@tokenoftrust/storefront-runner 2.5.6 → 3.0.0

package/scripts/tenant/validate.mjs

@@ -45,8 +45,9 @@ import {
   parseMappingTarget,
   workspacePathForTenantRelative,
 } from "../../agency-kit/tools/lib/tot-repo-mappings.mjs";
+import { CATALOG_IMAGES_DIR, publicBinaryFindings } from "../../agency-kit/tools/lib/public-binaries.mjs";
 import { validateVisualParityClosure } from "../../packages/cli/src/visual-parity.mjs";
-import { validateDeclaredConfig } from "../../packages/cli/src/declared-config.mjs";
+import { declaredObligations, isRegulatedCompliance, validateDeclaredConfig } from "../../packages/cli/src/declared-config.mjs";
 
 /** Catalogued embed slugs a tenant may opt into (mirror of EMBED_PROVIDERS). */
 const KNOWN_EMBED_SLUGS = new Set(KNOWN_EMBEDS.map((p) => p.slug));
@@ -253,18 +254,17 @@ function providesChrome(contentDir) {
 
 const CAPABILITY_KEYS = new Set(["cartCheckout", "ageVerification", "exciseTax"]);
 
+// What the obligation registry says this store owes (declared-config.mjs mirrors it).
 function complianceObligations(config) {
-  const compliance = config?.compliance || {};
+  const owed = new Set(declaredObligations(config?.compliance).map((o) => o.id));
   return {
-    ageVerification: !!compliance.minAge,
-    exciseTax: !!compliance.nicotineWarning,
+    ageVerification: owed.has("age_gate"),
+    exciseTax: owed.has("excise"),
   };
 }
 
 function rawHtmlAllowed(config) {
-  const obligations = complianceObligations(config);
-  const regulated = obligations.ageVerification || obligations.exciseTax;
-  return !regulated;
+  return !isRegulatedCompliance(config?.compliance);
 }
 
 function validateCapabilitiesDoc(doc, file, config) {
@@ -287,7 +287,7 @@ function validateCapabilitiesDoc(doc, file, config) {
     out.push(mk(ERROR, "capability-compliance-floor", file, "ageVerification cannot be disabled for a tenant with compliance.minAge"));
   }
   if (obligations.exciseTax && doc.exciseTax?.enabled === false) {
-    out.push(mk(ERROR, "capability-compliance-floor", file, "exciseTax cannot be disabled for a tenant with compliance.nicotineWarning"));
+    out.push(mk(ERROR, "capability-compliance-floor", file, "exciseTax cannot be disabled for a tenant with compliance.nicotineWarning or compliance.exciseTax"));
   }
   return out;
 }
@@ -1282,6 +1282,13 @@ export function validateTenant(tenantDir, opts = {}) {
   // 6. large public assets — advisory (never blocks); see LARGE_PUBLIC_ASSET_FIX.
   findings.push(...findLargePublicAssets(publicDir, rel));
 
+  // Tenant binaries never live in the tenant repo — the same rule the hosted reconcile refuses.
+  const publicEntries = walk(publicDir, () => true)
+    .map((p) => ({ rel: relative(publicDir, p).split("\\").join("/"), bytes: statSync(p).size }));
+  for (const f of publicBinaryFindings(publicEntries)) {
+    findings.push(mk(ERROR, f.code, `${rel(publicDir)}/${f.path.slice("public/".length)}`, f.message, f.remedy));
+  }
+
   const ok = !findings.some((f) => f.level === ERROR);
   return { ok, findings };
 }
@@ -1360,6 +1367,8 @@ function checkAsset(src, file, publicDir, tenantId) {
 function findLargePublicAssets(publicDir, rel) {
   const out = [];
   for (const p of walk(publicDir, () => true)) {
+    // public/catalog-images/ is already an error (catalog-images-in-repo); one line, not thousands.
+    if (relative(publicDir, p).split("\\").join("/").startsWith(CATALOG_IMAGES_DIR)) continue;
     const size = statSync(p).size;
     if (size >= LARGE_PUBLIC_ASSET_BYTES) {
       out.push(mk(WARN, "large-public-asset", rel(p), `${(size / 1024).toFixed(0)}KB`));