@tokenoftrust/storefront-runner 3.9.1 → 3.9.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/packages/public-runtime/src/checkout.ts +9 -6
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tokenoftrust/storefront-runner",
3
- "version": "3.9.1",
3
+ "version": "3.9.2",
4
4
  "license": "SEE LICENSE IN LICENSE",
5
5
  "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
6
6
  "packageManager": "pnpm@11.9.0",
package/packages/public-runtime/src/checkout.ts CHANGED
@@ -331,12 +331,15 @@ export type CartFieldVisibility = "native" | "internal" | "visible" | "variant-o
331
331
 
332
332
  /**
333
333
  * Characters the checkout store does not keep in a field name, each mapped to a look-alike it
334
- * keeps. The store validates the name as it rewrites it, not as it was signed: ASCII space, `.`
335
- * and `[` become `_` (a `[…]` pair turns the field into an array), `||` ends the name, and a name
336
- * holding `&` or `"` is dropped from validation. Measured 2026-10-23 against tot-preview.foxycart.com
337
- * by submitting each name with a non-matching hash and reading the name back from its
338
- * "Cart Validation Error: <name>" refusal. Every other character (NBSP, `/`, `'`, `+`, `-`,
339
- * non-ASCII) came back unchanged.
334
+ * keeps. The store hashes `code + name + value` with the name as it received it
335
+ * (https://wiki.foxycart.com/v/2.0/hmac_validation), and it receives request names through PHP,
336
+ * which converts "dots and spaces in variable names ... to underscores"
337
+ * (https://www.php.net/manual/en/language.variables.external.php, "HTML Forms (GET and POST)").
338
+ * Not documented, measured 2026-10-23 against tot-preview.foxycart.com by submitting each name
339
+ * with a non-matching hash and reading it back from the "Cart Validation Error: <name>" refusal:
340
+ * `[` also becomes `_` (a `[…]` pair turns the field into an array), leading spaces are dropped,
341
+ * `||` ends the name, and a name holding `&` or `"` is never validated. Every other character
342
+ * (NBSP, `/`, `'`, `+`, `-`, `#`, `=`, `%`, `,`, `:`, a single `|`, non-ASCII) came back unchanged.
340
343
  */
341
344
  const CHECKOUT_NAME_LOOKALIKES: Readonly<Record<string, string>> = {
342
345
  " ": " ",