@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/migrations-apps/meta/_journal.json

@@ -8,6 +8,27 @@
       "when": 1784820107464,
       "tag": "0000_fast_millenium_guard",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1787074116807,
+      "tag": "0001_woozy_lyja",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1787400126075,
+      "tag": "0002_good_switch",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1787403061681,
+      "tag": "0003_mute_marauders",
+      "breakpoints": true
     }
   ]
 }

package/apps/storefront/package.json

@@ -28,7 +28,6 @@
     "@fontsource/space-mono": "5.3.0",
     "@storyblok/astro": "^10.0.0",
     "@tailwindcss/vite": "^4.3.1",
-    "@tokenoftrust/private-apps-devkit": "*",
     "@tot/public-runtime": "*",
     "astro": "^7.0.3",
     "fuse.js": "^7.4.2",

package/apps/storefront/public/js/dashboard-team.js

@@ -42,11 +42,45 @@
       btn.title = "Re-send the sign-in email to " + m.developer;
       btn.addEventListener("click", () => resend(m.developer, btn));
       act.appendChild(btn);
+      if (m.inviteId) {
+        const revokeBtn = document.createElement("button");
+        revokeBtn.type = "button";
+        revokeBtn.className = "rowbtn";
+        revokeBtn.textContent = "Revoke";
+        revokeBtn.title = "Revoke " + m.developer + "'s access to this vendor";
+        revokeBtn.style.marginLeft = ".4rem";
+        revokeBtn.addEventListener("click", () => revoke(m.developer, m.inviteId, revokeBtn));
+        act.appendChild(revokeBtn);
+      }
       tr.appendChild(dev); tr.appendChild(roles); tr.appendChild(act);
       membersBody.appendChild(tr);
     }
   }
 
+  async function revoke(email, inviteId, btn) {
+    if (!confirm("Revoke " + email + "'s access to this vendor?")) return;
+    if (btn) btn.disabled = true;
+    showMsg("", "Revoking " + email + "'s access…");
+    try {
+      const res = await fetch("/api/grants/team-revoke", {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({ tenant, inviteId, email }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (res.ok) {
+        showMsg("ok", "Revoked " + email + "'s access.");
+        loadMembers();
+      } else {
+        showMsg("err", body.error || ("Couldn't revoke (HTTP " + res.status + ")."));
+        if (btn) btn.disabled = false;
+      }
+    } catch (e) {
+      showMsg("err", "Couldn't revoke: " + (e && e.message ? e.message : e));
+      if (btn) btn.disabled = false;
+    }
+  }
+
   async function resend(email, btn) {
     if (btn) btn.disabled = true;
     showMsg("", "Re-sending the sign-in email to " + email + "…");
@@ -104,8 +138,10 @@
     btn.disabled = true;
     showMsg("", "Sending…");
     try {
-      // The role selector is present only for ToT staff (#8453); members are
-      // developer-only. tot20 ignores a non-staff role, so sending it is harmless.
+      // The role selector always shows Developer + Contributor (a plain member may
+      // self-request Contributor — tot20 honors it, handoff
+      // 2026-08-22-tot20-contributor-role); Admin/Owner render only for ToT staff
+      // (#8453) — tot20 ignores those two from a plain member and pins to developer.
       const roleEl = $("role");
       const role = roleEl && roleEl.value ? roleEl.value : undefined;
       const noteEl = $("note");

package/apps/storefront/src/components/Seo.astro

@@ -3,6 +3,9 @@
  * <Seo> — per-page title/meta, Open Graph, Twitter card, canonical, JSON-LD.
  * (brief §8). Tenant-aware: OG image + site name come from the resolved tenant.
  */
+import { articleSeoMetaTags, type ArticleMeta } from "@/lib/seo/meta.js";
+import { withXDefault, type Alternate } from "@/lib/seo/alternates.js";
+
 interface JsonLd {
   [key: string]: unknown;
 }
@@ -17,6 +20,25 @@ interface Props {
   noindex?: boolean;
   /** One or more JSON-LD graphs (Product, BreadcrumbList, Organization…). */
   jsonLd?: JsonLd | JsonLd[];
+  /** Alternate RSS/Atom feeds this page advertises (e.g. a collection's feed). */
+  feeds?: { title: string; href: string }[];
+  // --- B1.6 article SEO hardening (all additive/optional) ---
+  /** Open Graph `article:*` meta; emitted only when `ogType === "article"`. */
+  article?: ArticleMeta;
+  /** og:image:alt — accessible description of the OG image. */
+  imageAlt?: string;
+  imageWidth?: number;
+  imageHeight?: number;
+  twitterSite?: string;
+  twitterCreator?: string;
+  /** Syndication: when set, REPLACES the derived self-canonical (rel=canonical
+   *  + og:url) so search engines point at the original. */
+  canonicalOverride?: string;
+  /** I2 — per-variant `hreflang` alternates for a translated article (self +
+   *  siblings). When present and non-empty, emits one `<link rel="alternate">`
+   *  per entry PLUS an `x-default`. Absent/empty ⇒ no alternate links (a
+   *  singleton post is unchanged). */
+  alternates?: Alternate[];
 }
 
 const {
@@ -27,10 +49,29 @@ const {
   ogImage,
   noindex = false,
   jsonLd,
+  feeds = [],
+  article,
+  imageAlt,
+  imageWidth,
+  imageHeight,
+  twitterSite,
+  twitterCreator,
+  canonicalOverride,
+  alternates = [],
 } = Astro.props;
 
 const { tenant, canonicalBase } = Astro.locals;
-const canonical = new URL(path, canonicalBase + "/").toString();
+const canonical =
+  canonicalOverride ?? new URL(path, canonicalBase + "/").toString();
+const articleMeta = articleSeoMetaTags({
+  ogType,
+  article,
+  imageAlt,
+  imageWidth,
+  imageHeight,
+  twitterSite,
+  twitterCreator,
+});
 // Don't double-append the brand: merchant SEO titles (title_tag) often already
 // end with the store name.
 const fullTitle = title.includes(tenant.displayName)
@@ -41,6 +82,7 @@ const image = ogImage
   : new URL(tenant.theme_tokens?.brand?.ogImage ?? "/brand/northwind-og.svg", canonicalBase + "/").toString();
 
 const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
+const alternateLinks = withXDefault(alternates);
 ---
 
 <title>{fullTitle}</title>
@@ -48,6 +90,18 @@ const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
 <link rel="canonical" href={canonical} />
 {noindex && <meta name="robots" content="noindex,nofollow" />}
 
+{
+  feeds.map((f) => (
+    <link rel="alternate" type="application/rss+xml" title={f.title} href={f.href} />
+  ))
+}
+
+{
+  alternateLinks.map((a) => (
+    <link rel="alternate" hreflang={a.hreflang} href={a.href} />
+  ))
+}
+
 <meta property="og:type" content={ogType} />
 <meta property="og:site_name" content={tenant.displayName} />
 <meta property="og:title" content={fullTitle} />
@@ -60,6 +114,16 @@ const graphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
 {description && <meta name="twitter:description" content={description} />}
 <meta name="twitter:image" content={image} />
 
+{
+  articleMeta.map((t) =>
+    t.property ? (
+      <meta property={t.property} content={t.content} />
+    ) : (
+      <meta name={t.name} content={t.content} />
+    ),
+  )
+}
+
 {
   graphs.map((g) => (
     <script