@tokenoftrust/storefront-runner 2.0.2 → 2.0.4

package/apps/storefront/src/lib/apps/v84NonportableRouteDogfood.ts

@@ -1,291 +0,0 @@
-/**
- * Offline dogfood of the eight v84 nonportable-code dispositions.
- *
- * This module sees only reviewed, redacted dossier metadata. It can emit typed
- * semantic events into an in-memory callback, evaluate a pure path mapping, or
- * record an inert retirement. It has no destination, browser, renderer,
- * persistence, network, install, publish, or source-tenant capability.
- */
-import {
-  CONSENT_CONFIG_SCHEMA_VERSION,
-  CommerceEventBroker,
-  ManagedAnalyticsEventBrokerBridge,
-  buildTenantConsentBroker,
-  validateConsentConfig,
-  validateTenantActionRegistry,
-  type CommerceEvent,
-} from "@tot/public-runtime";
-import type {
-  V84NonportableCodeIntentDossier,
-} from "./v84NonportableCodeCoaching.js";
-import type { V84CloneMigrationEvidence } from "./v84CloneMigrationEvidence.js";
-import { assertExactV84DogfoodContract } from "./v84NonportableRouteContract.js";
-import {
-  sameV84ReplayValue,
-  type V84CleanCloneReplayContext,
-} from "./v84CleanCloneReplayContext.js";
-
-const SOURCE = "tokenoftrust.com" as const;
-const CLONE = "tokenoftrust.com~clone~gtm-migration-v84" as const;
-const AT = "2026-08-30T00:00:00.000Z";
-const CORRELATION = { id: "corr-v84-nonportable-dogfood", expiresAt: "2026-08-30T02:00:00.000Z" };
-const PROTECTED = ["admin", "account", "identity", "age-assurance", "checkout", "payment"] as const;
-
-export type V84DogfoodOutcome = "converted" | "retired" | "evidence-rejected";
-
-export interface V84DogfoodLedgerRow {
-  readonly identity: string;
-  readonly intent: string;
-  readonly route: string;
-  readonly attemptedSteps: readonly string[];
-  readonly artifact: Readonly<Record<string, unknown>>;
-  readonly expectedVersusActual: { readonly expected: string; readonly actual: string };
-  readonly testsAndCloneQa: readonly string[];
-  readonly rollbackProof: string;
-  readonly finalOutcome: V84DogfoodOutcome;
-  readonly productRunbookGap: string | null;
-}
-
-function consentBroker() {
-  const checked = validateConsentConfig({
-    schemaVersion: CONSENT_CONFIG_SCHEMA_VERSION,
-    purposes: [{ purpose: "analytics", legalBasis: "consent", defaultState: "denied" }],
-    cmp: { mode: "none" },
-  });
-  if (!checked.ok) throw new Error("The fixed local consent policy is invalid.");
-  const broker = buildTenantConsentBroker(checked.value);
-  broker.setDecisions({ analytics: "granted" });
-  return broker;
-}
-
-function vendorAdapterId(dossier: V84NonportableCodeIntentDossier): string {
-  const ids: Readonly<Record<string, string>> = {
-    "tag:4": "platform.hubspot",
-    "tag:18": "platform.capterra",
-    "tag:29": "platform.linkedin",
-    "tag:31": "platform.g2",
-  };
-  const adapterId = ids[dossier.sourceObject.nodeKey];
-  if (!adapterId) throw new Error("The vendor destination route is not reviewed.");
-  return adapterId;
-}
-
-function exerciseNativeHook(dossier: V84NonportableCodeIntentDossier) {
-  const catalogLookup = { adapterId: vendorAdapterId(dossier), found: false } as const;
-  if (dossier.requiredContract.actionSelection === "owner-selection-required") {
-    return {
-      kind: "native-contract-refusal",
-      hook: dossier.recommendedTotPort.nativeHook,
-      approvedChoices: [...dossier.requiredContract.approvedActionNames],
-      deliveryCount: 0,
-      reason: "owner-action-selection-required",
-      catalogLookup,
-    } as const;
-  }
-  const registry = validateTenantActionRegistry({
-    schemaVersion: 1,
-    actions: dossier.requiredContract.approvedActionNames.map((name) => ({ name })),
-  });
-  if (!registry.ok) throw new Error("The dossier action contract is invalid.");
-  const consent = consentBroker();
-  const delivered: CommerceEvent[] = [];
-  const broker = new CommerceEventBroker({
-    trusted: { tenant: CLONE, environment: "candidate", siteSurface: "marketing" },
-    source: `urn:tot:storefront:v84-dogfood:${dossier.dossierId}`,
-    consentSnapshot: () => consent.getSnapshot(),
-    tenantActionRegistry: registry.value,
-    now: () => AT,
-  });
-  broker.subscribe({
-    id: `fake-local-${dossier.dossierId}`,
-    consentPurpose: "analytics",
-    types: dossier.recommendedTotPort.nativeHook ? [dossier.recommendedTotPort.nativeHook] : [],
-    sink: { kind: "callback", handler: (event) => delivered.push(event) },
-  });
-  const bridge = new ManagedAnalyticsEventBrokerBridge({ broker });
-  let results;
-  if (dossier.recommendedTotPort.nativeHook === "storefront.action.activated.v1") {
-    const initialized = bridge.initialize({ logicalId: `${dossier.dossierId}-document`, path: "/v84-dogfood", correlation: CORRELATION });
-    if (!initialized.ok || !initialized.emitted) throw new Error("The local action bridge did not initialize safely.");
-    results = dossier.requiredContract.approvedActionNames.map((name, index) =>
-      bridge.activate({ logicalId: `${dossier.dossierId}-action-${index + 1}`, name, correlation: CORRELATION }));
-  } else {
-    results = [bridge.initialize({ logicalId: dossier.dossierId, path: "/v84-dogfood", correlation: CORRELATION })];
-  }
-  bridge.dispose();
-  if (results.some((result) => !result.ok || !result.emitted) || delivered.length !== results.length) {
-    throw new Error("The local native-hook exercise did not deliver the exact typed event set.");
-  }
-  if (delivered.some((event) => event.storefront.tenant !== CLONE || event.storefront.environment === "live")) {
-    throw new Error("The local native-hook exercise escaped the diagnostic clone.");
-  }
-  return {
-    kind: "in-memory-native-event-proof",
-    hook: delivered[0]?.type,
-    payloads: delivered.map((event) => event.data),
-    payloadKeys: [...new Set(delivered.flatMap((event) => Object.keys(event.data)))].sort(),
-    deliveryCount: delivered.length,
-    destination: "fake-local-callback",
-    disposed: true,
-    catalogLookup,
-  } as const;
-}
-
-function retire(dossier: V84NonportableCodeIntentDossier, replayContext?: V84CleanCloneReplayContext) {
-  if (dossier.recommendedTotPort.nativeHook !== null) {
-    throw new Error("A retirement dossier unexpectedly requested runtime authority.");
-  }
-  const cloneLocalMarkers = new Set<string>();
-  const marker = `${CLONE}:retired:${dossier.sourceObject.nodeKey}`;
-  const markerKey = `stage/dogfood/retirement/${dossier.sourceObject.nodeKey}`;
-  if (replayContext) replayContext.write(markerKey, marker);
-  else cloneLocalMarkers.add(marker);
-  const markerObserved = replayContext
-    ? replayContext.read<string>(markerKey) === marker
-    : cloneLocalMarkers.has(marker);
-  if (replayContext) replayContext.delete(markerKey);
-  else cloneLocalMarkers.delete(marker);
-  const markerRemoved = replayContext
-    ? replayContext.read<string>(markerKey) === undefined
-    : !cloneLocalMarkers.has(marker);
-  if (!markerObserved || !markerRemoved) throw new Error("The inert retirement marker was not reversible.");
-  return {
-    kind: "inert-retirement-record",
-    retained: { nodeKey: dossier.sourceObject.nodeKey, dossierId: dossier.dossierId },
-    runtimeAuthority: "none",
-    installCreated: false,
-    markerObserved,
-    markerRemoved,
-  } as const;
-}
-
-function rejectedGap(dossier: V84NonportableCodeIntentDossier): string {
-  if (dossier.sourceObject.nodeKey === "variable:38") {
-    return "consumer decision required: name the consumer and approve a closed output enum before conversion";
-  }
-  const gap = dossier.recommendedTotPort.owningProductGap;
-  if (!gap) throw new Error("A non-retirement route lacks an exact owning-product gap.");
-  const ownerGap = dossier.requiredContract.actionSelection === "owner-selection-required"
-    ? "; consumer owner must select one approved action name"
-    : "";
-  return `owning product capability unavailable: ${gap}${ownerGap}`;
-}
-
-function exercise(
-  dossier: V84NonportableCodeIntentDossier,
-  replayContext?: V84CleanCloneReplayContext,
-): V84DogfoodLedgerRow {
-  if (dossier.recommendedTotPort.route === "retire") {
-    return {
-      identity: dossier.sourceObject.nodeKey,
-      intent: dossier.recoveredBusinessIntent,
-      route: "retire",
-      attemptedSteps: ["matched the exact redacted identity and graph role", "asserted no native hook", "created and observed a clone-local inert marker", "removed the marker"],
-      artifact: retire(dossier, replayContext),
-      expectedVersusActual: {
-        expected: "retain audit identity with zero runtime behavior",
-        actual: "inert retirement recorded; no install, hook, destination, or runtime authority created",
-      },
-      testsAndCloneQa: ["identity accounted once", "dependency graph checked", "marker observed then removed", "no hook requested", "clone effect counters remain zero"],
-      rollbackProof: "No runtime state exists to restore; removing the inert record leaves behavior unchanged.",
-      finalOutcome: "retired",
-      productRunbookGap: null,
-    };
-  }
-  const isMapping = dossier.recommendedTotPort.route === "declarative-typed-mapping";
-  const artifact = isMapping ? {
-    kind: "declarative-conversion-refusal",
-    observedGraph: { consumer: "trigger:39", variable: "variable:38", consumingTagCount: 0 },
-    mappingCreated: false,
-    reason: "named-consumer-and-output-enum-unresolved",
-  } as const : exerciseNativeHook(dossier);
-  const gap = rejectedGap(dossier);
-  return {
-    identity: dossier.sourceObject.nodeKey,
-    intent: dossier.recoveredBusinessIntent,
-    route: dossier.recommendedTotPort.route,
-    attemptedSteps: isMapping
-      ? ["verified trigger:39 references variable:38", "verified no tag consumes trigger:39", "looked for a named consumer and approved output enum", "refused to invent a mapping"]
-      : dossier.requiredContract.actionSelection === "owner-selection-required"
-        ? ["validated the closed action choice set", "refused to choose for the owner", "confirmed zero delivery", "looked up the owned destination"]
-        : ["validated the closed native event contract", "granted local analytics consent", "delivered the exact typed event set to an in-memory callback", "disposed the bridge", "looked up the owned destination"],
-    artifact,
-    expectedVersusActual: {
-      expected: dossier.recommendedTotPort.saferAlternative,
-      actual: dossier.requiredContract.actionSelection === "owner-selection-required"
-        ? `closed choice set validated with zero emission; exercise stopped: ${gap}`
-        : isMapping
-          ? `no mapping was created; exercise stopped: ${gap}`
-          : `safe local native contract exercise passed, but conversion stopped: ${gap}`,
-    },
-    testsAndCloneQa: isMapping
-      ? ["exact graph edge is present", "consumer tag count is zero", "no mapping or destination effect exists"]
-      : dossier.requiredContract.actionSelection === "owner-selection-required"
-        ? ["all approved choices retained", "zero events emitted before owner selection", "managed vendor adapter absent"]
-        : ["typed payload set delivered exactly once each", "clone tenant and candidate environment pinned", "fake callback disposed", "protected surfaces excluded"],
-    rollbackProof: isMapping
-      ? "Discarding the refusal artifact leaves the prior no-mapping state unchanged; no consumer was connected."
-      : dossier.requiredContract.actionSelection === "owner-selection-required"
-        ? "No subscriber, event, install, or destination state was created before the required owner decision."
-        : "Disposal removes the only in-memory subscriber; no install or destination state exists.",
-    finalOutcome: "evidence-rejected",
-    productRunbookGap: gap,
-  };
-}
-
-/** Exercise every reviewed route and return a terminal eight-row ledger. */
-export function buildV84NonportableRouteDogfood(
-  evidence: V84CloneMigrationEvidence,
-  catalogAdapterIds: readonly string[],
-  replayContext?: V84CleanCloneReplayContext,
-) {
-  if (replayContext && !sameV84ReplayValue(
-    replayContext.read<V84CloneMigrationEvidence>("stage/import/handoff"),
-    evidence,
-  )) {
-    throw new Error("The dogfood proof did not receive the shared import handoff.");
-  }
-  const safe = assertExactV84DogfoodContract(evidence, catalogAdapterIds);
-  const coaching = safe.evidence.nonportableCodeCoaching;
-  if (!coaching.policy.sourceReadOnly || !coaching.policy.importedArtifactsInert || coaching.policy.installsOrPublishes) {
-    throw new Error("The coaching policy is outside the inert diagnostic scope.");
-  }
-  if (coaching.dossiers.length !== 8 || new Set(coaching.dossiers.map((item) => item.sourceObject.nodeKey)).size !== 8) {
-    throw new Error("The dogfood gate requires exactly eight unique dossiers.");
-  }
-  if (coaching.dossiers.some((item) => item.recommendedTotPort.status !== "not-installed")) {
-    throw new Error("The dogfood input must be the reviewed pre-install coaching state.");
-  }
-  const ledger = coaching.dossiers.map((dossier) => exercise(dossier, replayContext));
-  if (ledger.some((row) => !["converted", "retired", "evidence-rejected"].includes(row.finalOutcome))) {
-    throw new Error("Every dogfood route must end in an explicit terminal outcome.");
-  }
-  const result = {
-    schemaVersion: 1 as const,
-    scope: { sourceTenant: SOURCE, sourceMode: "read-only-fixture" as const, cloneTenant: CLONE, destinationMode: "fake-local-only" as const },
-    ledger,
-    summary: {
-      total: ledger.length,
-      converted: ledger.filter((row) => row.finalOutcome === "converted").length,
-      retired: ledger.filter((row) => row.finalOutcome === "retired").length,
-      evidenceRejected: ledger.filter((row) => row.finalOutcome === "evidence-rejected").length,
-      unexplainedNotInstalled: 0,
-    },
-    catalogLookup: {
-      presentAdapterIds: [...safe.catalogAdapterIds].sort(),
-      requestedVendorAdapterIds: ["platform.hubspot", "platform.capterra", "platform.linkedin", "platform.g2"],
-      missingVendorAdapterIds: ["platform.hubspot", "platform.capterra", "platform.linkedin", "platform.g2"],
-    },
-    safety: {
-      sourceReads: 0, sourceWrites: 0, clonePersistentWrites: 0, externalNetworkRequests: 0,
-      liveSecretsUsed: 0, productionActions: 0, importedCodeExecuted: false,
-      originalMarkupRendered: false, runtimeLoaderInitialized: false, dataLayerTouched: false,
-    },
-    protectedSurfaces: [...PROTECTED],
-  };
-  if (replayContext) {
-    for (const row of ledger) replayContext.write(`stage/dogfood/artifacts/${row.identity}`, row.artifact);
-    replayContext.write("stage/dogfood/handoff", result);
-  }
-  return result;
-}

package/apps/storefront/src/lib/apps/ws1ManagedAnalyticsClient.ts

@@ -1,95 +0,0 @@
-/**
- * The EDGE transport for the pinned managed-analytics v1 contract: a thin HTTP
- * adapter that satisfies {@link Ws1ManagedAnalyticsClient} by POSTing each
- * pinned request to WS1's lifecycle service and returning the pinned response
- * shape. WS1 owns the actual service; this file only carries the request over
- * the wire.
- *
- * Tenant authority is server-derived, exactly as the pinned contract demands
- * ("no request in this module accepts a tenant id"): the tenant is sent as a
- * server-to-server header alongside the service credential — NEVER in a request
- * body, and NEVER read from the caller's request body. Unconfigured service URL
- * -> `null` (the route answers 503), never a guess.
- */
-import type { APIContext } from "astro";
-import {
-  MANAGED_ANALYTICS_API_V1_VERSION_POLICY,
-  type CreateMigrationDraftRequest,
-  type CreateMigrationDraftResponse,
-} from "@tot/public-runtime";
-import { readEnv } from "../env.js";
-import type { Ws1ManagedAnalyticsClient } from "./gtmMigrationInstall.js";
-
-export interface Ws1ManagedAnalyticsMigrationClient extends Ws1ManagedAnalyticsClient {
-  createMigrationDraft(request: CreateMigrationDraftRequest): Promise<CreateMigrationDraftResponse>;
-}
-
-export type Ws1Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-
-/** Base URL of WS1's managed-analytics lifecycle service (scheme + host). */
-const SERVICE_URL_ENV = "MANAGED_ANALYTICS_API_URL";
-/** Server-to-server bearer credential for WS1 (scopes the tenant server-side). */
-const SERVICE_SECRET_ENV = "MANAGED_ANALYTICS_API_SECRET";
-
-/** The versioned base path, taken from the pinned version policy — never hard-coded twice. */
-const V1_PATH = MANAGED_ANALYTICS_API_V1_VERSION_POLICY.path;
-
-/** POST one pinned request to `<base><v1>/<operation>` and return the parsed pinned response. */
-function post<TReq, TRes>(
-  fetchImpl: Ws1Fetch,
-  baseUrl: string,
-  operation: string,
-  headers: Record<string, string>,
-): (request: TReq) => Promise<TRes> {
-  return async (request: TReq): Promise<TRes> => {
-    const res = await fetchImpl(`${baseUrl}${V1_PATH}/${operation}`, {
-      method: "POST",
-      headers: { "content-type": "application/json", ...headers },
-      body: JSON.stringify(request),
-    });
-    // WS1 returns the pinned success OR error envelope as JSON for every status.
-    return (await res.json()) as TRes;
-  };
-}
-
-/** Build the tenant-bound public WS1 HTTP client; tests may inject a no-network fetch. */
-export function createWs1ManagedAnalyticsClient(input: {
-  readonly baseUrl: string;
-  readonly tenantId: string;
-  readonly authorization?: string;
-  readonly fetchImpl?: Ws1Fetch;
-}): Ws1ManagedAnalyticsMigrationClient {
-  const baseUrl = input.baseUrl.replace(/\/$/, "");
-  const headers: Record<string, string> = { "x-tot-tenant": input.tenantId };
-  if (input.authorization) headers.authorization = input.authorization;
-  const fetchImpl = input.fetchImpl ?? fetch;
-  return {
-    getMigrationDraft: post(fetchImpl, baseUrl, "getMigrationDraft", headers),
-    createMigrationDraft: post(fetchImpl, baseUrl, "createMigrationDraft", headers),
-    getAdapterDefinition: post(fetchImpl, baseUrl, "getAdapterDefinition", headers),
-    getIntegrationInstall: post(fetchImpl, baseUrl, "getIntegrationInstall", headers),
-    createIntegrationInstall: post(fetchImpl, baseUrl, "createIntegrationInstall", headers),
-    reviseIntegrationInstall: post(fetchImpl, baseUrl, "reviseIntegrationInstall", headers),
-  };
-}
-
-/**
- * Build an HTTP-backed {@link Ws1ManagedAnalyticsClient} for `tenantId`, or
- * `null` when WS1's service URL isn't configured in this runtime. `tenantId`
- * comes from the resolved operator session — never the request body — and is
- * sent as a server-to-server header, keeping every request body tenant-free per
- * the pinned contract.
- */
-export async function resolveWs1ManagedAnalyticsClient(
-  _context: APIContext,
-  tenantId: string,
-): Promise<Ws1ManagedAnalyticsClient | null> {
-  const baseUrl = (await readEnv(SERVICE_URL_ENV))?.replace(/\/$/, "");
-  if (!baseUrl) return null;
-  const secret = await readEnv(SERVICE_SECRET_ENV);
-  return createWs1ManagedAnalyticsClient({
-    baseUrl,
-    tenantId,
-    ...(secret ? { authorization: `Bearer ${secret}` } : {}),
-  });
-}

package/apps/storefront/src/lib/content-edit/applyDiff.ts

@@ -1,91 +0,0 @@
-/**
- * Apply a unified diff to a source string — the missing half of the content_edit wire
- * contract. tot-mcp's `content_edit` returns per-file unified DIFFS (`--- a/…` /
- * `+++ b/…` / `@@` hunks), not updated contents; to materialize a draft artifact
- * the storefront must re-apply the diff to the
- * exact content it sent.
- *
- * STRICT + FAIL-CLOSED by design: every hunk's context and deletion lines must match
- * the source exactly at the stated position (no fuzz, no offset search). Any mismatch
- * throws {@link DiffApplyError} and the caller writes NOTHING — a wrong-base apply must
- * never silently corrupt a draft. This is safe because we apply to the same string we
- * handed content_edit moments earlier; a mismatch means the model produced a bad diff.
- */
-
-export class DiffApplyError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "DiffApplyError";
-  }
-}
-
-interface Hunk {
-  /** 1-based start line in the ORIGINAL content (0 allowed for empty-file inserts). */
-  oldStart: number;
-  /** Body lines: " " context, "-" deletion, "+" addition. */
-  lines: string[];
-}
-
-const HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
-
-function parseHunks(diff: string): Hunk[] {
-  const hunks: Hunk[] = [];
-  let current: Hunk | null = null;
-  for (const raw of diff.split("\n")) {
-    const m = HUNK_RE.exec(raw);
-    if (m) {
-      current = { oldStart: parseInt(m[1] ?? "0", 10), lines: [] };
-      hunks.push(current);
-      continue;
-    }
-    if (!current) continue; // header lines (--- / +++ / diff --git) before the first hunk
-    if (raw === "" || raw === "\") continue;
-    const tag = raw[0];
-    if (tag === " " || tag === "-" || tag === "+") current.lines.push(raw);
-    else current = null; // trailing junk / next file header — stop collecting
-  }
-  return hunks;
-}
-
-/**
- * Apply `diff` (unified format) to `source`; returns the patched string. Throws
- * {@link DiffApplyError} on any malformed hunk or context mismatch. A diff with no
- * hunks returns the source unchanged.
- */
-export function applyUnifiedDiff(source: string, diff: string): string {
-  const hunks = parseHunks(diff);
-  if (hunks.length === 0) return source;
-
-  const src = source.split("\n");
-  const out: string[] = [];
-  // Cursor into src (0-based) of the next line not yet copied to out.
-  let cursor = 0;
-
-  for (const hunk of hunks) {
-    // oldStart is 1-based; a 0 means "insert into an empty file" (keep cursor).
-    const start = Math.max(hunk.oldStart - 1, 0);
-    if (start < cursor) throw new DiffApplyError("hunks overlap or are out of order");
-    if (start > src.length) throw new DiffApplyError("hunk start beyond end of content");
-    out.push(...src.slice(cursor, start));
-    cursor = start;
-
-    for (const line of hunk.lines) {
-      const tag = line[0];
-      const text = line.slice(1);
-      if (tag === "+") {
-        out.push(text);
-        continue;
-      }
-      // context (" ") and deletion ("-") must match the source exactly.
-      if (cursor >= src.length || src[cursor] !== text) {
-        throw new DiffApplyError(
-          `context mismatch at line ${cursor + 1}: expected ${JSON.stringify(text)}, found ${JSON.stringify(src[cursor] ?? "<eof>")}`,
-        );
-      }
-      if (tag === " ") out.push(text);
-      cursor++;
-    }
-  }
-  out.push(...src.slice(cursor));
-  return out.join("\n");
-}