@tokenoftrust/storefront-runner 2.4.14 → 2.4.16

package/apps/storefront/migrations-apps/0015_merchant_calculation_settings.sql

@@ -0,0 +1,31 @@
+-- Current merchant pricing and SKU defaults. One row per tenant. `revision` is the
+-- compare-and-swap token: a create lands only while the tenant has no row, and an
+-- update lands only when `revision` is still the caller's expected value.
+CREATE TABLE `merchant_calculation_settings` (
+  `tenant_id` text PRIMARY KEY NOT NULL,
+  `revision` integer NOT NULL,
+  `currency` text NOT NULL,
+  `engine_version` text NOT NULL,
+  `pricing_json` text NOT NULL,
+  `sku_json` text NOT NULL
+);
+--> statement-breakpoint
+-- Append-only copy of each accepted save. Rows are never updated. The current
+-- table is the only compare-and-swap target.
+CREATE TABLE `merchant_calculation_settings_revisions` (
+  `id` text PRIMARY KEY NOT NULL,
+  `tenant_id` text NOT NULL,
+  `revision` integer NOT NULL,
+  `currency` text NOT NULL,
+  `engine_version` text NOT NULL,
+  `pricing_json` text NOT NULL,
+  `sku_json` text NOT NULL,
+  `actor` text NOT NULL,
+  `saved_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_merchant_calculation_settings_revision`
+  ON `merchant_calculation_settings_revisions` (`tenant_id`, `revision`);
+--> statement-breakpoint
+CREATE INDEX `idx_merchant_calculation_settings_revisions_tenant`
+  ON `merchant_calculation_settings_revisions` (`tenant_id`);

package/apps/storefront/src/config/publicationSpaceConfig.ts

@@ -2,6 +2,7 @@ import type {
   PublicationSpaceAliasV1,
   PublicationSpaceManifestV1,
   PublicationSpaceSourceV1,
+  PublicationSpaceVisibilityV1,
 } from "@tot/public-runtime";
 
 /**
@@ -34,3 +35,39 @@ export function rootPublicationSpaceConfig(
     },
   };
 }
+
+/**
+ * A mounted publication space for a tenant — public or internal, at any
+ * declared, non-root mount. Visibility drives the authorization, discovery,
+ * and asset-access triad together, the same invariant
+ * `validatePublicationSpaceManifestV1` enforces: public spaces are open and
+ * discoverable, internal spaces are capability-gated and excluded from every
+ * public discovery surface.
+ */
+export function mountedPublicationSpaceConfig(
+  tenant: string,
+  id: string,
+  source: PublicationSpaceSourceV1,
+  mount: string,
+  visibility: PublicationSpaceVisibilityV1 = "public",
+  aliases: readonly PublicationSpaceAliasV1[] = [],
+): PublicationSpaceManifestV1 {
+  const internal = visibility === "internal";
+  return {
+    version: 1,
+    id,
+    tenant,
+    source,
+    routes: aliases.length ? { canonicalMount: mount, aliases: [...aliases] } : { canonicalMount: mount },
+    visibility,
+    authorization: internal ? { policy: "capability", capability: "internal-content-reader" } : { policy: "public" },
+    discovery: internal
+      ? { sitemap: false, feeds: false, publicSearch: false, llms: false }
+      : { sitemap: true, feeds: true, publicSearch: true, llms: true },
+    assets: { namespace: id, access: internal ? "authorized" : "public" },
+    renderer: {
+      contractVersion: "storefront-v1",
+      themeContractVersion: "tenant-theme-v1",
+    },
+  };
+}

package/apps/storefront/src/config/publicationSpaceRegistry.ts

@@ -1,25 +1,53 @@
 import type { PublicationSpaceManifestV1, PublicationSpaceSourceV1 } from "@tot/public-runtime";
-import { rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+import { mountedPublicationSpaceConfig, rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+import { PUBLICATION_SPACE_TOPOLOGY, type PublicationTopologyDeclarationV1 } from "./publicationSpaceTopology.js";
 
-const ROOT_SOURCES: Readonly<Record<string, PublicationSpaceSourceV1>> = {
-  home: { forge: "fixture", repo: "home", defaultBranch: "main" },
-  "tokenoftrust.com": { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" },
-  "storefront.tokenoftrust.store": {
-    forge: "gitea",
-    repo: "storefront.tokenoftrust.store",
-    defaultBranch: "main",
-  },
-  "sample-store.com": { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" },
-  "sample-store.e2e.test": { forge: "gitea", repo: "sample-store.e2e.test", defaultBranch: "main" },
-  "verify.e2e.test": { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" },
-  "fixture.e2e.test": { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" },
-  "chrome.e2e.test": { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" },
-  "catalog.e2e.test": { forge: "fixture", repo: "catalog.e2e.test", defaultBranch: "main" },
-};
+/**
+ * A declared source belongs to its tenant when the repo IS the tenant id, or is
+ * namespaced under it (`<tenant>-<suffix>`) — the naming convention every
+ * declared source in `publicationSpaceTopology.ts` already follows. This is the
+ * one check that stops a mounted space from naming a different tenant's
+ * repository, by construction rather than by a tenant-id branch here.
+ */
+function sourceBelongsToTenant(tenant: string, source: PublicationSpaceSourceV1): boolean {
+  return source.repo === tenant || source.repo.startsWith(`${tenant}-`);
+}
+
+/**
+ * Build one tenant's full publication-space manifest set — root plus any
+ * mounted public or internal spaces — from its declared topology. Pure
+ * resolution over the declaration: no tenant identity is ever branched on
+ * here, so this function is identical for every tenant and every mount count.
+ */
+export function publicationSpacesFromTopology(
+  tenant: string,
+  declaration: PublicationTopologyDeclarationV1,
+): PublicationSpaceManifestV1[] {
+  const spaces: PublicationSpaceManifestV1[] = [
+    rootPublicationSpaceConfig(tenant, declaration.root.source, declaration.root.aliases ?? []),
+    ...(declaration.mounted ?? []).map((mounted) =>
+      mountedPublicationSpaceConfig(
+        tenant,
+        mounted.id,
+        mounted.source,
+        mounted.mount,
+        mounted.visibility ?? "public",
+        mounted.aliases ?? [],
+      )),
+  ];
+  const foreign = spaces.find((space) => !sourceBelongsToTenant(tenant, space.source));
+  if (foreign) {
+    throw new Error(
+      `publication_foreign_source: space '${foreign.id}' for tenant '${tenant}' declares a source ` +
+        `('${foreign.source.forge}:${foreign.source.repo}') that is not namespaced under its own tenant.`,
+    );
+  }
+  return spaces;
+}
 
 /** Node-safe publication topology authority shared by runtime config and CI composition. */
 export function publicationSpacesForTenant(tenant: string): PublicationSpaceManifestV1[] {
-  const source = ROOT_SOURCES[tenant];
-  if (!source) return [];
-  return [rootPublicationSpaceConfig(tenant, source)];
+  const declaration = PUBLICATION_SPACE_TOPOLOGY[tenant];
+  if (!declaration) return [];
+  return publicationSpacesFromTopology(tenant, declaration);
 }

package/apps/storefront/src/config/publicationSpaceTopology.ts

@@ -0,0 +1,73 @@
+import type { PublicationSpaceAliasV1, PublicationSpaceSourceV1, PublicationSpaceVisibilityV1 } from "@tot/public-runtime";
+
+/**
+ * One declared non-root publication space: a mount, its source, and its
+ * visibility. Defaults to "public" — an "internal" declaration is the only
+ * way a tenant gets a capability-gated space.
+ */
+export interface MountedPublicationSpaceDeclarationV1 {
+  id: string;
+  source: PublicationSpaceSourceV1;
+  mount: string;
+  visibility?: PublicationSpaceVisibilityV1;
+  aliases?: readonly PublicationSpaceAliasV1[];
+}
+
+/** A tenant's complete declared publication topology: exactly one root, plus any mounted spaces. */
+export interface PublicationTopologyDeclarationV1 {
+  root: {
+    source: PublicationSpaceSourceV1;
+    aliases?: readonly PublicationSpaceAliasV1[];
+  };
+  mounted?: readonly MountedPublicationSpaceDeclarationV1[];
+}
+
+/**
+ * The declared publication topology for every provisioned tenant — the ONLY place a tenant's
+ * publication sources are named. `publicationSpaceRegistry.ts` resolves this generically, with
+ * no branching on tenant id; runtime config, CI composition, and both CDN publish paths all
+ * consume what it resolves, never this table directly.
+ */
+export const PUBLICATION_SPACE_TOPOLOGY: Readonly<Record<string, PublicationTopologyDeclarationV1>> = {
+  home: { root: { source: { forge: "fixture", repo: "home", defaultBranch: "main" } } },
+  "tokenoftrust.com": {
+    root: { source: { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" } },
+  },
+  "storefront.tokenoftrust.store": {
+    root: { source: { forge: "gitea", repo: "storefront.tokenoftrust.store", defaultBranch: "main" } },
+  },
+  "sample-store.com": {
+    root: { source: { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" } },
+  },
+  "sample-store.e2e.test": {
+    root: { source: { forge: "gitea", repo: "sample-store.e2e.test", defaultBranch: "main" } },
+  },
+  "verify.e2e.test": {
+    root: { source: { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" } },
+  },
+  // Carries the mounted public + mounted internal coverage every tenant topology can declare —
+  // see publicationSpaces.test.ts for the 3-space resolution this exercises.
+  "fixture.e2e.test": {
+    root: { source: { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" } },
+    mounted: [
+      {
+        id: "fixture-docs",
+        source: { forge: "fixture", repo: "fixture.e2e.test-docs", defaultBranch: "main" },
+        mount: "/docs",
+        visibility: "public",
+      },
+      {
+        id: "fixture-internal",
+        source: { forge: "fixture", repo: "fixture.e2e.test-internal", defaultBranch: "main" },
+        mount: "/internal-docs",
+        visibility: "internal",
+      },
+    ],
+  },
+  "chrome.e2e.test": {
+    root: { source: { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" } },
+  },
+  "catalog.e2e.test": {
+    root: { source: { forge: "fixture", repo: "catalog.e2e.test", defaultBranch: "main" } },
+  },
+};

package/apps/storefront/src/lib/admin/catalogSettingsClient.ts

@@ -0,0 +1,361 @@
+/**
+ * /admin/catalog-settings client. Field values are text nodes. A 409 keeps the
+ * open draft; replacing it requires the explicit reload control.
+ */
+import {
+  applySaveResult,
+  draftIsDirty,
+  editorFromPayload,
+  saveBody,
+  type SettingsEditorState,
+  type SettingsPayload,
+} from "@/lib/admin/catalogSettingsState";
+
+interface MethodOption {
+  id: string;
+  title: string;
+  reason: string;
+}
+
+interface SettingsResponse extends SettingsPayload {
+  ok: true;
+  pricingMethods: MethodOption[];
+  skuMethods: MethodOption[];
+  history: Array<{ revision: number; savedAt: string; actor: string }>;
+  historyUnavailable: boolean;
+}
+
+type Child = Node | string | null | undefined | false;
+
+function h<K extends keyof HTMLElementTagNameMap>(
+  tag: K,
+  attrs: Record<string, string | boolean | undefined> = {},
+  ...children: Child[]
+): HTMLElementTagNameMap[K] {
+  const node = document.createElement(tag);
+  for (const [key, value] of Object.entries(attrs)) {
+    if (value === undefined || value === false) continue;
+    node.setAttribute(key, value === true ? "" : value);
+  }
+  for (const child of children) if (child !== null && child !== undefined && child !== false) node.append(child);
+  return node;
+}
+
+const PRICING_NUMBERS: Array<[string, string]> = [
+  ["targetMargin", "Target margin (%)"],
+  ["markup", "Markup (%)"],
+  ["msrpAdjustment", "MSRP adjustment (%)"],
+  ["fixedMarkup", "Dollar markup"],
+  ["additionalCost", "Additional cost"],
+  ["additionalCostPercent", "Additional cost (%)"],
+  ["increment", "Rounding increment"],
+  ["minimumPrice", "Minimum price"],
+  ["maximumPrice", "Maximum price"],
+  ["minimumMargin", "Minimum margin (%)"],
+];
+
+const PRICING_SELECTS: Array<[string, string, string[]]> = [
+  ["costBasis", "Cost basis", ["wholesale", "adjusted"]],
+  ["rounding", "Rounding", ["none", "increment", "ending"]],
+  ["direction", "Round direction", ["up", "nearest", "down"]],
+  ["missingData", "Missing data", ["review", "fallback"]],
+  ["fallbackMethod", "Fallback method", ["msrp", "margin", "markup", "fixed"]],
+  ["updatePolicy", "When costs change", ["on-add", "manual", "automatic"]],
+];
+
+const PRICING_FLAGS: Array<[string, string]> = [
+  ["preserveMsrp", "Preserve MSRP as compare-at"],
+  ["capAtMsrp", "Cap the price at MSRP"],
+  ["includeManualOverrides", "Include manual product overrides"],
+];
+
+const RULE_NUMBERS: Array<[string, string]> = [
+  ["targetMargin", "Target margin (%)"],
+  ["markup", "Markup (%)"],
+  ["msrpAdjustment", "MSRP adjustment (%)"],
+  ["fixedMarkup", "Dollar markup"],
+];
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" ? value as Record<string, unknown> : {};
+}
+
+function numberOrBlank(raw: string): number | "" {
+  if (raw.trim() === "") return "";
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : "";
+}
+
+function fieldString(record: Record<string, unknown>, key: string): string {
+  const value = record[key];
+  return typeof value === "number" || typeof value === "string" ? String(value) : "";
+}
+
+export function initCatalogSettingsPage(root: HTMLElement): void {
+  const found = root.querySelector<HTMLElement>("[data-settings-app]");
+  const api = root.dataset.api ?? "";
+  const previewUrl = root.dataset.preview ?? "";
+  if (!found || !api || !previewUrl) return;
+  const panel: HTMLElement = found;
+
+  let state: SettingsEditorState | null = null;
+  let storeCurrency = root.dataset.currency ?? "";
+  let pricingMethods: MethodOption[] = [];
+  let skuMethods: MethodOption[] = [];
+  let history: SettingsResponse["history"] = [];
+  let historyUnavailable = false;
+  const sample: Record<string, number | ""> = { wholesale: "", msrp: "", minimum: "", maximum: "" };
+  const sampleText: Record<string, string> = { productKey: "", assortment: "", category: "", brand: "", selectedRuleId: "" };
+  const status = h("div", { "aria-live": "polite" });
+  const previewOut = h("div", { class: "preview-out" });
+
+  function paintStatus(extra?: string): void {
+    if (!state) return;
+    const dirty = draftIsDirty(state);
+    const revision = state.savedRevision === null ? "Not saved yet" : `Saved revision ${state.savedRevision}`;
+    const lines: Node[] = [h("p", { class: "muted" }, `${revision} · ${state.currency} · ${dirty ? "Unsaved edits" : "Matches the saved defaults"}`)];
+    if (storeCurrency && state.currency !== storeCurrency) {
+      lines.push(h("p", { class: "notice error", role: "alert" }, `Saved defaults are in ${state.currency}. This store is ${storeCurrency}. No currency conversion is applied.`));
+    }
+    if (state.conflict) {
+      lines.push(h("p", { class: "notice error", role: "alert" }, state.conflict.message));
+      lines.push(h("button", { type: "button", class: "btn", "data-reload": "true" }, "Load the saved revision"));
+    }
+    if (extra) lines.push(h("p", { class: "notice error", role: "alert" }, extra));
+    status.replaceChildren(...lines);
+    status.querySelector("[data-reload]")?.addEventListener("click", () => void load());
+  }
+
+  function select(record: Record<string, unknown>, key: string, label: string, options: Array<{ value: string; label: string }>, onChange: () => void): HTMLElement {
+    const current = fieldString(record, key);
+    const known = options.some((option) => option.value === current);
+    const control = h("select", { "aria-label": label }) as HTMLSelectElement;
+    if (current && !known) control.append(h("option", { value: current }, current));
+    for (const option of options) control.append(h("option", { value: option.value }, option.label));
+    control.value = current;
+    control.addEventListener("change", () => {
+      record[key] = control.value;
+      onChange();
+    });
+    return h("label", {}, label, control);
+  }
+
+  function numberField(record: Record<string, unknown>, key: string, label: string, onChange: () => void): HTMLElement {
+    const control = h("input", { type: "text", inputmode: "decimal", "aria-label": label, value: fieldString(record, key) }) as HTMLInputElement;
+    control.addEventListener("input", () => {
+      record[key] = numberOrBlank(control.value);
+      onChange();
+    });
+    return h("label", {}, label, control);
+  }
+
+  function textField(record: Record<string, unknown>, key: string, label: string, onChange: () => void, attrs: Record<string, string> = {}): HTMLElement {
+    const control = h("input", { type: "text", "aria-label": label, value: fieldString(record, key), ...attrs }) as HTMLInputElement;
+    control.addEventListener("input", () => {
+      record[key] = control.value;
+      onChange();
+    });
+    return h("label", {}, label, control);
+  }
+
+  function flag(record: Record<string, unknown>, key: string, label: string, onChange: () => void): HTMLElement {
+    const control = h("input", { type: "checkbox" }) as HTMLInputElement;
+    control.checked = record[key] === true;
+    control.addEventListener("change", () => {
+      record[key] = control.checked;
+      onChange();
+    });
+    return h("label", { class: "inline" }, control, ` ${label}`);
+  }
+
+  function configured(key: "pricingConfigured" | "skuConfigured", label: string): HTMLElement {
+    const control = h("input", { type: "checkbox" }) as HTMLInputElement;
+    control.checked = state?.draft[key] === true;
+    control.addEventListener("change", () => {
+      if (!state) return;
+      state.draft[key] = control.checked;
+      paintStatus();
+    });
+    return h("label", { class: "inline" }, control, ` ${label}`);
+  }
+
+  function ruleRows(list: Record<string, unknown>[], kind: "exception" | "tier" | "override", onChange: () => void): HTMLElement {
+    const rows = list.map((rule, index) => {
+      const remove = h("button", { type: "button", class: "btn small" }, "Remove");
+      remove.addEventListener("click", () => {
+        list.splice(index, 1);
+        renderForm();
+      });
+      const methodOptions = (kind === "tier" ? ["margin", "markup", "fixed"] : ["msrp", "margin", "markup", "msrp-adjustment", "fixed"])
+        .map((id) => ({ value: id, label: id }));
+      return h(
+        "div",
+        { class: "rule" },
+        textField(rule, "id", "Id", onChange),
+        kind !== "override" ? null : textField(rule, "productKey", "Product", onChange),
+        kind === "override" ? numberField(rule, "price", "Price", onChange) : null,
+        kind === "exception" ? textField(rule, "name", "Name", onChange) : null,
+        kind === "exception" ? select(rule, "scope", "Scope", ["assortment", "category", "brand"].map((id) => ({ value: id, label: id })), onChange) : null,
+        kind === "exception" ? textField(rule, "match", "Match", onChange) : null,
+        kind === "tier" ? numberField(rule, "minimumCost", "Minimum cost", onChange) : null,
+        kind === "tier" ? numberField(rule, "maximumCost", "Maximum cost", onChange) : null,
+        kind === "override" ? null : select(rule, "method", "Method", methodOptions, onChange),
+        kind === "override" ? null : h("div", { class: "grid" }, ...RULE_NUMBERS.filter(([key]) => kind === "exception" || key !== "msrpAdjustment").map(([key, label]) => numberField(rule, key, label, onChange))),
+        remove,
+      );
+    });
+    return h("div", { class: "rules" }, ...rows);
+  }
+
+  function renderForm(): void {
+    if (!state) return;
+    const pricing = state.draft.pricing;
+    const sku = state.draft.sku;
+    const touch = () => paintStatus();
+    const exceptions = Array.isArray(pricing.exceptions) ? pricing.exceptions.map(asRecord) : [];
+    const tiers = Array.isArray(pricing.costTiers) ? pricing.costTiers.map(asRecord) : [];
+    const overrides = Array.isArray(pricing.productOverrides) ? pricing.productOverrides.map(asRecord) : [];
+    pricing.exceptions = exceptions;
+    pricing.costTiers = tiers;
+    pricing.productOverrides = overrides;
+
+    const add = (list: Record<string, unknown>[], blank: Record<string, unknown>, label: string) => {
+      const button = h("button", { type: "button", class: "btn small" }, label);
+      button.addEventListener("click", () => {
+        list.push({ ...blank, id: `${label.slice(0, 3).toLowerCase()}-${list.length + 1}` });
+        renderForm();
+      });
+      return button;
+    };
+
+    panel.replaceChildren(
+      status,
+      h("section", { class: "panel" },
+        h("h2", {}, "Pricing"),
+        configured("pricingConfigured", "Use these pricing defaults"),
+        h("div", { class: "grid" },
+          select(pricing, "method", "Method", pricingMethods.map((method) => ({ value: method.id, label: method.title })), touch),
+          ...PRICING_NUMBERS.map(([key, label]) => numberField(pricing, key, label, touch)),
+          ...PRICING_SELECTS.map(([key, label, values]) => select(pricing, key, label, values.map((value) => ({ value, label: value })), touch)),
+          textField(pricing, "ending", "Price ending", touch, { maxlength: "2" }),
+        ),
+        h("div", { class: "flags" }, ...PRICING_FLAGS.map(([key, label]) => flag(pricing, key, label, touch))),
+        h("h3", {}, "Exceptions"),
+        ruleRows(exceptions, "exception", touch),
+        add(exceptions, { name: "Exception", scope: "brand", match: "", method: "margin", targetMargin: 40, markup: "", msrpAdjustment: "", fixedMarkup: "" }, "Add exception"),
+        h("h3", {}, "Cost tiers"),
+        ruleRows(tiers, "tier", touch),
+        add(tiers, { minimumCost: 0, maximumCost: "", method: "margin", targetMargin: 40, markup: "", fixedMarkup: "" }, "Add cost tier"),
+        h("h3", {}, "Product price overrides"),
+        ruleRows(overrides, "override", touch),
+        add(overrides, { productKey: "", price: 0 }, "Add product override"),
+      ),
+      h("section", { class: "panel" },
+        h("h2", {}, "SKUs"),
+        configured("skuConfigured", "Use these SKU defaults"),
+        h("div", { class: "grid" },
+          select(sku, "method", "Method", skuMethods.map((method) => ({ value: method.id, label: method.title })), touch),
+          textField(sku, "prefix", "Prefix", touch, { maxlength: "12" }),
+          numberField(sku, "startingNumber", "Starting number", touch),
+          select(sku, "separator", "Separator", [{ value: "-", label: "Hyphen" }, { value: "_", label: "Underscore" }, { value: "", label: "None" }], touch),
+        ),
+      ),
+      h("section", { class: "panel" },
+        h("h2", {}, "Preview a sample"),
+        h("p", { class: "muted small" }, "The server calculates this sample with the open draft. Saving defaults does not change prices or SKUs already on your products."),
+        h("div", { class: "grid" },
+          ...(["wholesale", "msrp", "minimum", "maximum"] as const).map((key) => {
+            const control = h("input", { type: "text", inputmode: "decimal", "aria-label": key, value: String(sample[key] ?? "") }) as HTMLInputElement;
+            control.addEventListener("input", () => { sample[key] = numberOrBlank(control.value); });
+            return h("label", {}, key, control);
+          }),
+          ...(["productKey", "assortment", "category", "brand", "selectedRuleId"] as const).map((key) => {
+            const control = h("input", { type: "text", "aria-label": key, value: sampleText[key] ?? "" }) as HTMLInputElement;
+            control.addEventListener("input", () => { sampleText[key] = control.value; });
+            return h("label", {}, key, control);
+          }),
+        ),
+        h("button", { type: "button", class: "btn", "data-preview": "true" }, "Calculate sample"),
+        previewOut,
+      ),
+      h("section", { class: "panel" },
+        h("h2", {}, "Saved revisions"),
+        historyUnavailable ? h("p", { class: "muted" }, "Saved history is unavailable.") : null,
+        history.length === 0 && !historyUnavailable ? h("p", { class: "muted" }, "No saved revision yet.") : null,
+        ...history.map((entry) => h("p", { class: "small" }, `Revision ${entry.revision} · ${entry.savedAt}`)),
+      ),
+      h("div", { class: "row" },
+        h("button", { type: "button", class: "btn primary", "data-save": "true" }, "Save defaults"),
+      ),
+    );
+    panel.querySelector("[data-preview]")?.addEventListener("click", () => void preview());
+    panel.querySelector("[data-save]")?.addEventListener("click", () => void save());
+    paintStatus();
+  }
+
+  async function load(): Promise<void> {
+    const response = await fetch(api, { headers: { accept: "application/json" } });
+    const body = await response.json() as SettingsResponse & { message?: string };
+    if (!response.ok || !body.ok) {
+      panel.replaceChildren(h("p", { class: "notice error", role: "alert" }, body.message || "Pricing and SKU defaults could not be loaded."));
+      return;
+    }
+    pricingMethods = body.pricingMethods;
+    skuMethods = body.skuMethods;
+    history = body.history;
+    historyUnavailable = body.historyUnavailable;
+    state = editorFromPayload(body);
+    if (typeof body.storeCurrency === "string") storeCurrency = body.storeCurrency;
+    renderForm();
+  }
+
+  async function save(): Promise<void> {
+    if (!state) return;
+    const current = state;
+    if (storeCurrency && current.currency !== storeCurrency) {
+      paintStatus(`Saved defaults are in ${current.currency}. This store is ${storeCurrency}. No currency conversion is applied.`);
+      return;
+    }
+    const response = await fetch(api, { method: "PUT", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(saveBody(current)) });
+    const body = await response.json() as { ok: boolean; code?: string; revision?: number | null; message?: string; issues?: string[]; pricing?: SettingsPayload["pricing"]; sku?: SettingsPayload["sku"] };
+    if (body.code === "revision_conflict") {
+      state = applySaveResult(current, { ok: false, code: "revision_conflict", revision: typeof body.revision === "number" ? body.revision : null, message: body.message || "These defaults changed. Your edits are still here." });
+      paintStatus();
+      return;
+    }
+    if (!response.ok || !body.ok || typeof body.revision !== "number" || !body.pricing || !body.sku) {
+      paintStatus([body.message, ...(body.issues ?? [])].filter(Boolean).join(" "));
+      return;
+    }
+    state = applySaveResult(current, { ok: true, revision: body.revision, pricing: body.pricing, sku: body.sku });
+    renderForm();
+  }
+
+  async function preview(): Promise<void> {
+    if (!state) return;
+    const current = state;
+    const draft = saveBody(current);
+    delete draft.expectedRevision;
+    const response = await fetch(previewUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ ...draft, sample: { ...sample, ...Object.fromEntries(Object.entries(sampleText).filter(([, value]) => value !== "")) } }),
+    });
+    const body = await response.json() as { ok?: boolean; message?: string; issues?: string[]; pricing?: { status: string; preview?: { price: number | null; calculation: string; issues: string[]; ruleExplanation: string } }; sku?: { status: string; value?: string } };
+    previewOut.replaceChildren();
+    if (!response.ok || !body.ok) {
+      previewOut.append(h("p", { class: "notice error" }, [body.message, ...(body.issues ?? [])].filter(Boolean).join(" ")));
+      return;
+    }
+    if (body.pricing?.status === "ok" && body.pricing.preview) {
+      const calculated = body.pricing.preview;
+      previewOut.append(h("p", {}, calculated.price === null ? "No price" : `${current.currency} ${calculated.price.toFixed(2)}`));
+      if (calculated.calculation) previewOut.append(h("p", { class: "muted small" }, calculated.calculation));
+      if (calculated.ruleExplanation) previewOut.append(h("p", { class: "muted small" }, calculated.ruleExplanation));
+      for (const issue of calculated.issues) previewOut.append(h("p", { class: "notice error" }, issue));
+    } else previewOut.append(h("p", { class: "muted" }, "Pricing defaults are off for this draft."));
+    previewOut.append(h("p", {}, body.sku?.status === "ok" ? `SKU ${body.sku.value ?? ""}` : "SKU defaults are off for this draft."));
+  }
+
+  void load();
+}

package/apps/storefront/src/lib/admin/catalogSettingsState.ts

@@ -0,0 +1,103 @@
+/**
+ * Pure editor state for pricing and SKU defaults.
+ * A revision conflict keeps the unsaved draft object. Loading a saved row is a
+ * separate, explicit step.
+ */
+
+export interface SettingsSection {
+  configured: boolean;
+  settings?: Record<string, unknown>;
+}
+
+export interface SettingsPayload {
+  contractRevision: string;
+  currency: string;
+  storeCurrency?: string;
+  engineVersion: string;
+  revision: number | null;
+  pricing: SettingsSection | null;
+  sku: SettingsSection | null;
+  draftDefaults: { pricing: Record<string, unknown>; sku: Record<string, unknown> };
+}
+
+export interface CalculationDraft {
+  pricingConfigured: boolean;
+  skuConfigured: boolean;
+  pricing: Record<string, unknown>;
+  sku: Record<string, unknown>;
+}
+
+export interface SettingsEditorState {
+  contractRevision: string;
+  expectedRevision: number | null;
+  savedRevision: number | null;
+  currency: string;
+  engineVersion: string;
+  draft: CalculationDraft;
+  saved: CalculationDraft | null;
+  conflict: { revision: number | null; message: string } | null;
+}
+
+export type SaveOutcome =
+  | { ok: true; revision: number; pricing: SettingsSection; sku: SettingsSection }
+  | { ok: false; code: "revision_conflict"; revision: number | null; message: string }
+  | { ok: false; code: string; message?: string };
+
+function sectionSettings(section: SettingsSection | null, fallback: Record<string, unknown>, configured: boolean): Record<string, unknown> {
+  if (configured && section?.configured === true && section.settings) return structuredClone(section.settings);
+  return structuredClone(fallback);
+}
+
+export function editorFromPayload(payload: SettingsPayload): SettingsEditorState {
+  const draft: CalculationDraft = {
+    pricingConfigured: payload.pricing?.configured === true,
+    skuConfigured: payload.sku?.configured === true,
+    pricing: sectionSettings(payload.pricing, payload.draftDefaults.pricing, payload.pricing?.configured === true),
+    sku: sectionSettings(payload.sku, payload.draftDefaults.sku, payload.sku?.configured === true),
+  };
+  return {
+    contractRevision: payload.contractRevision,
+    expectedRevision: payload.revision,
+    savedRevision: payload.revision,
+    currency: payload.currency,
+    engineVersion: payload.engineVersion,
+    draft,
+    saved: structuredClone(draft),
+    conflict: null,
+  };
+}
+
+export function saveBody(state: SettingsEditorState): Record<string, unknown> {
+  return {
+    contractRevision: state.contractRevision,
+    expectedRevision: state.expectedRevision,
+    engineVersion: state.engineVersion,
+    currency: state.currency,
+    pricing: state.draft.pricingConfigured ? { configured: true, settings: state.draft.pricing } : { configured: false },
+    sku: state.draft.skuConfigured ? { configured: true, settings: state.draft.sku } : { configured: false },
+  };
+}
+
+export function draftIsDirty(state: SettingsEditorState): boolean {
+  return JSON.stringify(state.draft) !== JSON.stringify(state.saved);
+}
+
+/** A conflict leaves the draft reference in place and does not move the expected revision. */
+export function applySaveResult(state: SettingsEditorState, result: SaveOutcome): SettingsEditorState {
+  if (result.ok) {
+    const next = editorFromPayload({
+      contractRevision: state.contractRevision,
+      currency: state.currency,
+      engineVersion: state.engineVersion,
+      revision: result.revision,
+      pricing: result.pricing,
+      sku: result.sku,
+      draftDefaults: { pricing: state.draft.pricing, sku: state.draft.sku },
+    });
+    return { ...next, conflict: null };
+  }
+  if (result.code === "revision_conflict" && "revision" in result) {
+    return { ...state, draft: state.draft, conflict: { revision: result.revision, message: result.message } };
+  }
+  return { ...state, draft: state.draft };
+}

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -726,3 +726,42 @@ export const orderAttribution = sqliteTable(
   },
   (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.externalOrderId] }) }),
 );
+
+// Merchant pricing and SKU defaults. One current row per tenant is the
+// compare-and-swap target (`revision` must still be the caller's expected
+// value). `merchant_calculation_settings_revisions` is the append-only copy of
+// each accepted save: tenant_id is the isolation boundary, actor is an opaque
+// id, and rows are never updated. Absence of a current row means the merchant
+// has not saved defaults.
+export const merchantCalculationSettings = sqliteTable("merchant_calculation_settings", {
+  tenantId: text("tenant_id").primaryKey(),
+  revision: integer("revision").notNull(),
+  currency: text("currency").notNull(),
+  engineVersion: text("engine_version").notNull(),
+  pricingJson: text("pricing_json").notNull(),
+  skuJson: text("sku_json").notNull(),
+});
+
+export const merchantCalculationSettingsRevisions = sqliteTable(
+  "merchant_calculation_settings_revisions",
+  {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id").notNull(),
+    revision: integer("revision").notNull(),
+    currency: text("currency").notNull(),
+    engineVersion: text("engine_version").notNull(),
+    pricingJson: text("pricing_json").notNull(),
+    skuJson: text("sku_json").notNull(),
+    actor: text("actor").notNull(),
+    savedAt: text("saved_at").notNull(),
+  },
+  (t) => ({
+    uqMerchantCalculationSettingsRevision: uniqueIndex("uq_merchant_calculation_settings_revision").on(
+      t.tenantId,
+      t.revision,
+    ),
+    idxMerchantCalculationSettingsRevisionsTenant: index("idx_merchant_calculation_settings_revisions_tenant").on(
+      t.tenantId,
+    ),
+  }),
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.14",
+  "version": "2.4.16",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",