@tokenoftrust/storefront-runner 1.3.4-rc.4 → 1.4.0

package/apps/storefront/src/pages/collections/[handle].astro

@@ -34,6 +34,13 @@ query.collection = handle;
 if (!query.pageSize) query.pageSize = 9;
 
 const { products, page, pageSize, total, facets } = await tot.listProducts(query);
+
+// A synthesized-EMPTY collection (zero active members overall — not merely
+// zero under the current facet/price/q filters) still resolves 200 for a direct
+// link, but must not be indexed: it's a crawlable dead end, kept out of the
+// sitemap + directory too. Detect it via the UNFILTERED membership total.
+const { total: memberTotal } = await tot.listProducts({ collection: handle, pageSize: 1 });
+const isEmptyCollection = memberTotal === 0;
 const basePath = `/collections/${handle}`;
 // Tenant-prefixed page path for facet/sort/pagination, which build links by
 // string-concatenating onto this base (so they stay inside a path-routed
@@ -76,6 +83,7 @@ if (query.priceMin != null || query.priceMax != null) {
   title={collection.seo.title || collection.title}
   description={collection.seo.description || (desc ? truncate(desc, 160) : `Shop ${collection.title} at ${tenant.displayName}.`)}
   path={basePath}
+  noindex={isEmptyCollection}
   jsonLd={[
     breadcrumbLd(crumbs, canonicalBase),
     itemListLd(products, canonicalBase, (page - 1) * pageSize),

package/apps/storefront/src/pages/collections/index.astro

@@ -8,11 +8,19 @@ import Breadcrumbs from "@/components/Breadcrumbs.astro";
 import CollectionCard from "@/components/CollectionCard.astro";
 import EmptyState from "@/components/EmptyState.astro";
 import { breadcrumbLd } from "@/lib/jsonld";
+import { activeMemberCount, nonEmptyCollections } from "@/lib/tot/query";
 
 const { tenant, tot, canonicalBase } = Astro.locals;
 // Commerce-only route: marketing tenants have no catalog surface.
 if (!Astro.locals.features.catalog) return new Response(null, { status: 404 });
-const collections = await tot.listCollections();
+// Directory lists only populated collections — empty synthesized shells are
+// hidden here just as they're kept out of the sitemap/llms.txt. Product counts
+// reflect ACTIVE membership (product_handles can list drafts/dropped items).
+const [allCollections, activeProducts] = await Promise.all([
+  tot.listCollections(),
+  tot.getAllActiveProducts(),
+]);
+const collections = nonEmptyCollections(allCollections, activeProducts);
 
 const crumbs = [
   { label: tenant.displayName, href: "/" },
@@ -51,7 +59,7 @@ const crumbs = [
     ) : (
       <div class="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
         {collections.map((c) => (
-          <CollectionCard collection={c} productCount={c.product_handles.length} />
+          <CollectionCard collection={c} productCount={activeMemberCount(c, activeProducts)} />
         ))}
       </div>
     )}

package/apps/storefront/src/pages/dashboard/[appDomain]/apps/index.astro

@@ -0,0 +1,119 @@
+---
+/**
+ * /dashboard/<appDomain>/apps — the console's app-health list (PrivateApps
+ * epic, D8 Chunk C). Guarded the same way as `../team.astro`: signed-in
+ * session + a membership for this appDomain, else bounce.
+ *
+ * Thin shell over one session-authed endpoint:
+ *   GET /api/apps/admin/health?tenant=<appDomain> → AppInstallHealthView[]
+ * `canManage` is resolved server-side from the SAME `MANAGE_ROLES` set the
+ * mutating admin routes gate on, and passed to the client via `data-can-
+ * manage` so a `developer` viewer never even sees the suspend/uninstall/
+ * rotate buttons rendered (the routes still enforce it independently —
+ * this is UX, not the security boundary).
+ */
+export const prerender = false;
+
+import { readViewerSession } from "@/lib/auth/route";
+import { membershipFor } from "@/lib/dashboard/tenantSelection";
+import { MANAGE_ROLES } from "@/lib/apps/adminSession.js";
+
+const cspNonce = Astro.locals.cspNonce;
+const appDomain = decodeURIComponent(Astro.params.appDomain ?? "");
+
+const session = await readViewerSession(Astro);
+if (!session) {
+  return Astro.redirect(
+    `/auth/login?next=${encodeURIComponent(`/dashboard/${appDomain}/apps`)}`,
+    302,
+  );
+}
+const membership = membershipFor(session.tenants, appDomain, {
+  selection: session.staffSelection,
+  nowSeconds: Math.floor(Date.now() / 1000),
+});
+if (!membership) {
+  return Astro.redirect("/dashboard", 302);
+}
+const canManage = MANAGE_ROLES.has(membership.role);
+const backHref = `/dashboard/${encodeURIComponent(appDomain)}`;
+---
+
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex, nofollow" />
+    <title>Apps — {appDomain}</title>
+    <style nonce={cspNonce}>
+      :root { color-scheme: light dark; }
+      * { box-sizing: border-box; }
+      body { font: 15px/1.6 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+        margin: 0; min-height: 100vh; padding: 2.5rem 1.25rem; background: #f5f4f0; color: #1c1c1c; }
+      @media (prefers-color-scheme: dark) { body { background: #14141a; color: #ececf1; } }
+      main { max-width: 48rem; margin-inline: auto; }
+      .eyebrow { font: 600 .68rem/1 ui-monospace, monospace; letter-spacing: .12em; text-transform: uppercase; color: #8a7f66; margin: 0 0 .5rem; }
+      h1 { font-size: 1.5rem; letter-spacing: -.01em; margin: 0 0 .3rem; }
+      .sub { color: #6a6a6a; margin: 0 0 1.5rem; }
+      @media (prefers-color-scheme: dark) { .sub { color: #a2a2ad; } }
+      #apps { display: flex; flex-direction: column; gap: 1rem; }
+      .card { background: #fff; border: 1px solid #e6e4de; border-radius: 12px; padding: 1.15rem 1.25rem; }
+      @media (prefers-color-scheme: dark) { .card { background: #1e1e28; border-color: #33333f; } }
+      .card .top { display: flex; align-items: baseline; justify-content: space-between; gap: 1rem; flex-wrap: wrap; }
+      .card .name { font-weight: 600; font-size: 1.02rem; }
+      .badge { font: 600 .68rem/1 ui-monospace, monospace; text-transform: uppercase; letter-spacing: .06em;
+        border: 1px solid currentColor; border-radius: 999px; padding: .2rem .55rem; }
+      .badge.status-active, .badge.health-healthy { color: #2e8b45; }
+      .badge.status-suspended, .badge.health-degraded { color: #b5860b; }
+      .badge.status-uninstalled, .badge.health-unhealthy, .badge.egress-blocked { color: #b13a3a; }
+      .badge.egress-ok { color: #2e8b45; }
+      .badge.egress-no_endpoint { color: #8a8a8a; }
+      dl.meta { display: grid; grid-template-columns: max-content 1fr; gap: .25rem 1rem; margin: .8rem 0 0; font-size: .85rem; }
+      dl.meta dt { color: #8a8a8a; }
+      dl.meta dd { margin: 0; }
+      .traces { font: .78rem/1.4 ui-monospace, monospace; color: #8a8a8a; word-break: break-all; }
+      .actions { margin-top: 1rem; display: flex; gap: .5rem; flex-wrap: wrap; }
+      .rowbtn { padding: .4rem .8rem; font-size: .82rem; background: transparent; color: inherit;
+        border: 1px solid #cfccc4; border-radius: 7px; font-weight: 600; cursor: pointer; }
+      @media (prefers-color-scheme: dark) { .rowbtn { border-color: #40404d; } }
+      .rowbtn:hover:not(:disabled) { border-color: #b7d0ff; }
+      .rowbtn:disabled { opacity: .5; cursor: default; }
+      .rowbtn.danger { color: #b13a3a; border-color: #e3b3b3; }
+      .msg { margin-top: .8rem; font-size: .85rem; border-radius: 9px; padding: .5rem .7rem; display: none; }
+      .msg.ok { display: block; background: #eaf7ee; border: 1px solid #bfe4c9; color: #1b6b34; }
+      .msg.err { display: block; background: #fdecec; border: 1px solid #f5c2c2; color: #9a1c1c; }
+      @media (prefers-color-scheme: dark) {
+        .msg.ok { background: #16311f; border-color: #2f6b41; color: #a7e0ba; }
+        .msg.err { background: #3a1f22; border-color: #6b2f34; color: #f6b9b9; }
+      }
+      .muted { color: #9a9a9a; font-size: .9rem; }
+      .who { margin-top: 2rem; font-size: .82rem; color: #8a8a8a; }
+      .who a, a.back { color: inherit; }
+      .linkbtn { background: none; border: 0; color: inherit; font: inherit; text-decoration: underline; cursor: pointer; padding: 0; margin: 0; }
+      .logout { display: inline; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <p class="eyebrow"><a class="back" href={backHref}>← {appDomain}</a></p>
+      <h1>Apps</h1>
+      <p class="sub">Installed apps and their webhook health for <strong>{appDomain}</strong>.{!canManage &&
+        " Viewing read-only — ask an admin or owner to suspend, uninstall, or rotate credentials."}</p>
+
+      <div id="apps" data-tenant={appDomain} data-can-manage={String(canManage)}>
+        <p class="muted">Loading…</p>
+      </div>
+
+      <p class="who">Signed in as {session.email} ·
+        <a href="/dashboard">Switch vendor</a> ·
+        <form class="logout" method="post" action="/api/auth/logout"><button type="submit" class="linkbtn">Sign out</button></form></p>
+    </main>
+
+    <!--
+      Client behavior is a STATIC same-origin file (public/js/dashboard-apps.js),
+      referenced via src so the strict CSP allows it through `script-src 'self'` — no
+      nonce, no per-build content-hash. Mirrors team.astro's script tag exactly.
+    -->
+    <script src="/js/dashboard-apps.js" is:inline defer></script>
+  </body>
+</html>

package/apps/storefront/src/pages/dashboard/[appDomain]/index.astro

@@ -34,6 +34,7 @@ if (!membership) {
   return Astro.redirect("/dashboard", 302);
 }
 const teamHref = `/dashboard/${encodeURIComponent(appDomain)}/team`;
+const appsHref = `/dashboard/${encodeURIComponent(appDomain)}/apps`;
 ---
 
 <html lang="en">
@@ -90,6 +91,10 @@ const teamHref = `/dashboard/${encodeURIComponent(appDomain)}/team`;
           <p class="h">Preview &amp; deploy →</p>
           <p class="d">The tenant's shared preview: target vs actual, reconcile, preview URL.</p>
         </a>
+        <a class="card" href={appsHref}>
+          <p class="h">Apps →</p>
+          <p class="d">Installed apps, webhook health, and manage suspend/uninstall/rotate.</p>
+        </a>
       </div>
 
       <p class="who">Signed in as {session.email} ·

package/apps/storefront/src/pages/index.astro

@@ -13,8 +13,12 @@ import ProductCard from "@/components/ProductCard.astro";
 import CollectionCard from "@/components/CollectionCard.astro";
 import Img from "@/components/Img.astro";
 import MarketingBlocks from "@/components/marketing/MarketingBlocks.astro";
+import TierCards from "@/components/membership/TierCards.astro";
 import { withBase } from "@/lib/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
+import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
+import { getRegistryService } from "@/lib/apps/adminService.js";
+import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
 import type { CatalogCollection, CatalogProduct } from "@tot/public-runtime";
 import {
   isMarketingBlock,
@@ -22,9 +26,11 @@ import {
   type EditorialBlock,
   type NewsletterBlock,
   type PromoTilesBlock,
+  type MembershipBandBlock,
   type MarketingBlock,
   type FeaturedProductsBlock,
 } from "@/lib/storyblok/content-model";
+import type { Tier } from "@/lib/membership/model";
 import {
   normalizeProductSectionSource,
 } from "@tot/public-runtime";
@@ -71,6 +77,7 @@ type Resolved =
   | { kind: "promo_tiles"; title?: string; tiles: PromoTilesBlock["tiles"] }
   | { kind: "collections"; title?: string; cols: CatalogCollection[] }
   | { kind: "products"; title?: string; products: CatalogProduct[] }
+  | { kind: "membership_band"; block: MembershipBandBlock }
   | { kind: "editorial"; block: EditorialBlock }
   | { kind: "newsletter"; block: NewsletterBlock };
 
@@ -124,6 +131,9 @@ for (const block of marketing ? [] : home.blocks) {
       resolved.push({ kind: "products", title: block.title, products });
       break;
     }
+    case "membership_band":
+      resolved.push({ kind: "membership_band", block });
+      break;
     case "editorial":
       resolved.push({ kind: "editorial", block });
       break;
@@ -132,6 +142,25 @@ for (const block of marketing ? [] : home.blocks) {
       break;
   }
 }
+
+// Private-app widgets (D5) — home.section slot. Commerce-home only; marketing-
+// tenant homes (raw HTML, above, and the marketing-block home) are out of
+// scope for D5 (deferred). No dark-mode preference infra exists yet — "light"
+// is the only theme hint until that lands.
+const homeSectionWidgets = marketing
+  ? []
+  : await renderWidgetSlot(
+      {
+        registry: await getRegistryService(),
+        tenantId: tenant.tenant_id,
+        customizationEnv: Astro.locals.customizationEnv,
+        slot: "home.section",
+        route: "/",
+        locale: tenant.locale,
+        theme: "light",
+      },
+      Astro.locals.activeWidgetPlacements,
+    );
 ---
 
 <Layout
@@ -165,6 +194,8 @@ for (const block of marketing ? [] : home.blocks) {
                     <img
                       src={t.image}
                       alt={t.label}
+                      width={1600}
+                      height={900}
                       loading="lazy"
                       class="absolute inset-0 h-full w-full object-cover transition-transform duration-300 group-hover:scale-105"
                     />
@@ -200,6 +231,20 @@ for (const block of marketing ? [] : home.blocks) {
           </Section>
         );
       }
+      if (r.kind === "membership_band") {
+        const b = r.block;
+        // Base-path-prefix each tier CTA so home-band links stay in-tenant under
+        // path-prefix preview routing (no-op host-routed). TierCards owns the
+        // illustrative-figures affordance from the Tier data itself.
+        const tiers: Tier[] = b.tiers.map((t) =>
+          t.cta ? { ...t, cta: { ...t.cta, href: withBase(basePath, t.cta.href) } } : t,
+        );
+        return (
+          <section class="bg-[var(--color-surface)] py-[clamp(3rem,7vw,6rem)]">
+            <TierCards tiers={tiers} eyebrow={b.eyebrow} heading={b.title} subhead={b.subhead} />
+          </section>
+        );
+      }
       if (r.kind === "editorial") {
         const b = r.block;
         const right = b.align !== "left";
@@ -281,4 +326,16 @@ for (const block of marketing ? [] : home.blocks) {
       return null;
     })
   }
+  {/* Private-app widgets (D5, home.section) — sandboxed per install. */}
+  {homeSectionWidgets.map((w) => (
+    <Section>
+      <AppWidgetFrame
+        endpoint={w.endpoint}
+        launchToken={w.launchToken}
+        appOrigin={w.appOrigin}
+        installId={w.installId}
+        title={w.title ?? "App widget"}
+      />
+    </Section>
+  ))}
 </Layout>

package/apps/storefront/src/pages/llms.txt.ts

@@ -10,7 +10,8 @@
  * SEO text; compliance facts come from tenant.compliance.
  */
 import type { APIContext } from "astro";
-import { createContentProvider } from "@/lib/storyblok/provider";
+import { nonEmptyCollections } from "@/lib/tot/query.js";
+import { listBlogPosts } from "@/lib/blog/provider.js";
 
 /** Collapse HTML/whitespace to a single trimmed line for a link description. */
 function oneLine(s: string | undefined, max = 140): string | undefined {
@@ -21,16 +22,23 @@ function oneLine(s: string | undefined, max = 140): string | undefined {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, tenant, canonicalBase } = context.locals;
+  const { tot, tenant, canonicalBase, content } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
-  const provider = createContentProvider(tenant);
 
-  const [collections, pages, featured, home] = await Promise.all([
-    tot.listCollections(),
-    provider.listPages(),
-    tot.getFeatured(12),
-    provider.getHome().catch(() => null),
-  ]);
+  // Use the request-resolved ContentProvider (locals.content) so any published /
+  // dev-draft overlay is reflected, matching sitemap.xml.ts (not a fresh provider).
+  const [allCollections, activeProducts, pages, featured, home, blogPosts] =
+    await Promise.all([
+      tot.listCollections(),
+      tot.getAllActiveProducts(),
+      content.listPages(),
+      tot.getFeatured(12),
+      content.getHome().catch(() => null),
+      listBlogPosts(tenant.tenant_id),
+    ]);
+  // Empty synthesized collections (no active members) never make the guide —
+  // an LLM shouldn't be pointed at a URL that resolves to zero products.
+  const collections = nonEmptyCollections(allCollections, activeProducts);
 
   const lines: string[] = [`# ${tenant.displayName}`, ""];
 
@@ -75,11 +83,24 @@ export async function GET(context: APIContext): Promise<Response> {
     lines.push("");
   }
 
+  if (blogPosts.length) {
+    lines.push("## Blog");
+    lines.push(`- [All articles](${base}/blog/)`);
+    for (const post of blogPosts) {
+      const desc = oneLine(post.description || post.excerpt);
+      lines.push(`- [${post.title}](${base}/blog/${post.slug}/)${desc ? `: ${desc}` : ""}`);
+    }
+    lines.push("");
+  }
+
   lines.push("## Optional");
   lines.push(`- [Full product catalog (XML sitemap)](${base}/sitemap.xml)`);
   lines.push(`- [Search](${base}/search)`);
   lines.push(
-    "- Every page ships Schema.org JSON-LD (Product, Offer, AggregateRating, Breadcrumb, Organization) for structured extraction.",
+    // Only the always-present graphs are advertised. AggregateRating/Review are
+    // emitted per-product ONLY where real review data exists (many stores have
+    // none), so we don't claim them site-wide — no fabricated capability.
+    "- Every page ships Schema.org JSON-LD (Product, Offer, Breadcrumb, Organization, WebSite, ItemList) for structured extraction; product ratings/reviews appear where the merchant has real review data.",
   );
   lines.push("");
 

package/apps/storefront/src/pages/products/[handle].astro

@@ -12,24 +12,38 @@ import ProductCard from "@/components/ProductCard.astro";
 import Section from "@/components/Section.astro";
 import ImageGallery from "@/components/islands/ImageGallery.tsx";
 import VariantSelector from "@/components/islands/VariantSelector.tsx";
+import CheckoutComplianceGate from "@/components/islands/CheckoutComplianceGate.tsx";
 import RecentlyViewed from "@/components/islands/RecentlyViewed.tsx";
 import NicotineWarning from "@/components/compliance/NicotineWarning.astro";
 import ReviewSummary from "@/components/commerce/ReviewSummary.astro";
 import ReviewList from "@/components/commerce/ReviewList.astro";
 import { isOnSale, isNew, isAvailable, fromPrice } from "@/lib/tot/query";
 import {
-  buildVariantCartPayload,
+  buildMemberSignedCartPayload,
   normalizePurchaseOptions,
+  visiblePurchaseOptions,
+  isAutopilotEnabled,
+  resolveMembershipRule,
+  DEFAULT_STACKING_POLICY,
+  readReviewAggregate,
 } from "@tot/public-runtime";
 import type {
   ProductPurchaseOption,
   VariantCartPayload,
+  MembershipTierRule,
+  MembershipStackingPolicy,
+  PurchaseOptionPricingContext,
 } from "@tot/public-runtime";
-import { readCartSecret } from "@/lib/checkoutCommerce";
+import { resolveCartSigning } from "@/lib/checkoutCommerce";
+import { isRegulatedTenant } from "@/lib/compliance/enforcement";
+import { resolveMemberContext } from "@/lib/membership/eligibility";
 import { truncate } from "@/lib/format";
 import { productLd, breadcrumbLd, reviewLd } from "@/lib/jsonld";
 import { isUsableImageUrl } from "@/lib/placeholder";
 import { withBase } from "@/lib/basePath";
+import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
+import { getRegistryService } from "@/lib/apps/adminService.js";
+import { renderWidgetSlot } from "@/lib/apps/widgets/renderSlot.js";
 
 const { handle } = Astro.params;
 const { tenant, tot, canonicalBase, basePath, commerce } = Astro.locals;
@@ -46,6 +60,23 @@ if (!product || product.status === "archived") {
 }
 const isDraft = product.status !== "active";
 
+// Private-app widgets (D5) — product.aside slot, one iframe per live install.
+// No dark-mode preference is resolved anywhere in the storefront yet; "light"
+// is the only theme hint until that infra exists.
+const productAsideWidgets = await renderWidgetSlot(
+  {
+    registry: await getRegistryService(),
+    tenantId: tenant.tenant_id,
+    customizationEnv: Astro.locals.customizationEnv,
+    slot: "product.aside",
+    route: `/products/${product.handle}`,
+    productHandle: product.handle,
+    locale: tenant.locale,
+    theme: "light",
+  },
+  Astro.locals.activeWidgetPlacements,
+);
+
 // Related: same collection first, then shared-tag fallback, exclude self+drafts.
 const related = await (async () => {
   const out = new Map<string, typeof product>();
@@ -79,9 +110,11 @@ function titleCase(s: string) {
 const mf = (ns: string, key: string) =>
   product.metafields.find((m) => m.namespace === ns && m.key === key)?.value;
 
-// Reviews — REAL data from the store's reviews app (Stamped), pulled as metafields.
-const reviewCount = Number(mf("stamped", "reviews_count") ?? mf("reviews", "count") ?? "0");
-const reviewAvg = Number(mf("stamped", "reviews_average") ?? mf("reviews", "rating") ?? "0");
+// Reviews — REAL aggregate from the store's reviews app, mirrored to metafields.
+// readReviewAggregate is the single, real-or-absent reader (§F9): it parses both
+// the bare and JSON-blob rating forms and the real count key, and returns {0,0}
+// unless BOTH numbers are real positives — so no fabricated rating can render.
+const { average: reviewAvg, count: reviewCount } = readReviewAggregate(product);
 
 // Short description (merchant's concise summary) shown high on the PDP, like the
 // source store. The longer description_html still renders below the buy column.
@@ -148,6 +181,29 @@ const available = isAvailable(product);
 // side so the island can render a signed, tamper-proof form. In `signed` mode a
 // missing secret means we render NO cart (never a tamperable form); the
 // `unsigned-demo` mode needs no secret. Drafts still get a cart (preview links).
+// Membership + Autopilot mechanics (F10). Member pricing renders only once a
+// real eligibility signal flows through resolveMemberContext (Phase 2); Phase 1
+// is anonymous. Autopilot (subscription options) is hidden when the tenant has
+// set commerce.autopilot.enabled = false (hide-at-launch).
+const member = resolveMemberContext();
+const membershipProgram = tenant.commerce?.membership;
+const membershipRule: MembershipTierRule | undefined = resolveMembershipRule(
+  member,
+  membershipProgram,
+);
+const pricing: {
+  membershipRule: MembershipTierRule;
+  stacking: MembershipStackingPolicy;
+} | undefined = membershipRule
+  ? { membershipRule, stacking: membershipProgram?.stacking ?? DEFAULT_STACKING_POLICY }
+  : undefined;
+const autopilotEnabled = isAutopilotEnabled(tenant.commerce?.autopilot);
+// Server-side pricing context (F11b). The SIGNED price is the member-adjusted
+// effective price for THIS request's resolved eligibility — never the list price,
+// and never re-derived client-side. Phase 1 resolves anonymous, so this yields the
+// list/subscription price; a Phase-2 member request signs their member price.
+const pricingCtx: PurchaseOptionPricingContext = { member, program: membershipProgram };
+
 let checkoutCart:
   | {
       action: string;
@@ -156,10 +212,16 @@ let checkoutCart:
     }
   | undefined;
 if (commerce) {
-  const secret = await readCartSecret(commerce);
-  if (commerce.mode !== "signed" || secret) {
+  // Fail closed for production signed checkout: a signed tenant with no
+  // cart-validation secret builds NO cart (never a tamperable form). See
+  // resolveCartSigning — it also logs the misconfiguration loudly.
+  const { enabled, secret } = await resolveCartSigning(commerce);
+  if (enabled) {
     try {
-      const purchaseOptions = normalizePurchaseOptions(product);
+      const purchaseOptions = visiblePurchaseOptions(
+        normalizePurchaseOptions(product),
+        { autopilotEnabled },
+      );
       const entries = await Promise.all(
         product.variants.map(
           async (v) => {
@@ -168,10 +230,12 @@ if (commerce) {
                 async (purchaseOption) =>
                   [
                     purchaseOption.id,
-                    await buildVariantCartPayload(product, v, {
+                    await buildMemberSignedCartPayload(product, v, {
                       mode: commerce.mode,
                       secret,
                       purchaseOption,
+                      pricing: pricingCtx,
+                      autopilotEnabled,
                     }),
                   ] as const,
               ),
@@ -298,8 +362,22 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
           options={product.options}
           currency={product.price_range.currency}
           locale={tenant.locale}
+          productHandle={product.handle}
+          productTitle={product.title}
           checkoutCart={checkoutCart}
+          pricing={pricing}
         />
+        {/* Regulated-tenant checkout ENFORCEMENT gate (F12/T5). Intercepts the
+            managed-cart handoff to clear age + ship-to compliance server-side
+            before the external checkout. Only mounts when a store is wired AND
+            the tenant is regulated. */}
+        {checkoutCart && isRegulatedTenant(tenant) && compliance?.minAge && (
+          <CheckoutComplianceGate
+            client:load
+            preflightUrl={withBase(basePath, "/api/compliance/preflight")}
+            minAge={compliance.minAge}
+          />
+        )}
         <button
           type="button"
           class="wishlist-toggle group mt-3 inline-flex w-full items-center justify-center gap-2 rounded-[var(--radius-md)] border border-[var(--color-border)] py-2.5 font-display text-sm font-medium transition-colors hover:border-[var(--color-sale)] hover:text-[var(--color-sale)] aria-pressed:border-[var(--color-sale)] aria-pressed:text-[var(--color-sale)]"
@@ -314,6 +392,19 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
         </button>
       </div>
 
+      {/* Private-app widgets (D5, product.aside) — sandboxed per install. */}
+      {productAsideWidgets.map((w) => (
+        <div class="mt-7">
+          <AppWidgetFrame
+            endpoint={w.endpoint}
+            launchToken={w.launchToken}
+            appOrigin={w.appOrigin}
+            installId={w.installId}
+            title={w.title ?? "App widget"}
+          />
+        </div>
+      ))}
+
       {/* Rich description + attribute lines — matches the source store's PDP:
           the longer description, then plain "Label: value" lines (no spec table). */}
       <div class="mt-9 border-t border-[var(--color-border)] pt-7">

package/apps/storefront/src/pages/sitemap.xml.ts

@@ -1,10 +1,16 @@
 /**
  * Per-tenant XML sitemap. Built from the resolved tenant's canonical base +
  * catalog. ACTIVE products only — getAllActiveProducts() excludes the draft
- * canary (`trail-cap`), so drafts never leak into the sitemap. Editorial slugs
- * come from the ContentProvider.
+ * canary (`trail-cap`), so drafts never leak into the sitemap. Collections are
+ * filtered to those with at least one active product (nonEmptyCollections), so
+ * empty synthesized collection shells never become crawlable dead ends.
+ * Editorial slugs come from the ContentProvider. The canonical base is resolved
+ * per-request (prod domain OR path-prefixed preview host), so every emitted
+ * loc is prefix-correct without special-casing here.
  */
 import type { APIContext } from "astro";
+import { nonEmptyCollections } from "@/lib/tot/query.js";
+import { listBlogPosts } from "@/lib/blog/provider.js";
 
 interface SitemapUrl {
   loc: string;
@@ -22,7 +28,7 @@ function escapeXml(value: string): string {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, canonicalBase, content, features } = context.locals;
+  const { tot, tenant, canonicalBase, content, features } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
 
   const urls: SitemapUrl[] = [{ loc: `${base}/` }];
@@ -30,10 +36,13 @@ export async function GET(context: APIContext): Promise<Response> {
   // Commerce URLs only for tenants with a catalog sitemap. Marketing tenants
   // emit homepage + content pages, keeping product/collection routes out.
   if (features.commerceSitemap) {
-    const [products, collections] = await Promise.all([
+    const [products, allCollections] = await Promise.all([
       tot.getAllActiveProducts(),
       tot.listCollections(),
     ]);
+    // Only collections with at least one active product — empty synthesized
+    // shells (all-draft/dropped membership) stay out of the sitemap.
+    const collections = nonEmptyCollections(allCollections, products);
     urls.push({ loc: `${base}/collections` });
     for (const c of collections) {
       urls.push({ loc: `${base}/collections/${c.handle}` });
@@ -56,6 +65,14 @@ export async function GET(context: APIContext): Promise<Response> {
     urls.push({ loc: `${base}/${page.slug}` });
   }
 
+  const blogPosts = await listBlogPosts(tenant.tenant_id);
+  if (blogPosts.length > 0) {
+    urls.push({ loc: `${base}/blog/` });
+    for (const post of blogPosts) {
+      urls.push({ loc: `${base}/blog/${post.slug}/`, lastmod: post.modifiedAt || post.publishedAt });
+    }
+  }
+
   const body = `<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
 ${urls