@tokenoftrust/cli 2.2.14 → 2.2.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.14",
+  "version": "2.2.16",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/declared-config.mjs

@@ -0,0 +1,82 @@
+/**
+ * The `.tot/config.json` keys the platform reads, and the refusal of everything
+ * else. Shared by `tot validate` (src/validate.mjs) and the monorepo/dev-loop
+ * validator (scripts/tenant/validate.mjs), so both refuse the same keys.
+ *
+ * Mirrors packages/public-runtime/src/declared-tenant-config.mjs (this package ships
+ * to npm on its own); test/declared-config-parity.test.mjs pins the two together, so
+ * a field the platform honors can never be refused here, and a key no surface reads
+ * can never pass. Dependency-free: the storefront runner copies this file as-is.
+ */
+
+export const TOT_CONFIG_KEYS = [
+  "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
+  "siteType", "compliance", "capabilities", "features", "embeds",
+];
+// Keys other tooling has written that the platform does NOT read, with the key it does.
+const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
+export const COMPLIANCE_KEYS = [
+  "ruleProfile", "minAge", "nicotineWarning", "shippingRestriction", "pactAct",
+  "adultSignature", "prop65", "purchaseLimit", "stateEligibility", "exciseTax",
+];
+export const FEATURE_KEYS = [
+  "catalog", "productSearch", "savedItems", "quickView", "newsletter", "commerceSitemap", "productJsonLd", "ageGate",
+];
+export const SITE_TYPES = ["commerce", "marketing"];
+
+const ERROR = "error";
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** @typedef {{level:string, rule:string, file:string, message:string, fix?:string}} Finding */
+function mk(level, rule, file, message, fix) {
+  return { level, rule, file, message, fix };
+}
+
+/**
+ * Refuse what the platform would silently ignore: an unknown top-level key, an
+ * unknown `compliance`/`features` key, or a declared field of the wrong shape. Each
+ * one passes JSON parsing and renders nothing — on a regulated store that is a
+ * mandated notice that never appears.
+ * @param {Record<string, any>} config parsed `.tot/config.json` (an object)
+ * @param {string} [file]
+ * @returns {Finding[]}
+ */
+export function validateDeclaredConfig(config, file = ".tot/config.json") {
+  const out = [];
+  for (const key of Object.keys(config)) {
+    if (!TOT_CONFIG_KEYS.includes(key)) {
+      const renamed = RENAMED_CONFIG_KEYS[/** @type {keyof typeof RENAMED_CONFIG_KEYS} */ (key)];
+      out.push(mk(ERROR, "config-unknown-key", file,
+        `\`${key}\` is not a .tot/config.json key — the platform never reads it`,
+        renamed ? `use \`${renamed}\`` : `known keys: ${TOT_CONFIG_KEYS.join(", ")}`));
+    }
+  }
+  if (config.siteType !== undefined && !SITE_TYPES.includes(config.siteType)) {
+    out.push(mk(ERROR, "config-site-type", file, `\`siteType\` is "${config.siteType}" — must be one of ${SITE_TYPES.join(", ")}`));
+  }
+  /** @type {Array<[string, string[]]>} */
+  const objectFields = [["compliance", COMPLIANCE_KEYS], ["features", FEATURE_KEYS]];
+  for (const [field, known] of objectFields) {
+    const value = config[field];
+    if (value === undefined) continue;
+    if (!isObject(value)) {
+      out.push(mk(ERROR, `config-${field}`, file, `\`${field}\` must be an object`));
+      continue;
+    }
+    for (const key of Object.keys(value)) {
+      if (!known.includes(key)) {
+        out.push(mk(ERROR, `config-${field}-unknown-key`, `${file} ${field}`,
+          `\`${field}.${key}\` is not a ${field} key — nothing renders from it`,
+          `known keys: ${known.join(", ")}`));
+      }
+    }
+  }
+  if (config.capabilities !== undefined && !isObject(config.capabilities)) {
+    out.push(mk(ERROR, "config-capabilities", file, "`capabilities` must be an object"));
+  }
+  if (config.embeds !== undefined
+    && !(Array.isArray(config.embeds) && config.embeds.every((/** @type {unknown} */ s) => typeof s === "string"))) {
+    out.push(mk(ERROR, "config-embeds", file, '`embeds` must be an array of embed slugs, e.g. ["youtube"]'));
+  }
+  return out;
+}

package/src/validate.mjs

@@ -17,12 +17,21 @@
  */
 import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
+import { validateDeclaredConfig } from "./declared-config.mjs";
 import {
   foreignTenantSegments,
   parseMappingTarget,
   workspacePathForTenantRelative,
 } from "./tot-repo-mappings.mjs";
 
+export {
+  TOT_CONFIG_KEYS,
+  COMPLIANCE_KEYS,
+  FEATURE_KEYS,
+  SITE_TYPES,
+  validateDeclaredConfig,
+} from "./declared-config.mjs";
+
 const NUL = String.fromCharCode(0);
 export const ERROR = "error";
 export const WARN = "warn";
@@ -68,70 +77,6 @@ const hasScanExt = (p) => CONFLICT_SCAN_EXT.has((p.match(/\.[^./\\]+$/) || [""])
 const KNOWN_KINDS = new Set(["file", "tree"]);
 const REQUIRED_WORKSPACES = ["content/", "public/", "theme.json"];
 
-// The keys the platform reads in `.tot/config.json`. Mirrors
-// packages/public-runtime/src/declared-tenant-config.mjs (this package ships to npm
-// on its own); test/declared-config-parity.test.mjs pins the two together, so a
-// field the platform honors can never be refused here, and a key no surface reads
-// can never pass.
-export const TOT_CONFIG_KEYS = [
-  "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "siteType", "compliance", "capabilities", "features",
-];
-// Keys other tooling has written that the platform does NOT read, with the key it does.
-const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
-export const COMPLIANCE_KEYS = [
-  "ruleProfile", "minAge", "nicotineWarning", "shippingRestriction", "pactAct",
-  "adultSignature", "prop65", "purchaseLimit", "stateEligibility", "exciseTax",
-];
-export const FEATURE_KEYS = [
-  "catalog", "productSearch", "savedItems", "quickView", "newsletter", "commerceSitemap", "productJsonLd", "ageGate",
-];
-export const SITE_TYPES = ["commerce", "marketing"];
-
-const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-
-/**
- * Refuse what the platform would silently ignore: an unknown top-level key, an
- * unknown `compliance`/`features` key, or a declared field of the wrong shape. Each
- * one passes JSON parsing and renders nothing — on a regulated store that is a
- * mandated notice that never appears.
- * @returns {Finding[]}
- */
-export function validateDeclaredConfig(config, file = ".tot/config.json") {
-  const out = [];
-  for (const key of Object.keys(config)) {
-    if (!TOT_CONFIG_KEYS.includes(key)) {
-      const renamed = RENAMED_CONFIG_KEYS[key];
-      out.push(mk(ERROR, "config-unknown-key", file,
-        `\`${key}\` is not a .tot/config.json key — the platform never reads it`,
-        renamed ? `use \`${renamed}\`` : `known keys: ${TOT_CONFIG_KEYS.join(", ")}`));
-    }
-  }
-  if (config.siteType !== undefined && !SITE_TYPES.includes(config.siteType)) {
-    out.push(mk(ERROR, "config-site-type", file, `\`siteType\` is "${config.siteType}" — must be one of ${SITE_TYPES.join(", ")}`));
-  }
-  /** @type {Array<[string, string[]]>} */
-  const objectFields = [["compliance", COMPLIANCE_KEYS], ["features", FEATURE_KEYS]];
-  for (const [field, known] of objectFields) {
-    const value = config[field];
-    if (value === undefined) continue;
-    if (!isObject(value)) {
-      out.push(mk(ERROR, `config-${field}`, file, `\`${field}\` must be an object`));
-      continue;
-    }
-    for (const key of Object.keys(value)) {
-      if (!known.includes(key)) {
-        out.push(mk(ERROR, `config-${field}-unknown-key`, `${file} ${field}`,
-          `\`${field}.${key}\` is not a ${field} key — nothing renders from it`,
-          `known keys: ${known.join(", ")}`));
-      }
-    }
-  }
-  if (config.capabilities !== undefined && !isObject(config.capabilities)) {
-    out.push(mk(ERROR, "config-capabilities", file, "`capabilities` must be an object"));
-  }
-  return out;
-}
 
 /**
  * Validate a parsed `.tot/config.json` against the shape the reconcile pipeline
@@ -279,7 +224,7 @@ function providesChrome(contentDir) {
 
 const CAPABILITY_KEYS = new Set(["cartCheckout", "ageVerification", "exciseTax"]);
 
-// Compact mirror of EMBED_PROVIDERS (packages/public-runtime/src/embed-catalog.mjs)
+// Compact mirror of EMBED_PROVIDERS (agency-kit/tools/lib/embed-catalog.mjs)
 // for the embed-CSP shift-left scan. The published `tot` CLI bundle can't reach
 // the repo's public-runtime package at runtime, so this is a copy — but a parity
 // test (packages/public-runtime/tests/embed-catalog-parity.test.ts) pins it to
@@ -292,6 +237,18 @@ export const KNOWN_EMBEDS = [
     markers: ["webforms.pipedrive.com", "pipedriveWebForms"],
     origins: ["https://webforms.pipedrive.com"],
   },
+  {
+    slug: "youtube",
+    label: "YouTube video (privacy-enhanced)",
+    markers: ["www.youtube-nocookie.com/embed/"],
+    origins: ["https://www.youtube-nocookie.com"],
+  },
+  {
+    slug: "vimeo",
+    label: "Vimeo video",
+    markers: ["player.vimeo.com/video/"],
+    origins: ["https://player.vimeo.com"],
+  },
 ];
 const KNOWN_EMBED_SLUGS = new Set(KNOWN_EMBEDS.map((p) => p.slug));
 const EMBED_SRC_RE = /<(?:script|iframe)\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi;
@@ -1318,10 +1275,15 @@ export function validateTenant(tenantDir, opts = {}) {
   // provider not opted into embeds.json, or an unknown external <script>/<iframe>
   // origin, is blocking; advisory (info) when there's no embeds.json to compare.
   {
-    let declaredEmbeds = null;
+    // The opt-in is the `embeds` .tot/config.json declares, plus an embeds.json.
+    let declaredEmbeds = Array.isArray(config?.embeds)
+      ? new Set(config.embeds.filter((/** @type {unknown} */ s) => typeof s === "string"))
+      : null;
     if (existsSync(embedsPath)) {
       const { value } = readJsonSafe(embedsPath);
-      if (Array.isArray(value)) declaredEmbeds = new Set(value.filter((s) => typeof s === "string"));
+      if (Array.isArray(value)) {
+        declaredEmbeds = new Set([...(declaredEmbeds ?? []), ...value.filter((s) => typeof s === "string")]);
+      }
     }
     for (const file of walk(contentDir, (p) => p.endsWith(".html"))) {
       const { knownSlugs, unknownOrigins } = scanHtmlForEmbeds(readFileSync(file, "utf8"));