@tokenoftrust/storefront-runner 1.4.1 → 1.4.2-rc.0

package/scripts/tot-dev.mjs

@@ -31,7 +31,7 @@
  *      Vite trusts) and run a recursive `fs.watch` on the checkout that re-syncs each
  *      changed file back into the in-tree copy on save — which is what fires Vite HMR.
  *
- * Two things learned the hard way (see the two-liners below):
+ * Two things to know (see the two-liners below):
  *   - Tenant is selected by the URL path-prefix (`/<appDomain>/`), NOT by
  *     DEFAULT_TENANT_ID — the @astrojs/cloudflare dev runtime (workerd) reads env
  *     from .dev.vars/bindings, so a spawned process.env var never reaches it, and
@@ -76,9 +76,8 @@ const flag = (name, def) => {
 
 // `--version` / `-v` / `version` → print the runner's PUBLISHED version and exit.
 // Reads the emitted root package.json (build-runner.mjs stamps RUNNER_VERSION in
-// PUBLISH mode). This is the version the 2026-07-14 cache-staleness bug hid — the
-// runner kept being served from a stale public-0.1.0 dir with no way to see it —
-// so making it directly checkable (npm bin `storefront-runner`) is part of the fix.
+// PUBLISH mode), so the runner's version is directly checkable (npm bin
+// `storefront-runner`).
 if (argv[0] === "--version" || argv[0] === "-v" || argv[0] === "version") {
   let v = "0.0.0";
   try {
@@ -165,7 +164,7 @@ if (!domain) {
 // Records let us undo everything on exit (leave the tree exactly as found).
 /** @type {{ target: string, backup: string|null }[]} */
 const grafts = [];
-/** @type {import("node:fs").FSWatcher[]} */
+/** @type {Array<{ close: () => void }>} */
 const watchers = [];
 let cleanedUp = false;
 
@@ -295,8 +294,7 @@ if (workspacePath) {
 
 // Resolve the port BEFORE printing a URL or booting astro. Vite's `strictPort`
 // defaults off, so a taken port makes astro SILENTLY drift to the next free one —
-// which then mismatches the URL we (and the CLI's liveness poll) advertise, and a
-// stale server on the original port produced a false "You're live" (2026-07-14).
+// which then mismatches the URL we (and the CLI's liveness poll) advertise.
 // Instead we pick the first free port ourselves and PRINT it, so a busy default
 // port "just works" (better UX than failing). See port-check.mjs.
 const requestedPort = Number(flag("port", "4321"));
@@ -362,8 +360,7 @@ const spawnEnv = workspacePath
 // require pnpm at RUNTIME), so resolve astro's real entry through Node's own
 // resolver from the app package and exec it with our Node. No package-manager
 // binary, no .bin shims, and no coupling to the package's name (the build
-// renames @tot/storefront → @tot/storefront-runner in the shipped tree, which
-// the old `pnpm --filter <name> exec` had to track).
+// renames @tot/storefront → @tot/storefront-runner in the shipped tree).
 const appDir = resolve(repoRoot, "apps/storefront");
 const astroEntry = resolve(
   dirname(createRequire(join(appDir, "package.json")).resolve("astro/package.json")),

package/apps/storefront/src/lib/dev/vcBinding.ts

@@ -1,80 +0,0 @@
-/**
- * Cockpit safety-net for the 08-18 vc-app-binding gap (§5): ensure the signed-in
- * developer is bound to storefront's version-control app so their `tot start`
- * checkout (`tenant_checkout`) and the repo tools stop 403-ing "No version-control
- * app is bound to your session."
- *
- * WHY a net at all: the ROOT fix binds every entitled human at the authority seams
- * the MCP owns — grant issuance, rendezvous `/approve`, native OAuth token issuance
- * — plus a one-shot backfill. Those cover the terminal path. This net covers the
- * BROWSER-FIRST developer who reached /cockpit via the storefront's own tot20
- * sign-in (a `tot_session` cookie) WITHOUT ever crossing an MCP binding seam, so
- * they'd otherwise land at cockpit with a `tot start` command that 403s.
- *
- * HOW (mirrors cli-signin-approve): there is NO per-human MCP session server-side —
- * the cockpit reaches the MCP only as the APP (private_key_jwt). So we re-issue a
- * FRESH tot20-signed id_token for the VERIFIED session email (via the storefront's
- * core credential — {@link reissueSubjectToken}, the same proof `/approve` sends)
- * and pass it as the `subject_token` the MCP binds the enrollment to. The app can't
- * assert an arbitrary subject; the MCP verifies the proof + the subject's LIVE
- * entitlement and authors the binding under its own forge authority (ADR-0001).
- *
- * ALWAYS FAIL-OPEN: any gap (proof re-issue failed, MCP cold/unreachable, the
- * endpoint not yet deployed) returns a typed `{ ok:false }` and NEVER throws — the
- * cockpit must render regardless, and the authority-seam binding + backfill are the
- * real guarantees. This is strictly a best-effort accelerator.
- */
-import { createForgeClient } from "@/lib/forge";
-import { reissueSubjectToken } from "@/lib/dev/subjectReissue";
-
-export type EnsureCockpitBindingResult =
-  | { ok: true; bound: boolean; created: boolean }
-  | { ok: false; reason: string };
-
-export interface EnsureCockpitBindingDeps {
-  /** Override the subject-proof minter (tests). */
-  reissue?: typeof reissueSubjectToken;
-  /** Override the forge-client factory (tests) — returns something with ensureVcAppBinding. */
-  makeForgeClient?: () => Promise<{
-    ensureVcAppBinding(opts: {
-      subjectToken?: string;
-    }): Promise<{ bound: boolean; created: boolean }>;
-  }>;
-}
-
-/**
- * Ensure the developer identified by their VERIFIED session `email` is bound to the
- * storefront VC app. Best-effort + fail-closed-to-typed-error: never throws.
- */
-export async function ensureCockpitVcBinding(
-  email: string,
-  deps: EnsureCockpitBindingDeps = {},
-): Promise<EnsureCockpitBindingResult> {
-  if (!email) return { ok: false, reason: "missing-identity" };
-
-  const reissue = deps.reissue ?? reissueSubjectToken;
-  let subjectToken: string;
-  try {
-    const proof = await reissue(email);
-    if (!proof.ok) return { ok: false, reason: `reissue-${proof.reason}` };
-    subjectToken = proof.idToken;
-  } catch {
-    // A re-issue fault must not surface as a cockpit 500.
-    return { ok: false, reason: "reissue-threw" };
-  }
-
-  try {
-    const client = deps.makeForgeClient
-      ? await deps.makeForgeClient()
-      : await createForgeClient();
-    const res = await client.ensureVcAppBinding({ subjectToken });
-    return { ok: true, bound: res.bound, created: res.created };
-  } catch (cause) {
-    // Fail-open: the ensure endpoint may not be deployed yet, or the MCP may be
-    // cold/unreachable. The proof itself is never logged; the reason is a terse code.
-    return {
-      ok: false,
-      reason: "mcp-" + (cause instanceof Error ? cause.name : "error"),
-    };
-  }
-}