@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/apps/storefront/astro.config.mjs

@@ -90,9 +90,9 @@ export default defineConfig({
     imageService: "compile",
   }),
   integrations: [
-    // Refuse to build unless every Gitea-classified tenant is materialized from
-    // Gitea at a pinned ref — intrinsic to `astro build`, not just deploy.sh, so
-    // no build path can silently bake empty/stale real-tenant content.
+    // A framework Worker build requires no real-tenant checkout: tenant content
+    // resolves from KV/R2 at request time. The same integration becomes strict
+    // only when TOT_BUILD_TENANTS names a per-tenant static publish input.
     materializeGuard(),
     preact({ compat: true }),
     // Astro's file-based router ignores ANY path segment starting with "_" (see

package/apps/storefront/env.d.ts

@@ -7,6 +7,9 @@ import type {
   TenantFeatures,
   ResolvedManagedCheckout,
   CapabilityConfig,
+  BrowserEnvironment,
+  CompiledIntegrationCsp,
+  EffectivePlan,
 } from "@tot/public-runtime";
 import type { ToTClient } from "@/lib/tot/ToTClient";
 import type { ContentProvider } from "@/lib/storyblok/provider";
@@ -29,6 +32,12 @@ interface KVNamespaceLike {
 interface R2BucketLike {
   get(key: string): Promise<unknown>;
   put(key: string, value: unknown): Promise<unknown>;
+  list(opts?: { prefix?: string; cursor?: string; limit?: number }): Promise<{
+    objects: { key: string }[];
+    truncated: boolean;
+    cursor?: string;
+  }>;
+  delete(keys: string | string[]): Promise<void>;
 }
 
 interface CloudflareEnv {
@@ -49,7 +58,7 @@ interface CloudflareEnv {
   TOT_SECRET_KEY?: string;
   TOT_ACCESS_TOKEN?: string;
   PUBLIC_CF_ANALYTICS_TOKEN?: string;
-  /** HMAC secret for signing/verifying customization preview tokens (D4). */
+  /** HMAC secret for signing/verifying customization preview tokens. */
   CUSTOMIZATION_PREVIEW_SECRET?: string;
   /**
    * Managed checkout (Track A). `FOXY_STORE_SUBDOMAIN` overrides the tenant's default
@@ -64,7 +73,7 @@ interface CloudflareEnv {
   FOXY_STORE_DOMAIN?: string;
   FOXY_CART_SECRET?: string;
   /**
-   * Order READ API bearer (U2) — the tenant's ToT `partnerApi.apiKey`, sent as
+   * Order READ API bearer — the tenant's ToT `partnerApi.apiKey`, sent as
    * `Authorization: Bearer` to the checkout order API. Server-side only (never
    * shipped to the browser). Absent -> the Orders route reports `not_provisioned`.
    */
@@ -120,17 +129,34 @@ declare global {
        */
       basePath: string;
       /**
-       * Which customization environment to serve (D4). "live" on production
+       * Which customization environment to serve. "live" on production
        * hosts; "test" only behind a valid, tenant-bound preview token on a
        * preview host. Downstream theme/content selection reads this.
        */
       customizationEnv: CustomizationEnv;
       /**
-       * Per-request CSP nonce (D2). Placed on the platform's own inline
+       * Per-request CSP nonce. Placed on the platform's own inline
        * <style>/<script is:inline> tags so a strict CSP can allow them without
        * `unsafe-inline`.
        */
       cspNonce: string;
+      /**
+       * The renderer-owned four-stage browser environment
+       * (`local|candidate|staged|live`) for this request, computed once by the
+       * middleware from authoritative server state. Both document mounts
+       * (Layout.astro and `rawHtmlResponse`) serialize THIS object, before any
+       * tenant/app code, so it is identical in both. Carries only public values —
+       * never a token, binding, or signed URL.
+       */
+      browserEnvironment: BrowserEnvironment;
+      /**
+       * The resolved effective plan (ext-kernel-03) for this request. The
+       * fixed-phase render engine (ext-kernel-04) consumes THIS in both document
+       * mounts (Layout.astro + rawHtmlResponse), so their renderer-owned phase
+       * markup is identical. Environment-only until declaration materialization is
+       * wired; carries no secret and no nonce.
+       */
+      integrationPlan: EffectivePlan;
       /**
        * Resolved cart/checkout facts for this request (loader src, cart URL,
        * mode). Present only for commerce tenants with a checkout store;
@@ -161,7 +187,7 @@ declare global {
       runtime?: { env: CloudflareEnv };
       /**
        * Every private-app widget placement actually rendered for this request
-       * (PrivateApps epic, D5). The middleware seeds this to `[]` before
+       * (PrivateApps epic). The middleware seeds this to `[]` before
        * `next()`; each page/layout that renders a widget slot (`renderSlot.ts`)
        * pushes its resolved placements onto it as the page renders, so the
        * middleware can read the full per-request set back out AFTER `next()`
@@ -169,6 +195,29 @@ declare global {
        * the origins that ended up on the page — never more.
        */
       activeWidgetPlacements?: { endpoint: string }[];
+      /**
+       * Third-party embed opt-in (EMBED_PROVIDERS catalog slugs) for THIS
+       * request, when it must come from a tenant the URL router can't resolve —
+       * specifically the candidate renderer (`/preview/render/<tenant>/…`, where
+       * `<tenant>` isn't the first path segment). `candidateRender` sets it to the
+       * resolved candidate tenant's opt-in; the middleware's embed scan prefers it
+       * over the router-resolved tenant's embeds when present. Unset on normal
+       * renders (the router-resolved tenant's embeds are authoritative there).
+       */
+      embedOptIn?: string[];
+      /**
+       * The version-scoped integration CSP contribution for THIS request, resolved
+       * from the tenant/environment/version effective plan (curated adapter
+       * profiles expanded + advanced exact origins merged, deterministic and bound
+       * to the plan's `planRevision`). It is plan-scoped server state — resolved
+       * before the edge-cache read so its `planRevision` folds into `pageCacheKey`
+       * (making a rollback/uninstall a clean warm miss, not a TTL wait) and its
+       * `additions` fold into the strict CSP the middleware builds after `next()`,
+       * only ever APPENDING reviewed origins to the six contributable directives.
+       * Absent when no integration declares CSP — the header and cache key are then
+       * byte-identical to a non-integration tenant's (zero cost when disabled).
+       */
+      integrationCsp?: CompiledIntegrationCsp;
     }
   }
 }

package/apps/storefront/integrations/materialize-guard.mjs

@@ -4,23 +4,20 @@ import {
 } from "../../../scripts/tenant/materialize-tenant-content.mjs";
 
 /**
- * Refuse `astro build` when any Gitea-classified tenant's content isn't
- * materialized from Gitea at a pinned ref. Runs in `astro:build:start`, so the
- * guard is INTRINSIC to the build — it fires for a bare `astro build`, `pnpm
- * build`, or a deploy.sh build alike, never letting an unmaterialized real
- * tenant bake empty content into the Worker.
+ * Protect the two intentionally different build modes:
+ *
+ *   - Framework Worker (no TOT_BUILD_TENANTS): tenant content is runtime data,
+ *     so absent Gitea checkouts are expected and must never block deployment.
+ *   - Per-tenant static publish (TOT_BUILD_TENANTS set): the named checkout is
+ *     build input and therefore must be materialized at a pinned ref.
  *
  * TOT_TENANT_REF   also assert every stamp is EXACTLY this commit (off-ref → refuse)
  * TOT_ALLOW_UNPINNED=1  tolerate a default-branch (unpinned) materialize
- * TOT_FRAMEWORK_ONLY_BUILD=1  tolerate ABSENT tenant content (a credential-less
- *   compile check bakes nothing, so there is nothing stale to guard). Populated
- *   content without a pinned Gitea stamp still refuses — this never weakens the
- *   deploy path, which materializes first and never sets this.
+ * TOT_FRAMEWORK_ONLY_BUILD=1  retained as a backwards-compatible explicit name
+ *   for framework mode; it is now the default whenever TOT_BUILD_TENANTS is unset.
  * TOT_BUILD_TENANTS  comma-separated tenant ids to scope the guard to. A per-tenant
  *   STATIC publish (materialize-tenant.mjs) sets this to the single tenant it renders,
- *   so a SIBLING Gitea tenant that isn't part of THIS publish can't block it. Unset ⇒
- *   guard every Gitea tenant — the Worker-deploy contract, where all tenants are
- *   served from one Worker at once and any unmaterialized tenant IS a real hazard.
+ *   so a sibling tenant can never block it. Unset ⇒ framework-only Worker build.
  */
 export function materializeGuard() {
   return {
@@ -35,12 +32,13 @@ export function materializeGuard() {
           .map((t) => t.trim())
           .filter(Boolean);
         const onlyTenants = scoped.length > 0 ? scoped : null;
-        if (process.env.TOT_FRAMEWORK_ONLY_BUILD === "1") {
+        const frameworkOnly = onlyTenants === null || process.env.TOT_FRAMEWORK_ONLY_BUILD === "1";
+        if (frameworkOnly) {
           const { problems } = checkPinned(undefined, { expectRef, allowUnpinned, onlyTenants });
           const absent = problems.filter((p) => p.reason === "absent");
           const real = problems.filter((p) => p.reason !== "absent");
           if (absent.length) {
-            const msg = `[materialize-guard] framework-only build: ${absent.length} tenant(s) absent (nothing baked): ${absent.map((p) => p.tenant).join(", ")}`;
+            const msg = `[materialize-guard] framework-only build: ${absent.length} tenant checkout(s) absent (served from runtime storage): ${absent.map((p) => p.tenant).join(", ")}`;
             if (logger && typeof logger.info === "function") logger.info(msg);
             else console.log(msg);
           }

package/apps/storefront/migrations-apps/0004_deep_morph.sql

@@ -0,0 +1,36 @@
+CREATE TABLE `candidate_attempts` (
+	`id` text PRIMARY KEY NOT NULL,
+	`candidate_id` text NOT NULL,
+	`tenant_id` text NOT NULL,
+	`attempt_number` integer NOT NULL,
+	`kind` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`head_sha` text,
+	`detail` text,
+	`evidence` text,
+	`started_at` text NOT NULL,
+	`finished_at` text
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidate_attempts_candidate_number` ON `candidate_attempts` (`candidate_id`,`attempt_number`);--> statement-breakpoint
+CREATE INDEX `idx_candidate_attempts_candidate` ON `candidate_attempts` (`candidate_id`);--> statement-breakpoint
+CREATE INDEX `idx_candidate_attempts_tenant` ON `candidate_attempts` (`tenant_id`);--> statement-breakpoint
+CREATE TABLE `candidates` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`repository` text NOT NULL,
+	`pr_number` integer NOT NULL,
+	`change_id` text NOT NULL,
+	`branch` text,
+	`title` text,
+	`author` text,
+	`status` text DEFAULT 'open' NOT NULL,
+	`head_sha` text,
+	`base_sha` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidates_tenant_repo_pr` ON `candidates` (`tenant_id`,`repository`,`pr_number`);--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_candidates_tenant_change` ON `candidates` (`tenant_id`,`change_id`);--> statement-breakpoint
+CREATE INDEX `idx_candidates_tenant_status` ON `candidates` (`tenant_id`,`status`);

package/apps/storefront/migrations-apps/0005_common_mystique.sql

@@ -0,0 +1,23 @@
+CREATE TABLE `consent_cmp_demand` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`adapter_id` text NOT NULL,
+	`source` text,
+	`at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_consent_cmp_demand_tenant_adapter` ON `consent_cmp_demand` (`tenant_id`,`adapter_id`);--> statement-breakpoint
+CREATE INDEX `idx_consent_cmp_demand_adapter` ON `consent_cmp_demand` (`adapter_id`);--> statement-breakpoint
+CREATE TABLE `consent_config_revisions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`revision` integer NOT NULL,
+	`config` text NOT NULL,
+	`actor` text NOT NULL,
+	`note` text,
+	`reverted_from` integer,
+	`created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_consent_config_tenant_revision` ON `consent_config_revisions` (`tenant_id`,`revision`);--> statement-breakpoint
+CREATE INDEX `idx_consent_config_tenant` ON `consent_config_revisions` (`tenant_id`);

package/apps/storefront/migrations-apps/0006_broad_microchip.sql

@@ -0,0 +1,16 @@
+CREATE TABLE `correlation_replay` (
+	`jti` text PRIMARY KEY NOT NULL,
+	`expires_at` integer NOT NULL,
+	`consumed_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `order_attribution` (
+	`tenant_id` text NOT NULL,
+	`external_order_id` text NOT NULL,
+	`attributed` integer DEFAULT 0 NOT NULL,
+	`correlation_id` text,
+	`correlation_expires_at` text,
+	`reason` text,
+	`recorded_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `external_order_id`)
+);

package/apps/storefront/migrations-apps/0007_brave_outlaw_kid.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `app_version_snapshots` (
+	`id` text PRIMARY KEY NOT NULL,
+	`install_id` text NOT NULL,
+	`tenant_id` text NOT NULL,
+	`seq` integer NOT NULL,
+	`app_version` text NOT NULL,
+	`facets` text NOT NULL,
+	`actor` text NOT NULL,
+	`note` text,
+	`restored_from_seq` integer,
+	`created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_app_version_snapshots_install_seq` ON `app_version_snapshots` (`install_id`,`seq`);--> statement-breakpoint
+CREATE INDEX `idx_app_version_snapshots_install` ON `app_version_snapshots` (`install_id`);

package/apps/storefront/migrations-apps/0008_blue_dazzler.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `candidate_submit_leases` (
+	`tenant_id` text NOT NULL,
+	`change_id` text NOT NULL,
+	`authorization_id` text NOT NULL,
+	`status` text DEFAULT 'active' NOT NULL,
+	`acquired_at` text NOT NULL,
+	`expires_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `change_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_candidate_submit_leases_expires` ON `candidate_submit_leases` (`expires_at`);

package/apps/storefront/migrations-apps/0009_bored_shinobi_shaw.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `integration_migration_drafts` (
+	`draft_id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`revision` integer NOT NULL,
+	`state` text DEFAULT 'open' NOT NULL,
+	`record` text NOT NULL,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_integration_migration_drafts_tenant` ON `integration_migration_drafts` (`tenant_id`,`created_at`);--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_kind` text;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_revision` integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_active_revision_id` text;--> statement-breakpoint
+ALTER TABLE `app_installs` ADD `managed_candidate` text;

package/apps/storefront/migrations-apps/0010_ws4_verified_provider_measurement.sql

@@ -0,0 +1,35 @@
+-- WS4 durable, minimized server ledger/outbox. No raw provider payload,
+-- customer identity, browser correlation, credential, or destination data.
+CREATE TABLE `regulated_commerce_provider_events` (
+  `provider` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `fingerprint` text NOT NULL,
+  `receipt_id` text NOT NULL,
+  `received_at` text NOT NULL,
+  PRIMARY KEY(`provider`, `provider_event_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `regulated_commerce_provider_orders` (
+  `provider` text NOT NULL,
+  `provider_order_id` text NOT NULL,
+  `tenant_id` text NOT NULL,
+  `state` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `updated_at` text NOT NULL,
+  PRIMARY KEY(`provider`, `provider_order_id`, `tenant_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `regulated_commerce_intent_outbox` (
+  `intent_id` text PRIMARY KEY NOT NULL,
+  `tenant_id` text NOT NULL,
+  `provider` text NOT NULL,
+  `provider_event_id` text NOT NULL,
+  `payload` text NOT NULL,
+  `created_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_regulated_commerce_outbox_provider_event`
+  ON `regulated_commerce_intent_outbox` (`provider`, `provider_event_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_regulated_commerce_outbox_tenant_created`
+  ON `regulated_commerce_intent_outbox` (`tenant_id`, `created_at`);