@tokenoftrust/storefront-runner 3.3.2 → 3.3.4

package/apps/storefront/src/lib/access/auth/loginGate.ts

@@ -100,10 +100,7 @@ export function sessionAdmitsHost(
   return sessionHostCapability(record, hostResource, nowSeconds) !== null;
 }
 
-/** Parse `DEMO_GATE_MODE` (default "password"). */
-export function parseGateMode(raw: string | null | undefined): GateMode {
-  return (raw ?? "").trim().toLowerCase() === "login" ? "login" : "password";
-}
+export { parseGateMode } from "../shared/gateMode.js";
 
 /**
  * Paths that MUST stay reachable without a session, or the visitor could never

package/apps/storefront/src/lib/access/shared/gateMode.ts

@@ -0,0 +1,4 @@
+/** Parse `DEMO_GATE_MODE` (default "password"). Dependency-free so plain-node scripts can load it. */
+export function parseGateMode(raw: string | null | undefined): "password" | "login" {
+  return (raw ?? "").trim().toLowerCase() === "login" ? "login" : "password";
+}

package/apps/storefront/src/lib/observability/diag/serverResponseTime.ts

@@ -0,0 +1,68 @@
+/**
+ * The document's server response time for the evidence panel: the `total` the Worker stamps in
+ * `Server-Timing` (`lib/observability/shared/serverTiming.ts`) next to the time this self-fetch
+ * waited for the response headers (TTFB as seen from the Worker). Advisory — never gates promotion.
+ *
+ * The self-fetch carries the viewer's preview grant so it measures the render a reviewer gets. A
+ * gate page or any non-200 answer is not that render, so it is reported as not measured rather
+ * than as a number.
+ */
+
+export interface ServerResponseTime {
+  measured: true;
+  /** `total;dur` from the document's `Server-Timing`, or null when the header is absent. */
+  serverTotalMs: number | null;
+  /** Wall time until the response headers arrived. */
+  ttfbMs: number;
+  /** The isolate was serving its first request (`isolate;desc="cold"`). */
+  cold: boolean;
+}
+
+export interface ServerResponseTimeUnmeasured {
+  measured: false;
+  reason: string;
+}
+
+/** Pull `total;dur` and the cold marker out of a `Server-Timing` header value. */
+export function parseServerTiming(header: string | null | undefined): Pick<ServerResponseTime, "serverTotalMs" | "cold"> {
+  if (!header) return { serverTotalMs: null, cold: false };
+  const entries = header.split(",").map((e) => e.trim());
+  const total = entries.find((e) => /^total(;|$)/.test(e))?.match(/;\s*dur=([0-9.]+)/);
+  return {
+    serverTotalMs: total ? Number(total[1]) : null,
+    cold: entries.some((e) => /^isolate;\s*desc="cold"$/.test(e)),
+  };
+}
+
+/**
+ * The URL and headers that make a self-fetch of `path` the viewer's own render: the request's
+ * `__preview` grant (query) and cookies are forwarded.
+ */
+export function viewerRenderRequest(requestUrl: string, path: string, cookie: string | null): { url: URL; headers: Headers } {
+  const source = new URL(requestUrl);
+  const url = new URL(path, source.origin);
+  const grant = source.searchParams.get("__preview");
+  if (grant) url.searchParams.set("__preview", grant);
+  const headers = new Headers();
+  if (cookie) headers.set("cookie", cookie);
+  return { url, headers };
+}
+
+/** Self-fetch and report the server response time, or why it could not be measured. */
+export async function measureServerResponseTime(
+  request: { url: URL; headers: Headers },
+  now: () => number = () => performance.now(),
+): Promise<ServerResponseTime | ServerResponseTimeUnmeasured> {
+  try {
+    const started = now();
+    const res = await fetch(request.url, { headers: request.headers, redirect: "manual" });
+    const ttfbMs = now() - started;
+    await res.body?.cancel();
+    const gate = res.headers.get("x-tot-gate");
+    if (gate) return { measured: false, reason: `the fetch was answered by the access gate (${gate}), not the store render` };
+    if (res.status !== 200) return { measured: false, reason: `the home document answered ${res.status}, not a render` };
+    return { measured: true, ...parseServerTiming(res.headers.get("server-timing")), ttfbMs: Math.round(ttfbMs) };
+  } catch {
+    return { measured: false, reason: "the home document could not be fetched" };
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.3.2",
+  "version": "3.3.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",