Finish OpenAI conversion tracking

const PIXEL_ID = "BgCs8neHjGo12KJT4wL814";

export default {
  async fetch(request, env) {
    const path = new URL(request.url).pathname;
    if (request.method === "GET" && path === "/")
      return new Response("Shopify conversion Worker is running.");
    if (path !== "/webhooks/orders") return new Response("Not found", {status:404});
    if (request.method !== "POST") return new Response("POST required", {status:405});
    for (const name of ["OPENAI_CONVERSIONS_API_KEY", "SHOPIFY_WEBHOOK_SECRET", "SHOPIFY_STORE_DOMAIN", "STORE_URL"]) {
      if (!env[name]) return new Response("Missing configuration: " + name, {status:503});
    }
    
    try {
      const body = await request.arrayBuffer();
      if (!await verify(body, request.headers.get("X-Shopify-Hmac-Sha256"), env.SHOPIFY_WEBHOOK_SECRET))
        return new Response("Invalid signature", {status:401});
      const shop = request.headers.get("X-Shopify-Shop-Domain");
      if (shop !== env.SHOPIFY_STORE_DOMAIN) return new Response("Unexpected store", {status:403});
      if (request.headers.get("X-Shopify-Topic") !== "orders/create")
        return new Response("Expected orders/create", {status:400});
      if (env.MEASUREMENT_ENABLED !== "true")
        return outcome("measurement_disabled", 503);
      const validating = env.OPENAI_VALIDATE_ONLY !== "false";
      if (request.headers.get("X-Shopify-Test") === "true" && !validating)
        return outcome("shopify_test_skipped");
      const order = JSON.parse(new TextDecoder().decode(body));
      if (order.source_name !== "web" || order.cancelled_at) return outcome("non_web_or_cancelled_order_skipped");
      const time = Date.parse(order.created_at);
      if (!numericId(order.id) || !Number.isFinite(time)) return new Response("Invalid order", {status:400});
      // Required-consent mode: developer must populate this attribute from actual consent.
      const attrs = Object.fromEntries((order.note_attributes || []).map(a => [a.name, a.value]));
      if (attrs.openai_measurement_consent !== "granted")
        return outcome("consent_missing_or_denied");
      const event = {
        id: "shopify_order_" + order.id,
        type: "order_created", timestamp_ms: time,
        action_source: "web",
        source_url: new URL("/checkout", env.STORE_URL).href,
        data: {type:"contents"}
      };
      if (typeof attrs.oppref === "string" && attrs.oppref.trim()) event.oppref = attrs.oppref;
      const currency = String(order.currency || "").toUpperCase();
      const total = Number(order.total_price);
      if (/^[A-Z]{3}$/.test(currency) && Number.isFinite(total)) {
        const digits = new Intl.NumberFormat("en", {style:"currency", currency}).resolvedOptions().maximumFractionDigits;
        const amount = Math.round(total * 10 ** digits);
        if (Number.isSafeInteger(amount)) Object.assign(event.data, {amount, currency});
      }
      const user = {};
      const email = order.email || order.contact_email;
      if (env.SEND_HASHED_EMAIL === "true" && typeof email === "string" && email.trim())
        user.emails_sha256 = [await sha256(email.trim().toLowerCase())];
      const customerId = numericId(order.customer?.id);
      if (env.SEND_HASHED_EXTERNAL_ID === "true" && customerId)
        user.external_ids_sha256 = [await sha256("shopify_customer_" + customerId)];
      if (typeof attrs.openai_obref === "string" && attrs.openai_obref.trim())
        user.obref = attrs.openai_obref;
      if (Object.keys(user).length) event.user = user;
      const upstream = await fetch("https://bzr.openai.com/v1/events?pid=" + encodeURIComponent(PIXEL_ID), {
        method:"POST",
        headers:{Authorization:"Bearer " + env.OPENAI_CONVERSIONS_API_KEY, "Content-Type":"application/json"},
        body:JSON.stringify({validate_only:validating, integration_source:"shopify_cloudflare_worker", events:[event]}),
        signal:AbortSignal.timeout(3000)
      });
      const diagnostic = {
        upstream_status: upstream.status, validating,
        has_email: Boolean(user.emails_sha256),
        has_external_id: Boolean(user.external_ids_sha256),
        has_obref: Boolean(user.obref), has_oppref: Boolean(event.oppref)
      };
      // Do not log response bodies, orders, emails, keys or click identifiers.
      if (!upstream.ok) return outcome("openai_rejected", 502, diagnostic);
      return outcome(validating ? "validated_not_recorded" : "submitted", 200, diagnostic);
    } catch {
      return outcome("processing_failed", 503);
    }
  }
};

async function verify(body, signature, secret) {
  if (!signature) return false;
  try {
    const bytes = Uint8Array.from(atob(signature), c => c.charCodeAt(0));
    if (bytes.length !== 32) return false;
    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), {name:"HMAC", hash:"SHA-256"}, false, ["verify"]);
    return await crypto.subtle.verify("HMAC", key, bytes, body);
  } catch { return false; }
}
function outcome(outcome, status = 200, details = {}) {
  console.log("OpenAI conversion", {outcome, ...details});
  return new Response(outcome, {status});
}
function numericId(value) {
  if (typeof value === "number" && !Number.isSafeInteger(value)) return null;
  const id = String(value ?? "").split("/").pop();
  return /^\d+$/.test(id) ? id : null;
}
async function sha256(value) {
  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
  return Array.from(new Uint8Array(bytes), b => b.toString(16).padStart(2,"0")).join("");
}

<!-- OpenAI consent and cart bridge. Replace the existing OpenAI base script. -->
<script>
(function () {
  if (window.__openaiConsentBridge) return;
  window.__openaiConsentBridge = true;
  const PIXEL_ID = "BgCs8neHjGo12KJT4wL814";
  // Leave false until ALL launch checks in this report pass.
  const OPENAI_THEME_MEASUREMENT_ENABLED = false;
  if (!window.oaiq) {
    const q = function () { q.q.push(arguments); };
    q.q = [];
    window.oaiq = q;
    const script = document.createElement("script");
    script.async = true;
    script.src = "https://bzrcdn.openai.com/sdk/oaiq.min.js";
    document.head.appendChild(script);
  }
  window.oaiq("consent", false);
  window.oaiq("init", {pixelId: PIXEL_ID});
  let chain = Promise.resolve();
  let started = false;
  function allowed() {
    const p = window.Shopify?.customerPrivacy;
    return Boolean(p && p.marketingAllowed() === true && p.saleOfDataAllowed() === true);
  }
  function cookie(name) {
    const row = document.cookie.split(";").map(s => s.trim())
      .find(s => s.startsWith(name + "="));
    if (!row) return "";
    try { return decodeURIComponent(row.slice(name.length + 1)); }
    catch { return ""; }
  }
  function sync() {
    // Stop browser measurement immediately on denial, before cart network work.
    window.oaiq("consent", OPENAI_THEME_MEASUREMENT_ENABLED && allowed());
    chain = chain.catch(() => {}).then(async () => {
      const permitted = allowed();
      const attrs = {
        openai_measurement_consent: permitted ? "granted" : "denied",
        openai_consent_updated_at: new Date().toISOString(),
        oppref: "",
        openai_obref: ""
      };
      if (permitted) {
        attrs.oppref = new URL(location.href).searchParams.get("oppref") || cookie("__oppref");
        attrs.openai_obref = cookie("__obref");
      }
      const root = window.Shopify?.routes?.root || "/";
      const response = await fetch(root + "cart/update.js", {
        method: "POST",
        headers: {"Content-Type": "application/json"},
        credentials: "same-origin",
        body: JSON.stringify({attributes: attrs})
      });
      if (!response.ok) throw new Error("Cart consent update failed");
      console.log("OpenAI cart consent", {state: attrs.openai_measurement_consent});
    });
    chain.catch(() => console.error("OpenAI cart consent sync failed; do not enable live CAPI."));
    return chain;
  }
  // For theme/developer verification. Does not change the shopper's choice.
  window.openaiSyncCartConsent = sync;
  // Before checkout, finish saving the latest consent choice to the cart.
  // Waits at most 2 seconds, so checkout is never blocked.
  function beforeCheckout(go) {
    Promise.race([sync(), new Promise(r => setTimeout(r, 2000))])
      .catch(() => {}).then(go);
  }
  document.addEventListener("submit", function (e) {
    const form = e.target;
    const button = e.submitter;
    if (!button || button.name !== "checkout" || form.dataset.openaiChecked) return;
    e.preventDefault();
    beforeCheckout(function () {
      form.dataset.openaiChecked = "true";
      const flag = document.createElement("input");
      flag.type = "hidden";
      flag.name = "checkout";
      flag.value = button.value || "";
      form.appendChild(flag);
      form.submit();
    });
  }, true);
  document.addEventListener("click", function (e) {
    const link = e.target.closest && e.target.closest('a[href*="/checkout"]');
    if (!link || e.defaultPrevented || e.metaKey || e.ctrlKey || e.shiftKey) return;
    e.preventDefault();
    beforeCheckout(function () { location.href = link.href; });
  }, true);
  function start() {
    if (started) return;
    started = true;
    document.addEventListener("visitorConsentCollected", sync);
    window.addEventListener("pageshow", sync);
    window.addEventListener("focus", sync);
    sync();
  }
  function load(attempt = 0) {
    if (window.Shopify?.customerPrivacy) return start();
    if (window.Shopify?.loadFeatures) {
      window.Shopify.loadFeatures([{name:"consent-tracking-api",version:"0.1"}], error => {
        if (error) console.error("OpenAI: Shopify privacy API unavailable.");
        else start();
      });
    } else if (attempt < 40) {
      setTimeout(() => load(attempt + 1), 250);
    } else console.error("OpenAI: Shopify privacy API unavailable.");
  }
  load();
})();
</script>

await window.openaiSyncCartConsent();
const cart = await fetch(window.Shopify.routes.root + "cart.js").then(r => r.json());
console.log(cart.attributes.openai_measurement_consent);