@tokenoftrust/storefront-runner 1.3.2 → 1.3.4-rc.2

package/packages/public-runtime/src/tenant.ts

@@ -5,7 +5,7 @@
  * interface (resolveTenant) is intentionally async + many-ready so the same seam
  * scales to Cloudflare-for-SaaS custom hostnames later without a rewrite.
  */
-import type { FoxyCommerceConfig } from "./foxy.js";
+import type { ManagedCheckoutConfig } from "./checkout.js";
 import type { CapabilityConfig } from "./capabilities.js";
 
 /**
@@ -306,13 +306,15 @@ export function siteTypeDefaults(siteType: SiteType): TenantFeatures {
  * preserving the platform's original behavior for existing tenants.
  */
 export function resolveTenantFeatures(
-  tenant: Pick<TenantConfig, "siteType" | "features">,
+  tenant: Pick<TenantConfig, "siteType" | "features" | "compliance">,
 ): TenantFeatures {
   const base = siteTypeDefaults(tenant.siteType ?? "commerce");
-  if (!tenant.features) return base;
-  for (const [k, v] of Object.entries(tenant.features)) {
-    if (v !== undefined) base[k as keyof TenantFeatures] = v;
+  if (tenant.features) {
+    for (const [k, v] of Object.entries(tenant.features)) {
+      if (v !== undefined) base[k as keyof TenantFeatures] = v;
+    }
   }
+  if (tenant.compliance?.minAge) base.ageGate = true;
   return base;
 }
 
@@ -344,14 +346,15 @@ export interface TenantConfig {
   /** Regulated-commerce affordances; undefined for unregulated tenants. */
   compliance?: ComplianceConfig;
   /**
-   * Cart/checkout engine wiring (FoxyCart, Track A). Present on commerce tenants
-   * that have a FoxyCart store; drives the loader + signed add-to-cart. The
-   * `storeSubDomain` here is a default — middleware may override it from env
-   * (FOXY_STORE_SUBDOMAIN) so the demo store swaps with zero code change. The
-   * signing SECRET is never stored on the tenant; it's an env Worker binding.
+   * Cart/checkout engine wiring (Track A). Present on commerce tenants
+   * that have a checkout store; drives the loader + signed add-to-cart. The
+   * `storeSubDomain` here is a default — middleware may override it from the
+   * existing provider-named env binding (FOXY_STORE_SUBDOMAIN) so the demo store
+   * swaps with zero code change. The signing SECRET is never stored on the
+   * tenant; it's an env Worker binding.
    */
   commerce?: {
-    foxy?: FoxyCommerceConfig;
+    checkout?: ManagedCheckoutConfig;
   };
   /**
    * PR-gated capability switches (cart/checkout, age/identity verification,

package/pnpm-workspace.yaml

@@ -1,6 +1,7 @@
 packages:
   - "apps/*"
   - "packages/*"
+linkWorkspacePackages: true
 onlyBuiltDependencies:
   - esbuild
   - sharp

package/scripts/dev/checkout-watch.mjs

@@ -1,6 +1,11 @@
 // @ts-check
 import { watch, readdirSync, statSync, existsSync, cpSync, rmSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { IGNORED_WATCH_DIRS, isTransientWatchFile } from "./transient-files.mjs";
+
+// Re-exported so existing importers (checkout-watch.test.mjs) keep working after the
+// predicate moved to its own typed module.
+export { isTransientWatchFile };
 
 // Standalone (`tot dev --workspace`) re-sync: the developer's checkout is COPIED
 // into the storefront's in-tree tenants/<id>/ (Vite's server.fs.allow refuses files
@@ -68,9 +73,13 @@ export function startWatch(source, isDir, onChange) {
         const rel = relDir ? join(relDir, e.name) : e.name;
         const abs = join(absDir, e.name);
         if (e.isDirectory()) {
+          if (IGNORED_WATCH_DIRS.has(e.name)) continue;
           visit(abs, rel);
           continue;
         }
+        // Skip editor/OS transient files so a vim `.swp` (etc.) never counts as a
+        // content change (no resync, no reload, no "changed" report).
+        if (isTransientWatchFile(e.name)) continue;
         present.add(rel);
         let m;
         try {

package/scripts/dev/file-browser.mjs

@@ -17,6 +17,7 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, extname, sep } from "node:path";
 import { resolveSafePath, matchesWriteAllowlist } from "./safe-path.mjs";
 import { resolveTenantSourceRoot } from "./tenant-source-root.mjs";
+import { isTransientWatchFile } from "./transient-files.mjs";
 
 /** Above this, the viewer degrades to "not shown" rather than shipping a huge string. */
 const MAX_FILE_BYTES = 512 * 1024;
@@ -67,7 +68,10 @@ export function buildTree(sourceRoot, { ignore = IGNORE_NAMES } = {}) {
     }
     const nodes = [];
     for (const e of entries) {
-      if (ignore.has(e.name)) continue;
+      // Editor/OS transient files (vim .swp, emacs #autosave#, ~backups, .DS_Store)
+      // are not the store's content — keep them out of the source tree so they never
+      // show up as an "untracked change" the developer has to reason about.
+      if (ignore.has(e.name) || isTransientWatchFile(e.name)) continue;
       const rel = relDir ? `${relDir}/${e.name}` : e.name;
       if (e.isDirectory()) {
         nodes.push({ name: e.name, path: rel, type: "dir", children: walk(join(absDir, e.name), rel) });

package/scripts/dev/transient-files.mjs

@@ -0,0 +1,34 @@
+// @ts-check
+/**
+ * Editor/OS transient-file predicate — shared by the local dev loop's file WATCHER
+ * (checkout-watch.mjs) and the source-tree browser (file-browser.mjs) so both hide
+ * the same non-content noise: a vim swap (`.home.html.swp`), an emacs autosave
+ * (`#home.html#`) or lock (`.#home.html`), a `~` backup, `.DS_Store`/`Thumbs.db`, or
+ * vim's `4913` write-probe. Kept in its own tiny, fully-typed module so a consumer
+ * that only needs the predicate never drags the watcher's other internals into its
+ * typecheck graph.
+ */
+
+/** Directories never worth descending into — VCS/dep/build noise that would churn a poll. */
+export const IGNORED_WATCH_DIRS = new Set([".git", "node_modules", ".astro", ".cache", ".turbo"]);
+
+/**
+ * True for editor/OS transient files that are NOT real content edits. A raw poll of
+ * a checkout subtree would otherwise treat one as a content change — re-syncing it,
+ * firing a spurious reload, and showing it as an untracked change. Matched on the
+ * BASENAME so it's independent of depth. "Official" changes track the store's real
+ * content; untracked editor junk is surfaced only at publish time, not here.
+ * @param {string} name the file basename
+ * @returns {boolean}
+ */
+export function isTransientWatchFile(name) {
+  return (
+    /\.(sw[a-z]{1,2}|tmp|temp|orig|bak)$/i.test(name) || // vim swap (.swp/.swo/.swx/.swpx…), temp/backup
+    /~$/.test(name) || // gedit/emacs/kate trailing-tilde backup
+    /^\.#/.test(name) || // emacs lockfile (.#file)
+    /^#.*#$/.test(name) || // emacs autosave (#file#)
+    name === ".DS_Store" ||
+    name === "Thumbs.db" ||
+    name === "4913" // vim's write-probe file
+  );
+}

package/scripts/tot-dev.mjs

@@ -49,6 +49,7 @@
  * Ctrl-C stops the server. Exit 1 = can't resolve tenant/domain/workspace; 2 = bad usage.
  */
 import { spawn, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
 import {
   readFileSync,
   existsSync,
@@ -356,10 +357,22 @@ const devSourceRoot = resolveDevSourceRoot(workspacePath, repoRoot, tenant);
 const spawnEnv = workspacePath
   ? { ...process.env, ASTRO_DEV_BACKGROUND: "1", TOT_DEV_TENANT: tenant, TOT_DEV_SOURCE_ROOT: devSourceRoot }
   : { ...process.env, TOT_DEV_TENANT: tenant, TOT_DEV_SOURCE_ROOT: devSourceRoot };
+// LAUNCHER-AGNOSTIC astro spawn: the published runner tree may have been
+// installed by pnpm OR npm (npm ships with every Node — the runner must not
+// require pnpm at RUNTIME), so resolve astro's real entry through Node's own
+// resolver from the app package and exec it with our Node. No package-manager
+// binary, no .bin shims, and no coupling to the package's name (the build
+// renames @tot/storefront → @tot/storefront-runner in the shipped tree, which
+// the old `pnpm --filter <name> exec` had to track).
+const appDir = resolve(repoRoot, "apps/storefront");
+const astroEntry = resolve(
+  dirname(createRequire(join(appDir, "package.json")).resolve("astro/package.json")),
+  "bin/astro.mjs", // astro's package.json bin entry
+);
 const child = spawn(
-  "pnpm",
-  ["--filter", "@tot/storefront-runner", "exec", "astro", "dev", "--port", port, "--host"],
-  { cwd: repoRoot, stdio: "inherit", env: spawnEnv },
+  process.execPath,
+  [astroEntry, "dev", "--port", port, "--host"],
+  { cwd: appDir, stdio: "inherit", env: spawnEnv },
 );
 
 // Clean up grafts on every exit path so we never leave symlinks in the tree.

package/apps/storefront/src/components/commerce/FoxyLoader.astro

@@ -1,23 +0,0 @@
----
-/**
- * <FoxyLoader> — injects FoxyCart's loader.js (Track A).
- *
- * Foxy's loader turns our add-to-cart forms/links into the sidecart + hosted
- * checkout ("Powered by FoxyCart"). It's loaded from the store's CDN path and
- * must sit near the end of <body>. Rendered only when the tenant has a store
- * (locals.commerce); marketing tenants ship nothing.
- *
- * Note: Foxy's loader is a mutable, versioned CDN artifact and does NOT support
- * Subresource Integrity — pinning a hash would break it on Foxy's next release.
- * It's constrained instead by the per-tenant CSP allowlist (cdn.foxycart.com +
- * the store origin) set in middleware. It is loaded as a plain cross-origin
- * script (NO `crossorigin` attribute) — cdn.foxycart.com serves it without CORS
- * headers, so `crossorigin="anonymous"` would make the browser block it.
- */
-const { commerce } = Astro.locals;
----
-{
-  commerce && (
-    <script src={commerce.loaderSrc} async defer></script>
-  )
-}

package/apps/storefront/src/pages/api/dev/activity.ts

@@ -1,124 +0,0 @@
-/**
- * GET/POST /api/dev/activity — the hosted /dev panel's file-level activity
- * feed (local→hosted activity bridge). See handoff
- * 2026-07-14-hosted-dev-activity-bridge-and-stepper.
- *
- * GET: the signed-in developer's own browser polls this (same capability gate
- * as every other /dev route) to render the activity log and feed the Step-2
- * gate's completion signal. POLL, not a held-open stream — Cloudflare Workers
- * are stateless per request, so a poll means a Worker redeploy mid-session
- * needs no reconnect logic on either side.
- *
- * POST: the developer's LOCAL dev-loop process reports one file save,
- * authorized by the opaque bearer minted alongside their cli-signin-code
- * paste (lib/dev/activityIngestToken.ts) — NOT the browser session cookie,
- * since the local process has no cookie.
- */
-import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { readKv } from "@/lib/env";
-import { resolvePreviewTenant } from "@/config/previewTenantLookup";
-import { verifyActivityIngestToken } from "@/lib/dev/activityIngestToken";
-import {
-  appendActivity,
-  readActivity,
-  describeActivity,
-  type ActivityEvent,
-  type ActivityEventKind,
-} from "@/lib/dev/activityStore";
-import { readRuntime, writeRuntime, shapeRuntime, toRuntimeView } from "@/lib/dev/runtimeStore";
-
-export const prerender = false;
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const session = await readViewerSession({ cookies: context.cookies });
-  if (!session) return json({ error: "sign in required" }, 401);
-  if (!session.capability || session.capability === "none") {
-    return json({ error: "no developer capability on this account" }, 403);
-  }
-
-  // Same tenant resolution every other /dev route uses — the session's own store,
-  // never caller input.
-  const wanted = (session.tenants?.[0]?.resource ?? session.resource ?? "").toLowerCase();
-  const tenant = wanted ? await resolvePreviewTenant(wanted) : null;
-  if (!tenant) return json({ error: "no store linked to this account" }, 403);
-
-  const kv = await readKv("TENANT_CACHE");
-  const events = kv ? await readActivity(kv, tenant.tenant_id) : [];
-  // The LIVE local-dev runtime (latest heartbeat), separate from the file-save
-  // feed — the cockpit renders it as a clickable local link + CLI version, with
-  // `live` computed server-side so a skewed local clock can't fake liveness.
-  const runtime = kv ? await readRuntime(kv, tenant.tenant_id) : null;
-  return json({
-    events: events.map((e) => ({ ...e, description: describeActivity(e.file, e.event) })),
-    runtime: runtime ? toRuntimeView(runtime) : null,
-  });
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const auth = context.request.headers.get("authorization") || "";
-  const m = /^Bearer\s+(.+)$/i.exec(auth);
-  if (!m) return json({ error: "missing bearer token" }, 401);
-
-  const sessionKv = await readKv("SESSION");
-  if (!sessionKv) return json({ error: "activity bridge not configured" }, 503);
-  const claims = await verifyActivityIngestToken(sessionKv, m[1] ?? "");
-  if (!claims) return json({ error: "invalid or expired token" }, 401);
-
-  let body: {
-    file?: unknown;
-    event?: unknown;
-    at?: unknown;
-    cliVersion?: unknown;
-    runnerVersion?: unknown;
-    url?: unknown;
-  };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-
-  // The token's own bound tenant, never a caller-supplied one — a stolen/expired
-  // token can't be redirected at a different vendor's runtime/activity feed.
-  const tenant = await resolvePreviewTenant(claims.tenant.toLowerCase());
-  if (!tenant) return json({ error: "no store linked to this token" }, 403);
-  const tenantCache = await readKv("TENANT_CACHE");
-
-  // Heartbeat: latest-wins local-dev runtime (CLI version + live localhost URL),
-  // stored SEPARATELY from the file-save ring buffer. Not a file event, so it
-  // takes no `file`; liveness is stamped from the SERVER clock (aliveAt), never
-  // the client's `at`.
-  if (body.event === "heartbeat") {
-    if (!tenantCache) return json({ ok: true, stored: false }); // no KV in this runtime (dev)
-    await writeRuntime(tenantCache, tenant.tenant_id, shapeRuntime(body, Date.now()));
-    return json({ ok: true, stored: true, kind: "runtime" });
-  }
-
-  const isUp = body.event === "up";
-  const file = typeof body.file === "string" ? body.file : "";
-  if (!file && !isUp) return json({ error: "file is required" }, 400);
-  // A file-relative path never needs to be long; cap it so a misbehaving or
-  // hostile bridge-token holder can't inflate the per-tenant KV ring-buffer
-  // entry toward KV's per-value size limit.
-  if (file.length > 512) return json({ error: "file path too long" }, 400);
-  const event: ActivityEventKind = isUp
-    ? "up"
-    : body.event === "add" || body.event === "unlink"
-      ? body.event
-      : "change";
-  const at = typeof body.at === "number" && Number.isFinite(body.at) ? body.at : Date.now();
-
-  if (!tenantCache) return json({ ok: true, stored: false }); // no KV in this runtime (dev) — accepted, not stored
-
-  const ev: ActivityEvent = { file, event, at };
-  await appendActivity(tenantCache, tenant.tenant_id, ev);
-  return json({ ok: true, stored: true });
-}

package/apps/storefront/src/pages/api/dev/cli-signin-code.ts

@@ -1,73 +0,0 @@
-/**
- * POST /api/dev/cli-signin-code — mint a browserless CLI sign-in command for the
- * SIGNED-IN developer (DevAccess #8425). The /dev getting-started page calls this to
- * render a copyable `tot login --code <token>` so the developer's terminal signs in with
- * no second browser round-trip and no OTP.
- *
- * AUTHORIZATION: the viewer's own session (the `tot_session` cookie). 401 if not signed
- * in, 403 if the session carries no developer capability (nothing to sign a CLI into).
- * The minted-for email is the VERIFIED session email — NEVER read from the body — so a
- * developer can only mint a code for themselves.
- *
- * TENANT-SCOPED CODE (roadtoa3 postmortem, 2026-07-12): the mint also carries the
- * developer's OWN tenant (their invite's vendor, the same resolution /dev renders with —
- * first membership, else the session resource; never client input). The MCP stores it
- * with the code so `tot login --code` lands the terminal ALREADY SCOPED to that vendor —
- * `tot start` goes straight to their store's source, no client_list round-trip, no
- * "no stores you can build on yet". See handoff
- * `2026-07-12-tot-mcp-cli-code-tenant-binding` for the MCP half (store tenant with the
- * code + write the durable subject-capability binding at mint).
- *
- * The response `command` CONTAINS the single-use token; it is returned only to this
- * authenticated developer's own browser and is never logged server-side.
- */
-import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { mintCliSignInCommand } from "@/lib/dev/cliSignInCode";
-import { mintActivityIngestToken } from "@/lib/dev/activityIngestToken";
-import { readKv } from "@/lib/env";
-
-export const prerender = false;
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const session = await readViewerSession(context);
-  if (!session) return json({ error: "not signed in" }, 401);
-  // Same gate the /dev page applies (hasStoreAccess): a real developer capability. A
-  // no-capability session has no scoped CLI session to mint.
-  if (!session.capability || session.capability === "none") {
-    return json({ error: "no developer access on this session", reason: "notEligible" }, 403);
-  }
-
-  // The developer's own vendor — the tenant their invite granted (same resolution /dev
-  // renders with). Rides with the code so the CLI session lands on this store directly.
-  const tenant = session.tenants?.[0]?.resource ?? session.resource ?? null;
-
-  // Mint the local→hosted activity-bridge credential alongside the CLI code (best
-  // effort — a runtime without the SESSION KV binding just omits it, and the local
-  // loop runs with no hosted signal, same as before this existed).
-  let activityBridge: { token: string; url: string } | null = null;
-  const sessionKv = await readKv("SESSION");
-  if (sessionKv && tenant) {
-    const { token } = await mintActivityIngestToken(sessionKv, {
-      email: session.email,
-      tenant,
-      capability: session.capability,
-    });
-    activityBridge = { token, url: context.url.origin };
-  }
-
-  const result = await mintCliSignInCommand(session.email, tenant, {}, activityBridge);
-  if (!result.ok) {
-    // 503 = seam not configured / MCP route unmounted; 502 = MCP fault. Surface neither
-    // the token nor internal detail beyond a terse reason.
-    return json({ error: "CLI sign-in code unavailable", reason: result.reason }, result.status);
-  }
-  return json({ command: result.command, expiresAt: result.expiresAt });
-}

package/apps/storefront/src/pages/api/dev/diff.ts

@@ -1,68 +0,0 @@
-/**
- * GET /api/dev/diff?path= — Phase 2 (cp-diff) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit, decision
- * architecture-environment-aware-cockpit). Diffs the developer's draft
- * overlay against published for one path, returning the SAME shape as the
- * local loop's `/__tot/diff` (scripts/dev/git-status.mjs handleDiff —
- * {ok,path,status,shown,before,after}) so dev.astro's existing diff UI
- * (doDiff/renderDiff) needs no client-side change.
- *
- * No git in the Worker — "status" derives from draft-present-vs-published
- * instead of `git status`: "unchanged" (no draft, or draft equals
- * published), "modified" (draft differs from an existing published value),
- * "added" (a draft exists for a path with no published counterpart yet —
- * e.g. a brand-new pages-html/<slug>.html the developer hasn't published).
- * Both sides are the raw-HTML/JSON writable surface, always text — no binary
- * degrade case exists here (unlike the local loop's arbitrary file tree).
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import {
-  resolveCockpitContext,
-  isCockpitContext,
-  isWritablePath,
-  readPublishedPath,
-  resolveDraftState,
-} from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-const MAX_DIFF_BYTES = 512 * 1024;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-
-  const path = new URL(context.request.url).searchParams.get("path");
-  if (!path) return json({ ok: false, status: "no_path", message: "path query param is required" }, 400);
-  if (!isWritablePath(path)) {
-    return json({ ok: false, status: "bad_path", message: `Not available on the hosted panel: ${path}` }, 400);
-  }
-
-  const [published, { draftContent }] = await Promise.all([
-    readPublishedPath(ctx, path),
-    resolveDraftState(context, ctx, path),
-  ]);
-
-  if (published === null && draftContent === null) {
-    return json({ ok: false, status: "not_found", message: `No such file: ${path}` }, 404);
-  }
-
-  const status =
-    draftContent === null
-      ? "unchanged"
-      : published === null
-        ? "added"
-        : draftContent === published
-          ? "unchanged"
-          : "modified";
-
-  const before = published ?? "";
-  const after = draftContent ?? published ?? "";
-  const size = new TextEncoder().encode(before + after).length;
-  if (size > MAX_DIFF_BYTES) {
-    return json({ ok: true, path, status, shown: false, reason: "too_big" });
-  }
-
-  return json({ ok: true, path, status, shown: true, before, after });
-}

package/apps/storefront/src/pages/api/dev/file.ts

@@ -1,57 +0,0 @@
-/**
- * GET /api/dev/file?path= — Phase 1 (cp-file) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit, decision
- * architecture-environment-aware-cockpit). Reads one file off the same
- * synthesized tree cp-tree (/api/dev/tree) lists, mirroring the local loop's
- * `/__tot/file` response contract (scripts/dev/file-browser.mjs readFile/
- * handleFile) so dev.astro's filesScript viewer needs no client-side change.
- *
- * `path` is one of the three shapes cp-tree ever lists — content/home.html,
- * content/pages-html/<slug>.html, or theme.json (scripts/dev/safe-path.mjs
- * WRITE_ALLOWLIST) — so this route is a closed switch on those shapes, not a
- * general path resolver; anything else is a clean 400, never a traversal risk.
- *
- * Reads the developer's OWN draft overlay first (readEffectivePath), falling
- * back to published — so re-opening a file after a cp-write save shows the
- * edit, and the `mtimeMs` it hands back is the SAME contentVersion() cp-write
- * checks on the next save (the C6 stale-write guard).
- *
- * `writable:true` on all three is intentional now that cp-write exists: this
- * is genuinely the editable surface.
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import {
-  resolveCockpitContext,
-  isCockpitContext,
-  isWritablePath,
-  languageForPath,
-  readEffectivePath,
-  contentVersion,
-} from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-const MAX_FILE_BYTES = 512 * 1024;
-
-export async function GET(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-
-  const path = new URL(context.request.url).searchParams.get("path");
-  if (!path) return json({ ok: false, status: "no_path", message: "path query param is required" }, 400);
-  if (!isWritablePath(path)) {
-    return json({ ok: false, status: "bad_path", message: `Not available on the hosted panel: ${path}` }, 400);
-  }
-
-  const { content } = await readEffectivePath(context, ctx, path);
-  if (content === null) return json({ ok: false, status: "not_found", message: `No such file: ${path}` }, 404);
-
-  const language = languageForPath(path);
-  const mtimeMs = contentVersion(content);
-  const size = new TextEncoder().encode(content).length;
-  if (size > MAX_FILE_BYTES) {
-    return json({ ok: true, status: "ok", path, tooBig: true, size, language, content: null, mtimeMs, writable: true });
-  }
-  return json({ ok: true, status: "ok", path, size, language, content, mtimeMs, writable: true });
-}

package/apps/storefront/src/pages/api/dev/locate.ts

@@ -1,125 +0,0 @@
-/**
- * POST /api/dev/locate — Phase 2 (cp-locate) of the hosted /dev cockpit
- * (workstream tot-lime-cloud-dev-cockpit, decision
- * architecture-environment-aware-cockpit). Click-to-source in the Worker:
- * given a clicked preview URL + captured DOM path, resolve the source
- * line:col in the developer's raw-HTML content, using the exact SAME pure
- * parse5 walk as the local loop (scripts/dev/locate.mjs `locate()`) and the
- * same URL -> content-path mapping (scripts/dev/locate-handler.mjs
- * `resolvePageSource`), both imported directly (dependency-free besides
- * parse5, safe in the Worker).
- *
- * Honors decision click-to-source-anchors-at-content-region from the
- * local-loop board: a click resolves against the raw content region only; the
- * storefront's own chrome (header/nav/footer, not in tenant source) refuses
- * explicitly with `not_in_content`, never a coincidental miss.
- *
- * Unlike the local route, this reads the developer's DRAFT overlay first
- * (readEffectivePath) — correct, since that's what their preview iframe is
- * actually showing once they've saved an edit (cp-write). No open-in-editor
- * equivalent: the jump lands in the in-cockpit editor via the existing
- * tot:locate postMessage handler (c8Script), already wired and unchanged.
- *
- * Only `locate()` itself is imported from scripts/dev/locate.mjs (pure,
- * parse5-only — Workers-safe). The URL->content-path mapping
- * (resolvePageSource in scripts/dev/locate-handler.mjs) is reimplemented
- * here rather than imported, because that module also pulls in node:fs +
- * node:child_process (open-in-editor) which have no place in a Worker
- * bundle; isWritablePath (hostedCockpit.ts) already IS this route's write
- * allowlist, so the two definitions can't drift.
- *
- * NOTE (scope): this ships the server contract only. The client picker
- * widget (src/lib/dev/ai-widget-client.js) that lets a developer click an
- * element in the preview has no hosted injection path yet (dev-only today,
- * see rawMarketingHtml.ts) — tracked separately as cp-locate-widget-injection
- * so that security-sensitive gating gets its own review rather than riding
- * in here.
- */
-import type { APIContext } from "astro";
-import { json } from "@/lib/grants/route.js";
-import { locate } from "../../../../../../scripts/dev/locate.mjs";
-import {
-  resolveCockpitContext,
-  isCockpitContext,
-  readEffectivePath,
-  isWritablePath,
-} from "@/lib/dev/hostedCockpit";
-
-export const prerender = false;
-
-interface LocateBody {
-  path?: unknown;
-  domPath?: unknown;
-}
-
-/**
- * Map a clicked preview URL to its raw-HTML content source, root-relative.
- * Mirrors scripts/dev/locate-handler.mjs's resolvePageSource exactly (see
- * that module's header for the mapping rules); duplicated rather than
- * imported for the node:fs-free-Worker-bundle reason above.
- */
-function resolvePreviewPageSource(pathname: string, appDomain: string): string | null {
-  let clean: string;
-  try {
-    clean = decodeURIComponent(pathname.split("?")[0]!.split("#")[0]!);
-  } catch {
-    return null;
-  }
-  const segments = clean.split("/").filter(Boolean);
-  if (segments.length && segments[0] === appDomain) segments.shift();
-  if (segments.some((s) => s === "..")) return null;
-  const rel = segments.length === 0 ? "content/home.html" : `content/pages-html/${segments.join("/")}.html`;
-  return isWritablePath(rel) ? rel : null;
-}
-
-function isDomPath(domPath: unknown): domPath is Array<{ tag: string; index: number }> {
-  return (
-    Array.isArray(domPath) &&
-    domPath.length > 0 &&
-    domPath.every(
-      (s) => s && typeof s === "object" && typeof (s as any).tag === "string" && Number.isFinite(Number((s as any).index)),
-    )
-  );
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  const ctx = await resolveCockpitContext(context);
-  if (!isCockpitContext(ctx)) return ctx;
-
-  let body: LocateBody;
-  try {
-    body = (await context.request.json()) as LocateBody;
-  } catch {
-    return json({ ok: false, status: "bad_json", message: "invalid JSON body" }, 400);
-  }
-
-  if (!isDomPath(body.domPath)) {
-    return json({ ok: false, status: "bad_dom_path", message: "domPath must be a non-empty array of {tag,index}" }, 400);
-  }
-
-  const rel = typeof body.path === "string" ? resolvePreviewPageSource(body.path, ctx.tenant.appDomain) : null;
-  if (!rel) {
-    return json({
-      ok: false,
-      status: "not_raw_html",
-      message: "This page isn’t a raw-HTML content page — click-to-source is for content/*.html tenants.",
-    });
-  }
-
-  const { content } = await readEffectivePath(context, ctx, rel);
-  if (content === null) {
-    return json({ ok: false, status: "not_raw_html", message: "No raw-HTML source backs this page." });
-  }
-
-  const found = locate(content, body.domPath);
-  if (typeof (found as { line?: number }).line === "number") {
-    const { line, col } = found as { line: number; col: number };
-    return json({ ok: true, path: rel, line, col });
-  }
-  return json({
-    ok: false,
-    status: "not_in_content",
-    message:
-      "That element is part of the storefront frame (header, nav, or footer), not your content source. Click something inside your page content.",
-  });
-}