@tokenoftrust/storefront-runner 3.3.1 → 3.3.3

package/apps/storefront/src/config/tenants.ts

@@ -98,7 +98,7 @@ export class StaticTenantResolver implements TenantResolver {
 
 export const tenantResolver: TenantResolver = new StaticTenantResolver();
 
-const COMPOSED_PLATFORM_FIELDS = ["access", "pathPrefixTenants", "capabilities"] as const;
+const COMPOSED_PLATFORM_FIELDS = ["access", "pathPrefixTenants", "capabilities", "siteType", "features"] as const;
 
 /** Same contract as the real registry's withPlatformPolicy — kept in sync by hand. */
 export function withPlatformPolicy(record: TenantConfig): TenantConfig {

package/apps/storefront/src/lib/access/auth/loginGate.ts

@@ -100,10 +100,7 @@ export function sessionAdmitsHost(
   return sessionHostCapability(record, hostResource, nowSeconds) !== null;
 }
 
-/** Parse `DEMO_GATE_MODE` (default "password"). */
-export function parseGateMode(raw: string | null | undefined): GateMode {
-  return (raw ?? "").trim().toLowerCase() === "login" ? "login" : "password";
-}
+export { parseGateMode } from "../shared/gateMode.js";
 
 /**
  * Paths that MUST stay reachable without a session, or the visitor could never

package/apps/storefront/src/lib/access/shared/gateMode.ts

@@ -0,0 +1,4 @@
+/** Parse `DEMO_GATE_MODE` (default "password"). Dependency-free so plain-node scripts can load it. */
+export function parseGateMode(raw: string | null | undefined): "password" | "login" {
+  return (raw ?? "").trim().toLowerCase() === "login" ? "login" : "password";
+}

package/apps/storefront/src/lib/observability/diag/serverResponseTime.ts

@@ -0,0 +1,41 @@
+/**
+ * The document's server response time for the evidence panel: the `total` the Worker stamps in
+ * `Server-Timing` (`lib/observability/shared/serverTiming.ts`) next to the time this self-fetch
+ * waited for the response headers (TTFB as seen from the Worker). Advisory — never gates promotion.
+ */
+
+export interface ServerResponseTime {
+  /** `total;dur` from the document's `Server-Timing`, or null when the header is absent. */
+  serverTotalMs: number | null;
+  /** Wall time until the response headers arrived. */
+  ttfbMs: number;
+  /** The isolate was serving its first request (`isolate;desc="cold"`). */
+  cold: boolean;
+}
+
+/** Pull `total;dur` and the cold marker out of a `Server-Timing` header value. */
+export function parseServerTiming(header: string | null | undefined): Pick<ServerResponseTime, "serverTotalMs" | "cold"> {
+  if (!header) return { serverTotalMs: null, cold: false };
+  const entries = header.split(",").map((e) => e.trim());
+  const total = entries.find((e) => /^total(;|$)/.test(e))?.match(/;\s*dur=([0-9.]+)/);
+  return {
+    serverTotalMs: total ? Number(total[1]) : null,
+    cold: entries.some((e) => /^isolate;\s*desc="cold"$/.test(e)),
+  };
+}
+
+/** Self-fetch `url` and report its server response time; null when the fetch fails. */
+export async function measureServerResponseTime(
+  url: URL,
+  now: () => number = () => performance.now(),
+): Promise<ServerResponseTime | null> {
+  try {
+    const started = now();
+    const res = await fetch(url, { redirect: "manual" });
+    const ttfbMs = now() - started;
+    await res.body?.cancel();
+    return { ...parseServerTiming(res.headers.get("server-timing")), ttfbMs: Math.round(ttfbMs) };
+  } catch {
+    return null;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.3.1",
+  "version": "3.3.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",