@tokenoftrust/storefront-runner 4.7.10 → 4.8.1

package/apps/storefront/src/lib/orders/admin/services/orders.ts

@@ -49,13 +49,85 @@ import type {
   OrderRelease,
   OrderRow,
   OrderShipState,
+  OrdersTodaySummary,
   OrdersViewModel,
 } from "../viewmodels/orders";
 import type { CheckoutOrderClient } from "../orderClient";
+import { DEFAULT_TIMEZONE } from "@tot/public-runtime/declared-tenant-config";
 
 const EVIDENCE_STATES: readonly EvidenceState[] = ["fresh", "not-required", "UNKNOWN", "stale", "unreadable", "absent"];
 const REFUND_PAYMENTS: ReadonlySet<PaymentState> = new Set(["refunded", "refund_requested", "refund_unknown"]);
 
+/** `YYYY-MM-DD` of an instant on the store's calendar. `null` when the instant does not parse. */
+export function storeDay(instant: string | Date, timeZone: string): string | null {
+  const at = typeof instant === "string" ? new Date(instant) : instant;
+  if (Number.isNaN(at.getTime())) return null;
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone, year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(at);
+  const part = (type: string) => parts.find((p) => p.type === type)?.value ?? "";
+  return `${part("year")}-${part("month")}-${part("day")}`;
+}
+
+/** An instant's clock time on the store's clock, e.g. `12:03 PM`. */
+export function formatStoreTime(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, hour: "numeric", minute: "2-digit" }).format(at);
+}
+
+/** An instant's date and clock time on the store's clock, e.g. `Oct 27, 12:03 PM`. */
+export function formatStoreDateTime(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, month: "short", day: "numeric", hour: "numeric", minute: "2-digit" }).format(at);
+}
+
+/** An instant's date on the store's calendar, e.g. `Oct 27`. */
+export function formatStoreDate(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, month: "short", day: "numeric" }).format(at);
+}
+
+/** A store day (`YYYY-MM-DD`) as `Oct 27`. */
+export function formatStoreDay(day: string): string {
+  const [y, m, d] = day.split("-").map(Number);
+  return new Intl.DateTimeFormat("en-US", { timeZone: "UTC", month: "short", day: "numeric" }).format(new Date(Date.UTC(y!, m! - 1, d!)));
+}
+
+/** The Today card when its orders could not be read: no figure is better than a wrong one. */
+export function unknownOrdersToday(timeZone: string = DEFAULT_TIMEZONE): OrdersTodaySummary {
+  return { grossSales: 0, paidOrders: 0, averageOrder: 0, refunds: 0, oldestOpenAt: null, day: null, timeZone };
+}
+
+/**
+ * Totals for the orders placed on the store's current calendar day. `rows` may span any dates;
+ * only those whose placement falls on `now`'s day in `timeZone` count. `oldestOpenAt` is not a
+ * today figure: it is the oldest order of `rows` that has not shipped, on any day.
+ */
+export function summarizeOrdersToday(
+  rows: readonly CheckoutOrderSummary[],
+  open: readonly CheckoutOrderSummary[] | null,
+  now: Date,
+  timeZone: string,
+): OrdersTodaySummary {
+  const day = storeDay(now, timeZone);
+  const today = rows.filter((r) => day !== null && storeDay(r.placedAt, timeZone) === day);
+  const paid = today.filter((r) => r.payment === "captured");
+  const cents = (rows: readonly CheckoutOrderSummary[]) => rows.reduce((sum, r) => sum + Math.round(r.total * 100), 0);
+  const grossSales = cents(paid) / 100;
+  const refunds = cents(today.filter((r) => r.payment === "refunded")) / 100;
+  const openAt = (open ?? []).filter((r) => r.fulfillment !== "completed").map((r) => r.placedAt).sort();
+  return {
+    grossSales,
+    paidOrders: paid.length,
+    averageOrder: paid.length ? Math.round((grossSales / paid.length) * 100) / 100 : 0,
+    refunds,
+    oldestOpenAt: openAt[0] ?? null,
+    day,
+    timeZone,
+  };
+}
+
 export interface SourcedState<T extends string = string> {
   state: T;
   source: string;
@@ -491,6 +563,7 @@ export function mapOrdersToViewModel(
   summaries: CheckoutOrderSummary[],
   details: Record<string, CheckoutOrderDetail>,
   scope: CommerceScope,
+  today: OrdersTodaySummary,
 ): OrdersViewModel {
   const rows = summaries.map(mapSummaryToRow);
   const detailsById: Record<string, OrderDetail> = {};
@@ -509,40 +582,23 @@ export function mapOrdersToViewModel(
         };
   }
 
-  const paidOrders = rows.filter((r) => r.payment === "captured");
-  const refunded = rows.filter((r) => r.payment === "refunded");
-  const grossSales = paidOrders.reduce((sum, r) => sum + r.total, 0);
-  const refunds = refunded.reduce((sum, r) => sum + r.total, 0);
-
   return {
     targetTenant,
     queues: buildQueues(rows),
     rows,
     detailsById,
-    today: {
-      grossSales,
-      paidOrders: paidOrders.length,
-      averageOrder: paidOrders.length ? Math.round((grossSales / paidOrders.length) * 100) / 100 : 0,
-      refunds,
-      oldestOpenAt: rows.length ? rows[rows.length - 1]!.placedAt : null,
-    },
+    today,
   };
 }
 
-export function emptyOrdersViewModel(targetTenant: string): OrdersViewModel {
+export function emptyOrdersViewModel(targetTenant: string, timeZone: string = DEFAULT_TIMEZONE): OrdersViewModel {
   const rows: OrderRow[] = [];
   return {
     targetTenant,
     queues: buildQueues(rows),
     rows,
     detailsById: {},
-    today: {
-      grossSales: 0,
-      paidOrders: 0,
-      averageOrder: 0,
-      refunds: 0,
-      oldestOpenAt: null,
-    },
+    today: unknownOrdersToday(timeZone),
   };
 }
 
@@ -551,6 +607,9 @@ export interface GetOrdersViewModelOptions {
   scope: CommerceScope;
   client: CheckoutOrderClient;
   filters?: Parameters<CheckoutOrderClient["listOrders"]>[0];
+  /** The store's declared IANA time zone (`resolveStoreTimeZone`); its calendar decides what "today" is. */
+  timeZone: string;
+  now?: Date;
 }
 
 export type OrdersLoadStatus = "loaded" | "empty" | "error" | "not_configured";
@@ -578,6 +637,45 @@ export function parseOrderFilters(params: URLSearchParams): CheckoutOrderListFil
   return f;
 }
 
+/** Most pages one whole-book read follows: 20 x 100 orders. */
+const WHOLE_BOOK_PAGES = 20;
+
+type WholeBook = { ok: true; orders: CheckoutOrderSummary[] } | { ok: false; reason: "unreadable" | "too-long" };
+
+/**
+ * Every order matching `filters`, page after page. Never a partial list: a book longer than
+ * `WHOLE_BOOK_PAGES` pages, or a page that cannot be read, is `ok: false`, because a total built
+ * from part of the book is the bug this exists to prevent.
+ */
+async function listWholeBook(client: CheckoutOrderClient, filters: CheckoutOrderListFilters): Promise<WholeBook> {
+  const orders: CheckoutOrderSummary[] = [];
+  let cursor: string | undefined;
+  for (let page = 0; page < WHOLE_BOOK_PAGES; page++) {
+    let read: Awaited<ReturnType<CheckoutOrderClient["listOrders"]>>;
+    try {
+      read = await client.listOrders({ ...filters, limit: 100, ...(cursor ? { cursor } : {}) });
+    } catch {
+      return { ok: false, reason: "unreadable" };
+    }
+    orders.push(...read.orders);
+    if (!read.page.nextCursor) return { ok: true, orders };
+    cursor = read.page.nextCursor;
+  }
+  return { ok: false, reason: "too-long" };
+}
+
+/** The Today card, read from the whole book so a queue filter or a page boundary never changes it. */
+async function readOrdersToday(client: CheckoutOrderClient, now: Date, timeZone: string): Promise<OrdersTodaySummary> {
+  // Two calendar days of slack: a store west of UTC starts its day up to a day behind UTC.
+  const since = new Date(now.getTime() - 48 * 60 * 60 * 1000).toISOString();
+  const [recent, open] = await Promise.all([
+    listWholeBook(client, { from: since }),
+    listWholeBook(client, { queue: "unfulfilled" }),
+  ]);
+  if (!recent.ok) return unknownOrdersToday(timeZone);
+  return summarizeOrdersToday(recent.orders, open.ok ? open.orders : null, now, timeZone);
+}
+
 export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions): Promise<OrdersLoadResult> {
   try {
     const { orders, page } = await opts.client.listOrders(opts.filters);
@@ -591,13 +689,14 @@ export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions):
         }
       }),
     );
+    const today = await readOrdersToday(opts.client, opts.now ?? new Date(), opts.timeZone);
     return {
       status: orders.length ? "loaded" : "empty",
-      vm: mapOrdersToViewModel(opts.targetTenant, orders, details, opts.scope),
+      vm: mapOrdersToViewModel(opts.targetTenant, orders, details, opts.scope, today),
       page,
     };
   } catch {
-    return { status: "error", vm: emptyOrdersViewModel(opts.targetTenant), page: null };
+    return { status: "error", vm: emptyOrdersViewModel(opts.targetTenant, opts.timeZone), page: null };
   }
 }
 

package/apps/storefront/src/lib/orders/admin/viewmodels/orders.ts

@@ -110,11 +110,18 @@ export interface OrderQueueSummary {
 }
 
 export interface OrdersTodaySummary {
+  /** Captured orders placed on the store's current day. */
   grossSales: number;
   paidOrders: number;
   averageOrder: number;
+  /** Refunded orders placed on the store's current day. */
   refunds: number;
+  /** The oldest order that has not shipped, on any day. Null when none is open or the book was not read whole. */
   oldestOpenAt: string | null;
+  /** The store calendar day (`YYYY-MM-DD`) these figures cover; null when the orders could not be read. */
+  day: string | null;
+  /** The IANA zone that calendar is read in. */
+  timeZone: string;
 }
 
 export interface OrdersViewModel {

package/apps/storefront/src/lib/orders/fixtures/orders.ts

@@ -177,6 +177,8 @@ function computeOrdersViewModel(envelope: AdminTenantEnvelope): OrdersViewModel
       averageOrder: paidOrders.length ? Math.round((grossSales / paidOrders.length) * 100) / 100 : 0,
       refunds: 0,
       oldestOpenAt,
+      day: null,
+      timeZone: "UTC",
     },
   };
 }

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -116,8 +116,9 @@ export async function POST(context: APIContext): Promise<Response> {
     const claims = await verifier.verify(idToken); // enforces aud === STOREFRONT_APP_DOMAIN
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/magic-exchange: id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return magicRedirect(context, { error: "verify_failed", tenant, emailHint, next });
   }
@@ -148,14 +149,11 @@ export async function POST(context: APIContext): Promise<Response> {
   try {
     const accepted = await acceptDeveloperInvite(tenant, derived.email);
     if (!accepted.accepted && !accepted.skipped) {
-      console.warn("auth/magic-exchange: invite accept did not record", {
-        tenant,
-        reason: accepted.reason,
-      });
+      console.warn("auth/magic-exchange: invite accept did not record", { reason: accepted.reason });
     }
   } catch (err) {
     console.warn("auth/magic-exchange: invite accept threw (swallowed)", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
   }
 
@@ -167,7 +165,6 @@ export async function POST(context: APIContext): Promise<Response> {
     const verification = await explainDeveloperAccess(tenant, derived.email, "accepted");
     if (verification.state === "broken") {
       console.warn("auth/magic-exchange: accepted invite does not resolve", {
-        tenant,
         failedStep: verification.failedStep,
       });
     }

package/apps/storefront/src/pages/api/auth/send.ts

@@ -20,7 +20,7 @@ import {
   devAuthEnabled,
   devAuthCode,
   storeDevCode,
-  DEV_AUTH_CODE_TTL_SECONDS,
+  deliverDevCode,
 } from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
@@ -46,22 +46,22 @@ export async function POST(context: APIContext): Promise<Response> {
   // dev guards in middleware/index.ts). It NEVER weakens the hosted path.
   //
   // On localhost tot20 isn't reachable, so no email can be sent. When a developer
-  // opts in with `DEV_AUTH=1` in `.dev.vars`, we instead mint a one-time code,
-  // store it in the SESSION KV, and PRINT it to the server console so the developer
-  // can complete sign-in locally. (The verify side that ACCEPTS this code + mints a
-  // session without tot20 is the security-sensitive half — see the handoff
-  // `2026-07-09-storefront-local-dev-auth-mode.md`; until it lands, the code is
-  // stored + printed but sign-in completes only once that verify path is wired.)
+  // opts in with `DEV_AUTH=1` in `.dev.vars`, we instead mint a one-time code, store
+  // it in the SESSION KV, and deliver it to the owner-private local outbox
+  // (`apps/storefront/.dev-auth/outbox.txt`). The code and address never reach the
+  // console or the response. /api/auth/verify consumes it (single use, 10 minutes).
   if (import.meta.env.DEV && (await devAuthEnabled())) {
     const kv = await readKv("SESSION");
     if (kv) {
       const code = devAuthCode();
       await storeDevCode(kv, email, code);
-      // eslint-disable-next-line no-console -- dev-only server-console code delivery
-      console.log(
-        `\n  🔑 [DEV AUTH] sign-in code for ${email}: ${code}\n` +
-          `     valid ${DEV_AUTH_CODE_TTL_SECONDS / 60}m · printed here only (no email in local dev)\n`,
-      );
+      if (!(await deliverDevCode(context.request, email, code))) {
+        // eslint-disable-next-line no-console -- dev-only diagnostic; no code, no address
+        console.warn(
+          "[DEV AUTH] could not deliver the sign-in code to the local outbox " +
+            "(is the dev-auth-outbox plugin registered in astro.config.mjs?).",
+        );
+      }
     } else {
       // eslint-disable-next-line no-console -- dev-only diagnostic
       console.warn(

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -94,8 +94,9 @@ export async function POST(context: APIContext): Promise<Response> {
     const claims = await verifier.verify(result.idToken); // enforces aud === STOREFRONT_APP_DOMAIN
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/step-up-verify: id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return loginRedirect(context, {
       sent: true,

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -19,6 +19,7 @@ import {
   getAccessClient,
   getSessionStore,
   setSessionCookie,
+  clearLoginEmailCookie,
   safeNext,
   loginRedirect,
 } from "@/lib/access/auth/route";
@@ -51,8 +52,8 @@ export async function POST(context: APIContext): Promise<Response> {
   // LOCAL DEV AUTH (verify side). `import.meta.env.DEV` is a STATIC boolean — this
   // whole branch (and the devAuth imports) are tree-shaken out of the production
   // build, so the hosted path below (offline JWKS verification, fail-closed) is
-  // never weakened. Second gate: the DEV_AUTH opt-in. Consume the console-printed
-  // code stored by /api/auth/send and mint a local session WITHOUT tot20 — the
+  // never weakened. Second gate: the DEV_AUTH opt-in. Consume the code stored by
+  // /api/auth/send (delivered to the private local outbox) and mint a local session WITHOUT tot20 — the
   // localhost completion of the invite→sign-in loop. See @/lib/auth/devAuth.
   if (import.meta.env.DEV && (await devAuthEnabled())) {
     const store = await getSessionStore();
@@ -72,6 +73,7 @@ export async function POST(context: APIContext): Promise<Response> {
       nowSeconds,
     );
     setSessionCookie(context, id, DEFAULT_SESSION_TTL_SECONDS);
+    clearLoginEmailCookie(context);
     return context.redirect(next, 303);
   }
 
@@ -127,8 +129,9 @@ export async function POST(context: APIContext): Promise<Response> {
     // Bind EVERY membership — no single-tenant scoping (multi-vendor picker input).
     derived = sessionFromFederatedClaims(claims);
   } catch (err) {
+    // The error class only: a verifier message can quote token claims (the address).
     console.error("auth/verify: federated id_token verification failed; failing closed", {
-      error: err instanceof Error ? err.message : String(err),
+      errorClass: err instanceof Error ? err.name : typeof err,
     });
     return loginRedirect(context, { sent: true, email, error: "verify_failed", next });
   }
@@ -155,5 +158,6 @@ export async function POST(context: APIContext): Promise<Response> {
     nowSeconds,
   );
   setSessionCookie(context, id, DEFAULT_SESSION_TTL_SECONDS);
+  clearLoginEmailCookie(context);
   return context.redirect(next, 303);
 }

package/apps/storefront/src/pages/auth/login.astro

@@ -11,7 +11,12 @@
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
 import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
-import { safeNext } from "@/lib/access/auth/route";
+import {
+  EMAIL_RE,
+  safeNext,
+  readLoginEmail,
+  setLoginEmailCookie,
+} from "@/lib/access/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -21,8 +26,19 @@ export const prerender = false;
 
 const cspNonce = Astro.locals.cspNonce;
 const url = new URL(Astro.request.url);
+// The in-progress address rides the HttpOnly login-email cookie, never the URL. A
+// legacy `?email=` link is canonicalized: the address moves to the cookie and the
+// page reloads without it, so it doesn't linger in history or Referer headers.
+if (url.searchParams.has("email")) {
+  const legacyEmail = (url.searchParams.get("email") ?? "").trim().toLowerCase();
+  if (EMAIL_RE.test(legacyEmail)) setLoginEmailCookie(Astro, legacyEmail);
+  const canonical = new URLSearchParams(url.searchParams);
+  canonical.delete("email");
+  const qs = canonical.toString();
+  return Astro.redirect(`/auth/login${qs ? `?${qs}` : ""}`, 302);
+}
 const sent = url.searchParams.get("sent") === "1";
-const email = (url.searchParams.get("email") ?? "").trim();
+const email = readLoginEmail(Astro);
 const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 const errorCode = url.searchParams.get("error");
 // Same open-redirect chokepoint the verify endpoint + login gate use — never a
@@ -56,7 +72,8 @@ const errorMessage = errorCode ? (ERROR_MESSAGES[errorCode] ?? "Something went w
 // A stale/failed code should drop back to the email step so a new code can be requested.
 const showCodeStep = sent && errorCode !== "expired" && errorCode !== "too_many_attempts";
 // Local-dev banner (statically dropped from prod). The message depends on the mode:
-// DEV_AUTH=1 → the console bypass is active (no email; code printed to the server console);
+// DEV_AUTH=1 → local codes are active (no email; the code goes to the owner-private
+// outbox file named in the dev-server log);
 // DEV_AUTH=0 → the REAL path is active (a code IS emailed by the configured tot20/qa, but
 // only to an address that already holds a role). Read the toggle so the banner never lies.
 const devMode = import.meta.env.DEV;
@@ -235,12 +252,13 @@ if (devMode) {
       </span>
       <p class="eyebrow">Token of Trust© · Regulated Storefront</p>
       {devMode && (devAuthOn ? (
-        <p class="dev"><strong>Local dev — console bypass</strong> (<code>DEV_AUTH=1</code>). No email is sent;
-        your sign-in code is printed to the <strong>server console</strong>. Set <code>DEV_AUTH=0</code> to use real emails.</p>
+        <p class="dev"><strong>Local dev — private outbox</strong> (<code>DEV_AUTH=1</code>). No email is sent;
+        your sign-in code is written to <code>apps/storefront/.dev-auth/outbox.txt</code> (readable only by you).
+        Set <code>DEV_AUTH=0</code> to use real emails.</p>
       ) : (
         <p class="dev"><strong>Local dev — live email</strong> (<code>DEV_AUTH=0</code>). A code is emailed by the
         configured tot20 (<code>TOT_CORE_URL</code>), but only to an address that already holds a role. Set
-        <code>DEV_AUTH=1</code> for offline console codes.</p>
+        <code>DEV_AUTH=1</code> for offline local codes.</p>
       ))}
       {errorMessage && <p class="err">{errorMessage}</p>}
 

package/apps/storefront/src/pages/auth/magic.astro

@@ -9,7 +9,7 @@
  * the token before the user ever clicked. So: NEVER exchange on GET. The token rides
  * in a hidden form field and leaves only via the POST.
  */
-import { normalizeEmailHint, redactEmailForHint } from "@/lib/access/privacy/emailHint";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -20,15 +20,12 @@ export const prerender = false;
 const cspNonce = Astro.locals.cspNonce;
 const url = new URL(Astro.request.url);
 const token = url.searchParams.get("token") ?? "";
-const legacyEmail = (url.searchParams.get("email") ?? "").trim(); // legacy display hint only
-const emailHint =
-  normalizeEmailHint(url.searchParams.get("email_hint")) ??
-  redactEmailForHint(legacyEmail) ??
-  "";
+// An `email` query parameter is never read, echoed or used to prefill: the address is
+// stripped from the URL and sign-in proceeds on the token alone.
+const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 if (url.searchParams.has("email")) {
   const canonical = new URLSearchParams(url.searchParams);
   canonical.delete("email");
-  if (emailHint) canonical.set("email_hint", emailHint);
   return Astro.redirect(
     `/auth/magic${canonical.toString() ? `?${canonical.toString()}` : ""}`,
     302,

package/apps/storefront/src/pages/index.astro

@@ -16,6 +16,7 @@ import Img from "@/components/assets/storefront/Img.astro";
 import PromoTiles from "@/components/content/storefront/content/PromoTiles.astro";
 import TrustStrip from "@/components/content/storefront/content/TrustStrip.astro";
 import Faq from "@/components/content/storefront/marketing/Faq.astro";
+import PostGrid from "@/components/content/storefront/blog/PostGrid.astro";
 import MarketingBlocks from "@/components/content/storefront/marketing/MarketingBlocks.astro";
 import TierCards from "@/components/membership/storefront/membership/TierCards.astro";
 import { withBase } from "@/lib/publication/shared/basePath";
@@ -41,11 +42,15 @@ import {
   editorialBlockView,
   editorialMediaView,
   homeBlockId,
+  latestPostsView,
   resolveCommerceStaticBlock,
   type CommerceStaticResolved,
+  type LatestPostsView,
 } from "@/lib/content/shared/homeVisualParity";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { collectionPathsV1, blogPathOptsV1 } from "@/lib/content/blog/collectionPaths.js";
 
-const { tenant, tot, content, basePath, apiBasePath, canonicalBase, features, capabilities } = Astro.locals;
+const { tenant, tot, content, basePath, apiBasePath, canonicalBase, features, capabilities, publicationTimestamp } = Astro.locals;
 const marketing = !features.catalog;
 
 // Raw-HTML home (vendor-injected): serve the tenant's own self-contained
@@ -109,6 +114,7 @@ type Resolved = (
   | { kind: "hero"; block: HeroBlock; product: CatalogProduct | null; instanceKey: string }
   | { kind: "collections"; title?: string; cols: CatalogCollection[] }
   | { kind: "products"; title?: string; products: CatalogProduct[]; presentation?: FeaturedProductsBlock["presentation"] }
+  | { kind: "latest_posts"; view: LatestPostsView }
   | CommerceStaticResolved
 ) & { blockId: string };
 
@@ -124,6 +130,20 @@ async function resolveProducts(
   );
 }
 
+// The blog is read only when a `latest_posts` block asks for it, through the same
+// listing the blog index renders, so this static home and /blog never disagree.
+const wantsLatestPosts = !marketing && home.blocks.some((block) => block.component === "latest_posts");
+const blogPosts = wantsLatestPosts
+  ? await listBlogPosts(tenant.tenant_id, content, publicationTimestamp)
+  : [];
+const blogPaths = wantsLatestPosts
+  ? collectionPathsV1(
+      Astro.locals,
+      "blog",
+      blogPathOptsV1(await getBlogSettings(tenant.tenant_id, content)),
+    )
+  : null;
+
 const resolved: Resolved[] = [];
 for (const [index, block] of (marketing ? [] : home.blocks).entries()) {
   const blockId = homeBlockId(block, index);
@@ -153,6 +173,11 @@ for (const [index, block] of (marketing ? [] : home.blocks).entries()) {
       resolved.push({ kind: "collections", title: block.title, cols, blockId });
       break;
     }
+    case "latest_posts": {
+      const view = blogPaths ? latestPostsView(block, blogPosts, blogPaths.index, basePath) : null;
+      if (view) resolved.push({ kind: "latest_posts", view, blockId });
+      break;
+    }
     case "featured_products": {
       const products = await resolveProducts(
         block.source,
@@ -364,6 +389,23 @@ const homeSectionWidgets = marketing
           </Section>
         );
       }
+      if (r.kind === "latest_posts") {
+        return (
+          <Section title={r.view.title} eyebrow={r.view.eyebrow} tone="bg" blockId={r.blockId}>
+            <PostGrid posts={r.view.posts} basePath={basePath} paths={blogPaths!} headingLevel="h3" eagerCount={0} />
+            {r.view.cta && (
+              <div class="mt-9 text-center">
+                <a
+                  href={r.view.cta.href}
+                  class="inline-flex rounded-full bg-[var(--color-primary)] px-6 py-3 font-display text-sm font-medium text-[var(--color-primary-contrast)]"
+                >
+                  {r.view.cta.label}
+                </a>
+              </div>
+            )}
+          </Section>
+        );
+      }
       if (r.kind === "faq") {
         return (
           <div data-block={r.blockId}>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.7.10",
+  "version": "4.8.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -19,7 +19,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "shipping",
+  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -69,6 +69,42 @@ export function currencyDeclarationProblems(currency) {
     : [`\`currency\` is ${JSON.stringify(currency)} — must be an uppercase ISO 4217 code such as "USD" or "CAD"`];
 }
 
+/** The IANA time zone a store's days are counted in when `.tot/config.json` declares none. */
+export const DEFAULT_TIMEZONE = "UTC";
+
+/**
+ * What is wrong with a declared `timezone`, one sentence; `[]` when it is valid. A valid one is
+ * an IANA zone name the runtime's Intl knows, such as "America/Los_Angeles" or "UTC"; a numeric
+ * offset is not a zone, so "today" would drift across daylight-saving changes.
+ *
+ * @param {unknown} timezone
+ * @returns {string[]}
+ */
+export function timezoneDeclarationProblems(timezone) {
+  const named = typeof timezone === "string" && /^[A-Za-z][A-Za-z0-9_+-]*(\/[A-Za-z0-9_+-]+)*$/.test(timezone);
+  if (named) {
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: /** @type {string} */ (timezone) });
+      return [];
+    } catch {
+      /* not a zone the runtime knows */
+    }
+  }
+  return [`\`timezone\` is ${JSON.stringify(timezone)} — must be an IANA time zone name such as "America/Los_Angeles" or "UTC"`];
+}
+
+/**
+ * The ONE place the time zone a store's days are counted in is resolved. A declared IANA zone
+ * wins; anything else (absent, wrong shape, unknown zone) is UTC. "Today", a daily total and an
+ * order's displayed time take the zone from here, never from the server's clock.
+ *
+ * @param {unknown} declared
+ * @returns {string}
+ */
+export function resolveStoreTimeZone(declared) {
+  return timezoneDeclarationProblems(declared).length === 0 ? /** @type {string} */ (declared) : DEFAULT_TIMEZONE;
+}
+
 
 /** Every `seo` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
 export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimSeoTitles", "structuredData"]);
@@ -737,6 +773,11 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
       out.push(mk(ERROR, "config-currency", file, `${problem} — the store sells in ${DEFAULT_CURRENCY} until it is fixed`));
     }
   }
+  if (config.timezone !== undefined) {
+    for (const problem of timezoneDeclarationProblems(config.timezone)) {
+      out.push(mk(ERROR, "config-timezone", file, `${problem} — the store counts its days in ${DEFAULT_TIMEZONE} until it is fixed`));
+    }
+  }
   if (config.seo !== undefined) {
     for (const problem of seoDeclarationProblems(config.seo)) {
       out.push(mk(ERROR, "config-seo", `${file} seo`, `${problem} — the whole \`seo\` declaration is ignored until it is fixed`));

package/packages/public-runtime/src/declared-tenant-config.d.mts

@@ -1,7 +1,7 @@
 /** Types for the dependency-free declared-tenant-config module (declared-tenant-config.mjs). */
 import type { TenantConfig } from "./tenant.js";
 
-export type DeclaredTenantConfigField = "displayName" | "siteType" | "compliance" | "capabilities" | "features" | "embeds" | "seo" | "currency" | "shipping";
+export type DeclaredTenantConfigField = "displayName" | "siteType" | "compliance" | "capabilities" | "features" | "embeds" | "seo" | "currency" | "timezone" | "shipping";
 export type DeclaredTenantConfig = Partial<Pick<TenantConfig, DeclaredTenantConfigField>>;
 
 export const DECLARED_TENANT_CONFIG_FIELDS: readonly DeclaredTenantConfigField[];
@@ -13,6 +13,9 @@ export const DEFAULT_CURRENCY: "USD";
 export const CURRENCY_CODES: readonly string[];
 export function resolveStoreCurrency(declared: unknown): string;
 export function currencyDeclarationProblems(currency: unknown): string[];
+export const DEFAULT_TIMEZONE: "UTC";
+export function resolveStoreTimeZone(declared: unknown): string;
+export function timezoneDeclarationProblems(timezone: unknown): string[];
 export const SEO_KEYS: readonly string[];
 export const STRUCTURED_DATA_KEYS: readonly string[];
 export const STRUCTURED_DATA_PAGE_TYPES: readonly import("./tenant.js").StructuredDataPageType[];