@tokenoftrust/cli 2.0.20 → 2.0.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.20",
+  "version": "2.0.22",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -275,6 +275,39 @@ export async function run(argv, ctx) {
   }
 }
 
+/**
+ * Is this client_switch failure the EXPECTED "that tenant is not one of your clients"
+ * refusal, as opposed to a broken session (transport, auth, malformed envelope, internal
+ * error)? The distinction is load-bearing: an expected refusal is a normal step on the
+ * staff-preview path and must be tolerated, while anything else means the session itself
+ * is unusable and must surface immediately rather than be mistaken for an authorization
+ * problem later.
+ *
+ * Matched on the server's STRUCTURED signal first (`serverCode` / status), because message
+ * text is not a contract. The text fallback exists only for servers predating a typed code
+ * and is deliberately narrow — when in doubt this returns false, which escalates. Treating
+ * an unknown failure as "expected" is the unsafe direction: it would let a dead connection
+ * pass for a routine refusal.
+ *
+ * Pure + exported so it is unit-tested without any I/O.
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+export function isNotClientTenantRefusal(error) {
+  const e = /** @type {any} */ (error);
+  if (!e) return false;
+  // A transport/protocol-level failure is never an authorization refusal.
+  const category = e?.diagnostic?.category ?? e?.category;
+  if (category && category !== "tool_error") return false;
+  const code = e?.diagnostic?.serverCode ?? e?.serverCode;
+  if (typeof code === "string") {
+    return code === "not_client_tenant" || code === "over_scoped";
+  }
+  // Text fallback (pre-typed-code servers) — narrow on purpose.
+  const message = typeof e?.message === "string" ? e.message : "";
+  return /not one of your client tenants/i.test(message);
+}
+
 /**
  * The privileged checkout core, composable in-process (used by `tot clone`
  * and by `tot start`): client_switch → tenant_checkout → optionally clone. The
@@ -287,26 +320,37 @@ export async function run(argv, ctx) {
  *   cloned: boolean, dir: string|null, head: string|null }>}
  */
 export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  // The switch CARRIES the best diagnosis but is NOT a precondition, and the difference
-  // matters in both directions:
+  // tenant_checkout is the SOLE AUTHORITATIVE checkout decision. client_switch is a scope
+  // convenience whose refusal may be entirely expected: a staff human checking out a
+  // merchant tenant under a staff-preview authorization holds no client grant on it, so the
+  // switch MUST refuse while the checkout legitimately succeeds. `tot git-credential` mints
+  // through this same function, so treating the switch as fatal breaks every fetch and push
+  // in such a checkout, not only the clone.
   //
-  //   - Discarding its refusal (the original behaviour) meant a genuinely unentitled tenant
-  //     surfaced later as tenant_checkout complaining about your PRIOR active tenant, which
-  //     reads as a scope-selection slip rather than a missing grant.
-  //   - Treating it as fatal breaks the STAFF-PREVIEW path, where the refusal is expected:
-  //     a staff human checking out a merchant tenant under an authorization holds no client
-  //     grant on it, so client_switch MUST fail while tenant_checkout legitimately succeeds
-  //     (it takes the tenant as an argument and resolves the app from the authorization).
-  //     `tot git-credential` mints through this same function, so a fatal switch also breaks
-  //     every fetch and push in such a checkout, not just the initial clone.
+  // Two failure modes are therefore BOTH wrong, and the second is the dangerous one:
+  //   - discarding the refusal loses the only good explanation when a tenant genuinely is
+  //     not yours;
+  //   - letting the refusal OVERRIDE a checkout denial replaces an authoritative answer
+  //     ("your staff authorization expired / was revoked / does not cover this resource")
+  //     with grant guidance that sends you chasing the wrong thing entirely.
+  // So an EXPECTED switch refusal may never speak over a checkout denial (see below).
   //
-  // So: remember it, proceed, and surface it only if the checkout ALSO fails — at which
-  // point it is the more specific of the two errors.
-  let switchRefusal = null;
+  // An UNEXPECTED switch failure — transport, auth, a malformed envelope — is not the
+  // not-a-client case at all. It means the session itself is broken, and carrying it
+  // silently would let a dead connection masquerade as an authorization problem, so it is
+  // raised immediately rather than remembered.
+  let expectedSwitchRefusal = null;
   try {
     await client.callTool("client_switch", { tenant });
   } catch (e) {
-    switchRefusal = e;
+    if (isNotClientTenantRefusal(e)) {
+      expectedSwitchRefusal = e;
+    } else {
+      throw new CliError(redact(String(e?.message || e)), {
+        next: "the session could not be scoped — check your connection and run `tot whoami`",
+        cause: e,
+      });
+    }
   }
   // vc-app-binding safety-net (08-18, §5): ensure THIS developer is bound to the
   // storefront version-control app BEFORE checkout, so tenant_checkout can resolve
@@ -328,14 +372,15 @@ export async function checkoutTenant(client, { tenant, tag = "main", cloneDir =
   try {
     checkout = await client.callTool("tenant_checkout", { tenant, tag });
   } catch (e) {
-    // Both failed: the switch's refusal names the cause more precisely than a thrown
-    // checkout, so lead with it.
-    if (switchRefusal) {
-      throw new CliError(redact(String(switchRefusal?.message || switchRefusal)), {
+    // A THROWN checkout is not a denial — it never rendered an authorization decision. Only
+    // here may the expected switch refusal speak, because it is the only explanation either
+    // call produced.
+    if (expectedSwitchRefusal) {
+      throw new CliError(redact(String(expectedSwitchRefusal?.message || expectedSwitchRefusal)), {
         next:
           "confirm you're entitled to this store — `tot grants` lists what your session can " +
           "act on, and `tot login` refreshes a grant issued after you signed in",
-        cause: switchRefusal,
+        cause: expectedSwitchRefusal,
       });
     }
     throw e;
@@ -346,15 +391,9 @@ export async function checkoutTenant(client, { tenant, tag = "main", cloneDir =
   // dump (James's 2026-07-19 first-experience failure).
   const err = checkoutError(checkout);
   if (err) {
-    // Same precedence: an unentitled tenant is better explained by the switch.
-    if (switchRefusal) {
-      throw new CliError(redact(String(switchRefusal?.message || switchRefusal)), {
-        next:
-          "confirm you're entitled to this store — `tot grants` lists what your session can " +
-          "act on, and `tot login` refreshes a grant issued after you signed in",
-        cause: switchRefusal,
-      });
-    }
+    // AUTHORITATIVE: the checkout rendered a decision, so it is the answer — even when the
+    // switch also refused. Substituting grant guidance here is what would tell someone whose
+    // staff authorization had EXPIRED to go looking at their grants.
     throw new CliError(redact(err.message), { next: err.next });
   }
   const gitRemote = checkout.gitRemote;

package/src/validate.mjs

@@ -313,15 +313,20 @@ function validateScriptsDoc(doc, file, config) {
   return out;
 }
 
-const SUPPORTED_BLOCK_CONTRACTS = new Set([
+// Standalone published-CLI mirror. packages/cli/test/validate.test.mjs pins it
+// to extension-contract-values.mjs, the repository/runtime authority.
+export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = Object.freeze([
   "block-palette@1",
   "block-palette@2",
   "block-palette@3",
   "block-palette@4",
+  "block-palette@5",
 ]);
+const SUPPORTED_BLOCK_CONTRACTS = new Set(BLOCK_PALETTE_SUPPORTED_CONTRACTS);
 const KNOWN_BLOCKS = new Set([
   "hero",
   "promo_tiles",
+  "trust_strip",
   "featured_collections",
   "featured_products",
   "editorial",
@@ -341,6 +346,7 @@ const KNOWN_BLOCKS = new Set([
 const REQUIRED_BLOCK_PROPS = {
   hero: ["headline"],
   promo_tiles: ["tiles"],
+  trust_strip: ["items"],
   featured_collections: ["handles"],
   editorial: ["title"],
   newsletter: ["title"],
@@ -368,6 +374,37 @@ const PRODUCT_SOURCE_KEYS = new Set([
   "recentlyViewed",
 ]);
 const PRODUCT_SOURCE_SHORTCUTS = new Set(["featured", "newest", "bestSelling", "onSale"]);
+export const PROMO_TILE_PRESENTATIONS = Object.freeze(["overlay", "portrait-cards", "editorial-cards", "logo-strip"]);
+const PROMO_TILE_PRESENTATION_SET = new Set(PROMO_TILE_PRESENTATIONS);
+
+export function isSafeRehostedAssetPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/")) return false;
+  if (value.includes("\\") || value.includes("?") || value.includes("#")) return false;
+  let decoded;
+  try { decoded = decodeURIComponent(value); } catch { return false; }
+  if (decoded !== value || decoded.includes("..") || decoded.includes("//")) return false;
+  return /^\/(?:tenants\/[^/]+|shared)\/[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value);
+}
+
+export function isSafeRehostedAssetPathForTenant(value, tenantId) {
+  if (!isSafeRehostedAssetPath(value) || typeof tenantId !== "string" || !tenantId) return false;
+  return value.startsWith("/shared/") || value.startsWith(`/tenants/${tenantId}/`);
+}
+
+export function isSafeStorefrontHref(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return false;
+  if (value.includes("\\") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f]/.test(value)) return false;
+  try {
+    const decoded = decodeURIComponent(value);
+    if (decoded !== value || decoded.includes("\\") || /[\u0000-\u001f\u007f]/.test(decoded)) return false;
+    const segments = value.split("/");
+    return !segments.some((segment, index) =>
+      index > 0 && (segment === "." || segment === ".." || (segment === "" && index < segments.length - 1))
+    );
+  } catch {
+    return false;
+  }
+}
 
 function validateProductSource(value, file, at) {
   const out = [];
@@ -403,7 +440,108 @@ function validateProductSource(value, file, at) {
   return out;
 }
 
-function validateHomeDoc(doc, file) {
+function validateVisualAsset(value, file, at, out, tenantId) {
+  const safe = tenantId
+    ? isSafeRehostedAssetPathForTenant(value, tenantId)
+    : isSafeRehostedAssetPath(value);
+  if (!safe) {
+    out.push(mk(ERROR, "asset-path", file, `${at} must be a /shared/... asset or belong to the active tenant`));
+  }
+}
+
+function validatePromoTiles(block, file, at, out, tenantId) {
+  if (block.presentation !== undefined && !PROMO_TILE_PRESENTATION_SET.has(block.presentation)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.presentation must be overlay, portrait-cards, editorial-cards, or logo-strip`));
+  }
+  if (!Array.isArray(block.tiles)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.tiles must be an array`));
+    return;
+  }
+  block.tiles.forEach((tile, index) => {
+    const tileAt = `${at}.tiles[${index}]`;
+    if (tile == null || typeof tile !== "object" || Array.isArray(tile)) {
+      out.push(mk(ERROR, "block-prop", file, `${tileAt} must be an object`));
+      return;
+    }
+    for (const prop of ["label", "href"]) {
+      if (typeof tile[prop] !== "string" || !tile[prop].trim()) {
+        out.push(mk(ERROR, "block-prop", file, `${tileAt}.${prop} must be a non-empty string`));
+      }
+    }
+    for (const prop of ["imageAlt", "meta"]) {
+      if (tile[prop] !== undefined && typeof tile[prop] !== "string") {
+        out.push(mk(ERROR, "block-prop", file, `${tileAt}.${prop} must be a string`));
+      }
+    }
+    if (tile.image !== undefined) validateVisualAsset(tile.image, file, `${tileAt}.image`, out, tenantId);
+    if (typeof tile.href === "string" && !isSafeStorefrontHref(tile.href)) {
+      out.push(mk(ERROR, "navigation-href", file, `${tileAt}.href must be a same-storefront root-relative path`));
+    }
+    if ((block.presentation ?? "overlay") !== "overlay" && tile.image === undefined) {
+      out.push(mk(ERROR, "block-required", file, `${tileAt}.image is required for ${block.presentation}`));
+    }
+  });
+  if ((block.ctaLabel === undefined) !== (block.ctaHref === undefined)) {
+    out.push(mk(ERROR, "block-required", file, `${at}.ctaLabel and ${at}.ctaHref must be supplied together`));
+  }
+  for (const prop of ["ctaLabel", "ctaHref"]) {
+    if (block[prop] !== undefined && (typeof block[prop] !== "string" || !block[prop].trim())) {
+      out.push(mk(ERROR, "block-prop", file, `${at}.${prop} must be a non-empty string`));
+    }
+  }
+  if (typeof block.ctaHref === "string" && !isSafeStorefrontHref(block.ctaHref)) {
+    out.push(mk(ERROR, "navigation-href", file, `${at}.ctaHref must be a same-storefront root-relative path`));
+  }
+}
+
+function validateTrustStrip(block, file, at, out, tenantId) {
+  if (!Array.isArray(block.items)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.items must be an array`));
+    return;
+  }
+  block.items.forEach((item, index) => {
+    const itemAt = `${at}.items[${index}]`;
+    if (item == null || typeof item !== "object" || Array.isArray(item) || !["claim", "rating"].includes(item.kind)) {
+      out.push(mk(ERROR, "block-prop", file, `${itemAt}.kind must be claim or rating`));
+      return;
+    }
+    if (item.kind === "claim") {
+      if (typeof item.label !== "string" || !item.label.trim()) {
+        out.push(mk(ERROR, "block-prop", file, `${itemAt}.label must be a non-empty string`));
+      }
+      if (item.icon !== undefined) validateVisualAsset(item.icon, file, `${itemAt}.icon`, out, tenantId);
+      if (item.iconAlt !== undefined && typeof item.iconAlt !== "string") {
+        out.push(mk(ERROR, "block-prop", file, `${itemAt}.iconAlt must be a string`));
+      }
+    } else if (
+      typeof item.average !== "number" || item.average <= 0 || item.average > 5 ||
+      typeof item.count !== "number" || item.count <= 0
+    ) {
+      out.push(mk(ERROR, "block-prop", file, `${itemAt} requires average 1–5 and a positive count`));
+    }
+  });
+}
+
+function validateFaq(block, file, at, out) {
+  if (!Array.isArray(block.items)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.items must be an array`));
+    return;
+  }
+  block.items.forEach((item, index) => {
+    const itemAt = `${at}.items[${index}]`;
+    if (item == null || typeof item !== "object" || Array.isArray(item)) {
+      out.push(mk(ERROR, "block-prop", file, `${itemAt} must be an object`));
+      return;
+    }
+    for (const prop of ["q", "a"]) {
+      if (typeof item[prop] !== "string" || !item[prop].trim()) {
+        out.push(mk(ERROR, "block-prop", file, `${itemAt}.${prop} must be a non-empty string`));
+      }
+    }
+  });
+}
+
+function validateHomeDoc(doc, file, tenantId) {
   const out = [];
   if (doc == null || typeof doc !== "object" || Array.isArray(doc)) {
     return [mk(ERROR, "home-root", file, "home.json must be a JSON object")];
@@ -433,6 +571,9 @@ function validateHomeDoc(doc, file) {
     for (const prop of REQUIRED_BLOCK_PROPS[component] || []) {
       if (block[prop] === undefined) out.push(mk(ERROR, "block-required", file, `${at} (${component}) is missing "${prop}"`));
     }
+    if (component === "featured_collections" && (!Array.isArray(block.handles) || !block.handles.every((v) => typeof v === "string"))) {
+      out.push(mk(ERROR, "block-prop", file, `${at}.handles must be a string array`));
+    }
     if (component === "featured_products") {
       if (block.source !== undefined) out.push(...validateProductSource(block.source, file, at));
       if (block.handles !== undefined && (!Array.isArray(block.handles) || !block.handles.every((v) => typeof v === "string"))) {
@@ -442,6 +583,18 @@ function validateHomeDoc(doc, file) {
         out.push(mk(ERROR, "block-prop", file, `${at}.limit must be a number`));
       }
     }
+    if (component === "hero" && block.image !== undefined) {
+      validateVisualAsset(block.image, file, `${at}.image`, out, tenantId);
+    }
+    if (component === "editorial" && block.image !== undefined) {
+      validateVisualAsset(block.image, file, `${at}.image`, out, tenantId);
+      if (typeof block.imageAlt !== "string") {
+        out.push(mk(ERROR, "block-required", file, `${at}.imageAlt is required when ${at}.image is supplied`));
+      }
+    }
+    if (component === "promo_tiles") validatePromoTiles(block, file, at, out, tenantId);
+    if (component === "trust_strip") validateTrustStrip(block, file, at, out, tenantId);
+    if (component === "faq") validateFaq(block, file, at, out);
   });
   return out;
 }
@@ -852,6 +1005,7 @@ export function validateTenant(tenantDir, opts = {}) {
     );
   }
   const scope = opts.scope || config?.scope;
+  const activeTenantId = opts.tenantId || scope || config?.tenant;
   // platform-route awareness: which framework routes the host platform owns for this tenant
   const mode = opts.mode === "workspace" ? "workspace" : "monorepo";
   const hostIsPlatform = mode === "monorepo" || config?.hostPlatform === "tot-storefront";
@@ -910,7 +1064,7 @@ export function validateTenant(tenantDir, opts = {}) {
       if (error) {
         findings.push(mk(ERROR, "content-json-parse", `content/${name}`, `invalid JSON: ${error} (fails the build)`));
       } else if (name === "home.json") {
-        findings.push(...validateHomeDoc(value, "content/home.json"));
+        findings.push(...validateHomeDoc(value, "content/home.json", activeTenantId));
       } else if (name === "chrome.json") {
         findings.push(...findDuplicateCtaIds(value, "content/chrome.json"));
         if (opts.previousChromeJson != null) {