@tokenoftrust/storefront-runner 4.7.9 → 4.8.0

package/apps/storefront/src/components/content/storefront/blog/PostGrid.astro

@@ -10,9 +10,13 @@ interface Props {
   posts: BlogPostSummary[];
   basePath: string;
   paths: CollectionPathsV1;
+  /** Card title level. An archive page uses h2; a section under its own h2 uses h3. */
+  headingLevel?: "h2" | "h3";
+  /** Leading cards whose image loads eagerly. Below-the-fold placements pass 0. */
+  eagerCount?: number;
 }
 
-const { posts, basePath, paths } = Astro.props;
+const { posts, basePath, paths, headingLevel = "h2", eagerCount = 3 } = Astro.props;
 const href = (path: string) => `${basePath}${path}` || "/";
 ---
 
@@ -26,14 +30,14 @@ const href = (path: string) => `${basePath}${path}` || "/";
             alt={post.featuredImage.alt}
             width={post.featuredImage.width}
             height={post.featuredImage.height}
-            loading={index < 3 ? "eager" : "lazy"}
+            loading={index < eagerCount ? "eager" : "lazy"}
             decoding="async"
           />
         ) : <div class="image-placeholder" aria-hidden="true"></div>}
         <div class="post-card-copy">
           <p class="post-meta"><time datetime={post.publishedAt}>{new Date(post.publishedAt).toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" })}</time>{post.tags[0] && <> · {post.tags[0]}</>}</p>
           <PostAccessBadge access={post.access} />
-          <h2>{post.title}</h2>
+          {headingLevel === "h3" ? <h3>{post.title}</h3> : <h2>{post.title}</h2>}
           <p>{post.excerpt}</p>
           <span>Read article <span aria-hidden="true">→</span></span>
         </div>
@@ -50,7 +54,7 @@ const href = (path: string) => `${basePath}${path}` || "/";
   .post-card img, .image-placeholder { width: 100%; aspect-ratio: 16 / 9; object-fit: cover; background: linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 12%, white), color-mix(in srgb, var(--color-accent) 24%, white)); }
   .post-card-copy { display: flex; flex: 1; flex-direction: column; padding: 1.25rem; }
   .post-meta { margin: 0 0 .7rem; color: var(--color-muted); font: 600 .72rem/1.45 var(--font-mono); text-transform: uppercase; letter-spacing: .05em; }
-  .post-card h2 { font-size: 1.18rem; line-height: 1.25; }
+  .post-card h2, .post-card h3 { font-size: 1.18rem; line-height: 1.25; }
   .post-card-copy > p:not(.post-meta) { display: -webkit-box; margin: .75rem 0 1rem; overflow: hidden; color: var(--color-muted); font-size: .92rem; -webkit-line-clamp: 3; -webkit-box-orient: vertical; }
   .post-card-copy > span { margin-top: auto; color: var(--color-accent-ink); font-weight: 700; font-size: .88rem; }
   @media (max-width: 980px) { .post-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); } }

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -35,6 +35,9 @@
  * carries only the reason, the cause, elapsed ms, whether the action was held,
  * whether `FC.client` existed, Foxy's own full-page and bypass decisions, the
  * document ready state and viewport/screen/body widths — never a URL or session.
+ * A CSP refusal raised by the drawer's own scripts is the cause when nothing else
+ * failed (`csp-eval`, `csp-inline`, `csp-resource`): the page policy admits no
+ * eval, so a store template that carries an inline script breaks the drawer.
  *
  * Every cart open waits for this store's Foxy session. The id comes from the
  * same-origin session endpoint (an HttpOnly cookie the browser cannot read) and
@@ -271,6 +274,20 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     failure = cause;
     runHeld();
   }
+  // A drawer can report ready and still fail to render: the page CSP has no
+  // 'unsafe-eval', so a store template carrying an inline <script> (which the
+  // drawer's jQuery runs through eval) throws inside cart.render. A refusal raised
+  // by the drawer's own scripts is kept as the cause of a later fall-through.
+  var drawerOrigins = [cartOrigin];
+  try { drawerOrigins.push(new URL(src, document.baseURI).origin); } catch (e) {}
+  var cspRefusal = null;
+  document.addEventListener('securitypolicyviolation', function (event) {
+    var from = null;
+    try { from = new URL(event.sourceFile).origin; } catch (e) {}
+    if (!from || drawerOrigins.indexOf(from) === -1) return;
+    var blocked = event.blockedURI;
+    cspRefusal = 'csp-' + (blocked === 'eval' || blocked === 'inline' ? blocked : 'resource');
+  });
   // A cart action reaching the window unhandled after the drawer settled navigates
   // to the full cart page. Record why, with no URL or session in the record.
   function fallthrough(kind, el) {
@@ -284,9 +301,10 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       return !!(node && node.classList && (node.classList.contains('fc-sidecart--bypass') || node.hasAttribute('data-fc-sidecart-bypass')));
     }
     var reason = state === 'ready' ? 'drawer-declined' : 'drawer-unavailable';
+    var cause = failure || cspRefusal;
     var detail = {
       reason: reason,
-      cause: failure,
+      cause: cause,
       kind: kind,
       held: replaying === el,
       elapsedMs: armedAt ? Date.now() - armedAt : null,
@@ -298,7 +316,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       screenWidth: window.screen ? window.screen.availWidth : null,
       bodyWidth: body ? body.clientWidth : null
     };
-    document.documentElement.setAttribute('data-cart-fallthrough', reason + (failure ? ':' + failure : ''));
+    document.documentElement.setAttribute('data-cart-fallthrough', reason + (cause ? ':' + cause : ''));
     try { console.warn('[tot-cart] cart fell through to the cart page', detail); } catch (e) {}
     try { window.dispatchEvent(new window.CustomEvent('tot:cart-fallthrough', { detail: detail })); } catch (e) {}
   }

package/apps/storefront/src/lib/content/shared/homeVisualParity.ts

@@ -1,13 +1,18 @@
 import {
+  LATEST_POSTS_DEFAULT_LIMIT,
+  LATEST_POSTS_MAX_LIMIT,
   isPageBlockImageReference,
   isSafeStorefrontHref,
 } from "@tot/public-runtime";
 import { withBase } from "@/lib/publication/shared/basePath";
+import { categorySlug } from "@/lib/content/blog/collection.js";
+import type { BlogPostSummary } from "@/lib/content/blog/types.js";
 import type {
   CommerceTrustStripBlock,
   EditorialBlock,
   FaqBlock,
   HomeBlock,
+  LatestPostsBlock,
   MarketingBlock,
   MembershipBandBlock,
   NewsletterBlock,
@@ -142,6 +147,70 @@ export function editorialBlockView(block: EditorialBlock): EditorialBlockView {
   };
 }
 
+export interface LatestPostsView {
+  eyebrow?: string;
+  title: string;
+  posts: BlogPostSummary[];
+  cta: { label: string; href: string } | null;
+}
+
+const LATEST_POSTS_DEFAULT_TITLE = "Latest posts";
+const LATEST_POSTS_DEFAULT_CTA_LABEL = "View all";
+
+/** The card count a `latest_posts` block shows: a whole number from 1 to the cap, else the default. */
+export function latestPostsLimit(value: unknown): number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1
+    ? Math.min(value, LATEST_POSTS_MAX_LIMIT)
+    : LATEST_POSTS_DEFAULT_LIMIT;
+}
+
+/**
+ * The newest `limit` posts, newest first by `publishedAt` (an unreadable date sorts last, ties keep
+ * the collection's own order), narrowed to one tag when the block declares it. The caller passes
+ * the posts the live blog lists, so drafts and unlisted posts never reach this.
+ */
+export function selectLatestPosts(
+  posts: readonly BlogPostSummary[],
+  block: Pick<LatestPostsBlock, "limit" | "tag">,
+): BlogPostSummary[] {
+  const tag = declaredText(block.tag);
+  const wanted = tag === undefined ? null : categorySlug(tag);
+  const time = (post: BlogPostSummary) => {
+    const ms = Date.parse(post.publishedAt);
+    return Number.isNaN(ms) ? Number.NEGATIVE_INFINITY : ms;
+  };
+  return posts
+    .filter((post) => wanted === null || post.tags.some((term) => categorySlug(term) === wanted))
+    .map((post, index) => ({ post, index, at: time(post) }))
+    .sort((a, b) => (a.at === b.at ? a.index - b.index : b.at > a.at ? 1 : -1))
+    .slice(0, latestPostsLimit(block.limit))
+    .map((entry) => entry.post);
+}
+
+/**
+ * The `latest_posts` section, or null when the tenant has no post to show (a section with a
+ * heading and no cards is worse than none). `blogIndexPath` is the blog index the collection
+ * resolves for the serving space, tenant-relative; the declared `ctaHref` replaces it.
+ */
+export function latestPostsView(
+  block: LatestPostsBlock,
+  posts: readonly BlogPostSummary[],
+  blogIndexPath: string,
+  basePath: string,
+): LatestPostsView | null {
+  const selected = selectLatestPosts(posts, block);
+  if (selected.length === 0) return null;
+  const href = declaredText(block.ctaHref) ?? blogIndexPath;
+  return {
+    eyebrow: declaredText(block.eyebrow),
+    title: declaredText(block.title) ?? LATEST_POSTS_DEFAULT_TITLE,
+    posts: selected,
+    cta: isSafeStorefrontHref(href)
+      ? { label: declaredText(block.ctaLabel) ?? LATEST_POSTS_DEFAULT_CTA_LABEL, href: withBase(basePath, href) }
+      : null,
+  };
+}
+
 /**
  * The editorial block's media column: the block image, else generated art when
  * the block asks for it with `imageSeed`, else none — a text-only block.

package/apps/storefront/src/lib/content/storyblok/content-model.ts

@@ -26,9 +26,30 @@ export type HomeBlock = (
   | EditorialBlock
   | NewsletterBlock
   | FaqBlock
+  | LatestPostsBlock
 ) &
   BlockIdentity;
 
+/**
+ * The newest posts of the tenant's own blog as cards, rendered into the static
+ * home page at publish. Every prop is optional: `{ "component": "latest_posts" }`
+ * is a complete block. A tenant with no listable post renders nothing.
+ */
+export interface LatestPostsBlock {
+  component: "latest_posts";
+  eyebrow?: string;
+  /** Section heading. Absent uses the platform default. */
+  title?: string;
+  /** Cards shown, newest first. Positive integer up to 12; absent uses 3. */
+  limit?: number;
+  /** Only posts carrying this tag (matched by slug, so casing and spacing are free). */
+  tag?: string;
+  /** "View all" button label. Absent uses the platform default. */
+  ctaLabel?: string;
+  /** "View all" button target, a same-storefront path. Absent targets the blog index. */
+  ctaHref?: string;
+}
+
 export interface CommerceTrustStripBlock {
   component: "trust_strip";
   items: TrustStripItem[];

package/apps/storefront/src/lib/orders/admin/orderSource.ts

@@ -45,7 +45,8 @@ export type OrderSourceGap = "no-tenant" | "stage-unknown" | "ledger-unavailable
 export interface LedgerSyncStatus {
   orders: number;
   lastOrderAt: string | null;
-  unconfirmed: { count: number; oldestAt: string | null };
+  /** Reservations from the last 7 days no payment confirmation has reached; `awaiting` is those still inside the grace window. */
+  unconfirmed: { count: number; oldestAt: string | null; awaiting: number };
 }
 
 /** Which FoxyCart store takes this tenant's payments, or null when no store is selected. */
@@ -147,11 +148,18 @@ export function orderSyncHealth(source: OrderSource, status: LedgerSyncStatus |
   if (source.kind === "not-connected") return { value: "Not connected", detail: orderSourceGapMessage(source.gap) };
   if (source.kind === "partner-api") return { value: "Connected", detail: "Reads this store's checkout orders." };
   if (!status) return { value: "Check", detail: "Order sync status could not be read. Reload to try again." };
-  if (status.unconfirmed.count > 0) {
-    const n = status.unconfirmed.count;
+  const overdue = status.unconfirmed.count - status.unconfirmed.awaiting;
+  if (overdue > 0) {
     return {
       value: "Check",
-      detail: `${n} checkout${n === 1 ? "" : "s"} in the last 7 days passed final cart with no payment confirmation received.`,
+      detail: `${overdue} checkout${overdue === 1 ? "" : "s"} passed final cart more than ${PAYMENT_CONFIRMATION_GRACE_MINUTES} minutes ago with no payment confirmation received.`,
+    };
+  }
+  if (status.unconfirmed.awaiting > 0) {
+    const n = status.unconfirmed.awaiting;
+    return {
+      value: "Connected",
+      detail: `${n} checkout${n === 1 ? "" : "s"} passed final cart in the last ${PAYMENT_CONFIRMATION_GRACE_MINUTES} minutes; payment confirmation has not reached this store yet.`,
     };
   }
   return {
@@ -283,6 +291,14 @@ function listLimit(limit: number | undefined): number {
 /** A shopper who abandons at payment leaves a reservation too, so only recent ones are reported. */
 export const UNCONFIRMED_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
 
+/**
+ * A payment confirmation reaches the ledger after the shopper pays, not with the reservation. A
+ * reservation younger than this is awaiting one; an older one is reported as missing it. One
+ * measured delivery took over 7 minutes (2026-10-27), so the window leaves room beyond that.
+ */
+export const PAYMENT_CONFIRMATION_GRACE_MINUTES = 15;
+const PAYMENT_CONFIRMATION_GRACE_MS = PAYMENT_CONFIRMATION_GRACE_MINUTES * 60 * 1000;
+
 /**
  * Paid orders and sync status over one tenant's ledger book, read once per request. A `scrappy`
  * reservation is never listed as an order; one from the last seven days that no provider event
@@ -338,10 +354,15 @@ export function ledgerOrderBook(
       .map((entry) => isoInstant(entry.placedAt))
       .filter((at) => at >= since)
       .sort();
+    const settled = new Date(now.getTime() - PAYMENT_CONFIRMATION_GRACE_MS).toISOString();
     return {
       orders: orders.length,
       lastOrderAt: placed[placed.length - 1] ?? null,
-      unconfirmed: { count: waiting.length, oldestAt: waiting[0] ?? null },
+      unconfirmed: {
+        count: waiting.length,
+        oldestAt: waiting[0] ?? null,
+        awaiting: waiting.filter((at) => at > settled).length,
+      },
     };
   };
 

package/apps/storefront/src/lib/orders/admin/services/orders.ts

@@ -49,13 +49,85 @@ import type {
   OrderRelease,
   OrderRow,
   OrderShipState,
+  OrdersTodaySummary,
   OrdersViewModel,
 } from "../viewmodels/orders";
 import type { CheckoutOrderClient } from "../orderClient";
+import { DEFAULT_TIMEZONE } from "@tot/public-runtime/declared-tenant-config";
 
 const EVIDENCE_STATES: readonly EvidenceState[] = ["fresh", "not-required", "UNKNOWN", "stale", "unreadable", "absent"];
 const REFUND_PAYMENTS: ReadonlySet<PaymentState> = new Set(["refunded", "refund_requested", "refund_unknown"]);
 
+/** `YYYY-MM-DD` of an instant on the store's calendar. `null` when the instant does not parse. */
+export function storeDay(instant: string | Date, timeZone: string): string | null {
+  const at = typeof instant === "string" ? new Date(instant) : instant;
+  if (Number.isNaN(at.getTime())) return null;
+  const parts = new Intl.DateTimeFormat("en-US", { timeZone, year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(at);
+  const part = (type: string) => parts.find((p) => p.type === type)?.value ?? "";
+  return `${part("year")}-${part("month")}-${part("day")}`;
+}
+
+/** An instant's clock time on the store's clock, e.g. `12:03 PM`. */
+export function formatStoreTime(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, hour: "numeric", minute: "2-digit" }).format(at);
+}
+
+/** An instant's date and clock time on the store's clock, e.g. `Oct 27, 12:03 PM`. */
+export function formatStoreDateTime(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, month: "short", day: "numeric", hour: "numeric", minute: "2-digit" }).format(at);
+}
+
+/** An instant's date on the store's calendar, e.g. `Oct 27`. */
+export function formatStoreDate(instant: string, timeZone: string): string {
+  const at = new Date(instant);
+  if (Number.isNaN(at.getTime())) return "";
+  return new Intl.DateTimeFormat("en-US", { timeZone, month: "short", day: "numeric" }).format(at);
+}
+
+/** A store day (`YYYY-MM-DD`) as `Oct 27`. */
+export function formatStoreDay(day: string): string {
+  const [y, m, d] = day.split("-").map(Number);
+  return new Intl.DateTimeFormat("en-US", { timeZone: "UTC", month: "short", day: "numeric" }).format(new Date(Date.UTC(y!, m! - 1, d!)));
+}
+
+/** The Today card when its orders could not be read: no figure is better than a wrong one. */
+export function unknownOrdersToday(timeZone: string = DEFAULT_TIMEZONE): OrdersTodaySummary {
+  return { grossSales: 0, paidOrders: 0, averageOrder: 0, refunds: 0, oldestOpenAt: null, day: null, timeZone };
+}
+
+/**
+ * Totals for the orders placed on the store's current calendar day. `rows` may span any dates;
+ * only those whose placement falls on `now`'s day in `timeZone` count. `oldestOpenAt` is not a
+ * today figure: it is the oldest order of `rows` that has not shipped, on any day.
+ */
+export function summarizeOrdersToday(
+  rows: readonly CheckoutOrderSummary[],
+  open: readonly CheckoutOrderSummary[] | null,
+  now: Date,
+  timeZone: string,
+): OrdersTodaySummary {
+  const day = storeDay(now, timeZone);
+  const today = rows.filter((r) => day !== null && storeDay(r.placedAt, timeZone) === day);
+  const paid = today.filter((r) => r.payment === "captured");
+  const cents = (rows: readonly CheckoutOrderSummary[]) => rows.reduce((sum, r) => sum + Math.round(r.total * 100), 0);
+  const grossSales = cents(paid) / 100;
+  const refunds = cents(today.filter((r) => r.payment === "refunded")) / 100;
+  const openAt = (open ?? []).filter((r) => r.fulfillment !== "completed").map((r) => r.placedAt).sort();
+  return {
+    grossSales,
+    paidOrders: paid.length,
+    averageOrder: paid.length ? Math.round((grossSales / paid.length) * 100) / 100 : 0,
+    refunds,
+    oldestOpenAt: openAt[0] ?? null,
+    day,
+    timeZone,
+  };
+}
+
 export interface SourcedState<T extends string = string> {
   state: T;
   source: string;
@@ -491,6 +563,7 @@ export function mapOrdersToViewModel(
   summaries: CheckoutOrderSummary[],
   details: Record<string, CheckoutOrderDetail>,
   scope: CommerceScope,
+  today: OrdersTodaySummary,
 ): OrdersViewModel {
   const rows = summaries.map(mapSummaryToRow);
   const detailsById: Record<string, OrderDetail> = {};
@@ -509,40 +582,23 @@ export function mapOrdersToViewModel(
         };
   }
 
-  const paidOrders = rows.filter((r) => r.payment === "captured");
-  const refunded = rows.filter((r) => r.payment === "refunded");
-  const grossSales = paidOrders.reduce((sum, r) => sum + r.total, 0);
-  const refunds = refunded.reduce((sum, r) => sum + r.total, 0);
-
   return {
     targetTenant,
     queues: buildQueues(rows),
     rows,
     detailsById,
-    today: {
-      grossSales,
-      paidOrders: paidOrders.length,
-      averageOrder: paidOrders.length ? Math.round((grossSales / paidOrders.length) * 100) / 100 : 0,
-      refunds,
-      oldestOpenAt: rows.length ? rows[rows.length - 1]!.placedAt : null,
-    },
+    today,
   };
 }
 
-export function emptyOrdersViewModel(targetTenant: string): OrdersViewModel {
+export function emptyOrdersViewModel(targetTenant: string, timeZone: string = DEFAULT_TIMEZONE): OrdersViewModel {
   const rows: OrderRow[] = [];
   return {
     targetTenant,
     queues: buildQueues(rows),
     rows,
     detailsById: {},
-    today: {
-      grossSales: 0,
-      paidOrders: 0,
-      averageOrder: 0,
-      refunds: 0,
-      oldestOpenAt: null,
-    },
+    today: unknownOrdersToday(timeZone),
   };
 }
 
@@ -551,6 +607,9 @@ export interface GetOrdersViewModelOptions {
   scope: CommerceScope;
   client: CheckoutOrderClient;
   filters?: Parameters<CheckoutOrderClient["listOrders"]>[0];
+  /** The store's declared IANA time zone (`resolveStoreTimeZone`); its calendar decides what "today" is. */
+  timeZone: string;
+  now?: Date;
 }
 
 export type OrdersLoadStatus = "loaded" | "empty" | "error" | "not_configured";
@@ -578,6 +637,45 @@ export function parseOrderFilters(params: URLSearchParams): CheckoutOrderListFil
   return f;
 }
 
+/** Most pages one whole-book read follows: 20 x 100 orders. */
+const WHOLE_BOOK_PAGES = 20;
+
+type WholeBook = { ok: true; orders: CheckoutOrderSummary[] } | { ok: false; reason: "unreadable" | "too-long" };
+
+/**
+ * Every order matching `filters`, page after page. Never a partial list: a book longer than
+ * `WHOLE_BOOK_PAGES` pages, or a page that cannot be read, is `ok: false`, because a total built
+ * from part of the book is the bug this exists to prevent.
+ */
+async function listWholeBook(client: CheckoutOrderClient, filters: CheckoutOrderListFilters): Promise<WholeBook> {
+  const orders: CheckoutOrderSummary[] = [];
+  let cursor: string | undefined;
+  for (let page = 0; page < WHOLE_BOOK_PAGES; page++) {
+    let read: Awaited<ReturnType<CheckoutOrderClient["listOrders"]>>;
+    try {
+      read = await client.listOrders({ ...filters, limit: 100, ...(cursor ? { cursor } : {}) });
+    } catch {
+      return { ok: false, reason: "unreadable" };
+    }
+    orders.push(...read.orders);
+    if (!read.page.nextCursor) return { ok: true, orders };
+    cursor = read.page.nextCursor;
+  }
+  return { ok: false, reason: "too-long" };
+}
+
+/** The Today card, read from the whole book so a queue filter or a page boundary never changes it. */
+async function readOrdersToday(client: CheckoutOrderClient, now: Date, timeZone: string): Promise<OrdersTodaySummary> {
+  // Two calendar days of slack: a store west of UTC starts its day up to a day behind UTC.
+  const since = new Date(now.getTime() - 48 * 60 * 60 * 1000).toISOString();
+  const [recent, open] = await Promise.all([
+    listWholeBook(client, { from: since }),
+    listWholeBook(client, { queue: "unfulfilled" }),
+  ]);
+  if (!recent.ok) return unknownOrdersToday(timeZone);
+  return summarizeOrdersToday(recent.orders, open.ok ? open.orders : null, now, timeZone);
+}
+
 export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions): Promise<OrdersLoadResult> {
   try {
     const { orders, page } = await opts.client.listOrders(opts.filters);
@@ -591,13 +689,14 @@ export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions):
         }
       }),
     );
+    const today = await readOrdersToday(opts.client, opts.now ?? new Date(), opts.timeZone);
     return {
       status: orders.length ? "loaded" : "empty",
-      vm: mapOrdersToViewModel(opts.targetTenant, orders, details, opts.scope),
+      vm: mapOrdersToViewModel(opts.targetTenant, orders, details, opts.scope, today),
       page,
     };
   } catch {
-    return { status: "error", vm: emptyOrdersViewModel(opts.targetTenant), page: null };
+    return { status: "error", vm: emptyOrdersViewModel(opts.targetTenant, opts.timeZone), page: null };
   }
 }
 

package/apps/storefront/src/lib/orders/admin/viewmodels/orders.ts

@@ -110,11 +110,18 @@ export interface OrderQueueSummary {
 }
 
 export interface OrdersTodaySummary {
+  /** Captured orders placed on the store's current day. */
   grossSales: number;
   paidOrders: number;
   averageOrder: number;
+  /** Refunded orders placed on the store's current day. */
   refunds: number;
+  /** The oldest order that has not shipped, on any day. Null when none is open or the book was not read whole. */
   oldestOpenAt: string | null;
+  /** The store calendar day (`YYYY-MM-DD`) these figures cover; null when the orders could not be read. */
+  day: string | null;
+  /** The IANA zone that calendar is read in. */
+  timeZone: string;
 }
 
 export interface OrdersViewModel {

package/apps/storefront/src/lib/orders/fixtures/orders.ts

@@ -177,6 +177,8 @@ function computeOrdersViewModel(envelope: AdminTenantEnvelope): OrdersViewModel
       averageOrder: paidOrders.length ? Math.round((grossSales / paidOrders.length) * 100) / 100 : 0,
       refunds: 0,
       oldestOpenAt,
+      day: null,
+      timeZone: "UTC",
     },
   };
 }

package/apps/storefront/src/pages/index.astro

@@ -16,6 +16,7 @@ import Img from "@/components/assets/storefront/Img.astro";
 import PromoTiles from "@/components/content/storefront/content/PromoTiles.astro";
 import TrustStrip from "@/components/content/storefront/content/TrustStrip.astro";
 import Faq from "@/components/content/storefront/marketing/Faq.astro";
+import PostGrid from "@/components/content/storefront/blog/PostGrid.astro";
 import MarketingBlocks from "@/components/content/storefront/marketing/MarketingBlocks.astro";
 import TierCards from "@/components/membership/storefront/membership/TierCards.astro";
 import { withBase } from "@/lib/publication/shared/basePath";
@@ -41,11 +42,15 @@ import {
   editorialBlockView,
   editorialMediaView,
   homeBlockId,
+  latestPostsView,
   resolveCommerceStaticBlock,
   type CommerceStaticResolved,
+  type LatestPostsView,
 } from "@/lib/content/shared/homeVisualParity";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { collectionPathsV1, blogPathOptsV1 } from "@/lib/content/blog/collectionPaths.js";
 
-const { tenant, tot, content, basePath, apiBasePath, canonicalBase, features, capabilities } = Astro.locals;
+const { tenant, tot, content, basePath, apiBasePath, canonicalBase, features, capabilities, publicationTimestamp } = Astro.locals;
 const marketing = !features.catalog;
 
 // Raw-HTML home (vendor-injected): serve the tenant's own self-contained
@@ -109,6 +114,7 @@ type Resolved = (
   | { kind: "hero"; block: HeroBlock; product: CatalogProduct | null; instanceKey: string }
   | { kind: "collections"; title?: string; cols: CatalogCollection[] }
   | { kind: "products"; title?: string; products: CatalogProduct[]; presentation?: FeaturedProductsBlock["presentation"] }
+  | { kind: "latest_posts"; view: LatestPostsView }
   | CommerceStaticResolved
 ) & { blockId: string };
 
@@ -124,6 +130,20 @@ async function resolveProducts(
   );
 }
 
+// The blog is read only when a `latest_posts` block asks for it, through the same
+// listing the blog index renders, so this static home and /blog never disagree.
+const wantsLatestPosts = !marketing && home.blocks.some((block) => block.component === "latest_posts");
+const blogPosts = wantsLatestPosts
+  ? await listBlogPosts(tenant.tenant_id, content, publicationTimestamp)
+  : [];
+const blogPaths = wantsLatestPosts
+  ? collectionPathsV1(
+      Astro.locals,
+      "blog",
+      blogPathOptsV1(await getBlogSettings(tenant.tenant_id, content)),
+    )
+  : null;
+
 const resolved: Resolved[] = [];
 for (const [index, block] of (marketing ? [] : home.blocks).entries()) {
   const blockId = homeBlockId(block, index);
@@ -153,6 +173,11 @@ for (const [index, block] of (marketing ? [] : home.blocks).entries()) {
       resolved.push({ kind: "collections", title: block.title, cols, blockId });
       break;
     }
+    case "latest_posts": {
+      const view = blogPaths ? latestPostsView(block, blogPosts, blogPaths.index, basePath) : null;
+      if (view) resolved.push({ kind: "latest_posts", view, blockId });
+      break;
+    }
     case "featured_products": {
       const products = await resolveProducts(
         block.source,
@@ -364,6 +389,23 @@ const homeSectionWidgets = marketing
           </Section>
         );
       }
+      if (r.kind === "latest_posts") {
+        return (
+          <Section title={r.view.title} eyebrow={r.view.eyebrow} tone="bg" blockId={r.blockId}>
+            <PostGrid posts={r.view.posts} basePath={basePath} paths={blogPaths!} headingLevel="h3" eagerCount={0} />
+            {r.view.cta && (
+              <div class="mt-9 text-center">
+                <a
+                  href={r.view.cta.href}
+                  class="inline-flex rounded-full bg-[var(--color-primary)] px-6 py-3 font-display text-sm font-medium text-[var(--color-primary-contrast)]"
+                >
+                  {r.view.cta.label}
+                </a>
+              </div>
+            )}
+          </Section>
+        );
+      }
       if (r.kind === "faq") {
         return (
           <div data-block={r.blockId}>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.7.9",
+  "version": "4.8.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -19,7 +19,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "shipping",
+  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -69,6 +69,42 @@ export function currencyDeclarationProblems(currency) {
     : [`\`currency\` is ${JSON.stringify(currency)} — must be an uppercase ISO 4217 code such as "USD" or "CAD"`];
 }
 
+/** The IANA time zone a store's days are counted in when `.tot/config.json` declares none. */
+export const DEFAULT_TIMEZONE = "UTC";
+
+/**
+ * What is wrong with a declared `timezone`, one sentence; `[]` when it is valid. A valid one is
+ * an IANA zone name the runtime's Intl knows, such as "America/Los_Angeles" or "UTC"; a numeric
+ * offset is not a zone, so "today" would drift across daylight-saving changes.
+ *
+ * @param {unknown} timezone
+ * @returns {string[]}
+ */
+export function timezoneDeclarationProblems(timezone) {
+  const named = typeof timezone === "string" && /^[A-Za-z][A-Za-z0-9_+-]*(\/[A-Za-z0-9_+-]+)*$/.test(timezone);
+  if (named) {
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: /** @type {string} */ (timezone) });
+      return [];
+    } catch {
+      /* not a zone the runtime knows */
+    }
+  }
+  return [`\`timezone\` is ${JSON.stringify(timezone)} — must be an IANA time zone name such as "America/Los_Angeles" or "UTC"`];
+}
+
+/**
+ * The ONE place the time zone a store's days are counted in is resolved. A declared IANA zone
+ * wins; anything else (absent, wrong shape, unknown zone) is UTC. "Today", a daily total and an
+ * order's displayed time take the zone from here, never from the server's clock.
+ *
+ * @param {unknown} declared
+ * @returns {string}
+ */
+export function resolveStoreTimeZone(declared) {
+  return timezoneDeclarationProblems(declared).length === 0 ? /** @type {string} */ (declared) : DEFAULT_TIMEZONE;
+}
+
 
 /** Every `seo` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
 export const SEO_KEYS = Object.freeze(["trailingSlash", "verbatimSeoTitles", "structuredData"]);
@@ -737,6 +773,11 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
       out.push(mk(ERROR, "config-currency", file, `${problem} — the store sells in ${DEFAULT_CURRENCY} until it is fixed`));
     }
   }
+  if (config.timezone !== undefined) {
+    for (const problem of timezoneDeclarationProblems(config.timezone)) {
+      out.push(mk(ERROR, "config-timezone", file, `${problem} — the store counts its days in ${DEFAULT_TIMEZONE} until it is fixed`));
+    }
+  }
   if (config.seo !== undefined) {
     for (const problem of seoDeclarationProblems(config.seo)) {
       out.push(mk(ERROR, "config-seo", `${file} seo`, `${problem} — the whole \`seo\` declaration is ignored until it is fixed`));

package/packages/public-runtime/src/declared-tenant-config.d.mts

@@ -1,7 +1,7 @@
 /** Types for the dependency-free declared-tenant-config module (declared-tenant-config.mjs). */
 import type { TenantConfig } from "./tenant.js";
 
-export type DeclaredTenantConfigField = "displayName" | "siteType" | "compliance" | "capabilities" | "features" | "embeds" | "seo" | "currency" | "shipping";
+export type DeclaredTenantConfigField = "displayName" | "siteType" | "compliance" | "capabilities" | "features" | "embeds" | "seo" | "currency" | "timezone" | "shipping";
 export type DeclaredTenantConfig = Partial<Pick<TenantConfig, DeclaredTenantConfigField>>;
 
 export const DECLARED_TENANT_CONFIG_FIELDS: readonly DeclaredTenantConfigField[];
@@ -13,6 +13,9 @@ export const DEFAULT_CURRENCY: "USD";
 export const CURRENCY_CODES: readonly string[];
 export function resolveStoreCurrency(declared: unknown): string;
 export function currencyDeclarationProblems(currency: unknown): string[];
+export const DEFAULT_TIMEZONE: "UTC";
+export function resolveStoreTimeZone(declared: unknown): string;
+export function timezoneDeclarationProblems(timezone: unknown): string[];
 export const SEO_KEYS: readonly string[];
 export const STRUCTURED_DATA_KEYS: readonly string[];
 export const STRUCTURED_DATA_PAGE_TYPES: readonly import("./tenant.js").StructuredDataPageType[];

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -27,6 +27,7 @@ export const DECLARED_TENANT_CONFIG_FIELDS = Object.freeze([
   "embeds",
   "seo",
   "currency",
+  "timezone",
   "shipping",
 ]);
 
@@ -149,6 +150,42 @@ export function currencyDeclarationProblems(currency) {
     : [`\`currency\` is ${JSON.stringify(currency)} — must be an uppercase ISO 4217 code such as "USD" or "CAD"`];
 }
 
+/** The IANA time zone a store's days are counted in when `.tot/config.json` declares none. */
+export const DEFAULT_TIMEZONE = "UTC";
+
+/**
+ * What is wrong with a declared `timezone`, one sentence; `[]` when it is valid. A valid one is
+ * an IANA zone name the runtime's Intl knows, such as "America/Los_Angeles" or "UTC"; a numeric
+ * offset is not a zone, so "today" would drift across daylight-saving changes.
+ *
+ * @param {unknown} timezone
+ * @returns {string[]}
+ */
+export function timezoneDeclarationProblems(timezone) {
+  const named = typeof timezone === "string" && /^[A-Za-z][A-Za-z0-9_+-]*(\/[A-Za-z0-9_+-]+)*$/.test(timezone);
+  if (named) {
+    try {
+      new Intl.DateTimeFormat("en-US", { timeZone: /** @type {string} */ (timezone) });
+      return [];
+    } catch {
+      /* not a zone the runtime knows */
+    }
+  }
+  return [`\`timezone\` is ${JSON.stringify(timezone)} — must be an IANA time zone name such as "America/Los_Angeles" or "UTC"`];
+}
+
+/**
+ * The ONE place the time zone a store's days are counted in is resolved. A declared IANA zone
+ * wins; anything else (absent, wrong shape, unknown zone) is UTC. "Today", a daily total and an
+ * order's displayed time take the zone from here, never from the server's clock.
+ *
+ * @param {unknown} declared
+ * @returns {string}
+ */
+export function resolveStoreTimeZone(declared) {
+  return timezoneDeclarationProblems(declared).length === 0 ? /** @type {string} */ (declared) : DEFAULT_TIMEZONE;
+}
+
 const SITE_TYPES = new Set(SITE_TYPES_LIST);
 
 const isPlainObject = (value) =>
@@ -343,7 +380,7 @@ export function declaredTenantConfig(config) {
   /** @type {Record<string, unknown>} */
   const out = {};
   if (!isPlainObject(config)) return out;
-  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, shipping } = /** @type {Record<string, unknown>} */ (config);
+  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, timezone, shipping } = /** @type {Record<string, unknown>} */ (config);
   // The store's name as visitors read it: the `<title>` suffix, og:site_name,
   // Organization JSON-LD, breadcrumbs, the default blog heading, the copyright line.
   if (typeof displayName === "string" && displayName.trim()) out.displayName = displayName.trim();
@@ -356,6 +393,8 @@ export function declaredTenantConfig(config) {
   if (seo !== undefined && seoDeclarationProblems(seo).length === 0) out.seo = seo;
   // Wrong-shaped or unknown codes are omitted: the store sells in USD (`tot validate` reports it).
   if (currency !== undefined && currencyDeclarationProblems(currency).length === 0) out.currency = currency;
+  // Wrong-shaped or unknown zones are omitted: the store counts its days in UTC (`tot validate` reports it).
+  if (timezone !== undefined && timezoneDeclarationProblems(timezone).length === 0) out.timezone = timezone;
   // The shipping charge: refused whole when any part is malformed (`tot validate` and the
   // reconcile report it), so checkout keeps charging no shipping rather than a guess.
   if (shipping !== undefined && shippingDeclarationProblems(shipping).length === 0) {

package/packages/public-runtime/src/extension-contract-values.d.mts

@@ -1,4 +1,4 @@
-export declare const BLOCK_PALETTE_CURRENT_CONTRACT: "block-palette@7";
+export declare const BLOCK_PALETTE_CURRENT_CONTRACT: "block-palette@8";
 export declare const BLOCK_PALETTE_SUPPORTED_CONTRACTS: readonly [
   "block-palette@1",
   "block-palette@2",
@@ -7,8 +7,11 @@ export declare const BLOCK_PALETTE_SUPPORTED_CONTRACTS: readonly [
   "block-palette@5",
   "block-palette@6",
   "block-palette@7",
+  "block-palette@8",
 ];
 export declare const FEATURED_PRODUCT_PRESENTATIONS: readonly ["grid", "carousel"];
+export declare const LATEST_POSTS_DEFAULT_LIMIT: 3;
+export declare const LATEST_POSTS_MAX_LIMIT: 12;
 export declare const PROMO_TILE_PRESENTATIONS: readonly [
   "overlay",
   "portrait-cards",

package/packages/public-runtime/src/extension-contract-values.mjs

@@ -5,7 +5,7 @@
  * runtime and repository Node tooling. The separately published CLI mirrors
  * these values and pins that mirror with a parity test.
  */
-export const BLOCK_PALETTE_CURRENT_CONTRACT = "block-palette@7";
+export const BLOCK_PALETTE_CURRENT_CONTRACT = "block-palette@8";
 
 export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = Object.freeze([
   "block-palette@1",
@@ -14,11 +14,16 @@ export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = Object.freeze([
   "block-palette@4",
   "block-palette@5",
   "block-palette@6",
+  "block-palette@7",
   BLOCK_PALETTE_CURRENT_CONTRACT,
 ]);
 
 export const FEATURED_PRODUCT_PRESENTATIONS = Object.freeze(["grid", "carousel"]);
 
+/** `latest_posts` card count: the default when `limit` is absent, and the most a block may show. */
+export const LATEST_POSTS_DEFAULT_LIMIT = 3;
+export const LATEST_POSTS_MAX_LIMIT = 12;
+
 export const PROMO_TILE_PRESENTATIONS = Object.freeze([
   "overlay",
   "portrait-cards",

package/packages/public-runtime/src/extension-contract.ts

@@ -15,6 +15,8 @@ export {
   BLOCK_PALETTE_CURRENT_CONTRACT,
   BLOCK_PALETTE_SUPPORTED_CONTRACTS,
   FEATURED_PRODUCT_PRESENTATIONS,
+  LATEST_POSTS_DEFAULT_LIMIT,
+  LATEST_POSTS_MAX_LIMIT,
   PROMO_TILE_PRESENTATIONS,
   THEME_HEADING_LEVELS,
   imageSourceUrlRefusal,

package/packages/public-runtime/src/tenant.ts

@@ -524,6 +524,12 @@ export interface TenantConfig {
    * (declared-tenant-config.mjs), never as a literal.
    */
   currency: string;
+  /**
+   * The IANA time zone the store's days are counted in: the Orders "Today" total and the order
+   * times the admin shows. UTC unless `.tot/config.json` declares another; read it through
+   * `resolveStoreTimeZone` (declared-tenant-config.mjs), never as a literal.
+   */
+  timezone?: string;
   locale: string;
   /** Explicit publication spaces for this tenant, including one canonical root. */
   publicationSpaces?: readonly PublicationSpaceManifestV1[];

package/scripts/tenant/validate.mjs

@@ -34,6 +34,7 @@ import { listTenantDirIds, tenantDirSegments } from "../lib/tenant-dirs.mjs";
 import {
   BLOCK_PALETTE_SUPPORTED_CONTRACTS,
   FEATURED_PRODUCT_PRESENTATIONS,
+  LATEST_POSTS_MAX_LIMIT,
   PROMO_TILE_PRESENTATIONS,
   THEME_HEADING_LEVELS,
   isPageBlockImageReference,
@@ -364,6 +365,7 @@ const KNOWN_BLOCKS = new Set([
   "membership_band",
   "editorial",
   "newsletter",
+  "latest_posts",
   "marketing_hero",
   "trust_bar",
   "split_compare",
@@ -584,6 +586,20 @@ function validateEditorial(block, file, at, out) {
   }
 }
 
+function validateLatestPosts(block, file, at, out) {
+  if (block.limit !== undefined && (!Number.isInteger(block.limit) || block.limit < 1 || block.limit > LATEST_POSTS_MAX_LIMIT)) {
+    out.push(mk(ERROR, "block-prop", file, `${at}.limit must be a whole number from 1 to ${LATEST_POSTS_MAX_LIMIT}`));
+  }
+  for (const prop of ["eyebrow", "title", "tag", "ctaLabel", "ctaHref"]) {
+    if (block[prop] !== undefined && (typeof block[prop] !== "string" || !block[prop].trim())) {
+      out.push(mk(ERROR, "block-prop", file, `${at}.${prop} must be a non-empty string`));
+    }
+  }
+  if (typeof block.ctaHref === "string" && block.ctaHref.trim() && !isSafeStorefrontHref(block.ctaHref)) {
+    out.push(mk(ERROR, "navigation-href", file, `${at}.ctaHref must be a same-storefront root-relative path`));
+  }
+}
+
 function validateHomeDoc(doc, file, tenantId) {
   const out = [];
   if (doc == null || typeof doc !== "object" || Array.isArray(doc)) {
@@ -648,6 +664,7 @@ function validateHomeDoc(doc, file, tenantId) {
     if (component === "promo_tiles") validatePromoTiles(block, file, at, out, tenantId);
     if (component === "trust_strip") validateTrustStrip(block, file, at, out, tenantId);
     if (component === "faq") validateFaq(block, file, at, out);
+    if (component === "latest_posts") validateLatestPosts(block, file, at, out);
   });
   return out;
 }