npm - @tokenoftrust/storefront-runner - Versions diffs - 0.1.0 - Mend

@tokenoftrust/storefront-runner 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (337) hide show

package/apps/storefront/src/middleware/index.ts ADDED Viewed

@@ -0,0 +1,413 @@
+/**
+ * Tenant-resolution middleware (brief §7).
+ *
+ * Per request: Host -> TenantConfig (via TenantResolver) -> resolve theme ->
+ * bind a ToTClient to the tenant's data scope -> stash everything on
+ * Astro.locals so pages/components stay tenant-agnostic. The serialized theme
+ * CSS-var block is injected into <head> by Layout.astro from locals.themeStyle.
+ */
+import { defineMiddleware } from "astro:middleware";
+import { getTenantResolver } from "@/config/resolver";
+import { referenceTheme } from "@/themes/reference";
+import { mergeTheme, themeToCssVars } from "@/themes/schema";
+import { createToTClient } from "@/lib/tot/ToTClient";
+import { readEnv, readKv, readD1 } from "@/lib/env";
+import { resolveTenantRouting } from "@/lib/tenantRouting";
+import { createContentProvider } from "@/lib/storyblok/provider";
+import {
+  isCacheablePath,
+  pageCacheKey,
+  readCacheVersion,
+  getCachedPage,
+  putCachedPage,
+} from "@/lib/edgeCache";
+import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
+import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { maybeInjectPreviewReload } from "@/lib/previewReload";
+import {
+  resolveCustomizationEnv,
+  buildCsp,
+  STOREFRONT_CSP_ALLOWLIST,
+  foxyCspAdditions,
+  CSP_REPORT_GROUP,
+  CSP_REPORT_PATH,
+  readPublishedArtifact,
+  themeArtifactPath,
+  resolveTenantFeatures,
+  resolveCapabilities,
+  capabilitiesArtifactPath,
+} from "@tot/public-runtime";
+import type { CapabilityConfig } from "@tot/public-runtime";
+import { resolveTenantCommerce } from "@/lib/foxyCommerce";
+import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
+import {
+  evaluateLoginGate,
+  parseGateMode,
+  isAuthPath,
+  sessionAdmitsHost,
+  PUBLIC_HOME_TENANT_ID,
+} from "@/lib/auth/loginGate";
+import { gatedHoldingResponse } from "@/lib/auth/gatePage";
+import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
+import { membershipFor } from "@/lib/dashboard/tenantSelection";
+import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
+export const onRequest = defineMiddleware(async (context, next) => {
+  const { request, locals } = context;
+  const url = new URL(request.url);
+  const host =
+    request.headers.get("host") ?? url.host ?? "localhost";
+  // ---- Site maintenance kill-switch (fail-safe full close) ------------------
+  // MAINTENANCE_MODE=1 takes the ENTIRE site offline (every host + path) with a
+  // static "Coming Soon" holding page, BEFORE tenant resolution, the access
+  // gate, the edge cache, or any render. Not a login gate — auth paths are not
+  // exempt. Back online: set MAINTENANCE_MODE=0 (or unset) and redeploy.
+  if (isMaintenanceOn(await readEnv("MAINTENANCE_MODE"))) {
+    return maintenanceResponse();
+  }
+  // Demo access gate for named hosts (DEMO_GATE_HOSTS). Two modes, switched by
+  // DEMO_GATE_MODE:
+  //   "password" (default) — interim Basic-Auth gate, enforced HERE (host-level,
+  //     no tenant/session needed) so a blocked host never reaches tenant
+  //     resolution, the edge cache, or any render.
+  //   "login" — "Sign in with ToT" gate, enforced just below (needs the resolved
+  //     tenant as the grant `resource` + the SESSION KV), redirecting to
+  //     /auth/login unless a valid, resource-bound tot_session cookie is present.
+  const gateMode = parseGateMode(await readEnv("DEMO_GATE_MODE"));
+  const demoGateHosts = await readEnv("DEMO_GATE_HOSTS");
+  if (gateMode === "password") {
+    const demoGate = evaluateDemoGate(host, request.headers.get("authorization"), {
+      hosts: demoGateHosts,
+      password: await readEnv("DEMO_GATE_PASSWORD"),
+      realm: await readEnv("DEMO_GATE_REALM"),
+    });
+    if (demoGate) return demoGate;
+  }
+  // Host first; if the host owns no tenant, a leading /<domain>/ path segment
+  // selects one (DNS-free tenant selection on localhost/preview). The resolver
+  // is KV-backed in prod (many-tenant) and static in plain dev.
+  const resolver = await getTenantResolver();
+  const { tenant, basePath, renderPath } = await resolveTenantRouting(
+    host,
+    url.pathname,
+    resolver,
+  );
+  if (!tenant) {
+    return new Response("Unknown host", { status: 404 });
+  }
+  // Workers Cache API: backs the full-page edge cache below. Undefined in
+  // `astro dev` (Node) — every use is a no-op there.
+  const cache =
+    typeof caches !== "undefined" && "default" in caches
+      ? (caches as unknown as { default: Cache }).default
+      : undefined;
+  const kv = await readKv("TENANT_CACHE");
+  // Login-gate enforcement (DEMO_GATE_MODE="login"): runs before the edge cache
+  // so a gated page is never served to an unauthenticated viewer. The platform's
+  // own "self" home tenant is EXEMPT — it renders publicly (browse + sign up);
+  // every other tenant on a gated host is withheld behind sign-in. A valid,
+  // resource-bound tot_session sets locals.viewer (email + roles) for chrome;
+  // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
+  // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
+  // grant `resource` is the tenant's appDomain — never input.
+  const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
+  if (gateMode === "login" && hostInGateList(host, demoGateHosts)) {
+    // UNIFIED on the federated session: read the FULL session (no resource filter —
+    // federated sign-in's aud is the storefront app, not this tenant) and admit the
+    // viewer iff they hold a MEMBERSHIP for the host's tenant. One session model for
+    // the console + the preview gate. Deny-closed: no session / no membership → gate.
+    let viewerRecord = null;
+    if (!isAuthPath(url.pathname)) {
+      const sessionKv = await readKv("SESSION");
+      if (sessionKv) {
+        const sid = context.cookies.get(SESSION_COOKIE)?.value ?? null;
+        viewerRecord = await readSession(
+          new KvSessionStore(sessionKv),
+          sid,
+          Math.floor(Date.now() / 1000),
+        );
+      }
+    }
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const admitted = sessionAdmitsHost(viewerRecord, tenant.appDomain, nowSeconds);
+    const decision = evaluateLoginGate({
+      host,
+      pathname: url.pathname,
+      search: url.search,
+      mode: gateMode,
+      gatedHosts: demoGateHosts,
+      hasValidSession: admitted,
+      tenantExempt,
+    });
+    if (decision.action === "redirect") {
+      // Withhold content but offer sign-in (carrying the intended destination).
+      return gatedHoldingResponse(decision.location);
+    }
+    if (admitted && viewerRecord) {
+      // Surface the viewer's role FOR THIS host's tenant as chrome. A member sees
+      // their tenants[] role; a ToT-staff viewer admitted via an explicit vendor
+      // selection sees the staffRoles-scoped capability (distinct path).
+      const role = membershipFor(viewerRecord.tenants, tenant.appDomain, {
+        selection: viewerRecord.staffSelection,
+        nowSeconds,
+      })?.role;
+      locals.viewer = {
+        email: viewerRecord.email,
+        roles: role ? [role] : viewerRecord.roles,
+        capability: role ?? viewerRecord.capability,
+      };
+    }
+  }
+  // Preview/test detection (also reused for the customization env below). A
+  // production read is one with no preview host, query token, or preview cookie.
+  const isPreviewHost = host.toLowerCase().startsWith("preview.");
+  const queryToken = url.searchParams.get("__preview");
+  const cookieToken = context.cookies.get("tot_preview")?.value ?? null;
+  // ---- Edge page cache (D1): short-circuit production browse reads on a hit,
+  // BEFORE building the client / theme / rendering. Misses store the final
+  // response at the end of this middleware.
+  //
+  // NEVER in dev (`astro dev`): the workerd dev runtime persists the Workers Cache
+  // API in .wrangler/state, so a cached page would be served stale across edits AND
+  // restarts — silently defeating hot-reload (edits look "lost"). Dev must always
+  // re-render. import.meta.env.DEV statically drops this guard from the prod build.
+  const pageCacheEligible =
+    !import.meta.env.DEV &&
+    request.method.toUpperCase() === "GET" &&
+    !isPreviewHost &&
+    !queryToken &&
+    !cookieToken &&
+    isCacheablePath(url.pathname, url.searchParams);
+  let pageKey: Request | null = null;
+  if (pageCacheEligible && cache && kv) {
+    const version = await readCacheVersion(kv, tenant.tenant_id);
+    pageKey = pageCacheKey(tenant.tenant_id, url.pathname, url.search, version);
+    const hit = await getCachedPage(cache, pageKey);
+    if (hit) return hit;
+  }
+  // Edge read replica: opt-in via USE_D1_CATALOG=1 (+ a CATALOG_DB binding). Off
+  // by default, so the bundled fixture snapshot serves reads.
+  const d1 =
+    (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined;
+  const tot = await createToTClient(tenant, d1);
+  const proto = url.protocol === "http:" ? "http" : "https";
+  // Canonical base uses the tenant's canonical domain in prod; for local dev we
+  // keep the actual host (plus any /<domain> base path) so links resolve.
+  const isLocal = host.startsWith("localhost") || host.startsWith("127.0.0.1");
+  const canonicalBase = isLocal
+    ? `${proto}://${host}${basePath}`
+    : `https://${tenant.canonicalDomain}`;
+  // Live vs test customization (D4). Production hosts always serve "live" and
+  // ignore any token; a "preview." host is auth-gated by a signed, tenant-bound,
+  // short-TTL preview token (?__preview= on first hit, then the tot_preview
+  // cookie). Test is never indexable (X-Robots-Tag below).
+  const previewToken = queryToken ?? cookieToken;
+  const customization = await resolveCustomizationEnv({
+    isPreviewHost,
+    tenantId: tenant.tenant_id,
+    token: previewToken,
+    secret: (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null,
+    nowSeconds: Math.floor(Date.now() / 1000),
+  });
+  if (customization.reject) {
+    return new Response(customization.reject.message, {
+      status: customization.reject.status,
+    });
+  }
+  // Persist a query-supplied token as a cookie so later navigations stay in test.
+  if (customization.env === "test" && queryToken) {
+    context.cookies.set("tot_preview", queryToken, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge: 3600,
+    });
+  }
+  // Apply a published theme override for the resolved environment (store->app).
+  // The live domain serves `live`; a gated preview serves `test`. When nothing
+  // is published the build-time tenant theme is used unchanged.
+  //
+  // Resolution is versioned-aware inside readPublishedArtifact: env maps to a
+  // publish channel (live->live, test->preview); if the tenant has a channel
+  // pointer, the artifact is resolved through the immutable site version
+  // (channel -> versionId -> manifest -> content). Tenants with no channel
+  // pointer fall back to the legacy per-path selection — no behavior change.
+  const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
+  let theme = mergeTheme(referenceTheme, tenant.theme_tokens);
+  const publishedTheme = await readPublishedArtifact(
+    kvGet,
+    tenant.tenant_id,
+    customization.env,
+    themeArtifactPath(tenant.tenant_id),
+  );
+  if (publishedTheme) {
+    try {
+      theme = mergeTheme(theme, JSON.parse(publishedTheme) as DeepPartial<ThemeTokens>);
+    } catch {
+      /* malformed published artifact — keep the build-time theme */
+    }
+  }
+  // Per-environment capabilities (Track A/B). Config-as-code: the build-time
+  // TenantConfig default is overridden by the published capabilities artifact for
+  // THIS environment — materialized from the tenant repo's .tot/config.json per
+  // commit (localhost=working tree, preview=PR head, live=promoted). So a
+  // capability change is PR-gated and separable per environment.
+  let publishedCaps: Partial<CapabilityConfig> | null = null;
+  const publishedCapsRaw = await readPublishedArtifact(
+    kvGet,
+    tenant.tenant_id,
+    customization.env,
+    capabilitiesArtifactPath(tenant.tenant_id),
+  );
+  if (publishedCapsRaw) {
+    try {
+      publishedCaps = JSON.parse(publishedCapsRaw) as Partial<CapabilityConfig>;
+    } catch {
+      /* malformed published artifact — keep the build-time default */
+    }
+  }
+  const capabilities = resolveCapabilities(tenant, publishedCaps);
+  // Per-request CSP nonce (D2): goes on the platform's own inline tags in
+  // Layout.astro so a strict CSP can allow them without 'unsafe-inline'.
+  const cspNonce = crypto.randomUUID();
+  locals.tenant = tenant;
+  // Effective capability flags for this tenant (commerce defaults unless the
+  // tenant declares siteType:"marketing" / explicit features). Pages and chrome
+  // read these instead of hard-coding tenant identity checks.
+  locals.features = resolveTenantFeatures(tenant);
+  locals.capabilities = capabilities;
+  // FoxyCart cart/checkout facts (Track A) — only when the tenant has a catalog
+  // AND the cartCheckout capability is enabled for THIS environment. Drives the
+  // loader + signed add-to-cart, and the CSP additions below.
+  const commerce =
+    locals.features.catalog && capabilities.cartCheckout.enabled
+      ? await resolveTenantCommerce(tenant)
+      : null;
+  locals.commerce = commerce ?? undefined;
+  locals.tot = tot;
+  locals.content = createContentProvider(tenant, {
+    get: kvGet,
+    env: customization.env,
+  });
+  locals.themeStyle = themeToCssVars(theme);
+  locals.canonicalBase = canonicalBase;
+  locals.customizationEnv = customization.env;
+  locals.cspNonce = cspNonce;
+  // Prefix that path-routed pages live under ("" for host-routed). Pages stay
+  // tenant-agnostic; the Layout uses this to keep root-absolute links inside
+  // the tenant prefix on the client.
+  locals.basePath = basePath;
+  // When a /<domain>/ prefix selected the tenant, rewrite to the stripped route
+  // so the existing file-based routes match. next(path) rewrites WITHOUT
+  // re-running middleware, so the locals set above are preserved.
+  let response = basePath
+    ? await next(`${renderPath}${url.search}`)
+    : await next();
+  // On-publish auto-refresh: inject the live-reload client into SHARED preview
+  // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).
+  // It polls /__preview/version and reloads when this tenant's cache-version
+  // bumps on publish/reconcile. Injection happens before the CSP header is set so
+  // the script's per-request nonce (cspNonce) matches the enforced policy.
+  response = await maybeInjectPreviewReload(response, {
+    env: customization.env,
+    tenantId: tenant.tenant_id,
+    basePath,
+    nonce: cspNonce,
+  });
+  // Baseline security headers (S1) on every response — set before the page-cache
+  // store below so cached copies carry them too.
+  applySecurityHeaders(response.headers);
+  // Preview (test) output must never be indexed.
+  if (customization.noindex) {
+    response.headers.set("X-Robots-Tag", "noindex, nofollow");
+  }
+  // Strict CSP — now ENFORCED in every environment (Epic S2). The report-only
+  // rollout is complete: platform output is CSP-clean — inline styles are
+  // externalized (`inlineStylesheets: "never"`), Astro's static inline scripts +
+  // island style are hash-pinned (cspStaticHashes), our dynamic inline tags carry
+  // the per-request nonce, and the last inline event handler (SortSelect's
+  // `onchange`) is now a bundled 'self' script. Reporting endpoints stay attached
+  // (report-to/report-uri work in enforce mode), so we keep telemetry as tenant
+  // client JS arrives — those per-version tenant hashes extend `scriptSrc` per
+  // request (the mechanism below already supports it).
+  //
+  // DEV EXCEPTION: `astro dev` serves CSS/HMR as UN-nonced inline <style>/<script>
+  // (Vite injects them); the strict nonce policy blocks those, leaving the dev
+  // site unstyled. The BUILD is CSP-clean (styles are externalized via
+  // `inlineStylesheets:"never"`), so we enforce there and only REPORT in dev —
+  // violations are still surfaced, but styling/HMR work locally.
+  const cspHeader = import.meta.env.DEV
+    ? "Content-Security-Policy-Report-Only"
+    : "Content-Security-Policy";
+  response.headers.set(
+    "Reporting-Endpoints",
+    `${CSP_REPORT_GROUP}="${CSP_REPORT_PATH}"`,
+  );
+  // FoxyCart origins (loader CDN + the store's cart/checkout host) added to the
+  // strict policy only when this tenant has a store — so add-to-cart, the
+  // sidecart iframe/XHR, and the cross-origin form POST all pass.
+  const foxyCsp = commerce ? foxyCspAdditions(commerce.origin) : null;
+  response.headers.set(
+    cspHeader,
+    buildCsp({
+      nonce: cspNonce,
+      ...STOREFRONT_CSP_ALLOWLIST,
+      // Pin Astro's static inline hydration scripts + island style by hash
+      // (they're identical every request); my dynamic inline tags use the nonce.
+      scriptSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.scriptSrc,
+        ...STATIC_SCRIPT_HASHES,
+        ...(foxyCsp?.scriptSrc ?? []),
+      ],
+      styleSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.styleSrc,
+        ...STATIC_STYLE_HASHES,
+        ...(foxyCsp?.styleSrc ?? []),
+      ],
+      fontSrc: [...STOREFRONT_CSP_ALLOWLIST.fontSrc, ...(foxyCsp?.fontSrc ?? [])],
+      connectSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.connectSrc,
+        ...(foxyCsp?.connectSrc ?? []),
+      ],
+      imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(foxyCsp?.imgSrc ?? [])],
+      frameSrc: foxyCsp?.frameSrc ?? [],
+      formAction: foxyCsp?.formAction ?? [],
+      reportGroup: CSP_REPORT_GROUP,
+      reportUri: CSP_REPORT_PATH,
+    }),
+  );
+  // D1: store the fully-rendered, CSP-stamped response for the next reader. Only
+  // production (no preview token reached here) cacheable GETs have a pageKey;
+  // putCachedPage additionally skips non-200, non-HTML, and cookie-bearing
+  // responses. Also expose Cache-Control to any fronting CDN.
+  if (pageKey && cache && customization.env === "live") {
+    response.headers.set(
+      "Cache-Control",
+      "public, s-maxage=300, stale-while-revalidate=86400",
+    );
+    await putCachedPage(cache, pageKey, response);
+  }
+  return response;
+});

package/apps/storefront/src/pages/404.astro ADDED Viewed

@@ -0,0 +1,61 @@
+---
+/**
+ * 404 — written in the Northwind voice, not a stub. Offers a way home and a
+ * few collections to wander into so a dead link still lands somewhere useful.
+ */
+import Layout from "@/layouts/Layout.astro";
+import CollectionCard from "@/components/CollectionCard.astro";
+import { withBase } from "@/lib/basePath";
+const { tenant, tot, basePath } = Astro.locals;
+// A handful of collections to redirect lost visitors toward.
+const collections = (await tot.listCollections()).slice(0, 3);
+---
+<Layout
+  title="Page not found"
+  description="The page you were after isn't here."
+  path="/404"
+  noindex={true}
+>
+  <section class="bg-[var(--color-bg)]">
+    <div class="container-prose py-[clamp(4rem,10vw,8rem)] text-center" data-reveal>
+      <p class="eyebrow mb-4">404</p>
+      <h1 class="display-xl mx-auto max-w-[18ch]">
+        This page wandered off in the fog.
+      </h1>
+      <p class="mx-auto mt-5 max-w-[44ch] text-[1.1rem] text-[var(--color-muted)]">
+        The link you followed leads nowhere we keep. No harm done — let's get you
+        back on the trail.
+      </p>
+      <div class="mt-9 flex flex-wrap items-center justify-center gap-3">
+        <a
+          href={withBase(basePath, "/")}
+          class="inline-flex items-center rounded-full bg-[var(--color-primary)] px-6 py-3 font-display text-sm font-medium text-[var(--color-primary-contrast)] transition-transform hover:-translate-y-0.5"
+        >
+          Back home
+        </a>
+        <a
+          href={withBase(basePath, "/collections")}
+          class="inline-flex items-center rounded-full border border-[var(--color-border)] px-6 py-3 font-display text-sm font-medium text-[var(--color-text)] transition-colors hover:border-[var(--color-primary)]"
+        >
+          Browse collections
+        </a>
+      </div>
+    </div>
+  </section>
+  {collections.length > 0 && (
+    <section class="bg-[var(--color-surface)] py-[clamp(2.5rem,6vw,4.5rem)]">
+      <div class="container-prose">
+        <p class="eyebrow mb-6 text-center">Maybe you were looking for</p>
+        <div class="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+          {collections.map((c) => (
+            <CollectionCard collection={c} productCount={c.product_handles.length} />
+          ))}
+        </div>
+      </div>
+    </section>
+  )}
+</Layout>

package/apps/storefront/src/pages/[...slug].astro ADDED Viewed

@@ -0,0 +1,90 @@
+---
+/**
+ * Editorial pages from the ContentProvider (Storyblok seam; local fallback in
+ * Phase 1). Catch-all, lowest routing priority — Astro resolves /products,
+ * /collections, /search first. We still guard defensively against those
+ * prefixes so a stray slug can never shadow a real route.
+ */
+import Layout from "@/layouts/Layout.astro";
+import Breadcrumbs from "@/components/Breadcrumbs.astro";
+import { breadcrumbLd } from "@/lib/jsonld";
+import { truncate } from "@/lib/format";
+import { rawHtmlResponse } from "@/lib/rawMarketingHtml";
+const { tenant, canonicalBase, content, basePath } = Astro.locals;
+const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
+// Defensive: never let the catch-all answer for first-class route namespaces.
+// (Keeps the commerce boundary hard — a marketing subpage can never shadow a
+// product/collection route.)
+if (
+  !slug ||
+  slug.startsWith("products/") ||
+  slug.startsWith("collections/")
+) {
+  return new Response(null, { status: 404 });
+}
+// Preview/dev-only style-guide surfaces are requested at `/_style-guide/<tenant>/…`
+// (the leading underscore signals internal). Astro won't route a `_`-prefixed pages
+// dir, so the pages live under `/style-guide/…` and we rewrite the underscored URL
+// onto them. These are noindex + sitemap-excluded and never reskin the live site.
+if (slug === "_style-guide" || slug.startsWith("_style-guide/")) {
+  return Astro.rewrite("/style-guide/" + slug.slice("_style-guide".length + 1));
+}
+// Raw tenant-authored marketing subpage (vendor-injected HTML) — serve the
+// self-contained document VERBATIM, bypassing the block Layout, with the request
+// CSP nonce stamped onto its first-party inline <style>/<script>. Same path as the
+// raw home in index.astro. Middleware still applies canonical host, security
+// headers, CSP, and (prod) the edge cache.
+const rawHtml = await content.getPageHtml(slug);
+if (rawHtml) {
+  // Shared chrome: a body-only fragment gets wrapped in the tenant's chrome.html;
+  // a full document serves verbatim (backward-compatible). See rawMarketingHtml.ts.
+  const chromeWrapper = await content.getChromeHtml();
+  return rawHtmlResponse(rawHtml, { nonce: Astro.locals.cspNonce, basePath, chromeWrapper });
+}
+const page = await content.getPage(slug);
+if (!page) return new Response(null, { status: 404 });
+const crumbs = [
+  { label: tenant.displayName, href: "/" },
+  { label: page.title, href: `/${page.slug}` },
+];
+const description =
+  page.seoDescription ||
+  (page.intro ? truncate(page.intro, 160) : undefined);
+---
+<Layout
+  title={page.seoTitle || page.title}
+  description={description}
+  path={`/${page.slug}`}
+  ogType="article"
+  jsonLd={breadcrumbLd(crumbs, canonicalBase)}
+>
+  <div class="container-prose pt-6">
+    <Breadcrumbs crumbs={crumbs} />
+  </div>
+  {/* Page hero */}
+  <header class="container-prose pb-2 pt-8">
+    {page.eyebrow && <p class="eyebrow eyebrow--tick mb-3">{page.eyebrow}</p>}
+    <h1 class="display-xl max-w-[20ch]">
+      {page.title}
+    </h1>
+    {page.intro && (
+      <p class="mt-5 max-w-[60ch] text-[1.1rem] text-[var(--color-muted)]">
+        {page.intro}
+      </p>
+    )}
+  </header>
+  {/* Body — constrained to a readable measure. */}
+  <div class="container-prose pb-[clamp(3rem,7vw,6rem)] pt-8">
+    <div class="rte mx-auto max-w-[68ch] text-[var(--color-text)]" set:html={page.body_html} />
+  </div>
+</Layout>

package/apps/storefront/src/pages/api/auth/logout.ts ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * POST /api/auth/logout — end the signed-in session.
+ *
+ * Revokes the server-side record (so the session can't be reused even if the
+ * cookie is replayed) and clears the cookie, then bounces to the login page.
+ * Exempt from the login gate (it's under /api/auth/), so a viewer can always
+ * sign out.
+ */
+import type { APIContext } from "astro";
+import { getSessionStore, clearSessionCookie } from "@/lib/auth/route";
+import { revokeSession, SESSION_COOKIE } from "@/lib/auth/session";
+export const prerender = false;
+export async function POST(context: APIContext): Promise<Response> {
+  const sid = context.cookies.get(SESSION_COOKIE)?.value ?? null;
+  const store = await getSessionStore();
+  if (store) await revokeSession(store, sid);
+  clearSessionCookie(context);
+  return context.redirect("/auth/login", 303);
+}