@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/lib/apps/v84CleanCloneReplayContext.ts

@@ -0,0 +1,16 @@
+/** Shared fake/local state contract for one composed v84 clean-clone pass. */
+export const V84_REPLAY_SESSION_ID = "offline-v84-shared-clone-session" as const;
+export const V84_REPLAY_CLONE_TENANT = "tokenoftrust.com~clone~gtm-migration-v84" as const;
+
+export interface V84CleanCloneReplayContext {
+  readonly sessionId: typeof V84_REPLAY_SESSION_ID;
+  readonly cloneTenant: typeof V84_REPLAY_CLONE_TENANT;
+  read<T>(key: string): T | undefined;
+  write(key: string, value: unknown): void;
+  delete(key: string): void;
+  keys(prefix?: string): readonly string[];
+}
+
+export function sameV84ReplayValue(left: unknown, right: unknown): boolean {
+  return JSON.stringify(left) === JSON.stringify(right);
+}

package/apps/storefront/src/lib/apps/v84CloneLifecycleCacheEvidence.ts

@@ -0,0 +1,105 @@
+/** Clone-only cold/warm cache evidence over local managed-install state. */
+import { getCachedPage, pageCacheKey, putCachedPage } from "../edgeCache.js";
+import type { V84DisabledInstallMaterializationResult } from "./v84CloneLifecycleMaterialization.js";
+import {
+  V84_NATIVE_CLONE_TENANT,
+  V84_NATIVE_SOURCE_TENANT,
+} from "./v84CloneNativeInstallEvidence.js";
+import type { V84CleanCloneReplayContext } from "./v84CleanCloneReplayContext.js";
+
+const CACHE_BODY = "<!-- offline v84 lifecycle cache artifact; no integration markup -->";
+const INTEGRATION_MARKUP = /<script|dataLayer|googletagmanager|GTM-|\beval\s*\(/i;
+
+function fakeCache(replayContext?: V84CleanCloneReplayContext) {
+  const store = new Map<string, Response>();
+  const reads: string[] = [];
+  const writes: string[] = [];
+  const cache = {
+    async match(request: Request) {
+      reads.push(request.url);
+      if (replayContext) {
+        const found = replayContext.read<{
+          body: string;
+          headers: Record<string, string>;
+          status: number;
+        }>(`stage/lifecycle/cache/${encodeURIComponent(request.url)}`);
+        return found ? new Response(found.body, { headers: found.headers, status: found.status }) : undefined;
+      }
+      return store.get(request.url)?.clone();
+    },
+    async put(request: Request, response: Response) {
+      writes.push(request.url);
+      if (replayContext) {
+        replayContext.write(`stage/lifecycle/cache/${encodeURIComponent(request.url)}`, {
+          body: await response.clone().text(),
+          headers: Object.fromEntries(response.headers.entries()),
+          status: response.status,
+        });
+        return;
+      }
+      store.set(request.url, response.clone());
+    },
+  } as unknown as Cache;
+  return { cache, reads, writes };
+}
+
+/** Exercise a true cold miss and warm clone-only hit without touching source keys. */
+export async function buildV84CloneCacheEvidence(
+  materialization: V84DisabledInstallMaterializationResult,
+  replayContext?: V84CleanCloneReplayContext,
+) {
+  const memory = fakeCache(replayContext);
+  const disabledCacheKeyBefore = pageCacheKey(
+    V84_NATIVE_CLONE_TENANT,
+    "/v84-lifecycle",
+    "",
+    1,
+    materialization.candidatePlanBefore.planRevision,
+  );
+  const cloneCacheKey = pageCacheKey(
+    V84_NATIVE_CLONE_TENANT,
+    "/v84-lifecycle",
+    "",
+    1,
+    materialization.candidatePlanAfter.planRevision,
+  );
+  const sourceCacheKey = pageCacheKey(V84_NATIVE_SOURCE_TENANT, "/v84-lifecycle", "", 1);
+  const cold = await getCachedPage(memory.cache, cloneCacheKey);
+  await putCachedPage(memory.cache, cloneCacheKey, new Response(CACHE_BODY, {
+    status: 200,
+    headers: { "content-type": "text/html; charset=utf-8" },
+  }));
+  const warm = await getCachedPage(memory.cache, cloneCacheKey);
+  const warmBody = warm ? await warm.text() : "";
+  if (
+    cold !== null ||
+    !warm ||
+    warmBody !== CACHE_BODY ||
+    warm.headers.get("x-tot-cache") !== "hit" ||
+    disabledCacheKeyBefore.url !== cloneCacheKey.url ||
+    INTEGRATION_MARKUP.test(warmBody)
+  ) {
+    throw new Error("The clone-local warm-cache proof failed.");
+  }
+  if (memory.reads.includes(sourceCacheKey.url) || memory.writes.includes(sourceCacheKey.url)) {
+    throw new Error("The warm-cache proof touched the source namespace.");
+  }
+
+  return {
+    warmCache: {
+      tenant: V84_NATIVE_CLONE_TENANT,
+      coldMiss: true,
+      warmHit: true,
+      cloneWriteCount: memory.writes.length,
+      sourceReadCount: memory.reads.filter((url) => url === sourceCacheKey.url).length,
+      sourceWriteCount: memory.writes.filter((url) => url === sourceCacheKey.url).length,
+      managedInstallStateChanged: materialization.managedInstallStateChanged,
+      effectivePlanChanged:
+        materialization.candidatePlanBefore.planRevision !== materialization.candidatePlanAfter.planRevision,
+      disabledDraftsChangedCacheKey: disabledCacheKeyBefore.url !== cloneCacheKey.url,
+      artifactContainsIntegrationMarkup: INTEGRATION_MARKUP.test(warmBody),
+    },
+    cloneCacheReads: memory.reads.length,
+    cloneCacheWrites: memory.writes.length,
+  };
+}

package/apps/storefront/src/lib/apps/v84CloneLifecycleEvidence.ts

@@ -0,0 +1,177 @@
+/**
+ * Exact-clone, offline lifecycle validation composed from public product seams.
+ *
+ * It consumes the already-reviewed native-install evidence, then exercises only
+ * public-value environment, consent, semantic-event, lifecycle-bridge, and cache
+ * contracts. It has no renderer, integration loader, destination runtime, network,
+ * persistence, GTM, eval, or publish authority.
+ */
+import {
+  APPROVED_MARKETING_ACTION_NAMES,
+  planCacheIdentity,
+  sha256Hex,
+  snapshotManagedAnalyticsDeclarativeInput,
+  stableIntegrationStringify,
+} from "@tot/public-runtime";
+import { buildV84CloneCacheEvidence } from "./v84CloneLifecycleCacheEvidence.js";
+import {
+  validateV84DisabledInstallMaterialization,
+  type V84LifecycleMaterializationDependencies,
+} from "./v84CloneLifecycleMaterialization.js";
+import { buildV84CloneLifecycleSemantics } from "./v84CloneLifecycleSemantics.js";
+import {
+  V84_NATIVE_CLONE_TENANT,
+  V84_NATIVE_SOURCE_TENANT,
+  V84_WS1_API_CONTRACT,
+  V84_WS1_FINAL,
+  V84_WS2_EVIDENCE_SHA256,
+  V84_WS2_FINAL,
+  type V84NativeInstallEvidence,
+} from "./v84CloneNativeInstallEvidence.js";
+import {
+  sameV84ReplayValue,
+  type V84CleanCloneReplayContext,
+} from "./v84CleanCloneReplayContext.js";
+
+/** SHA-256 of the full canonical native-install evidence accepted by this unit. */
+export const V84_NATIVE_INSTALL_EVIDENCE_SHA256 = "d479a8b07cdde0808c75abea7410c7f1c685ed8d79f5e62f21a6261d1087eda8" as const;
+
+function assertNativeEvidence(evidence: V84NativeInstallEvidence): void {
+  if (
+    evidence.scope.sourceTenant !== V84_NATIVE_SOURCE_TENANT ||
+    evidence.scope.sourceMode !== "read-only" ||
+    evidence.scope.cloneTenant !== V84_NATIVE_CLONE_TENANT ||
+    evidence.scope.destinationMode !== "offline-in-memory-fake-only" ||
+    evidence.contractPins.ws1Final !== V84_WS1_FINAL ||
+    evidence.contractPins.ws1ApiContract !== V84_WS1_API_CONTRACT ||
+    evidence.contractPins.ws2Final !== V84_WS2_FINAL ||
+    evidence.contractPins.ws2EvidenceSha256 !== V84_WS2_EVIDENCE_SHA256 ||
+    evidence.installations.length !== 2 ||
+    evidence.installations.some((item) =>
+      item.desired.installStatus !== "disabled" ||
+      item.desired.revisionStatus !== "draft" ||
+      item.effective.activeRevisionId !== null ||
+      item.effective.materialized !== false
+    ) ||
+    stableIntegrationStringify(evidence.semanticActions) !==
+      stableIntegrationStringify(APPROVED_MARKETING_ACTION_NAMES) ||
+    evidence.operationCounts.reviseIntegrationInstall !== 0 ||
+    evidence.operationCounts.setIntegrationInstallStatus !== 0 ||
+    evidence.operationCounts.publish !== 0 ||
+    evidence.safety.sourceMutationCount !== 0 ||
+    evidence.safety.liveDestinationCount !== 0 ||
+    evidence.safety.externalNetworkRequestCount !== 0 ||
+    evidence.safety.importedCodeExecuted ||
+    evidence.safety.runtimeLoaded ||
+    evidence.safety.lifecycle !== "reviewed-disabled-draft-only"
+  ) {
+    throw new Error("The supplied native-install evidence is outside the exact disabled v84 proof.");
+  }
+}
+
+/** Build deterministic, sanitized evidence. Every delivery remains an in-memory callback. */
+export async function buildV84CloneLifecycleEvidence(
+  unsafeNativeEvidence: unknown,
+  materializationDependencies?: V84LifecycleMaterializationDependencies,
+  replayContext?: V84CleanCloneReplayContext,
+) {
+  const snapshot = snapshotManagedAnalyticsDeclarativeInput<V84NativeInstallEvidence>(unsafeNativeEvidence);
+  if (!snapshot.ok) throw new Error("The native-install evidence could not be snapshotted safely.");
+  const nativeEvidence = snapshot.value;
+  assertNativeEvidence(nativeEvidence);
+  if (replayContext && !sameV84ReplayValue(
+    replayContext.read<V84NativeInstallEvidence>("stage/native/handoff"),
+    nativeEvidence,
+  )) {
+    throw new Error("The lifecycle proof did not receive the shared native handoff.");
+  }
+  const nativeEvidenceSha256 = await sha256Hex(stableIntegrationStringify(nativeEvidence));
+  if (nativeEvidenceSha256 !== V84_NATIVE_INSTALL_EVIDENCE_SHA256) {
+    throw new Error("The supplied native-install evidence does not match the pinned exact proof.");
+  }
+
+  const semantics = buildV84CloneLifecycleSemantics();
+  const materialization = await validateV84DisabledInstallMaterialization(
+    nativeEvidence.installations,
+    semantics.candidateEnvironment,
+    semantics.stagedEnvironment,
+    materializationDependencies,
+    replayContext,
+  );
+  const candidatePlan = materialization.candidatePlanAfter;
+  const stagedPlan = materialization.stagedPlanAfter;
+  const cache = await buildV84CloneCacheEvidence(materialization, replayContext);
+
+  const evidence = {
+    schemaVersion: 1 as const,
+    scope: {
+      sourceTenant: V84_NATIVE_SOURCE_TENANT,
+      sourceMode: "read-only" as const,
+      cloneTenant: V84_NATIVE_CLONE_TENANT,
+      destinationMode: "offline-in-memory-callback-only" as const,
+      environments: ["candidate", "staged"] as const,
+    },
+    contractPins: {
+      ws1Final: V84_WS1_FINAL,
+      ws1ApiContract: V84_WS1_API_CONTRACT,
+      ws2Final: V84_WS2_FINAL,
+      ws2EvidenceSha256: V84_WS2_EVIDENCE_SHA256,
+      nativeInstallEvidenceSha256: nativeEvidenceSha256,
+    },
+    disabledDrafts: {
+      count: nativeEvidence.installations.length,
+      statuses: nativeEvidence.installations.map(({ desired }) => ({
+        install: desired.installStatus,
+        revision: desired.revisionStatus,
+      })),
+      activeRevisionCount: nativeEvidence.installations.filter(({ effective }) => effective.activeRevisionId !== null).length,
+      materializedCount: candidatePlan.integrations.length + stagedPlan.integrations.length,
+      materializedDeclarationCount: materialization.materializedDeclarationCount,
+      materializedAssetCount: materialization.materializedAssetCount,
+      readModelUnmaterializedCount: materialization.readModelUnmaterializedCount,
+      lifecycleRefusalCount: materialization.lifecycleRefusalCount,
+      lifecycleMutationCount: materialization.lifecycleMutationCount,
+    },
+    environment: {
+      candidate: semantics.candidateEnvironment,
+      staged: semantics.stagedEnvironment,
+      candidatePlanIdentity: planCacheIdentity(candidatePlan),
+      stagedPlanIdentity: planCacheIdentity(stagedPlan),
+      distinctPlanIdentities: planCacheIdentity(candidatePlan) !== planCacheIdentity(stagedPlan),
+      liveEnvironmentCount: 0,
+    },
+    consent: semantics.consent,
+    lifecycle: semantics.lifecycle,
+    routes: semantics.routes,
+    actions: semantics.actions,
+    warmCache: cache.warmCache,
+    operationCounts: {
+      sourceReads: 0,
+      sourceWrites: 0,
+      managedMaterializationReads: materialization.materializationReadCount,
+      managedReadModelAssemblies: materialization.readModelAssemblyCount,
+      managedLifecycleLoads: materialization.lifecycleLoadCount,
+      cloneCacheReads: cache.cloneCacheReads,
+      cloneCacheWrites: cache.cloneCacheWrites,
+      inMemoryEventDeliveries: semantics.inMemoryEventDeliveries,
+      externalNetworkRequests: 0,
+      lifecycleMutations: 0,
+      publishes: 0,
+    },
+    safety: {
+      importedCodeExecuted: false,
+      rendererCalled: false,
+      integrationLifecycleRuntimeInitialized: false,
+      nativeDestinationRuntimeInvoked: false,
+      gtmLoaded: false,
+      markupEvaluated: false,
+      externalNetworkUsed: false,
+      liveSecretUsed: false,
+      productionUsed: false,
+      sourceMutated: false,
+      diagnosticsCarryDestinationValues: false,
+    },
+  };
+  replayContext?.write("stage/lifecycle/handoff", evidence);
+  return evidence;
+}

package/apps/storefront/src/lib/apps/v84CloneLifecycleMaterialization.ts

@@ -0,0 +1,251 @@
+/**
+ * Fake/local adapter that proves disabled managed-install rows remain absent from
+ * the real declaration, admin read-model, and lifecycle seams.
+ */
+import {
+  resolveEffectivePlan,
+  stableIntegrationStringify,
+  type BrowserEnvironment,
+  type EffectivePlan,
+  type IntegrationDeclarationInput,
+} from "@tot/public-runtime";
+import type { Queryable } from "../d1/catalog.js";
+import { loadActiveManagedInstallDeclarations } from "../integration/managedInstallDeclarations.js";
+import { assembleIntegrationReadModel } from "./integrationReadModel.js";
+import { handleLifecycleRequest } from "./integrationLifecycleController.js";
+import {
+  V84_NATIVE_CLONE_TENANT,
+  type V84NativeInstallEvidence,
+} from "./v84CloneNativeInstallEvidence.js";
+import type { V84CleanCloneReplayContext } from "./v84CleanCloneReplayContext.js";
+
+type NativeInstall = V84NativeInstallEvidence["installations"][number];
+
+interface LocalManagedRow {
+  readonly install_id: string;
+  readonly tenant_id: string;
+  readonly managed_kind: "managed-analytics-v1";
+  readonly status: "suspended";
+  readonly app_id: string;
+  readonly app_version: string;
+  readonly manifest: "{}";
+  readonly revision_status: "draft";
+}
+
+export interface V84LifecycleMaterializationDependencies {
+  readonly loadDeclarations: typeof loadActiveManagedInstallDeclarations;
+}
+
+const dependencies: V84LifecycleMaterializationDependencies = {
+  loadDeclarations: loadActiveManagedInstallDeclarations,
+};
+
+function resolvePlan(
+  environment: BrowserEnvironment,
+  declarations: readonly IntegrationDeclarationInput[],
+): EffectivePlan {
+  const result = resolveEffectivePlan({
+    tenantPublicId: V84_NATIVE_CLONE_TENANT,
+    environment,
+    declarations,
+  });
+  if (!result.ok) throw new Error("The local managed-install plan failed safely.");
+  return result.value;
+}
+
+function localRows(installations: readonly NativeInstall[]): LocalManagedRow[] {
+  return installations.map((install, index) => ({
+    install_id: `v84-local-managed-${index + 1}`,
+    tenant_id: V84_NATIVE_CLONE_TENANT,
+    managed_kind: "managed-analytics-v1",
+    status: "suspended",
+    app_id: install.adapterId,
+    app_version: install.adapterVersion,
+    manifest: "{}",
+    revision_status: install.desired.revisionStatus,
+  }));
+}
+
+/** Minimal local Queryable that executes the materializer's active-row predicate. */
+function localManagedInstallDb(rows: readonly LocalManagedRow[]): Queryable {
+  const unexpected = async (): Promise<never> => {
+    throw new Error("The disabled managed-install proof reached an unexpected persistence operation.");
+  };
+  return {
+    all: async <T>(sql: string, ...params: unknown[]) => {
+      const normalized = sql.replace(/\s+/g, " ").trim();
+      if (
+        !normalized.includes("FROM app_installs") ||
+        !normalized.includes("tenant_id = ?") ||
+        !normalized.includes("managed_kind = ?") ||
+        !normalized.includes("status = 'active'") ||
+        params.length !== 2
+      ) {
+        throw new Error("The managed-install materializer widened its active-row boundary.");
+      }
+      const [tenantId, managedKind] = params;
+      return rows
+        .filter((row) =>
+          row.tenant_id === tenantId &&
+          row.managed_kind === managedKind &&
+          row.status === ("active" as string)
+        )
+        .map(({ install_id, app_id, app_version, manifest }) => ({
+          install_id,
+          app_id,
+          app_version,
+          manifest,
+        })) as T[];
+    },
+    first: unexpected,
+    run: unexpected,
+    exec: unexpected,
+  };
+}
+
+export interface V84DisabledInstallMaterializationResult {
+  readonly candidatePlanBefore: EffectivePlan;
+  readonly candidatePlanAfter: EffectivePlan;
+  readonly stagedPlanAfter: EffectivePlan;
+  readonly managedInstallStateChanged: true;
+  readonly readModelUnmaterializedCount: 2;
+  readonly lifecycleRefusalCount: 2;
+  readonly materializedDeclarationCount: 0;
+  readonly materializedAssetCount: 0;
+  readonly materializationReadCount: 2;
+  readonly readModelAssemblyCount: 1;
+  readonly lifecycleLoadCount: 2;
+  readonly lifecycleMutationCount: 0;
+}
+
+/**
+ * Exercise the actual managed-install declaration loader, admin read model, and
+ * lifecycle controller over local rows derived from the canonical install output.
+ */
+export async function validateV84DisabledInstallMaterialization(
+  installations: readonly NativeInstall[],
+  candidateEnvironment: BrowserEnvironment,
+  stagedEnvironment: BrowserEnvironment,
+  deps: V84LifecycleMaterializationDependencies = dependencies,
+  replayContext?: V84CleanCloneReplayContext,
+): Promise<V84DisabledInstallMaterializationResult> {
+  const localBeforeRows: readonly LocalManagedRow[] = [];
+  const localAfterRows = localRows(installations);
+  if (replayContext) {
+    replayContext.write("stage/lifecycle/materialization/before", localBeforeRows);
+    replayContext.write("stage/lifecycle/materialization/after", localAfterRows);
+  }
+  const beforeRows = replayContext
+    ? replayContext.read<readonly LocalManagedRow[]>("stage/lifecycle/materialization/before") ?? []
+    : localBeforeRows;
+  const afterRows = replayContext
+    ? replayContext.read<readonly LocalManagedRow[]>("stage/lifecycle/materialization/after") ?? []
+    : localAfterRows;
+  if (
+    afterRows.length !== 2 ||
+    afterRows.some((row) => row.status !== "suspended" || row.revision_status !== "draft") ||
+    stableIntegrationStringify(beforeRows) === stableIntegrationStringify(afterRows)
+  ) {
+    throw new Error("The local disabled managed-install state was not exact.");
+  }
+
+  let materializationReadCount = 0;
+  const loadDeclarations = async (db: Queryable) => {
+    materializationReadCount += 1;
+    return deps.loadDeclarations(db, V84_NATIVE_CLONE_TENANT);
+  };
+  const beforeDeclarations = await loadDeclarations(
+    localManagedInstallDb(beforeRows),
+  );
+  const afterDeclarations = await loadDeclarations(
+    localManagedInstallDb(afterRows),
+  );
+  if (beforeDeclarations.length !== 0 || afterDeclarations.length !== 0) {
+    throw new Error("A disabled draft was treated as a materializable managed install.");
+  }
+
+  const candidatePlanBefore = resolvePlan(candidateEnvironment, beforeDeclarations);
+  const candidatePlanAfter = resolvePlan(candidateEnvironment, afterDeclarations);
+  const stagedPlanAfter = resolvePlan(stagedEnvironment, afterDeclarations);
+  let readModelAssemblyCount = 0;
+  readModelAssemblyCount += 1;
+  const readModel = assembleIntegrationReadModel({
+    tenantPublicId: V84_NATIVE_CLONE_TENANT,
+    stage: "candidate",
+    items: afterRows.map((row) => ({
+      install: {
+        installId: row.install_id,
+        appId: row.app_id,
+        appVersion: row.app_version,
+        tenantId: row.tenant_id,
+        status: row.status,
+      },
+      purpose: "Reviewed managed analytics destination.",
+      desiredConfig: { destinationConfigured: true },
+      declaredTier: "platform-adapter",
+      effectivePlan: null,
+      effectiveCsp: null,
+      consentSnapshot: null,
+      candidate: null,
+      knownGood: null,
+    })),
+  });
+  if (
+    !readModel.ok ||
+    readModel.value.items.length !== 2 ||
+    readModel.value.items.some((item) => item.effective !== null || !item.drift.unmaterialized)
+  ) {
+    throw new Error("The disabled managed-install read model materialized an effective state.");
+  }
+
+  let lifecycleMutationCount = 0;
+  let lifecycleRefusalCount = 0;
+  let lifecycleLoadCount = 0;
+  for (const row of afterRows) {
+    const response = await handleLifecycleRequest({
+      load: async () => { lifecycleLoadCount += 1; return null; },
+      save: async () => { lifecycleMutationCount += 1; },
+      resolveCandidateEvidence: async () => {
+        throw new Error("An unmaterialized disabled install must not resolve candidate evidence.");
+      },
+      resolveGate: async () => {
+        throw new Error("An unmaterialized disabled install must not resolve a publish gate.");
+      },
+    }, {
+      action: "preview",
+      installId: row.install_id,
+      actor: "v84-local-reviewer",
+    });
+    if (response.status !== 409 || JSON.stringify(response.body) !== JSON.stringify({
+      error: "integration is not materialized",
+      code: "not_materialized",
+    })) {
+      throw new Error("The disabled managed-install lifecycle did not fail closed.");
+    }
+    lifecycleRefusalCount += 1;
+  }
+  if (
+    materializationReadCount !== 2 ||
+    readModelAssemblyCount !== 1 ||
+    lifecycleLoadCount !== 2 ||
+    lifecycleMutationCount !== 0 ||
+    lifecycleRefusalCount !== 2
+  ) {
+    throw new Error("The disabled managed-install lifecycle changed local state.");
+  }
+
+  return {
+    candidatePlanBefore,
+    candidatePlanAfter,
+    stagedPlanAfter,
+    managedInstallStateChanged: true,
+    readModelUnmaterializedCount: 2,
+    lifecycleRefusalCount: 2,
+    materializedDeclarationCount: afterDeclarations.length as 0,
+    materializedAssetCount: afterDeclarations.flatMap((item) => item.materializedAssets).length as 0,
+    materializationReadCount: materializationReadCount as 2,
+    readModelAssemblyCount: readModelAssemblyCount as 1,
+    lifecycleLoadCount: lifecycleLoadCount as 2,
+    lifecycleMutationCount,
+  };
+}