@tokenoftrust/cli 2.0.10 → 2.0.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/submit.mjs

@@ -1158,9 +1158,9 @@ function reportCandidate(result, changeId, { quiet = false } = {}) {
  *   status?: {status?: string, reconcile?: object|null, compliance?: object|null,
  *     previewUrl?: string|null, shipped?: object|null, dispatched?: boolean|null,
  *     notDispatched?: boolean, delivery?: object|null}|null,
- *   previewPrUrl?: string|null, error?: string|null, note?: string|null }} input
+ *   previewPrUrl?: string|null, error?: string|null, note?: string|null, noChanges?: boolean }} input
  */
-export function buildJsonResult({ ok, ref = null, commit = null, changeId = null, candidate = null, status = null, previewPrUrl = null, error = null, note = null }) {
+export function buildJsonResult({ ok, ref = null, commit = null, changeId = null, candidate = null, status = null, previewPrUrl = null, error = null, note = null, noChanges = false }) {
   return {
     ok,
     ref,
@@ -1183,6 +1183,13 @@ export function buildJsonResult({ ok, ref = null, commit = null, changeId = null
     forwardFailed: /** @type {any} */ (status)?.forwardFailed ?? false,
     delivery: status?.delivery ?? null,
     previewPrUrl,
+    // Honest-diagnosis parity with the human-readable formatNotDispatchedBlock: a
+    // `--json` caller gets the SAME "why" signal a human sees on the console. Without
+    // this, `candidate:null, notDispatched:true, delivery:null` reads identically for
+    // "no file diff → candidate_open never even ran" and "webhook never registered" /
+    // "wrong tenant scope" — an automation caller (or a human piping --json) had no way
+    // to tell an empty-diff no-op from a genuine platform dispatch failure.
+    ...(noChanges ? { noChanges: true } : {}),
     ...(error ? { error } : {}),
     ...(note ? { note } : {}),
   };
@@ -1756,8 +1763,9 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
     // — automation doesn't want a browser popping up.
     // `commit: statusSha` — the diagnostic blocks name the sha that was actually polled,
     // so a "never dispatched" hint points at a sha `preview_status` knows about.
-    reportStatus(status, tenant, { open: !args.noOpen && !args.json, quiet: args.json, commit: statusSha, ref, verb, noChanges: patchEntries.length === 0 });
-    emitJson(args, buildJsonResult({ ok: status?.status !== "failed", ref, commit, changeId, candidate, status, previewPrUrl }));
+    const noChanges = patchEntries.length === 0;
+    reportStatus(status, tenant, { open: !args.noOpen && !args.json, quiet: args.json, commit: statusSha, ref, verb, noChanges });
+    emitJson(args, buildJsonResult({ ok: status?.status !== "failed", ref, commit, changeId, candidate, status, previewPrUrl, noChanges }));
     return status?.status === "failed" ? 1 : 0;
   } catch (e) {
     progress?.stop();

package/src/validate.mjs

@@ -742,7 +742,12 @@ function walk(dir, pred) {
 
 // --- link / asset extraction -------------------------------------------------
 const HREF_RE = /\bhref\s*=\s*"([^"]*)"/gi;
-const SRC_RE = /\b(?:src|srcset)\s*=\s*"([^"]*)"/gi;
+const SRC_RE = /\bsrc\s*=\s*"([^"]*)"/gi;
+// `srcset` carries a comma-separated list of `url descriptor` pairs (e.g.
+// "a.webp 480w, b.webp 800w"), not a single URL — each candidate must be split
+// off its descriptor before being checked as an asset. Mirrors
+// scripts/publish/lib/asset-reachability.mjs's srcset handling.
+const SRCSET_RE = /\bsrcset\s*=\s*"([^"]*)"/gi;
 const STYLE_OPEN_WITH_ATTRS_RE = /<style\s+[^>]*>/i;
 /** An in-page skip link: an anchor to a #main-ish target, or one carrying a skip class. */
 const SKIP_LINK_RE = /<a\b[^>]*(?:class="[^"]*\bskip[-\w]*\b[^"]*"|href="#(?:main|content|main-content)\b")/i;
@@ -974,6 +979,14 @@ export function validateTenant(tenantDir, opts = {}) {
       const f = checkAsset(m[1].trim(), r, publicDir, opts.tenantId || config?.tenant);
       if (f) findings.push(f);
     }
+    for (const m of html.matchAll(SRCSET_RE)) {
+      for (const candidate of m[1].split(",")) {
+        const url = candidate.trim().split(/\s+/)[0];
+        if (!url) continue;
+        const f = checkAsset(url, r, publicDir, opts.tenantId || config?.tenant);
+        if (f) findings.push(f);
+      }
+    }
   }
 
   // 5. git conflict markers — advisory (never blocks), but LOUD: a half-resolved