@tokenoftrust/storefront-runner 0.1.0

package/apps/storefront/lib/resolve-tot-credentials.sh

@@ -0,0 +1,69 @@
+# resolve-tot-credentials.sh — resolve storefront's OWN ToT app identity: the
+# credentials it uses to authenticate ITSELF to the MCP forge/grant surface
+# (credential_validate -> repo_provision / tenant_checkout / grant_* / ...).
+# Distinct from TOT_CATALOG_* — the client creds storefront uses to read the ToT
+# catalog API (see RUNBOOK.md); these two may reuse the same apiClient keys but
+# serve different call sites. SOURCED (not executed) by provision.sh,
+# sync-secrets.sh, and ad hoc by scripts/tenant/provision-gitea-repo.mjs runs.
+#
+# TOT_APP_DOMAIN + MCP_BASE_URL default to storefront's proven qa binding:
+# tot-mcp's infrastructure/resources.env.json has
+#   .environments.qa.appNamespaces["storefront.tokenoftrust.com"] == "storefront"
+# and docs/architecture/tot-git-repo-mcp-architecture.md lists mcp.qa.tokenoftrust.com
+# as the qa MCP endpoint. Override either via env once a test/production binding
+# exists (see devbook://app-binding Recipe A for how a new binding gets added).
+#
+# TOT_API_KEY / TOT_SECRET_KEY: env wins; else SSM SecureString at
+# /tot/app/storefront/{tot-api-key,tot-secret-key}. Seed those once via
+#   scripts/secrets/put-tot-secret.sh --name /tot/app/storefront/tot-api-key
+#   scripts/secrets/put-tot-secret.sh --name /tot/app/storefront/tot-secret-key
+# (silent prompt, never in argv/history/disk — same shape as put-cf-secret.sh).
+#
+# MCP_SERVICE_SHARED_SECRET: env wins; else the SAME shared SSM SecureString
+# tot-mcp mints (decision mcp-shared-secret-single-source-ssm) — storefront READS
+# it so both sides agree without a manual dev-var. The path is PARAMETERIZED via
+# MCP_SERVICE_SHARED_SECRET_SSM_PARAM (one-line config). recordDeveloperAppBinding
+# reads MCP_SERVICE_SHARED_SECRET from the Worker env at runtime (unchanged).
+# Confirmed shared param (one hardwired path): /tot/dev-access/mcp-service-shared-secret (tot-mcp mints it).
+#
+# No live verification here (unlike resolve-cf-token.sh's /user/tokens/verify) —
+# credential_validate IS the verification, and every caller does that as its own
+# first step. A silent no-op if nothing resolves; callers then fail at that
+# validation with a clear MCP-side error instead of a confusing local one.
+TOT_APP_DOMAIN="${TOT_APP_DOMAIN:-storefront.tokenoftrust.com}"
+MCP_BASE_URL="${MCP_BASE_URL:-https://mcp.qa.tokenoftrust.com}"
+export TOT_APP_DOMAIN MCP_BASE_URL
+
+# Shared MCP service-secret SSM path — ONE hardwired shared param that tot-mcp
+# mints and both sides read (decision mcp-shared-secret-one-hardwired-path). It's a
+# single storefront<->mcp<->Gitea relationship, NOT per-env: no env-code, no
+# per-tier path — the plain constant below. SecureString, us-east-1, same AWS
+# account (242086487598). The env-var escape hatch stays for edge cases, but the
+# default IS this constant.
+MCP_SERVICE_SHARED_SECRET_SSM_PARAM="${MCP_SERVICE_SHARED_SECRET_SSM_PARAM:-/tot/dev-access/mcp-service-shared-secret}"
+
+if command -v aws >/dev/null 2>&1; then
+  if [ -z "${TOT_API_KEY:-}" ]; then
+    _tot_api_key="$(aws ssm get-parameter --name /tot/app/storefront/tot-api-key --with-decryption --query Parameter.Value --output text 2>/dev/null || true)"
+    if [ -n "$_tot_api_key" ] && [ "$_tot_api_key" != "None" ]; then
+      export TOT_API_KEY="$_tot_api_key"
+      echo "Loaded TOT_API_KEY from SSM (/tot/app/storefront/tot-api-key)"
+    fi
+  fi
+  if [ -z "${TOT_SECRET_KEY:-}" ]; then
+    _tot_secret_key="$(aws ssm get-parameter --name /tot/app/storefront/tot-secret-key --with-decryption --query Parameter.Value --output text 2>/dev/null || true)"
+    if [ -n "$_tot_secret_key" ] && [ "$_tot_secret_key" != "None" ]; then
+      export TOT_SECRET_KEY="$_tot_secret_key"
+      echo "Loaded TOT_SECRET_KEY from SSM (/tot/app/storefront/tot-secret-key)"
+    fi
+  fi
+  # Same mechanism as TOT_* above: env wins, else the SHARED SSM SecureString.
+  if [ -z "${MCP_SERVICE_SHARED_SECRET:-}" ]; then
+    _mcp_shared_secret="$(aws ssm get-parameter --name "$MCP_SERVICE_SHARED_SECRET_SSM_PARAM" --with-decryption --query Parameter.Value --output text 2>/dev/null || true)"
+    if [ -n "$_mcp_shared_secret" ] && [ "$_mcp_shared_secret" != "None" ]; then
+      export MCP_SERVICE_SHARED_SECRET="$_mcp_shared_secret"
+      echo "Loaded MCP_SERVICE_SHARED_SECRET from SSM ($MCP_SERVICE_SHARED_SECRET_SSM_PARAM)"
+    fi
+  fi
+  unset _tot_api_key _tot_secret_key _mcp_shared_secret
+fi

package/apps/storefront/migrations/0000_baseline.sql

@@ -0,0 +1,54 @@
+CREATE TABLE `collections` (
+	`handle` text PRIMARY KEY NOT NULL,
+	`title` text NOT NULL,
+	`position` integer DEFAULT 99 NOT NULL,
+	`data` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `customization_pointers` (
+	`tenant_id` text PRIMARY KEY NOT NULL,
+	`rev` integer NOT NULL,
+	`live` text NOT NULL,
+	`test` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `customization_versions` (
+	`tenant_id` text NOT NULL,
+	`path` text NOT NULL,
+	`version_id` text NOT NULL,
+	`size` integer NOT NULL,
+	`created_at` text NOT NULL,
+	`content` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `path`, `version_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `product_collections` (
+	`handle` text NOT NULL,
+	`collection` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_pc_collection` ON `product_collections` (`collection`);--> statement-breakpoint
+CREATE TABLE `product_facets` (
+	`handle` text NOT NULL,
+	`name` text NOT NULL,
+	`value` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_pf_name` ON `product_facets` (`name`,`value`);--> statement-breakpoint
+CREATE TABLE `products` (
+	`handle` text PRIMARY KEY NOT NULL,
+	`title` text NOT NULL,
+	`vendor` text,
+	`product_type` text,
+	`tags` text DEFAULT '[]' NOT NULL,
+	`description_text` text DEFAULT '' NOT NULL,
+	`price_min` real NOT NULL,
+	`price_max` real NOT NULL,
+	`currency` text NOT NULL,
+	`image` text,
+	`available` integer DEFAULT 0 NOT NULL,
+	`status` text NOT NULL,
+	`position` integer DEFAULT 0 NOT NULL,
+	`created_at` text,
+	`data` text NOT NULL
+);

package/apps/storefront/migrations/0001_products_fts.sql

@@ -0,0 +1,9 @@
+-- Custom SQL migration file, put your code below! --
+-- FTS5 (trigram) virtual table for typo-tolerant product search. Drizzle can't model
+-- CREATE VIRTUAL TABLE, so this is hand-maintained — keep it in step with
+-- CATALOG_D1_SCHEMA in @tot/private-controlplane (the structural equivalence test in
+-- src/lib/d1/schema.test.ts enforces that the migrations reproduce that contract).
+CREATE VIRTUAL TABLE IF NOT EXISTS products_fts USING fts5 (
+  handle UNINDEXED, title, vendor, product_type, tags, description_text,
+  tokenize = 'trigram'
+);

package/apps/storefront/migrations/README.md

@@ -0,0 +1,54 @@
+# D1 provision migrations (Drizzle Kit)
+
+The catalog + customization D1 schema as numbered migrations, applied by `provision.sh`
+(the **provision** lifecycle phase — never `deploy`, never runtime). Generated by
+**Drizzle Kit** (ADR-0002), applied by `wrangler d1 migrations apply`.
+
+## Source of truth
+
+- **`src/lib/d1/schema.ts`** (Drizzle schema) is the source of truth for migration
+  *generation*. `drizzle-kit generate` diffs it into numbered `migrations/*.sql`
+  (+ `meta/` journal) and owns the SQLite table-rebuild logic for `ALTER`s.
+- **`products_fts`** (FTS5 virtual table) can't be modelled by Drizzle — it's a custom
+  migration (`0001_products_fts.sql`), hand-maintained.
+- The raw-SQL read model + ETL still consume `CATALOG_D1_SCHEMA`/`CUSTOMIZATION_D1_SCHEMA`
+  (`@tot/private-controlplane`). A **structural** equivalence test (`src/lib/d1/schema.test.ts`,
+  PRAGMA-based) asserts the migrations reproduce that contract, so generator and read
+  model can't drift.
+
+## Safety (D1 has no rollback)
+
+`src/lib/d1/migrationSafety.ts` + its test **fail CI** on any unmarked `DROP TABLE` /
+`DROP COLUMN` (which also catches SQLite column-dropping rebuilds), because the
+equivalence test only proves *end-state* correctness, not a safe transition. An
+*intended* destructive change must opt in, in the migration file:
+
+```sql
+-- allow-destructive: <why this data loss is intended>
+```
+
+## Workflows
+
+**Regular change (add/alter a column, table):**
+1. Edit `src/lib/d1/schema.ts`.
+2. `pnpm --filter @tot/storefront gen:migrations` (Drizzle emits the next numbered SQL,
+   including SQLite table-rebuilds for unsupported `ALTER`s).
+3. If a column was removed, add `-- allow-destructive: <reason>` to the generated file.
+4. Update the matching `@tot/private-controlplane` const so the equivalence test stays green; commit
+   schema + generated `.sql` + journal together.
+
+**Custom SQL (e.g. a new FTS table, trigger):**
+`pnpm --filter @tot/storefront gen:migrations:custom` → fill in the emitted file.
+
+Never renumber or rewrite a *shipped* id (`wrangler` tracks applied ids); only append.
+
+## Applying
+
+`provision.sh --env=<env>` runs, after creating the D1 database:
+
+```sh
+wrangler d1 migrations apply CATALOG_DB --env <env> [--remote|--local]
+```
+
+> Catalog + customization tables share the **one** `CATALOG_DB` binding (one edge DB),
+> per `src/lib/customization/d1Store.ts`.

package/apps/storefront/migrations/meta/0000_snapshot.json

@@ -0,0 +1,347 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "3667f8d8-a1ba-49ac-809a-c06004bad5d6",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "tables": {
+    "collections": {
+      "name": "collections",
+      "columns": {
+        "handle": {
+          "name": "handle",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 99
+        },
+        "data": {
+          "name": "data",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "customization_pointers": {
+      "name": "customization_pointers",
+      "columns": {
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "rev": {
+          "name": "rev",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "live": {
+          "name": "live",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "test": {
+          "name": "test",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "customization_versions": {
+      "name": "customization_versions",
+      "columns": {
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "version_id": {
+          "name": "version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "size": {
+          "name": "size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "customization_versions_tenant_id_path_version_id_pk": {
+          "columns": [
+            "tenant_id",
+            "path",
+            "version_id"
+          ],
+          "name": "customization_versions_tenant_id_path_version_id_pk"
+        }
+      },
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "product_collections": {
+      "name": "product_collections",
+      "columns": {
+        "handle": {
+          "name": "handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "collection": {
+          "name": "collection",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "idx_pc_collection": {
+          "name": "idx_pc_collection",
+          "columns": [
+            "collection"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "product_facets": {
+      "name": "product_facets",
+      "columns": {
+        "handle": {
+          "name": "handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "idx_pf_name": {
+          "name": "idx_pf_name",
+          "columns": [
+            "name",
+            "value"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "products": {
+      "name": "products",
+      "columns": {
+        "handle": {
+          "name": "handle",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "vendor": {
+          "name": "vendor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "product_type": {
+          "name": "product_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "tags": {
+          "name": "tags",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "description_text": {
+          "name": "description_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "''"
+        },
+        "price_min": {
+          "name": "price_min",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "price_max": {
+          "name": "price_max",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "available": {
+          "name": "available",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "data": {
+          "name": "data",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}