@tokenoftrust/cli 2.2.15 → 2.2.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.15",
+  "version": "2.2.16",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/declared-config.mjs

@@ -11,7 +11,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "siteType", "compliance", "capabilities", "features",
+  "siteType", "compliance", "capabilities", "features", "embeds",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -74,5 +74,9 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
   if (config.capabilities !== undefined && !isObject(config.capabilities)) {
     out.push(mk(ERROR, "config-capabilities", file, "`capabilities` must be an object"));
   }
+  if (config.embeds !== undefined
+    && !(Array.isArray(config.embeds) && config.embeds.every((/** @type {unknown} */ s) => typeof s === "string"))) {
+    out.push(mk(ERROR, "config-embeds", file, '`embeds` must be an array of embed slugs, e.g. ["youtube"]'));
+  }
   return out;
 }

package/src/validate.mjs

@@ -224,7 +224,7 @@ function providesChrome(contentDir) {
 
 const CAPABILITY_KEYS = new Set(["cartCheckout", "ageVerification", "exciseTax"]);
 
-// Compact mirror of EMBED_PROVIDERS (packages/public-runtime/src/embed-catalog.mjs)
+// Compact mirror of EMBED_PROVIDERS (agency-kit/tools/lib/embed-catalog.mjs)
 // for the embed-CSP shift-left scan. The published `tot` CLI bundle can't reach
 // the repo's public-runtime package at runtime, so this is a copy — but a parity
 // test (packages/public-runtime/tests/embed-catalog-parity.test.ts) pins it to
@@ -237,6 +237,18 @@ export const KNOWN_EMBEDS = [
     markers: ["webforms.pipedrive.com", "pipedriveWebForms"],
     origins: ["https://webforms.pipedrive.com"],
   },
+  {
+    slug: "youtube",
+    label: "YouTube video (privacy-enhanced)",
+    markers: ["www.youtube-nocookie.com/embed/"],
+    origins: ["https://www.youtube-nocookie.com"],
+  },
+  {
+    slug: "vimeo",
+    label: "Vimeo video",
+    markers: ["player.vimeo.com/video/"],
+    origins: ["https://player.vimeo.com"],
+  },
 ];
 const KNOWN_EMBED_SLUGS = new Set(KNOWN_EMBEDS.map((p) => p.slug));
 const EMBED_SRC_RE = /<(?:script|iframe)\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi;
@@ -1263,10 +1275,15 @@ export function validateTenant(tenantDir, opts = {}) {
   // provider not opted into embeds.json, or an unknown external <script>/<iframe>
   // origin, is blocking; advisory (info) when there's no embeds.json to compare.
   {
-    let declaredEmbeds = null;
+    // The opt-in is the `embeds` .tot/config.json declares, plus an embeds.json.
+    let declaredEmbeds = Array.isArray(config?.embeds)
+      ? new Set(config.embeds.filter((/** @type {unknown} */ s) => typeof s === "string"))
+      : null;
     if (existsSync(embedsPath)) {
       const { value } = readJsonSafe(embedsPath);
-      if (Array.isArray(value)) declaredEmbeds = new Set(value.filter((s) => typeof s === "string"));
+      if (Array.isArray(value)) {
+        declaredEmbeds = new Set([...(declaredEmbeds ?? []), ...value.filter((s) => typeof s === "string")]);
+      }
     }
     for (const file of walk(contentDir, (p) => p.endsWith(".html"))) {
       const { knownSlugs, unknownOrigins } = scanHtmlForEmbeds(readFileSync(file, "utf8"));