@tokenoftrust/storefront-runner 4.7.10 → 4.8.1

package/apps/storefront/src/lib/access/shared/developerInvites.ts

@@ -54,9 +54,9 @@
  */
 import { readEnv } from "@/lib/publication/shared/env";
 import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
-import { diagEmail } from "@/lib/observability/diag/redact";
 import { checkStorePreviewReady, type PreflightDecision } from "@/lib/access/shared/invitePreflight";
 import { explainDeveloperAccess, type AccessVerification } from "@/lib/access/shared/accessExplain";
+import { failureReasonForStatus, type FailureReason } from "@/lib/observability/diag/failureReason";
 
 /**
  * The header carrying the storefront-signed staff BROKER ASSERTION to tot20
@@ -444,8 +444,6 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
     // the email-send trace). `signInUrlHost` is the top allowlist suspect.
     logInviteDiag("request", {
       endpoint: `${this.baseUrl}/api/clients/developerInvites`,
-      tenant: input.tenant,
-      email: diagEmail(input.email.toLowerCase()),
       sendEmail: input.sendEmail ?? "(unset → tot20 default)",
       hasSignInUrl: !!input.signInUrl,
       signInUrlHost: safeHost(input.signInUrl),
@@ -460,14 +458,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         headers,
         body,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure calling tot20 " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure calling tot20",
       };
     }
 
@@ -486,19 +482,17 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
     // DIAGNOSTIC: tot20's decision — the crux is `emailed`. `changed:false, emailed:false`
     // means tot20 authorized + already had the role but did NOT send (the gate we're hunting).
     logInviteDiag("response", {
-      tenant: input.tenant,
-      email: diagEmail(input.email.toLowerCase()),
       httpStatus: res.status,
       ok: result.ok,
       ...(result.ok
         ? {
             changed: result.changed,
             emailed: result.emailed,
-            emailReason: result.emailReason ?? "(none)",
-            emailDetail: result.emailDetail,
+            hasEmailReason: !!result.emailReason,
+            hasEmailDetail: !!result.emailDetail,
             signInEligible: result.signInEligible,
           }
-        : { reason: result.reason, code: result.code }),
+        : { reason: result.reason, hasCode: !!result.code }),
     });
     return result;
   }
@@ -529,14 +523,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         `${this.baseUrl}/api/clients/developerInvites?${q.toString()}`,
         headers,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure listing invites " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure listing invites",
       };
     }
     let parsed: unknown;
@@ -576,14 +568,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         `${this.baseUrl}/api/clients/developerInvites/${encodeURIComponent(inviteId)}`,
         headers,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure revoking invite " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure revoking invite",
       };
     }
     let parsed: unknown;
@@ -801,6 +791,29 @@ export function developerInviteHttpStatus(
   }
 }
 
+/**
+ * Client-facing copy for a developer-invite failure. Routes answer with this, never with
+ * the result's `message` (which can carry tot20's own text).
+ */
+export function developerInviteFailureMessage(reason: DeveloperInviteFailureReason): string {
+  switch (reason) {
+    case "notGranted":
+      return "storefront isn't authorized to manage developers on this vendor";
+    case "notAuthenticated":
+      return "storefront's operator credential was rejected";
+    case "tenantRequired":
+      return "a target vendor is required";
+    case "invalidEmail":
+      return "a valid developer email is required";
+    case "tenantNotFound":
+      return "this vendor isn't a resolvable Token of Trust app";
+    case "storeNotProvisioned":
+      return "this vendor's store repo isn't provisioned on this environment yet";
+    default:
+      return "Token of Trust couldn't complete the request; try again shortly";
+  }
+}
+
 function defaultMessage(
   reason: DeveloperInviteFailureReason,
   status: number,
@@ -1108,9 +1121,9 @@ export async function recordDeveloperAppBinding(
 export type AcceptInviteResult =
   | { accepted: true; changed: boolean }
   // Not attempted (seam unconfigured) or no invite to accept — not a hard failure.
-  | { accepted: false; skipped: true; reason: string }
+  | { accepted: false; skipped: true; reason: "no-tenant-or-email" | "not-configured" | "no-invite-for-email" }
   // Attempted but failed for a real reason (auth / store fault / transport).
-  | { accepted: false; skipped: false; reason: string };
+  | { accepted: false; skipped: false; reason: FailureReason };
 
 /**
  * Mark a developer invite ACCEPTED at the magic-link confirm (#8425 accept-before-
@@ -1167,19 +1180,9 @@ export async function acceptDeveloperInvite(
     if (res.status === 404) {
       return { accepted: false, skipped: true, reason: "no-invite-for-email" };
     }
-    return {
-      accepted: false,
-      skipped: false,
-      reason: `tot20 accept returned status ${res.status}`,
-    };
-  } catch (cause) {
-    return {
-      accepted: false,
-      skipped: false,
-      reason:
-        "developerInvites accept transport failure: " +
-        (cause instanceof Error ? cause.message : String(cause)),
-    };
+    return { accepted: false, skipped: false, reason: failureReasonForStatus(res.status) };
+  } catch {
+    return { accepted: false, skipped: false, reason: "transport" };
   }
 }
 
@@ -1258,9 +1261,8 @@ export async function inviteDeveloperToTenant(
   const preflight = deps.preflight ?? checkStorePreviewReady;
   const ready = await preflight(input.tenant);
   if (ready.block) {
-    console.warn(
-      `[developerInvites] invite BLOCKED by preflight for ${input.tenant}: ${ready.reason}`,
-    );
+    // Finite fields only: no tenant, no free-form preflight reason.
+    console.warn("[developerInvites] invite blocked by preflight");
     return {
       invite: {
         ok: false,

package/apps/storefront/src/lib/access/shared/invitePreflight.ts

@@ -82,7 +82,7 @@ export async function checkStorePreviewReady(
   if (outcome.kind === "not-configured") return { block: false, reason: "not-configured" };
   if (outcome.kind === "bad-url") return { block: false, reason: "bad-mcp-url" };
   if (outcome.kind === "transport-error") {
-    return { block: false, reason: "preflight request failed: " + outcome.message };
+    return { block: false, reason: "preflight request failed" };
   }
   if (outcome.kind === "misconfigured") {
     return { block: false, reason: `preflight misconfigured: status ${outcome.status}` };

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -76,7 +76,6 @@
  * swaps in the Http client with no call-site change.
  */
 import { readEnv } from "@/lib/publication/shared/env";
-import { diagEmail } from "@/lib/observability/diag/redact";
 import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
@@ -285,8 +284,6 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
 
     logGrantDiag("request", {
       endpoint: `${this.baseUrl}/api/clients/principalGrants`,
-      tenant: input.tenant,
-      email: diagEmail(input.principal.email.toLowerCase()),
       capability: input.capability,
       expiresAt: input.expiresAt,
     });
@@ -298,17 +295,18 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
         this.brokeredHeaders(assertion, false),
         body,
       );
-    } catch (cause) {
-      return transportFailure("creating principal grant", cause);
+    } catch {
+      return transportFailure("creating principal grant");
     }
     const parsed = await safeJson(res, "creating principal grant");
     if ("failed" in parsed) return parsed.failed;
     const result = normalizeCreateResponse(res.status, parsed.body);
     logGrantDiag("response", {
-      tenant: input.tenant,
       httpStatus: res.status,
       ok: result.ok,
-      ...(result.ok ? { ref: result.ref } : { reason: result.reason, code: result.code }),
+      ...(result.ok
+        ? { hasRef: !!result.ref }
+        : { reason: result.reason, hasCode: !!result.code }),
     });
     return result;
   }
@@ -324,8 +322,8 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
         `${this.baseUrl}/api/clients/principalGrants?tenant=${encodeURIComponent(tenant)}`,
         this.brokeredHeaders(assertion, true),
       );
-    } catch (cause) {
-      return transportFailure("listing principal grants", cause);
+    } catch {
+      return transportFailure("listing principal grants");
     }
     const parsed = await safeJson(res, "listing principal grants");
     if ("failed" in parsed) return parsed.failed;
@@ -345,8 +343,8 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
           `?tenant=${encodeURIComponent(tenant)}`,
         this.brokeredHeaders(assertion, true),
       );
-    } catch (cause) {
-      return transportFailure("revoking principal grant", cause);
+    } catch {
+      return transportFailure("revoking principal grant");
     }
     const parsed = await safeJson(res, "revoking principal grant");
     if ("failed" in parsed) return parsed.failed;
@@ -365,12 +363,12 @@ function brokerNotConfigured(): PrincipalGrantFailed {
   };
 }
 
-async function transportFailure(action: string, cause: unknown): Promise<PrincipalGrantFailed> {
+async function transportFailure(action: string): Promise<PrincipalGrantFailed> {
   return {
     ok: false,
     status: 0,
     reason: "error",
-    message: `principalGrants: transport failure ${action} ` + (cause instanceof Error ? cause.message : String(cause)),
+    message: `principalGrants: transport failure ${action}`,
   };
 }
 
@@ -458,11 +456,12 @@ function failureFrom(
   const code = typeof c.code === "string" ? c.code : undefined;
   const reason = reasonFor(code, status);
   const upstream = typeof c.message === "string" ? c.message : undefined;
-  const message = reason === "error" && upstream ? upstream : defaultMessage(reason, status);
+  const message = reason === "error" && upstream ? upstream : principalGrantFailureMessage(reason);
   return { status, reason, message, ...(code ? { code } : {}) };
 }
 
-function defaultMessage(reason: PrincipalGrantFailureReason, status: number): string {
+/** Finite operator-facing copy for a principal-grant refusal — the only text a route returns. */
+export function principalGrantFailureMessage(reason: PrincipalGrantFailureReason): string {
   switch (reason) {
     case "notAuthenticated":
       return "storefront isn't authorized to grant on this tenant";
@@ -486,7 +485,7 @@ function defaultMessage(reason: PrincipalGrantFailureReason, status: number): st
     case "brokerNotConfigured":
       return "delegation isn't available on this deployment";
     default:
-      return `principalGrants: tot20 returned status ${status}`;
+      return "Token of Trust couldn't complete the delegation; try again shortly";
   }
 }
 
@@ -578,7 +577,7 @@ export class MockPrincipalGrantClient implements PrincipalGrantClient {
       ok: false,
       status: 403,
       reason: "subjectNotTenantOwner",
-      message: defaultMessage("subjectNotTenantOwner", 403),
+      message: principalGrantFailureMessage("subjectNotTenantOwner"),
       code: "operatorGrants:subjectNotTenantOwner",
     };
   }

package/apps/storefront/src/lib/content/shared/homeVisualParity.ts

@@ -1,13 +1,18 @@
 import {
+  LATEST_POSTS_DEFAULT_LIMIT,
+  LATEST_POSTS_MAX_LIMIT,
   isPageBlockImageReference,
   isSafeStorefrontHref,
 } from "@tot/public-runtime";
 import { withBase } from "@/lib/publication/shared/basePath";
+import { categorySlug } from "@/lib/content/blog/collection.js";
+import type { BlogPostSummary } from "@/lib/content/blog/types.js";
 import type {
   CommerceTrustStripBlock,
   EditorialBlock,
   FaqBlock,
   HomeBlock,
+  LatestPostsBlock,
   MarketingBlock,
   MembershipBandBlock,
   NewsletterBlock,
@@ -142,6 +147,70 @@ export function editorialBlockView(block: EditorialBlock): EditorialBlockView {
   };
 }
 
+export interface LatestPostsView {
+  eyebrow?: string;
+  title: string;
+  posts: BlogPostSummary[];
+  cta: { label: string; href: string } | null;
+}
+
+const LATEST_POSTS_DEFAULT_TITLE = "Latest posts";
+const LATEST_POSTS_DEFAULT_CTA_LABEL = "View all";
+
+/** The card count a `latest_posts` block shows: a whole number from 1 to the cap, else the default. */
+export function latestPostsLimit(value: unknown): number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1
+    ? Math.min(value, LATEST_POSTS_MAX_LIMIT)
+    : LATEST_POSTS_DEFAULT_LIMIT;
+}
+
+/**
+ * The newest `limit` posts, newest first by `publishedAt` (an unreadable date sorts last, ties keep
+ * the collection's own order), narrowed to one tag when the block declares it. The caller passes
+ * the posts the live blog lists, so drafts and unlisted posts never reach this.
+ */
+export function selectLatestPosts(
+  posts: readonly BlogPostSummary[],
+  block: Pick<LatestPostsBlock, "limit" | "tag">,
+): BlogPostSummary[] {
+  const tag = declaredText(block.tag);
+  const wanted = tag === undefined ? null : categorySlug(tag);
+  const time = (post: BlogPostSummary) => {
+    const ms = Date.parse(post.publishedAt);
+    return Number.isNaN(ms) ? Number.NEGATIVE_INFINITY : ms;
+  };
+  return posts
+    .filter((post) => wanted === null || post.tags.some((term) => categorySlug(term) === wanted))
+    .map((post, index) => ({ post, index, at: time(post) }))
+    .sort((a, b) => (a.at === b.at ? a.index - b.index : b.at > a.at ? 1 : -1))
+    .slice(0, latestPostsLimit(block.limit))
+    .map((entry) => entry.post);
+}
+
+/**
+ * The `latest_posts` section, or null when the tenant has no post to show (a section with a
+ * heading and no cards is worse than none). `blogIndexPath` is the blog index the collection
+ * resolves for the serving space, tenant-relative; the declared `ctaHref` replaces it.
+ */
+export function latestPostsView(
+  block: LatestPostsBlock,
+  posts: readonly BlogPostSummary[],
+  blogIndexPath: string,
+  basePath: string,
+): LatestPostsView | null {
+  const selected = selectLatestPosts(posts, block);
+  if (selected.length === 0) return null;
+  const href = declaredText(block.ctaHref) ?? blogIndexPath;
+  return {
+    eyebrow: declaredText(block.eyebrow),
+    title: declaredText(block.title) ?? LATEST_POSTS_DEFAULT_TITLE,
+    posts: selected,
+    cta: isSafeStorefrontHref(href)
+      ? { label: declaredText(block.ctaLabel) ?? LATEST_POSTS_DEFAULT_CTA_LABEL, href: withBase(basePath, href) }
+      : null,
+  };
+}
+
 /**
  * The editorial block's media column: the block image, else generated art when
  * the block asks for it with `imageSeed`, else none — a text-only block.

package/apps/storefront/src/lib/content/storyblok/content-model.ts

@@ -26,9 +26,30 @@ export type HomeBlock = (
   | EditorialBlock
   | NewsletterBlock
   | FaqBlock
+  | LatestPostsBlock
 ) &
   BlockIdentity;
 
+/**
+ * The newest posts of the tenant's own blog as cards, rendered into the static
+ * home page at publish. Every prop is optional: `{ "component": "latest_posts" }`
+ * is a complete block. A tenant with no listable post renders nothing.
+ */
+export interface LatestPostsBlock {
+  component: "latest_posts";
+  eyebrow?: string;
+  /** Section heading. Absent uses the platform default. */
+  title?: string;
+  /** Cards shown, newest first. Positive integer up to 12; absent uses 3. */
+  limit?: number;
+  /** Only posts carrying this tag (matched by slug, so casing and spacing are free). */
+  tag?: string;
+  /** "View all" button label. Absent uses the platform default. */
+  ctaLabel?: string;
+  /** "View all" button target, a same-storefront path. Absent targets the blog index. */
+  ctaHref?: string;
+}
+
 export interface CommerceTrustStripBlock {
   component: "trust_strip";
   items: TrustStripItem[];

package/apps/storefront/src/lib/engagement/messaging/messagesClient.ts

@@ -16,6 +16,10 @@
  * Built like `@/lib/grants/developerInvites` (interface + Http impl + Mock + env factory).
  */
 import { readEnv } from "@/lib/publication/shared/env";
+import {
+  failureReasonForStatus,
+  type FailureReason,
+} from "@/lib/observability/diag/failureReason";
 
 export interface InlineEmail {
   /** Recipient address. */
@@ -26,9 +30,13 @@ export interface InlineEmail {
   html: string;
 }
 
+/**
+ * `reason` is a finite category. Upstream failure text (exception messages, tot20's
+ * `message`/`reason` fields) can echo the recipient address, so it never leaves this client.
+ */
 export type MessageSendResult =
   | { sent: true; id?: string }
-  | { sent: false; status: number; reason: string };
+  | { sent: false; status: number; reason: FailureReason };
 
 export interface MessagesClient {
   sendInlineEmail(msg: InlineEmail): Promise<MessageSendResult>;
@@ -97,14 +105,14 @@ export class HttpMessagesClient implements MessagesClient {
           ...this.credentialFields(),
         },
       );
-    } catch (cause) {
-      return { sent: false, status: 0, reason: cause instanceof Error ? cause.message : String(cause) };
+    } catch {
+      return { sent: false, status: 0, reason: "transport" };
     }
     let body: unknown;
     try {
       body = await res.json();
     } catch {
-      return { sent: false, status: res.status, reason: `non-JSON body (status ${res.status})` };
+      return { sent: false, status: res.status, reason: "non-json" };
     }
     return normalizeSend(res.status, body);
   }
@@ -117,9 +125,7 @@ export function normalizeSend(status: number, body: unknown): MessageSendResult
   if (c.sent === true || (status >= 200 && status < 300 && c.sent !== false)) {
     return { sent: true, ...(typeof c.id === "string" ? { id: c.id } : {}) };
   }
-  const reason =
-    typeof c.message === "string" ? c.message : typeof c.reason === "string" ? c.reason : `send failed (status ${status})`;
-  return { sent: false, status, reason };
+  return { sent: false, status, reason: failureReasonForStatus(status) };
 }
 
 // --- Mock (tests + local dev) -----------------------------------------------

package/apps/storefront/src/lib/observability/diag/failureReason.ts

@@ -0,0 +1,37 @@
+/**
+ * The finite set of failure categories a diagnostic line or client-facing response may
+ * carry. Upstream failure text (exception messages, response bodies, remote `message` /
+ * `reason` fields) can hold addresses, tokens or tenant detail, so it is mapped to one of
+ * these categories at the producer and never forwarded verbatim.
+ */
+export const FAILURE_REASONS = [
+  "transport",
+  "non-json",
+  "unauthorized",
+  "not-found",
+  "rate-limited",
+  "rejected",
+  "upstream-error",
+  "not-configured",
+  "unknown",
+] as const;
+
+export type FailureReason = (typeof FAILURE_REASONS)[number];
+
+const KNOWN: ReadonlySet<string> = new Set(FAILURE_REASONS);
+
+export function isFailureReason(value: unknown): value is FailureReason {
+  return typeof value === "string" && KNOWN.has(value);
+}
+
+/** Category for an HTTP status (0 = no response reached us). */
+export function failureReasonForStatus(status: number): FailureReason {
+  if (status === 0) return "transport";
+  if (status === 401 || status === 403) return "unauthorized";
+  if (status === 404) return "not-found";
+  if (status === 429) return "rate-limited";
+  if (status >= 400 && status < 500) return "rejected";
+  if (status >= 500 && status < 600) return "upstream-error";
+  if (status >= 200 && status < 300) return "rejected";
+  return "unknown";
+}

package/apps/storefront/src/lib/observability/diag/redact.ts

@@ -1,20 +1,17 @@
 /**
- * Redaction helpers for diagnostic logs — keep traces correlatable without persisting PII.
+ * Redaction helpers for diagnostic logs. An email address never appears in a diagnostic
+ * line in any build: not the local part, not its first character, not the domain.
+ * Correlate with an opaque reference (for example `hashActorId`) instead.
  */
 
-/** Mask an email for logs: keep the first char + the domain (`d***@example.com`). */
-export function maskEmail(email: string): string {
-  const at = email.indexOf("@");
-  if (at <= 0) return "***";
-  return `${email[0]}***${email.slice(at)}`;
+export const REDACTED_EMAIL = "[redacted-email]";
+
+/** A log-safe stand-in for an email address. Reveals nothing about the input. */
+export function maskEmail(_email: string): string {
+  return REDACTED_EMAIL;
 }
 
-/**
- * Email for a diagnostic line: the FULL address in local dev only (`import.meta.env.DEV`
- * is a static boolean → this branch is tree-shaken from the production worker), where logs
- * are local + gitignored and the raw address is needed for debugging; MASKED everywhere the
- * build is deployed, so prod/worker logs never persist raw recipient PII.
- */
-export function diagEmail(email: string): string {
-  return import.meta.env.DEV ? email : maskEmail(email);
+/** Email for a diagnostic line. Fully redacted in local dev and deployed builds alike. */
+export function diagEmail(_email: string): string {
+  return REDACTED_EMAIL;
 }

package/apps/storefront/src/lib/orders/admin/orderSource.ts

@@ -45,7 +45,8 @@ export type OrderSourceGap = "no-tenant" | "stage-unknown" | "ledger-unavailable
 export interface LedgerSyncStatus {
   orders: number;
   lastOrderAt: string | null;
-  unconfirmed: { count: number; oldestAt: string | null };
+  /** Reservations from the last 7 days no payment confirmation has reached; `awaiting` is those still inside the grace window. */
+  unconfirmed: { count: number; oldestAt: string | null; awaiting: number };
 }
 
 /** Which FoxyCart store takes this tenant's payments, or null when no store is selected. */
@@ -147,11 +148,18 @@ export function orderSyncHealth(source: OrderSource, status: LedgerSyncStatus |
   if (source.kind === "not-connected") return { value: "Not connected", detail: orderSourceGapMessage(source.gap) };
   if (source.kind === "partner-api") return { value: "Connected", detail: "Reads this store's checkout orders." };
   if (!status) return { value: "Check", detail: "Order sync status could not be read. Reload to try again." };
-  if (status.unconfirmed.count > 0) {
-    const n = status.unconfirmed.count;
+  const overdue = status.unconfirmed.count - status.unconfirmed.awaiting;
+  if (overdue > 0) {
     return {
       value: "Check",
-      detail: `${n} checkout${n === 1 ? "" : "s"} in the last 7 days passed final cart with no payment confirmation received.`,
+      detail: `${overdue} checkout${overdue === 1 ? "" : "s"} passed final cart more than ${PAYMENT_CONFIRMATION_GRACE_MINUTES} minutes ago with no payment confirmation received.`,
+    };
+  }
+  if (status.unconfirmed.awaiting > 0) {
+    const n = status.unconfirmed.awaiting;
+    return {
+      value: "Connected",
+      detail: `${n} checkout${n === 1 ? "" : "s"} passed final cart in the last ${PAYMENT_CONFIRMATION_GRACE_MINUTES} minutes; payment confirmation has not reached this store yet.`,
     };
   }
   return {
@@ -283,6 +291,14 @@ function listLimit(limit: number | undefined): number {
 /** A shopper who abandons at payment leaves a reservation too, so only recent ones are reported. */
 export const UNCONFIRMED_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
 
+/**
+ * A payment confirmation reaches the ledger after the shopper pays, not with the reservation. A
+ * reservation younger than this is awaiting one; an older one is reported as missing it. One
+ * measured delivery took over 7 minutes (2026-10-27), so the window leaves room beyond that.
+ */
+export const PAYMENT_CONFIRMATION_GRACE_MINUTES = 15;
+const PAYMENT_CONFIRMATION_GRACE_MS = PAYMENT_CONFIRMATION_GRACE_MINUTES * 60 * 1000;
+
 /**
  * Paid orders and sync status over one tenant's ledger book, read once per request. A `scrappy`
  * reservation is never listed as an order; one from the last seven days that no provider event
@@ -338,10 +354,15 @@ export function ledgerOrderBook(
       .map((entry) => isoInstant(entry.placedAt))
       .filter((at) => at >= since)
       .sort();
+    const settled = new Date(now.getTime() - PAYMENT_CONFIRMATION_GRACE_MS).toISOString();
     return {
       orders: orders.length,
       lastOrderAt: placed[placed.length - 1] ?? null,
-      unconfirmed: { count: waiting.length, oldestAt: waiting[0] ?? null },
+      unconfirmed: {
+        count: waiting.length,
+        oldestAt: waiting[0] ?? null,
+        awaiting: waiting.filter((at) => at > settled).length,
+      },
     };
   };