@tokenoftrust/storefront-runner 2.4.53 → 2.4.55

package/apps/storefront/src/lib/fulfillment/readiness.ts

@@ -0,0 +1,150 @@
+/**
+ * Release and hand-off gates for whole-order fulfillment.
+ *
+ * Evidence, payment, stock, refund, and cancel are rechecked from stored source
+ * truth. Compliance `fresh` is not evidence. A carrier account is tenant
+ * configuration: its absence is not a hold, and this module does not select a vendor.
+ */
+import {
+  decideCommerceCommand,
+  paymentIsCaptured,
+  type CommerceEvidence,
+  type ComplianceRuleProfile,
+  type EvidenceState,
+  type FulfillmentState,
+  type LabelState,
+  type PaymentState,
+  type ProviderOutcome,
+  type StockState,
+} from "@tot/public-runtime";
+import { COMPLIANCE_RULE_PROFILES } from "@/config/compliance/rulesets";
+
+export const RELEASE_HOLDS = [
+  "evidence-unknown",
+  "evidence-stale",
+  "evidence-unreadable",
+  "evidence-absent",
+  "operator-hold",
+  "payment-pending",
+  "payment-unknown",
+  "payment-not-captured",
+  "refund-pending",
+  "refunded",
+  "refund-unknown",
+  "cancel-pending",
+  "cancelled",
+  "stock-unknown",
+  "stock-unconfirmed",
+  "fulfillment-unknown",
+] as const;
+
+export type ReleaseHold = (typeof RELEASE_HOLDS)[number];
+
+export interface CarrierPolicy {
+  adultSignatureRequired: boolean;
+  prohibitedCarriers: readonly string[];
+  /** Null when the tenant has not configured an account. Absence is not a hold. */
+  carrierAccountId: string | null;
+}
+
+export interface ReadinessInput {
+  payment: PaymentState;
+  stock: StockState;
+  fulfillment: FulfillmentState;
+  label: LabelState;
+  evidence: CommerceEvidence;
+  operatorHold: boolean;
+  cancelPending: boolean;
+  providerOutcome: ProviderOutcome | null;
+  adultSignature: "accepted" | "refused" | "absent";
+  adultSignatureRequired: boolean;
+}
+
+const EVIDENCE_HOLDS: Record<EvidenceState, ReleaseHold | null> = {
+  fresh: null,
+  UNKNOWN: "evidence-unknown",
+  stale: "evidence-stale",
+  unreadable: "evidence-unreadable",
+  absent: "evidence-absent",
+};
+
+function add(holds: ReleaseHold[], hold: ReleaseHold | null): void {
+  if (hold && !holds.includes(hold)) holds.push(hold);
+}
+
+/** Holds that forbid creating a shipment intent. Compliance is not an input. */
+export function releaseHolds(input: ReadinessInput): ReleaseHold[] {
+  const holds: ReleaseHold[] = [];
+  for (const field of ["verification", "tax", "risk", "stock"] as const) {
+    const value = input.evidence[field];
+    add(holds, value in EVIDENCE_HOLDS ? EVIDENCE_HOLDS[value as EvidenceState] : "evidence-unreadable");
+  }
+  if (input.operatorHold) add(holds, "operator-hold");
+  if (input.cancelPending) add(holds, "cancel-pending");
+  if (input.fulfillment === "cancelled") add(holds, "cancelled");
+  if (input.fulfillment === "UNKNOWN") add(holds, "fulfillment-unknown");
+  if (input.payment === "pending" || input.payment === "authorized") add(holds, "payment-pending");
+  else if (input.payment === "UNKNOWN" || input.payment === "capture_unknown") add(holds, "payment-unknown");
+  else if (input.payment === "refund_requested") add(holds, "refund-pending");
+  else if (input.payment === "refunded") add(holds, "refunded");
+  else if (input.payment === "refund_unknown") add(holds, "refund-unknown");
+  else if (input.payment === "voided") add(holds, "cancelled");
+  else if (!paymentIsCaptured(input.payment)) add(holds, "payment-not-captured");
+  if (input.stock === "UNKNOWN") add(holds, "stock-unknown");
+  else if (input.stock !== "confirmed") add(holds, "stock-unconfirmed");
+  return holds;
+}
+
+export function canRelease(input: ReadinessInput): boolean {
+  return input.fulfillment === "ready" && releaseHolds(input).length === 0;
+}
+
+export function handoffRefusal(input: ReadinessInput): ReleaseHold | "adult-signature" | "label" | "reconcile" | "fulfillment" | "evidence" | "payment" | "stock" | "reuse" | null {
+  const holds = releaseHolds(input);
+  if (holds.length > 0) return holds[0] ?? "fulfillment";
+  const decision = decideCommerceCommand({
+    command: "hand-off",
+    payment: input.payment,
+    stock: input.stock,
+    fulfillment: input.fulfillment,
+    label: input.label,
+    evidence: input.evidence,
+    providerOutcome: input.providerOutcome,
+  });
+  if (!decision.admit) return decision.reason === "admitted" ? "fulfillment" : decision.reason;
+  if (input.adultSignatureRequired && input.adultSignature !== "accepted") return "adult-signature";
+  return null;
+}
+
+export function carrierPolicyForTenant(tenant: {
+  tenant_id: string;
+  compliance?: { ruleProfile?: string };
+  carrierAccountId?: unknown;
+}): CarrierPolicy {
+  const profile = tenant.compliance?.ruleProfile;
+  const build =
+    profile && Object.hasOwn(COMPLIANCE_RULE_PROFILES, profile)
+      ? COMPLIANCE_RULE_PROFILES[profile as ComplianceRuleProfile]
+      : undefined;
+  const ruleset = build ? build(tenant.tenant_id) : null;
+  const raw = tenant.carrierAccountId;
+  const carrierAccountId = typeof raw === "string" && raw.trim() !== "" ? raw.trim() : null;
+  const enabled = ruleset?.pactAct.enabled === true;
+  return {
+    adultSignatureRequired: enabled && ruleset.pactAct.adultSignatureRequired === true,
+    prohibitedCarriers: enabled ? [...ruleset.pactAct.prohibitedCarriers] : [],
+    carrierAccountId,
+  };
+}
+
+/** A supplied carrier is never a selection. USPS is refused when the policy prohibits it. */
+export function carrierSelectionRefusal(
+  policy: CarrierPolicy,
+  carrier: string | undefined,
+): "carrier-prohibited" | "vendor-not-selected" | null {
+  if (carrier === undefined) return null;
+  const normalized = carrier.trim().toUpperCase();
+  if (normalized === "") return "vendor-not-selected";
+  if (policy.prohibitedCarriers.some((item) => item.toUpperCase() === normalized)) return "carrier-prohibited";
+  return "vendor-not-selected";
+}

package/apps/storefront/src/lib/fulfillment/store.ts

@@ -0,0 +1,109 @@
+/**
+ * Tenant-scoped SQL seam for scrappy commerce tables.
+ *
+ * Batch phase, holds, packing slips, and label intents are rows in
+ * `scrappy_shipment_audit` (append-only). The commerce migration has no batch
+ * table; this store does not create one.
+ */
+import type { D1Like } from "../d1/catalog.js";
+
+export interface SqlStatement {
+  sql: string;
+  params: readonly unknown[];
+}
+
+export interface FulfillmentDatabase {
+  get<T extends Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<T | undefined>;
+  all<T extends Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<T[]>;
+  /** One transaction. A unique-constraint loss returns zeros so the caller can re-read. */
+  batch(statements: readonly SqlStatement[]): Promise<number[]>;
+}
+
+interface SqliteStatement {
+  all(...params: unknown[]): Array<Record<string, unknown>>;
+  get(...params: unknown[]): Record<string, unknown> | undefined;
+  run(...params: unknown[]): { changes?: number | bigint };
+}
+
+export interface SqliteDatabase {
+  prepare(sql: string): SqliteStatement;
+  exec(sql: string): void;
+}
+
+function changesOf(result: { changes?: number | bigint } | undefined): number {
+  const changes = result?.changes ?? 0;
+  return typeof changes === "bigint" ? Number(changes) : changes;
+}
+
+function lostRace(error: unknown): boolean {
+  return error instanceof Error && error.message.includes("UNIQUE constraint failed");
+}
+
+export function fulfillmentDbFromSqlite(db: SqliteDatabase): FulfillmentDatabase {
+  db.exec("PRAGMA foreign_keys = ON");
+  let chain: Promise<unknown> = Promise.resolve();
+  const enqueue = <T>(fn: () => T): Promise<T> => {
+    const run = chain.then(
+      () => fn(),
+      () => fn(),
+    );
+    chain = run.then(
+      () => undefined,
+      () => undefined,
+    );
+    return run;
+  };
+  return {
+    get: (sql, params = []) => enqueue(() => db.prepare(sql).get(...params) as never),
+    all: (sql, params = []) => enqueue(() => db.prepare(sql).all(...params) as never),
+    batch: (statements) =>
+      enqueue(() => {
+        if (statements.length === 0) return [];
+        db.exec("BEGIN IMMEDIATE");
+        const changes: number[] = [];
+        try {
+          for (const statement of statements) {
+            changes.push(changesOf(db.prepare(statement.sql).run(...statement.params)));
+          }
+          db.exec("COMMIT");
+          return changes;
+        } catch (error) {
+          try {
+            db.exec("ROLLBACK");
+          } catch {
+            /* the transaction is already closed */
+          }
+          if (lostRace(error)) return statements.map(() => 0);
+          throw new Error("storage", { cause: error });
+        }
+      }),
+  };
+}
+
+export function fulfillmentDbFromD1(db: D1Like): FulfillmentDatabase {
+  return {
+    async get(sql, params = []) {
+      const row = await db.prepare(sql).bind(...params).first();
+      return (row ?? undefined) as never;
+    },
+    async all(sql, params = []) {
+      const result = await db.prepare(sql).bind(...params).all();
+      return (result.results ?? []) as never;
+    },
+    async batch(statements) {
+      if (statements.length === 0) return [];
+      if (!db.batch) throw new Error("storage");
+      try {
+        const results = await db.batch(statements.map((statement) => db.prepare(statement.sql).bind(...statement.params)));
+        return results.map((result) => {
+          if (!result || typeof result !== "object") return 0;
+          const meta = Reflect.get(result, "meta") as { changes?: number } | undefined;
+          return Number(meta?.changes ?? 0);
+        });
+      } catch (error) {
+        if (lostRace(error)) return statements.map(() => 0);
+        throw new Error("storage", { cause: error });
+      }
+    },
+  };
+}

package/apps/storefront/src/lib/webhooks/deliveryEngine.ts

@@ -22,11 +22,13 @@
  * public target can't 302 its way to an internal one; either case never
  * reads as `delivered`.
  */
-import { WebhookDeliveryStore, type WebhookDelivery, type WebhookEvent, type WebhookTopic } from "./deliveryStore.js";
+import { WebhookDeliveryStore, ScrappyCommerceOutbox, type CommerceOutboxDue, type WebhookDelivery, type WebhookEvent, type WebhookTopic } from "./deliveryStore.js";
 import type { AppInstall } from "../apps/registryService.js";
 import { buildCloudEventEnvelope } from "./events.js";
 import { computeBackoffDelaySeconds, MAX_DELIVERY_ATTEMPTS, type AttemptOutcome } from "./dispatcher.js";
 import { validateWebhookEndpoint } from "./endpointGuard.js";
+import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
+import type { Queryable } from "../d1/catalog.js";
 
 /** Bounded per-attempt timeout — a hung receiver must not hold a dispatcher slot open indefinitely. */
 const DEFAULT_TIMEOUT_MS = 10_000;
@@ -277,3 +279,110 @@ async function postWithTimeout(
     clearTimeout(timer);
   }
 }
+
+const COMMERCE_PRIVATE_KEYS = new Set([
+  "customer",
+  "customerEmail",
+  "customerName",
+  "email",
+  "phone",
+  "line1",
+  "line2",
+  "postalCode",
+  "shippingAddress",
+  "billingAddress",
+  "address",
+  "firstName",
+  "lastName",
+  "name",
+]);
+
+function commercePayloadHasPrivateIdentity(value: unknown): boolean {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some((item) => commercePayloadHasPrivateIdentity(item));
+  return Object.entries(value as Record<string, unknown>).some(
+    ([key, child]) => COMMERCE_PRIVATE_KEYS.has(key) || commercePayloadHasPrivateIdentity(child),
+  );
+}
+
+function publicCommercePayload(payload: string): Record<string, unknown> | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(payload);
+  } catch {
+    return null;
+  }
+  if (commercePayloadHasPrivateIdentity(parsed)) return null;
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const body = parsed as Record<string, unknown>;
+  const event = body.public;
+  if (event === null || typeof event !== "object" || Array.isArray(event)) return null;
+  if ((event as Record<string, unknown>).type !== "order.observed") return null;
+  return event as Record<string, unknown>;
+}
+
+export type CommerceSweepResult =
+  | { ok: true; delivered: number; retried: number; dead: number }
+  | { ok: false; reason: "scheduler" };
+
+export type CommerceDeliver = (event: Record<string, unknown>) => Promise<void>;
+
+/**
+ * Deliver due commerce outbox rows. A scheduler other than the declared alarm
+ * leaves every row pending.
+ */
+export async function sweepDurableCommerce(input: {
+  db: Queryable;
+  scheduler: string;
+  now: string;
+  deliver?: CommerceDeliver;
+}): Promise<CommerceSweepResult> {
+  if (input.scheduler !== COMMERCE_SCHEDULER) return { ok: false, reason: "scheduler" };
+  const port = new ScrappyCommerceOutbox(input.db);
+  const due = await port.due(input.now);
+  let delivered = 0;
+  let retried = 0;
+  let dead = 0;
+  const tenants: { tenantId: string; stage: string }[] = [];
+  const seenTenant = (tenantId: string, stage: string) => {
+    if (!tenants.some((item) => item.tenantId === tenantId && item.stage === stage)) {
+      tenants.push({ tenantId, stage });
+    }
+  };
+  for (const row of due) {
+    seenTenant(row.tenant_id, row.stage);
+    const outcome = await settleCommerceRow(port, row, input.now, input.deliver);
+    if (outcome === "delivered") delivered += 1;
+    else if (outcome === "retried") retried += 1;
+    else dead += 1;
+  }
+  for (const tenant of tenants) await port.noteCursor(tenant.tenantId, tenant.stage, input.now);
+  return { ok: true, delivered, retried, dead };
+}
+
+async function settleCommerceRow(
+  port: ScrappyCommerceOutbox,
+  row: CommerceOutboxDue,
+  now: string,
+  deliver: CommerceDeliver | undefined,
+): Promise<"delivered" | "retried" | "dead"> {
+  const event = publicCommercePayload(row.payload);
+  if (!event) {
+    await port.markDead(row.outbox_id);
+    return "dead";
+  }
+  try {
+    if (deliver) await deliver(event);
+    await port.markDelivered(row.outbox_id);
+    return "delivered";
+  } catch {
+    const next = row.attempt_count + 1;
+    if (next >= MAX_DELIVERY_ATTEMPTS) {
+      await port.markDead(row.outbox_id, next);
+      return "dead";
+    }
+    const availableAt = new Date(Date.parse(now) + computeBackoffDelaySeconds(next) * 1000).toISOString();
+    await port.markRetry(row.outbox_id, next, availableAt);
+    return "retried";
+  }
+}

package/apps/storefront/src/lib/webhooks/deliveryStore.ts

@@ -665,3 +665,73 @@ export class WebhookDeliveryStore {
     return toDomain(await this.mustFindDeliveryRow(deliveryId));
   }
 }
+
+export interface CommerceOutboxDue {
+  outbox_id: string;
+  tenant_id: string;
+  stage: string;
+  payload: string;
+  attempt_count: number;
+  available_at: string;
+}
+
+/** Due commerce outbox rows. The order ledger owns the insert; this port owns sweep progress. */
+export class ScrappyCommerceOutbox {
+  constructor(private readonly db: Queryable) {}
+
+  async due(now: string): Promise<CommerceOutboxDue[]> {
+    const rows = await this.db.all<CommerceOutboxDue>(
+      `SELECT outbox_id, tenant_id, stage, payload, attempt_count, available_at
+         FROM scrappy_commerce_outbox
+        WHERE state = 'pending' AND available_at <= ?
+        ORDER BY available_at`,
+      now,
+    );
+    return rows.map((row) => ({ ...row, attempt_count: Number(row.attempt_count) }));
+  }
+
+  async markDelivered(outboxId: string): Promise<void> {
+    await this.db.run(
+      `UPDATE scrappy_commerce_outbox SET state = 'delivered' WHERE outbox_id = ? AND state = 'pending'`,
+      outboxId,
+    );
+  }
+
+  async markRetry(outboxId: string, attemptCount: number, availableAt: string): Promise<void> {
+    await this.db.run(
+      `UPDATE scrappy_commerce_outbox
+          SET state = 'pending', attempt_count = ?, available_at = ?
+        WHERE outbox_id = ? AND state = 'pending'`,
+      attemptCount,
+      availableAt,
+      outboxId,
+    );
+  }
+
+  async markDead(outboxId: string, attemptCount?: number): Promise<void> {
+    if (attemptCount === undefined) {
+      await this.db.run(
+        `UPDATE scrappy_commerce_outbox SET state = 'dead' WHERE outbox_id = ? AND state = 'pending'`,
+        outboxId,
+      );
+      return;
+    }
+    await this.db.run(
+      `UPDATE scrappy_commerce_outbox
+          SET state = 'dead', attempt_count = ?
+        WHERE outbox_id = ? AND state = 'pending'`,
+      attemptCount,
+      outboxId,
+    );
+  }
+
+  async noteCursor(tenantId: string, stage: string, cursor: string): Promise<void> {
+    await this.db.run(
+      `INSERT INTO scrappy_sweep_cursor (tenant_id, stage, cursor) VALUES (?,?,?)
+       ON CONFLICT(tenant_id, stage) DO UPDATE SET cursor = excluded.cursor`,
+      tenantId,
+      stage,
+      cursor,
+    );
+  }
+}

package/apps/storefront/src/lib/webhooks/getDispatcher.ts

@@ -15,15 +15,16 @@
  * design-resolution + entry-wiring context).
  */
 import { WebhookDeliveryStore } from "./deliveryStore.js";
-import { attemptDelivery } from "./deliveryEngine.js";
+import { attemptDelivery, sweepDurableCommerce, type CommerceDeliver, type CommerceSweepResult } from "./deliveryEngine.js";
 import { InMemoryDispatcher, type AttemptDeliveryFn, type WebhookDispatcher } from "./dispatcher.js";
 import { CloudflareQueueDispatcher, type CloudflareQueueSender } from "./cloudflareQueueDispatcher.js";
 import { AppRegistryService } from "../apps/registryService.js";
 import { D1CredentialStore } from "../apps/credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "../apps/gatewayKeys.js";
 import { json } from "../apps/registryAccess.js";
-import { fromD1 } from "../d1/catalog.js";
+import { fromD1, type Queryable } from "../d1/catalog.js";
 import { readD1, readEnv, readQueue } from "../env.js";
+import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
 
 /** Binding name `getDispatcher()` checks to pick the Cloudflare Queues adapter. Not yet declared in `wrangler.toml`. */
 export const WEBHOOK_QUEUE_BINDING = "WEBHOOK_DELIVERY_QUEUE";
@@ -47,3 +48,29 @@ export async function getDispatcher(): Promise<WebhookDispatcher | Response> {
   if (queueSender) return new CloudflareQueueDispatcher(queueSender);
   return new InMemoryDispatcher(attempt);
 }
+
+/**
+ * Commerce work is already durable when it is saved. This dispatcher only
+ * sweeps that outbox, and only when the declared scheduler is configured.
+ * It never falls back to an in-memory queue.
+ */
+export class CommerceAlarmDispatcher {
+  constructor(
+    private readonly db: Queryable,
+    private readonly scheduler: string,
+  ) {}
+
+  async enqueue(): Promise<void> {}
+
+  sweep(now: string, deliver?: CommerceDeliver): Promise<CommerceSweepResult> {
+    return sweepDurableCommerce({ db: this.db, scheduler: this.scheduler, now, deliver });
+  }
+}
+
+export async function getReliableDispatcher(): Promise<CommerceAlarmDispatcher | Response> {
+  const scheduler = await readEnv("SCRAPPY_COMMERCE_SCHEDULER");
+  if (scheduler !== COMMERCE_SCHEDULER) return json({ error: "commerce scheduler not configured" }, 503);
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ error: "commerce scheduler not configured" }, 503);
+  return new CommerceAlarmDispatcher(fromD1(d1), scheduler);
+}

package/apps/storefront/src/pages/api/admin/fulfillment/batches.ts

@@ -0,0 +1,59 @@
+/**
+ * Authenticated owner API for whole-order batch claim and batch read.
+ */
+import type { APIContext } from "astro";
+import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import {
+  fulfillmentResultResponse,
+  isOpaqueId,
+  openFulfillment,
+  parseFulfillmentBody,
+  readJsonBody,
+} from "@/lib/fulfillment/fulfillmentService";
+
+export const prerender = false;
+
+function ownerRefusal(status: number, reason: string): Response {
+  return new Response(JSON.stringify({ error: reason }), {
+    status,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+      "x-robots-tag": "noindex, nofollow",
+    },
+  });
+}
+
+async function requireOwner(context: APIContext): Promise<Response | null> {
+  const access = await requireAdminApiEntry(context, { requireOwner: true });
+  if (access.ok) return null;
+  return ownerRefusal(access.status, access.reason);
+}
+
+export async function GET(context: APIContext): Promise<Response> {
+  const refused = await requireOwner(context);
+  if (refused) return refused;
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  const batchId = new URL(context.request.url).searchParams.get("batchId") ?? "";
+  if (!isOpaqueId(batchId)) return fulfillmentResultResponse({ ok: false, code: "not-found" }, () => ({}));
+  return fulfillmentResultResponse(await opened.service.batch(opened.actor, batchId), (batch) => batch);
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const refused = await requireOwner(context);
+  if (refused) return refused;
+  const raw = await readJsonBody(context.request);
+  if (!raw.ok) return fulfillmentResultResponse(raw, () => ({}));
+  const parsed = parseFulfillmentBody(raw.value);
+  if (!parsed.ok) return fulfillmentResultResponse(parsed, () => ({}));
+  if (!parsed.value.orderIds || parsed.value.orderIds.length === 0) {
+    return fulfillmentResultResponse({ ok: false, code: "malformed" }, () => ({}));
+  }
+  const opened = await openFulfillment(context, parsed.value.tenantId ?? null);
+  if (!opened.ok) return opened.response;
+  return fulfillmentResultResponse(
+    await opened.service.claim(opened.actor, parsed.value.orderIds, parsed.value.expectedVersions),
+    (batch) => batch,
+  );
+}

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -0,0 +1,32 @@
+/**
+ * Owner-only retrieval of a stored ship-to address.
+ * The read runs only after the owner gate admits the caller.
+ */
+import type { APIContext } from "astro";
+import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import {
+  fulfillmentResultResponse,
+  isOpaqueId,
+  openFulfillment,
+} from "@/lib/fulfillment/fulfillmentService";
+
+export const prerender = false;
+
+export async function GET(context: APIContext): Promise<Response> {
+  const access = await requireAdminApiEntry(context, { requireOwner: true });
+  if (!access.ok) {
+    return new Response(JSON.stringify({ error: access.reason }), {
+      status: access.status,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        "x-robots-tag": "noindex, nofollow",
+      },
+    });
+  }
+  const orderId = context.params.id ?? "";
+  if (!isOpaqueId(orderId)) return fulfillmentResultResponse({ ok: false, code: "not-found" }, () => ({}));
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  return fulfillmentResultResponse(await opened.service.readAddress(opened.actor, orderId), (address) => address);
+}