@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/migrations-apps/meta/_journal.json

@@ -15,6 +15,62 @@
       "when": 1787074116807,
       "tag": "0001_woozy_lyja",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1787400126075,
+      "tag": "0002_good_switch",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1787403061681,
+      "tag": "0003_mute_marauders",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1787675399435,
+      "tag": "0004_deep_morph",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "6",
+      "when": 1787993394721,
+      "tag": "0005_common_mystique",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "6",
+      "when": 1788001135182,
+      "tag": "0006_broad_microchip",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "6",
+      "when": 1788007131463,
+      "tag": "0007_brave_outlaw_kid",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "6",
+      "when": 1788199945462,
+      "tag": "0008_blue_dazzler",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "6",
+      "when": 1788226793871,
+      "tag": "0009_bored_shinobi_shaw",
+      "breakpoints": true
     }
   ]
 }

package/apps/storefront/public/apps/tot.demo.analytics/0.1.0/entry.js

@@ -0,0 +1,42 @@
+/**
+ * ToT Demo Analytics — the exact-version entry module for the tot.demo.analytics
+ * tenant-local declaration (ext-kernel-09). Served same-origin and verbatim from
+ * apps/storefront/public/apps/…, it is the module the integration lifecycle runtime
+ * dynamically imports once its `analytics` consent purpose is eligible.
+ *
+ * It exports only the lifecycle contract (init, optional update/dispose). init()
+ * publishes a public window marker so a preview page demonstrably proves the entry
+ * ran, and sends a best-effort cookieless beacon to the declared analytics origin
+ * (permitted by the plan's CSP connect-src). No secret, no cross-origin script.
+ */
+const BEACON_ORIGIN = "https://demo-analytics.tokenoftrust.com";
+
+/** Publish a frozen, public marker other page code / a preview probe can observe. */
+function mark(phase) {
+  try {
+    const w = /** @type {Record<string, unknown>} */ (window);
+    const prior = Array.isArray(w.__TOT_DEMO_ANALYTICS__) ? w.__TOT_DEMO_ANALYTICS__ : [];
+    w.__TOT_DEMO_ANALYTICS__ = Object.freeze([...prior, { phase, at: Date.now() }]);
+  } catch {
+    /* a hardened window may reject the assignment — the marker is best-effort */
+  }
+}
+
+export function init() {
+  mark("init");
+  try {
+    if (typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function") {
+      navigator.sendBeacon(`${BEACON_ORIGIN}/collect`, "tot-demo:init");
+    }
+  } catch {
+    /* beacon is best-effort; a blocked/offline endpoint never breaks the page */
+  }
+}
+
+export function update(reason) {
+  mark(`update:${reason}`);
+}
+
+export function dispose() {
+  mark("dispose");
+}

package/apps/storefront/public/js/dashboard-team.js

@@ -42,11 +42,45 @@
       btn.title = "Re-send the sign-in email to " + m.developer;
       btn.addEventListener("click", () => resend(m.developer, btn));
       act.appendChild(btn);
+      if (m.inviteId) {
+        const revokeBtn = document.createElement("button");
+        revokeBtn.type = "button";
+        revokeBtn.className = "rowbtn";
+        revokeBtn.textContent = "Revoke";
+        revokeBtn.title = "Revoke " + m.developer + "'s access to this vendor";
+        revokeBtn.style.marginLeft = ".4rem";
+        revokeBtn.addEventListener("click", () => revoke(m.developer, m.inviteId, revokeBtn));
+        act.appendChild(revokeBtn);
+      }
       tr.appendChild(dev); tr.appendChild(roles); tr.appendChild(act);
       membersBody.appendChild(tr);
     }
   }
 
+  async function revoke(email, inviteId, btn) {
+    if (!confirm("Revoke " + email + "'s access to this vendor?")) return;
+    if (btn) btn.disabled = true;
+    showMsg("", "Revoking " + email + "'s access…");
+    try {
+      const res = await fetch("/api/grants/team-revoke", {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ tenant, inviteId, email }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (res.ok) {
+        showMsg("ok", "Revoked " + email + "'s access.");
+        loadMembers();
+      } else {
+        showMsg("err", body.error || ("Couldn't revoke (HTTP " + res.status + ")."));
+        if (btn) btn.disabled = false;
+      }
+    } catch (e) {
+      showMsg("err", "Couldn't revoke: " + (e && e.message ? e.message : e));
+      if (btn) btn.disabled = false;
+    }
+  }
+
   async function resend(email, btn) {
     if (btn) btn.disabled = true;
     showMsg("", "Re-sending the sign-in email to " + email + "…");
@@ -104,8 +138,10 @@
     btn.disabled = true;
     showMsg("", "Sending…");
     try {
-      // The role selector is present only for ToT staff (#8453); members are
-      // developer-only. tot20 ignores a non-staff role, so sending it is harmless.
+      // The role selector always shows Developer + Contributor (a plain member may
+      // self-request Contributor — tot20 honors it, handoff
+      // 2026-08-22-tot20-contributor-role); Admin/Owner render only for ToT staff
+      // (#8453) — tot20 ignores those two from a plain member and pins to developer.
       const roleEl = $("role");
       const role = roleEl && roleEl.value ? roleEl.value : undefined;
       const noteEl = $("note");

package/apps/storefront/public/platform/amplitude-http/v1/entry.mjs

@@ -0,0 +1,19 @@
+/**
+ * Data-only marker for the reviewed platform adapter runtime registry.
+ *
+ * This public path proves the exact versioned asset declared by the adapter is
+ * materialized. The lifecycle loader resolves this tuple to Storefront-owned code
+ * from its closed registry; this marker never imports or executes vendor code.
+ */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.amplitude",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/amplitude-http/v1/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-amplitude-http-v1",
+});

package/apps/storefront/public/platform/google-measurement/v1/entry.mjs

@@ -0,0 +1,19 @@
+/**
+ * Reviewed same-origin marker for the native GA4 platform adapter.
+ *
+ * The lifecycle host imports this exact-version asset, verifies every field, then
+ * constructs the adapter from its bundled @tot/public-runtime implementation with
+ * host-injected fetch. This file executes no vendor code and reads no browser global.
+ */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.google-measurement",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/google-measurement/v1/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-ga4-v1",
+});

package/apps/storefront/public/shared/commerce-chrome.css

@@ -146,6 +146,17 @@ body { overflow-x: clip; }
   font-size: .62rem; font-weight: 700; min-width: 16px; height: 16px; border-radius: var(--radius-full);
   display: grid; place-items: center; padding: 0 4px;
 }
+.header-cta {
+  border-radius: var(--radius-full); padding: 8px 16px;
+  font-family: var(--font-display, inherit); font-size: .875rem; font-weight: 500;
+  white-space: nowrap; transition: transform .15s ease, opacity .15s ease;
+}
+.header-cta--primary {
+  background: var(--color-accent); color: var(--color-primary-contrast);
+}
+.header-actions .header-cta--primary:hover { color: var(--color-primary-contrast); transform: translateY(-1px); }
+.header-cta--secondary, .header-cta--ghost { border: 1px solid currentColor; }
+.header-actions .header-cta--secondary:hover, .header-actions .header-cta--ghost:hover { opacity: .8; }
 .hamburger { display: none; flex-direction: column; gap: 5px; background: none; border: 0; padding: 6px; }
 .hamburger span { width: 26px; height: 2px; background: var(--color-text); border-radius: 2px; }
 
@@ -346,11 +357,18 @@ a.article-card__tag:hover { text-decoration: underline; }
   .tile-grid { grid-template-columns: repeat(3, 1fr); }
 }
 @media (max-width: 860px) {
-  .primary-nav { position: fixed; inset: 0 0 0 auto; width: min(84vw, 340px); background: var(--color-surface); box-shadow: var(--shadow-lg); transform: translateX(100%); transition: transform .25s ease; padding: 78px 20px 24px; overflow-y: auto; z-index: 120; }
-  .primary-nav.open { transform: none; }
+  /* No-JS base: the primary nav stays a normal, in-flow stacked list — always
+     visible and reachable by scroll/Tab with no script running at all. */
   .primary-nav > ul { flex-direction: column; align-items: stretch; gap: 4px; }
   .primary-nav a, .primary-nav .nav-item > a { display: block; padding: 12px 4px; border-bottom: 1px solid var(--color-border); }
   .hamburger { display: flex; }
+  /* Progressive enhancement only: CHROME_BEHAVIOR_JS stamps .js-nav on <html>
+     as soon as it runs, turning the same nav into an off-canvas drawer toggled
+     by the hamburger. Gating the fixed/off-screen positioning behind .js-nav
+     means a no-JS visitor always sees the nav in place — JS only changes its
+     PRESENTATION, never its reachability. */
+  .js-nav .primary-nav { position: fixed; inset: 0 0 0 auto; width: min(84vw, 340px); background: var(--color-surface); box-shadow: var(--shadow-lg); transform: translateX(100%); transition: transform .25s ease; padding: 78px 20px 24px; overflow-y: auto; z-index: 120; }
+  .js-nav .primary-nav.open { transform: none; }
   /* Mega panels: inline accordion on mobile */
   .mega { position: static; opacity: 1; visibility: visible; transform: none; box-shadow: none; border: 0; border-radius: 0; padding: 4px 4px 8px 14px; min-width: 0; }
   .mega--wide { min-width: 0; }

package/apps/storefront/scripts/build-v84-clean-clone-standalone.mjs

@@ -0,0 +1,68 @@
+/** Deterministically build the committed runtime-only clean-clone replay snapshot. */
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url));
+const storefrontDir = dirname(scriptsDir);
+const repositoryRoot = resolve(storefrontDir, "../..");
+const outputPath = resolve(repositoryRoot, "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs");
+
+export async function buildV84CleanCloneStandaloneBytes() {
+  const require = createRequire(import.meta.url);
+  const tsxRequire = createRequire(require.resolve("tsx/package.json"));
+  const esbuild = tsxRequire("esbuild");
+  if (tsxRequire("esbuild/package.json").version !== "0.28.1") {
+    throw new Error("The pinned standalone replay bundler changed.");
+  }
+  const fixture = readFileSync(resolve(
+    repositoryRoot,
+    "packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.redacted.json",
+  ), "utf8");
+  const runtimeLoaderPath = resolve(
+    repositoryRoot,
+    "packages/public-runtime/src/integration/lifecycle-boot.ts",
+  );
+  const result = await esbuild.build({
+    absWorkingDir: repositoryRoot,
+    entryPoints: ["apps/storefront/scripts/replay-v84-clean-clone-standalone.ts"],
+    outfile: "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs",
+    bundle: true,
+    write: false,
+    platform: "node",
+    format: "esm",
+    target: "node24",
+    charset: "utf8",
+    legalComments: "none",
+    sourcemap: false,
+    treeShaking: true,
+    plugins: [{
+      name: "remove-unused-standalone-runtime-loader",
+      setup(build) {
+        build.onLoad({ filter: /lifecycle-boot\.ts$/ }, (args) => {
+          if (args.path !== runtimeLoaderPath) {
+            throw new Error("The standalone runtime-loader removal target changed.");
+          }
+          return { contents: "export {};\n", loader: "ts" };
+        });
+      },
+    }],
+    define: { __V84_FIXED_FIXTURE_TEXT__: JSON.stringify(fixture) },
+    logLevel: "silent",
+  });
+  if (result.outputFiles.length !== 1) throw new Error("The standalone replay build output changed.");
+  const bytes = result.outputFiles[0].contents;
+  const source = Buffer.from(bytes).toString("utf8");
+  const loaderMatch = source.match(/\bimport\s*\(|\b(?:createRequire|tsImport)\s*\(/);
+  if (loaderMatch) {
+    throw new Error(`The standalone replay contains a dynamic module loader: ${loaderMatch[0]}`);
+  }
+  return bytes;
+}
+
+const invokedPath = fileURLToPath(import.meta.url) === process.argv[1];
+if (invokedPath) {
+  if (process.argv.length !== 2) throw new Error("The standalone replay build accepts no arguments.");
+  writeFileSync(outputPath, await buildV84CleanCloneStandaloneBytes());
+}

package/apps/storefront/scripts/deny-v84-clean-clone-standalone-capabilities.mjs

@@ -0,0 +1,111 @@
+/** Install the no-network/no-process/no-filesystem-mutation boundary inside the attested bundle. */
+import childProcess from "node:child_process";
+import cluster from "node:cluster";
+import dgram from "node:dgram";
+import dns from "node:dns";
+import fs from "node:fs";
+import http from "node:http";
+import http2 from "node:http2";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import vm from "node:vm";
+import workerThreads from "node:worker_threads";
+import { syncBuiltinESMExports } from "node:module";
+
+const MESSAGE = "Capability access is disabled for the fixed clean-clone replay.";
+const MUTATION_MESSAGE = "Mutation capability is disabled for the fixed clean-clone replay.";
+
+function deny() {
+  throw new Error(MESSAGE);
+}
+function denyMutation() {
+  throw new Error(MUTATION_MESSAGE);
+}
+function replace(target, name, value = deny) {
+  if (typeof target[name] !== "function") return;
+  Object.defineProperty(target, name, { configurable: false, enumerable: true, writable: false, value });
+}
+
+export async function installV84CleanCloneStandaloneCapabilityBoundary() {
+  replace(globalThis, "fetch");
+  replace(globalThis, "WebSocket");
+  replace(globalThis, "EventSource");
+  replace(globalThis, "Worker");
+  if (typeof process.execve === "function") replace(process, "execve");
+  for (const target of [http, https]) {
+    replace(target, "request");
+    replace(target, "get");
+    replace(target, "ClientRequest");
+  }
+  replace(http2, "connect");
+  replace(net, "connect");
+  replace(net, "createConnection");
+  replace(net.Socket.prototype, "connect");
+  replace(tls, "connect");
+  replace(tls.TLSSocket.prototype, "connect");
+  replace(dgram, "createSocket");
+  replace(dgram, "Socket");
+  for (const method of [
+    "lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa",
+    "resolveCname", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv",
+    "resolveTlsa", "resolveTxt", "reverse",
+  ]) {
+    replace(dns, method);
+    replace(dns.promises, method);
+  }
+  replace(dns, "Resolver");
+  replace(dns.promises, "Resolver");
+  for (const method of ["exec", "execFile", "execFileSync", "execSync", "fork", "spawn", "spawnSync"]) {
+    replace(childProcess, method);
+  }
+  replace(childProcess.ChildProcess.prototype, "spawn");
+  replace(childProcess, "ChildProcess");
+  replace(cluster, "fork");
+  for (const method of ["runInContext", "runInNewContext", "runInThisContext"]) {
+    replace(vm.Script.prototype, method);
+  }
+  for (const method of [
+    "Script", "compileFunction", "createScript", "runInContext", "runInNewContext", "runInThisContext",
+  ]) replace(vm, method);
+  replace(workerThreads, "Worker");
+
+  const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_RDWR |
+    fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_APPEND;
+  const readOnlyFlags = (flags) => typeof flags === "number"
+    ? (flags & WRITE_OPEN_FLAGS) === 0
+    : flags === "r" || flags === "rs" || flags === "sr";
+  const guardedOpen = (original) => function (path, flags, ...rest) {
+    if (!readOnlyFlags(flags)) return denyMutation();
+    return Reflect.apply(original, this, [path, flags, ...rest]);
+  };
+  const originalOpen = fs.open;
+  const originalOpenSync = fs.openSync;
+  const originalPromiseOpen = fs.promises.open;
+  const guardFileHandle = await originalPromiseOpen(process.execPath, "r");
+  const fileHandlePrototype = Object.getPrototypeOf(guardFileHandle);
+  await guardFileHandle.close();
+  for (const method of [
+    "appendFile", "appendFileSync", "chmod", "chmodSync", "chown", "chownSync",
+    "copyFile", "copyFileSync", "cp", "cpSync", "createWriteStream", "link", "linkSync",
+    "fchmod", "fchmodSync", "fchown", "fchownSync", "fdatasync", "fdatasyncSync",
+    "fsync", "fsyncSync", "ftruncate", "ftruncateSync", "futimes", "futimesSync",
+    "lchmod", "lchmodSync", "lchown", "lchownSync", "lutimes", "lutimesSync",
+    "mkdir", "mkdirSync", "mkdtemp", "mkdtempSync", "mkdtempDisposable",
+    "mkdtempDisposableSync", "openAsBlob", "rename", "renameSync", "rm", "rmSync",
+    "rmdir", "rmdirSync", "symlink", "symlinkSync", "truncate", "truncateSync",
+    "unlink", "unlinkSync", "utimes", "utimesSync", "write", "writeFile", "writeFileSync",
+    "writeSync", "writev", "writevSync", "FileWriteStream", "WriteStream",
+  ]) {
+    replace(fs, method, denyMutation);
+    replace(fs.promises, method, denyMutation);
+  }
+  for (const method of [
+    "appendFile", "chmod", "chown", "createWriteStream", "datasync", "sync", "truncate",
+    "utimes", "write", "writeFile", "writev",
+  ]) replace(fileHandlePrototype, method, denyMutation);
+  replace(fs, "open", guardedOpen(originalOpen));
+  replace(fs, "openSync", guardedOpen(originalOpenSync));
+  replace(fs.promises, "open", guardedOpen(originalPromiseOpen));
+  syncBuiltinESMExports();
+}

package/apps/storefront/scripts/deny-v84-dogfood-capabilities.mjs

@@ -0,0 +1,2 @@
+/** The common v84 proof guard includes filesystem mutation denial. */
+import "./deny-v84-lifecycle-capabilities.mjs";