@tokenoftrust/storefront-runner 2.0.3 → 2.0.4

package/apps/storefront/src/lib/shared/invitePreflight.ts

@@ -0,0 +1,123 @@
+/**
+ * Invite preflight — block a developer invite when the target store's repo isn't
+ * provisioned on THIS environment, so a broken connection surfaces to the INVITER
+ * at invite time instead of dead-ending later in the invitee's terminal on
+ * "Repo <owner>-main is not provisioned".
+ *
+ * The check is the MCP's credential-free resource-registry read — the SAME read
+ * `tenant_checkout` gates on — reached the SAME way the app-binding writer +
+ * cli-signin-code seam reach the MCP:
+ *   GET {origin(MCP_APP_BINDING_URL)}/internal/preview-status?tenant=<appDomain>&app=storefront&tag=main
+ *     header  x-mcp-service-secret: <MCP_SERVICE_SHARED_SECRET>
+ *     → 200 { owner, app, repo, provisioned, previewReleased } | 400 | 502
+ * Contract source of truth: tot-mcp src/server/preview-status-routes.ts. We gate on
+ * `provisioned` — the exact precondition `tenant_checkout` needs. We do NOT gate on
+ * `previewReleased`: it is (provisioned && preview-approved), which is FALSE for every
+ * store that hasn't shipped a preview yet — gating on it would block invites for
+ * provisioned-but-unreleased stores whose checkout would actually succeed.
+ *
+ * FAIL-OPEN: we BLOCK only on a DEFINITIVE not-ready answer (a clean 200 with
+ * previewReleased:false). An unconfigured seam (no URL/secret), a non-200, a
+ * transport/parse fault, or a timeout is INCONCLUSIVE → allow (log a warning),
+ * mirroring recordDeveloperAppBinding's "skipped when not-configured" stance — we
+ * never break invites just because the MCP is briefly unreachable.
+ */
+import { readEnv } from "@/lib/env";
+
+/** How long we'll wait on the preview-status read before failing open. */
+const PREFLIGHT_TIMEOUT_MS = 4000;
+
+/** GET transport seam (injectable for tests) — mirrors HttpTransport but read-only. */
+export interface PreflightTransport {
+  get(
+    url: string,
+    headers: Record<string, string>,
+  ): Promise<{ status: number; json(): Promise<unknown> }>;
+}
+
+/** The real transport: a timeout-bounded GET. */
+export class FetchPreflightTransport implements PreflightTransport {
+  async get(url: string, headers: Record<string, string>) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), PREFLIGHT_TIMEOUT_MS);
+    try {
+      const res = await fetch(url, { method: "GET", headers, signal: ctrl.signal });
+      return { status: res.status, json: () => res.json() };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+/** BLOCK carries the inviter-facing message; ALLOW carries a reason (for logging). */
+export type PreflightDecision =
+  | { block: true; reason: "not-provisioned"; message: string }
+  | { block: false; reason: string };
+
+/** The inviter-facing block message, naming the store. */
+function blockMessage(tenant: string): string {
+  return (
+    `${tenant} isn't set up on this environment yet — its store repo isn't ` +
+    `provisioned. Finish provisioning that store before inviting a developer to it.`
+  );
+}
+
+/**
+ * Preflight `tenant` (the target appDomain). Returns a BLOCK only on a definitive
+ * not-provisioned answer; every inconclusive condition allows (fail-open). Never
+ * throws.
+ */
+export async function checkStorePreviewReady(
+  tenant: string,
+  deps: { transport?: PreflightTransport } = {},
+): Promise<PreflightDecision> {
+  const bindingUrl = await readEnv("MCP_APP_BINDING_URL");
+  const secret = await readEnv("MCP_SERVICE_SHARED_SECRET");
+  if (!bindingUrl || !secret) {
+    // Seam not configured (the MCP route isn't even mounted without the secret) —
+    // inconclusive, so allow rather than break every invite.
+    return { block: false, reason: "not-configured" };
+  }
+
+  let endpoint: string;
+  try {
+    const origin = new URL(bindingUrl).origin;
+    const q = new URLSearchParams({ tenant: tenant.toLowerCase(), app: "storefront", tag: "main" });
+    // Canonical, namespace-neutral path (the read is generic, not dev-role-scoped).
+    endpoint = `${origin}/internal/preview-status?${q.toString()}`;
+  } catch {
+    return { block: false, reason: "bad-mcp-url" };
+  }
+
+  const transport = deps.transport ?? new FetchPreflightTransport();
+  let res: { status: number; json(): Promise<unknown> };
+  try {
+    res = await transport.get(endpoint, { "x-mcp-service-secret": secret });
+  } catch (cause) {
+    return {
+      block: false,
+      reason: "preflight request failed: " + (cause instanceof Error ? cause.message : String(cause)),
+    };
+  }
+
+  // Only a clean 200 is a conclusive answer; anything else is inconclusive → allow.
+  if (res.status < 200 || res.status >= 300) {
+    return { block: false, reason: `preflight returned status ${res.status}` };
+  }
+  let payload: { provisioned?: unknown; previewReleased?: unknown };
+  try {
+    payload = (await res.json()) as typeof payload;
+  } catch {
+    return { block: false, reason: "unparseable preflight response" };
+  }
+  // Gate on `provisioned` — the ONE precondition the invitee's first `tot start`
+  // checkout needs (a missing repo is the austin→sample-store failure). Treat only
+  // an explicit `false` as a definitive block; a missing/non-boolean field is
+  // inconclusive → allow. NOT `previewReleased` (see the file header): that now means
+  // provisioned && preview-approved, which is false for every not-yet-shipped store and
+  // would block invites whose checkout actually succeeds.
+  if (payload.provisioned === false) {
+    return { block: true, reason: "not-provisioned", message: blockMessage(tenant) };
+  }
+  return { block: false, reason: "provisioned" };
+}

package/apps/storefront/src/lib/webhooks/deliveryEngine.ts

@@ -24,8 +24,6 @@
  */
 import { WebhookDeliveryStore, type WebhookDelivery, type WebhookEvent, type WebhookTopic } from "./deliveryStore.js";
 import type { AppInstall } from "../apps/registryService.js";
-import { loadWebhookSigningConfig, type WebhookSigningConfig } from "./webhookSigningKey.js";
-import { signWebhookRequest, type SignWebhookRequestResult } from "./signing.js";
 import { buildCloudEventEnvelope } from "./events.js";
 import { computeBackoffDelaySeconds, MAX_DELIVERY_ATTEMPTS, type AttemptOutcome } from "./dispatcher.js";
 import { validateWebhookEndpoint } from "./endpointGuard.js";
@@ -33,6 +31,28 @@ import { validateWebhookEndpoint } from "./endpointGuard.js";
 /** Bounded per-attempt timeout — a hung receiver must not hold a dispatcher slot open indefinitely. */
 const DEFAULT_TIMEOUT_MS = 10_000;
 
+// Both signing.js and webhookSigningKey.js ultimately re-export from
+// @tokenoftrust/private-apps-devkit, a workspace-only package never vendored
+// into the public storefront-runner — a static import of either (type-only
+// included: `tsc` resolves a module for `import type` too) would be a
+// dangling import in that build. The VALUES are loaded via dynamic import at
+// their call sites below (see attemptDelivery/deliverSigned); these two
+// shapes are duplicated here, type-only, so this module's own types don't
+// need those files to exist in the runner. Keep in sync with
+// webhookSigningKey.ts's WebhookSigningConfig and
+// private-apps-devkit/src/signing.ts's SignWebhookRequestResult.
+interface WebhookSigningConfig {
+  key: CryptoKey;
+  kid: string;
+}
+interface SignWebhookRequestResult {
+  headers: {
+    "content-digest": string;
+    "signature-input": string;
+    signature: string;
+  };
+}
+
 /** The minimal registry seam the engine needs: resolving the target install by id. Satisfied by `AppRegistryService`. */
 export interface InstallResolver {
   get(installId: string): Promise<AppInstall | null>;
@@ -83,7 +103,17 @@ export async function attemptDelivery(deliveryId: string, deps: AttemptDeliveryD
   const now = deps.now ?? (() => new Date());
   const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const loadSigningConfig = deps.loadSigningConfig ?? loadWebhookSigningConfig;
+  const loadSigningConfig =
+    deps.loadSigningConfig ??
+    (async () => {
+      // Absent from the public storefront-runner (dropped; see WebhookSigningConfig above).
+      // ts-ignore, not ts-expect-error: this module DOES exist in the full repo's own
+      // typecheck (only missing from the runner-extracted tree), so there's no error to
+      // "expect" here in that context — ts-expect-error would itself error as unused.
+      // @ts-ignore
+      const mod = await import("./webhookSigningKey.js");
+      return mod.loadWebhookSigningConfig() as Promise<WebhookSigningConfig>;
+    });
 
   const delivery = await store.getDelivery(deliveryId);
   if (!delivery) {
@@ -172,7 +202,11 @@ async function deliverSigned(
     now: ctx.now,
   });
   const body = JSON.stringify(envelope);
-  const { headers } = await signWebhookRequest({
+  // Absent from the public storefront-runner (dropped; see SignWebhookRequestResult above);
+  // ts-ignore not ts-expect-error, same reasoning as loadSigningConfig above.
+  // @ts-ignore
+  const { signWebhookRequest } = await import("./signing.js");
+  const { headers }: SignWebhookRequestResult = await signWebhookRequest({
     method: "POST",
     url: install.webhookEndpoint!,
     body,

package/apps/storefront/src/lib/webhooks/emit.ts

@@ -48,7 +48,7 @@
 import { WebhookDeliveryStore, type WebhookTopic } from "./deliveryStore.js";
 import { TOPIC_REQUIRED_SCOPE } from "./events.js";
 import { getDispatcher } from "./getDispatcher.js";
-import { getRegistryService } from "../apps/adminService.js";
+import { getRegistryService } from "../apps/registryAccess.js";
 import type { AppInstall } from "../apps/registryService.js";
 import { fromD1 } from "../d1/catalog.js";
 import { readD1 } from "../env.js";

package/apps/storefront/src/lib/webhooks/getDispatcher.ts

@@ -21,7 +21,7 @@ import { CloudflareQueueDispatcher, type CloudflareQueueSender } from "./cloudfl
 import { AppRegistryService } from "../apps/registryService.js";
 import { D1CredentialStore } from "../apps/credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "../apps/gatewayKeys.js";
-import { json } from "../apps/adminService.js";
+import { json } from "../apps/registryAccess.js";
 import { fromD1 } from "../d1/catalog.js";
 import { readD1, readEnv, readQueue } from "../env.js";
 

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -25,7 +25,7 @@ import {
 } from "@/lib/auth/identityToken";
 import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
 import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { acceptDeveloperInvite } from "@/lib/grants/developerInvites";
+import { acceptDeveloperInvite } from "@/lib/shared/developerInvites";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/index.astro

@@ -17,7 +17,7 @@ import TierCards from "@/components/membership/TierCards.astro";
 import { withBase } from "@/lib/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
 import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
-import { getRegistryService } from "@/lib/apps/adminService.js";
+import { getRegistryService } from "@/lib/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
 import type { CatalogCollection, CatalogProduct } from "@tot/public-runtime";
 import {

package/apps/storefront/src/pages/products/[handle].astro

@@ -42,7 +42,7 @@ import { productLd, breadcrumbLd, reviewLd } from "@/lib/jsonld";
 import { isUsableImageUrl } from "@/lib/placeholder";
 import { withBase } from "@/lib/basePath";
 import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
-import { getRegistryService } from "@/lib/apps/adminService.js";
+import { getRegistryService } from "@/lib/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
 
 const { handle } = Astro.params;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/node_modules/.bin/tsc

@@ -0,0 +1,43 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+basedir_win="$basedir"
+exe=""
+msys=""
+
+case `uname -a` in
+  *CYGWIN*|*MINGW*|*MSYS*)
+    if command -v cygpath > /dev/null 2>&1; then
+      basedir_win=`cygpath -w "$basedir"`
+    fi
+    exe=".exe"
+    msys="true"
+  ;;
+  *WSL2*)
+    if command -v wslpath > /dev/null 2>&1; then
+      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
+      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
+        basedir_win="$basedir"
+      else
+        exe=".exe"
+      fi
+    fi
+  ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
+  exec "$basedir/node.exe"  "$basedir_win/../typescript/bin/tsc" "$@"
+elif [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../typescript/bin/tsc" "$@"
+elif command -v node >/dev/null 2>&1; then
+  exec node  "$basedir/../typescript/bin/tsc" "$@"
+elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
+  exec node.exe  "$basedir_win/../typescript/bin/tsc" "$@"
+else
+  exec node  "$basedir/../typescript/bin/tsc" "$@"
+fi
+# cmd-shim-target=/home/runner/work/storefront/storefront/storefront-runner-dist/packages/public-runtime/node_modules/typescript/bin/tsc

package/packages/public-runtime/node_modules/.bin/tsserver

@@ -0,0 +1,43 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+basedir_win="$basedir"
+exe=""
+msys=""
+
+case `uname -a` in
+  *CYGWIN*|*MINGW*|*MSYS*)
+    if command -v cygpath > /dev/null 2>&1; then
+      basedir_win=`cygpath -w "$basedir"`
+    fi
+    exe=".exe"
+    msys="true"
+  ;;
+  *WSL2*)
+    if command -v wslpath > /dev/null 2>&1; then
+      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
+      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
+        basedir_win="$basedir"
+      else
+        exe=".exe"
+      fi
+    fi
+  ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
+  exec "$basedir/node.exe"  "$basedir_win/../typescript/bin/tsserver" "$@"
+elif [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../typescript/bin/tsserver" "$@"
+elif command -v node >/dev/null 2>&1; then
+  exec node  "$basedir/../typescript/bin/tsserver" "$@"
+elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
+  exec node.exe  "$basedir_win/../typescript/bin/tsserver" "$@"
+else
+  exec node  "$basedir/../typescript/bin/tsserver" "$@"
+fi
+# cmd-shim-target=/home/runner/work/storefront/storefront/storefront-runner-dist/packages/public-runtime/node_modules/typescript/bin/tsserver

package/packages/public-runtime/node_modules/.bin/vitest

@@ -0,0 +1,43 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+basedir_win="$basedir"
+exe=""
+msys=""
+
+case `uname -a` in
+  *CYGWIN*|*MINGW*|*MSYS*)
+    if command -v cygpath > /dev/null 2>&1; then
+      basedir_win=`cygpath -w "$basedir"`
+    fi
+    exe=".exe"
+    msys="true"
+  ;;
+  *WSL2*)
+    if command -v wslpath > /dev/null 2>&1; then
+      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"
+      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then
+        basedir_win="$basedir"
+      else
+        exe=".exe"
+      fi
+    fi
+  ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/vitest@2.1.8_@types+node@26.4.1_happy-dom@20.13.1_lightningcss@1.33.0/node_modules/vitest/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/vitest@2.1.8_@types+node@26.4.1_happy-dom@20.13.1_lightningcss@1.33.0/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/vitest@2.1.8_@types+node@26.4.1_happy-dom@20.13.1_lightningcss@1.33.0/node_modules/vitest/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/vitest@2.1.8_@types+node@26.4.1_happy-dom@20.13.1_lightningcss@1.33.0/node_modules:/home/runner/work/storefront/storefront/storefront-runner-dist/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -n "$exe" ] && [ -x "$basedir/node.exe" ]; then
+  exec "$basedir/node.exe"  "$basedir_win/../vitest/vitest.mjs" "$@"
+elif [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../vitest/vitest.mjs" "$@"
+elif command -v node >/dev/null 2>&1; then
+  exec node  "$basedir/../vitest/vitest.mjs" "$@"
+elif [ -n "$exe" ] && command -v node.exe >/dev/null 2>&1; then
+  exec node.exe  "$basedir_win/../vitest/vitest.mjs" "$@"
+else
+  exec node  "$basedir/../vitest/vitest.mjs" "$@"
+fi
+# cmd-shim-target=/home/runner/work/storefront/storefront/storefront-runner-dist/packages/public-runtime/node_modules/vitest/vitest.mjs

package/pnpm-workspace.yaml

@@ -1,6 +1,9 @@
 packages:
   - "apps/*"
   - "packages/*"
+allowBuilds:
+  esbuild: set this to true or false
+  workerd: set this to true or false
 linkWorkspacePackages: true
 onlyBuiltDependencies:
   - esbuild

package/apps/storefront/src/lib/apps/adminService.ts

@@ -1,116 +0,0 @@
-/**
- * Composition root + shared helpers for the `/api/apps/admin/*` routes —
- * builds an `AppRegistryService` over the
- * `STOREFRONT_APPS_DB` `Queryable` binding and a `D1CredentialStore`, the same
- * construction `api/apps/oauth/token.ts` uses, and mirrors
- * `../grants/route.ts`'s `getService()` + no-store `json()` + 503-when-
- * unconfigured pattern. Kept out of the pure service module so that stays
- * transport-free and unit-testable against a fake `Queryable`.
- */
-import {
-  AppRegistryService,
-  RegistryError,
-  type AppInstall,
-  type RegistryErrorCode,
-} from "./registryService.js";
-import { D1CredentialStore } from "./credentials.js";
-import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "./gatewayKeys.js";
-import { fromD1 } from "../d1/catalog.js";
-import { readD1, readEnv } from "../env.js";
-import { MANAGE_ROLES, type AdminAuthResult } from "./adminSession.js";
-import { ManagedAnalyticsApiV1Facade } from "./managedAnalyticsService.js";
-
-/**
- * No-store JSON response — install/rotate bodies carry a one-time client
- * secret and must never be edge- or browser-cached.
- */
-export function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", "cache-control": "no-store" },
-  });
-}
-
-/**
- * Build an `AppRegistryService` over the real `STOREFRONT_APPS_DB` D1
- * binding, or return a 503 Response when that binding isn't configured in
- * this runtime. Never leaks binding/secret detail in the response body.
- */
-export async function getRegistryService(): Promise<AppRegistryService | Response> {
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return json({ error: "app registry not configured" }, 503);
-  const db = fromD1(d1);
-  const activeKid = (await readEnv(APP_GATEWAY_KID_ENV)) ?? DEFAULT_APP_GATEWAY_KID;
-  const credentials = new D1CredentialStore(db, activeKid);
-  return new AppRegistryService(db, credentials);
-}
-
-/** Build the managed-analytics v1 service over the same tenant control-plane D1. */
-export async function getManagedAnalyticsService(): Promise<ManagedAnalyticsApiV1Facade | Response> {
-  const d1 = await readD1("STOREFRONT_APPS_DB");
-  if (!d1) return json({ error: "app registry not configured" }, 503);
-  return new ManagedAnalyticsApiV1Facade(fromD1(d1));
-}
-
-/** HTTP status per `RegistryError` code — the one shared fail-closed mapping. */
-const STATUS_BY_REGISTRY_CODE: Record<RegistryErrorCode, number> = {
-  scope_denied: 400,
-  not_found: 404,
-  already_installed: 409,
-  invalid_state: 409,
-  invalid_webhook_endpoint: 400,
-  invalid_widget_placement: 400,
-  unknown_version: 404,
-  invalid_version_facets: 400,
-};
-
-/** Map a `RegistryError` to its HTTP status. Never echoes internals — code + message only. */
-export function registryErrorResponse(err: RegistryError): Response {
-  const body: Record<string, unknown> = { error: err.message, code: err.code };
-  if (err.denials) body.denials = err.denials;
-  return json(body, STATUS_BY_REGISTRY_CODE[err.code]);
-}
-
-/** Parse `{ installId }` from a JSON body — shared by every installId-bearing admin route. */
-export function parseInstallId(body: unknown): string | null {
-  if (!body || typeof body !== "object") return null;
-  const installId = (body as { installId?: unknown }).installId;
-  return typeof installId === "string" && installId.trim() ? installId.trim() : null;
-}
-
-/**
- * Resolve `installId` and verify it belongs to `tenantId` — every mutating
- * admin route (update/suspend/resume/uninstall/rotate) MUST call this BEFORE
- * invoking a service method, since those methods take a bare `installId` with
- * no tenant check of their own. A foreign-tenant
- * `installId` is reported IDENTICALLY to a truly-missing one — 404, same
- * body shape as `RegistryError("not_found")` — so there is no cross-tenant
- * existence oracle.
- */
-export async function requireOwnedInstall(
-  registry: AppRegistryService,
-  installId: string,
-  tenantId: string,
-): Promise<AppInstall | Response> {
-  const install = await registry.get(installId);
-  if (!install || install.tenantId !== tenantId) {
-    return json({ error: "App install not found.", code: "not_found" }, 404);
-  }
-  return install;
-}
-
-/**
- * Gate a mutating admin route on the resolved auth's role — call AFTER
- * `resolveOperatorSession` for every write route (suspend/resume/uninstall/
- * update/rotate/replay). A console session's `role` must be in
- * `MANAGE_ROLES`: a `developer` is read-only and gets a 403 here. The
- * host-bound/Bearer path (`resolveAdminSession`) carries no `role` at all —
- * it is already manage-capable (gated by `ADMIN_CAPABILITIES`/the dedicated
- * secret) — so an `undefined` role is exempt, not denied.
- */
-export function requireManageRole(auth: Extract<AdminAuthResult, { ok: true }>): Response | null {
-  if (auth.role !== undefined && !MANAGE_ROLES.has(auth.role)) {
-    return json({ error: "not authorized to manage apps for this tenant" }, 403);
-  }
-  return null;
-}