npm - @tokenoftrust/storefront-runner - Versions diffs - 1.3.4-rc.4 → 1.4.1 - Mend

@tokenoftrust/storefront-runner 1.3.4-rc.4 → 1.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (246) hide show

package/apps/storefront/src/pages/admin.astro CHANGED Viewed

@@ -13,7 +13,7 @@
  * SHELL CONTRACT — every AdminXTab.astro component mounted below must preserve:
  *   - A `<section id="{tab}" data-admin-panel data-agent-scope="{tab}">` root,
  *     where {tab} is one of: orders, products, subscriptions, customers, fulfillment,
- *     reporting, ai-workflows, settings. The shell's hash router shows/hides
+ *     reporting, ai-workflows, publish, settings. The shell's hash router shows/hides
  *     panels by matching `html[data-admin-tab]` to this id, and the AI Ask
  *     envelope reads `data-agent-scope` to label its active context.
  *   - No tab-switching chrome of its own — `#{tab}` deep links and the shell's
@@ -37,9 +37,11 @@ import OrdersWorkspace from "../components/admin/orders/OrdersWorkspace.astro";
 import AdminProductsTab from "../components/admin/AdminProductsTab.astro";
 import AdminSubscriptionsTab from "../components/admin/AdminSubscriptionsTab.astro";
 import AdminReportingTab from "../components/admin/AdminReportingTab.astro";
+import AdminPublishTab from "../components/admin/AdminPublishTab.astro";
 import AdminSettingsTab from "../components/admin/AdminSettingsTab.astro";
 import { readViewerSession } from "@/lib/auth/route";
 import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
+import { resolveAdminEntry } from "@/lib/auth/adminEntry";
 const { tenant, basePath, cspNonce } = Astro.locals;
 const adminPath = `${basePath || ""}/admin`;
@@ -49,6 +51,19 @@ const viewerEmail = (Astro.locals.viewer?.email ?? viewerSession?.email ?? "").t
 const viewerDomain = viewerEmail.split("@").at(-1) ?? "";
 const canViewInternalGuide = viewerDomain === "tokenoftrust.com";
+// dg6 — admin session ENTRY resolved SERVER-SIDE against the resolved tenant's
+// appDomain (never client input, never a bearer secret): an authenticated
+// owner/team member for THIS tenant reaches the admin context; a non-member /
+// anonymous visitor was already held at the sign-in gate (middleware). Consumes
+// u10's owner + ship-capability model; the go-live tabs (AdminPublishTab) read
+// the same host-bound `Astro.locals.viewer.capability`, so the shell just stamps
+// the authoritative principal for chrome + tests — it does not re-gate.
+const adminEntry = resolveAdminEntry({
+  record: viewerSession,
+  hostResource: tenant.appDomain,
+  nowSeconds: Math.floor(Date.now() / 1000),
+});
 // Internal admin-app tenant mode (baseline doc §Admin App As Tenant,
 // tenant-envelope-contract): every mounted tab receives an explicit
 // { adminAppTenant, targetTenant } envelope. Only a real ToT-staff session
@@ -72,6 +87,11 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
   data-admin-target-tenant={tenantEnvelope.targetTenant}
   data-admin-operator={tenantEnvelope.operator ?? ""}
   data-admin-is-staff={isStaff ? "true" : "false"}
+  data-admin-viewer-authenticated={viewerSession ? "true" : "false"}
+  data-admin-entry-principal={adminEntry.principal}
+  data-admin-is-owner={adminEntry.isOwnerViewer ? "true" : "false"}
+  data-admin-can-ship={adminEntry.shipCapabilities.shipOnBehalf ? "true" : "false"}
+  data-admin-can-apex-cutover={adminEntry.shipCapabilities.apexCutover ? "true" : "false"}
 >
   <head>
     <meta charset="utf-8" />
@@ -80,10 +100,12 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
     <title>{tenantLabel} Admin</title>
     <script is:inline nonce={cspNonce}>
       (() => {
-        const adminTabs = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "settings"];
+        const adminTabs = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "publish", "settings"];
         const canViewInternalGuide = document.documentElement.dataset.internalAdminGuide === "true";
         const defaultTab = canViewInternalGuide ? "orders" : "settings";
-        const hash = window.location.hash.slice(1);
+        // A deep link may carry a query suffix in the hash (e.g. #publish?pr=42);
+        // the tab id is only the part before "?".
+        const hash = window.location.hash.slice(1).split("?")[0];
         const activeTab = adminTabs.includes(hash) ? hash : defaultTab;
         const mode = canViewInternalGuide && hash && !adminTabs.includes(hash) ? "guide" : "work-area";
@@ -232,6 +254,100 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
         background: rgba(255, 255, 255, 0.06);
       }
+      /* Cross-surface hop to the developer cockpit — same card language as the
+         sidebar's other blocks, kept visually quieter than the nav tabs. */
+      .cockpit-link {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+        padding: 10px 12px;
+        border: 1px solid rgba(255, 255, 255, 0.12);
+        border-radius: var(--admin-radius);
+        background: rgba(255, 255, 255, 0.04);
+        color: rgba(238, 247, 245, 0.85);
+        font-size: 13px;
+        text-decoration: none;
+      }
+      .cockpit-link:hover {
+        background: rgba(255, 255, 255, 0.1);
+        color: #fff;
+      }
+      .cockpit-link svg {
+        width: 15px;
+        height: 15px;
+        stroke: currentColor;
+        fill: none;
+      }
+      /* Signed-in-as chip (identity visibility — Trello 13075 postscript: an
+         owner staring at a read-only Publish tab could not tell WHO the shell
+         thought they were). Mirrors .store's card language; the standing line
+         states the resolved principal FOR THIS STORE, not a global role. */
+      .account {
+        display: grid;
+        grid-template-columns: auto 1fr;
+        gap: 10px;
+        align-items: center;
+        padding: 12px;
+        border: 1px solid rgba(255, 255, 255, 0.12);
+        border-radius: var(--admin-radius);
+        background: rgba(255, 255, 255, 0.06);
+        /* Pinned to the sidebar's lower-left (the conventional account slot) —
+           the sidebar is a flex column, so this soaks the remaining space. */
+        margin-top: auto;
+      }
+      .account .account-avatar {
+        display: grid;
+        place-items: center;
+        width: 32px;
+        height: 32px;
+        border-radius: 50%;
+        border: 1px solid rgba(255, 255, 255, 0.2);
+        background: rgba(255, 255, 255, 0.08);
+      }
+      .account .account-avatar svg {
+        width: 16px;
+        height: 16px;
+        stroke: currentColor;
+        fill: none;
+        stroke-width: 1.8;
+      }
+      .account .account-meta {
+        display: grid;
+        gap: 2px;
+        min-width: 0;
+      }
+      .account .account-email {
+        font-weight: 640;
+        font-size: 13px;
+        overflow: hidden;
+        text-overflow: ellipsis;
+        white-space: nowrap;
+      }
+      .account .account-standing {
+        color: rgba(238, 247, 245, 0.7);
+        font-size: 11px;
+      }
+      .account .account-standing[data-standing="none"] {
+        color: rgba(255, 196, 120, 0.9);
+      }
+      .account a {
+        color: inherit;
+      }
+      .account .account-signout button {
+        margin-top: 2px;
+        padding: 0;
+        border: 0;
+        background: none;
+        color: rgba(238, 247, 245, 0.6);
+        font-size: 11px;
+        text-decoration: underline;
+        cursor: pointer;
+      }
+      .account .account-signout button:hover {
+        color: rgba(238, 247, 245, 0.9);
+      }
       .tenant-picker {
         display: grid;
         gap: 4px;
@@ -508,6 +624,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="fulfillment"] #fulfillment,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="reporting"] #reporting,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="ai-workflows"] #ai-workflows,
+      html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="publish"] #publish,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="settings"] #settings {
         display: grid;
       }
@@ -784,6 +901,13 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
         background: #fff6e7;
       }
+      /* A JS-toggled `.risk-alert` (e.g. the degraded-forge strip) must stay hidden
+         when `hidden` is set — the base display:flex above would otherwise win over
+         the UA [hidden] rule and keep it visible. */
+      .risk-alert[hidden] {
+        display: none;
+      }
       .risk-alert svg {
         color: var(--admin-amber);
       }
@@ -1068,6 +1192,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
       <symbol id="i-orders" viewBox="0 0 24 24"><path d="M7 4h10a2 2 0 0 1 2 2v14l-3-2-2 2-2-2-2 2-3 2V6a2 2 0 0 1 2-2Z"></path><path d="M9 9h6M9 13h6"></path></symbol>
       <symbol id="i-box" viewBox="0 0 24 24"><path d="m3 7 9-4 9 4-9 4-9-4Z"></path><path d="M3 7v10l9 4 9-4V7"></path><path d="M12 11v10"></path></symbol>
       <symbol id="i-users" viewBox="0 0 24 24"><path d="M16 21v-2a4 4 0 0 0-4-4H7a4 4 0 0 0-4 4v2"></path><circle cx="9.5" cy="7" r="4"></circle><path d="M22 21v-2a4 4 0 0 0-3-3.9"></path><path d="M16 3.1a4 4 0 0 1 0 7.8"></path></symbol>
+      <symbol id="i-user" viewBox="0 0 24 24"><path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2"></path><circle cx="12" cy="7" r="4"></circle></symbol>
       <symbol id="i-shield" viewBox="0 0 24 24"><path d="M12 3 20 6v6c0 5-3.4 8.4-8 9-4.6-.6-8-4-8-9V6l8-3Z"></path><path d="m8.8 12 2.2 2.2L15.8 9"></path></symbol>
       <symbol id="i-chart" viewBox="0 0 24 24"><path d="M4 19V5"></path><path d="M4 19h16"></path><path d="M8 16v-5"></path><path d="M12 16V8"></path><path d="M16 16v-3"></path></symbol>
       <symbol id="i-workflows" viewBox="0 0 24 24"><path d="M6 5h6a4 4 0 0 1 4 4v1"></path><path d="m19 7-3 3-3-3"></path><path d="M18 19h-6a4 4 0 0 1-4-4v-1"></path><path d="m5 17 3-3 3 3"></path><circle cx="6" cy="5" r="2"></circle><circle cx="18" cy="19" r="2"></circle></symbol>
@@ -1133,6 +1258,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <a href="#fulfillment" data-admin-tab-link><svg><use href="#i-truck"></use></svg><span>Fulfillment</span></a>
           <a href="#reporting" data-admin-tab-link><svg><use href="#i-chart"></use></svg><span>Reporting</span></a>
           <a href="#ai-workflows" data-admin-tab-link><svg><use href="#i-workflows"></use></svg><span>AI Workflows</span></a>
+          <a href="#publish" data-admin-tab-link><svg><use href="#i-export"></use></svg><span>Publish</span></a>
           <a href="#settings" data-admin-tab-link><svg><use href="#i-gear"></use></svg><span>Settings</span></a>
         </nav>
@@ -1141,6 +1267,44 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <div class="health-row"><span>Payments</span><strong>OK</strong></div>
           <div class="health-row"><span>Risk checks</span><strong>OK</strong></div>
         </div>
+        <!-- Cross-surface hop: the developer cockpit is a SIBLING surface (dev
+             setup + connection status), not an admin tab — link, don't embed.
+             basePath-aware so it stays inside the tenant prefix. -->
+        <a class="cockpit-link" href={`${basePath || ""}/cockpit`}>
+          <svg><use href="#i-gear"></use></svg><span>Developer cockpit</span>
+        </a>
+        <div class="account" data-admin-account>
+          <span class="account-avatar" aria-hidden="true"><svg><use href="#i-user"></use></svg></span>
+          <span class="account-meta">
+            {viewerEmail ? (
+              <>
+                <span class="account-email" title={viewerEmail}>{viewerEmail}</span>
+                <span
+                  class="account-standing"
+                  data-standing={adminEntry.isOwnerViewer ? "owner" : isStaff ? "staff" : "none"}
+                >
+                  {adminEntry.isOwnerViewer
+                    ? `owner/admin of ${tenantEnvelope.targetTenant}`
+                    : isStaff
+                      ? `ToT staff · not an owner of ${tenantEnvelope.targetTenant}`
+                      : `signed in · no owner/admin standing for ${tenantEnvelope.targetTenant}`}
+                </span>
+                <form class="account-signout" method="post" action="/api/auth/logout">
+                  <button type="submit">Sign out</button>
+                </form>
+              </>
+            ) : (
+              <>
+                <span class="account-email">Not signed in</span>
+                <span class="account-standing" data-standing="none">
+                  <a href="/auth/login">sign in</a> as an owner/admin of {tenantEnvelope.targetTenant} to publish
+                </span>
+              </>
+            )}
+          </span>
+        </div>
       </aside>
       <main class="main">
@@ -1159,6 +1323,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <a class="tab" href="#fulfillment" role="tab" aria-controls="fulfillment" aria-selected="false" data-admin-tab-link>Fulfillment</a>
           <a class="tab" href="#reporting" role="tab" aria-controls="reporting" aria-selected="false" data-admin-tab-link>Reporting</a>
           <a class="tab" href="#ai-workflows" role="tab" aria-controls="ai-workflows" aria-selected="false" data-admin-tab-link>AI Workflows</a>
+          <a class="tab" href="#publish" role="tab" aria-controls="publish" aria-selected="false" data-admin-tab-link>Publish</a>
           <a class="tab" href="#settings" role="tab" aria-controls="settings" aria-selected="false" data-admin-tab-link>Settings</a>
         </div>
@@ -1206,6 +1371,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
                   <a id="admin-tab-fulfillment" class="tab" href="#fulfillment" role="tab" aria-controls="fulfillment" aria-selected="false" data-admin-tab-link>Fulfillment</a>
                   <a id="admin-tab-reporting" class="tab" href="#reporting" role="tab" aria-controls="reporting" aria-selected="false" data-admin-tab-link>Reporting</a>
                   <a id="admin-tab-ai-workflows" class="tab" href="#ai-workflows" role="tab" aria-controls="ai-workflows" aria-selected="false" data-admin-tab-link>AI Workflows</a>
+                  <a id="admin-tab-publish" class="tab" href="#publish" role="tab" aria-controls="publish" aria-selected="false" data-admin-tab-link>Publish</a>
                   <a id="admin-tab-settings" class="tab" href="#settings" role="tab" aria-controls="settings" aria-selected="false" data-admin-tab-link>Settings</a>
                 </div>
@@ -1331,6 +1497,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <AdminFulfillmentTab envelope={tenantEnvelope} />
           <AdminReportingTab envelope={tenantEnvelope} />
           <AdminAIWorkflowsTab envelope={tenantEnvelope} />
+          <AdminPublishTab envelope={tenantEnvelope} />
           <AdminSettingsTab envelope={tenantEnvelope} />
           {canViewInternalGuide && (
@@ -1447,7 +1614,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
     <script is:inline nonce={cspNonce}>
       (() => {
-        const tabIds = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "settings"];
+        const tabIds = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "publish", "settings"];
         const tabSet = new Set(tabIds);
         const tabHashPattern = new RegExp(`^#(${tabIds.join("|")})$`);
         const canViewInternalGuide = document.documentElement.dataset.internalAdminGuide === "true";
@@ -1460,16 +1627,20 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           fulfillment: "Fulfillment",
           reporting: "Reporting",
           "ai-workflows": "AI Workflows",
+          publish: "Publish",
           settings: "Settings",
         };
         const panelIdFromHash = () => {
-          const hash = window.location.hash.slice(1);
-          if (!hash) return defaultTab;
+          const rawHash = window.location.hash.slice(1);
+          // The tab id is the part before any "?" query suffix (#publish?pr=42);
+          // the raw hash is still used for internal-guide anchor resolution.
+          const hash = rawHash.split("?")[0];
+          if (!rawHash) return defaultTab;
           if (tabSet.has(hash)) return hash;
           if (!canViewInternalGuide) return defaultTab;
-          const target = hash ? document.getElementById(hash) : null;
+          const target = rawHash ? document.getElementById(rawHash) : null;
           const panel = target?.closest?.("[data-admin-panel]");
           if (panel?.id && tabSet.has(panel.id)) return panel.id;
@@ -1599,8 +1770,11 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           if (panelId) {
             setActiveTab(panelId);
-            const hash = window.location.hash.slice(1);
-            if (!canViewInternalGuide && (!hash || !tabSet.has(hash))) {
+            // Strip any query suffix before deciding whether the hash names a
+            // real tab — a valid deep link like #publish?pr=42 must not be
+            // normalized away to #settings for merchant viewers.
+            const hashTab = window.location.hash.slice(1).split("?")[0];
+            if (!canViewInternalGuide && !tabSet.has(hashTab)) {
               history.replaceState(null, "", "#settings");
             }
             if (scroll) requestAnimationFrame(() => scrollToHashTarget(panelId));

package/apps/storefront/src/pages/api/activity.ts ADDED Viewed

@@ -0,0 +1,137 @@
+/**
+ * POST /api/activity — the ingest endpoint of the operational activity telemetry
+ * spine (card D4). Accepts one `ActivityEvent` (or a batch array) as JSON from
+ * the emitter cohorts — the CLI (D3) and the UI (D6), both posting the wire shape
+ * of `packages/public-runtime/src/activity/event.ts` — authenticates the caller,
+ * re-redacts server-side, and fans each accepted event out to the sink(s) its
+ * catalog entry declares. See DECISIONS.md §8 for the store decision.
+ *
+ * AUTH — HMAC-SHA256 service-auth (`src/lib/activity/ingestAuth.ts`). The caller
+ * presents the authenticated tenant in `x-tot-activity-tenant` and a hex
+ * signature over `<tenant>\n<rawBody>` in `x-tot-activity-signature`, keyed by
+ * the `ACTIVITY_INGEST_SECRET` Worker secret. Binding the tenant into the signed
+ * material is what makes the tenant scope trustworthy: the route writes every
+ * row under THIS verified tenant and discards any body-supplied `scope.tenantId`
+ * (multi-tenant isolation). An unset secret is a 503 (seam not configured — the
+ * same convention as the MCP webhook receivers), not an auth failure.
+ *
+ * DEFENSE IN DEPTH — every event is rebuilt through `createActivityEvent()`
+ * (`ingestEvents`), re-applying the default-deny allowlist + canary scan even
+ * though emitters already redacted. A value-canary trip is self-telemetried as
+ * `system.ingest.rejected` so a leak attempt is visible (D6/D7 alert on it).
+ *
+ * OFF THE CRITICAL PATH — auth + parse + validate + redact are cheap synchronous
+ * CPU; the sink WRITES (D1 + Analytics Engine) run past the response via
+ * `runAfterResponse` (Workers `waitUntil`). The response is a 202 with per-event
+ * accepted/rejected counts the instant validation is done — a slow D1 write never
+ * holds the emitter's request open. JSON bodies are exempt from Astro's CSRF
+ * origin check, so the server-to-server callers work.
+ */
+import type { APIContext } from "astro";
+import { readD1, readEnv, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { fromD1 } from "@/lib/d1/catalog";
+import { verifyIngestAuth } from "@/lib/activity/ingestAuth";
+import { ingestEvents, type IngestRejection } from "@/lib/activity/ingest";
+import { fanOutActivity, type AnalyticsEngineLike, type ActivitySinks } from "@/lib/activity/store";
+import { isActivityDisabled } from "@/lib/activity/killSwitch";
+import { createActivityEvent } from "@tot/public-runtime";
+export const prerender = false;
+/** Cap the batch so a single POST can't fan out unbounded work past the response. */
+const MAX_BATCH = 200;
+function json(body: unknown, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    // Write-path ack — never cacheable. Mirrors the house convention.
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}
+export async function POST(context: APIContext): Promise<Response> {
+  // Kill switch (D8): telemetry off ⇒ accept-and-drop. Fail-open toward the EMITTER —
+  // a 202 (never a 4xx/5xx) so a CLI/UI poster never errors, retries, or is delayed by
+  // the switch; nothing is validated, stored, or fanned out.
+  if (isActivityDisabled()) {
+    return json({ ok: true, disabled: true, accepted: 0, rejected: [] }, 202);
+  }
+  const secret = await readEnv("ACTIVITY_INGEST_SECRET");
+  if (!secret) {
+    // Seam not configured (emitters don't post without the shared ingest secret).
+    return new Response("activity ingest not configured", { status: 503 });
+  }
+  // Read the RAW body once: it is both the auth material and the JSON payload.
+  const rawBody = await context.request.text();
+  const auth = await verifyIngestAuth(context.request.headers, rawBody, secret);
+  if (!auth.ok) return new Response(auth.reason, { status: auth.status });
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return json({ ok: false, reason: "invalid JSON body" }, 400);
+  }
+  const events = Array.isArray(parsed) ? parsed : [parsed];
+  if (events.length === 0) return json({ ok: true, accepted: 0, rejected: [] }, 202);
+  if (events.length > MAX_BATCH) {
+    return json({ ok: false, reason: `batch too large (max ${MAX_BATCH})` }, 413);
+  }
+  // Validate + re-redact under the AUTHENTICATED tenant (cheap, synchronous).
+  const { accepted, rejected } = ingestEvents(events, auth.tenantId);
+  // Resolve the sink bindings (absent in dev/until provisioned ⇒ that sink is
+  // skipped, never an error).
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  const analytics = (await readAnalytics("ACTIVITY_ANALYTICS")) as AnalyticsEngineLike | undefined;
+  const sinks: ActivitySinks = {
+    ...(d1 ? { db: fromD1(d1) } : {}),
+    ...(analytics ? { analytics } : {}),
+    ingestedAt: new Date().toISOString(),
+  };
+  // Self-telemetry: a value-canary trip during server-side redaction means an
+  // emitter leaked (or tried to leak) a secret/PII into the payload. Emit a
+  // `system.ingest.rejected` event (itself routed to logs+analytics) so D6/D7 can
+  // alert — the fact of the trip, the action, never the offending value. Rejected
+  // events get the same self-telemetry so a spoof/unknown-action attempt is
+  // visible. Built here (synchronously) but fanned out off-path below.
+  const selfTelemetry = [
+    ...accepted
+      .filter((a) => a.canaryTripped)
+      .map((a) =>
+        createActivityEvent({
+          action: "system.ingest.rejected",
+          actor: { kind: "system", id: "activity-ingest" },
+          source: "server",
+          outcome: { status: "refused", errorClass: "canary_tripped" },
+          scope: { tenantId: auth.tenantId },
+          payload: { args: { reason: "canary_tripped", attemptedAction: a.event.action } },
+        }).event,
+      ),
+    ...rejected.map((r: IngestRejection) =>
+      createActivityEvent({
+        action: "system.ingest.rejected",
+        actor: { kind: "system", id: "activity-ingest" },
+        source: "server",
+        outcome: { status: "refused", errorClass: r.reason },
+        scope: { tenantId: auth.tenantId },
+        payload: { args: { reason: r.reason, ...(r.attemptedAction ? { attemptedAction: r.attemptedAction } : {}) } },
+      }).event,
+    ),
+  ];
+  // Fan every accepted event + the self-telemetry out to its sinks, PAST the
+  // response. Best-effort per sink (never throws). The adapter's per-request
+  // ExecutionContext lives at `locals.runtime.ctx`; runAfterResponse floats the
+  // promise in dev/Node when it is absent.
+  const cfContext = (context.locals as { runtime?: { ctx?: CfExecutionContextLike } })?.runtime?.ctx ?? null;
+  const work = Promise.all([...accepted.map((a) => a.event), ...selfTelemetry].map((e) => fanOutActivity(e, sinks)));
+  runAfterResponse(work, cfContext);
+  return json({ ok: true, accepted: accepted.length, rejected }, 202);
+}

package/apps/storefront/src/pages/api/admin/activity-alerts.ts ADDED Viewed

@@ -0,0 +1,73 @@
+/**
+ * `GET /api/admin/activity-alerts` — the polled/on-demand surface for card D7's
+ * operational-activity alert conditions.
+ *
+ * On-demand by design (see `lib/activity/alerts.ts` header): D7 deliberately does
+ * NOT add a cron/scheduled runner (no established precedent for one in this repo).
+ * This route runs `checkActivityAlerts()` fresh on every call, so it doubles as:
+ *   (a) the data source for the `/admin/ops-timeline` alerts banner (that page
+ *       calls the same function directly, in-process — this route is for OTHER
+ *       callers), and
+ *   (b) a lightweight endpoint an external uptime/monitor tool can poll on an
+ *       interval, turning "on-demand" into "effectively continuous" without this
+ *       repo standing up its own scheduler.
+ *
+ * ACCESS CONTROL mirrors `/admin/ops-timeline` exactly (same owner/admin-of-tenant
+ * or ToT-staff gate via `resolveAdminEntry`/`resolveAdminTenantMode`) rather than a
+ * new service-secret seam — this repo's other machine-to-machine surfaces
+ * (candidate-reconcile, the activity ingest route) authenticate a SPECIFIC known
+ * caller (MCP, an emitter) via a shared secret; there is no such caller for
+ * "a monitor polls for alerts" yet, and inventing one is the "new notification
+ * infra" the card scopes OUT. An admin/staff session (the same one that already
+ * views ops-timeline) is the correct, already-available caller today.
+ *
+ * TENANT ISOLATION — scoped to `Astro.locals.tenant.tenant_id` exactly like
+ * ops-timeline; never a URL/query value.
+ */
+import type { APIContext } from "astro";
+import { readViewerSession } from "@/lib/auth/route";
+import { resolveAdminEntry } from "@/lib/auth/adminEntry";
+import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
+import { readD1 } from "@/lib/env";
+import { fromD1 } from "@/lib/d1/catalog";
+import { checkActivityAlerts } from "@/lib/activity/alerts";
+export const prerender = false;
+const JSON_HEADERS = {
+  "content-type": "application/json; charset=utf-8",
+  "cache-control": "no-store",
+  "x-robots-tag": "noindex, nofollow",
+};
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+export async function GET(context: APIContext): Promise<Response> {
+  const { tenant } = context.locals;
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const viewerSession = await readViewerSession(context);
+  if (!viewerSession) return json({ ok: false, reason: "sign_in_required" }, 401);
+  const adminEntry = resolveAdminEntry({
+    record: viewerSession,
+    hostResource: tenant.appDomain,
+    nowSeconds,
+  });
+  const { isStaff } = resolveAdminTenantMode({
+    session: viewerSession,
+    adminAppTenant: tenant.appDomain,
+    requestedTarget: null,
+    nowSeconds,
+  });
+  const authorized = adminEntry.isOwnerViewer || isStaff;
+  if (!authorized) return json({ ok: false, reason: "not_authorized" }, 403);
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ ok: true, dbAvailable: false, alerts: [] });
+  const alerts = await checkActivityAlerts(fromD1(d1), tenant.tenant_id);
+  return json({ ok: true, dbAvailable: true, alerts });
+}

package/apps/storefront/src/pages/api/apps/admin/credentials/rotate.ts ADDED Viewed

@@ -0,0 +1,86 @@
+/**
+ * POST /api/apps/admin/credentials/rotate — rotate an install's client
+ * secret, keeping the same `client_id` (PrivateApps epic, D2 Chunk C; D8
+ * console-session auth added). The new secret is returned ONCE here and never
+ * again — the same one-time-secret guarantee `install()` gives (see
+ * `registryService.ts`'s `InstallResult` doc).
+ *
+ * `registryService.rotateCredentials()` takes a bare `installId` with no
+ * tenant check of its own (Chunk A assumption #1) — so this route resolves
+ * the install via `requireOwnedInstall` BEFORE calling it, rejecting a
+ * foreign-tenant `installId` with the SAME 404 a truly-missing one gets (no
+ * cross-tenant existence oracle). Mutating: `requireManageRole` gates a
+ * console `developer` role out — the host-bound/Bearer path is exempt (no
+ * `role`).
+ */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import {
+  getRegistryService,
+  registryErrorResponse,
+  requireOwnedInstall,
+  requireManageRole,
+  parseInstallId,
+  json,
+} from "@/lib/apps/adminService.js";
+import { RegistryError } from "@/lib/apps/registryService.js";
+import { resolveUiActor } from "@/lib/activity/uiActor";
+import { recordActivity } from "@/lib/activity/recordActivity";
+export const prerender = false;
+export async function POST(context: APIContext): Promise<Response> {
+  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
+  const auth = await resolveOperatorSession(context, requestedTenant);
+  if (!auth.ok) return json({ error: auth.message }, auth.status);
+  const manageDenied = requireManageRole(auth);
+  if (manageDenied) return manageDenied;
+  let body: unknown;
+  try {
+    body = await context.request.json();
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+  const installId = parseInstallId(body);
+  if (!installId) return json({ error: "installId is required" }, 400);
+  const registry = await getRegistryService();
+  if (registry instanceof Response) return registry;
+  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
+  if (owned instanceof Response) return owned;
+  // D10: acting cohort (merchant/admin), emitted source "server". SECURITY: the
+  // rotated secret (`issued.secret`) is NEVER placed in the payload — the allowlist
+  // names only the non-sensitive app handle (appId/env, from the owned install) +
+  // rotation time.
+  const activityActor = await resolveUiActor(context, { owner: auth.tenantId });
+  try {
+    const issued = await registry.rotateCredentials(installId, auth.actor);
+    recordActivity({
+      action: "app.credential.rotated",
+      actor: activityActor,
+      source: "server",
+      outcome: { status: "succeeded" },
+      scope: { tenantId: auth.tenantId },
+      payload: { args: { appId: owned.appId, env: owned.env, rotatedAt: new Date().toISOString() } },
+    });
+    return json({ credential: { clientId: issued.clientId, secret: issued.secret } });
+  } catch (err) {
+    if (err instanceof RegistryError) {
+      recordActivity({
+        action: "app.credential.rotated",
+        actor: activityActor,
+        source: "server",
+        outcome: { status: "failed", errorClass: err.code },
+        scope: { tenantId: auth.tenantId },
+        payload: { args: { appId: owned.appId, env: owned.env } },
+      });
+      return registryErrorResponse(err);
+    }
+    throw err;
+  }
+}

package/apps/storefront/src/pages/api/apps/admin/health.ts ADDED Viewed

@@ -0,0 +1,44 @@
+/**
+ * GET /api/apps/admin/health — the console's per-install health rollup for
+ * the resolved operator tenant (PrivateApps epic, D8 Chunk C). Read-only:
+ * any membership role admits (mirrors `list.ts`'s `?tenant=`-as-candidate
+ * scoping — the tenant actually queried is always `auth.tenantId`, never the
+ * raw param).
+ *
+ * Folds `registryService.listByTenant` with `deliveryStore.getInstallHealth`
+ * per install through `healthAggregate.ts`'s `buildInstallHealthView` — that
+ * view is what data-minimizes `webhookEndpoint` down to `hasWebhookEndpoint`,
+ * so this route never even holds the raw endpoint value to leak.
+ */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import { getRegistryService, json } from "@/lib/apps/adminService.js";
+import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
+import { buildInstallHealthView, type AppInstallHealthView } from "@/lib/apps/healthAggregate.js";
+import { fromD1 } from "@/lib/d1/catalog.js";
+import { readD1 } from "@/lib/env";
+export const prerender = false;
+export async function GET(context: APIContext): Promise<Response> {
+  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
+  const auth = await resolveOperatorSession(context, requestedTenant);
+  if (!auth.ok) return json({ error: auth.message }, auth.status);
+  const registry = await getRegistryService();
+  if (registry instanceof Response) return registry;
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ error: "webhook store not configured" }, 503);
+  const deliveryStore = new WebhookDeliveryStore(fromD1(d1));
+  const installs = await registry.listByTenant(auth.tenantId);
+  const apps: AppInstallHealthView[] = await Promise.all(
+    installs.map(async (install) => {
+      const health = await deliveryStore.getInstallHealth(install.installId);
+      return buildInstallHealthView(install, health);
+    }),
+  );
+  return json({ apps });
+}