@tokenoftrust/storefront-runner 2.3.0 → 2.3.1

package/apps/storefront/src/config/devTenantSeed.ts

@@ -26,6 +26,7 @@
  * tenancy-resolver-fence — the concrete registry stays behind the config boundary.
  */
 import type { DeepPartial, TenantConfig, ThemeTokens } from "@tot/public-runtime";
+import { SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
 import { rootPublicationSpaceConfig } from "./publicationSpaceConfig";
 import { loadTenantAnalyticsDeclarations } from "@/lib/integration/tenantAnalyticsDeclarations";
 
@@ -94,12 +95,14 @@ export function synthesizeDevTenant(
     ...(euUkVisitors ? { euUkVisitors } : {}),
   };
   // Cart wires to the shared ToT demo checkout store (test mode, no secret), the
-  // same as the bundled demo tenants. A marketing tenant never resolves it (the
+  // same as the bundled demo tenants — and the SAME constant the hosted QA/test
+  // tier's demo-checkout fallback reuses (checkoutCommerce.ts), so both surfaces
+  // stay wired to one definition. A marketing tenant never resolves it (the
   // render chain gates on features.catalog); a commerce one gets its cart
   // affordance and /cart on localhost whether or not it has catalog files yet.
   return {
     ...base,
-    commerce: { checkout: { storeSubDomain: "tot-preview", mode: "unsigned-demo" } },
+    commerce: { checkout: SHARED_DEMO_CHECKOUT },
   };
 }
 

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -11,19 +11,31 @@
  *   - `FOXY_CART_SECRET` is the cart-validation secret used only in `signed`
  *     mode; the `unsigned-demo` mode never reads it (validation is OFF), which
  *     is what lets a developer run the whole cart locally with zero secrets.
+ *
+ * `COMMERCE_DEMO_CHECKOUT_TIER` gates a FALLBACK for a commerce tenant that has
+ * no `commerce.checkout` of its own (e.g. a staff-provisioned store —
+ * buildStaffTenantConfig projects a minimal record with none). Declared-tier
+ * config, not a tenant check: "test" reuses the exact SHARED_DEMO_CHECKOUT the
+ * local dev loop wires (synthesizeDevTenant), so a staff-provisioned store's
+ * cart renders on hosted QA preview the same as it does under `tot dev`. Any
+ * other value — including unset, the PRODUCTION default — fails CLOSED to no
+ * cart: an unpaid production store's preview IS its public site, so a demo
+ * checkout must never appear there. A tenant's own declared checkout always
+ * wins; this only fills in when `commerce.checkout` is absent.
  */
 import type { TenantConfig, ResolvedManagedCheckout } from "@tot/public-runtime";
-import { resolveManagedCheckout } from "@tot/public-runtime";
+import { resolveManagedCheckout, SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
 import { readEnv } from "@/lib/runtimeEnv";
 
 /**
  * Resolve the effective checkout facts for a tenant, or null when the tenant has
- * no store configured. Applies the checkout env overrides.
+ * no store configured (its own, or the QA/test-tier demo fallback). Applies the
+ * checkout env overrides.
  */
 export async function resolveTenantCommerce(
   tenant: TenantConfig,
 ): Promise<ResolvedManagedCheckout | null> {
-  const checkout = tenant.commerce?.checkout;
+  const checkout = tenant.commerce?.checkout ?? (await demoCheckoutFallback());
   if (!checkout) return null;
   // Per-environment overrides so the SAME tenant can point at different stores /
   // checkout hosts by env: FOXY_STORE_SUBDOMAIN picks the checkout store;
@@ -38,6 +50,17 @@ export async function resolveTenantCommerce(
   return resolveManagedCheckout({ ...checkout, storeSubDomain, storeDomain });
 }
 
+/**
+ * The QA/test-tier-only demo-checkout fallback, or undefined when this
+ * environment hasn't declared itself eligible. Fails closed: only the literal
+ * value "test" enables it, so an unset var (today's only production-shaped
+ * state — there is no `[env.production]` block yet) never does.
+ */
+async function demoCheckoutFallback() {
+  const tier = await readEnv("COMMERCE_DEMO_CHECKOUT_TIER");
+  return tier === "test" ? SHARED_DEMO_CHECKOUT : undefined;
+}
+
 /**
  * The cart-validation secret for signed mode. Returns undefined in
  * `unsigned-demo` mode (never needed) or when unset. A signed-mode tenant with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -59,6 +59,19 @@ export interface ManagedCheckoutConfig {
   cartDrawerCss?: string;
 }
 
+/**
+ * The ONE shared ToT-owned demo checkout store (test mode, cart validation
+ * OFF, no secret). The local dev loop (`synthesizeDevTenant`) wires every
+ * local commerce checkout to this exact config; the hosted QA/test tier's
+ * demo-checkout fallback (`resolveTenantCommerce`) reuses this same constant
+ * rather than a second copy of the literal, so "the same as `tot dev`" stays
+ * true by construction instead of by two authors agreeing.
+ */
+export const SHARED_DEMO_CHECKOUT: ManagedCheckoutConfig = {
+  storeSubDomain: "tot-preview",
+  mode: "unsigned-demo",
+};
+
 /** Resolved, request-scoped commerce facts stashed on `Astro.locals`. */
 export interface ResolvedManagedCheckout extends ManagedCheckoutConfig {
   /** `https://<storeDomain>` — the loader + cart origin (for CSP + links). */