@tokenoftrust/storefront-runner 2.4.68 → 2.4.70
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -20,7 +20,7 @@ import {
|
|
|
20
20
|
type ProviderOutcome,
|
|
21
21
|
type PublicCommerceEvent,
|
|
22
22
|
type StockState,
|
|
23
|
-
} from "
|
|
23
|
+
} from "@tot/public-runtime";
|
|
24
24
|
|
|
25
25
|
export const SCRAPPY_FULFILLMENT_PATH = "/scrappy-fulfillment";
|
|
26
26
|
export const WORKSPACE_PAGE_LIMIT = 4;
|
|
@@ -29,7 +29,6 @@ import { computeBackoffDelaySeconds, MAX_DELIVERY_ATTEMPTS, type AttemptOutcome
|
|
|
29
29
|
import { validateWebhookEndpoint } from "./endpointGuard.js";
|
|
30
30
|
import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
|
|
31
31
|
import type { Queryable } from "../d1/catalog.js";
|
|
32
|
-
import { PRIVATE_COMMERCE_KEYS } from "../apps/orders/orderMapper.js";
|
|
33
32
|
|
|
34
33
|
/** Bounded per-attempt timeout — a hung receiver must not hold a dispatcher slot open indefinitely. */
|
|
35
34
|
const DEFAULT_TIMEOUT_MS = 10_000;
|
|
@@ -281,11 +280,31 @@ async function postWithTimeout(
|
|
|
281
280
|
}
|
|
282
281
|
}
|
|
283
282
|
|
|
283
|
+
// Transport rejects private fields even when an outbox row was written outside
|
|
284
|
+
// the Orders service. scrappyDurability.test.ts checks every Orders private key
|
|
285
|
+
// recursively at actual retry time so the two boundary policies cannot diverge.
|
|
286
|
+
const COMMERCE_PRIVATE_KEYS = new Set([
|
|
287
|
+
"customer",
|
|
288
|
+
"customerEmail",
|
|
289
|
+
"customerName",
|
|
290
|
+
"email",
|
|
291
|
+
"phone",
|
|
292
|
+
"line1",
|
|
293
|
+
"line2",
|
|
294
|
+
"postalCode",
|
|
295
|
+
"shippingAddress",
|
|
296
|
+
"billingAddress",
|
|
297
|
+
"address",
|
|
298
|
+
"firstName",
|
|
299
|
+
"lastName",
|
|
300
|
+
"name",
|
|
301
|
+
]);
|
|
302
|
+
|
|
284
303
|
function commercePayloadHasPrivateIdentity(value: unknown): boolean {
|
|
285
304
|
if (value === null || typeof value !== "object") return false;
|
|
286
305
|
if (Array.isArray(value)) return value.some((item) => commercePayloadHasPrivateIdentity(item));
|
|
287
306
|
return Object.entries(value as Record<string, unknown>).some(
|
|
288
|
-
([key, child]) =>
|
|
307
|
+
([key, child]) => COMMERCE_PRIVATE_KEYS.has(key) || commercePayloadHasPrivateIdentity(child),
|
|
289
308
|
);
|
|
290
309
|
}
|
|
291
310
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tokenoftrust/storefront-runner",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.70",
|
|
4
4
|
"license": "SEE LICENSE IN LICENSE",
|
|
5
5
|
"description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
|
|
6
6
|
"packageManager": "pnpm@11.9.0",
|