@tokenoftrust/storefront-runner 6.3.2 → 6.3.4

package/apps/storefront/src/components/catalog/storefront/islands/RecentlyViewed.tsx

@@ -1,14 +1,15 @@
 /**
  * Recently viewed (Shopify-style discovery rail). A small client island that
  * records the current product to localStorage on a PDP and renders the rest as
- * a quiet strip. No server round-trip — snapshots are self-contained, so it
- * works against fixtures or live ToT identically. Renders nothing until it has
- * something to show (no layout shift, no empty state noise).
+ * a quiet strip. History is namespaced by the trusted tenant prop. A missing
+ * tenant renders nothing and does not touch storage. Entries render only when
+ * the current tenant's catalog index lists their handle.
  */
 import { useEffect, useState } from "preact/hooks";
+import { loadCatalogIndex } from "@/lib/catalog/shared/catalogQueryView";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/publication/shared/basePath";
+import { clientBasePath, withClientBase } from "@/lib/publication/shared/basePath";
 
 export interface RVItem {
   handle: string;
@@ -22,59 +23,75 @@ export interface RVItem {
 }
 
 interface Props {
+  /** Trusted renderer tenant. Missing context renders nothing and touches no storage. */
+  tenant?: string;
   /** When set (on a PDP), this product is recorded and excluded from the rail. */
   current?: RVItem;
   locale: string;
   title?: string;
   max?: number;
+  /** Style-guide samples. Rendered only when `tenant` is absent, and never stored. */
+  preview?: RVItem[];
 }
 
-const KEY = "tot:recently-viewed";
+const LEGACY_KEY = "tot:recently-viewed";
 const CAP = 12;
 
-function read(): RVItem[] {
+function tenantKey(tenant: string): string {
+  return `${LEGACY_KEY}:${tenant}`;
+}
+
+function isItem(value: unknown): value is RVItem {
+  if (!value || typeof value !== "object") return false;
+  const item = value as Partial<RVItem>;
+  return typeof item.handle === "string" && item.handle.length > 0
+    && typeof item.title === "string"
+    && typeof item.price === "number" && Number.isFinite(item.price)
+    && typeof item.currency === "string" && item.currency.length > 0
+    && (item.vendor === undefined || typeof item.vendor === "string")
+    && (item.img === undefined || typeof item.img === "string")
+    && (item.rehosted === undefined || typeof item.rehosted === "boolean")
+    && typeof item.seed === "string";
+}
+
+function readStored(tenant: string): RVItem[] {
   try {
-    const raw = localStorage.getItem(KEY);
+    const raw = localStorage.getItem(tenantKey(tenant));
     if (!raw) return [];
     const arr = JSON.parse(raw);
-    return Array.isArray(arr) ? (arr as RVItem[]) : [];
+    return Array.isArray(arr) ? arr.filter(isItem) : [];
   } catch (error) {
-    // Corrupt JSON or blocked storage is an empty rail. Any other failure is a bug.
     if (error instanceof SyntaxError) return [];
     if (typeof DOMException !== "undefined" && error instanceof DOMException) return [];
     throw error;
   }
 }
 
-export default function RecentlyViewed({
-  current,
-  locale,
-  title = "Recently viewed",
-  max = 5,
-}: Props) {
-  const [items, setItems] = useState<RVItem[]>([]);
-
-  useEffect(() => {
-    let list = read();
-    if (current) {
-      list = [current, ...list.filter((i) => i.handle !== current.handle)].slice(
-        0,
-        CAP,
-      );
-      try {
-        localStorage.setItem(KEY, JSON.stringify(list));
-      } catch {
-        /* storage full / disabled — degrade silently */
-      }
-    }
-    // Exclude the current product from what we *show*.
-    setItems(
-      list.filter((i) => i.handle !== current?.handle).slice(0, max),
-    );
-  }, [current?.handle]);
+function writeStored(tenant: string, list: RVItem[]): void {
+  try {
+    localStorage.setItem(tenantKey(tenant), JSON.stringify(list));
+  } catch {
+    /* storage full / disabled — degrade silently */
+  }
+}
 
-  if (items.length === 0) return null;
+function discardLegacy(): void {
+  try {
+    localStorage.removeItem(LEGACY_KEY);
+  } catch {
+    /* blocked storage — the legacy key is still never read */
+  }
+}
 
+function Rail({
+  items,
+  locale,
+  title,
+}: {
+  items: RVItem[];
+  locale: string;
+  title: string;
+}) {
   return (
     <section
       class="container-prose border-t border-[var(--color-border)] py-12"
@@ -123,3 +140,60 @@ export default function RecentlyViewed({
     </section>
   );
 }
+
+export default function RecentlyViewed({
+  tenant,
+  current,
+  locale,
+  title = "Recently viewed",
+  max = 5,
+  preview,
+}: Props) {
+  const scope = tenant && tenant.length > 0 ? tenant : "";
+  const [shown, setShown] = useState<{ tenant: string; items: RVItem[] } | null>(null);
+  const visible = shown && shown.tenant === scope ? shown.items : [];
+
+  useEffect(() => {
+    if (!scope) return;
+    let cancelled = false;
+    const list = current
+      ? [current, ...readStored(scope).filter((item) => item.handle !== current.handle)].slice(0, CAP)
+      : readStored(scope);
+    if (current) writeStored(scope, list);
+    discardLegacy();
+    const candidates = list.filter((item) => item.handle !== current?.handle);
+    loadCatalogIndex(clientBasePath()).then((index) => {
+      if (cancelled) return;
+      if (!Array.isArray(index?.products)) throw new Error("catalog index: products");
+      const handles = new Set(index.products.flatMap((product) =>
+        typeof product?.handle === "string" && product.handle ? [product.handle] : []));
+      setShown({
+        tenant: scope,
+        items: candidates.filter((item) => handles.has(item.handle)).slice(0, max),
+      });
+    }).catch(() => {
+      if (!cancelled) setShown({ tenant: scope, items: [] });
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [
+    scope,
+    max,
+    current?.handle,
+    current?.title,
+    current?.price,
+    current?.currency,
+    current?.vendor,
+    current?.img,
+    current?.rehosted,
+    current?.seed,
+  ]);
+
+  if (!scope) {
+    const samples = (preview ?? []).filter(isItem).slice(0, max);
+    return samples.length > 0 ? <Rail items={samples} locale={locale} title={title} /> : null;
+  }
+  if (visible.length === 0) return null;
+  return <Rail items={visible} locale={locale} title={title} />;
+}

package/apps/storefront/src/lib/catalog/shared/catalogQueryView.ts

@@ -43,18 +43,22 @@ export function searchFromIndex(index: CatalogIndex, q: string, limit = SEARCH_R
     .filter(Boolean);
 }
 
-let indexRequest: Promise<CatalogIndex> | null = null;
+const indexRequests = new Map<string, Promise<CatalogIndex>>();
 
-/** Fetch the tenant's catalog index once per page (`base` is the tenant's client base path). */
+/** Fetch the tenant's catalog index once per base path. A second tenant does not reuse the first. */
 export function loadCatalogIndex(base: string): Promise<CatalogIndex> {
-  indexRequest ??= fetch(`${base.replace(/\/+$/, "")}${CATALOG_INDEX_PATH}`, {
+  const key = base.replace(/\/+$/, "");
+  const cached = indexRequests.get(key);
+  if (cached) return cached;
+  const pending = fetch(`${key}${CATALOG_INDEX_PATH}`, {
     headers: { Accept: "application/json" },
   }).then((res) => {
     if (!res.ok) throw new Error(`catalog index: HTTP ${res.status}`);
     return res.json() as Promise<CatalogIndex>;
   });
-  indexRequest.catch(() => {
-    indexRequest = null;
+  pending.catch(() => {
+    if (indexRequests.get(key) === pending) indexRequests.delete(key);
   });
-  return indexRequest;
+  indexRequests.set(key, pending);
+  return pending;
 }

package/apps/storefront/src/lib/commerce/refusalSentence.ts

@@ -0,0 +1,52 @@
+/** One shopper-readable sentence for every final-cart refusal finding. Closed text only; never cart or tenant data. */
+export const GENERIC_REFUSAL_SENTENCE = "We couldn't confirm your order right now. Please review your cart and try again, or contact the store if it keeps happening.";
+
+const SENTENCES: Readonly<Record<string, string>> = {
+  "tenant-not-admitted": "This store isn't set up to accept orders yet. Please contact the store for help.",
+  "tenant-unregistered": "This store isn't set up to accept orders yet. Please contact the store for help.",
+  "shared-store-unavailable": "Checkout is temporarily unavailable. Please try again later.",
+  "checkout-unconfigured": "Checkout isn't set up for this store yet. Please contact the store for help.",
+  "tenant-own-store": "This store checks out through its own payment page, so this cart can't be confirmed here.",
+  "caller-unconfigured": "Checkout is temporarily unavailable. Please try again later.",
+  "store-unconfigured": "Checkout is temporarily unavailable. Please try again later.",
+  "config-unreadable": "Checkout is temporarily unavailable. Please try again later.",
+  "catalog-unavailable": "We couldn't load the product catalog. Please try again in a moment.",
+  "checkout-requirements-unreadable": "Checkout is temporarily unavailable. Please try again later.",
+  "authority-error": "Something went wrong confirming your order. Please try again.",
+  "authority-unavailable": "We couldn't check stock for your cart right now. Please try again in a moment.",
+  "malformed-request": "We couldn't read your cart. Please return to the cart and try again.",
+  "catalog-cart-mismatch": "Something in your cart is no longer available as listed. Please review your cart and try again.",
+  "catalog-not-authority": "Something in your cart is no longer available as listed. Please review your cart and try again.",
+  "shipping-unavailable": "We couldn't work out shipping for your cart. Please review your cart and try again.",
+  "shipping-changed": "Shipping for your cart has changed. Please review your cart and try again.",
+  "stock-unavailable": "One or more items in your cart are out of stock.",
+  "stock-unknown": "We couldn't confirm stock for your cart. Please try again in a moment.",
+  "provider-cart-conflict": "Your cart changed in another window. Please reload the cart and try again.",
+  "provider-cart-changed": "Your cart changed since it was checked. Please review your cart and try again.",
+  "admission-consumed": "This cart has already been used for an order. Please start a new cart.",
+  "admission-expired": "Your cart check expired. Please return to the cart and try again.",
+  "evidence-expired": "Your cart check expired. Please return to the cart and try again.",
+  "tenant-changed": "Your cart changed since it was checked. Please review your cart and try again.",
+  "stage-changed": "Your cart changed since it was checked. Please review your cart and try again.",
+  "currency-changed": "The currency for your cart changed. Please review your cart and try again.",
+  "destination-changed": "Your shipping destination changed. Please review your cart and try again.",
+  "product-changed": "Your cart changed since it was checked. Please review your cart and try again.",
+  "price-changed": "A price in your cart changed. Please review your cart and try again.",
+  "quantity-changed": "A quantity in your cart changed. Please review your cart and try again.",
+  "evidence-window-changed": "Your cart check expired. Please return to the cart and try again.",
+  "cart-unbound": "Your cart changed since it was checked. Please review your cart and try again.",
+  "verification-seam-absent": "We couldn't verify your age and eligibility right now. Please try again in a moment.",
+  "verification-provider-unconfigured": "Age verification isn't available for this store right now. Please contact the store for help.",
+  "verification-refused": "Your order can't be completed because it didn't pass the store's eligibility checks.",
+  "payment-reconcile": "We couldn't confirm payment for your order. Please try again.",
+  "payment-refused": "Payment for your order couldn't be confirmed. Please try again.",
+  "fulfillment-refused": "This order can't be fulfilled as requested. Please review your cart and try again.",
+};
+
+/** The sentence for a finding; unknown findings, including a bare code, get the generic sentence. */
+export function refusalSentence(finding: string): string {
+  if (Object.hasOwn(SENTENCES, finding)) return SENTENCES[finding]!;
+  if (finding.startsWith("verification-refused:")) return SENTENCES["verification-refused"]!;
+  if (finding.startsWith("evidence-")) return "We couldn't confirm the checks for your order right now. Please try again in a moment.";
+  return GENERIC_REFUSAL_SENTENCE;
+}

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -23,6 +23,7 @@ import { DeclaredTenantConfigUnreadError, withDeclaredTenantConfig } from "@/con
 import { resolveStoreCurrency } from "@tot/public-runtime/declared-tenant-config";
 import { createContentProvider } from "@/lib/content/storyblok/provider";
 import { createToTClient } from "@/lib/catalog/tot/ToTClient";
+import { refusalSentence } from "@/lib/commerce/refusalSentence";
 export const prerender = false;
 const HEX = /^[a-f0-9]{64}$/;
 /** The shopper's verification correlation handle, as the signed `verification` cart option carries it. */
@@ -30,7 +31,7 @@ const VERIFICATION_REF = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,199}$/;
 function json(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" } });
 }
-function deny(finding: string, status = 409, owner?: string): Response { return json({ ok: false, finding, ...(owner ? { owner } : {}) }, status); }
+function deny(finding: string, status = 409, owner?: string): Response { return json({ ok: false, finding, message: refusalSentence(finding), ...(owner ? { owner } : {}) }, status); }
 /**
  * Which check refused, and on which cart line (its index in the presented snapshot). Logged on
  * the decision line only: closed check names and an index, never a SKU, price or cart value.
@@ -329,7 +330,7 @@ async function authorize(context: APIContext): Promise<Response> {
     trustedIssuers: issuers, expectedAudience: audience, activeKids, stockTracked, authorities });
   if (!decision.ok) {
     if (decision.finding.startsWith("verification-refused") && (seamView.flavors || seamView.lines)) {
-      return json({ ok: false, finding: decision.finding,
+      return json({ ok: false, finding: decision.finding, message: refusalSentence(decision.finding),
         ...(decision.finding === "verification-refused:flavored_prohibited" && seamView.flavors ? { flavors: seamView.flavors } : {}),
         ...(seamView.lines ? { lines: seamView.lines } : {}) }, 409);
     }

package/apps/storefront/src/pages/products/[handle].astro

@@ -626,6 +626,7 @@ const structuredData = {
   {/* Recently viewed (client island; records this product, shows the rest). */}
   <RecentlyViewed
     client:idle
+    tenant={tenant.tenant_id}
     locale={tenant.locale}
     current={{
       handle: product.handle,

package/apps/storefront/src/pages/style-guide/[tenant]/[theme].astro

@@ -1443,9 +1443,9 @@ const componentVarsInline = [
           <MobileNav client:idle nav={sampleMobileNav} announcement="Free US shipping on orders over $100" />
         </div>
 
-        <p class="sg-cap" style="margin:22px 0 8px">RecentlyViewed — localStorage discovery rail, seeded here for preview (renders empty on a real first visit until a product is viewed)</p>
-        <script is:inline nonce={cspNonce} set:html={`localStorage.setItem("tot:recently-viewed", ${JSON.stringify(JSON.stringify(sampleRecentlyViewed))}); localStorage.setItem("tot:wishlist", ${JSON.stringify(JSON.stringify(sampleRecentlyViewed.slice(0, 2)))});`} />
-        <RecentlyViewed client:idle locale="en-US" />
+        <p class="sg-cap" style="margin:22px 0 8px">RecentlyViewed — localStorage discovery rail. These samples are preview-only and are not stored.</p>
+        <script is:inline nonce={cspNonce} set:html={`localStorage.setItem("tot:wishlist", ${JSON.stringify(JSON.stringify(sampleRecentlyViewed.slice(0, 2)))});`} />
+        <RecentlyViewed client:idle locale="en-US" preview={sampleRecentlyViewed} />
 
         <p class="sg-cap" style="margin:22px 0 8px">SavedList — the <code>/saved</code> wishlist, seeded here for preview (empty state shown until an item is saved)</p>
         <SavedList client:only="preact" locale="en-US" />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.3.2",
+  "version": "6.3.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",