@tokenoftrust/storefront-runner 1.3.4-rc.3 → 1.4.0

package/apps/storefront/src/lib/webhooks/webhookSigningKey.ts

@@ -0,0 +1,146 @@
+/**
+ * RS256 signing-key loader for outbound webhook delivery (PrivateApps epic,
+ * D4 Chunk B) — the key `signing.ts` uses to attach HTTP Message Signatures
+ * (RFC 9421) to every CloudEvents webhook POST.
+ *
+ * Mirrors `../apps/gatewayKeys.ts`'s `loadGatewaySigningConfig`/
+ * `loadGatewayJwks` structure EXACTLY (import cache keyed on the base64
+ * source, JWKS derivation that strips every private RSA field), but over a
+ * SEPARATE key (`WEBHOOK_SIGNING_PRIVATE_KEY_B64`) with a separate kid
+ * (`webhook-signing-1`) — per `d4-design-resolutions`, this key must never be
+ * the same as the D2 gateway key. The gateway key attests requests an app
+ * makes INTO the storefront (app → gateway trust); the webhook signing key
+ * attests events the storefront pushes OUT to an app (gateway → app trust,
+ * the opposite direction). Sharing a key would let a receiver's verification
+ * key double as the ability to (offline) verify gateway tokens, and rotating
+ * one would force rotating the other.
+ *
+ * The private key never leaves this module. `loadWebhookJwks` derives the
+ * PUBLIC-only JWKS from it, published (Chunk B) via a new field on
+ * `/.well-known/tot-app-authorization-metadata`.
+ */
+import { importPKCS8, exportJWK, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
+import { readEnv } from "@/lib/env";
+// Re-exported (not re-defined) — `@tokenoftrust/private-apps-devkit`'s
+// signing.ts is the ONE source of truth for this constant since D6 Chunk B
+// (it's the `alg` its sign/verify functions produce/accept); this module
+// just keeps the historical import path (`./webhookSigningKey.js`) working.
+export { WEBHOOK_SIGNING_HTTPSIG_ALG } from "@tokenoftrust/private-apps-devkit";
+
+/** The only algorithm the webhook signer signs with (verifiers reject anything else). */
+export const WEBHOOK_SIGNING_ALG = "RS256";
+
+/** Default key id (overridable via `WEBHOOK_SIGNING_KID`). Names the published key. */
+export const DEFAULT_WEBHOOK_SIGNING_KID = "webhook-signing-1";
+
+/** Env keys the loader reads (server-only). */
+export const WEBHOOK_SIGNING_PRIVATE_KEY_ENV = "WEBHOOK_SIGNING_PRIVATE_KEY_B64";
+export const WEBHOOK_SIGNING_KID_ENV = "WEBHOOK_SIGNING_KID";
+
+/**
+ * Thrown when the webhook signer can't load its signing key — the private
+ * key env is absent/malformed. Callers FAIL CLOSED: with no key, no delivery
+ * can be signed, and the metadata route omits the webhook JWKS field rather
+ * than publish a key that will never actually sign anything.
+ */
+export class WebhookSigningKeyError extends Error {}
+
+/** Optional test/DI overrides (avoids touching process env in unit tests). */
+export interface WebhookSigningKeyOverrides {
+  /** base64 of the PKCS8 PEM private key (defaults to the env value). */
+  privateKeyB64?: string;
+  kid?: string;
+}
+
+export interface WebhookSigningConfig {
+  key: CryptoKey;
+  kid: string;
+}
+
+// Same cache shape as gatewayKeys.ts's signingKeyCache/publicJwkCache, keyed
+// on the base64 string so a rotated key transparently re-imports/re-derives.
+const signingKeyCache = new Map<string, CryptoKey>();
+const publicJwkCache = new Map<string, JWK>();
+
+async function importPrivateKey(privateKeyB64: string): Promise<CryptoKey> {
+  const cached = signingKeyCache.get(privateKeyB64);
+  if (cached) return cached;
+  let pem: string;
+  try {
+    pem = Buffer.from(privateKeyB64, "base64").toString("utf8");
+  } catch (cause) {
+    throw new WebhookSigningKeyError(
+      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not valid base64 ` +
+        (cause instanceof Error ? cause.message : String(cause)),
+    );
+  }
+  if (!/-----BEGIN (RSA )?PRIVATE KEY-----/.test(pem)) {
+    throw new WebhookSigningKeyError(
+      `webhook signing: decoded ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not a PEM private key`,
+    );
+  }
+  let key: CryptoKey;
+  try {
+    // extractable: true — required so `loadWebhookJwks` below can derive the
+    // public JWK from this same key, and so `signing.ts` can sign raw bytes
+    // with `crypto.subtle.sign` directly (no JWS wrapping needed for RFC
+    // 9421 — the signature is over the derived signature base, not a JWT).
+    key = (await importPKCS8(pem, WEBHOOK_SIGNING_ALG, { extractable: true })) as CryptoKey;
+  } catch (cause) {
+    throw new WebhookSigningKeyError(
+      `webhook signing: failed to import the RS256 private key ` +
+        (cause instanceof Error ? cause.message : String(cause)),
+    );
+  }
+  signingKeyCache.set(privateKeyB64, key);
+  return key;
+}
+
+/**
+ * Resolve the active signing config (key + kid) from env, or `overrides` in
+ * tests. FAILS CLOSED: throws {@link WebhookSigningKeyError} when the private
+ * key env is absent/malformed.
+ */
+export async function loadWebhookSigningConfig(
+  overrides: WebhookSigningKeyOverrides = {},
+): Promise<WebhookSigningConfig> {
+  const privateKeyB64 =
+    overrides.privateKeyB64 ?? (await readEnv(WEBHOOK_SIGNING_PRIVATE_KEY_ENV));
+  if (!privateKeyB64) {
+    throw new WebhookSigningKeyError(
+      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not configured (fail closed)`,
+    );
+  }
+  const kid = overrides.kid ?? (await readEnv(WEBHOOK_SIGNING_KID_ENV)) ?? DEFAULT_WEBHOOK_SIGNING_KID;
+  const key = await importPrivateKey(privateKeyB64);
+  return { key, kid };
+}
+
+/**
+ * Derive the PUBLIC JWKS for the active webhook signing key — sanitized
+ * (every private RSA field stripped) and cached by the source private-key
+ * base64. V1 always returns exactly one key; the envelope supports more
+ * without a shape change later (rotation-with-overlap).
+ */
+export async function loadWebhookJwks(
+  overrides: WebhookSigningKeyOverrides = {},
+): Promise<JSONWebKeySet> {
+  const privateKeyB64 =
+    overrides.privateKeyB64 ?? (await readEnv(WEBHOOK_SIGNING_PRIVATE_KEY_ENV));
+  if (!privateKeyB64) {
+    throw new WebhookSigningKeyError(
+      `webhook signing: ${WEBHOOK_SIGNING_PRIVATE_KEY_ENV} is not configured (fail closed)`,
+    );
+  }
+  const { key, kid } = await loadWebhookSigningConfig(overrides);
+  let jwk = publicJwkCache.get(privateKeyB64);
+  if (!jwk) {
+    const full = (await exportJWK(key)) as Record<string, unknown>;
+    // Strip every private RSA field (RFC 7518 §6.3.2) — only the public parts
+    // (kty, n, e) are ever published. This line is the one place that matters.
+    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, ...publicOnly } = full;
+    jwk = { ...publicOnly, kid, alg: WEBHOOK_SIGNING_ALG, use: "sig" };
+    publicJwkCache.set(privateKeyB64, jwk);
+  }
+  return { keys: [jwk] };
+}

package/apps/storefront/src/middleware/index.ts

@@ -30,6 +30,7 @@ import {
   buildCsp,
   STOREFRONT_CSP_ALLOWLIST,
   checkoutCspAdditions,
+  appWidgetCspAdditions,
   CSP_REPORT_GROUP,
   CSP_REPORT_PATH,
   readPublishedArtifact,
@@ -46,13 +47,13 @@ import {
   parseGateMode,
   isAuthPath,
   sessionAdmitsHost,
+  sessionHostCapability,
   PUBLIC_HOME_TENANT_ID,
 } from "@/lib/auth/loginGate";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
 import { HEALTH_PATH, healthResponse } from "@/lib/health";
-import { membershipFor } from "@/lib/dashboard/tenantSelection";
 import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
 
 export const onRequest = defineMiddleware(async (context, next) => {
@@ -160,17 +161,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
       return gatedHoldingResponse(decision.location);
     }
     if (admitted && viewerRecord) {
-      // Surface the viewer's role FOR THIS host's tenant as chrome. A member sees
-      // their tenants[] role; a ToT-staff viewer admitted via an explicit vendor
-      // selection sees the staffRoles-scoped capability (distinct path).
-      const role = membershipFor(viewerRecord.tenants, tenant.appDomain, {
-        selection: viewerRecord.staffSelection,
-        nowSeconds,
-      })?.role;
+      // Surface the viewer's standing FOR THIS host's tenant as chrome, BOUND to
+      // the host so a capability the session holds for another tenant never leaks
+      // in: a member sees their tenants[] role; the owner of their own tenant sees
+      // the resource-scoped session's capability; a ToT-staff viewer admitted via
+      // an explicit vendor selection sees the staffRoles-scoped capability. The
+      // ship gates (u10 decideIsOwner/resolveShipPrincipal) read this capability,
+      // so binding it here keeps owner-resolution server-side + tenant-correct.
+      const hostCapability = sessionHostCapability(viewerRecord, tenant.appDomain, nowSeconds);
       locals.viewer = {
         email: viewerRecord.email,
-        roles: role ? [role] : viewerRecord.roles,
-        capability: role ?? viewerRecord.capability,
+        roles: hostCapability ? [hostCapability] : viewerRecord.roles,
+        capability: hostCapability ?? viewerRecord.capability,
       };
     }
   }
@@ -210,8 +212,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
     if (hit) return hit;
   }
 
-  // Edge read replica: opt-in via USE_D1_CATALOG=1 (+ a CATALOG_DB binding). Off
-  // by default, so the bundled fixture snapshot serves reads.
+  // Catalog source selection (F17 graduation path — docs/architecture/product-catalog.md).
+  // A store's product source graduates over its life: JSON fixtures (dev default) ->
+  // D1 edge replica (staging) -> hosted ToT catalog (go-live). Here we pick the read
+  // backend: USE_D1_CATALOG=1 (+ a CATALOG_DB binding) reads the D1 edge replica;
+  // otherwise createToTClient falls back to the bundled JSON fixture snapshot. The
+  // hosted catalog graduates the SAME canonical records into the D1 read model
+  // (emitCatalogSql), so JSON/D1/hosted render identically — pinned by
+  // lib/tot/sourceSelection.test.ts.
   const d1 =
     (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined;
   const tot = await createToTClient(tenant, d1);
@@ -360,6 +368,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
   locals.canonicalBase = canonicalBase;
   locals.customizationEnv = customization.env;
   locals.cspNonce = cspNonce;
+  // Seeded here, filled in by whichever page/layout renders a widget slot
+  // (renderSlot.ts) as the page renders inside next() below — read back out
+  // after next() resolves so the CSP frame-src reflects exactly what rendered.
+  locals.activeWidgetPlacements = [];
   // Prefix that path-routed pages live under ("" for host-routed). Pages stay
   // tenant-agnostic; the Layout uses this to keep root-absolute links inside
   // the tenant prefix on the client.
@@ -427,6 +439,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // strict policy only when this tenant has a store — so add-to-cart, the
   // sidecart iframe/XHR, and the cross-origin form POST all pass.
   const checkoutCsp = commerce ? checkoutCspAdditions(commerce.origin) : null;
+  // Private-app widget origins (D5) — read back AFTER next() so this reflects
+  // exactly the placements that rendered on THIS page, never a wildcard.
+  const widgetCsp = appWidgetCspAdditions(locals.activeWidgetPlacements ?? []);
   response.headers.set(
     cspHeader,
     buildCsp({
@@ -450,7 +465,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
         ...(checkoutCsp?.connectSrc ?? []),
       ],
       imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(checkoutCsp?.imgSrc ?? [])],
-      frameSrc: checkoutCsp?.frameSrc ?? [],
+      frameSrc: [...(checkoutCsp?.frameSrc ?? []), ...widgetCsp.frameSrc],
       formAction: checkoutCsp?.formAction ?? [],
       reportGroup: CSP_REPORT_GROUP,
       reportUri: CSP_REPORT_PATH,

package/apps/storefront/src/pages/404.astro

@@ -2,15 +2,25 @@
 /**
  * 404 — written in the Northwind voice, not a stub. Offers a way home and a
  * few collections to wander into so a dead link still lands somewhere useful.
+ *
+ * DELIBERATELY on-demand — do NOT prerender (audit finding "selective-prerender").
+ * Fully tenant-varying: it reads Astro.locals.tenant + tot.listCollections() and
+ * renders under locals.themeStyle, all set per-request by the middleware from the
+ * resolved Host. Prerendering would freeze a single build-time tenant AND strip the
+ * middleware-applied CSP + security headers (no static _headers fallback exists).
  */
+export const prerender = false;
+
 import Layout from "@/layouts/Layout.astro";
 import CollectionCard from "@/components/CollectionCard.astro";
 import { withBase } from "@/lib/basePath";
 
-const { tenant, tot, basePath } = Astro.locals;
+const { tenant, tot, basePath, features } = Astro.locals;
 
-// A handful of collections to redirect lost visitors toward.
-const collections = (await tot.listCollections()).slice(0, 3);
+// A handful of collections to redirect lost visitors toward. Marketing tenants
+// (features.catalog === false) have no /collections route at all — skip the
+// fetch entirely rather than trust it to come back empty.
+const collections = features.catalog ? (await tot.listCollections()).slice(0, 3) : [];
 ---
 
 <Layout
@@ -36,12 +46,14 @@ const collections = (await tot.listCollections()).slice(0, 3);
         >
           Back home
         </a>
-        <a
-          href={withBase(basePath, "/collections")}
-          class="inline-flex items-center rounded-full border border-[var(--color-border)] px-6 py-3 font-display text-sm font-medium text-[var(--color-text)] transition-colors hover:border-[var(--color-primary)]"
-        >
-          Browse collections
-        </a>
+        {features.catalog && (
+          <a
+            href={withBase(basePath, "/collections")}
+            class="inline-flex items-center rounded-full border border-[var(--color-border)] px-6 py-3 font-display text-sm font-medium text-[var(--color-text)] transition-colors hover:border-[var(--color-primary)]"
+          >
+            Browse collections
+          </a>
+        )}
       </div>
     </div>
   </section>

package/apps/storefront/src/pages/[...slug].astro

@@ -7,6 +7,8 @@
  */
 import Layout from "@/layouts/Layout.astro";
 import Breadcrumbs from "@/components/Breadcrumbs.astro";
+import ProseSections from "@/components/content/ProseSections.astro";
+import ProseToc from "@/components/content/ProseToc.astro";
 import { breadcrumbLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
@@ -56,6 +58,27 @@ const crumbs = [
 const description =
   page.seoDescription ||
   (page.intro ? truncate(page.intro, 160) : undefined);
+
+// Structured pages (F4) drive the body from `sections`; legacy pages keep the
+// sanitized `body_html`. Prefer structured whenever a page ships sections.
+const structured = (page.sections?.length ?? 0) > 0;
+
+// Reviewer-only needs-review flags render in preview/dev only — mirrors the
+// middleware's "production read" definition (no preview host / token / cookie),
+// so a real shopper never sees scaffolding but a reviewer does.
+const isPreview =
+  import.meta.env.DEV ||
+  Astro.url.hostname.toLowerCase().startsWith("preview.") ||
+  Astro.url.searchParams.has("__preview") ||
+  Astro.cookies.has("tot_preview");
+
+const updatedLabel = page.updated
+  ? new Date(page.updated).toLocaleDateString("en-US", {
+      year: "numeric",
+      month: "long",
+      day: "numeric",
+    })
+  : null;
 ---
 
 <Layout
@@ -80,10 +103,21 @@ const description =
         {page.intro}
       </p>
     )}
+    {updatedLabel && (
+      <p class="mt-3 text-sm text-[var(--color-muted)]">Last updated {updatedLabel}</p>
+    )}
+    {structured && <ProseToc sections={page.sections!} />}
   </header>
 
-  {/* Body — constrained to a readable measure. */}
+  {/* Body — constrained to a readable measure. Structured pages (F4) render
+      framework widgets from `sections`; legacy pages keep the sanitized HTML. */}
   <div class="container-prose pb-[clamp(3rem,7vw,6rem)] pt-8">
-    <div class="rte mx-auto max-w-[68ch] text-[var(--color-text)]" set:html={page.body_html} />
+    {structured ? (
+      <div class="mx-auto max-w-[68ch]">
+        <ProseSections sections={page.sections!} includeNeedsReview={isPreview} />
+      </div>
+    ) : (
+      <div class="rte mx-auto max-w-[68ch] text-[var(--color-text)]" set:html={page.body_html} />
+    )}
   </div>
 </Layout>

package/apps/storefront/src/pages/admin.astro

@@ -13,7 +13,7 @@
  * SHELL CONTRACT — every AdminXTab.astro component mounted below must preserve:
  *   - A `<section id="{tab}" data-admin-panel data-agent-scope="{tab}">` root,
  *     where {tab} is one of: orders, products, subscriptions, customers, fulfillment,
- *     reporting, ai-workflows, settings. The shell's hash router shows/hides
+ *     reporting, ai-workflows, publish, settings. The shell's hash router shows/hides
  *     panels by matching `html[data-admin-tab]` to this id, and the AI Ask
  *     envelope reads `data-agent-scope` to label its active context.
  *   - No tab-switching chrome of its own — `#{tab}` deep links and the shell's
@@ -37,9 +37,11 @@ import OrdersWorkspace from "../components/admin/orders/OrdersWorkspace.astro";
 import AdminProductsTab from "../components/admin/AdminProductsTab.astro";
 import AdminSubscriptionsTab from "../components/admin/AdminSubscriptionsTab.astro";
 import AdminReportingTab from "../components/admin/AdminReportingTab.astro";
+import AdminPublishTab from "../components/admin/AdminPublishTab.astro";
 import AdminSettingsTab from "../components/admin/AdminSettingsTab.astro";
 import { readViewerSession } from "@/lib/auth/route";
 import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
+import { resolveAdminEntry } from "@/lib/auth/adminEntry";
 
 const { tenant, basePath, cspNonce } = Astro.locals;
 const adminPath = `${basePath || ""}/admin`;
@@ -49,6 +51,19 @@ const viewerEmail = (Astro.locals.viewer?.email ?? viewerSession?.email ?? "").t
 const viewerDomain = viewerEmail.split("@").at(-1) ?? "";
 const canViewInternalGuide = viewerDomain === "tokenoftrust.com";
 
+// dg6 — admin session ENTRY resolved SERVER-SIDE against the resolved tenant's
+// appDomain (never client input, never a bearer secret): an authenticated
+// owner/team member for THIS tenant reaches the admin context; a non-member /
+// anonymous visitor was already held at the sign-in gate (middleware). Consumes
+// u10's owner + ship-capability model; the go-live tabs (AdminPublishTab) read
+// the same host-bound `Astro.locals.viewer.capability`, so the shell just stamps
+// the authoritative principal for chrome + tests — it does not re-gate.
+const adminEntry = resolveAdminEntry({
+  record: viewerSession,
+  hostResource: tenant.appDomain,
+  nowSeconds: Math.floor(Date.now() / 1000),
+});
+
 // Internal admin-app tenant mode (baseline doc §Admin App As Tenant,
 // tenant-envelope-contract): every mounted tab receives an explicit
 // { adminAppTenant, targetTenant } envelope. Only a real ToT-staff session
@@ -72,6 +87,11 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
   data-admin-target-tenant={tenantEnvelope.targetTenant}
   data-admin-operator={tenantEnvelope.operator ?? ""}
   data-admin-is-staff={isStaff ? "true" : "false"}
+  data-admin-viewer-authenticated={viewerSession ? "true" : "false"}
+  data-admin-entry-principal={adminEntry.principal}
+  data-admin-is-owner={adminEntry.isOwnerViewer ? "true" : "false"}
+  data-admin-can-ship={adminEntry.shipCapabilities.shipOnBehalf ? "true" : "false"}
+  data-admin-can-apex-cutover={adminEntry.shipCapabilities.apexCutover ? "true" : "false"}
 >
   <head>
     <meta charset="utf-8" />
@@ -80,7 +100,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
     <title>{tenantLabel} Admin</title>
     <script is:inline nonce={cspNonce}>
       (() => {
-        const adminTabs = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "settings"];
+        const adminTabs = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "publish", "settings"];
         const canViewInternalGuide = document.documentElement.dataset.internalAdminGuide === "true";
         const defaultTab = canViewInternalGuide ? "orders" : "settings";
         const hash = window.location.hash.slice(1);
@@ -508,6 +528,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="fulfillment"] #fulfillment,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="reporting"] #reporting,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="ai-workflows"] #ai-workflows,
+      html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="publish"] #publish,
       html.admin-tabs-ready[data-admin-mode="work-area"][data-admin-tab="settings"] #settings {
         display: grid;
       }
@@ -1133,6 +1154,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <a href="#fulfillment" data-admin-tab-link><svg><use href="#i-truck"></use></svg><span>Fulfillment</span></a>
           <a href="#reporting" data-admin-tab-link><svg><use href="#i-chart"></use></svg><span>Reporting</span></a>
           <a href="#ai-workflows" data-admin-tab-link><svg><use href="#i-workflows"></use></svg><span>AI Workflows</span></a>
+          <a href="#publish" data-admin-tab-link><svg><use href="#i-export"></use></svg><span>Publish</span></a>
           <a href="#settings" data-admin-tab-link><svg><use href="#i-gear"></use></svg><span>Settings</span></a>
         </nav>
 
@@ -1159,6 +1181,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <a class="tab" href="#fulfillment" role="tab" aria-controls="fulfillment" aria-selected="false" data-admin-tab-link>Fulfillment</a>
           <a class="tab" href="#reporting" role="tab" aria-controls="reporting" aria-selected="false" data-admin-tab-link>Reporting</a>
           <a class="tab" href="#ai-workflows" role="tab" aria-controls="ai-workflows" aria-selected="false" data-admin-tab-link>AI Workflows</a>
+          <a class="tab" href="#publish" role="tab" aria-controls="publish" aria-selected="false" data-admin-tab-link>Publish</a>
           <a class="tab" href="#settings" role="tab" aria-controls="settings" aria-selected="false" data-admin-tab-link>Settings</a>
         </div>
 
@@ -1206,6 +1229,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
                   <a id="admin-tab-fulfillment" class="tab" href="#fulfillment" role="tab" aria-controls="fulfillment" aria-selected="false" data-admin-tab-link>Fulfillment</a>
                   <a id="admin-tab-reporting" class="tab" href="#reporting" role="tab" aria-controls="reporting" aria-selected="false" data-admin-tab-link>Reporting</a>
                   <a id="admin-tab-ai-workflows" class="tab" href="#ai-workflows" role="tab" aria-controls="ai-workflows" aria-selected="false" data-admin-tab-link>AI Workflows</a>
+                  <a id="admin-tab-publish" class="tab" href="#publish" role="tab" aria-controls="publish" aria-selected="false" data-admin-tab-link>Publish</a>
                   <a id="admin-tab-settings" class="tab" href="#settings" role="tab" aria-controls="settings" aria-selected="false" data-admin-tab-link>Settings</a>
                 </div>
 
@@ -1331,6 +1355,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           <AdminFulfillmentTab envelope={tenantEnvelope} />
           <AdminReportingTab envelope={tenantEnvelope} />
           <AdminAIWorkflowsTab envelope={tenantEnvelope} />
+          <AdminPublishTab envelope={tenantEnvelope} />
           <AdminSettingsTab envelope={tenantEnvelope} />
 
           {canViewInternalGuide && (
@@ -1447,7 +1472,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
 
     <script is:inline nonce={cspNonce}>
       (() => {
-        const tabIds = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "settings"];
+        const tabIds = ["orders", "products", "subscriptions", "customers", "fulfillment", "reporting", "ai-workflows", "publish", "settings"];
         const tabSet = new Set(tabIds);
         const tabHashPattern = new RegExp(`^#(${tabIds.join("|")})$`);
         const canViewInternalGuide = document.documentElement.dataset.internalAdminGuide === "true";
@@ -1460,6 +1485,7 @@ const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = admin
           fulfillment: "Fulfillment",
           reporting: "Reporting",
           "ai-workflows": "AI Workflows",
+          publish: "Publish",
           settings: "Settings",
         };
 

package/apps/storefront/src/pages/api/apps/admin/credentials/rotate.ts

@@ -0,0 +1,60 @@
+/**
+ * POST /api/apps/admin/credentials/rotate — rotate an install's client
+ * secret, keeping the same `client_id` (PrivateApps epic, D2 Chunk C; D8
+ * console-session auth added). The new secret is returned ONCE here and never
+ * again — the same one-time-secret guarantee `install()` gives (see
+ * `registryService.ts`'s `InstallResult` doc).
+ *
+ * `registryService.rotateCredentials()` takes a bare `installId` with no
+ * tenant check of its own (Chunk A assumption #1) — so this route resolves
+ * the install via `requireOwnedInstall` BEFORE calling it, rejecting a
+ * foreign-tenant `installId` with the SAME 404 a truly-missing one gets (no
+ * cross-tenant existence oracle). Mutating: `requireManageRole` gates a
+ * console `developer` role out — the host-bound/Bearer path is exempt (no
+ * `role`).
+ */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import {
+  getRegistryService,
+  registryErrorResponse,
+  requireOwnedInstall,
+  requireManageRole,
+  parseInstallId,
+  json,
+} from "@/lib/apps/adminService.js";
+import { RegistryError } from "@/lib/apps/registryService.js";
+
+export const prerender = false;
+
+export async function POST(context: APIContext): Promise<Response> {
+  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
+  const auth = await resolveOperatorSession(context, requestedTenant);
+  if (!auth.ok) return json({ error: auth.message }, auth.status);
+  const manageDenied = requireManageRole(auth);
+  if (manageDenied) return manageDenied;
+
+  let body: unknown;
+  try {
+    body = await context.request.json();
+  } catch {
+    return json({ error: "invalid JSON body" }, 400);
+  }
+
+  const installId = parseInstallId(body);
+  if (!installId) return json({ error: "installId is required" }, 400);
+
+  const registry = await getRegistryService();
+  if (registry instanceof Response) return registry;
+
+  const owned = await requireOwnedInstall(registry, installId, auth.tenantId);
+  if (owned instanceof Response) return owned;
+
+  try {
+    const issued = await registry.rotateCredentials(installId, auth.actor);
+    return json({ credential: { clientId: issued.clientId, secret: issued.secret } });
+  } catch (err) {
+    if (err instanceof RegistryError) return registryErrorResponse(err);
+    throw err;
+  }
+}

package/apps/storefront/src/pages/api/apps/admin/health.ts

@@ -0,0 +1,44 @@
+/**
+ * GET /api/apps/admin/health — the console's per-install health rollup for
+ * the resolved operator tenant (PrivateApps epic, D8 Chunk C). Read-only:
+ * any membership role admits (mirrors `list.ts`'s `?tenant=`-as-candidate
+ * scoping — the tenant actually queried is always `auth.tenantId`, never the
+ * raw param).
+ *
+ * Folds `registryService.listByTenant` with `deliveryStore.getInstallHealth`
+ * per install through `healthAggregate.ts`'s `buildInstallHealthView` — that
+ * view is what data-minimizes `webhookEndpoint` down to `hasWebhookEndpoint`,
+ * so this route never even holds the raw endpoint value to leak.
+ */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import { getRegistryService, json } from "@/lib/apps/adminService.js";
+import { WebhookDeliveryStore } from "@/lib/webhooks/deliveryStore.js";
+import { buildInstallHealthView, type AppInstallHealthView } from "@/lib/apps/healthAggregate.js";
+import { fromD1 } from "@/lib/d1/catalog.js";
+import { readD1 } from "@/lib/env";
+
+export const prerender = false;
+
+export async function GET(context: APIContext): Promise<Response> {
+  const requestedTenant = new URL(context.request.url).searchParams.get("tenant");
+  const auth = await resolveOperatorSession(context, requestedTenant);
+  if (!auth.ok) return json({ error: auth.message }, auth.status);
+
+  const registry = await getRegistryService();
+  if (registry instanceof Response) return registry;
+
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ error: "webhook store not configured" }, 503);
+  const deliveryStore = new WebhookDeliveryStore(fromD1(d1));
+
+  const installs = await registry.listByTenant(auth.tenantId);
+  const apps: AppInstallHealthView[] = await Promise.all(
+    installs.map(async (install) => {
+      const health = await deliveryStore.getInstallHealth(install.installId);
+      return buildInstallHealthView(install, health);
+    }),
+  );
+
+  return json({ apps });
+}