@tokenoftrust/storefront-runner 4.11.6 → 4.11.8

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -143,12 +143,22 @@ export async function resolveNamedSubjectGrant(
     });
     if (outcome.kind !== "ok") return false;
     const payload = (await outcome.json()) as Record<string, unknown> | null;
-    return payload?.capability === capability;
+    if (payload?.capability === capability) return true;
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: ${namedGrantRefusal(payload)}`);
+    return false;
   } catch {
+    console.warn(`[mcp-service-seam] named grant ${capability} not held: unparseable answer`);
     return false;
   }
 }
 
+/** Why a 2xx named-grant answer did not grant, in the seam's own fixed vocabulary. Never the subject. */
+function namedGrantRefusal(payload: Record<string, unknown> | null): string {
+  const reason = typeof payload?.reason === "string" && /^[a-z_-]{1,40}$/.test(payload.reason) ? payload.reason : null;
+  if (payload?.capability === null) return reason ? `capability null, reason ${reason}` : "capability null (no grant)";
+  return "unexpected capability";
+}
+
 /**
  * Resolve the viewer's LIVE ship capability over `appDomain`. Returns the granted
  * `Capability` — `"ship-on-behalf"` ONLY on an explicit `200 { capability:

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -12,6 +12,13 @@
  * A thrown transport failure comes back as one fixed diagnostic, never the thrown value: a
  * fetch error can carry the request URL (and so its subject query) to every downstream sink.
  *
+ * Every outcome but `ok` logs one `[mcp-service-seam]` line naming the method, the contract path
+ * and a fixed reason: the env name for `not-configured` / `bad-url`, the error class (from a fixed
+ * list) for `transport-error`, the status otherwise. A `TypeError` also carries its message and its
+ * cause's message, scrubbed of URLs, email addresses and the secret, because fetch's wording is
+ * what separates a lost connection from one refused before connecting or a TLS trust failure.
+ * Never the URL, query or secret, and no other thrown value's text.
+ *
  * A 401 or 404 from a seam route is misconfiguration, never a business answer: tot-mcp's
  * routes answer 200 for every absent/unknown case, so 401 means the secret or URL is wrong
  * and 404 means the path is not served. Both log LOUDLY and come back as `misconfigured`
@@ -75,11 +82,50 @@ function misconfigurationReason(status: 401 | 404, urlEnv: string): string {
     : "tot-mcp does not serve this path; storefront and tot-mcp disagree on the service-seam contract";
 }
 
+/** Error classes a transport failure may name in a log line; anything else reads `Error`. */
+const TRANSPORT_ERROR_CLASSES = new Set(["TimeoutError", "AbortError", "TypeError", "SyntaxError"]);
+
+/** The class of a thrown transport failure, from a fixed list. Never its message. */
+export function transportErrorClass(thrown: unknown): string {
+  return thrown instanceof Error && TRANSPORT_ERROR_CLASSES.has(thrown.name) ? thrown.name : "Error";
+}
+
+/** A thrown text with every URL, email address and the given secret removed, whitespace folded, capped. */
+function scrubbed(text: string, secret: string): string {
+  let out = text;
+  if (secret) out = out.split(secret).join("<secret>");
+  return out
+    .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"<>)]+/gi, "<url>")
+    .replace(/[^\s@'"<>(),;:]+@[^\s@'"<>(),;:]+\.[a-z]{2,}/gi, "<email>")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 160);
+}
+
+/**
+ * For a `TypeError` (how a Workers fetch reports a connection it could not make: lost, refused
+ * before connecting, TLS trust), its message and its cause's message, scrubbed of URLs, email
+ * addresses and the service secret. Those words are what tell the network causes apart. Any other
+ * thrown value yields nothing: its text is not a fetch's own wording.
+ */
+export function transportErrorDetail(thrown: unknown, secret: string): string {
+  if (!(thrown instanceof TypeError)) return "";
+  const cause = (thrown as { cause?: unknown }).cause;
+  const causeText = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "";
+  const parts = [`message "${scrubbed(thrown.message, secret)}"`];
+  if (causeText) parts.push(`cause "${scrubbed(causeText, secret)}"`);
+  return `: ${parts.join(", ")}`;
+}
+
 export async function callMcpService(req: McpServiceRequest): Promise<McpServiceOutcome> {
   const urlEnv = AUTHORITY_ENV[req.authority ?? "binding"];
   const authorityUrl = await readEnv(urlEnv);
   const secret = await readEnv("MCP_SERVICE_SHARED_SECRET");
-  if (!authorityUrl || !secret) return { kind: "not-configured" };
+  if (!authorityUrl || !secret) {
+    const missing = [!authorityUrl && urlEnv, !secret && "MCP_SERVICE_SHARED_SECRET"].filter(Boolean).join(" and ");
+    console.warn(`[mcp-service-seam] ${req.method} ${req.path} not-configured: ${missing} unset`);
+    return { kind: "not-configured" };
+  }
 
   let origin: string | null;
   if (req.authority === "grant") {
@@ -91,7 +137,10 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       origin = null;
     }
   }
-  if (!origin) return { kind: "bad-url" };
+  if (!origin) {
+    console.error(`[mcp-service-seam] ${req.method} ${req.path} bad-url: ${urlEnv} is not a usable origin`);
+    return { kind: "bad-url" };
+  }
   let url = `${origin}${req.path}`;
   if (req.query) url += `?${new URLSearchParams(req.query).toString()}`;
 
@@ -105,7 +154,10 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       if (!req.transport.post) throw new Error("transport has no post()");
       res = await req.transport.post(url, headers, req.body);
     }
-  } catch {
+  } catch (thrown) {
+    console.error(
+      `[mcp-service-seam] ${req.method} ${req.path} transport-error: ${transportErrorClass(thrown)} (${urlEnv})${transportErrorDetail(thrown, secret)}`,
+    );
     return { kind: "transport-error", message: MCP_SERVICE_TRANSPORT_FAILURE };
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.6",
+  "version": "4.11.8",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",