TK-10046: apply-residual reads canonical secrets-manager token (shopify/.env token lost read_products)

ad27a81da42317f60fb7aaa3bd69e1212516c17e · 2026-08-10 10:58:37 -0700 · Steve Abrams

The old shopify/.env SHOPIFY_ADMIN_TOKEN (…c1d6) began returning 'Access denied … read_products' mid-session; secrets-manager/.env (…7d19) is the canonical working token per CLAUDE.md. Applier now prefers it with shopify/.env fallback. Read-only dry-run verified: all 9 BATCH-1 HIGH targets already resolved live (6 already reassigned, 3 PR already minted to DWPX-5001xx) — 0 remaining writes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M scripts/tk10002-null-sample/apply-residual.js

Diff

commit ad27a81da42317f60fb7aaa3bd69e1212516c17e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 10 10:58:37 2026 -0700

    TK-10046: apply-residual reads canonical secrets-manager token (shopify/.env token lost read_products)
    
    The old shopify/.env SHOPIFY_ADMIN_TOKEN (…c1d6) began returning 'Access denied … read_products' mid-session; secrets-manager/.env (…7d19) is the canonical working token per CLAUDE.md. Applier now prefers it with shopify/.env fallback. Read-only dry-run verified: all 9 BATCH-1 HIGH targets already resolved live (6 already reassigned, 3 PR already minted to DWPX-5001xx) — 0 remaining writes.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/tk10002-null-sample/apply-residual.js | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/scripts/tk10002-null-sample/apply-residual.js b/scripts/tk10002-null-sample/apply-residual.js
index 4bef186d..3b5da622 100644
--- a/scripts/tk10002-null-sample/apply-residual.js
+++ b/scripts/tk10002-null-sample/apply-residual.js
@@ -10,8 +10,17 @@ const { Pool } = require('pg');
 const fs = require('fs');
 const { requireApproval } = require('../../shopify/scripts/lib/approval-gate');
 const pool = new Pool({ host:'/tmp', database:'dw_unified', user: require('os').userInfo().username });
-const TOKEN = fs.readFileSync(require('path').join(process.env.HOME,'Projects/Designer-Wallcoverings/shopify/.env'),'utf8')
-  .split('\n').find(l=>l.startsWith('SHOPIFY_ADMIN_TOKEN=')).split('=').slice(1).join('=').replace(/['"]/g,'').trim();
+// TK-10046 (2026-08-10): read the CANONICAL token from secrets-manager/.env first.
+// The old shopify/.env token (…c1d6) lost read_products mid-session; secrets-manager/.env (…7d19) is authoritative per CLAUDE.md.
+function readAdminToken(){
+  const path=require('path');
+  for(const p of [ path.join(process.env.HOME,'Projects/secrets-manager/.env'),
+                   path.join(process.env.HOME,'Projects/Designer-Wallcoverings/shopify/.env') ]){
+    try{ const line=fs.readFileSync(p,'utf8').split('\n').find(l=>l.startsWith('SHOPIFY_ADMIN_TOKEN=')); if(line) return line.split('=').slice(1).join('=').replace(/['"]/g,'').trim(); }catch(_){}
+  }
+  throw new Error('SHOPIFY_ADMIN_TOKEN not found in secrets-manager/.env or shopify/.env');
+}
+const TOKEN = readAdminToken();
 const STORE='designer-laboratory-sandbox.myshopify.com', API='2024-10';
 const APPLY = process.env.APPLY === '1';
 const sleep = ms => new Promise(r=>setTimeout(r,ms));

← 6e0219a4 chore: v1.2.10 → v1.2.11 (session close — CC 'The Classics' · back to Dw Validator Debug TK11314 · Add Majilite Metallic Specialties I Constant Contact campaig 692b87fe →