@tokenoftrust/storefront-runner 2.4.63 → 2.4.64

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -87,10 +87,30 @@ export async function readCartSecret(
  *     but the secret is missing, so NO cart may be built. The caller must render
  *     no buy form (never a tamperable / broken one).
  */
+/** Shopper copy when checkout cannot be signed. No operator setup detail. */
+export const CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE = "Checkout is unavailable.";
+
+/** Product-page alert. The cart signing env var name stays in the server log. */
+export function shopperCheckoutUnavailableHtml(): string {
+  return (
+    `<p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>` +
+    `${CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE}</p>`
+  );
+}
+
+/**
+ * Message safe to put in an HTTP body. `signing-unavailable` carries operator
+ * setup text from the cart runtime; shoppers get the neutral message instead.
+ */
+export function shopperCartDenialMessage(code: string, message: string): string {
+  if (code === "signing-unavailable") return CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE;
+  return message;
+}
+
 export interface CartSigningResolution {
   enabled: boolean;
   secret?: string;
-  /** Set when signed mode has no secret. Actionable for the operator. No secret value. */
+  /** Operator setup detail. Do not write this into shopper HTML or an HTTP body. */
   operatorError?: string;
 }
 

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -26,7 +26,7 @@ import {
   type CartDenialCode,
 } from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
-import { resolveCartSigning } from "@/lib/checkoutCommerce";
+import { resolveCartSigning, shopperCartDenialMessage } from "@/lib/checkoutCommerce";
 
 export const prerender = false;
 
@@ -88,7 +88,11 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   }
   const signing = await resolveCartSigning(commerce);
   if (!signing.enabled) {
-    return cartDenial("signing-unavailable", signing.operatorError ?? "Signed checkout is unavailable.", 503);
+    return cartDenial(
+      "signing-unavailable",
+      shopperCartDenialMessage("signing-unavailable", signing.operatorError ?? ""),
+      503,
+    );
   }
   const form = await context.request.formData();
   const entries: Array<[string, string]> = [];
@@ -103,7 +107,7 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   });
   if (!result.ok) {
     const status = result.code === "signing-unavailable" ? 503 : 422;
-    return cartDenial(result.code, result.message, status);
+    return cartDenial(result.code, shopperCartDenialMessage(result.code, result.message), status);
   }
   return new Response(null, {
     status: 303,

package/apps/storefront/src/pages/products/[handle].astro

@@ -37,7 +37,7 @@ import type {
   MembershipStackingPolicy,
   PurchaseOptionPricingContext,
 } from "@tot/public-runtime";
-import { resolveCartSigning } from "@/lib/checkoutCommerce";
+import { resolveCartSigning, shopperCheckoutUnavailableHtml } from "@/lib/checkoutCommerce";
 import { isRegulatedTenant } from "@/lib/compliance/enforcement";
 import { resolveMemberContext } from "@/lib/membership/eligibility";
 import { truncate } from "@/lib/format";
@@ -223,14 +223,14 @@ let checkoutCart:
       byVariantId: Record<string, Record<string, VariantCartPayload>>;
     }
   | undefined;
-let cartOperatorError: string | undefined;
+let checkoutUnavailable = false;
 if (commerce) {
   // Fail closed for production signed checkout: a signed tenant with no
   // cart-validation secret builds NO cart (never a tamperable form). See
   // resolveCartSigning — it also logs the misconfiguration loudly.
   const signing = await resolveCartSigning(commerce);
   if (!signing.enabled) {
-    cartOperatorError = signing.operatorError;
+    checkoutUnavailable = true;
   } else {
     try {
       const purchaseOptions = visiblePurchaseOptions(
@@ -265,10 +265,9 @@ if (commerce) {
         byVariantId: Object.fromEntries(entries),
       };
     } catch (err) {
-      cartOperatorError =
-        err instanceof Error && err.name === "CartSigningUnavailableError"
-          ? err.message
-          : undefined;
+      if (err instanceof Error && err.name === "CartSigningUnavailableError") {
+        checkoutUnavailable = true;
+      }
       console.warn(
         `[storefront] Invalid checkout purchase options for ${product.handle}; cart disabled for this product.`,
       );
@@ -386,11 +385,7 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
           The form action is the worker cart route, so a native submit reaches
           the server check. A clear browser preflight is not payment authority. */}
       <div class="mt-7" data-payment-authority="none">
-        {cartOperatorError && (
-          <p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>
-            {cartOperatorError}
-          </p>
-        )}
+        {checkoutUnavailable && <Fragment set:html={shopperCheckoutUnavailableHtml()} />}
         <VariantSelector
           client:load
           variants={publicSelectorVariants(product.variants)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.63",
+  "version": "2.4.64",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",