@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/middleware/index.ts

@@ -11,7 +11,7 @@ import { getTenantResolver } from "@/config/resolver";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme, themeToCssVars } from "@/themes/schema";
 import { createToTClient } from "@/lib/tot/ToTClient";
-import { readEnv, readKv, readD1 } from "@/lib/env";
+import { readEnv, readKv, readD1, readR2 } from "@/lib/env";
 import { resolveTenantRouting } from "@/lib/tenantRouting";
 import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
 import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
@@ -21,6 +21,7 @@ import {
   readCacheVersion,
   getCachedPage,
   putCachedPage,
+  staticBundleCacheKey,
 } from "@/lib/edgeCache";
 import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
@@ -31,6 +32,10 @@ import {
   STOREFRONT_CSP_ALLOWLIST,
   checkoutCspAdditions,
   appWidgetCspAdditions,
+  embedCspAdditions,
+  foldIntegrationCsp,
+  embedsArtifactPath,
+  resolveEffectiveEmbeds,
   CSP_REPORT_GROUP,
   CSP_REPORT_PATH,
   readPublishedArtifact,
@@ -38,23 +43,40 @@ import {
   resolveTenantFeatures,
   resolveCapabilities,
   capabilitiesArtifactPath,
+  resolveChannelDigest,
+  resolveServableChannelVersion,
+  channelFromEnv,
+  serveStaticBundle,
+  resolveEnvironmentOnlyPlan,
+  resolveInterimBridgePlan,
+  compileIntegrationCspFromPlan,
+  collectDeclaredCspProfiles,
+  INTEGRATION_NONCE_PLACEHOLDER,
 } from "@tot/public-runtime";
-import type { CapabilityConfig } from "@tot/public-runtime";
+import type { CapabilityConfig, StaticBundleR2BucketLike, BrowserEnvironment } from "@tot/public-runtime";
+import { loadTenantIntegrationDeclarations } from "@/lib/integration/tenantDeclarations";
+import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
+import { fromD1 } from "@/lib/d1/catalog";
 import { resolveTenantCommerce } from "@/lib/checkoutCommerce";
 import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
 import {
   evaluateLoginGate,
   parseGateMode,
   isAuthPath,
+  isAdminPath,
   sessionAdmitsHost,
   sessionHostCapability,
   PUBLIC_HOME_TENANT_ID,
 } from "@/lib/auth/loginGate";
+import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
 import { HEALTH_PATH, healthResponse } from "@/lib/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
+import { requestBrowserEnvironment, deriveSiteSurface, cspHeaderName } from "@/lib/integration/browserEnvironment";
+import { freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
+import { recordActivity } from "@/lib/activity/recordActivity";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
 import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
 
@@ -64,19 +86,19 @@ export const onRequest = defineMiddleware(async (context, next) => {
   const host =
     request.headers.get("host") ?? url.host ?? "localhost";
 
-  // ---- Activity telemetry kill switch (card D8) -----------------------------
+  // ---- Activity telemetry kill switch -----------------------------
   // Prime the ONE `ACTIVITY_TELEMETRY_DISABLED` flag from the (async) Worker env
   // once per isolate, BEFORE the first emit, so every telemetry chokepoint in this
   // isolate (deploy-provenance, recordActivity, ingest) observes it. Fail-open,
   // never throws. Off by default (unset ⇒ telemetry on).
   await primeActivityKillSwitch();
 
-  // ---- Deploy provenance (card D2) — worker_commit / deploy.version_observed -
+  // ---- Deploy provenance — worker_commit / deploy.version_observed -
   // Once per worker isolate (cold start), emit `deploy.version_observed` carrying
-  // this build's commit SHA so D5 can derive deploy skew (running build vs umbrella
-  // tip). Idempotent per isolate, best-effort, never throws — so it's safe here at
-  // the very front door, ahead of /health, and fires regardless of Host/tenant/gate.
-  // A no-op when the D8 kill switch above is set.
+  // this build's commit SHA for downstream deploy-skew derivation (running build vs
+  // umbrella tip). Idempotent per isolate, best-effort, never throws — so it's safe
+  // here at the very front door, ahead of /health, and fires regardless of
+  // Host/tenant/gate. A no-op when the kill switch above is set.
   observeDeployVersion();
 
   // ---- /health — liveness + deploy-identity probe ---------------------------
@@ -164,16 +186,67 @@ export const onRequest = defineMiddleware(async (context, next) => {
     }
     const nowSeconds = Math.floor(Date.now() / 1000);
     const admitted = sessionAdmitsHost(viewerRecord, tenant.appDomain, nowSeconds);
+    // QA content-bypass: only when the server has configured DEMO_GATE_BYPASS_TOKEN
+    // (never in a prod slot) AND the request presents a matching X-Demo-Gate-Bypass
+    // header. Unset token ⇒ false ⇒ fully inert; a client cannot self-grant. The
+    // public-content-only restriction (admin/cockpit/api excluded) is enforced
+    // inside evaluateLoginGate via isBypassPrivilegedPath.
+    const bypassToken = await readEnv("DEMO_GATE_BYPASS_TOKEN");
+    const qaBypass =
+      !!bypassToken && request.headers.get("x-demo-gate-bypass") === bypassToken;
+
+    // Canonical admin tenant landing: an AUTHENTICATED viewer who is not a
+    // member/staff of THIS host's tenant must be routed to their OWN tenant
+    // (auto when sole) or the tenant picker (when several / none) — never bounced
+    // into a sign-in loop and never silently shown the wrong tenant. Only for
+    // admin paths, only for an authed non-member, and never on the /admin/select
+    // picker itself (whose whole purpose is to be reachable by such a viewer).
+    if (
+      isAdminPath(url.pathname) &&
+      !isAdminSelectPath(url.pathname) &&
+      !admitted &&
+      viewerRecord &&
+      !qaBypass
+    ) {
+      const landing = resolveAdminLanding({
+        record: viewerRecord,
+        routedTenant: tenant.appDomain,
+        basePath,
+        intended: url.pathname + url.search,
+        nowSeconds,
+      });
+      if (landing.action === "auto" || landing.action === "select") {
+        return context.redirect(landing.location, 303);
+      }
+    }
+
+    // The /admin/select picker requires only a VALID SESSION (any authed viewer),
+    // not membership of the routed tenant — it lists the viewer's OWN tenants. So
+    // it passes the gate on the strength of the session alone.
+    const hasValidSession =
+      admitted || (isAdminSelectPath(url.pathname) && !!viewerRecord);
     const decision = evaluateLoginGate({
       host,
       pathname: url.pathname,
       search: url.search,
       mode: gateMode,
       gatedHosts: demoGateHosts,
-      hasValidSession: admitted,
+      hasValidSession,
       tenantExempt,
+      qaBypass,
     });
     if (decision.action === "redirect") {
+      // ADMIN (and any privileged surface) hard-redirects to sign-in rather than
+      // rendering the merchant-facing "Coming soon" holding page: an unauthenticated
+      // admin visitor must land on the sign-in prompt, never an ambiguous 200 that
+      // reads as "this store isn't ready." The holding page's whole audience is a
+      // public browser of a gated STOREFRONT; it is the wrong signal for /admin. The
+      // gate already decided to withhold — this only changes HOW (303 vs holding
+      // page); it never weakens the gate. `decision.location` already carries
+      // `?next=` so the admin returns to exactly where they were headed.
+      if (isAdminPath(url.pathname)) {
+        return context.redirect(decision.location, 303);
+      }
       // Withhold content but offer sign-in (carrying the intended destination).
       return gatedHoldingResponse(decision.location);
     }
@@ -183,7 +256,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
       // in: a member sees their tenants[] role; the owner of their own tenant sees
       // the resource-scoped session's capability; a ToT-staff viewer admitted via
       // an explicit vendor selection sees the staffRoles-scoped capability. The
-      // ship gates (u10 decideIsOwner/resolveShipPrincipal) read this capability,
+      // ship gates (decideIsOwner/resolveShipPrincipal) read this capability,
       // so binding it here keeps owner-resolution server-side + tenant-correct.
       const hostCapability = sessionHostCapability(viewerRecord, tenant.appDomain, nowSeconds);
       locals.viewer = {
@@ -199,13 +272,156 @@ export const onRequest = defineMiddleware(async (context, next) => {
   const isPreviewHost = host.toLowerCase().startsWith("preview.");
   const queryToken = url.searchParams.get("__preview");
   const cookieToken = context.cookies.get("tot_preview")?.value ?? null;
-  // Per-developer AI-edit draft (decision draft-overlay-same-origin): the signed
+  // Per-developer AI-edit draft: the signed
   // tot_dev_draft cookie's mere PRESENCE opts the request out of the shared page
   // cache below (a draft view must never be cached publicly); it's verified —
   // signature, expiry, tenant binding — before the overlay is applied further down.
   const draftCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
 
-  // ---- Edge page cache (D1): short-circuit production browse reads on a hit,
+  // Active managed installs share the same declaration/resolver/CSP/broker/cache
+  // plane as tenant-config integrations. Read only canonical active rows and their
+  // current immutable snapshot; candidates, suspended rows, and drafts produce no
+  // declaration. A missing/unmigrated binding fails closed to no managed effects.
+  const appsD1 = await readD1("STOREFRONT_APPS_DB");
+  let managedIntegrationDeclarations = [] as Awaited<ReturnType<typeof loadActiveManagedInstallDeclarations>>;
+  if (appsD1) {
+    try {
+      managedIntegrationDeclarations = await loadActiveManagedInstallDeclarations(fromD1(appsD1), tenant.tenant_id);
+    } catch {
+      managedIntegrationDeclarations = [];
+    }
+  }
+
+  // ---- Digest-addressed static-bundle serving (ADR 0012) --------------------
+  // For a static-publish tenant's PRODUCTION reads only (never preview/test — the
+  // "Worker serves interactive preview, R2 serves prod" split), read the live
+  // bundle straight out of R2 instead of falling through to SSR. Deliberately
+  // BEFORE the edge page cache / catalog / theme / customization machinery below:
+  // none of that applies to bundle bytes served verbatim, and this path must
+  // never SSR-fallthrough once it's eligible (a missing digest/object fails
+  // closed, see `serveStaticBundle`), so it has to fully own the response, not
+  // degrade into the normal render.
+  // Host-resolved reads only (`basePath === ""`): bundle bytes are served
+  // VERBATIM with root-absolute links, so a path-prefixed view
+  // (/<domain>/… on the shared .store host) would escape its prefix on every
+  // href — those views keep SSR, which rewrites hrefs through basePath.
+  const staticBundleEligible =
+    tenant.staticPublish != null &&
+    tenant.staticPublish.enabled !== false &&
+    basePath === "" &&
+    request.method.toUpperCase() === "GET" &&
+    !isPreviewHost &&
+    !queryToken &&
+    !cookieToken &&
+    !draftCookie &&
+    managedIntegrationDeclarations.length === 0 &&
+    !url.pathname.startsWith("/api/");
+  if (staticBundleEligible) {
+    const bundleBucket = await readR2("STATIC_BUNDLES");
+    if (bundleBucket) {
+      const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
+      // The R2 bundle key is the `treeDigest`, NOT the `live` channel versionId
+      // (the Gitea sha). Read the reconciled digest companion (`channelDigests.live`)
+      // — `gatedPromote`/`rollbackCandidateAtomic` write it in the same CAS flip as
+      // the versionId. No digest = this tenant has never staged a bundle — SSR
+      // serves it (a static-publish tenant must be able to bootstrap, and its
+      // app surfaces must never be downed by an unstaged static plane).
+      const digest = await resolveChannelDigest(kvGet, tenant.tenant_id, "live");
+      if (digest) {
+        const bundleCacheKey = cache
+          ? staticBundleCacheKey(tenant.tenant_id, digest, url.pathname, url.search)
+          : null;
+        if (bundleCacheKey && cache) {
+          const hit = await getCachedPage(cache, bundleCacheKey);
+          if (hit) return hit;
+        }
+        const bundleResponse = await serveStaticBundle(
+          {
+            bucket: bundleBucket as unknown as StaticBundleR2BucketLike,
+            digest,
+            onFailClosed: (detail) => {
+              console.error(
+                `[static-bundle] fail-closed for ${tenant.tenant_id} ${url.pathname}: ${detail}`,
+              );
+            },
+          },
+          url.pathname,
+        );
+        // `null` = the manifest proves this path is outside the bundle's static
+        // surface (an app surface like /admin) — SSR owns it below.
+        if (bundleResponse) {
+          if (bundleCacheKey && cache) {
+            await putCachedPage(cache, bundleCacheKey, bundleResponse);
+          }
+          return bundleResponse;
+        }
+      } else {
+        console.error(
+          `[static-bundle] no live digest for ${tenant.tenant_id} — SSR until a bundle is staged`,
+        );
+      }
+    }
+    // No STATIC_BUNDLES binding (plain `astro dev`, or unconfigured) —
+    // degrading to SSR here rather than a hard failure keeps `astro dev`/tests
+    // usable without provisioning R2.
+  }
+
+  // ---- Tenant-local integration materialization (ext-kernel-09) --------------
+  // Resolve a tenant's OWN declared, exact-version integrations into the effective
+  // plan the render engine serves, THROUGH the interim marketing bridge (which
+  // refuses a regulated tenant and fail-closes an invalid declaration set). Done
+  // HERE, before the edge-cache read, so a declared tenant's `planRevision` folds
+  // into the page-cache key below (a rollback/uninstall resolves a new revision →
+  // the old warm entry is unreachable → a clean re-render without the removed
+  // origins, never a TTL wait) AND its reviewed CSP origins reach the strict header.
+  //
+  // An UNDECLARED tenant does NONE of this: `loadTenantIntegrationDeclarations`
+  // returns the empty set, so `integrationCsp` stays undefined (the page-cache key
+  // is byte-identical to the non-integration form) and the environment-only plan is
+  // resolved below exactly as before — zero cost.
+  let resolvedBrowserEnvironment: BrowserEnvironment | null = null;
+  const integrationDeclarations = [
+    ...loadTenantIntegrationDeclarations(tenant),
+    ...managedIntegrationDeclarations,
+  ];
+  if (integrationDeclarations.length > 0) {
+    const declPreviewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
+    const declEnv = await resolveCustomizationEnv({
+      isPreviewHost,
+      tenantId: tenant.tenant_id,
+      token: queryToken ?? cookieToken,
+      secret: declPreviewSecret,
+      nowSeconds: Math.floor(Date.now() / 1000),
+      pathname: url.pathname,
+    });
+    const declFeatures = resolveTenantFeatures(tenant);
+    resolvedBrowserEnvironment = requestBrowserEnvironment({
+      host,
+      isPreviewHost,
+      customizationEnv: declEnv.env,
+      canonicalHost: tenant.canonicalDomain || host,
+      siteSurface: deriveSiteSurface({ catalog: declFeatures.catalog, pathname: renderPath }),
+    });
+    const bridge = resolveInterimBridgePlan({
+      tenantPublicId: tenant.tenant_id,
+      tenant,
+      environment: resolvedBrowserEnvironment,
+      declarations: integrationDeclarations,
+    });
+    if (bridge.ok) {
+      // A resolved plan serves; its compiled CSP additions + `planRevision` reach the
+      // cache key and the header. A refusal (regulated) or an invalid set leaves the
+      // plan unset here → the environment-only fallback below fills it (nothing loads).
+      locals.integrationPlan = bridge.plan;
+      const compiled = compileIntegrationCspFromPlan(
+        bridge.plan,
+        collectDeclaredCspProfiles(integrationDeclarations),
+      );
+      if (compiled.ok) locals.integrationCsp = compiled.value;
+    }
+  }
+
+  // ---- Edge page cache: short-circuit production browse reads on a hit,
   // BEFORE building the client / theme / rendering. Misses store the final
   // response at the end of this middleware.
   //
@@ -224,12 +440,27 @@ export const onRequest = defineMiddleware(async (context, next) => {
   let pageKey: Request | null = null;
   if (pageCacheEligible && cache && kv) {
     const version = await readCacheVersion(kv, tenant.tenant_id);
-    pageKey = pageCacheKey(tenant.tenant_id, url.pathname, url.search, version);
+    // Fold the resolved integration plan revision into the key so a warm entry is
+    // version-scoped: a rollback/uninstall resolves a new revision → old entry
+    // unreachable → clean re-render without the removed origins (never a TTL wait).
+    // Undefined until the integration plane is resolved for this tenant — the key
+    // is then byte-identical to the non-integration form. The store below reuses
+    // this same `pageKey`, so read and write stay consistent.
+    pageKey = pageCacheKey(
+      tenant.tenant_id,
+      url.pathname,
+      url.search,
+      version,
+      locals.integrationCsp?.planRevision,
+    );
     const hit = await getCachedPage(cache, pageKey);
-    if (hit) return hit;
+    // The cached artifact is nonce-free (carries the placeholder). Stamp a fresh
+    // per-response nonce into its body + CSP header so a warm hit is served with a
+    // brand-new nonce, never the one an earlier response rendered with.
+    if (hit) return await stampResponseNonce(hit, freshNonce());
   }
 
-  // Catalog source selection (F17 graduation path — docs/architecture/product-catalog.md).
+  // Catalog source selection (docs/architecture/product-catalog.md).
   // A store's product source graduates over its life: JSON fixtures (dev default) ->
   // D1 edge replica (staging) -> hosted ToT catalog (go-live). Here we pick the read
   // backend: USE_D1_CATALOG=1 (+ a CATALOG_DB binding) reads the D1 edge replica;
@@ -249,7 +480,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     ? `${proto}://${host}${basePath}`
     : `https://${tenant.canonicalDomain}`;
 
-  // Live vs test customization (D4). Production hosts always serve "live" and
+  // Live vs test customization. Production hosts always serve "live" and
   // ignore any token; a "preview." host is auth-gated by a signed, tenant-bound,
   // short-TTL preview token (?__preview= on first hit, then the tot_preview
   // cookie). Test is never indexable (X-Robots-Tag below).
@@ -262,6 +493,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     token: previewToken,
     secret: previewSecret,
     nowSeconds,
+    pathname: url.pathname,
   });
   if (customization.reject) {
     return new Response(customization.reject.message, {
@@ -290,6 +522,28 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // pointer fall back to the legacy per-path selection — no behavior change.
   const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
 
+  // Self-heal a DANGLING channel pointer: the pointer for this env's channel may
+  // name a version that was never built (or whose manifest was evicted).
+  // `readVersionedArtifact` already serves last-built content instead of emptying
+  // the surface; here we do the once-per-request detection to ENQUEUE a rebuild of
+  // the dangling version. Fail-open: a KV hiccup never blocks the render (the reads
+  // below still run).
+  if (kv) {
+    const channel = channelFromEnv(customization.env);
+    await resolveServableChannelVersion(kvGet, tenant.tenant_id, channel, ({ versionId }) => {
+      recordActivity({
+        action: "preview.build.requested",
+        actor: { kind: "system", id: "storefront" },
+        source: "server",
+        outcome: { status: "succeeded" },
+        scope: { tenantId: tenant.tenant_id },
+        payload: { args: { changeId: versionId } },
+      });
+    }).catch(() => {
+      /* fail-open: self-heal detection never breaks the request */
+    });
+  }
+
   // Verify the developer-draft cookie (signature + expiry + tenant binding) — the
   // overlay below only engages for the developer who minted the draft, on THIS
   // tenant. Same secret + trust model as the preview token; invalid/expired/foreign
@@ -348,9 +602,34 @@ export const onRequest = defineMiddleware(async (context, next) => {
   }
   const capabilities = resolveCapabilities(tenant, publishedCaps);
 
-  // Per-request CSP nonce (D2): goes on the platform's own inline tags in
-  // Layout.astro so a strict CSP can allow them without 'unsafe-inline'.
-  const cspNonce = crypto.randomUUID();
+  // Embed opt-in (self-serve, config-as-code on the same spine as capabilities):
+  // the build-time TenantConfig.embeds default is overlaid with the tenant's
+  // published embeds.json for THIS env, then filtered to the vetted catalog. A
+  // tenant enables a catalogued embed by committing embeds.json — no platform
+  // change — but can never introduce a non-catalog origin.
+  let publishedEmbeds: string[] | null = null;
+  const publishedEmbedsRaw = await readPublishedArtifact(
+    kvGet,
+    tenant.tenant_id,
+    customization.env,
+    embedsArtifactPath(tenant.tenant_id),
+  );
+  if (publishedEmbedsRaw) {
+    try {
+      const parsed = JSON.parse(publishedEmbedsRaw);
+      if (Array.isArray(parsed)) publishedEmbeds = parsed.filter((s) => typeof s === "string");
+    } catch {
+      /* malformed published artifact — keep the build-time default */
+    }
+  }
+  const effectiveEmbeds = resolveEffectiveEmbeds(tenant.embeds, publishedEmbeds);
+
+  // Nonce placeholder: the platform's inline tags AND the CSP header are rendered
+  // with this sentinel, never a live nonce (ADR 0018). A fresh per-response nonce
+  // is stamped in at serve time (stampResponseNonce below), so the cached artifact
+  // is nonce-free and every response — cold render or warm cache hit — gets a fresh
+  // matching nonce/CSP pair.
+  const cspNonce = INTEGRATION_NONCE_PLACEHOLDER;
 
   locals.tenant = tenant;
   // Effective capability flags for this tenant (commerce defaults unless the
@@ -393,6 +672,31 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // tenant-agnostic; the Layout uses this to keep root-absolute links inside
   // the tenant prefix on the client.
   locals.basePath = basePath;
+  // Renderer-owned four-stage browser environment (ADR 0014 E1 / 0017), computed
+  // ONCE here from authoritative request state and serialized before app code by
+  // both document mounts (Layout.astro + rawHtmlResponse). The candidate render
+  // paths build their own `candidate`-stage object instead of this one.
+  // Reuse the environment resolved for a declared tenant's integration plane above
+  // (identical inputs → identical object) so the plan's environment and this object
+  // never diverge; an undeclared tenant computes it here for the first time.
+  locals.browserEnvironment =
+    resolvedBrowserEnvironment ??
+    requestBrowserEnvironment({
+      host,
+      isPreviewHost,
+      customizationEnv: customization.env,
+      canonicalHost: tenant.canonicalDomain || host,
+      siteSurface: deriveSiteSurface({ catalog: locals.features.catalog, pathname: renderPath }),
+    });
+  // Resolved effective plan (ext-kernel-03) for this request — the fixed-phase
+  // render engine (ext-kernel-04) consumes it in BOTH document mounts (Layout.astro
+  // + rawHtmlResponse). A declared tenant's plan is already resolved above (through
+  // the interim bridge); an undeclared tenant — or one the bridge refused / failed
+  // closed — resolves the environment-only plan here, so a page with no serving
+  // integration emits no vendor runtime/markup.
+  locals.integrationPlan =
+    locals.integrationPlan ??
+    resolveEnvironmentOnlyPlan(locals.browserEnvironment, tenant.tenant_id);
 
   // /dev was renamed to /cockpit (2026-07-20). 302-redirect any old /dev link —
   // host-routed (/dev) or path-routed (/<vendor>/dev) — to the new path, preserving
@@ -421,7 +725,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     nonce: cspNonce,
   });
 
-  // Baseline security headers (S1) on every response — set before the page-cache
+  // Baseline security headers on every response — set before the page-cache
   // store below so cached copies carry them too.
   applySecurityHeaders(response.headers);
 
@@ -445,9 +749,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // site unstyled. The BUILD is CSP-clean (styles are externalized via
   // `inlineStylesheets:"never"`), so we enforce there and only REPORT in dev —
   // violations are still surfaced, but styling/HMR work locally.
-  const cspHeader = import.meta.env.DEV
-    ? "Content-Security-Policy-Report-Only"
-    : "Content-Security-Policy";
+  const cspHeader = cspHeaderName(import.meta.env.DEV);
   response.headers.set(
     "Reporting-Endpoints",
     `${CSP_REPORT_GROUP}="${CSP_REPORT_PATH}"`,
@@ -456,40 +758,66 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // strict policy only when this tenant has a store — so add-to-cart, the
   // sidecart iframe/XHR, and the cross-origin form POST all pass.
   const checkoutCsp = commerce ? checkoutCspAdditions(commerce.origin) : null;
-  // Private-app widget origins (D5) — read back AFTER next() so this reflects
+  // Private-app widget origins — read back AFTER next() so this reflects
   // exactly the placements that rendered on THIS page, never a wildcard.
   const widgetCsp = appWidgetCspAdditions(locals.activeWidgetPlacements ?? []);
+  // Third-party marketing embeds (e.g. a Pipedrive form) the tenant opted into
+  // via .tot/config.json `embeds:`. Only scan the HTML body when the tenant
+  // declared at least one embed — zero cost for everyone else — and add each
+  // provider's origins ONLY if its marker is actually on THIS page.
+  // Prefer an opt-in the render handler resolved for a tenant the URL router
+  // couldn't (the candidate renderer sets locals.embedOptIn — see candidateRender);
+  // otherwise use the router-resolved tenant's effective embeds.
+  const embedsForScan = locals.embedOptIn ?? effectiveEmbeds;
+  let embedCsp = { scriptSrc: [] as string[], connectSrc: [] as string[], frameSrc: [] as string[] };
+  if (
+    embedsForScan.length > 0 &&
+    (response.headers.get("content-type") ?? "").includes("text/html")
+  ) {
+    embedCsp = embedCspAdditions(embedsForScan, await response.clone().text());
+  }
+  const cspOptions = {
+    nonce: cspNonce,
+    ...STOREFRONT_CSP_ALLOWLIST,
+    // Pin Astro's static inline hydration scripts + island style by hash
+    // (they're identical every request); my dynamic inline tags use the nonce.
+    scriptSrc: [
+      ...STOREFRONT_CSP_ALLOWLIST.scriptSrc,
+      ...STATIC_SCRIPT_HASHES,
+      ...(checkoutCsp?.scriptSrc ?? []),
+      ...embedCsp.scriptSrc,
+    ],
+    styleSrc: [
+      ...STOREFRONT_CSP_ALLOWLIST.styleSrc,
+      ...STATIC_STYLE_HASHES,
+      ...(checkoutCsp?.styleSrc ?? []),
+    ],
+    fontSrc: [...STOREFRONT_CSP_ALLOWLIST.fontSrc, ...(checkoutCsp?.fontSrc ?? [])],
+    connectSrc: [
+      ...STOREFRONT_CSP_ALLOWLIST.connectSrc,
+      ...(checkoutCsp?.connectSrc ?? []),
+      ...embedCsp.connectSrc,
+    ],
+    imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(checkoutCsp?.imgSrc ?? [])],
+    frameSrc: [
+      ...(checkoutCsp?.frameSrc ?? []),
+      ...widgetCsp.frameSrc,
+      ...embedCsp.frameSrc,
+    ],
+    formAction: checkoutCsp?.formAction ?? [],
+    reportGroup: CSP_REPORT_GROUP,
+    reportUri: CSP_REPORT_PATH,
+  };
+  // Version-scoped integration plane: APPEND the resolved plan's compiled origins
+  // (curated adapter profiles + advanced exact origins) to the six contributable
+  // directives only — never the base. Absent (no integration) this is a no-op, so
+  // the header is byte-identical to a non-integration tenant's.
   response.headers.set(
     cspHeader,
-    buildCsp({
-      nonce: cspNonce,
-      ...STOREFRONT_CSP_ALLOWLIST,
-      // Pin Astro's static inline hydration scripts + island style by hash
-      // (they're identical every request); my dynamic inline tags use the nonce.
-      scriptSrc: [
-        ...STOREFRONT_CSP_ALLOWLIST.scriptSrc,
-        ...STATIC_SCRIPT_HASHES,
-        ...(checkoutCsp?.scriptSrc ?? []),
-      ],
-      styleSrc: [
-        ...STOREFRONT_CSP_ALLOWLIST.styleSrc,
-        ...STATIC_STYLE_HASHES,
-        ...(checkoutCsp?.styleSrc ?? []),
-      ],
-      fontSrc: [...STOREFRONT_CSP_ALLOWLIST.fontSrc, ...(checkoutCsp?.fontSrc ?? [])],
-      connectSrc: [
-        ...STOREFRONT_CSP_ALLOWLIST.connectSrc,
-        ...(checkoutCsp?.connectSrc ?? []),
-      ],
-      imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(checkoutCsp?.imgSrc ?? [])],
-      frameSrc: [...(checkoutCsp?.frameSrc ?? []), ...widgetCsp.frameSrc],
-      formAction: checkoutCsp?.formAction ?? [],
-      reportGroup: CSP_REPORT_GROUP,
-      reportUri: CSP_REPORT_PATH,
-    }),
+    buildCsp(foldIntegrationCsp(cspOptions, locals.integrationCsp?.additions ?? {})),
   );
 
-  // D1: store the fully-rendered, CSP-stamped response for the next reader. Only
+  // Store the fully-rendered, CSP-stamped response for the next reader. Only
   // production (no preview token reached here) cacheable GETs have a pageKey;
   // putCachedPage additionally skips non-200, non-HTML, and cookie-bearing
   // responses. Also expose Cache-Control to any fronting CDN.
@@ -498,7 +826,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
       "Cache-Control",
       "public, s-maxage=300, stale-while-revalidate=86400",
     );
+    // Store the nonce-free artifact (the placeholder is still in the body + CSP
+    // header) BEFORE stamping — so the cache never holds a live/reusable nonce.
     await putCachedPage(cache, pageKey, response);
   }
-  return response;
+  // Stamp a fresh per-response nonce into this cold response's body + CSP header
+  // (the warm-hit path above stamps its own). Both paths therefore serve a fresh,
+  // matching nonce/CSP pair, and no nonce is reused across responses (ADR 0018).
+  return await stampResponseNonce(response, freshNonce());
 });

package/apps/storefront/src/pages/[...slug].astro

@@ -43,8 +43,13 @@ const rawHtml = await content.getPageHtml(slug);
 if (rawHtml && rawHtmlPolicy(tenant).allowed) {
   // Shared chrome: a body-only fragment gets wrapped in the tenant's chrome.html;
   // a full document serves verbatim (backward-compatible). See rawMarketingHtml.ts.
-  const chromeWrapper = await content.getChromeHtml();
-  return rawHtmlResponse(rawHtml, { nonce: Astro.locals.cspNonce, basePath, chromeWrapper });
+  const chromeWrapper = await content.getChromeHtml(`/${slug}`);
+  return rawHtmlResponse(rawHtml, {
+    nonce: Astro.locals.cspNonce,
+    basePath,
+    chromeWrapper,
+    plan: Astro.locals.integrationPlan,
+  });
 }
 
 const page = await content.getPage(slug);
@@ -59,7 +64,7 @@ const description =
   page.seoDescription ||
   (page.intro ? truncate(page.intro, 160) : undefined);
 
-// Structured pages (F4) drive the body from `sections`; legacy pages keep the
+// Structured pages drive the body from `sections`; legacy pages keep the
 // sanitized `body_html`. Prefer structured whenever a page ships sections.
 const structured = (page.sections?.length ?? 0) > 0;
 
@@ -109,7 +114,7 @@ const updatedLabel = page.updated
     {structured && <ProseToc sections={page.sections!} />}
   </header>
 
-  {/* Body — constrained to a readable measure. Structured pages (F4) render
+  {/* Body — constrained to a readable measure. Structured pages render
       framework widgets from `sections`; legacy pages keep the sanitized HTML. */}
   <div class="container-prose pb-[clamp(3rem,7vw,6rem)] pt-8">
     {structured ? (