@tokenoftrust/storefront-runner 2.0.1 → 2.0.3

package/apps/storefront/src/pages/api/apps/v1/health.ts

@@ -1,32 +0,0 @@
-/**
- * `GET /api/apps/v1/health` — the D4 install delivery/telemetry health read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `getInstallHealth`). Requires no scope beyond a valid token — only ever the
- * caller's OWN install health (the `sub` claim `authorizeAppRequest` already
- * resolved), never another install's.
- *
- * `WebhookDeliveryStore.getInstallHealth`'s `InstallHealth` return already IS
- * the contract's `InstallHealth` shape 1:1, incl. `p95DeliveryMs` (a
- * never-attempted install reads as healthy/zeroed) — no mapper needed, unlike
- * `Delivery` below.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const health = await store.getInstallHealth(auth.install.installId);
-  return withRequestId(json(health), context);
-}

package/apps/storefront/src/pages/api/apps/v1/inventory.ts

@@ -1,59 +0,0 @@
-/**
- * `GET /api/apps/v1/inventory` — the D3 inventory-availability read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `listInventory`). Requires scope `inventory:read`.
- *
- * No new table: this projects `{sku, available, quantity?, policy?}` off the
- * variants embedded in the existing catalog read model
- * (`../../../lib/d1/catalog.js`'s `listAllActiveProducts`) — active products
- * only. A variant with no `sku` is skipped; the contract's `InventoryList`
- * item requires one, and there's nothing to key it by otherwise.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { listAllActiveProducts, fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-interface InventoryItem {
-  sku: string;
-  available: boolean;
-  quantity?: number;
-  policy?: "deny" | "continue";
-}
-
-function toInventoryItem(policy: string | undefined, quantity: number | undefined, sku: string, available: boolean): InventoryItem {
-  return {
-    sku,
-    available,
-    quantity,
-    policy: policy === "deny" || policy === "continue" ? policy : undefined,
-  };
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "inventory:read");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const d1 = await readD1("CATALOG_DB");
-  if (!d1) return withRequestId(json({ error: "catalog not configured", code: "unconfigured" }, 503), context);
-  const db = fromD1(d1);
-
-  const skuFilter = new URL(context.request.url).searchParams.get("sku");
-  const products = await listAllActiveProducts(db);
-
-  const items: InventoryItem[] = [];
-  for (const product of products) {
-    for (const variant of product.variants) {
-      if (!variant.sku) continue;
-      if (skuFilter && variant.sku !== skuFilter) continue;
-      items.push(
-        toInventoryItem(variant.inventory.policy, variant.inventory.quantity, variant.sku, variant.inventory.available),
-      );
-    }
-  }
-
-  return withRequestId(json({ items }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/orders/[id].ts

@@ -1,48 +0,0 @@
-/**
- * `GET /api/apps/v1/orders/{id}` — the D6 minimal single-order read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s `getOrder`).
- * Requires scope `orders:read:minimal`.
- *
- * `{id}` is tot-foxycart's `externalId` — the same id `listOrders` echoes
- * back as `Order.id`. There's no cross-tenant oracle here: the Foxy partner
- * API key is itself tenant-scoped, so a call can only ever resolve THIS
- * tenant's own orders — an unknown id and a different tenant's id both come
- * back `null` from `FoxyOrderClient.getOrder` and are reported identically
- * as 404.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { toContractOrder } from "@/lib/apps/orders/orderMapper.js";
-import { getFoxyOrderClient } from "@/lib/apps/orders/foxyOrderClient.js";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "orders:read:minimal");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const id = context.params.id;
-  if (!id) return withRequestId(json({ error: "missing order id", code: "bad_request" }, 400), context);
-
-  let client;
-  try {
-    client = await getFoxyOrderClient();
-  } catch {
-    return withRequestId(json({ error: "orders not configured", code: "unconfigured" }, 503), context);
-  }
-
-  let foxyOrder;
-  try {
-    foxyOrder = await client.getOrder(auth.install.tenantId, id);
-  } catch {
-    return withRequestId(json({ error: "failed to read order", code: "upstream_error" }, 502), context);
-  }
-  if (!foxyOrder) return withRequestId(json({ error: "order not found", code: "not_found" }, 404), context);
-
-  const order = await toContractOrder(foxyOrder, {
-    tenantId: auth.install.tenantId,
-    installId: auth.install.installId,
-  });
-  return withRequestId(json(order), context);
-}

package/apps/storefront/src/pages/api/apps/v1/orders.ts

@@ -1,73 +0,0 @@
-/**
- * `GET /api/apps/v1/orders` — the D6 minimal order list (PrivateApps epic;
- * `docs/private-apps/contract/openapi.yaml`'s `listOrders`). Requires scope
- * `orders:read:minimal`.
- *
- * Reads live from tot-foxycart via `FoxyOrderClient` (never a raw fetch) and
- * maps every row through `orderMapper.ts`'s `toContractOrder` — nothing
- * beyond the contract's minimized `Order` shape (customer as opaque hash, no
- * checkout/tax/signed-cart internals) ever leaves this route. Fail-closed:
- * an unconfigured Foxy client is a 503, any upstream read failure is a clean
- * 502 — neither leaks Foxy's own error detail.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { toContractOrder, type ContractOrderStatus } from "@/lib/apps/orders/orderMapper.js";
-import { getFoxyOrderClient } from "@/lib/apps/orders/foxyOrderClient.js";
-
-export const prerender = false;
-
-const DEFAULT_PAGE_SIZE = 24;
-const MAX_PAGE_SIZE = 100;
-const ORDER_STATUSES: readonly ContractOrderStatus[] = ["created", "fulfilled", "cancelled"];
-
-function parsePage(raw: string | null, fallback: number): number {
-  const n = raw != null ? Number(raw) : NaN;
-  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : fallback;
-}
-
-function parseStatus(raw: string | null): ContractOrderStatus | undefined {
-  return raw != null && (ORDER_STATUSES as readonly string[]).includes(raw) ? (raw as ContractOrderStatus) : undefined;
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "orders:read:minimal");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const url = new URL(context.request.url);
-  const page = parsePage(url.searchParams.get("page"), 1);
-  const pageSize = Math.min(
-    MAX_PAGE_SIZE,
-    Math.max(1, parsePage(url.searchParams.get("pageSize"), DEFAULT_PAGE_SIZE)),
-  );
-  const statusFilter = parseStatus(url.searchParams.get("status"));
-
-  let client;
-  try {
-    client = await getFoxyOrderClient();
-  } catch {
-    return withRequestId(json({ error: "orders not configured", code: "unconfigured" }, 503), context);
-  }
-
-  let foxyPage;
-  try {
-    foxyPage = await client.listOrders(auth.install.tenantId, {
-      limit: pageSize,
-      offset: (page - 1) * pageSize,
-    });
-  } catch {
-    return withRequestId(json({ error: "failed to read orders", code: "upstream_error" }, 502), context);
-  }
-
-  const mapCtx = { tenantId: auth.install.tenantId, installId: auth.install.installId };
-  let orders = await Promise.all(foxyPage.orders.map((order) => toContractOrder(order, mapCtx)));
-  // tot-foxycart's own `status` query param speaks Foxy's status vocabulary, not
-  // the contract's created|fulfilled|cancelled enum — there's no confirmed
-  // mapping to push this filter upstream, so it's applied post-map here. This
-  // can leave a page short of `pageSize`, and `total` still reflects Foxy's
-  // UNFILTERED count — a known gap, flagged rather than built around.
-  if (statusFilter) orders = orders.filter((order) => order.status === statusFilter);
-
-  return withRequestId(json({ orders, page, pageSize, total: foxyPage.total }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/reports.ts

@@ -1,21 +0,0 @@
-/**
- * `GET /api/apps/v1/reports` — the D3 report-snapshot list (PrivateApps
- * epic; `docs/private-apps/contract/openapi.yaml`'s `listReports`). Requires
- * scope `reports:read`.
- *
- * Real auth + scope enforcement, empty data: this milestone ships the
- * endpoint's contract shape (a valid `ReportList`) with no report snapshots
- * behind it yet — there is no report-generation pipeline to read from.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "reports:read");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  return withRequestId(json({ reports: [] }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/webhooks/deliveries/[deliveryId]/replay.ts

@@ -1,74 +0,0 @@
-/**
- * `POST /api/apps/v1/webhooks/deliveries/{deliveryId}/replay` — the D4
- * install-owned replay (PrivateApps epic; `docs/private-apps/contract/
- * openapi.yaml`'s `replayWebhookDelivery`). Authorized by install ownership,
- * not a scope (`x-requiredScope: null`, `x-authorization: install-owns-
- * delivery`): an app may replay only a delivery it owns.
- *
- * Preserves the SAME `deliveryId` (the CloudEvents wire id) throughout — a
- * receiver that already acked a `delivered` delivery still dedupes a
- * replayed resend of it — via `deliveryStore.ts`'s `requeueForReplay`, which
- * resets the row (incl. out of the `delivered`/`dead-lettered` terminal
- * states) to `pending` with a fresh attempt budget so the dispatcher's
- * `attemptDelivery` makes a real HTTP attempt instead of hitting its
- * terminal-state no-op branch. See `requeueForReplay`'s own doc comment for
- * the full rationale.
- *
- * No `Idempotency-Key` ledger exists yet (no table backs it), so this only
- * validates the header's presence, per the contract's `required: true` — it
- * does not yet detect/409 a reused key with a mismatched body (there is no
- * request body on this operation to hash in the first place).
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
-import { toContractDelivery } from "@/lib/webhooks/deliveryMapper.js";
-import { getDispatcher } from "@/lib/webhooks/getDispatcher.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  if (!context.request.headers.get("idempotency-key")) {
-    return withRequestId(json({ error: "Idempotency-Key header is required" }, 400), context);
-  }
-
-  const deliveryId = context.params.deliveryId;
-  if (!deliveryId) {
-    return withRequestId(json({ error: "deliveryId is required", code: "not_found" }, 404), context);
-  }
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const delivery = await store.getDelivery(deliveryId);
-  if (!delivery || delivery.installId !== auth.install.installId) {
-    return withRequestId(json({ error: "Delivery not found.", code: "not_found" }, 404), context);
-  }
-
-  const dispatcher = await getDispatcher();
-  if (dispatcher instanceof Response) return withRequestId(dispatcher, context);
-
-  const requeued = await store.requeueForReplay(deliveryId);
-  await dispatcher.enqueue({ deliveryId });
-
-  // D11: the app-facing (install-owned, app-JWT authed) replay — the `agent` cohort. Same
-  // catalog key as the admin console call site; `surface: "v1"` disambiguates. installId
-  // is an opaque per-install handle; deliveryId is the opaque CloudEvents wire id.
-  recordActivity({
-    action: "webhook.delivery.replayed",
-    actor: { kind: "agent", id: auth.install.installId },
-    source: "server",
-    outcome: { status: "succeeded" },
-    scope: { tenantId: auth.install.tenantId },
-    payload: { args: { deliveryId, surface: "v1" } },
-  });
-  return withRequestId(json(toContractDelivery(requeued), 202), context);
-}

package/apps/storefront/src/pages/api/apps/v1/webhooks/deliveries.ts

@@ -1,47 +0,0 @@
-/**
- * `GET /api/apps/v1/webhooks/deliveries` — the D4 install-owned delivery
- * list (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `listWebhookDeliveries`). Authorized by install ownership, not a scope
- * (`x-requiredScope: null`, `x-authorization: install-owns-delivery`): any
- * installed app may list ITS OWN delivery records, never another install's —
- * `listDeliveriesByInstall` is scoped to `auth.install.installId` from the
- * JWT, never a caller-supplied id.
- *
- * Delivery rows never carry a payload body (see `deliveryStore.ts`'s header),
- * so there is nothing sensitive to redact in `toContractDelivery`'s output.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore, type DeliveryState } from "@/lib/webhooks/deliveryStore.js";
-import { toContractDelivery } from "@/lib/webhooks/deliveryMapper.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-const DELIVERY_STATES: readonly DeliveryState[] = ["pending", "retrying", "delivered", "dead-lettered"];
-
-/** Absent = no filter (`undefined`); an unrecognized value is a 400, not a silent no-op. */
-function parseStateFilter(raw: string | null): DeliveryState | undefined | "invalid" {
-  if (raw === null) return undefined;
-  return (DELIVERY_STATES as readonly string[]).includes(raw) ? (raw as DeliveryState) : "invalid";
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const state = parseStateFilter(new URL(context.request.url).searchParams.get("state"));
-  if (state === "invalid") {
-    return withRequestId(json({ error: "invalid state filter", code: "invalid_state_filter" }, 400), context);
-  }
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const deliveries = await store.listDeliveriesByInstall(auth.install.installId, { state });
-
-  return withRequestId(json({ deliveries: deliveries.map(toContractDelivery) }), context);
-}

package/apps/storefront/src/pages/api/cache-purge.ts

@@ -1,55 +0,0 @@
-/**
- * POST /api/cache-purge — bump a tenant's edge page-cache version.
- *
- * The ETL load step calls this per tenant after a (re)migration so freshly
- * migrated content is visible immediately, rather than waiting out the page
- * TTL. This closes the loop that HttpToTClient.purgeTenant() (catalog API cache)
- * only half-covered: that purges the data cache; this purges the rendered HTML.
- *
- * Auth: `Authorization: Bearer <CACHE_PURGE_SECRET>`. JSON bodies are exempt from
- * Astro's CSRF origin check, so the server-to-server ETL caller works.
- */
-import type { APIContext } from "astro";
-import { readEnv, readKv } from "@/lib/env";
-import { bumpCacheVersion } from "@/lib/edgeCache";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const secret = await readEnv("CACHE_PURGE_SECRET");
-  const auth = context.request.headers.get("authorization");
-  if (!secret || auth !== `Bearer ${secret}`) {
-    return new Response("Unauthorized", { status: 401 });
-  }
-
-  const kv = await readKv("TENANT_CACHE");
-  if (!kv) {
-    return new Response("No cache store bound", { status: 503 });
-  }
-
-  let tenantId: string | undefined;
-  try {
-    tenantId = ((await context.request.json()) as { tenantId?: string })?.tenantId;
-  } catch {
-    /* fall through to 400 */
-  }
-  if (!tenantId) {
-    return new Response("tenantId required", { status: 400 });
-  }
-
-  const version = await bumpCacheVersion(kv, tenantId);
-  // D11: the caller is the Bearer-secret ETL load step (a machine, no session) — emit as
-  // the `agent` cohort with an opaque handle. Best-effort; never affects the purge.
-  recordActivity({
-    action: "cache.purged",
-    actor: { kind: "agent", id: "storefront" },
-    source: "server",
-    outcome: { status: "succeeded" },
-    scope: { tenantId },
-    payload: { args: { version } },
-  });
-  return new Response(JSON.stringify({ tenantId, version }), {
-    headers: { "content-type": "application/json" },
-  });
-}

package/apps/storefront/src/pages/api/compliance/tamper.ts

@@ -1,88 +0,0 @@
-/**
- * POST /api/compliance/tamper — the server receiver for protected-surface tamper
- * beacons (D-R7, `integration-protected-tamper-recovery`).
- *
- * The browser sentinel restores safe state IN the document and posts a
- * `TamperEvidenceBeacon` here. This route validates it fail-closed, records the
- * durable evidence + operator alert, and — when the beacon is attributable to a
- * single active install — SUSPENDS that install. It is a DETECTIVE control: the
- * suspension is after-the-fact recovery, never prevention.
- *
- * TENANT SCOPE is server-owned: the install lookup and suspend are ALWAYS keyed on
- * `locals.tenant` (middleware-resolved from the request host), never on the
- * body-supplied `tenant` — a page cannot ask to suspend another tenant's app. The
- * beacon body carries no secret (the contract rejects one), and the response is a
- * write-path ack the emitter ignores, so a failed post never breaks the page.
- */
-import type { APIContext } from "astro";
-import { getRegistryService, json } from "@/lib/apps/adminService.js";
-import type { AppInstall } from "@/lib/apps/registryService.js";
-import { RegistryError } from "@/lib/apps/registryService.js";
-import { planTamperRecovery, type AttributableInstall } from "@tot/public-runtime";
-
-export const prerender = false;
-
-const SYSTEM_ACTOR = "system:tamper-sentinel";
-
-function toAttributable(install: AppInstall): AttributableInstall {
-  return {
-    installId: install.installId,
-    appId: install.appId,
-    appVersion: install.appVersion,
-    status: install.status,
-  };
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const tenantId = context.locals.tenant?.tenant_id;
-  // No resolved tenant ⇒ nothing third-party could be scoped to; accept-and-drop so
-  // the emitter never errors or retries.
-  if (!tenantId) return json({ ok: true, accepted: false }, 202);
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ ok: false, error: "invalid JSON body" }, 400);
-  }
-
-  // Resolve the tenant's installs (empty when the registry binding isn't configured
-  // in this runtime — the beacon is still validated + recorded, just not actioned).
-  const registry = await getRegistryService();
-  const installs: AttributableInstall[] =
-    registry instanceof Response
-      ? []
-      : (await registry.listByTenant(tenantId)).map(toAttributable);
-
-  const plan = planTamperRecovery(body, installs, {
-    recordId: crypto.randomUUID(),
-    receivedAt: new Date().toISOString(),
-  });
-  if (!plan.ok) return json({ ok: false, error: "invalid tamper beacon" }, 400);
-
-  const { record, suspend } = plan.plan;
-  // Durable, secret-free evidence line for operations. The beacon itself is the record.
-  // eslint-disable-next-line no-console
-  console.warn(
-    `[tamper] tenant=${tenantId} record=${record.recordId} surface=${record.beacon.surface} kind=${record.beacon.kind} recovered=${record.beacon.recovered} app=${record.beacon.attribution?.appId ?? "unattributable"}`,
-  );
-
-  let suspended = false;
-  if (suspend && !(registry instanceof Response)) {
-    try {
-      await registry.suspend(suspend.installId, SYSTEM_ACTOR);
-      suspended = true;
-    } catch (err) {
-      // An already-suspended/uninstalled install (invalid_state) is a benign
-      // no-op under rapid re-mutation; anything else is swallowed so the write
-      // path never errors the emitter. The audit row from a successful suspend is
-      // the durable trail.
-      if (!(err instanceof RegistryError)) {
-        // eslint-disable-next-line no-console
-        console.error(`[tamper] suspend failed for ${suspend.installId}`, err);
-      }
-    }
-  }
-
-  return json({ ok: true, accepted: true, recovered: record.beacon.recovered, suspended }, 202);
-}

package/apps/storefront/src/pages/api/dashboard/enter-vendor.ts

@@ -1,154 +0,0 @@
-/**
- * POST /api/dashboard/enter-vendor { vendorAppDomain } — the ToT-STAFF admission
- * endpoint (#8425 staff access). Phase 2 of two-phase admission: on the staff
- * viewer explicitly selecting a searched vendor, tot20 writes the server-side
- * AUDIT row and returns the staffRoles-scoped capability; we then stamp a
- * short-lived {@link StaffSelection} on the session and admit the viewer to
- * `/dashboard/<appDomain>` scoped to that capability.
- *
- * AUTHORIZATION — two independent axes:
- *   NEAR (this endpoint): a valid `tot_session` carrying ToT-STAFF scope
- *     (`staff[]` non-empty). No session → 401; no staff scope → 403.
- *   FAR (tot20): `/clients/staffVendorAccess`, operator-authed as storefront,
- *     presenting a storefront-signed staff broker assertion in the
- *     `X-ToT-Broker-Assertion` header (minted from the verified session email).
- *     tot20 verifies it, re-checks staff scope from its `sub`, scopes the capability,
- *     and writes the audit row — it is the authority. No plaintext email on the wire.
- *
- * The staff selection is a DISTINCT access path from `tenants[]`: we NEVER
- * synthesize a membership. The dashboard guard + login gate consult the marker
- * separately (see tenantSelection.staffAdmits / loginGate.sessionAdmitsHost).
- */
-import type { APIContext } from "astro";
-import { readViewerSession, getSessionMutationHandle } from "@/lib/auth/route";
-import { updateSession } from "@/lib/auth/session";
-import { isStaffSession, buildStaffSelection } from "@/lib/dashboard/staffAdmission";
-import {
-  createStaffVendorAccessClient,
-  staffAccessHttpStatus,
-  StaffVendorAccessClientError,
-} from "@/lib/dashboard/staffVendorAccess";
-import { mintBrokerAssertion, BrokerAssertionError } from "@/lib/auth/brokerAssertion";
-import { resolveUiActor, recordUiActivity } from "@/lib/activity/uiActor";
-
-export const prerender = false;
-
-/** JSON response with no-store (staff access state must never be edge-cached). */
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", "cache-control": "no-store" },
-  });
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const session = await readViewerSession(context);
-  if (!session) return json({ error: "not signed in" }, 401);
-  if (!isStaffSession(session)) {
-    return json({ error: "staff access required", reason: "notStaff" }, 403);
-  }
-
-  let body: { vendorAppDomain?: unknown };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  const vendorAppDomain =
-    typeof body.vendorAppDomain === "string" ? body.vendorAppDomain.trim() : "";
-  if (!vendorAppDomain) return json({ error: "vendorAppDomain is required" }, 400);
-
-  // D11: staff-impersonation audit event. Resolve the actor AFTER the staff gate above,
-  // so the cohort is always `admin` (a ToT-staff session); the staff email is PII and is
-  // never stored (actor.id is its salted hash). Reused at each emit exit point below.
-  const activityActor = await resolveUiActor(context, {});
-
-  let client;
-  try {
-    client = await createStaffVendorAccessClient();
-  } catch (err) {
-    if (err instanceof StaffVendorAccessClientError) {
-      return json({ error: "staff-access integration not configured" }, 503);
-    }
-    throw err;
-  }
-
-  // #8453 `staff-invite-proof-via-broker`: prove the staff actor with a fresh
-  // storefront-signed assertion minted from the VERIFIED session email. Fail closed
-  // (503) if the signing key is unconfigured.
-  let brokerAssertion: string;
-  try {
-    brokerAssertion = await mintBrokerAssertion(session.email);
-  } catch (err) {
-    if (err instanceof BrokerAssertionError) {
-      return json({ error: "staff-proof signing not configured" }, 503);
-    }
-    throw err;
-  }
-
-  // FAR authority: tot20 verifies the assertion, derives the staff actor, scopes the
-  // capability, and writes the audit row. We admit ONLY on its ok.
-  const result = await client.grantStaffAccess(brokerAssertion, vendorAppDomain);
-  if (!result.ok) {
-    recordUiActivity(activityActor, {
-      action: "dashboard.vendor_entered",
-      outcome: { status: "refused", errorClass: result.reason ?? `http_${result.status}` },
-      scope: { tenantId: vendorAppDomain },
-      payload: { args: { resource: vendorAppDomain } },
-    });
-    return json(
-      { error: result.message, reason: result.reason, code: result.code },
-      staffAccessHttpStatus(result.reason, result.status),
-    );
-  }
-
-  // Stamp the distinct staff-selection marker on the session (short-lived, scoped
-  // to the returned capability). Never a tenants[] entry.
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  const selection = buildStaffSelection({
-    resource: vendorAppDomain,
-    capability: result.capability,
-    nowSeconds,
-  });
-  const handle = await getSessionMutationHandle(context);
-  if (!handle) {
-    // No SESSION KV / no cookie (e.g. plain `astro dev`) — the audit row is
-    // written but we can't persist the marker. Fail closed so the viewer isn't
-    // told they're admitted when the guard can't see it.
-    recordUiActivity(activityActor, {
-      action: "dashboard.vendor_entered",
-      outcome: { status: "failed", errorClass: "session_store_unavailable" },
-      scope: { tenantId: vendorAppDomain },
-      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
-    });
-    return json({ error: "session store unavailable; cannot persist admission" }, 503);
-  }
-  const updated = await updateSession(
-    handle.store,
-    handle.id,
-    (rec) => ({ ...rec, staffSelection: selection }),
-    nowSeconds,
-  );
-  if (!updated) {
-    recordUiActivity(activityActor, {
-      action: "dashboard.vendor_entered",
-      outcome: { status: "failed", errorClass: "session_expired" },
-      scope: { tenantId: vendorAppDomain },
-      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
-    });
-    return json({ error: "session expired; sign in again" }, 401);
-  }
-
-  recordUiActivity(activityActor, {
-    action: "dashboard.vendor_entered",
-    outcome: { status: "succeeded" },
-    scope: { tenantId: vendorAppDomain },
-    payload: { args: { resource: vendorAppDomain, capability: result.capability } },
-  });
-  return json({
-    ok: true,
-    appDomain: vendorAppDomain,
-    capability: result.capability,
-    redirect: `/dashboard/${encodeURIComponent(vendorAppDomain)}`,
-  });
-}