@tokenoftrust/cli 2.0.1 → 2.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/accept.mjs

@@ -526,7 +526,7 @@ export async function runIntegrate(
       "x-tot-capability": "ship-on-behalf",
     };
   } else {
-    const viewer = await resolveViewer({ tenant, env, fetchImpl });
+    const viewer = await resolveViewer({ tenant, env, fetchImpl, storefrontUrl });
     if (!viewer.ok) {
       console.error(fail(viewer.message, viewer.hint));
       return 2;

package/src/commands/preview-doctor.mjs

@@ -18,7 +18,8 @@
  *     generic storefront origin (from PREVIEW_RECONCILE_SECRET / GRANTS_ADMIN_SECRET
  *     / TOT_OPERATOR_SECRET, or `--secret`).
  *   - VIEWER SESSION (an invited developer with no secret): mint a `tot_session`
- *     from their own `tot login` on the tenant's own host (`resolveViewerTransport`).
+ *     from their own `tot login`, routed through the shared storefront origin under
+ *     the tenant's path prefix (`resolveViewerTransport`).
  * A caller who cannot see the accept queue cannot get a diagnosis of it — an auth
  * refusal (401/403) is relayed as a clean house-style failure, not a wrapped verdict.
  *
@@ -126,7 +127,10 @@ export async function runDoctor(
       "x-tot-capability": "ship-on-behalf",
     };
   } else {
-    const viewer = await resolveViewer({ tenant, env, fetchImpl });
+    // `--url` steers BOTH transports. It previously reached only the operator-secret
+    // branch, so a developer diagnosing their own tenant had no way to redirect the
+    // command and the flag read as ignored.
+    const viewer = await resolveViewer({ tenant, env, fetchImpl, storefrontUrl });
     if (!viewer.ok) {
       console.error(fail(viewer.message, viewer.hint));
       return 2;

package/src/commands/submit.mjs

@@ -1356,15 +1356,32 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
 
   // 1. validate locally — refuse on errors.
   if (!args.skipValidate) {
+    /** Warnings that would otherwise be swallowed, but describe a defect that ships
+     *  looking healthy: [rule, headline, what it costs if ignored]. */
+    const LOUD_ADVISORY_RULES = [
+      [
+        "git-conflict-markers",
+        "git conflict markers in submitted content — an unfinished merge/rebase?",
+        "The preview will still build, but it will serve the broken markers. Resolve before shipping.",
+      ],
+      [
+        "duplicate-skip-link",
+        "duplicate skip link — your chrome already supplies one",
+        "The page renders fine and every automated check passes; a screen-reader user hears it twice.",
+      ],
+    ];
     const { ok, findings } = validateTenant(workspace, { tenantId: tenant, scope: ctx.config?.scope });
-    // Advisory but LOUD: git conflict markers must never slip past as "validated"
-    // (the half-resolved-rebase incident). Surfaced on the ok path too — warnings
-    // are otherwise swallowed here — but they never block the submit.
-    const conflicts = findings.filter((f) => f.rule === "git-conflict-markers");
-    if (conflicts.length) {
-      console.error(`\n⚠ git conflict markers in submitted content (${conflicts.length} file(s)) — an unfinished merge/rebase?`);
-      for (const f of conflicts) console.error(`  ⚠ ${f.file} — ${f.message}`);
-      console.error("  The preview will still build, but it will serve the broken markers. Resolve before shipping.\n");
+    // Advisory but LOUD. Warnings are otherwise swallowed on the ok path, which is
+    // wrong for defects that SHIP SILENTLY: the preview builds, the console is clean,
+    // reconcile and compliance pass, and the flaw only surfaces to whoever reads the
+    // rendered page. Those get surfaced here — never blocking, since none of them
+    // makes the candidate unservable.
+    for (const [rule, headline, consequence] of LOUD_ADVISORY_RULES) {
+      const hits = findings.filter((f) => f.rule === rule);
+      if (!hits.length) continue;
+      console.error(`\n⚠ ${headline} (${hits.length} file(s))`);
+      for (const f of hits) console.error(`  ⚠ ${f.file} — ${f.message}`);
+      console.error(`  ${consequence}\n`);
     }
     if (!ok) {
       const errs = findings.filter((f) => f.level === ERROR);

package/src/validate.mjs

@@ -452,6 +452,8 @@ function walk(dir, pred) {
 const HREF_RE = /\bhref\s*=\s*"([^"]*)"/gi;
 const SRC_RE = /\b(?:src|srcset)\s*=\s*"([^"]*)"/gi;
 const STYLE_OPEN_WITH_ATTRS_RE = /<style\s+[^>]*>/i;
+/** An in-page skip link: an anchor to a #main-ish target, or one carrying a skip class. */
+const SKIP_LINK_RE = /<a\b[^>]*(?:class="[^"]*\bskip[-\w]*\b[^"]*"|href="#(?:main|content|main-content)\b")/i;
 
 // --- platform-owned routes (framework surfaces, NOT tenant pages) ------------
 /**
@@ -643,6 +645,17 @@ export function validateTenant(tenantDir, opts = {}) {
           "make it a full <!doctype html> document, add a content/chrome.json with header.variant/header.brand.label/header.nav and footer.variant/footer.columns, or add content/chrome.html with <!--PAGE_BODY-->"),
       );
     }
+    // A body-only fragment is spliced INTO the tenant's chrome, and that chrome
+    // already supplies the skip link. A fragment that kept its own ships two — an
+    // a11y defect no browser reports and reconcile cannot see, so it survives every
+    // gate and lands in the assembled page.
+    if (!base && !isFullDocument(html) && hasChrome && SKIP_LINK_RE.test(html)) {
+      findings.push(
+        mk(WARN, "duplicate-skip-link", r,
+          "keeps its own skip link, but the tenant's chrome already supplies one — the assembled page will have two",
+          "delete the page-level skip link; the chrome's skipLink is the one that renders"),
+      );
+    }
     if (STYLE_OPEN_WITH_ATTRS_RE.test(html)) {
       findings.push(
         mk(WARN, "style-attrs", r,

package/src/viewer-session.mjs

@@ -17,11 +17,22 @@ import { resolveDeveloperSession, AuthUnavailableError } from "./auth.mjs";
 
 const SESSION_COOKIE = "tot_session";
 
-/** The tenant's own storefront host — the dev-viewer admission derives the tenant
- *  from the request host, so the session + integrate MUST target it (not the generic
- *  storefront origin + X-Tot-Owner, which only steers the operator-secret path). */
-function tenantBase(tenant) {
-  return `https://${String(tenant || "").trim().toLowerCase()}`;
+/** Default storefront origin serving every tenant under a path prefix. */
+export const DEFAULT_STOREFRONT_ORIGIN = "https://storefront.tokenoftrust.store";
+
+/** The tenant's storefront base on the shared worker: `<origin>/<tenant>`.
+ *
+ *  The dev-viewer admission derives the tenant from the REQUEST, not from an
+ *  X-Tot-Owner header (that only steers the operator-secret path) — but it reads
+ *  it from the leading path segment, which the middleware strips, so the shared
+ *  origin serves every tenant. Addressing `https://<tenant>` directly only works
+ *  for a tenant whose apex has already cut over to the storefront; for everyone
+ *  else that host is still their legacy site and answers 404 to every
+ *  `/api/...` path. Routing through the shared origin works in both cases. */
+/** @param {string} tenant @param {string|null} [storefrontUrl] @returns {string} */
+function tenantBase(tenant, storefrontUrl = null) {
+  const origin = String(storefrontUrl || DEFAULT_STOREFRONT_ORIGIN).trim().replace(/\/+$/, "");
+  return `${origin}/${String(tenant || "").trim().toLowerCase()}`;
 }
 
 /** Pull `tot_session=<id>` out of a (possibly comma-folded) Set-Cookie header. The
@@ -38,8 +49,11 @@ export function parseSessionCookie(setCookie) {
  *   { ok:false, message, hint }                  — a clean, actionable refusal
  * Never throws.
  *
+ * `storefrontUrl` overrides the storefront origin (the CLI's `--url`), so a
+ * developer can point the same command at a non-default deployment.
+ *
  * @param {{ tenant:string, env?:NodeJS.ProcessEnv, fetchImpl?:typeof fetch,
- *   resolveDev?:typeof resolveDeveloperSession }} params
+ *   storefrontUrl?:string|null, resolveDev?:typeof resolveDeveloperSession }} params
  * @returns {Promise<
  *   { ok:true, base:string, authHeaders:Record<string,string> } |
  *   { ok:false, message:string, hint:string }
@@ -49,6 +63,7 @@ export async function resolveViewerTransport({
   tenant,
   env = process.env,
   fetchImpl = fetch,
+  storefrontUrl = null,
   resolveDev = resolveDeveloperSession,
 }) {
   // The developer's OWN MCP token (read + silently refreshed by the resolver). No
@@ -67,7 +82,7 @@ export async function resolveViewerTransport({
     };
   }
 
-  const base = tenantBase(tenant);
+  const base = tenantBase(tenant, storefrontUrl);
   let res;
   try {
     res = await fetchImpl(`${base}/api/dev/cli-session`, {