@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -0,0 +1,150 @@
+/**
+ * Shared emit helper for UI-ORIGINATED operational activity.
+ *
+ * The UI cohort's entry point onto the actor×action telemetry contract. It sits
+ * ON TOP of the server emitter ({@link recordActivity}) — every admin/cockpit action
+ * handler already runs SERVER-SIDE in the same Worker, so a UI action reaches
+ * telemetry through the same in-process `recordActivity()` call the server path uses (one
+ * structured Workers-Logs line), NOT a client-side `fetch` to the ingest endpoint.
+ * There is no browser-only signal to capture: an admin/cockpit "Publish / Connect /
+ * Invite / Approve / Rollback" click is a server-rendered form/JSON POST to an API
+ * route, so the route handler that already does the work is exactly where the emit
+ * belongs (zero extra HTTP round-trip, no new auth/trust boundary). The HMAC
+ * ingest path exists for emitters that CAN'T call `recordActivity()` directly (the
+ * out-of-process CLI cohort) — it is not this cohort's path.
+ *
+ * WHAT THIS ADDS over calling `recordActivity()` raw: it stamps `source: "ui"` and,
+ * critically, resolves the ACTOR KIND from the authenticated session so the timeline
+ * can attribute an action to the right cohort:
+ *
+ *   • "admin"    — a ToT-STAFF viewer (the session carries `staff[]` scope). ToT
+ *                  operators acting through the admin shell / staff vendor selection.
+ *   • "merchant" — a store OWNER acting on THEIR OWN store (a signed-in viewer whose
+ *                  host-bound capability is owner/admin). The self-serve cohort.
+ *   • "dev"      — a signed-in DEVELOPER viewer who is neither staff nor owner (e.g. a
+ *                  ship-on-behalf developer invited onto someone else's store).
+ *   • "agent"    — a HEADLESS, capability-driven caller with no human viewer session
+ *                  (the Bearer/CLI operator seam) — automation acting on the surface.
+ *
+ * The classifier is a PURE function ({@link classifyActorKind}) so the cohort mapping
+ * is unit-tested without a live request. The opaque `actor.id` is the salted,
+ * non-reversible hash of the acting identity (never raw PII in the core zone) — the
+ * SAME {@link hashActorId} + `ACTIVITY_ACTOR_SALT` the server path uses, so one person stays
+ * correlatable across the CLI, server, and UI cohorts.
+ *
+ * USAGE (mirrors reject.ts — resolve the actor ONCE after auth, emit at each
+ * exit point, zero change to the handler's control flow):
+ *
+ *   const actor = await resolveUiActor(context, { owner: auth.owner });
+ *   // …do the work…
+ *   recordUiActivity(actor, { action: "change.ship", outcome: { status: "succeeded" }, scope });
+ */
+import type { APIContext } from "astro";
+import type {
+  ActivityActor,
+  ActorKind,
+  ActivityOutcome,
+  ActivityScope,
+  ActivityPayload,
+} from "@tot/public-runtime";
+import type { ActionKey } from "@tot/public-runtime";
+import { readViewerSession } from "@/lib/auth/route";
+import { isStaffSession } from "@/lib/dashboard/staffAdmission";
+import { readEnv } from "@/lib/env";
+import { hashActorId, recordActivity } from "./recordActivity";
+
+/** The host-bound capabilities that mark a viewer as the store OWNER (merchant). */
+const OWNER_CAPABILITIES = new Set(["owner", "admin"]);
+
+/** The minimal viewer chrome the middleware stamps on `locals.viewer`. */
+interface ViewerLike {
+  email?: string;
+  capability?: string;
+}
+
+/**
+ * Classify the acting cohort from the authenticated session — PURE so the mapping is
+ * testable without a request. Order matters and is fail-safe:
+ *
+ *   1. no signed-in viewer  → "agent" (headless Bearer/CLI operator — capability-
+ *      driven automation; there is no human identity on this request).
+ *   2. ToT-staff session    → "admin" (checked BEFORE ownership: a staff viewer who
+ *      entered a vendor via a live selection carries an owner-ish host capability, but
+ *      they are ToT staff, not the merchant).
+ *   3. owner/admin capability on this host → "merchant" (the store owner on their own store).
+ *   4. otherwise            → "dev" (a signed-in developer without ownership, e.g.
+ *      ship-on-behalf).
+ */
+export function classifyActorKind(
+  viewer: ViewerLike | null | undefined,
+  session: { staff?: string[] } | null | undefined,
+): ActorKind {
+  if (!viewer?.email) return "agent";
+  if (isStaffSession(session)) return "admin";
+  if (viewer.capability && OWNER_CAPABILITIES.has(viewer.capability)) return "merchant";
+  return "dev";
+}
+
+export interface ResolveUiActorInput {
+  /**
+   * Fallback acting identity for the HEADLESS path (no signed-in viewer) — typically
+   * the resolved tenant owner (`auth.owner`). Only used to seed the opaque id when
+   * there is no viewer email; never stored raw (always hashed).
+   */
+  owner?: string;
+}
+
+/**
+ * Resolve the {@link ActivityActor} for a UI-originated action from the request's
+ * authenticated session. Reads the full viewer session ONCE (for the staff scope the
+ * host-bound `locals.viewer` chrome doesn't carry) and computes the opaque, salted
+ * actor id. Best-effort: any read fault degrades to a coarse non-PII actor rather
+ * than throwing — telemetry must never break the action it describes. Resolve this
+ * ONCE per request (after auth) and reuse the result across every emit exit point.
+ */
+export async function resolveUiActor(
+  context: APIContext,
+  input: ResolveUiActorInput = {},
+): Promise<ActivityActor> {
+  // The host-bound `locals.viewer` chrome omits `staff[]`, so read the full session
+  // to tell a ToT-staff (admin) actor from a store owner (merchant). Best-effort.
+  const session = await readViewerSession(context).catch(() => null);
+  // Prefer the host-scoped `locals.viewer` (set by middleware for tenant-gated
+  // surfaces — the ship/grants routes); fall back to the raw session's
+  // email/capability for a route that never went through that host gate (e.g. the
+  // /dev cockpit's rendezvous-approval endpoint) but still has a real signed-in
+  // viewer. Both describe the SAME signed-in-or-not shape.
+  const viewer: ViewerLike | undefined =
+    (context.locals?.viewer as ViewerLike | undefined) ??
+    (session ? { email: session.email, capability: session.capability } : undefined);
+  const kind = classifyActorKind(viewer, session);
+  const identifier = viewer?.email ?? input.owner ?? "system";
+  const id = await hashActorId(identifier, await readEnv("ACTIVITY_ACTOR_SALT"));
+  return { kind, id };
+}
+
+/**
+ * Emit ONE UI-originated activity event with a PRE-RESOLVED actor. A thin, SYNC
+ * wrapper over {@link recordActivity} that stamps `source: "ui"` — so a handler
+ * calls it at each exit point (succeeded / failed / refused) exactly as the server
+ * emitters do, with no control-flow change. Best-effort + never throws (inherited
+ * from `recordActivity`).
+ */
+export function recordUiActivity(
+  actor: ActivityActor,
+  input: {
+    action: ActionKey;
+    outcome: ActivityOutcome;
+    scope?: ActivityScope;
+    payload?: ActivityPayload;
+  },
+): void {
+  recordActivity({
+    action: input.action,
+    actor,
+    source: "ui",
+    outcome: input.outcome,
+    ...(input.scope ? { scope: input.scope } : {}),
+    ...(input.payload ? { payload: input.payload } : {}),
+  });
+}

package/apps/storefront/src/lib/activity/workerCommit.ts

@@ -0,0 +1,70 @@
+/**
+ * worker_commit — build provenance for the running Worker.
+ *
+ * The commit SHA THIS Worker build was cut from, made available REPO-WIDE at
+ * runtime so every server-emitted ActivityEvent can carry it (see event.ts
+ * `ActivityScope.workerCommit`) and the query surface can derive **deploy skew** — "is the
+ * build serving this request == the pushed umbrella tip, or is a stale worker
+ * still live?".
+ *
+ * HOW IT GETS HERE. Workers have no filesystem/git at runtime, so the SHA is
+ * baked in at BUILD time: astro.config.mjs's Vite `define` replaces the
+ * `__GIT_SHA__` token with a string literal of the build's commit (CI-provided
+ * `GIT_SHA`/`WORKERS_CI_COMMIT_SHA`/`GITHUB_SHA`, else local `git rev-parse`,
+ * else "unknown"). This is the SAME source /health already reports (lib/health.ts)
+ * — we read it through the identical `typeof` guard so both agree by construction,
+ * and so the value is safe under vitest (where the define isn't applied → "unknown").
+ *
+ * This is the single accessor the whole repo threads through: recordActivity()
+ * spreads serverActivityScope() into every server event; the deploy.version_observed
+ * emitter (deployVersion.ts) reads workerCommit() directly.
+ */
+import type { ActivityScope } from "@tot/public-runtime";
+
+/** Sentinel when the build had no git context (also the vitest value). */
+export const UNKNOWN_COMMIT = "unknown";
+
+/**
+ * The commit SHA this Worker build was cut from, or "unknown". Never throws; the
+ * `typeof` guard keeps it safe under vitest (the `__GIT_SHA__` define is only
+ * applied by the Astro/Vite build). Optionally overridable for tests.
+ */
+export function workerCommit(override?: string): string {
+  if (override != null) return override;
+  return typeof __GIT_SHA__ !== "undefined" ? __GIT_SHA__ : UNKNOWN_COMMIT;
+}
+
+/** First 7 chars of the build commit for eyeballing against `git log`, or "unknown". */
+export function workerCommitShort(override?: string): string {
+  const sha = workerCommit(override);
+  return sha === UNKNOWN_COMMIT ? UNKNOWN_COMMIT : sha.slice(0, 7);
+}
+
+/**
+ * True when the build has a real git commit (not the "unknown" sentinel). The
+ * skew derivation only compares against the umbrella tip when this holds — an
+ * "unknown" build can't be meaningfully skew-checked.
+ */
+export function hasKnownWorkerCommit(override?: string): boolean {
+  return workerCommit(override) !== UNKNOWN_COMMIT;
+}
+
+/**
+ * Build the CORE scope for a SERVER-sourced ActivityEvent with `worker_commit`
+ * stamped in. This is the seam recordActivity() spreads into every server
+ * event so provenance is present WITHOUT each call site remembering it:
+ *
+ *   createActivityEvent({ ..., source: "server", scope: serverActivityScope({ tenantId }) })
+ *
+ * Pass the event's other scope fields (tenantId/changeId/traceId) as `extra`;
+ * workerCommit always wins for the `workerCommit` slot. Omits the field entirely
+ * when the build commit is "unknown" so a downstream skew query never mistakes the
+ * sentinel for a real deployed SHA.
+ */
+export function serverActivityScope(extra?: ActivityScope): ActivityScope {
+  const sha = workerCommit();
+  return {
+    ...extra,
+    ...(sha !== UNKNOWN_COMMIT ? { workerCommit: sha } : {}),
+  };
+}

package/apps/storefront/src/lib/admin/adminShell.ts

@@ -0,0 +1,290 @@
+/**
+ * Admin console shell client logic — hash-router tab switching, the floating
+ * Ask envelope, tenant-picker navigation, and roving-tabindex keyboard nav for
+ * the tablists. Imported from a processed `<script>` in admin.astro (ADR 0013):
+ * type-checked, bundled, tree-shaken, and its bundle hash is in the enforced
+ * CSP. The Ask envelope is built with the shared, unit-tested
+ * `buildAskEnvelope` (ai/askEnvelope) instead of a hand-copied inline mirror.
+ *
+ * There is no chat backend yet — the Ask envelope is emitted for dev inspection
+ * only (window.__toTAdminAsk + a "tot:admin-ask" CustomEvent), never sent over
+ * the network.
+ */
+import { buildAskEnvelope, type AskEnvelope } from "./ai/askEnvelope";
+
+const TAB_IDS = [
+  "orders",
+  "products",
+  "subscriptions",
+  "customers",
+  "fulfillment",
+  "reporting",
+  "ai-workflows",
+  "blog",
+  "publish",
+  "settings",
+] as const;
+
+const ASK_CONTEXTS: Record<string, string> = {
+  orders: "Orders",
+  products: "Products",
+  subscriptions: "Subscriptions",
+  customers: "Customers",
+  fulfillment: "Fulfillment",
+  reporting: "Reporting",
+  "ai-workflows": "AI Workflows",
+  blog: "Blog",
+  publish: "Publish",
+  settings: "Settings",
+};
+
+declare global {
+  interface Window {
+    __toTAdminAsk?: AskEnvelope;
+  }
+}
+
+export function initAdminShell(): void {
+  const tabSet = new Set<string>(TAB_IDS);
+  const tabHashPattern = new RegExp(`^#(${TAB_IDS.join("|")})$`);
+  const canViewInternalGuide =
+    document.documentElement.dataset.internalAdminGuide === "true";
+  const defaultTab = canViewInternalGuide ? "orders" : "settings";
+
+  const buildAskEnvelopeForTab = (id: string): AskEnvelope => {
+    const root = document.documentElement.dataset;
+    const isStaff = root.adminIsStaff === "true";
+    const panel = document.getElementById(id);
+    const selectedRecordId =
+      panel?.querySelector<HTMLElement>("[data-admin-selected-id]")?.dataset
+        .adminSelectedId || null;
+
+    return buildAskEnvelope({
+      tenant: {
+        adminAppTenant: root.adminAppTenant ?? "",
+        targetTenant: root.adminTargetTenant ?? "",
+        operator: root.adminOperator || null,
+      },
+      isStaff,
+      activeTab: id,
+      selectedRecordId,
+    });
+  };
+
+  const setAskContext = (id: string): void => {
+    const label = ASK_CONTEXTS[id] ?? "Storefront";
+    const askButton = document.querySelector<HTMLElement>("[data-admin-ask]");
+    const askContext = document.querySelector<HTMLElement>(
+      "[data-admin-ask-context]",
+    );
+
+    if (askContext) askContext.textContent = label;
+    if (askButton) {
+      askButton.setAttribute("aria-label", `Ask about ${label}`);
+      askButton.setAttribute("title", `Ask about ${label}`);
+      askButton.dataset.askScope = id;
+    }
+
+    window.__toTAdminAsk = buildAskEnvelopeForTab(id);
+  };
+
+  const panelIdFromHash = (): string | null => {
+    const rawHash = window.location.hash.slice(1);
+    // The tab id is the part before any "?" query suffix (#publish?pr=42);
+    // the raw hash is still used for internal-guide anchor resolution.
+    const hash = rawHash.split("?")[0] ?? "";
+    if (!rawHash) return defaultTab;
+    if (tabSet.has(hash)) return hash;
+    if (!canViewInternalGuide) return defaultTab;
+
+    const target = rawHash ? document.getElementById(rawHash) : null;
+    const panel = target?.closest<HTMLElement>("[data-admin-panel]");
+    if (panel?.id && tabSet.has(panel.id)) return panel.id;
+
+    return null;
+  };
+
+  const setActiveTab = (id: string): void => {
+    if (!tabSet.has(id)) return;
+
+    document.documentElement.dataset.adminMode = "work-area";
+    document.documentElement.dataset.adminTab = id;
+    setAskContext(id);
+
+    document.querySelectorAll<HTMLElement>("[data-admin-panel]").forEach((panel) => {
+      const active = panel.id === id;
+      panel.hidden = !active;
+      panel.setAttribute("aria-hidden", active ? "false" : "true");
+    });
+
+    document
+      .querySelectorAll<HTMLAnchorElement>("[data-admin-tab-link]")
+      .forEach((link) => {
+        const active = link.hash === `#${id}`;
+        link.classList.toggle("active", active);
+
+        if (link.getAttribute("role") === "tab") {
+          link.setAttribute("aria-selected", active ? "true" : "false");
+          link.tabIndex = active ? 0 : -1;
+        }
+      });
+  };
+
+  const setGuideMode = (): void => {
+    if (!canViewInternalGuide) {
+      setActiveTab(defaultTab);
+      return;
+    }
+
+    document.documentElement.dataset.adminMode = "guide";
+    setAskContext(defaultTab);
+
+    document.querySelectorAll<HTMLElement>("[data-admin-panel]").forEach((panel) => {
+      panel.hidden = true;
+      panel.setAttribute("aria-hidden", "true");
+    });
+
+    document
+      .querySelectorAll<HTMLAnchorElement>("[data-admin-tab-link]")
+      .forEach((link) => {
+        link.classList.remove("active");
+
+        if (link.getAttribute("role") === "tab") {
+          link.setAttribute("aria-selected", "false");
+          link.tabIndex = 0;
+        }
+      });
+  };
+
+  const scrollWorkspaceToTop = (): void => {
+    const scroller = document.querySelector<HTMLElement>(".main");
+    const reset = (): void => {
+      if (scroller) {
+        scroller.scrollTo({ top: 0, left: 0 });
+        return;
+      }
+
+      window.scrollTo({ top: 0, left: 0 });
+    };
+
+    reset();
+    requestAnimationFrame(reset);
+    setTimeout(reset, 0);
+  };
+
+  const scrollToHashTarget = (panelId: string): void => {
+    const hash = window.location.hash.slice(1);
+    const target = hash ? document.getElementById(hash) : null;
+
+    if (!target || tabSet.has(hash) || target.id === panelId) {
+      scrollWorkspaceToTop();
+      return;
+    }
+
+    target?.scrollIntoView({ block: "start" });
+  };
+
+  const activateFromHash = ({ scroll = false }: { scroll?: boolean } = {}): void => {
+    const panelId = panelIdFromHash();
+
+    if (panelId) {
+      setActiveTab(panelId);
+      // Strip any query suffix before deciding whether the hash names a
+      // real tab — a valid deep link like #publish?pr=42 must not be
+      // normalized away to #settings for merchant viewers.
+      const hashTab = window.location.hash.slice(1).split("?")[0] ?? "";
+      if (!canViewInternalGuide && !tabSet.has(hashTab)) {
+        history.replaceState(null, "", "#settings");
+      }
+      if (scroll) requestAnimationFrame(() => scrollToHashTarget(panelId));
+      return;
+    }
+
+    setGuideMode();
+    if (scroll) {
+      const hash = window.location.hash.slice(1);
+      requestAnimationFrame(() =>
+        document.getElementById(hash)?.scrollIntoView({ block: "start" }),
+      );
+    }
+  };
+
+  document
+    .querySelector<HTMLSelectElement>("[data-admin-tenant-picker-select]")
+    ?.addEventListener("change", (event) => {
+      const params = new URLSearchParams(window.location.search);
+      params.set("asTenant", (event.target as HTMLSelectElement).value);
+      window.location.assign(
+        `${window.location.pathname}?${params}${window.location.hash}`,
+      );
+    });
+
+  // Emit the Ask envelope on open. No chat backend yet — dev-inspectable
+  // only via window.__toTAdminAsk (already kept current by setAskContext)
+  // and this "tot:admin-ask" CustomEvent.
+  document.querySelector("[data-admin-ask]")?.addEventListener("click", () => {
+    const activeTab = document.documentElement.dataset.adminTab ?? defaultTab;
+    const envelope = buildAskEnvelopeForTab(activeTab);
+    window.__toTAdminAsk = envelope;
+    document.dispatchEvent(new CustomEvent("tot:admin-ask", { detail: envelope }));
+    if (
+      window.location.hostname === "localhost" ||
+      window.location.hostname === "127.0.0.1"
+    ) {
+      console.debug("[admin:ask]", envelope);
+    }
+  });
+
+  document.addEventListener("click", (event) => {
+    const target =
+      event.target instanceof Element
+        ? event.target
+        : (event.target as Node | null)?.parentElement ?? null;
+    const link = target?.closest<HTMLAnchorElement>("a[href^='#']");
+    if (!link || !tabHashPattern.test(link.hash)) return;
+
+    event.preventDefault();
+    const id = link.hash.slice(1);
+    setActiveTab(id);
+    history.pushState(null, "", link.hash);
+    scrollWorkspaceToTop();
+  });
+
+  document.addEventListener("keydown", (event) => {
+    const target = event.target instanceof Element ? event.target : null;
+    const currentTab = target?.closest<HTMLElement>(
+      "[role='tab'][data-admin-tab-link]",
+    );
+    if (!currentTab) return;
+
+    // Filter to visible tabs only: the mobile tab bar and the internal
+    // Admin Tab Map can both be present in the DOM at once (one hidden
+    // via CSS depending on viewport/viewer), and this selector matches
+    // role="tab" elements in either — without this filter, arrow/home/
+    // end navigation could walk into a display:none tablist whose
+    // .focus() is a silent no-op.
+    const tabs = Array.from(
+      document.querySelectorAll<HTMLElement>("[role='tab'][data-admin-tab-link]"),
+    ).filter((el) => el.offsetParent !== null);
+    const currentIndex = tabs.indexOf(currentTab);
+    let nextIndex = currentIndex;
+
+    if (event.key === "ArrowRight") nextIndex = (currentIndex + 1) % tabs.length;
+    if (event.key === "ArrowLeft")
+      nextIndex = (currentIndex - 1 + tabs.length) % tabs.length;
+    if (event.key === "Home") nextIndex = 0;
+    if (event.key === "End") nextIndex = tabs.length - 1;
+
+    if (nextIndex === currentIndex) return;
+
+    const nextTab = tabs[nextIndex];
+    if (!nextTab) return;
+
+    event.preventDefault();
+    nextTab.focus();
+    nextTab.click();
+  });
+
+  window.addEventListener("hashchange", () => activateFromHash({ scroll: true }));
+  activateFromHash({ scroll: Boolean(window.location.hash) });
+}

package/apps/storefront/src/lib/admin/ai/approvalMode.ts

@@ -1,7 +1,6 @@
 /**
- * Canonical approval state machine (baseline §Settings / §AI Workflows,
- * ai-evidence-substrate item d). `settings.ts` and `aiWorkflows.ts` previously
- * declared their own copies of this union; both now import it from here.
+ * Canonical approval state machine. `settings.ts` and `aiWorkflows.ts` import
+ * this union from here.
  */
 export type ApprovalMode = "draft_only" | "approval_required" | "guarded_automation";
 

package/apps/storefront/src/lib/admin/ai/audit.ts

@@ -1,9 +1,7 @@
 /**
- * Canonical audit event model (baseline "Audit logs must record both the
- * operator and the target tenant"; ai-evidence-substrate item e). Every
- * mutation-shaped or AI-suggested action in the admin console should record
- * one of these, keyed by `targetTenant` — never `adminAppTenant`, per
- * decision `tenant-envelope-contract`.
+ * Canonical audit event model — records both the operator and the target
+ * tenant. Every mutation-shaped or AI-suggested action in the admin console
+ * should record one of these, keyed by `targetTenant` — never `adminAppTenant`.
  */
 export interface AuditEvent {
   /** The signed-in operator's email, or a system actor id for automation-triggered events. */

package/apps/storefront/src/lib/admin/checkoutStyleInput.ts

@@ -1,23 +1,23 @@
 /**
  * Validate + sanitize merchant-submitted checkout styling into a safe, complete
- * `CheckoutStyle` before it is published to the versioned spine (U12 save path).
+ * `CheckoutStyle` before it is published to the versioned spine (the save path).
  *
  * The submitted body is a partial (`DeepPartial<CheckoutStyle>`): a merchant may
  * set one field without restating the rest, so this merges any valid override
- * over `DEFAULT_CHECKOUT_STYLE` (reusing U10's `mergeCheckoutStyle`) and returns a
- * complete descriptor. It is the WRITE-side guard; the go-live GateReport (U13)
+ * over `DEFAULT_CHECKOUT_STYLE` (reusing `mergeCheckoutStyle`) and returns a
+ * complete descriptor. It is the WRITE-side guard; the GateReport
  * still does the deeper compliance/contrast/perf pass on promote.
  *
  * Two hard constraints enforced here:
  *   - **ASCII-safe.** Hosted checkout cache pass is not Unicode-safe — a non-ASCII
- *     byte in a value that U11 renders into the pushed CSS can blank the checkout.
+ *     byte in a value rendered into the pushed CSS can blank the checkout.
  *     Every provided string leaf must be printable ASCII.
- *   - **CSS-token hygiene.** These values are interpolated into generated CSS
- *     (U11), so we reject the characters that could break out of a declaration
+ *   - **CSS-token hygiene.** These values are interpolated into generated CSS,
+ *     so we reject the characters that could break out of a declaration
  *     (`;` `{` `}` `<` `>` and newlines). Defense-in-depth, not the full gate.
  *
  * Pure + dependency-free (no I/O, no Astro): unit-testable in isolation and safe
- * to reuse from the gate (U13) or the CSS renderer (U11) if promoted to
+ * to reuse from the gate or the CSS renderer if promoted to
  * public-runtime later.
  */
 import {

package/apps/storefront/src/lib/admin/checkoutStyleTarget.ts

@@ -1,9 +1,9 @@
 /**
- * Decide which tenant a checkout-style save may write to (U12b — staff
- * cross-tenant save).
+ * Decide which tenant a checkout-style save may write to — staff cross-tenant
+ * save.
  *
  * The base save gate (`resolveOwnerSession`) resolves the operator's OWN tenant
- * (the routed appDomain). U12 always wrote there. But a ToT-staff operator can
+ * (the routed appDomain). But a ToT-staff operator can
  * "operate as" another tenant via the admin picker (`?asTenant=`), and their
  * save must land on THAT tenant's artifact — provided they're actually
  * authorized for it. This resolver makes that decision, and it deliberately

package/apps/storefront/src/lib/admin/orderClient.ts

@@ -1,5 +1,5 @@
 /**
- * Server-side client for the checkout order READ API (card 8585 / U2).
+ * Server-side client for the checkout order READ API.
  *
  * Calls `GET /commerce/orders[/:orderId]` with the tenant's per-tenant bearer key
  * (the ToT `partnerApi.apiKey`, held as a Worker secret — NEVER shipped to the
@@ -8,8 +8,7 @@
  *
  * The fetch runs on the Cloudflare Worker (server), so the call is same-origin →
  * cross-service server-to-server; it is NOT browser-originated and therefore not
- * CSP-governed — the U2 CSP connect-src entry is intentionally skipped (board
- * decision `u2-csp-server-side-fetch`).
+ * CSP-governed — the CSP connect-src entry is intentionally skipped.
  *
  * `fetchImpl` is injectable so the client is unit-testable offline.
  */
@@ -68,8 +67,7 @@ export interface CheckoutOrderClientConfig {
 /**
  * Resolve the checkout order API base URL for an environment (contract §2).
  * qa/test use the non-prod proxy; live uses prod. Kept private so it does not
- * collide with U11b's exported checkout theme base URL before the units fold;
- * the integrator can dedup into one shared export.
+ * collide with the exported checkout theme base URL.
  */
 export function orderApiBaseUrl(env: CustomizationEnv): string {
   return env === "live"