@tokenoftrust/storefront-runner 4.6.1 → 4.6.3

package/agency-kit/tools/lib/catalog-model/sku.d.mts

@@ -1,7 +1,7 @@
 export const SKU_MAX_LENGTH: number;
 export const CHECKOUT_CODE_MAX_LENGTH: number;
 export const SKU_TOKEN_MAX_LENGTH: number;
-export type SkuRefusal = "not-string" | "empty" | "control-character" | "too-long";
+export type SkuRefusal = "not-string" | "empty" | "control-character" | "ill-formed" | "too-long";
 export function parseSku(value: unknown): { ok: true; sku: string } | { ok: false; reason: SkuRefusal };
 export function isStoredSku(value: unknown): value is string;
 export function skuKey(sku: string): string;

package/agency-kit/tools/lib/catalog-model/sku.mjs

@@ -3,7 +3,8 @@
  *
  * A SKU is merchant data, kept exactly as the merchant wrote it. The only rewrite is trimming
  * leading and trailing whitespace on the way in. A SKU is refused only when it is empty, carries a
- * control character, or is longer than {@link SKU_MAX_LENGTH} characters. Anything else, a space
+ * control character, is not well-formed Unicode (a lone UTF-16 surrogate, which has no UTF-8 form
+ * and so no token), or is longer than {@link SKU_MAX_LENGTH} characters. Anything else, a space
  * included, is a valid SKU; a space is a lint warning, never an error.
  *
  * Two SKUs are the same SKU when their {@link skuKey} is equal: trimmed, NBSP read as a space, and
@@ -25,6 +26,8 @@ export const CHECKOUT_CODE_MAX_LENGTH = 200;
 export const SKU_TOKEN_MAX_LENGTH = SKU_MAX_LENGTH * 12;
 
 const CONTROL = /\p{Cc}/u;
+/** A lone surrogate: in `u` mode a paired surrogate is one code point and never matches. */
+const LONE_SURROGATE = /\p{Cs}/u;
 const WHITESPACE = /\s/u;
 const TOKEN_SAFE = /^[A-Za-z0-9._-]$/;
 const TOKEN = /^(?:[A-Za-z0-9._-]|%[0-9A-F]{2})+$/;
@@ -33,13 +36,14 @@ const TOKEN = /^(?:[A-Za-z0-9._-]|%[0-9A-F]{2})+$/;
  * Read a SKU as it arrives from a merchant, a file or an import.
  *
  * @param {unknown} value
- * @returns {{ ok: true, sku: string } | { ok: false, reason: "not-string" | "empty" | "control-character" | "too-long" }}
+ * @returns {{ ok: true, sku: string } | { ok: false, reason: "not-string" | "empty" | "control-character" | "ill-formed" | "too-long" }}
  */
 export function parseSku(value) {
   if (typeof value !== "string") return { ok: false, reason: "not-string" };
   const sku = value.trim();
   if (sku === "") return { ok: false, reason: "empty" };
   if (CONTROL.test(sku)) return { ok: false, reason: "control-character" };
+  if (LONE_SURROGATE.test(sku)) return { ok: false, reason: "ill-formed" };
   if ([...sku].length > SKU_MAX_LENGTH) return { ok: false, reason: "too-long" };
   return { ok: true, sku };
 }
@@ -92,6 +96,7 @@ const REASONS = {
   "not-string": "a SKU must be text",
   empty: "a SKU cannot be empty",
   "control-character": "a SKU cannot contain a control character (tab, newline, ...)",
+  "ill-formed": "a SKU must be well-formed Unicode text (it contains a broken character)",
   "too-long": `a SKU is at most ${SKU_MAX_LENGTH} characters`,
 };
 

package/apps/storefront/src/lib/orders/admin/orderSource.ts

@@ -137,10 +137,15 @@ export interface OrderSyncHealth {
   detail: string;
 }
 
-/** The sidebar's order-sync row, from the same source the Orders tab reads. */
+/**
+ * The sidebar's order-sync row, from the same source the Orders tab reads. `status` is the ledger
+ * read; `null` means that read was unavailable, never that the ledger is healthy. A partner-api
+ * source has no ledger status and ignores it.
+ */
 export function orderSyncHealth(source: OrderSource, status: LedgerSyncStatus | null): OrderSyncHealth {
   if (source.kind === "not-connected") return { value: "Not connected", detail: orderSourceGapMessage(source.gap) };
-  if (source.kind === "partner-api" || !status) return { value: "Connected", detail: "Reads this store's checkout orders." };
+  if (source.kind === "partner-api") return { value: "Connected", detail: "Reads this store's checkout orders." };
+  if (!status) return { value: "Check", detail: "Order sync status could not be read. Reload to try again." };
   if (status.unconfirmed.count > 0) {
     const n = status.unconfirmed.count;
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.6.1",
+  "version": "4.6.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",