@tokenoftrust/storefront-runner 4.9.1 → 4.9.3

package/apps/storefront/src/lib/engagement/contact/contactMessages.ts

@@ -1,20 +1,41 @@
 /**
  * `contact_messages` store — visitor messages from a store's contact form, kept in
- * `STOREFRONT_APPS_DB`. Pure over a minimal SQL seam, so the Worker runs it
+ * `STOREFRONT_APPS_DB` (migrations-apps/0021). Pure over a minimal SQL seam, so the Worker runs it
  * against D1 and tests against `node:sqlite`.
  *
- * Every method takes the tenant id and scopes its SQL by it: an id belonging to
- * another tenant is indistinguishable from an id that does not exist. The caller
- * resolves `tenantId` from the routed tenant, never from a request body.
+ * The visitor's name, email, phone and message exist at rest only as one contact vault envelope
+ * (`lib/customers/contactVault/envelope.ts`, purpose `contact-message`) whose AAD binds tenant, stage, message
+ * id and the immutable `not_after`. A row still holding legacy plaintext is never read; the rollout
+ * and the hourly sweep seal it ({@link sealLegacyContactMessages}).
+ *
+ * Every method takes the tenant id and the routed stage and scopes its SQL by both: an id belonging
+ * to another tenant or stage is indistinguishable from an id that does not exist. Every read writes
+ * its `contact_access_audit` row before anything is decrypted. Nothing here logs.
  */
+import {
+  openVaultRecord,
+  sealVaultRecord,
+  VaultKeyUnavailableError,
+  type VaultBinding,
+  type VaultKeyring,
+} from "@/lib/customers/contactVault/envelope.js";
+import { isReadable, notAfterFrom } from "@/lib/customers/contactVault/retention.js";
+import { admitAudit, auditStatement, type ContactActor, type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
+
+interface QueryStatement {
+  sql: string;
+  params?: readonly unknown[];
+}
+
 /** The SQL surface this store needs; D1's `fromD1` and the test harness both satisfy it. */
 export interface ContactDb {
   all<T = Record<string, unknown>>(sql: string, ...params: unknown[]): Promise<T[]>;
   first<T = Record<string, unknown>>(sql: string, ...params: unknown[]): Promise<T | null>;
   run(sql: string, ...params: unknown[]): Promise<void>;
+  /** D1 executes a batch sequentially inside one implicit transaction. */
+  batch?(statements: readonly QueryStatement[]): Promise<void>;
 }
 
-export const CONTACT_RETENTION_DAYS = 365;
 export const CONTACT_LIST_LIMIT = 200;
 
 export type ContactMessageStatus = "unread" | "read";
@@ -22,6 +43,7 @@ export type ContactMessageStatus = "unread" | "read";
 export interface NewContactMessage {
   id: string;
   tenantId: string;
+  stage: VaultStage;
   name: string;
   email: string;
   phone: string;
@@ -41,114 +63,269 @@ export interface ContactMessage {
   readAt: string | null;
 }
 
-interface ContactMessageRow {
+export type ContactRefusal =
+  | { ok: false; status: 404; reason: "not-found" }
+  | { ok: false; status: 429; reason: "quota" }
+  | { ok: false; status: 503; reason: "audit-unavailable" | "vault-key-unavailable" };
+
+export type ListOutcome = { ok: true; messages: ContactMessage[] } | ContactRefusal;
+export type SupportReadOutcome = { ok: true; message: ContactMessage } | ContactRefusal;
+export type EraseOutcome = { ok: true } | ContactRefusal;
+
+interface SealedRow {
   id: string;
-  name: string;
-  email: string;
-  phone: string;
-  message: string;
+  key_id: string;
+  nonce: string;
+  ciphertext: string;
+  not_after: string;
+  expires_at: string;
   page_path: string | null;
   status: string;
   created_at: string;
   read_at: string | null;
 }
 
-function toMessage(row: ContactMessageRow): ContactMessage {
-  return {
-    id: row.id,
-    name: row.name,
-    email: row.email,
-    phone: row.phone,
-    message: row.message,
-    pagePath: row.page_path,
-    status: row.status === "read" ? "read" : "unread",
-    createdAt: row.created_at,
-    readAt: row.read_at,
-  };
+interface ContactPlaintext {
+  name: string;
+  email: string;
+  phone: string;
+  message: string;
+}
+
+const SEALED_COLUMNS = "id, key_id, nonce, ciphertext, not_after, expires_at, page_path, status, created_at, read_at";
+/** A row the store may act on: sealed, and strictly before both its expiry and its ceiling. */
+const READABLE = "ciphertext IS NOT NULL AND ? < expires_at AND ? < not_after";
+
+function binding(tenantId: string, stage: VaultStage, id: string, notAfter: string): VaultBinding {
+  return { purpose: "contact-message", tenantId, stage, recordId: id, notAfter };
+}
+
+function requireBatch(db: ContactDb): NonNullable<ContactDb["batch"]> {
+  if (!db.batch) throw new Error("D1 batch is unavailable");
+  return db.batch.bind(db);
+}
+
+function asPlaintext(value: unknown): ContactPlaintext | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const v = value as Record<string, unknown>;
+  const fields = [v.name, v.email, v.phone, v.message];
+  if (!fields.every((f) => typeof f === "string")) return null;
+  return { name: v.name as string, email: v.email as string, phone: v.phone as string, message: v.message as string };
 }
 
 export class ContactMessagesStore {
   constructor(
     private readonly db: ContactDb,
+    private readonly keyring: VaultKeyring | null,
     private readonly now: () => Date = () => new Date(),
   ) {}
 
+  /** Seal and store one message. Throws {@link VaultKeyUnavailableError} (writing nothing) without a keyring. */
   async insert(input: NewContactMessage): Promise<void> {
+    const created = this.now();
+    const notAfter = notAfterFrom(created);
+    const plaintext: ContactPlaintext = { name: input.name, email: input.email, phone: input.phone, message: input.message };
+    const sealed = await sealVaultRecord(this.keyring, binding(input.tenantId, input.stage, input.id, notAfter), plaintext);
     await this.db.run(
       `INSERT INTO contact_messages
-         (id, tenant_id, name, email, phone, message, page_path, status, created_at, notify_status, notify_attempts)
-       VALUES (?, ?, ?, ?, ?, ?, ?, 'unread', ?, 'pending', 0)`,
+         (id, tenant_id, stage, key_id, nonce, ciphertext, not_after, expires_at, page_path, status, created_at, notify_status, notify_attempts)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'unread', ?, 'pending', 0)`,
       input.id,
       input.tenantId,
-      input.name,
-      input.email,
-      input.phone,
-      input.message,
+      input.stage,
+      sealed.keyId,
+      sealed.nonce,
+      sealed.ciphertext,
+      notAfter,
+      notAfter,
       input.pagePath,
-      this.now().toISOString(),
+      created.toISOString(),
     );
   }
 
-  /** Newest first, capped at {@link CONTACT_LIST_LIMIT}. */
-  async list(tenantId: string): Promise<ContactMessage[]> {
-    const rows = await this.db.all<ContactMessageRow>(
-      `SELECT id, name, email, phone, message, page_path, status, created_at, read_at
-         FROM contact_messages
-        WHERE tenant_id = ?
+  /** The owner inbox: one `list` audit row commits, then newest first, capped at {@link CONTACT_LIST_LIMIT}. */
+  async list(tenantId: string, stage: VaultStage, actor: ContactActor, auditId: string): Promise<ListOutcome> {
+    if (!this.keyring) return { ok: false, status: 503, reason: "vault-key-unavailable" };
+    const now = this.now();
+    const admitted = await admitAudit(this.db, auditStatement({
+      auditId, tenantId, stage, recordKind: "contact-message", recordId: "*", actor, action: "list", now,
+    }));
+    if (admitted === "quota") return { ok: false, status: 429, reason: "quota" };
+    if (admitted === "unavailable") return { ok: false, status: 503, reason: "audit-unavailable" };
+    const iso = now.toISOString();
+    const rows = await this.db.all<SealedRow>(
+      `SELECT ${SEALED_COLUMNS} FROM contact_messages
+        WHERE tenant_id = ? AND stage = ? AND ${READABLE}
         ORDER BY created_at DESC, id DESC
         LIMIT ?`,
-      tenantId,
-      CONTACT_LIST_LIMIT,
+      tenantId, stage, iso, iso, CONTACT_LIST_LIMIT,
+    );
+    const messages: ContactMessage[] = [];
+    for (const row of rows) {
+      const message = await this.open(tenantId, stage, row, now);
+      if (message) messages.push(message);
+    }
+    return { ok: true, messages };
+  }
+
+  /**
+   * ToT support reads one message. The caller has already proven a live staff selection and a live
+   * owner-consented grant; the audit row (with the staff quota in the same statement) commits first.
+   */
+  async supportRead(tenantId: string, stage: VaultStage, id: string, actor: ContactActor, auditId: string): Promise<SupportReadOutcome> {
+    if (!this.keyring) return { ok: false, status: 503, reason: "vault-key-unavailable" };
+    const now = this.now();
+    const admitted = await admitAudit(this.db, auditStatement({
+      auditId, tenantId, stage, recordKind: "contact-message", recordId: id, actor, action: "read", now,
+    }));
+    if (admitted === "quota") return { ok: false, status: 429, reason: "quota" };
+    if (admitted === "unavailable") return { ok: false, status: 503, reason: "audit-unavailable" };
+    const iso = now.toISOString();
+    const row = await this.db.first<SealedRow>(
+      `SELECT ${SEALED_COLUMNS} FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ${READABLE}`,
+      tenantId, stage, id, iso, iso,
     );
-    return rows.map(toMessage);
+    const message = row ? await this.open(tenantId, stage, row, now) : null;
+    return message ? { ok: true, message } : { ok: false, status: 404, reason: "not-found" };
   }
 
-  async unreadCount(tenantId: string): Promise<number> {
+  async unreadCount(tenantId: string, stage: VaultStage): Promise<number> {
+    const iso = this.now().toISOString();
     const row = await this.db.first<{ n: number }>(
-      `SELECT COUNT(*) AS n FROM contact_messages WHERE tenant_id = ? AND status = 'unread'`,
-      tenantId,
+      `SELECT COUNT(*) AS n FROM contact_messages WHERE tenant_id = ? AND stage = ? AND status = 'unread' AND ${READABLE}`,
+      tenantId, stage, iso, iso,
     );
     return Number(row?.n ?? 0);
   }
 
-  /** True when the tenant owns a message with this id (now marked read). */
-  async markRead(tenantId: string, id: string): Promise<boolean> {
+  /** True when the tenant holds a readable message with this id in this stage (now marked read). */
+  async markRead(tenantId: string, stage: VaultStage, id: string): Promise<boolean> {
+    const iso = this.now().toISOString();
     const rows = await this.db.all<{ id: string }>(
       `UPDATE contact_messages
           SET status = 'read', read_at = COALESCE(read_at, ?)
-        WHERE tenant_id = ? AND id = ?
+        WHERE tenant_id = ? AND stage = ? AND id = ? AND ${READABLE}
         RETURNING id`,
-      this.now().toISOString(),
-      tenantId,
-      id,
+      iso, tenantId, stage, id, iso, iso,
     );
     return rows.length > 0;
   }
 
-  /** True when the tenant owned a message with this id (now deleted). */
-  async delete(tenantId: string, id: string): Promise<boolean> {
-    const rows = await this.db.all<{ id: string }>(
-      `DELETE FROM contact_messages WHERE tenant_id = ? AND id = ? RETURNING id`,
-      tenantId,
-      id,
-    );
-    return rows.length > 0;
+  /** Erase one sealed message: its audit row and its delete commit in one batch, or neither does. */
+  async erase(tenantId: string, stage: VaultStage, id: string, actor: ContactActor, auditId: string): Promise<EraseOutcome> {
+    const now = this.now();
+    const rowSql = `SELECT 1 FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ciphertext IS NOT NULL`;
+    const exists = await this.db.first(rowSql, tenantId, stage, id);
+    if (!exists) return { ok: false, status: 404, reason: "not-found" };
+    const audit = auditStatement({
+      auditId, tenantId, stage, recordKind: "contact-message", recordId: id, actor, action: "erase", now,
+      requireRow: { sql: rowSql, params: [tenantId, stage, id] },
+    });
+    const statements: QueryStatement[] = [
+      { sql: audit.sql.replace(/\s*RETURNING audit_id$/, ""), params: audit.params },
+      {
+        sql: `DELETE FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ciphertext IS NOT NULL
+                AND EXISTS (SELECT 1 FROM contact_access_audit WHERE audit_id = ?)`,
+        params: [tenantId, stage, id, auditId],
+      },
+    ];
+    try {
+      await requireBatch(this.db)(statements);
+    } catch {
+      return { ok: false, status: 503, reason: "audit-unavailable" };
+    }
+    const audited = await this.db.first(`SELECT 1 AS present FROM contact_access_audit WHERE audit_id = ?`, auditId);
+    if (audited) return { ok: true };
+    const still = await this.db.first(rowSql, tenantId, stage, id);
+    return still ? { ok: false, status: 429, reason: "quota" } : { ok: false, status: 404, reason: "not-found" };
+  }
+
+  /** Decrypt one row, or null when it is past retention or does not authenticate under its binding. */
+  private async open(tenantId: string, stage: VaultStage, row: SealedRow, now: Date): Promise<ContactMessage | null> {
+    if (!isReadable(now, row.expires_at, row.not_after)) return null;
+    const opened = await openVaultRecord(this.keyring, binding(tenantId, stage, row.id, row.not_after), {
+      keyId: row.key_id, nonce: row.nonce, ciphertext: row.ciphertext,
+    }).catch((error: unknown) => {
+      if (error instanceof VaultKeyUnavailableError) return null;
+      throw error;
+    });
+    const plain = asPlaintext(opened);
+    if (!plain) return null;
+    return {
+      id: row.id,
+      ...plain,
+      pagePath: row.page_path,
+      status: row.status === "read" ? "read" : "unread",
+      createdAt: row.created_at,
+      readAt: row.read_at,
+    };
   }
 }
 
 /**
- * Delete every message older than the retention window, across all tenants.
- * Returns the number of rows removed.
+ * Delete every message at or past its expiry or its ceiling, across all tenants and stages (legacy
+ * rows included). Returns the number of rows removed. An unreadable clock throws.
  */
-export async function purgeExpiredContactMessages(
-  db: ContactDb,
-  now: Date = new Date(),
-  retentionDays: number = CONTACT_RETENTION_DAYS,
-): Promise<number> {
-  const cutoff = new Date(now.getTime() - retentionDays * 86_400_000).toISOString();
+export async function purgeExpiredContactMessages(db: ContactDb, now: Date): Promise<number> {
+  if (Number.isNaN(now.getTime())) throw new Error("contact message purge: unreadable clock");
+  const iso = now.toISOString();
   const rows = await db.all<{ id: string }>(
-    `DELETE FROM contact_messages WHERE created_at < ? RETURNING id`,
-    cutoff,
+    `DELETE FROM contact_messages WHERE expires_at <= ? OR not_after <= ? RETURNING id`,
+    iso, iso,
   );
   return rows.length;
 }
+
+interface LegacyRow {
+  id: string;
+  tenant_id: string;
+  stage: VaultStage;
+  not_after: string;
+  legacy_name: string | null;
+  legacy_email: string | null;
+  legacy_phone: string | null;
+  legacy_message: string | null;
+}
+
+/**
+ * Seal up to `limit` rows still holding legacy plaintext (oldest id first), across all tenants.
+ * Each row is one statement: the envelope is written and every `legacy_*` column nulled together,
+ * only while the row is still unsealed. `remaining` counts the unsealed rows left.
+ */
+export async function sealLegacyContactMessages(
+  db: ContactDb,
+  keyring: VaultKeyring,
+  now: Date,
+  limit: number,
+): Promise<{ sealed: number; remaining: number }> {
+  if (Number.isNaN(now.getTime())) throw new Error("contact message sealing: unreadable clock");
+  const rows = await db.all<LegacyRow>(
+    `SELECT id, tenant_id, stage, not_after, legacy_name, legacy_email, legacy_phone, legacy_message
+       FROM contact_messages WHERE ciphertext IS NULL
+      ORDER BY id LIMIT ?`,
+    Math.max(0, Math.floor(limit)),
+  );
+  let sealed = 0;
+  for (const row of rows) {
+    const plaintext: ContactPlaintext = {
+      name: row.legacy_name ?? "",
+      email: row.legacy_email ?? "",
+      phone: row.legacy_phone ?? "",
+      message: row.legacy_message ?? "",
+    };
+    const envelope = await sealVaultRecord(keyring, binding(row.tenant_id, row.stage, row.id, row.not_after), plaintext);
+    const changed = await db.all<{ id: string }>(
+      `UPDATE contact_messages
+          SET key_id = ?, nonce = ?, ciphertext = ?,
+              legacy_name = NULL, legacy_email = NULL, legacy_phone = NULL, legacy_message = NULL
+        WHERE id = ? AND ciphertext IS NULL
+        RETURNING id`,
+      envelope.keyId, envelope.nonce, envelope.ciphertext, row.id,
+    );
+    sealed += changed.length;
+  }
+  const left = await db.first<{ n: number }>(
+    `SELECT COUNT(*) AS n FROM contact_messages WHERE ciphertext IS NULL`,
+  );
+  return { sealed, remaining: Number(left?.n ?? 0) };
+}

package/apps/storefront/src/lib/engagement/contact/contract.ts

@@ -8,6 +8,7 @@
  *                                         → 200 { ok:true }
  *                                           400 invalid_json | invalid_input (+ field)
  *                                           403 forbidden_origin | invalid_token
+ *                                           409 stage-unknown (the store's stage could not be resolved)
  *                                           413 too_large · 415 unsupported_media_type
  *                                           429 rate_limited · 503 unavailable
  *                                           500 store_failed (keep the visitor's text and retry)
@@ -56,6 +57,7 @@ export type ContactErrorCode =
   | "unsupported_media_type"
   | "rate_limited"
   | "unavailable"
+  | "stage-unknown"
   | "store_failed";
 
 export type ContactSubmitResponse =

package/apps/storefront/src/lib/fulfillment/commerceProjection.ts

@@ -104,7 +104,6 @@ export async function projectCommerceOrder(
           }
         : {}),
       lines,
-      address: null,
       compliance: trusted ? snapshot.compliance : "UNKNOWN",
       stock: trusted && snapshot.payment === "captured" ? "confirmed" : "UNKNOWN",
       fulfillment:

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -18,7 +18,6 @@ import {
   actorMayCommand,
   decideCommerceCommand,
   publicCommerceEvent,
-  readOwnerAddress,
   totalsMatch,
   type CommerceActor,
   type CommerceEvidence,
@@ -32,6 +31,7 @@ import {
   type StockState,
 } from "@tot/public-runtime";
 import { readD1 } from "@/lib/publication/shared/env";
+import { terminalTransitionExpiryStatement } from "@/lib/orders/vault/orderContactVault.js";
 import { decideAdminApiAccess } from "@/lib/access/auth/adminApiGuard";
 import { readViewerSession } from "@/lib/access/auth/route";
 import type { SessionRecord } from "@/lib/access/auth/session";
@@ -80,7 +80,6 @@ export interface SourceOrderSnapshot {
   totals: MinorTotals;
   evidence: CommerceEvidence;
   lines: readonly { sku: string; quantity: number }[];
-  address: Record<string, unknown> | null;
 }
 
 export interface PackingSlip {
@@ -279,7 +278,6 @@ function observedEvent(input: {
   label: LabelState;
   totals: MinorTotals;
   evidence: CommerceEvidence;
-  address: unknown;
 }): string {
   return jsonText(
     publicCommerceEvent({
@@ -294,7 +292,6 @@ function observedEvent(input: {
       label: input.label,
       totals: input.totals,
       verificationDetail: input.evidence,
-      address: input.address,
     }),
   );
 }
@@ -586,32 +583,6 @@ export class FulfillmentService {
     return ok({ batchId, orders });
   }
 
-  async readAddress(
-    actor: FulfillmentActor,
-    orderId: string,
-  ): Promise<FulfillmentResult<Record<string, unknown>>> {
-    const scope = { tenantId: actor.tenantId, stage: actor.stage };
-    let opened = false;
-    const gate = readOwnerAddress(actor, scope, () => {
-      opened = true;
-      return true;
-    });
-    if (!gate.ok || !opened || !isOpaqueId(actor.actorId)) return refuse("denied");
-    if (!isOpaqueId(orderId)) return refuse("not-found");
-    const row = await this.db.get<{ address_json: string }>(
-      `SELECT address_json FROM scrappy_order_addresses WHERE tenant_id = ? AND stage = ? AND order_id = ?`,
-      [scope.tenantId, scope.stage, orderId],
-    );
-    if (!row) return refuse("not-found");
-    try {
-      const parsed = JSON.parse(row.address_json) as unknown;
-      if (!isRecord(parsed)) return refuse("unreadable");
-      return ok(parsed);
-    } catch {
-      return refuse("unreadable");
-    }
-  }
-
   async applySourceSnapshot(
     actor: FulfillmentActor,
     snapshot: SourceOrderSnapshot,
@@ -956,6 +927,7 @@ export class FulfillmentService {
             ],
           },
           auditStatement(state, actor.actorId, "transition", state.order.fulfillment, "handed_off", version, stamp(this.now(), state.auditCount + 1)),
+          terminalTransitionExpiryStatement(state.order, version, new Date(this.now())),
         ],
       };
     });
@@ -1177,21 +1149,6 @@ export class FulfillmentService {
     ];
     const gate = `tenant_id = ? AND stage = ? AND order_id = ? AND event_version = 1 AND source = ? AND source_order_id = ?`;
     const gateParams = [snapshot.tenantId, snapshot.stage, snapshot.orderId, snapshot.source, snapshot.sourceOrderId];
-    if (snapshot.address) {
-      statements.push({
-        sql: `INSERT INTO scrappy_order_addresses (tenant_id, stage, order_id, address_json)
-          SELECT tenant_id, stage, order_id, ?
-          FROM scrappy_commerce_orders
-          WHERE ${gate}
-            AND NOT EXISTS (
-              SELECT 1 FROM scrappy_order_addresses AS a
-              WHERE a.tenant_id = scrappy_commerce_orders.tenant_id
-                AND a.stage = scrappy_commerce_orders.stage
-                AND a.order_id = scrappy_commerce_orders.order_id
-            )`,
-        params: [jsonText(snapshot.address), ...gateParams],
-      });
-    }
     const stub = {
       order: {
         tenantId: snapshot.tenantId,
@@ -1215,7 +1172,6 @@ export class FulfillmentService {
       gatedAudit(stub, actor.actorId, "evidence", "none", jsonText(snapshot.evidence), at, gate, gateParams),
       gatedAudit(stub, actor.actorId, "lines", "none", jsonText(snapshot.lines), stamp(this.now(), 2), gate, gateParams),
       gatedAudit(stub, actor.actorId, "totals", "none", jsonText(snapshot.totals), stamp(this.now(), 3), gate, gateParams),
-      gatedAudit(stub, actor.actorId, "address-present", "none", snapshot.address ? "yes" : "no", stamp(this.now(), 4), gate, gateParams),
       gatedAudit(
         stub,
         actor.actorId,
@@ -1233,7 +1189,6 @@ export class FulfillmentService {
           label,
           totals: snapshot.totals,
           evidence: snapshot.evidence,
-          address: snapshot.address,
         }),
         stamp(this.now(), 5),
         gate,
@@ -1299,35 +1254,6 @@ export class FulfillmentService {
       statements.push(auditStatement(state, actor.actorId, "lines", "source", jsonText(snapshot.lines), nextVersion, stamp(this.now(), n)));
       n += 1;
       statements.push(auditStatement(state, actor.actorId, "totals", "source", jsonText(snapshot.totals), nextVersion, stamp(this.now(), n)));
-      if (snapshot.address) {
-        statements.push({
-          sql: `INSERT INTO scrappy_order_addresses (tenant_id, stage, order_id, address_json)
-            SELECT ?, ?, ?, ?
-            WHERE EXISTS (
-              SELECT 1 FROM scrappy_commerce_orders
-              WHERE tenant_id = ? AND stage = ? AND order_id = ? AND event_version = ?
-            )
-            ON CONFLICT(tenant_id, stage, order_id) DO UPDATE SET address_json = excluded.address_json
-            WHERE EXISTS (
-              SELECT 1 FROM scrappy_commerce_orders
-              WHERE tenant_id = ? AND stage = ? AND order_id = ? AND event_version = ?
-            )`,
-          params: [
-            snapshot.tenantId,
-            snapshot.stage,
-            snapshot.orderId,
-            jsonText(snapshot.address),
-            snapshot.tenantId,
-            snapshot.stage,
-            snapshot.orderId,
-            nextVersion,
-            snapshot.tenantId,
-            snapshot.stage,
-            snapshot.orderId,
-            nextVersion,
-          ],
-        });
-      }
       const storedFulfillment = state.order.fulfillment === "handed_off" ? "handed_off" : fulfillment;
       n += 1;
       statements.push(
@@ -1348,7 +1274,6 @@ export class FulfillmentService {
             label,
             totals: snapshot.totals,
             evidence: snapshot.evidence,
-            address: snapshot.address,
           }),
           nextVersion,
           stamp(this.now(), n),
@@ -1357,6 +1282,7 @@ export class FulfillmentService {
       if (confirmedCancel && state.order.fulfillment !== "handed_off") {
         n += 1;
         statements.push(auditStatement(state, actor.actorId, "pending-cancel", "open", "confirmed", nextVersion, stamp(this.now(), n)));
+        statements.push(terminalTransitionExpiryStatement(state.order, nextVersion, new Date(this.now())));
       }
       if (snapshot.sourceVersion !== undefined) statements.push(projectionCheckpoint(snapshot,nextVersion,this.now()));
       return { type: "write", statements, minimumChanges: 1 };
@@ -1657,7 +1583,6 @@ function validateSnapshot(snapshot: SourceOrderSnapshot): string | null {
   if (!oneOf(snapshot.label, LABEL_STATES) || !oneOf(snapshot.stage, ["preview", "publication"] as const)) return "malformed";
   if (!parseEvidence(snapshot.evidence) || !parseLines(snapshot.lines) || !parseTotals(snapshot.totals)) return "malformed";
   if (snapshot.amountMinor !== snapshot.totals.totalMinor || !totalsMatch(snapshot.totals)) return "malformed";
-  if (snapshot.address !== null && !isRecord(snapshot.address)) return "malformed";
   return null;
 }
 

package/apps/storefront/src/lib/integrations/webhooks/deliveryEngine.ts

@@ -291,9 +291,13 @@ const COMMERCE_PRIVATE_KEYS = new Set([
   "phone",
   "line1",
   "line2",
+  "city",
+  "company",
   "postalCode",
   "shippingAddress",
   "billingAddress",
+  "shipTo",
+  "billTo",
   "address",
   "firstName",
   "lastName",