@tokenoftrust/cli 4.7.1 → 4.7.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.7.1",
+  "version": "4.7.3",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/viewer-session.mjs

@@ -54,6 +54,29 @@ function originOf(url) {
   }
 }
 
+/** The hosted storefront Worker's own public origins (`[env.preview]`). Only a
+ *  storefront called at one of these EXACT origins may steer the CLI to present a
+ *  session for a different MCP issuer: anything reached through `--url` /
+ *  `TOT_STOREFRONT_URL` is user input, and a hostile one could otherwise name the
+ *  prod issuer and collect that session. */
+export const FIRST_PARTY_STOREFRONT_ORIGINS = Object.freeze(new Set([
+  DEFAULT_STOREFRONT_ORIGIN,
+  "https://storefront.tokenoftrust.workers.dev",
+]));
+
+/** The Token of Trust MCP issuers a first-party storefront may name. Exact origins. */
+export const TOKEN_OF_TRUST_MCP_ORIGINS = Object.freeze(new Set([
+  "https://mcp.tokenoftrust.com",
+  "https://mcp.qa.tokenoftrust.com",
+]));
+
+/** True only when BOTH sides are declared first-party, by exact origin. */
+function mayPresentSessionFor(storefrontBase, issuer) {
+  const storefront = originOf(storefrontBase);
+  return Boolean(storefront && issuer &&
+    FIRST_PARTY_STOREFRONT_ORIGINS.has(storefront) && TOKEN_OF_TRUST_MCP_ORIGINS.has(issuer));
+}
+
 /**
  * Turn a non-2xx `/api/dev/cli-session` response into one clean, actionable
  * `{ message, hint }` — the ONE place this CLI interprets that endpoint's refusal
@@ -91,9 +114,13 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
   if (error === "unresolved_token" && trustedMcp) {
     const signedInOrigin = originOf(signedInMcpUrl);
     if (signedInOrigin && signedInOrigin !== trustedMcp) {
+      // `TOT_SELECTED_MCP_URL=… tot login` adds a session for the storefront's MCP
+      // WITHOUT rebinding this checkout (`tot login --mcp` inside a checkout would
+      // move every command there to the other tier). Once that session exists,
+      // `resolveViewerTransport` uses it for the hosted storefront on its own.
       return {
-        message: `you're signed in to ${signedInOrigin}, but this store trusts ${trustedMcp}.`,
-        hint: `run \`tot login --mcp ${trustedMcp}\` (or unset TOT_MCP_URL), then re-run.`,
+        message: `you're signed in to ${signedInOrigin}, but the hosted storefront trusts ${trustedMcp}.`,
+        hint: `sign in to it once with \`TOT_SELECTED_MCP_URL=${trustedMcp} tot login\` (this checkout stays on ${signedInOrigin}), then re-run.`,
       };
     }
   }
@@ -150,42 +177,48 @@ export async function resolveViewerTransport({
   }
 
   const base = tenantBase(tenant, storefrontUrl);
-  let res;
-  try {
-    // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
-    // check rejects any unsafe-method request that is cross-origin AND either
-    // form-like (`application/x-www-form-urlencoded`, `multipart/form-data`,
-    // `text/plain`) or carries no content-type at all. Node's `fetch` sends no
-    // `Origin`, so every request from here is "cross-origin" — declaring JSON is what
-    // takes it out of the form-POST class the check guards. It is an honest
-    // declaration, not a bypass: a browser cannot send `application/json`
-    // cross-origin without a CORS preflight this worker never answers, so the
-    // anti-CSRF property is preserved exactly. Spoofing an `Origin` header instead
-    // would assert a browser context that does not exist and protect nothing.
-    vlog(`POST ${base}/api/dev/cli-session`);
-    res = await fetchImpl(`${base}/api/dev/cli-session`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${dev.token}`,
-        "content-type": "application/json",
-      },
-      body: "{}",
-    });
-  } catch (e) {
-    return {
-      ok: false,
-      message: `couldn't reach ${base} to start a session: ${e?.message || e}`,
-      hint: "check the --tenant domain / your network, then re-run.",
-    };
+  const first = await mintSession(base, dev.token, fetchImpl, vlog);
+  if (!first.ok) return first.refusal;
+  /** @type {any} */
+  let res = first.response;
+
+  // The hosted storefront trusts ONE MCP issuer, independent of the tier this
+  // checkout is bound to (a QA-registry store is still served by the shared
+  // storefront). When it names a different issuer, the session to present is the
+  // one for THAT issuer — the checkout's own binding is for the registry, not for
+  // this transport. Use it when the developer holds one; otherwise fall through
+  // to the refusal, which says how to get one without rebinding the checkout.
+  if (res.status === 401) {
+    const body = await readJson(res);
+    const trustedMcp = typeof body?.trustedMcp === "string" ? body.trustedMcp : null;
+    const signedInOrigin = originOf(dev.mcpUrl);
+    if (
+      body?.error === "unresolved_token" &&
+      mayPresentSessionFor(base, trustedMcp) &&
+      signedInOrigin && signedInOrigin !== trustedMcp
+    ) {
+      let trustedDev = null;
+      try {
+        trustedDev = await resolveDev(null, { ...env, TOT_SELECTED_MCP_URL: trustedMcp }, { fetchImpl });
+      } catch {
+        /* no usable session for the storefront's issuer — report the mismatch below */
+      }
+      if (trustedDev?.token && originOf(trustedDev.mcpUrl) === trustedMcp) {
+        vlog(`cli-session: retrying with your ${trustedMcp} session`);
+        const retry = await mintSession(base, trustedDev.token, fetchImpl, vlog);
+        if (!retry.ok) return retry.refusal;
+        res = retry.response;
+        dev = trustedDev;
+      } else {
+        res = replayJson(res, body);
+      }
+    } else {
+      res = replayJson(res, body);
+    }
   }
-  vlog(`cli-session → HTTP ${res.status}`);
+
   if (res.status === 401 || res.status === 502 || res.status === 503) {
-    let body = null;
-    try {
-      body = await res.json();
-    } catch {
-      /* non-JSON error body — describeCliSessionRefusal falls back cleanly */
-    }
+    const body = await readJson(res);
     if (body?.error || body?.code) vlog(`cli-session error: ${[body.error, body.code].filter(Boolean).join(" / ")}`);
     const { message, hint } = describeCliSessionRefusal(res.status, body, dev.mcpUrl);
     return { ok: false, message, hint };
@@ -218,3 +251,64 @@ export async function resolveViewerTransport({
     },
   };
 }
+
+/** The refusal body, or null when the body is not JSON (describeCliSessionRefusal
+ *  falls back cleanly). Any other failure — a body already consumed, a stream
+ *  error — is a bug or a fault, not "no body", and propagates.
+ *  @param {{ json: () => Promise<any> }} res */
+async function readJson(res) {
+  try {
+    return await res.json();
+  } catch (e) {
+    if (!(e instanceof SyntaxError)) throw e;
+    return null;
+  }
+}
+
+/** A response whose body was already read, re-readable once more. */
+function replayJson(res, body) {
+  return { ok: res.ok, status: res.status, headers: res.headers, json: async () => body };
+}
+
+/**
+ * POST the bearer to `<base>/api/dev/cli-session`.
+ * @returns {Promise<{ ok: true, response: any } | { ok: false, refusal: { ok: false, message: string, hint: string } }>}
+ */
+async function mintSession(base, token, fetchImpl, vlog) {
+  let res;
+  try {
+    // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
+    // check rejects any unsafe-method request that is cross-origin AND either
+    // form-like (`application/x-www-form-urlencoded`, `multipart/form-data`,
+    // `text/plain`) or carries no content-type at all. Node's `fetch` sends no
+    // `Origin`, so every request from here is "cross-origin" — declaring JSON is what
+    // takes it out of the form-POST class the check guards. It is an honest
+    // declaration, not a bypass: a browser cannot send `application/json`
+    // cross-origin without a CORS preflight this worker never answers, so the
+    // anti-CSRF property is preserved exactly. Spoofing an `Origin` header instead
+    // would assert a browser context that does not exist and protect nothing.
+    vlog(`POST ${base}/api/dev/cli-session`);
+    res = await fetchImpl(`${base}/api/dev/cli-session`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+      },
+      body: "{}",
+      // Never follow a redirect with the bearer attached: a 3xx is a refusal here
+      // (non-2xx), so the token only ever reaches the origin it was addressed to.
+      redirect: "manual",
+    });
+  } catch (e) {
+    return {
+      ok: false,
+      refusal: {
+        ok: false,
+        message: `couldn't reach ${base} to start a session: ${e?.message || e}`,
+        hint: "check the --tenant domain / your network, then re-run.",
+      },
+    };
+  }
+  vlog(`cli-session → HTTP ${res.status}`);
+  return { ok: true, response: res };
+}

package/src/visual-parity.mjs

@@ -255,8 +255,9 @@ function pageShape(value, file) {
       case "definitions": if (!Array.isArray(section.items) || !section.items.length || section.items.some((item) => !item || !string(item.term) || !rich(item.description))) findings.push(finding("parity-section-shape", at, "definitions require string terms and RichText descriptions", "supply valid definition items")); break;
       case "callout": if (!rich(section.body) || !["info", "warning", "legal", "success"].includes(section.tone) || section.title !== undefined && !string(section.title)) findings.push(finding("parity-section-shape", at, "callout requires supported tone, RichText body, and optional string title", "supply a valid callout")); break;
       case "contact": if (section.heading !== undefined && !string(section.heading) || section.email !== undefined && !string(section.email) || section.phone !== undefined && !string(section.phone) || section.address !== undefined && (!Array.isArray(section.address) || section.address.some((line) => !string(line))) || !string(section.email) && !string(section.phone) && !(Array.isArray(section.address) && section.address.length)) findings.push(finding("parity-section-shape", at, "contact requires string members and email, phone, or address", "supply valid contact details")); break;
+      case "contact_form": if (["heading", "messageLabel", "submitLabel", "successMessage"].some((key) => section[key] !== undefined && !string(section[key])) || section.fields !== undefined && (!Array.isArray(section.fields) || section.fields.some((field) => field !== "name" && field !== "phone"))) findings.push(finding("parity-section-shape", at, "contact_form requires optional string copy and fields limited to name or phone", "supply a valid contact_form section")); break;
       case "needs_review": if (!string(section.reason) || section.severity !== undefined && !["blocker", "note"].includes(section.severity) || section.owner !== undefined && !string(section.owner) || section.href !== undefined && !string(section.href)) findings.push(finding("parity-section-shape", at, "needs_review requires reason and valid optional severity/owner/href", "supply a valid needs_review section")); break;
-      default: findings.push(finding("parity-section-kind", `${at}/kind`, "section kind is not supported by the renderer", "use heading, paragraph, list, definitions, callout, contact, or needs_review"));
+      default: findings.push(finding("parity-section-kind", `${at}/kind`, "section kind is not supported by the renderer", "use heading, paragraph, list, definitions, callout, contact, contact_form, or needs_review"));
     }
   });
   const bodyHtml = typeof value.body_html === "string" && value.body_html.trim() !== "";

package/template/sample-store/content/chrome.html

@@ -28,7 +28,7 @@
     <ul>
       <li><a href="/blogs/news">News</a></li>
       <li><a href="/pages/about-us">About</a></li>
-      <li><a href="/pages/contact-us">Contact</a></li>
+      <li><a href="/contact-us">Contact</a></li>
     </ul>
     <div class="utility-nav__right">
       <span class="sel">English</span>
@@ -98,7 +98,7 @@
         <ul>
           <li><a href="/search">Search</a></li>
           <li><a href="/pages/about-us">About Us</a></li>
-          <li><a href="/pages/contact-us">Contact Us</a></li>
+          <li><a href="/contact-us">Contact Us</a></li>
           <li><a href="/blogs/news">Blog</a></li>
         </ul>
       </div>

package/template/sample-store/content/pages/contact-us.json

@@ -0,0 +1,22 @@
+{
+  "slug": "contact-us",
+  "title": "Contact Sample Vapor Co.",
+  "seoTitle": "Contact | Sample Vapor Co.",
+  "seoDescription": "Sample contact page for the fictional Sample Vapor Co. demo store.",
+  "eyebrow": "Sample content",
+  "intro": "This is a placeholder contact page for a fictional demo store.",
+  "isPolicy": false,
+  "sections": [
+    { "kind": "heading", "text": "Support hours" },
+    { "kind": "paragraph", "text": "Sample copy: set your real support hours here." },
+    { "kind": "heading", "text": "Customer support" },
+    { "kind": "paragraph", "text": "Sample copy: describe how customers reach you." },
+    {
+      "kind": "contact_form",
+      "heading": "Send us a message",
+      "fields": ["name", "phone"],
+      "messageLabel": "How can we help?",
+      "submitLabel": "Send message"
+    }
+  ]
+}

package/template/sample-store/content/pages-html/pages/contact-us.html

@@ -1,48 +0,0 @@
-<head>
-<title>Contact | Sample Vapor Co.</title>
-<meta name="description" content="Sample contact page for the fictional Sample Vapor Co. demo store.">
-<link rel="canonical" href="https://sample-store.example/pages/contact-us">
-<meta name="robots" content="noindex,nofollow">
-<link rel="stylesheet" href="/tenants/sample-store.example/pages/page.css">
-</head>
-<main id="main">
-
-  <section class="page-hero page-hero--center section--tight">
-    <div class="container">
-      <nav class="crumbs" aria-label="Breadcrumb"><a href="/">Home</a> / Contact Us</nav>
-      <h1>Contact Sample Vapor Co.</h1>
-      <p>This is a placeholder contact page for a fictional demo store. Nothing here submits anywhere.</p>
-    </div>
-  </section>
-
-  <section class="section" aria-labelledby="contact-h">
-    <h2 id="contact-h" class="sr-only">Get in touch</h2>
-    <div class="container">
-      <div class="contact-grid">
-        <div class="contact-card">
-          <h3>Support hours</h3>
-          <p>Sample copy — set your real support hours here.</p>
-        </div>
-        <div class="contact-card">
-          <h3>Customer support</h3>
-          <p>Sample copy — describe how customers reach you.</p>
-        </div>
-        <div class="contact-card">
-          <h3>Track your order</h3>
-          <p>Sample copy — link your order-tracking flow here.</p>
-        </div>
-      </div>
-
-      <form class="contact-form" action="/api/contact" method="post">
-        <div class="row2">
-          <input type="text" name="name" aria-label="Name" placeholder="Name" required>
-          <input type="email" name="email" aria-label="Email" placeholder="Email" required>
-        </div>
-        <input type="text" name="order" aria-label="Order number (optional)" placeholder="Order number (optional)">
-        <textarea name="comment" aria-label="How can we help?" placeholder="How can we help?"></textarea>
-        <button type="submit" class="btn btn-primary">Send Message</button>
-      </form>
-    </div>
-  </section>
-
-</main>