@curless/shopify-storefront 0.1.0

package/dist/index.js

@@ -0,0 +1,974 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+// Moody Lenses — a remote MCP connector (Streamable HTTP).
+//
+// A buyer-facing storefront for ONE merchant: browse the lenses, get a checkout
+// link, look up an order. Published to the Claude connector directory and to
+// ChatGPT Apps, so it is a hosted URL rather than a local stdio server.
+//
+// ⚠️ NO MONEY PASSES THROUGH THIS SERVICE. Moody is not on a payment rail yet
+// (no Stripe account, no wallet), so checkout is a Shopify cart permalink:
+// Shopify collects, Shopify creates the order, Shopify emails the receipt. That
+// is the whole reason it can ship now — there is no float, no ledger and no
+// reconciliation to get wrong. When a rail is ready, `create_moody_checkout`
+// gains a second branch; nothing else here changes.
+//
+// ⚠️ AND NO BUYER IDENTITY. Nobody logs in, so the server cannot know who is
+// asking. That is why order lookup takes the order number AND the email, and
+// why it must never grow a "list my orders" tool without real authentication:
+// order numbers are sequential, and a list keyed on an email anyone can type is
+// a way to read a stranger's purchases.
+//
+// env:
+//   MOODY_SHOPIFY_SHOP_DOMAIN     moodylenses.myshopify.com
+//   MOODY_SHOPIFY_CLIENT_ID       the app's client id (Dev Dashboard)
+//   MOODY_SHOPIFY_CLIENT_SECRET   the app's client secret — signs the OAuth callback
+//   MOODY_SHOPIFY_ADMIN_TOKEN     optional: a pre-existing token, skipping the install
+//   MOODY_TOKEN_PATH              where the installed token is kept (default /app/data/moody-token.json)
+//   MOODY_APP_URL                 the SHOPIFY APP's base — OAuth callback lives here,
+//                                 must be a Curless hostname and must match the Dev
+//                                 Dashboard's Allowed redirection URL
+//   MOODY_PUBLIC_URL              what shoppers and directories see — the merchant's
+//                                 own domain (default: same as MOODY_APP_URL)
+//                                 (all PREFIXED — the box's .env is shared, see below)
+//   PORT                  default 8090
+//   CATALOG_REFRESH_MS    default 300000 (5 min)
+//   OPENAI_APPS_CHALLENGE_TOKENS  host=token,host=token — ChatGPT Apps domain
+//                                 verification, per ORIGIN (the token is bound to one)
+//   OPENAI_APPS_CHALLENGE_TOKEN   single-host fallback for the above
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+import { MOODY_CARD_HTML } from './card.generated.js';
+import { CatalogRegistry } from './catalog-registry.js';
+import { Catalog } from './catalog.js';
+import { challengeFor } from './challenge.js';
+import { resolveStorefront } from './config.js';
+import { credentialsRejected, needsAuth } from './connection.js';
+import { docsPage } from './legal.js';
+import { loadStorefrontConfig } from './load-config.js';
+import { MultiTokenStore, isStorableShop } from './multi-token-store.js';
+import { exchangeCode, installUrl, isShopDomain, makeState, verifyCallbackHmac, verifyState, } from './oauth.js';
+import { RateLimiter, clientIp } from './rate-limit.js';
+import { explainNoTenant, multiShopResolver, singleShopResolver } from './tenant.js';
+import { TokenStore } from './token-store.js';
+import { buildOutputSchemas, buildTools, callTool } from './tools.js';
+import { handleWebhook, verifyWebhookHmac } from './webhooks.js';
+const PORT = Number(process.env.PORT) || 8090;
+// One process serves exactly one storefront, so the config is read once here
+// and its names resolved once — the request path never re-derives them.
+const STORE = resolveStorefront(loadStorefrontConfig());
+const TOOLS = buildTools(STORE.tools, STORE.vocab);
+const OUTPUT_SCHEMAS = buildOutputSchemas(STORE.tools);
+const MERCHANT_NAME = STORE.config.server.title;
+const REFRESH_MS = (() => {
+    const n = Number(process.env.CATALOG_REFRESH_MS ?? 300_000);
+    // A non-numeric or zero interval would busy-loop the Shopify API or never
+    // refresh at all; neither failure announces itself.
+    return Number.isFinite(n) && n >= 30_000 ? n : 300_000;
+})();
+// PREFIXED env, deliberately. Every app service on the box shares one `.env`
+// (compose `env_file`), and sinocare-backend already reads the unprefixed
+// SHOPIFY_SHOP_DOMAIN / SHOPIFY_ADMIN_TOKEN for a DIFFERENT store. Reading those
+// here would silently repoint Sinocare's catalog at Moody's shop the moment this
+// service was configured. No fallback to the unprefixed names: the fallback is
+// exactly the collision.
+const SHOP_DOMAIN = STORE.config.shopify.shopDomain ?? '';
+const CLIENT_ID = process.env.STOREFRONT_SHOPIFY_CLIENT_ID ?? '';
+const CLIENT_SECRET = process.env.STOREFRONT_SHOPIFY_CLIENT_SECRET ?? '';
+// TWO base urls, because two different parties look at this service and they
+// should not see the same hostname.
+//
+// APP_URL is the SHOPIFY APP's own address — where Shopify sends a merchant back
+// after they authorise. That app is a Curless product: the next merchant installs
+// the same one, so its callback belongs on a Curless hostname and must not move
+// to any single merchant's domain. Putting it on mcp.moodycosmetics.com would
+// bounce the SECOND merchant's install through Moody's website.
+//
+// ⚠️ It must also match an Allowed redirection URL in the Shopify Dev Dashboard,
+// exactly. Changing it without changing that first breaks every install.
+//
+// The storefronts live on their own hostname and never under the gateway's:
+// mcp.curless.ai's catch-all is the gateway, which publishes real OAuth
+// metadata, so a client pointed there discovers the GATEWAY's sign-in and tries
+// to register a merchant account for a storefront that needs none.
+const APP_URL = STORE.appUrl;
+// PUBLIC_URL is what a SHOPPER and an assistant directory see — the merchant's
+// own domain. It carries the card's images, the listing icon and the legal
+// pages, and it is the origin a directory walks up from to find a favicon: from
+// mcp.moodycosmetics.com that lands on Moody's own mark, which is the whole
+// reason the merchant owns this hostname.
+//
+// Defaults to APP_URL so a storefront with no domain of its own still works.
+const PUBLIC_URL = STORE.publicUrl;
+// Which of the two hostnames a request arrived on, so the front page can differ.
+//
+// The root used to serve the MERCHANT's status page — connected shop, product
+// count, last sync — on every host, including the one a shopper and a directory
+// reviewer reach. That is the wrong audience: they get an operations readout for
+// a store they are trying to buy from.
+//
+// False whenever the two urls are the same, which is the single-host default: a
+// deployment with no merchant domain of its own still gets the merchant page,
+// because there is nobody else to serve.
+const PUBLIC_HOST = new URL(PUBLIC_URL).host.toLowerCase();
+const APP_HOST = new URL(APP_URL).host.toLowerCase();
+const onBuyerHost = (c) => PUBLIC_HOST !== APP_HOST && (c.req.header('host') ?? '').toLowerCase() === PUBLIC_HOST;
+// `read_discounts` is what lets the card show "Buy 2 get 5% OFF" — those live on
+// the shop, not on any product. ⚠️ Scopes are granted at INSTALL: adding one here
+// changes nothing until the merchant reinstalls, and until then the storefront
+// runs exactly as before, minus the promotions.
+const SCOPES = STORE.scopes;
+const TOKEN_PATH = STORE.tokenPath;
+// The shop domain is the one thing we cannot start without: it is which store
+// this connector IS. Credentials can arrive later — the merchant installs when
+// they install — but a connector with no shop has nothing to be.
+// ...unless this IS the listed app, where having no shop at boot is the whole
+// point: the shops are whoever installs it, and demanding one here would make
+// the public build impossible to start.
+if (STORE.config.shopify.mode === 'env' && (!SHOP_DOMAIN || !isShopDomain(SHOP_DOMAIN))) {
+    console.error(`${STORE.config.id}: shopify.shopDomain must be a *.myshopify.com domain in ${process.env.STOREFRONT_CONFIG}`);
+    process.exit(1);
+}
+const oauth = {
+    clientId: CLIENT_ID,
+    clientSecret: CLIENT_SECRET,
+    shopDomain: SHOP_DOMAIN,
+    appUrl: APP_URL,
+    scopes: SCOPES,
+};
+const tokens = new TokenStore(TOKEN_PATH);
+// Two buckets. The wide one keeps anyone from spending the merchant's Shopify
+// quota — an exhausted quota shows up to real buyers as a store with no
+// products. The narrow one is on order lookup, which takes attacker-chosen
+// input and answers a question about a real person's purchase.
+// Who is shopping, as reported at handshake. MCP clients identify themselves in
+// `initialize` (clientInfo.name — "claude-ai", "ChatGPT", …), but that arrives on
+// a DIFFERENT request from the tool call, so it has to be remembered against the
+// session the transport gives us. No session header → we fall back to the
+// User-Agent, and then to nothing. It is a label on an order, not an
+// authorisation decision, so a best guess is fine and a wrong one is harmless.
+const clients = new Map();
+const CLIENT_TTL_MS = 60 * 60_000;
+const rememberClient = (sessionId, name) => {
+    if (!sessionId || !name)
+        return;
+    const now = Date.now();
+    for (const [k, v] of clients)
+        if (now - v.at > CLIENT_TTL_MS)
+            clients.delete(k);
+    if (clients.size > 5_000)
+        clients.clear();
+    clients.set(sessionId, { name, at: now });
+};
+const assistantFor = (c) => {
+    const sid = c.req.header('mcp-session-id');
+    const known = sid ? clients.get(sid)?.name : undefined;
+    if (known)
+        return known;
+    const ua = c.req.header('user-agent');
+    // Node's default UA and curl say nothing about who is shopping.
+    return ua && !/^(node|curl|undici|python)/i.test(ua) ? ua.slice(0, 60) : undefined;
+};
+// Named so the docs page can quote them instead of restating them from memory —
+// a published number that drifts from the enforced one is worse than none.
+const MCP_RATE_PER_MIN = 60;
+const LOOKUP_RATE_PER_MIN = 10;
+const mcpLimit = new RateLimiter(MCP_RATE_PER_MIN, 60_000);
+const lookupLimit = new RateLimiter(LOOKUP_RATE_PER_MIN, 60_000);
+// The Shopify config is resolved PER CALL rather than at boot, because the token
+// arrives when the merchant installs — which may be days after this process
+// started. Until then every tool answers "not connected yet" instead of the
+// service being dead or, worse, looking like an empty store.
+const shopifyConfig = async () => {
+    const envToken = process.env.STOREFRONT_SHOPIFY_ADMIN_TOKEN;
+    if (envToken)
+        return { shopDomain: SHOP_DOMAIN, adminToken: envToken };
+    const stored = await tokens.get();
+    return stored ? { shopDomain: SHOP_DOMAIN, adminToken: stored.accessToken } : null;
+};
+const catalog = new Catalog(shopifyConfig);
+// ── Multi-tenant, for the listed app ────────────────────────────────────────
+//
+// Built in BOTH modes, and deliberately so. If these only existed under
+// `oauth-install` then every site that reads a shop would need to know which
+// mode it is in, and the one that forgot would answer as the wrong merchant.
+// Instead the resolver is the single door: in `env` it always returns the one
+// configured tenant, so the branded deployments behave exactly as before.
+const multiTokens = new MultiTokenStore(`${dirname(TOKEN_PATH)}/shops`);
+const registry = new CatalogRegistry(async (shop) => {
+    const stored = await multiTokens.get(shop);
+    return stored ? { shopDomain: shop, adminToken: stored.accessToken } : null;
+}, { refreshMs: REFRESH_MS });
+// The merchant's artwork, read once at boot from beside their config.
+//
+// Read here rather than per request so a missing file is a startup fact an
+// operator sees in the log, not a 500 the first time a directory asks for the
+// icon. Missing is allowed: a merchant who supplied none gets no icon rather
+// than someone else's.
+const brandAsset = (rel) => {
+    if (!rel)
+        return null;
+    try {
+        const raw = readFileSync(resolve(dirname(String(process.env.STOREFRONT_CONFIG)), rel));
+        // Copied into its own ArrayBuffer: node's Buffer is Uint8Array<ArrayBufferLike>,
+        // which since TS 5.7 is not the Uint8Array<ArrayBuffer> a response body wants.
+        const bytes = new Uint8Array(new ArrayBuffer(raw.byteLength));
+        bytes.set(raw);
+        return bytes;
+    }
+    catch (err) {
+        console.error(`[brand] ${rel} could not be read: ${err.message}`);
+        return null;
+    }
+};
+const ICON_PNG = brandAsset(STORE.config.server.iconFile);
+const LOGO_PNG = brandAsset(STORE.config.server.logoFile);
+const MULTI = STORE.config.shopify.mode === 'oauth-install';
+/**
+ * The shop a request is about.
+ *
+ * Branded: nothing — the resolver knows the one shop, and a `shop` param would
+ * be a claim it checks rather than an answer it needs.
+ *
+ * Listed: the PATH, because the buyer's connector URL is what carries it. Not a
+ * header and not a query: the connector URL is configured once, in the host,
+ * and anything the model could vary per call is something it could get wrong at
+ * the moment money is committed.
+ */
+const shopForRequest = (c) => MULTI ? c.req.param('shop') : undefined;
+const resolveTenant = MULTI
+    ? multiShopResolver({ registry, tokens: multiTokens })
+    : singleShopResolver({ store: STORE, catalog, tokens });
+const app = new Hono();
+// The merchant's own mark, for anything that shows this connector by name — the
+// assistant directories, the browser tab on the status page, `serverInfo.icons`.
+// It is the MERCHANT's logo, not ours: what a shopper connects to is their shop.
+//
+// Cached hard because it never changes without a redeploy.
+app.get('/icon.png', (c) => {
+    // Read from beside THIS merchant's config. A deployment that supplied no
+    // artwork 404s rather than borrowing another merchant's — the mistake the
+    // shared origin favicon already made once.
+    if (!ICON_PNG)
+        return c.notFound();
+    return c.body(ICON_PNG, 200, {
+        'content-type': 'image/png',
+        'cache-control': 'public, max-age=86400',
+    });
+});
+app.get('/favicon.ico', (c) => c.redirect('./icon.png', 301));
+// The wordmark at its true proportions, for the card header.
+app.get('/logo.png', (c) => {
+    if (!LOGO_PNG)
+        return c.notFound();
+    return c.body(LOGO_PNG, 200, {
+        'content-type': 'image/png',
+        'cache-control': 'public, max-age=86400',
+    });
+});
+// Both assistant directories require a public privacy policy and terms before
+// they will list a connector. Served from here rather than written into a wiki
+// somewhere: they describe what THIS code does, so they belong next to it and
+// change when it does.
+const LEGAL = {
+    // The page names THIS storefront's tools. Listing another merchant's is how a
+    // reviewer reads Elspet's docs and is told about lenses.
+    tools: STORE.tools,
+    noun: STORE.vocab.noun,
+    nounPlural: STORE.vocab.nounPlural,
+    merchantName: MERCHANT_NAME,
+    storefront: STORE.config.server.websiteUrl ?? PUBLIC_URL,
+    // Curless publishes, on the merchant's behalf — decided 2026-08-05. Which
+    // makes us the party a directory reviewer writes to, and the party a shopper
+    // writes to about the connector itself; anything about an ORDER is Moody's,
+    // and both pages say so.
+    operator: STORE.config.legal.operator ?? 'Curless',
+    // The same address the merchant-side connector already publishes, so a reply
+    // is not waiting on whoever happens to own one inbox.
+    operatorContact: STORE.config.legal.operatorContact ?? 'ops@curless.ai',
+    // The merchant's OWN address, as published in their own privacy policy —
+    // not the one on their contact page, which is still the Shopify theme's
+    // placeholder (info@yourstore.com).
+    merchantContact: STORE.config.legal.merchantContact ?? '',
+    updated: STORE.config.legal.updated ?? '',
+    shopDomain: SHOP_DOMAIN,
+    region: STORE.config.legal.region ?? 'ap-southeast-1 (Singapore)',
+    // Quoted from the limiters themselves, so the page cannot claim a number the
+    // code stopped enforcing.
+    rateGeneral: MCP_RATE_PER_MIN,
+    rateLookup: LOOKUP_RATE_PER_MIN,
+};
+// The page an IT administrator reads before allowing this server into their
+// organisation — the URL the directories ask for as "public-facing docs".
+// The merchant's storefront read from the SHOP, not from our config.
+//
+// Shopify's primaryDomain is already where the product and checkout links point,
+// so deriving these from it means the day the shop moves to a new domain the
+// policy redirects move with it — nobody has to remember a second place. The
+// configured value stays as the fallback for a shop we cannot read yet, which is
+// also the only state where a hardcoded guess is better than nothing.
+const storefrontUrl = () => {
+    const withUrl = catalog.current.products.find((p) => p.url);
+    if (!withUrl?.url)
+        return LEGAL.storefront;
+    try {
+        return new URL(withUrl.url).origin;
+    }
+    catch {
+        return LEGAL.storefront;
+    }
+};
+app.get('/docs', (c) => c.html(docsPage({ ...LEGAL, storefront: storefrontUrl() })));
+// The MERCHANT's policies, not ours. They already publish both, and a second
+// privacy policy from us would be a second answer to the same question — for a
+// shopper working out who holds their data, two answers is worse than one.
+// Redirected rather than deleted so an old link lands on the authoritative page
+// instead of a 404.
+app.get('/privacy', (c) => c.redirect(`${storefrontUrl()}/policies/privacy-policy`, 301));
+app.get('/terms', (c) => c.redirect(`${storefrontUrl()}/policies/terms-of-service`, 301));
+// Product images, re-served from OUR origin.
+//
+// The card is drawn in a sandboxed iframe whose CSP the host sets, and Claude's
+// blocked cdn.shopify.com outright — a grid of broken-image glyphs with the
+// product name as alt text, which looks like a store that has fallen over. The
+// connector's own origin is the one host such an iframe is plausibly allowed to
+// load from, so the card asks for images here and falls back to the CDN.
+//
+// ⚠️ ONLY Shopify's CDN, and only image bytes. An open proxy is a way to make
+// our server fetch anything an attacker names — internal addresses included — so
+// the host is checked against a literal, the response must be an image, and the
+// size is bounded.
+const IMAGE_HOST = 'cdn.shopify.com';
+const IMAGE_MAX_BYTES = 3_000_000;
+const IMAGE_TIMEOUT_MS = 8_000;
+// Rendered by <img>, where SVG cannot run script — but this URL is also directly
+// navigable, and an SVG served from OUR origin that a merchant happened to
+// upload to their CDN would then be script on mcp.moodycosmetics.com. Raster
+// only; the card has never needed anything else.
+const IMAGE_TYPES = /^image\/(jpeg|png|gif|webp|avif)$/;
+// Every /img hit makes us fetch from Shopify. Unlimited, that is an
+// unauthenticated amplifier pointed at the merchant's CDN quota and our own
+// bandwidth — and it went out that way, at 30 of 30 requests answered.
+// Generous, because one card render asks for a whole grid at once.
+const IMAGE_RATE_PER_MIN = 240;
+const imageLimit = new RateLimiter(IMAGE_RATE_PER_MIN, 60_000);
+app.get('/img', async (c) => {
+    if (!imageLimit.take(clientIp(c.req.raw.headers)))
+        return c.text('slow down', 429);
+    const raw = c.req.query('u') ?? '';
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return c.text('bad url', 400);
+    }
+    if (url.protocol !== 'https:' || url.hostname !== IMAGE_HOST)
+        return c.text('forbidden', 403);
+    try {
+        const upstream = await fetch(url, {
+            headers: { accept: 'image/*' },
+            // ⚠️ NOT 'follow'. Checking the hostname we were given and then following
+            // wherever it leads is the classic SSRF bypass: one redirect off
+            // cdn.shopify.com and we are fetching an address of someone else's
+            // choosing, from inside the network, with the allowlist already satisfied.
+            // Shopify serves these images directly, so a redirect is a surprise and
+            // being refused is the right response to one.
+            redirect: 'error',
+            // Without this a slow upstream holds a request open indefinitely, which is
+            // the cheapest way to tie up a single-process server.
+            signal: AbortSignal.timeout(IMAGE_TIMEOUT_MS),
+        });
+        const type = (upstream.headers.get('content-type') ?? '').split(';')[0]?.trim() ?? '';
+        if (!upstream.ok || !IMAGE_TYPES.test(type))
+            return c.text('not an image', 502);
+        const len = Number(upstream.headers.get('content-length') ?? 0);
+        if (len > IMAGE_MAX_BYTES)
+            return c.text('too large', 502);
+        const buf = Buffer.from(await upstream.arrayBuffer());
+        if (buf.byteLength > IMAGE_MAX_BYTES)
+            return c.text('too large', 502);
+        return c.body(buf, 200, {
+            'content-type': type,
+            // Shopify's URLs carry a ?v= that changes when the image does, so this is
+            // safe to cache for a long time and the card asks for it on every render.
+            'cache-control': 'public, max-age=86400',
+            // Believe the type above and nothing else — no sniffing our way into
+            // treating these bytes as a document.
+            'x-content-type-options': 'nosniff',
+            'content-security-policy': "default-src 'none'; sandbox",
+        });
+    }
+    catch {
+        return c.text('upstream failed', 502);
+    }
+});
+app.get('/healthz', async (c) => {
+    const snap = catalog.current;
+    const connected = (await shopifyConfig()) !== null;
+    return c.json({
+        // `credentials-rejected` is its own state, not a flavour of ok: the shelf is
+        // still being served from the last good snapshot, but nothing can be bought
+        // and the merchant has to reconnect.
+        status: credentialsRejected(snap.lastError)
+            ? 'credentials-rejected'
+            : snap.loadedAt
+                ? 'ok'
+                : connected
+                    ? 'starting'
+                    : 'not-installed',
+        shop: SHOP_DOMAIN,
+        connected,
+        products: snap.products.length,
+        catalogLoadedAt: snap.loadedAt?.toISOString() ?? null,
+        // Present when the LAST refresh failed. The snapshot may still be serving.
+        lastError: snap.lastError ?? null,
+    });
+});
+// The app's own page — what "Open app" in the Shopify admin lands on. Two jobs:
+// tell the merchant whether their store is connected, and give them the button
+// that connects it. Without this the app opens onto whatever the host serves at
+// the root, which tells a merchant nothing and looks broken.
+//
+// It is also the page an App Store review would ask for. Deliberately plain: a
+// headless integration has no dashboard to show, and inventing one would be
+// making up a product that does not exist.
+app.get('/', async (c) => {
+    // A shopper or a reviewer who types the connector's hostname into a browser
+    // gets a sentence and a way to the actual shop — not the merchant's install
+    // status. Deliberately says what this is and what it cannot do, because the
+    // people who arrive here uninvited are mostly reviewers deciding whether to
+    // trust it.
+    if (onBuyerHost(c)) {
+        const shop = storefrontUrl();
+        return c.html(`<!doctype html><meta charset="utf-8"><link rel="icon" href="/icon.png"><title>${escapeHtml(MERCHANT_NAME)}</title>
+       <style>
+         body{font-family:system-ui,-apple-system,sans-serif;margin:0;padding:48px 32px;color:#1a1a1a;
+              line-height:1.7;max-width:34rem}
+         h1{font-size:20px;margin:0 0 16px}
+         a{color:#1a1a1a}
+         .muted{color:#6b7280;font-size:14px}
+       </style>
+       <h1>${escapeHtml(MERCHANT_NAME)}</h1>
+       <p>This address is the ${escapeHtml(MERCHANT_NAME)} connector for AI assistants. It lets an
+       assistant show you ${escapeHtml(MERCHANT_NAME)}' ${escapeHtml(STORE.vocab.nounPlural)}, what is in stock,
+       and a link to checkout. There is nothing to use on this page.</p>
+       <p>To shop, go to <a href="${escapeHtml(shop)}">${escapeHtml(new URL(shop).host)}</a>.</p>
+       <p class="muted">No sign-in, and no payment happens here — checkout is on
+       ${escapeHtml(MERCHANT_NAME)}' own page. <a href="/docs">What this connector can reach</a>.</p>`);
+    }
+    const snap = catalog.current;
+    const connected = (await shopifyConfig()) !== null;
+    // Shopify sends the merchant HERE after a legacy-flow install, with ?shop=…
+    // &hmac=…&timestamp=…, and the convention is that the app starts OAuth on the
+    // spot. Landing them on a page with a button instead works, but it asks a
+    // merchant who just clicked "install" to click "connect" — which reads as the
+    // install not having taken. Start it for them.
+    //
+    // The signature is checked first: `shop` decides where we send someone, and an
+    // unverified one would make this an open redirect. Pinned to our store too.
+    const shopParam = c.req.query('shop');
+    if (needsAuth(connected, snap.lastError) && shopParam && CLIENT_SECRET) {
+        const search = new URL(c.req.url).search;
+        if (verifyCallbackHmac(CLIENT_SECRET, search) &&
+            isShopDomain(shopParam) &&
+            shopParam.toLowerCase() === SHOP_DOMAIN.toLowerCase()) {
+            return c.redirect(installUrl(oauth, makeState(CLIENT_SECRET)));
+        }
+        // A shop param we cannot verify is not an error to show — fall through to the
+        // page, which offers the same thing behind a click.
+    }
+    // HOLDING a token is not the same as holding a WORKING one, and conflating the
+    // two locked a merchant out of fixing it: reinstalling revokes the old token,
+    // so ours started failing 401 — while this page still said "Connected" and the
+    // auto-start branch above still skipped, because the file was there. They
+    // approved the app and landed on a page insisting nothing was wrong.
+    const rejected = credentialsRejected(snap.lastError);
+    const body = rejected
+        ? `<p class="warn">Shopify is refusing our credentials for <b>${SHOP_DOMAIN}</b>.</p>
+       <p>That is what happens after the app is reinstalled elsewhere — the old
+       access token is revoked. Reconnecting issues a new one; nothing else is
+       affected and no data is lost.</p>
+       <p><a class="btn" href="./auth/install">Reconnect ${escapeHtml(SHOP_DOMAIN)}</a></p>
+       <p class="muted">Last sync said: ${escapeHtml(snap.lastError ?? '')}</p>`
+        : connected
+            ? `<p class="ok">Connected to <b>${SHOP_DOMAIN}</b>.</p>
+       <p>${snap.products.length} products readable${snap.loadedAt
+                ? ` · last synced ${snap.loadedAt.toISOString().replace('T', ' ').slice(0, 16)} UTC`
+                : ''}.</p>
+       ${snap.lastError ? `<p class="warn">Last sync said: ${escapeHtml(snap.lastError)}</p>` : ''}
+       <p class="muted">Shoppers reach this catalogue through an AI assistant. Nothing here
+       moves money — checkout happens on your own Shopify checkout page.</p>`
+            : `<p>This store is not connected yet.</p>
+       <p><a class="btn" href="./auth/install">Connect ${escapeHtml(SHOP_DOMAIN)}</a></p>
+       <p class="muted">Grants read-only access to your products and orders. Nothing is
+       written to your store, and no money passes through us.</p>`;
+    return c.html(`<!doctype html><meta charset="utf-8"><link rel="icon" href="./icon.png"><title>${escapeHtml(MERCHANT_NAME)}</title>
+     <style>
+       body{font-family:system-ui,-apple-system,sans-serif;margin:0;padding:32px;color:#1a1a1a;line-height:1.6}
+       h1{font-size:18px;margin:0 0 16px}
+       .ok{color:#0a7d3f;font-weight:600}
+       .warn{color:#a15c00}
+       .muted{color:#6b7280;font-size:14px}
+       .btn{display:inline-block;background:#1a1a1a;color:#fff;text-decoration:none;
+            padding:10px 18px;border-radius:8px;font-weight:600}
+     </style>
+     <h1>${escapeHtml(MERCHANT_NAME)} · shopping assistant</h1>
+     ${body}`);
+});
+// ── Install (OAuth) ──────────────────────────────────────────────────────────
+// The merchant reaches /auth/install from the custom-distribution link, approves
+// the scopes on Shopify, and comes back to /auth/callback with a code.
+app.get('/auth/install', (c) => {
+    if (!CLIENT_ID || !CLIENT_SECRET)
+        return c.text('app credentials are not configured', 503);
+    // Pinned. This app is distributed to ONE store, so a request naming another
+    // shop is not a case to support — and an endpoint that redirects to any
+    // attacker-named *.myshopify.com is an open redirector wearing our domain.
+    const shop = c.req.query('shop');
+    if (MULTI) {
+        // The listed app has no shop of its own, so `shop` is REQUIRED — without it
+        // the redirect was being built with an empty host (https:///admin/...),
+        // which is what a merchant would have clicked from the App Store.
+        //
+        // The open-redirect worry the branded case pins away is sharper here, not
+        // softer: this endpoint sends people somewhere, on our domain. The
+        // allow-list is the same one the token store uses — exactly the shape
+        // Shopify issues, nothing else — so `?shop=evil.example.com` cannot turn
+        // this into a redirector wearing curless.ai.
+        const named = (shop ?? '').trim().toLowerCase();
+        if (!named)
+            return c.text('add ?shop=<store>.myshopify.com to install', 400);
+        if (!isStorableShop(named))
+            return c.text('that is not a Shopify store domain', 400);
+        return c.redirect(installUrl({ ...oauth, shopDomain: named }, makeState(CLIENT_SECRET)));
+    }
+    // Pinned. A branded deployment is distributed to ONE store, so a request
+    // naming another shop is not a case to support.
+    if (shop && shop.toLowerCase() !== SHOP_DOMAIN.toLowerCase()) {
+        return c.text('this app is not distributed to that store', 400);
+    }
+    return c.redirect(installUrl(oauth, makeState(CLIENT_SECRET)));
+});
+// The three webhooks Shopify requires of a listed app, on one endpoint —
+// the topic is a header, so three routes would be three copies of the same
+// signature check.
+//
+// ⚠️ The RAW body, before any parsing. `c.req.text()` gives the bytes Shopify
+// signed; re-serialising the parsed JSON changes them and every genuine
+// delivery would fail to verify.
+app.post('/webhooks/shopify', async (c) => {
+    const raw = await c.req.text();
+    if (!verifyWebhookHmac(CLIENT_SECRET, raw, c.req.header('x-shopify-hmac-sha256') ?? '')) {
+        // 401 and nothing else. Naming what failed would tell an unverified caller
+        // whether the secret or the body was wrong.
+        return c.json({ error: 'unauthorized' }, 401);
+    }
+    const topic = c.req.header('x-shopify-topic') ?? '';
+    const shop = c.req.header('x-shopify-shop-domain') ?? '';
+    const result = await handleWebhook(topic, shop, {
+        forgetShop: async (s) => {
+            if (MULTI) {
+                // Both, and in this order: stop the refresh loop first so nothing is
+                // mid-flight against a token we are about to delete.
+                registry.forget(s);
+                await multiTokens.forget(s);
+                console.log(`[webhook] ${topic} for ${s} — token and catalogue dropped`);
+                return;
+            }
+            // Single-shop mode has one token and one catalogue, both wired at deploy
+            // time, so there is no per-shop entry to drop. Logged rather than
+            // silently ignored: an uninstall here is a real event an operator will
+            // want in the record, and the next refresh fails on the revoked token
+            // and the status page says so. The multi-tenant path drops the token and
+            // stops the catalogue instead.
+            console.log(`[webhook] ${topic} for ${s} — single-shop deployment, nothing per-shop to drop`);
+        },
+    });
+    return c.json(result.body, result.status);
+});
+app.get('/auth/callback', async (c) => {
+    if (!CLIENT_SECRET)
+        return c.text('app credentials are not configured', 503);
+    const url = new URL(c.req.url);
+    const query = Object.fromEntries(url.searchParams.entries());
+    // ORDER MATTERS: verify before touching anything. This endpoint is public, so
+    // an unverified `code` here is an attacker's code, and exchanging it would
+    // store a token for a shop of their choosing. Verified against the RAW query
+    // string — that is what Shopify signed.
+    if (!verifyCallbackHmac(CLIENT_SECRET, url.search))
+        return c.text('bad signature', 401);
+    if (!query.state || !verifyState(CLIENT_SECRET, query.state)) {
+        return c.text('bad state', 401);
+    }
+    const shop = String(query.shop ?? '');
+    // The listed app has no single expected shop — the callback's shop IS the
+    // answer. What still has to hold is that it LOOKS like a Shopify store, which
+    // is the same allow-list the token store keys on; the HMAC above already
+    // proved the query came from Shopify.
+    const shopOk = MULTI
+        ? isStorableShop(shop.toLowerCase())
+        : isShopDomain(shop) && shop.toLowerCase() === SHOP_DOMAIN.toLowerCase();
+    if (!shopOk) {
+        return c.text('unexpected shop', 400);
+    }
+    const code = String(query.code ?? '');
+    if (!code)
+        return c.text('missing code', 400);
+    try {
+        const { accessToken, scope } = await exchangeCode(oauth, code);
+        // Per-shop in the listed app, single-file in a branded one. The record is
+        // the same; where it lands is the whole difference between serving one
+        // merchant and serving many.
+        const record = {
+            shopDomain: shop,
+            accessToken,
+            scope,
+            installedAt: new Date().toISOString(),
+        };
+        if (MULTI)
+            await multiTokens.set(record);
+        else
+            await tokens.set(record);
+        console.log(`[oauth] installed on ${shop} (scopes: ${scope})`);
+        // The catalog is empty until now; fill it before the merchant looks.
+        void catalog.refresh();
+        return c.html(`<!doctype html><meta charset="utf-8"><link rel="icon" href="./icon.png"><title>Connected</title>
+       <body style="font-family:system-ui;padding:40px;max-width:32rem">
+       <h2>${MERCHANT_NAME} is connected.</h2>
+       <p>Your catalogue is now readable by the assistant. You can close this tab.</p>
+       </body>`);
+    }
+    catch (err) {
+        // Say what failed without echoing the exchange body.
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`[oauth] token exchange failed for ${shop}: ${message}`);
+        return c.text('could not complete the install — please try the link again', 502);
+    }
+});
+// ChatGPT Apps domain verification: echo the token back verbatim. Public and
+// not a secret; rotating it is an env change and a restart.
+//
+// PER HOST, because the token is issued per ORIGIN and this service answers on
+// more than one. A single value served everywhere means the moment a second
+// hostname is verified, the first one starts returning the second one's token —
+// and the app that was already verified quietly fails its next re-check. The
+// symptom ("verification just dropped") points nowhere near the cause, and this
+// is exactly the shape of a migration: both hosts have to stay verified while
+// the directories are moved over one at a time.
+//
+//   OPENAI_APPS_CHALLENGE_TOKENS=host=token,host=token   preferred
+//   OPENAI_APPS_CHALLENGE_TOKEN=token                    single-host fallback
+app.get('/.well-known/openai-apps-challenge', (c) => {
+    const token = challengeFor(c.req.header('host'), process.env.OPENAI_APPS_CHALLENGE_TOKENS, process.env.OPENAI_APPS_CHALLENGE_TOKEN);
+    if (!token)
+        return c.notFound();
+    return c.text(token);
+});
+// Anything interpolated into the page below comes from our own env, but escape
+// it anyway: the day one of these becomes merchant-supplied, the page should not
+// be the thing that has to be remembered.
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (ch) => ch === '&'
+    ? '&amp;'
+    : ch === '<'
+        ? '&lt;'
+        : ch === '>'
+            ? '&gt;'
+            : ch === '"'
+                ? '&quot;'
+                : '&#39;');
+// The MCP Apps card. Declared on the tools AND on their results — a host reads
+// it from either — and served over resources/read. Version the URI: hosts cache
+// by it, and a stale card is worse than no card because it looks current.
+const CARD_URI = `${STORE.cardUriPrefix}storefront-v19.html`;
+// ⚠️ `text/html;profile=mcp-app`, matching the merchant card that already works
+// on claude.ai. v1 shipped `text/html+skybridge` and Claude answered "There was
+// a problem displaying content from moody" — the card never rendered. The MIME
+// is how the host recognises this resource as a card at all, so a plausible
+// near-miss fails silently rather than degrading.
+const CARD_MIME = 'text/html;profile=mcp-app';
+// One card, two hosts. Claude (MCP Apps) reads `ui.resourceUri` (+ the legacy
+// `ui/resourceUri`); ChatGPT (Apps SDK) reads `openai/outputTemplate` to know a
+// tool renders this component, and `openai/widgetAccessible` is what lets the
+// rendered card call back into these tools — the card does exactly that when the
+// buyer opens a lens or presses Buy, so without it those clicks do nothing.
+const UI_META = {
+    ui: { resourceUri: CARD_URI },
+    'ui/resourceUri': CARD_URI,
+    'openai/outputTemplate': CARD_URI,
+    'openai/widgetAccessible': true,
+};
+// WHERE THE CARD MAY LOAD IMAGES FROM. This is the declaration whose absence
+// cost three rounds of "the pictures still aren't showing".
+//
+// An MCP App runs in a sandboxed iframe with no same-origin server, and the spec
+// is explicit: `resourceDomains` "empty or omitted → no network resources
+// (secure default)". So every product image was blocked before it left the
+// starting line — not by the CDN, not by the markup. I had only ever set
+// `openai/widgetCSP`, which is ChatGPT's key and which Claude does not read, and
+// then spent two attempts explaining the symptom with theories about the CDN.
+//
+// Both namespaces now, because the two hosts read different ones:
+//   ui.csp        — MCP Apps (Claude). The spec shape, `resourceDomains`.
+//   openai/*      — ChatGPT's Apps SDK, same list in its own spelling.
+//
+// Shopify's CDN serves every product image; our own origin is the fallback the
+// card tries second.
+const IMAGE_ORIGINS = ['https://cdn.shopify.com', new URL(PUBLIC_URL).origin];
+const WIDGET_META = {
+    ui: { csp: { resourceDomains: IMAGE_ORIGINS, connectDomains: [] } },
+    'openai/widgetCSP': { connect_domains: [], resource_domains: IMAGE_ORIGINS },
+    'openai/widgetDomain': new URL(PUBLIC_URL).origin,
+};
+const PROTOCOL_VERSION = '2025-06-18';
+const ok = (c, id, result) => c.json({ jsonrpc: '2.0', id: id ?? null, result });
+const fail = (c, id, code, message) => c.json({ jsonrpc: '2.0', id: id ?? null, error: { code, message } });
+// One line per call: method, tool, outcome, milliseconds.
+//
+// Added because a buyer hit "Unable to reach Moody" and the server had recorded
+// NOTHING — not the call, not a rate limit, not an error. The only honest answer
+// to "why did that fail" was that we could not say, which is not an answer a
+// merchant's storefront gets to give twice.
+const logCall = (method, tool, outcome, startedAt) => {
+    console.log(`[mcp] ${method ?? '?'}${tool ? ` ${tool}` : ''} ${outcome} ${Date.now() - startedAt}ms`);
+};
+// The JSON-RPC subset an MCP client actually needs from a read-only server:
+// initialize / tools/list / tools/call. No server-initiated messages, so every
+// response is a plain JSON body rather than an SSE stream.
+// BOTH paths, and both stay. A bare origin is the nicer connector URL to hand
+// out — `https://mcp.moodylenses.com` rather than `…/mcp` — but `/mcp` is the
+// address already registered in the Claude directory and in ChatGPT, and
+// changing a published server URL is a manual request to a review team. Serving
+// both costs one line and means the hostname move is the only variable.
+//
+// Only POST is shared: GET / is the front page above, and GET /mcp is the
+// descriptor below. The transport only ever POSTs.
+// The listed app carries the shop in the connector URL: /s/<shop>/mcp.
+//
+// Registered ONLY in that mode. Mounting it in a branded deployment would let
+// /s/anything/mcp answer with the one shop it serves — the same products under
+// a name that has nothing to do with them, which is exactly the confusion the
+// resolver refuses elsewhere.
+const MCP_PATHS = MULTI ? ['/mcp', '/', '/s/:shop/mcp'] : ['/mcp', '/'];
+app.on('POST', MCP_PATHS, async (c) => {
+    const startedAt = Date.now();
+    if (!mcpLimit.take(clientIp(c.req.raw.headers))) {
+        // Logged loudly: a rate limit reaches the buyer as "unable to reach", which
+        // is indistinguishable from the service being down unless we say so here.
+        logCall('?', undefined, 'RATE-LIMITED', startedAt);
+        return c.json({ jsonrpc: '2.0', id: null, error: { code: -32029, message: 'rate limited' } }, 429);
+    }
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return fail(c, null, -32700, 'parse error');
+    }
+    const { id, method, params } = body;
+    if (method === 'initialize') {
+        const info = params?.clientInfo;
+        rememberClient(c.req.header('mcp-session-id'), info?.name);
+        return ok(c, id, {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: { tools: {}, resources: {} },
+            // What a host shows beside this connector. `name` is the machine id, so
+            // the human-facing bits are `title` and `icons` — and the icon is MOODY's
+            // mark, not ours: a shopper is connecting to their shop, and our logo
+            // there would name the wrong party. `websiteUrl` points at their own
+            // storefront for the same reason.
+            serverInfo: {
+                name: STORE.config.server.name,
+                title: MERCHANT_NAME,
+                version: '0.1.0',
+                websiteUrl: STORE.config.server.websiteUrl ?? PUBLIC_URL,
+                // Omitted rather than guessed: a directory shows this beside the
+                // connector's name, and pointing it at another merchant's mark names
+                // the wrong party.
+                ...(STORE.config.server.iconUrl || ICON_PNG
+                    ? {
+                        icons: [
+                            {
+                                src: STORE.config.server.iconUrl ?? `${PUBLIC_URL}/icon.png`,
+                                mimeType: 'image/png',
+                                sizes: ['256x256'],
+                            },
+                        ],
+                    }
+                    : {}),
+            },
+            // How to BEHAVE, not just what the tools are. Without this the assistant
+            // treated a shopper the way it treats a research question: it interrogated
+            // them about colour, replacement cycle and pair-versus-single before
+            // showing a single lens, then narrated its own recommendations on top of a
+            // card that already showed the lenses. The buyer opened a storefront and
+            // got a questionnaire.
+            //
+            // The card is the storefront. It has filter chips, a Buy on every lens and
+            // its own prescription picker — everything the assistant was asking about,
+            // the buyer can just tap. So: show it, then be quiet.
+            instructions: [
+                `${MERCHANT_NAME} storefront. The card IS the shop: it shows the ${STORE.vocab.nounPlural} with pictures, filter chips, and a Buy button on each one.`,
+                // What this reads, stated once. It used to end "rather than web search
+                // or remembered product knowledge" — written after watching a host with
+                // its own shopping surface answer from a scraped page that quoted two
+                // different prices for the same lens and could not name a prescription.
+                // Removed because a connector telling the model not to use other tools
+                // is the pattern Anthropic's criteria reject, and because the routing it
+                // was trying to win is the host's to decide. The fact is what carries.
+                `These tools read the ${MERCHANT_NAME} shop itself, live: the price it charges today, what it can actually ship, and the option combinations it will accept.`,
+                `FIRST TURN: call ${STORE.tools.list} ONCE with no query and stop. Do not interview them first — whatever the ${STORE.vocab.noun} needs chosen, the card lets them choose it. Do not recommend anything and do not describe the ${STORE.vocab.nounPlural} in prose; they are on the screen.`,
+                `Say at most one short line, e.g. "Here are the ${STORE.vocab.nounPlural} — tap Buy on any of them."`,
+                'Only search (`query`) when the buyer has actually said what they want. Only recommend when they ask you to.',
+                'ONE call is enough. If a search comes back broader than asked, that answer already contains the closest matches — do not search again. Repeated calls stack another storefront card in front of the buyer for the same question.',
+                // Merchant-specific guidance, if this shop has any — moody's
+                // prescription rules are nonsense at a pet shop.
+                ...[STORE.vocab.hints.product, STORE.vocab.hints.checkout].filter(Boolean),
+                `${STORE.tools.checkout} returns a link to the ${MERCHANT_NAME} checkout page, where the buyer pays.`,
+            ].join('\n'),
+        });
+    }
+    // Liveness. The spec's ping is a request the receiver MUST answer promptly
+    // with an empty result — and hosts use it to decide whether the server is
+    // still there. We answered -32601, so Claude concluded it could not reach us
+    // and showed the buyer "Unable to reach Moody Lenses" and "There was a problem
+    // displaying content" — over a connection on which every tool call was
+    // succeeding. The banner said nothing was working; the log said everything was.
+    if (method === 'ping') {
+        logCall(method, undefined, 'ok', startedAt);
+        return ok(c, id, {});
+    }
+    // Notifications carry no id and expect no response body.
+    if (method === 'notifications/initialized') {
+        logCall(method, undefined, 'ok', startedAt);
+        return c.body(null, 202);
+    }
+    if (method === 'tools/list') {
+        // All four, because all four return something the buyer looks AT — including
+        // create_moody_checkout, whose most common answer is "one eye is missing".
+        // That is the card's whole reason to exist: the buyer picks the second
+        // prescription themselves instead of an assistant filling it in.
+        return ok(c, id, {
+            tools: TOOLS.map((t) => {
+                // The shape of what each tool returns, merged on here rather than kept
+                // in the TOOLS literal — that list is the contract a buyer's assistant
+                // reads, and it stays legible without the schemas inline.
+                const outputSchema = OUTPUT_SCHEMAS[t.name];
+                return { ...t, _meta: UI_META, ...(outputSchema ? { outputSchema } : {}) };
+            }),
+        });
+    }
+    if (method === 'resources/list') {
+        return ok(c, id, {
+            resources: [
+                {
+                    uri: CARD_URI,
+                    name: `${MERCHANT_NAME} storefront`,
+                    description: `Browse ${STORE.vocab.nounPlural}, choose the options, open checkout`,
+                    mimeType: CARD_MIME,
+                    _meta: WIDGET_META,
+                },
+            ],
+        });
+    }
+    if (method === 'resources/read') {
+        const uri = String(params?.uri ?? '');
+        // ANY card URI in our namespace gets the CURRENT card, and the answer
+        // echoes the URI that was asked for.
+        //
+        // Bumping the URI is how a host is told the card changed — but a host that
+        // still holds the old one then asks for a resource we refused to serve, and
+        // ChatGPT showed the buyer "Failed to fetch template" until the connector
+        // was deleted and re-added. Nothing was broken except our own refusal.
+        //
+        // Echoing the requested URI rather than answering with CARD_URI: a host
+        // that asked for v12 and got v16 back has been handed a reply to a
+        // question it did not ask, and some will discard it.
+        if (!uri.startsWith(STORE.cardUriPrefix)) {
+            return fail(c, id, -32602, `unknown resource: ${uri}`);
+        }
+        return ok(c, id, {
+            contents: [{ uri, mimeType: CARD_MIME, text: MOODY_CARD_HTML, _meta: WIDGET_META }],
+        });
+    }
+    if (method === 'tools/call') {
+        const name = String(params?.name ?? '');
+        const args = (params?.arguments ?? {});
+        if (!TOOLS.some((t) => t.name === name)) {
+            logCall(method, name, 'UNKNOWN-TOOL', startedAt);
+            return fail(c, id, -32602, `unknown tool: ${name}`);
+        }
+        if (name === STORE.tools.lookupOrder && !lookupLimit.take(clientIp(c.req.raw.headers))) {
+            // A refusal, not an error: say it in the tool result so the assistant can
+            // tell the buyer to wait rather than presenting the connector as broken.
+            logCall(method, name, 'LOOKUP-RATE-LIMITED', startedAt);
+            return ok(c, id, {
+                content: [
+                    { type: 'text', text: 'Too many order lookups from here. Please try again in a minute.' },
+                ],
+                structuredContent: { view: 'rate-limited' },
+                isError: true,
+            });
+        }
+        try {
+            // Resolve the tenant FIRST. The single-shop config helper below it reads
+            // the ONE configured shop, so in the listed app it answers null for every
+            // request and the honest "which shop?" never gets asked.
+            const resolution = await resolveTenant(shopForRequest(c));
+            if (!resolution.ok) {
+                // Not installed is an honest answer, not an empty catalogue — and each
+                // of the three reasons says something different and actionable.
+                return ok(c, id, {
+                    content: [{ type: 'text', text: explainNoTenant(resolution) }],
+                    structuredContent: {
+                        view: 'not-installed',
+                        shop: resolution.reason === 'no-shop'
+                            ? ''
+                            : (resolution.shop ??
+                                resolution.given ??
+                                ''),
+                    },
+                });
+            }
+            const shopify = resolution.tenant.shopify;
+            const deps = {
+                catalog: resolution.tenant.catalog,
+                shopify,
+                merchantName: MERCHANT_NAME,
+                ...(LOGO_PNG ? { logoUrl: `${PUBLIC_URL}/logo.png` } : {}),
+                tools: STORE.tools,
+                vocab: { noun: STORE.vocab.noun, nounPlural: STORE.vocab.nounPlural },
+                imageProxy: `${PUBLIC_URL}/img?u=`,
+                ...(assistantFor(c) ? { assistant: assistantFor(c) } : {}),
+            };
+            const res = await callTool(deps, name, args);
+            logCall(method, name, `ok view=${String(res.structured.view ?? '?')}`, startedAt);
+            return ok(c, id, {
+                content: [{ type: 'text', text: res.text }],
+                structuredContent: res.structured,
+                _meta: UI_META,
+            });
+        }
+        catch (err) {
+            // A tool failure is a RESULT, not a transport error: the client should be
+            // able to show the buyer what went wrong instead of a dead connector.
+            const message = err instanceof Error ? err.message : String(err);
+            logCall(method, name, `FAILED ${message}`, startedAt);
+            return ok(c, id, {
+                content: [{ type: 'text', text: `That did not work: ${message}` }],
+                isError: true,
+            });
+        }
+    }
+    logCall(method, undefined, 'METHOD-NOT-FOUND', startedAt);
+    return fail(c, id, -32601, `method not found: ${String(method)}`);
+});
+// Some hosts probe with GET before POSTing. Answer plainly rather than 404,
+// which reads as "wrong URL" while debugging a connector.
+app.get('/mcp', (c) => c.json({ name: STORE.config.server.name, transport: 'streamable-http' }));
+catalog.start(REFRESH_MS);
+serve({ fetch: app.fetch, port: PORT }, (info) => {
+    console.log(`${STORE.config.id}: listening on :${info.port} (shop ${SHOP_DOMAIN}, refresh ${REFRESH_MS}ms)`);
+});
+//# sourceMappingURL=index.js.map