@tokenoftrust/cli 4.7.4 → 4.7.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.7.4",
+  "version": "4.7.6",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/preview-token.mjs

@@ -13,7 +13,7 @@
  * `--json` prints `{ token, exp, ttlSeconds, tenantId, previewVersion }` instead.
  * Treat the token like a password: anyone holding it sees the unpublished site.
  */
-import { resolveViewerTransport } from "../viewer-session.mjs";
+import { resolveViewerTransport, describeIdentity } from "../viewer-session.mjs";
 import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 
 const MAX_TTL_SECONDS = 24 * 3600;
@@ -115,8 +115,10 @@ export async function run(argv, ctx, deps = {}) {
     /* non-JSON error body — this endpoint answers 401/403 as plain text */
   }
   if (res.status === 401 || res.status === 403) {
+    const checked = describeIdentity(transport.identity);
     err(
-      `✗ your account can't view ${tenant}'s preview.\n\n` +
+      `✗ your account can't view ${tenant}'s preview.\n` +
+        `  checked: ${checked ?? "your `tot login` session"} at ${transport.base}\n\n` +
         `  → next: ${refusalHint(res.status, missingGrantsOf(data))}.`,
     );
     return 1;

package/src/declared-config.d.mts

@@ -22,6 +22,9 @@ export const DEFAULT_CURRENCY: "USD";
 export const CURRENCY_CODES: readonly string[];
 export function resolveStoreCurrency(declared: unknown): string;
 export function currencyDeclarationProblems(currency: unknown): string[];
+export const DEFAULT_TIMEZONE: "UTC";
+export function resolveStoreTimeZone(declared: unknown): string;
+export function timezoneDeclarationProblems(timezone: unknown): string[];
 export const SHIPPING_KEYS: readonly string[];
 export const SHIPPING_TIER_KEYS: readonly string[];
 export const MAX_SHIPPING_AMOUNT: number;

package/src/declared-config.mjs

@@ -19,7 +19,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "shipping",
+  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -69,6 +69,42 @@ export function currencyDeclarationProblems(currency) {
     : [`\`currency\` is ${JSON.stringify(currency)} — must be an uppercase ISO 4217 code such as "USD" or "CAD"`];
 }
 
+/** The IANA time zone a store's days are counted in when `.tot/config.json` declares none. */
+export const DEFAULT_TIMEZONE = "UTC";
+
+/**
+ * What is wrong with a declared `timezone`, one sentence; `[]` when it is valid. A valid one is
+ * an IANA zone name the runtime's Intl knows, such as "America/Los_Angeles" or "UTC"; a numeric
+ * offset is not a zone, so "today" would drift across daylight-saving changes.
+ *
+ * @param {unknown} timezone
+ * @returns {string[]}
+ */
+export function timezoneDeclarationProblems(timezone) {
+  const named = typeof timezone === "string" && /^[A-Za-z][A-Za-z0-9_+-]*(\/[A-Za-z0-9_+-]+)*$/.test(timezone);
+  if (named) {
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: /** @type {string} */ (timezone) });
+      return [];
+    } catch {
+      /* not a zone the runtime knows */
+    }
+  }
+  return [`\`timezone\` is ${JSON.stringify(timezone)} — must be an IANA time zone name such as "America/Los_Angeles" or "UTC"`];
+}
+
+/**
+ * The ONE place the time zone a store's days are counted in is resolved. A declared IANA zone
+ * wins; anything else (absent, wrong shape, unknown zone) is UTC. "Today", a daily total and an
+ * order's displayed time take the zone from here, never from the server's clock.
+ *
+ * @param {unknown} declared
+ * @returns {string}
+ */
+export function resolveStoreTimeZone(declared) {
+  return timezoneDeclarationProblems(declared).length === 0 ? /** @type {string} */ (declared) : DEFAULT_TIMEZONE;
+}
+
 
 /** Every `seo` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
 export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimSeoTitles", "structuredData"]);
@@ -737,6 +773,11 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
       out.push(mk(ERROR, "config-currency", file, `${problem} — the store sells in ${DEFAULT_CURRENCY} until it is fixed`));
     }
   }
+  if (config.timezone !== undefined) {
+    for (const problem of timezoneDeclarationProblems(config.timezone)) {
+      out.push(mk(ERROR, "config-timezone", file, `${problem} — the store counts its days in ${DEFAULT_TIMEZONE} until it is fixed`));
+    }
+  }
   if (config.seo !== undefined) {
     for (const problem of seoDeclarationProblems(config.seo)) {
       out.push(mk(ERROR, "config-seo", `${file} seo`, `${problem} — the whole \`seo\` declaration is ignored until it is fixed`));

package/src/validate.mjs

@@ -441,8 +441,11 @@ export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = Object.freeze([
   "block-palette@5",
   "block-palette@6",
   "block-palette@7",
+  "block-palette@8",
 ]);
 export const FEATURED_PRODUCT_PRESENTATIONS = Object.freeze(["grid", "carousel"]);
+export const LATEST_POSTS_DEFAULT_LIMIT = 3;
+export const LATEST_POSTS_MAX_LIMIT = 12;
 const SUPPORTED_BLOCK_CONTRACTS = new Set(BLOCK_PALETTE_SUPPORTED_CONTRACTS);
 const KNOWN_BLOCKS = new Set([
   "hero",
@@ -452,6 +455,7 @@ const KNOWN_BLOCKS = new Set([
   "featured_products",
   "editorial",
   "newsletter",
+  "latest_posts",
   "membership_band",
   "marketing_hero",
   "trust_bar",
@@ -736,6 +740,20 @@ function validateEditorial(block, file, at, out) {
   }
 }
 
+function validateLatestPosts(block, file, at, out) {
+  if (block.limit !== undefined && (!Number.isInteger(block.limit) || block.limit < 1 || block.limit > LATEST_POSTS_MAX_LIMIT)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.limit must be a whole number from 1 to ${LATEST_POSTS_MAX_LIMIT}`));
+  }
+  for (const prop of ["eyebrow", "title", "tag", "ctaLabel", "ctaHref"]) {
+    if (block[prop] !== undefined && (typeof block[prop] !== "string" || !block[prop].trim())) {
+      out.push(mk(ERROR, "block-prop", file, `${at}.${prop} must be a non-empty string`));
+    }
+  }
+  if (typeof block.ctaHref === "string" && block.ctaHref.trim() && !isSafeStorefrontHref(block.ctaHref)) {
+    out.push(mk(ERROR, "navigation-href", file, `${at}.ctaHref must be a same-storefront root-relative path`));
+  }
+}
+
 function validateHomeDoc(doc, file, tenantId) {
   const out = [];
   if (doc == null || typeof doc !== "object" || Array.isArray(doc)) {
@@ -800,6 +818,7 @@ function validateHomeDoc(doc, file, tenantId) {
     if (component === "promo_tiles") validatePromoTiles(block, file, at, out, tenantId);
     if (component === "trust_strip") validateTrustStrip(block, file, at, out, tenantId);
     if (component === "faq") validateFaq(block, file, at, out);
+    if (component === "latest_posts") validateLatestPosts(block, file, at, out);
   });
   return out;
 }

package/src/viewer-session.mjs

@@ -133,7 +133,8 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
 
 /**
  * Resolve a viewer-session transport for `tenant`. Returns
- *   { ok:true, base, authHeaders }               — base = tenant host; cookie transport
+ *   { ok:true, base, identity, authHeaders }     — base = tenant host; cookie transport;
+ *                                                  identity = { account (masked), mcp origin }
  *   { ok:false, message, hint }                  — a clean, actionable refusal
  * Never throws.
  *
@@ -144,7 +145,8 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
  *   storefrontUrl?:string|null, resolveDev?:typeof resolveDeveloperSession,
  *   verbose?:boolean, log?:(s:string)=>void }} params
  * @returns {Promise<
- *   { ok:true, base:string, authHeaders:Record<string,string> } |
+ *   { ok:true, base:string, identity:{ account:string|null, mcp:string|null },
+ *     authHeaders:Record<string,string> } |
  *   { ok:false, message:string, hint:string }
  * >}
  */
@@ -231,6 +233,7 @@ export async function resolveViewerTransport({
     };
   }
 
+  const minted = await readJson(res);
   const cookie = parseSessionCookie(res.headers.get("set-cookie"));
   if (!cookie) {
     return {
@@ -243,6 +246,10 @@ export async function resolveViewerTransport({
   return {
     ok: true,
     base,
+    identity: {
+      account: maskAccount(typeof minted?.email === "string" ? minted.email : null),
+      mcp: originOf(dev.mcpUrl),
+    },
     authHeaders: {
       cookie: `${SESSION_COOKIE}=${cookie}`,
       // Matches the admin browser client; the server IGNORES this hint and re-reads
@@ -252,6 +259,28 @@ export async function resolveViewerTransport({
   };
 }
 
+/** A recognizable stand-in for the signed-in account: first character and domain
+ *  (`d…@example.com`), never the full address.
+ *  @param {string|null} email @returns {string|null} */
+export function maskAccount(email) {
+  const at = email ? email.lastIndexOf("@") : -1;
+  if (!email || at < 1) return null;
+  return `${email[0]}…${email.slice(at)}`;
+}
+
+/**
+ * Which identity and tier the store checked, for a refusal line:
+ * `d…@example.com via https://mcp.tokenoftrust.com`.
+ * @param {{ account?: string|null, mcp?: string|null }|null|undefined} identity
+ * @returns {string|null}
+ */
+export function describeIdentity(identity) {
+  const account = identity?.account || null;
+  const mcp = identity?.mcp || null;
+  if (account && mcp) return `${account} via ${mcp}`;
+  return account || (mcp ? `your ${mcp} sign-in` : null);
+}
+
 /** The refusal body, or null when the body is not JSON (describeCliSessionRefusal
  *  falls back cleanly). Any other failure — a body already consumed, a stream
  *  error — is a bug or a fault, not "no body", and propagates.