@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -0,0 +1,104 @@
+/**
+ * E1.1 — public reaction endpoint. POST a reaction for the post addressed by the
+ * route (`/api/blog/<collection>/<slug>/react`); returns the post's full reaction
+ * tallies as JSON. Anonymous, no identity — the reader is never authenticated.
+ *
+ * Discipline (mirrors the other public POSTs, `newsletter.ts` / `rum/vitals.ts`):
+ *   - Tenant is resolved from `locals.tenant`, NEVER the request body.
+ *   - A soft per-IP KV rate limit stops trivial scripted inflation; over-cap
+ *     returns the current tallies (429) without counting — abuse blast-radius is
+ *     ~0 (a counter), so the cap is lenient.
+ *   - Never 500. Every path returns a clean JSON response; `recordReaction` is
+ *     itself best-effort and never throws.
+ */
+import type { APIRoute } from "astro";
+import { readKv } from "@/lib/env";
+import {
+  getReactionCounts,
+  isReaction,
+  recordReaction,
+  type Reaction,
+} from "@/lib/blog/reactions";
+import { checkRateLimit } from "@/lib/rate/kvWindow";
+
+export const prerender = false;
+
+const RATE_WINDOW_SECONDS = 60;
+const RATE_MAX_PER_WINDOW = 10;
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" },
+  });
+}
+
+/** Best-effort client IP for rate-limit keying — Cloudflare's header, else XFF. */
+function clientIp(request: Request): string {
+  const cf = request.headers.get("cf-connecting-ip");
+  if (cf) return cf;
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff) return xff.split(",")[0]!.trim();
+  return "unknown";
+}
+
+/** Pull the reaction from a JSON or form-encoded body. */
+async function readReaction(request: Request): Promise<string | null> {
+  try {
+    const type = request.headers.get("content-type") ?? "";
+    if (type.includes("application/json")) {
+      const body = (await request.json()) as { reaction?: unknown };
+      return typeof body.reaction === "string" ? body.reaction : null;
+    }
+    const form = await request.formData();
+    const value = form.get("reaction");
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+export const POST: APIRoute = async (context) => {
+  const tenantId = context.locals?.tenant?.tenant_id;
+  const collection = context.params.collection;
+  const slug = context.params.slug;
+  if (!tenantId || !collection || !slug) {
+    return json({ ok: false, error: "not_found", counts: {} as Record<Reaction, number> }, 404);
+  }
+
+  const reaction = await readReaction(context.request);
+  const kv = await readKv("TENANT_CACHE");
+
+  if (!isReaction(reaction)) {
+    return json(
+      {
+        ok: false,
+        error: "invalid_reaction",
+        counts: await getReactionCounts(kv, tenantId, collection, slug),
+      },
+      400,
+    );
+  }
+
+  const { allowed } = await checkRateLimit(kv, `react:${tenantId}:${clientIp(context.request)}`, {
+    windowSeconds: RATE_WINDOW_SECONDS,
+    maxRequests: RATE_MAX_PER_WINDOW,
+  });
+  if (!allowed) {
+    return json(
+      {
+        ok: false,
+        error: "rate_limited",
+        counts: await getReactionCounts(kv, tenantId, collection, slug),
+      },
+      429,
+    );
+  }
+
+  // Best-effort: no-ops for a non-live post; never throws. When there is no KV
+  // binding (local dev) the increment can't persist, but we still return the
+  // (all-zero) tallies so the client has a consistent shape.
+  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction);
+
+  return json({ ok: true, counts: await getReactionCounts(kv, tenantId, collection, slug) });
+};

package/apps/storefront/src/pages/api/cache-purge.ts

@@ -12,6 +12,7 @@
 import type { APIContext } from "astro";
 import { readEnv, readKv } from "@/lib/env";
 import { bumpCacheVersion } from "@/lib/edgeCache";
+import { recordActivity } from "@/lib/activity/recordActivity";
 
 export const prerender = false;
 
@@ -38,6 +39,16 @@ export async function POST(context: APIContext): Promise<Response> {
   }
 
   const version = await bumpCacheVersion(kv, tenantId);
+  // D11: the caller is the Bearer-secret ETL load step (a machine, no session) — emit as
+  // the `agent` cohort with an opaque handle. Best-effort; never affects the purge.
+  recordActivity({
+    action: "cache.purged",
+    actor: { kind: "agent", id: "storefront" },
+    source: "server",
+    outcome: { status: "succeeded" },
+    scope: { tenantId },
+    payload: { args: { version } },
+  });
   return new Response(JSON.stringify({ tenantId, version }), {
     headers: { "content-type": "application/json" },
   });

package/apps/storefront/src/pages/api/dashboard/enter-vendor.ts

@@ -29,6 +29,7 @@ import {
   StaffVendorAccessClientError,
 } from "@/lib/dashboard/staffVendorAccess";
 import { mintBrokerAssertion, BrokerAssertionError } from "@/lib/auth/brokerAssertion";
+import { resolveUiActor, recordUiActivity } from "@/lib/activity/uiActor";
 
 export const prerender = false;
 
@@ -57,6 +58,11 @@ export async function POST(context: APIContext): Promise<Response> {
     typeof body.vendorAppDomain === "string" ? body.vendorAppDomain.trim() : "";
   if (!vendorAppDomain) return json({ error: "vendorAppDomain is required" }, 400);
 
+  // D11: staff-impersonation audit event. Resolve the actor AFTER the staff gate above,
+  // so the cohort is always `admin` (a ToT-staff session); the staff email is PII and is
+  // never stored (actor.id is its salted hash). Reused at each emit exit point below.
+  const activityActor = await resolveUiActor(context, {});
+
   let client;
   try {
     client = await createStaffVendorAccessClient();
@@ -84,6 +90,12 @@ export async function POST(context: APIContext): Promise<Response> {
   // capability, and writes the audit row. We admit ONLY on its ok.
   const result = await client.grantStaffAccess(brokerAssertion, vendorAppDomain);
   if (!result.ok) {
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "refused", errorClass: result.reason ?? `http_${result.status}` },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain } },
+    });
     return json(
       { error: result.message, reason: result.reason, code: result.code },
       staffAccessHttpStatus(result.reason, result.status),
@@ -103,6 +115,12 @@ export async function POST(context: APIContext): Promise<Response> {
     // No SESSION KV / no cookie (e.g. plain `astro dev`) — the audit row is
     // written but we can't persist the marker. Fail closed so the viewer isn't
     // told they're admitted when the guard can't see it.
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "failed", errorClass: "session_store_unavailable" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
     return json({ error: "session store unavailable; cannot persist admission" }, 503);
   }
   const updated = await updateSession(
@@ -112,9 +130,21 @@ export async function POST(context: APIContext): Promise<Response> {
     nowSeconds,
   );
   if (!updated) {
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "failed", errorClass: "session_expired" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
     return json({ error: "session expired; sign in again" }, 401);
   }
 
+  recordUiActivity(activityActor, {
+    action: "dashboard.vendor_entered",
+    outcome: { status: "succeeded" },
+    scope: { tenantId: vendorAppDomain },
+    payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+  });
   return json({
     ok: true,
     appDomain: vendorAppDomain,

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -0,0 +1,146 @@
+/**
+ * N2 — newsletter double-opt-in subscribe. `POST /api/newsletter/<collection>/subscribe`
+ * with body `{ email }` (JSON) or an `email` form field.
+ *
+ * Discipline (mirrors the other public POSTs, `blog/.../react.ts` / `newsletter.ts`):
+ *   - `tenant_id` is resolved from `locals.tenant`, `collection` from the ROUTE —
+ *     NEVER the request body (tenant is the isolation boundary).
+ *   - A soft per-IP KV rate limit (`kvWindow`) stops trivial scripted signups.
+ *   - `INSERT OR IGNORE` a `pending` row with a fresh opaque token + consent
+ *     record (`consent_source` = referrer, `consent_ip_hash` = sha256(ip+salt) —
+ *     NEVER a raw IP). A repeat subscribe is idempotent.
+ *   - Confirmation email is STUBBED (no ESP in-repo yet — N4 wires it); a stub
+ *     failure never fails the subscribe.
+ *   - Never 500. A `fetch`/JSON caller gets a clean JSON body; a plain form POST
+ *     is redirected back to the referrer so the page can show its own thanks.
+ */
+import type { APIRoute } from "astro";
+import { readD1, readKv, readEnv } from "@/lib/env";
+import { fromD1 } from "@/lib/d1/catalog";
+import { checkRateLimit } from "@/lib/rate/kvWindow";
+import { NewsletterSubscribersStore } from "@/lib/newsletter/subscribers";
+import { randomToken, hashConsentIp } from "@/lib/newsletter/consent";
+import { sendConfirmationEmail } from "@/lib/newsletter/confirmationEmail";
+
+export const prerender = false;
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const COLLECTION_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const RATE_WINDOW_SECONDS = 3600;
+const RATE_MAX_PER_WINDOW = 5;
+/** Dev fallback only — production sets NEWSLETTER_CONSENT_SALT as a secret. */
+const DEV_CONSENT_SALT = "newsletter-consent-dev-salt";
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" },
+  });
+}
+
+/** Best-effort client IP for rate-limit keying + consent record — CF header, else XFF. */
+function clientIp(request: Request): string {
+  const cf = request.headers.get("cf-connecting-ip");
+  if (cf) return cf;
+  const xff = request.headers.get("x-forwarded-for");
+  if (xff) return xff.split(",")[0]!.trim();
+  return "unknown";
+}
+
+/** Read `email` from a JSON or form-encoded body; null if unparseable. */
+async function readEmail(request: Request): Promise<string | null> {
+  try {
+    const type = request.headers.get("content-type") ?? "";
+    if (type.includes("application/json")) {
+      const body = (await request.json()) as { email?: unknown };
+      return typeof body.email === "string" ? body.email : null;
+    }
+    const value = (await request.formData()).get("email");
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** True when the caller wants JSON (fetch/JS) rather than a page navigation. */
+function wantsJson(request: Request): boolean {
+  const ct = request.headers.get("content-type") ?? "";
+  if (ct.includes("application/json")) return true;
+  return (request.headers.get("accept") ?? "").includes("application/json");
+}
+
+/** Success response: JSON for fetch, else redirect back to the referrer with a flag. */
+function ok(request: Request): Response {
+  if (wantsJson(request)) return json({ ok: true, status: "pending" });
+  const referer = request.headers.get("referer");
+  if (referer) {
+    try {
+      const back = new URL(referer);
+      back.searchParams.set("subscribed", "1");
+      return Response.redirect(back.toString(), 303);
+    } catch {
+      /* fall through */
+    }
+  }
+  return json({ ok: true, status: "pending" });
+}
+
+export const POST: APIRoute = async (context) => {
+  const tenantId = context.locals?.tenant?.tenant_id;
+  const collection = context.params.collection;
+  if (!tenantId || !collection || !COLLECTION_RE.test(collection)) {
+    return json({ ok: false, error: "not_found" }, 404);
+  }
+
+  try {
+    const email = (await readEmail(context.request))?.trim().toLowerCase() ?? "";
+    if (!EMAIL_RE.test(email)) {
+      return json({ ok: false, error: "invalid_email" }, 400);
+    }
+
+    const kv = await readKv("TENANT_CACHE");
+    const { allowed } = await checkRateLimit(
+      kv,
+      `newsletter-subscribe:${tenantId}:${clientIp(context.request)}`,
+      { windowSeconds: RATE_WINDOW_SECONDS, maxRequests: RATE_MAX_PER_WINDOW },
+    );
+    if (!allowed) return json({ ok: false, error: "rate_limited" }, 429);
+
+    const d1 = await readD1("STOREFRONT_APPS_DB");
+    if (!d1) {
+      // No apps DB binding (local/dev without D1): can't persist. Don't fail the
+      // visitor — log and acknowledge so the flow is exercisable in dev.
+      console.log(`[newsletter] subscribe (no D1) ${email} → ${tenantId}/${collection}`);
+      return ok(context.request);
+    }
+
+    const referer = context.request.headers.get("referer");
+    const consentSource = referer ? new URL(referer).pathname : null;
+    const salt = (await readEnv("NEWSLETTER_CONSENT_SALT")) ?? DEV_CONSENT_SALT;
+    const consentIpHash = await hashConsentIp(clientIp(context.request), salt);
+
+    const store = new NewsletterSubscribersStore(fromD1(d1));
+    const result = await store.subscribe({
+      tenantId,
+      collection,
+      email,
+      token: randomToken(),
+      consentSource,
+      consentIpHash,
+    });
+
+    // Only (re)send confirmation while still pending — never re-mail a confirmed
+    // or unsubscribed address. Best-effort; a stub failure must not fail signup.
+    if (result.status === "pending") {
+      const origin = new URL(context.request.url).origin;
+      const basePath = context.locals?.basePath ?? "";
+      const confirmUrl = `${origin}${basePath}/api/newsletter/confirm?token=${result.token}`;
+      await sendConfirmationEmail({ email, collection, confirmUrl }).catch(() => {});
+    }
+
+    return ok(context.request);
+  } catch {
+    // Never 500 on a signup — acknowledge and move on.
+    return ok(context.request);
+  }
+};

package/apps/storefront/src/pages/api/newsletter/confirm.ts

@@ -0,0 +1,75 @@
+/**
+ * N2 — newsletter double-opt-in confirm. `GET /api/newsletter/confirm?token=…`
+ * (the link in the confirmation email). Flips the addressed `pending` subscriber
+ * to `confirmed`; that timestamp + the stored consent source/ip-hash IS the GDPR
+ * consent record.
+ *
+ * The token is opaque + per-subscriber, so it identifies the exact row without
+ * an email in the URL; the lookup is still scoped to `locals.tenant`. Idempotent:
+ * re-clicking an already-confirmed link is a success, not an error. An unknown/
+ * stale token renders a clean "invalid link" page — never a 500.
+ */
+import type { APIRoute } from "astro";
+import { readD1 } from "@/lib/env";
+import { fromD1 } from "@/lib/d1/catalog";
+import { NewsletterSubscribersStore } from "@/lib/newsletter/subscribers";
+
+export const prerender = false;
+
+function page(title: string, message: string, status = 200): Response {
+  const esc = (s: string) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" })[c]!);
+  const html = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <title>${esc(title)}</title>
+    <style>
+      :root { color-scheme: light dark; }
+      body { font-family: ui-serif, Georgia, serif; margin: 0; min-height: 100vh;
+        display: grid; place-items: center; padding: 2rem; text-align: center;
+        background: #f4f1ea; color: #2f3a34; }
+      .card { max-width: 30rem; }
+      h1 { font-size: clamp(1.6rem, 4vw, 2.2rem); margin: 0 0 0.75rem; }
+      p { color: #5a655e; line-height: 1.6; }
+      a { color: #2f3a34; font-weight: 600; }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h1>${esc(title)}</h1>
+      <p>${esc(message)}</p>
+      <p><a href="/">Back to the shop →</a></p>
+    </div>
+  </body>
+</html>`;
+  return new Response(html, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" },
+  });
+}
+
+export const GET: APIRoute = async (context) => {
+  const tenantId = context.locals?.tenant?.tenant_id;
+  const token = context.url.searchParams.get("token")?.trim();
+  if (!tenantId || !token) {
+    return page("Invalid link", "That confirmation link isn't valid. Try subscribing again.", 400);
+  }
+
+  try {
+    const d1 = await readD1("STOREFRONT_APPS_DB");
+    if (!d1) {
+      return page("Try again shortly", "We couldn't confirm your subscription just now. Please try again in a moment.", 503);
+    }
+    const store = new NewsletterSubscribersStore(fromD1(d1));
+    const result = await store.confirmByToken({ tenantId, token });
+    if (result === "not_found") {
+      return page("Invalid link", "That confirmation link is expired or already used. Try subscribing again.", 400);
+    }
+    // "confirmed" and "already" are both success — idempotent.
+    return page("You're confirmed.", "Thanks for confirming — you'll hear from us when something worth knowing lands.");
+  } catch {
+    return page("Try again shortly", "We couldn't confirm your subscription just now. Please try again in a moment.", 503);
+  }
+};

package/apps/storefront/src/pages/api/newsletter/unsubscribe.ts

@@ -0,0 +1,90 @@
+/**
+ * Newsletter one-click unsubscribe (newsletter-send epic, N3) — the endpoint the
+ * unsubscribe footer link and the RFC 8058 `List-Unsubscribe` header both point at.
+ * (N4 composes those headers/links; this unit is only the target they hit.)
+ *
+ *   - GET  /api/newsletter/unsubscribe?token=…  — a clicked email-footer link. Flips
+ *     the subscriber to `unsubscribed` and renders a plain confirmation page.
+ *   - POST /api/newsletter/unsubscribe?token=…  — the RFC 8058 `List-Unsubscribe-Post:
+ *     List-Unsubscribe=One-Click` request a mailbox provider (Gmail/Yahoo) fires. Same
+ *     effect, 200 with no interstitial and no confirmation step.
+ *
+ * The `token` (query string only — never the email in the URL) is an opaque per-
+ * subscriber capability, so this succeeds WITHOUT login in one click. It is idempotent
+ * (re-unsubscribing is a no-op success) and NON-LEAKING: an unknown token gets the exact
+ * same response as a real one, so an observer can't probe which tokens exist.
+ *
+ * NOTE (integration): Astro's global `security.checkOrigin` (default-on for a server
+ * build) 403s a cross-origin form-encoded POST before it reaches this handler, which
+ * would break the RFC 8058 one-click POST from a mailbox provider. See the unit report.
+ */
+import type { APIContext } from "astro";
+import { readD1 } from "@/lib/env";
+import { fromD1 } from "@/lib/d1/catalog";
+import { unsubscribeByToken } from "@/lib/newsletter/subscribers";
+
+export const prerender = false;
+
+/** Confirmation page for the clicked-link (GET) path. `noindex`; house serif style. */
+function confirmationPage(): Response {
+  const html = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <title>Unsubscribed</title>
+    <style>
+      :root { color-scheme: light dark; }
+      body { font-family: ui-serif, Georgia, serif; margin: 0; min-height: 100vh;
+        display: grid; place-items: center; padding: 2rem; text-align: center;
+        background: #f4f1ea; color: #2f3a34; }
+      .card { max-width: 30rem; }
+      h1 { font-size: clamp(1.6rem, 4vw, 2.2rem); margin: 0 0 0.75rem; }
+      p { color: #5a655e; line-height: 1.6; }
+      a { color: #2f3a34; font-weight: 600; }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h1>You're unsubscribed.</h1>
+      <p>You won't receive any more of these emails. Changed your mind? You can always sign up again.</p>
+      <p><a href="/">Back to the shop →</a></p>
+    </div>
+  </body>
+</html>`;
+  return new Response(html, {
+    status: 200,
+    headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" },
+  });
+}
+
+/** Apply the unsubscribe for the token in the query string. Best-effort: never throws,
+ *  and returns the same value regardless of whether the token was real (non-leaking).
+ *  When no D1 binding is present (local/dev) it's a silent no-op — the response shape
+ *  is identical either way. */
+async function applyUnsubscribe(context: APIContext): Promise<void> {
+  try {
+    const token = new URL(context.request.url).searchParams.get("token") ?? "";
+    const d1 = await readD1("STOREFRONT_APPS_DB");
+    if (!d1) return;
+    await unsubscribeByToken(fromD1(d1), token, new Date().toISOString());
+  } catch {
+    // Unsubscribe must never error out at the reader — degrade to the same success
+    // response. (A failed write is preferable to showing a subscriber an error.)
+  }
+}
+
+export async function GET(context: APIContext): Promise<Response> {
+  await applyUnsubscribe(context);
+  return confirmationPage();
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  await applyUnsubscribe(context);
+  // RFC 8058 one-click: a bare 200, no body of consequence, no confirmation step.
+  return new Response("Unsubscribed", {
+    status: 200,
+    headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" },
+  });
+}

package/apps/storefront/src/pages/api/publish/stage-bundle.ts

@@ -0,0 +1,70 @@
+/**
+ * PUT/HEAD /api/publish/stage-bundle?key=versions/<digest>/<rel> — the
+ * authenticated Worker staging surface that writes bundle objects into the
+ * `STATIC_BUNDLES` R2 binding, so CI stages digests WITHOUT a static R2
+ * S3-compatible key pair. Auth (a CI `private_key_jwt` assertion, RFC 7523/8707,
+ * one-time `jti`) + the write logic live in `@/lib/publish/stageBundleUpload`;
+ * this route only resolves the runtime bindings/config.
+ *
+ * Fails CLOSED (503 "not configured") until a human wires the CI client's public
+ * JWKS (`STATIC_BUNDLE_UPLOAD_JWKS`) + the endpoint's own audience
+ * (`STATIC_BUNDLE_UPLOAD_AUDIENCE`) — the same "needs provisioning" gate the R2
+ * buckets themselves sit behind. It is EXEMPT from the demo login gate
+ * (loginGate.ts `isStaticBundleUploadPath`): it carries its own, stricter auth,
+ * so it must answer server-to-server rather than being masked by a "Coming soon"
+ * holding page.
+ */
+import type { APIContext } from "astro";
+import { readEnv, readKv, readR2 } from "@/lib/env";
+import {
+  handleStageBundleUpload,
+  kvJtiReplayStore,
+  DEFAULT_STAGE_BUNDLE_UPLOAD_ISSUER,
+  type StageBundleUploadBucket,
+  type StageBundleUploadConfig,
+  type JtiKvLike,
+} from "@/lib/publish/stageBundleUpload";
+
+export const prerender = false;
+
+async function handle(context: APIContext): Promise<Response> {
+  const bucket = (await readR2("STATIC_BUNDLES")) as StageBundleUploadBucket | undefined;
+  if (!bucket) {
+    return new Response(JSON.stringify({ error: "no_bundle_store" }), {
+      status: 503,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
+  const jwksRaw = await readEnv("STATIC_BUNDLE_UPLOAD_JWKS");
+  const audience = await readEnv("STATIC_BUNDLE_UPLOAD_AUDIENCE");
+  if (!jwksRaw || !audience) {
+    return new Response(JSON.stringify({ error: "upload_not_configured" }), {
+      status: 503,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  let jwks: StageBundleUploadConfig["jwks"];
+  try {
+    jwks = JSON.parse(jwksRaw) as StageBundleUploadConfig["jwks"];
+  } catch {
+    return new Response(JSON.stringify({ error: "upload_not_configured" }), {
+      status: 503,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  const issuer =
+    (await readEnv("STATIC_BUNDLE_UPLOAD_ISSUER")) ?? DEFAULT_STAGE_BUNDLE_UPLOAD_ISSUER;
+
+  const kv = (await readKv("TENANT_CACHE")) as JtiKvLike | undefined;
+
+  return handleStageBundleUpload({
+    request: context.request,
+    bucket,
+    config: { jwks, issuer, audience },
+    ...(kv ? { jtiStore: kvJtiReplayStore(kv) } : {}),
+  });
+}
+
+export const PUT = handle;
+export const HEAD = handle;

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -14,6 +14,8 @@
  */
 import type { APIRoute } from "astro";
 import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/analytics/webVitals";
+import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { recordBlogView } from "@/lib/blog/viewCounts";
 
 export const prerender = false;
 
@@ -38,14 +40,31 @@ function parseSample(raw: unknown): WebVitalsSample | null {
   };
 }
 
-export const POST: APIRoute = async ({ request }) => {
+export const POST: APIRoute = async (context) => {
   try {
-    const sample = parseSample(await request.json());
+    const sample = parseSample(await context.request.json());
     if (sample) {
       // eslint-disable-next-line no-console
       console.info("[rum:web-vitals]", JSON.stringify(sample));
       // TODO(F14 follow-up): forward to Analytics Engine and run
       // rumAlert.detectRegressions on the per-route/hour rollup.
+
+      // B3.3 — per-post blog view counts. CLS is emitted exactly once per page
+      // load (LCP/INP are conditional), so it is the reliable one-per-view
+      // signal; count off it only. `recordBlogView` no-ops unless `sample.path`
+      // resolves to a live post for the resolved tenant. Runs PAST the response
+      // so the beacon 204 is never delayed and the KV write never fails the
+      // request.
+      if (sample.metric === "cls") {
+        const tenantId = context.locals?.tenant?.tenant_id;
+        const kv = tenantId ? await readKv("TENANT_CACHE") : undefined;
+        if (tenantId && kv) {
+          const cfContext =
+            (context.locals as { runtime?: { ctx?: CfExecutionContextLike } })?.runtime?.ctx ??
+            null;
+          runAfterResponse(recordBlogView(kv, tenantId, sample.path), cfContext);
+        }
+      }
     }
   } catch {
     /* never fail a telemetry beacon */

package/apps/storefront/src/pages/auth/login.astro

@@ -11,6 +11,7 @@
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
 import { normalizeEmailHint } from "@/lib/privacy/emailHint";
+import { safeNext } from "@/lib/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -24,10 +25,10 @@ const sent = url.searchParams.get("sent") === "1";
 const email = (url.searchParams.get("email") ?? "").trim();
 const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 const errorCode = url.searchParams.get("error");
-const next = (() => {
-  const n = url.searchParams.get("next") ?? "/";
-  return n.startsWith("/") && !n.startsWith("//") ? n : "/";
-})();
+// Same open-redirect chokepoint the verify endpoint + login gate use — never a
+// parallel weaker copy (this value is threaded into the sign-in form's hidden
+// `next` and back to /api/auth/verify, which re-checks it with the same guard).
+const next = safeNext(url.searchParams.get("next"));
 
 // RFC 9470 step-up: tot core told /api/auth/verify (or /api/auth/magic-exchange,
 // which redirects to /auth/magic instead) that it needs a fresher credential