@tokenoftrust/cli 6.6.0 → 6.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "6.6.0",
+  "version": "6.8.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/declared-config.mjs

@@ -24,7 +24,7 @@ export const TOT_CONFIG_KEYS = [
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
 export const COMPLIANCE_KEYS = [
-  "ruleProfile", "minAge", "nicotineWarning", "shippingRestriction", "pactAct",
+  "ruleProfile", "minAge", "ageVerificationRequired", "nicotineWarning", "shippingRestriction", "pactAct",
   "adultSignature", "prop65", "purchaseLimit", "stateEligibility", "exciseTax",
 ];
 export const FEATURE_KEYS = [
@@ -352,6 +352,7 @@ function shippingProblemMessage(problems) {
 export const COMPLIANCE_NOTICES = {
   ruleProfile: "checkout compliance rules",
   minAge: "age gate",
+  ageVerificationRequired: "age verification",
   nicotineWarning: "FDA nicotine warning",
   shippingRestriction: "shipping-restriction notice",
   pactAct: "PACT Act notice",
@@ -395,6 +396,16 @@ export const COMPLIANCE_OBLIGATIONS = Object.freeze([
   { id: "jurisdiction", surface: "commerce", keys: ["stateEligibility", "shippingRestriction"] },
 ]);
 
+/**
+ * Does the declared block require age/identity verification? Mirrors
+ * `ageVerificationRequired` in compliance-obligations.ts: required unless
+ * `ageVerificationRequired: false`, and always for a store that sells nicotine.
+ * @param {Record<string, any> | null | undefined} compliance
+ */
+export function declaresAgeVerificationRequired(compliance) {
+  return compliance?.ageVerificationRequired !== false || !!compliance?.nicotineWarning;
+}
+
 /**
  * The obligations a declared compliance block switches on, as `resolveObligations` returns
  * them (id + surface), in registry order.
@@ -404,6 +415,7 @@ export const COMPLIANCE_OBLIGATIONS = Object.freeze([
 export function declaredObligations(compliance) {
   return COMPLIANCE_OBLIGATIONS
     .filter((o) => o.keys.some((key) => !!compliance?.[key]))
+    .filter((o) => o.id !== "age_gate" || declaresAgeVerificationRequired(compliance))
     .map(({ id, surface }) => ({ id, surface }));
 }
 
@@ -572,6 +584,13 @@ export function complianceFindings(config, file = ".tot/config.json") {
       "`capabilities.exciseTax` cannot be disabled for a store with `compliance.nicotineWarning` or `compliance.exciseTax` — the hosted preview refuses this revision.",
       "Remove `capabilities.exciseTax.enabled: false` from .tot/config.json."));
   }
+  if (compliance?.ageVerificationRequired === false && compliance?.nicotineWarning) {
+    out.push(mk(WARN, "compliance-age-verification-policy", `${file} compliance`,
+      "`compliance.ageVerificationRequired: false` has no effect on a store that sells nicotine " +
+        "(`compliance.nicotineWarning`): platform policy keeps age/ID verification required at checkout.",
+      "Remove `compliance.ageVerificationRequired` from .tot/config.json, or turn only the arrival popup off " +
+        "with `features.ageGate: false`."));
+  }
   if (isRegulatedObligationSet(obligations) && !compliance?.ruleProfile) {
     out.push(mk(WARN, "compliance-rule-profile", `${file} compliance`,
       `This store is regulated (${regulatedBy(compliance, obligations)}) but declares no ` +