@tokenoftrust/storefront-runner 2.4.90 → 2.5.0

package/apps/storefront/src/lib/orders/data/orderMapper.ts

@@ -136,6 +136,10 @@ const UNKNOWN_EVIDENCE: CommerceEvidence = {
 };
 
 export interface CommerceSourceEvent {
+  lines?: readonly { sku: string; quantity: number; unitMinor: number }[];
+  admissionReference?: string;
+  providerCartDigest?: string;
+  destinationDigest?: string;
   eventVersion: number;
   command: CommerceCommandName;
   orderId: string;
@@ -219,7 +223,7 @@ function readEvidence(value: unknown): CommerceEvidence {
   if (!isRecord(value)) return { ...UNKNOWN_EVIDENCE };
   const pick = (key: keyof CommerceEvidence): CommerceEvidence[keyof CommerceEvidence] => {
     const found = value[key];
-    if (found === "fresh" || found === "UNKNOWN" || found === "stale" || found === "unreadable" || found === "absent") {
+    if (found === "fresh" || found === "not-required" || found === "UNKNOWN" || found === "stale" || found === "unreadable" || found === "absent") {
       return found;
     }
     return "UNKNOWN";
@@ -260,7 +264,19 @@ export function normalizeCommerceEvent(value: unknown): CommerceSourceEvent | "m
   if (!(STOCK_STATES as readonly string[]).includes(stock)) return "malformed";
   if (!(FULFILLMENT_STATES as readonly string[]).includes(fulfillment)) return "malformed";
   if (!(LABEL_STATES as readonly string[]).includes(label)) return "malformed";
+  const lines = value.lines;
+  if (lines !== undefined && (!Array.isArray(lines) || lines.some(line => !isRecord(line) ||
+      typeof line.sku !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(line.sku) ||
+      !Number.isSafeInteger(line.quantity) || Number(line.quantity) < 1 ||
+      !Number.isSafeInteger(line.unitMinor) || Number(line.unitMinor) < 0))) return "malformed";
+  for (const key of ["admissionReference", "providerCartDigest", "destinationDigest"] as const) {
+    if (value[key] !== undefined && (typeof value[key] !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(value[key] as string))) return "malformed";
+  }
   return {
+    ...(lines !== undefined ? { lines: lines as {sku:string;quantity:number;unitMinor:number}[] } : {}),
+    ...(typeof value.admissionReference === "string" ? { admissionReference:value.admissionReference } : {}),
+    ...(typeof value.providerCartDigest === "string" ? { providerCartDigest:value.providerCartDigest } : {}),
+    ...(typeof value.destinationDigest === "string" ? { destinationDigest:value.destinationDigest } : {}),
     eventVersion,
     command,
     orderId,
@@ -351,6 +367,11 @@ export function foldCommerceEvents(events: readonly CommerceSourceEvent[]): Comm
       payment = "captured";
       paymentVersion = event.eventVersion;
     }
+    if (event.command === "capture" && event.eventVersion >= fulfillmentVersion &&
+        fulfillment !== "cancelled" && fulfillment !== "handed_off") {
+      fulfillment = event.fulfillment;
+      fulfillmentVersion = event.eventVersion;
+    }
     if (event.command === "refund" && event.eventVersion >= paymentVersion) {
       const decision = decideCommerceCommand({
         command: "refund",

package/apps/storefront/src/lib/orders/data/ordersStore.ts

@@ -335,13 +335,21 @@ export class ScrappyOrderLedger {
                 source_order_id = excluded.source_order_id,
                 currency = excluded.currency,
                 placed_at = excluded.placed_at,
-                payment_state = excluded.payment_state,
+                payment_state = CASE WHEN EXISTS(SELECT 1 FROM scrappy_shipment_audit a WHERE a.tenant_id=scrappy_commerce_orders.tenant_id
+                    AND a.stage=scrappy_commerce_orders.stage AND a.order_id=scrappy_commerce_orders.order_id) AND scrappy_commerce_orders.payment_state IN ('refund_requested','refund_unknown','refunded','voided')
+                  THEN scrappy_commerce_orders.payment_state ELSE excluded.payment_state END,
                 compliance_state = excluded.compliance_state,
                 stock_state = excluded.stock_state,
-                fulfillment_state = excluded.fulfillment_state,
-                label_state = excluded.label_state,
+                fulfillment_state = CASE WHEN scrappy_commerce_orders.fulfillment_state IN ('handed_off','cancelled')
+                  THEN scrappy_commerce_orders.fulfillment_state
+                  WHEN EXISTS(SELECT 1 FROM scrappy_shipment_audit a WHERE a.tenant_id=scrappy_commerce_orders.tenant_id
+                    AND a.stage=scrappy_commerce_orders.stage AND a.order_id=scrappy_commerce_orders.order_id)
+                  THEN 'held' ELSE excluded.fulfillment_state END,
+                label_state = CASE WHEN scrappy_commerce_orders.label_state IN ('intent','purchased','printed','void_requested','UNKNOWN')
+                  THEN scrappy_commerce_orders.label_state ELSE excluded.label_state END,
                 amount_minor = excluded.amount_minor,
-                event_version = excluded.event_version`,
+                event_version = CASE WHEN EXISTS(SELECT 1 FROM scrappy_shipment_audit a WHERE a.tenant_id=scrappy_commerce_orders.tenant_id
+                    AND a.stage=scrappy_commerce_orders.stage AND a.order_id=scrappy_commerce_orders.order_id) THEN MAX(scrappy_commerce_orders.event_version + 1, excluded.event_version) ELSE excluded.event_version END`,
         params: [
           tenantId,
           stage,

package/apps/storefront/src/pages/api/admin/commerce-readiness.ts

@@ -1,13 +1,9 @@
-/**
- * GET/POST /api/admin/commerce-readiness
- *
- * Phase 1: the client fulfills in their own carrier account. This route reports
- * whether order and payment reconcile has been exercised. It does not read an
- * order row, write a payment, or call a carrier. Postage is not a result.
- *
- * The exercised comparison is scripts/commerce/scrappy-reconcile.mjs. This
- * surface has no ledger, so configured, absent, and unreadable stay unhealthy.
- */
+import { openFulfillment } from "@/lib/fulfillment/fulfillmentService";
+import { readCommerceDurability } from "@/lib/fulfillment/commerceReadback";
+import { readD1 } from "@/lib/publication/shared/env";
+import { fromD1 } from "@/lib/catalog/d1/catalog";
+import { commercePipelineFor } from "@/lib/fulfillment/commerceRuntime";
+/** Owner-only persisted projection health and durable replay. External payment reconciliation remains separate. */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { workerCommit } from "@/lib/activity/workerCommit";
@@ -80,11 +76,10 @@ function replayStage(value: unknown): CommerceStage | null {
   return value === "preview" || value === "publication" ? value : null;
 }
 
-export function admitAdminReplay(input: {
-  tenantId: string;
-  stage: CommerceStage;
-  kind: "order" | "refund";
-}): { admitted: boolean; reason: "admitted" | "denied" | "refused" } {
+export function admitAdminReplay(input: { tenantId: string; stage: CommerceStage; kind: "order" | "refund" }): {
+  admitted: boolean;
+  reason: "admitted" | "denied" | "refused";
+} {
   const actor = { role: "owner" as const, tenantId: input.tenantId, stage: input.stage };
   const resource = { tenantId: input.tenantId, stage: input.stage };
   if (!actorMayCommand(actor, resource)) return { admitted: false, reason: "denied" };
@@ -106,7 +101,20 @@ export function admitAdminReplay(input: {
 export async function GET(context: APIContext): Promise<Response> {
   const access = await requireAdminApiEntry(context, { requireOwner: true });
   if (!access.ok) return json({ ok: false, reason: access.reason }, access.status);
-  return json({ ok: true, report: projectAdminReadiness({ scheduler: COMMERCE_SCHEDULER, deployedSha: workerCommit() }) });
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ ok: false, reason: "unavailable" }, 503);
+  return json({
+    ok: true,
+    report: await readCommerceDurability(
+      fromD1(d1),
+      opened.actor.tenantId,
+      opened.actor.stage,
+      new Date().toISOString(),
+      workerCommit(),
+    ),
+  });
 }
 
 export async function POST(context: APIContext): Promise<Response> {
@@ -120,7 +128,8 @@ export async function POST(context: APIContext): Promise<Response> {
   } catch {
     return json({ ok: false, reason: "refused" }, 400);
   }
-  if (body === null || typeof body !== "object" || Array.isArray(body)) return json({ ok: false, reason: "refused" }, 400);
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    return json({ ok: false, reason: "refused" }, 400);
   const record = body as Record<string, unknown>;
   if (Object.keys(record).some((key) => !REPLAY_KEYS.has(key))) return json({ ok: false, reason: "refused" }, 400);
   const stage = replayStage(record.stage);
@@ -128,15 +137,36 @@ export async function POST(context: APIContext): Promise<Response> {
   if (!stage || !kind || typeof record.orderId !== "string" || typeof record.sourceEventId !== "string") {
     return json({ ok: false, reason: "refused" }, 400);
   }
-  if (!OPAQUE.test(record.orderId) || !OPAQUE.test(record.sourceEventId)) return json({ ok: false, reason: "refused" }, 400);
+  if (!OPAQUE.test(record.orderId) || !OPAQUE.test(record.sourceEventId))
+    return json({ ok: false, reason: "refused" }, 400);
   const decision = admitAdminReplay({ tenantId: context.locals.tenant.tenant_id, stage, kind });
   if (!decision.admitted) return json({ ok: false, reason: decision.reason }, 403);
-  return json({
-    ok: true,
-    admitted: true,
-    durableWrite: false,
-    command: "reconcile",
-    reason: decision.reason,
-    report: projectAdminReadiness({ scheduler: COMMERCE_SCHEDULER, deployedSha: workerCommit() }),
-  });
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  if (stage !== opened.actor.stage) return json({ ok: false, reason: "denied" }, 403);
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ ok: false, reason: "unavailable" }, 503);
+  const db = fromD1(d1);
+  const row = await db.first<{ outbox_id: string }>(
+    `SELECT outbox_id FROM scrappy_commerce_outbox WHERE tenant_id=? AND stage=? AND order_id=? AND source_event_id=?`,
+    opened.actor.tenantId,
+    stage,
+    record.orderId,
+    record.sourceEventId,
+  );
+  if (!row) return json({ ok: false, reason: "not-found" }, 404);
+  const pipeline = await commercePipelineFor(opened.actor.tenantId);
+  if (!pipeline?.commerceReplay) return json({ ok: false, reason: "scheduler-unavailable" }, 503);
+  await pipeline.commerceReplay(opened.actor.tenantId, stage, row.outbox_id);
+  return json(
+    {
+      ok: true,
+      admitted: true,
+      durableWrite: true,
+      command: "reconcile",
+      reason: "queued",
+      report: await readCommerceDurability(db, opened.actor.tenantId, stage, new Date().toISOString(), workerCommit()),
+    },
+    202,
+  );
 }

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -23,10 +23,14 @@ import {
   foxyCartRedirectUrl,
   parseConsentSnapshot,
   defaultConsentSnapshot,
+  buildVariantCartPayload,
+  commerceTenantId,
+  MAX_CART_QUANTITY,
   type CartDenialCode,
 } from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/checkout/commerce/checkoutHandoffCorrelation";
 import { resolveCartSigning, shopperCartDenialMessage } from "@/lib/checkout/shared/checkoutCommerce";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 
 export const prerender = false;
 
@@ -97,13 +101,41 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   const form = await context.request.formData();
   const entries: Array<[string, string]> = [];
   for (const [name, value] of form.entries()) {
-    if (typeof value === "string") entries.push([name, value]);
+    if (typeof value !== "string") return cartDenial("signature", "Invalid cart.", 422);
+    entries.push([name, value]);
+  }
+  if (form.has("sample_product") || form.has("sample_variant")) {
+    const sampleTenant = await readEnv("COMMERCE_SAMPLE_TENANT_ID");
+    if (
+      !sampleTenant || sampleTenant !== commerceTenantId(tenant) ||
+      await readEnv("COMMERCE_DEMO_CHECKOUT_TIER") !== "test" || commerce.mode !== "signed"
+    ) return cartDenial("tenant", "Invalid cart.", 422);
+    const allowed = new Set(["sample_product", "sample_variant", "quantity"]);
+    if (entries.length !== 3 || entries.some(([name]) => !allowed.has(name)) ||
+      new Set(entries.map(([name]) => name)).size !== 3) {
+      return cartDenial("signature", "Invalid cart.", 422);
+    }
+    const quantity = form.get("quantity") as string;
+    if (!/^[1-9][0-9]*$/.test(quantity) || !Number.isSafeInteger(Number(quantity)) || Number(quantity) > MAX_CART_QUANTITY) {
+      return cartDenial("quantity", "Invalid quantity.", 422);
+    }
+    const product = await context.locals.tot.getProductByHandle(form.get("sample_product") as string);
+    const variant = product?.variants.find((v) => v.id === form.get("sample_variant"));
+    if (!product || product.status !== "active" || product.visibility === "hidden" || product.visibility === "unlisted" ||
+      !variant || !variant.inventory.available || product.tenant_id !== tenant.tot_data_scope ||
+      variant.tenant_id !== tenant.tot_data_scope) {
+      return cartDenial("signature", "Product is unavailable.", 422);
+    }
+    const payload = await buildVariantCartPayload(product, variant, {
+      mode: "signed", secret: signing.secret, tenantId: commerceTenantId(tenant),
+    });
+    entries.splice(0, entries.length, ...payload.hidden.map((f): [string, string] => [f.name, f.value]), [payload.quantityName, quantity]);
   }
   const result = await enforceCartSubmission({
     entries,
     mode: commerce.mode,
     secret: signing.secret,
-    trustedTenantId: tenant.tenant_id,
+    trustedTenantId: commerceTenantId(tenant),
   });
   if (!result.ok) {
     const status = result.code === "signing-unavailable" ? 503 : 422;