@tokenoftrust/storefront-runner 4.11.6 → 4.11.7

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -143,12 +143,22 @@ export async function resolveNamedSubjectGrant(
     });
     if (outcome.kind !== "ok") return false;
     const payload = (await outcome.json()) as Record<string, unknown> | null;
-    return payload?.capability === capability;
+    if (payload?.capability === capability) return true;
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: ${namedGrantRefusal(payload)}`);
+    return false;
   } catch {
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: unparseable answer`);
     return false;
   }
 }
 
+/** Why a 2xx named-grant answer did not grant, in the seam's own fixed vocabulary. Never the subject. */
+function namedGrantRefusal(payload: Record<string, unknown> | null): string {
+  const reason = typeof payload?.reason === "string" && /^[a-z_-]{1,40}$/.test(payload.reason) ? payload.reason : null;
+  if (payload?.capability === null) return reason ? `capability null, reason ${reason}` : "capability null (no grant)";
+  return "unexpected capability";
+}
+
 /**
  * Resolve the viewer's LIVE ship capability over `appDomain`. Returns the granted
  * `Capability` — `"ship-on-behalf"` ONLY on an explicit `200 { capability:

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -12,6 +12,10 @@
  * A thrown transport failure comes back as one fixed diagnostic, never the thrown value: a
  * fetch error can carry the request URL (and so its subject query) to every downstream sink.
  *
+ * Every outcome but `ok` logs one `[mcp-service-seam]` line naming the method, the contract path
+ * and a fixed reason: the env name for `not-configured` / `bad-url`, the error class (from a fixed
+ * list) for `transport-error`, the status otherwise. Never the URL, query, secret or thrown text.
+ *
  * A 401 or 404 from a seam route is misconfiguration, never a business answer: tot-mcp's
  * routes answer 200 for every absent/unknown case, so 401 means the secret or URL is wrong
  * and 404 means the path is not served. Both log LOUDLY and come back as `misconfigured`
@@ -75,11 +79,23 @@ function misconfigurationReason(status: 401 | 404, urlEnv: string): string {
     : "tot-mcp does not serve this path; storefront and tot-mcp disagree on the service-seam contract";
 }
 
+/** Error classes a transport failure may name in a log line; anything else reads `Error`. */
+const TRANSPORT_ERROR_CLASSES = new Set(["TimeoutError", "AbortError", "TypeError", "SyntaxError"]);
+
+/** The class of a thrown transport failure, from a fixed list. Never its message. */
+export function transportErrorClass(thrown: unknown): string {
+  return thrown instanceof Error && TRANSPORT_ERROR_CLASSES.has(thrown.name) ? thrown.name : "Error";
+}
+
 export async function callMcpService(req: McpServiceRequest): Promise<McpServiceOutcome> {
   const urlEnv = AUTHORITY_ENV[req.authority ?? "binding"];
   const authorityUrl = await readEnv(urlEnv);
   const secret = await readEnv("MCP_SERVICE_SHARED_SECRET");
-  if (!authorityUrl || !secret) return { kind: "not-configured" };
+  if (!authorityUrl || !secret) {
+    const missing = [!authorityUrl && urlEnv, !secret && "MCP_SERVICE_SHARED_SECRET"].filter(Boolean).join(" and ");
+    console.warn(`[mcp-service-seam] ${req.method} ${req.path} not-configured: ${missing} unset`);
+    return { kind: "not-configured" };
+  }
 
   let origin: string | null;
   if (req.authority === "grant") {
@@ -91,7 +107,10 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       origin = null;
     }
   }
-  if (!origin) return { kind: "bad-url" };
+  if (!origin) {
+    console.error(`[mcp-service-seam] ${req.method} ${req.path} bad-url: ${urlEnv} is not a usable origin`);
+    return { kind: "bad-url" };
+  }
   let url = `${origin}${req.path}`;
   if (req.query) url += `?${new URLSearchParams(req.query).toString()}`;
 
@@ -105,7 +124,8 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       if (!req.transport.post) throw new Error("transport has no post()");
       res = await req.transport.post(url, headers, req.body);
     }
-  } catch {
+  } catch (thrown) {
+    console.error(`[mcp-service-seam] ${req.method} ${req.path} transport-error: ${transportErrorClass(thrown)} (${urlEnv})`);
     return { kind: "transport-error", message: MCP_SERVICE_TRANSPORT_FAILURE };
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.6",
+  "version": "4.11.7",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",