@tokenoftrust/storefront-runner 1.3.2 → 1.3.4-rc.2

package/apps/storefront/src/pages/api/dev/publish.ts

@@ -1,128 +0,0 @@
-/**
- * POST /api/dev/publish — Phase 3 (cp-publish) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit). Publishes the developer's current
- * draft content for one file into the tenant's TEST channel — the moment the
- * private draft overlay (cp-write) becomes something OTHER viewers can see
- * (still not live).
- *
- * SCOPE (see decision cp-publish-scope-correction): the card's literal plan
- * ("wire to api/preview/promote.ts") doesn't fit this surface — that route
- * needs a server-to-server bearer secret + a CDP-driven compliance
- * GateReport, and operates on the Gitea-fed preview/live channel, not the
- * dev-draft: overlay. Instead this uses the lower-level primitive the
- * reconcile pipeline itself is built on — `publishToTest`
- * (private-controlplane/customization-versioning.ts) over `KVVersionStore` —
- * writing straight into the SAME published-artifact store
- * `readPublishedArtifact`/`PublishedContentProvider` read. Content-addressed
- * + idempotent by construction (re-publishing identical bytes is a no-op).
- *
- * Deliberately test-only: promoting test -> live is the real external-publish
- * action and isn't reachable from this surface (see decision + the dispatched
- * cp-publish-go-live follow-up). "Publish" here closes write -> preview ->
- * diff -> publish-to-test, honestly, without faking or bypassing the
- * existing compliance gate.
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import { readKv } from "@/lib/env";
-import {
-  publishToTest,
-  CustomizationError,
-  KVVersionStore,
-  type CustomizationManifest,
-} from "@tot/private-controlplane";
-import { contentArtifactPath, themeArtifactPath } from "@tot/public-runtime";
-import {
-  resolveCockpitContext,
-  isCockpitContext,
-  isWritablePath,
-  pageSlugForPath,
-  resolveDraftState,
-} from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-// The developer's editable raw-HTML/theme surface, in ARTIFACT-path shape
-// (tenants/<id>/...) — what publishToTest's isEditable check and the
-// published-artifact store both key on. Not the tenant's real
-// declarative-customization manifest (out of scope here): this is
-// defense-in-depth on top of the isWritablePath gate already enforced below.
-const PUBLISH_MANIFEST: CustomizationManifest = {
-  version: 1,
-  classes: {
-    "platform-owned": [],
-    "extension-point": [],
-    "tenant-owned": ["tenants/<id>/content/home.html", "tenants/<id>/content/pages-html/**", "tenants/<id>/theme.json"],
-  },
-  immutableCompliance: [],
-};
-
-/**
- * Map this route's short content path (content/home.html, theme.json, ...)
- * to the artifact path the published-artifact store actually keys on
- * (contentArtifactPath/themeArtifactPath — the SAME mapping
- * PublishedContentProvider's getHomeHtml/getPageHtml use internally via
- * `publishedRaw`). Only ever called after isWritablePath(path) passed, so
- * every branch here has a defined result.
- */
-function artifactPathFor(tenantId: string, path: string): string {
-  if (path === "theme.json") return themeArtifactPath(tenantId);
-  if (path === "content/home.html") return contentArtifactPath(tenantId, "home.html");
-  return contentArtifactPath(tenantId, `pages-html/${pageSlugForPath(path)}.html`);
-}
-
-interface PublishBody {
-  path?: unknown;
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-
-  let body: PublishBody;
-  try {
-    body = (await context.request.json()) as PublishBody;
-  } catch {
-    return json({ ok: false, status: "bad_content", message: "invalid JSON body" }, 400);
-  }
-
-  const path = typeof body.path === "string" ? body.path : "";
-  if (!path) return json({ ok: false, status: "no_path", message: "path is required" }, 400);
-  if (!isWritablePath(path)) {
-    return json({ ok: false, status: "not_writable", message: `not in the write allowlist: ${path}` }, 403);
-  }
-
-  const { draftContent } = await resolveDraftState(context, ctx, path);
-  if (draftContent === null) {
-    return json(
-      { ok: false, status: "no_draft", message: "You have no unpublished edit for this file — nothing to publish." },
-      409,
-    );
-  }
-
-  const kv = await readKv("TENANT_CACHE");
-  if (!kv) {
-    // No KV bound (e.g. bare local build) — accept but report unpersisted,
-    // matching cp-write's degraded-mode contract rather than a broken call.
-    return json({ ok: true, status: "ok", path, applied: false });
-  }
-
-  const store = new KVVersionStore(kv);
-  const artifactPath = artifactPathFor(ctx.tenant.tenant_id, path);
-  try {
-    const result = await publishToTest(store, PUBLISH_MANIFEST, ctx.tenant.tenant_id, artifactPath, draftContent);
-    return json({
-      ok: true,
-      status: "ok",
-      path,
-      applied: true,
-      versionId: result.artifact.versionId,
-      channel: "test",
-    });
-  } catch (err) {
-    if (err instanceof CustomizationError) {
-      return json({ ok: false, status: err.code, message: err.message }, 409);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/pages/api/dev/tree.ts

@@ -1,70 +0,0 @@
-/**
- * GET /api/dev/tree — Phase 1 (cp-tree) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit, decision
- * architecture-environment-aware-cockpit). Lists the signed-in developer's OWN
- * tenant content so the hosted cockpit's Files tab renders the same tree shape
- * the local loop's `/__tot/tree` does (see scripts/dev/file-browser.mjs
- * buildTree/handleTree — this route mirrors its {ok,tree} response contract,
- * consumed unchanged by dev.astro's filesScript via the cp-env apiBase resolver).
- *
- * Unlike the local tree (an arbitrary on-disk directory walk), the hosted
- * Worker has no filesystem — the tree here is SYNTHESIZED from exactly the
- * raw-HTML surface the content provider chain understands + the write
- * allowlist (scripts/dev/safe-path.mjs WRITE_ALLOWLIST): content/home.html,
- * content/pages-html/<slug>.html, and theme.json. A tenant on structured
- * (Storyblok/JSON) content simply has an emptier tree — nothing to browse/edit
- * on this raw-HTML surface yet.
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import { readPublishedArtifact, themeArtifactPath } from "@tot/public-runtime";
-import { resolveCockpitContext, isCockpitContext } from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-type TreeNode =
-  | { name: string; path: string; type: "file"; language: string | null }
-  | { name: string; path: string; type: "dir"; children: TreeNode[] };
-
-export async function GET(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-  const { tenant, provider, kvGet } = ctx;
-
-  const [homeHtml, pageSlugs, themeRaw] = await Promise.all([
-    provider.getHomeHtml(),
-    provider.listPageHtmlSlugs(),
-    readPublishedArtifact(kvGet, tenant.tenant_id, "live", themeArtifactPath(tenant.tenant_id)),
-  ]);
-
-  const contentChildren: TreeNode[] = [];
-  if (homeHtml !== null) {
-    contentChildren.push({ name: "home.html", path: "content/home.html", type: "file", language: "html" });
-  }
-  if (pageSlugs.length > 0) {
-    contentChildren.push({
-      name: "pages-html",
-      path: "content/pages-html",
-      type: "dir",
-      children: pageSlugs
-        .slice()
-        .sort((a, b) => a.localeCompare(b))
-        .map((slug) => ({
-          name: `${slug}.html`,
-          path: `content/pages-html/${slug}.html`,
-          type: "file" as const,
-          language: "html",
-        })),
-    });
-  }
-
-  const tree: TreeNode[] = [];
-  if (contentChildren.length > 0) {
-    tree.push({ name: "content", path: "content", type: "dir", children: contentChildren });
-  }
-  if (themeRaw !== null) {
-    tree.push({ name: "theme.json", path: "theme.json", type: "file", language: "json" });
-  }
-
-  return json({ ok: true, tenantId: tenant.tenant_id, tree });
-}

package/apps/storefront/src/pages/api/dev/write.ts

@@ -1,116 +0,0 @@
-/**
- * POST /api/dev/write — Phase 2 (cp-write) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit, decision
- * architecture-environment-aware-cockpit). The heart of cloud editing: a
- * direct text edit (not an AI prompt) written into the developer's PRIVATE
- * draft overlay, reusing /api/content-edit/ai-edit.ts's exact materialization
- * mechanism (dev-draft: KV keys + signed tot_dev_draft cookie the middleware
- * overlay reads) — so the /dev live preview reflects the edit and no other
- * viewer/channel is touched. Same request/response contract as the local
- * loop's `/__tot/write` (scripts/dev/file-writer.mjs handleWrite), including
- * the C6 baseVersion 409 conflict guard — but "version" here is
- * contentVersion() (a content hash), not a filesystem mtime, since the Worker
- * has none; cp-file hands back the same hash so the two agree.
- *
- * Deviates from file-writer.mjs in one place: a theme.json write must parse as
- * JSON before it lands (mirrors ai-edit.ts's guard) — this draft overlay feeds
- * the SAME live preview theme.json ai-edit writes, and a malformed draft would
- * degrade that preview for the developer, unlike a plain on-disk write.
- *
- * When KV or the signing secret is unavailable (e.g. no CUSTOMIZATION_PREVIEW_SECRET
- * configured for this env), the edit is accepted but not persisted —
- * `applied:false`, exactly ai-edit's degraded-mode contract — never a broken call.
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import { DEV_DRAFT_TTL_SECONDS, devDraftKey } from "@/lib/dev/devDraft";
-import {
-  resolveCockpitContext,
-  isCockpitContext,
-  isWritablePath,
-  readPublishedPath,
-  resolveDraftState,
-  contentVersion,
-  setDraftCookie,
-} from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-const MAX_WRITE_BYTES = 2 * 1024 * 1024;
-
-interface WriteBody {
-  path?: unknown;
-  content?: unknown;
-  baseVersion?: unknown;
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-
-  let body: WriteBody;
-  try {
-    body = (await context.request.json()) as WriteBody;
-  } catch {
-    return json({ ok: false, status: "bad_content", message: "invalid JSON body" }, 400);
-  }
-
-  const path = typeof body.path === "string" ? body.path : "";
-  if (!path) return json({ ok: false, status: "no_path", message: "path is required" }, 400);
-  if (!isWritablePath(path)) {
-    return json({ ok: false, status: "not_writable", message: `not in the write allowlist: ${path}` }, 403);
-  }
-
-  const content = body.content;
-  if (typeof content !== "string") {
-    return json({ ok: false, status: "bad_content", message: "content must be a string" }, 400);
-  }
-  if (new TextEncoder().encode(content).length > MAX_WRITE_BYTES) {
-    return json({ ok: false, status: "too_large", message: "content exceeds the write size limit" }, 413);
-  }
-  if (path === "theme.json") {
-    try {
-      JSON.parse(content);
-    } catch {
-      return json({ ok: false, status: "bad_content", message: "theme.json must be valid JSON" }, 400);
-    }
-  }
-
-  // Stale-write guard (C6): compare the caller's baseVersion against the
-  // developer's CURRENT value for this path (their draft if one exists, else
-  // published) — omit baseVersion to force-save, exactly the local contract.
-  const { draftId, draftContent } = await resolveDraftState(context, ctx, path);
-  const currentContent = draftContent !== null ? draftContent : await readPublishedPath(ctx, path);
-  const currentVersion = contentVersion(currentContent);
-  const baseVersion = typeof body.baseVersion === "number" ? body.baseVersion : undefined;
-  if (baseVersion !== undefined && currentVersion !== baseVersion) {
-    return json(
-      {
-        ok: false,
-        status: "conflict",
-        current: currentVersion,
-        message:
-          currentVersion === null
-            ? `${path} was deleted since you opened it`
-            : `${path} changed since you opened it`,
-      },
-      409,
-    );
-  }
-
-  const bytes = new TextEncoder().encode(content).length;
-  const mtimeMs = contentVersion(content);
-
-  if (!ctx.kvPut || !ctx.draftSecret) {
-    // Nothing to persist against (e.g. bare local build with no KV/secret) —
-    // report success without pretending the draft landed, like ai-edit.
-    return json({ ok: true, status: "ok", path, bytes, mtimeMs, applied: false });
-  }
-
-  await ctx.kvPut(devDraftKey(ctx.tenant.tenant_id, draftId, path), content, {
-    expirationTtl: DEV_DRAFT_TTL_SECONDS,
-  });
-  await setDraftCookie(context, ctx, draftId);
-
-  return json({ ok: true, status: "ok", path, bytes, mtimeMs, applied: true });
-}