@tokenoftrust/storefront-runner 2.2.111 → 2.2.113

package/apps/storefront/public/js/dashboard-team.js

@@ -220,8 +220,8 @@
     }
   }
 
-  function showMsg(kind, text) {
-    const el = $("msg");
+  function showMsg(kind, text, targetId) {
+    const el = $(targetId || "msg");
     el.className = "msg " + kind;
     el.replaceChildren();
     if (typeof text === "string") {
@@ -242,15 +242,21 @@
     btn.className = "secondary";
     btn.textContent = "Provision now?";
     btn.title = "Create the store repo on this environment, then retry the invite";
-    btn.addEventListener("click", () => provisionStore(btn));
+    btn.addEventListener("click", () => provisionStore(btn, { successHint: "Click Send invite again." }));
     wrap.appendChild(line);
     wrap.appendChild(btn);
     showMsg("err", wrap);
   }
 
-  async function provisionStore(btn) {
+  // Shared by the invite dead-end's one-shot "Provision now?" button AND the
+  // persistent "Repair store connection" button below — same idempotent
+  // POST /api/grants/provision-store, which re-asserts the repo AND its webhooks
+  // on every call, even when the repo is already provisioned.
+  async function provisionStore(btn, opts) {
+    opts = opts || {};
+    const targetId = opts.targetId || "msg";
     if (btn) btn.disabled = true;
-    showMsg("", "Provisioning store repo…");
+    showMsg("", opts.pendingMessage || "Provisioning store repo…", targetId);
     try {
       const res = await fetch("/api/grants/provision-store", {
         method: "POST",
@@ -262,14 +268,15 @@
         const created = body.created ? "created" : "already present";
         showMsg(
           "ok",
-          "Store repo " + created + " for " + (body.tenant || tenant) +
-            ". Click Send invite again.",
+          "Store repo " + created + " for " + (body.tenant || tenant) + "." +
+            (opts.successHint ? " " + opts.successHint : ""),
+          targetId,
         );
       } else {
-        showMsg("err", body.error || ("Provision failed (HTTP " + res.status + ")."));
+        showMsg("err", body.error || ("Provision failed (HTTP " + res.status + ")."), targetId);
       }
     } catch (e) {
-      showMsg("err", "Provision failed: " + (e && e.message ? e.message : e));
+      showMsg("err", "Provision failed: " + (e && e.message ? e.message : e), targetId);
     } finally {
       if (btn) btn.disabled = false;
     }
@@ -330,5 +337,20 @@
     inviteBtn.addEventListener("click", invite);
     emailInput.addEventListener("keydown", (e) => { if (e.key === "Enter") invite(); });
   }
+
+  // Persistent repair affordance: the invite dead-end's "Provision now?" button only
+  // ever appears as a 409 reaction, so once a repo is `provisioned: true` that path
+  // can never recur — leaving no self-service way to re-run the same idempotent
+  // repair (e.g. when the repo's registered webhook has drifted). This button is
+  // always available, independent of invite state.
+  const repairBtn = $("repairBtn");
+  if (repairBtn) {
+    repairBtn.addEventListener("click", () => provisionStore(repairBtn, {
+      targetId: "repairMsg",
+      pendingMessage: "Repairing store connection…",
+      successHint: "Webhooks re-synced.",
+    }));
+  }
+
   loadMembers();
 })();

package/apps/storefront/src/middleware/renderChain.ts

@@ -42,6 +42,7 @@ import {
   CSP_REPORT_GROUP,
   CSP_REPORT_PATH,
   readPublishedArtifact,
+  readVersionArtifact,
   themeArtifactPath,
   resolveTenantFeatures,
   resolveCapabilities,
@@ -63,6 +64,7 @@ import {
   resolveNativeGa4SandboxUrl,
 } from "@tot/public-runtime";
 import { readBakedManagedInstalls } from "@/lib/integration/bakedManagedInstalls";
+import { readWithImagePreviewRewriteOverlay } from "@tot/public-runtime/image-preview-rewrite-overlay";
 import type {
   CapabilityConfig,
   ConsentSnapshot,
@@ -451,15 +453,13 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? `${proto}://${host}${basePath}`
     : `https://${tenant.canonicalDomain}`;
 
-  // Apply a published theme override for the resolved environment (store->app).
-  // The live domain serves `live`; a gated preview serves `test`. When nothing
-  // is published the build-time tenant theme is used unchanged.
+  // Apply the theme selected for this render. A candidate route reads its exact
+  // version; an ordinary route resolves the environment's published channel.
   //
-  // Resolution is versioned-aware inside readPublishedArtifact: env maps to a
-  // publish channel (live->live, test->preview); if the tenant has a channel
-  // pointer, the artifact is resolved through the immutable site version
-  // (channel -> versionId -> manifest -> content). Tenants with no channel
-  // pointer fall back to the legacy per-path selection — no behavior change.
+  // readPublishedArtifact maps env to a publish channel (live->live,
+  // test->preview) and resolves it through the immutable site version. A
+  // candidate must bypass that pointer so a reviewer sees the candidate's own
+  // theme, capabilities, and embed opt-in with its content.
   // Request-scoped read memo: every content read resolves the same pointer and
   // version manifest, and a catalog render reads one artifact per catalog file.
   const kvReads = new Map<string, Promise<string | null>>();
@@ -473,6 +473,15 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
         return read;
       }
     : async () => null;
+  const readRuntimeArtifact = (path: string) => candidatePin
+    ? readWithImagePreviewRewriteOverlay(
+        kvGet,
+        tenant.tenant_id,
+        candidatePin.versionId,
+        path,
+        () => readVersionArtifact(kvGet, tenant.tenant_id, candidatePin.versionId, path),
+      )
+    : readPublishedArtifact(kvGet, tenant.tenant_id, customization.env, path);
 
   // Self-heal a DANGLING channel pointer: the pointer for this env's channel may
   // name a version that was never built (or whose manifest was evicted).
@@ -480,7 +489,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // the surface; here we do the once-per-request detection to ENQUEUE a rebuild of
   // the dangling version. Fail-open: a KV hiccup never blocks the render (the reads
   // below still run).
-  if (kv) {
+  if (kv && !candidatePin) {
     const channel = channelFromEnv(customization.env);
     await resolveServableChannelVersion(kvGet, tenant.tenant_id, channel, ({ versionId }) => {
       recordActivity({
@@ -508,12 +517,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     draftClaims && draftClaims.tenantId === tenant.tenant_id ? draftClaims : null;
 
   let theme = mergeTheme(referenceTheme, tenant.theme_tokens);
-  const publishedTheme = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    themeArtifactPath(tenant.tenant_id),
-  );
+  const publishedTheme = await readRuntimeArtifact(themeArtifactPath(tenant.tenant_id));
   if (publishedTheme) {
     try {
       theme = mergeTheme(theme, JSON.parse(publishedTheme) as DeepPartial<ThemeTokens>);
@@ -539,12 +543,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // commit (localhost=working tree, preview=PR head, live=promoted). So a
   // capability change is PR-gated and separable per environment.
   let publishedCaps: Partial<CapabilityConfig> | null = null;
-  const publishedCapsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    capabilitiesArtifactPath(tenant.tenant_id),
-  );
+  const publishedCapsRaw = await readRuntimeArtifact(capabilitiesArtifactPath(tenant.tenant_id));
   if (publishedCapsRaw) {
     try {
       publishedCaps = JSON.parse(publishedCapsRaw) as Partial<CapabilityConfig>;
@@ -560,12 +559,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // tenant enables a catalogued embed by committing embeds.json — no platform
   // change — but can never introduce a non-catalog origin.
   let publishedEmbeds: string[] | null = null;
-  const publishedEmbedsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    embedsArtifactPath(tenant.tenant_id),
-  );
+  const publishedEmbedsRaw = await readRuntimeArtifact(embedsArtifactPath(tenant.tenant_id));
   if (publishedEmbedsRaw) {
     try {
       const parsed = JSON.parse(publishedEmbedsRaw);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.111",
+  "version": "2.2.113",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",