@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/astro.config.mjs

@@ -57,6 +57,7 @@ const gitSha = (() => {
 import preact from "@astrojs/preact";
 import tailwindcss from "@tailwindcss/vite";
 import { tenantHotReload } from "./dev-plugins/tenant-hot-reload.mjs";
+import { materializeGuard } from "./integrations/materialize-guard.mjs";
 
 // SSR on Cloudflare Workers. `output: 'server'` because every response is
 // tenant-resolved at the edge from the Host header (see src/middleware).
@@ -88,7 +89,22 @@ export default defineConfig({
     // images get rehosted to R2 in Phase 1 ETL (see DECISIONS.md).
     imageService: "compile",
   }),
-  integrations: [preact({ compat: true })],
+  integrations: [
+    // A framework Worker build requires no real-tenant checkout: tenant content
+    // resolves from KV/R2 at request time. The same integration becomes strict
+    // only when TOT_BUILD_TENANTS names a per-tenant static publish input.
+    materializeGuard(),
+    preact({ compat: true }),
+    // Astro's file-based router ignores ANY path segment starting with "_" (see
+    // `astro/dist/core/routing/create-manifest.js`), so a page literally named
+    // `pages/__evidence.astro` silently never becomes a route (confirmed by build:
+    // no "/__evidence" entry lands in the route manifest, and it 404s in dev — the
+    // SAME latent gap `pages/__preview/version.ts` has, pre-existing and out of
+    // scope here). `injectRoute` is the supported way to bind an arbitrary URL
+    // pattern to a component that lives OUTSIDE `src/pages` (so it never competes
+    // with file-based routing), which is how `/__evidence` — the diagnostic evidence
+    // instrument panel — is wired to a real route.
+  ],
   vite: {
     // Build-time constants: the CLI install spec the cockpit hands out (next vs latest),
     // and this build's commit SHA reported by /health.

package/apps/storefront/env.d.ts

@@ -7,6 +7,9 @@ import type {
   TenantFeatures,
   ResolvedManagedCheckout,
   CapabilityConfig,
+  BrowserEnvironment,
+  CompiledIntegrationCsp,
+  EffectivePlan,
 } from "@tot/public-runtime";
 import type { ToTClient } from "@/lib/tot/ToTClient";
 import type { ContentProvider } from "@/lib/storyblok/provider";
@@ -29,6 +32,12 @@ interface KVNamespaceLike {
 interface R2BucketLike {
   get(key: string): Promise<unknown>;
   put(key: string, value: unknown): Promise<unknown>;
+  list(opts?: { prefix?: string; cursor?: string; limit?: number }): Promise<{
+    objects: { key: string }[];
+    truncated: boolean;
+    cursor?: string;
+  }>;
+  delete(keys: string | string[]): Promise<void>;
 }
 
 interface CloudflareEnv {
@@ -49,7 +58,7 @@ interface CloudflareEnv {
   TOT_SECRET_KEY?: string;
   TOT_ACCESS_TOKEN?: string;
   PUBLIC_CF_ANALYTICS_TOKEN?: string;
-  /** HMAC secret for signing/verifying customization preview tokens (D4). */
+  /** HMAC secret for signing/verifying customization preview tokens. */
   CUSTOMIZATION_PREVIEW_SECRET?: string;
   /**
    * Managed checkout (Track A). `FOXY_STORE_SUBDOMAIN` overrides the tenant's default
@@ -64,7 +73,7 @@ interface CloudflareEnv {
   FOXY_STORE_DOMAIN?: string;
   FOXY_CART_SECRET?: string;
   /**
-   * Order READ API bearer (U2) — the tenant's ToT `partnerApi.apiKey`, sent as
+   * Order READ API bearer — the tenant's ToT `partnerApi.apiKey`, sent as
    * `Authorization: Bearer` to the checkout order API. Server-side only (never
    * shipped to the browser). Absent -> the Orders route reports `not_provisioned`.
    */
@@ -120,17 +129,34 @@ declare global {
        */
       basePath: string;
       /**
-       * Which customization environment to serve (D4). "live" on production
+       * Which customization environment to serve. "live" on production
        * hosts; "test" only behind a valid, tenant-bound preview token on a
        * preview host. Downstream theme/content selection reads this.
        */
       customizationEnv: CustomizationEnv;
       /**
-       * Per-request CSP nonce (D2). Placed on the platform's own inline
+       * Per-request CSP nonce. Placed on the platform's own inline
        * <style>/<script is:inline> tags so a strict CSP can allow them without
        * `unsafe-inline`.
        */
       cspNonce: string;
+      /**
+       * The renderer-owned four-stage browser environment
+       * (`local|candidate|staged|live`) for this request, computed once by the
+       * middleware from authoritative server state. Both document mounts
+       * (Layout.astro and `rawHtmlResponse`) serialize THIS object, before any
+       * tenant/app code, so it is identical in both. Carries only public values —
+       * never a token, binding, or signed URL.
+       */
+      browserEnvironment: BrowserEnvironment;
+      /**
+       * The resolved effective plan (ext-kernel-03) for this request. The
+       * fixed-phase render engine (ext-kernel-04) consumes THIS in both document
+       * mounts (Layout.astro + rawHtmlResponse), so their renderer-owned phase
+       * markup is identical. Environment-only until declaration materialization is
+       * wired; carries no secret and no nonce.
+       */
+      integrationPlan: EffectivePlan;
       /**
        * Resolved cart/checkout facts for this request (loader src, cart URL,
        * mode). Present only for commerce tenants with a checkout store;
@@ -161,7 +187,7 @@ declare global {
       runtime?: { env: CloudflareEnv };
       /**
        * Every private-app widget placement actually rendered for this request
-       * (PrivateApps epic, D5). The middleware seeds this to `[]` before
+       * (PrivateApps epic). The middleware seeds this to `[]` before
        * `next()`; each page/layout that renders a widget slot (`renderSlot.ts`)
        * pushes its resolved placements onto it as the page renders, so the
        * middleware can read the full per-request set back out AFTER `next()`
@@ -169,6 +195,29 @@ declare global {
        * the origins that ended up on the page — never more.
        */
       activeWidgetPlacements?: { endpoint: string }[];
+      /**
+       * Third-party embed opt-in (EMBED_PROVIDERS catalog slugs) for THIS
+       * request, when it must come from a tenant the URL router can't resolve —
+       * specifically the candidate renderer (`/preview/render/<tenant>/…`, where
+       * `<tenant>` isn't the first path segment). `candidateRender` sets it to the
+       * resolved candidate tenant's opt-in; the middleware's embed scan prefers it
+       * over the router-resolved tenant's embeds when present. Unset on normal
+       * renders (the router-resolved tenant's embeds are authoritative there).
+       */
+      embedOptIn?: string[];
+      /**
+       * The version-scoped integration CSP contribution for THIS request, resolved
+       * from the tenant/environment/version effective plan (curated adapter
+       * profiles expanded + advanced exact origins merged, deterministic and bound
+       * to the plan's `planRevision`). It is plan-scoped server state — resolved
+       * before the edge-cache read so its `planRevision` folds into `pageCacheKey`
+       * (making a rollback/uninstall a clean warm miss, not a TTL wait) and its
+       * `additions` fold into the strict CSP the middleware builds after `next()`,
+       * only ever APPENDING reviewed origins to the six contributable directives.
+       * Absent when no integration declares CSP — the header and cache key are then
+       * byte-identical to a non-integration tenant's (zero cost when disabled).
+       */
+      integrationCsp?: CompiledIntegrationCsp;
     }
   }
 }

package/apps/storefront/integrations/materialize-guard.mjs

@@ -0,0 +1,54 @@
+import {
+  assertPinnedMaterialized,
+  checkPinned,
+} from "../../../scripts/tenant/materialize-tenant-content.mjs";
+
+/**
+ * Protect the two intentionally different build modes:
+ *
+ *   - Framework Worker (no TOT_BUILD_TENANTS): tenant content is runtime data,
+ *     so absent Gitea checkouts are expected and must never block deployment.
+ *   - Per-tenant static publish (TOT_BUILD_TENANTS set): the named checkout is
+ *     build input and therefore must be materialized at a pinned ref.
+ *
+ * TOT_TENANT_REF   also assert every stamp is EXACTLY this commit (off-ref → refuse)
+ * TOT_ALLOW_UNPINNED=1  tolerate a default-branch (unpinned) materialize
+ * TOT_FRAMEWORK_ONLY_BUILD=1  retained as a backwards-compatible explicit name
+ *   for framework mode; it is now the default whenever TOT_BUILD_TENANTS is unset.
+ * TOT_BUILD_TENANTS  comma-separated tenant ids to scope the guard to. A per-tenant
+ *   STATIC publish (materialize-tenant.mjs) sets this to the single tenant it renders,
+ *   so a sibling tenant can never block it. Unset ⇒ framework-only Worker build.
+ */
+export function materializeGuard() {
+  return {
+    name: "materialize-guard",
+    hooks: {
+      "astro:build:start": (ctx = {}) => {
+        const logger = ctx.logger;
+        const expectRef = process.env.TOT_TENANT_REF || null;
+        const allowUnpinned = process.env.TOT_ALLOW_UNPINNED === "1";
+        const scoped = (process.env.TOT_BUILD_TENANTS || "")
+          .split(",")
+          .map((t) => t.trim())
+          .filter(Boolean);
+        const onlyTenants = scoped.length > 0 ? scoped : null;
+        const frameworkOnly = onlyTenants === null || process.env.TOT_FRAMEWORK_ONLY_BUILD === "1";
+        if (frameworkOnly) {
+          const { problems } = checkPinned(undefined, { expectRef, allowUnpinned, onlyTenants });
+          const absent = problems.filter((p) => p.reason === "absent");
+          const real = problems.filter((p) => p.reason !== "absent");
+          if (absent.length) {
+            const msg = `[materialize-guard] framework-only build: ${absent.length} tenant checkout(s) absent (served from runtime storage): ${absent.map((p) => p.tenant).join(", ")}`;
+            if (logger && typeof logger.info === "function") logger.info(msg);
+            else console.log(msg);
+          }
+          if (real.length) {
+            assertPinnedMaterialized({ expectRef, allowUnpinned, onlyTenants });
+          }
+          return;
+        }
+        assertPinnedMaterialized({ expectRef, allowUnpinned, onlyTenants });
+      },
+    },
+  };
+}

package/apps/storefront/migrations-apps/0002_good_switch.sql

@@ -0,0 +1,26 @@
+CREATE TABLE `newsletter_sends` (
+	`tenant_id` text NOT NULL,
+	`collection` text NOT NULL,
+	`digest_id` text NOT NULL,
+	`post_slugs` text DEFAULT '[]' NOT NULL,
+	`recipient_count` integer DEFAULT 0 NOT NULL,
+	`sent_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `collection`, `digest_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `newsletter_subscribers` (
+	`tenant_id` text NOT NULL,
+	`collection` text NOT NULL,
+	`email` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`token` text NOT NULL,
+	`consent_source` text,
+	`consent_ip_hash` text,
+	`subscribed_at` text NOT NULL,
+	`confirmed_at` text,
+	`unsubscribed_at` text,
+	`last_sent_at` text,
+	PRIMARY KEY(`tenant_id`, `collection`, `email`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_newsletter_tenant_coll_status` ON `newsletter_subscribers` (`tenant_id`,`collection`,`status`);

package/apps/storefront/migrations-apps/0003_mute_marauders.sql

@@ -0,0 +1,12 @@
+CREATE TABLE `social_tokens` (
+	`tenant_id` text NOT NULL,
+	`network` text NOT NULL,
+	`ciphertext` text NOT NULL,
+	`iv` text NOT NULL,
+	`expires_at` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `network`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_social_tokens_tenant` ON `social_tokens` (`tenant_id`);

package/apps/storefront/migrations-apps/0004_deep_morph.sql

@@ -0,0 +1,36 @@
+CREATE TABLE `candidate_attempts` (
+	`id` text PRIMARY KEY NOT NULL,
+	`candidate_id` text NOT NULL,
+	`tenant_id` text NOT NULL,
+	`attempt_number` integer NOT NULL,
+	`kind` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`head_sha` text,
+	`detail` text,
+	`evidence` text,
+	`started_at` text NOT NULL,
+	`finished_at` text
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidate_attempts_candidate_number` ON `candidate_attempts` (`candidate_id`,`attempt_number`);--> statement-breakpoint
+CREATE INDEX `idx_candidate_attempts_candidate` ON `candidate_attempts` (`candidate_id`);--> statement-breakpoint
+CREATE INDEX `idx_candidate_attempts_tenant` ON `candidate_attempts` (`tenant_id`);--> statement-breakpoint
+CREATE TABLE `candidates` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`repository` text NOT NULL,
+	`pr_number` integer NOT NULL,
+	`change_id` text NOT NULL,
+	`branch` text,
+	`title` text,
+	`author` text,
+	`status` text DEFAULT 'open' NOT NULL,
+	`head_sha` text,
+	`base_sha` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidates_tenant_repo_pr` ON `candidates` (`tenant_id`,`repository`,`pr_number`);--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidates_tenant_change` ON `candidates` (`tenant_id`,`change_id`);--> statement-breakpoint
+CREATE INDEX `idx_candidates_tenant_status` ON `candidates` (`tenant_id`,`status`);

package/apps/storefront/migrations-apps/0005_common_mystique.sql

@@ -0,0 +1,23 @@
+CREATE TABLE `consent_cmp_demand` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`adapter_id` text NOT NULL,
+	`source` text,
+	`at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_consent_cmp_demand_tenant_adapter` ON `consent_cmp_demand` (`tenant_id`,`adapter_id`);--> statement-breakpoint
+CREATE INDEX `idx_consent_cmp_demand_adapter` ON `consent_cmp_demand` (`adapter_id`);--> statement-breakpoint
+CREATE TABLE `consent_config_revisions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`revision` integer NOT NULL,
+	`config` text NOT NULL,
+	`actor` text NOT NULL,
+	`note` text,
+	`reverted_from` integer,
+	`created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_consent_config_tenant_revision` ON `consent_config_revisions` (`tenant_id`,`revision`);--> statement-breakpoint
+CREATE INDEX `idx_consent_config_tenant` ON `consent_config_revisions` (`tenant_id`);

package/apps/storefront/migrations-apps/0006_broad_microchip.sql

@@ -0,0 +1,16 @@
+CREATE TABLE `correlation_replay` (
+	`jti` text PRIMARY KEY NOT NULL,
+	`expires_at` integer NOT NULL,
+	`consumed_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `order_attribution` (
+	`tenant_id` text NOT NULL,
+	`external_order_id` text NOT NULL,
+	`attributed` integer DEFAULT 0 NOT NULL,
+	`correlation_id` text,
+	`correlation_expires_at` text,
+	`reason` text,
+	`recorded_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `external_order_id`)
+);

package/apps/storefront/migrations-apps/0007_brave_outlaw_kid.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `app_version_snapshots` (
+	`id` text PRIMARY KEY NOT NULL,
+	`install_id` text NOT NULL,
+	`tenant_id` text NOT NULL,
+	`seq` integer NOT NULL,
+	`app_version` text NOT NULL,
+	`facets` text NOT NULL,
+	`actor` text NOT NULL,
+	`note` text,
+	`restored_from_seq` integer,
+	`created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_app_version_snapshots_install_seq` ON `app_version_snapshots` (`install_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `idx_app_version_snapshots_install` ON `app_version_snapshots` (`install_id`);

package/apps/storefront/migrations-apps/0008_blue_dazzler.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `candidate_submit_leases` (
+	`tenant_id` text NOT NULL,
+	`change_id` text NOT NULL,
+	`authorization_id` text NOT NULL,
+	`status` text DEFAULT 'active' NOT NULL,
+	`acquired_at` text NOT NULL,
+	`expires_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `change_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_candidate_submit_leases_expires` ON `candidate_submit_leases` (`expires_at`);

package/apps/storefront/migrations-apps/0009_bored_shinobi_shaw.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `integration_migration_drafts` (
+	`draft_id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`revision` integer NOT NULL,
+	`state` text DEFAULT 'open' NOT NULL,
+	`record` text NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_integration_migration_drafts_tenant` ON `integration_migration_drafts` (`tenant_id`,`created_at`);--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_kind` text;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_revision` integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_active_revision_id` text;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_candidate` text;

package/apps/storefront/migrations-apps/0010_ws4_verified_provider_measurement.sql

@@ -0,0 +1,35 @@
+-- WS4 durable, minimized server ledger/outbox. No raw provider payload,
+-- customer identity, browser correlation, credential, or destination data.
+CREATE TABLE `regulated_commerce_provider_events` (
+  `provider` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `fingerprint` text NOT NULL,
+  `receipt_id` text NOT NULL,
+  `received_at` text NOT NULL,
+  PRIMARY KEY(`provider`, `provider_event_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `regulated_commerce_provider_orders` (
+  `provider` text NOT NULL,
+  `provider_order_id` text NOT NULL,
+  `tenant_id` text NOT NULL,
+  `state` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `updated_at` text NOT NULL,
+  PRIMARY KEY(`provider`, `provider_order_id`, `tenant_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `regulated_commerce_intent_outbox` (
+  `intent_id` text PRIMARY KEY NOT NULL,
+  `tenant_id` text NOT NULL,
+  `provider` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `payload` text NOT NULL,
+  `created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_regulated_commerce_outbox_provider_event`
+  ON `regulated_commerce_intent_outbox` (`provider`, `provider_event_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_regulated_commerce_outbox_tenant_created`
+  ON `regulated_commerce_intent_outbox` (`tenant_id`, `created_at`);