astroidjs 0.6.0 → 0.7.1

package/dist/commerce/adapters.d.ts

@@ -1,16 +1,42 @@
 import type { CatalogItem } from "./sync.js";
+/** Where a Square object is sold, as `louise-toolkit/commerce/square` reports it.
+ *  Optional throughout, so an item assembled by hand or by an older client still
+ *  satisfies the type and reads as "sold everywhere". */
+export interface SquarePresenceLike {
+    presentAtAllLocations?: boolean;
+    presentAtLocationIds?: string[];
+    absentAtLocationIds?: string[];
+}
+/** A per-location price override. A null/absent `priceCents` means the override
+ *  adjusts something other than price, and the base price still applies. */
+export interface SquareLocationOverrideLike {
+    locationId: string;
+    priceCents?: number | null;
+    currency?: string | null;
+    soldOut?: boolean | null;
+}
 /** The subset of `SquareCatalogItem` the mirror reads. */
-export interface SquareItemLike {
+export interface SquareItemLike extends SquarePresenceLike {
     id: string;
     name: string;
     imageUrl?: string | null;
-    variations?: {
+    variations?: ({
         id: string;
         name: string;
         sku?: string | null;
+        /** The BASE price. A location override wins over it where one exists. */
         priceCents: number;
         currency?: string;
-    }[];
+        locationOverrides?: SquareLocationOverrideLike[];
+    } & SquarePresenceLike)[];
+}
+/** Options for {@link squareToCatalogItem}. */
+export interface SquareAdapterOptions {
+    /**
+     * Resolve prices and presence for one merchant location. Omit for a
+     * single-location account, where base prices are the only prices.
+     */
+    locationId?: string;
 }
 /** The subset of `FwProduct` the mirror reads. */
 export interface FourthwallProductLike {
@@ -32,6 +58,22 @@ export interface FourthwallProductLike {
         attributes?: unknown;
     }[];
 }
+/**
+ * Is this item sold at `locationId` at all?
+ *
+ * Exported because a location-scoped sync needs to SKIP items the merchant
+ * doesn't carry, and `squareToCatalogItem` can't do that for you — it returns
+ * one item, and "don't store this row" isn't a `CatalogItem`. Without the guard
+ * an unstocked item mirrors as a $0 card with no variants, which looks like a
+ * pricing bug rather than a catalog decision.
+ *
+ * ```ts
+ * const rows = items
+ *   .filter((i) => squareItemSoldAt(i, locationId))
+ *   .map((i) => squareToCatalogItem(i, { locationId }));
+ * ```
+ */
+export declare function squareItemSoldAt(item: SquareItemLike, locationId: string): boolean;
 /**
  * Square item → `CatalogItem`.
  *
@@ -39,8 +81,26 @@ export interface FourthwallProductLike {
  * beans" with 12oz and 2lb variations), so a single headline number has to mean
  * "from" — taking the first variation's price instead would change with Square's
  * ordering and quietly misprice the card.
+ *
+ * ## Scoping to one merchant
+ *
+ * Pass `locationId` and both halves resolve at that location: variations the
+ * merchant doesn't carry are dropped, and the rest price through
+ * `location_overrides` rather than the base price.
+ *
+ * The headline number has to be scoped for the same reason the variants are.
+ * "From $8" computed over the whole catalog, on a page where the $8 size isn't
+ * stocked, advertises a price this merchant will never honour — and because the
+ * dropped variation is usually the cheap one, the error runs in the direction a
+ * customer notices at the till.
+ *
+ * Unscoped behaviour is unchanged: no `locationId` means base prices and every
+ * variation, which is correct for a single-location account.
+ *
+ * An item sold nowhere at `locationId` yields no variants and a price of 0 —
+ * filter with {@link squareItemSoldAt} before calling rather than storing that.
  */
-export declare function squareToCatalogItem(item: SquareItemLike): CatalogItem;
+export declare function squareToCatalogItem(item: SquareItemLike, options?: SquareAdapterOptions): CatalogItem;
 /**
  * Fourthwall product → `CatalogItem`. Same "lowest variant wins" rule as Square,
  * for the same reason.

package/dist/commerce/adapters.js

@@ -13,9 +13,49 @@
 // shape the mirror stores. Deliberately pure — they take the provider's objects,
 // not credentials or an `env`, so they're trivially testable and the caller
 // keeps control of how the fetch happens (cached, paged, rate-limited).
+/**
+ * Is this object sold at `locationId`?
+ *
+ * Mirrors `presentAt` in `louise-toolkit/commerce/square`, but tolerant of the
+ * fields being absent. The two lists are NOT symmetric — `presentAtLocationIds`
+ * is a whitelist consulted when `presentAtAllLocations` is false,
+ * `absentAtLocationIds` a blacklist consulted when it is true. Reading them the
+ * other way round shows a merchant products they do not carry.
+ */
+function presentAtLocation(o, locationId) {
+    return o.presentAtAllLocations === false
+        ? (o.presentAtLocationIds ?? []).includes(locationId)
+        : !(o.absentAtLocationIds ?? []).includes(locationId);
+}
+/** The effective price of a variation at one location: the override's price if
+ *  it sets one, otherwise the base price. */
+function variationPriceAt(v, locationId) {
+    const override = (v.locationOverrides ?? []).find((o) => o.locationId === locationId);
+    return override?.priceCents != null ? override.priceCents : v.priceCents;
+}
 /** Minor units → major. Square prices in cents; the mirror stores dollars, since
  *  that's what a template renders and what an owner types into an overlay. */
 const toMajor = (cents) => Math.round(cents) / 100;
+/**
+ * Is this item sold at `locationId` at all?
+ *
+ * Exported because a location-scoped sync needs to SKIP items the merchant
+ * doesn't carry, and `squareToCatalogItem` can't do that for you — it returns
+ * one item, and "don't store this row" isn't a `CatalogItem`. Without the guard
+ * an unstocked item mirrors as a $0 card with no variants, which looks like a
+ * pricing bug rather than a catalog decision.
+ *
+ * ```ts
+ * const rows = items
+ *   .filter((i) => squareItemSoldAt(i, locationId))
+ *   .map((i) => squareToCatalogItem(i, { locationId }));
+ * ```
+ */
+export function squareItemSoldAt(item, locationId) {
+    if (!presentAtLocation(item, locationId))
+        return false;
+    return (item.variations ?? []).some((v) => presentAtLocation(v, locationId));
+}
 /**
  * Square item → `CatalogItem`.
  *
@@ -23,20 +63,53 @@ const toMajor = (cents) => Math.round(cents) / 100;
  * beans" with 12oz and 2lb variations), so a single headline number has to mean
  * "from" — taking the first variation's price instead would change with Square's
  * ordering and quietly misprice the card.
+ *
+ * ## Scoping to one merchant
+ *
+ * Pass `locationId` and both halves resolve at that location: variations the
+ * merchant doesn't carry are dropped, and the rest price through
+ * `location_overrides` rather than the base price.
+ *
+ * The headline number has to be scoped for the same reason the variants are.
+ * "From $8" computed over the whole catalog, on a page where the $8 size isn't
+ * stocked, advertises a price this merchant will never honour — and because the
+ * dropped variation is usually the cheap one, the error runs in the direction a
+ * customer notices at the till.
+ *
+ * Unscoped behaviour is unchanged: no `locationId` means base prices and every
+ * variation, which is correct for a single-location account.
+ *
+ * An item sold nowhere at `locationId` yields no variants and a price of 0 —
+ * filter with {@link squareItemSoldAt} before calling rather than storing that.
  */
-export function squareToCatalogItem(item) {
-    const prices = (item.variations ?? []).map((v) => v.priceCents).filter((c) => Number.isFinite(c));
+export function squareToCatalogItem(item, options = {}) {
+    const locationId = options.locationId;
+    const variations = (item.variations ?? []).filter((v) => locationId === undefined || presentAtLocation(v, locationId));
+    const priceOf = (v) => locationId === undefined ? v.priceCents : variationPriceAt(v, locationId);
+    const prices = variations.map(priceOf).filter((c) => Number.isFinite(c));
     return {
         externalId: item.id,
         name: item.name,
         price: prices.length ? toMajor(Math.min(...prices)) : 0,
         images: item.imageUrl ? [item.imageUrl] : [],
-        variants: (item.variations ?? []).map((v) => ({
+        variants: variations.map((v) => ({
             id: v.id,
             name: v.name,
             sku: v.sku ?? null,
-            price: toMajor(v.priceCents),
-            currency: v.currency ?? "USD",
+            price: toMajor(priceOf(v)),
+            currency: (locationId === undefined
+                ? undefined
+                : (v.locationOverrides ?? []).find((o) => o.locationId === locationId)?.currency) ??
+                v.currency ??
+                "USD",
+            // Only meaningful when scoped: `sold_out` is a per-location flag, so an
+            // unscoped read has no single answer and omits it rather than guessing.
+            ...(locationId === undefined
+                ? {}
+                : {
+                    soldOut: (v.locationOverrides ?? []).find((o) => o.locationId === locationId)?.soldOut ??
+                        false,
+                }),
         })),
     };
 }

package/dist/commerce/checkout-scaffold.js

@@ -20,7 +20,7 @@
 // redirects to its own hosted checkout (no card token to charge) and Stripe has
 // no catalog API, so it fills the `invoicing` role rather than `storefront`.
 import { astroidCatalogMirror } from "./mirror.js";
-import { astroidCommerceProviders, astroidCommerceRoles } from "./roles.js";
+import { astroidCommerceProviders, astroidCommerceRoles, hasMultiLocation } from "./roles.js";
 /** Does this project take card payments in-page? Square storefront only. */
 export function usesCardCheckout(config) {
     return astroidCommerceRoles(config.commerce).storefront === "square";
@@ -38,6 +38,7 @@ export function generateAstroidCheckoutRoute(config) {
     if (!usesCardCheckout(config))
         return null;
     const { table } = astroidCatalogMirror(config);
+    const multi = hasMultiLocation(config.commerce);
     return [
         "// Server-authoritative checkout (POST /api/checkout).",
         "//",
@@ -45,9 +46,18 @@ export function generateAstroidCheckoutRoute(config) {
         "// receipt email all belong here. What should NOT change is the ORDER of the",
         "// steps below; each one is load-bearing:",
         "//",
-        "//   1. Re-price every line from the D1 catalog mirror. The client's price is",
-        "//      a STALENESS CHECK, never an input to the charge. Accept `unitPrice`",
-        "//      from the request body and anyone can buy anything for a penny.",
+        multi
+            ? "//   0. Resolve WHICH MERCHANT this sale belongs to, from the host — never\n" +
+                "//      from the request body. See `resolveLocationId` below."
+            : null,
+        multi
+            ? "//   1. Re-price every line AT THAT LOCATION, live from Square. The client's\n" +
+                "//      price is a STALENESS CHECK, never an input to the charge. Accept\n" +
+                "//      `unitPrice` from the request body and anyone can buy anything for a\n" +
+                "//      penny."
+            : "//   1. Re-price every line from the D1 catalog mirror. The client's price is\n" +
+                "//      a STALENESS CHECK, never an input to the charge. Accept `unitPrice`\n" +
+                "//      from the request body and anyone can buy anything for a penny.",
         "//   2. Refuse on mismatch rather than charging the server's number silently.",
         "//      Being charged more than the page said is worse than being asked to",
         "//      review the cart.",
@@ -57,40 +67,99 @@ export function generateAstroidCheckoutRoute(config) {
         "//   4. Charge only when commerce is actually provisioned. With placeholder",
         "//      secrets this simulates instead — it must never call Square with a",
         "//      dummy credential.",
+        multi
+            ? "//\n" +
+                "// Step 4 runs BEFORE step 1 here, and only here: per-location re-pricing is\n" +
+                "// itself a Square call, so the provisioning check has to come first or the\n" +
+                "// rule above is broken by the very step that enforces it."
+            : null,
         'import type { APIRoute } from "astro";',
         'import { env } from "cloudflare:workers";',
         "import {",
         "  checkoutIdempotencyKey,",
-        "  readCatalog,",
+        multi ? null : "  readCatalog,",
         "  resolveCommerceStatus,",
         "  type SecretSource,",
         "  verifyCheckout,",
         '} from "astroidjs";',
-        'import { createPayment } from "louise-toolkit/commerce/square";',
+        multi
+            ? 'import { createPayment, retrieveVariationPricesAt } from "louise-toolkit/commerce/square";'
+            : 'import { createPayment } from "louise-toolkit/commerce/square";',
         'import { isSameOrigin } from "louise-toolkit/security";',
         'import astroidConfig from "../../../astroid.config.js";',
         "",
         "export const prerender = false;",
         "",
-        "/** Server-side prices, in minor units, straight from the catalog mirror. */",
-        "async function serverPrices(variantIds: string[]): Promise<Map<string, number>> {",
-        "  // `readCatalog` returns the product ARRAY (published only by default).",
-        "  const items = await readCatalog({",
-        "    db: env.DB,",
-        `    table: ${JSON.stringify(table)},`,
-        "  });",
-        "  const prices = new Map<string, number>();",
-        "  for (const item of items) {",
-        "    // The mirror stores MAJOR units (dollars); the charge is in minor units.",
-        "    // `Math.round` is not decoration — 19.99 * 100 is 1998.9999999999998, and",
-        "    // a float cent here fails the exact-equality staleness check on every",
-        "    // single checkout.",
-        "    if (variantIds.includes(item.externalId)) {",
-        "      prices.set(item.externalId, Math.round(item.price * 100));",
-        "    }",
-        "  }",
-        "  return prices;",
-        "}",
+        ...(multi
+            ? [
+                "// ── Which merchant is this? ────────────────────────────────────────────────",
+                "//",
+                '// `square.locations: "multi"` means the location is a property of the',
+                "// REQUEST, not of the environment — which is why Astroid does not require a",
+                "// SQUARE_LOCATION_ID for this project. Fill this in and keep two rules:",
+                "//",
+                "//   * Derive it from the HOST (or an authenticated session), never from the",
+                "//     request body. A body-supplied location lets a customer name the",
+                "//     cheapest merchant's id and pay that price at the dearest merchant's",
+                "//     shop — the same exploit as a client-supplied price, one level back.",
+                "//   * Return null for anything unrecognised. Falling back to a default",
+                "//     rings one merchant's sale against another merchant's books, and looks",
+                "//     completely successful while doing it.",
+                "//",
+                "// Returning null refuses the checkout. That is deliberate: an unwired",
+                "// multi-merchant store should take no money rather than the wrong money.",
+                "function resolveLocationId(request: Request): string | null {",
+                "  const host = new URL(request.url).hostname.toLowerCase();",
+                "  // TODO(you): map host → Square location id (a constant map here, a D1",
+                "  // lookup, or `tenantLabel` from astroidjs if you use Astroid tenancy).",
+                "  const locations: Record<string, string> = {};",
+                "  return locations[host] ?? null;",
+                "}",
+                "",
+                "/** Server-side prices, in minor units, at ONE merchant's location. */",
+                "async function serverPrices(",
+                "  variantIds: string[],",
+                "  scope?: { locationId?: string },",
+                "): Promise<Map<string, number>> {",
+                "  // Live from Square rather than the D1 mirror, and not by preference: the",
+                "  // mirror holds ONE price per item, so it structurally cannot answer",
+                '  // "what does this cost at this location". `retrieveVariationPricesAt`',
+                "  // resolves `location_overrides`, and omits any variation the merchant",
+                "  // does not carry — so an unstocked id fails closed as `unavailable`",
+                "  // instead of silently selling at the base price.",
+                "  const locationId = scope?.locationId;",
+                "  if (!locationId) return new Map();",
+                "  const environment =",
+                '    env.SQUARE_ENVIRONMENT === "production" ? "production" : "sandbox";',
+                "  const money = await retrieveVariationPricesAt(",
+                '    { accessToken: env.SQUARE_ACCESS_TOKEN ?? "", environment },',
+                "    variantIds,",
+                "    locationId,",
+                "  );",
+                "  return new Map([...money].map(([id, m]) => [id, m.amount]));",
+                "}",
+            ]
+            : [
+                "/** Server-side prices, in minor units, straight from the catalog mirror. */",
+                "async function serverPrices(variantIds: string[]): Promise<Map<string, number>> {",
+                "  // `readCatalog` returns the product ARRAY (published only by default).",
+                "  const items = await readCatalog({",
+                "    db: env.DB,",
+                `    table: ${JSON.stringify(table)},`,
+                "  });",
+                "  const prices = new Map<string, number>();",
+                "  for (const item of items) {",
+                "    // The mirror stores MAJOR units (dollars); the charge is in minor units.",
+                "    // `Math.round` is not decoration — 19.99 * 100 is 1998.9999999999998, and",
+                "    // a float cent here fails the exact-equality staleness check on every",
+                "    // single checkout.",
+                "    if (variantIds.includes(item.externalId)) {",
+                "      prices.set(item.externalId, Math.round(item.price * 100));",
+                "    }",
+                "  }",
+                "  return prices;",
+                "}",
+            ]),
         "",
         "const json = (body: unknown, status = 200) =>",
         "  new Response(JSON.stringify(body), {",
@@ -126,32 +195,75 @@ export function generateAstroidCheckoutRoute(config) {
         '    return json({ error: "A uuid `cartId` is required" }, 400);',
         "  }",
         "",
-        "  // 1 + 2: re-price and refuse on mismatch.",
-        "  const check = await verifyCheckout(body.lines, serverPrices);",
-        "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
-        "",
-        "  // 3: stable per cart, distinct per customer.",
-        '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
-        "",
-        "  // 4: dormant until provisioned. An unconfigured store still re-prices and",
-        "  // still refuses a stale cart — it just doesn't move money.",
-        "  // Cast as the toolkit's own `astroidModuleStatus` does: `readSecret`",
-        "  // accepts a plain string OR a Secrets Store binding, which CloudflareEnv",
-        "  // types more narrowly than the resolver's `SecretSource` map.",
-        "  const status = await resolveCommerceStatus(",
-        "    astroidConfig.commerce,",
-        "    env as unknown as Record<string, SecretSource>,",
-        "  );",
-        "  if (!status.configured) {",
-        "    console.info(",
-        '      `[astroid:commerce] simulated checkout — unprovisioned: ${status.missing.join(", ")}`,',
-        "    );",
-        "    return json({",
-        "      simulated: true,",
-        "      subtotalCents: check.subtotalCents,",
-        "      idempotencyKey,",
-        "    });",
-        "  }",
+        ...(multi
+            ? [
+                "  // 0: whose sale is this? Refuse rather than guess.",
+                "  const locationId = resolveLocationId(request);",
+                "  if (!locationId) {",
+                '    return json({ error: "This storefront is not open for orders." }, 409);',
+                "  }",
+                "",
+                "  // 4, EARLY — and the ordering is the point. Re-pricing per location is",
+                "  // itself a live Square call, so the dormancy gate has to precede",
+                "  // verification here rather than follow it; running it after would call",
+                "  // Square with a placeholder token, which this route must never do.",
+                "  //",
+                "  // The cost is real and worth naming: an unprovisioned multi-merchant",
+                "  // store cannot do the staleness check at all, because the prices live at",
+                "  // the provider. It says so (`priced: false`) rather than echoing the",
+                "  // client's total back as if the server had agreed to it.",
+                "  //",
+                "  // Cast as the toolkit's own `astroidModuleStatus` does: `readSecret`",
+                "  // accepts a plain string OR a Secrets Store binding, which CloudflareEnv",
+                "  // types more narrowly than the resolver's `SecretSource` map.",
+                "  const status = await resolveCommerceStatus(",
+                "    astroidConfig.commerce,",
+                "    env as unknown as Record<string, SecretSource>,",
+                "  );",
+                "  if (!status.configured) {",
+                "    console.info(",
+                '      `[astroid:commerce] simulated checkout — unprovisioned: ${status.missing.join(", ")}`,',
+                "    );",
+                "    return json({ simulated: true, priced: false });",
+                "  }",
+                "",
+                "  // 1 + 2: re-price AT THIS LOCATION and refuse on mismatch.",
+                "  const check = await verifyCheckout(body.lines, serverPrices, {",
+                "    scope: { locationId },",
+                "  });",
+                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "",
+                "  // 3: stable per cart, distinct per customer.",
+                '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
+            ]
+            : [
+                "  // 1 + 2: re-price and refuse on mismatch.",
+                "  const check = await verifyCheckout(body.lines, serverPrices);",
+                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "",
+                "  // 3: stable per cart, distinct per customer.",
+                '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
+                "",
+                "  // 4: dormant until provisioned. An unconfigured store still re-prices and",
+                "  // still refuses a stale cart — it just doesn't move money.",
+                "  // Cast as the toolkit's own `astroidModuleStatus` does: `readSecret`",
+                "  // accepts a plain string OR a Secrets Store binding, which CloudflareEnv",
+                "  // types more narrowly than the resolver's `SecretSource` map.",
+                "  const status = await resolveCommerceStatus(",
+                "    astroidConfig.commerce,",
+                "    env as unknown as Record<string, SecretSource>,",
+                "  );",
+                "  if (!status.configured) {",
+                "    console.info(",
+                '      `[astroid:commerce] simulated checkout — unprovisioned: ${status.missing.join(", ")}`,',
+                "    );",
+                "    return json({",
+                "      simulated: true,",
+                "      subtotalCents: check.subtotalCents,",
+                "      idempotencyKey,",
+                "    });",
+                "  }",
+            ]),
         "",
         '  const sourceId = typeof body.sourceId === "string" ? body.sourceId : "";',
         '  if (!sourceId) return json({ error: "A card token (`sourceId`) is required" }, 400);',
@@ -170,7 +282,11 @@ export function generateAstroidCheckoutRoute(config) {
         "      sourceId,",
         "      // The SERVER's number, never the client's.",
         '      amountMoney: { amount: check.subtotalCents, currency: "USD" },',
-        '      locationId: env.SQUARE_LOCATION_ID ?? "",',
+        multi
+            ? "      // The location the cart was PRICED against — necessarily the same one,\n" +
+                "      // or the sale rings against a merchant who never quoted this total."
+            : null,
+        multi ? "      locationId," : '      locationId: env.SQUARE_LOCATION_ID ?? "",',
         "      idempotencyKey,",
         '      ...(typeof body.verificationToken === "string"',
         "        ? { verificationToken: body.verificationToken }",
@@ -187,7 +303,12 @@ export function generateAstroidCheckoutRoute(config) {
         "  });",
         "};",
         "",
-    ].join("\n");
+        // `null` marks a line that belongs to the other location mode. Dropped
+        // rather than emitted as "" so the generated file has no stray blank lines
+        // where a single-location project's checkout differs from a multi's.
+    ]
+        .filter((line) => line !== null)
+        .join("\n");
 }
 /**
  * `src/components/SquareCard.astro` — the card input.
@@ -202,6 +323,7 @@ export function generateAstroidCheckoutRoute(config) {
 export function generateAstroidSquareCard(config) {
     if (!usesCardCheckout(config))
         return null;
+    const multi = hasMultiLocation(config.commerce);
     return [
         "---",
         "// Square Web Payments card input.",
@@ -215,10 +337,24 @@ export function generateAstroidSquareCard(config) {
         "// commerce is on), so no policy change is needed.",
         'import { env } from "cloudflare:workers";',
         "",
+        ...(multi
+            ? [
+                "// Multi-location: the merchant is a property of the PAGE, so the id comes",
+                "// in as a prop. Only the card iframe is bound to it — the charge takes its",
+                "// location from the server, which resolves it independently in",
+                "// /api/checkout. This one cannot pick the merchant, and shouldn't: it is",
+                "// rendered from markup a customer can reach.",
+                "interface Props {",
+                "  locationId: string;",
+                "}",
+                "const { locationId } = Astro.props;",
+                "",
+            ]
+            : []),
         "// The PUBLIC application id — safe in the browser, unlike the access token.",
         "// Absent (an unprovisioned store) → render nothing rather than a dead form.",
         "const appId = env.SQUARE_APP_ID;",
-        "const locationId = env.SQUARE_LOCATION_ID;",
+        multi ? null : "const locationId = env.SQUARE_LOCATION_ID;",
         'const environment = env.SQUARE_ENVIRONMENT ?? "sandbox";',
         "const ready = Boolean(appId && locationId);",
         "---",
@@ -235,8 +371,9 @@ export function generateAstroidSquareCard(config) {
         "    </div>",
         "  ) : (",
         '    <p class="text-sm opacity-70">',
-        "      Card payments are not configured yet — set SQUARE_APP_ID and",
-        "      SQUARE_LOCATION_ID.",
+        multi
+            ? "      Card payments are not configured yet — set SQUARE_APP_ID and pass a\n      `locationId` prop."
+            : "      Card payments are not configured yet — set SQUARE_APP_ID and\n      SQUARE_LOCATION_ID.",
         "    </p>",
         "  )",
         "}",
@@ -268,7 +405,9 @@ export function generateAstroidSquareCard(config) {
         "  }",
         "</script>",
         "",
-    ].join("\n");
+    ]
+        .filter((line) => line !== null)
+        .join("\n");
 }
 /** Does this project talk to Square in ANY role — storefront, invoicing, or
  *  otherwise? Distinct from {@link usesCardCheckout}, which asks the narrower