@tokenoftrust/storefront-runner 0.1.0

package/apps/storefront/src/lib/colors.ts

@@ -0,0 +1,97 @@
+/**
+ * Map human color-option values to swatch fills for product cards.
+ *
+ * Merchants name colors in their own vernacular ("Oatmeal", "Spruce"), not hex.
+ * We resolve a known palette first, fall back to a CSS named color when the
+ * value happens to be one, and otherwise render an "unknown" swatch (neutral
+ * with a slash) rather than guessing wrong. Tenant-agnostic: this is product
+ * data, not theme.
+ */
+
+/** Curated names common to apparel/home catalogs (lowercased keys). */
+const PALETTE: Record<string, string> = {
+  black: "#1a1a1a",
+  charcoal: "#36393b",
+  graphite: "#3a3a3a",
+  slate: "#556770",
+  grey: "#8a8d91",
+  gray: "#8a8d91",
+  silver: "#c7c9cc",
+  white: "#f6f5f1",
+  ivory: "#f3efe4",
+  cream: "#efe9d8",
+  ecru: "#e8e1cd",
+  oatmeal: "#ddd3bf",
+  natural: "#e3d9c2",
+  sand: "#d8c6a3",
+  stone: "#cbbfa9",
+  tan: "#c5a980",
+  camel: "#b48a5e",
+  rust: "#a4512f",
+  terracotta: "#bf6a4a",
+  brick: "#8f4334",
+  olive: "#6f6f3a",
+  forest: "#2f4a36",
+  spruce: "#23413a",
+  sage: "#9aa583",
+  teal: "#2a6f72",
+  navy: "#1f2a44",
+  indigo: "#2c3a63",
+  denim: "#41597d",
+  blue: "#2f5e8f",
+  burgundy: "#5e2230",
+  wine: "#5e2230",
+  plum: "#5a3a55",
+  blush: "#e7c7c0",
+  pink: "#e3a6ad",
+  mustard: "#c79a3a",
+  amber: "#b5612f",
+  brown: "#5f4733",
+  chocolate: "#46342a",
+  khaki: "#9a8b66",
+};
+
+/** CSS named colors we accept as a fallback when not in PALETTE. */
+const CSS_NAMED = new Set([
+  "red", "orange", "yellow", "green", "blue", "purple", "pink", "brown",
+  "black", "white", "gray", "grey", "beige", "ivory", "navy", "teal",
+  "maroon", "olive", "coral", "salmon", "khaki", "tan", "gold",
+]);
+
+export interface Swatch {
+  /** Original option value, e.g. "Oatmeal". */
+  label: string;
+  /** CSS color for the dot, or null when unknown. */
+  fill: string | null;
+}
+
+export function resolveSwatch(value: string): Swatch {
+  const key = value.trim().toLowerCase();
+  if (key in PALETTE) return { label: value, fill: PALETTE[key]! };
+  // Two-word names: try the last token ("Heather Grey" -> "grey").
+  const last = key.split(/\s+/).pop()!;
+  if (last in PALETTE) return { label: value, fill: PALETTE[last]! };
+  if (CSS_NAMED.has(key)) return { label: value, fill: key };
+  if (CSS_NAMED.has(last)) return { label: value, fill: last };
+  return { label: value, fill: null };
+}
+
+/** The product option that holds colors, if any (Color / Colour / Shade). */
+export function colorOptionValues(
+  options: { name: string; values: string[] }[],
+): string[] {
+  const opt = options.find((o) => /colou?r|shade|finish/i.test(o.name));
+  return opt ? opt.values : [];
+}
+
+/** True when a fill is light enough to need a ring so it reads on a light bg. */
+export function isLightFill(fill: string): boolean {
+  const m = /^#([0-9a-f]{6})$/i.exec(fill);
+  if (!m) return false;
+  const n = parseInt(m[1]!, 16);
+  const r = (n >> 16) & 255,
+    g = (n >> 8) & 255,
+    b = n & 255;
+  // Perceived luminance.
+  return 0.2126 * r + 0.7152 * g + 0.0722 * b > 200;
+}

package/apps/storefront/src/lib/content-edit/client.ts

@@ -0,0 +1,230 @@
+/**
+ * JsonRpcContentEditClient — the storefront's server-to-server caller for
+ * tot-mcp's `content_edit` tool (the inline-AI edit loop, WS5 G1). Mirrors
+ * {@link JsonRpcChangeClient} exactly (same transport, same session-validation,
+ * same tool-result unwrap, same typed errors) — reusing the forge seam's
+ * exported transport + error types so there is ONE wire contract, not two.
+ *
+ * AUTH SHAPE (G4 design note, `pending beta/WS2 confirmation`): the storefront
+ * backend calls `content_edit` as the TENANT OPERATOR (`credential_validate`
+ * with storefront's own TOT_API_KEY/TOT_SECRET_KEY — the SAME credential
+ * change/accept already uses), not as the individual signed-in developer.
+ * Developer-level authorization is the caller's job (`/dev`'s own
+ * `readViewerSession()` + capability check, BEFORE this client is ever
+ * constructed) — this client only proves "a legitimate storefront backend is
+ * asking", the same trust boundary `/api/changes/accept` already relies on.
+ */
+import {
+  FetchTransport,
+  ForgeAuthError,
+  ForgeConfigError,
+  ForgeTransportError,
+  SESSION_HEADER,
+  type McpTransport,
+  type JsonRpcRequest,
+  type TotCredentials,
+  type TransportResponse,
+} from "@/lib/forge";
+import { mapForgeError } from "@/lib/forge/errors.js";
+import { readEnv } from "@/lib/env";
+import type { ContentEditFile, ContentEditResult } from "./types.js";
+
+export const CONTENT_EDIT_TOOL = {
+  validate: "credential_validate",
+  edit: "content_edit",
+} as const;
+
+export { SESSION_HEADER } from "@/lib/forge";
+
+// --- MCP tool-result envelope (mirrors the change client) -------------------
+
+interface McpToolResult {
+  content?: Array<{ type?: string; text?: string }>;
+  structuredContent?: unknown;
+  isError?: boolean;
+}
+
+function parseTextContent(content: McpToolResult["content"]): unknown {
+  const text = content?.find((c) => c.type === "text" || c.text != null)?.text;
+  if (text == null) return undefined;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+function unwrapToolResult<T>(result: unknown): T {
+  const env = (result ?? {}) as McpToolResult;
+  const payload =
+    env.structuredContent !== undefined
+      ? env.structuredContent
+      : parseTextContent(env.content);
+
+  if (env.isError) {
+    const p = (payload ?? {}) as Record<string, unknown>;
+    throw mapForgeError({
+      code: typeof p.code === "number" ? p.code : undefined,
+      message: typeof p.message === "string" ? p.message : "content_edit tool error",
+      data: (p.data as Record<string, unknown>) ?? p,
+    });
+  }
+  return payload as T;
+}
+
+// --- Config -------------------------------------------------------------
+
+export interface JsonRpcContentEditClientConfig {
+  /** MCP base URL (the `POST /mcp` endpoint). */
+  baseUrl: string;
+  /** Storefront's ToT operator credentials for `credential_validate`. */
+  credentials: TotCredentials;
+  /** Transport override (defaults to fetch). Injected by tests. */
+  transport?: McpTransport;
+}
+
+// --- The client -----------------------------------------------------------
+
+export class JsonRpcContentEditClient {
+  private readonly baseUrl: string;
+  private readonly credentials: TotCredentials;
+  private readonly transport: McpTransport;
+  private nextId = 1;
+  /** Cached session validation — validate once, reuse (lazily). */
+  private sessionPromise?: Promise<string | undefined>;
+
+  constructor(config: JsonRpcContentEditClientConfig) {
+    if (!config.baseUrl) {
+      throw new ForgeConfigError("content-edit: MCP_BASE_URL is not configured");
+    }
+    if (!config.credentials?.apiKey) {
+      throw new ForgeConfigError(
+        "content-edit: storefront ToT credentials are not configured",
+      );
+    }
+    this.baseUrl = config.baseUrl;
+    this.credentials = config.credentials;
+    this.transport = config.transport ?? new FetchTransport(config.baseUrl);
+  }
+
+  async editContent(
+    prompt: string,
+    files: readonly ContentEditFile[],
+  ): Promise<ContentEditResult> {
+    const sessionId = await this.ensureSession();
+    const result = await this.rpc(
+      "tools/call",
+      { name: CONTENT_EDIT_TOOL.edit, arguments: { prompt, files } },
+      sessionId,
+    );
+    return unwrapToolResult<ContentEditResult>(result);
+  }
+
+  // --- internals (mirror JsonRpcChangeClient) --------------------------------
+
+  private ensureSession(): Promise<string | undefined> {
+    this.sessionPromise ??= this.validateSession();
+    return this.sessionPromise;
+  }
+
+  private async validateSession(): Promise<string | undefined> {
+    const args = this.credentialArgs();
+    let res: TransportResponse;
+    try {
+      res = await this.rpcRaw(
+        "tools/call",
+        { name: CONTENT_EDIT_TOOL.validate, arguments: args },
+        undefined,
+      );
+    } catch (err) {
+      this.sessionPromise = undefined; // let a later call retry
+      throw err;
+    }
+    if (res.body.error) {
+      this.sessionPromise = undefined;
+      throw new ForgeAuthError(
+        res.body.error.message ?? "content-edit: credential validation failed",
+      );
+    }
+    try {
+      const validated = unwrapToolResult<{ session?: string; sessionId?: string }>(
+        res.body.result,
+      );
+      return (
+        res.sessionId ?? validated?.session ?? validated?.sessionId ?? undefined
+      );
+    } catch (err) {
+      this.sessionPromise = undefined;
+      throw err instanceof ForgeAuthError
+        ? err
+        : new ForgeAuthError("content-edit: credential validation was rejected", {
+            cause: err,
+          });
+    }
+  }
+
+  /** Build the credential payload; omits absent secrets. Never logged. */
+  private credentialArgs(): Record<string, unknown> {
+    const c = this.credentials;
+    const out: Record<string, unknown> = { apiKey: c.apiKey };
+    if (c.secretKey) out.secretKey = c.secretKey;
+    if (c.accessToken) out.accessToken = c.accessToken;
+    return out;
+  }
+
+  private async rpc(
+    method: string,
+    params: unknown,
+    sessionId: string | undefined,
+  ): Promise<unknown> {
+    const res = await this.rpcRaw(method, params, sessionId);
+    if (res.body.error) throw mapForgeError(res.body.error);
+    return res.body.result;
+  }
+
+  private async rpcRaw(
+    method: string,
+    params: unknown,
+    sessionId: string | undefined,
+  ): Promise<TransportResponse> {
+    const headers: Record<string, string> = {};
+    if (sessionId) headers[SESSION_HEADER] = sessionId;
+    const body: JsonRpcRequest = {
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method,
+      params,
+    };
+    try {
+      return await this.transport.post({ body, headers });
+    } catch (err) {
+      if (err instanceof ForgeTransportError) throw err;
+      throw new ForgeTransportError(
+        `content-edit: transport failure calling ${method}`,
+        { cause: err },
+      );
+    }
+  }
+}
+
+// --- Factory ----------------------------------------------------------------
+
+/**
+ * Build a {@link JsonRpcContentEditClient} from the runtime env — the SAME env
+ * the change client reads (`MCP_BASE_URL` + storefront's own ToT credentials).
+ * Throws {@link ForgeConfigError} when the base URL or api key is missing.
+ * Secrets are read via {@link readEnv} and never logged.
+ */
+export async function createContentEditClient(
+  overrides: Partial<JsonRpcContentEditClientConfig> = {},
+): Promise<JsonRpcContentEditClient> {
+  const baseUrl = overrides.baseUrl ?? (await readEnv("MCP_BASE_URL")) ?? "";
+  const credentials =
+    overrides.credentials ??
+    ({
+      apiKey: (await readEnv("TOT_API_KEY")) ?? "",
+      secretKey: await readEnv("TOT_SECRET_KEY"),
+      accessToken: await readEnv("TOT_ACCESS_TOKEN"),
+    } satisfies TotCredentials);
+  return new JsonRpcContentEditClient({ ...overrides, baseUrl, credentials });
+}

package/apps/storefront/src/lib/content-edit/index.ts

@@ -0,0 +1,14 @@
+/**
+ * content_edit integration — public barrel. Import the typed client and its
+ * route helper from here (`@/lib/content-edit`) so call sites never reach into
+ * individual files.
+ */
+export type { ContentEditFile, ContentEditFileDiff, ContentEditResult } from "./types.js";
+export {
+  JsonRpcContentEditClient,
+  createContentEditClient,
+  CONTENT_EDIT_TOOL,
+  SESSION_HEADER,
+} from "./client.js";
+export type { JsonRpcContentEditClientConfig } from "./client.js";
+export { getContentEditClient } from "./route.js";

package/apps/storefront/src/lib/content-edit/route.ts

@@ -0,0 +1,25 @@
+/**
+ * Route helper for `/api/content-edit/ai-edit` — mirrors `@/lib/change/route.ts`'s
+ * `getChangeClient`: build the env-configured client, or a 503 Response when
+ * the MCP integration isn't configured (missing `MCP_BASE_URL`/credentials).
+ */
+import { ForgeError } from "@/lib/forge";
+import { createContentEditClient } from "./client.js";
+import { json } from "@/lib/grants/route.js";
+
+/**
+ * Build a content-edit client over the real MCP from env, or return a 503
+ * Response when the integration is not configured. Never leaks secret values.
+ */
+export async function getContentEditClient(): Promise<
+  Awaited<ReturnType<typeof createContentEditClient>> | Response
+> {
+  try {
+    return await createContentEditClient();
+  } catch (err) {
+    if (err instanceof ForgeError && err.kind === "config") {
+      return json({ error: "content_edit integration not configured" }, 503);
+    }
+    throw err;
+  }
+}

package/apps/storefront/src/lib/content-edit/types.ts

@@ -0,0 +1,19 @@
+/** Wire shape for tot-mcp's `content_edit` tool — mirrors tot-mcp's own
+ * ContentFile/ContentFileDiff/ContentEditResult (src/services/content-editor.ts). */
+
+export interface ContentEditFile {
+  /** e.g. "content/home.html" or "theme.json" — content_edit's own allowlist. */
+  path: string;
+  content: string;
+}
+
+export interface ContentEditFileDiff {
+  path: string;
+  /** Unified diff (`--- a/<path>` / `+++ b/<path>`) against the given content. */
+  diff: string;
+}
+
+export interface ContentEditResult {
+  diffs: ContentEditFileDiff[];
+  summary: string;
+}

package/apps/storefront/src/lib/cspStaticHashes.ts

@@ -0,0 +1,24 @@
+/**
+ * CSP hashes for the **static** inline `<script>`/`<style>` that Astro emits in
+ * the production build — the `client:load|idle|only` hydration directive
+ * loaders, the `<astro-island>` definition, the `astro-island{display:contents}`
+ * style, and bundled Layout scripts. These are identical across tenants and
+ * requests (no dynamic data), so hashes (not nonces) are the correct, strict
+ * tool for them.
+ *
+ * They change only when Astro or our bundled scripts change (e.g. an Astro
+ * upgrade). A drift check re-extracts them from a fresh build and fails if this
+ * list is stale — see `scripts/check-csp-hashes.mjs`. Regenerate with:
+ *   node scripts/check-csp-hashes.mjs --print
+ */
+export const STATIC_SCRIPT_HASHES: readonly string[] = [
+  "'sha256-BF0290pkb3jxQsE7z00xR8Imp8X34FLC88L0lkMnrGw='",
+  "'sha256-SaCkFfPruIdTXT8/97JArQmGxiJAL2o4bBDvSgJ5y3Q='",
+  "'sha256-QzWFZi+FLIx23tnm9SBU4aEgx4x8DsuASP07mfqol/c='",
+  "'sha256-YicfxUFBkKrQapZ/tzZKlaKTdNHgwVfv7y2Wa0NC6/k='",
+  "'sha256-eIXWvAmxkr251LJZkjniEK5LcPF3NkapbJepohwYRIc='",
+];
+
+export const STATIC_STYLE_HASHES: readonly string[] = [
+  "'sha256-vv9IoKo7BSLbWcUHr3tNmfNVmm5L/9Cfn2H6LMk7/ow='",
+];