@tokenoftrust/storefront-runner 2.4.80 → 2.4.82

package/apps/storefront/src/components/blog/BlogPostArticle.astro

@@ -8,6 +8,7 @@
  * the request.
  */
 import Layout from "@/layouts/Layout.astro";
+import { sourceSeoTitle } from "@/lib/seo/documentTitle";
 import Breadcrumbs from "@/components/Breadcrumbs.astro";
 import BlogPaywall from "@/components/blog/BlogPaywall.astro";
 import ReactionBar from "@/components/blog/ReactionBar.astro";
@@ -26,6 +27,7 @@ const {
 
 <Layout
   title={post.seoTitle || post.title}
+  seoTitle={sourceSeoTitle(Astro.locals.tenant.seo, post.seoTitle)}
   description={post.description}
   path={path}
   ogType="article"

package/apps/storefront/src/components/islands/CheckoutComplianceGate.tsx

@@ -26,6 +26,7 @@ import { useCallback, useEffect, useRef, useState } from "preact/hooks";
 import type { CartComplianceDecision } from "@tot/public-runtime";
 import {
   clearStoredRef,
+  isStoreNotPublicRefusal,
   parsePreflightResponse,
   pollVerification,
   readStoredRef,
@@ -91,6 +92,10 @@ type DialogPhase = VerificationPhase | "stalled";
 const FAIL_CLOSED_MESSAGE =
   "We couldn't reach our compliance check. For your safety, checkout is paused — please try again.";
 
+/** The store-not-public gate refused the preflight: checkout needs a signed-in session. */
+const STORE_NOT_PUBLIC_MESSAGE =
+  "This store isn't open to the public yet, so checkout is unavailable here. Sign in to the store to test checkout.";
+
 export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props) {
   const [pending, setPending] = useState<PendingLine | null>(null);
   const [region, setRegion] = useState("");
@@ -110,6 +115,8 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
   const [popupBlocked, setPopupBlocked] = useState(false);
   /** Cancellation token for the in-flight poll loop (at most one at a time). */
   const pollToken = useRef<{ cancelled: boolean } | null>(null);
+  /** Set by the last preflight POST when the store-not-public gate answered it. */
+  const gateRefused = useRef(false);
 
   const stopPolling = useCallback(() => {
     if (pollToken.current) pollToken.current.cancelled = true;
@@ -191,6 +198,7 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
       opts: { ref: string | null; includeShopper: boolean },
     ): Promise<PreflightResponse | null> => {
       const trimmedEmail = email.trim();
+      gateRefused.current = false;
       try {
         const res = await fetch(preflightUrl, {
           method: "POST",
@@ -218,6 +226,10 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
               : {}),
           }),
         });
+        if (isStoreNotPublicRefusal(res)) {
+          gateRefused.current = true;
+          return null;
+        }
         return parsePreflightResponse(await res.json());
       } catch {
         return null;
@@ -336,7 +348,7 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
     setLoading(false);
     if (!res) {
       // Fail closed: a regulated tenant never proceeds on an unreadable result.
-      setError(FAIL_CLOSED_MESSAGE);
+      setError(gateRefused.current ? STORE_NOT_PUBLIC_MESSAGE : FAIL_CLOSED_MESSAGE);
       return;
     }
     apply(pending, res);

package/apps/storefront/src/components/islands/checkoutVerificationFlow.ts

@@ -173,6 +173,15 @@ export interface PollDeps {
   timeoutMs?: number;
 }
 
+/**
+ * True when the login gate, not the preflight route, answered: the store is not
+ * public and this viewer holds no session (see `lib/auth/gatePage.ts`). Still fail
+ * closed — the caller only names the reason instead of reporting an outage.
+ */
+export function isStoreNotPublicRefusal(res: Pick<Response, "status" | "headers">): boolean {
+  return res.status === 401 && res.headers.get("x-tot-gate") === "store-not-public";
+}
+
 /**
  * Re-read the server's decision until it resolves. The client NEVER decides the
  * shopper passed — it only relays `decision.status === "clear"`.

package/apps/storefront/src/lib/seo/documentTitle.ts

@@ -13,14 +13,14 @@
  * renders as written, any other is suffixed.
  */
 /**
- * A product's or collection's own catalog SEO title, as the `seoTitle` to render verbatim, when
- * the tenant declares `seo.verbatimCatalogTitles`; otherwise undefined, so it is suffixed.
+ * A product's, collection's or blog post's own SEO title, as the `seoTitle` to render verbatim,
+ * when the tenant declares `seo.verbatimSeoTitles`; otherwise undefined, so it is suffixed.
  */
-export function catalogSeoTitle(
-  seo: { verbatimCatalogTitles?: boolean } | undefined,
+export function sourceSeoTitle(
+  seo: { verbatimSeoTitles?: boolean } | undefined,
   ownSeoTitle: string | undefined,
 ): string | undefined {
-  return seo?.verbatimCatalogTitles && ownSeoTitle?.trim() ? ownSeoTitle : undefined;
+  return seo?.verbatimSeoTitles && ownSeoTitle?.trim() ? ownSeoTitle : undefined;
 }
 
 export function documentTitle(title: string, seoTitle: string | undefined, storeName: string): string {

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -110,7 +110,7 @@ export const POST: APIRoute = async (context) => {
     if (!d1) {
       // No apps DB binding (local/dev without D1): can't persist. Don't fail the
       // visitor — log and acknowledge so the flow is exercisable in dev.
-      console.log(`[newsletter] subscribe (no D1) ${email} → ${tenantId}/${collection}`);
+      console.log(`[newsletter] subscribe not persisted (no D1) → ${tenantId}/${collection}`);
       return ok(context.request);
     }
 
@@ -133,14 +133,22 @@ export const POST: APIRoute = async (context) => {
     // or unsubscribed address. Best-effort; a stub failure must not fail signup.
     if (result.status === "pending") {
       const origin = new URL(context.request.url).origin;
-      const basePath = context.locals?.basePath ?? "";
-      const confirmUrl = `${origin}${basePath}/api/newsletter/confirm?token=${result.token}`;
-      await sendConfirmationEmail({ email, collection, confirmUrl }).catch(() => {});
+      // The tenant's real routed prefix: a pinned preview's basePath has no API mirror.
+      const apiBasePath = context.locals?.apiBasePath ?? context.locals?.basePath ?? "";
+      const confirmUrl = `${origin}${apiBasePath}/api/newsletter/confirm?token=${result.token}`;
+      await sendConfirmationEmail({ email, collection, confirmUrl }).catch((err: unknown) => {
+        console.error(
+          `[newsletter] confirmation email failed tenant=${tenantId} collection=${collection}: ${err instanceof Error ? err.name : "unknown"}`,
+        );
+      });
     }
 
     return ok(context.request);
-  } catch {
-    // Never 500 on a signup — acknowledge and move on.
+  } catch (err) {
+    // Never 500 on a signup — acknowledge, but never swallow the failure silently.
+    console.error(
+      `[newsletter] subscribe failed collection=${collection}: ${err instanceof Error ? err.name : "unknown"}`,
+    );
     return ok(context.request);
   }
 };

package/apps/storefront/src/pages/collections/[handle].astro

@@ -19,7 +19,7 @@ import { parseQuery, buildQueryString } from "@/lib/url";
 import { breadcrumbLd, itemListLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
 import { pageUrlForm } from "@/lib/seo/urlForm";
-import { catalogSeoTitle } from "@/lib/seo/documentTitle";
+import { sourceSeoTitle } from "@/lib/seo/documentTitle";
 import { withBase } from "@/lib/basePath";
 import { isBlankDescriptionHtml, sanitizeDescriptionHtml } from "@/lib/content/sanitizeDescriptionHtml";
 
@@ -92,7 +92,7 @@ if (query.priceMin != null || query.priceMax != null) {
 
 <Layout
   title={collection.seo.title || collection.title}
-  seoTitle={catalogSeoTitle(tenant.seo, collection.seo.title)}
+  seoTitle={sourceSeoTitle(tenant.seo, collection.seo.title)}
   description={collection.seo.description || (desc ? truncate(desc, 160) : `Shop ${collection.title} at ${tenant.displayName}.`)}
   path={basePath}
   noindex={isEmptyCollection}

package/apps/storefront/src/pages/products/[handle].astro

@@ -47,7 +47,7 @@ import { isUsableImageUrl } from "@/lib/placeholder";
 import { withBase } from "@/lib/basePath";
 import { productPageType, structuredDataProfile } from "@/lib/seo/structuredData";
 import { pageUrlForm } from "@/lib/seo/urlForm";
-import { catalogSeoTitle } from "@/lib/seo/documentTitle";
+import { sourceSeoTitle } from "@/lib/seo/documentTitle";
 import { shippingPolicyPath } from "@/lib/commerce/shippingPolicy";
 import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/apps/registryAccess.js";
@@ -314,7 +314,7 @@ const structuredData = {
 
 <Layout
   title={product.seo.title || product.title}
-  seoTitle={catalogSeoTitle(tenant.seo, product.seo.title)}
+  seoTitle={sourceSeoTitle(tenant.seo, product.seo.title)}
   description={product.seo.description || truncate(product.description_text, 160)}
   path={`/products/${product.handle}`}
   ogType="product"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.80",
+  "version": "2.4.82",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -31,7 +31,7 @@ export const FEATURE_KEYS = [
 export const SITE_TYPES = ["commerce", "marketing"];
 
 /** Every `seo` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
-export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimCatalogTitles", "structuredData"]);
+export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimSeoTitles", "structuredData"]);
 
 /** Every `seo.structuredData` key. */
 export const STRUCTURED_DATA_KEYS = Object.freeze(["graphs", "names", "reviews", "onlyOn"]);
@@ -86,8 +86,8 @@ export function seoDeclarationProblems(seo) {
   if (source.trailingSlash !== undefined && typeof source.trailingSlash !== "boolean") {
     problems.push("`seo.trailingSlash` must be true or false");
   }
-  if (source.verbatimCatalogTitles !== undefined && typeof source.verbatimCatalogTitles !== "boolean") {
-    problems.push("`seo.verbatimCatalogTitles` must be true or false");
+  if (source.verbatimSeoTitles !== undefined && typeof source.verbatimSeoTitles !== "boolean") {
+    problems.push("`seo.verbatimSeoTitles` must be true or false");
   }
   const sd = source.structuredData;
   if (sd === undefined) return problems;

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -75,7 +75,7 @@ export const FEATURE_KEYS = Object.freeze([
 export const SITE_TYPES_LIST = Object.freeze(["commerce", "marketing"]);
 
 /** Every `seo` key (SeoDeclaration, tenant.ts). */
-export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimCatalogTitles", "structuredData"]);
+export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimSeoTitles", "structuredData"]);
 
 /** Every `seo.structuredData` key. */
 export const STRUCTURED_DATA_KEYS = Object.freeze(["graphs", "names", "reviews", "onlyOn"]);
@@ -132,8 +132,8 @@ export function seoDeclarationProblems(seo) {
   if (source.trailingSlash !== undefined && typeof source.trailingSlash !== "boolean") {
     problems.push("`seo.trailingSlash` must be true or false");
   }
-  if (source.verbatimCatalogTitles !== undefined && typeof source.verbatimCatalogTitles !== "boolean") {
-    problems.push("`seo.verbatimCatalogTitles` must be true or false");
+  if (source.verbatimSeoTitles !== undefined && typeof source.verbatimSeoTitles !== "boolean") {
+    problems.push("`seo.verbatimSeoTitles` must be true or false");
   }
   const sd = source.structuredData;
   if (sd === undefined) return problems;

package/packages/public-runtime/src/tenant.ts

@@ -778,11 +778,11 @@ export interface SeoDeclaration {
    */
   trailingSlash?: boolean;
   /**
-   * A product's or collection's own catalog SEO title is the complete `<title>`, rendered as
-   * written (a source that already ends its titles in "| Brand"). Absent or false ⇒ it is
-   * suffixed with the store name like any other page title.
+   * A product's, collection's or blog post's own SEO title is the complete `<title>`, rendered
+   * as written (a source that already ends its titles in "| Brand"). Absent or false ⇒ it is
+   * suffixed with the store name unless it already names the store.
    */
-  verbatimCatalogTitles?: boolean;
+  verbatimSeoTitles?: boolean;
   /**
    * The structured-data profile. When present it is the ONLY JSON-LD a declared page type
    * emits: one `@graph` holding exactly the listed nodes, in order. A node whose data the