@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/scripts/dev/publish.mjs

@@ -20,15 +20,11 @@
  * Auth: the developer's own cached OAuth session (`tot login`,
  * `~/.tot/credentials.json`), via `packages/cli/src/auth.mjs`'s
  * `resolveDeveloperSession` — reads, silently refreshes, and attaches the
- * Bearer exactly as `tot submit` does. NOT the storefront-operator
- * TOT_API_KEY/TOT_SECRET_KEY path this module used before 2026-07-26:
- * tot-mcp went OAuth-first on 2026-07-23 ("Require OAuth before remote MCP
- * initialize"), which retired the old no-browser operator/credential_validate
- * trust path entirely — every caller, including this one, now needs a real
- * OAuth bearer just to complete `initialize`. There is no service-account /
- * client-credentials grant on this MCP (confirmed against its OAuth
- * authorization-server metadata), so a human `tot login` (one-time; refresh
- * is silent afterward, ~30-day refresh tokens) is the only way in.
+ * Bearer exactly as `tot submit` does. Every caller needs a real OAuth bearer
+ * just to complete `initialize`; there is no service-account / client-credentials
+ * grant on this MCP (confirmed against its OAuth authorization-server metadata),
+ * so a human `tot login` (one-time; refresh is silent afterward, ~30-day refresh
+ * tokens) is the only way in.
  */
 import { createHash } from "node:crypto";
 import { readFile } from "./file-browser.mjs";

package/scripts/dev/safe-path.mjs

@@ -90,8 +90,8 @@ export function isSafePath(root, relPath) {
 }
 
 /**
- * Strict WRITE allowlist for C5's `POST /__tot/write` — only the raw-HTML
- * content surface is writable. Read/tree endpoints (C3) do NOT use this; they
+ * Strict WRITE allowlist for the `POST /__tot/write` endpoint — only the raw-HTML
+ * content surface is writable. Read/tree endpoints do NOT use this; they
  * rely on `resolveSafePath` containment alone so the tree can show everything.
  * Kept here so the write path reuses the one guard rather than reinventing it.
  */

package/scripts/dev/shot.mjs

@@ -20,7 +20,7 @@ const CHROME_PATHS = [
   "/usr/bin/chromium-browser",
   "/usr/bin/chromium",
 ].filter(Boolean);
-const executablePath = CHROME_PATHS.find((p) => existsSync(p));
+const executablePath = CHROME_PATHS.find((p) => !!p && existsSync(p));
 
 const args = process.argv.slice(2);
 const url = args[0];

package/scripts/dev/tenant-source-root.mjs

@@ -4,7 +4,7 @@
  *
  * CRITICAL (standalone write-through): in `--workspace` mode `tot dev` COPIES the
  * developer's checkout into an in-tree graft and re-syncs on save. The file tree,
- * viewer, diff and (C5) writer must operate on the developer's REAL CHECKOUT —
+ * viewer, diff and writer must operate on the developer's REAL CHECKOUT —
  * NOT the in-tree graft — or edits made in the browser are silently discarded on
  * the next resync. `tot dev` therefore sets TOT_DEV_SOURCE_ROOT to the checkout
  * in standalone mode and to `tenants/<id>/` in monorepo mode; this module is the

package/scripts/dev/unified-diff.mjs

@@ -1,8 +1,8 @@
 /**
  * Minimal unified-diff applier for the inline-AI edit loop (WS5 G1).
  *
- * The MCP `content_edit` tool returns a per-file unified diff (`--- a/<path>` /
- * `+++ b/<path>` header, `@@ -l,c +l,c @@` hunks) rather than a full-file
+ * The MCP `content_edit` tool returns a per-file unified diff (a `---`/`+++`
+ * file header, then hunk headers of the form "-l,c +l,c") rather than a full-file
  * rewrite — this is what turns that diff back into the file's new content, so
  * `tot dev` can apply it, hot-reload, and undo it cleanly. Dependency-free
  * (matches the rest of the tenant tooling — see packages/cli/src/mcp.mjs).
@@ -12,10 +12,15 @@
  * that's exactly the shape content_edit's system prompt asks the model for.
  */
 
-/** One `@@ -l,c +l,c @@` hunk: the old/new starting line + its body lines. */
+/**
+ * One hunk (its "-l,c +l,c" header): the old/new starting line + its body lines.
+ * @typedef {{ oldStart: number, body: string[] }} Hunk
+ */
 function parseHunks(diff) {
   const lines = diff.split(/\r?\n/);
+  /** @type {Hunk[]} */
   const hunks = [];
+  /** @type {Hunk | null} */
   let current = null;
   const hunkHeader = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 

package/scripts/tot-dev.mjs

@@ -31,7 +31,7 @@
  *      Vite trusts) and run a recursive `fs.watch` on the checkout that re-syncs each
  *      changed file back into the in-tree copy on save — which is what fires Vite HMR.
  *
- * Two things learned the hard way (see the two-liners below):
+ * Two things to know (see the two-liners below):
  *   - Tenant is selected by the URL path-prefix (`/<appDomain>/`), NOT by
  *     DEFAULT_TENANT_ID — the @astrojs/cloudflare dev runtime (workerd) reads env
  *     from .dev.vars/bindings, so a spawned process.env var never reaches it, and
@@ -76,9 +76,8 @@ const flag = (name, def) => {
 
 // `--version` / `-v` / `version` → print the runner's PUBLISHED version and exit.
 // Reads the emitted root package.json (build-runner.mjs stamps RUNNER_VERSION in
-// PUBLISH mode). This is the version the 2026-07-14 cache-staleness bug hid — the
-// runner kept being served from a stale public-0.1.0 dir with no way to see it —
-// so making it directly checkable (npm bin `storefront-runner`) is part of the fix.
+// PUBLISH mode), so the runner's version is directly checkable (npm bin
+// `storefront-runner`).
 if (argv[0] === "--version" || argv[0] === "-v" || argv[0] === "version") {
   let v = "0.0.0";
   try {
@@ -165,7 +164,7 @@ if (!domain) {
 // Records let us undo everything on exit (leave the tree exactly as found).
 /** @type {{ target: string, backup: string|null }[]} */
 const grafts = [];
-/** @type {import("node:fs").FSWatcher[]} */
+/** @type {Array<{ close: () => void }>} */
 const watchers = [];
 let cleanedUp = false;
 
@@ -295,8 +294,7 @@ if (workspacePath) {
 
 // Resolve the port BEFORE printing a URL or booting astro. Vite's `strictPort`
 // defaults off, so a taken port makes astro SILENTLY drift to the next free one —
-// which then mismatches the URL we (and the CLI's liveness poll) advertise, and a
-// stale server on the original port produced a false "You're live" (2026-07-14).
+// which then mismatches the URL we (and the CLI's liveness poll) advertise.
 // Instead we pick the first free port ourselves and PRINT it, so a busy default
 // port "just works" (better UX than failing). See port-check.mjs.
 const requestedPort = Number(flag("port", "4321"));
@@ -344,11 +342,11 @@ console.log(`  Private local preview — nothing is published. Server binds all
 // tells Astro "you are already the managed child → run foreground" (see astro's
 // cli/dev/{index,background}.js), so our SIGINT/exit lifecycle and symlink cleanup
 // stay correct. Monorepo mode is left untouched (current behavior).
-// TOT_DEV_TENANT tells the inline-AI edit loop (WS5 G1 — astro.config.mjs's
+// TOT_DEV_TENANT tells the inline-AI edit loop (astro.config.mjs's
 // inlineAiEditPlugin, scripts/dev/ai-edit.mjs) which tenant's content/theme to
 // read+write: one `tot dev <tenant>` run always serves exactly one tenant, so
 // there's no per-request domain lookup to do.
-// TOT_DEV_SOURCE_ROOT tells the /dev file tools (C3 tree/viewer, C4 diff, C5
+// TOT_DEV_SOURCE_ROOT tells the /dev file tools (tree/viewer, diff,
 // writer — scripts/dev/tenant-source-root.mjs) WHERE the developer's editable
 // source lives. STANDALONE: the developer's REAL checkout (wsRoot) — the tools
 // MUST read+write it, NOT the in-tree graft, or browser edits are silently lost
@@ -362,8 +360,7 @@ const spawnEnv = workspacePath
 // require pnpm at RUNTIME), so resolve astro's real entry through Node's own
 // resolver from the app package and exec it with our Node. No package-manager
 // binary, no .bin shims, and no coupling to the package's name (the build
-// renames @tot/storefront → @tot/storefront-runner in the shipped tree, which
-// the old `pnpm --filter <name> exec` had to track).
+// renames @tot/storefront → @tot/storefront-runner in the shipped tree).
 const appDir = resolve(repoRoot, "apps/storefront");
 const astroEntry = resolve(
   dirname(createRequire(join(appDir, "package.json")).resolve("astro/package.json")),

package/apps/storefront/src/lib/dev/vcBinding.ts

@@ -1,80 +0,0 @@
-/**
- * Cockpit safety-net for the 08-18 vc-app-binding gap (§5): ensure the signed-in
- * developer is bound to storefront's version-control app so their `tot start`
- * checkout (`tenant_checkout`) and the repo tools stop 403-ing "No version-control
- * app is bound to your session."
- *
- * WHY a net at all: the ROOT fix binds every entitled human at the authority seams
- * the MCP owns — grant issuance, rendezvous `/approve`, native OAuth token issuance
- * — plus a one-shot backfill. Those cover the terminal path. This net covers the
- * BROWSER-FIRST developer who reached /cockpit via the storefront's own tot20
- * sign-in (a `tot_session` cookie) WITHOUT ever crossing an MCP binding seam, so
- * they'd otherwise land at cockpit with a `tot start` command that 403s.
- *
- * HOW (mirrors cli-signin-approve): there is NO per-human MCP session server-side —
- * the cockpit reaches the MCP only as the APP (private_key_jwt). So we re-issue a
- * FRESH tot20-signed id_token for the VERIFIED session email (via the storefront's
- * core credential — {@link reissueSubjectToken}, the same proof `/approve` sends)
- * and pass it as the `subject_token` the MCP binds the enrollment to. The app can't
- * assert an arbitrary subject; the MCP verifies the proof + the subject's LIVE
- * entitlement and authors the binding under its own forge authority (ADR-0001).
- *
- * ALWAYS FAIL-OPEN: any gap (proof re-issue failed, MCP cold/unreachable, the
- * endpoint not yet deployed) returns a typed `{ ok:false }` and NEVER throws — the
- * cockpit must render regardless, and the authority-seam binding + backfill are the
- * real guarantees. This is strictly a best-effort accelerator.
- */
-import { createForgeClient } from "@/lib/forge";
-import { reissueSubjectToken } from "@/lib/dev/subjectReissue";
-
-export type EnsureCockpitBindingResult =
-  | { ok: true; bound: boolean; created: boolean }
-  | { ok: false; reason: string };
-
-export interface EnsureCockpitBindingDeps {
-  /** Override the subject-proof minter (tests). */
-  reissue?: typeof reissueSubjectToken;
-  /** Override the forge-client factory (tests) — returns something with ensureVcAppBinding. */
-  makeForgeClient?: () => Promise<{
-    ensureVcAppBinding(opts: {
-      subjectToken?: string;
-    }): Promise<{ bound: boolean; created: boolean }>;
-  }>;
-}
-
-/**
- * Ensure the developer identified by their VERIFIED session `email` is bound to the
- * storefront VC app. Best-effort + fail-closed-to-typed-error: never throws.
- */
-export async function ensureCockpitVcBinding(
-  email: string,
-  deps: EnsureCockpitBindingDeps = {},
-): Promise<EnsureCockpitBindingResult> {
-  if (!email) return { ok: false, reason: "missing-identity" };
-
-  const reissue = deps.reissue ?? reissueSubjectToken;
-  let subjectToken: string;
-  try {
-    const proof = await reissue(email);
-    if (!proof.ok) return { ok: false, reason: `reissue-${proof.reason}` };
-    subjectToken = proof.idToken;
-  } catch {
-    // A re-issue fault must not surface as a cockpit 500.
-    return { ok: false, reason: "reissue-threw" };
-  }
-
-  try {
-    const client = deps.makeForgeClient
-      ? await deps.makeForgeClient()
-      : await createForgeClient();
-    const res = await client.ensureVcAppBinding({ subjectToken });
-    return { ok: true, bound: res.bound, created: res.created };
-  } catch (cause) {
-    // Fail-open: the ensure endpoint may not be deployed yet, or the MCP may be
-    // cold/unreachable. The proof itself is never logged; the reason is a terse code.
-    return {
-      ok: false,
-      reason: "mcp-" + (cause instanceof Error ? cause.name : "error"),
-    };
-  }
-}