@tokenoftrust/storefront-runner 3.10.2 → 3.10.4

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -233,12 +233,17 @@ async function authorize(context: APIContext): Promise<Response> {
   const requirements = await readCheckoutRequirements(tenant.tenant_id, contentEnv);
   if (!requirements) return deny("checkout-requirements-unreadable", 503);
   const policy = testStoreEvidencePolicy(requirements);
+  // Stock is tracked only for a tenant that declares the `mirror` provider. An undeclared tenant
+  // has no balance to read, so its stock evidence is honestly `not-required`, not a refusal.
+  const stockTracked = tenant.inventory?.provider === "mirror";
   const authorities = [];
-  for (const sku of new Set(snapshot.lines.map(line => line.sku))) {
-    authorities.push(await readMirrorStock(queryable, { tenantId: snapshot.tenantId, stage: snapshot.stage, sku, locationId: "unspecified", now, maxAgeMs: 15 * 60_000 }));
+  if (stockTracked) {
+    for (const sku of new Set(snapshot.lines.map(line => line.sku))) {
+      authorities.push(await readMirrorStock(queryable, { tenantId: snapshot.tenantId, stage: snapshot.stage, sku, locationId: "unspecified", now, maxAgeMs: 15 * 60_000 }));
+    }
   }
   const stockExpiry = Math.min(...authorities.flatMap(authority => authority ? [Date.parse(authority.asOf) + 15 * 60_000] : []));
-  const evidence: CommerceEvidence = { verification: "absent", tax: "absent", risk: "absent", stock: "fresh" };
+  const evidence: CommerceEvidence = { verification: "absent", tax: "absent", risk: "absent", stock: stockTracked ? "fresh" : "not-required" };
   const expiresAt = existing?.expiresAt ?? new Date(Math.min(Date.now() + 5 * 60_000, stockExpiry)).toISOString();
   const provenance = {} as CommerceEvidenceProvenance;
   for (const field of ["verification", "tax", "risk"] as const) {
@@ -247,7 +252,9 @@ async function authorize(context: APIContext): Promise<Response> {
       provenance[field] = { requirement: "not-required", state: "not-required", source: SHARED_STORE_POLICY_SOURCE, policyRevision: SHARED_STORE_POLICY_REVISION, expiresAt };
     }
   }
-  provenance.stock = { requirement: "required", state: "satisfied", source: "tenant-inventory-movements", policyRevision: "mirror-v1", expiresAt };
+  provenance.stock = stockTracked
+    ? { requirement: "required", state: "satisfied", source: "tenant-inventory-movements", policyRevision: "mirror-v1", expiresAt }
+    : { requirement: "not-required", state: "not-required", source: "tenant-inventory-undeclared", policyRevision: "untracked-v1", expiresAt };
   const presented: FinalCartBinding = { tenantId: snapshot.tenantId, stage: snapshot.stage, currency: snapshot.currency, lines: snapshot.lines,
     destinationDigest: snapshot.destinationDigest, verificationExpiresAt: expiresAt, taxExpiresAt: expiresAt };
   const seamView = await seam(authorityContext, snapshot, selected, policy);
@@ -257,7 +264,7 @@ async function authorize(context: APIContext): Promise<Response> {
   }
   const decision = await evaluateFinalCart({ now, routedTenantId: commerceTenantId(tenant), quoted: presented, presented, evidence,
     seam: seamView, catalogAvailable: true, browserConfirmed: false, token,
-    trustedIssuers: issuers, expectedAudience: audience, activeKids, authorities });
+    trustedIssuers: issuers, expectedAudience: audience, activeKids, stockTracked, authorities });
   if (!decision.ok) {
     if (decision.finding === "verification-refused:flavored_prohibited" && seamView.flavors) {
       return json({ ok: false, finding: decision.finding, flavors: seamView.flavors }, 409);
@@ -269,7 +276,7 @@ async function authorize(context: APIContext): Promise<Response> {
   const cartDigest = existing?.cartDigest ?? await digest(`commerce-provider-cart-v1\n${snapshot.providerCartId}\n${snapshot.providerCartDigest}`);
   const reserved = await reserveAllocation(d1CommerceRunner(database), { tenantId: decision.tenantId, stage: decision.stage, orderId: authorizationId,
     cartDigest, expiresAt: decision.expiresAt, now, currency: snapshot.currency, amountMinor: snapshot.totals.totalMinor,
-    issuer: decision.issuer, jti: decision.jti, holds: decision.holds,
+    issuer: decision.issuer, jti: decision.jti, holds: decision.holds, stockUntracked: !stockTracked,
     providerCart: { provider: snapshot.provider, id: snapshot.providerCartId, digest: snapshot.providerCartDigest, expectedAuthorizationId: snapshot.expectedAuthorizationId },
     admissionStatement: admissionSnapshotStatement({ ...snapshot, authorizationId, cartDigest, evidence, provenance, expiresAt: decision.expiresAt, now }),
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.10.2",
+  "version": "3.10.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout-orders.ts

@@ -401,7 +401,7 @@ export type CallerTokenRefusal =
   | "stage";
 
 export function evidencePermitsRelease(evidence: CommerceEvidence): boolean {
-  return evidence.stock === "fresh" && (["verification", "tax", "risk"] as const)
+  return (["verification", "tax", "risk", "stock"] as const)
     .every(field => evidence[field] === "fresh" || evidence[field] === "not-required");
 }