@tokenoftrust/storefront-runner 4.11.0 → 4.11.1

package/apps/storefront/src/lib/orders/vault/vault-test-support.ts

@@ -0,0 +1,258 @@
+/**
+ * Test support for the order contact vault suites: node:sqlite with every migrations-apps file
+ * applied in order (fault hooks to inject failures and force races), a stubbed KMS that records
+ * every EncryptionContext it sees, and synthetic fixtures. Never imported by Worker code.
+ */
+import { createRequire } from "node:module";
+import { readFileSync, readdirSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import type { Queryable, QueryStatement } from "../../catalog/d1/catalog.js";
+import { VaultKeyUnavailableError, type EncryptionContext, type KmsClient } from "@/lib/customers/contactVault/kms.js";
+import { readOrderContactCommand, type OrderContactCommand } from "./orderContact.js";
+
+export interface SqliteStmt {
+  all(...params: unknown[]): Array<Record<string, unknown>>;
+  get(...params: unknown[]): Record<string, unknown> | undefined;
+  run(...params: unknown[]): unknown;
+}
+export interface SqliteDatabase {
+  prepare(sql: string): SqliteStmt;
+  exec(sql: string): void;
+}
+const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite") as {
+  DatabaseSync: new (path: string) => SqliteDatabase;
+};
+
+export const MIGRATIONS_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..", "migrations-apps");
+
+export function migrationFiles(): string[] {
+  return readdirSync(MIGRATIONS_DIR).filter((name) => name.endsWith(".sql")).sort();
+}
+
+export function newDatabase(): SqliteDatabase {
+  return new DatabaseSync(":memory:");
+}
+
+export function applyMigration(raw: SqliteDatabase, file: string): void {
+  raw.exec(readFileSync(join(MIGRATIONS_DIR, file), "utf8"));
+}
+
+/** Fault hooks a test sets to inject failures or force two operations to race. */
+export interface Faults {
+  /** Called after statement `index` of a batch ran; throwing rolls the batch back. */
+  afterBatchStatement?: (index: number, sql: string) => void;
+  /** Awaited before a batch starts. */
+  beforeBatch?: () => Promise<void>;
+  /** Called (and awaited) before `all`; throwing fails that statement. */
+  beforeAll?: (sql: string) => Promise<void> | void;
+}
+
+export interface Harness {
+  db: Queryable;
+  raw: SqliteDatabase;
+  faults: Faults;
+}
+
+export function harness(): Harness {
+  const raw = newDatabase();
+  const faults: Faults = {};
+  const db: Queryable = {
+    all: async (sql, ...params) => {
+      await faults.beforeAll?.(sql);
+      return raw.prepare(sql).all(...params) as never;
+    },
+    first: async (sql, ...params) => (raw.prepare(sql).get(...params) ?? null) as never,
+    run: async (sql, ...params) => {
+      raw.prepare(sql).run(...params);
+    },
+    exec: async (sql) => {
+      raw.exec(sql);
+    },
+    batch: async (statements: readonly QueryStatement[]) => {
+      await faults.beforeBatch?.();
+      raw.exec("BEGIN");
+      try {
+        statements.forEach((statement, index) => {
+          raw.prepare(statement.sql).run(...(statement.params ?? []));
+          faults.afterBatchStatement?.(index, statement.sql);
+        });
+        raw.exec("COMMIT");
+      } catch (error) {
+        raw.exec("ROLLBACK");
+        throw error;
+      }
+    },
+  };
+  for (const file of migrationFiles()) applyMigration(raw, file);
+  return { db, raw, faults };
+}
+
+/** Resolves once `size` callers are waiting, so they proceed together. */
+export function barrier(size: number): () => Promise<void> {
+  let waiting = 0;
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => { release = resolve; });
+  return async () => {
+    waiting += 1;
+    if (waiting >= size) release();
+    await gate;
+  };
+}
+
+/** A placeholder key ARN, assembled at runtime so no account-id-shaped literal ships in the runner. */
+export const KMS_KEY_ARN = ["arn", "aws", "kms", "us-east-1", "0".repeat(12), `key/${"0".repeat(8)}-0000-0000-0000-${"0".repeat(12)}`].join(":");
+
+export interface StubKms {
+  client: KmsClient;
+  generated: EncryptionContext[];
+  decrypted: EncryptionContext[];
+  /** Every key byte string (base64 and hex) and wrapped blob the stub ever handed out. */
+  material(): string[];
+  fail: boolean;
+  /** Decrypt ignores the tenant in the context (simulates a mis-scoped KMS policy: only the AAD protects). */
+  ignoreTenant: boolean;
+}
+
+export function stubKms(): StubKms {
+  const store = new Map<string, { bytes: Uint8Array; ctx: EncryptionContext }>();
+  const stub: StubKms = {
+    generated: [],
+    decrypted: [],
+    fail: false,
+    ignoreTenant: false,
+    material: () => [...store.entries()].flatMap(([blob, { bytes }]) => [
+      blob, Buffer.from(bytes).toString("base64"), Buffer.from(bytes).toString("hex"),
+    ]),
+    client: {
+      async generateDataKey(ctx) {
+        if (stub.fail) throw new VaultKeyUnavailableError();
+        stub.generated.push({ ...ctx });
+        const bytes = crypto.getRandomValues(new Uint8Array(32));
+        const blob = Buffer.from(crypto.getRandomValues(new Uint8Array(48))).toString("base64");
+        store.set(blob, { bytes: bytes.slice(), ctx: { ...ctx } });
+        return { plaintext: bytes, ciphertextBlob: blob, keyArn: KMS_KEY_ARN };
+      },
+      async decrypt(blob, ctx, keyArn) {
+        if (stub.fail) throw new VaultKeyUnavailableError();
+        stub.decrypted.push({ ...ctx });
+        const entry = store.get(blob);
+        if (!entry || keyArn !== KMS_KEY_ARN || entry.ctx.stage !== ctx.stage || entry.ctx.purpose !== ctx.purpose
+          || (!stub.ignoreTenant && entry.ctx.tenantId !== ctx.tenantId)) {
+          throw new VaultKeyUnavailableError();
+        }
+        return entry.bytes.slice();
+      },
+    },
+  };
+  return stub;
+}
+
+export const DAY_MS = 86_400_000;
+export const HOUR_MS = 3_600_000;
+export const T0 = Date.parse("2026-01-01T00:00:00.000Z");
+export const day = (n: number): Date => new Date(T0 + n * DAY_MS);
+export const iso = (n: number): string => day(n).toISOString();
+
+export const TENANT = "synthetic-tenant";
+export const OTHER_TENANT = "other-synthetic-tenant";
+export const ISSUER = "synthetic-issuer";
+export const SYNTHETIC = [
+  "Synthetic Customer", "customer@example.test", "+1 555 0100", "15550100", "1 Example Way", "Suite 9", "Synthetic Billing",
+  "Example City", "90210",
+];
+
+export function contact(orderId = "order-1", overrides: { phone?: string; email?: string } = {}): OrderContactCommand {
+  const read = readOrderContactCommand({
+    kind: "order-contact",
+    v: 1,
+    orderId,
+    customer: { name: "Synthetic Customer", email: overrides.email ?? "customer@example.test", phone: overrides.phone ?? "+1 555 0100" },
+    shipTo: { name: "Synthetic Customer", line1: "1 Example Way", line2: "Suite 9", city: "Example City", region: "CA", postalCode: "90210", country: "US" },
+    billTo: { name: "Synthetic Billing", line1: "1 Example Way", city: "Example City", postalCode: "90210", country: "US" },
+  });
+  if (!read) throw new Error("fixture command did not parse");
+  return read;
+}
+
+export function seedOrder(
+  h: { raw: SqliteDatabase },
+  orderId: string,
+  options: { placedAt?: string; fulfillment?: string; tenantId?: string; stage?: string; amountMinor?: number } = {},
+): void {
+  h.raw.prepare(
+    `INSERT INTO scrappy_commerce_orders
+       (tenant_id, stage, order_id, source, source_order_id, currency, placed_at, payment_state, compliance_state,
+        stock_state, fulfillment_state, label_state, amount_minor, event_version)
+     VALUES (?, ?, ?, 'foxycart', ?, 'USD', ?, 'captured', 'fresh', 'confirmed', ?, 'none', ?, 1)`,
+  ).run(
+    options.tenantId ?? TENANT, options.stage ?? "publication", orderId, orderId,
+    options.placedAt ?? iso(0), options.fulfillment ?? "ready", options.amountMinor ?? 2500,
+  );
+}
+
+export function seedAllocation(h: { raw: SqliteDatabase }, orderId: string, sku: string, quantity: number, stage = "publication"): void {
+  h.raw.prepare(
+    `INSERT INTO scrappy_allocations (tenant_id, stage, order_id, sku, location_id, quantity, state)
+     VALUES (?, ?, ?, ?, 'unspecified', ?, 'confirmed')`,
+  ).run(TENANT, stage, orderId, sku, quantity);
+}
+
+let auditSeq = 0;
+/** A terminal shipment-audit row, written in the real `<ISO>#NNNNNN` stamp format by default. */
+export function terminalAudit(
+  h: { raw: SqliteDatabase },
+  orderId: string,
+  at: string,
+  options: { kind?: "transition" | "pending-cancel"; stage?: string; raw?: boolean; tenantId?: string } = {},
+): void {
+  auditSeq += 1;
+  const kind = options.kind ?? "transition";
+  const stamp = options.raw ? at : `${at}#${String(auditSeq).padStart(6, "0")}`;
+  h.raw.prepare(
+    `INSERT INTO scrappy_shipment_audit (audit_id, tenant_id, stage, order_id, at, actor_id, kind, from_state, to_state)
+     VALUES (?, ?, ?, ?, ?, 'subject-merchant', ?, ?, ?)`,
+  ).run(`ship-audit-${auditSeq}`, options.tenantId ?? TENANT, options.stage ?? "publication", orderId, stamp, kind,
+    kind === "transition" ? "ready" : "requested", kind === "transition" ? "handed_off" : "confirmed");
+}
+
+/** Make an order terminal (handed off) at `at`, as the fulfillment service records it. */
+export function handOff(h: { raw: SqliteDatabase }, orderId: string, at: string, stage = "publication"): void {
+  h.raw.prepare(`UPDATE scrappy_commerce_orders SET fulfillment_state = 'handed_off' WHERE order_id = ? AND stage = ?`).run(orderId, stage);
+  terminalAudit(h, orderId, at, { stage });
+}
+
+export function count(h: { raw: SqliteDatabase }, table: string, where = "1 = 1", ...params: unknown[]): number {
+  return Number(h.raw.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE ${where}`).get(...params)?.n ?? 0);
+}
+
+/** Row counts of every table an intake, read, erase or purge could touch. */
+export function counts(h: { raw: SqliteDatabase }): Record<string, number> {
+  return {
+    vault: count(h, "order_contact_vault"),
+    markers: count(h, "order_contact_markers"),
+    keys: count(h, "contact_vault_data_keys"),
+    replay: count(h, "scrappy_caller_replay"),
+    audit: count(h, "contact_access_audit"),
+    orders: count(h, "scrappy_commerce_orders"),
+    messages: count(h, "contact_messages"),
+  };
+}
+
+export function vaultRow(h: { raw: SqliteDatabase }, orderId: string, tenantId = TENANT, stage = "publication"): Record<string, unknown> | undefined {
+  return h.raw.prepare(`SELECT * FROM order_contact_vault WHERE tenant_id = ? AND stage = ? AND order_id = ?`).get(tenantId, stage, orderId);
+}
+
+/** Every table's contents as one string, to prove no synthetic contact value lands outside a ciphertext. */
+export function allTableText(h: { raw: SqliteDatabase }): string {
+  const tables = h.raw.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((row) => String(row.name));
+  return tables.map((table) => JSON.stringify(h.raw.prepare(`SELECT * FROM "${table}"`).all())).join("\n");
+}
+
+/** Every ciphertext and blind index currently stored in the vault. */
+export function storedSecrets(h: { raw: SqliteDatabase }): string[] {
+  const rows = h.raw.prepare(`SELECT * FROM order_contact_vault`).all();
+  return rows.flatMap((row) => Object.entries(row)
+    .filter(([column, value]) => (column.endsWith("_ct") || column.endsWith("_bidx")) && typeof value === "string")
+    .map(([, value]) => String(value)));
+}

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -3,11 +3,15 @@ import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
  * Owner retrieval and erase of an order's customer contact (name, email, phone, ship-to, bill-to)
  * from the contact vault. ToT staff are refused here (403 support-read-required) and use the
  * reason-and-grant routes under ./contact/. Every read and erase is audited before it acts.
+ *
+ * GET returns only the field groups readable now, each with its expiry and retention rule id.
+ * DELETE erases the groups named in an optional JSON body `{groups: [...]}` (default: every group no
+ * retention floor holds); a floor-held group answers 409 retention-hold with its hold-until date.
  */
 import type { APIContext } from "astro";
 import { isOpaqueId } from "@/lib/fulfillment/fulfillmentService";
 import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
-import { eraseOrderContact, readOrderContact } from "@/lib/orders/vault/orderContactVault";
+import { eraseOrderContact, readEraseGroups, readOrderContact, type Group } from "@/lib/orders/vault/orderContactVault";
 
 export const prerender = false;
 
@@ -16,11 +20,29 @@ export async function GET(context: APIContext): Promise<Response> {
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
   const route = await openContactRoute(context, "owner");
   if (!route.ok) return route.response;
-  const read = await readOrderContact(route.db, route.keyring, {
+  const read = await readOrderContact(route.db, route.kms, {
     tenantId: route.tenantId, stage: route.stage, orderId, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),
   });
   if (!read.ok) return contactJson({ error: read.reason }, read.status);
-  return contactJson({ ...read.contact, expiresAt: read.expiresAt }, 200);
+  return contactJson({ ...read.contact, expiresAt: read.expiresAt, groups: read.groups }, 200);
+}
+
+/** The erase body: empty means the default groups; otherwise exactly `{groups}`. Null when malformed. */
+async function eraseGroups(request: Request): Promise<Group[] | undefined | null> {
+  const raw = await request.text();
+  if (raw.trim() === "") return undefined;
+  if (raw.length > 4096) return null;
+  let body: unknown;
+  try {
+    body = JSON.parse(raw);
+  } catch (error) {
+    if (error instanceof SyntaxError) return null;
+    throw error;
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+  const keys = Object.keys(body);
+  if (keys.length !== 1 || keys[0] !== "groups") return null;
+  return readEraseGroups((body as { groups: unknown }).groups);
 }
 
 export async function DELETE(context: APIContext): Promise<Response> {
@@ -28,9 +50,16 @@ export async function DELETE(context: APIContext): Promise<Response> {
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
   const route = await openContactRoute(context, "owner");
   if (!route.ok) return route.response;
+  const groups = await eraseGroups(context.request);
+  if (groups === null) return contactJson({ error: "malformed" }, 400);
   const erased = await eraseOrderContact(route.db, {
     tenantId: route.tenantId, stage: route.stage, orderId, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),
+    ...(groups ? { groups } : {}),
   });
-  if (!erased.ok) return contactJson({ error: erased.reason }, erased.status);
-  return contactJson({ erased: true }, 200);
+  if (!erased.ok) {
+    return erased.reason === "retention-hold"
+      ? contactJson({ error: erased.reason, group: erased.group, holdUntil: erased.holdUntil }, erased.status)
+      : contactJson({ error: erased.reason }, erased.status);
+  }
+  return contactJson({ erased: true, groups: erased.groups }, 200);
 }

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contact-search.ts

@@ -0,0 +1,25 @@
+/**
+ * `POST /api/admin/fulfillment/orders/contact-search` — owner exact-match search of order contact by
+ * email or phone. The value travels only in the JSON body `{email}` or `{phone}`: Workers logs
+ * record URLs, so any query string is refused before the body is read. Returns the routed tenant
+ * and stage's matching order ids (no-store) and writes a `search` audit row holding the count only.
+ * Staff are refused 403 support-read-required. Nothing here logs the body.
+ */
+import type { APIContext } from "astro";
+import { contactJson, openContactRoute, readRequestJson } from "@/lib/orders/vault/contactRoutes";
+import { readSearchQuery, searchOrderContacts } from "@/lib/orders/vault/orderContactVault";
+
+export const prerender = false;
+
+export async function POST(context: APIContext): Promise<Response> {
+  if (new URL(context.request.url).search !== "") return contactJson({ error: "malformed" }, 400);
+  const route = await openContactRoute(context, "owner");
+  if (!route.ok) return route.response;
+  const query = readSearchQuery(await readRequestJson(context.request));
+  if (!query) return contactJson({ error: "malformed" }, 400);
+  const found = await searchOrderContacts(route.db, route.kms, {
+    tenantId: route.tenantId, stage: route.stage, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(), query,
+  });
+  if (!found.ok) return contactJson({ error: found.reason }, found.status);
+  return contactJson({ orderIds: found.orderIds }, 200);
+}

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contacts.ts

@@ -0,0 +1,21 @@
+/**
+ * `GET /api/admin/fulfillment/orders/contacts` — the Orders panel's contact list for the routed
+ * tenant and stage: one query joining orders to the vault, one `list` audit row carrying the count
+ * (written before anything is decrypted), then only the field groups readable now with their
+ * expiries and rule ids. Owner only; staff are refused 403 support-read-required.
+ */
+import type { APIContext } from "astro";
+import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
+import { listOrderContacts } from "@/lib/orders/vault/orderContactVault";
+
+export const prerender = false;
+
+export async function GET(context: APIContext): Promise<Response> {
+  const route = await openContactRoute(context, "owner");
+  if (!route.ok) return route.response;
+  const listed = await listOrderContacts(route.db, route.kms, {
+    tenantId: route.tenantId, stage: route.stage, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),
+  });
+  if (!listed.ok) return contactJson({ error: listed.reason }, listed.status);
+  return contactJson({ contacts: listed.contacts }, 200);
+}

package/apps/storefront/src/pages/api/contact.ts

@@ -10,9 +10,10 @@
  * binding refuses with 503; the rate limiter fails closed. Responses never echo
  * input, and logs carry only tenant, submission id and outcome.
  *
- * The message is stored only as a contact vault envelope under the routed stage
- * (`customizationEnv` live = publication, test = preview). An unknown stage refuses
- * 409 and a missing or unreadable vault keyring refuses 503, both before any write.
+ * The message is stored only as field-level contact vault ciphertexts under the
+ * routed stage (`customizationEnv` live = publication, test = preview). An unknown
+ * stage refuses 409 before any write; a missing or malformed `CONTACT_VAULT_KMS`
+ * secret, a KMS error or a KMS timeout refuses 503 (retryable) with nothing written.
  */
 import type { APIContext } from "astro";
 import { readD1, readEnv, readKv } from "@/lib/publication/shared/env";
@@ -21,8 +22,8 @@ import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 import { hashConsentIp } from "@/lib/engagement/newsletter/consent";
 import { ContactMessagesStore } from "@/lib/engagement/contact/contactMessages";
 import { commerceStageForEnv } from "@/lib/fulfillment/fulfillmentService";
-import { loadVaultKeyring } from "@/lib/orders/vault/keyringEnv";
-import { VaultKeyUnavailableError } from "@/lib/customers/contactVault/envelope.js";
+import { VaultKeyUnavailableError } from "@/lib/customers/contactVault/kms.js";
+import { loadVaultKms } from "@/lib/orders/vault/kmsEnv";
 import { verifyContactToken } from "@/lib/engagement/contact/submitToken";
 import { requestClientIp } from "@/lib/publication/shared/cdnForward";
 import {
@@ -127,11 +128,8 @@ export async function POST(context: APIContext): Promise<Response> {
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return refuse("no_database", "unavailable", 503);
 
-  const keyring = await loadVaultKeyring();
-  if (!keyring) return refuse("vault_key_unavailable", "unavailable", 503);
-
   try {
-    await new ContactMessagesStore(fromD1(d1), keyring).insert({
+    await new ContactMessagesStore(fromD1(d1), await loadVaultKms()).insert({
       id: submissionId,
       tenantId,
       stage,

package/apps/storefront/src/scheduled/contactVaultSweep.ts

@@ -1,18 +1,25 @@
 /**
  * The hourly contact vault sweep — the Worker's `scheduled` handler body. One `now` per firing,
- * taken from its scheduled time: purge expired order contacts and contact messages, shorten terminal
- * orders' retention, and seal any contact message still held as legacy plaintext. Expiry predicates
- * only; it never touches an order, audit or other row.
+ * taken from its scheduled time: clear expired order-contact field groups and contact messages,
+ * shorten terminal orders' retention, seal any contact message still held as legacy plaintext,
+ * rotate data keys older than a year, and recompute blind indexes still under a retired kid. Expiry predicates only; it never touches an order or audit row.
  *
- * It logs ONE structured line of counts on success and ONE fixed error code on failure — never an
- * error message, id or row, since either could carry data. It composes orders and engagement, which
- * no module under src/lib may do, so it lives beside the Worker entry.
+ * Purge never needs a key, so it always runs; sealing and rotation need KMS and are skipped (with
+ * `kmsAvailable: false`) when it refuses. It logs ONE structured line of counts on success and ONE
+ * fixed error code on failure — never an error message, id or row, since either could carry data.
+ * It composes orders and engagement, which no module under src/lib may do, so it lives beside the
+ * Worker entry.
  */
 import { fromD1, type Queryable } from "@/lib/catalog/d1/catalog.js";
-import type { VaultKeyring } from "@/lib/customers/contactVault/envelope.js";
-import { purgeExpiredContactMessages, sealLegacyContactMessages } from "@/lib/engagement/contact/contactMessages.js";
-import { loadVaultKeyring } from "@/lib/orders/vault/keyringEnv.js";
-import { purgeOrderContacts, type PurgeCounts } from "@/lib/orders/vault/orderContactVault.js";
+import { VaultKeyUnavailableError, type KmsClient } from "@/lib/customers/contactVault/kms.js";
+import {
+  purgeContactMessages,
+  recomputeMessageBlindIndexes,
+  sealLegacyContactMessages,
+  type MessagePurgeCounts,
+} from "@/lib/engagement/contact/contactMessages.js";
+import { loadVaultKms } from "@/lib/orders/vault/kmsEnv.js";
+import { purgeOrderContacts, rotateContactVaultKeys, type PurgeCounts } from "@/lib/orders/vault/orderContactVault.js";
 import { readD1 } from "@/lib/publication/shared/env";
 
 export const SWEEP_LEGACY_SEAL_LIMIT = 500;
@@ -22,25 +29,45 @@ export const SWEEP_FAILED = "contact-vault-sweep-failed";
 
 export interface SweepCounts {
   orders: PurgeCounts;
-  messagesPurged: number;
+  messages: MessagePurgeCounts;
+  kmsAvailable: boolean;
   legacySealed: number;
   legacyRemaining: number;
+  keysRotated: number;
+  blindIndexesRecomputed: number;
 }
 
-export async function runContactVaultSweep(db: Queryable, keyring: VaultKeyring | null, now: Date): Promise<SweepCounts> {
+/** Run a KMS-dependent step; a KMS refusal reports unavailable instead of failing the sweep. */
+async function withKms<T>(step: () => Promise<T>): Promise<T | null> {
+  try {
+    return await step();
+  } catch (error) {
+    if (error instanceof VaultKeyUnavailableError) return null;
+    throw error;
+  }
+}
+
+export async function runContactVaultSweep(db: Queryable, kms: KmsClient, now: Date): Promise<SweepCounts> {
   if (Number.isNaN(now.getTime())) throw new Error("contact vault sweep: unreadable clock");
   const orders = await purgeOrderContacts(db, now);
-  const messagesPurged = await purgeExpiredContactMessages(db, now);
-  const legacy = keyring
-    ? await sealLegacyContactMessages(db, keyring, now, SWEEP_LEGACY_SEAL_LIMIT)
-    : { sealed: 0, remaining: -1 };
-  return { orders, messagesPurged, legacySealed: legacy.sealed, legacyRemaining: legacy.remaining };
+  const messages = await purgeContactMessages(db, now);
+  const legacy = await withKms(() => sealLegacyContactMessages(db, kms, now, SWEEP_LEGACY_SEAL_LIMIT));
+  const rotation = await withKms(() => rotateContactVaultKeys(db, kms, now, { recompute: [recomputeMessageBlindIndexes] }));
+  return {
+    orders,
+    messages,
+    kmsAvailable: legacy !== null && rotation !== null,
+    legacySealed: legacy?.sealed ?? 0,
+    legacyRemaining: legacy?.remaining ?? -1,
+    keysRotated: rotation?.rotated ?? 0,
+    blindIndexesRecomputed: rotation?.recomputed ?? 0,
+  };
 }
 
 export interface ScheduledSweepDeps {
   openDb(): Promise<Queryable | null>;
-  loadKeyring(): Promise<VaultKeyring | null>;
-  sweep(db: Queryable, keyring: VaultKeyring | null, now: Date): Promise<SweepCounts>;
+  loadKms(): Promise<KmsClient>;
+  sweep(db: Queryable, kms: KmsClient, now: Date): Promise<SweepCounts>;
   log(line: string): void;
   logError(line: string): void;
 }
@@ -50,7 +77,7 @@ const workerDeps: ScheduledSweepDeps = {
     const d1 = await readD1("STOREFRONT_APPS_DB");
     return d1 ? fromD1(d1) : null;
   },
-  loadKeyring: loadVaultKeyring,
+  loadKms: loadVaultKms,
   sweep: runContactVaultSweep,
   log: (line) => console.log(line),
   logError: (line) => console.error(line),
@@ -62,17 +89,19 @@ export async function runScheduledContactVaultSweep(scheduledTime: number, deps:
   try {
     const db = await deps.openDb();
     if (!db) return fail(SWEEP_DB_UNAVAILABLE);
-    const keyring = await deps.loadKeyring();
-    const counts = await deps.sweep(db, keyring, new Date(scheduledTime));
+    const counts = await deps.sweep(db, await deps.loadKms(), new Date(scheduledTime));
     deps.log(JSON.stringify({
       event: CONTACT_VAULT_SWEEP_EVENT,
-      keyringAvailable: keyring !== null,
-      ordersPurged: counts.orders.purged,
-      tombstonesRemoved: counts.orders.tombstonesRemoved,
+      kmsAvailable: counts.kmsAvailable,
+      groupsPurged: counts.orders.groupsPurged,
+      ordersDetached: counts.orders.detached,
+      ordersPreviewDeleted: counts.orders.previewDeleted,
       ordersShortened: counts.orders.shortened,
-      messagesPurged: counts.messagesPurged,
+      messages: counts.messages,
       legacySealed: counts.legacySealed,
       legacyRemaining: counts.legacyRemaining,
+      keysRotated: counts.keysRotated,
+      blindIndexesRecomputed: counts.blindIndexesRecomputed,
     }));
   } catch {
     fail(SWEEP_FAILED);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.0",
+  "version": "4.11.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",