@tokenoftrust/storefront-runner 3.9.0 → 3.9.1

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -113,7 +113,30 @@ function fullCartProduct(value: unknown, handle: string, scope: string): value i
       Object.values(variant.option_values).every(option => typeof option === "string") &&
       variant.inventory && typeof variant.inventory === "object" && !Array.isArray(variant.inventory) && typeof variant.inventory.available === "boolean");
 }
+/** The caller's per-request id (its token's `jti`), echoed so the caller's decision log joins this one. */
+const CORRELATION_ID = /^cart-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/**
+ * One `commerce-final-cart-decision` line per request: the caller's correlation id, the finding, the
+ * HTTP status and the elapsed time. Closed values only — never cart, tenant-config or shopper data.
+ * A throw answers JSON `authority-error` so the caller maps it to a shopper sentence.
+ */
 export async function POST(context: APIContext): Promise<Response> {
+  const started = Date.now();
+  const header = context.request.headers.get("x-commerce-correlation-id") ?? "";
+  const correlationId = CORRELATION_ID.test(header) ? header : "absent";
+  let response: Response;
+  let threw = false;
+  try { response = await authorize(context); } catch { threw = true; response = deny("authority-error", 500); }
+  let finding = "approved";
+  if (response.status !== 200 || threw) {
+    try { finding = String((await response.clone().json() as { finding?: unknown }).finding ?? "unreadable").slice(0, 80); } catch { finding = "unreadable"; }
+  }
+  try {
+    console.info("commerce-final-cart-decision", JSON.stringify({ correlationId, ok: response.status === 200, finding, status: response.status, threw, ms: Date.now() - started }));
+  } catch { /* Diagnostic delivery cannot alter the decision. */ }
+  return response;
+}
+async function authorize(context: APIContext): Promise<Response> {
   if (Number(context.request.headers.get("content-length") ?? 0) > 65536) return deny("malformed-request");
   const raw = await context.request.text();
   if (raw.length > 65536) return deny("malformed-request");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.9.0",
+  "version": "3.9.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",