@tokenoftrust/storefront-runner 2.0.1 → 2.0.3

package/apps/storefront/src/pages/api/apps/admin/integrations.ts

@@ -1,89 +0,0 @@
-/**
- * GET /api/apps/admin/integrations — the effective integration admin read model
- * (ext-admin-02): the tenant-scoped data behind ext-admin-01's `/admin#integrations`
- * IA. Combines each install's desired config, resolved effective plan, compiled CSP,
- * consent, assurance, candidate, and rollback availability into ONE safe view.
- *
- * Auth mirrors `list.ts` exactly: the `?tenant=` query param is only ever a CANDIDATE
- * into `resolveOperatorSession` — the tenant actually used is `auth.tenantId` from the
- * resolved session, never the raw param — so another tenant, or a vendor with no
- * membership, is denied (401/403) before any read model is assembled. Read-only: any
- * membership role admits. The pure {@link assembleIntegrationReadModel} is the second,
- * defense-in-depth gate: it re-asserts every materialized input belongs to
- * `auth.tenantId` and redacts secrets, so a mis-plumbed control plane cannot leak.
- *
- * The control-plane materialization of effective plans, candidate evidence, and
- * assurance records is resolved per install where present; an install with none yet
- * surfaces honestly as `configuring` (no effective authority, no rollback), never a
- * fabricated live state.
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import { getRegistryService, json } from "@/lib/apps/adminService.js";
-import { parseEnvironment, type IntegrationEnvironment } from "@tot/public-runtime";
-import {
-  assembleIntegrationReadModel,
-  type IntegrationReadModelInputItem,
-} from "@/lib/apps/integrationReadModel.js";
-import { tenantLocalReadModelItems } from "@/lib/apps/tenantIntegrationMaterialization.js";
-import { resolveAdminTenant } from "@/config/adminTenantLookup";
-
-export const prerender = false;
-
-/** A merchant-legible purpose line for an install, never an internal adapter name. */
-function purposeFor(appId: string): string {
-  return `Integration: ${appId}`;
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const url = new URL(context.request.url);
-  const requestedTenant = url.searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const stage: IntegrationEnvironment = parseEnvironment(url.searchParams.get("stage")) ?? "staged";
-
-  const installs = await registry.listByTenant(auth.tenantId);
-  const items: IntegrationReadModelInputItem[] = installs
-    .filter((install) => install.status !== "uninstalled")
-    .map((install) => ({
-      install: {
-        installId: install.installId,
-        appId: install.appId,
-        appVersion: install.appVersion,
-        tenantId: install.tenantId,
-        status: install.status,
-      },
-      purpose: purposeFor(install.appId),
-      // The desired config is the tenant's own input; when the manifest snapshot is not
-      // a structured object it contributes nothing — never a fabricated value.
-      desiredConfig: {},
-    }));
-
-  // ext-kernel-09: a tenant's OWN (tenant-local) declarations are materialized through
-  // the interim bridge and appended with their REAL effective plan + compiled CSP, so a
-  // declared integration surfaces effective state — not `configuring`. Resolved off the
-  // auth-bound tenant config only (the tenant id is `auth.tenantId`, never the param).
-  // Best-effort + additive: a resolver hiccup degrades to the managed-app view rather
-  // than failing the whole read model closed.
-  try {
-    const tenantConfig = await resolveAdminTenant(auth.tenantId);
-    if (tenantConfig && tenantConfig.tenant_id === auth.tenantId) {
-      items.push(...tenantLocalReadModelItems(tenantConfig, stage));
-    }
-  } catch (err) {
-    console.error(`[admin-integrations] tenant-local materialization skipped for ${auth.tenantId}: ${String(err)}`);
-  }
-
-  const result = assembleIntegrationReadModel({ tenantPublicId: auth.tenantId, stage, items });
-  if (!result.ok) {
-    // A cross-tenant input or surviving secret is a server-side integrity failure, not
-    // something to echo back field-by-field.
-    return json({ error: "integration read model failed integrity checks" }, 500);
-  }
-
-  return json({ readModel: result.value });
-}

package/apps/storefront/src/pages/api/apps/admin/list.ts

@@ -1,26 +0,0 @@
-/**
- * GET /api/apps/admin/list — list the app installs for the resolved operator
- * tenant (PrivateApps epic, D2 Chunk C; D8 console-session auth added). The
- * `?tenant=` query param (read by console callers with several memberships,
- * mirroring `../../grants/team-members.ts`) is only ever a CANDIDATE into
- * `resolveOperatorSession` — the tenant actually used below is `auth.tenantId`
- * from the resolved session, never the raw param, so a caller can only ever
- * see their own tenant's installs. Read-only: any membership role admits.
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import { getRegistryService, json } from "@/lib/apps/adminService.js";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const installs = await registry.listByTenant(auth.tenantId);
-  return json({ installs });
-}

package/apps/storefront/src/pages/api/apps/admin/platform-adapters.ts

@@ -1,85 +0,0 @@
-/**
- * POST /api/apps/admin/platform-adapters — the first-class native adapter
- * surface (ext-admin-04). Two actions over the pure, edge-safe adapter core
- * ({@link platformAdapterCatalog} / {@link buildPlatformAdapterDeclaration}):
- *
- *   - `catalog` — the first-class adapter cards (consent purposes + performance
- *     budget + CSP origins + per-stage destination behavior), so a merchant sees the
- *     material effects before configuring anything.
- *   - `build` — turn a merchant's public destination ids (per environment) into a
- *     tenant-scoped declaration + resolved effective plan + read-model card, or
- *     refuse. Fail-closed: an unknown adapter, a missing/invalid live id, or a
- *     non-live stage that reuses the live id blocks with violations.
- *
- * Auth mirrors the other `/api/apps/admin/*` routes: the tenant is `auth.tenantId`
- * from the resolved operator session — NEVER the request body — so a build is only
- * ever scoped to the caller's own tenant. The build environment is derived server-side
- * as a `candidate` stage, so the browser can never forge a live-stage declaration.
- * Configuring is a manage action ({@link requireManageRole}). The route does NOT
- * persist — staging/publishing a produced candidate is ext-admin-07's lifecycle.
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import { json, requireManageRole } from "@/lib/apps/adminService.js";
-import {
-  platformAdapterCatalog,
-  buildPlatformAdapterDeclaration,
-  resolveBrowserEnvironment,
-  INTEGRATION_SITE_SURFACES,
-  type IntegrationSiteSurface,
-} from "@tot/public-runtime";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const url = new URL(context.request.url);
-  const requestedTenant = url.searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const roleDenied = requireManageRole(auth);
-  if (roleDenied) return roleDenied;
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ error: "request body must be JSON" }, 400);
-  }
-  if (typeof body !== "object" || body === null) {
-    return json({ error: "request body must be a JSON object" }, 400);
-  }
-  const action = (body as { action?: unknown }).action;
-
-  if (action === "catalog") {
-    return json({ catalog: platformAdapterCatalog() });
-  }
-
-  if (action === "build") {
-    const fields = (body as { fields?: unknown }).fields;
-    const base = typeof fields === "object" && fields !== null ? (fields as Record<string, unknown>) : {};
-    const surfaceParam = (base["siteSurface"] as IntegrationSiteSurface | undefined) ?? "storefront";
-    const siteSurface = INTEGRATION_SITE_SURFACES.includes(surfaceParam) ? surfaceParam : "storefront";
-    // A build always targets a candidate; the environment is server-derived, so a
-    // browser can never forge a live-stage declaration.
-    const environment = resolveBrowserEnvironment({
-      siteSurface,
-      canonicalHost: url.host,
-      revision: typeof base["revision"] === "string" ? (base["revision"] as string) : "adapter-candidate",
-      dev: false,
-      localHost: false,
-      candidate: true,
-      previewHost: false,
-      customizationEnv: "test",
-    });
-    const result = buildPlatformAdapterDeclaration({
-      adapterId: base["adapterId"],
-      ids: base["ids"],
-      tenantPublicId: auth.tenantId,
-      environment,
-    });
-    const status = result.ok ? 200 : result.reason === "unknown-adapter" ? 404 : 422;
-    return json({ result }, status);
-  }
-
-  return json({ error: 'action must be "catalog" or "build"' }, 400);
-}

package/apps/storefront/src/pages/api/apps/admin/resume.ts

@@ -1,79 +0,0 @@
-/**
- * POST /api/apps/admin/resume — resume a suspended install back to active
- * (PrivateApps epic, D2 Chunk C; D8 console-session auth added).
- *
- * `registryService.resume()` takes a bare `installId` with no tenant check of
- * its own (Chunk A assumption #1) — so this route resolves the install via
- * `requireOwnedInstall` BEFORE calling it, rejecting a foreign-tenant
- * `installId` with the SAME 404 a truly-missing one gets (no cross-tenant
- * existence oracle). Mutating: `requireManageRole` gates a console
- * `developer` role out — the host-bound/Bearer path is exempt (no `role`).
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import {
-  getRegistryService,
-  registryErrorResponse,
-  requireOwnedInstall,
-  requireManageRole,
-  parseInstallId,
-  json,
-} from "@/lib/apps/adminService.js";
-import { RegistryError } from "@/lib/apps/registryService.js";
-import { resolveUiActor } from "@/lib/activity/uiActor";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const manageDenied = requireManageRole(auth);
-  if (manageDenied) return manageDenied;
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-
-  const installId = parseInstallId(body);
-  if (!installId) return json({ error: "installId is required" }, 400);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
-  if (owned instanceof Response) return owned;
-
-  // D10: acting cohort (merchant/admin), emitted source "server" per the app.* catalog.
-  const activityActor = await resolveUiActor(context, { owner: auth.tenantId });
-
-  try {
-    const install = await registry.resume(installId, auth.actor);
-    recordActivity({
-      action: "app.resume",
-      actor: activityActor,
-      source: "server",
-      outcome: { status: "succeeded" },
-      scope: { tenantId: auth.tenantId },
-      payload: { args: { appId: owned.appId, env: owned.env } },
-    });
-    return json({ install });
-  } catch (err) {
-    if (err instanceof RegistryError) {
-      recordActivity({
-        action: "app.resume",
-        actor: activityActor,
-        source: "server",
-        outcome: { status: err.code === "invalid_state" ? "refused" : "failed", errorClass: err.code },
-        scope: { tenantId: auth.tenantId },
-        payload: { args: { appId: owned.appId, env: owned.env } },
-      });
-      return registryErrorResponse(err);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/pages/api/apps/admin/suspend.ts

@@ -1,80 +0,0 @@
-/**
- * POST /api/apps/admin/suspend — suspend an active install: immediately
- * disables its API tokens, webhook delivery, and widget placements
- * (PrivateApps epic, D2 Chunk C; D8 console-session auth added).
- *
- * `registryService.suspend()` takes a bare `installId` with no tenant check
- * of its own (Chunk A assumption #1) — so this route resolves the install via
- * `requireOwnedInstall` BEFORE calling it, rejecting a foreign-tenant
- * `installId` with the SAME 404 a truly-missing one gets (no cross-tenant
- * existence oracle). Mutating: `requireManageRole` gates a console
- * `developer` role out — the host-bound/Bearer path is exempt (no `role`).
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import {
-  getRegistryService,
-  registryErrorResponse,
-  requireOwnedInstall,
-  requireManageRole,
-  parseInstallId,
-  json,
-} from "@/lib/apps/adminService.js";
-import { RegistryError } from "@/lib/apps/registryService.js";
-import { resolveUiActor } from "@/lib/activity/uiActor";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const manageDenied = requireManageRole(auth);
-  if (manageDenied) return manageDenied;
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-
-  const installId = parseInstallId(body);
-  if (!installId) return json({ error: "installId is required" }, 400);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
-  if (owned instanceof Response) return owned;
-
-  // D10: acting cohort (merchant/admin), emitted source "server" per the app.* catalog.
-  const activityActor = await resolveUiActor(context, { owner: auth.tenantId });
-
-  try {
-    const install = await registry.suspend(installId, auth.actor);
-    recordActivity({
-      action: "app.suspend",
-      actor: activityActor,
-      source: "server",
-      outcome: { status: "succeeded" },
-      scope: { tenantId: auth.tenantId },
-      payload: { args: { appId: owned.appId, env: owned.env } },
-    });
-    return json({ install });
-  } catch (err) {
-    if (err instanceof RegistryError) {
-      recordActivity({
-        action: "app.suspend",
-        actor: activityActor,
-        source: "server",
-        outcome: { status: err.code === "invalid_state" ? "refused" : "failed", errorClass: err.code },
-        scope: { tenantId: auth.tenantId },
-        payload: { args: { appId: owned.appId, env: owned.env } },
-      });
-      return registryErrorResponse(err);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/pages/api/apps/admin/uninstall.ts

@@ -1,98 +0,0 @@
-/**
- * POST /api/apps/admin/uninstall — uninstall an app: revokes credentials and
- * clears placements, but retains the install row + audit trail (PrivateApps
- * epic, D2 Chunk C; D8 console-session auth added).
- *
- * `registryService.uninstall()` takes a bare `installId` with no tenant check
- * of its own (Chunk A assumption #1) — so this route resolves the install via
- * `requireOwnedInstall` BEFORE calling it, rejecting a foreign-tenant
- * `installId` with the SAME 404 a truly-missing one gets (no cross-tenant
- * existence oracle). Mutating: `requireManageRole` gates a console
- * `developer` role out — the host-bound/Bearer path is exempt (no `role`).
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import {
-  getRegistryService,
-  registryErrorResponse,
-  requireOwnedInstall,
-  requireManageRole,
-  parseInstallId,
-  json,
-} from "@/lib/apps/adminService.js";
-import { RegistryError } from "@/lib/apps/registryService.js";
-import { emitWebhookEvent } from "@/lib/webhooks/emit.js";
-import { resolveUiActor } from "@/lib/activity/uiActor";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const manageDenied = requireManageRole(auth);
-  if (manageDenied) return manageDenied;
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-
-  const installId = parseInstallId(body);
-  if (!installId) return json({ error: "installId is required" }, 400);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
-  if (owned instanceof Response) return owned;
-
-  // D10: acting cohort (merchant/admin), emitted source "server" per the app.*
-  // catalog. Best-effort, never alters control flow.
-  const activityActor = await resolveUiActor(context, { owner: auth.tenantId });
-
-  try {
-    const install = await registry.uninstall(installId, auth.actor);
-    try {
-      // Best-effort, and deliberately AFTER uninstall has already flipped the
-      // install to "uninstalled" — this is the final farewell delivery; see
-      // emit.ts / deliveryEngine.ts's matching status exemption for it.
-      await emitWebhookEvent("app.uninstalled", auth.tenantId, {}, { installId });
-    } catch (cause) {
-      console.warn(
-        "[diag:webhooks:emit]",
-        JSON.stringify({
-          topic: "app.uninstalled",
-          tenantId: auth.tenantId,
-          installId,
-          error: cause instanceof Error ? cause.message : String(cause),
-        }),
-      );
-    }
-    recordActivity({
-      action: "app.uninstall",
-      actor: activityActor,
-      source: "server",
-      outcome: { status: "succeeded" },
-      scope: { tenantId: auth.tenantId },
-      payload: { args: { appId: owned.appId, env: owned.env } },
-    });
-    return json({ install });
-  } catch (err) {
-    if (err instanceof RegistryError) {
-      recordActivity({
-        action: "app.uninstall",
-        actor: activityActor,
-        source: "server",
-        outcome: { status: "failed", errorClass: err.code },
-        scope: { tenantId: auth.tenantId },
-        payload: { args: { appId: owned.appId, env: owned.env } },
-      });
-      return registryErrorResponse(err);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/pages/api/apps/admin/update.ts

@@ -1,126 +0,0 @@
-/**
- * POST /api/apps/admin/update — patch an existing install's version, scopes,
- * manifest snapshot, or webhook endpoint (PrivateApps epic, D2 Chunk C; D8
- * console-session auth added).
- *
- * `registryService.update()` takes a bare `installId` with no tenant check of
- * its own (Chunk A assumption #1) — so this route resolves the install via
- * `requireOwnedInstall` BEFORE calling it, rejecting a foreign-tenant
- * `installId` with the SAME 404 a truly-missing one gets (no cross-tenant
- * existence oracle). Mutating: `requireManageRole` gates a console
- * `developer` role out — the host-bound/Bearer path is exempt (no `role`).
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import {
-  getRegistryService,
-  registryErrorResponse,
-  requireOwnedInstall,
-  requireManageRole,
-  parseInstallId,
-  json,
-} from "@/lib/apps/adminService.js";
-import { RegistryError, type AppInstallPatch } from "@/lib/apps/registryService.js";
-import { resolveUiActor } from "@/lib/activity/uiActor";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-interface UpdateBody {
-  installId?: unknown;
-  appVersion?: unknown;
-  scopes?: unknown;
-  manifest?: unknown;
-  webhookEndpoint?: unknown;
-  widgetPlacements?: unknown;
-}
-
-/** Validate + narrow the given fields into `AppInstallPatch`, or a 400 message. */
-function parsePatch(body: UpdateBody): AppInstallPatch | string {
-  const patch: AppInstallPatch = {};
-  if (body.appVersion !== undefined) {
-    if (typeof body.appVersion !== "string" || !body.appVersion.trim()) {
-      return "appVersion, when given, must be a non-empty string";
-    }
-    patch.appVersion = body.appVersion;
-  }
-  if (body.scopes !== undefined) {
-    if (!Array.isArray(body.scopes) || body.scopes.some((s) => typeof s !== "string")) {
-      return "scopes, when given, must be a string[]";
-    }
-    patch.scopes = body.scopes as string[];
-  }
-  if (body.manifest !== undefined) {
-    if (body.manifest === null || typeof body.manifest !== "object" || Array.isArray(body.manifest)) {
-      return "manifest, when given, must be an object";
-    }
-    patch.manifest = body.manifest;
-  }
-  if (body.webhookEndpoint !== undefined) {
-    if (body.webhookEndpoint !== null && typeof body.webhookEndpoint !== "string") {
-      return "webhookEndpoint, when given, must be a string or null";
-    }
-    patch.webhookEndpoint = body.webhookEndpoint as string | null;
-  }
-  if (body.widgetPlacements !== undefined) {
-    if (!Array.isArray(body.widgetPlacements)) return "widgetPlacements, when given, must be an array";
-    patch.widgetPlacements = body.widgetPlacements;
-  }
-  return patch;
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const manageDenied = requireManageRole(auth);
-  if (manageDenied) return manageDenied;
-
-  let body: UpdateBody;
-  try {
-    body = (await context.request.json()) as UpdateBody;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-
-  const installId = parseInstallId(body);
-  if (!installId) return json({ error: "installId is required" }, 400);
-
-  const patch = parsePatch(body);
-  if (typeof patch === "string") return json({ error: patch }, 400);
-
-  const registry = await getRegistryService();
-  if (registry instanceof Response) return registry;
-
-  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
-  if (owned instanceof Response) return owned;
-
-  // D10: acting cohort (merchant/admin), emitted source "server" per the app.* catalog.
-  const activityActor = await resolveUiActor(context, { owner: auth.tenantId });
-
-  try {
-    const install = await registry.update(installId, patch, auth.actor);
-    recordActivity({
-      action: "app.update",
-      actor: activityActor,
-      source: "server",
-      outcome: { status: "succeeded" },
-      scope: { tenantId: auth.tenantId },
-      payload: { args: { appId: owned.appId, env: owned.env } },
-    });
-    return json({ install });
-  } catch (err) {
-    if (err instanceof RegistryError) {
-      recordActivity({
-        action: "app.update",
-        actor: activityActor,
-        source: "server",
-        outcome: { status: err.code === "invalid_state" ? "refused" : "failed", errorClass: err.code },
-        scope: { tenantId: auth.tenantId },
-        payload: { args: { appId: owned.appId, env: owned.env } },
-      });
-      return registryErrorResponse(err);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/pages/api/apps/admin/webhooks/deliveries/[deliveryId]/replay.ts

@@ -1,70 +0,0 @@
-/**
- * POST /api/apps/admin/webhooks/deliveries/{deliveryId}/replay — the
- * ops/support replay (PrivateApps epic, D4 Chunk E; D8 console-session auth
- * added). Operator session only; `tenantId` comes from `auth.tenantId`
- * (`resolveOperatorSession`), never the request. A `deliveryId` whose
- * `tenantId` doesn't match the operator's resolved tenant 404s identically to
- * a truly-missing one — same no-cross-tenant-oracle discipline
- * `requireOwnedInstall` keeps for install ids. `webhook_deliveries` already
- * carries its own `tenantId` (set at creation, mirroring the owning
- * install's), so this checks that column directly rather than round-tripping
- * through the registry. Mutating (re-enqueues a delivery): `requireManageRole`
- * gates a console `developer` role out — the host-bound/Bearer path is
- * exempt (no `role`).
- *
- * Not part of the app-facing `openapi.yaml` contract (same as the rest of
- * `admin/*`) — no `Idempotency-Key` requirement; an authenticated operator
- * retriggering a replay isn't the untrusted-client-retry case that header
- * guards against.
- *
- * Same `requeueForReplay` + same-`deliveryId` re-enqueue as the app-facing
- * replay — see that route's doc comment for the full rationale.
- */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import { json, requireManageRole } from "@/lib/apps/adminService.js";
-import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
-import { getDispatcher } from "@/lib/webhooks/getDispatcher.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-import { resolveUiActor, recordUiActivity } from "@/lib/activity/uiActor";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
-  const auth = await resolveOperatorSession(context, requestedTenant);
-  if (!auth.ok) return json({ error: auth.message }, auth.status);
-  const manageDenied = requireManageRole(auth);
-  if (manageDenied) return manageDenied;
-
-  const deliveryId = context.params.deliveryId;
-  if (!deliveryId) return json({ error: "Delivery not found.", code: "not_found" }, 404);
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return json({ error: "webhook store not configured" }, 503);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const delivery = await store.getDelivery(deliveryId);
-  if (!delivery || delivery.tenantId !== auth.tenantId) {
-    return json({ error: "Delivery not found.", code: "not_found" }, 404);
-  }
-
-  const dispatcher = await getDispatcher();
-  if (dispatcher instanceof Response) return dispatcher;
-
-  const requeued = await store.requeueForReplay(deliveryId);
-  await dispatcher.enqueue({ deliveryId });
-
-  // D11: ops/support console replay. Resolve the acting cohort (admin/merchant per
-  // resolveOperatorSession) from the session; `surface: "admin"` disambiguates from the
-  // app-facing v1 call site that shares this key. deliveryId is the opaque wire id.
-  const activityActor = await resolveUiActor(context, {});
-  recordUiActivity(activityActor, {
-    action: "webhook.delivery.replayed",
-    outcome: { status: "succeeded" },
-    scope: { tenantId: auth.tenantId },
-    payload: { args: { deliveryId, surface: "admin" } },
-  });
-  return json({ delivery: requeued }, 202);
-}