npm - @tokenoftrust/storefront-runner - Versions diffs - 1.4.0 → 1.4.2-rc.0 - Mend

@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (193) hide show

package/scripts/dev/file-browser.mjs CHANGED Viewed

@@ -5,13 +5,11 @@
  *
  * Follows the scripts/dev delegation pattern (see ai-edit.mjs): all logic lives
  * here, dependency-free and testable under `node --test`; a thin dev-only Vite
- * plugin (dev-plugins/dev-file-browser.mjs — added when C0/C1 integrate) maps
+ * plugin (dev-plugins/dev-file-browser.mjs) maps
  * req/res onto `handleTree` / `handleFile`. Every path is routed through
  * safe-path.mjs; the source root comes from tenant-source-root.mjs (never SSR).
  *
- * Git-status badges (C3 acceptance) layer on when C4's git-status.mjs lands —
- * the tree here carries structure only, so this module owns no git surface and
- * doesn't collide with C4.
+ * The tree here carries structure only, so this module owns no git surface.
  */
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, extname, sep } from "node:path";

package/scripts/dev/file-writer.mjs CHANGED Viewed

@@ -123,7 +123,7 @@ export function handleWrite(env = process.env, body = {}) {
     return { status: 400, json: { ok: false, status: "no_path", message: "path is required" } };
   }
-  const result = writeSourceFile(root.sourceRoot, relPath, body.content, {
+  const result = writeSourceFile(root.sourceRoot, relPath, /** @type {string} */ (body.content), {
     baseVersion: body ? body.baseVersion : undefined,
   });
   const status = result.ok

package/scripts/dev/git-status.mjs CHANGED Viewed

@@ -118,10 +118,10 @@ export function computeDiff(gitCwd, sourceRoot, relPath) {
   } catch {
     workingExists = false;
   }
-  if (workingExists && st.isDirectory()) {
+  if (st && st.isDirectory()) {
     return { ok: false, status: "is_dir", message: `${relPath} is a directory` };
   }
-  if (workingExists) {
+  if (workingExists && st) {
     if (BINARY_EXT.has(extname(posix).toLowerCase())) {
       return { ok: true, path: posix, status: fileStatus(gitCwd, relPath), shown: false, reason: "binary" };
     }

package/scripts/dev/locate-handler.mjs CHANGED Viewed

@@ -3,12 +3,12 @@
  *   POST /__tot/locate          {domPath, path} → {ok, path, line, col} | {status}
  *   POST /__tot/open-in-editor   {path, line, col} → {ok} | {status}
  *
- * Keeps locate.mjs a PURE parse5 walk (already integrated + tested 5/5); this module
+ * Keeps locate.mjs a PURE parse5 walk; this module
  * adds the env/path-resolution/refusal concerns and is itself unit-testable under
  * `node --test` with no running dev server (the scripts/dev delegation pattern — see
  * file-browser.mjs). The thin dev-plugins/dev-locate.mjs wrapper maps req/res onto it.
  *
- * HONORS decision `click-to-source-anchors-at-content-region`: the served page wraps
+ * The served page wraps
  * the raw content region (<main>, the whole of content/home.html) in the storefront's
  * own chrome (skip-link, header, nav, footer) that is NOT in the tenant source. So we
  * resolve the clicked URL to its raw content source and walk THAT from <body>:
@@ -90,7 +90,7 @@ export function handleLocate(env = process.env, body = {}) {
   const html = readFileSync(abs, "utf8");
   const found = locate(html, body.domPath);
-  if (typeof found.line === "number") {
+  if ("line" in found && typeof found.line === "number") {
     return { status: 200, json: { ok: true, path: rel, line: found.line, col: found.col } };
   }
   // The walk missed: the element is outside the raw content region — i.e. the storefront

package/scripts/dev/port-check.mjs CHANGED Viewed

@@ -8,9 +8,9 @@ import net from "node:net";
  * predicts astro's own bind on either IP family.
  *
  * WHY THIS EXISTS: Vite's `strictPort` defaults OFF, so when the requested port is
- * taken astro SILENTLY moves to the next free port. On 2026-07-14 that stranded the
- * CLI's liveness poll on the ORIGINAL port (answered by a stale foreign server) →
- * a false "✨ You're live" pointing at the wrong server. Pre-flighting the port and
+ * taken astro SILENTLY moves to the next free port — stranding the CLI's liveness
+ * poll on the ORIGINAL port (answered by a stale foreign server) → a false
+ * "✨ You're live" pointing at the wrong server. Pre-flighting the port and
  * failing clearly removes that whole class of silent failure.
  *
  * Dependency-free (node:net only) so it copies into the standalone runner and is

package/scripts/dev/publish.mjs CHANGED Viewed

@@ -20,15 +20,11 @@
  * Auth: the developer's own cached OAuth session (`tot login`,
  * `~/.tot/credentials.json`), via `packages/cli/src/auth.mjs`'s
  * `resolveDeveloperSession` — reads, silently refreshes, and attaches the
- * Bearer exactly as `tot submit` does. NOT the storefront-operator
- * TOT_API_KEY/TOT_SECRET_KEY path this module used before 2026-07-26:
- * tot-mcp went OAuth-first on 2026-07-23 ("Require OAuth before remote MCP
- * initialize"), which retired the old no-browser operator/credential_validate
- * trust path entirely — every caller, including this one, now needs a real
- * OAuth bearer just to complete `initialize`. There is no service-account /
- * client-credentials grant on this MCP (confirmed against its OAuth
- * authorization-server metadata), so a human `tot login` (one-time; refresh
- * is silent afterward, ~30-day refresh tokens) is the only way in.
+ * Bearer exactly as `tot submit` does. Every caller needs a real OAuth bearer
+ * just to complete `initialize`; there is no service-account / client-credentials
+ * grant on this MCP (confirmed against its OAuth authorization-server metadata),
+ * so a human `tot login` (one-time; refresh is silent afterward, ~30-day refresh
+ * tokens) is the only way in.
  */
 import { createHash } from "node:crypto";
 import { readFile } from "./file-browser.mjs";

package/scripts/dev/shot.mjs CHANGED Viewed

@@ -20,7 +20,7 @@ const CHROME_PATHS = [
   "/usr/bin/chromium-browser",
   "/usr/bin/chromium",
 ].filter(Boolean);
-const executablePath = CHROME_PATHS.find((p) => existsSync(p));
+const executablePath = CHROME_PATHS.find((p) => !!p && existsSync(p));
 const args = process.argv.slice(2);
 const url = args[0];

package/scripts/dev/unified-diff.mjs CHANGED Viewed

@@ -1,8 +1,8 @@
 /**
  * Minimal unified-diff applier for the inline-AI edit loop (WS5 G1).
  *
- * The MCP `content_edit` tool returns a per-file unified diff (`--- a/<path>` /
- * `+++ b/<path>` header, `@@ -l,c +l,c @@` hunks) rather than a full-file
+ * The MCP `content_edit` tool returns a per-file unified diff (a `---`/`+++`
+ * file header, then hunk headers of the form "-l,c +l,c") rather than a full-file
  * rewrite — this is what turns that diff back into the file's new content, so
  * `tot dev` can apply it, hot-reload, and undo it cleanly. Dependency-free
  * (matches the rest of the tenant tooling — see packages/cli/src/mcp.mjs).
@@ -12,10 +12,15 @@
  * that's exactly the shape content_edit's system prompt asks the model for.
  */
-/** One `@@ -l,c +l,c @@` hunk: the old/new starting line + its body lines. */
+/**
+ * One hunk (its "-l,c +l,c" header): the old/new starting line + its body lines.
+ * @typedef {{ oldStart: number, body: string[] }} Hunk
+ */
 function parseHunks(diff) {
   const lines = diff.split(/\r?\n/);
+  /** @type {Hunk[]} */
   const hunks = [];
+  /** @type {Hunk | null} */
   let current = null;
   const hunkHeader = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;

package/scripts/tot-dev.mjs CHANGED Viewed

@@ -31,7 +31,7 @@
  *      Vite trusts) and run a recursive `fs.watch` on the checkout that re-syncs each
  *      changed file back into the in-tree copy on save — which is what fires Vite HMR.
  *
- * Two things learned the hard way (see the two-liners below):
+ * Two things to know (see the two-liners below):
  *   - Tenant is selected by the URL path-prefix (`/<appDomain>/`), NOT by
  *     DEFAULT_TENANT_ID — the @astrojs/cloudflare dev runtime (workerd) reads env
  *     from .dev.vars/bindings, so a spawned process.env var never reaches it, and
@@ -76,9 +76,8 @@ const flag = (name, def) => {
 // `--version` / `-v` / `version` → print the runner's PUBLISHED version and exit.
 // Reads the emitted root package.json (build-runner.mjs stamps RUNNER_VERSION in
-// PUBLISH mode). This is the version the 2026-07-14 cache-staleness bug hid — the
-// runner kept being served from a stale public-0.1.0 dir with no way to see it —
-// so making it directly checkable (npm bin `storefront-runner`) is part of the fix.
+// PUBLISH mode), so the runner's version is directly checkable (npm bin
+// `storefront-runner`).
 if (argv[0] === "--version" || argv[0] === "-v" || argv[0] === "version") {
   let v = "0.0.0";
   try {
@@ -165,7 +164,7 @@ if (!domain) {
 // Records let us undo everything on exit (leave the tree exactly as found).
 /** @type {{ target: string, backup: string|null }[]} */
 const grafts = [];
-/** @type {import("node:fs").FSWatcher[]} */
+/** @type {Array<{ close: () => void }>} */
 const watchers = [];
 let cleanedUp = false;
@@ -295,8 +294,7 @@ if (workspacePath) {
 // Resolve the port BEFORE printing a URL or booting astro. Vite's `strictPort`
 // defaults off, so a taken port makes astro SILENTLY drift to the next free one —
-// which then mismatches the URL we (and the CLI's liveness poll) advertise, and a
-// stale server on the original port produced a false "You're live" (2026-07-14).
+// which then mismatches the URL we (and the CLI's liveness poll) advertise.
 // Instead we pick the first free port ourselves and PRINT it, so a busy default
 // port "just works" (better UX than failing). See port-check.mjs.
 const requestedPort = Number(flag("port", "4321"));
@@ -362,8 +360,7 @@ const spawnEnv = workspacePath
 // require pnpm at RUNTIME), so resolve astro's real entry through Node's own
 // resolver from the app package and exec it with our Node. No package-manager
 // binary, no .bin shims, and no coupling to the package's name (the build
-// renames @tot/storefront → @tot/storefront-runner in the shipped tree, which
-// the old `pnpm --filter <name> exec` had to track).
+// renames @tot/storefront → @tot/storefront-runner in the shipped tree).
 const appDir = resolve(repoRoot, "apps/storefront");
 const astroEntry = resolve(
   dirname(createRequire(join(appDir, "package.json")).resolve("astro/package.json")),

package/apps/storefront/src/lib/webhooks/signing.ts DELETED Viewed

@@ -1,29 +0,0 @@
-/**
- * HTTP Message Signatures (RFC 9421) + Content-Digest (RFC 9530) signer for
- * outbound webhook delivery (PrivateApps epic, D4 Chunk B).
- *
- * The implementation MOVED to `@tokenoftrust/private-apps-devkit`
- * (PrivateApps epic D6 Chunk B) so the `tot app` CLI harness (D6 Chunk D) can
- * verify webhook signatures without importing Astro-internal code — without
- * forking security-critical crypto into a second, drifting copy. This file
- * is now a thin re-export; the devkit package is the ONE source of truth.
- * See `packages/private-apps-devkit/src/signing.ts` for the full scope
- * notes (hand-rolled/narrowly-scoped, not a general httpsig implementation)
- * and `packages/private-apps-devkit/tests/signing.test.ts` for the RFC-vector
- * proofs. `signing.test.ts` alongside this file still imports from here —
- * unchanged — so it now exercises those same functions through this
- * re-export.
- */
-export {
-  SIGNATURE_LABEL,
-  WEBHOOK_SIGNATURE_COVERED_COMPONENTS,
-  computeContentDigestSha256,
-  buildSignatureParamsValue,
-  buildSignatureBase,
-  signWebhookRequest,
-  verifyWebhookSignature,
-  type SignWebhookRequestInput,
-  type SignWebhookRequestResult,
-  type WebhookVerifyResult,
-  type VerifyWebhookSignatureInput,
-} from "@tokenoftrust/private-apps-devkit";

package/apps/storefront/src/lib/webhooks/webhookSigningKey.ts DELETED Viewed

@@ -1,146 +0,0 @@
-/**
- * RS256 signing-key loader for outbound webhook delivery (PrivateApps epic,
- * D4 Chunk B) — the key `signing.ts` uses to attach HTTP Message Signatures
- * (RFC 9421) to every CloudEvents webhook POST.
- *
- * Mirrors `../apps/gatewayKeys.ts`'s `loadGatewaySigningConfig`/
- * `loadGatewayJwks` structure EXACTLY (import cache keyed on the base64
- * source, JWKS derivation that strips every private RSA field), but over a
- * SEPARATE key (`WEBHOOK_SIGNING_PRIVATE_KEY_B64`) with a separate kid
- * (`webhook-signing-1`) — per `d4-design-resolutions`, this key must never be
- * the same as the D2 gateway key. The gateway key attests requests an app
- * makes INTO the storefront (app → gateway trust); the webhook signing key
- * attests events the storefront pushes OUT to an app (gateway → app trust,
- * the opposite direction). Sharing a key would let a receiver's verification
- * key double as the ability to (offline) verify gateway tokens, and rotating
- * one would force rotating the other.
- *
- * The private key never leaves this module. `loadWebhookJwks` derives the
- * PUBLIC-only JWKS from it, published (Chunk B) via a new field on
- * `/.well-known/tot-app-authorization-metadata`.
- */
-import { importPKCS8, exportJWK, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
-import { readEnv } from "@/lib/env";
-// Re-exported (not re-defined) — `@tokenoftrust/private-apps-devkit`'s
-// signing.ts is the ONE source of truth for this constant since D6 Chunk B
-// (it's the `alg` its sign/verify functions produce/accept); this module
-// just keeps the historical import path (`./webhookSigningKey.js`) working.
-export { WEBHOOK_SIGNING_HTTPSIG_ALG } from "@tokenoftrust/private-apps-devkit";
-/** The only algorithm the webhook signer signs with (verifiers reject anything else). */
-export const WEBHOOK_SIGNING_ALG = "RS256";
-/** Default key id (overridable via `WEBHOOK_SIGNING_KID`). Names the published key. */
-export const DEFAULT_WEBHOOK_SIGNING_KID = "webhook-signing-1";
-/** Env keys the loader reads (server-only). */
-export const WEBHOOK_SIGNING_PRIVATE_KEY_ENV = "WEBHOOK_SIGNING_PRIVATE_KEY_B64";
-export const WEBHOOK_SIGNING_KID_ENV = "WEBHOOK_SIGNING_KID";
-/**
- * Thrown when the webhook signer can't load its signing key — the private
- * key env is absent/malformed. Callers FAIL CLOSED: with no key, no delivery
- * can be signed, and the metadata route omits the webhook JWKS field rather
- * than publish a key that will never actually sign anything.
- */
-export class WebhookSigningKeyError extends Error {}
-/** Optional test/DI overrides (avoids touching process env in unit tests). */
-export interface WebhookSigningKeyOverrides {
-  /** base64 of the PKCS8 PEM private key (defaults to the env value). */
-  privateKeyB64?: string;
-  kid?: string;
-}
-export interface WebhookSigningConfig {
-  key: CryptoKey;
-  kid: string;
-}
-// Same cache shape as gatewayKeys.ts's signingKeyCache/publicJwkCache, keyed
-// on the base64 string so a rotated key transparently re-imports/re-derives.
-const signingKeyCache = new Map<string, CryptoKey>();
-const publicJwkCache = new Map<string, JWK>();
-async function importPrivateKey(privateKeyB64: string): Promise<CryptoKey> {
-  const cached = signingKeyCache.get(privateKeyB64);
-  if (cached) return cached;
-  let pem: string;
-  try {
-    pem = Buffer.from(privateKeyB64, "base64").toString("utf8");
-  } catch (cause) {
-    throw new WebhookSigningKeyError(
-      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not valid base64 ` +
-        (cause instanceof Error ? cause.message : String(cause)),
-    );
-  }
-  if (!/-----BEGIN (RSA )?PRIVATE KEY-----/.test(pem)) {
-    throw new WebhookSigningKeyError(
-      `webhook signing: decoded ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not a PEM private key`,
-    );
-  }
-  let key: CryptoKey;
-  try {
-    // extractable: true — required so `loadWebhookJwks` below can derive the
-    // public JWK from this same key, and so `signing.ts` can sign raw bytes
-    // with `crypto.subtle.sign` directly (no JWS wrapping needed for RFC
-    // 9421 — the signature is over the derived signature base, not a JWT).
-    key = (await importPKCS8(pem, WEBHOOK_SIGNING_ALG, { extractable: true })) as CryptoKey;
-  } catch (cause) {
-    throw new WebhookSigningKeyError(
-      `webhook signing: failed to import the RS256 private key ` +
-        (cause instanceof Error ? cause.message : String(cause)),
-    );
-  }
-  signingKeyCache.set(privateKeyB64, key);
-  return key;
-}
-/**
- * Resolve the active signing config (key + kid) from env, or `overrides` in
- * tests. FAILS CLOSED: throws {@link WebhookSigningKeyError} when the private
- * key env is absent/malformed.
- */
-export async function loadWebhookSigningConfig(
-  overrides: WebhookSigningKeyOverrides = {},
-): Promise<WebhookSigningConfig> {
-  const privateKeyB64 =
-    overrides.privateKeyB64 ?? (await readEnv(WEBHOOK_SIGNING_PRIVATE_KEY_ENV));
-  if (!privateKeyB64) {
-    throw new WebhookSigningKeyError(
-      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not configured (fail closed)`,
-    );
-  }
-  const kid = overrides.kid ?? (await readEnv(WEBHOOK_SIGNING_KID_ENV)) ?? DEFAULT_WEBHOOK_SIGNING_KID;
-  const key = await importPrivateKey(privateKeyB64);
-  return { key, kid };
-}
-/**
- * Derive the PUBLIC JWKS for the active webhook signing key — sanitized
- * (every private RSA field stripped) and cached by the source private-key
- * base64. V1 always returns exactly one key; the envelope supports more
- * without a shape change later (rotation-with-overlap).
- */
-export async function loadWebhookJwks(
-  overrides: WebhookSigningKeyOverrides = {},
-): Promise<JSONWebKeySet> {
-  const privateKeyB64 =
-    overrides.privateKeyB64 ?? (await readEnv(WEBHOOK_SIGNING_PRIVATE_KEY_ENV));
-  if (!privateKeyB64) {
-    throw new WebhookSigningKeyError(
-      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not configured (fail closed)`,
-    );
-  }
-  const { key, kid } = await loadWebhookSigningConfig(overrides);
-  let jwk = publicJwkCache.get(privateKeyB64);
-  if (!jwk) {
-    const full = (await exportJWK(key)) as Record<string, unknown>;
-    // Strip every private RSA field (RFC 7518 §6.3.2) — only the public parts
-    // (kty, n, e) are ever published. This line is the one place that matters.
-    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, ...publicOnly } = full;
-    jwk = { ...publicOnly, kid, alg: WEBHOOK_SIGNING_ALG, use: "sig" };
-    publicJwkCache.set(privateKeyB64, jwk);
-  }
-  return { keys: [jwk] };
-}