@tokenoftrust/cli 2.2.14 → 2.2.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.14",
+  "version": "2.2.15",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/declared-config.mjs

@@ -0,0 +1,78 @@
+/**
+ * The `.tot/config.json` keys the platform reads, and the refusal of everything
+ * else. Shared by `tot validate` (src/validate.mjs) and the monorepo/dev-loop
+ * validator (scripts/tenant/validate.mjs), so both refuse the same keys.
+ *
+ * Mirrors packages/public-runtime/src/declared-tenant-config.mjs (this package ships
+ * to npm on its own); test/declared-config-parity.test.mjs pins the two together, so
+ * a field the platform honors can never be refused here, and a key no surface reads
+ * can never pass. Dependency-free: the storefront runner copies this file as-is.
+ */
+
+export const TOT_CONFIG_KEYS = [
+  "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
+  "siteType", "compliance", "capabilities", "features",
+];
+// Keys other tooling has written that the platform does NOT read, with the key it does.
+const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
+export const COMPLIANCE_KEYS = [
+  "ruleProfile", "minAge", "nicotineWarning", "shippingRestriction", "pactAct",
+  "adultSignature", "prop65", "purchaseLimit", "stateEligibility", "exciseTax",
+];
+export const FEATURE_KEYS = [
+  "catalog", "productSearch", "savedItems", "quickView", "newsletter", "commerceSitemap", "productJsonLd", "ageGate",
+];
+export const SITE_TYPES = ["commerce", "marketing"];
+
+const ERROR = "error";
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** @typedef {{level:string, rule:string, file:string, message:string, fix?:string}} Finding */
+function mk(level, rule, file, message, fix) {
+  return { level, rule, file, message, fix };
+}
+
+/**
+ * Refuse what the platform would silently ignore: an unknown top-level key, an
+ * unknown `compliance`/`features` key, or a declared field of the wrong shape. Each
+ * one passes JSON parsing and renders nothing — on a regulated store that is a
+ * mandated notice that never appears.
+ * @param {Record<string, any>} config parsed `.tot/config.json` (an object)
+ * @param {string} [file]
+ * @returns {Finding[]}
+ */
+export function validateDeclaredConfig(config, file = ".tot/config.json") {
+  const out = [];
+  for (const key of Object.keys(config)) {
+    if (!TOT_CONFIG_KEYS.includes(key)) {
+      const renamed = RENAMED_CONFIG_KEYS[/** @type {keyof typeof RENAMED_CONFIG_KEYS} */ (key)];
+      out.push(mk(ERROR, "config-unknown-key", file,
+        `\`${key}\` is not a .tot/config.json key — the platform never reads it`,
+        renamed ? `use \`${renamed}\`` : `known keys: ${TOT_CONFIG_KEYS.join(", ")}`));
+    }
+  }
+  if (config.siteType !== undefined && !SITE_TYPES.includes(config.siteType)) {
+    out.push(mk(ERROR, "config-site-type", file, `\`siteType\` is "${config.siteType}" — must be one of ${SITE_TYPES.join(", ")}`));
+  }
+  /** @type {Array<[string, string[]]>} */
+  const objectFields = [["compliance", COMPLIANCE_KEYS], ["features", FEATURE_KEYS]];
+  for (const [field, known] of objectFields) {
+    const value = config[field];
+    if (value === undefined) continue;
+    if (!isObject(value)) {
+      out.push(mk(ERROR, `config-${field}`, file, `\`${field}\` must be an object`));
+      continue;
+    }
+    for (const key of Object.keys(value)) {
+      if (!known.includes(key)) {
+        out.push(mk(ERROR, `config-${field}-unknown-key`, `${file} ${field}`,
+          `\`${field}.${key}\` is not a ${field} key — nothing renders from it`,
+          `known keys: ${known.join(", ")}`));
+      }
+    }
+  }
+  if (config.capabilities !== undefined && !isObject(config.capabilities)) {
+    out.push(mk(ERROR, "config-capabilities", file, "`capabilities` must be an object"));
+  }
+  return out;
+}

package/src/validate.mjs

@@ -17,12 +17,21 @@
  */
 import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
+import { validateDeclaredConfig } from "./declared-config.mjs";
 import {
   foreignTenantSegments,
   parseMappingTarget,
   workspacePathForTenantRelative,
 } from "./tot-repo-mappings.mjs";
 
+export {
+  TOT_CONFIG_KEYS,
+  COMPLIANCE_KEYS,
+  FEATURE_KEYS,
+  SITE_TYPES,
+  validateDeclaredConfig,
+} from "./declared-config.mjs";
+
 const NUL = String.fromCharCode(0);
 export const ERROR = "error";
 export const WARN = "warn";
@@ -68,70 +77,6 @@ const hasScanExt = (p) => CONFLICT_SCAN_EXT.has((p.match(/\.[^./\\]+$/) || [""])
 const KNOWN_KINDS = new Set(["file", "tree"]);
 const REQUIRED_WORKSPACES = ["content/", "public/", "theme.json"];
 
-// The keys the platform reads in `.tot/config.json`. Mirrors
-// packages/public-runtime/src/declared-tenant-config.mjs (this package ships to npm
-// on its own); test/declared-config-parity.test.mjs pins the two together, so a
-// field the platform honors can never be refused here, and a key no surface reads
-// can never pass.
-export const TOT_CONFIG_KEYS = [
-  "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "siteType", "compliance", "capabilities", "features",
-];
-// Keys other tooling has written that the platform does NOT read, with the key it does.
-const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
-export const COMPLIANCE_KEYS = [
-  "ruleProfile", "minAge", "nicotineWarning", "shippingRestriction", "pactAct",
-  "adultSignature", "prop65", "purchaseLimit", "stateEligibility", "exciseTax",
-];
-export const FEATURE_KEYS = [
-  "catalog", "productSearch", "savedItems", "quickView", "newsletter", "commerceSitemap", "productJsonLd", "ageGate",
-];
-export const SITE_TYPES = ["commerce", "marketing"];
-
-const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-
-/**
- * Refuse what the platform would silently ignore: an unknown top-level key, an
- * unknown `compliance`/`features` key, or a declared field of the wrong shape. Each
- * one passes JSON parsing and renders nothing — on a regulated store that is a
- * mandated notice that never appears.
- * @returns {Finding[]}
- */
-export function validateDeclaredConfig(config, file = ".tot/config.json") {
-  const out = [];
-  for (const key of Object.keys(config)) {
-    if (!TOT_CONFIG_KEYS.includes(key)) {
-      const renamed = RENAMED_CONFIG_KEYS[key];
-      out.push(mk(ERROR, "config-unknown-key", file,
-        `\`${key}\` is not a .tot/config.json key — the platform never reads it`,
-        renamed ? `use \`${renamed}\`` : `known keys: ${TOT_CONFIG_KEYS.join(", ")}`));
-    }
-  }
-  if (config.siteType !== undefined && !SITE_TYPES.includes(config.siteType)) {
-    out.push(mk(ERROR, "config-site-type", file, `\`siteType\` is "${config.siteType}" — must be one of ${SITE_TYPES.join(", ")}`));
-  }
-  /** @type {Array<[string, string[]]>} */
-  const objectFields = [["compliance", COMPLIANCE_KEYS], ["features", FEATURE_KEYS]];
-  for (const [field, known] of objectFields) {
-    const value = config[field];
-    if (value === undefined) continue;
-    if (!isObject(value)) {
-      out.push(mk(ERROR, `config-${field}`, file, `\`${field}\` must be an object`));
-      continue;
-    }
-    for (const key of Object.keys(value)) {
-      if (!known.includes(key)) {
-        out.push(mk(ERROR, `config-${field}-unknown-key`, `${file} ${field}`,
-          `\`${field}.${key}\` is not a ${field} key — nothing renders from it`,
-          `known keys: ${known.join(", ")}`));
-      }
-    }
-  }
-  if (config.capabilities !== undefined && !isObject(config.capabilities)) {
-    out.push(mk(ERROR, "config-capabilities", file, "`capabilities` must be an object"));
-  }
-  return out;
-}
 
 /**
  * Validate a parsed `.tot/config.json` against the shape the reconcile pipeline