@tokenoftrust/storefront-runner 2.4.49 → 2.4.50

package/apps/storefront/src/components/islands/CheckoutComplianceGate.tsx

@@ -1,15 +1,11 @@
 /**
- * <CheckoutComplianceGate> — the storefront's pre-handoff compliance ENFORCEMENT
- * seam for regulated (age/nicotine) tenants.
+ * <CheckoutComplianceGate> — browser preflight for a regulated add-to-cart submit.
  *
- * Checkout completion happens in the EXTERNAL managed cart, so the last moment the
- * storefront controls is the add-to-cart submit. This island intercepts that
- * submit for any `form[data-managed-cart]`, collects the ship-to state + 21+
- * affirmation, and asks the server-authoritative gate (`/api/compliance/preflight`,
- * F12) whether the cart may proceed. Only a `clear` decision releases the handoff;
- * a hard block (restricted destination, flavored ban, per-order limit, failed /
- * unconfigured verification) STOPS it and shows why. Fail-closed by construction:
- * if the preflight itself errors on a regulated tenant, we do NOT hand off.
+ * The dialog collects the ship-to state and the age affirmation, then asks
+ * `/api/compliance/preflight` whether this browser may submit the form. Only a
+ * server `clear` releases that submit. A hard block (restricted destination,
+ * flavored ban, per-order limit, failed or unconfigured verification) stops it.
+ * If the preflight cannot be read, the dialog does not submit.
  *
  * On a tenant wired to the LIVE Token of Trust verification provider, preflight
  * additionally echoes a `verification` block (ref / provider status / continuation
@@ -18,15 +14,13 @@
  * continuation URL in a new tab, then re-read the SERVER's decision on an interval
  * until it clears or denies. Sandbox / no-provider tenants never receive the block
  * and see exactly the flow they always did. The client never decides a pass:
- * `decision.status === "clear"` from the server is the only thing that releases the
- * handoff, here as everywhere else. See `checkoutVerificationFlow.ts`.
+ * `decision.status === "clear"` from the server is the only thing that releases
+ * the submit. See `checkoutVerificationFlow.ts`.
  *
- * This is progressive enhancement: the underlying form still posts the real
- * (server-pre-signed) cart fields. If this island never hydrates, the form submits
- * as before — so the gate hardens the flow without being a single point of failure
- * for rendering the buy button. The REAL production enforcement is defense-in-depth
- * in the managed-cart pre-cart webhook (Track B); this is the storefront-side check
- * and the demo/preview's visible compliance checkpoint.
+ * This preflight is browser UX. It is not payment authorization. A `clear`
+ * decision only lets the native form submit; the server checks the cart again
+ * and never treats this dialog as authority to take payment. If the island
+ * never hydrates, or scripts are disabled, the form posts on its own.
  */
 import { useCallback, useEffect, useRef, useState } from "preact/hooks";
 import type { CartComplianceDecision } from "@tot/public-runtime";
@@ -177,11 +171,12 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
   const proceed = useCallback((line: PendingLine) => {
     stopPolling();
     clearStoredRef(verificationRefKey(preflightUrl, line));
+    // UX latch so this dialog does not intercept the resubmit. Not payment
+    // authority — the form's server action checks the cart.
     line.form.dataset.complianceCleared = "1";
+    line.form.dataset.paymentAuthority = "none";
     document.documentElement.style.overflow = "";
     setPending(null);
-    // requestSubmit re-runs submit; our listener now passes it through, and the
-    // managed-cart loader takes over the (still server-pre-signed) POST.
     if (typeof line.form.requestSubmit === "function") line.form.requestSubmit();
     else line.form.submit();
   }, [preflightUrl, stopPolling]);
@@ -377,6 +372,7 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
     <div
       class="fixed inset-0 z-[110] bg-[color-mix(in_srgb,var(--color-text)_75%,transparent)] backdrop-blur-sm"
       role="dialog"
+      data-payment-authority="none"
       aria-modal="true"
       aria-labelledby="cgate-title"
       onClick={(e) => {

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -24,7 +24,11 @@
  * wins; this only fills in when `commerce.checkout` is absent.
  */
 import type { TenantConfig, ResolvedManagedCheckout } from "@tot/public-runtime";
-import { resolveManagedCheckout, SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
+import {
+  CART_SIGNING_OPERATOR_ERROR,
+  resolveManagedCheckout,
+  SHARED_DEMO_CHECKOUT,
+} from "@tot/public-runtime";
 import { readEnv } from "@/lib/runtimeEnv";
 
 /**
@@ -86,6 +90,8 @@ export async function readCartSecret(
 export interface CartSigningResolution {
   enabled: boolean;
   secret?: string;
+  /** Set when signed mode has no secret. Actionable for the operator. No secret value. */
+  operatorError?: string;
 }
 
 /**
@@ -108,5 +114,5 @@ export async function resolveCartSigning(
     "[storefront] signed checkout is configured but FOXY_CART_SECRET is missing — " +
       "buy forms disabled (fail-closed). Set the cart-validation secret for this environment.",
   );
-  return { enabled: false };
+  return { enabled: false, operatorError: CART_SIGNING_OPERATOR_ERROR };
 }

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -18,8 +18,15 @@
  *     unattributed response; the handoff proceeds, checkout is never blocked.
  */
 import type { APIContext } from "astro";
-import { parseConsentSnapshot, defaultConsentSnapshot } from "@tot/public-runtime";
+import {
+  enforceCartSubmission,
+  foxyCartRedirectUrl,
+  parseConsentSnapshot,
+  defaultConsentSnapshot,
+  type CartDenialCode,
+} from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
+import { resolveCartSigning } from "@/lib/checkoutCommerce";
 
 export const prerender = false;
 
@@ -38,7 +45,78 @@ interface HandoffBody {
   consent?: unknown;
 }
 
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (ch) => {
+    if (ch === "&") return "&amp;";
+    if (ch === "<") return "&lt;";
+    if (ch === ">") return "&gt;";
+    if (ch === '"') return "&quot;";
+    return "&#39;";
+  });
+}
+
+function cartDenial(code: CartDenialCode, message: string, status: number): Response {
+  const body =
+    `<!doctype html><html><body><p data-cart-denial="${code}" data-payment-authorized="false">${escapeHtml(message)}</p></body></html>`;
+  return new Response(body, {
+    status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-tot-payment-authorized": "false",
+    },
+  });
+}
+
+function isCartForm(request: Request): boolean {
+  const type = request.headers.get("content-type") ?? "";
+  return (
+    type.includes("application/x-www-form-urlencoded") ||
+    type.includes("multipart/form-data")
+  );
+}
+
+/** Native cart POST. Browser preflight is not consulted. Payment is never authorized. */
+async function cartFormPost(context: APIContext): Promise<Response> {
+  const { tenant, commerce } = context.locals;
+  if (!commerce) {
+    return cartDenial(
+      "signing-unavailable",
+      "Checkout is unavailable because this store has no cart configured.",
+      409,
+    );
+  }
+  const signing = await resolveCartSigning(commerce);
+  if (!signing.enabled) {
+    return cartDenial("signing-unavailable", signing.operatorError ?? "Signed checkout is unavailable.", 503);
+  }
+  const form = await context.request.formData();
+  const entries: Array<[string, string]> = [];
+  for (const [name, value] of form.entries()) {
+    if (typeof value === "string") entries.push([name, value]);
+  }
+  const result = await enforceCartSubmission({
+    entries,
+    mode: commerce.mode,
+    secret: signing.secret,
+    trustedTenantId: tenant.tenant_id,
+  });
+  if (!result.ok) {
+    const status = result.code === "signing-unavailable" ? 503 : 422;
+    return cartDenial(result.code, result.message, status);
+  }
+  return new Response(null, {
+    status: 303,
+    headers: {
+      location: foxyCartRedirectUrl(commerce.cartUrl, result.fields),
+      "cache-control": "no-store",
+      "x-tot-payment-authorized": "false",
+    },
+  });
+}
+
 export async function POST(context: APIContext): Promise<Response> {
+  if (isCartForm(context.request)) return cartFormPost(context);
   const { tenant, browserEnvironment, commerce } = context.locals;
 
   // No managed checkout on this tenant → nothing to attribute.

package/apps/storefront/src/pages/products/[handle].astro

@@ -21,7 +21,9 @@ import ReviewSummary from "@/components/commerce/ReviewSummary.astro";
 import ReviewList from "@/components/commerce/ReviewList.astro";
 import { isOnSale, isNew, isAvailable, fromPrice } from "@/lib/tot/query";
 import {
-  buildMemberSignedCartPayload,
+  buildVariantCartPayload,
+  priceForPurchaseOption,
+  workerCartApiPath,
   normalizePurchaseOptions,
   visiblePurchaseOptions,
   isAutopilotEnabled,
@@ -208,6 +210,13 @@ const autopilotEnabled = isAutopilotEnabled(tenant.commerce?.autopilot);
 // list/subscription price; a Phase-2 member request signs their member price.
 const pricingCtx: PurchaseOptionPricingContext = { member, program: membershipProgram };
 
+const cartApiPath = workerCartApiPath({
+  provider: tenant.serving?.provider ?? "worker-r2-pointer",
+  phase: Astro.locals.browserEnvironment.environment === "live" ? "publication" : "preview",
+  apiBasePath,
+  endpoint: "/api/commerce/checkout-handoff",
+});
+
 let checkoutCart:
   | {
       action: string;
@@ -215,12 +224,15 @@ let checkoutCart:
       byVariantId: Record<string, Record<string, VariantCartPayload>>;
     }
   | undefined;
+let cartOperatorError: string | undefined;
 if (commerce) {
   // Fail closed for production signed checkout: a signed tenant with no
   // cart-validation secret builds NO cart (never a tamperable form). See
   // resolveCartSigning — it also logs the misconfiguration loudly.
-  const { enabled, secret } = await resolveCartSigning(commerce);
-  if (enabled) {
+  const signing = await resolveCartSigning(commerce);
+  if (!signing.enabled) {
+    cartOperatorError = signing.operatorError;
+  } else {
     try {
       const purchaseOptions = visiblePurchaseOptions(
         normalizePurchaseOptions(product),
@@ -230,33 +242,41 @@ if (commerce) {
         product.variants.map(
           async (v) => {
             const payloads = await Promise.all(
-              purchaseOptions.map(
-                async (purchaseOption) =>
-                  [
-                    purchaseOption.id,
-                    await buildMemberSignedCartPayload(product, v, {
-                      mode: commerce.mode,
-                      secret,
-                      purchaseOption,
-                      pricing: pricingCtx,
-                      autopilotEnabled,
-                    }),
-                  ] as const,
-              ),
+              purchaseOptions.map(async (purchaseOption) => {
+                const effective = priceForPurchaseOption(
+                  v.price,
+                  purchaseOption,
+                  pricingCtx,
+                );
+                return [
+                  purchaseOption.id,
+                  await buildVariantCartPayload(product, v, {
+                    mode: commerce.mode,
+                    secret: signing.secret,
+                    purchaseOption,
+                    signedPrice: effective.price,
+                    autopilotEnabled,
+                    tenantId: tenant.tenant_id,
+                  }),
+                ] as const;
+              }),
             );
             return [v.id, Object.fromEntries(payloads)] as const;
           },
         ),
       );
       checkoutCart = {
-        action: commerce.cartUrl,
+        action: cartApiPath,
         purchaseOptions,
         byVariantId: Object.fromEntries(entries),
       };
     } catch (err) {
+      cartOperatorError =
+        err instanceof Error && err.name === "CartSigningUnavailableError"
+          ? err.message
+          : undefined;
       console.warn(
         `[storefront] Invalid checkout purchase options for ${product.handle}; cart disabled for this product.`,
-        err,
       );
     }
   }
@@ -368,8 +388,15 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
         </div>
       )}
 
-      {/* Variant selector island owns live price/SKU/availability + buy CTA. */}
-      <div class="mt-7">
+      {/* Variant selector island owns live price/SKU/availability + buy CTA.
+          The form action is the worker cart route, so a native submit reaches
+          the server check. A clear browser preflight is not payment authority. */}
+      <div class="mt-7" data-payment-authority="none">
+        {cartOperatorError && (
+          <p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>
+            {cartOperatorError}
+          </p>
+        )}
         <VariantSelector
           client:load
           variants={publicSelectorVariants(product.variants)}
@@ -380,7 +407,7 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
           productTitle={product.title}
           checkoutCart={checkoutCart}
           pricing={pricing}
-          handoffUrl={withBase(apiBasePath, "/api/commerce/checkout-handoff")}
+          handoffUrl={cartApiPath}
         />
         {/* Regulated-tenant checkout ENFORCEMENT gate. Intercepts the
             managed-cart handoff to clear age + ship-to compliance server-side

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.49",
+  "version": "2.4.50",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -129,10 +129,116 @@ export interface BuildVariantCartPayloadOptions {
    * — subscriptions visible) so existing callers are unaffected.
    */
   autopilotEnabled?: boolean;
+  /**
+   * Tenant id from the request's authenticated context (`locals.tenant`).
+   * Signed into the cart when present. Never taken from the submitted form.
+   */
+  tenantId?: string;
+}
+
+/** Declared public serving substrate (ADR 0013 `serving.provider`). */
+export type CartRouteProvider = "worker-r2-pointer" | "s3-overwrite";
+
+/** Preview is any non-live stage. Publication is the live public site. */
+export type CartRoutePhase = "preview" | "publication";
+
+export const CART_API_ENDPOINT = "/api/commerce/checkout-handoff";
+
+/** Inclusive upper bound for a cart line quantity. */
+export const MAX_CART_QUANTITY = 99;
+
+export const CART_SIGNING_OPERATOR_ERROR =
+  "Signed checkout is unavailable: set FOXY_CART_SECRET (the cart secret) for this environment. No cart was signed.";
+
+export type CartDenialCode =
+  | "signature"
+  | "price"
+  | "quantity"
+  | "tenant"
+  | "signing-unavailable";
+
+export class CartSigningUnavailableError extends Error {
+  readonly code = "signing-unavailable" as const;
+  constructor() {
+    super(CART_SIGNING_OPERATOR_ERROR);
+    this.name = "CartSigningUnavailableError";
+  }
 }
 
 const DEFAULT_CHECKOUT_HOST_SUFFIX = ".foxycart.com";
 const SUBSCRIPTION_FREQUENCY_RE = /^(?:\d+(?:\.\d+)?|\.\d+)[dwmy]$/;
+const PREVIEW_PIN_RE = /\/preview\/(?:staged|candidate)(?:\/|$)/;
+const UNSIGNED_PREFIXES = ["h:", "x:", "__", "utm_"] as const;
+
+/**
+ * Cart line name. The product title is the line. A multi-variant product appends
+ * the variant title unless that title is the placeholder "Default Title".
+ */
+export function cartLineName(
+  product: CatalogProduct,
+  variant: CatalogVariant,
+): string {
+  const productTitle = product.title.trim();
+  const variantTitle = variant.title.trim();
+  const generic =
+    variantTitle.length === 0 || variantTitle.toLowerCase() === "default title";
+  if (product.variants.length > 1 && !generic) {
+    return `${productTitle} — ${variantTitle}`;
+  }
+  return productTitle || variantTitle;
+}
+
+/** Drop a preview pin if one was passed as the API prefix. */
+export function unpinnedApiBase(apiBasePath: string): string {
+  const trimmed = apiBasePath.trim().replace(/\/+$/, "");
+  const idx = trimmed.search(PREVIEW_PIN_RE);
+  if (idx === -1) return trimmed;
+  return trimmed.slice(0, idx).replace(/\/+$/, "");
+}
+
+/**
+ * Worker route for a cart API call. Preview (both providers) and Cloudflare
+ * publication use the unpinned tenant prefix. CloudFront publication uses a
+ * root `/api/...` path, which is the declared CDN behavior. Never a preview pin
+ * and never a public-page origin.
+ */
+export function workerCartApiPath(input: {
+  provider: CartRouteProvider;
+  phase: CartRoutePhase;
+  apiBasePath: string;
+  endpoint?: string;
+}): string {
+  const endpoint = input.endpoint ?? CART_API_ENDPOINT;
+  if (!endpoint.startsWith("/api/") || endpoint.includes("?") || endpoint.includes("#")) {
+    throw new Error("workerCartApiPath: endpoint must be an /api path");
+  }
+  if (PREVIEW_PIN_RE.test(endpoint)) {
+    throw new Error("workerCartApiPath: endpoint must not include a preview pin");
+  }
+  if (input.phase === "publication" && input.provider === "s3-overwrite") {
+    return endpoint;
+  }
+  return `${unpinnedApiBase(input.apiBasePath)}${endpoint}`;
+}
+
+/** True when `path` is a worker-routed cart API path for this provider and phase. */
+export function cartApiReachesWorker(
+  path: string,
+  input: { provider: CartRouteProvider; phase: CartRoutePhase },
+): boolean {
+  const pathname = path.replace(/^https?:\/\/[^/]+/, "").split("?")[0] ?? "";
+  if (PREVIEW_PIN_RE.test(pathname)) return false;
+  if (input.phase === "publication" && input.provider === "s3-overwrite") {
+    return /^\/api\/.+/.test(pathname);
+  }
+  return /^(?:\/[^/]+)?\/api\/.+/.test(pathname);
+}
+
+export function quantityAllowed(value: string): boolean {
+  if (!/^[1-9]\d*$/.test(value)) return false;
+  const n = Number(value);
+  return n >= 1 && n <= MAX_CART_QUANTITY;
+}
 
 /** Resolve the full request-scoped commerce facts from a tenant's config. */
 export function resolveManagedCheckout(
@@ -160,7 +266,7 @@ export function cartFieldsForVariant(
   product: CatalogProduct,
   variant: CatalogVariant,
   purchaseOption?: ProductPurchaseOption,
-  opts?: { signedPrice?: number },
+  opts?: { signedPrice?: number; tenantId?: string },
 ): { code: string; fields: CartField[] } {
   const code = variant.sku && variant.sku.length ? variant.sku : variant.id;
   const image = product.images.find((i) => i.id === variant.image_id)?.url ??
@@ -172,12 +278,19 @@ export function cartFieldsForVariant(
     opts?.signedPrice !== undefined
       ? assertEffectivePrice(opts.signedPrice, variant.price)
       : purchaseOptionPrice(variant.price, purchaseOption);
+  if (!variant.currency) {
+    throw new Error("cartFieldsForVariant: variant currency is required");
+  }
   const fields: CartField[] = [
-    { name: "name", value: variant.title || product.title },
+    { name: "name", value: cartLineName(product, variant) },
     { name: "price", value: price.toFixed(2) },
+    { name: "currency", value: variant.currency },
     { name: "code", value: code },
     { name: "quantity", value: "1", open: true },
   ];
+  if (opts?.tenantId) {
+    fields.push({ name: "tenant", value: opts.tenantId });
+  }
   if (image) fields.push({ name: "image", value: image });
   // Variant options (Flavor, Nicotine strength, …) travel as product options so
   // the cart line reflects the exact variant the shopper picked.
@@ -357,13 +470,11 @@ export async function buildVariantCartPayload(
     product,
     variant,
     opts.purchaseOption,
-    { signedPrice: opts.signedPrice },
+    { signedPrice: opts.signedPrice, tenantId: opts.tenantId },
   );
   const signed = opts.mode === "signed";
   if (signed && !opts.secret) {
-    throw new Error(
-      "buildVariantCartPayload: signed mode requires a cart secret",
-    );
+    throw new CartSigningUnavailableError();
   }
 
   const rendered: RenderedCartField[] = signed
@@ -376,3 +487,158 @@ export async function buildVariantCartPayload(
   const hidden = rendered.filter((_, i) => i !== qtyIdx);
   return { hidden, quantityName };
 }
+
+const CART_DENIAL_MESSAGE: Record<CartDenialCode, string> = {
+  signature: "Checkout was refused because the cart signature does not match.",
+  price: "Checkout was refused because the price does not match the signed price.",
+  quantity: "Checkout was refused because the quantity is not an allowed amount.",
+  tenant: "Checkout was refused because the cart tenant does not match this store.",
+  "signing-unavailable": CART_SIGNING_OPERATOR_ERROR,
+};
+
+export interface CartSubmissionField {
+  name: string;
+  value: string;
+}
+
+export type CartEnforcement =
+  | { ok: true; fields: CartSubmissionField[]; paymentAuthorized: false }
+  | { ok: false; code: CartDenialCode; message: string; paymentAuthorized: false };
+
+interface ParsedCartField {
+  rawName: string;
+  baseName: string;
+  value: string;
+  hash?: string;
+  open: boolean;
+  passthrough: boolean;
+}
+
+function isPassthroughName(name: string): boolean {
+  return UNSIGNED_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+
+function parseSubmittedField(rawName: string, value: string): ParsedCartField {
+  if (isPassthroughName(rawName)) {
+    return { rawName, baseName: rawName, value, open: false, passthrough: true };
+  }
+  const parts = rawName.split("||");
+  if (parts.length === 3 && parts[2] === "open") {
+    return {
+      rawName,
+      baseName: parts[0] ?? "",
+      value,
+      hash: parts[1],
+      open: true,
+      passthrough: false,
+    };
+  }
+  if (parts.length === 2) {
+    return {
+      rawName,
+      baseName: parts[0] ?? "",
+      value,
+      hash: parts[1],
+      open: false,
+      passthrough: false,
+    };
+  }
+  return { rawName, baseName: rawName, value, open: false, passthrough: false };
+}
+
+function denial(code: CartDenialCode): CartEnforcement {
+  return {
+    ok: false,
+    code,
+    message: CART_DENIAL_MESSAGE[code],
+    paymentAuthorized: false,
+  };
+}
+
+function specificCode(baseName: string): CartDenialCode {
+  if (baseName === "price") return "price";
+  if (baseName === "quantity") return "quantity";
+  if (baseName === "tenant") return "tenant";
+  return "signature";
+}
+
+/**
+ * Server cart check. A browser preflight result is not an input and cannot
+ * authorize payment. Tenant is compared to the trusted request tenant. Price,
+ * quantity, and signature failures are distinct. The returned fields are what
+ * may be handed to the cart; `paymentAuthorized` is always false.
+ */
+export async function enforceCartSubmission(input: {
+  entries: Iterable<[string, string]>;
+  mode: ManagedCheckoutConfig["mode"];
+  secret?: string;
+  trustedTenantId: string;
+}): Promise<CartEnforcement> {
+  if (input.mode === "signed" && !input.secret) return denial("signing-unavailable");
+  if (!input.trustedTenantId) return denial("tenant");
+
+  const parsed = [...input.entries].map(([name, value]) => parseSubmittedField(name, value));
+  const byBase = new Map<string, ParsedCartField>();
+  for (const field of parsed) {
+    if (field.passthrough) continue;
+    if (byBase.has(field.baseName)) return denial("signature");
+    byBase.set(field.baseName, field);
+  }
+
+  const codeField = byBase.get("code");
+  if (!codeField || !codeField.value) return denial("signature");
+
+  const failures = new Set<CartDenialCode>();
+  const signed = input.mode === "signed";
+  const secret = input.secret ?? "";
+
+  const hashOk = async (field: ParsedCartField): Promise<boolean> => {
+    if (!field.hash) return false;
+    const valueToHash = field.open ? "--OPEN--" : field.value;
+    const expected = await hmacHex(secret, codeField.value + field.baseName + valueToHash);
+    return expected === field.hash;
+  };
+
+  if (signed) {
+    if (!(await hashOk(codeField))) failures.add("signature");
+    for (const field of byBase.values()) {
+      if (field.baseName === "code") continue;
+      if (!(await hashOk(field))) failures.add(specificCode(field.baseName));
+    }
+  }
+
+  const tenantField = byBase.get("tenant");
+  if (!tenantField || tenantField.value !== input.trustedTenantId) {
+    failures.add("tenant");
+  }
+  const priceField = byBase.get("price");
+  if (!priceField || !/^\d+\.\d{2}$/.test(priceField.value)) failures.add("price");
+  const quantityField = byBase.get("quantity");
+  if (!quantityField || !quantityAllowed(quantityField.value)) failures.add("quantity");
+  if (signed) {
+    for (const required of ["name", "currency"]) {
+      if (!byBase.get(required)) failures.add("signature");
+    }
+  }
+
+  const order: CartDenialCode[] = ["tenant", "price", "quantity", "signature"];
+  for (const code of order) {
+    if (failures.has(code)) return denial(code);
+  }
+
+  return {
+    ok: true,
+    paymentAuthorized: false,
+    fields: parsed.map((field) => ({ name: field.rawName, value: field.value })),
+  };
+}
+
+/** Cart URL the browser may navigate to after enforcement. Not a payment. */
+export function foxyCartRedirectUrl(
+  cartUrl: string,
+  fields: readonly CartSubmissionField[],
+): string {
+  const url = new URL(cartUrl);
+  for (const field of fields) url.searchParams.append(field.name, field.value);
+  return url.toString();
+}