@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/lib/blog/reactions.ts

@@ -0,0 +1,87 @@
+/**
+ * E1.1 — per-post reader reactions: an anonymous, additive emoji tally, the
+ * first reader-sentiment signal for the blog platform (complements view counts,
+ * which measure reads). A near-clone of `viewCounts.ts`: KV counters keyed by
+ * (tenant, collection, slug, reaction), best-effort read-modify-write, no PII,
+ * no per-visitor identity, no moderation (an emoji count carries no user text —
+ * worst case is an inflated tally, self-limiting and low-stakes).
+ *
+ * Storage is the TENANT_CACHE KV namespace (same binding view-counts uses).
+ * Under concurrency some increments are lost to KV's last-write-wins semantics:
+ * acceptable for a demand signal, not a billing counter.
+ *
+ * Tenant/collection-generic by construction — nothing here is bound to a
+ * specific tenant or collection.
+ */
+import { getPost } from "./collection.js";
+
+/** The fixed reaction vocabulary. Not free-form — a closed set like the pillar vocabulary. */
+export const REACTIONS = ["like", "insightful", "celebrate"] as const;
+export type Reaction = (typeof REACTIONS)[number];
+
+/** Narrow an untrusted string to a known reaction, or null. */
+export function isReaction(value: unknown): value is Reaction {
+  return typeof value === "string" && (REACTIONS as readonly string[]).includes(value);
+}
+
+/** KV key for one (post, reaction) rolling tally. */
+export function reactionsKey(
+  tenantId: string,
+  collection: string,
+  slug: string,
+  reaction: Reaction,
+): string {
+  return `blogreact:${tenantId}:${collection}:${slug}:${reaction}`;
+}
+
+async function readCount(kv: KVNamespace, key: string): Promise<number> {
+  const raw = await kv.get(key);
+  const n = raw == null ? 0 : Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+
+/**
+ * Increment the tally for `reaction` on a post IF the reaction is in the vocab
+ * AND the post is live (published/unlisted/due-scheduled) for this tenant —
+ * `getPost` returns null on the live path for a draft/404/non-post. Best-effort:
+ * never throws (a reaction must never fail the reader's request).
+ */
+export async function recordReaction(
+  kv: KVNamespace,
+  tenantId: string,
+  collection: string,
+  slug: string,
+  reaction: string,
+): Promise<void> {
+  try {
+    if (!isReaction(reaction)) return;
+    const post = await getPost(tenantId, collection, slug);
+    if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
+    const key = reactionsKey(tenantId, collection, slug, reaction);
+    const next = (await readCount(kv, key)) + 1;
+    await kv.put(key, String(next));
+  } catch {
+    /* swallow — reactions are best-effort */
+  }
+}
+
+/**
+ * The full tally map for a post: every vocab reaction to its count (0 if unset).
+ * A null KV (local dev, no binding) yields all-zero counts. Read by the reader
+ * reaction bar and the admin engagement panel (E1.2).
+ */
+export async function getReactionCounts(
+  kv: KVNamespace | undefined,
+  tenantId: string,
+  collection: string,
+  slug: string,
+): Promise<Record<Reaction, number>> {
+  const out = Object.fromEntries(REACTIONS.map((r) => [r, 0])) as Record<Reaction, number>;
+  if (!kv) return out;
+  await Promise.all(
+    REACTIONS.map(async (reaction) => {
+      out[reaction] = await readCount(kv, reactionsKey(tenantId, collection, slug, reaction));
+    }),
+  );
+  return out;
+}

package/apps/storefront/src/lib/blog/rss.ts

@@ -0,0 +1,92 @@
+import type { BlogPostSummary } from "./types.js";
+
+/**
+ * Hand-rolled RSS 2.0 renderer (no `@astrojs/rss` dependency), the syndication
+ * mirror of `sitemap.xml.ts`. Tenant- and collection-agnostic: the caller passes
+ * the resolved canonical base + the collection's route base, so the SAME renderer
+ * serves `/the-build/rss.xml`, `/blog/rss.xml`, and any tenant. Feeding it the
+ * engine's live-visible list (`listPosts` default) inherits the visibility
+ * chokepoint — drafts/unlisted never reach a feed.
+ */
+export interface RssFeedInput {
+  channelTitle: string;
+  channelDescription: string;
+  /** Resolved canonical base, e.g. `https://x.com` or a path-prefixed preview host. */
+  canonicalBase: string;
+  /** The collection's route base, e.g. `/the-build`. */
+  collectionBase: string;
+  /**
+   * Feed items. `BlogPost` is assignable here (it extends `BlogPostSummary`),
+   * so an item may carry a full `contentHtml` body — which is emitted as
+   * `<content:encoded>` for public posts only. Gated posts stay in the feed but
+   * never syndicate their body (see the per-item guard below).
+   */
+  posts: Array<BlogPostSummary & { contentHtml?: string }>;
+}
+
+/** XML-escape text inside a tag (mirrors sitemap.xml.ts). */
+export function escapeXml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
+/** RFC-822 date (`Sun, 01 Mar 2026 00:00:00 GMT`), the RSS `pubDate` format. */
+function rfc822(iso: string): string {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : d.toUTCString();
+}
+
+export function renderRssFeed(input: RssFeedInput): string {
+  const { channelTitle, channelDescription, posts } = input;
+  const base = input.canonicalBase.replace(/\/$/, "");
+  const collectionBase = `/${input.collectionBase.replace(/^\/+|\/+$/g, "")}`;
+  const channelLink = `${base}${collectionBase}/`;
+  const feedLink = `${base}${collectionBase}/rss.xml`;
+
+  const items = posts
+    .map((post) => {
+      const link = `${base}${collectionBase}/${post.slug}/`;
+      const pubDate = rfc822(post.publishedAt);
+      const categories = post.categories
+        .map((c) => `      <category>${escapeXml(c)}</category>`)
+        .join("\n");
+      // Entitlement guard: a gated post (access !== "public") stays discoverable
+      // in the feed but NEVER syndicates its body — otherwise a feed reader would
+      // unlock paywalled content. Only public posts emit <content:encoded>.
+      const gated = (post.access ?? "public") !== "public";
+      const contentEncoded =
+        !gated && post.contentHtml
+          ? `      <content:encoded><![CDATA[${post.contentHtml}]]></content:encoded>`
+          : "";
+      return [
+        "    <item>",
+        `      <title>${escapeXml(post.title)}</title>`,
+        `      <link>${escapeXml(link)}</link>`,
+        `      <guid isPermaLink="true">${escapeXml(link)}</guid>`,
+        pubDate ? `      <pubDate>${pubDate}</pubDate>` : "",
+        `      <dc:creator>${escapeXml(post.author)}</dc:creator>`,
+        `      <description>${escapeXml(post.excerpt)}</description>`,
+        contentEncoded,
+        categories,
+      ]
+        .filter(Boolean)
+        .join("\n");
+    })
+    .join("\n");
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/">
+  <channel>
+    <title>${escapeXml(channelTitle)}</title>
+    <link>${escapeXml(channelLink)}</link>
+    <atom:link href="${escapeXml(feedLink)}" rel="self" type="application/rss+xml" />
+    <description>${escapeXml(channelDescription)}</description>
+${items}
+  </channel>
+</rss>
+`;
+}

package/apps/storefront/src/lib/blog/teaser.ts

@@ -0,0 +1,83 @@
+/**
+ * Teaser truncation for gated posts. A members-only post is still a 200 with
+ * partial content (indexable — see the B4.0 spike's SEO note), so an anonymous /
+ * unentitled reader gets the first few blocks of the real body plus a paywall
+ * card, not a hard wall.
+ *
+ * Truncation is by TOP-LEVEL BLOCK COUNT, cutting only on an element boundary so
+ * the returned string is never a partial tag. The blog renderer emits each block
+ * (`<p>`, `<h2>`, `<ul>`, `<blockquote>`, `<pre>`, …) as a top-level sibling, so
+ * "first N blocks" is a clean prefix of the rendered HTML; the boundary scan also
+ * tolerates legacy/migrated `contentHtml` from other sources.
+ */
+
+const VOID_TAGS = new Set([
+  "area", "base", "br", "col", "embed", "hr", "img", "input",
+  "link", "meta", "param", "source", "track", "wbr",
+]);
+
+/** Default teaser length: enough to be a genuine content sample, not the whole story. */
+const DEFAULT_BLOCKS = 3;
+
+/**
+ * The first `blocks` top-level block elements of `contentHtml`. Returns the whole
+ * string when it has fewer than `blocks` top-level elements. Cuts only after a
+ * top-level element closes (or a void/self-closing element), so HTML is never
+ * severed mid-tag.
+ */
+export function teaserHtml(contentHtml: string, blocks: number = DEFAULT_BLOCKS): string {
+  if (blocks <= 0) return "";
+  const n = contentHtml.length;
+  let i = 0;
+  let depth = 0;
+  let topLevel = 0;
+
+  while (i < n) {
+    if (contentHtml[i] !== "<") {
+      i++;
+      continue;
+    }
+    if (contentHtml.startsWith("<!--", i)) {
+      const end = contentHtml.indexOf("-->", i + 4);
+      i = end === -1 ? n : end + 3;
+      continue;
+    }
+    const gt = contentHtml.indexOf(">", i);
+    if (gt === -1) break; // malformed tail — stop rather than emit a partial tag
+    const tag = contentHtml.slice(i, gt + 1);
+    i = gt + 1;
+
+    const closing = tag.startsWith("</");
+    const selfClosing = tag.endsWith("/>");
+    const name = tag.match(/^<\/?\s*([a-zA-Z][a-zA-Z0-9-]*)/)?.[1]?.toLowerCase() ?? "";
+
+    if (closing) {
+      if (depth > 0) depth--;
+      if (depth === 0) {
+        topLevel++;
+        if (topLevel >= blocks) return contentHtml.slice(0, i);
+      }
+    } else if (selfClosing || VOID_TAGS.has(name)) {
+      if (depth === 0) {
+        topLevel++;
+        if (topLevel >= blocks) return contentHtml.slice(0, i);
+      }
+    } else {
+      depth++;
+    }
+  }
+  return contentHtml;
+}
+
+/**
+ * The body HTML to render for an article: full content when the viewer is
+ * entitled (or the post is ungated), a teaser otherwise. The single place the
+ * gate/teaser branch lives, so the public/full-content path stays provably
+ * unchanged — `articleBodyHtml(html, { gated: false, ... }) === html`.
+ */
+export function articleBodyHtml(
+  contentHtml: string,
+  opts: { gated: boolean; unlock: boolean },
+): string {
+  return opts.gated && !opts.unlock ? teaserHtml(contentHtml) : contentHtml;
+}

package/apps/storefront/src/lib/blog/types.ts

@@ -5,6 +5,16 @@ export interface BlogImage {
   height?: number;
 }
 
+export type PostStatus = "draft" | "published" | "unlisted" | "scheduled";
+
+/**
+ * Per-post entitlement gate — who may read the body. Orthogonal to `PostStatus`
+ * (which answers "is this published to the live site"): a post has both. Checked
+ * at render time via `viewerHasBlogAccess`, never folded into `isVisibleOnLive`.
+ * Room for future `"tier:<id>"` / `"assurance:<acr>"`; only these three today.
+ */
+export type BlogAccess = "public" | "authenticated" | "members";
+
 export interface BlogPostSummary {
   source: { platform: "wordpress"; id: string };
   slug: string;
@@ -18,9 +28,33 @@ export interface BlogPostSummary {
   categories: string[];
   tags: string[];
   featuredImage?: BlogImage;
+  status: PostStatus; // seeded/legacy posts without this field default to "published"
+  scheduledAt?: string; // ISO date; when status === "scheduled", the post goes live once this instant has passed
+  canonicalUrl?: string; // syndication override
+  inLanguage?: string; // default "en"
+  access?: BlogAccess; // entitlement gate; default "public". Orthogonal to `status`
+  translationGroupId?: string; // stable id shared by every language variant of one article; absent = singleton
 }
 
 export interface BlogPost extends BlogPostSummary {
   oldSlugs: string[];
   contentHtml: string;
+  // Markdown source for the admin editor. When present, `contentHtml` is
+  // its rendered output; migrated/legacy posts may carry only `contentHtml`.
+  bodyMarkdown?: string;
+}
+
+/**
+ * Optional per-tenant × per-collection author bios, keyed by the author's slug
+ * (see `authorSlug`). Sourced from `tenants/<id>/content/<collection>/authors.json`;
+ * absent file or missing key falls back to just the byline name.
+ */
+export interface AuthorBio {
+  name: string;
+  bio?: string;
+  title?: string; // role/title, e.g. "Founder"
+  avatar?: string; // image path (site-relative or absolute)
+  url?: string; // personal/site URL
+  sameAs?: string[]; // social profile URLs — E-E-A-T signal (feeds Person.sameAs)
+  twitter?: string; // handle, e.g. "@ada" (feeds twitter:creator)
 }

package/apps/storefront/src/lib/blog/viewCounts.ts

@@ -0,0 +1,243 @@
+/**
+ * Per-post view counts: the "first demand signal" for the blog platform.
+ *
+ * Rides the EXISTING RUM beacon (`api/rum/vitals.ts`) rather than adding a new
+ * ingestion path. Each page load emits exactly one CLS field-vitals sample (LCP
+ * and INP are conditional), so the beacon handler treats that CLS sample as the
+ * one-per-view signal and increments counters when it lands on a blog-post URL.
+ * All counts are keyed by (tenant, collection, slug) — no PII, no per-visitor
+ * identity.
+ *
+ * Two counters per view, written together:
+ *   - a rolling LIFETIME total (`blogViewsKey`), unbounded; and
+ *   - a per-UTC-day BUCKET (`blogViewsDayKey`, TTL-expiring) that powers the
+ *     time-series sparkline and the "views over last N days" top-posts ranking.
+ * The day buckets are additive to the lifetime total, not a replacement.
+ *
+ * Storage is the TENANT_CACHE KV namespace — the same binding the newsletter stub
+ * writes to and the only durable store bound on the live `preview` worker. The
+ * increment is a read-modify-write, so under concurrency some increments can be
+ * lost to KV's last-write-wins semantics: acceptable for a rough demand signal,
+ * not a billing counter.
+ *
+ * Tenant/collection-generic by construction — nothing here is bound to
+ * `the-build` or `tokenoftrust.com`.
+ */
+import { getPost, listPosts } from "./collection.js";
+
+// Mirror the engine's guards (collection.ts): a collection is one path segment;
+// a slug is lower-kebab. Keeping them local avoids widening the engine's surface.
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const SEGMENT_RE = /^[a-z0-9][a-z0-9._-]*$/;
+
+// Daily buckets auto-expire this many days after their last write. Comfortably
+// past the widest window the dashboard reads (30d), so a "last N days" query
+// never asks for a key that should still exist but was reaped.
+const DAY_BUCKET_TTL_DAYS = 45;
+const DAY_MS = 86_400_000;
+
+/** KV key for one post's rolling lifetime view count. */
+export function blogViewsKey(tenantId: string, collection: string, slug: string): string {
+  return `blogviews:${tenantId}:${collection}:${slug}`;
+}
+
+/** `yyyy-mm-dd` (UTC) stamp for a Date — the day-bucket suffix. */
+export function dayStamp(date: Date): string {
+  return date.toISOString().slice(0, 10);
+}
+
+/**
+ * KV key for one post's views on ONE UTC day. Distinct from `blogViewsKey` by
+ * the trailing `:<yyyy-mm-dd>` segment, so the lifetime counter and the daily
+ * buckets never collide.
+ */
+export function blogViewsDayKey(
+  tenantId: string,
+  collection: string,
+  slug: string,
+  day: string,
+): string {
+  return `${blogViewsKey(tenantId, collection, slug)}:${day}`;
+}
+
+/**
+ * Parse a request pathname into a candidate (collection, slug) post ref, or null
+ * if it is not shaped like a post URL. A post lives at `<base>/<slug>/`, so the
+ * LAST two non-empty path segments are the candidate collection + slug. Taking
+ * the last two (not the first) naturally ignores any `/<domain>` basePath prefix
+ * (DNS-free preview routing) and rejects listing/section pages (`/the-build/`,
+ * `/the-build/category/x/`, `/the-build/author/x/`) and file routes
+ * (`/the-build/rss.xml`, whose slug fails `SLUG_RE`) — those either fail the
+ * guards or resolve to no post. This is only a SHAPE guard; the caller confirms
+ * the post actually exists and is live via `getPost`.
+ */
+export function parseBlogPostPath(path: string): { collection: string; slug: string } | null {
+  const segs = path.split("/").filter(Boolean);
+  if (segs.length < 2) return null;
+  const slug = segs[segs.length - 1]!;
+  const collection = segs[segs.length - 2]!;
+  if (!SEGMENT_RE.test(collection) || !SLUG_RE.test(slug)) return null;
+  return { collection, slug };
+}
+
+async function readCount(kv: KVNamespace, key: string): Promise<number> {
+  const raw = await kv.get(key);
+  const n = raw == null ? 0 : Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+
+/**
+ * Increment the view counter for a post IF the pathname resolves to a live
+ * (published or unlisted) post for this tenant. Drafts, 404s, and non-blog paths
+ * are ignored — `getPost` returns null on the live path for anything not visible.
+ * Best-effort: never throws (a telemetry beacon must never fail the request).
+ */
+export async function recordBlogView(
+  kv: KVNamespace,
+  tenantId: string,
+  path: string,
+): Promise<void> {
+  try {
+    const ref = parseBlogPostPath(path);
+    if (!ref) return;
+    const post = await getPost(tenantId, ref.collection, ref.slug);
+    if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
+    const key = blogViewsKey(tenantId, ref.collection, ref.slug);
+    const dayKey = blogViewsDayKey(tenantId, ref.collection, ref.slug, dayStamp(new Date()));
+    const [lifetime, today] = await Promise.all([readCount(kv, key), readCount(kv, dayKey)]);
+    await Promise.all([
+      // Rolling lifetime counter — unbounded.
+      kv.put(key, String(lifetime + 1)),
+      // Additive daily bucket for the time-series/top-posts dashboard. TTL keeps
+      // the day-bucket keyspace bounded (a day is only ever written on that day,
+      // so it expires ~45d after it stops receiving writes).
+      kv.put(dayKey, String(today + 1), { expirationTtl: (DAY_BUCKET_TTL_DAYS * DAY_MS) / 1000 }),
+    ]);
+  } catch {
+    /* swallow — view counting is best-effort telemetry */
+  }
+}
+
+/**
+ * READER for the future admin "Blog" tab (B2.1, not yet in this base branch).
+ * The tab is server-rendered with `Astro.locals.tenant` and can obtain the KV via
+ * `readKv("TENANT_CACHE")`, so it calls this directly with the slugs from
+ * `listPosts(tenantId, collection, { includeUnpublished: true })` to render a
+ * "Views" column. Returns a slug -> count map (missing keys read as 0); a null KV
+ * (local dev, no binding) yields all-zero counts.
+ */
+export async function getBlogViewCounts(
+  kv: KVNamespace | undefined,
+  tenantId: string,
+  collection: string,
+  slugs: readonly string[],
+): Promise<Record<string, number>> {
+  const out: Record<string, number> = {};
+  for (const slug of slugs) out[slug] = 0;
+  if (!kv) return out;
+  await Promise.all(
+    slugs.map(async (slug) => {
+      out[slug] = await readCount(kv, blogViewsKey(tenantId, collection, slug));
+    }),
+  );
+  return out;
+}
+
+/** The UTC day stamps for the last `days` days, oldest first (today is last). */
+export function recentDayStamps(days: number, now: Date = new Date()): string[] {
+  const n = Math.max(1, Math.floor(days));
+  const end = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+  const out: string[] = [];
+  for (let i = n - 1; i >= 0; i--) out.push(dayStamp(new Date(end - i * DAY_MS)));
+  return out;
+}
+
+/** One day of a post's view series. */
+export interface DailyViews {
+  day: string;
+  views: number;
+}
+
+/**
+ * Per-day view series for one post over the last `days` days (oldest first),
+ * for a sparkline/trend. Missing days read as 0; a null KV yields an all-zero
+ * series of the right length.
+ */
+export async function getPostViewSeries(
+  kv: KVNamespace | undefined,
+  tenantId: string,
+  collection: string,
+  slug: string,
+  days: number,
+  now: Date = new Date(),
+): Promise<DailyViews[]> {
+  const stamps = recentDayStamps(days, now);
+  if (!kv) return stamps.map((day) => ({ day, views: 0 }));
+  return Promise.all(
+    stamps.map(async (day) => ({
+      day,
+      views: await readCount(kv, blogViewsDayKey(tenantId, collection, slug, day)),
+    })),
+  );
+}
+
+/** One ranked row in the top-posts dashboard. */
+export interface TopPost {
+  collection: string;
+  slug: string;
+  title: string;
+  status: string;
+  /** Views within the window (`sinceDays`), or lifetime when no window given. */
+  views: number;
+  /** Lifetime total, always populated. */
+  lifetime: number;
+  /** Per-day series over the window, oldest first — omitted when unwindowed. */
+  series?: DailyViews[];
+}
+
+/**
+ * Rank a collection's posts by view count, most-viewed first.
+ *
+ * KV has no cross-key aggregation, so we take the simplest correct approach:
+ * enumerate the known posts via `listPosts` and read each one's counter(s). At
+ * blog scale (tens of posts) this is a bounded fan-out of parallel KV gets, not
+ * a scan — fine for an admin-tab render, and it needs no write-time index to
+ * keep in sync. `opts.sinceDays` ranks by a windowed sum of the daily buckets
+ * (and returns the series for a sparkline); without it, ranking is by lifetime.
+ */
+export async function getTopPosts(
+  kv: KVNamespace | undefined,
+  tenantId: string,
+  collection: string,
+  opts?: { limit?: number; sinceDays?: number; now?: Date },
+): Promise<TopPost[]> {
+  const posts = await listPosts(tenantId, collection, { includeUnpublished: true });
+  const now = opts?.now ?? new Date();
+  const rows = await Promise.all(
+    posts.map(async (post) => {
+      const lifetime = kv ? await readCount(kv, blogViewsKey(tenantId, collection, post.slug)) : 0;
+      if (opts?.sinceDays == null) {
+        return {
+          collection,
+          slug: post.slug,
+          title: post.title,
+          status: post.status,
+          views: lifetime,
+          lifetime,
+        } satisfies TopPost;
+      }
+      const series = await getPostViewSeries(
+        kv,
+        tenantId,
+        collection,
+        post.slug,
+        opts.sinceDays,
+        now,
+      );
+      const views = series.reduce((sum, d) => sum + d.views, 0);
+      return { collection, slug: post.slug, title: post.title, status: post.status, views, lifetime, series } satisfies TopPost;
+    }),
+  );
+  rows.sort((a, b) => b.views - a.views || b.lifetime - a.lifetime);
+  return opts?.limit != null ? rows.slice(0, Math.max(0, opts.limit)) : rows;
+}

package/apps/storefront/src/lib/chrome/examples/tokenoftrust.chrome-assignments.example.json

@@ -0,0 +1,6 @@
+{
+  "assignments": {
+    "/contact/contact-sales": { "headerVariant": "minimal" },
+    "/contact/contact-sales/thank-you": { "headerVariant": "minimal" }
+  }
+}

package/apps/storefront/src/lib/chrome/examples/tokenoftrust.chrome.example.json

@@ -0,0 +1,79 @@
+{
+  "lang": "en",
+  "head": {
+    "favicon": "/tenants/tokenoftrust.com/favicon.png",
+    "themeStylesheets": ["/tenants/tokenoftrust.com/themes/tot-navy.css"]
+  },
+  "sharedMarketingCss": true,
+  "header": {
+    "variant": "primary",
+    "brand": {
+      "href": "/",
+      "label": "Token of Trust",
+      "logo": {
+        "src": "/tenants/tokenoftrust.com/logo-wordmark.png",
+        "alt": "Token of Trust",
+        "width": 180,
+        "height": 32
+      }
+    },
+    "nav": [
+      { "id": "nav-platform", "label": "Platform", "href": "/#platform" },
+      { "id": "nav-industries", "label": "Industries", "href": "/#industries" },
+      { "id": "nav-resources", "label": "Resources", "href": "https://help.tokenoftrust.com", "external": true },
+      { "id": "nav-pricing", "label": "Pricing", "href": "https://tokenoftrust.com/pricing/", "external": true },
+      { "id": "nav-login", "label": "Login", "href": "https://app.tokenoftrust.com", "external": true }
+    ],
+    "ctas": [
+      { "id": "cta-book-demo", "label": "Book Demo", "href": "https://tokenoftrust.com/contact/", "variant": "secondary" },
+      { "id": "cta-start-free", "label": "Start For Free", "href": "https://app.tokenoftrust.com", "variant": "primary" }
+    ]
+  },
+  "footer": {
+    "variant": "default",
+    "brand": {
+      "text": "Customer verification and compliance for regulated ecommerce. 200+ countries. We will never sell your data."
+    },
+    "columns": [
+      {
+        "title": "Platform",
+        "links": [
+          { "id": "ftr-platform-idv", "label": "Identity Verification", "href": "/#platform" },
+          { "id": "ftr-platform-age", "label": "Age Assurance", "href": "/#platform" },
+          { "id": "ftr-platform-fraud", "label": "Fraud Prevention", "href": "/#platform" },
+          { "id": "ftr-platform-evidence", "label": "Compliance Evidence", "href": "/#platform" },
+          { "id": "ftr-platform-aml", "label": "AML · PACT Act · Tax", "href": "/#platform" }
+        ]
+      },
+      {
+        "title": "Industries",
+        "links": [
+          { "id": "ftr-industries-alcohol", "label": "Alcohol", "href": "/#industries" },
+          { "id": "ftr-industries-vape", "label": "Tobacco & Vape", "href": "/#industries" },
+          { "id": "ftr-industries-age-restricted", "label": "Age-Restricted Goods", "href": "/#industries" },
+          { "id": "ftr-industries-marketplaces", "label": "Marketplaces", "href": "/#industries" }
+        ]
+      },
+      {
+        "title": "Company",
+        "links": [
+          { "id": "ftr-company-pricing", "label": "Pricing", "href": "https://tokenoftrust.com/pricing/", "external": true },
+          { "id": "ftr-company-contact", "label": "Contact Sales", "href": "https://tokenoftrust.com/contact/", "external": true },
+          { "id": "ftr-company-resources", "label": "Resources", "href": "https://help.tokenoftrust.com", "external": true },
+          { "id": "ftr-company-login", "label": "Login", "href": "https://app.tokenoftrust.com", "external": true }
+        ]
+      },
+      {
+        "title": "Legal",
+        "links": [
+          { "id": "ftr-legal-privacy", "label": "Privacy Policy", "href": "https://tokenoftrust.com/privacy/", "external": true },
+          { "id": "ftr-legal-terms", "label": "Terms", "href": "https://tokenoftrust.com/terms/", "external": true }
+        ]
+      }
+    ],
+    "social": [],
+    "bottom": {
+      "note": "GDPR · CCPA · PIPEDA compliant. 256-bit SSL. We will never sell your data."
+    }
+  }
+}