@tokenoftrust/storefront-runner 2.0.5 → 2.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/apps/storefront/src/lib/shared/developerInvites.ts +6 -0
  2. package/package.json +1 -1
package/apps/storefront/src/lib/shared/developerInvites.ts CHANGED
@@ -2,6 +2,12 @@
2
2
  * DeveloperInviteClient — the storefront's seam to tot20's operator-auth
3
3
  * developer-invite endpoint (#8425): a keyless, self-serve invite path.
4
4
  *
5
+ * This is the ENROLLMENT (L1) surface — see docs/architecture/grant-surfaces.md
6
+ * ("Let a person sign in / hold a role on a tenant"). It writes eligibility +
7
+ * emails a sign-in link; it is NOT the authorization (L2) surface and must never
8
+ * be extended to emit a delegated capability like `ship-on-behalf` — that grant
9
+ * is a separate, revocable write through tot20's principal-keyed grant writer.
10
+ *
5
11
  * An authenticated OPERATOR — storefront, presenting its OWN per-tier ToT
6
12
  * credentials — invites a developer EMAIL onto a tenant it OPERATES (not owns).
7
13
  * tot20 authorizes via its own operator-grant check (`hasOperatorGrant`), writes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tokenoftrust/storefront-runner",
3
- "version": "2.0.5",
3
+ "version": "2.0.6",
4
4
  "license": "SEE LICENSE IN LICENSE",
5
5
  "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
6
6
  "packageManager": "pnpm@11.9.0",