@tokenoftrust/storefront-runner 4.6.2 → 4.6.4

package/agency-kit/tools/lib/catalog-model/sku.d.mts

@@ -1,7 +1,7 @@
 export const SKU_MAX_LENGTH: number;
 export const CHECKOUT_CODE_MAX_LENGTH: number;
 export const SKU_TOKEN_MAX_LENGTH: number;
-export type SkuRefusal = "not-string" | "empty" | "control-character" | "too-long";
+export type SkuRefusal = "not-string" | "empty" | "control-character" | "ill-formed" | "too-long";
 export function parseSku(value: unknown): { ok: true; sku: string } | { ok: false; reason: SkuRefusal };
 export function isStoredSku(value: unknown): value is string;
 export function skuKey(sku: string): string;

package/agency-kit/tools/lib/catalog-model/sku.mjs

@@ -3,7 +3,8 @@
  *
  * A SKU is merchant data, kept exactly as the merchant wrote it. The only rewrite is trimming
  * leading and trailing whitespace on the way in. A SKU is refused only when it is empty, carries a
- * control character, or is longer than {@link SKU_MAX_LENGTH} characters. Anything else, a space
+ * control character, is not well-formed Unicode (a lone UTF-16 surrogate, which has no UTF-8 form
+ * and so no token), or is longer than {@link SKU_MAX_LENGTH} characters. Anything else, a space
  * included, is a valid SKU; a space is a lint warning, never an error.
  *
  * Two SKUs are the same SKU when their {@link skuKey} is equal: trimmed, NBSP read as a space, and
@@ -25,6 +26,8 @@ export const CHECKOUT_CODE_MAX_LENGTH = 200;
 export const SKU_TOKEN_MAX_LENGTH = SKU_MAX_LENGTH * 12;
 
 const CONTROL = /\p{Cc}/u;
+/** A lone surrogate: in `u` mode a paired surrogate is one code point and never matches. */
+const LONE_SURROGATE = /\p{Cs}/u;
 const WHITESPACE = /\s/u;
 const TOKEN_SAFE = /^[A-Za-z0-9._-]$/;
 const TOKEN = /^(?:[A-Za-z0-9._-]|%[0-9A-F]{2})+$/;
@@ -33,13 +36,14 @@ const TOKEN = /^(?:[A-Za-z0-9._-]|%[0-9A-F]{2})+$/;
  * Read a SKU as it arrives from a merchant, a file or an import.
  *
  * @param {unknown} value
- * @returns {{ ok: true, sku: string } | { ok: false, reason: "not-string" | "empty" | "control-character" | "too-long" }}
+ * @returns {{ ok: true, sku: string } | { ok: false, reason: "not-string" | "empty" | "control-character" | "ill-formed" | "too-long" }}
  */
 export function parseSku(value) {
   if (typeof value !== "string") return { ok: false, reason: "not-string" };
   const sku = value.trim();
   if (sku === "") return { ok: false, reason: "empty" };
   if (CONTROL.test(sku)) return { ok: false, reason: "control-character" };
+  if (LONE_SURROGATE.test(sku)) return { ok: false, reason: "ill-formed" };
   if ([...sku].length > SKU_MAX_LENGTH) return { ok: false, reason: "too-long" };
   return { ok: true, sku };
 }
@@ -92,6 +96,7 @@ const REASONS = {
   "not-string": "a SKU must be text",
   empty: "a SKU cannot be empty",
   "control-character": "a SKU cannot contain a control character (tab, newline, ...)",
+  "ill-formed": "a SKU must be well-formed Unicode text (it contains a broken character)",
   "too-long": `a SKU is at most ${SKU_MAX_LENGTH} characters`,
 };
 

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -165,7 +165,13 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
   document.addEventListener("visibilitychange", function () {
     if (document.visibilityState === "hidden") endCartNavigation();
   });
+  // A shopper action belongs to the page lifecycle it was taken in. Leaving the page
+  // starts a new one, so an action whose async work (session, gate, drawer) settles
+  // after a back-forward-cache restore is abandoned rather than replayed.
+  var lifecycle = 0;
+  function current(gen) { return gen === lifecycle; }
   window.addEventListener("pagehide", function () {
+    lifecycle++;
     endCartNavigation();
     dropHeld();
   });
@@ -389,7 +395,9 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     }
     if (event.defaultPrevented) return;
     event.preventDefault();
+    var gen = lifecycle;
     whenReady(anchor, function () {
+      if (!current(gen)) return;
       stampAnchor(anchor);
       replay(anchor, function () { anchor.click(); });
     });
@@ -427,8 +435,9 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     note.textContent = ${literal(CART_UNAVAILABLE_MESSAGE)};
     form.insertAdjacentElement('afterend', note);
   }
-  function openSessionThen(form, fn) {
+  function openSessionThen(form, gen, fn) {
     ensureSession().then(function (id) {
+      if (!current(gen)) return;
       if (!id) { showCartUnavailable(form); return; }
       form.dataset.cartSession = '1';
       fn();
@@ -441,6 +450,10 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     var managed = form.matches(${managedCart});
     var cartForm = targetsCart(form.getAttribute('action'));
     if (!managed && !cartForm) return;
+    var gen = lifecycle;
+    function resubmitLive() {
+      if (current(gen)) replay(form, function () { resubmit(form); });
+    }
     if (form.dataset.cartSession === '1') {
       if (!cartForm || settled()) {
         if (!event.defaultPrevented && settled()) {
@@ -455,18 +468,23 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
         return;
       }
       event.preventDefault();
-      whenReady(form, function () { stampForm(form); replay(form, function () { resubmit(form); }); });
+      whenReady(form, function () {
+        if (!current(gen)) return;
+        stampForm(form);
+        resubmitLive();
+      });
       return;
     }
     event.preventDefault();
     function afterGate() {
-      openSessionThen(form, function () {
+      if (!current(gen)) return;
+      openSessionThen(form, gen, function () {
         if (cartForm) {
           stampForm(form);
-          whenReady(form, function () { replay(form, function () { resubmit(form); }); });
+          whenReady(form, resubmitLive);
           return;
         }
-        resubmit(form);
+        if (current(gen)) resubmit(form);
       });
     }
     if (storeNotPublic && managed && form.dataset.checkoutReachable !== '1') {
@@ -481,7 +499,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       }).then(function (res) {
         if (res.status === 401 && res.headers.get('x-tot-gate') === 'store-not-public') {
           return res.json().then(function (body) { return body && body.signIn; }, function () { return null; })
-            .then(function (signIn) { showUnavailable(form, signIn); });
+            .then(function (signIn) { if (current(gen)) showUnavailable(form, signIn); });
         }
         form.dataset.checkoutReachable = '1';
         afterGate();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.6.2",
+  "version": "4.6.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/contact-sales-action-source.ts

@@ -86,6 +86,10 @@ export function createContactSalesActionSource(
     subscribe(listener) {
       if (!document || typeof document.querySelectorAll !== "function") return () => {};
       const removals: Array<() => void> = [];
+      // A deferred navigation belongs to this subscription. Teardown (pagehide) abandons
+      // it, so a back-forward-cache restore never resumes a navigation the shopper left.
+      let live = true;
+      removals.push(() => { live = false; });
       const bound = new Set<ContactSalesActionElement>();
       for (const source of CONTACT_SALES_ACTION_SOURCES) {
         const nodes = document.querySelectorAll(source.selector);
@@ -110,7 +114,7 @@ export function createContactSalesActionSource(
             // A full-document navigation destroys the isolated GA4 iframe. Give its
             // MessagePort one bounded turn to receive the reviewed action first.
             if (navigationHref) {
-              schedule(() => options.navigate?.(navigationHref), CONTACT_SALES_NAVIGATION_DEFER_MS);
+              schedule(() => { if (live) options.navigate?.(navigationHref); }, CONTACT_SALES_NAVIGATION_DEFER_MS);
             }
           };
           node.addEventListener("click", emit);