@tokenoftrust/storefront-runner 2.3.1 → 2.4.0

package/apps/storefront/src/lib/dashboard/delegateGate.ts

@@ -36,7 +36,7 @@ export type DelegateSection = { mode: "unpaid"; role: null; explanation: string
 /**
  * Resolve the whole delegate section. Before a store is paid there is no live
  * site and preview-access developers can already add changes to the release
- * (`canAddToRelease`), so delegation has nothing to grant: every viewer, the
+ * (the `merge-to-preview` admission class, lib/pipeline/admission.ts), so delegation has nothing to grant: every viewer, the
  * owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store resolves
  * {@link resolveDelegateGate} unchanged.
  */

package/apps/storefront/src/lib/shared/capability.ts

@@ -16,6 +16,18 @@
 /** Access level the acting operator holds. */
 export type Capability = "preview-access" | "ship-on-behalf";
 
+const CAPABILITIES: readonly Capability[] = ["preview-access", "ship-on-behalf"];
+
+/**
+ * The console operator's capability from env + request. Pure decision over the two inputs;
+ * fail-closed to `preview-access`. Only call AFTER the operator Bearer has been authenticated (so
+ * the header is trusted).
+ */
+export function decideCapability(configured: string | undefined, requested: string | null): Capability {
+  const raw = (configured ?? requested ?? "").trim();
+  return CAPABILITIES.includes(raw as Capability) ? (raw as Capability) : "preview-access";
+}
+
 /** Complete tenant-role vocabulary emitted by verified identity assertions. */
 export const TENANT_ROLES = ["owner", "admin", "member"] as const;
 export type TenantRole = (typeof TENANT_ROLES)[number];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/apps/storefront/src/lib/shared/addToRelease.ts

@@ -1,32 +0,0 @@
-/**
- * Who may Add to release — integrate an accepted change into the store's
- * `preview` release. Pure; shared by the integrate/resolve admission, the
- * Publish console, and the Team page so all three answer one question.
- */
-import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
-import { isOwnerCapability, type Capability } from "./capability";
-
-/** Pure inputs to the Add-to-release decision. */
-export interface AddToReleaseInput {
-  /** The viewer's standing over THIS tenant (owner/admin/member), if any. */
-  capability: string | null | undefined;
-  /** The viewer's live ship grant over this tenant. */
-  shipGrant: Capability;
-  /** True only when the viewer's access is bound to THIS tenant. */
-  tenantScoped: boolean;
-  /** The tenant's storefront mode — `"enabled"` means the store is paid. */
-  storefrontMode: string | null | undefined;
-}
-
-/**
- * May this viewer add an accepted change to the store's `preview` release?
- *
- * Owner/admin standing or a ship-on-behalf grant always may. Before a store is
- * paid there is no live site, so preview IS the site: a developer whose access is
- * scoped to this tenant may add without a ship-on-behalf grant. Once the store is
- * paid, the preview/live split and ship-on-behalf delegation apply.
- */
-export function canAddToRelease(input: AddToReleaseInput): boolean {
-  if (isOwnerCapability(input.capability) || input.shipGrant === "ship-on-behalf") return true;
-  return input.tenantScoped && !storefrontModeAllowsGoLive(input.storefrontMode);
-}