@tokenoftrust/storefront-runner 4.11.5 → 4.11.7

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -143,12 +143,22 @@ export async function resolveNamedSubjectGrant(
     });
     if (outcome.kind !== "ok") return false;
     const payload = (await outcome.json()) as Record<string, unknown> | null;
-    return payload?.capability === capability;
+    if (payload?.capability === capability) return true;
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: ${namedGrantRefusal(payload)}`);
+    return false;
   } catch {
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: unparseable answer`);
     return false;
   }
 }
 
+/** Why a 2xx named-grant answer did not grant, in the seam's own fixed vocabulary. Never the subject. */
+function namedGrantRefusal(payload: Record<string, unknown> | null): string {
+  const reason = typeof payload?.reason === "string" && /^[a-z_-]{1,40}$/.test(payload.reason) ? payload.reason : null;
+  if (payload?.capability === null) return reason ? `capability null, reason ${reason}` : "capability null (no grant)";
+  return "unexpected capability";
+}
+
 /**
  * Resolve the viewer's LIVE ship capability over `appDomain`. Returns the granted
  * `Capability` — `"ship-on-behalf"` ONLY on an explicit `200 { capability:

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -12,6 +12,10 @@
  * A thrown transport failure comes back as one fixed diagnostic, never the thrown value: a
  * fetch error can carry the request URL (and so its subject query) to every downstream sink.
  *
+ * Every outcome but `ok` logs one `[mcp-service-seam]` line naming the method, the contract path
+ * and a fixed reason: the env name for `not-configured` / `bad-url`, the error class (from a fixed
+ * list) for `transport-error`, the status otherwise. Never the URL, query, secret or thrown text.
+ *
  * A 401 or 404 from a seam route is misconfiguration, never a business answer: tot-mcp's
  * routes answer 200 for every absent/unknown case, so 401 means the secret or URL is wrong
  * and 404 means the path is not served. Both log LOUDLY and come back as `misconfigured`
@@ -75,11 +79,23 @@ function misconfigurationReason(status: 401 | 404, urlEnv: string): string {
     : "tot-mcp does not serve this path; storefront and tot-mcp disagree on the service-seam contract";
 }
 
+/** Error classes a transport failure may name in a log line; anything else reads `Error`. */
+const TRANSPORT_ERROR_CLASSES = new Set(["TimeoutError", "AbortError", "TypeError", "SyntaxError"]);
+
+/** The class of a thrown transport failure, from a fixed list. Never its message. */
+export function transportErrorClass(thrown: unknown): string {
+  return thrown instanceof Error && TRANSPORT_ERROR_CLASSES.has(thrown.name) ? thrown.name : "Error";
+}
+
 export async function callMcpService(req: McpServiceRequest): Promise<McpServiceOutcome> {
   const urlEnv = AUTHORITY_ENV[req.authority ?? "binding"];
   const authorityUrl = await readEnv(urlEnv);
   const secret = await readEnv("MCP_SERVICE_SHARED_SECRET");
-  if (!authorityUrl || !secret) return { kind: "not-configured" };
+  if (!authorityUrl || !secret) {
+    const missing = [!authorityUrl && urlEnv, !secret && "MCP_SERVICE_SHARED_SECRET"].filter(Boolean).join(" and ");
+    console.warn(`[mcp-service-seam] ${req.method} ${req.path} not-configured: ${missing} unset`);
+    return { kind: "not-configured" };
+  }
 
   let origin: string | null;
   if (req.authority === "grant") {
@@ -91,7 +107,10 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       origin = null;
     }
   }
-  if (!origin) return { kind: "bad-url" };
+  if (!origin) {
+    console.error(`[mcp-service-seam] ${req.method} ${req.path} bad-url: ${urlEnv} is not a usable origin`);
+    return { kind: "bad-url" };
+  }
   let url = `${origin}${req.path}`;
   if (req.query) url += `?${new URLSearchParams(req.query).toString()}`;
 
@@ -105,7 +124,8 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       if (!req.transport.post) throw new Error("transport has no post()");
       res = await req.transport.post(url, headers, req.body);
     }
-  } catch {
+  } catch (thrown) {
+    console.error(`[mcp-service-seam] ${req.method} ${req.path} transport-error: ${transportErrorClass(thrown)} (${urlEnv})`);
     return { kind: "transport-error", message: MCP_SERVICE_TRANSPORT_FAILURE };
   }
 

package/apps/storefront/src/lib/orders/admin/orderSource.ts

@@ -86,6 +86,22 @@ export function workerOrderSourceDeps(
   };
 }
 
+/**
+ * The stage a tenant's orders are recorded under, shared by every reader of an order (the Orders
+ * tab, the order routes and the contact vault routes): a shared-store tenant's ledger and sealed
+ * contacts carry this Worker's `COMMERCE_STAGE`; an own-store tenant's carry the routed environment's.
+ */
+export async function resolveOrderStage(
+  input: { tenantId: string; customizationEnv: CustomizationEnv | undefined },
+  deps: Pick<OrderSourceDeps, "admitSharedStoreTenant" | "readEnv">,
+): Promise<{ checkout: "shared-test-store" | "own-store"; stage: CommerceStage | null }> {
+  if ((await deps.admitSharedStoreTenant(input.tenantId)).ok) {
+    const stage = await deps.readEnv("COMMERCE_STAGE");
+    return { checkout: "shared-test-store", stage: stage === "preview" || stage === "publication" ? stage : null };
+  }
+  return { checkout: "own-store", stage: commerceStageForEnv(input.customizationEnv) };
+}
+
 export async function resolveOrderSource(
   input: { tenantId: string; customizationEnv: CustomizationEnv | undefined },
   deps: OrderSourceDeps,
@@ -93,19 +109,16 @@ export async function resolveOrderSource(
   const tenantId = input.tenantId.trim();
   if (!tenantId) return { kind: "not-connected", checkout: null, gap: "no-tenant" };
 
-  if ((await deps.admitSharedStoreTenant(tenantId)).ok) {
-    const checkout = "shared-test-store";
-    const stage = await deps.readEnv("COMMERCE_STAGE");
-    if (stage !== "preview" && stage !== "publication") return { kind: "not-connected", checkout, gap: "stage-unknown" };
+  const { checkout, stage } = await resolveOrderStage({ tenantId, customizationEnv: input.customizationEnv }, deps);
+  if (!stage) return { kind: "not-connected", checkout, gap: "stage-unknown" };
+
+  if (checkout === "shared-test-store") {
     const db = await deps.readLedgerDb();
     if (!db) return { kind: "not-connected", checkout, gap: "ledger-unavailable" };
     const book = ledgerOrderBook(new ScrappyOrderLedger(db), { tenantId, stage });
     return { kind: "ledger", checkout, scope: { tenantId, stage }, client: book.client, status: book.status };
   }
 
-  const checkout = "own-store";
-  const stage = commerceStageForEnv(input.customizationEnv);
-  if (!stage) return { kind: "not-connected", checkout, gap: "stage-unknown" };
   const bearer = await deps.readEnv("FOXY_ORDER_API_KEY");
   if (!bearer) return { kind: "not-connected", checkout, gap: "partner-key-missing" };
   return {

package/apps/storefront/src/lib/orders/vault/contactRoutes.ts

@@ -1,16 +1,19 @@
 /**
  * The admission every order-contact admin route runs before it touches the vault: the owner gate,
  * then the owner-or-staff split (contactReaderAuthority), then — for staff — a reason, a ticket and a
- * LIVE owner-consented customer-contact-read grant. The tenant comes from the routed host and the
- * stage from the routed customization environment, never from the request.
+ * LIVE owner-consented customer-contact-read grant. The tenant comes from the routed host, never
+ * from the request. An order contact's stage is the one its order is recorded under
+ * (`resolveOrderStage`, shared with the Orders tab, with the shared-store admission its route
+ * supplies); a message's is the routed customization environment's.
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readViewerSession } from "@/lib/access/auth/route";
 import { contactReaderAuthority, resolveContactReadGrant } from "@/lib/access/auth/contactReaderAuthority";
-import { readD1 } from "@/lib/publication/shared/env";
+import { readD1, readEnv } from "@/lib/publication/shared/env";
 import { fromD1, type Queryable } from "@/lib/catalog/d1/catalog.js";
 import { commerceStageForEnv } from "@/lib/fulfillment/fulfillmentService";
+import { resolveOrderStage, type OrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import type { KmsClient } from "@/lib/customers/contactVault/kms.js";
 import { loadVaultKms } from "./kmsEnv.js";
 import { type ContactActor, type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
@@ -54,6 +57,7 @@ export type ContactRoute =
 export async function openContactRoute(
   context: APIContext,
   expect: "owner" | "staff",
+  record: "message" | Pick<OrderSourceDeps, "admitSharedStoreTenant">,
   body?: unknown,
 ): Promise<ContactRoute> {
   const refuse = (error: string, status: number): ContactRoute => ({ ok: false, response: contactJson({ error }, status) });
@@ -79,7 +83,13 @@ export async function openContactRoute(
     actor = { actorId: authority.actorId, role: "staff", ...reason };
   }
 
-  const stage = commerceStageForEnv(context.locals.customizationEnv);
+  const customizationEnv = context.locals.customizationEnv;
+  const stage = record === "message"
+    ? commerceStageForEnv(customizationEnv)
+    : (await resolveOrderStage({ tenantId: host, customizationEnv }, {
+      admitSharedStoreTenant: record.admitSharedStoreTenant,
+      readEnv: async (name) => (await readEnv(name)) ?? undefined,
+    })).stage;
   if (!stage) return refuse("stage-unknown", 409);
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return refuse("unavailable", 503);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -10,6 +10,7 @@ import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
  */
 import type { APIContext } from "astro";
 import { isOpaqueId } from "@/lib/fulfillment/fulfillmentService";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
 import { eraseOrderContact, readEraseGroups, readOrderContact, type Group } from "@/lib/orders/vault/orderContactVault";
 
@@ -18,7 +19,7 @@ export const prerender = false;
 export async function GET(context: APIContext): Promise<Response> {
   const orderId = routedApiParam(context, "fulfillment-address");
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const read = await readOrderContact(route.db, route.kms, {
     tenantId: route.tenantId, stage: route.stage, orderId, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),
@@ -48,7 +49,7 @@ async function eraseGroups(request: Request): Promise<Group[] | undefined | null
 export async function DELETE(context: APIContext): Promise<Response> {
   const orderId = routedApiParam(context, "fulfillment-address");
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const groups = await eraseGroups(context.request);
   if (groups === null) return contactJson({ error: "malformed" }, 400);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contact-search.ts

@@ -6,6 +6,7 @@
  * Staff are refused 403 support-read-required. Nothing here logs the body.
  */
 import type { APIContext } from "astro";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute, readRequestJson } from "@/lib/orders/vault/contactRoutes";
 import { readSearchQuery, searchOrderContacts } from "@/lib/orders/vault/orderContactVault";
 
@@ -13,7 +14,7 @@ export const prerender = false;
 
 export async function POST(context: APIContext): Promise<Response> {
   if (new URL(context.request.url).search !== "") return contactJson({ error: "malformed" }, 400);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const query = readSearchQuery(await readRequestJson(context.request));
   if (!query) return contactJson({ error: "malformed" }, 400);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contacts.ts

@@ -5,13 +5,14 @@
  * expiries and rule ids. Owner only; staff are refused 403 support-read-required.
  */
 import type { APIContext } from "astro";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
 import { listOrderContacts } from "@/lib/orders/vault/orderContactVault";
 
 export const prerender = false;
 
 export async function GET(context: APIContext): Promise<Response> {
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const listed = await listOrderContacts(route.db, route.kms, {
     tenantId: route.tenantId, stage: route.stage, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.5",
+  "version": "4.11.7",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",