@tokenoftrust/cli 2.2.0 → 2.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -342,6 +342,27 @@ async function runReadOnlyAlias(alias, args, { env, createClient, establish, sig
   }
 }
 
+/**
+ * Where an invited developer whose store does not resolve gets the exact broken step: the
+ * owner's Team page "Check access" (tot-mcp access_explain), which walks their sign-in and
+ * checkout chain and names the first failure with its fix.
+ * @param {string} tenant
+ */
+export const ACCESS_EXPLAIN_HINT = (tenant) =>
+  `To see exactly which step breaks, ask the owner of ${tenant} to click "Check access" ` +
+  "next to your name on their Team page (or run the tot MCP tool access_explain).";
+
+/**
+ * Does tenant_checkout's own denial send the caller to the entitlement plane (no grant or
+ * client context resolved for the tenant), as opposed to a staff-preview authorization?
+ * Read from the structured fields tenant_checkout sets, never from message text.
+ * @param {unknown} checkout
+ */
+export function checkoutPointsAtEntitlement(checkout) {
+  const c = /** @type {any} */ (checkout);
+  return c?.status === "not_entitled" || c?.nextAction === "grant_introspect";
+}
+
 /**
  * Is this client_switch failure the EXPECTED "that tenant is not one of your clients"
  * refusal, as opposed to a broken session (transport, auth, malformed envelope, internal
@@ -446,7 +467,8 @@ export async function checkoutTenant(client, { tenant, tag = "main", cloneDir =
       throw new CliError(redact(String(expectedSwitchRefusal?.message || expectedSwitchRefusal)), {
         next:
           "confirm you're entitled to this store — `tot grants` lists what your session can " +
-          "act on, and `tot login` refreshes a grant issued after you signed in",
+          "act on, and `tot login` refreshes a grant issued after you signed in. " +
+          ACCESS_EXPLAIN_HINT(tenant),
         cause: expectedSwitchRefusal,
       });
     }
@@ -460,7 +482,18 @@ export async function checkoutTenant(client, { tenant, tag = "main", cloneDir =
   if (err) {
     // AUTHORITATIVE: the checkout rendered a decision, so it is the answer — even when the
     // switch also refused. Substituting grant guidance here is what would tell someone whose
-    // staff authorization had EXPIRED to go looking at their grants.
+    // staff authorization had EXPIRED to go looking at their grants. Only when the checkout's
+    // OWN denial points at entitlement does the switch refusal ride below it: for an invited
+    // developer it is the one that names the cause (the store is not among the tenants their
+    // session resolved), and dropping it left only a downstream "Over-scoped" that reads like
+    // a selection error.
+    if (expectedSwitchRefusal && checkoutPointsAtEntitlement(checkout)) {
+      const switchMessage = String(expectedSwitchRefusal?.message || expectedSwitchRefusal);
+      throw new CliError(
+        redact(`${err.message}\n  client_switch also refused: ${switchMessage}`),
+        { next: `${err.next} ${ACCESS_EXPLAIN_HINT(tenant)}`, cause: expectedSwitchRefusal },
+      );
+    }
     throw new CliError(redact(err.message), { next: err.next });
   }
   const gitRemote = checkout.gitRemote;

package/template/sample-store/content/chrome.html

@@ -84,7 +84,7 @@
         <p>A fictional demo store for the Token of Trust local dev loop.<br>Not a real merchant — sample content only.</p>
       </div>
       <div class="footer-col">
-        <h4>Shop</h4>
+        <p class="footer-col-title">Shop</p>
         <ul>
           <li><a href="/collections/e-liquid">E-Liquid</a></li>
           <li><a href="/collections/salt-nic">Salt Nic</a></li>
@@ -94,7 +94,7 @@
         </ul>
       </div>
       <div class="footer-col">
-        <h4>Support</h4>
+        <p class="footer-col-title">Support</p>
         <ul>
           <li><a href="/search">Search</a></li>
           <li><a href="/pages/about-us">About Us</a></li>
@@ -103,7 +103,7 @@
         </ul>
       </div>
       <div class="footer-col">
-        <h4>Company</h4>
+        <p class="footer-col-title">Company</p>
         <ul>
           <li><a href="/pages/shipping-returns">Shipping &amp; Returns</a></li>
           <li><a href="/pages/privacy-policy">Privacy Policy</a></li>

package/template/sample-store/public/pages/home.css

@@ -60,7 +60,7 @@
 .footer-news input { flex: 1; border: 1px solid rgba(255,255,255,.3); background: transparent; color: #fff; border-radius: 999px; padding: 10px 16px; font-size: .9rem; }
 .footer-news input::placeholder { color: #a9b8e6; }
 .footer-news button { background: #fff; color: var(--navy-ink); border: 0; border-radius: 999px; width: 42px; font-size: 1.1rem; font-weight: 700; cursor: pointer; }
-.footer-col > p { color: #a9b8e6; font-size: .88rem; margin-top: 4px; }
+.footer-col > p:not(.footer-col-title) { color: #a9b8e6; font-size: .88rem; margin-top: 4px; }
 
 /* --- Payment badges ------------------------------------------------------- */
 .pay-badges { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 16px; }

package/template/sample-store/public/pages/mkt.css

@@ -147,7 +147,7 @@
 .footer-grid { display: grid; grid-template-columns: 1.4fr repeat(3, 1fr); gap: clamp(24px, 4vw, 56px); }
 .footer-brand img { height: 40px; filter: brightness(0) invert(1); opacity: .95; }
 .footer-brand p { color: #a9b8e6; margin-top: 14px; font-size: .9rem; max-width: 34ch; }
-.footer-col h4 { color: #fff; font-size: .82rem; letter-spacing: .1em; text-transform: uppercase; margin-bottom: 14px; }
+.footer-col .footer-col-title { color: #fff; font-size: .82rem; font-weight: bold; letter-spacing: .1em; text-transform: uppercase; margin: 0 0 14px; }
 .footer-col ul { display: flex; flex-direction: column; gap: 9px; }
 .footer-col a { color: #c3cff0; font-size: .92rem; }
 .footer-col a:hover { color: #fff; text-decoration: underline; }