@tokenoftrust/storefront-runner 3.9.0 → 3.9.2

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -113,7 +113,30 @@ function fullCartProduct(value: unknown, handle: string, scope: string): value i
       Object.values(variant.option_values).every(option => typeof option === "string") &&
       variant.inventory && typeof variant.inventory === "object" && !Array.isArray(variant.inventory) && typeof variant.inventory.available === "boolean");
 }
+/** The caller's per-request id (its token's `jti`), echoed so the caller's decision log joins this one. */
+const CORRELATION_ID = /^cart-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/**
+ * One `commerce-final-cart-decision` line per request: the caller's correlation id, the finding, the
+ * HTTP status and the elapsed time. Closed values only — never cart, tenant-config or shopper data.
+ * A throw answers JSON `authority-error` so the caller maps it to a shopper sentence.
+ */
 export async function POST(context: APIContext): Promise<Response> {
+  const started = Date.now();
+  const header = context.request.headers.get("x-commerce-correlation-id") ?? "";
+  const correlationId = CORRELATION_ID.test(header) ? header : "absent";
+  let response: Response;
+  let threw = false;
+  try { response = await authorize(context); } catch { threw = true; response = deny("authority-error", 500); }
+  let finding = "approved";
+  if (response.status !== 200 || threw) {
+    try { finding = String((await response.clone().json() as { finding?: unknown }).finding ?? "unreadable").slice(0, 80); } catch { finding = "unreadable"; }
+  }
+  try {
+    console.info("commerce-final-cart-decision", JSON.stringify({ correlationId, ok: response.status === 200, finding, status: response.status, threw, ms: Date.now() - started }));
+  } catch { /* Diagnostic delivery cannot alter the decision. */ }
+  return response;
+}
+async function authorize(context: APIContext): Promise<Response> {
   if (Number(context.request.headers.get("content-length") ?? 0) > 65536) return deny("malformed-request");
   const raw = await context.request.text();
   if (raw.length > 65536) return deny("malformed-request");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.9.0",
+  "version": "3.9.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -331,12 +331,15 @@ export type CartFieldVisibility = "native" | "internal" | "visible" | "variant-o
 
 /**
  * Characters the checkout store does not keep in a field name, each mapped to a look-alike it
- * keeps. The store validates the name as it rewrites it, not as it was signed: ASCII space, `.`
- * and `[` become `_` (a `[…]` pair turns the field into an array), `||` ends the name, and a name
- * holding `&` or `"` is dropped from validation. Measured 2026-10-23 against tot-preview.foxycart.com
- * by submitting each name with a non-matching hash and reading the name back from its
- * "Cart Validation Error: <name>" refusal. Every other character (NBSP, `/`, `'`, `+`, `-`,
- * non-ASCII) came back unchanged.
+ * keeps. The store hashes `code + name + value` with the name as it received it
+ * (https://wiki.foxycart.com/v/2.0/hmac_validation), and it receives request names through PHP,
+ * which converts "dots and spaces in variable names ... to underscores"
+ * (https://www.php.net/manual/en/language.variables.external.php, "HTML Forms (GET and POST)").
+ * Not documented, measured 2026-10-23 against tot-preview.foxycart.com by submitting each name
+ * with a non-matching hash and reading it back from the "Cart Validation Error: <name>" refusal:
+ * `[` also becomes `_` (a `[…]` pair turns the field into an array), leading spaces are dropped,
+ * `||` ends the name, and a name holding `&` or `"` is never validated. Every other character
+ * (NBSP, `/`, `'`, `+`, `-`, `#`, `=`, `%`, `,`, `:`, a single `|`, non-ASCII) came back unchanged.
  */
 const CHECKOUT_NAME_LOOKALIKES: Readonly<Record<string, string>> = {
   " ": " ",