@tokenoftrust/storefront-runner 2.0.4 → 2.0.5

package/scripts/tenant/validate.mjs

@@ -168,6 +168,25 @@ function validateRawHtmlBody(html) {
 // step with packages/cli/src/validate.mjs's identical copy.
 const CHROME_HEADER_VARIANTS = new Set(["primary", "minimal"]);
 const CHROME_FOOTER_VARIANTS = new Set(["default"]);
+/**
+ * The declarative-interaction-tracking rule, mirrored: every actionable item —
+ * an object carrying both `id` and `href` — declares EXACTLY ONE of a non-empty
+ * `action` (its stable intent) or `tracking: "none"` (an explicit opt-out).
+ * Declaring neither or both is a violation, and nothing is derived from `id`.
+ * Contract: docs/architecture/interaction-tracking-attribute-contract.md
+ */
+function chromeTrackingDeclared(value) {
+  if (Array.isArray(value)) return value.every(chromeTrackingDeclared);
+  if (value == null || typeof value !== "object") return true;
+  if (typeof value.id === "string" && typeof value.href === "string") {
+    const hasAction = typeof value.action === "string" && value.action.trim() !== "";
+    const optedOut = value.tracking === "none";
+    if (hasAction === optedOut) return false;
+    if (value.tracking !== undefined && !optedOut) return false;
+  }
+  return Object.values(value).every(chromeTrackingDeclared);
+}
+
 export function looksLikeChromeConfig(value) {
   if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
   const header = value.header;
@@ -180,6 +199,7 @@ export function looksLikeChromeConfig(value) {
   if (footer == null || typeof footer !== "object" || Array.isArray(footer)) return false;
   if (!CHROME_FOOTER_VARIANTS.has(footer.variant)) return false;
   if (!Array.isArray(footer.columns)) return false;
+  if (!chromeTrackingDeclared(value)) return false;
   return true;
 }
 
@@ -410,6 +430,278 @@ function validateHomeDoc(doc, file) {
   return out;
 }
 
+// --- CTA / actionable-identity advisory rules (unit dt-validator-cta-rules) -
+// Three ADVISORY warnings (never block) that a schema pass alone doesn't
+// reach. `validateChromeConfig` (@tot/public-runtime chrome.ts) already
+// HARD-FAILS the governed chrome.json path on the either/or action/
+// tracking:"none" rule (interaction-tracking.ts validateTracking) — this
+// validator does not re-run that schema (deep per-item errors are the
+// write-path's job, per the looksLikeChromeConfig comment above). These three
+// catch what the schema pass doesn't:
+//   - `duplicate-cta`   — a copy-paste mistake that still PASSES schema (two
+//     actionable items sharing one governed identity).
+//   - `cta-missing-id`  — tenant-authored raw HTML fragments carry NO
+//     `data-tot-*` at all pre-derivation (see docs/architecture/interaction-
+//     tracking-attribute-contract.md "Deriving data-tot-el") — there is no
+//     schema here for validateChromeConfig to fail.
+//   - `cta-id-drift`    — `data-tot-el` is a PERMANENT identity per
+//     dt-contract-v1's decision ledger ("a change here is DRIFT and is a
+//     defect"); this one needs a PRIOR version to compare against, which a
+//     single-snapshot validateTenant() run doesn't have on its own — see
+//     `opts.previousChromeJson`, below.
+
+// --- "assign stable tracking ids" — the one named, actionable step (unit
+// dt-assign-ids-step). The three rules above are DETECTION; this is the single
+// place every touchpoint (`tot validate`, `tot submit`/`tot preview`, and the
+// `tot dev` save-loop nudge — scripts/dev/checkout-watch.mjs) points an author
+// at the SAME fix in the SAME words, so it reads as one coherent nudge no
+// matter which command surfaced it. The mechanism already exists (derivation:
+// dt-id-derivation; writeback: dt-id-writeback,
+// apps/storefront/src/pages/api/admin/tracking-writeback.ts) — this names the
+// step and points at it, it invents nothing. Kept in step with
+// packages/cli/src/validate.mjs's identical copy of this block.
+export const TRACKING_ID_STEP_NAME = "assign stable tracking ids";
+export const CTA_MISSING_ID_FIX =
+  "assign stable tracking ids: GET/POST /api/admin/tracking-writeback proposes a data-tot-el for every element that's missing one, as a reviewable candidate PR (GET first for a dry-run preview) — or run `tot validate` to see the full list before you submit.";
+
+/**
+ * The advisory rules LOUD enough to call out by NAME at `tot validate` / `tot
+ * submit` / `tot preview` — none of them block, but each ships a page that
+ * looks perfectly healthy (clean build, every other check green) while
+ * quietly losing something. `[rule, headline, what it costs if ignored]`.
+ * ONE place so every surface prints identical wording; `printLoudAdvisories`
+ * is the shared renderer.
+ */
+export const LOUD_ADVISORY_RULES = [
+  [
+    "git-conflict-markers",
+    "git conflict markers in submitted content — an unfinished merge/rebase?",
+    "The preview will still build, but it will serve the broken markers. Resolve before shipping.",
+  ],
+  [
+    "duplicate-skip-link",
+    "duplicate skip link — your chrome already supplies one",
+    "The page renders fine and every automated check passes; a screen-reader user hears it twice.",
+  ],
+  [
+    "duplicate-cta",
+    "duplicate CTA identity — two actionable items share one data-tot-el",
+    "Both elements still work, but the click listener and every downstream analytics query treat them as ONE interaction — you lose the ability to tell them apart.",
+  ],
+  [
+    "cta-missing-id",
+    `actionable element with no governed identity (data-tot-el) — needs to ${TRACKING_ID_STEP_NAME}`,
+    `It renders and works fine, but it's invisible to interaction tracking — nothing about it is ever recorded. ${CTA_MISSING_ID_FIX}`,
+  ],
+  [
+    "cta-id-drift",
+    "a previously-declared data-tot-el changed value",
+    "The page still works, but everything already recorded under the old id is now orphaned — this identity is supposed to be permanent.",
+  ],
+];
+
+/**
+ * Print the LOUD-but-advisory findings as named, grouped callouts — see
+ * packages/cli/src/validate.mjs's identical copy for the full rationale.
+ * @param {Finding[]} findings
+ * @param {{ log?: (s: string) => void }} [opts]
+ */
+export function printLoudAdvisories(findings, { log = (s) => console.error(s) } = {}) {
+  for (const [rule, headline, consequence] of LOUD_ADVISORY_RULES) {
+    const hits = findings.filter((f) => f.rule === rule);
+    if (!hits.length) continue;
+    log(`\n⚠ ${headline} (${hits.length} finding(s))`);
+    for (const f of hits) log(`  ⚠ ${f.file} — ${f.message}`);
+    log(`  ${consequence}\n`);
+  }
+}
+
+/** Every declared actionable `id` in a ChromeConfig, with a path for
+ *  messages — the SAME field rawChrome.ts / SiteHeader.astro stamp verbatim as
+ *  `data-tot-el` (ctaIdentityAttr for header.ctas; the direct `id` field on
+ *  every other actionable shape — see @tot/public-runtime chrome.ts's
+ *  ChromeLink/ChromeNavItem/ChromeCta/ChromeActionLink), so a collision here
+ *  is a collision of GOVERNED IDENTITY, not just of an authoring label. Walks
+ *  the same shapes validateChromeConfig itself walks. Pure.
+ */
+function collectChromeActionableIds(config) {
+  const out = [];
+  const push = (id, path) => {
+    if (typeof id === "string" && id.trim()) out.push({ id: id.trim(), path });
+  };
+  const header = config?.header;
+  if (header && typeof header === "object" && !Array.isArray(header)) {
+    for (const [i, n] of (Array.isArray(header.nav) ? header.nav : []).entries()) {
+      if (n == null || typeof n !== "object") continue;
+      push(n.id, `header.nav[${i}]`);
+      for (const [j, c] of (Array.isArray(n.children) ? n.children : []).entries()) {
+        if (c && typeof c === "object") push(c.id, `header.nav[${i}].children[${j}]`);
+      }
+      for (const [j, col] of (Array.isArray(n.columns) ? n.columns : []).entries()) {
+        if (col == null || typeof col !== "object") continue;
+        for (const [k, l] of (Array.isArray(col.links) ? col.links : []).entries()) {
+          if (l && typeof l === "object") push(l.id, `header.nav[${i}].columns[${j}].links[${k}]`);
+        }
+      }
+    }
+    for (const [i, c] of (Array.isArray(header.ctas) ? header.ctas : []).entries()) {
+      if (c && typeof c === "object") push(c.id, `header.ctas[${i}]`);
+    }
+    if (header.memberCue && typeof header.memberCue === "object") push(header.memberCue.id, "header.memberCue");
+    const u = header.utilityNav;
+    if (u && typeof u === "object" && !Array.isArray(u)) {
+      for (const [i, l] of (Array.isArray(u.links) ? u.links : []).entries()) {
+        if (l && typeof l === "object") push(l.id, `header.utilityNav.links[${i}]`);
+      }
+      if (u.memberCue && typeof u.memberCue === "object") push(u.memberCue.id, "header.utilityNav.memberCue");
+    }
+  }
+  const footer = config?.footer;
+  if (footer && typeof footer === "object" && !Array.isArray(footer)) {
+    for (const [i, col] of (Array.isArray(footer.columns) ? footer.columns : []).entries()) {
+      if (col == null || typeof col !== "object") continue;
+      for (const [j, l] of (Array.isArray(col.links) ? col.links : []).entries()) {
+        if (l && typeof l === "object") push(l.id, `footer.columns[${i}].links[${j}]`);
+      }
+    }
+  }
+  return out;
+}
+
+/** `duplicate-cta`: two or more actionable items in one ChromeConfig resolve
+ *  to the SAME governed identity. Almost always a copy-paste authoring
+ *  mistake — the click listener's `closest("[data-tot-el]")` match and every
+ *  downstream analytics query assume one element per id, so a duplicate
+ *  silently merges two distinct interactions' data. WARN, never blocks: the
+ *  page still renders and both elements still work.
+ */
+function findDuplicateCtaIds(config, file) {
+  const byId = new Map();
+  for (const { id, path } of collectChromeActionableIds(config)) {
+    if (!byId.has(id)) byId.set(id, []);
+    byId.get(id).push(path);
+  }
+  const out = [];
+  for (const [id, paths] of byId) {
+    if (paths.length > 1) {
+      out.push(
+        mk(WARN, "duplicate-cta", file,
+          `id "${id}" is declared on ${paths.length} actionable items (${paths.join(", ")}) — data-tot-el must be unique per element; the click listener's closest() match and downstream analytics both assume one`,
+          "give every occurrence but one a distinct id"),
+      );
+    }
+  }
+  return out;
+}
+
+/**
+ * `cta-id-drift`: a governed actionable item's `data-tot-el` changed value
+ * between two versions of the SAME chrome.json, matched by structural
+ * position (e.g. "header.ctas[0]") — the same slot in both versions. Per
+ * dt-contract-v1's ledger `data-tot-el` is a PERMANENT identity ("a change
+ * here is DRIFT and is a defect"), unlike `data-tot-placement` which is
+ * expected to move on redesign.
+ *
+ * `previous` is an OPTIONAL caller-supplied prior chrome.json (already
+ * parsed) — this static, single-snapshot validator has no version history of
+ * its own, and no existing publish/preview utility in this repo diffs the
+ * CTA IDENTITY LIST across versions (apps/storefront/src/lib/publish and
+ * .../preview diff release ARTIFACT BYTES for the release panel, never this)
+ * to hook into instead. A version-aware caller (a future publish-time check,
+ * `tot validate --against <ref>`) supplies `previous`; this run alone never
+ * invents one, so omitting it is a silent no-op, not a missing check.
+ *
+ * A reorder/insert that shifts array positions can produce a false
+ * positive/negative here (position, not the item's own identity, is the
+ * match key) — a known limitation of matching without a stronger anchor.
+ */
+function findCtaIdDrift(previous, current, file) {
+  if (previous == null || typeof previous !== "object") return [];
+  const before = new Map(collectChromeActionableIds(previous).map((e) => [e.path, e.id]));
+  const out = [];
+  for (const { id, path } of collectChromeActionableIds(current)) {
+    const priorId = before.get(path);
+    if (priorId !== undefined && priorId !== id) {
+      out.push(
+        mk(WARN, "cta-id-drift", file,
+          `${path}.id changed from "${priorId}" to "${id}" — data-tot-el is a permanent identity; a change here is drift, not a redesign, and breaks continuity with everything already recorded under the old id`,
+          "keep the original id (a deliberate identity migration is a separate, tracked decision, not an incidental edit)"),
+      );
+    }
+  }
+  return out;
+}
+
+// Compact mirror of @tot/public-runtime tracking-id-derivation.ts's trackable-
+// tag set and `isWellFormedTrackingId` shape check — this script can't import
+// that TS package at runtime (same published-CLI/no-build-step constraint as
+// the chrome-shape mirrors above). Deliberately simplified: full structural
+// derivation (region path, confidence) needs a real parser and an ancestor
+// stack; this is a flat regex tag scan (the same style as HREF_RE/SRC_RE
+// above), so it only answers "does this element carry a well-formed
+// data-tot-el at all", not "what would a good one look like".
+const ACTIONABLE_TAG_RE = /<([a-z][a-z0-9-]*)\b([^>]*)>/gi;
+const TRACKABLE_HTML_TAGS = new Set(["a", "area", "button", "details", "summary", "form", "input", "select", "textarea", "label"]);
+const TRACKABLE_HTML_ROLES = new Set(["button", "link", "tab", "menuitem", "switch", "checkbox"]);
+
+function htmlAttr(attrs, name) {
+  const m = new RegExp(`\\b${name}\\s*=\\s*"([^"]*)"`, "i").exec(attrs);
+  return m ? m[1] : undefined;
+}
+
+/** Mirror of tracking-id-derivation.ts's `isTrackableNode`: an `<a>`/`<area>`
+ *  needs a real `href`; the fixed tag set is always a candidate; anything
+ *  else needs an interactive ARIA role. */
+function isTrackableHtmlTag(tag, attrs) {
+  if (tag === "a" || tag === "area") {
+    const href = htmlAttr(attrs, "href");
+    return typeof href === "string" && href.trim().length > 0;
+  }
+  if (TRACKABLE_HTML_TAGS.has(tag)) return true;
+  const role = htmlAttr(attrs, "role");
+  return typeof role === "string" && TRACKABLE_HTML_ROLES.has(role.trim().toLowerCase());
+}
+
+/** Mirror of tracking-id-derivation.ts's `isWellFormedTrackingId`: lowercase
+ *  kebab tokens, non-empty, within the same 64-char budget. */
+function isWellFormedCtaId(el) {
+  return typeof el === "string" && el.length > 0 && el.length <= 64 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(el);
+}
+
+/**
+ * `cta-missing-id`: a tenant-authored HTML fragment's actionable element
+ * carries no well-formed `data-tot-el`. Tenant fragments ship NO `data-tot-*`
+ * at all pre-derivation (docs/architecture/interaction-tracking-attribute-
+ * contract.md "Deriving data-tot-el") — `validateChromeConfig`'s hard
+ * either/or failure only reaches the SCHEMA-GOVERNED chrome.json path, never
+ * a raw fragment, so an un-identified CTA here would otherwise ship silently
+ * unmeasurable: the page renders fine, every other check passes, and the
+ * element is simply invisible to interaction tracking. WARN, never blocks.
+ *
+ * Exported so the `tot dev` save-loop nudge (scripts/dev/checkout-watch.mjs)
+ * can reuse the SAME detection on a single saved file, in-process, rather
+ * than re-implementing it — dt-assign-ids-step is a discoverability/wiring
+ * unit, not a new detector.
+ */
+export function findMissingCtaIds(html, file) {
+  const out = [];
+  ACTIONABLE_TAG_RE.lastIndex = 0;
+  let m;
+  while ((m = ACTIONABLE_TAG_RE.exec(html))) {
+    const tag = m[1].toLowerCase();
+    const attrs = m[2] || "";
+    if (!isTrackableHtmlTag(tag, attrs)) continue;
+    const totEl = htmlAttr(attrs, "data-tot-el");
+    if (isWellFormedCtaId(totEl)) continue;
+    out.push(
+      mk(WARN, "cta-missing-id", file,
+        `a <${tag}> actionable element has ${totEl ? `a malformed data-tot-el (${JSON.stringify(totEl)})` : "no data-tot-el"} — it renders and functions but is invisible to interaction tracking`,
+        CTA_MISSING_ID_FIX),
+    );
+  }
+  return out;
+}
+
 // --- filesystem helpers ------------------------------------------------------
 function readJsonSafe(path) {
   try {
@@ -513,10 +805,13 @@ function resolvePlatformRouteOwnership(config, hostIsPlatform) {
 /**
  * Full static validation of a tenant directory.
  * @param {string} tenantDir absolute path to the tenant dir (content/ public/ theme.json [.tot/])
- * @param {{tenantId?:string, scope?:string, mode?:"monorepo"|"workspace"}} [opts]
+ * @param {{tenantId?:string, scope?:string, mode?:"monorepo"|"workspace", previousChromeJson?:any}} [opts]
  *   `mode` — "monorepo" (default): served by this platform, so commerce tenants own
  *   the framework routes. "workspace": a standalone checkout, conservative about
  *   platform-route ownership unless the config resolves the host.
+ *   `previousChromeJson` — an already-parsed PRIOR version of content/chrome.json,
+ *   supplied by a version-aware caller, so the `cta-id-drift` check has something
+ *   to compare against (see findCtaIdDrift above). Omitted ⇒ that check is a no-op.
  * @returns {{ok:boolean, findings:Finding[]}}
  */
 export function validateTenant(tenantDir, opts = {}) {
@@ -615,6 +910,11 @@ export function validateTenant(tenantDir, opts = {}) {
         findings.push(mk(ERROR, "content-json-parse", `content/${name}`, `invalid JSON: ${error} (fails the build)`));
       } else if (name === "home.json") {
         findings.push(...validateHomeDoc(value, "content/home.json"));
+      } else if (name === "chrome.json") {
+        findings.push(...findDuplicateCtaIds(value, "content/chrome.json"));
+        if (opts.previousChromeJson != null) {
+          findings.push(...findCtaIdDrift(opts.previousChromeJson, value, "content/chrome.json"));
+        }
       }
     }
   }
@@ -667,6 +967,9 @@ export function validateTenant(tenantDir, opts = {}) {
           "use a bare <style> tag"),
       );
     }
+    // actionable elements with no (or malformed) governed identity — advisory,
+    // never blocking (see findMissingCtaIds above).
+    findings.push(...findMissingCtaIds(html, r));
 
     // link portability + resolution
     for (const m of html.matchAll(HREF_RE)) {
@@ -826,6 +1129,8 @@ if (isMain) {
   const errors = findings.filter((f) => f.level === ERROR);
   const warns = findings.filter((f) => f.level === WARN);
   console.log(`\ntot validate — ${tenantId ?? dir}\n`);
+  // Named, grouped callouts FIRST — see printLoudAdvisories above.
+  printLoudAdvisories(findings, { log: (s) => console.log(s) });
   for (const f of findings) {
     const tag = f.level === ERROR ? "✗" : "⚠";
     console.log(`  ${tag} [${f.rule}] ${f.file}\n      ${f.message}${f.fix ? `\n      → ${f.fix}` : ""}`);

package/scripts/tot-dev.mjs

@@ -65,6 +65,7 @@ import { resolveDevSourceRoot } from "./dev/tenant-source-root.mjs";
 import { tenantDirRelative, tenantDirSegments } from "./lib/tenant-dirs.mjs";
 import { firstFreePort } from "./dev/port-check.mjs";
 import { resync, startWatch } from "./dev/checkout-watch.mjs";
+import { findMissingCtaIds } from "./tenant/validate.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = resolve(here, ".."); // scripts/ -> repo root
@@ -169,6 +170,42 @@ const grafts = [];
 const watchers = [];
 let cleanedUp = false;
 
+// --- dev-loop nudge: "assign stable tracking ids" (unit dt-assign-ids-step) ---
+// The save→reload loop is a point the developer is ALREADY paying attention to
+// (they just edited and are watching for the reload) — the same named,
+// actionable step surfaced at `tot validate` / `tot submit` / `tot preview`
+// (scripts/tenant/validate.mjs's CTA_MISSING_ID_FIX / LOUD_ADVISORY_RULES)
+// belongs here too, in the SAME words, or a developer sees a different warning
+// depending on which command happened to notice first. Reuses that module's
+// `findMissingCtaIds` detector directly — this unit wires an existing detector
+// into a new touchpoint, it does not invent a new one. Advisory only: a
+// scan failure (unreadable file, mid-write) never blocks the reload.
+const trackingIdNudged = new Set();
+function nudgeTrackingIds(absPath, label) {
+  if (!/\.html?$/i.test(absPath)) return;
+  let html;
+  try {
+    html = readFileSync(absPath, "utf8");
+  } catch {
+    return; // deleted mid-scan, or a transient editor write — never block the reload over this
+  }
+  const findings = findMissingCtaIds(html, label);
+  if (!findings.length) {
+    trackingIdNudged.delete(label); // fixed — nudge again if it regresses later
+    return;
+  }
+  // One nudge per file per session while it stays unfixed, not once per keystroke-driven save.
+  if (trackingIdNudged.has(label)) return;
+  trackingIdNudged.add(label);
+  console.log(
+    `\n  ⚠ assign stable tracking ids — ${findings.length} actionable element(s) in ${label} have no data-tot-el`,
+  );
+  console.log(`    They render and work fine, but stay invisible to interaction tracking until identified.`);
+  console.log(
+    `    Assign them: GET/POST /api/admin/tracking-writeback proposes ids for review as a candidate PR, or run \`tot validate\` for the full list.\n`,
+  );
+}
+
 function isSymlink(p) {
   try {
     return lstatSync(p).isSymbolicLink();
@@ -275,7 +312,10 @@ if (workspacePath) {
     // `startWatch` polls by default (reliable — native fs.watch dropped editor
     // atomic-saves on macOS); TOT_DEV_NATIVE_WATCH=1 opts into event-driven watch.
     try {
-      const w = startWatch(source, isDir, (rel) => resync(source, target, rel));
+      const w = startWatch(source, isDir, (rel) => {
+        resync(source, target, rel);
+        nudgeTrackingIds(isDir ? join(source, rel) : source, rel ? `${wsRel}/${rel}` : wsRel);
+      });
       watchers.push(w);
     } catch (e) {
       console.warn(`  ⚠ could not watch ${wsRel} (edits won't hot-reload): ${e?.message}`);
@@ -289,8 +329,24 @@ if (workspacePath) {
     cleanupGrafts();
     process.exit(1);
   }
-} else if (!existsSync(resolve(repoRoot, ...tenantDirSegments(tenant), "content"))) {
-  console.warn(`⚠ no tenants/${tenant}/content/ found — the tenant may not be registered yet.`);
+} else {
+  // MONOREPO mode: content/ is already in place (nothing grafted), so nothing
+  // else here watches it at the JS level — astro's own Vite HMR reloads on save
+  // silently. Add a lightweight watch for the SAME "assign stable tracking ids"
+  // nudge the standalone graft loop gets above (see nudgeTrackingIds).
+  const monorepoContentDir = resolve(repoRoot, ...tenantDirSegments(tenant), "content");
+  if (!existsSync(monorepoContentDir)) {
+    console.warn(`⚠ no tenants/${tenant}/content/ found — the tenant may not be registered yet.`);
+  } else {
+    try {
+      const w = startWatch(monorepoContentDir, true, (rel) => {
+        if (rel) nudgeTrackingIds(join(monorepoContentDir, rel), `content/${rel}`);
+      });
+      watchers.push(w);
+    } catch (e) {
+      console.warn(`  ⚠ could not watch tenants/${tenant}/content/ for the tracking-id nudge: ${e?.message}`);
+    }
+  }
 }
 
 // Resolve the port BEFORE printing a URL or booting astro. Vite's `strictPort`

package/tenants/home/public/js/storefront.js

@@ -1,90 +1,17 @@
-/* Storefront early-access landing — interactions + analytics.
+/* Storefront early-access landing — interactions.
  * Served at /tenants/home/js/storefront.js (mirrored from tenants/home/public/).
- *
- * ---- tot20 analytics: public reportAnalytics endpoint --------------------
- * GET /reportAnalytics/{origin}/{pluginVersion}/{subject}/{action}?...
- * origin=totcom => anonymous marketing path (user_id null, device-id based).
- * apiKeyNotRequired + allowCORs, so we fire a fire-and-forget GET beacon.
- *
- * Beacon transport is an Image() GET on purpose: the storefront CSP is
- * `img-src https:` (allowed) but `connect-src 'self'` (a cross-origin fetch to
- * qa.tokenoftrust.com would be BLOCKED). An <img> GET sidesteps connect-src.
- *
- * Detail rides in utm_content/utm_campaign (the endpoint's eventProperties).
- * Events use subject=cust and are shaped onto two EXISTING registered wildcards
- * in tot20's analytics schema (analyticEvents.json), so they validate (HTTP 200)
- * with no schema change:
- *   - views  → cust_viewed_totcom_page_*   (the anonymous tokenoftrust.com convention)
- *   - clicks → cust_clicked_btn_*
- * ------------------------------------------------------------------------- */
+ */
 (function () {
-  const BASE = "https://qa.tokenoftrust.com/api"; // tot20 public API (qa; swap for prod)
-  const ORIGIN = "totcom", PLUGIN = "1.0", SUBJECT = "cust", APP_DOMAIN = "tokenoftrust.com";
-
-  function deviceId() {
-    try {
-      const k = "ampDeviceId";
-      let v = localStorage.getItem(k);
-      if (!v) { v = (crypto.randomUUID ? crypto.randomUUID() : String(Date.now()) + Math.random()); localStorage.setItem(k, v); }
-      return v;
-    } catch (e) { return "anon"; }
-  }
-  function track(action, detail, campaign) {
-    try {
-      const qs = new URLSearchParams({
-        appDomain: APP_DOMAIN, ampDeviceId: deviceId(),
-        title: document.title, referrer: document.referrer || "",
-        lang: navigator.language || "", screen_w: String(screen.width), screen_h: String(screen.height)
-      });
-      if (detail) qs.set("utm_content", detail);
-      qs.set("utm_campaign", campaign || "storefront_early_access");
-      qs.set("utm_source", "storefront-landing"); qs.set("utm_medium", "web");
-      const url = BASE + "/reportAnalytics/" + ORIGIN + "/" + PLUGIN + "/" + SUBJECT + "/" + encodeURIComponent(action) + "?" + qs.toString();
-      // Image() GET beacon — allowed by img-src https:; a fetch would hit connect-src 'self'.
-      new Image().src = url;
-    } catch (e) { /* fire-and-forget */ }
-  }
-  window.__totTrack = track;
-
-  // 1) page view
-  track("viewed_totcom_page_storefront_early_access");
-
-  // 2) every click on a labeled control (captures all CTAs, nav, deck links, login)
-  document.addEventListener("click", function (e) {
-    const el = e.target.closest("[data-ev]");
-    if (el) { const l = el.getAttribute("data-ev"); track("clicked_btn_" + l, l); }
-  });
-
-  // 3) section visibility (which parts of the page people actually reach)
-  if ("IntersectionObserver" in window) {
-    const seen = {};
-    const io = new IntersectionObserver(function (entries) {
-      entries.forEach(function (en) {
-        const name = en.target.getAttribute("data-section");
-        if (en.isIntersecting && !seen[name]) { seen[name] = 1; track("viewed_totcom_page_section_" + name, name); }
-      });
-    }, { threshold: .4 });
-    document.querySelectorAll("[data-section]").forEach(function (s) { io.observe(s); });
-  }
-
-  // 4) scroll depth
-  const marks = [25, 50, 75, 100], hit = {};
-  window.addEventListener("scroll", function () {
-    const sc = document.documentElement, pct = Math.round((sc.scrollTop + window.innerHeight) / sc.scrollHeight * 100);
-    marks.forEach(function (m) { if (pct >= m && !hit[m]) { hit[m] = 1; track("viewed_totcom_page_scroll_" + m, String(m)); } });
-  }, { passive: true });
-
-  // 5) comparison expand/collapse
+  // 1) comparison expand/collapse
   document.querySelectorAll(".cmp .top").forEach(function (btn) {
     btn.addEventListener("click", function () {
       const card = btn.closest(".cmp"), open = card.getAttribute("aria-expanded") === "true";
       card.setAttribute("aria-expanded", open ? "false" : "true");
       btn.setAttribute("aria-expanded", open ? "false" : "true");
-      // (analytics for the open already fired via data-ev on the button)
     });
   });
 
-  // 6) persona tabs
+  // 2) persona tabs
   const tabs = document.querySelectorAll(".seg [data-persona]");
   const panels = document.querySelectorAll(".ppanel");
   tabs.forEach(function (tab) {
@@ -95,12 +22,6 @@
     });
   });
 
-  // 7) time on page (sent on leave)
-  const start = Date.now();
-  window.addEventListener("pagehide", function () {
-    track("viewed_totcom_page_exit", String(Math.round((Date.now() - start) / 1000)));
-  });
-
   // ---- request-access modal --------------------------------------------------
   // Board address the mailto: fallback targets (mirrors the server route's
   // recipient). Kept in sync with apps/storefront/src/pages/api/request-access.ts.
@@ -108,13 +29,12 @@
   const modal = document.getElementById("ra-modal");
   const form = modal && modal.querySelector("form.ra");
 
-  function openModal(source) {
+  function openModal() {
     if (!modal) return;
     modal.classList.remove("done");
     if (form) form.classList.remove("has-error");
     modal.classList.add("on");
     document.body.style.overflow = "hidden";
-    track("clicked_btn_request_access_open", source || "unknown");
     const first = modal.querySelector("input[name=email]");
     if (first) setTimeout(function () { first.focus(); }, 40);
   }
@@ -128,7 +48,7 @@
   document.querySelectorAll('a[href="#request"]').forEach(function (a) {
     a.addEventListener("click", function (e) {
       e.preventDefault();
-      openModal(a.getAttribute("data-ev") || "cta");
+      openModal();
     });
   });
   if (modal) {
@@ -164,7 +84,6 @@
         phone: String(fd.get("phone") || "").trim(),
         details: String(fd.get("details") || "").trim(),
       };
-      track("clicked_btn_request_access_submit", fields.email ? "with_email" : "no_email");
 
       const btn = form.querySelector("button[type=submit]");
       const label = btn ? btn.textContent : "";