@tokenoftrust/storefront-runner 1.3.2

package/apps/storefront/src/lib/url.ts

@@ -0,0 +1,142 @@
+/**
+ * URL <-> ListProductsQuery codec for URL-addressable PLP facets (brief §5).
+ * Filters live in the querystring so results are shareable + back-button safe.
+ *
+ * Encoding:
+ *   ?sort=price-asc&page=2&availability=in-stock
+ *   &opt.Color=Navy&opt.Color=Forest      (repeated => OR within a facet)
+ *   &opt.Size=M&tag=sale&priceMin=50&priceMax=200&q=wool
+ */
+import type { ListProductsQuery } from "@tot/public-runtime";
+import type { PriceBucket } from "./priceBuckets.js";
+
+export function parseQuery(url: URL): ListProductsQuery {
+  const sp = url.searchParams;
+  const q: ListProductsQuery = {};
+
+  const sort = sp.get("sort");
+  if (
+    sort === "featured" ||
+    sort === "price-asc" ||
+    sort === "price-desc" ||
+    sort === "newest" ||
+    sort === "title-asc"
+  ) {
+    q.sort = sort;
+  }
+
+  // NOTE: read raw params first — Number(null) === 0, which would silently
+  // inject priceMin/priceMax/page = 0 and filter everything out.
+  const num = (key: string): number | undefined => {
+    const raw = sp.get(key);
+    if (raw == null || raw === "") return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : undefined;
+  };
+
+  const page = num("page");
+  if (page != null && page > 0) q.page = page;
+  const pageSize = num("pageSize");
+  if (pageSize != null && pageSize > 0) q.pageSize = pageSize;
+
+  const avail = sp.get("availability");
+  if (avail === "in-stock" || avail === "all") q.availability = avail;
+
+  const priceMin = num("priceMin");
+  if (priceMin != null) q.priceMin = priceMin;
+  const priceMax = num("priceMax");
+  if (priceMax != null) q.priceMax = priceMax;
+
+  const text = sp.get("q");
+  if (text) q.q = text;
+
+  const tags = sp.getAll("tag");
+  if (tags.length) q.tags = tags;
+
+  // Option facets: opt.<Name>=<value> (repeatable).
+  const filters: Record<string, string[]> = {};
+  for (const [key, value] of sp.entries()) {
+    if (key.startsWith("opt.")) {
+      const name = key.slice(4);
+      (filters[name] ??= []).push(value);
+    }
+  }
+  // tags also expressed as a facet for the facet UI.
+  if (tags.length) filters["tags"] = tags;
+  if (Object.keys(filters).length) q.filters = filters;
+
+  return q;
+}
+
+/** Build a querystring from a partial query, preserving repeated params. */
+export function buildQueryString(
+  base: ListProductsQuery,
+  patch: Partial<ListProductsQuery> = {},
+): string {
+  const q = { ...base, ...patch };
+  const sp = new URLSearchParams();
+  if (q.sort && q.sort !== "featured") sp.set("sort", q.sort);
+  if (q.page && q.page > 1) sp.set("page", String(q.page));
+  if (q.pageSize) sp.set("pageSize", String(q.pageSize));
+  if (q.availability && q.availability !== "all")
+    sp.set("availability", q.availability);
+  if (q.priceMin != null) sp.set("priceMin", String(q.priceMin));
+  if (q.priceMax != null) sp.set("priceMax", String(q.priceMax));
+  if (q.q) sp.set("q", q.q);
+  if (q.filters) {
+    for (const [name, values] of Object.entries(q.filters)) {
+      if (name === "tags") {
+        values.forEach((v) => sp.append("tag", v));
+      } else {
+        values.forEach((v) => sp.append(`opt.${name}`, v));
+      }
+    }
+  }
+  const s = sp.toString();
+  return s ? `?${s}` : "";
+}
+
+/** Toggle a single facet value on/off, returning the new querystring (page reset). */
+export function toggleFacet(
+  current: ListProductsQuery,
+  facet: string,
+  value: string,
+): string {
+  const filters: Record<string, string[]> = {};
+  for (const [k, v] of Object.entries(current.filters ?? {})) filters[k] = [...v];
+  const list = filters[facet] ?? [];
+  filters[facet] = list.includes(value)
+    ? list.filter((x) => x !== value)
+    : [...list, value];
+  if (!filters[facet].length) delete filters[facet];
+  const next: ListProductsQuery = { ...current, filters, page: 1 };
+  if (!Object.keys(filters).length) delete next.filters;
+  // tags facet mirrors q.tags
+  if (facet === "tags") {
+    next.tags = filters["tags"];
+    if (!next.tags?.length) delete next.tags;
+  }
+  return buildQueryString(next);
+}
+
+/** Is this price bucket the currently active price range? */
+export function isPriceBucketActive(query: ListProductsQuery, bucket: PriceBucket): boolean {
+  return (
+    (query.priceMin ?? undefined) === bucket.min &&
+    (query.priceMax ?? undefined) === (bucket.max ?? undefined)
+  );
+}
+
+/** Toggle a price bucket on/off (single-select — a bucket replaces any prior
+ * price range, matching the free-text priceMin/priceMax fields it shares). */
+export function togglePriceBucket(current: ListProductsQuery, bucket: PriceBucket): string {
+  const next: ListProductsQuery = { ...current, page: 1 };
+  if (isPriceBucketActive(current, bucket)) {
+    delete next.priceMin;
+    delete next.priceMax;
+  } else {
+    next.priceMin = bucket.min;
+    next.priceMax = bucket.max;
+  }
+  return buildQueryString(next);
+}

package/apps/storefront/src/lib/wishlist.ts

@@ -0,0 +1,63 @@
+/**
+ * Wishlist / favorites — UI-only stub (brief §5: "favorites may be stubbed in
+ * UI only"). Persists a small product snapshot to localStorage so the heart and
+ * the /saved page work with zero backend. Phase 2 can swap this for an account-
+ * backed list without touching components (they only call these helpers + listen
+ * for the change event).
+ */
+
+export interface SavedItem {
+  handle: string;
+  title: string;
+  price: number;
+  currency: string;
+  vendor?: string;
+  img?: string;
+  rehosted?: boolean;
+  seed: string;
+}
+
+const KEY = "tot:wishlist";
+export const WISHLIST_EVENT = "tot:wishlist-changed";
+
+export function readWishlist(): SavedItem[] {
+  try {
+    const raw = localStorage.getItem(KEY);
+    const arr = raw ? JSON.parse(raw) : [];
+    return Array.isArray(arr) ? (arr as SavedItem[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+function write(items: SavedItem[]): void {
+  try {
+    localStorage.setItem(KEY, JSON.stringify(items));
+  } catch {
+    /* storage disabled — degrade silently */
+  }
+  window.dispatchEvent(
+    new CustomEvent(WISHLIST_EVENT, { detail: { count: items.length } }),
+  );
+}
+
+export function isSaved(handle: string): boolean {
+  return readWishlist().some((i) => i.handle === handle);
+}
+
+/** Toggle membership; returns the new saved state. */
+export function toggleSaved(item: SavedItem): boolean {
+  const list = readWishlist();
+  const idx = list.findIndex((i) => i.handle === item.handle);
+  if (idx >= 0) {
+    list.splice(idx, 1);
+    write(list);
+    return false;
+  }
+  write([item, ...list].slice(0, 100));
+  return true;
+}
+
+export function count(): number {
+  return readWishlist().length;
+}

package/apps/storefront/src/middleware/index.ts

@@ -0,0 +1,455 @@
+/**
+ * Tenant-resolution middleware (brief §7).
+ *
+ * Per request: Host -> TenantConfig (via TenantResolver) -> resolve theme ->
+ * bind a ToTClient to the tenant's data scope -> stash everything on
+ * Astro.locals so pages/components stay tenant-agnostic. The serialized theme
+ * CSS-var block is injected into <head> by Layout.astro from locals.themeStyle.
+ */
+import { defineMiddleware } from "astro:middleware";
+import { getTenantResolver } from "@/config/resolver";
+import { referenceTheme } from "@/themes/reference";
+import { mergeTheme, themeToCssVars } from "@/themes/schema";
+import { createToTClient } from "@/lib/tot/ToTClient";
+import { readEnv, readKv, readD1 } from "@/lib/env";
+import { resolveTenantRouting } from "@/lib/tenantRouting";
+import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
+import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
+import {
+  isCacheablePath,
+  pageCacheKey,
+  readCacheVersion,
+  getCachedPage,
+  putCachedPage,
+} from "@/lib/edgeCache";
+import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
+import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { maybeInjectPreviewReload } from "@/lib/previewReload";
+import {
+  resolveCustomizationEnv,
+  buildCsp,
+  STOREFRONT_CSP_ALLOWLIST,
+  foxyCspAdditions,
+  CSP_REPORT_GROUP,
+  CSP_REPORT_PATH,
+  readPublishedArtifact,
+  themeArtifactPath,
+  resolveTenantFeatures,
+  resolveCapabilities,
+  capabilitiesArtifactPath,
+} from "@tot/public-runtime";
+import type { CapabilityConfig } from "@tot/public-runtime";
+import { resolveTenantCommerce } from "@/lib/foxyCommerce";
+import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
+import {
+  evaluateLoginGate,
+  parseGateMode,
+  isAuthPath,
+  sessionAdmitsHost,
+  PUBLIC_HOME_TENANT_ID,
+} from "@/lib/auth/loginGate";
+import { gatedHoldingResponse } from "@/lib/auth/gatePage";
+import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
+import { membershipFor } from "@/lib/dashboard/tenantSelection";
+import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  const { request, locals } = context;
+  const url = new URL(request.url);
+  const host =
+    request.headers.get("host") ?? url.host ?? "localhost";
+
+  // ---- Site maintenance kill-switch (fail-safe full close) ------------------
+  // MAINTENANCE_MODE=1 takes the ENTIRE site offline (every host + path) with a
+  // static "Coming Soon" holding page, BEFORE tenant resolution, the access
+  // gate, the edge cache, or any render. Not a login gate — auth paths are not
+  // exempt. Back online: set MAINTENANCE_MODE=0 (or unset) and redeploy.
+  if (isMaintenanceOn(await readEnv("MAINTENANCE_MODE"))) {
+    return maintenanceResponse();
+  }
+
+  // Demo access gate for named hosts (DEMO_GATE_HOSTS). Two modes, switched by
+  // DEMO_GATE_MODE:
+  //   "password" (default) — interim Basic-Auth gate, enforced HERE (host-level,
+  //     no tenant/session needed) so a blocked host never reaches tenant
+  //     resolution, the edge cache, or any render.
+  //   "login" — "Sign in with ToT" gate, enforced just below (needs the resolved
+  //     tenant as the grant `resource` + the SESSION KV), redirecting to
+  //     /auth/login unless a valid, resource-bound tot_session cookie is present.
+  const gateMode = parseGateMode(await readEnv("DEMO_GATE_MODE"));
+  const demoGateHosts = await readEnv("DEMO_GATE_HOSTS");
+  if (gateMode === "password") {
+    const demoGate = evaluateDemoGate(host, request.headers.get("authorization"), {
+      hosts: demoGateHosts,
+      password: await readEnv("DEMO_GATE_PASSWORD"),
+      realm: await readEnv("DEMO_GATE_REALM"),
+    });
+    if (demoGate) return demoGate;
+  }
+
+  // Host first; if the host owns no tenant, a leading /<domain>/ path segment
+  // selects one (DNS-free tenant selection on localhost/preview). The resolver
+  // is KV-backed in prod (many-tenant) and static in plain dev.
+  const resolver = await getTenantResolver();
+  const { tenant, basePath, renderPath } = await resolveTenantRouting(
+    host,
+    url.pathname,
+    resolver,
+  );
+  if (!tenant) {
+    return new Response("Unknown host", { status: 404 });
+  }
+
+  // Workers Cache API: backs the full-page edge cache below. Undefined in
+  // `astro dev` (Node) — every use is a no-op there.
+  const cache =
+    typeof caches !== "undefined" && "default" in caches
+      ? (caches as unknown as { default: Cache }).default
+      : undefined;
+  const kv = await readKv("TENANT_CACHE");
+
+  // Login-gate enforcement (DEMO_GATE_MODE="login"): runs before the edge cache
+  // so a gated page is never served to an unauthenticated viewer. The platform's
+  // own "self" home tenant is EXEMPT — it renders publicly (browse + sign up);
+  // every other tenant on a gated host is withheld behind sign-in. A valid,
+  // resource-bound tot_session sets locals.viewer (email + roles) for chrome;
+  // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
+  // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
+  // grant `resource` is the tenant's appDomain — never input.
+  const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
+  if (gateMode === "login" && hostInGateList(host, demoGateHosts)) {
+    // UNIFIED on the federated session: read the FULL session (no resource filter —
+    // federated sign-in's aud is the storefront app, not this tenant) and admit the
+    // viewer iff they hold a MEMBERSHIP for the host's tenant. One session model for
+    // the console + the preview gate. Deny-closed: no session / no membership → gate.
+    let viewerRecord = null;
+    if (!isAuthPath(url.pathname)) {
+      const sessionKv = await readKv("SESSION");
+      if (sessionKv) {
+        const sid = context.cookies.get(SESSION_COOKIE)?.value ?? null;
+        viewerRecord = await readSession(
+          new KvSessionStore(sessionKv),
+          sid,
+          Math.floor(Date.now() / 1000),
+        );
+      }
+    }
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const admitted = sessionAdmitsHost(viewerRecord, tenant.appDomain, nowSeconds);
+    const decision = evaluateLoginGate({
+      host,
+      pathname: url.pathname,
+      search: url.search,
+      mode: gateMode,
+      gatedHosts: demoGateHosts,
+      hasValidSession: admitted,
+      tenantExempt,
+    });
+    if (decision.action === "redirect") {
+      // Withhold content but offer sign-in (carrying the intended destination).
+      return gatedHoldingResponse(decision.location);
+    }
+    if (admitted && viewerRecord) {
+      // Surface the viewer's role FOR THIS host's tenant as chrome. A member sees
+      // their tenants[] role; a ToT-staff viewer admitted via an explicit vendor
+      // selection sees the staffRoles-scoped capability (distinct path).
+      const role = membershipFor(viewerRecord.tenants, tenant.appDomain, {
+        selection: viewerRecord.staffSelection,
+        nowSeconds,
+      })?.role;
+      locals.viewer = {
+        email: viewerRecord.email,
+        roles: role ? [role] : viewerRecord.roles,
+        capability: role ?? viewerRecord.capability,
+      };
+    }
+  }
+
+  // Preview/test detection (also reused for the customization env below). A
+  // production read is one with no preview host, query token, or preview cookie.
+  const isPreviewHost = host.toLowerCase().startsWith("preview.");
+  const queryToken = url.searchParams.get("__preview");
+  const cookieToken = context.cookies.get("tot_preview")?.value ?? null;
+  // Per-developer AI-edit draft (decision draft-overlay-same-origin): the signed
+  // tot_dev_draft cookie's mere PRESENCE opts the request out of the shared page
+  // cache below (a draft view must never be cached publicly); it's verified —
+  // signature, expiry, tenant binding — before the overlay is applied further down.
+  const draftCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
+
+  // ---- Edge page cache (D1): short-circuit production browse reads on a hit,
+  // BEFORE building the client / theme / rendering. Misses store the final
+  // response at the end of this middleware.
+  //
+  // NEVER in dev (`astro dev`): the workerd dev runtime persists the Workers Cache
+  // API in .wrangler/state, so a cached page would be served stale across edits AND
+  // restarts — silently defeating hot-reload (edits look "lost"). Dev must always
+  // re-render. import.meta.env.DEV statically drops this guard from the prod build.
+  const pageCacheEligible =
+    !import.meta.env.DEV &&
+    request.method.toUpperCase() === "GET" &&
+    !isPreviewHost &&
+    !queryToken &&
+    !cookieToken &&
+    !draftCookie &&
+    isCacheablePath(url.pathname, url.searchParams);
+  let pageKey: Request | null = null;
+  if (pageCacheEligible && cache && kv) {
+    const version = await readCacheVersion(kv, tenant.tenant_id);
+    pageKey = pageCacheKey(tenant.tenant_id, url.pathname, url.search, version);
+    const hit = await getCachedPage(cache, pageKey);
+    if (hit) return hit;
+  }
+
+  // Edge read replica: opt-in via USE_D1_CATALOG=1 (+ a CATALOG_DB binding). Off
+  // by default, so the bundled fixture snapshot serves reads.
+  const d1 =
+    (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined;
+  const tot = await createToTClient(tenant, d1);
+
+  const proto = url.protocol === "http:" ? "http" : "https";
+  // Canonical base uses the tenant's canonical domain in prod; for local dev we
+  // keep the actual host (plus any /<domain> base path) so links resolve.
+  const isLocal = host.startsWith("localhost") || host.startsWith("127.0.0.1");
+  const canonicalBase = isLocal
+    ? `${proto}://${host}${basePath}`
+    : `https://${tenant.canonicalDomain}`;
+
+  // Live vs test customization (D4). Production hosts always serve "live" and
+  // ignore any token; a "preview." host is auth-gated by a signed, tenant-bound,
+  // short-TTL preview token (?__preview= on first hit, then the tot_preview
+  // cookie). Test is never indexable (X-Robots-Tag below).
+  const previewToken = queryToken ?? cookieToken;
+  const previewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const customization = await resolveCustomizationEnv({
+    isPreviewHost,
+    tenantId: tenant.tenant_id,
+    token: previewToken,
+    secret: previewSecret,
+    nowSeconds,
+  });
+  if (customization.reject) {
+    return new Response(customization.reject.message, {
+      status: customization.reject.status,
+    });
+  }
+  // Persist a query-supplied token as a cookie so later navigations stay in test.
+  if (customization.env === "test" && queryToken) {
+    context.cookies.set("tot_preview", queryToken, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge: 3600,
+    });
+  }
+
+  // Apply a published theme override for the resolved environment (store->app).
+  // The live domain serves `live`; a gated preview serves `test`. When nothing
+  // is published the build-time tenant theme is used unchanged.
+  //
+  // Resolution is versioned-aware inside readPublishedArtifact: env maps to a
+  // publish channel (live->live, test->preview); if the tenant has a channel
+  // pointer, the artifact is resolved through the immutable site version
+  // (channel -> versionId -> manifest -> content). Tenants with no channel
+  // pointer fall back to the legacy per-path selection — no behavior change.
+  const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
+
+  // Verify the developer-draft cookie (signature + expiry + tenant binding) — the
+  // overlay below only engages for the developer who minted the draft, on THIS
+  // tenant. Same secret + trust model as the preview token; invalid/expired/foreign
+  // tokens degrade silently to the base chain (never an error page).
+  const draftClaims =
+    draftCookie && previewSecret && kv
+      ? await verifyDevDraftToken(previewSecret, draftCookie, nowSeconds)
+      : null;
+  const draft =
+    draftClaims && draftClaims.tenantId === tenant.tenant_id ? draftClaims : null;
+
+  let theme = mergeTheme(referenceTheme, tenant.theme_tokens);
+  const publishedTheme = await readPublishedArtifact(
+    kvGet,
+    tenant.tenant_id,
+    customization.env,
+    themeArtifactPath(tenant.tenant_id),
+  );
+  if (publishedTheme) {
+    try {
+      theme = mergeTheme(theme, JSON.parse(publishedTheme) as DeepPartial<ThemeTokens>);
+    } catch {
+      /* malformed published artifact — keep the build-time theme */
+    }
+  }
+  // Developer-draft theme overlay (on top of published) — only for the draft owner.
+  if (draft) {
+    const draftTheme = await kvGet(devDraftKey(tenant.tenant_id, draft.draftId, "theme.json"));
+    if (draftTheme) {
+      try {
+        theme = mergeTheme(theme, JSON.parse(draftTheme) as DeepPartial<ThemeTokens>);
+      } catch {
+        /* malformed draft artifact — keep the resolved theme */
+      }
+    }
+  }
+
+  // Per-environment capabilities (Track A/B). Config-as-code: the build-time
+  // TenantConfig default is overridden by the published capabilities artifact for
+  // THIS environment — materialized from the tenant repo's .tot/config.json per
+  // commit (localhost=working tree, preview=PR head, live=promoted). So a
+  // capability change is PR-gated and separable per environment.
+  let publishedCaps: Partial<CapabilityConfig> | null = null;
+  const publishedCapsRaw = await readPublishedArtifact(
+    kvGet,
+    tenant.tenant_id,
+    customization.env,
+    capabilitiesArtifactPath(tenant.tenant_id),
+  );
+  if (publishedCapsRaw) {
+    try {
+      publishedCaps = JSON.parse(publishedCapsRaw) as Partial<CapabilityConfig>;
+    } catch {
+      /* malformed published artifact — keep the build-time default */
+    }
+  }
+  const capabilities = resolveCapabilities(tenant, publishedCaps);
+
+  // Per-request CSP nonce (D2): goes on the platform's own inline tags in
+  // Layout.astro so a strict CSP can allow them without 'unsafe-inline'.
+  const cspNonce = crypto.randomUUID();
+
+  locals.tenant = tenant;
+  // Effective capability flags for this tenant (commerce defaults unless the
+  // tenant declares siteType:"marketing" / explicit features). Pages and chrome
+  // read these instead of hard-coding tenant identity checks.
+  locals.features = resolveTenantFeatures(tenant);
+  locals.capabilities = capabilities;
+  // FoxyCart cart/checkout facts (Track A) — only when the tenant has a catalog
+  // AND the cartCheckout capability is enabled for THIS environment. Drives the
+  // loader + signed add-to-cart, and the CSP additions below.
+  const commerce =
+    locals.features.catalog && capabilities.cartCheckout.enabled
+      ? await resolveTenantCommerce(tenant)
+      : null;
+  locals.commerce = commerce ?? undefined;
+  locals.tot = tot;
+  locals.content = createContentProvider(tenant, {
+    get: kvGet,
+    env: customization.env,
+  });
+  // Developer-draft content overlay — serves the AI-edited artifacts to the draft
+  // owner only; every other viewer keeps the published/base chain above.
+  if (draft) {
+    locals.content = new DevDraftContentProvider(
+      locals.content,
+      tenant.tenant_id,
+      draft.draftId,
+      kvGet,
+    );
+  }
+  locals.themeStyle = themeToCssVars(theme);
+  locals.canonicalBase = canonicalBase;
+  locals.customizationEnv = customization.env;
+  locals.cspNonce = cspNonce;
+  // Prefix that path-routed pages live under ("" for host-routed). Pages stay
+  // tenant-agnostic; the Layout uses this to keep root-absolute links inside
+  // the tenant prefix on the client.
+  locals.basePath = basePath;
+
+  // When a /<domain>/ prefix selected the tenant, rewrite to the stripped route
+  // so the existing file-based routes match. next(path) rewrites WITHOUT
+  // re-running middleware, so the locals set above are preserved.
+  let response = basePath
+    ? await next(`${renderPath}${url.search}`)
+    : await next();
+
+  // On-publish auto-refresh: inject the live-reload client into SHARED preview
+  // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).
+  // It polls /__preview/version and reloads when this tenant's cache-version
+  // bumps on publish/reconcile. Injection happens before the CSP header is set so
+  // the script's per-request nonce (cspNonce) matches the enforced policy.
+  response = await maybeInjectPreviewReload(response, {
+    env: customization.env,
+    tenantId: tenant.tenant_id,
+    basePath,
+    nonce: cspNonce,
+  });
+
+  // Baseline security headers (S1) on every response — set before the page-cache
+  // store below so cached copies carry them too.
+  applySecurityHeaders(response.headers);
+
+  // Preview (test) output must never be indexed.
+  if (customization.noindex) {
+    response.headers.set("X-Robots-Tag", "noindex, nofollow");
+  }
+
+  // Strict CSP — now ENFORCED in every environment (Epic S2). The report-only
+  // rollout is complete: platform output is CSP-clean — inline styles are
+  // externalized (`inlineStylesheets: "never"`), Astro's static inline scripts +
+  // island style are hash-pinned (cspStaticHashes), our dynamic inline tags carry
+  // the per-request nonce, and the last inline event handler (SortSelect's
+  // `onchange`) is now a bundled 'self' script. Reporting endpoints stay attached
+  // (report-to/report-uri work in enforce mode), so we keep telemetry as tenant
+  // client JS arrives — those per-version tenant hashes extend `scriptSrc` per
+  // request (the mechanism below already supports it).
+  //
+  // DEV EXCEPTION: `astro dev` serves CSS/HMR as UN-nonced inline <style>/<script>
+  // (Vite injects them); the strict nonce policy blocks those, leaving the dev
+  // site unstyled. The BUILD is CSP-clean (styles are externalized via
+  // `inlineStylesheets:"never"`), so we enforce there and only REPORT in dev —
+  // violations are still surfaced, but styling/HMR work locally.
+  const cspHeader = import.meta.env.DEV
+    ? "Content-Security-Policy-Report-Only"
+    : "Content-Security-Policy";
+  response.headers.set(
+    "Reporting-Endpoints",
+    `${CSP_REPORT_GROUP}="${CSP_REPORT_PATH}"`,
+  );
+  // FoxyCart origins (loader CDN + the store's cart/checkout host) added to the
+  // strict policy only when this tenant has a store — so add-to-cart, the
+  // sidecart iframe/XHR, and the cross-origin form POST all pass.
+  const foxyCsp = commerce ? foxyCspAdditions(commerce.origin) : null;
+  response.headers.set(
+    cspHeader,
+    buildCsp({
+      nonce: cspNonce,
+      ...STOREFRONT_CSP_ALLOWLIST,
+      // Pin Astro's static inline hydration scripts + island style by hash
+      // (they're identical every request); my dynamic inline tags use the nonce.
+      scriptSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.scriptSrc,
+        ...STATIC_SCRIPT_HASHES,
+        ...(foxyCsp?.scriptSrc ?? []),
+      ],
+      styleSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.styleSrc,
+        ...STATIC_STYLE_HASHES,
+        ...(foxyCsp?.styleSrc ?? []),
+      ],
+      fontSrc: [...STOREFRONT_CSP_ALLOWLIST.fontSrc, ...(foxyCsp?.fontSrc ?? [])],
+      connectSrc: [
+        ...STOREFRONT_CSP_ALLOWLIST.connectSrc,
+        ...(foxyCsp?.connectSrc ?? []),
+      ],
+      imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(foxyCsp?.imgSrc ?? [])],
+      frameSrc: foxyCsp?.frameSrc ?? [],
+      formAction: foxyCsp?.formAction ?? [],
+      reportGroup: CSP_REPORT_GROUP,
+      reportUri: CSP_REPORT_PATH,
+    }),
+  );
+
+  // D1: store the fully-rendered, CSP-stamped response for the next reader. Only
+  // production (no preview token reached here) cacheable GETs have a pageKey;
+  // putCachedPage additionally skips non-200, non-HTML, and cookie-bearing
+  // responses. Also expose Cache-Control to any fronting CDN.
+  if (pageKey && cache && customization.env === "live") {
+    response.headers.set(
+      "Cache-Control",
+      "public, s-maxage=300, stale-while-revalidate=86400",
+    );
+    await putCachedPage(cache, pageKey, response);
+  }
+  return response;
+});