@tokenoftrust/storefront-runner 2.4.66 → 2.4.68

package/apps/storefront/src/components/islands/VariantSelector.tsx

@@ -477,12 +477,11 @@ export default function VariantSelector({
         </div>
       </div>
 
-      {/* Add to cart. With a wired checkout store this is a real checkout form —
-          loader.js turns the submit into the cart drawer + hosted checkout. The
-          product fields are server-pre-signed (tamper-proof); the quantity
-          rides along as the selected stepper value. Without a store (marketing
-          tenant / signed mode missing secret) it degrades to a disabled
-          placeholder. */}
+      {/* Add to cart. With a wired checkout store the form action is the
+          checkout-handoff commerce route (`/api/commerce/checkout-handoff`).
+          Product fields are server-pre-signed; the quantity is the selected
+          stepper value. Without a store (marketing tenant, or signed mode with
+          no cart secret) the control is a disabled placeholder. */}
       {checkoutCart ? (
         <div class="flex flex-col gap-1.5">
           <form

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -152,14 +152,17 @@ function destinationOf(value: unknown): { region: string; country: string } | nu
   return { region: region.toUpperCase(), country: country === "" ? "US" : country.toUpperCase() };
 }
 
-async function catalogOffers(sku: string): Promise<boolean> {
+async function catalogAvailableFor(skus: readonly string[]): Promise<boolean> {
+  if (skus.length === 0) return false;
   const database = await readD1("CATALOG_DB");
   if (!database) return false;
+  const wanted = new Set(skus);
   try {
     const products = await listAllActiveProducts(fromD1(database));
     for (const product of products) {
       for (const variant of product.variants) {
-        if (variant.sku === sku && variant.inventory.available === true) return true;
+        if (variant.sku === undefined) continue;
+        if (wanted.has(variant.sku) && variant.inventory.available === true) return true;
       }
     }
   } catch {
@@ -216,24 +219,7 @@ export async function POST(context: APIContext): Promise<Response> {
     return deny("malformed-request", 409);
   }
 
-  if (body.scheme === "shared-secret") {
-    const decision = await evaluateFinalCart({
-      now: new Date().toISOString(),
-      routedTenantId: appDomain,
-      quoted: readCart(body.quoted) ?? emptyCart(appDomain),
-      presented: readCart(body.presented) ?? emptyCart(appDomain),
-      evidence: readEvidence(body.evidence),
-      seam: { status: "clear" },
-      catalogAvailable: false,
-      browserConfirmed: body.browserConfirmed === true,
-      token: { scheme: "shared-secret" },
-      trustedIssuers: [],
-      expectedAudience: "",
-      activeKids: [],
-      authorities: [],
-    });
-    return deny(decision.ok ? "shared-secret" : decision.finding, statusFor(decision.ok ? "shared-secret" : decision.finding), decision.ok ? undefined : decision.owner);
-  }
+  if (body.scheme === "shared-secret") return deny("shared-secret", statusFor("shared-secret"));
 
   const quoted = readCart(body.quoted);
   const presented = readCart(body.presented);
@@ -263,12 +249,7 @@ export async function POST(context: APIContext): Promise<Response> {
       const exp = typeof decoded.exp === "number" ? new Date(decoded.exp * 1000).toISOString() : "";
       const audienceClaim = typeof decoded.aud === "string" ? decoded.aud : Array.isArray(decoded.aud) ? decoded.aud[0] ?? "" : "";
       const stageClaim = claimString(decoded, "stage");
-      const stage: CommerceStage =
-        stageClaim === "preview" || stageClaim === "publication"
-          ? stageClaim
-          : presented.stage === "preview"
-            ? "publication"
-            : "preview";
+      if (stageClaim !== "preview" && stageClaim !== "publication") return deny("stage", statusFor("stage"));
       token = {
         scheme: "asymmetric-jwks",
         signatureValid,
@@ -278,7 +259,7 @@ export async function POST(context: APIContext): Promise<Response> {
         expiresAt: exp,
         jti: claimString(decoded, "jti"),
         tenantId: claimString(decoded, "tenantId"),
-        stage,
+        stage: stageClaim,
       };
     } catch {
       token = null;
@@ -301,10 +282,7 @@ export async function POST(context: APIContext): Promise<Response> {
       );
     }
   }
-  let catalogAvailable = false;
-  for (const line of presented.lines) {
-    if (await catalogOffers(line.sku)) catalogAvailable = true;
-  }
+  const catalogAvailable = await catalogAvailableFor(presented.lines.map((line) => line.sku));
 
   const decision = await evaluateFinalCart({
     now,
@@ -353,14 +331,3 @@ export async function POST(context: APIContext): Promise<Response> {
   });
 }
 
-function emptyCart(tenantId: string): FinalCartBinding {
-  return {
-    tenantId,
-    stage: "preview",
-    currency: "USD",
-    lines: [{ sku: "sku-1", quantity: 1, unitMinor: 0 }],
-    destinationDigest: "dest-synthetic",
-    verificationExpiresAt: "1970-01-01T00:00:00.000Z",
-    taxExpiresAt: "1970-01-01T00:00:00.000Z",
-  };
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.66",
+  "version": "2.4.68",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -110,13 +110,13 @@ export interface BuildVariantCartPayloadOptions {
   secret?: string;
   purchaseOption?: ProductPurchaseOption;
   /**
-   * The member-adjusted EFFECTIVE price to sign, computed server-side via
-   * membership.ts `priceForPurchaseOption` for the shopper's resolved eligibility.
-   * When set it REPLACES the list/subscription price as the single signed source
-   * of truth, so a given price is only ever valid for the member context it was
-   * signed under (see {@link ../membership.ts buildMemberSignedCartPayload}).
-   * Absent → the list/subscription price (anonymous shopper). Never a client-
-   * supplied value: only the server, holding the cart secret, ever signs it.
+   * Member-adjusted effective price to sign. `buildMemberSignedCartPayload`
+   * in membership.ts runs `priceForPurchaseOption` for this request's resolved
+   * eligibility and passes that price here. `buildVariantCartPayload` signs it
+   * in place of the list or subscription price, so the signature matches only
+   * that member context. Absent, the list or subscription price is signed for
+   * an anonymous shopper. The client never supplies this value; only the
+   * server, holding the cart secret, signs it.
    */
   signedPrice?: number;
   /**