@tokenoftrust/storefront-runner 4.8.0 → 4.9.0

package/apps/storefront/src/lib/access/shared/developerInvites.ts

@@ -54,9 +54,9 @@
  */
 import { readEnv } from "@/lib/publication/shared/env";
 import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
-import { diagEmail } from "@/lib/observability/diag/redact";
 import { checkStorePreviewReady, type PreflightDecision } from "@/lib/access/shared/invitePreflight";
 import { explainDeveloperAccess, type AccessVerification } from "@/lib/access/shared/accessExplain";
+import { failureReasonForStatus, type FailureReason } from "@/lib/observability/diag/failureReason";
 
 /**
  * The header carrying the storefront-signed staff BROKER ASSERTION to tot20
@@ -444,8 +444,6 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
     // the email-send trace). `signInUrlHost` is the top allowlist suspect.
     logInviteDiag("request", {
       endpoint: `${this.baseUrl}/api/clients/developerInvites`,
-      tenant: input.tenant,
-      email: diagEmail(input.email.toLowerCase()),
       sendEmail: input.sendEmail ?? "(unset → tot20 default)",
       hasSignInUrl: !!input.signInUrl,
       signInUrlHost: safeHost(input.signInUrl),
@@ -460,14 +458,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         headers,
         body,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure calling tot20 " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure calling tot20",
       };
     }
 
@@ -486,19 +482,17 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
     // DIAGNOSTIC: tot20's decision — the crux is `emailed`. `changed:false, emailed:false`
     // means tot20 authorized + already had the role but did NOT send (the gate we're hunting).
     logInviteDiag("response", {
-      tenant: input.tenant,
-      email: diagEmail(input.email.toLowerCase()),
       httpStatus: res.status,
       ok: result.ok,
       ...(result.ok
         ? {
             changed: result.changed,
             emailed: result.emailed,
-            emailReason: result.emailReason ?? "(none)",
-            emailDetail: result.emailDetail,
+            hasEmailReason: !!result.emailReason,
+            hasEmailDetail: !!result.emailDetail,
             signInEligible: result.signInEligible,
           }
-        : { reason: result.reason, code: result.code }),
+        : { reason: result.reason, hasCode: !!result.code }),
     });
     return result;
   }
@@ -529,14 +523,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         `${this.baseUrl}/api/clients/developerInvites?${q.toString()}`,
         headers,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure listing invites " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure listing invites",
       };
     }
     let parsed: unknown;
@@ -576,14 +568,12 @@ export class HttpDeveloperInviteClient implements DeveloperInviteClient {
         `${this.baseUrl}/api/clients/developerInvites/${encodeURIComponent(inviteId)}`,
         headers,
       );
-    } catch (cause) {
+    } catch {
       return {
         ok: false,
         status: 0,
         reason: "error",
-        message:
-          "developerInvites: transport failure revoking invite " +
-          (cause instanceof Error ? cause.message : String(cause)),
+        message: "developerInvites: transport failure revoking invite",
       };
     }
     let parsed: unknown;
@@ -801,6 +791,29 @@ export function developerInviteHttpStatus(
   }
 }
 
+/**
+ * Client-facing copy for a developer-invite failure. Routes answer with this, never with
+ * the result's `message` (which can carry tot20's own text).
+ */
+export function developerInviteFailureMessage(reason: DeveloperInviteFailureReason): string {
+  switch (reason) {
+    case "notGranted":
+      return "storefront isn't authorized to manage developers on this vendor";
+    case "notAuthenticated":
+      return "storefront's operator credential was rejected";
+    case "tenantRequired":
+      return "a target vendor is required";
+    case "invalidEmail":
+      return "a valid developer email is required";
+    case "tenantNotFound":
+      return "this vendor isn't a resolvable Token of Trust app";
+    case "storeNotProvisioned":
+      return "this vendor's store repo isn't provisioned on this environment yet";
+    default:
+      return "Token of Trust couldn't complete the request; try again shortly";
+  }
+}
+
 function defaultMessage(
   reason: DeveloperInviteFailureReason,
   status: number,
@@ -1108,9 +1121,9 @@ export async function recordDeveloperAppBinding(
 export type AcceptInviteResult =
   | { accepted: true; changed: boolean }
   // Not attempted (seam unconfigured) or no invite to accept — not a hard failure.
-  | { accepted: false; skipped: true; reason: string }
+  | { accepted: false; skipped: true; reason: "no-tenant-or-email" | "not-configured" | "no-invite-for-email" }
   // Attempted but failed for a real reason (auth / store fault / transport).
-  | { accepted: false; skipped: false; reason: string };
+  | { accepted: false; skipped: false; reason: FailureReason };
 
 /**
  * Mark a developer invite ACCEPTED at the magic-link confirm (#8425 accept-before-
@@ -1167,19 +1180,9 @@ export async function acceptDeveloperInvite(
     if (res.status === 404) {
       return { accepted: false, skipped: true, reason: "no-invite-for-email" };
     }
-    return {
-      accepted: false,
-      skipped: false,
-      reason: `tot20 accept returned status ${res.status}`,
-    };
-  } catch (cause) {
-    return {
-      accepted: false,
-      skipped: false,
-      reason:
-        "developerInvites accept transport failure: " +
-        (cause instanceof Error ? cause.message : String(cause)),
-    };
+    return { accepted: false, skipped: false, reason: failureReasonForStatus(res.status) };
+  } catch {
+    return { accepted: false, skipped: false, reason: "transport" };
   }
 }
 
@@ -1258,9 +1261,8 @@ export async function inviteDeveloperToTenant(
   const preflight = deps.preflight ?? checkStorePreviewReady;
   const ready = await preflight(input.tenant);
   if (ready.block) {
-    console.warn(
-      `[developerInvites] invite BLOCKED by preflight for ${input.tenant}: ${ready.reason}`,
-    );
+    // Finite fields only: no tenant, no free-form preflight reason.
+    console.warn("[developerInvites] invite blocked by preflight");
     return {
       invite: {
         ok: false,

package/apps/storefront/src/lib/access/shared/invitePreflight.ts

@@ -82,7 +82,7 @@ export async function checkStorePreviewReady(
   if (outcome.kind === "not-configured") return { block: false, reason: "not-configured" };
   if (outcome.kind === "bad-url") return { block: false, reason: "bad-mcp-url" };
   if (outcome.kind === "transport-error") {
-    return { block: false, reason: "preflight request failed: " + outcome.message };
+    return { block: false, reason: "preflight request failed" };
   }
   if (outcome.kind === "misconfigured") {
     return { block: false, reason: `preflight misconfigured: status ${outcome.status}` };

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -76,7 +76,6 @@
  * swaps in the Http client with no call-site change.
  */
 import { readEnv } from "@/lib/publication/shared/env";
-import { diagEmail } from "@/lib/observability/diag/redact";
 import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
@@ -285,8 +284,6 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
 
     logGrantDiag("request", {
       endpoint: `${this.baseUrl}/api/clients/principalGrants`,
-      tenant: input.tenant,
-      email: diagEmail(input.principal.email.toLowerCase()),
       capability: input.capability,
       expiresAt: input.expiresAt,
     });
@@ -298,17 +295,18 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
         this.brokeredHeaders(assertion, false),
         body,
       );
-    } catch (cause) {
-      return transportFailure("creating principal grant", cause);
+    } catch {
+      return transportFailure("creating principal grant");
     }
     const parsed = await safeJson(res, "creating principal grant");
     if ("failed" in parsed) return parsed.failed;
     const result = normalizeCreateResponse(res.status, parsed.body);
     logGrantDiag("response", {
-      tenant: input.tenant,
       httpStatus: res.status,
       ok: result.ok,
-      ...(result.ok ? { ref: result.ref } : { reason: result.reason, code: result.code }),
+      ...(result.ok
+        ? { hasRef: !!result.ref }
+        : { reason: result.reason, hasCode: !!result.code }),
     });
     return result;
   }
@@ -324,8 +322,8 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
         `${this.baseUrl}/api/clients/principalGrants?tenant=${encodeURIComponent(tenant)}`,
         this.brokeredHeaders(assertion, true),
       );
-    } catch (cause) {
-      return transportFailure("listing principal grants", cause);
+    } catch {
+      return transportFailure("listing principal grants");
     }
     const parsed = await safeJson(res, "listing principal grants");
     if ("failed" in parsed) return parsed.failed;
@@ -345,8 +343,8 @@ export class HttpPrincipalGrantClient implements PrincipalGrantClient {
           `?tenant=${encodeURIComponent(tenant)}`,
         this.brokeredHeaders(assertion, true),
       );
-    } catch (cause) {
-      return transportFailure("revoking principal grant", cause);
+    } catch {
+      return transportFailure("revoking principal grant");
     }
     const parsed = await safeJson(res, "revoking principal grant");
     if ("failed" in parsed) return parsed.failed;
@@ -365,12 +363,12 @@ function brokerNotConfigured(): PrincipalGrantFailed {
   };
 }
 
-async function transportFailure(action: string, cause: unknown): Promise<PrincipalGrantFailed> {
+async function transportFailure(action: string): Promise<PrincipalGrantFailed> {
   return {
     ok: false,
     status: 0,
     reason: "error",
-    message: `principalGrants: transport failure ${action} ` + (cause instanceof Error ? cause.message : String(cause)),
+    message: `principalGrants: transport failure ${action}`,
   };
 }
 
@@ -458,11 +456,12 @@ function failureFrom(
   const code = typeof c.code === "string" ? c.code : undefined;
   const reason = reasonFor(code, status);
   const upstream = typeof c.message === "string" ? c.message : undefined;
-  const message = reason === "error" && upstream ? upstream : defaultMessage(reason, status);
+  const message = reason === "error" && upstream ? upstream : principalGrantFailureMessage(reason);
   return { status, reason, message, ...(code ? { code } : {}) };
 }
 
-function defaultMessage(reason: PrincipalGrantFailureReason, status: number): string {
+/** Finite operator-facing copy for a principal-grant refusal — the only text a route returns. */
+export function principalGrantFailureMessage(reason: PrincipalGrantFailureReason): string {
   switch (reason) {
     case "notAuthenticated":
       return "storefront isn't authorized to grant on this tenant";
@@ -486,7 +485,7 @@ function defaultMessage(reason: PrincipalGrantFailureReason, status: number): st
     case "brokerNotConfigured":
       return "delegation isn't available on this deployment";
     default:
-      return `principalGrants: tot20 returned status ${status}`;
+      return "Token of Trust couldn't complete the delegation; try again shortly";
   }
 }
 
@@ -578,7 +577,7 @@ export class MockPrincipalGrantClient implements PrincipalGrantClient {
       ok: false,
       status: 403,
       reason: "subjectNotTenantOwner",
-      message: defaultMessage("subjectNotTenantOwner", 403),
+      message: principalGrantFailureMessage("subjectNotTenantOwner"),
       code: "operatorGrants:subjectNotTenantOwner",
     };
   }

package/apps/storefront/src/lib/engagement/messaging/messagesClient.ts

@@ -16,6 +16,10 @@
  * Built like `@/lib/grants/developerInvites` (interface + Http impl + Mock + env factory).
  */
 import { readEnv } from "@/lib/publication/shared/env";
+import {
+  failureReasonForStatus,
+  type FailureReason,
+} from "@/lib/observability/diag/failureReason";
 
 export interface InlineEmail {
   /** Recipient address. */
@@ -26,9 +30,13 @@ export interface InlineEmail {
   html: string;
 }
 
+/**
+ * `reason` is a finite category. Upstream failure text (exception messages, tot20's
+ * `message`/`reason` fields) can echo the recipient address, so it never leaves this client.
+ */
 export type MessageSendResult =
   | { sent: true; id?: string }
-  | { sent: false; status: number; reason: string };
+  | { sent: false; status: number; reason: FailureReason };
 
 export interface MessagesClient {
   sendInlineEmail(msg: InlineEmail): Promise<MessageSendResult>;
@@ -97,14 +105,14 @@ export class HttpMessagesClient implements MessagesClient {
           ...this.credentialFields(),
         },
       );
-    } catch (cause) {
-      return { sent: false, status: 0, reason: cause instanceof Error ? cause.message : String(cause) };
+    } catch {
+      return { sent: false, status: 0, reason: "transport" };
     }
     let body: unknown;
     try {
       body = await res.json();
     } catch {
-      return { sent: false, status: res.status, reason: `non-JSON body (status ${res.status})` };
+      return { sent: false, status: res.status, reason: "non-json" };
     }
     return normalizeSend(res.status, body);
   }
@@ -117,9 +125,7 @@ export function normalizeSend(status: number, body: unknown): MessageSendResult
   if (c.sent === true || (status >= 200 && status < 300 && c.sent !== false)) {
     return { sent: true, ...(typeof c.id === "string" ? { id: c.id } : {}) };
   }
-  const reason =
-    typeof c.message === "string" ? c.message : typeof c.reason === "string" ? c.reason : `send failed (status ${status})`;
-  return { sent: false, status, reason };
+  return { sent: false, status, reason: failureReasonForStatus(status) };
 }
 
 // --- Mock (tests + local dev) -----------------------------------------------

package/apps/storefront/src/lib/observability/diag/failureReason.ts

@@ -0,0 +1,37 @@
+/**
+ * The finite set of failure categories a diagnostic line or client-facing response may
+ * carry. Upstream failure text (exception messages, response bodies, remote `message` /
+ * `reason` fields) can hold addresses, tokens or tenant detail, so it is mapped to one of
+ * these categories at the producer and never forwarded verbatim.
+ */
+export const FAILURE_REASONS = [
+  "transport",
+  "non-json",
+  "unauthorized",
+  "not-found",
+  "rate-limited",
+  "rejected",
+  "upstream-error",
+  "not-configured",
+  "unknown",
+] as const;
+
+export type FailureReason = (typeof FAILURE_REASONS)[number];
+
+const KNOWN: ReadonlySet<string> = new Set(FAILURE_REASONS);
+
+export function isFailureReason(value: unknown): value is FailureReason {
+  return typeof value === "string" && KNOWN.has(value);
+}
+
+/** Category for an HTTP status (0 = no response reached us). */
+export function failureReasonForStatus(status: number): FailureReason {
+  if (status === 0) return "transport";
+  if (status === 401 || status === 403) return "unauthorized";
+  if (status === 404) return "not-found";
+  if (status === 429) return "rate-limited";
+  if (status >= 400 && status < 500) return "rejected";
+  if (status >= 500 && status < 600) return "upstream-error";
+  if (status >= 200 && status < 300) return "rejected";
+  return "unknown";
+}

package/apps/storefront/src/lib/observability/diag/redact.ts

@@ -1,20 +1,17 @@
 /**
- * Redaction helpers for diagnostic logs — keep traces correlatable without persisting PII.
+ * Redaction helpers for diagnostic logs. An email address never appears in a diagnostic
+ * line in any build: not the local part, not its first character, not the domain.
+ * Correlate with an opaque reference (for example `hashActorId`) instead.
  */
 
-/** Mask an email for logs: keep the first char + the domain (`d***@example.com`). */
-export function maskEmail(email: string): string {
-  const at = email.indexOf("@");
-  if (at <= 0) return "***";
-  return `${email[0]}***${email.slice(at)}`;
+export const REDACTED_EMAIL = "[redacted-email]";
+
+/** A log-safe stand-in for an email address. Reveals nothing about the input. */
+export function maskEmail(_email: string): string {
+  return REDACTED_EMAIL;
 }
 
-/**
- * Email for a diagnostic line: the FULL address in local dev only (`import.meta.env.DEV`
- * is a static boolean → this branch is tree-shaken from the production worker), where logs
- * are local + gitignored and the raw address is needed for debugging; MASKED everywhere the
- * build is deployed, so prod/worker logs never persist raw recipient PII.
- */
-export function diagEmail(email: string): string {
-  return import.meta.env.DEV ? email : maskEmail(email);
+/** Email for a diagnostic line. Fully redacted in local dev and deployed builds alike. */
+export function diagEmail(_email: string): string {
+  return REDACTED_EMAIL;
 }

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -116,8 +116,9 @@ export async function POST(context: APIContext): Promise<Response> {
     const claims = await verifier.verify(idToken); // enforces aud === STOREFRONT_APP_DOMAIN
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/magic-exchange: id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return magicRedirect(context, { error: "verify_failed", tenant, emailHint, next });
   }
@@ -148,14 +149,11 @@ export async function POST(context: APIContext): Promise<Response> {
   try {
     const accepted = await acceptDeveloperInvite(tenant, derived.email);
     if (!accepted.accepted && !accepted.skipped) {
-      console.warn("auth/magic-exchange: invite accept did not record", {
-        tenant,
-        reason: accepted.reason,
-      });
+      console.warn("auth/magic-exchange: invite accept did not record", { reason: accepted.reason });
     }
   } catch (err) {
     console.warn("auth/magic-exchange: invite accept threw (swallowed)", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
   }
 
@@ -167,7 +165,6 @@ export async function POST(context: APIContext): Promise<Response> {
     const verification = await explainDeveloperAccess(tenant, derived.email, "accepted");
     if (verification.state === "broken") {
       console.warn("auth/magic-exchange: accepted invite does not resolve", {
-        tenant,
         failedStep: verification.failedStep,
       });
     }

package/apps/storefront/src/pages/api/auth/send.ts

@@ -20,7 +20,7 @@ import {
   devAuthEnabled,
   devAuthCode,
   storeDevCode,
-  DEV_AUTH_CODE_TTL_SECONDS,
+  deliverDevCode,
 } from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
@@ -46,22 +46,22 @@ export async function POST(context: APIContext): Promise<Response> {
   // dev guards in middleware/index.ts). It NEVER weakens the hosted path.
   //
   // On localhost tot20 isn't reachable, so no email can be sent. When a developer
-  // opts in with `DEV_AUTH=1` in `.dev.vars`, we instead mint a one-time code,
-  // store it in the SESSION KV, and PRINT it to the server console so the developer
-  // can complete sign-in locally. (The verify side that ACCEPTS this code + mints a
-  // session without tot20 is the security-sensitive half — see the handoff
-  // `2026-07-09-storefront-local-dev-auth-mode.md`; until it lands, the code is
-  // stored + printed but sign-in completes only once that verify path is wired.)
+  // opts in with `DEV_AUTH=1` in `.dev.vars`, we instead mint a one-time code, store
+  // it in the SESSION KV, and deliver it to the owner-private local outbox
+  // (`apps/storefront/.dev-auth/outbox.txt`). The code and address never reach the
+  // console or the response. /api/auth/verify consumes it (single use, 10 minutes).
   if (import.meta.env.DEV && (await devAuthEnabled())) {
     const kv = await readKv("SESSION");
     if (kv) {
       const code = devAuthCode();
       await storeDevCode(kv, email, code);
-      // eslint-disable-next-line no-console -- dev-only server-console code delivery
-      console.log(
-        `\n  🔑 [DEV AUTH] sign-in code for ${email}: ${code}\n` +
-          `     valid ${DEV_AUTH_CODE_TTL_SECONDS / 60}m · printed here only (no email in local dev)\n`,
-      );
+      if (!(await deliverDevCode(context.request, email, code))) {
+        // eslint-disable-next-line no-console -- dev-only diagnostic; no code, no address
+        console.warn(
+          "[DEV AUTH] could not deliver the sign-in code to the local outbox " +
+            "(is the dev-auth-outbox plugin registered in astro.config.mjs?).",
+        );
+      }
     } else {
       // eslint-disable-next-line no-console -- dev-only diagnostic
       console.warn(

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -94,8 +94,9 @@ export async function POST(context: APIContext): Promise<Response> {
     const claims = await verifier.verify(result.idToken); // enforces aud === STOREFRONT_APP_DOMAIN
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/step-up-verify: id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return loginRedirect(context, {
       sent: true,

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -19,6 +19,7 @@ import {
   getAccessClient,
   getSessionStore,
   setSessionCookie,
+  clearLoginEmailCookie,
   safeNext,
   loginRedirect,
 } from "@/lib/access/auth/route";
@@ -51,8 +52,8 @@ export async function POST(context: APIContext): Promise<Response> {
   // LOCAL DEV AUTH (verify side). `import.meta.env.DEV` is a STATIC boolean — this
   // whole branch (and the devAuth imports) are tree-shaken out of the production
   // build, so the hosted path below (offline JWKS verification, fail-closed) is
-  // never weakened. Second gate: the DEV_AUTH opt-in. Consume the console-printed
-  // code stored by /api/auth/send and mint a local session WITHOUT tot20 — the
+  // never weakened. Second gate: the DEV_AUTH opt-in. Consume the code stored by
+  // /api/auth/send (delivered to the private local outbox) and mint a local session WITHOUT tot20 — the
   // localhost completion of the invite→sign-in loop. See @/lib/auth/devAuth.
   if (import.meta.env.DEV && (await devAuthEnabled())) {
     const store = await getSessionStore();
@@ -72,6 +73,7 @@ export async function POST(context: APIContext): Promise<Response> {
       nowSeconds,
     );
     setSessionCookie(context, id, DEFAULT_SESSION_TTL_SECONDS);
+    clearLoginEmailCookie(context);
     return context.redirect(next, 303);
   }
 
@@ -127,8 +129,9 @@ export async function POST(context: APIContext): Promise<Response> {
     // Bind EVERY membership — no single-tenant scoping (multi-vendor picker input).
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/verify: federated id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return loginRedirect(context, { sent: true, email, error: "verify_failed", next });
   }
@@ -155,5 +158,6 @@ export async function POST(context: APIContext): Promise<Response> {
     nowSeconds,
   );
   setSessionCookie(context, id, DEFAULT_SESSION_TTL_SECONDS);
+  clearLoginEmailCookie(context);
   return context.redirect(next, 303);
 }

package/apps/storefront/src/pages/auth/login.astro

@@ -11,7 +11,12 @@
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
 import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
-import { safeNext } from "@/lib/access/auth/route";
+import {
+  EMAIL_RE,
+  safeNext,
+  readLoginEmail,
+  setLoginEmailCookie,
+} from "@/lib/access/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -21,8 +26,19 @@ export const prerender = false;
 
 const cspNonce = Astro.locals.cspNonce;
 const url = new URL(Astro.request.url);
+// The in-progress address rides the HttpOnly login-email cookie, never the URL. A
+// legacy `?email=` link is canonicalized: the address moves to the cookie and the
+// page reloads without it, so it doesn't linger in history or Referer headers.
+if (url.searchParams.has("email")) {
+  const legacyEmail = (url.searchParams.get("email") ?? "").trim().toLowerCase();
+  if (EMAIL_RE.test(legacyEmail)) setLoginEmailCookie(Astro, legacyEmail);
+  const canonical = new URLSearchParams(url.searchParams);
+  canonical.delete("email");
+  const qs = canonical.toString();
+  return Astro.redirect(`/auth/login${qs ? `?${qs}` : ""}`, 302);
+}
 const sent = url.searchParams.get("sent") === "1";
-const email = (url.searchParams.get("email") ?? "").trim();
+const email = readLoginEmail(Astro);
 const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 const errorCode = url.searchParams.get("error");
 // Same open-redirect chokepoint the verify endpoint + login gate use — never a
@@ -56,7 +72,8 @@ const errorMessage = errorCode ? (ERROR_MESSAGES[errorCode] ?? "Something went w
 // A stale/failed code should drop back to the email step so a new code can be requested.
 const showCodeStep = sent && errorCode !== "expired" && errorCode !== "too_many_attempts";
 // Local-dev banner (statically dropped from prod). The message depends on the mode:
-// DEV_AUTH=1 → the console bypass is active (no email; code printed to the server console);
+// DEV_AUTH=1 → local codes are active (no email; the code goes to the owner-private
+// outbox file named in the dev-server log);
 // DEV_AUTH=0 → the REAL path is active (a code IS emailed by the configured tot20/qa, but
 // only to an address that already holds a role). Read the toggle so the banner never lies.
 const devMode = import.meta.env.DEV;
@@ -235,12 +252,13 @@ if (devMode) {
       </span>
       <p class="eyebrow">Token of Trust© · Regulated Storefront</p>
       {devMode && (devAuthOn ? (
-        <p class="dev"><strong>Local dev — console bypass</strong> (<code>DEV_AUTH=1</code>). No email is sent;
-        your sign-in code is printed to the <strong>server console</strong>. Set <code>DEV_AUTH=0</code> to use real emails.</p>
+        <p class="dev"><strong>Local dev — private outbox</strong> (<code>DEV_AUTH=1</code>). No email is sent;
+        your sign-in code is written to <code>apps/storefront/.dev-auth/outbox.txt</code> (readable only by you).
+        Set <code>DEV_AUTH=0</code> to use real emails.</p>
       ) : (
         <p class="dev"><strong>Local dev — live email</strong> (<code>DEV_AUTH=0</code>). A code is emailed by the
         configured tot20 (<code>TOT_CORE_URL</code>), but only to an address that already holds a role. Set
-        <code>DEV_AUTH=1</code> for offline console codes.</p>
+        <code>DEV_AUTH=1</code> for offline local codes.</p>
       ))}
       {errorMessage && <p class="err">{errorMessage}</p>}
 

package/apps/storefront/src/pages/auth/magic.astro

@@ -9,7 +9,7 @@
  * the token before the user ever clicked. So: NEVER exchange on GET. The token rides
  * in a hidden form field and leaves only via the POST.
  */
-import { normalizeEmailHint, redactEmailForHint } from "@/lib/access/privacy/emailHint";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -20,15 +20,12 @@ export const prerender = false;
 const cspNonce = Astro.locals.cspNonce;
 const url = new URL(Astro.request.url);
 const token = url.searchParams.get("token") ?? "";
-const legacyEmail = (url.searchParams.get("email") ?? "").trim(); // legacy display hint only
-const emailHint =
-  normalizeEmailHint(url.searchParams.get("email_hint")) ??
-  redactEmailForHint(legacyEmail) ??
-  "";
+// An `email` query parameter is never read, echoed or used to prefill: the address is
+// stripped from the URL and sign-in proceeds on the token alone.
+const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 if (url.searchParams.has("email")) {
   const canonical = new URLSearchParams(url.searchParams);
   canonical.delete("email");
-  if (emailHint) canonical.set("email_hint", emailHint);
   return Astro.redirect(
     `/auth/magic${canonical.toString() ? `?${canonical.toString()}` : ""}`,
     302,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",