@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/apps/storefront/src/pages/api/apps/internal/order-forward.ts

@@ -23,18 +23,29 @@ import {
   receiveForwardedOrder,
   type OrderForwardInput,
 } from "@/lib/apps/orders/orderForwardReceiver.js";
+import { joinForwardedOrderConversion } from "@/lib/apps/orders/orderConversionD1.js";
+import { D1VerifiedProviderMeasurementStore } from "@/lib/apps/orders/verifiedProviderMeasurement.js";
 import type { OrderLineItem, OrderStatus } from "@/lib/apps/orders/ordersStore.js";
 import { recordActivity } from "@/lib/activity/recordActivity";
 
 export const prerender = false;
 
 const SIGNATURE_HEADER = "x-order-forward-signature";
-const ORDER_STATUSES: readonly OrderStatus[] = ["created", "fulfilled", "cancelled"];
+const ORDER_STATUSES: readonly OrderStatus[] = ["created", "fulfilled", "refunded", "cancelled"];
 
 function json(body: unknown, status: number): Response {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 }
 
+/** Coarse, non-PII conversion-join diagnostic (never the order id or correlation token). */
+function logConversionDiag(fields: Record<string, unknown>): void {
+  try {
+    console.warn("[diag:order-conversion]", JSON.stringify(fields));
+  } catch {
+    /* diagnostics must never break the caller */
+  }
+}
+
 // --- HMAC verification -----------------------------------------------------
 // Same shape as `@tot/private-controlplane`'s `verifyGiteaSignature` (hex
 // HMAC-SHA256 over the raw body, verified via `crypto.subtle.verify` so a
@@ -85,6 +96,10 @@ interface OrderForwardBody {
   lineItems?: unknown;
   rawCustomerId?: unknown;
   createdAt?: unknown;
+  providerFields?: unknown;
+  providerEventId?: unknown;
+  occurredAt?: unknown;
+  amountMinor?: unknown;
 }
 
 function parseLineItems(value: unknown): OrderLineItem[] | string {
@@ -128,7 +143,16 @@ function parseOrderForwardInput(body: OrderForwardBody): OrderForwardInput | str
     return "rawCustomerId must be a string";
   }
   if (body.createdAt !== undefined && typeof body.createdAt !== "string") return "createdAt must be a string";
+  if (
+    body.providerFields !== undefined &&
+    (typeof body.providerFields !== "object" || body.providerFields === null || Array.isArray(body.providerFields))
+  ) {
+    return "providerFields must be an object";
+  }
 
+  if (body.providerEventId !== undefined && (typeof body.providerEventId !== "string" || !body.providerEventId.trim())) return "providerEventId must be a non-empty string";
+  if (body.occurredAt !== undefined && typeof body.occurredAt !== "string") return "occurredAt must be a string";
+  if (body.amountMinor !== undefined && (typeof body.amountMinor !== "number" || !Number.isSafeInteger(body.amountMinor) || body.amountMinor < 0)) return "amountMinor must be a non-negative safe integer";
   return {
     tenantId: body.tenantId,
     externalOrderId: body.externalOrderId,
@@ -140,6 +164,10 @@ function parseOrderForwardInput(body: OrderForwardBody): OrderForwardInput | str
     lineItems,
     rawCustomerId: body.rawCustomerId as string | undefined,
     createdAt: body.createdAt as string | undefined,
+    providerEventId: body.providerEventId as string | undefined,
+    occurredAt: body.occurredAt as string | undefined,
+    amountMinor: body.amountMinor as number | undefined,
+    providerFields: body.providerFields as Record<string, unknown> | undefined,
   };
 }
 
@@ -168,7 +196,51 @@ export async function POST(context: APIContext): Promise<Response> {
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return json({ error: "orders store not configured" }, 503);
 
-  const result = await receiveForwardedOrder(fromD1(d1), input);
+  const db = fromD1(d1);
+  const result = await receiveForwardedOrder(db, input);
+
+
+  // This local-only outbox runs only after raw-body HMAC verification and the
+  // trusted order receiver. Its failure is fail-soft: commerce still ACKs.
+  try {
+    const measurement = await new D1VerifiedProviderMeasurementStore(db).record(input);
+    if (measurement.outcome === "recorded") {
+      logConversionDiag({ tenantId: input.tenantId, env: input.env, regulatedMeasurement: "recorded" });
+    }
+  } catch (cause) {
+    logConversionDiag({
+      tenantId: input.tenantId,
+      env: input.env,
+      regulatedMeasurement: "outbox-unavailable",
+      error: cause instanceof Error ? cause.name : "unknown",
+    });
+  }
+
+  // Join the verified order to its browser handoff correlation and produce the
+  // authoritative server conversion event(s) — ext-commerce-05 destinations fan
+  // these out. The join owns idempotency + single-use replay defense; a failure
+  // here must never fail the order ACK, so it is fail-soft (logged, swallowed).
+  try {
+    const conversion = await joinForwardedOrderConversion(db, input, result);
+    if (conversion.events.length > 0) {
+      // Coarse, non-PII diagnostic: attribution outcome + conversion count only —
+      // never the order id, correlation token, or any customer field.
+      logConversionDiag({
+        tenantId: input.tenantId,
+        env: input.env,
+        conversions: conversion.events.length,
+        attributed: conversion.attribution.attributed,
+        reason: conversion.attribution.attributed ? undefined : conversion.attribution.reason,
+      });
+    }
+  } catch (cause) {
+    logConversionDiag({
+      tenantId: input.tenantId,
+      env: input.env,
+      error: cause instanceof Error ? cause.name : "unknown",
+    });
+  }
+
   // D11: HIGH-VOLUME machine action (the tot-foxycart forwarder, HMAC-authed) → analytics
   // only, never timelined. Coarse dimensions only; customer/order ids never stored.
   recordActivity({

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -0,0 +1,77 @@
+/**
+ * POST /api/commerce/checkout-handoff — the checkout-correlation MINT seam
+ * (ext-commerce-10).
+ *
+ * The shopper's analytics consent is a CLIENT-side decision (CMP / native banner),
+ * but the correlation token is minted under the SERVER-only signing secret. So at the
+ * handoff the client posts its LIVE consent snapshot and the server mints the token,
+ * returning ONLY the opaque passthrough cart field to attach to the managed-cart form.
+ * The signing secret never leaves the server; the token carries no PII and no secret.
+ *
+ * Server-owned by construction:
+ *   - The tenant and the {@link IntegrationEnvironment} stage come from `context.locals`
+ *     (the renderer-owned `BrowserEnvironment`), NEVER from the request body — a client
+ *     cannot mint a cross-tenant or cross-stage token.
+ *   - The consent snapshot is parsed FAIL-CLOSED (`parseConsentSnapshot`): an absent,
+ *     forged, or tampered snapshot collapses to default-deny → unattributed.
+ *   - No store on this tenant, consent withheld, or no signing key → an explicit
+ *     unattributed response; the handoff proceeds, checkout is never blocked.
+ */
+import type { APIContext } from "astro";
+import { parseConsentSnapshot, defaultConsentSnapshot } from "@tot/public-runtime";
+import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
+
+export const prerender = false;
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+    },
+  });
+}
+
+interface HandoffBody {
+  /** The shopper's serialized consent snapshot (the `__TOT_INTEGRATION_CONSENT__` global). */
+  consent?: unknown;
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const { tenant, browserEnvironment, commerce } = context.locals;
+
+  // No managed checkout on this tenant → nothing to attribute.
+  if (!commerce) {
+    return json({ attributed: false, reason: "no-store" });
+  }
+
+  let body: HandoffBody;
+  try {
+    body = (await context.request.json()) as HandoffBody;
+  } catch {
+    body = {};
+  }
+
+  // Fail-closed: an absent/forged/tampered snapshot is default-deny (essential only).
+  const consent = parseConsentSnapshot(body.consent) ?? defaultConsentSnapshot();
+
+  const result = await resolveCheckoutHandoffCorrelation({
+    tenant: tenant.tenant_id,
+    // Env-consistency: the request's own resolved stage, never a client value.
+    environment: browserEnvironment.environment,
+    consent,
+    // Opaque per-handoff logical id the order join threads back to.
+    eventId: crypto.randomUUID(),
+  });
+
+  if (result.attributed) {
+    // Return ONLY the opaque passthrough field; the signing secret never leaves here.
+    return json({ attributed: true, cartField: result.cartField });
+  }
+  return json({ attributed: false, reason: result.reason });
+}
+
+export async function GET(): Promise<Response> {
+  return json({ error: "method_not_allowed" }, 405);
+}

package/apps/storefront/src/pages/api/compliance/tamper.ts

@@ -0,0 +1,88 @@
+/**
+ * POST /api/compliance/tamper — the server receiver for protected-surface tamper
+ * beacons (D-R7, `integration-protected-tamper-recovery`).
+ *
+ * The browser sentinel restores safe state IN the document and posts a
+ * `TamperEvidenceBeacon` here. This route validates it fail-closed, records the
+ * durable evidence + operator alert, and — when the beacon is attributable to a
+ * single active install — SUSPENDS that install. It is a DETECTIVE control: the
+ * suspension is after-the-fact recovery, never prevention.
+ *
+ * TENANT SCOPE is server-owned: the install lookup and suspend are ALWAYS keyed on
+ * `locals.tenant` (middleware-resolved from the request host), never on the
+ * body-supplied `tenant` — a page cannot ask to suspend another tenant's app. The
+ * beacon body carries no secret (the contract rejects one), and the response is a
+ * write-path ack the emitter ignores, so a failed post never breaks the page.
+ */
+import type { APIContext } from "astro";
+import { getRegistryService, json } from "@/lib/apps/adminService.js";
+import type { AppInstall } from "@/lib/apps/registryService.js";
+import { RegistryError } from "@/lib/apps/registryService.js";
+import { planTamperRecovery, type AttributableInstall } from "@tot/public-runtime";
+
+export const prerender = false;
+
+const SYSTEM_ACTOR = "system:tamper-sentinel";
+
+function toAttributable(install: AppInstall): AttributableInstall {
+  return {
+    installId: install.installId,
+    appId: install.appId,
+    appVersion: install.appVersion,
+    status: install.status,
+  };
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const tenantId = context.locals.tenant?.tenant_id;
+  // No resolved tenant ⇒ nothing third-party could be scoped to; accept-and-drop so
+  // the emitter never errors or retries.
+  if (!tenantId) return json({ ok: true, accepted: false }, 202);
+
+  let body: unknown;
+  try {
+    body = await context.request.json();
+  } catch {
+    return json({ ok: false, error: "invalid JSON body" }, 400);
+  }
+
+  // Resolve the tenant's installs (empty when the registry binding isn't configured
+  // in this runtime — the beacon is still validated + recorded, just not actioned).
+  const registry = await getRegistryService();
+  const installs: AttributableInstall[] =
+    registry instanceof Response
+      ? []
+      : (await registry.listByTenant(tenantId)).map(toAttributable);
+
+  const plan = planTamperRecovery(body, installs, {
+    recordId: crypto.randomUUID(),
+    receivedAt: new Date().toISOString(),
+  });
+  if (!plan.ok) return json({ ok: false, error: "invalid tamper beacon" }, 400);
+
+  const { record, suspend } = plan.plan;
+  // Durable, secret-free evidence line for operations. The beacon itself is the record.
+  // eslint-disable-next-line no-console
+  console.warn(
+    `[tamper] tenant=${tenantId} record=${record.recordId} surface=${record.beacon.surface} kind=${record.beacon.kind} recovered=${record.beacon.recovered} app=${record.beacon.attribution?.appId ?? "unattributable"}`,
+  );
+
+  let suspended = false;
+  if (suspend && !(registry instanceof Response)) {
+    try {
+      await registry.suspend(suspend.installId, SYSTEM_ACTOR);
+      suspended = true;
+    } catch (err) {
+      // An already-suspended/uninstalled install (invalid_state) is a benign
+      // no-op under rapid re-mutation; anything else is swallowed so the write
+      // path never errors the emitter. The audit row from a successful suspend is
+      // the durable trail.
+      if (!(err instanceof RegistryError)) {
+        // eslint-disable-next-line no-console
+        console.error(`[tamper] suspend failed for ${suspend.installId}`, err);
+      }
+    }
+  }
+
+  return json({ ok: true, accepted: true, recovered: record.beacon.recovered, suspended }, 202);
+}

package/apps/storefront/src/pages/api/integrations/v1/[operation].ts

@@ -0,0 +1,108 @@
+/** Published managed analytics v1 RPC transport: basePath + client method name. */
+import type { APIContext } from "astro";
+import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
+import { getManagedAnalyticsService, json, requireManageRole } from "@/lib/apps/adminService.js";
+import {
+  validateCreateIntegrationInstallRequest, validateCreateMigrationDraftRequest,
+  validateDeleteIntegrationInstallRequest, validateDeleteMigrationDraftRequest,
+  validateGetAdapterDefinitionRequest, validateGetIntegrationInstallRequest,
+  validateGetIntegrationRevisionRequest, validateGetMigrationDraftRequest,
+  validateListAdapterDefinitionsRequest, validateListIntegrationInstallsRequest,
+  validateListIntegrationRevisionsRequest, validateReviseIntegrationInstallRequest,
+  validateSetIntegrationInstallStatusRequest, validateUpdateMigrationDraftRequest,
+  type CreateIntegrationInstallRequest, type CreateMigrationDraftRequest,
+  type DeleteIntegrationInstallRequest, type DeleteMigrationDraftRequest,
+  type GetAdapterDefinitionRequest, type GetIntegrationInstallRequest,
+  type GetIntegrationRevisionRequest, type GetMigrationDraftRequest,
+  type ListAdapterDefinitionsRequest, type ListIntegrationInstallsRequest,
+  type ListIntegrationRevisionsRequest, type ReviseIntegrationInstallRequest,
+  type SetIntegrationInstallStatusRequest, type UpdateMigrationDraftRequest,
+} from "@tot/public-runtime";
+import { MANAGED_ANALYTICS_READ_OPERATIONS, managedAnalyticsOpaqueId, sanitizeManagedAnalyticsOutbound, type ManagedAnalyticsOperation } from "@/lib/apps/managedAnalyticsService.js";
+
+export const prerender = false;
+type Validator = (input: unknown) => { ok: true; value: unknown } | { ok: false; violations: Array<{ path: string; code: string; message: string }> };
+
+// Null-prototype + own-property lookup: `constructor`/prototype names can never
+// enter dispatch, even if a runtime supplies them as a dynamic path segment.
+const VALIDATORS: Readonly<Record<string, Validator>> = Object.assign(Object.create(null) as Record<string, Validator>, {
+  listAdapterDefinitions: validateListAdapterDefinitionsRequest,
+  getAdapterDefinition: validateGetAdapterDefinitionRequest,
+  listIntegrationInstalls: validateListIntegrationInstallsRequest,
+  getIntegrationInstall: validateGetIntegrationInstallRequest,
+  listIntegrationRevisions: validateListIntegrationRevisionsRequest,
+  getIntegrationRevision: validateGetIntegrationRevisionRequest,
+  getMigrationDraft: validateGetMigrationDraftRequest,
+  createMigrationDraft: validateCreateMigrationDraftRequest,
+  updateMigrationDraft: validateUpdateMigrationDraftRequest,
+  deleteMigrationDraft: validateDeleteMigrationDraftRequest,
+  createIntegrationInstall: validateCreateIntegrationInstallRequest,
+  reviseIntegrationInstall: validateReviseIntegrationInstallRequest,
+  setIntegrationInstallStatus: validateSetIntegrationInstallStatusRequest,
+  deleteIntegrationInstall: validateDeleteIntegrationInstallRequest,
+});
+
+const STATUS: Record<string, number> = {
+  invalid_request: 400, unauthorized: 401, forbidden: 403, not_found: 404,
+  validation_failed: 422, unsupported_version: 400, stale_revision: 409,
+  idempotency_conflict: 409, adapter_deprecated: 409, conflict: 409,
+  internal_error: 500,
+};
+function response(body: unknown): Response {
+  const code = body && typeof body === "object" && "error" in body
+    ? (body as { error?: { code?: string } }).error?.code : undefined;
+  return json(body, code ? STATUS[code] ?? 500 : 200);
+}
+function routeError(code: string, message: string, details?: Array<{ path: string; code: string; message: string }>): Response {
+  return response({ apiVersion: "v1", requestId: managedAnalyticsOpaqueId("req"), error: { code, message, ...(details?.length ? { details } : {}) } });
+}
+function operationResponse(operation: ManagedAnalyticsOperation, body: unknown): Response {
+  const safe = sanitizeManagedAnalyticsOutbound(operation, body);
+  return safe === null ? routeError("internal_error", "The integration service could not complete the request.") : response(safe);
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  try {
+    const operation = context.params.operation;
+    if (!operation || !Object.prototype.hasOwnProperty.call(VALIDATORS, operation)) {
+      return routeError("invalid_request", "Unknown managed analytics v1 operation.");
+    }
+    const op = operation as ManagedAnalyticsOperation;
+    const url = new URL(context.request.url);
+    const auth = await resolveOperatorSession(context, url.searchParams.get("tenant"));
+    if (!auth.ok) return routeError(auth.status === 401 ? "unauthorized" : "forbidden", "The request is not authorized.");
+    if (!MANAGED_ANALYTICS_READ_OPERATIONS.has(op) && requireManageRole(auth)) {
+      return routeError("forbidden", "The request is not authorized.");
+    }
+    let raw: unknown;
+    try { raw = await context.request.json(); }
+    catch { return routeError("invalid_request", "The request body must be valid JSON."); }
+    const parsed = VALIDATORS[operation]!(raw);
+    if (!parsed.ok) {
+      const unsupportedVersion = parsed.violations.some(({ path, code }) => path === "apiVersion" && code === "unsupported_value");
+      return routeError(unsupportedVersion ? "unsupported_version" : "invalid_request", unsupportedVersion ? "The API version is not supported." : "The request failed validation.", parsed.violations);
+    }
+    const service = await getManagedAnalyticsService();
+    if (service instanceof Response) return routeError("internal_error", "The integration service is unavailable.");
+    const ctx = { tenantId: auth.tenantId, actor: auth.actor };
+    const request = parsed.value;
+    switch (op) {
+      case "listAdapterDefinitions": return operationResponse(op, service.listAdapterDefinitions(request as ListAdapterDefinitionsRequest));
+      case "getAdapterDefinition": return operationResponse(op, service.getAdapterDefinition((request as GetAdapterDefinitionRequest).query.adapterId));
+      case "listIntegrationInstalls": return operationResponse(op, await service.listIntegrationInstalls(ctx, request as ListIntegrationInstallsRequest));
+      case "getIntegrationInstall": return operationResponse(op, await service.getIntegrationInstall(ctx, (request as GetIntegrationInstallRequest).query.installId));
+      case "listIntegrationRevisions": { const value = request as ListIntegrationRevisionsRequest; return operationResponse(op, await service.listIntegrationRevisions(ctx, value.query.installId, value.query)); }
+      case "getIntegrationRevision": { const value = request as GetIntegrationRevisionRequest; return operationResponse(op, await service.getIntegrationRevision(ctx, value.query.installId, value.query.revisionId)); }
+      case "getMigrationDraft": return operationResponse(op, await service.getMigrationDraft(ctx, (request as GetMigrationDraftRequest).query.draftId));
+      case "createMigrationDraft": return operationResponse(op, await service.createMigrationDraft(ctx, request as CreateMigrationDraftRequest));
+      case "updateMigrationDraft": return operationResponse(op, await service.updateMigrationDraft(ctx, request as UpdateMigrationDraftRequest));
+      case "deleteMigrationDraft": return operationResponse(op, await service.deleteMigrationDraft(ctx, request as DeleteMigrationDraftRequest));
+      case "createIntegrationInstall": return operationResponse(op, await service.createIntegrationInstall(ctx, request as CreateIntegrationInstallRequest));
+      case "reviseIntegrationInstall": return operationResponse(op, await service.reviseIntegrationInstall(ctx, request as ReviseIntegrationInstallRequest));
+      case "setIntegrationInstallStatus": return operationResponse(op, await service.setIntegrationInstallStatus(ctx, request as SetIntegrationInstallStatusRequest));
+      case "deleteIntegrationInstall": return operationResponse(op, await service.deleteIntegrationInstall(ctx, request as DeleteIntegrationInstallRequest));
+    }
+  } catch {
+    return routeError("internal_error", "The integration service could not complete the request.");
+  }
+}

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -60,8 +60,7 @@ export const POST: APIRoute = async (context) => {
         const kv = tenantId ? await readKv("TENANT_CACHE") : undefined;
         if (tenantId && kv) {
           const cfContext =
-            (context.locals as { runtime?: { ctx?: CfExecutionContextLike } })?.runtime?.ctx ??
-            null;
+            (context.locals as { cfContext?: CfExecutionContextLike })?.cfContext ?? null;
           runAfterResponse(recordBlogView(kv, tenantId, sample.path), cfContext);
         }
       }

package/apps/storefront/src/pages/blog/[slug].astro

@@ -11,11 +11,11 @@ import { buildAlternates } from "@/lib/seo/alternates.js";
 import { languageLabel } from "@/lib/i18n.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/jsonld.js";
 
-const { tenant, canonicalBase, basePath } = Astro.locals;
+const { tenant, canonicalBase, basePath, content } = Astro.locals;
 const slug = Astro.params.slug ?? "";
-const post = await getBlogPost(tenant.tenant_id, slug);
+const post = await getBlogPost(tenant.tenant_id, slug, content);
 if (!post) {
-  const redirect = await resolveBlogRedirect(tenant.tenant_id, slug);
+  const redirect = await resolveBlogRedirect(tenant.tenant_id, slug, content);
   if (redirect) return Astro.redirect(`${basePath}/blog/${redirect}/`, 301);
   return new Response(null, { status: 404 });
 }
@@ -38,7 +38,7 @@ const canonical = new URL(`/blog/${post.slug}/`, canonicalBase + "/").toString()
 // (the invariant `blog/author/[author].astro` documents). Same slug + same source
 // the archive itself filters on, so the two can't disagree.
 const authorArchiveSlug = authorSlug(post.author);
-const authorHasArchive = (await listBlogPosts(tenant.tenant_id)).some(
+const authorHasArchive = (await listBlogPosts(tenant.tenant_id, content)).some(
   (p) => authorSlug(p.author) === authorArchiveSlug,
 );
 const authorUrl = authorHasArchive
@@ -63,7 +63,7 @@ const authorHref = authorHasArchive
 // I2 — hreflang alternates + per-variant <html lang>. Singleton ⇒ [] alternates
 // and no `lang` override, so a non-translated post is byte-identical to today.
 const translations = post.translationGroupId
-  ? await getTranslations(tenant.tenant_id, "blog", post.slug)
+  ? await getTranslations(tenant.tenant_id, "blog", post.slug, { content })
   : [];
 const alternates = buildAlternates(translations, (s) =>
   new URL(`/blog/${s}/`, canonicalBase + "/").toString(),

package/apps/storefront/src/pages/blog/author/[author].astro

@@ -8,15 +8,15 @@ import { breadcrumbLd } from "@/lib/jsonld.js";
 // Author archive for the `/blog` collection. Lists exactly the posts whose
 // bylines link here (same source as /blog/index.astro + /blog/[slug].astro),
 // so a byline never points at a page missing its post.
-const { tenant, basePath, canonicalBase } = Astro.locals;
+const { tenant, basePath, canonicalBase, content } = Astro.locals;
 const slug = Astro.params.author ?? "";
 
-const allPosts = await listBlogPosts(tenant.tenant_id);
+const allPosts = await listBlogPosts(tenant.tenant_id, content);
 const posts = allPosts.filter((post) => authorSlug(post.author) === slug);
 if (posts.length === 0) return new Response(null, { status: 404 });
 
 const authorName = posts[0]!.author;
-const bio = (await getAuthors(tenant.tenant_id, "blog"))[slug];
+const bio = (await getAuthors(tenant.tenant_id, "blog", content))[slug];
 
 const href = (path: string) => `${basePath}${path}` || "/";
 const canonical = new URL(`/blog/author/${slug}/`, canonicalBase + "/").toString();

package/apps/storefront/src/pages/blog/category/[category].astro

@@ -5,12 +5,12 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase } = Astro.locals;
+const { tenant, basePath, canonicalBase, content } = Astro.locals;
 const param = Astro.params.category ?? "";
 
 // Same source as the /blog index (the collection's curated list), filtered to
 // one category — so a post can never appear here that isn't already live on /blog.
-const all = await listBlogPosts(tenant.tenant_id);
+const all = await listBlogPosts(tenant.tenant_id, content);
 const match = collectPostsByTerm(all, "categories", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;

package/apps/storefront/src/pages/blog/index.astro

@@ -3,8 +3,8 @@ import Layout from "@/layouts/Layout.astro";
 import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
 import { listBlogPosts } from "@/lib/blog/provider.js";
 
-const { tenant, basePath, canonicalBase } = Astro.locals;
-const posts = await listBlogPosts(tenant.tenant_id);
+const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const posts = await listBlogPosts(tenant.tenant_id, content);
 if (posts.length === 0) return new Response(null, { status: 404 });
 
 const href = (path: string) => `${basePath}${path}` || "/";

package/apps/storefront/src/pages/blog/tag/[tag].astro

@@ -5,10 +5,10 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase } = Astro.locals;
+const { tenant, basePath, canonicalBase, content } = Astro.locals;
 const param = Astro.params.tag ?? "";
 
-const all = await listBlogPosts(tenant.tenant_id);
+const all = await listBlogPosts(tenant.tenant_id, content);
 const match = collectPostsByTerm(all, "tags", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;