@blamejs/blamejs-shop 0.4.95 → 0.4.97

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.97 (2026-06-25) — **Constraint-collision handling no longer depends on the database error text, so duplicate detection works in production instead of only in tests.** Several write paths detected a UNIQUE (or related) constraint collision by matching the database error message — looking for the literal text 'UNIQUE constraint failed'. That text only survives in local/test runs: in production, the data layer redacts the underlying SQLite error to a generic 'HTTP 500' with no constraint text, so the match silently failed and the intended collision handling was skipped — the raw error surfaced instead of the idempotent replay, the typed duplicate error, the regenerate-and-retry, or the claim reuse. Every such site now detects the collision by re-reading state through the unique key after the insert fails: if the row is present the failure was the collision and the site runs its existing handling; if not, the original error is re-thrown. This makes idempotent webhook replays, duplicate-key errors, code/token retries, and discount-claim reuse behave correctly in production, not just under tests. No configuration changes. **Fixed:** *Constraint-collision detection is now state-based, not error-message-based* — Duplicate-delivery webhook replays (webhook receiver), duplicate-key errors (tenant domain + slug, vendor SKU), regenerate-and-retry on a code/token collision (referral codes, gift-redemption tokens, API keys, affiliate codes), and the auto-discount per-order claim reuse all decided 'was this a constraint collision?' by scanning the SQLite error message. Production redacts that message to a bare 'HTTP 500', so the check was blind there and the collision branch never ran. Each site now re-reads by its unique key after an insert error and runs its handling only when the row is actually present, re-throwing any other error — the same approach the gift-card and affiliate-commission ledgers already use. The admin error-to-response mapper, which has no single key to re-read, now prefers a typed constraint code over the message text where the driver provides one.
+
+- v0.4.96 (2026-06-25) — **Compose two newly-public framework primitives directly, removing an internal-path dependency and a drift-prone duplicate transition table.** Two internal refactors that adopt framework surface the application previously had to work around, with no change in behaviour. The text-guard module composed the framework's codepoint-threat catalog by reaching into an internal vendored module path, because the catalog was not on the framework's public surface; it now composes the public b.codepointClass (the same module, reference-identical), so a future framework refresh that moves the internal file can't break the import. The quotes module kept a hand-rolled loop that re-derived a quote's next status from a second copy of its transition table; it now resolves the destination through the state machine's own side-effect-free resolver, off the single transition definition, so the two can no longer drift apart. No configuration changes. **Changed:** *Text-guard composes the public codepoint-threat catalog* — The free-text guard built its bidi / control / null-byte / zero-width / mixed-script screening on the framework's codepoint catalog by requiring an internal vendored module path, since the catalog was not yet exported publicly. It now composes the public b.codepointClass — the identical module — so the screening no longer depends on an internal file location that an upstream refresh could relocate. · *Quote transitions resolve through the state machine instead of a duplicate table* — Validating a quote's lifecycle edge (respond / accept / reject / cancel / expire / convert) used the state machine to check the edge was legal, then a separate hand-rolled loop over a second copy of the transition table to read the destination status. The destination is now resolved by the state machine's own side-effect-free resolver, off the single transition definition the machine is built from, removing the duplicate table walk that could drift from it.
+
 - v0.4.95 (2026-06-25) — **An order state change no longer logs a phantom transition when it loses a concurrent race, and a transient failure writing the history row no longer strands a stock hold.** Advancing an order through its lifecycle reads the order's current status, resolves the next state, then writes it with an UPDATE guarded on the row still being in the state it was read in — so when two writers race the same order (the stale-order reaper cancelling while a payment webhook marks it paid), exactly one wins and the loser collapses to a no-op. Two issues in that path are fixed. First, the state machine's transition audit was emitted before the guarded write resolved, so a writer that LOST the race still recorded a 'success' transition into the audit trail for a state change that never landed; the audit is now written only for the writer that actually moved the row. Second, the denormalized history-row insert ran between the committed status write and the inventory settlement with no failure handling: a transient error writing that row aborted the whole call after the status had already advanced, so the stock hold was never converted to a shelf debit (or released) and a webhook retry — finding the order already advanced — skipped settlement entirely, stranding the hold. The history insert is now best-effort (the state-machine audit is the authoritative record), so a failure writing it never prevents the hold from settling. No configuration changes. **Changed:** *Vendored framework refreshed to 0.15.24* — Updates the vendored blamejs framework to 0.15.24, an upstream build supply-chain hardening release with no runtime API changes. No operator action required. **Fixed:** *A lost order-transition race no longer records a phantom 'success' in the audit trail* — The order state machine emitted its transition audit during the in-memory replay, before the guarded status write that decides the race. A writer that lost the race (its conditional update matched zero rows and it no-opped) had nonetheless already written a 'success' transition into the audit trail — a record an auditor could not tell apart from a real one. The destination state is now resolved side-effect-free, and the transition audit is emitted only after the guarded write wins, so the audit trail records exactly the transitions that actually landed. · *A transient failure writing an order's history row no longer strands its stock hold* — After an order's status write committed, the order_transitions history row was inserted with no failure handling, ahead of the inventory settlement. A transient error on that insert aborted the call with the order already advanced, so the held stock was never debited or released; a webhook retry then found the order past its starting state, no-opped at the concurrency guard, and skipped settlement — leaving the hold stranded with no automatic recovery. A history-row write failure no longer aborts settlement, so the hold always settles once the state change commits. Because that row is also where a PayPal capture id is recovered from, a write failure is not silently dropped: the row's full payload — including any capture metadata — is recorded to the durable error feed (and the audit chain) for reconciliation.
 
 - v0.4.94 (2026-06-25) — **A print-on-demand fulfillment status change is now an atomic claim — concurrent updates can no longer clobber each other or record a phantom transition.** Advancing a print-on-demand fulfillment through its lifecycle (submitted → shipped / failed / cancelled) read the row's current status, validated the move in memory, and then wrote the new status with an UPDATE keyed on the row id alone. Two updates racing the same fulfillment — a worker marking it shipped while an operator marks it failed, or a re-delivered supplier webhook — both read the same starting status, both passed the in-memory check, and both wrote unconditionally, so the later write silently overwrote the earlier one's status and columns (a lost update), and each emitted a 'success' transition into the audit trail even though only one write reflected reality. The status write is now a single-statement atomic claim gated on the row still being in the state it was read in (the same compare-and-swap the dropship-forwarding and returns lifecycles already use): exactly one update wins, the loser changes zero rows and is refused, and the audit record is written only for the update that actually changed the row. No configuration changes. **Fixed:** *Concurrent print-on-demand fulfillment transitions no longer clobber each other or log a phantom transition* — The fulfillment status update was keyed on the row id with no guard on the starting state, so two concurrent transitions both wrote unconditionally — last-writer-wins overwrote the other's status and stamped columns, and both emitted a 'success' transition audit. The update is now an atomic compare-and-swap gated on the row still being in the from-state, with the destination resolved side-effect-free and the audit emitted only on the winning write. The losing transition changes zero rows and is refused with a clear concurrency error instead of corrupting the record.

package/lib/admin.js

@@ -724,12 +724,23 @@ function _safeNotice(e, auditAction) {
     return { status: 400, code: "bad-request", message: "Invalid input." };
   }
   var msg = (e && e.message) || "";
-  if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
-    return /FOREIGN KEY/i.test(msg)
+  // Prefer a typed constraint code over message text: the production D1
+  // service-binding redacts the SQLite constraint string to a generic
+  // "HTTP 500", so a message regex is blind in prod (it only matches under
+  // node:sqlite). A generic, table-agnostic mapper has no UNIQUE key to
+  // re-read, so it can't use the state-agnostic re-read pattern the typed
+  // call sites use — it relies on `e.code` set by the caller / DB driver,
+  // falling back to the (test-only-reliable) message scan.
+  var sqlState = (e && (e.code || e.sqliteCode)) || "";
+  var isUnique  = sqlState === "SQLITE_CONSTRAINT_UNIQUE"     || sqlState === "UNIQUE"      || /UNIQUE constraint failed/i.test(msg);
+  var isForeign = sqlState === "SQLITE_CONSTRAINT_FOREIGNKEY" || sqlState === "FOREIGN_KEY" || /FOREIGN KEY constraint failed/i.test(msg);
+  var isCheckNN = sqlState === "SQLITE_CONSTRAINT_CHECK"      || sqlState === "SQLITE_CONSTRAINT_NOTNULL" || /(?:CHECK|NOT NULL) constraint failed/i.test(msg);
+  if (isUnique || isForeign) {
+    return isForeign
       ? { status: 409, code: "conflict", message: "A referenced record does not exist." }
       : { status: 409, code: "conflict", message: "That value is already in use." };
   }
-  if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
+  if (isCheckNN) {
     return { status: 400, code: "bad-request", message: "A required value is missing or invalid." };
   }
   // Genuine unknown error — record it server-side via the framework audit

package/lib/affiliates.js

@@ -474,7 +474,17 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite). Re-read by the
+        // colliding UNIQUE key (`code`): if a row now holds the code we tried,
+        // the failure WAS the collision, so loop and regenerate; if no such
+        // row exists the insert failed for another reason, so re-throw.
+        var clash = await query(
+          "SELECT id FROM affiliates WHERE code = ?1", [row.code]
+        );
+        if (!clash.rows.length) throw e;
       }
     }
     if (lastErr) throw lastErr;

package/lib/api-keys.js

@@ -352,7 +352,17 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite). Re-read by the
+        // colliding UNIQUE key (`token_hash`): if a row now holds this hash the
+        // failure WAS the collision, so regenerate and retry; otherwise the
+        // insert failed for another reason, so re-throw.
+        var clash = await query(
+          "SELECT id FROM api_keys WHERE token_hash = ?1", [row.token_hash]
+        );
+        if (!clash.rows.length) throw e;
         // Regenerate on collision.
         plaintext           = _generateToken();
         row.token_hash      = _hashToken(plaintext);

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.95",
+  "version": "0.4.97",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/auto-discount.js

@@ -1275,17 +1275,25 @@ function create(opts) {
       // a claim from a prior attempt whose rollback didn't complete —
       // reuse it (its counter reservation was already paid), after
       // returning the increment this call just took.
-      if (/UNIQUE constraint failed/i.test((e && e.message) || "")) {
+      //
+      // State-agnostic collision detection — never error-message matching.
+      // The production D1 service-binding redacts the SQLite "UNIQUE
+      // constraint failed" text to a generic "HTTP 500", so a message regex
+      // is blind in prod (it only matches under node:sqlite). Re-read by the
+      // colliding UNIQUE key (rule_slug, order_id): if a row now exists the
+      // failure WAS the collision, so reuse it; otherwise the insert failed
+      // for another reason, so re-throw (without returning the increment).
+      var held = (await query(
+        "SELECT id FROM auto_discount_applications WHERE rule_slug = ?1 AND order_id = ?2",
+        [slug, claimRef],
+      )).rows[0];
+      if (held) {
         await query(
           "UPDATE auto_discount_rules SET redemptions_used = " +
           "CASE WHEN redemptions_used > 0 THEN redemptions_used - 1 ELSE 0 END, updated_at = ?1 WHERE slug = ?2",
           [_now(), slug],
         );
-        var held = (await query(
-          "SELECT id FROM auto_discount_applications WHERE rule_slug = ?1 AND order_id = ?2",
-          [slug, claimRef],
-        )).rows[0];
-        return { claimed: true, id: held ? held.id : null, reused: true };
+        return { claimed: true, id: held.id, reused: true };
       }
       throw e;
     }

package/lib/quotes.js

@@ -212,35 +212,27 @@ function _getQuoteFsm() {
   return _quoteFsm;
 }
 
-// Resolve the to-status for a legal (from, event) pair off the transition
-// table — the FSM's `can()` only answers yes/no, so the destination comes from
-// the declaration the machine was built from (one source of truth).
-function _toStatus(fromStatus, event) {
-  for (var i = 0; i < QUOTE_TRANSITIONS.length; i += 1) {
-    var t = QUOTE_TRANSITIONS[i];
-    if (t.from === fromStatus && t.on === event) return t.to;
-  }
-  return null;
-}
-
 // Validate one status-changing edge through the FSM. `event` is the verb name
 // above; `fromStatus` is the row's CURRENT status. Returns the resolved
 // to-status on success. Throws a coded QUOTE_TRANSITION_REFUSED Error when the
 // machine refuses the edge (terminal state, wrong source state, or unknown
 // event) so the caller maps it to a uniform 409 regardless of which guard
-// tripped — the same shape the hand-rolled status checks used to throw. The
-// machine's synchronous `can()` is the gate (no guards declared, so it never
-// awaits); the destination is read back off the transition table.
+// tripped — the same shape the hand-rolled status checks used to throw.
+// `target` resolves the destination state side-effect-free (no audit emit, no
+// state mutation) and returns null on an illegal edge — so it is BOTH the gate
+// and the to-status resolver in one call, read off the single FSM source of
+// truth rather than a parallel transition-table walk that could drift from it.
 function _assertTransition(fromStatus, event, verbLabel) {
   var fsm = _getQuoteFsm();
   var instance = fsm.restore({ state: fromStatus, history: [], context: {} });
-  if (!instance.can(event)) {
+  var toStatus = instance.target(event);
+  if (toStatus == null) {
     var refused = new Error("quotes." + verbLabel + ": refused — quote is " +
       fromStatus + ", cannot " + event);
     refused.code = "QUOTE_TRANSITION_REFUSED";
     throw refused;
   }
-  return _toStatus(fromStatus, event);
+  return toStatus;
 }
 
 // ---- validators ---------------------------------------------------------

package/lib/referral-leaderboard.js

@@ -476,26 +476,29 @@ function create(opts) {
           [id, customerId, tier, periodLabel, pointsBudget, ts],
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
-          // Lost the race to a concurrent caller — return their row.
-          var raced = await query(
-            "SELECT id, customer_id, tier, period_label, points_awarded, occurred_at " +
-            "FROM referral_leaderboard_bonuses " +
-            "WHERE customer_id = ?1 AND period_label = ?2 AND tier = ?3 LIMIT 1",
-            [customerId, periodLabel, tier],
-          );
-          if (raced.rows.length) {
-            var rr = raced.rows[0];
-            return {
-              id:             rr.id,
-              customer_id:    rr.customer_id,
-              tier:           rr.tier,
-              period_label:   rr.period_label,
-              points_awarded: Number(rr.points_awarded || 0),
-              occurred_at:    Number(rr.occurred_at || 0),
-              status:         "already-awarded",
-            };
-          }
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (customer_id, period_label, tier) — if the row now exists we lost
+        // the race to a concurrent caller, so return their row; otherwise
+        // the insert failed for another reason, so re-throw.
+        var raced = await query(
+          "SELECT id, customer_id, tier, period_label, points_awarded, occurred_at " +
+          "FROM referral_leaderboard_bonuses " +
+          "WHERE customer_id = ?1 AND period_label = ?2 AND tier = ?3 LIMIT 1",
+          [customerId, periodLabel, tier],
+        );
+        if (raced.rows.length) {
+          var rr = raced.rows[0];
+          return {
+            id:             rr.id,
+            customer_id:    rr.customer_id,
+            tier:           rr.tier,
+            period_label:   rr.period_label,
+            points_awarded: Number(rr.points_awarded || 0),
+            occurred_at:    Number(rr.occurred_at || 0),
+            status:         "already-awarded",
+          };
         }
         throw e;
       }

package/lib/referrals.js

@@ -260,8 +260,16 @@ function create(opts) {
           break;
         } catch (e) {
           lastErr = e;
-          // UNIQUE-violation: regenerate. Any other error propagates.
-          if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) {
+          // State-agnostic collision detection — never error-message
+          // matching. The production D1 service-binding redacts the
+          // SQLite "UNIQUE constraint failed" text to a generic "HTTP
+          // 500", so a message regex is blind in prod. Re-read the
+          // colliding `code`: if a row with that code now exists the
+          // failure WAS the UNIQUE race, so we regenerate and retry; if
+          // no such row exists the insert failed for another reason and
+          // we propagate. The cap (5 attempts) is unchanged.
+          var clash = await _codeRowByCode(code);
+          if (!clash) {
             throw e;
           }
         }

package/lib/subscription-gifts.js

@@ -385,7 +385,16 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message
+        // matching. The production D1 service-binding redacts the SQLite
+        // "UNIQUE constraint failed" text to a generic "HTTP 500", so a
+        // message regex is blind in prod. Re-read by the colliding
+        // token_hash: if a row with that hash now exists the failure WAS
+        // the UNIQUE race, so we regenerate the token and retry; if no
+        // such row exists the insert failed for another reason and we
+        // propagate. The cap (5 attempts) is unchanged.
+        var clash = await _getRawByTokenHash(tokenHash);
+        if (!clash) throw e;
       }
     }
     if (lastErr) throw lastErr;

package/lib/tenants.js

@@ -265,7 +265,17 @@ function create(opts) {
         [id, tenantId, domain, isPrimary ? 1 : 0, ts]
       );
     } catch (e) {
-      if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+      // State-agnostic collision detection: the production D1 service
+      // binding redacts the SQLite "UNIQUE constraint failed" text to a
+      // generic "HTTP 500", so a message regex is blind in prod. Re-read
+      // by the UNIQUE key (tenant_domains.domain is globally UNIQUE) — if
+      // the row now exists, the insert lost a duplicate-domain race; if
+      // not, the insert failed for another reason, so re-throw.
+      var clash = await query(
+        "SELECT 1 FROM tenant_domains WHERE domain = ?1 LIMIT 1",
+        [domain]
+      );
+      if (clash.rows.length) {
         var dupe = new Error("tenants: domain '" + domain + "' is already registered");
         dupe.code = "TENANT_DOMAIN_DUPLICATE";
         throw dupe;
@@ -337,7 +347,14 @@ function create(opts) {
           [id, slug, name, defaultCurrency, defaultLocale, themeSlug, status, ts]
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (tenants.slug) — if the row now exists, a concurrent define won
+        // the slug; otherwise the insert failed for another reason, so
+        // re-throw.
+        var clash = await _tenantBySlug(slug);
+        if (clash) {
           var slugDupe = new Error("tenants.defineTenant: slug '" + slug + "' is already registered");
           slugDupe.code = "TENANT_SLUG_DUPLICATE";
           throw slugDupe;

package/lib/text-guard.js

@@ -15,13 +15,9 @@
  *   The dangerous-codepoint surface (bidi overrides, C0 control bytes,
  *   null bytes, zero-width / invisible formatting, mixed-script
  *   confusables) is NOT reinvented here — it composes the framework's
- *   own codepoint catalog, the single source of truth the guard-*
- *   family already builds on. The framework does not yet re-export the
- *   catalog on its public index; until it does, this module reaches
- *   the catalog leaf directly. The leaf has no dependency on any shop
- *   module, so requiring it is refresh-safe; an upstream one-line
- *   `module.exports` add would let this collapse to `b.codepointClass`
- *   with no behavior change.
+ *   own codepoint catalog (`b.codepointClass`), the single source of
+ *   truth the guard-* family already builds on, so the tables and
+ *   regexes never drift into a second hand-maintained copy.
  *
  *   Validators THROW a `TypeError` on bad input. The admin / account
  *   request wrappers map a thrown `TypeError` to a clean 400, so a
@@ -50,13 +46,11 @@
 var b = require("./vendor/blamejs");
 
 // The framework's codepoint catalog (bidi / control / null / zero-width
-// tables + regexes, the script ranges, and the detect/assert/strip
-// helpers the guard-* family composes). It is not on the framework's
-// public index yet; the catalog leaf has no shop-module dependency, so
-// composing it directly stays refresh-safe and keeps a single source of
-// truth instead of a second copy of the tables.
-// allow:vendor-hand-edit — composing the framework's codepoint catalog leaf (no shop dependency, refresh-safe); collapses to b.codepointClass once upstream re-exports it
-var codepointClass = require("./vendor/blamejs/lib/codepoint-class");
+// tables + regexes, the script ranges, and the detect/assert/strip helpers
+// the guard-* family composes), exposed on the public surface as
+// b.codepointClass — so this composes a single source of truth instead of a
+// second copy of the tables.
+var codepointClass = b.codepointClass;
 
 // ---- shop validators ----------------------------------------------------
 

package/lib/vendors.js

@@ -615,7 +615,16 @@ function create(opts) {
           [vendorSlug, sku, ts],
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (vendor_skus.sku) — if the row now exists, a concurrent assign
+        // claimed the SKU; otherwise the insert failed for another reason,
+        // so re-throw.
+        var clash = await query(
+          "SELECT vendor_slug FROM vendor_skus WHERE sku = ?1", [sku],
+        );
+        if (clash.rows.length) {
           var raced = new Error("vendors.assignSku: sku " + JSON.stringify(sku) + " is already assigned");
           raced.code = "VENDOR_SKU_TAKEN";
           throw raced;

package/lib/webhook-receiver.js

@@ -704,12 +704,21 @@ function create(opts) {
           [eventId, slug, idempotencyKey, bodySha, bodyBytes.length, nowMs],
         );
       } catch (e) {
-        // The UNIQUE(source_slug, idempotency_key) constraint races
-        // when two deliveries with the same key arrive simultaneously
-        // — the second insert collapses to a replay rather than a
-        // hard error. The caller saw a successful verify; we treat
-        // the late-arriving duplicate as a benign replay.
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1 && idempotencyKey != null) {
+        // The UNIQUE(source_slug, idempotency_key) constraint races when two
+        // deliveries with the same key arrive simultaneously — the second
+        // insert collapses to a replay rather than a hard error.
+        //
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite, where the full
+        // text survives). On ANY insert error we re-read the (source_slug,
+        // idempotency_key) row: if it now exists the failure WAS the UNIQUE
+        // race, so we collapse to a benign replay; if it does not exist the
+        // insert failed for another reason and we re-throw the original error.
+        // The idempotencyKey != null guard stays — a row with a NULL key has
+        // no unique slot to replay onto.
+        if (idempotencyKey != null) {
           var late = await query(
             "SELECT id FROM webhook_received_events " +
             "WHERE source_slug = ?1 AND idempotency_key = ?2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.95",
+  "version": "0.4.97",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {