@tokenoftrust/cli 4.4.0 → 4.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.4.0",
+  "version": "4.4.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/pr.mjs

@@ -36,6 +36,7 @@ import {
 import { createMcpClient } from "../mcp.mjs";
 import { establishSession, AuthUnavailableError } from "../auth.mjs";
 import { fail } from "../errors.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 import { scopeToTenant } from "../tenant-scope.mjs";
 import { repoNameFromRemote, currentBranch } from "./submit.mjs";
 // `tot pr list` reuses `tot ship --pr`'s operator-secret transport helpers verbatim
@@ -53,7 +54,7 @@ const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 const SUBCOMMANDS = ["list", "view", "close"];
 
 /**
- * The storefront-owned, shareable `/preview/<tenant>/pr/<N>` link — NEVER the
+ * The storefront-owned, shareable `/<tenant>/preview/pr/<N>` link — NEVER the
  * forge/Gitea `url` (2026-08-18 incident: a raw forge PR URL reached an
  * owner). `candidate_status` (the local-checkout MCP tool) has no
  * `previewUrl` field at all, unlike the operator `GET /api/changes` path — so
@@ -66,8 +67,7 @@ const SUBCOMMANDS = ["list", "view", "close"];
  */
 export function buildPreviewUrl(storefrontUrl, tenant, prNumber) {
   if (typeof prNumber !== "number" || !tenant) return null;
-  const base = (storefrontUrl || DEFAULT_STOREFRONT_URL).trim().replace(/\/+$/, "");
-  return `${base}/preview/${tenant}/pr/${prNumber}`;
+  return previewPrUrl(storefrontUrl || DEFAULT_STOREFRONT_URL, tenant, prNumber);
 }
 
 const USAGE = `tot pr — see and manage candidate PRs

package/src/commands/preview-build.mjs

@@ -30,6 +30,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { planForAction, printPlanAndConfirm } from "../plan.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -147,7 +148,7 @@ export async function run(argv, ctx) {
     return 2;
   }
 
-  const previewUrl = pr != null ? `${base}/preview/${encodeURIComponent(tenant)}/pr/${pr}` : null;
+  const previewUrl = pr != null ? previewPrUrl(base, tenant, pr) : null;
 
   // Self-declaring: state the EXACT plan before acting (the shared plan module).
   const planLines = planForAction({

package/src/commands/rollback.mjs

@@ -39,6 +39,7 @@ import { fail } from "../errors.mjs";
 import { scopeToTenant } from "../tenant-scope.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
 import { startProgress } from "../progress.mjs";
+import { previewRevUrl } from "../preview-url.mjs";
 import { resolveViewerTransport } from "../viewer-session.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
@@ -145,7 +146,7 @@ export function normalizeRollbackResult(r) {
 // ─── Revision links (pure) ───────────────────────────────────────────────
 
 /**
- * The immutable `/preview/<tenant>/rev/<sha>/` deep-link for a promoted
+ * The immutable `/<tenant>/preview/rev/<sha>/` deep-link for a promoted
  * `versionId` — this route, and per `gitea-only-tenant-content-authority` the
  * `versionId` recorded by a promote IS the tenant Gitea sha, so no extra lookup
  * is needed to build it. `null` when there's no `base` (storefront origin) or no
@@ -158,7 +159,7 @@ export function normalizeRollbackResult(r) {
  */
 export function revisionUrl(base, tenant, versionId) {
   if (!base || !versionId) return null;
-  return `${String(base).replace(/\/+$/, "")}/preview/${encodeURIComponent(tenant)}/rev/${encodeURIComponent(versionId)}/`;
+  return previewRevUrl(base, tenant, versionId);
 }
 
 // ─── Candidate selection + rendering (pure) ──────────────────────────────────────

package/src/commands/submit.mjs

@@ -57,6 +57,7 @@ import { startProgress } from "../progress.mjs";
 import { CliError, fail } from "../errors.mjs";
 import { isBrokerUnavailable, waitOutBrokerOutage } from "../broker-outage.mjs";
 import { emitActivity } from "../activity.mjs";
+import { previewPrUrl } from "../preview-url.mjs";
 import {
   diagnosticReference,
   invocationDegradedResult,
@@ -2096,7 +2097,7 @@ function reportComplianceCheck(c) {
  * formatShareableUrlBlock's job, above — the two are deliberately redundant:
  * this one is available immediately but "building", that one is authoritative
  * once reconcile actually lands). Same route shape as the server-minted one
- * (`/preview/<tenant>/pr/<N>`) by construction — see
+ * (`/<tenant>/preview/pr/<N>`) by construction — see
  * docs/architecture/preview-candidate-workflow.md — so the link doesn't change
  * out from under the reviewer once the build completes; it just starts
  * resolving.
@@ -2108,7 +2109,7 @@ function reportComplianceCheck(c) {
  * @returns {string}
  */
 export function shareablePrUrl(base, tenant, prNumber) {
-  return `${String(base).replace(/\/+$/, "")}/preview/${tenant}/pr/${prNumber}`;
+  return previewPrUrl(base, tenant, prNumber) ?? "";
 }
 
 /**

package/src/declared-config.d.mts

@@ -68,6 +68,9 @@ export interface NicotineWarningPresentation {
   textTransform: "uppercase" | "none";
   fontWeight: number;
   fontSizePx: number;
+  borderWidthPx?: number;
+  paddingYPx?: number;
+  letterSpacingPx?: number;
 }
 export interface ResolvedNicotineWarning {
   enabled: boolean;
@@ -79,6 +82,8 @@ export interface ResolvedNicotineWarning {
 export const NICOTINE_WARNING_TEXT: string;
 export const CONSPICUITY_FLOOR: Readonly<{ contrast: number; fontSizePx: number; fontWeight: number }>;
 export const DEFAULT_NICOTINE_WARNING_PRESET: string;
+export const NICOTINE_WARNING_BOX_BOUNDS: Readonly<Record<"borderWidthPx" | "paddingYPx" | "letterSpacingPx", Readonly<{ min: number; max: number; integer: boolean }>>>;
+export const MEDIUM_WEIGHT_REQUIREMENTS: Readonly<{ fontSizePx: number; contrast: number; borderWidthPx: number }>;
 export const NICOTINE_WARNING_PRESETS: Readonly<Record<string, Readonly<NicotineWarningPresentation>>>;
 export const NICOTINE_WARNING_KEYS: readonly string[];
 export const NICOTINE_WARNING_STYLE_KEYS: readonly string[];

package/src/declared-config.mjs

@@ -782,6 +782,16 @@ export const CONSPICUITY_FLOOR = Object.freeze({ contrast: 7, fontSizePx: 12, fo
 /** Bounds on the size a custom style may declare, so the bar cannot swallow the header. */
 const MAX_FONT_SIZE_PX = 24;
 
+/** Bounds on the optional box and spacing keys; an unset key renders the preset's own frame. */
+export const NICOTINE_WARNING_BOX_BOUNDS = Object.freeze({
+  borderWidthPx: Object.freeze({ min: 0, max: 8, integer: true }),
+  paddingYPx: Object.freeze({ min: 0, max: 24, integer: true }),
+  letterSpacingPx: Object.freeze({ min: 0, max: 4, integer: false }),
+});
+
+/** Weight 500 is allowed only on a boxed bar that is at least this large, contrasty and bordered. */
+export const MEDIUM_WEIGHT_REQUIREMENTS = Object.freeze({ fontSizePx: 16, contrast: 7, borderWidthPx: 2 });
+
 export const DEFAULT_NICOTINE_WARNING_PRESET = "dark";
 
 /**
@@ -816,6 +826,9 @@ export const NICOTINE_WARNING_PRESETS = Object.freeze({
  *   textTransform: "uppercase" | "none",
  *   fontWeight: number,
  *   fontSizePx: number,
+ *   borderWidthPx?: number,
+ *   paddingYPx?: number,
+ *   letterSpacingPx?: number,
  * }} NicotineWarningPresentation
  */
 
@@ -824,9 +837,10 @@ export const NICOTINE_WARNING_KEYS = Object.freeze(["preset", "style", "checkWid
 
 export const NICOTINE_WARNING_STYLE_KEYS = Object.freeze([
   "background", "text", "border", "textTransform", "fontWeight", "fontSizePx",
+  "borderWidthPx", "paddingYPx", "letterSpacingPx",
 ]);
 const TEXT_TRANSFORMS = ["uppercase", "none"];
-const FONT_WEIGHTS = [600, 700, 800, 900];
+const FONT_WEIGHTS = [500, 600, 700, 800, 900];
 const HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
 
 /** `#abc` / `#AABBCC` → `#aabbcc`. */
@@ -865,7 +879,15 @@ export function conspicuityProblems(p) {
     out.push(`font size ${p.fontSizePx}px is below the ${CONSPICUITY_FLOOR.fontSizePx}px floor`);
   }
   if (p.fontWeight < CONSPICUITY_FLOOR.fontWeight) {
-    out.push(`font weight ${p.fontWeight} is below the ${CONSPICUITY_FLOOR.fontWeight} floor`);
+    const need = MEDIUM_WEIGHT_REQUIREMENTS;
+    const medium = p.fontWeight === 500 && p.fontSizePx >= need.fontSizePx && ratio >= need.contrast
+      && (p.borderWidthPx ?? 0) >= need.borderWidthPx;
+    if (!medium) {
+      out.push(`font weight ${p.fontWeight} is below the ${CONSPICUITY_FLOOR.fontWeight} floor` +
+        (p.fontWeight === 500
+          ? ` (500 needs font size >= ${need.fontSizePx}px, contrast >= ${need.contrast}:1 and borderWidthPx >= ${need.borderWidthPx})`
+          : ""));
+    }
   }
   return out;
 }
@@ -885,6 +907,14 @@ function styleValueProblem(key, value) {
       return typeof value === "number" && Number.isFinite(value) && value >= CONSPICUITY_FLOOR.fontSizePx && value <= MAX_FONT_SIZE_PX
         ? null
         : `\`fontSizePx\` must be a number from ${CONSPICUITY_FLOOR.fontSizePx} to ${MAX_FONT_SIZE_PX}`;
+    case "borderWidthPx":
+    case "paddingYPx":
+    case "letterSpacingPx": {
+      const { min, max, integer } = NICOTINE_WARNING_BOX_BOUNDS[key];
+      return typeof value === "number" && Number.isFinite(value) && value >= min && value <= max && (!integer || Number.isInteger(value))
+        ? null
+        : `\`${key}\` must be ${integer ? "a whole number" : "a number"} from ${min} to ${max}`;
+    }
     default:
       return `\`${key}\` is not a nicotine-warning style key (allowed: ${NICOTINE_WARNING_STYLE_KEYS.join(", ")})`;
   }
@@ -993,7 +1023,10 @@ export function nicotineWarningCheckWidths(declaration) {
  */
 export function describeNicotineWarningPresentation(p) {
   return `background ${p.background}, text ${p.text}, border ${p.border}, ` +
-    `${p.textTransform === "uppercase" ? "uppercase" : "normal case"}, weight ${p.fontWeight}, ${p.fontSizePx}px`;
+    `${p.textTransform === "uppercase" ? "uppercase" : "normal case"}, weight ${p.fontWeight}, ${p.fontSizePx}px` +
+    (p.borderWidthPx === undefined ? "" : `, border width ${p.borderWidthPx}px`) +
+    (p.paddingYPx === undefined ? "" : `, vertical padding ${p.paddingYPx}px`) +
+    (p.letterSpacingPx === undefined ? "" : `, letter spacing ${p.letterSpacingPx}px`);
 }
 
 /**
@@ -1017,11 +1050,12 @@ export function describeNicotineWarningPresentation(p) {
  */
 export function nicotineWarningHtml(declaration, variant) {
   const { presentation, preset } = resolveNicotineWarning(declaration);
+  const barPadding = presentation.paddingYPx === undefined ? "0.5rem" : `${presentation.paddingYPx}px`;
   const attrs = `style="${nicotineWarningStyle(presentation, variant)}" role="note" aria-label="Health warning" ` +
     `data-compliance="nicotine-warning" data-nicotine-warning-preset="${preset ?? "custom"}"`;
   const text = NICOTINE_WARNING_TEXT_LOCK;
   return variant === "bar"
-    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:0.5rem;text-align:center;${text}">${NICOTINE_WARNING_TEXT}</p></div>`
+    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:${barPadding};text-align:center;${text}">${NICOTINE_WARNING_TEXT}</p></div>`
     : `<div ${attrs}><p style="margin:0;${text}">${NICOTINE_WARNING_TEXT}</p></div>`;
 }
 
@@ -1061,15 +1095,17 @@ const NICOTINE_WARNING_TEXT_LOCK = [
  */
 export function nicotineWarningStyle(p, variant) {
   const size = variant === "block" ? Math.max(p.fontSizePx, 14) : p.fontSizePx;
+  const boxed = `${p.borderWidthPx ?? 2}px`;
   const frame = variant === "bar"
-    ? [`border-bottom:2px solid ${p.border}`]
-    : [`border:2px solid ${p.border}`, "border-radius:var(--radius-md)", "padding:0.75rem 1rem"];
+    ? [p.borderWidthPx === undefined ? `border-bottom:2px solid ${p.border}` : `border:${boxed} solid ${p.border}`]
+    : [`border:${boxed} solid ${p.border}`, "border-radius:var(--radius-md)",
+      `padding:${p.paddingYPx === undefined ? "0.75rem" : `${p.paddingYPx}px`} 1rem`];
   return [
     ...frame,
     `background-color:${p.background}`,
     `color:${p.text}`,
     `text-transform:${p.textTransform}`,
-    `letter-spacing:${p.textTransform === "uppercase" ? "0.06em" : "normal"}`,
+    `letter-spacing:${p.letterSpacingPx !== undefined ? `${p.letterSpacingPx}px` : p.textTransform === "uppercase" ? "0.06em" : "normal"}`,
     `font-weight:${p.fontWeight}`,
     `font-size:${size}px`,
     "line-height:1.4",

package/src/preview-url.mjs

@@ -0,0 +1,54 @@
+/**
+ * The one builder of preview URLs. A store's preview lives under the store, never under a
+ * `/preview/<store>` prefix:
+ *
+ *   <origin>/<store>/preview             the store's current shared preview
+ *   <origin>/<store>/preview/pr/<n>      candidate PR n
+ *   <origin>/<store>/preview/rev/<sha>/  an immutable revision
+ *
+ * Every producer (Worker, CLI) calls these; `apps/storefront/src/pages/preview/preview-url-routes.test.ts`
+ * resolves each shape against the page route table. `packages/cli/src/preview-url.mjs` is a
+ * byte-identical copy (a CLI test pins it).
+ */
+
+/** The canonical shapes, for messages that name the right URL. */
+export const PREVIEW_URL_SHAPE = "/<store>/preview[/pr/<n>]";
+
+function trimOrigin(origin) {
+  return String(origin).trim().replace(/\/+$/, "");
+}
+
+/** `/<store>/preview` with an optional sub-path (`/pr/5`). */
+export function previewPath(store, subPath = "") {
+  return `/${encodeURIComponent(store)}/preview${subPath}`;
+}
+
+export function previewUrl(origin, store) {
+  return `${trimOrigin(origin)}${previewPath(store)}`;
+}
+
+/** `null` when `prNumber` is not a positive integer. */
+export function previewPrUrl(origin, store, prNumber) {
+  const n = Number(prNumber);
+  if (!Number.isInteger(n) || n < 1) return null;
+  return `${trimOrigin(origin)}${previewPath(store, `/pr/${n}`)}`;
+}
+
+export function previewRevUrl(origin, store, versionId) {
+  return `${trimOrigin(origin)}${previewPath(store, `/rev/${encodeURIComponent(versionId)}/`)}`;
+}
+
+/**
+ * The canonical location for a legacy `/preview/<store>[/pr/<n>[/...]]` request, or `null` when
+ * the path is not that shape. `isStore` decides whether the first segment names a store
+ * (the caller owns what a store id looks like), so `/preview/pr/5`, `/preview/rev/...` and the
+ * other first-segment routes are never read as a store.
+ */
+export function legacyPreviewLocation(pathname, search, isStore) {
+  const m = /^\/preview\/([^/]+)(\/.*)?$/.exec(pathname);
+  if (!m) return null;
+  const store = m[1];
+  if (!/^[A-Za-z0-9.-]+$/.test(store) || !isStore(store)) return null;
+  const rest = (m[2] ?? "").replace(/\/+$/, "");
+  return `/${store}/preview${rest}${search ?? ""}`;
+}