@tokenoftrust/cli 4.10.0 → 4.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.10.0",
+  "version": "4.11.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/analytics-declaration.mjs

@@ -10,8 +10,9 @@
  * input; `agency-kit/tools/lib/fixtures/analytics-declarations.json` is run through both, so a
  * drift on either side fails a test.
  *
- * Messages carry no value from the file — never an id, never a key's value — only the field path
- * and a fixed explanation, so a finding is safe to print, log or forward.
+ * Messages carry no value from the file — never an id, never a key's value, never an unrecognized
+ * key — only the field path and a fixed explanation, so a finding is safe to print, log or forward.
+ * An unrecognized key is anchored by its position among the rejected keys (`$property[0]`).
  *
  * Pure: callers pass the file's text. `packages/cli/src/analytics-declaration.mjs` is a
  * byte-identical copy (a test pins it).
@@ -77,6 +78,17 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * The anchor for the `ordinal`-th rejected key of an object. A rejected key is untrusted text, so
+ * the path names its position among the rejected keys, never the key.
+ * @param {string} base
+ * @param {number} ordinal
+ */
+function rejectedKeyPath(base, ordinal) {
+  const anchor = `$property[${ordinal}]`;
+  return base ? `${base}.${anchor}` : anchor;
+}
+
 /**
  * @param {Record<string, unknown>} obj
  * @param {readonly string[]} allowed
@@ -84,9 +96,11 @@ function isPlainObject(value) {
  * @param {AnalyticsViolation[]} out
  */
 function unknownKeys(obj, allowed, base, out) {
+  let ordinal = 0;
   for (const key of Object.keys(obj)) {
     if (allowed.includes(key) || ANNOTATION_KEYS.includes(key)) continue;
-    out.push({ path: base ? `${base}.${key}` : key, code: "unknown_field" });
+    out.push({ path: rejectedKeyPath(base, ordinal), code: "unknown_field" });
+    ordinal += 1;
   }
 }
 
@@ -100,12 +114,14 @@ function unknownKeys(obj, allowed, base, out) {
 function stageIdViolations(ids, adapter, base, out) {
   /** @type {Map<string, string[]>} */
   const valid = new Map();
+  let rejectedStages = 0;
   for (const [stage, raw] of Object.entries(ids)) {
-    const at = `${base}.ids.${stage}`;
     if (!ANALYTICS_STAGES.includes(stage)) {
-      out.push({ path: at, code: "unknown_enum" });
+      out.push({ path: rejectedKeyPath(`${base}.ids`, rejectedStages), code: "unknown_enum" });
+      rejectedStages += 1;
       continue;
     }
+    const at = `${base}.ids.${stage}`;
     if (!Array.isArray(raw)) {
       out.push({ path: at, code: "type" });
       continue;

package/src/commands/go-live.mjs

@@ -37,6 +37,7 @@ import { fail } from "../errors.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
 import { startProgress } from "../progress.mjs";
 import { openBrowser } from "../open.mjs";
+import { formatImageTypes, normalizeImageTypes } from "../image-census.mjs";
 
 const USAGE = `tot go-live — cut the apex domain over to the storefront
 
@@ -111,6 +112,7 @@ export function normalizeReadiness(r) {
       ? rd.blockedReasons.filter((s) => typeof s === "string")
       : checks.filter((c) => !c.ok).map((c) => c.detail),
     appDomain: typeof o.appDomain === "string" ? o.appDomain : null,
+    imageTypes: normalizeImageTypes(o.imageTypes),
     domainState: rd && o.domain && typeof o.domain === "object" ? o.domain : null,
   };
 }
@@ -201,6 +203,10 @@ export function renderReadiness({ appDomain, readiness, action }) {
     if (!c.ok && c.remedy) lines.push(`        → ${c.remedy}`);
   }
   if (action === "connect") {
+    lines.push(
+      "",
+      `  Uncaptured images by type: ${readiness.imageTypes ? formatImageTypes(readiness.imageTypes) : "not recorded for the live bundle"}`,
+    );
     lines.push(
       "",
       readiness.ready

package/src/commands/validate.mjs

@@ -22,6 +22,7 @@ import { join, relative, resolve, sep } from "node:path";
 import { validateTenant, ERROR, WARN, printLoudAdvisories } from "../validate.mjs";
 import { validateVisualParityClosure } from "../visual-parity.mjs";
 import { fail } from "../errors.mjs";
+import { countSourceImages, formatImageTypes } from "../image-census.mjs";
 import { tenantDirSegments } from "../tenant-dirs.mjs";
 import {
   describeOwner, readWorkspaceTopology, rootFilesOwnedByMounts, TOPOLOGY_FILE,
@@ -187,7 +188,7 @@ export function run(argv, ctx) {
   const { ok, findings } = result;
 
   if (args.json) {
-    console.log(JSON.stringify({ ok, findings }, null, 2));
+    console.log(JSON.stringify({ ok, findings, imageCensus: countSourceImages(dir) }, null, 2));
     return ok ? 0 : 1;
   }
 
@@ -210,6 +211,9 @@ export function run(argv, ctx) {
     console.log(`  ${tag} [${f.rule}] ${f.file}\n      ${f.message}${f.fix ? `\n      → ${f.fix}` : ""}`);
   }
   if (findings.length === 0) console.log("  (no findings)");
+  // Informational, never a finding: the repo keeps source URLs and the publish captures them. A
+  // non-zero type is what `tot go-live` will still block on until a publish has captured it.
+  console.log(`\n  Uncaptured images by type: ${formatImageTypes(countSourceImages(dir))}`);
   console.log(`\n${errors.length === 0 ? "✔" : "✖"} ${errors.length} error(s), ${warns.length} warning(s).\n`);
   return errors.length === 0 ? 0 : 1;
 }

package/src/image-census.mjs

@@ -0,0 +1,86 @@
+/**
+ * The local image census behind `tot validate`, and the one-line format `tot go-live` shares.
+ *
+ * The repo keeps source URLs by design; the publish captures every image into the platform pool.
+ * This counts, without a network or a publish, the source-hosted image references capture will
+ * still have to pull, by type: catalog, blog, pages, other. It is an estimate of the same quantity
+ * the publish census measures (`scripts/publish/lib/captured-image-rewrite.mjs`); the type rule is
+ * the same and a test pins the two together. Dependency-free.
+ */
+import { lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export const IMAGE_TYPES = ["catalog", "blog", "pages", "other"];
+const TEXT = /\.(?:html?|css|json)$/i;
+const MAX_TEXT = 1_500_000;
+const PAGES_PREFIXES = ["content/pages/", "content/pages-html/"];
+const REMOTE_URL = /https?:\/\/[^\s"'<>()\\,]+/gi;
+const IMAGE_PATH = /\.(?:jpe?g|png|gif|webp|avif|svg|ico|bmp|tiff?)$/i;
+
+/** @param {string} path @returns {"catalog"|"blog"|"pages"|"other"} */
+export function imageTypeOf(path) {
+  if (path.startsWith("content/catalog/")) return "catalog";
+  if (path.startsWith("content/blog/")) return "blog";
+  if (PAGES_PREFIXES.some((prefix) => path.startsWith(prefix))) return "pages";
+  return "other";
+}
+
+/** Whether `candidate` names a remote image: an image file extension, or a Shopify files path. */
+function isRemoteImage(candidate) {
+  let url;
+  try { url = new URL(candidate); } catch { return false; }
+  return IMAGE_PATH.test(url.pathname) || /(?:^|\.)cdn\.shopify\.com$/i.test(url.hostname) && url.pathname.includes("/files/");
+}
+
+/**
+ * Source-hosted image references under `content/`, `public/` and `theme.json`, by type. A file over
+ * the byte cap counts as one uncaptured reference, as the publish census counts it.
+ * @param {string} dir the tenant checkout
+ * @returns {Record<"catalog"|"blog"|"pages"|"other", {files: number, references: number, uncaptured: number}>}
+ */
+export function countSourceImages(dir) {
+  const out = Object.fromEntries(IMAGE_TYPES.map((type) => [type, { files: 0, references: 0, uncaptured: 0 }]));
+  /** @param {string} rel */
+  const visit = (rel) => {
+    const absolute = join(dir, rel);
+    const stat = lstatSync(absolute, { throwIfNoEntry: false });
+    if (!stat || stat.isSymbolicLink()) return;
+    if (stat.isDirectory()) {
+      for (const name of readdirSync(absolute).sort()) visit(rel ? `${rel}/${name}` : name);
+      return;
+    }
+    if (!stat.isFile() || !TEXT.test(rel)) return;
+    const bucket = out[imageTypeOf(rel)];
+    bucket.files += 1;
+    if (stat.size > MAX_TEXT) { bucket.references += 1; bucket.uncaptured += 1; return; }
+    const found = (readFileSync(absolute, "utf8").match(REMOTE_URL) ?? []).filter(isRemoteImage).length;
+    bucket.references += found;
+    bucket.uncaptured += found;
+  };
+  visit("content");
+  visit("public");
+  visit("theme.json");
+  return /** @type {any} */ (out);
+}
+
+/** `catalog 0, blog 3, pages 1, other 0` */
+export function formatImageTypes(types) {
+  return IMAGE_TYPES.map((type) => `${type} ${types[type].uncaptured}`).join(", ");
+}
+
+/**
+ * A per-type census from untrusted JSON (a server response): every type must carry non-negative
+ * integer counts, or the whole thing is null — nothing is invented for a missing type.
+ * @param {unknown} raw
+ */
+export function normalizeImageTypes(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const out = {};
+  for (const type of IMAGE_TYPES) {
+    const c = /** @type {any} */ (raw)[type];
+    const counts = [c?.files, c?.references, c?.uncaptured];
+    if (!counts.every((n) => Number.isSafeInteger(n) && n >= 0)) return null;
+    out[type] = { files: c.files, references: c.references, uncaptured: c.uncaptured };
+  }
+  return out;
+}