@tokenoftrust/storefront-runner 2.4.9 → 2.4.11

package/apps/storefront/src/components/style-guide/StyleGuideNav.astro

@@ -14,6 +14,8 @@
  * aria-current="page". When `headings` is supplied (the guide's H2 outline) a
  * nested table of contents is rendered as in-page anchor links.
  */
+import { styleGuideHref } from "@/lib/styleGuidePaths";
+
 type Active = "index" | "tenant" | "components" | "chrome" | "guide";
 
 interface Heading {
@@ -33,11 +35,11 @@ interface Props {
 
 const { tenant, theme, active, headings = [] } = Astro.props;
 
-const base = `/_style-guide`;
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
 // Per-theme surfaces only resolve when we know which theme to skin with.
-const componentsHref = theme ? `${base}/${tenant}/${theme}/` : undefined;
-const chromeHref = theme ? `${base}/${tenant}/chrome/${theme}/` : undefined;
-const guideHref = theme ? `${base}/${tenant}/guide/${theme}/` : undefined;
+const componentsHref = theme ? href(`/${tenant}/${theme}/`) : undefined;
+const chromeHref = theme ? href(`/${tenant}/chrome/${theme}/`) : undefined;
+const guideHref = theme ? href(`/${tenant}/guide/${theme}/`) : undefined;
 
 const toc = headings.filter((h) => h.depth === 2);
 ---
@@ -47,14 +49,14 @@ const toc = headings.filter((h) => h.depth === 2);
   <ul class="sg-nav__list">
     <li>
       <a
-        href={`${base}/`}
+        href={href("/")}
         class:list={["sg-nav__link", { "is-active": active === "index" }]}
         aria-current={active === "index" ? "page" : undefined}
       >All client guides</a>
     </li>
     <li>
       <a
-        href={`${base}/${tenant}/`}
+        href={href(`/${tenant}/`)}
         class:list={["sg-nav__link", { "is-active": active === "tenant" }]}
         aria-current={active === "tenant" ? "page" : undefined}
       >{tenant} — overview</a>

package/apps/storefront/src/layouts/Layout.astro

@@ -18,6 +18,8 @@ import CartDrawerStyles from "@/components/commerce/CartDrawerStyles.astro";
 import NicotineWarning from "@/components/compliance/NicotineWarning.astro";
 import PactActNotice from "@/components/compliance/PactActNotice.astro";
 import ShippingRestrictionNotice from "@/components/compliance/ShippingRestrictionNotice.astro";
+import ExciseTaxNotice from "@/components/compliance/ExciseTaxNotice.astro";
+import { EXCISE_TAX_DISCLOSURE_TEXT } from "@/lib/compliance/rawComplianceNotices";
 import IsolatedAgeGate from "@/components/islands/IsolatedAgeGate.tsx";
 import AuthBadge from "@/components/auth/AuthBadge.astro";
 import { referenceTheme } from "@/themes/reference";
@@ -446,12 +448,7 @@ const footerWidgets = await renderWidgetSlot(
         is calculated + added inside the managed cart. This is the storefront's
         honest shopper-facing signal of it. */}
     {capabilities.exciseTax.enabled && features.catalog && (
-      <p
-        class="border-t border-[var(--color-border)] bg-[var(--color-bg)] py-2.5 text-center text-xs text-[var(--color-muted)]"
-        data-capability="excise-tax"
-      >
-        Applicable excise tax is calculated at checkout.
-      </p>
+      <ExciseTaxNotice variant="footer" config={{ note: EXCISE_TAX_DISCLOSURE_TEXT }} />
     )}
 
     {/* Checkout loader — turns add-to-cart forms into the cart drawer + hosted

package/apps/storefront/src/lib/compliance/rawComplianceNotices.ts

@@ -6,8 +6,8 @@
  * independent of its content: the FDA nicotine warning, the PACT Act notice, the
  * shipping/jurisdiction notice, and the excise-tax disclosure. Each mirrors the exact
  * markup its Layout.astro sibling renders (NicotineWarning.astro "bar" variant,
- * PactActNotice.astro and ShippingRestrictionNotice.astro "footer" variants via
- * ComplianceNotice.astro, and Layout's own excise-tax <p>) so a raw and a block-composed page present
+ * PactActNotice.astro, ShippingRestrictionNotice.astro and ExciseTaxNotice.astro
+ * "footer" variants via ComplianceNotice.astro) so a raw and a block-composed page present
  * these anchors identically. See `rawHtmlPolicy` for which anchors this does
  * and doesn't cover (notably: NOT `age-gate`).
  */
@@ -61,11 +61,16 @@ export function pactActNoticeHtml(minAge?: number): string {
   );
 }
 
-/** Mirrors Layout.astro's excise-tax disclosure <p>. */
+/** The excise-tax disclosure wording — the one copy Layout.astro and the raw path both render. */
+export const EXCISE_TAX_DISCLOSURE_TEXT = "Applicable excise tax is calculated at checkout.";
+
+/** Mirrors ExciseTaxNotice.astro's "footer" variant (via ComplianceNotice.astro), as Layout.astro renders it. */
 export function exciseTaxNoticeHtml(): string {
   return (
-    '<p class="border-t border-[var(--color-border)] bg-[var(--color-bg)] py-2.5 text-center text-xs text-[var(--color-muted)]" data-capability="excise-tax">' +
-    "Applicable excise tax is calculated at checkout.</p>"
+    '<div class="border-t border-[var(--color-border)] bg-[var(--color-bg)]" data-compliance="excise-tax">' +
+    '<p class="container-prose py-3 text-center text-sm text-[var(--color-muted)]" role="note" aria-label="Excise tax notice">' +
+    escapeHtml(EXCISE_TAX_DISCLOSURE_TEXT) +
+    "</p></div>"
   );
 }
 

package/apps/storefront/src/lib/compliance/tamper-sentinel-boot.ts

@@ -42,10 +42,12 @@ const SURFACE_SELECTORS: Record<ProtectedSurface, readonly string[]> = {
     '[data-compliance="pact-act"]',
     '[data-compliance="purchase-limit"]',
     '[data-compliance="adult-signature"]',
+    '[data-compliance="excise-tax"]',
   ],
   "shipping-jurisdiction-notice": [
     '[data-compliance="shipping-restriction"]',
     '[data-compliance="jurisdiction"]',
+    '[data-compliance="state-eligibility"]',
   ],
   "cart-preflight": ["[data-cart-preflight]"],
   "checkout-controls": ["[data-checkout-controls]"],

package/apps/storefront/src/lib/previewReload.ts

@@ -106,12 +106,18 @@ export function buildPreviewReloadScript(opts: {
  * All dynamic text is written via textContent (never innerHTML), so a hostile
  * blockedURI can't inject markup. Kept tiny + dependency-free.
  */
-export function buildCspViolationBannerScript(): string {
+export function buildCspViolationBannerScript(basePath = ""): string {
+  // A style-guide surface is `/_style-guide/…` or `/style-guide/…`, under the tenant
+  // prefix when path-routed (lib/styleGuidePaths.ts).
   return `(() => {
   if (window.__totCspBanner) return; window.__totCspBanner = true;
   const seen = new Set();
   let box = null;
-  const isStyleGuide = /^\\/_style-guide(?:\\/|$)/.test(window.location.pathname || "");
+  const BASE = ${jsonForScript(basePath)};
+  const path = window.location.pathname || "";
+  const isStyleGuide = /^\\/_?style-guide(?:\\/|$)/.test(
+    BASE && path.indexOf(BASE + "/") === 0 ? path.slice(BASE.length) : path,
+  );
   const isPreviewInspectionStyle = (directive, uri) =>
     directive === "style-src-elem" &&
     (uri === "inline" || uri === "(inline)") &&
@@ -176,7 +182,7 @@ export function injectPreviewReloadHtml(
   // violation banner (both test-env only, injected via the same seam).
   const script =
     `<script nonce="${opts.nonce}">${buildPreviewReloadScript(opts)}</script>` +
-    `<script nonce="${opts.nonce}">${buildCspViolationBannerScript()}</script>`;
+    `<script nonce="${opts.nonce}">${buildCspViolationBannerScript(opts.basePath)}</script>`;
   if (/<\/body>/i.test(html)) {
     return html.replace(/<\/body>/i, `${script}</body>`);
   }

package/apps/storefront/src/lib/styleGuidePaths.ts

@@ -0,0 +1,31 @@
+/**
+ * URLs of the preview/dev style-guide surfaces under the request's tenant routing.
+ *
+ * The guides live at `/style-guide/…` and are addressed through the internal
+ * `/_style-guide/…` alias, which `[...slug].astro` rewrites in-process. A rewrite
+ * re-runs the middleware against the NEW URL, so tenant resolution is decided again
+ * from that URL alone. On the shared preview host, where the tenant is selected by a
+ * `/<domain>` path prefix (`locals.basePath`), a URL without that prefix resolves the
+ * host's own tenant and a registered tenant's guide 404s. Every style-guide link and
+ * the alias rewrite therefore carry the prefix.
+ */
+
+const ALIAS = "_style-guide";
+
+/** Link to a style-guide surface. `path` starts with "/" (e.g. `/<tenant>/chrome/<theme>/`). */
+export function styleGuideHref(basePath: string, path = "/"): string {
+  return `${basePath}/${ALIAS}${path}`;
+}
+
+/**
+ * Where an `/_style-guide…` alias request renders: the real route, under the same
+ * tenant prefix and with the query intact. `undefined` when `slug` is not the alias.
+ */
+export function styleGuideAliasRewrite(
+  basePath: string,
+  slug: string,
+  search = "",
+): string | undefined {
+  if (slug !== ALIAS && !slug.startsWith(`${ALIAS}/`)) return undefined;
+  return `${basePath}/style-guide/${slug.slice(ALIAS.length + 1)}${search}`;
+}

package/apps/storefront/src/pages/[...slug].astro

@@ -15,6 +15,7 @@ import { truncate } from "@/lib/format";
 import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import { rewriteThroughRenderChain } from "@/lib/pinnedRouteRewriteBoundary";
+import { styleGuideAliasRewrite } from "@/lib/styleGuidePaths";
 
 const { tenant, canonicalBase, content, basePath, capabilities, features } = Astro.locals;
 const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
@@ -33,12 +34,11 @@ if (
 // Preview/dev-only style-guide surfaces are requested at `/_style-guide/<tenant>/…`
 // (the leading underscore signals internal). Astro won't route a `_`-prefixed pages
 // dir, so the pages live under `/style-guide/…` and we rewrite the underscored URL
-// onto them. These are noindex + sitemap-excluded and never reskin the live site.
-if (slug === "_style-guide" || slug.startsWith("_style-guide/")) {
-  return rewriteThroughRenderChain(
-    Astro,
-    "/style-guide/" + slug.slice("_style-guide".length + 1),
-  );
+// onto them, under the same tenant prefix. These are noindex + sitemap-excluded and
+// never reskin the live site.
+const styleGuideTarget = styleGuideAliasRewrite(basePath, slug, Astro.url.search);
+if (styleGuideTarget !== undefined) {
+  return rewriteThroughRenderChain(Astro, styleGuideTarget);
 }
 
 // Raw tenant-authored marketing subpage (vendor-injected HTML) — serve the

package/apps/storefront/src/pages/style-guide/[tenant]/[theme].astro

@@ -21,6 +21,7 @@ export const prerender = false;
 // render here without the app Layout. The `.sg-commerce` wrapper pins the
 // reference palette so they look coherent regardless of the marketing theme CSS.
 import { loadStyleGuideThemes, styleGuideCompositionSheets } from "@/lib/styleGuideThemes";
+import { styleGuideHref } from "@/lib/styleGuidePaths";
 import { derivedTokenDeclarations } from "@/themes/derivedTokens";
 import "@/styles/global.css";
 import PriceDisplay from "@/components/commerce/PriceDisplay.astro";
@@ -90,6 +91,7 @@ import type { HeroBlock, MarketingBlock } from "@/lib/storyblok/content-model";
 const { tenant, theme } = Astro.params;
 const cspNonce = Astro.locals.cspNonce;
 const favicon = Astro.locals.tenant.theme_tokens.brand?.favicon ?? "/favicon.svg";
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
 
 // --- Sample chrome data (preview-only; no live tenant content) ----------------
 // Every actionable item declares its tracking intent (`action`) alongside its
@@ -653,9 +655,9 @@ const componentVarsInline = [
       <span class="role">{t.role}</span>
       <b>{t.name}</b>
       <span class="status">{t.status} · concept {t.concept?.id}@{t.concept?.version}</span>
-      <a href={`/_style-guide/${tenant}/chrome/${t.id}/`} style="margin-left:auto">shared chrome →</a>
-      <a href={`/_style-guide/${tenant}/guide/${t.id}/`}>widget library guide →</a>
-      <a href={`/_style-guide/${tenant}/`}>← all guides</a>
+      <a href={href(`/${tenant}/chrome/${t.id}/`)} style="margin-left:auto">shared chrome →</a>
+      <a href={href(`/${tenant}/guide/${t.id}/`)}>widget library guide →</a>
+      <a href={href(`/${tenant}/`)}>← all guides</a>
     </header>
 
     <main>

package/apps/storefront/src/pages/style-guide/[tenant]/chrome/[theme].astro

@@ -30,8 +30,11 @@ const cspNonce = Astro.locals.cspNonce;
 const favicon = Astro.locals.tenant.theme_tokens.brand?.favicon ?? "/favicon.svg";
 
 import { loadStyleGuideThemes } from "@/lib/styleGuideThemes";
+import { styleGuideHref } from "@/lib/styleGuidePaths";
 import { derivedTokenDeclarations } from "@/themes/derivedTokens";
 
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
+
 const t = (await loadStyleGuideThemes(
   tenant ?? "",
   Astro.locals.tenant,
@@ -112,8 +115,8 @@ const componentVarsInline = [
       <span class="flag">Preview · shared chrome · noindex</span>
       <span class="role">{t.role}</span>
       <b>{t.name}</b>
-      <a class="right" href={`/_style-guide/${tenant}/guide/${t.id}/`}>widget library guide →</a>
-      <a href={`/_style-guide/${tenant}/${t.id}/`}>← component guide</a>
+      <a class="right" href={href(`/${tenant}/guide/${t.id}/`)}>widget library guide →</a>
+      <a href={href(`/${tenant}/${t.id}/`)}>← component guide</a>
     </nav>
 
     <main class="sg-page" style={componentVarsInline}>

package/apps/storefront/src/pages/style-guide/[tenant]/guide/[theme].astro

@@ -21,10 +21,12 @@ import "@/styles/global.css";
 import type { MarkdownInstance } from "astro";
 import StyleGuideNav from "@/components/style-guide/StyleGuideNav.astro";
 import { loadStyleGuideThemes } from "@/lib/styleGuideThemes";
+import { styleGuideHref } from "@/lib/styleGuidePaths";
 import { derivedTokenDeclarations } from "@/themes/derivedTokens";
 
 const { tenant, theme } = Astro.params;
 const cspNonce = Astro.locals.cspNonce;
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
 const favicon = Astro.locals.tenant.theme_tokens.brand?.favicon ?? "/favicon.svg";
 
 const t = (await loadStyleGuideThemes(
@@ -125,8 +127,8 @@ const componentVarsInline = [
       <span class="flag">Preview · widget library · noindex</span>
       <span class="role">{t.role}</span>
       <b>{t.name}</b>
-      <a class="right" href={`/_style-guide/${tenant}/${t.id}/`}>← component guide</a>
-      <a href={`/_style-guide/${tenant}/`}>tenant hub →</a>
+      <a class="right" href={href(`/${tenant}/${t.id}/`)}>← component guide</a>
+      <a href={href(`/${tenant}/`)}>tenant hub →</a>
     </header>
 
     <div class="sg-shell">

package/apps/storefront/src/pages/style-guide/[tenant]/index.astro

@@ -18,9 +18,11 @@ export const prerender = false;
 
 import StyleGuideNav from "@/components/style-guide/StyleGuideNav.astro";
 import { loadStyleGuideThemes } from "@/lib/styleGuideThemes";
+import { styleGuideHref } from "@/lib/styleGuidePaths";
 
 const { tenant } = Astro.params;
 const cspNonce = Astro.locals.cspNonce;
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
 const favicon = Astro.locals.tenant.theme_tokens.brand?.favicon ?? "/favicon.svg";
 
 const themes = await loadStyleGuideThemes(
@@ -83,13 +85,13 @@ const navTheme = themes[0]?.id;
       </aside>
       <main class="wrap">
         <span class="flag">Preview · dev only · noindex</span>
-        <p class="back"><a href="/_style-guide/">← all clients</a></p>
+        <p class="back"><a href={href("/")}>← all clients</a></p>
         <h1>{tenant} — theme style guides</h1>
         <p class="sub">Open any guide independently to compare looks side-by-side. Nothing here reskins the live site. The <b>Widget Library Guide</b> (left nav) documents every shared component.</p>
 
         {themes.map((t) => (
           <div>
-            <a class="card" href={`/_style-guide/${tenant}/${t.id}/`}>
+            <a class="card" href={href(`/${tenant}/${t.id}/`)}>
               <div class="row">
                 <span class:list={["badge", t.role]}>{t.role}</span>
                 <span class="name">{t.name}</span>
@@ -98,8 +100,8 @@ const navTheme = themes[0]?.id;
               {t.description && <p class="desc">{t.description}</p>}
             </a>
             <div class="sub-links">
-              <a href={`/_style-guide/${tenant}/chrome/${t.id}/`}>shared chrome preview →</a>
-              <a href={`/_style-guide/${tenant}/guide/${t.id}/`}>widget library guide →</a>
+              <a href={href(`/${tenant}/chrome/${t.id}/`)}>shared chrome preview →</a>
+              <a href={href(`/${tenant}/guide/${t.id}/`)}>widget library guide →</a>
             </div>
           </div>
         ))}

package/apps/storefront/src/pages/style-guide/index.astro

@@ -21,8 +21,10 @@
 export const prerender = false;
 
 import { listedTenantIds } from "@tot/public-runtime";
+import { styleGuideHref } from "@/lib/styleGuidePaths";
 
 const cspNonce = Astro.locals.cspNonce;
+const href = (path: string) => styleGuideHref(Astro.locals.basePath ?? "", path);
 const includeTestTenants = Astro.url.searchParams.get("includeTestTenants") === "1";
 
 // All tenant-local theme descriptors, grouped by tenant. Colocated repo-root
@@ -91,18 +93,18 @@ const tenants = [...byTenant.entries()]
       <h1>Client style guides</h1>
       <p class="sub">Every client tenant and its theme guides. Open a guide to preview the standard components and page sections re-skinned under that theme. Nothing here re-skins a live site.</p>
       <p class="sub">{includeTestTenants
-        ? <span>Showing platform test tenants too — <a href="/_style-guide/">hide them</a>.</span>
-        : <span>Platform test tenants are hidden — <a href="/_style-guide/?includeTestTenants=1">show them</a>.</span>}</p>
+        ? <span>Showing platform test tenants too — <a href={href("/")}>hide them</a>.</span>
+        : <span>Platform test tenants are hidden — <a href={href("/?includeTestTenants=1")}>show them</a>.</span>}</p>
 
       {tenants.map(({ tenant, themes }) => (
         <section class="tenant">
           <h2>
             {tenant}
-            <a href={`/_style-guide/${tenant}/`}>tenant hub →</a>
-            {themes[0]?.id && <a href={`/_style-guide/${tenant}/guide/${themes[0].id}/`}>widget library guide →</a>}
+            <a href={href(`/${tenant}/`)}>tenant hub →</a>
+            {themes[0]?.id && <a href={href(`/${tenant}/guide/${themes[0].id}/`)}>widget library guide →</a>}
           </h2>
           {themes.map((t) => (
-            <a class="card" href={`/_style-guide/${tenant}/${t.id}/`}>
+            <a class="card" href={href(`/${tenant}/${t.id}/`)}>
               <div class="row">
                 <span class:list={["badge", t.role]}>{t.role}</span>
                 <span class="name">{t.name}</span>

package/docs/widget-library-guide.md

@@ -3,7 +3,8 @@
 **Status:** maintained reference, workstream `shared-ecommerce-widgets`. This is the
 human- and agent-facing guide to the shared regulated-ecommerce widget library that every
 storefront tenant inherits. It is the **source of truth**; the style-guide route
-`/_style-guide/<tenant>/guide/<theme>/` renders this same file as HTML.
+`/_style-guide/<tenant>/guide/<theme>/` renders this same file as HTML (on the shared preview
+host, under the tenant's path prefix: `/<domain>/_style-guide/<tenant>/guide/<theme>/`).
 
 > **How to keep this accurate.** Every widget entry is enumerated from real code under
 > `apps/storefront/src/components/**` and the shared libs in `apps/storefront/src/lib/`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.9",
+  "version": "2.4.11",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/binary-path.ts

@@ -8,7 +8,7 @@
  *
  *   - WRITE: `customization-seed.ts#buildSeedFiles` base64-encodes binaries when
  *     it materializes the colocated subtree into a flat Gitea-repo seed.
- *   - READ:  `gitea-source.ts#createGiteaHttpSource().readContent` base64-encodes
+ *   - READ:  `mcp-gitea-source.ts#createMcpGiteaSource().readContent` base64-encodes
  *     binaries when it reads them back at a commit for the reconcile/assets sink.
  *
  * Keeping the extension set here (and importing it in both) guarantees the two