@blamejs/blamejs-shop 0.4.96 → 0.4.98

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.98 (2026-06-25) — **A concurrent vendor registration with the same slug now returns a typed duplicate error instead of leaking a raw database error.** Registering a vendor checks whether the slug is already taken before inserting, then inserts. Two registrations of the same slug racing each other can both pass that pre-check, so the second insert collides on the slug primary key. That insert had no failure handling, so the raw database error surfaced — and in production, where the data layer redacts it to a generic 'HTTP 500', the caller got an opaque error rather than the typed 'slug already registered' it gets from the pre-check. The insert is now wrapped: on any failure it re-reads by slug, and if a row exists it raises the same typed duplicate error the pre-check raises, otherwise it re-throws. No configuration changes. **Fixed:** *Racing vendor registrations surface a typed duplicate error, not a raw 500* — vendors.registerVendor pre-checks the slug and then inserts, but a concurrent registration of the same slug can slip past the pre-check and collide on the slug primary key. The insert is now wrapped to detect that state-agnostically — re-reading by slug after a failure and raising the same typed VENDOR_SLUG_TAKEN error the pre-check raises (rather than leaking the raw constraint error, which production redacts to a bare 500). Mirrors the assignSku duplicate handling.
+
+- v0.4.97 (2026-06-25) — **Constraint-collision handling no longer depends on the database error text, so duplicate detection works in production instead of only in tests.** Several write paths detected a UNIQUE (or related) constraint collision by matching the database error message — looking for the literal text 'UNIQUE constraint failed'. That text only survives in local/test runs: in production, the data layer redacts the underlying SQLite error to a generic 'HTTP 500' with no constraint text, so the match silently failed and the intended collision handling was skipped — the raw error surfaced instead of the idempotent replay, the typed duplicate error, the regenerate-and-retry, or the claim reuse. Every such site now detects the collision by re-reading state through the unique key after the insert fails: if the row is present the failure was the collision and the site runs its existing handling; if not, the original error is re-thrown. This makes idempotent webhook replays, duplicate-key errors, code/token retries, and discount-claim reuse behave correctly in production, not just under tests. No configuration changes. **Fixed:** *Constraint-collision detection is now state-based, not error-message-based* — Duplicate-delivery webhook replays (webhook receiver), duplicate-key errors (tenant domain + slug, vendor SKU), regenerate-and-retry on a code/token collision (referral codes, gift-redemption tokens, API keys, affiliate codes), and the auto-discount per-order claim reuse all decided 'was this a constraint collision?' by scanning the SQLite error message. Production redacts that message to a bare 'HTTP 500', so the check was blind there and the collision branch never ran. Each site now re-reads by its unique key after an insert error and runs its handling only when the row is actually present, re-throwing any other error — the same approach the gift-card and affiliate-commission ledgers already use. The admin error-to-response mapper, which has no single key to re-read, now prefers a typed constraint code over the message text where the driver provides one.
+
 - v0.4.96 (2026-06-25) — **Compose two newly-public framework primitives directly, removing an internal-path dependency and a drift-prone duplicate transition table.** Two internal refactors that adopt framework surface the application previously had to work around, with no change in behaviour. The text-guard module composed the framework's codepoint-threat catalog by reaching into an internal vendored module path, because the catalog was not on the framework's public surface; it now composes the public b.codepointClass (the same module, reference-identical), so a future framework refresh that moves the internal file can't break the import. The quotes module kept a hand-rolled loop that re-derived a quote's next status from a second copy of its transition table; it now resolves the destination through the state machine's own side-effect-free resolver, off the single transition definition, so the two can no longer drift apart. No configuration changes. **Changed:** *Text-guard composes the public codepoint-threat catalog* — The free-text guard built its bidi / control / null-byte / zero-width / mixed-script screening on the framework's codepoint catalog by requiring an internal vendored module path, since the catalog was not yet exported publicly. It now composes the public b.codepointClass — the identical module — so the screening no longer depends on an internal file location that an upstream refresh could relocate. · *Quote transitions resolve through the state machine instead of a duplicate table* — Validating a quote's lifecycle edge (respond / accept / reject / cancel / expire / convert) used the state machine to check the edge was legal, then a separate hand-rolled loop over a second copy of the transition table to read the destination status. The destination is now resolved by the state machine's own side-effect-free resolver, off the single transition definition the machine is built from, removing the duplicate table walk that could drift from it.
 
 - v0.4.95 (2026-06-25) — **An order state change no longer logs a phantom transition when it loses a concurrent race, and a transient failure writing the history row no longer strands a stock hold.** Advancing an order through its lifecycle reads the order's current status, resolves the next state, then writes it with an UPDATE guarded on the row still being in the state it was read in — so when two writers race the same order (the stale-order reaper cancelling while a payment webhook marks it paid), exactly one wins and the loser collapses to a no-op. Two issues in that path are fixed. First, the state machine's transition audit was emitted before the guarded write resolved, so a writer that LOST the race still recorded a 'success' transition into the audit trail for a state change that never landed; the audit is now written only for the writer that actually moved the row. Second, the denormalized history-row insert ran between the committed status write and the inventory settlement with no failure handling: a transient error writing that row aborted the whole call after the status had already advanced, so the stock hold was never converted to a shelf debit (or released) and a webhook retry — finding the order already advanced — skipped settlement entirely, stranding the hold. The history insert is now best-effort (the state-machine audit is the authoritative record), so a failure writing it never prevents the hold from settling. No configuration changes. **Changed:** *Vendored framework refreshed to 0.15.24* — Updates the vendored blamejs framework to 0.15.24, an upstream build supply-chain hardening release with no runtime API changes. No operator action required. **Fixed:** *A lost order-transition race no longer records a phantom 'success' in the audit trail* — The order state machine emitted its transition audit during the in-memory replay, before the guarded status write that decides the race. A writer that lost the race (its conditional update matched zero rows and it no-opped) had nonetheless already written a 'success' transition into the audit trail — a record an auditor could not tell apart from a real one. The destination state is now resolved side-effect-free, and the transition audit is emitted only after the guarded write wins, so the audit trail records exactly the transitions that actually landed. · *A transient failure writing an order's history row no longer strands its stock hold* — After an order's status write committed, the order_transitions history row was inserted with no failure handling, ahead of the inventory settlement. A transient error on that insert aborted the call with the order already advanced, so the held stock was never debited or released; a webhook retry then found the order past its starting state, no-opped at the concurrency guard, and skipped settlement — leaving the hold stranded with no automatic recovery. A history-row write failure no longer aborts settlement, so the hold always settles once the state change commits. Because that row is also where a PayPal capture id is recovered from, a write failure is not silently dropped: the row's full payload — including any capture metadata — is recorded to the durable error feed (and the audit chain) for reconciliation.

package/lib/admin.js

@@ -724,12 +724,23 @@ function _safeNotice(e, auditAction) {
     return { status: 400, code: "bad-request", message: "Invalid input." };
   }
   var msg = (e && e.message) || "";
-  if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
-    return /FOREIGN KEY/i.test(msg)
+  // Prefer a typed constraint code over message text: the production D1
+  // service-binding redacts the SQLite constraint string to a generic
+  // "HTTP 500", so a message regex is blind in prod (it only matches under
+  // node:sqlite). A generic, table-agnostic mapper has no UNIQUE key to
+  // re-read, so it can't use the state-agnostic re-read pattern the typed
+  // call sites use — it relies on `e.code` set by the caller / DB driver,
+  // falling back to the (test-only-reliable) message scan.
+  var sqlState = (e && (e.code || e.sqliteCode)) || "";
+  var isUnique  = sqlState === "SQLITE_CONSTRAINT_UNIQUE"     || sqlState === "UNIQUE"      || /UNIQUE constraint failed/i.test(msg);
+  var isForeign = sqlState === "SQLITE_CONSTRAINT_FOREIGNKEY" || sqlState === "FOREIGN_KEY" || /FOREIGN KEY constraint failed/i.test(msg);
+  var isCheckNN = sqlState === "SQLITE_CONSTRAINT_CHECK"      || sqlState === "SQLITE_CONSTRAINT_NOTNULL" || /(?:CHECK|NOT NULL) constraint failed/i.test(msg);
+  if (isUnique || isForeign) {
+    return isForeign
       ? { status: 409, code: "conflict", message: "A referenced record does not exist." }
       : { status: 409, code: "conflict", message: "That value is already in use." };
   }
-  if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
+  if (isCheckNN) {
     return { status: 400, code: "bad-request", message: "A required value is missing or invalid." };
   }
   // Genuine unknown error — record it server-side via the framework audit

package/lib/affiliates.js

@@ -474,7 +474,17 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite). Re-read by the
+        // colliding UNIQUE key (`code`): if a row now holds the code we tried,
+        // the failure WAS the collision, so loop and regenerate; if no such
+        // row exists the insert failed for another reason, so re-throw.
+        var clash = await query(
+          "SELECT id FROM affiliates WHERE code = ?1", [row.code]
+        );
+        if (!clash.rows.length) throw e;
       }
     }
     if (lastErr) throw lastErr;

package/lib/api-keys.js

@@ -352,7 +352,17 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite). Re-read by the
+        // colliding UNIQUE key (`token_hash`): if a row now holds this hash the
+        // failure WAS the collision, so regenerate and retry; otherwise the
+        // insert failed for another reason, so re-throw.
+        var clash = await query(
+          "SELECT id FROM api_keys WHERE token_hash = ?1", [row.token_hash]
+        );
+        if (!clash.rows.length) throw e;
         // Regenerate on collision.
         plaintext           = _generateToken();
         row.token_hash      = _hashToken(plaintext);

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.96",
+  "version": "0.4.98",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/auto-discount.js

@@ -1275,17 +1275,25 @@ function create(opts) {
       // a claim from a prior attempt whose rollback didn't complete —
       // reuse it (its counter reservation was already paid), after
       // returning the increment this call just took.
-      if (/UNIQUE constraint failed/i.test((e && e.message) || "")) {
+      //
+      // State-agnostic collision detection — never error-message matching.
+      // The production D1 service-binding redacts the SQLite "UNIQUE
+      // constraint failed" text to a generic "HTTP 500", so a message regex
+      // is blind in prod (it only matches under node:sqlite). Re-read by the
+      // colliding UNIQUE key (rule_slug, order_id): if a row now exists the
+      // failure WAS the collision, so reuse it; otherwise the insert failed
+      // for another reason, so re-throw (without returning the increment).
+      var held = (await query(
+        "SELECT id FROM auto_discount_applications WHERE rule_slug = ?1 AND order_id = ?2",
+        [slug, claimRef],
+      )).rows[0];
+      if (held) {
         await query(
           "UPDATE auto_discount_rules SET redemptions_used = " +
           "CASE WHEN redemptions_used > 0 THEN redemptions_used - 1 ELSE 0 END, updated_at = ?1 WHERE slug = ?2",
           [_now(), slug],
         );
-        var held = (await query(
-          "SELECT id FROM auto_discount_applications WHERE rule_slug = ?1 AND order_id = ?2",
-          [slug, claimRef],
-        )).rows[0];
-        return { claimed: true, id: held ? held.id : null, reused: true };
+        return { claimed: true, id: held.id, reused: true };
       }
       throw e;
     }

package/lib/referral-leaderboard.js

@@ -476,26 +476,29 @@ function create(opts) {
           [id, customerId, tier, periodLabel, pointsBudget, ts],
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
-          // Lost the race to a concurrent caller — return their row.
-          var raced = await query(
-            "SELECT id, customer_id, tier, period_label, points_awarded, occurred_at " +
-            "FROM referral_leaderboard_bonuses " +
-            "WHERE customer_id = ?1 AND period_label = ?2 AND tier = ?3 LIMIT 1",
-            [customerId, periodLabel, tier],
-          );
-          if (raced.rows.length) {
-            var rr = raced.rows[0];
-            return {
-              id:             rr.id,
-              customer_id:    rr.customer_id,
-              tier:           rr.tier,
-              period_label:   rr.period_label,
-              points_awarded: Number(rr.points_awarded || 0),
-              occurred_at:    Number(rr.occurred_at || 0),
-              status:         "already-awarded",
-            };
-          }
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (customer_id, period_label, tier) — if the row now exists we lost
+        // the race to a concurrent caller, so return their row; otherwise
+        // the insert failed for another reason, so re-throw.
+        var raced = await query(
+          "SELECT id, customer_id, tier, period_label, points_awarded, occurred_at " +
+          "FROM referral_leaderboard_bonuses " +
+          "WHERE customer_id = ?1 AND period_label = ?2 AND tier = ?3 LIMIT 1",
+          [customerId, periodLabel, tier],
+        );
+        if (raced.rows.length) {
+          var rr = raced.rows[0];
+          return {
+            id:             rr.id,
+            customer_id:    rr.customer_id,
+            tier:           rr.tier,
+            period_label:   rr.period_label,
+            points_awarded: Number(rr.points_awarded || 0),
+            occurred_at:    Number(rr.occurred_at || 0),
+            status:         "already-awarded",
+          };
         }
         throw e;
       }

package/lib/referrals.js

@@ -260,8 +260,16 @@ function create(opts) {
           break;
         } catch (e) {
           lastErr = e;
-          // UNIQUE-violation: regenerate. Any other error propagates.
-          if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) {
+          // State-agnostic collision detection — never error-message
+          // matching. The production D1 service-binding redacts the
+          // SQLite "UNIQUE constraint failed" text to a generic "HTTP
+          // 500", so a message regex is blind in prod. Re-read the
+          // colliding `code`: if a row with that code now exists the
+          // failure WAS the UNIQUE race, so we regenerate and retry; if
+          // no such row exists the insert failed for another reason and
+          // we propagate. The cap (5 attempts) is unchanged.
+          var clash = await _codeRowByCode(code);
+          if (!clash) {
             throw e;
           }
         }

package/lib/subscription-gifts.js

@@ -385,7 +385,16 @@ function create(opts) {
         break;
       } catch (e) {
         lastErr = e;
-        if (!e || !e.message || e.message.indexOf("UNIQUE") === -1) throw e;
+        // State-agnostic collision detection — never error-message
+        // matching. The production D1 service-binding redacts the SQLite
+        // "UNIQUE constraint failed" text to a generic "HTTP 500", so a
+        // message regex is blind in prod. Re-read by the colliding
+        // token_hash: if a row with that hash now exists the failure WAS
+        // the UNIQUE race, so we regenerate the token and retry; if no
+        // such row exists the insert failed for another reason and we
+        // propagate. The cap (5 attempts) is unchanged.
+        var clash = await _getRawByTokenHash(tokenHash);
+        if (!clash) throw e;
       }
     }
     if (lastErr) throw lastErr;

package/lib/tenants.js

@@ -265,7 +265,17 @@ function create(opts) {
         [id, tenantId, domain, isPrimary ? 1 : 0, ts]
       );
     } catch (e) {
-      if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+      // State-agnostic collision detection: the production D1 service
+      // binding redacts the SQLite "UNIQUE constraint failed" text to a
+      // generic "HTTP 500", so a message regex is blind in prod. Re-read
+      // by the UNIQUE key (tenant_domains.domain is globally UNIQUE) — if
+      // the row now exists, the insert lost a duplicate-domain race; if
+      // not, the insert failed for another reason, so re-throw.
+      var clash = await query(
+        "SELECT 1 FROM tenant_domains WHERE domain = ?1 LIMIT 1",
+        [domain]
+      );
+      if (clash.rows.length) {
         var dupe = new Error("tenants: domain '" + domain + "' is already registered");
         dupe.code = "TENANT_DOMAIN_DUPLICATE";
         throw dupe;
@@ -337,7 +347,14 @@ function create(opts) {
           [id, slug, name, defaultCurrency, defaultLocale, themeSlug, status, ts]
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (tenants.slug) — if the row now exists, a concurrent define won
+        // the slug; otherwise the insert failed for another reason, so
+        // re-throw.
+        var clash = await _tenantBySlug(slug);
+        if (clash) {
           var slugDupe = new Error("tenants.defineTenant: slug '" + slug + "' is already registered");
           slugDupe.code = "TENANT_SLUG_DUPLICATE";
           throw slugDupe;

package/lib/vendors.js

@@ -398,19 +398,36 @@ function create(opts) {
       }
 
       var ts = _now();
-      await query(
-        "INSERT INTO vendors " +
-        "(slug, name, contact_email_hash, contact_email_normalised, " +
-        " contact_phone, address_json, payout_method, payout_address, " +
-        " commission_split_bps, status, paused_at, archived_at, " +
-        " created_at, updated_at) " +
-        "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, NULL, ?12, ?12)",
-        [
-          slug, name, emailHash, emailNorm, phone, addressJson,
-          payoutMethod, payoutAddr, splitBps, status,
-          status === "paused" ? ts : null, ts,
-        ],
-      );
+      try {
+        await query(
+          "INSERT INTO vendors " +
+          "(slug, name, contact_email_hash, contact_email_normalised, " +
+          " contact_phone, address_json, payout_method, payout_address, " +
+          " commission_split_bps, status, paused_at, archived_at, " +
+          " created_at, updated_at) " +
+          "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, NULL, ?12, ?12)",
+          [
+            slug, name, emailHash, emailNorm, phone, addressJson,
+            payoutMethod, payoutAddr, splitBps, status,
+            status === "paused" ? ts : null, ts,
+          ],
+        );
+      } catch (e) {
+        // The pre-check above can miss a CONCURRENT registration, and the
+        // production D1 service binding redacts the SQLite slug-PRIMARY-KEY
+        // constraint message to a generic "HTTP 500", so a message regex would
+        // be blind there. State-agnostic detection: re-read by the UNIQUE key
+        // (vendors.slug) — if the row now exists a racing register won, so
+        // surface the SAME typed duplicate the pre-check throws; otherwise the
+        // insert failed for another reason, so re-throw.
+        var raced = await _getVendorRaw(slug);
+        if (raced) {
+          var racedDupe = new Error("vendors.registerVendor: slug " + JSON.stringify(slug) + " already registered");
+          racedDupe.code = "VENDOR_SLUG_TAKEN";
+          throw racedDupe;
+        }
+        throw e;
+      }
       return _hydrateVendor(await _getVendorRaw(slug));
     },
 
@@ -615,7 +632,16 @@ function create(opts) {
           [vendorSlug, sku, ts],
         );
       } catch (e) {
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1) {
+        // State-agnostic collision detection: prod D1 redacts the SQLite
+        // "UNIQUE constraint failed" message to a generic "HTTP 500", so a
+        // message regex is blind there. Re-read by the UNIQUE key
+        // (vendor_skus.sku) — if the row now exists, a concurrent assign
+        // claimed the SKU; otherwise the insert failed for another reason,
+        // so re-throw.
+        var clash = await query(
+          "SELECT vendor_slug FROM vendor_skus WHERE sku = ?1", [sku],
+        );
+        if (clash.rows.length) {
           var raced = new Error("vendors.assignSku: sku " + JSON.stringify(sku) + " is already assigned");
           raced.code = "VENDOR_SKU_TAKEN";
           throw raced;

package/lib/webhook-receiver.js

@@ -704,12 +704,21 @@ function create(opts) {
           [eventId, slug, idempotencyKey, bodySha, bodyBytes.length, nowMs],
         );
       } catch (e) {
-        // The UNIQUE(source_slug, idempotency_key) constraint races
-        // when two deliveries with the same key arrive simultaneously
-        // — the second insert collapses to a replay rather than a
-        // hard error. The caller saw a successful verify; we treat
-        // the late-arriving duplicate as a benign replay.
-        if (e && e.message && e.message.indexOf("UNIQUE") !== -1 && idempotencyKey != null) {
+        // The UNIQUE(source_slug, idempotency_key) constraint races when two
+        // deliveries with the same key arrive simultaneously — the second
+        // insert collapses to a replay rather than a hard error.
+        //
+        // State-agnostic collision detection — never error-message matching.
+        // The production D1 service-binding redacts the SQLite "UNIQUE
+        // constraint failed" text to a generic "HTTP 500", so a message regex
+        // is blind in prod (it only matches under node:sqlite, where the full
+        // text survives). On ANY insert error we re-read the (source_slug,
+        // idempotency_key) row: if it now exists the failure WAS the UNIQUE
+        // race, so we collapse to a benign replay; if it does not exist the
+        // insert failed for another reason and we re-throw the original error.
+        // The idempotencyKey != null guard stays — a row with a NULL key has
+        // no unique slot to replay onto.
+        if (idempotencyKey != null) {
           var late = await query(
             "SELECT id FROM webhook_received_events " +
             "WHERE source_slug = ?1 AND idempotency_key = ?2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.96",
+  "version": "0.4.98",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {