@tokenoftrust/cli 1.3.1-rc.2 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.1-rc.2",
+  "version": "1.3.2",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",
@@ -36,6 +36,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test",
+    "prepublishOnly": "node ../../scripts/build/check-cli-clean.mjs ."
   }
 }

package/src/sample.mjs

@@ -9,16 +9,19 @@
  * regulated tenant's identity so the runner's tenant registry resolves it with
  * its `compliance` block on.
  *
- * WHY GIANTVAPES (not a novel synthetic domain): compliance + catalog are
- * resolved by the RUNNER's tenant registry (apps/storefront/src/config/tenants.ts),
- * keyed by domain. `giantvapes.com` is a registered 21+/PACT vape store WITH a
- * `compliance` block and a 50-product catalog fixture baked into the runner, so
- * the sample lights up age-gate + nicotine warning + a populated catalog with
- * zero server. A truly novel domain (e.g. "sample.example") is unclaimed → the
- * runner falls back to HOME_TENANT (siteType "marketing", NO compliance, empty
- * catalog), which would defeat the whole "the free taste still does compliance"
- * goal — so we deliberately borrow giantvapes' identity for the sample. It's the
- * smallest of the vapor tenants (448K), so it keeps the npm tarball light.
+ * WHY sample-store.example (a FICTIONAL store, not a real merchant): compliance
+ * is resolved by the RUNNER's SANITIZED tenant registry
+ * (apps/storefront/src/config/tenants.ts — rewritten at build time by
+ * scripts/build/build-runner.mjs), keyed by domain. The runner registers ONE
+ * generic sample tenant, `sample-store.example`, that carries a `compliance`
+ * block (minAge 21, nicotineWarning), so the sample lights up the age-gate +
+ * nicotine warning off a NON-merchant identity with zero server. The bundled
+ * template below (`template/sample-store/`) is neutral, fictional "Sample Vapor
+ * Co." content — no real merchant's brand, copy, or assets ship here.
+ *
+ * (Earlier this borrowed a real vape merchant's identity + content to get a
+ * populated catalog; that leaked private merchant IP into public npm and was
+ * replaced — see the H1/H2 runner-sanitization work — with this generic sample.)
  *
  * Dependency-free (node:fs + node:path only).
  */
@@ -30,10 +33,10 @@ import { dirname, join, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url)); // packages/cli/src
 
-/** The tenant identity the sample borrows so compliance + catalog resolve (see module doc). */
-export const SAMPLE_TENANT = "giantvapes";
+/** The generic sample tenant the runner registers with a compliance block (see module doc). */
+export const SAMPLE_TENANT = "sample-store.example";
 /** Dotted scope → the runner's path-prefix route + registry lookup (must contain a dot per context.mjs). */
-export const SAMPLE_SCOPE = "giantvapes.com";
+export const SAMPLE_SCOPE = "sample-store.example";
 /** Default directory name scaffolded when the user doesn't name one. */
 export const SAMPLE_DIR_NAME = "sample-store";