@tokenoftrust/storefront-runner 2.0.3 → 2.0.4

package/apps/storefront/src/lib/content-edit/client.ts

@@ -1,286 +0,0 @@
-/**
- * JsonRpcContentEditClient — the storefront's server-to-server caller for
- * tot-mcp's `content_edit` tool (the inline-AI edit loop, WS5 G1). Mirrors
- * {@link JsonRpcChangeClient} exactly (same transport, same session-validation,
- * same tool-result unwrap, same typed errors) — reusing the forge seam's
- * exported transport + error types so there is ONE wire contract, not two.
- *
- * AUTH SHAPE (Option A, `content-edit-machine-identity` — mirrors change/B3):
- * the storefront backend calls `content_edit` with the SAME machine-identity
- * APP token the change/forge clients use — a `client_credentials` +
- * `private_key_jwt` token minted against the MCP's OAuth token endpoint via
- * {@link AppTokenProvider}, attached as Bearer at `initialize` and on every
- * request by {@link FetchTransport} — NOT the retired `credential_validate`
- * handshake and NOT a human `TOT_ACCESS_TOKEN`. Developer-level authorization
- * is, and remains, the caller's job: `/dev`'s own `readViewerSession()` +
- * capability check (BEFORE this client is ever constructed) derives the
- * tenant from the signed-in developer's OWN session, never from a
- * caller-supplied value — tenant isolation is enforced there, unaffected by
- * this change. This client only proves "a legitimate storefront backend
- * (machine identity) is asking", the same trust boundary
- * `/api/changes/accept` already relies on post-B3.
- */
-import {
-  FetchTransport,
-  ForgeAuthError,
-  ForgeConfigError,
-  ForgeTransportError,
-  SESSION_HEADER,
-  AppTokenProvider,
-  deriveMcpOauthEndpoints,
-  type McpTransport,
-  type JsonRpcRequest,
-  type TotCredentials,
-  type TransportResponse,
-  type BearerProvider,
-} from "@/lib/forge";
-import { mapForgeError } from "@/lib/forge/errors.js";
-import { readEnv } from "@/lib/env";
-import type { ContentEditFile, ContentEditResult } from "./types.js";
-
-export const CONTENT_EDIT_TOOL = {
-  /**
-   * Session-validation tool for the NON-OAuth (api-key/secret) construction —
-   * kept ONLY for backward-compatible test-transport injection (no
-   * bearerProvider). The deployed path never calls this — see the module
-   * header.
-   */
-  validate: "credential_validate",
-  edit: "content_edit",
-} as const;
-
-export { SESSION_HEADER } from "@/lib/forge";
-
-// --- MCP tool-result envelope (mirrors the change client) -------------------
-
-interface McpToolResult {
-  content?: Array<{ type?: string; text?: string }>;
-  structuredContent?: unknown;
-  isError?: boolean;
-}
-
-function parseTextContent(content: McpToolResult["content"]): unknown {
-  const text = content?.find((c) => c.type === "text" || c.text != null)?.text;
-  if (text == null) return undefined;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-
-function unwrapToolResult<T>(result: unknown): T {
-  const env = (result ?? {}) as McpToolResult;
-  const payload =
-    env.structuredContent !== undefined
-      ? env.structuredContent
-      : parseTextContent(env.content);
-
-  if (env.isError) {
-    const p = (payload ?? {}) as Record<string, unknown>;
-    throw mapForgeError({
-      code: typeof p.code === "number" ? p.code : undefined,
-      message: typeof p.message === "string" ? p.message : "content_edit tool error",
-      data: (p.data as Record<string, unknown>) ?? p,
-    });
-  }
-  return payload as T;
-}
-
-// --- Config -------------------------------------------------------------
-
-export interface JsonRpcContentEditClientConfig {
-  /** MCP base URL (the `POST /mcp` endpoint). */
-  baseUrl: string;
-  /** Storefront's ToT credentials for the legacy `credential_validate` path. */
-  credentials: TotCredentials;
-  /** Transport override (defaults to fetch). Injected by tests. */
-  transport?: McpTransport;
-  /**
-   * Machine-identity app-token source (mirrors forge's B2 / change's B3,
-   * binding `c0-forge-auth-supersede`). When present, the client
-   * authenticates PURELY via a `client_credentials` + `private_key_jwt` app
-   * token — attached as Bearer at `initialize` and on every request by
-   * {@link FetchTransport}, re-minted on expiry/401 — and NEVER calls the
-   * retired `credential_validate` handshake. Built by
-   * {@link createContentEditClient} from `MCP_BASE_URL`; tests may inject
-   * their own {@link BearerProvider}.
-   */
-  bearerProvider?: BearerProvider;
-}
-
-// --- The client -----------------------------------------------------------
-
-export class JsonRpcContentEditClient {
-  private readonly baseUrl: string;
-  private readonly credentials: TotCredentials;
-  private readonly transport: McpTransport;
-  private nextId = 1;
-  /** Cached session validation — validate once, reuse (lazily). */
-  private sessionPromise?: Promise<string | undefined>;
-  /** True when a machine-identity app token authenticates the session (mirrors forge B2 / change B3). */
-  private readonly usesServiceAuth: boolean;
-
-  constructor(config: JsonRpcContentEditClientConfig) {
-    if (!config.baseUrl) {
-      throw new ForgeConfigError("content-edit: MCP_BASE_URL is not configured");
-    }
-    if (!config.credentials?.apiKey) {
-      throw new ForgeConfigError(
-        "content-edit: storefront ToT credentials are not configured",
-      );
-    }
-    this.baseUrl = config.baseUrl;
-    this.credentials = config.credentials;
-    this.usesServiceAuth = config.bearerProvider != null;
-    this.transport =
-      config.transport ?? new FetchTransport(config.baseUrl, config.bearerProvider);
-  }
-
-  async editContent(
-    prompt: string,
-    files: readonly ContentEditFile[],
-  ): Promise<ContentEditResult> {
-    const sessionId = await this.ensureSession();
-    const result = await this.rpc(
-      "tools/call",
-      { name: CONTENT_EDIT_TOOL.edit, arguments: { prompt, files } },
-      sessionId,
-    );
-    return unwrapToolResult<ContentEditResult>(result);
-  }
-
-  // --- internals (mirror JsonRpcChangeClient) --------------------------------
-
-  private ensureSession(): Promise<string | undefined> {
-    // Service-auth (mirrors forge B2 / change B3 / binding
-    // `c0-forge-auth-supersede`): the app token is attached as Bearer at the
-    // transport layer (initialize + every request), so the legacy
-    // `credential_validate` round-trip is skipped entirely — it was retired
-    // MCP-side and would now be rejected. FetchTransport still threads the
-    // real `Mcp-Session-Id` the Bearer-authed handshake minted, so a session
-    // id is never needed from here. Without a bearerProvider (e.g. an
-    // injected mock transport in unit tests) the legacy validate path is kept.
-    this.sessionPromise ??= this.usesServiceAuth
-      ? Promise.resolve(undefined)
-      : this.validateSession();
-    return this.sessionPromise;
-  }
-
-  private async validateSession(): Promise<string | undefined> {
-    const args = this.credentialArgs();
-    let res: TransportResponse;
-    try {
-      res = await this.rpcRaw(
-        "tools/call",
-        { name: CONTENT_EDIT_TOOL.validate, arguments: args },
-        undefined,
-      );
-    } catch (err) {
-      this.sessionPromise = undefined; // let a later call retry
-      throw err;
-    }
-    if (res.body.error) {
-      this.sessionPromise = undefined;
-      throw new ForgeAuthError(
-        res.body.error.message ?? "content-edit: credential validation failed",
-      );
-    }
-    try {
-      const validated = unwrapToolResult<{ session?: string; sessionId?: string }>(
-        res.body.result,
-      );
-      return (
-        res.sessionId ?? validated?.session ?? validated?.sessionId ?? undefined
-      );
-    } catch (err) {
-      this.sessionPromise = undefined;
-      throw err instanceof ForgeAuthError
-        ? err
-        : new ForgeAuthError("content-edit: credential validation was rejected", {
-            cause: err,
-          });
-    }
-  }
-
-  /** Build the credential payload; omits absent secrets. Never logged. */
-  private credentialArgs(): Record<string, unknown> {
-    const c = this.credentials;
-    const out: Record<string, unknown> = { apiKey: c.apiKey };
-    if (c.secretKey) out.secretKey = c.secretKey;
-    if (c.accessToken) out.accessToken = c.accessToken;
-    return out;
-  }
-
-  private async rpc(
-    method: string,
-    params: unknown,
-    sessionId: string | undefined,
-  ): Promise<unknown> {
-    const res = await this.rpcRaw(method, params, sessionId);
-    if (res.body.error) throw mapForgeError(res.body.error);
-    return res.body.result;
-  }
-
-  private async rpcRaw(
-    method: string,
-    params: unknown,
-    sessionId: string | undefined,
-  ): Promise<TransportResponse> {
-    const headers: Record<string, string> = {};
-    if (sessionId) headers[SESSION_HEADER] = sessionId;
-    const body: JsonRpcRequest = {
-      jsonrpc: "2.0",
-      id: this.nextId++,
-      method,
-      params,
-    };
-    try {
-      return await this.transport.post({ body, headers });
-    } catch (err) {
-      if (err instanceof ForgeTransportError) throw err;
-      throw new ForgeTransportError(
-        `content-edit: transport failure calling ${method}`,
-        { cause: err },
-      );
-    }
-  }
-}
-
-// --- Factory ----------------------------------------------------------------
-
-/**
- * Build a {@link JsonRpcContentEditClient} from the runtime env — the SAME env
- * the change client reads:
- *   - `MCP_BASE_URL`  — the `POST /mcp` endpoint (its ORIGIN also hosts the OAuth
- *     token endpoint + resource the app token binds to; already `…/storefront`
- *     per B4, so the app token's resource + this RPC endpoint match).
- *   - `TOT_API_KEY` (+ optional `TOT_SECRET_KEY`) — storefront's OWN ToT
- *     credentials (retained for legacy/local paths; the deployed content-edit
- *     session no longer uses them for auth).
- *
- * Machine identity (mirrors forge B2 / change B3 / binding
- * `c0-forge-auth-supersede`): the content-edit session authenticates with a
- * `client_credentials` + `private_key_jwt` APP token minted against the MCP's
- * OAuth token endpoint via {@link AppTokenProvider} — NOT a human
- * `TOT_ACCESS_TOKEN` and NOT a shared secret. `TOT_ACCESS_TOKEN` is
- * deliberately NOT read here.
- *
- * Throws {@link ForgeConfigError} when the base URL or api key is missing.
- * Secrets are read via {@link readEnv} and never logged.
- */
-export async function createContentEditClient(
-  overrides: Partial<JsonRpcContentEditClientConfig> = {},
-): Promise<JsonRpcContentEditClient> {
-  const baseUrl = overrides.baseUrl ?? (await readEnv("MCP_BASE_URL")) ?? "";
-  const credentials =
-    overrides.credentials ??
-    ({
-      apiKey: (await readEnv("TOT_API_KEY")) ?? "",
-      secretKey: await readEnv("TOT_SECRET_KEY"),
-    } satisfies TotCredentials);
-  const bearerProvider =
-    overrides.bearerProvider ??
-    (baseUrl ? new AppTokenProvider(deriveMcpOauthEndpoints(baseUrl)) : undefined);
-  return new JsonRpcContentEditClient({ ...overrides, baseUrl, credentials, bearerProvider });
-}

package/apps/storefront/src/lib/content-edit/index.ts

@@ -1,14 +0,0 @@
-/**
- * content_edit integration — public barrel. Import the typed client and its
- * route helper from here (`@/lib/content-edit`) so call sites never reach into
- * individual files.
- */
-export type { ContentEditFile, ContentEditFileDiff, ContentEditResult } from "./types.js";
-export {
-  JsonRpcContentEditClient,
-  createContentEditClient,
-  CONTENT_EDIT_TOOL,
-  SESSION_HEADER,
-} from "./client.js";
-export type { JsonRpcContentEditClientConfig } from "./client.js";
-export { getContentEditClient } from "./route.js";

package/apps/storefront/src/lib/content-edit/route.ts

@@ -1,25 +0,0 @@
-/**
- * Route helper for `/api/content-edit/ai-edit` — mirrors `@/lib/change/route/route.ts`'s
- * `getChangeClient`: build the env-configured client, or a 503 Response when
- * the MCP integration isn't configured (missing `MCP_BASE_URL`/credentials).
- */
-import { ForgeError } from "@/lib/forge";
-import { createContentEditClient } from "./client.js";
-import { json } from "@/lib/grants/route.js";
-
-/**
- * Build a content-edit client over the real MCP from env, or return a 503
- * Response when the integration is not configured. Never leaks secret values.
- */
-export async function getContentEditClient(): Promise<
-  Awaited<ReturnType<typeof createContentEditClient>> | Response
-> {
-  try {
-    return await createContentEditClient();
-  } catch (err) {
-    if (err instanceof ForgeError && err.kind === "config") {
-      return json({ error: "content_edit integration not configured" }, 503);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/lib/content-edit/types.ts

@@ -1,19 +0,0 @@
-/** Wire shape for tot-mcp's `content_edit` tool — mirrors tot-mcp's own
- * ContentFile/ContentFileDiff/ContentEditResult (src/services/content-editor.ts). */
-
-export interface ContentEditFile {
-  /** e.g. "content/home.html" or "theme.json" — content_edit's own allowlist. */
-  path: string;
-  content: string;
-}
-
-export interface ContentEditFileDiff {
-  path: string;
-  /** Unified diff (`--- a/<path>` / `+++ b/<path>`) against the given content. */
-  diff: string;
-}
-
-export interface ContentEditResult {
-  diffs: ContentEditFileDiff[];
-  summary: string;
-}

package/apps/storefront/src/pages/api/content-edit/ai-edit.ts

@@ -1,164 +0,0 @@
-/**
- * POST /api/content-edit/ai-edit — the `/dev` page's "Build with Claude" live loop
- * (WS5 G4 + decision draft-overlay-same-origin). A prompt becomes a reviewable
- * per-file diff via tot-mcp's `content_edit` tool, applied to the signed-in
- * developer's OWN tenant content — and materialized into their private DRAFT
- * overlay so the /dev live preview shows the change instantly (visible AND
- * interactive), while live/test channels and every other viewer are untouched.
- *
- * AUTH: `/dev`'s own signed-in-viewer session (`readViewerSession`) is the
- * developer-level gate; the MCP call authenticates as the storefront's own
- * TENANT-OPERATOR credential (`getContentEditClient` — the same
- * credential_validate path `/api/changes/accept` uses). The tenant edited is the
- * SESSION'S OWN first membership — never a caller-supplied tenant.
- *
- * DRAFT MATERIALIZATION: content_edit returns unified DIFFS, not contents, so we
- * re-apply each diff to the exact content we sent (applyUnifiedDiff, strict +
- * fail-closed) and write the results to `dev-draft:` KV keys with a TTL, minting
- * the signed tot_dev_draft cookie the middleware's overlay verifies. When KV or
- * the signing secret is absent (e.g. bare `astro dev`), the edit still runs and
- * returns diffs — `applied:false` tells the page the preview won't change.
- */
-import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { getContentEditClient } from "@/lib/content-edit";
-import { applyUnifiedDiff, DiffApplyError } from "@/lib/content-edit/applyDiff";
-import { json } from "@/lib/grants/route.js";
-import { readEnv, readKv } from "@/lib/env";
-// Arbitrary-tenant lookup lives behind the config-layer provider so this handler
-// doesn't import the concrete resolver/static-map directly (tenancy-resolver-fence).
-import { resolvePreviewTenant } from "@/config/previewTenantLookup";
-import { createContentProvider } from "@/lib/storyblok/provider";
-import { readPublishedArtifact, themeArtifactPath } from "@tot/public-runtime";
-import {
-  DEV_DRAFT_COOKIE,
-  DEV_DRAFT_TTL_SECONDS,
-  devDraftKey,
-  signDevDraftToken,
-  verifyDevDraftToken,
-} from "@/lib/dev/devDraft";
-import type { ContentEditFile } from "@/lib/content-edit/types";
-
-export const prerender = false;
-
-export async function POST(context: APIContext): Promise<Response> {
-  const session = await readViewerSession({ cookies: context.cookies });
-  if (!session) return json({ error: "sign in required" }, 401);
-  if (!session.capability || session.capability === "none") {
-    return json({ error: "no developer capability on this account" }, 403);
-  }
-
-  let body: { prompt?: unknown };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
-  if (!prompt) return json({ error: "prompt is required" }, 400);
-
-  // The tenant is the session's OWN store (first membership, else the session's
-  // primary resource) — the same resolution /dev renders with. No caller-supplied
-  // tenant is ever honored here.
-  const wanted = (session.tenants?.[0]?.resource ?? session.resource ?? "").toLowerCase();
-  const tenant = wanted ? await resolvePreviewTenant(wanted) : null;
-  if (!tenant) return json({ error: "no store linked to this account" }, 403);
-
-  const kv = await readKv("TENANT_CACHE");
-  const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
-  const secret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-  const nowSeconds = Math.floor(Date.now() / 1000);
-
-  // Reuse the caller's existing draft (so successive edits stack) or start a new one.
-  const priorCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
-  const priorClaims =
-    priorCookie && secret ? await verifyDevDraftToken(secret, priorCookie, nowSeconds) : null;
-  const draftId =
-    priorClaims?.tenantId === tenant.tenant_id ? priorClaims.draftId : crypto.randomUUID();
-
-  // Current content = the developer's draft when present, else what actually serves
-  // (published overlay → build-time), so edits stack and always start from reality.
-  const provider = createContentProvider(tenant, kv ? { get: kvGet, env: "live" } : undefined);
-  const draftHome = await kvGet(devDraftKey(tenant.tenant_id, draftId, "content/home.html"));
-  const homeHtml = draftHome ?? (await provider.getHomeHtml());
-  const draftTheme = await kvGet(devDraftKey(tenant.tenant_id, draftId, "theme.json"));
-  const themeJson =
-    draftTheme ??
-    (await readPublishedArtifact(kvGet, tenant.tenant_id, "live", themeArtifactPath(tenant.tenant_id))) ??
-    JSON.stringify(tenant.theme_tokens ?? {}, null, 2);
-
-  // content_edit's allowlist: home document + theme. A block-based tenant with no raw
-  // home.html still gets theme edits (themeStyle drives its pages).
-  const files: ContentEditFile[] = [];
-  if (homeHtml) files.push({ path: "content/home.html", content: homeHtml });
-  files.push({ path: "theme.json", content: themeJson });
-
-  const client = await getContentEditClient();
-  if (client instanceof Response) return client;
-
-  let result;
-  try {
-    result = await client.editContent(prompt, files);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return json({ ok: false, error: message }, 502);
-  }
-
-  // Materialize the draft: re-apply each returned diff to the exact content we sent.
-  // Strict + fail-closed per file — a bad diff writes nothing for that file. Theme
-  // must still parse as JSON before it may land (a broken draft theme would degrade
-  // the whole preview).
-  const sent = new Map(files.map((f) => [f.path, f.content]));
-  const appliedPaths: string[] = [];
-  const canApply = !!kv && !!secret;
-  if (canApply) {
-    for (const d of result.diffs ?? []) {
-      const base = sent.get(d.path);
-      if (base == null) continue; // never write a path we didn't offer
-      let next: string;
-      try {
-        next = applyUnifiedDiff(base, d.diff);
-      } catch (err) {
-        if (err instanceof DiffApplyError) continue;
-        throw err;
-      }
-      if (next === base) continue;
-      if (d.path === "theme.json") {
-        try {
-          JSON.parse(next);
-        } catch {
-          continue;
-        }
-      }
-      await kv!.put(devDraftKey(tenant.tenant_id, draftId, d.path), next, {
-        expirationTtl: DEV_DRAFT_TTL_SECONDS,
-      });
-      appliedPaths.push(d.path);
-    }
-    if (appliedPaths.length > 0) {
-      // (Re)issue the signed draft cookie so the middleware overlay serves this draft.
-      const token = await signDevDraftToken(
-        secret!,
-        tenant.tenant_id,
-        draftId,
-        DEV_DRAFT_TTL_SECONDS,
-        nowSeconds,
-      );
-      context.cookies.set(DEV_DRAFT_COOKIE, token, {
-        httpOnly: true,
-        secure: true,
-        sameSite: "lax",
-        path: "/",
-        maxAge: DEV_DRAFT_TTL_SECONDS,
-      });
-    }
-  }
-
-  return json({
-    ok: true,
-    ...result,
-    // True when the draft landed and the live preview will show it on reload.
-    applied: appliedPaths.length > 0,
-    appliedPaths,
-  });
-}