@tokenoftrust/cli 4.12.0 → 4.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/viewer-session.mjs

@@ -3,7 +3,7 @@
  *
  * An invited developer holds a `tot login` MCP session but no operator secret and no
  * storefront cookie. This discovers
- * the storefront's trusted issuer without credentials, then mints a VIEWER session
+ * the storefront's trusted issuers without credentials, then mints a VIEWER session
  * from the developer's matching MCP token (POST
  * /api/dev/cli-session on the tenant's own host, which resolves WHO the opaque token
  * is via the MCP and hands back a `tot_session` cookie), then hands the caller a
@@ -55,42 +55,20 @@ function originOf(url) {
   }
 }
 
-/** The hosted storefront Worker's own public origins (`[env.preview]`). Only a
- *  storefront called at one of these EXACT origins may steer the CLI to present a
- *  session for a different MCP issuer: anything reached through `--url` /
- *  `TOT_STOREFRONT_URL` is user input, and a hostile one could otherwise name the
- *  prod issuer and collect that session. */
-export const FIRST_PARTY_STOREFRONT_ORIGINS = Object.freeze(new Set([
-  DEFAULT_STOREFRONT_ORIGIN,
-  "https://storefront.tokenoftrust.workers.dev",
-]));
-
-/** The Token of Trust MCP issuers a first-party storefront may name. Exact origins. */
+/** Exact identity issuers supported by hosted storefront sessions. */
 export const TOKEN_OF_TRUST_MCP_ORIGINS = Object.freeze(new Set([
   "https://mcp.tokenoftrust.com",
   "https://mcp.qa.tokenoftrust.com",
 ]));
 
-/** True only when BOTH sides are declared first-party, by exact origin. */
-function mayPresentSessionFor(storefrontBase, issuer) {
-  const storefront = originOf(storefrontBase);
-  return Boolean(storefront && issuer &&
-    FIRST_PARTY_STOREFRONT_ORIGINS.has(storefront) && TOKEN_OF_TRUST_MCP_ORIGINS.has(issuer));
-}
-
 /**
  * Turn a non-2xx `/api/dev/cli-session` response into one clean, actionable
  * `{ message, hint }` — the ONE place this CLI interprets that endpoint's refusal
  * shape, so ship/preview-token (both routed through `resolveViewerTransport`)
  * never duplicate or drift from each other.
  *
- * - 401 `unresolved_token` carrying `trustedMcp`, where the CLI's OWN signed-in
- *   MCP (`signedInMcpUrl`, from `resolveDeveloperSession`) is a DIFFERENT origin
- *   — the genuine tier mismatch (signed in to qa, store trusts prod, or vice
- *   versa): say exactly which two origins disagree and the exact fix.
- * - Any other 401 — a real "you're not recognized here" — keeps the plain
- *   login hint, but still surfaces the server's error code so a report isn't
- *   just "it didn't work".
+ * - 401 keeps recovery on the CLI's selected issuer. Discovery or refusal payloads
+ *   never select another credential or steer sign-in to another authority.
  * - 502/503 — the SEAM is broken (unconfigured, unreachable, malformed), which
  *   is never a login problem: say so, with the server's code, and suggest a
  *   retry instead of `tot login`.
@@ -103,7 +81,6 @@ function mayPresentSessionFor(storefrontBase, issuer) {
 export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
   const error = body && typeof body.error === "string" ? body.error : null;
   const code = body && typeof body.code === "string" ? body.code : null;
-  const trustedMcp = body && typeof body.trustedMcp === "string" ? body.trustedMcp : null;
 
   if (status === 502 || status === 503) {
     return {
@@ -112,23 +89,13 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
     };
   }
 
-  if (error === "unresolved_token" && trustedMcp && TOKEN_OF_TRUST_MCP_ORIGINS.has(trustedMcp)) {
-    const signedInOrigin = originOf(signedInMcpUrl);
-    if (signedInOrigin && signedInOrigin !== trustedMcp) {
-      // `TOT_SELECTED_MCP_URL=… tot login` adds a session for the storefront's MCP
-      // WITHOUT rebinding this checkout (`tot login --mcp` inside a checkout would
-      // move every command there to the other tier). Once that session exists,
-      // `resolveViewerTransport` uses it for the hosted storefront on its own.
-      return {
-        message: `you're signed in to ${signedInOrigin}, but the hosted storefront trusts ${trustedMcp}.`,
-        hint: `sign in to it once with \`TOT_SELECTED_MCP_URL=${trustedMcp} tot login\` (this checkout stays on ${signedInOrigin}), then re-run.`,
-      };
-    }
-  }
+  const selectedMcp = originOf(signedInMcpUrl);
+  const login = selectedMcp && TOKEN_OF_TRUST_MCP_ORIGINS.has(selectedMcp)
+    ? `TOT_SELECTED_MCP_URL=${selectedMcp} tot login` : "tot login";
 
   return {
     message: `your \`tot\` session wasn't recognized for this store${error && error !== "unresolved_token" ? ` (${error})` : ""}.`,
-    hint: "run `tot login`, then re-run.",
+    hint: `run \`${login}\`, then re-run.`,
   };
 }
 
@@ -200,24 +167,17 @@ export async function resolveViewerTransport({
       hint: "retry shortly; if it persists, report it with `tot feedback`." };
   }
   const advertised = await readJson(discovery);
-  const trustedMcp = typeof advertised?.trustedMcp === "string" ? advertised.trustedMcp : null;
-  if (!trustedMcp || !TOKEN_OF_TRUST_MCP_ORIGINS.has(trustedMcp)) {
+  const trustedMcps = advertised?.trustedMcps;
+  if (!Array.isArray(trustedMcps) || !trustedMcps.length ||
+      !trustedMcps.every((issuer) => typeof issuer === "string" && TOKEN_OF_TRUST_MCP_ORIGINS.has(issuer))) {
     return { ok: false, ...describeCliSessionRefusal(503, { code: "invalid_mcp_issuer" }, dev.mcpUrl) };
   }
-  if (originOf(dev.mcpUrl) !== trustedMcp) {
-    /** @type {{ ok: false, message: string, hint: string }} */
-    const refusal = { ok: false, ...describeCliSessionRefusal(401, { error: "unresolved_token", trustedMcp }, dev.mcpUrl) };
-    if (!mayPresentSessionFor(base, trustedMcp)) return refusal;
-    let trustedDev = null;
-    try {
-      trustedDev = await resolveDev(null, { ...env, TOT_SELECTED_MCP_URL: trustedMcp }, { fetchImpl });
-    } catch {
-      /* No usable credential for the declared issuer: nothing is presented. */
-    }
-    if (!trustedDev?.token || originOf(trustedDev.mcpUrl) !== trustedMcp) return refusal;
-    dev = trustedDev;
+  const selectedMcp = originOf(dev.mcpUrl);
+  if (!selectedMcp || !trustedMcps.includes(selectedMcp)) {
+    return { ok: false, message: "your selected MCP issuer isn't trusted by this store.",
+      hint: "report it with `tot feedback`; this command keeps your selected issuer." };
   }
-  const mintedSession = await mintSession(base, dev.token, fetchImpl, vlog);
+  const mintedSession = await mintSession(base, dev.token, selectedMcp, fetchImpl, vlog);
   if (!mintedSession.ok) return mintedSession.refusal;
   const res = mintedSession.response;
 
@@ -300,7 +260,7 @@ async function readJson(res) {
  * POST the bearer to `<base>/api/dev/cli-session`.
  * @returns {Promise<{ ok: true, response: any } | { ok: false, refusal: { ok: false, message: string, hint: string } }>}
  */
-async function mintSession(base, token, fetchImpl, vlog) {
+async function mintSession(base, token, mcpOrigin, fetchImpl, vlog) {
   let res;
   try {
     // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
@@ -320,7 +280,7 @@ async function mintSession(base, token, fetchImpl, vlog) {
         authorization: `Bearer ${token}`,
         "content-type": "application/json",
       },
-      body: "{}",
+      body: JSON.stringify({ mcpOrigin }),
       // Never follow a redirect with the bearer attached: a 3xx is a refusal here
       // (non-2xx), so the token only ever reaches the origin it was addressed to.
       redirect: "manual",