@tokenoftrust/storefront-runner 2.0.2 → 2.0.4

package/apps/storefront/src/pages/api/apps/v1/health.ts

@@ -1,32 +0,0 @@
-/**
- * `GET /api/apps/v1/health` — the D4 install delivery/telemetry health read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `getInstallHealth`). Requires no scope beyond a valid token — only ever the
- * caller's OWN install health (the `sub` claim `authorizeAppRequest` already
- * resolved), never another install's.
- *
- * `WebhookDeliveryStore.getInstallHealth`'s `InstallHealth` return already IS
- * the contract's `InstallHealth` shape 1:1, incl. `p95DeliveryMs` (a
- * never-attempted install reads as healthy/zeroed) — no mapper needed, unlike
- * `Delivery` below.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const health = await store.getInstallHealth(auth.install.installId);
-  return withRequestId(json(health), context);
-}

package/apps/storefront/src/pages/api/apps/v1/inventory.ts

@@ -1,59 +0,0 @@
-/**
- * `GET /api/apps/v1/inventory` — the D3 inventory-availability read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `listInventory`). Requires scope `inventory:read`.
- *
- * No new table: this projects `{sku, available, quantity?, policy?}` off the
- * variants embedded in the existing catalog read model
- * (`../../../lib/d1/catalog.js`'s `listAllActiveProducts`) — active products
- * only. A variant with no `sku` is skipped; the contract's `InventoryList`
- * item requires one, and there's nothing to key it by otherwise.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { listAllActiveProducts, fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-interface InventoryItem {
-  sku: string;
-  available: boolean;
-  quantity?: number;
-  policy?: "deny" | "continue";
-}
-
-function toInventoryItem(policy: string | undefined, quantity: number | undefined, sku: string, available: boolean): InventoryItem {
-  return {
-    sku,
-    available,
-    quantity,
-    policy: policy === "deny" || policy === "continue" ? policy : undefined,
-  };
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "inventory:read");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const d1 = await readD1("CATALOG_DB");
-  if (!d1) return withRequestId(json({ error: "catalog not configured", code: "unconfigured" }, 503), context);
-  const db = fromD1(d1);
-
-  const skuFilter = new URL(context.request.url).searchParams.get("sku");
-  const products = await listAllActiveProducts(db);
-
-  const items: InventoryItem[] = [];
-  for (const product of products) {
-    for (const variant of product.variants) {
-      if (!variant.sku) continue;
-      if (skuFilter && variant.sku !== skuFilter) continue;
-      items.push(
-        toInventoryItem(variant.inventory.policy, variant.inventory.quantity, variant.sku, variant.inventory.available),
-      );
-    }
-  }
-
-  return withRequestId(json({ items }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/orders/[id].ts

@@ -1,48 +0,0 @@
-/**
- * `GET /api/apps/v1/orders/{id}` — the D6 minimal single-order read
- * (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s `getOrder`).
- * Requires scope `orders:read:minimal`.
- *
- * `{id}` is tot-foxycart's `externalId` — the same id `listOrders` echoes
- * back as `Order.id`. There's no cross-tenant oracle here: the Foxy partner
- * API key is itself tenant-scoped, so a call can only ever resolve THIS
- * tenant's own orders — an unknown id and a different tenant's id both come
- * back `null` from `FoxyOrderClient.getOrder` and are reported identically
- * as 404.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { toContractOrder } from "@/lib/apps/orders/orderMapper.js";
-import { getFoxyOrderClient } from "@/lib/apps/orders/foxyOrderClient.js";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "orders:read:minimal");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const id = context.params.id;
-  if (!id) return withRequestId(json({ error: "missing order id", code: "bad_request" }, 400), context);
-
-  let client;
-  try {
-    client = await getFoxyOrderClient();
-  } catch {
-    return withRequestId(json({ error: "orders not configured", code: "unconfigured" }, 503), context);
-  }
-
-  let foxyOrder;
-  try {
-    foxyOrder = await client.getOrder(auth.install.tenantId, id);
-  } catch {
-    return withRequestId(json({ error: "failed to read order", code: "upstream_error" }, 502), context);
-  }
-  if (!foxyOrder) return withRequestId(json({ error: "order not found", code: "not_found" }, 404), context);
-
-  const order = await toContractOrder(foxyOrder, {
-    tenantId: auth.install.tenantId,
-    installId: auth.install.installId,
-  });
-  return withRequestId(json(order), context);
-}

package/apps/storefront/src/pages/api/apps/v1/orders.ts

@@ -1,73 +0,0 @@
-/**
- * `GET /api/apps/v1/orders` — the D6 minimal order list (PrivateApps epic;
- * `docs/private-apps/contract/openapi.yaml`'s `listOrders`). Requires scope
- * `orders:read:minimal`.
- *
- * Reads live from tot-foxycart via `FoxyOrderClient` (never a raw fetch) and
- * maps every row through `orderMapper.ts`'s `toContractOrder` — nothing
- * beyond the contract's minimized `Order` shape (customer as opaque hash, no
- * checkout/tax/signed-cart internals) ever leaves this route. Fail-closed:
- * an unconfigured Foxy client is a 503, any upstream read failure is a clean
- * 502 — neither leaks Foxy's own error detail.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { toContractOrder, type ContractOrderStatus } from "@/lib/apps/orders/orderMapper.js";
-import { getFoxyOrderClient } from "@/lib/apps/orders/foxyOrderClient.js";
-
-export const prerender = false;
-
-const DEFAULT_PAGE_SIZE = 24;
-const MAX_PAGE_SIZE = 100;
-const ORDER_STATUSES: readonly ContractOrderStatus[] = ["created", "fulfilled", "cancelled"];
-
-function parsePage(raw: string | null, fallback: number): number {
-  const n = raw != null ? Number(raw) : NaN;
-  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : fallback;
-}
-
-function parseStatus(raw: string | null): ContractOrderStatus | undefined {
-  return raw != null && (ORDER_STATUSES as readonly string[]).includes(raw) ? (raw as ContractOrderStatus) : undefined;
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "orders:read:minimal");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const url = new URL(context.request.url);
-  const page = parsePage(url.searchParams.get("page"), 1);
-  const pageSize = Math.min(
-    MAX_PAGE_SIZE,
-    Math.max(1, parsePage(url.searchParams.get("pageSize"), DEFAULT_PAGE_SIZE)),
-  );
-  const statusFilter = parseStatus(url.searchParams.get("status"));
-
-  let client;
-  try {
-    client = await getFoxyOrderClient();
-  } catch {
-    return withRequestId(json({ error: "orders not configured", code: "unconfigured" }, 503), context);
-  }
-
-  let foxyPage;
-  try {
-    foxyPage = await client.listOrders(auth.install.tenantId, {
-      limit: pageSize,
-      offset: (page - 1) * pageSize,
-    });
-  } catch {
-    return withRequestId(json({ error: "failed to read orders", code: "upstream_error" }, 502), context);
-  }
-
-  const mapCtx = { tenantId: auth.install.tenantId, installId: auth.install.installId };
-  let orders = await Promise.all(foxyPage.orders.map((order) => toContractOrder(order, mapCtx)));
-  // tot-foxycart's own `status` query param speaks Foxy's status vocabulary, not
-  // the contract's created|fulfilled|cancelled enum — there's no confirmed
-  // mapping to push this filter upstream, so it's applied post-map here. This
-  // can leave a page short of `pageSize`, and `total` still reflects Foxy's
-  // UNFILTERED count — a known gap, flagged rather than built around.
-  if (statusFilter) orders = orders.filter((order) => order.status === statusFilter);
-
-  return withRequestId(json({ orders, page, pageSize, total: foxyPage.total }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/reports.ts

@@ -1,21 +0,0 @@
-/**
- * `GET /api/apps/v1/reports` — the D3 report-snapshot list (PrivateApps
- * epic; `docs/private-apps/contract/openapi.yaml`'s `listReports`). Requires
- * scope `reports:read`.
- *
- * Real auth + scope enforcement, empty data: this milestone ships the
- * endpoint's contract shape (a valid `ReportList`) with no report snapshots
- * behind it yet — there is no report-generation pipeline to read from.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-
-export const prerender = false;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, "reports:read");
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  return withRequestId(json({ reports: [] }), context);
-}

package/apps/storefront/src/pages/api/apps/v1/webhooks/deliveries/[deliveryId]/replay.ts

@@ -1,74 +0,0 @@
-/**
- * `POST /api/apps/v1/webhooks/deliveries/{deliveryId}/replay` — the D4
- * install-owned replay (PrivateApps epic; `docs/private-apps/contract/
- * openapi.yaml`'s `replayWebhookDelivery`). Authorized by install ownership,
- * not a scope (`x-requiredScope: null`, `x-authorization: install-owns-
- * delivery`): an app may replay only a delivery it owns.
- *
- * Preserves the SAME `deliveryId` (the CloudEvents wire id) throughout — a
- * receiver that already acked a `delivered` delivery still dedupes a
- * replayed resend of it — via `deliveryStore.ts`'s `requeueForReplay`, which
- * resets the row (incl. out of the `delivered`/`dead-lettered` terminal
- * states) to `pending` with a fresh attempt budget so the dispatcher's
- * `attemptDelivery` makes a real HTTP attempt instead of hitting its
- * terminal-state no-op branch. See `requeueForReplay`'s own doc comment for
- * the full rationale.
- *
- * No `Idempotency-Key` ledger exists yet (no table backs it), so this only
- * validates the header's presence, per the contract's `required: true` — it
- * does not yet detect/409 a reused key with a mismatched body (there is no
- * request body on this operation to hash in the first place).
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
-import { toContractDelivery } from "@/lib/webhooks/deliveryMapper.js";
-import { getDispatcher } from "@/lib/webhooks/getDispatcher.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  if (!context.request.headers.get("idempotency-key")) {
-    return withRequestId(json({ error: "Idempotency-Key header is required" }, 400), context);
-  }
-
-  const deliveryId = context.params.deliveryId;
-  if (!deliveryId) {
-    return withRequestId(json({ error: "deliveryId is required", code: "not_found" }, 404), context);
-  }
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const delivery = await store.getDelivery(deliveryId);
-  if (!delivery || delivery.installId !== auth.install.installId) {
-    return withRequestId(json({ error: "Delivery not found.", code: "not_found" }, 404), context);
-  }
-
-  const dispatcher = await getDispatcher();
-  if (dispatcher instanceof Response) return withRequestId(dispatcher, context);
-
-  const requeued = await store.requeueForReplay(deliveryId);
-  await dispatcher.enqueue({ deliveryId });
-
-  // D11: the app-facing (install-owned, app-JWT authed) replay — the `agent` cohort. Same
-  // catalog key as the admin console call site; `surface: "v1"` disambiguates. installId
-  // is an opaque per-install handle; deliveryId is the opaque CloudEvents wire id.
-  recordActivity({
-    action: "webhook.delivery.replayed",
-    actor: { kind: "agent", id: auth.install.installId },
-    source: "server",
-    outcome: { status: "succeeded" },
-    scope: { tenantId: auth.install.tenantId },
-    payload: { args: { deliveryId, surface: "v1" } },
-  });
-  return withRequestId(json(toContractDelivery(requeued), 202), context);
-}

package/apps/storefront/src/pages/api/apps/v1/webhooks/deliveries.ts

@@ -1,47 +0,0 @@
-/**
- * `GET /api/apps/v1/webhooks/deliveries` — the D4 install-owned delivery
- * list (PrivateApps epic; `docs/private-apps/contract/openapi.yaml`'s
- * `listWebhookDeliveries`). Authorized by install ownership, not a scope
- * (`x-requiredScope: null`, `x-authorization: install-owns-delivery`): any
- * installed app may list ITS OWN delivery records, never another install's —
- * `listDeliveriesByInstall` is scoped to `auth.install.installId` from the
- * JWT, never a caller-supplied id.
- *
- * Delivery rows never carry a payload body (see `deliveryStore.ts`'s header),
- * so there is nothing sensitive to redact in `toContractDelivery`'s output.
- */
-import type { APIContext } from "astro";
-import { authorizeAppRequest } from "@/lib/apps/apiAuth.js";
-import { json, withRequestId } from "@/lib/apps/apiRoute.js";
-import { WebhookDeliveryStore, type DeliveryState } from "@/lib/webhooks/deliveryStore.js";
-import { toContractDelivery } from "@/lib/webhooks/deliveryMapper.js";
-import { fromD1 } from "@/lib/d1/catalog.js";
-import { readD1 } from "@/lib/env";
-
-export const prerender = false;
-
-const DELIVERY_STATES: readonly DeliveryState[] = ["pending", "retrying", "delivered", "dead-lettered"];
-
-/** Absent = no filter (`undefined`); an unrecognized value is a 400, not a silent no-op. */
-function parseStateFilter(raw: string | null): DeliveryState | undefined | "invalid" {
-  if (raw === null) return undefined;
-  return (DELIVERY_STATES as readonly string[]).includes(raw) ? (raw as DeliveryState) : "invalid";
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const auth = await authorizeAppRequest(context, null);
-  if (!auth.ok) return withRequestId(auth.response, context);
-
-  const state = parseStateFilter(new URL(context.request.url).searchParams.get("state"));
-  if (state === "invalid") {
-    return withRequestId(json({ error: "invalid state filter", code: "invalid_state_filter" }, 400), context);
-  }
-
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return withRequestId(json({ error: "webhook store not configured", code: "unconfigured" }, 503), context);
-  const store = new WebhookDeliveryStore(fromD1(d1));
-
-  const deliveries = await store.listDeliveriesByInstall(auth.install.installId, { state });
-
-  return withRequestId(json({ deliveries: deliveries.map(toContractDelivery) }), context);
-}

package/apps/storefront/src/pages/api/cache-purge.ts

@@ -1,55 +0,0 @@
-/**
- * POST /api/cache-purge — bump a tenant's edge page-cache version.
- *
- * The ETL load step calls this per tenant after a (re)migration so freshly
- * migrated content is visible immediately, rather than waiting out the page
- * TTL. This closes the loop that HttpToTClient.purgeTenant() (catalog API cache)
- * only half-covered: that purges the data cache; this purges the rendered HTML.
- *
- * Auth: `Authorization: Bearer <CACHE_PURGE_SECRET>`. JSON bodies are exempt from
- * Astro's CSRF origin check, so the server-to-server ETL caller works.
- */
-import type { APIContext } from "astro";
-import { readEnv, readKv } from "@/lib/env";
-import { bumpCacheVersion } from "@/lib/edgeCache";
-import { recordActivity } from "@/lib/activity/recordActivity";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const secret = await readEnv("CACHE_PURGE_SECRET");
-  const auth = context.request.headers.get("authorization");
-  if (!secret || auth !== `Bearer ${secret}`) {
-    return new Response("Unauthorized", { status: 401 });
-  }
-
-  const kv = await readKv("TENANT_CACHE");
-  if (!kv) {
-    return new Response("No cache store bound", { status: 503 });
-  }
-
-  let tenantId: string | undefined;
-  try {
-    tenantId = ((await context.request.json()) as { tenantId?: string })?.tenantId;
-  } catch {
-    /* fall through to 400 */
-  }
-  if (!tenantId) {
-    return new Response("tenantId required", { status: 400 });
-  }
-
-  const version = await bumpCacheVersion(kv, tenantId);
-  // D11: the caller is the Bearer-secret ETL load step (a machine, no session) — emit as
-  // the `agent` cohort with an opaque handle. Best-effort; never affects the purge.
-  recordActivity({
-    action: "cache.purged",
-    actor: { kind: "agent", id: "storefront" },
-    source: "server",
-    outcome: { status: "succeeded" },
-    scope: { tenantId },
-    payload: { args: { version } },
-  });
-  return new Response(JSON.stringify({ tenantId, version }), {
-    headers: { "content-type": "application/json" },
-  });
-}

package/apps/storefront/src/pages/api/compliance/tamper.ts

@@ -1,88 +0,0 @@
-/**
- * POST /api/compliance/tamper — the server receiver for protected-surface tamper
- * beacons (D-R7, `integration-protected-tamper-recovery`).
- *
- * The browser sentinel restores safe state IN the document and posts a
- * `TamperEvidenceBeacon` here. This route validates it fail-closed, records the
- * durable evidence + operator alert, and — when the beacon is attributable to a
- * single active install — SUSPENDS that install. It is a DETECTIVE control: the
- * suspension is after-the-fact recovery, never prevention.
- *
- * TENANT SCOPE is server-owned: the install lookup and suspend are ALWAYS keyed on
- * `locals.tenant` (middleware-resolved from the request host), never on the
- * body-supplied `tenant` — a page cannot ask to suspend another tenant's app. The
- * beacon body carries no secret (the contract rejects one), and the response is a
- * write-path ack the emitter ignores, so a failed post never breaks the page.
- */
-import type { APIContext } from "astro";
-import { getRegistryService, json } from "@/lib/apps/adminService.js";
-import type { AppInstall } from "@/lib/apps/registryService.js";
-import { RegistryError } from "@/lib/apps/registryService.js";
-import { planTamperRecovery, type AttributableInstall } from "@tot/public-runtime";
-
-export const prerender = false;
-
-const SYSTEM_ACTOR = "system:tamper-sentinel";
-
-function toAttributable(install: AppInstall): AttributableInstall {
-  return {
-    installId: install.installId,
-    appId: install.appId,
-    appVersion: install.appVersion,
-    status: install.status,
-  };
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const tenantId = context.locals.tenant?.tenant_id;
-  // No resolved tenant ⇒ nothing third-party could be scoped to; accept-and-drop so
-  // the emitter never errors or retries.
-  if (!tenantId) return json({ ok: true, accepted: false }, 202);
-
-  let body: unknown;
-  try {
-    body = await context.request.json();
-  } catch {
-    return json({ ok: false, error: "invalid JSON body" }, 400);
-  }
-
-  // Resolve the tenant's installs (empty when the registry binding isn't configured
-  // in this runtime — the beacon is still validated + recorded, just not actioned).
-  const registry = await getRegistryService();
-  const installs: AttributableInstall[] =
-    registry instanceof Response
-      ? []
-      : (await registry.listByTenant(tenantId)).map(toAttributable);
-
-  const plan = planTamperRecovery(body, installs, {
-    recordId: crypto.randomUUID(),
-    receivedAt: new Date().toISOString(),
-  });
-  if (!plan.ok) return json({ ok: false, error: "invalid tamper beacon" }, 400);
-
-  const { record, suspend } = plan.plan;
-  // Durable, secret-free evidence line for operations. The beacon itself is the record.
-  // eslint-disable-next-line no-console
-  console.warn(
-    `[tamper] tenant=${tenantId} record=${record.recordId} surface=${record.beacon.surface} kind=${record.beacon.kind} recovered=${record.beacon.recovered} app=${record.beacon.attribution?.appId ?? "unattributable"}`,
-  );
-
-  let suspended = false;
-  if (suspend && !(registry instanceof Response)) {
-    try {
-      await registry.suspend(suspend.installId, SYSTEM_ACTOR);
-      suspended = true;
-    } catch (err) {
-      // An already-suspended/uninstalled install (invalid_state) is a benign
-      // no-op under rapid re-mutation; anything else is swallowed so the write
-      // path never errors the emitter. The audit row from a successful suspend is
-      // the durable trail.
-      if (!(err instanceof RegistryError)) {
-        // eslint-disable-next-line no-console
-        console.error(`[tamper] suspend failed for ${suspend.installId}`, err);
-      }
-    }
-  }
-
-  return json({ ok: true, accepted: true, recovered: record.beacon.recovered, suspended }, 202);
-}

package/apps/storefront/src/pages/api/content-edit/ai-edit.ts

@@ -1,164 +0,0 @@
-/**
- * POST /api/content-edit/ai-edit — the `/dev` page's "Build with Claude" live loop
- * (WS5 G4 + decision draft-overlay-same-origin). A prompt becomes a reviewable
- * per-file diff via tot-mcp's `content_edit` tool, applied to the signed-in
- * developer's OWN tenant content — and materialized into their private DRAFT
- * overlay so the /dev live preview shows the change instantly (visible AND
- * interactive), while live/test channels and every other viewer are untouched.
- *
- * AUTH: `/dev`'s own signed-in-viewer session (`readViewerSession`) is the
- * developer-level gate; the MCP call authenticates as the storefront's own
- * TENANT-OPERATOR credential (`getContentEditClient` — the same
- * credential_validate path `/api/changes/accept` uses). The tenant edited is the
- * SESSION'S OWN first membership — never a caller-supplied tenant.
- *
- * DRAFT MATERIALIZATION: content_edit returns unified DIFFS, not contents, so we
- * re-apply each diff to the exact content we sent (applyUnifiedDiff, strict +
- * fail-closed) and write the results to `dev-draft:` KV keys with a TTL, minting
- * the signed tot_dev_draft cookie the middleware's overlay verifies. When KV or
- * the signing secret is absent (e.g. bare `astro dev`), the edit still runs and
- * returns diffs — `applied:false` tells the page the preview won't change.
- */
-import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { getContentEditClient } from "@/lib/content-edit";
-import { applyUnifiedDiff, DiffApplyError } from "@/lib/content-edit/applyDiff";
-import { json } from "@/lib/grants/route.js";
-import { readEnv, readKv } from "@/lib/env";
-// Arbitrary-tenant lookup lives behind the config-layer provider so this handler
-// doesn't import the concrete resolver/static-map directly (tenancy-resolver-fence).
-import { resolvePreviewTenant } from "@/config/previewTenantLookup";
-import { createContentProvider } from "@/lib/storyblok/provider";
-import { readPublishedArtifact, themeArtifactPath } from "@tot/public-runtime";
-import {
-  DEV_DRAFT_COOKIE,
-  DEV_DRAFT_TTL_SECONDS,
-  devDraftKey,
-  signDevDraftToken,
-  verifyDevDraftToken,
-} from "@/lib/dev/devDraft";
-import type { ContentEditFile } from "@/lib/content-edit/types";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const session = await readViewerSession({ cookies: context.cookies });
-  if (!session) return json({ error: "sign in required" }, 401);
-  if (!session.capability || session.capability === "none") {
-    return json({ error: "no developer capability on this account" }, 403);
-  }
-
-  let body: { prompt?: unknown };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
-  if (!prompt) return json({ error: "prompt is required" }, 400);
-
-  // The tenant is the session's OWN store (first membership, else the session's
-  // primary resource) — the same resolution /dev renders with. No caller-supplied
-  // tenant is ever honored here.
-  const wanted = (session.tenants?.[0]?.resource ?? session.resource ?? "").toLowerCase();
-  const tenant = wanted ? await resolvePreviewTenant(wanted) : null;
-  if (!tenant) return json({ error: "no store linked to this account" }, 403);
-
-  const kv = await readKv("TENANT_CACHE");
-  const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
-  const secret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-  const nowSeconds = Math.floor(Date.now() / 1000);
-
-  // Reuse the caller's existing draft (so successive edits stack) or start a new one.
-  const priorCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
-  const priorClaims =
-    priorCookie && secret ? await verifyDevDraftToken(secret, priorCookie, nowSeconds) : null;
-  const draftId =
-    priorClaims?.tenantId === tenant.tenant_id ? priorClaims.draftId : crypto.randomUUID();
-
-  // Current content = the developer's draft when present, else what actually serves
-  // (published overlay → build-time), so edits stack and always start from reality.
-  const provider = createContentProvider(tenant, kv ? { get: kvGet, env: "live" } : undefined);
-  const draftHome = await kvGet(devDraftKey(tenant.tenant_id, draftId, "content/home.html"));
-  const homeHtml = draftHome ?? (await provider.getHomeHtml());
-  const draftTheme = await kvGet(devDraftKey(tenant.tenant_id, draftId, "theme.json"));
-  const themeJson =
-    draftTheme ??
-    (await readPublishedArtifact(kvGet, tenant.tenant_id, "live", themeArtifactPath(tenant.tenant_id))) ??
-    JSON.stringify(tenant.theme_tokens ?? {}, null, 2);
-
-  // content_edit's allowlist: home document + theme. A block-based tenant with no raw
-  // home.html still gets theme edits (themeStyle drives its pages).
-  const files: ContentEditFile[] = [];
-  if (homeHtml) files.push({ path: "content/home.html", content: homeHtml });
-  files.push({ path: "theme.json", content: themeJson });
-
-  const client = await getContentEditClient();
-  if (client instanceof Response) return client;
-
-  let result;
-  try {
-    result = await client.editContent(prompt, files);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return json({ ok: false, error: message }, 502);
-  }
-
-  // Materialize the draft: re-apply each returned diff to the exact content we sent.
-  // Strict + fail-closed per file — a bad diff writes nothing for that file. Theme
-  // must still parse as JSON before it may land (a broken draft theme would degrade
-  // the whole preview).
-  const sent = new Map(files.map((f) => [f.path, f.content]));
-  const appliedPaths: string[] = [];
-  const canApply = !!kv && !!secret;
-  if (canApply) {
-    for (const d of result.diffs ?? []) {
-      const base = sent.get(d.path);
-      if (base == null) continue; // never write a path we didn't offer
-      let next: string;
-      try {
-        next = applyUnifiedDiff(base, d.diff);
-      } catch (err) {
-        if (err instanceof DiffApplyError) continue;
-        throw err;
-      }
-      if (next === base) continue;
-      if (d.path === "theme.json") {
-        try {
-          JSON.parse(next);
-        } catch {
-          continue;
-        }
-      }
-      await kv!.put(devDraftKey(tenant.tenant_id, draftId, d.path), next, {
-        expirationTtl: DEV_DRAFT_TTL_SECONDS,
-      });
-      appliedPaths.push(d.path);
-    }
-    if (appliedPaths.length > 0) {
-      // (Re)issue the signed draft cookie so the middleware overlay serves this draft.
-      const token = await signDevDraftToken(
-        secret!,
-        tenant.tenant_id,
-        draftId,
-        DEV_DRAFT_TTL_SECONDS,
-        nowSeconds,
-      );
-      context.cookies.set(DEV_DRAFT_COOKIE, token, {
-        httpOnly: true,
-        secure: true,
-        sameSite: "lax",
-        path: "/",
-        maxAge: DEV_DRAFT_TTL_SECONDS,
-      });
-    }
-  }
-
-  return json({
-    ok: true,
-    ...result,
-    // True when the draft landed and the live preview will show it on reload.
-    applied: appliedPaths.length > 0,
-    appliedPaths,
-  });
-}