@tokenoftrust/storefront-runner 2.4.51 → 2.4.53

package/apps/storefront/src/lib/admin/viewmodels/orders.ts

@@ -8,6 +8,9 @@
 
 export type OrderPaymentState = "authorized" | "captured" | "refunded";
 
+/** Display risk. `unknown` is absent evidence, not a low-risk clearance. */
+export type OrderRiskLevel = "low" | "medium" | "high" | "unknown";
+
 export type OrderShipState = "ready_to_ship" | "hold_review_required" | "unfulfilled" | "completed";
 
 /** The exact merchant-facing language the shell contract requires. */
@@ -54,7 +57,35 @@ export interface OrderRow {
   shipState: OrderShipState;
   blocker: string | null;
   nextStep: string;
-  riskLevel: "low" | "medium" | "high";
+  riskLevel: OrderRiskLevel;
+}
+
+/** One independent readiness fact. Source and as-of belong to this column only. */
+export interface OrderReadinessColumn {
+  key: "payment" | "tax" | "verification" | "risk" | "stock" | "fulfillment";
+  state: string;
+  source: string;
+  asOf: string | null;
+}
+
+/** Release is held unless every block is empty. `held` is not inferred from payment capture. */
+export interface OrderRelease {
+  state: "held" | "ready";
+  ready: boolean;
+  blocks: readonly string[];
+}
+
+/** Storewide, filtered, and page money are separate scopes. Refunds are not values. */
+export interface OrderMoneyScope {
+  count: number;
+  valueMinor: number;
+  refundMinor: number;
+}
+
+export interface OrderAccounting {
+  storewide: OrderMoneyScope;
+  filter: OrderMoneyScope;
+  page: OrderMoneyScope;
 }
 
 export interface OrderDetail extends OrderRow {
@@ -64,6 +95,9 @@ export interface OrderDetail extends OrderRow {
   shipping: number;
   estimatedTax: number;
   taxesAndFees: number;
+  /** Present when the order was assessed. Absent on the mock book. */
+  columns?: OrderReadinessColumn[];
+  release?: OrderRelease;
 }
 
 export type OrderQueueKey = "needs_attention" | "ready_to_ship" | "unfulfilled" | "all" | "completed";
@@ -89,4 +123,6 @@ export interface OrdersViewModel {
   rows: OrderRow[];
   detailsById: Record<string, OrderDetail>;
   today: OrdersTodaySummary;
+  /** Set by a scrappy book query. Never copied from the current page alone. */
+  accounting?: OrderAccounting;
 }

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -2,18 +2,22 @@
  * `GET /api/admin/orders/:id` — one order's full detail for the Orders tab.
  *
  * Server-side proxy to checkout `GET /commerce/orders/:orderId` for the
- * resolved tenant + env. Bearer stays server-side; response is the CheckoutOrderDetail
- * DTO. `verificationDetail` is currently empty — consumers tolerate that.
- * Read-only (scope-locks).
+ * resolved tenant + env. Bearer stays server-side. Address is included only
+ * for an owner of this tenant and stage. Readiness is assessed, not inferred.
+ * Read-only.
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
 import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
 import {
+  commerceActorForAdmin,
+  commerceStageForCustomization,
   createCheckoutOrderClient,
   orderApiBaseUrl,
   OrderApiError,
+  projectCheckoutOrder,
 } from "@/lib/admin/orderClient";
+import { assessCheckoutOrder } from "@/lib/admin/services/orders";
 
 export const prerender = false;
 
@@ -49,8 +53,19 @@ export async function GET(context: APIContext): Promise<Response> {
   });
 
   try {
-    const order = await client.getOrder(orderId);
-    return new Response(JSON.stringify({ order }), { headers: JSON_HEADERS });
+    const stage = commerceStageForCustomization(customizationEnv);
+    const actor = commerceActorForAdmin({
+      tenantId: tenant.appDomain,
+      stage,
+      owner: access.entry.isOwnerViewer,
+      admitted: access.entry.admitted,
+    });
+    const order = projectCheckoutOrder(await client.getOrder(orderId), actor, {
+      tenantId: tenant.appDomain,
+      stage,
+    });
+    const readiness = assessCheckoutOrder(order);
+    return new Response(JSON.stringify({ order, readiness }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);
     return jsonError("unexpected", 500);

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -10,7 +10,6 @@
  * host/approver layer) — same posture as `api/evidence.json.ts`; no new gate here.
  */
 import type { APIContext } from "astro";
-import type { CheckoutOrderListFilters } from "@tot/public-runtime";
 import { readEnv } from "@/lib/env";
 import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
 import {
@@ -18,6 +17,7 @@ import {
   orderApiBaseUrl,
   OrderApiError,
 } from "@/lib/admin/orderClient";
+import { assessCheckoutOrder, parseOrderFilters } from "@/lib/admin/services/orders";
 
 export const prerender = false;
 
@@ -50,16 +50,8 @@ export async function GET(context: APIContext): Promise<Response> {
   }
 
   const url = new URL(context.request.url);
-  const q = url.searchParams;
-  const limitRaw = q.get("limit");
-  const filters: CheckoutOrderListFilters = {
-    queue: q.get("queue") ?? undefined,
-    status: q.get("status") ?? undefined,
-    from: q.get("from") ?? undefined,
-    to: q.get("to") ?? undefined,
-    limit: limitRaw != null ? Number(limitRaw) : undefined,
-    cursor: q.get("cursor") ?? undefined,
-  };
+  // Tenant comes from the host, never from a query parameter.
+  const filters = parseOrderFilters(url.searchParams);
 
   const client = createCheckoutOrderClient({
     baseUrl: orderApiBaseUrl(customizationEnv),
@@ -69,7 +61,11 @@ export async function GET(context: APIContext): Promise<Response> {
 
   try {
     const data = await client.listOrders(filters);
-    return new Response(JSON.stringify(data), { headers: JSON_HEADERS });
+    const orders = data.orders.map((order) => ({
+      ...order,
+      readiness: assessCheckoutOrder(order),
+    }));
+    return new Response(JSON.stringify({ ...data, orders }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);
     return jsonError("unexpected", 500);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.51",
+  "version": "2.4.53",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",