@tokenoftrust/storefront-runner 2.2.93 → 2.2.95

package/apps/storefront/src/lib/compliance/enforcement.ts

@@ -107,11 +107,13 @@ export async function resolveTenantRuleset(
 /** Build the enforcement→evidence signals for a tenant (for the promote gate). */
 export async function resolveEnforcementEvidenceSignals(
   tenant: Pick<TenantConfig, "tenant_id" | "compliance">,
+  opts: { ageGateBypassedByRawHtml?: boolean } = {},
 ): Promise<EnforcementEvidenceSignals> {
   const regulated = isRegulatedTenant(tenant);
   const ruleset = await resolveTenantRuleset(tenant);
   return enforcementSignals(ruleset, {
     regulated,
     reportingCaptureWired: PACT_REPORTING_CAPTURE_WIRED,
+    ageGateBypassedByRawHtml: !!opts.ageGateBypassedByRawHtml,
   });
 }

package/apps/storefront/src/lib/compliance/rawComplianceNotices.ts

@@ -0,0 +1,72 @@
+/**
+ * Force-injectable compliance markup for the raw-HTML serve path.
+ *
+ * `rawHtmlResponse` (rawMarketingHtml.ts) bypasses Astro's Layout, so these are
+ * the platform-owned anchors that CAN be guaranteed on a raw document
+ * independent of its content: the FDA nicotine warning, the shipping/
+ * jurisdiction notice, and the excise-tax disclosure. Each mirrors the exact
+ * markup its Layout.astro sibling renders (NicotineWarning.astro "bar" variant,
+ * ShippingRestrictionNotice.astro "footer" variant via ComplianceNotice.astro,
+ * and Layout's own excise-tax <p>) so a raw and a block-composed page present
+ * these anchors identically. See `rawHtmlPolicy` for which anchors this does
+ * and doesn't cover (notably: NOT `age-gate`).
+ */
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+const NICOTINE_WARNING_TEXT =
+  "WARNING: This product contains nicotine. Nicotine is an addictive chemical.";
+
+/** Mirrors NicotineWarning.astro's "bar" variant. */
+export function nicotineWarningBarHtml(): string {
+  return (
+    '<div class="border-b-2 border-[var(--color-text)] bg-[var(--color-text)] text-[var(--color-bg)]" role="note" aria-label="Health warning" data-compliance="nicotine-warning">' +
+    '<p class="container-prose py-2 text-center text-[0.72rem] font-semibold uppercase tracking-[0.06em] sm:text-xs">' +
+    NICOTINE_WARNING_TEXT +
+    "</p></div>"
+  );
+}
+
+/** Mirrors ShippingRestrictionNotice.astro's "footer" variant (via ComplianceNotice.astro). Empty when `text` is absent — same as the Astro component. */
+export function shippingRestrictionNoticeHtml(text: string | undefined): string {
+  if (!text) return "";
+  return (
+    '<div class="border-t border-[var(--color-border)] bg-[var(--color-bg)]" data-compliance="shipping-restriction">' +
+    '<p class="container-prose py-3 text-center text-sm text-[var(--color-muted)]" role="note" aria-label="Shipping restriction notice">' +
+    escapeHtml(text) +
+    "</p></div>"
+  );
+}
+
+/** Mirrors Layout.astro's excise-tax disclosure <p>. */
+export function exciseTaxNoticeHtml(): string {
+  return (
+    '<p class="border-t border-[var(--color-border)] bg-[var(--color-bg)] py-2.5 text-center text-xs text-[var(--color-muted)]" data-capability="excise-tax">' +
+    "Applicable excise tax is calculated at checkout.</p>"
+  );
+}
+
+export interface RawComplianceChromeInput {
+  nicotineWarning?: boolean;
+  shippingRestriction?: string;
+  exciseTaxEnabled?: boolean;
+}
+
+/** The markup to inject at `rawHtmlResponse`'s body-start boundary. */
+export function renderRawComplianceTop(input: RawComplianceChromeInput): string {
+  return input.nicotineWarning ? nicotineWarningBarHtml() : "";
+}
+
+/** The markup to inject at `rawHtmlResponse`'s body-deferred boundary. */
+export function renderRawComplianceBottom(input: RawComplianceChromeInput): string {
+  let out = shippingRestrictionNoticeHtml(input.shippingRestriction);
+  if (input.exciseTaxEnabled) out += exciseTaxNoticeHtml();
+  return out;
+}

package/apps/storefront/src/lib/rawMarketingHtml.ts

@@ -299,6 +299,15 @@ export function rawHtmlResponse(
      * unchanged from today (see resolveCanonicalHref).
      */
     canonicalUrl?: string;
+    /**
+     * Platform-owned compliance markup to force-inject at the body-start and
+     * body-deferred boundaries, independent of the tenant's own document —
+     * see rawComplianceNotices.ts and rawHtmlPolicy's uncoveredSurfaces.
+     * Omitted (the default) is a strict no-op, so every existing raw-HTML
+     * tenant that never passes these is byte-for-byte unchanged.
+     */
+    complianceTop?: string;
+    complianceBottom?: string;
   },
 ): Response {
   let composed =
@@ -344,7 +353,9 @@ export function rawHtmlResponse(
   const phases = renderIntegrationPhases(opts.plan, opts.nonce, opts.consentSnapshot);
   composed = injectHeadStart(composed, phases.head);
   composed = injectBodyStart(composed, phases.bodyStart);
+  if (opts.complianceTop) composed = injectBodyStart(composed, opts.complianceTop);
   composed = injectBodyEnd(composed, phases.bodyDeferred);
+  if (opts.complianceBottom) composed = injectBodyEnd(composed, opts.complianceBottom);
   // Declarative interaction tracking, last in the body so the whole document —
   // a verbatim tenant document, a fragment spliced into a hand-authored
   // `chrome.html`, or a fragment spliced into the generated `renderRawChrome`

package/apps/storefront/src/pages/[...slug].astro

@@ -12,9 +12,10 @@ import ProseToc from "@/components/content/ProseToc.astro";
 import { breadcrumbLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
 import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
+import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import { markPinnedRouteRewriteComplete } from "@/lib/pinnedRouteRewriteBoundary";
 
-const { tenant, canonicalBase, content, basePath } = Astro.locals;
+const { tenant, canonicalBase, content, basePath, capabilities, features } = Astro.locals;
 const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
 
 // Defensive: never let the catch-all answer for first-class route namespaces.
@@ -43,10 +44,16 @@ if (slug === "_style-guide" || slug.startsWith("_style-guide/")) {
 // bypass Layout. Regulated commerce tenants fall through to platform-composed
 // pages so compliance UI cannot be removed by raw HTML.
 const rawHtml = await content.getPageHtml(slug);
-if (rawHtml && rawHtmlPolicy(tenant).allowed) {
+const rawPolicy = rawHtmlPolicy(tenant);
+if (rawHtml && rawPolicy.allowed) {
   // Shared chrome: a body-only fragment gets wrapped in the tenant's chrome.html;
   // a full document serves verbatim (backward-compatible). See rawMarketingHtml.ts.
   const chromeWrapper = await content.getChromeHtml(`/${slug}`);
+  const notices = {
+    nicotineWarning: !!tenant.compliance?.nicotineWarning,
+    shippingRestriction: tenant.compliance?.shippingRestriction,
+    exciseTaxEnabled: capabilities.exciseTax.enabled && features.catalog,
+  };
   return rawHtmlResponse(rawHtml, {
     nonce: Astro.locals.cspNonce,
     basePath,
@@ -54,6 +61,8 @@ if (rawHtml && rawHtmlPolicy(tenant).allowed) {
     plan: Astro.locals.integrationPlan,
     consentSnapshot: Astro.locals.consentSnapshot,
     canonicalUrl: rawPageCanonicalUrl(canonicalBase, slug),
+    complianceTop: rawPolicy.regulated ? renderRawComplianceTop(notices) : undefined,
+    complianceBottom: rawPolicy.regulated ? renderRawComplianceBottom(notices) : undefined,
   });
 }
 

package/apps/storefront/src/pages/index.astro

@@ -20,6 +20,7 @@ import MarketingBlocks from "@/components/marketing/MarketingBlocks.astro";
 import TierCards from "@/components/membership/TierCards.astro";
 import { withBase } from "@/lib/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
+import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
@@ -42,7 +43,7 @@ import {
   type CommerceStaticResolved,
 } from "@/lib/homeVisualParity";
 
-const { tenant, tot, content, basePath, canonicalBase, features } = Astro.locals;
+const { tenant, tot, content, basePath, canonicalBase, features, capabilities } = Astro.locals;
 const marketing = !features.catalog;
 
 // Raw-HTML home (vendor-injected): serve the tenant's own self-contained
@@ -59,11 +60,17 @@ const marketing = !features.catalog;
 // age/identity, warning, tax, and checkout guardrails remain non-removable.
 // Mirrors the raw-subpage path in [...slug].astro.
 const rawHtml = await content.getHomeHtml();
-if (rawHtml && rawHtmlPolicy(tenant).allowed) {
+const rawPolicy = rawHtmlPolicy(tenant);
+if (rawHtml && rawPolicy.allowed) {
   // Shared chrome: if the tenant ships a chrome.html wrapper AND this home is a
   // body-only fragment, rawHtmlResponse splices it in; a full document serves
   // verbatim (backward-compatible).
   const chromeWrapper = await content.getChromeHtml("/");
+  const notices = {
+    nicotineWarning: !!tenant.compliance?.nicotineWarning,
+    shippingRestriction: tenant.compliance?.shippingRestriction,
+    exciseTaxEnabled: capabilities.exciseTax.enabled && features.catalog,
+  };
   return rawHtmlResponse(rawHtml, {
     nonce: Astro.locals.cspNonce,
     basePath,
@@ -71,6 +78,8 @@ if (rawHtml && rawHtmlPolicy(tenant).allowed) {
     plan: Astro.locals.integrationPlan,
     consentSnapshot: Astro.locals.consentSnapshot,
     canonicalUrl: new URL("/", canonicalBase + "/").toString(),
+    complianceTop: rawPolicy.regulated ? renderRawComplianceTop(notices) : undefined,
+    complianceBottom: rawPolicy.regulated ? renderRawComplianceBottom(notices) : undefined,
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.93",
+  "version": "2.2.95",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/compliance/evidence-signals.ts

@@ -27,6 +27,14 @@ export interface EnforcementEvidenceSignals {
   exciseWired: boolean;
   /** PACT per-order reporting capture is wired when required. */
   reportingWired: boolean;
+  /**
+   * The age-gate component actually RENDERS on the live page, OR no age gate is
+   * required. False when a regulated tenant's home/pages serve via the raw-HTML
+   * bypass (which cannot yet force-inject the hydrated age-gate island) — distinct
+   * from `verificationWired` (a provider being configured is moot if the gate
+   * component itself never reaches the page).
+   */
+  ageGateRenderable: boolean;
 }
 
 export interface EnforcementSignalInput {
@@ -34,6 +42,12 @@ export interface EnforcementSignalInput {
   regulated: boolean;
   /** Whether the PACT per-order reporting capture sink is wired in this deployment. */
   reportingCaptureWired: boolean;
+  /**
+   * True when this tenant's regulated pages are currently served via the
+   * raw-HTML bypass with no injected age gate (see `rawHtmlPolicy`'s
+   * `uncoveredSurfaces`). Defaults to false (block-composed / not applicable).
+   */
+  ageGateBypassedByRawHtml?: boolean;
 }
 
 /**
@@ -52,6 +66,7 @@ export function enforcementSignals(
       verificationWired: true,
       exciseWired: true,
       reportingWired: true,
+      ageGateRenderable: true,
     };
   }
   if (!ruleset) {
@@ -61,6 +76,7 @@ export function enforcementSignals(
       verificationWired: false,
       exciseWired: false,
       reportingWired: false,
+      ageGateRenderable: false,
     };
   }
   const verificationWired =
@@ -77,5 +93,6 @@ export function enforcementSignals(
     verificationWired,
     exciseWired,
     reportingWired,
+    ageGateRenderable: !input.ageGateBypassedByRawHtml,
   };
 }

package/packages/public-runtime/src/raw-html-policy.ts

@@ -2,16 +2,65 @@
  * Policy for the raw tenant-authored HTML path.
  *
  * Raw HTML is a useful migration/marketing bridge, but it bypasses Astro Layout
- * composition. Regulated tenants must stay on a platform-composed path
- * so age/identity verification, warnings, taxes, checkout signing, and publish
- * gates remain non-removable.
+ * composition — so whatever compliance anchors the page itself would normally
+ * render have to be guaranteed another way. The raw-serve path (`rawHtmlResponse`
+ * in `rawMarketingHtml.ts`) force-injects the platform's own markup for the
+ * anchors it CAN guarantee independent of the tenant's document content —
+ * `compliance-warning` (NicotineWarning) and `shipping-jurisdiction-notice`
+ * (ShippingRestrictionNotice) are plain, policy-fixed text, so injecting them is
+ * exactly as non-removable on the raw path as on the block-composed one.
+ *
+ * `age-gate` is NOT yet injectable on the raw path — `IsolatedAgeGate` is a
+ * hydrated island, and the raw-serve Response is built outside Astro's own
+ * component/island pipeline, so there is no verified way yet to force a real,
+ * functioning age gate onto an arbitrary raw document.
+ *
+ * PUBLISH/PREVIEW vs LIVE are deliberately split here: raw HTML is always
+ * ALLOWED to reconcile and serve on preview — a tenant can get its warnings
+ * visible and iterate even before the age gate is solved. `uncoveredSurfaces`
+ * is the signal, not a block: the LIVE promotion gate
+ * (`resolveEnforcementEvidenceSignals` → `ageGateRenderable` →
+ * `evidence-producer.ts`'s `age_gate` check) is what actually refuses to
+ * promote a tenant whose required `age-gate` surface isn't covered. That is
+ * where restrictions belong — not here.
  */
 import type { TenantConfig } from "./tenant.js";
-import { isRegulated } from "./compliance-obligations.js";
+import { isRegulated, protectedSurfacesFor, type ProtectedSurface } from "./compliance-obligations.js";
+
+/**
+ * Protected surfaces the raw-serve path force-injects itself (see
+ * `rawHtmlResponse`'s `complianceTop`/`complianceBottom`), independent of the
+ * tenant's own document. Anything else required but not in this list blocks
+ * raw HTML.
+ */
+const RAW_HTML_INJECTABLE_SURFACES: readonly ProtectedSurface[] = [
+  "compliance-warning",
+  "shipping-jurisdiction-notice",
+];
+
+/**
+ * Protected surfaces a MARKETING PAGE (home / raw subpage) is responsible for.
+ * `cart-preflight` and `checkout-controls` are commerce-route concerns (cart,
+ * checkout) that a raw marketing page can never touch either way — the hybrid
+ * pattern already keeps those on the live, platform-owned commerce core — so
+ * they're irrelevant to whether THIS page may serve raw HTML.
+ */
+const MARKETING_PAGE_SURFACES: readonly ProtectedSurface[] = [
+  "age-gate",
+  "compliance-warning",
+  "shipping-jurisdiction-notice",
+];
 
 export interface RawHtmlPolicyDecision {
+  /** Always true — raw HTML may always reconcile/preview. See module header. */
   allowed: boolean;
   regulated: boolean;
+  /**
+   * Protected surfaces this tenant requires that the raw path cannot (yet)
+   * force-inject — informational: the LIVE promotion gate reads this, serving
+   * is never blocked on it.
+   */
+  uncoveredSurfaces: ProtectedSurface[];
   reason?: string;
 }
 
@@ -19,15 +68,10 @@ export function rawHtmlPolicy(
   tenant: Pick<TenantConfig, "siteType" | "compliance">,
 ): RawHtmlPolicyDecision {
   const regulated = isRegulated(tenant);
+  const required = protectedSurfacesFor(tenant);
+  const uncoveredSurfaces = required.filter(
+    (s) => MARKETING_PAGE_SURFACES.includes(s) && !RAW_HTML_INJECTABLE_SURFACES.includes(s),
+  );
 
-  if (regulated) {
-    return {
-      allowed: false,
-      regulated,
-      reason:
-        "Raw HTML bypasses platform Layout compliance; regulated commerce tenants must use block composition or an extracted runtime.",
-    };
-  }
-
-  return { allowed: true, regulated };
+  return { allowed: true, regulated, uncoveredSurfaces };
 }