rerobe-js-orm 4.9.15 → 4.9.17

package/lib/constants/order-constants.js

@@ -36,8 +36,9 @@ exports.SALES_CHANNELS = {
 };
 // Point-of-sale / in-person channels: the customer is handed the goods at the
 // moment of sale, so every item is fulfilled at sale time (there is no separate
-// fulfillment step, and no per-item fulfillment record is created).
-exports.POS_SALES_CHANNELS = [exports.SALES_CHANNELS.ribbnWebPOS, exports.SALES_CHANNELS.ribbnMobilePOS];
+// fulfillment step, and no per-item fulfillment record is created). `store` is a
+// legacy in-person store-sale channel, treated the same.
+exports.POS_SALES_CHANNELS = [exports.SALES_CHANNELS.ribbnWebPOS, exports.SALES_CHANNELS.ribbnMobilePOS, exports.SALES_CHANNELS.store];
 exports.FULFILLMENT_TYPES = {
     fulfilled: 'FULFILLED',
     partiallyFulfilled: 'PARTIALLY_FULFILLED',

package/lib/helpers/OrderHelpers.js

@@ -828,10 +828,28 @@ class OrderHelpers {
         const timeBucket = this.generateTimeBucket(order.createdAtTimestamp || Date.now(), timeBucketMinutes);
         // Create a hash of line items - what is being ordered
         const lineItemsHash = this.generateLineItemsHash(order.lineItems || []);
+        // Payment anchor - the Stripe-issued PaymentIntent id, present once the order
+        // is paid. Including it gives two genuinely-distinct sales of an IDENTICAL
+        // cart different keys (different PaymentIntents), so a rapid, legitimate
+        // re-sale of the same stocked SKU is not mistaken for a duplicate — while
+        // retries of the SAME payment still collapse to one key. Omitted (filtered out
+        // below) when absent, so unpaid / offline orders keep the pure content + time
+        // fingerprint and behave exactly as before. Unlike id / shopifyId /
+        // orderNumber, the PaymentIntent id is Stripe-issued (not a client-forgeable
+        // arbitrary value), so it cannot be used to bypass idempotency.
+        const paymentIntentId = order.paymentIntentId || '';
         // Combine all fields into a consistent string
         // Note: We explicitly exclude client-generated IDs (id, shopifyId, orderNumber)
         // since clients control these and could bypass idempotency protection
-        const keyComponents = [customerEmail, totalAmount, currencyCode, merchantId, timeBucket, lineItemsHash];
+        const keyComponents = [
+            customerEmail,
+            totalAmount,
+            currencyCode,
+            merchantId,
+            timeBucket,
+            lineItemsHash,
+            paymentIntentId,
+        ];
         // Filter out empty values and join
         const keyString = keyComponents.filter((component) => component && String(component).trim().length > 0).join('|');
         // Generate SHA-256 hash for consistent length and uniqueness

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rerobe-js-orm",
-  "version": "4.9.15",
+  "version": "4.9.17",
   "description": "ReRobe's Javascript ORM Framework",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",