@tokenoftrust/storefront-runner 4.4.0 → 4.6.0

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -2,13 +2,14 @@
 import type { APIContext } from "astro";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify, type JSONWebKeySet } from "jose";
 import {
-  commerceTenantId, totalsMatch, shippingMinorFor, isContentVersionId, catalogPinDigestFinding, cartLineCode,
+  commerceTenantId, totalsMatch, shippingMinorFor, isContentVersionId, catalogPinDigestFinding, cartLineKey,
   type CallerToken, type CatalogProduct, type CatalogVariant, type CommerceEvidence, type CommerceEvidenceProvenance,
   type CommerceProviderCartSnapshot, type FinalCartBinding, type TenantConfig,
 } from "@tot/public-runtime";
+import { skuFromToken } from "@tot/public-runtime/sku";
 import { fromD1 } from "@/lib/catalog/d1/catalog.js";
 import { readD1, readEnv, readKv } from "@/lib/publication/shared/env";
-import { evaluateFinalCart, type SeamView } from "@/lib/checkout/commerce/finalCartAuthorization.js";
+import { evaluateFinalCart, type RefusedLine, type SeamView } from "@/lib/checkout/commerce/finalCartAuthorization.js";
 import { d1CommerceRunner, reserveAllocation } from "@/lib/inventory/allocations.js";
 import { readMirrorBalance, readMirrorStock } from "@/lib/inventory/mirrorStock.js";
 import { admissionMatches, readCommerceAdmission, admissionSnapshotStatement } from "@/lib/checkout/commerce/commerceAdmission.js";
@@ -72,7 +73,7 @@ function readSnapshot(value: unknown): CommerceProviderCartSnapshot | null {
       typeof v.providerCartDigest !== "string" || !HEX.test(v.providerCartDigest) || typeof v.destinationDigest !== "string" || !HEX.test(v.destinationDigest) ||
       typeof v.tenantId !== "string" || !["preview", "publication"].includes(String(v.stage)) || typeof v.currency !== "string" || !/^[A-Z]{3}$/.test(v.currency) ||
       !Array.isArray(v.lines) || v.lines.length < 1 || v.lines.length > 50) return null;
-  if (v.lines.some(line => !line || typeof line !== "object" || typeof line.sku !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,80}$/.test(line.sku) ||
+  if (v.lines.some(line => !line || typeof line !== "object" || skuFromToken(line.sku) === null ||
       !Number.isSafeInteger(line.quantity) || line.quantity < 1 || line.quantity > 99 || !Number.isSafeInteger(line.unitMinor) || line.unitMinor < 0 ||
       Object.keys(line).some(k => !["sku", "quantity", "unitMinor"].includes(k)))) return null;
   if (!v.totals || typeof v.totals !== "object" || Object.keys(v.totals).length !== 4 ||
@@ -84,6 +85,15 @@ function readSnapshot(value: unknown): CommerceProviderCartSnapshot | null {
   if (!totalsMatch(snapshot.totals) || snapshot.lines.reduce((sum, line) => sum + line.quantity * line.unitMinor, 0) !== snapshot.totals.subtotalMinor) return null;
   return snapshot;
 }
+/**
+ * The snapshot with each line's checkout product code read back to its line key (the stored SKU,
+ * or the variant id for a variant with none). The provider digest covers the codes as the caller
+ * sent them; everything after it — catalog match, stock, holds, the admission record — is keyed
+ * by the line key, the same key inventory movements carry.
+ */
+function keyedLines(wire: CommerceProviderCartSnapshot): CommerceProviderCartSnapshot {
+  return { ...wire, lines: wire.lines.map(line => ({ ...line, sku: skuFromToken(line.sku)! })) };
+}
 /**
  * The compliance seam under the shared test store's policy. When verification is required the
  * cart's verification ref goes to preflight, whose live provider re-reads its real status
@@ -97,8 +107,8 @@ async function seam(context: APIContext, snapshot: CommerceProviderCartSnapshot,
       getProductByHandle: async (handle: string) => selected.get(handle) ?? null,
     } } } as APIContext, {
       lines: snapshot.lines.map(line => {
-        const product = products.find(p => p.variants.some(v => cartLineCode(v) === line.sku))!;
-        const variant = product.variants.find(v => cartLineCode(v) === line.sku)!;
+        const product = products.find(p => p.variants.some(v => cartLineKey(v) === line.sku))!;
+        const variant = product.variants.find(v => cartLineKey(v) === line.sku)!;
         return { handle: product.handle, variantId: variant.id, sku: line.sku, quantity: line.quantity };
       }),
       destination: snapshot.destination,
@@ -108,8 +118,19 @@ async function seam(context: APIContext, snapshot: CommerceProviderCartSnapshot,
     const blocks = decision.blocks;
     if (blocks.length === 0) return { status: "clear", verified };
     const flavors = [...new Set(blocks.flatMap(block => block.code === "flavored_prohibited" ? block.flavors ?? [] : []))];
+    const titleOf = (sku: string) => products.find(p => p.variants.some(v => v.sku === sku))?.title;
+    const seen = new Set<string>();
+    const lines: RefusedLine[] = [];
+    for (const block of blocks) {
+      if (block.failedClosed === true || typeof block.message !== "string" || !block.message) continue;
+      const key = `${block.code}\n${block.sku ?? ""}\n${block.message}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const title = block.sku ? titleOf(block.sku) : undefined;
+      lines.push({ code: block.code, message: block.message, ...(block.sku ? { sku: block.sku } : {}), ...(title ? { title } : {}) });
+    }
     return { status: "blocked", verified, failedClosed: blocks.some(block => block.failedClosed === true), codes: blocks.map(block => block.code),
-      ...(flavors.length ? { flavors } : {}) };
+      ...(flavors.length ? { flavors } : {}), ...(lines.length ? { lines } : {}) };
   } catch { return { status: "absent", verified: false }; }
 }
 function fullCartProduct(value: unknown, handle: string, scope: string): value is CatalogProduct {
@@ -159,9 +180,10 @@ async function authorize(context: APIContext): Promise<Response> {
   if (Number(context.request.headers.get("content-length") ?? 0) > 65536) return deny("malformed-request");
   const raw = await context.request.text();
   if (raw.length > 65536) return deny("malformed-request");
-  let snapshot: CommerceProviderCartSnapshot | null;
-  try { snapshot = readSnapshot(JSON.parse(raw)); } catch { snapshot = null; }
-  if (!snapshot) return deny("malformed-request");
+  let wire: CommerceProviderCartSnapshot | null;
+  try { wire = readSnapshot(JSON.parse(raw)); } catch { wire = null; }
+  if (!wire) return deny("malformed-request");
+  const snapshot = keyedLines(wire);
   const jwks = publicJwks(await readEnv("COMMERCE_CALLER_JWKS"));
   const issuers = list(await readEnv("COMMERCE_CALLER_ISSUERS"));
   const audience = await readEnv("COMMERCE_CALLER_AUDIENCE");
@@ -201,7 +223,7 @@ async function authorize(context: APIContext): Promise<Response> {
     : createContentProvider(tenant, { get: kvGet, env: contentEnv });
   const tot = await createToTClient(tenant, await readD1("CATALOG_DB"), content);
   const authorityContext = { ...context, locals: { ...context.locals, tenant, tot, content } } as APIContext;
-  const catalogPin = await catalogPinDigestFinding(snapshot);
+  const catalogPin = await catalogPinDigestFinding(wire);
   if (catalogPin) return deny(catalogPin);
   let listing: CatalogProduct[];
   try { listing = await tot.getAllActiveProducts(); } catch { return deny("catalog-unavailable", 503); }
@@ -209,9 +231,9 @@ async function authorize(context: APIContext): Promise<Response> {
   const selected = new Map<string, CatalogProduct>();
   const mismatch = (check: string, line?: number) => refuse("catalog-cart-mismatch", line === undefined ? { check } : { check, line });
   if (snapshot.currency !== resolveStoreCurrency(tenant.currency)) return mismatch("store-currency");
-  // A line's `sku` is the product code the page signed (`cartLineCode`): the SKU, or the
-  // variant id for a variant with none.
-  const coded = (line: { sku: string }) => (variant: CatalogVariant | null | undefined) => !!variant && cartLineCode(variant) === line.sku;
+  // A line's `sku` is the line key the page's signed product code encodes (`cartLineKey`): the
+  // stored SKU, or the variant id for a variant with none.
+  const coded = (line: { sku: string }) => (variant: CatalogVariant | null | undefined) => !!variant && cartLineKey(variant) === line.sku;
   for (const [index, line] of snapshot.lines.entries()) {
     const matches = listing.flatMap(product => product && product.status === "active" && (!product.visibility || product.visibility === "public") && product.tenant_id === tenant.tot_data_scope && Array.isArray(product.variants)
       ? product.variants.filter(coded(line)).map(variant => ({ product, variant })) : []);
@@ -306,8 +328,10 @@ async function authorize(context: APIContext): Promise<Response> {
     seam: seamView, catalogAvailable: true, browserConfirmed: false, token,
     trustedIssuers: issuers, expectedAudience: audience, activeKids, stockTracked, authorities });
   if (!decision.ok) {
-    if (decision.finding === "verification-refused:flavored_prohibited" && seamView.flavors) {
-      return json({ ok: false, finding: decision.finding, flavors: seamView.flavors }, 409);
+    if (decision.finding.startsWith("verification-refused") && (seamView.flavors || seamView.lines)) {
+      return json({ ok: false, finding: decision.finding,
+        ...(decision.finding === "verification-refused:flavored_prohibited" && seamView.flavors ? { flavors: seamView.flavors } : {}),
+        ...(seamView.lines ? { lines: seamView.lines } : {}) }, 409);
     }
     return deny(decision.finding, 409, decision.owner);
   }

package/apps/storefront/src/pages/tenants/[id]/[...path].ts

@@ -158,16 +158,26 @@ export async function GET(context: APIContext): Promise<Response> {
   const previewVersionId = pinnedVersionId ?? sharedPreview.versionId;
 
   const pathname = url.pathname;
+  const publicationChannel =
+    sharedPreview.preview || context.locals.customizationEnv === "test" ? "preview" : "live";
   const fromPublication = await tryServePublicationRootAsset({
     tenant: context.locals.tenant,
     bucket: bucket as unknown as PublicationArtifactReadBucketV1,
     kvGet: (key) => kv.get(key),
     tenantId: urlTenant,
     pathname,
-    channel: sharedPreview.preview || context.locals.customizationEnv === "test" ? "preview" : "live",
+    channel: publicationChannel,
     ifNoneMatch: context.request.headers.get("if-none-match"),
   });
-  if (fromPublication) return fromPublication;
+  if (fromPublication) {
+    // Preview bytes answer a tokenless URL (the credential rides in a cookie), so
+    // they must never be cached where the next visitor of that URL would get them.
+    if (publicationChannel === "preview") {
+      fromPublication.headers.set("cache-control", "no-store");
+      fromPublication.headers.set("x-robots-tag", "noindex, nofollow");
+    }
+    return fromPublication;
+  }
 
   if (previewVersionId) {
     const overlay = await tryServePreviewRewriteOverlay({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -782,6 +782,16 @@ export const CONSPICUITY_FLOOR = Object.freeze({ contrast: 7, fontSizePx: 12, fo
 /** Bounds on the size a custom style may declare, so the bar cannot swallow the header. */
 const MAX_FONT_SIZE_PX = 24;
 
+/** Bounds on the optional box and spacing keys; an unset key renders the preset's own frame. */
+export const NICOTINE_WARNING_BOX_BOUNDS = Object.freeze({
+  borderWidthPx: Object.freeze({ min: 0, max: 8, integer: true }),
+  paddingYPx: Object.freeze({ min: 0, max: 24, integer: true }),
+  letterSpacingPx: Object.freeze({ min: 0, max: 4, integer: false }),
+});
+
+/** Weight 500 is allowed only on a boxed bar that is at least this large, contrasty and bordered. */
+export const MEDIUM_WEIGHT_REQUIREMENTS = Object.freeze({ fontSizePx: 16, contrast: 7, borderWidthPx: 2 });
+
 export const DEFAULT_NICOTINE_WARNING_PRESET = "dark";
 
 /**
@@ -816,6 +826,9 @@ export const NICOTINE_WARNING_PRESETS = Object.freeze({
  *   textTransform: "uppercase" | "none",
  *   fontWeight: number,
  *   fontSizePx: number,
+ *   borderWidthPx?: number,
+ *   paddingYPx?: number,
+ *   letterSpacingPx?: number,
  * }} NicotineWarningPresentation
  */
 
@@ -824,9 +837,10 @@ export const NICOTINE_WARNING_KEYS = Object.freeze(["preset", "style", "checkWid
 
 export const NICOTINE_WARNING_STYLE_KEYS = Object.freeze([
   "background", "text", "border", "textTransform", "fontWeight", "fontSizePx",
+  "borderWidthPx", "paddingYPx", "letterSpacingPx",
 ]);
 const TEXT_TRANSFORMS = ["uppercase", "none"];
-const FONT_WEIGHTS = [600, 700, 800, 900];
+const FONT_WEIGHTS = [500, 600, 700, 800, 900];
 const HEX = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
 
 /** `#abc` / `#AABBCC` → `#aabbcc`. */
@@ -865,7 +879,15 @@ export function conspicuityProblems(p) {
     out.push(`font size ${p.fontSizePx}px is below the ${CONSPICUITY_FLOOR.fontSizePx}px floor`);
   }
   if (p.fontWeight < CONSPICUITY_FLOOR.fontWeight) {
-    out.push(`font weight ${p.fontWeight} is below the ${CONSPICUITY_FLOOR.fontWeight} floor`);
+    const need = MEDIUM_WEIGHT_REQUIREMENTS;
+    const medium = p.fontWeight === 500 && p.fontSizePx >= need.fontSizePx && ratio >= need.contrast
+      && (p.borderWidthPx ?? 0) >= need.borderWidthPx;
+    if (!medium) {
+      out.push(`font weight ${p.fontWeight} is below the ${CONSPICUITY_FLOOR.fontWeight} floor` +
+        (p.fontWeight === 500
+          ? ` (500 needs font size >= ${need.fontSizePx}px, contrast >= ${need.contrast}:1 and borderWidthPx >= ${need.borderWidthPx})`
+          : ""));
+    }
   }
   return out;
 }
@@ -885,6 +907,14 @@ function styleValueProblem(key, value) {
       return typeof value === "number" && Number.isFinite(value) && value >= CONSPICUITY_FLOOR.fontSizePx && value <= MAX_FONT_SIZE_PX
         ? null
         : `\`fontSizePx\` must be a number from ${CONSPICUITY_FLOOR.fontSizePx} to ${MAX_FONT_SIZE_PX}`;
+    case "borderWidthPx":
+    case "paddingYPx":
+    case "letterSpacingPx": {
+      const { min, max, integer } = NICOTINE_WARNING_BOX_BOUNDS[key];
+      return typeof value === "number" && Number.isFinite(value) && value >= min && value <= max && (!integer || Number.isInteger(value))
+        ? null
+        : `\`${key}\` must be ${integer ? "a whole number" : "a number"} from ${min} to ${max}`;
+    }
     default:
       return `\`${key}\` is not a nicotine-warning style key (allowed: ${NICOTINE_WARNING_STYLE_KEYS.join(", ")})`;
   }
@@ -993,7 +1023,10 @@ export function nicotineWarningCheckWidths(declaration) {
  */
 export function describeNicotineWarningPresentation(p) {
   return `background ${p.background}, text ${p.text}, border ${p.border}, ` +
-    `${p.textTransform === "uppercase" ? "uppercase" : "normal case"}, weight ${p.fontWeight}, ${p.fontSizePx}px`;
+    `${p.textTransform === "uppercase" ? "uppercase" : "normal case"}, weight ${p.fontWeight}, ${p.fontSizePx}px` +
+    (p.borderWidthPx === undefined ? "" : `, border width ${p.borderWidthPx}px`) +
+    (p.paddingYPx === undefined ? "" : `, vertical padding ${p.paddingYPx}px`) +
+    (p.letterSpacingPx === undefined ? "" : `, letter spacing ${p.letterSpacingPx}px`);
 }
 
 /**
@@ -1017,11 +1050,12 @@ export function describeNicotineWarningPresentation(p) {
  */
 export function nicotineWarningHtml(declaration, variant) {
   const { presentation, preset } = resolveNicotineWarning(declaration);
+  const barPadding = presentation.paddingYPx === undefined ? "0.5rem" : `${presentation.paddingYPx}px`;
   const attrs = `style="${nicotineWarningStyle(presentation, variant)}" role="note" aria-label="Health warning" ` +
     `data-compliance="nicotine-warning" data-nicotine-warning-preset="${preset ?? "custom"}"`;
   const text = NICOTINE_WARNING_TEXT_LOCK;
   return variant === "bar"
-    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:0.5rem;text-align:center;${text}">${NICOTINE_WARNING_TEXT}</p></div>`
+    ? `<div ${attrs}><p class="container-prose" style="margin-block:0;padding-block:${barPadding};text-align:center;${text}">${NICOTINE_WARNING_TEXT}</p></div>`
     : `<div ${attrs}><p style="margin:0;${text}">${NICOTINE_WARNING_TEXT}</p></div>`;
 }
 
@@ -1061,15 +1095,17 @@ const NICOTINE_WARNING_TEXT_LOCK = [
  */
 export function nicotineWarningStyle(p, variant) {
   const size = variant === "block" ? Math.max(p.fontSizePx, 14) : p.fontSizePx;
+  const boxed = `${p.borderWidthPx ?? 2}px`;
   const frame = variant === "bar"
-    ? [`border-bottom:2px solid ${p.border}`]
-    : [`border:2px solid ${p.border}`, "border-radius:var(--radius-md)", "padding:0.75rem 1rem"];
+    ? [p.borderWidthPx === undefined ? `border-bottom:2px solid ${p.border}` : `border:${boxed} solid ${p.border}`]
+    : [`border:${boxed} solid ${p.border}`, "border-radius:var(--radius-md)",
+      `padding:${p.paddingYPx === undefined ? "0.75rem" : `${p.paddingYPx}px`} 1rem`];
   return [
     ...frame,
     `background-color:${p.background}`,
     `color:${p.text}`,
     `text-transform:${p.textTransform}`,
-    `letter-spacing:${p.textTransform === "uppercase" ? "0.06em" : "normal"}`,
+    `letter-spacing:${p.letterSpacingPx !== undefined ? `${p.letterSpacingPx}px` : p.textTransform === "uppercase" ? "0.06em" : "normal"}`,
     `font-weight:${p.fontWeight}`,
     `font-size:${size}px`,
     "line-height:1.4",

package/packages/public-runtime/package.json

@@ -10,6 +10,7 @@
   "exports": {
     ".": "./src/index.ts",
     "./blog-visibility": "./src/blog-visibility.mjs",
+    "./preview-url": "./src/preview-url.mjs",
     "./publication-redirects": "./src/publication-redirects.mjs",
     "./image-dependencies": "./src/image-dependencies.ts",
     "./image-finding-dependencies": "./src/image-finding-dependencies.ts",
@@ -25,6 +26,7 @@
     "./image-release-gate": "./src/image-release-gate.ts",
     "./pool-asset-headers": "./src/pool-asset-headers.ts",
     "./catalog-files": "./src/catalog-files.ts",
+    "./sku": "./src/sku.ts",
     "./embed-catalog": "./src/embed-catalog.mjs",
     "./retention-holds": "./src/retention-holds.ts",
     "./publication-content-redirects": "./src/publication-content-redirects.ts",

package/packages/public-runtime/src/checkout.ts

@@ -28,6 +28,7 @@ import { resolveStoreCurrency } from "./declared-tenant-config.mjs";
 import { DEFAULT_ONE_TIME_PURCHASE_OPTION } from "./product.js";
 import type { ShippingPolicy, TenantConfig } from "./tenant.js";
 import { isContentVersionId } from "./checkout-orders.js";
+import { skuToken } from "./sku.js";
 
 /** Stable commerce scope shared by signed carts, provider callers and operator authorization. */
 export function commerceTenantId(tenant: Pick<TenantConfig, "appDomain">): string {
@@ -501,13 +502,22 @@ export function resolveManagedCheckout(
 }
 
 /**
- * The checkout product code for a variant: its SKU, or its id when it has none. Every field
- * is hashed against it, and the final-cart authority finds a cart line's variant by it.
+ * The line identity of a variant across commerce: its stored SKU, or its id when it has none.
+ * Cart lines, holds, allocations and inventory movements are all keyed by it.
  */
-export function cartLineCode(variant: Pick<CatalogVariant, "id" | "sku">): string {
+export function cartLineKey(variant: Pick<CatalogVariant, "id" | "sku">): string {
   return variant.sku && variant.sku.length ? variant.sku : variant.id;
 }
 
+/**
+ * The checkout product code for a variant: its {@link cartLineKey} as a `skuToken`, so a SKU with
+ * a space or any other character still makes a token-safe code. Every field is hashed against it;
+ * the final-cart authority reads it back with `skuFromToken`.
+ */
+export function cartLineCode(variant: Pick<CatalogVariant, "id" | "sku">): string {
+  return skuToken(cartLineKey(variant));
+}
+
 /**
  * The raw (unsigned) cart fields for a variant: name, price, code, image, the
  * variant's options, and an editable quantity. `code` is the checkout product code

package/packages/public-runtime/src/preview-url.d.mts

@@ -0,0 +1,10 @@
+export const PREVIEW_URL_SHAPE: string;
+export function previewPath(store: string, subPath?: string): string;
+export function previewUrl(origin: string, store: string): string;
+export function previewPrUrl(origin: string, store: string, prNumber: number | string): string | null;
+export function previewRevUrl(origin: string, store: string, versionId: string): string;
+export function legacyPreviewLocation(
+  pathname: string,
+  search: string | undefined,
+  isStore: (segment: string) => boolean,
+): string | null;

package/packages/public-runtime/src/preview-url.mjs

@@ -0,0 +1,54 @@
+/**
+ * The one builder of preview URLs. A store's preview lives under the store, never under a
+ * `/preview/<store>` prefix:
+ *
+ *   <origin>/<store>/preview             the store's current shared preview
+ *   <origin>/<store>/preview/pr/<n>      candidate PR n
+ *   <origin>/<store>/preview/rev/<sha>/  an immutable revision
+ *
+ * Every producer (Worker, CLI) calls these; `apps/storefront/src/pages/preview/preview-url-routes.test.ts`
+ * resolves each shape against the page route table. `packages/cli/src/preview-url.mjs` is a
+ * byte-identical copy (a CLI test pins it).
+ */
+
+/** The canonical shapes, for messages that name the right URL. */
+export const PREVIEW_URL_SHAPE = "/<store>/preview[/pr/<n>]";
+
+function trimOrigin(origin) {
+  return String(origin).trim().replace(/\/+$/, "");
+}
+
+/** `/<store>/preview` with an optional sub-path (`/pr/5`). */
+export function previewPath(store, subPath = "") {
+  return `/${encodeURIComponent(store)}/preview${subPath}`;
+}
+
+export function previewUrl(origin, store) {
+  return `${trimOrigin(origin)}${previewPath(store)}`;
+}
+
+/** `null` when `prNumber` is not a positive integer. */
+export function previewPrUrl(origin, store, prNumber) {
+  const n = Number(prNumber);
+  if (!Number.isInteger(n) || n < 1) return null;
+  return `${trimOrigin(origin)}${previewPath(store, `/pr/${n}`)}`;
+}
+
+export function previewRevUrl(origin, store, versionId) {
+  return `${trimOrigin(origin)}${previewPath(store, `/rev/${encodeURIComponent(versionId)}/`)}`;
+}
+
+/**
+ * The canonical location for a legacy `/preview/<store>[/pr/<n>[/...]]` request, or `null` when
+ * the path is not that shape. `isStore` decides whether the first segment names a store
+ * (the caller owns what a store id looks like), so `/preview/pr/5`, `/preview/rev/...` and the
+ * other first-segment routes are never read as a store.
+ */
+export function legacyPreviewLocation(pathname, search, isStore) {
+  const m = /^\/preview\/([^/]+)(\/.*)?$/.exec(pathname);
+  if (!m) return null;
+  const store = m[1];
+  if (!/^[A-Za-z0-9.-]+$/.test(store) || !isStore(store)) return null;
+  const rest = (m[2] ?? "").replace(/\/+$/, "");
+  return `/${store}/preview${rest}${search ?? ""}`;
+}

package/packages/public-runtime/src/sku.ts

@@ -0,0 +1,19 @@
+/**
+ * The SKU contract for the platform. It lives once, in the agency kit's pure catalog module
+ * (`agency-kit/tools/lib/catalog-model/sku.mjs`), which the catalog file reader, the kit's tools
+ * and this runtime all import.
+ */
+export {
+  CHECKOUT_CODE_MAX_LENGTH,
+  SKU_MAX_LENGTH,
+  SKU_TOKEN_MAX_LENGTH,
+  isStoredSku,
+  parseSku,
+  skuCollisions,
+  skuFindings,
+  skuFromToken,
+  skuKey,
+  skuToken,
+  type SkuFinding,
+  type SkuRefusal,
+} from "../../../agency-kit/tools/lib/catalog-model/sku.mjs";

package/packages/public-runtime/src/tenant.ts

@@ -296,6 +296,9 @@ export interface NicotineWarningDeclaration {
     textTransform?: "uppercase" | "none";
     fontWeight?: number;
     fontSizePx?: number;
+    borderWidthPx?: number;
+    paddingYPx?: number;
+    letterSpacingPx?: number;
   };
 }