@tokenoftrust/cli 2.5.2 → 2.5.4

package/README.md

@@ -5,12 +5,17 @@ One command to go from a Token of Trust invite to a running store.
 ```sh
 npm i -g @tokenoftrust/cli
 
-tot clone                    # list the stores you can build on
-tot clone <tenant> my-store  # mirrors `git clone`; dir defaults to <tenant>
+# list the stores you can build on
+tot clone
+# mirrors `git clone`; dir defaults to <tenant>
+tot clone <tenant> my-store
 cd my-store
-tot dev                      # run it locally with save→reload — no Docker needed
-tot preview                  # bundle your edits into a compliance-reviewed preview
-tot ship                     # promote a reconciled preview live (diff + one confirm)
+# run it locally with save→reload — no Docker needed
+tot dev
+# bundle your edits into a compliance-reviewed preview
+tot preview
+# promote a reconciled preview live (diff + one confirm)
+tot ship
 ```
 
 **Prerequisites: Node.js and an invite. Nothing else.** `tot dev` downloads the
@@ -88,7 +93,8 @@ tot login                        tot login
 The value is an **opaque label** — any string works, so it's easy to script parallel identities:
 
 ```
-export TOT_PROFILE=$(uuidgen)    # a fresh isolated identity per terminal / test worker
+# a fresh isolated identity per terminal / test worker
+export TOT_PROFILE=$(uuidgen)
 tot login
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -306,7 +306,8 @@ export async function run(argv, ctx, deps = {}) {
         tenant: args.tenant, dir: /** @type {string} */ (res.dir), env, storefrontUrl: args.url, redact, readTopology, cloneDeps,
       });
       console.log(`\nYour local working clone is at ${res.dir}.`);
-      console.log(`  cd ${res.dir} && tot dev            # run it locally with save→reload`);
+      console.log("  # run it locally with save→reload");
+      console.log(`  cd ${res.dir} && tot dev`);
       console.log(`  (origin has no token — \`tot\` mints one fresh at fetch/push time)`);
       return 0;
     }

package/src/declared-config.mjs

@@ -712,6 +712,15 @@ export function describeNicotineWarningPresentation(p) {
  * of every page; "block" is the reinforced box on the product page. Every interpolated value
  * is a validated hex colour, enum or number. Styling is inline (no utility classes), so the
  * markup renders the same wherever it is served, whatever stylesheet the page carries.
+ *
+ * Every presentation and visibility declaration is inline `!important`, which no tenant
+ * stylesheet rule can override: tenant CSS cannot hide, move, clip, fade or restyle the warning,
+ * and the text element re-asserts the warning's own presentation so a tenant `p { … }` rule does
+ * not reach it. What inline styles cannot stop is another element painting over the warning (a
+ * fixed or sticky header pinned to the top of the viewport). Raising the warning above page
+ * chrome would paint it over the tenant's own open menus and drawers, so occlusion is measured
+ * instead: the page browser gate (`validate-page-browser.mjs`, `nicotineWarning`) fails a page
+ * whose warning is covered at a phone, tablet or desktop width and names the covering element.
  * @param {unknown} declaration the tenant's `compliance.nicotineWarning`
  * @param {"bar" | "block"} variant
  */
@@ -719,11 +728,40 @@ export function nicotineWarningHtml(declaration, variant) {
   const { presentation, preset } = resolveNicotineWarning(declaration);
   const attrs = `style="${nicotineWarningStyle(presentation, variant)}" role="note" aria-label="Health warning" ` +
     `data-compliance="nicotine-warning" data-nicotine-warning-preset="${preset ?? "custom"}"`;
+  const text = NICOTINE_WARNING_TEXT_LOCK;
   return variant === "bar"
-    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:0.5rem;text-align:center">${NICOTINE_WARNING_TEXT}</p></div>`
-    : `<div ${attrs}><p style="margin:0">${NICOTINE_WARNING_TEXT}</p></div>`;
+    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:0.5rem;text-align:center;${text}">${NICOTINE_WARNING_TEXT}</p></div>`
+    : `<div ${attrs}><p style="margin:0;${text}">${NICOTINE_WARNING_TEXT}</p></div>`;
 }
 
+/** Declarations that keep the warning on screen, at full opacity, in its own place. */
+const NICOTINE_WARNING_VISIBILITY_LOCK = [
+  "display:block",
+  "visibility:visible",
+  "opacity:1",
+  "position:relative",
+  "inset:auto",
+  "transform:none",
+  "clip-path:none",
+  "filter:none",
+  "height:auto",
+  "max-height:none",
+  "overflow:visible",
+];
+
+/** The text element inherits the warning's presentation, whatever a tenant `p` rule says. */
+const NICOTINE_WARNING_TEXT_LOCK = [
+  "display:block",
+  "visibility:visible",
+  "opacity:1",
+  "color:inherit",
+  "font-size:inherit",
+  "font-weight:inherit",
+  "text-transform:inherit",
+  "letter-spacing:inherit",
+  "line-height:inherit",
+].map((d) => `${d}!important`).join(";");
+
 /**
  * Inline CSS for a presentation. `variant` "block" (the product page) never renders smaller
  * than 14px.
@@ -744,5 +782,6 @@ export function nicotineWarningStyle(p, variant) {
     `font-weight:${p.fontWeight}`,
     `font-size:${size}px`,
     "line-height:1.4",
-  ].join(";");
+    ...NICOTINE_WARNING_VISIBILITY_LOCK,
+  ].map((d) => `${d}!important`).join(";");
 }

package/template/private-app/README.md

@@ -30,10 +30,14 @@ are the stable human and LLM entry points.
 ## Local loop (no network, no real ToT account needed)
 
 ```
-tot app dev validate            # lint tot-app.json against the contract
-node server.js &                # start the stub receiver
-tot app dev emit order.created  # sign a fixture CloudEvent and POST it in
-tot app dev mint                 # mint a dev widget-launch JWT against an ephemeral key
+# lint tot-app.json against the contract
+tot app dev validate
+# start the stub receiver
+node server.js &
+# sign a fixture CloudEvent and POST it in
+tot app dev emit order.created
+# mint a dev widget-launch JWT against an ephemeral key
+tot app dev mint
 ```
 
 `tot app dev` generates its own throwaway RS256 keypair per app directory