed INSIDE the
-  //            insert and capped at the live balance, so two concurrent
-  //            sweeps can't both burn the same expired pool. The second
-  //            sweep serializes behind the first's committed row, sees
-  //            zero pending, and matches no rows — never burning the
-  //            still-valid (non-expired) credit left in the wallet.
-  //            Stored as an `expire` row stamped SWEEP_SOURCE_REF.
-  // Returns the written row's resolved values, or null when the guard
-  // refused the write.
-  async function _writeRowAtomic(kind, customerId, amount, source, sourceRef, orderId, expiresAt, requestedTs) {
+  // Strictly-monotonic per-customer occurred_at: a write at or before the
+  // prior row's timestamp is bumped to prior+1, so the denormalized
+  // balance_after snapshot is unambiguous on read. A backdated operator
+  // write still lands at the requested time when there's no collision.
+  function _resolveOccurredAt(requestedTs, latestTs) {
+    if (latestTs == null) return requestedTs;
+    if (requestedTs > latestTs) return requestedTs;
+    return latestTs + 1;
+  }
+
+  // How many times a writer re-derives the chain tip when the parent fence
+  // refuses its INSERT (another write landed first). Each fence round lets
+  // exactly ONE racing writer win, so a burst of N concurrent writes to the
+  // SAME customer needs up to N rounds — the cap is sized well beyond any
+  // realistic same-wallet fan-in (an admin grant + the scheduled expiry
+  // sweep + a checkout debit racing at once) so a legitimate burst is never
+  // dropped with STORE_CREDIT_CONTENTION. A genuine non-collision insert
+  // error re-throws on the first attempt (see _attemptChainedWrite), so a
+  // high cap never spins on a real failure.
+  var CHAIN_WRITE_ATTEMPTS = 64;
+
+  // One fenced write against the tip the caller just read. The live balance
+  // AND the strictly-monotonic occurred_at are computed APP-SIDE and bound
+  // explicitly, together with prev_hash + row_hash so every row participates
+  // in the per-customer hash chain. What makes the app-computed values safe
+  // is the chain-parent fence UNIQUE(customer_id, prev_hash) (migration
+  // 0236): a write derived from a STALE tip collides at the constraint
+  // instead of forking the chain or persisting a balance computed off a
+  // stale snapshot — the caller re-reads and retries. The debit overdraft
+  // gate stays INSIDE the statement (the correlated subquery, never a
+  // JS-side check): with the fence it is defense-in-depth, and it is what
+  // turns a genuine overdraft into a zero-row refusal rather than a retry
+  // loop.
+  //
+  // Collision detection is STATE-AGNOSTIC, never error-message matching:
+  // the production D1 service-binding redacts the SQLite "UNIQUE constraint
+  // failed" text to a generic "HTTP 500", so on ANY insert error we re-read
+  // the tip — if it advanced past the parent we tried to chain off, a
+  // competing write claimed our slot (a genuine fence collision) and we
+  // retry; if the tip is unchanged the insert failed for another reason, so
+  // we re-throw. Returns one of { written }, { refused } (the guard said no
+  // against the live tip), or { collided } (tip moved — retry).
+  async function _attemptChainedWrite(customerId, kind, latest, d) {
     var id = b.uuid.v7();
     var storedKind = kind === "sweep" ? "expire" : kind;
+    var rowHash = _computeRowHash(latest.row_hash, _rowFieldsForHash({
+      id:                  id,
+      customer_id:         customerId,
+      kind:                storedKind,
+      amount_minor:        d.amount,
+      source:              d.source,
+      source_ref:          d.sourceRef,
+      order_id:            d.orderId,
+      balance_after_minor: d.after,
+      expires_at:          d.expiresAt,
+      occurred_at:         d.ts,
+    }));
     var balSub = "COALESCE((SELECT balance_after_minor FROM store_credit_ledger " +
                  "WHERE customer_id = ?2 ORDER BY occurred_at DESC, id DESC LIMIT 1), 0)";
-    var tsSub  = "COALESCE((SELECT occurred_at FROM store_credit_ledger " +
-                 "WHERE customer_id = ?2 ORDER BY occurred_at DESC, id DESC LIMIT 1), 0)";
-    var tsExpr = "CASE WHEN ?8 > " + tsSub + " THEN ?8 ELSE " + tsSub + " + 1 END";
-    var amountExpr, afterExpr, guard;
-    if (kind === "credit") {
-      amountExpr = "?3";
-      afterExpr  = balSub + " + ?3";
-      guard      = "1";
-    } else if (kind === "debit") {
-      amountExpr = "?3";
-      afterExpr  = balSub + " - ?3";
-      guard      = balSub + " >= ?3";
-    } else if (kind === "sweep") {
-      // `?3` is this customer's expired-credit total. Subtract the live
-      // sum of prior sweep-stamped expire rows to get the still-pending
-      // burn, then cap at the live balance — both recomputed at INSERT
-      // time so a racing second sweep sees the first's committed row.
-      var sweptSub = "COALESCE((SELECT SUM(amount_minor) FROM store_credit_ledger " +
-                     "WHERE customer_id = ?2 AND kind = 'expire' AND source_ref = ?5), 0)";
-      var pending  = "(?3 - " + sweptSub + ")";
-      amountExpr   = "CASE WHEN " + balSub + " < " + pending + " THEN " + balSub + " ELSE " + pending + " END";
-      afterExpr    = "CASE WHEN " + balSub + " < " + pending + " THEN 0 ELSE " + balSub + " - " + pending + " END";
-      guard        = pending + " > 0 AND " + balSub + " > 0";
-    } else {            // expire — burn MIN(amount, live balance)
-      amountExpr = "CASE WHEN " + balSub + " < ?3 THEN " + balSub + " ELSE ?3 END";
-      afterExpr  = "CASE WHEN " + balSub + " < ?3 THEN 0 ELSE " + balSub + " - ?3 END";
-      guard      = balSub + " > 0";
+    try {
+      var res = await query(
+        "INSERT INTO store_credit_ledger " +
+        "(id, customer_id, kind, amount_minor, source, source_ref, order_id, balance_after_minor, expires_at, occurred_at, prev_hash, row_hash) " +
+        "SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12 " +
+        "WHERE " + (d.guarded ? balSub + " >= ?4" : "1"),
+        [id, customerId, storedKind, d.amount, d.source, d.sourceRef, d.orderId, d.after, d.expiresAt, d.ts, latest.row_hash, rowHash],
+      );
+      if (Number(res.rowCount || 0) === 0) return { refused: true };
+      return { written: { id: id, amount_minor: d.amount, balance_after_minor: d.after, occurred_at: d.ts } };
+    } catch (e) {
+      var after = await _readLatest(customerId);
+      if (after.row_hash !== latest.row_hash) return { collided: true };
+      throw e;
     }
-    var res = await query(
-      "INSERT INTO store_credit_ledger " +
-      "(id, customer_id, kind, amount_minor, source, source_ref, order_id, balance_after_minor, expires_at, occurred_at) " +
-      "SELECT ?1, ?2, ?9, " + amountExpr + ", ?4, ?5, ?6, " + afterExpr + ", ?7, " + tsExpr + " " +
-      "WHERE " + guard,
-      [id, customerId, amount, source, sourceRef, orderId, expiresAt, requestedTs, storedKind],
-    );
-    if (Number(res.rowCount || 0) === 0) return null;
-    var row = (await query(
-      "SELECT amount_minor, balance_after_minor, occurred_at FROM store_credit_ledger WHERE id = ?1",
-      [id],
-    )).rows[0];
-    return {
-      id:                  id,
-      amount_minor:        row.amount_minor,
-      balance_after_minor: row.balance_after_minor,
-      occurred_at:         row.occurred_at,
-    };
+  }
+
+  // Run a chained write with bounded tip-contention retries. `derive` maps
+  // the freshly-read tip to the attempt's concrete fields (it may be async —
+  // the sweep reads its prior-burn sum inside), or returns { noop: true }
+  // for a write that degrades gracefully on an empty / already-settled
+  // wallet. Each fence collision re-reads the tip and re-derives, so the
+  // values that land are always consistent with the parent they chain off.
+  async function _writeChained(customerId, kind, derive) {
+    for (var attempt = 0; attempt < CHAIN_WRITE_ATTEMPTS; attempt += 1) {
+      var latest = await _readLatest(customerId);
+      var d = await derive(latest);
+      if (d.noop) return { noop: true, balance: latest.balance };
+      var r = await _attemptChainedWrite(customerId, kind, latest, d);
+      if (r.collided) continue;
+      if (r.refused) return { refused: true };
+      return r.written;
+    }
+    var contention = new Error("storeCredit." + kind + ": persistent chain-tip contention — retry the write");
+    contention.code = "STORE_CREDIT_CONTENTION";
+    throw contention;
   }
 
   return {
@@ -264,7 +328,18 @@ function create(opts) {
       var requested  = _epochMs(input.occurred_at, "occurred_at");
       if (requested == null) requested = _now();
 
-      var w = await _writeRowAtomic("credit", customerId, amount, source, sourceRef, null, expiresAt, requested);
+      var w = await _writeChained(customerId, "credit", function (latest) {
+        return {
+          amount:    amount,
+          source:    source,
+          sourceRef: sourceRef,
+          orderId:   null,
+          expiresAt: expiresAt,
+          after:     latest.balance + amount,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   false,
+        };
+      });
 
       return {
         id:                  w.id,
@@ -289,11 +364,23 @@ function create(opts) {
       var requested  = _epochMs(input.occurred_at, "occurred_at");
       if (requested == null) requested = _now();
 
-      // The balance gate lives INSIDE the insert — a refused write covers
-      // both "always insufficient" and "a concurrent debit drained it
-      // first", with no window between check and write.
-      var w = await _writeRowAtomic("debit", customerId, amount, null, null, orderId, null, requested);
-      if (!w) {
+      // The balance gate lives INSIDE the insert (defense-in-depth behind
+      // the chain-parent fence) — a refused write covers both "always
+      // insufficient" and "a concurrent debit drained it first", with no
+      // window between check and write.
+      var w = await _writeChained(customerId, "debit", function (latest) {
+        return {
+          amount:    amount,
+          source:    null,
+          sourceRef: null,
+          orderId:   orderId,
+          expiresAt: null,
+          after:     latest.balance - amount,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   true,
+        };
+      });
+      if (w.refused) {
         var insufficient = new Error("storeCredit.debit: amount exceeds available balance");
         insufficient.code = "STORE_CREDIT_INSUFFICIENT_BALANCE";
         throw insufficient;
@@ -334,8 +421,24 @@ function create(opts) {
       // already at zero) is the structured no-op below, never a throw —
       // by design: a no-op expire is a valid outcome of a bulk sweep,
       // and a zero-amount row would violate CHECK(amount_minor > 0).
-      var w = await _writeRowAtomic("expire", customerId, amount, null, reason, null, null, requested);
-      if (!w) {
+      var w = await _writeChained(customerId, "expire", function (latest) {
+        var burn = amount > latest.balance ? latest.balance : amount;
+        // An empty wallet is the structured no-op below, never a throw —
+        // a zero-amount row would violate CHECK(amount_minor > 0), and a
+        // no-op expire is a valid outcome of a bulk sweep.
+        if (burn === 0) return { noop: true };
+        return {
+          amount:    burn,
+          source:    null,
+          sourceRef: reason,
+          orderId:   null,
+          expiresAt: null,
+          after:     latest.balance - burn,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   false,
+        };
+      });
+      if (w.noop) {
         return {
           id:                  null,
           customer_id:         customerId,
@@ -343,7 +446,7 @@ function create(opts) {
           amount_minor:        0,
           requested_minor:     amount,
           reason:              reason,
-          balance_after_minor: await _currentBalance(customerId),
+          balance_after_minor: w.balance,
           occurred_at:         requested,
           noop:                true,
         };
@@ -368,6 +471,124 @@ function create(opts) {
       return { customer_id: customerId, balance_minor: bal };
     },
 
+    // Recompute one customer's hash chain and flag the first divergence —
+    // the tamper-evidence READ side of the chain the writers maintain.
+    // Walks the wallet's rows in (occurred_at, id) order; rows from before
+    // the chain columns existed (NULL row_hash) are tolerated as an
+    // unverifiable legacy PREFIX, but once a hashed row anchors, every
+    // later row must link — an unhashed row after the anchor, a prev_hash
+    // that doesn't name its parent, or a row_hash that doesn't recompute is
+    // a break. A populated ledger that never anchors (every row NULL-hashed
+    // — the shape a full-ledger rewrite leaves behind) fails as unanchored;
+    // an empty ledger is the only no-anchor case that passes. O(n) per
+    // customer; operator-audit use, not hot-path.
+    //
+    // Optional trusted anchor (opts.anchor = { count, head }) — the ONLY
+    // way to detect a TAIL TRUNCATION (deleting the most-recent rows) or a
+    // whole-chain replacement, since an append-only chain stays internally
+    // consistent after its tail is removed (a deleted latest debit makes
+    // balance() revert while the remaining prefix still links). The caller
+    // supplies a count + head captured from a trusted prior snapshot of this
+    // same result (count = total_rows, head = last_hash) — a periodic
+    // operator checkpoint or an out-of-band monitor. The chain row at index
+    // count-1 must still carry that head hash, so a truncation BELOW the
+    // snapshot is caught even after later valid appends. Without an anchor
+    // this verifies INTERNAL consistency only and reports
+    // anchor_checked:false so the caller knows truncation was not ruled out
+    // (operator-audit-log closes the same gap with signed checkpoints).
+    verifyChain: async function (customerId, opts) {
+      _uuid(customerId, "customer_id");
+      opts = opts || {};
+      var anchor = null;
+      if (opts.anchor != null) {
+        if (typeof opts.anchor !== "object"
+            || typeof opts.anchor.count !== "number" || !Number.isInteger(opts.anchor.count) || opts.anchor.count < 1
+            || typeof opts.anchor.head !== "string" || opts.anchor.head.length !== SHA3_512_HEX_LEN) {
+          throw new TypeError("storeCredit.verifyChain: anchor must be { count: positive integer, head: " + SHA3_512_HEX_LEN + "-hex-char string }");
+        }
+        anchor = opts.anchor;
+      }
+      var r = await query(
+        "SELECT * FROM store_credit_ledger WHERE customer_id = ?1 " +
+        "ORDER BY occurred_at ASC, id ASC",
+        [customerId],
+      );
+      var rows = r.rows;
+      var legacyPrefix = 0;
+      var anchored = false;
+      var prevHash = ZERO_HASH;
+      for (var i = 0; i < rows.length; i += 1) {
+        var row = rows[i];
+        if (!anchored && row.row_hash == null) { legacyPrefix += 1; continue; }
+        anchored = true;
+        var breakBase = {
+          ok:            false,
+          rows_verified: i - legacyPrefix,
+          legacy_prefix: legacyPrefix,
+          break_at:      i,
+          break_row_id:  row.id,
+        };
+        if (row.row_hash == null) {
+          return Object.assign(breakBase, { reason: "unhashed row after chain anchor" });
+        }
+        if (row.prev_hash !== prevHash) {
+          return Object.assign(breakBase, { reason: "prev_hash mismatch", expected: prevHash, actual: row.prev_hash });
+        }
+        var computed = _computeRowHash(prevHash, _rowFieldsForHash(row));
+        if (computed !== row.row_hash) {
+          return Object.assign(breakBase, { reason: "row_hash mismatch", expected: computed, actual: row.row_hash });
+        }
+        prevHash = row.row_hash;
+      }
+      if (!anchored && rows.length > 0) {
+        return {
+          ok:            false,
+          rows_verified: 0,
+          legacy_prefix: legacyPrefix,
+          break_at:      0,
+          break_row_id:  rows[0].id,
+          reason:        "unanchored chain (no hashed row in a populated ledger)",
+        };
+      }
+      // Internal walk is clean. With a trusted anchor, also rule out a tail
+      // truncation below the snapshot: the row at the snapshot's position
+      // must still carry the snapshot's head hash (it survives later valid
+      // appends), and the chain must not be shorter than the snapshot.
+      if (anchor) {
+        if (rows.length < anchor.count) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "row count below anchor (possible tail truncation)",
+            expected_count: anchor.count,
+            actual_count:   rows.length,
+          };
+        }
+        var anchorRow = rows[anchor.count - 1];
+        if (!anchorRow || anchorRow.row_hash !== anchor.head) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "anchor row hash mismatch (possible tail truncation or divergence)",
+            expected:       anchor.head,
+            actual:         anchorRow ? anchorRow.row_hash : null,
+          };
+        }
+      }
+      return {
+        ok:             true,
+        rows_verified:  rows.length - legacyPrefix,
+        legacy_prefix:  legacyPrefix,
+        total_rows:     rows.length,
+        last_hash:      prevHash,
+        anchor_checked: anchor != null,
+      };
+    },
+
     history: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("storeCredit.history: input object required");
@@ -639,8 +860,38 @@ function create(opts) {
         // expired credits are "first-out" from the operator's POV — the
         // schema doesn't track FIFO at row level, so the audit trail
         // reflects what was actually burned.
-        var w = await _writeRowAtomic("sweep", customerId, expiredTotal, null, SWEEP_SOURCE_REF, null, null, now);
-        if (!w) continue;
+        var w = await _writeChained(customerId, "sweep", async function (latest) {
+          // Pending burn = this customer's expired-credit total minus the
+          // sweep's OWN prior output (expire rows stamped SWEEP_SOURCE_REF),
+          // capped at the live balance. The prior-burn sum is read INSIDE
+          // the derive so a fence retry recomputes it against the committed
+          // tip: a racing second sweep collides, re-reads a now-nonzero
+          // swept sum, sees zero pending, and no-ops — never burning the
+          // still-valid (non-expired) credit the first sweep left behind.
+          // Operator expires + debits already reduced the balance; the
+          // balance cap is what keeps the sweep from over-burning a partly
+          // drained wallet, so they must not also be netted out of the
+          // expired pool (only this sweep's own output is).
+          var sweptRow = (await query(
+            "SELECT COALESCE(SUM(amount_minor), 0) AS swept FROM store_credit_ledger " +
+            "WHERE customer_id = ?1 AND kind = 'expire' AND source_ref = ?2",
+            [customerId, SWEEP_SOURCE_REF],
+          )).rows[0];
+          var pending = expiredTotal - Number(sweptRow.swept || 0);
+          if (pending <= 0 || latest.balance <= 0) return { noop: true };
+          var burn = pending > latest.balance ? latest.balance : pending;
+          return {
+            amount:    burn,
+            source:    null,
+            sourceRef: SWEEP_SOURCE_REF,
+            orderId:   null,
+            expiresAt: null,
+            after:     latest.balance - burn,
+            ts:        _resolveOccurredAt(now, latest.occurred_at),
+            guarded:   false,
+          };
+        });
+        if (!w || w.noop || w.refused) continue;
         processed.push({
           id:                  w.id,
           customer_id:         customerId,

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.19",
-      "tag": "v0.15.19",
+      "version": "0.15.20",
+      "tag": "v0.15.20",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -841,6 +841,7 @@
         "release-notes/v0.15.18.json": "lib/vendor/blamejs/release-notes/v0.15.18.json",
         "release-notes/v0.15.19.json": "lib/vendor/blamejs/release-notes/v0.15.19.json",
         "release-notes/v0.15.2.json": "lib/vendor/blamejs/release-notes/v0.15.2.json",
+        "release-notes/v0.15.20.json": "lib/vendor/blamejs/release-notes/v0.15.20.json",
         "release-notes/v0.15.3.json": "lib/vendor/blamejs/release-notes/v0.15.3.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
@@ -1547,7 +1548,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:ebd9e3a79a0dce5518430a52c9c6e24cbf7bad0406bbed2c4e7ad5eb1ab297c6",
+        "CHANGELOG.md": "sha256:4642c9fe7ab6aacfbf5b95e3780834b6b1fb4f485139571171d8a30eb702cde7",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1557,7 +1558,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:23f7ee4a44f21e433ed1d3c6f414575eb3e30f66a328422973a1109a276c537b",
-        "api-snapshot.json": "sha256:719da0f2483fb5672ee09e398f4d85304c875f6f9df96f21ad32cdc3aa1cc3b5",
+        "api-snapshot.json": "sha256:7ca3b73f197b253072a2210417668acf336bb36a8407556e7e3663b0b1543aa9",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -2298,7 +2299,7 @@
         "lib/vc.js": "sha256:554cf29ea712b231256e1eaa75f6b1f1d39c392aac86b33e818d52e956ea83ae",
         "lib/vendor-data.js": "sha256:ddb77b33d89a2c5345deca98eacb45695d4c8a70014bc5df22c7393f52e11416",
         "lib/vendor/.vendor-data-pubkey": "sha256:73a935b8c72f55d821c22ddb8188453bab324f80d229d033a0a1549819a1f096",
-        "lib/vendor/MANIFEST.json": "sha256:09194d50f99999485fb525da118afd815c475be0ef4f6e58fbc3f41ffd91d1dd",
+        "lib/vendor/MANIFEST.json": "sha256:c2b9e40fb993db0f92c49154a5ac078e01324ccd02a19985e38186da06dd7338",
         "lib/vendor/bimi-trust-anchors.data.js": "sha256:aa7a4d33b65a68422a2a2c1670177689f66fdcaa08bd2514d78798b827bd1608",
         "lib/vendor/bimi-trust-anchors.pem": "sha256:81ff9f5ab3c9774132c845684e783be95cf73146f8b670d964105f0a3765b4b4",
         "lib/vendor/common-passwords-top-10000.data.js": "sha256:87b223beca89f33d2c2c32a2cfda0bc187e58061de40e7127bb5ffc4258c6e2a",
@@ -2307,9 +2308,9 @@
         "lib/vendor/noble-curves.cjs": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731",
         "lib/vendor/noble-post-quantum.cjs": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68",
         "lib/vendor/pki.cjs": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77",
-        "lib/vendor/public-suffix-list.dat": "sha256:0adddeb62057d8d40799dffb29fe14f65dd009259afe02eb2f0b4602b791aae6",
-        "lib/vendor/public-suffix-list.data.js": "sha256:82af512cacf0fd2c60925e63f877b69477b1b2f7bb5af698fd862af61369902e",
-        "lib/vendor/simplewebauthn-server.cjs": "sha256:f359a782ac57e3ff56ac71083d17f5c082f88ab49d645fc2bede398b47adebdb",
+        "lib/vendor/public-suffix-list.dat": "sha256:42c4f3544726fa2feb4f304c889c5e391feb5d28080c9b6356ff82e267a93706",
+        "lib/vendor/public-suffix-list.data.js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6",
+        "lib/vendor/simplewebauthn-server.cjs": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c",
         "lib/vendor/vendor-data-pubkey.js": "sha256:a12afa34cd7472e2eaebad2fcd44714102d3edd0601e45769404124a513926d0",
         "lib/vex.js": "sha256:b45c1c9729dfc69f2140478d46eec91f47da94b5f440be36fa825cb733a718fc",
         "lib/watcher.js": "sha256:8618da919affabbe4c4d33915647b3ee4b27e6ea091638f032d4bfead797baf8",
@@ -2328,7 +2329,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:c625373887cfae872dde0fca9ea6955278d6fc721128c04bbd01a31986b9d409",
+        "package.json": "sha256:7409a04e0673a297045ce2248e196cb4f856f2a037af73e837b0264b76984071",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2349,6 +2350,7 @@
         "release-notes/v0.15.18.json": "sha256:c8b3ce7af0f7863cdc3f5179f0525469331720a80b741b73236fdd6f4243bbaa",
         "release-notes/v0.15.19.json": "sha256:8c6a745accd2c551953464991bb23547e8cf87286d57938c57080755785e58b5",
         "release-notes/v0.15.2.json": "sha256:36e1423dda94ed4e55c660e0fae882019005d8de3ee5e3b6ac4f38ccf8e744a2",
+        "release-notes/v0.15.20.json": "sha256:bc469d136c909f94d89d2816a5a4c7b08ae93380d812e837d4f1c554eae1ce2b",
         "release-notes/v0.15.3.json": "sha256:19a0074c445545468ca3cc411b21ec8bdb27be2669ae1950347cc244f6aa348c",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
@@ -2387,7 +2389,7 @@
         "scripts/validate-source-comment-blocks.js": "sha256:f3a8d9ef0dcf9612a694d5c005c8c05b3ffbd7e92a14a8efb4aa97f054528f7f",
         "scripts/vendor-data-gen.js": "sha256:76b627bc6e19b4a122edfca6f514bcb8ca11af02902f0957e641f503337a8a0f",
         "scripts/vendor-data-keygen.js": "sha256:94eaa4d8f832b4aac9ccbcb2a07e6b99cd35cf7b044e1412079cebdefc1f4c0e",
-        "scripts/vendor-update.sh": "sha256:c1c879ee620f064a06d776c1d330749b5128a35581352ef385fa8baf4a35f79a",
+        "scripts/vendor-update.sh": "sha256:373d7f024b7caa3345a3598fa3a586078dd842f0071e6fdad00a473f48a3a929",
         "test/00-primitives.js": "sha256:64f3a0ec3678f8b3ab401ed59cdc1139f4e8720f5ed61443a718d8f480f64d5b",
         "test/10-state.js": "sha256:7f286e00fda002ccf50ccc59d658b6dce9a4bccee304232984a932a2ceb31c49",
         "test/20-db.js": "sha256:241ef6b7ef305d077aeafb22ee3bcc75b6b549a8fa9b1a6b5d6d5fba43b48d7d",
@@ -3002,7 +3004,7 @@
         "test/layer-0-primitives/vc.test.js": "sha256:504fadbce3c8210c7ecb74e927686bdec03d7581b1dae4150c2ebefc326c182b",
         "test/layer-0-primitives/vendor-currency-classify.test.js": "sha256:a56c08cce24a600fa827756d220159365a2c3cc30428ade49df97b19466125a6",
         "test/layer-0-primitives/vendor-data.test.js": "sha256:e216ae83b187c66f1002c419e4af2701573e5743666007b564a0257332bc0c9b",
-        "test/layer-0-primitives/vendor-manifest.test.js": "sha256:55685bd11686bf76495ec29769470de05a6aaf4648d2b5722d96f213d9e32587",
+        "test/layer-0-primitives/vendor-manifest.test.js": "sha256:494f89868468618592390854903f301b4d675c1b46c11fe5117e475195731c4d",
         "test/layer-0-primitives/vex.test.js": "sha256:4a06e3e9a6ea8ffe3ab2c0af69cbe2835c1d50768c184308bb2e40638c8998cc",
         "test/layer-0-primitives/watcher.test.js": "sha256:346ef70ff89e9d4b6ba27f6a1859be0cd782b8224930c7c3d2ead5d495c08dd7",
         "test/layer-0-primitives/web-push-vapid.test.js": "sha256:4634dcf1c3fdae300b291d20473285a9d9fe2f49f9c54e4e3a2e149768d3fe32",