npm - @tokenoftrust/storefront-runner - Versions diffs - 1.4.2-rc.0 → 2.0.1 - Mend

@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (370) hide show

package/apps/storefront/src/lib/rawMarketingHtml.ts CHANGED Viewed

@@ -15,6 +15,11 @@
  * injection is a deliberate string replace — robust for first-party documents, not a
  * sanitizer. Untrusted vendor HTML must be sandboxed/sanitized instead.
  */
+import {
+  renderIntegrationPhases,
+  type EffectivePlan,
+} from "@tot/public-runtime";
 export { rawHtmlPolicy } from "@tot/public-runtime";
 /**
@@ -64,6 +69,50 @@ export function wrapFragmentInChrome(fragment: string, chromeWrapper: string): s
   return out;
 }
+/**
+ * Insert `snippet` at the very start of the document's `<head>` (or, absent a
+ * head, right after `<html>`, else at the document start) — so the renderer-owned
+ * head phases precede any tenant/app `<script>`/`<style>` in the served document.
+ * A body-only fragment with no wrapper has neither tag, so it is prepended.
+ */
+function injectHeadStart(html: string, snippet: string): string {
+  // `(?:\s[^>]*)?>` matches `<head>` / `<head lang=…>` but NOT `<header>`.
+  const head = /<head(?:\s[^>]*)?>/i.exec(html);
+  if (head) {
+    const at = head.index + head[0].length;
+    return html.slice(0, at) + snippet + html.slice(at);
+  }
+  const htmlTag = /<html(?:\s[^>]*)?>/i.exec(html);
+  if (htmlTag) {
+    const at = htmlTag.index + htmlTag[0].length;
+    return html.slice(0, at) + snippet + html.slice(at);
+  }
+  return snippet + html;
+}
+/**
+ * Insert `snippet` at the very start of `<body>` (the body.start boundary), or —
+ * for a body-only fragment with no `<body>` — at the document start.
+ */
+function injectBodyStart(html: string, snippet: string): string {
+  const body = /<body(?:\s[^>]*)?>/i.exec(html);
+  if (body) {
+    const at = body.index + body[0].length;
+    return html.slice(0, at) + snippet + html.slice(at);
+  }
+  return snippet + html;
+}
+/**
+ * Insert `snippet` immediately before `</body>` (the document.deferred boundary),
+ * or — for a body-only fragment with no `</body>` — at the document end.
+ */
+function injectBodyEnd(html: string, snippet: string): string {
+  const at = html.toLowerCase().lastIndexOf("</body>");
+  if (at >= 0) return html.slice(0, at) + snippet + html.slice(at);
+  return html + snippet;
+}
 /** Stamp `nonce` onto every inline `<style>`/`<script>` so a strict CSP admits them. */
 export function nonceInlineTags(html: string, nonce: string): string {
   return html
@@ -79,7 +128,7 @@ export function nonceInlineTags(html: string, nonce: string): string {
  * must NOT get the tenant prefix:
  *   - `/tenants/…` — per-tenant static assets (logo, favicon, theme/mkt css);
  *   - `/shared/…`  — platform-shipped shared assets (e.g. the shared commerce-chrome
- *     stylesheet, unit F2) that every tenant links.
+ *     stylesheet) that every tenant links.
  * Asset `src="…"` isn't matched at all (href-only).
  */
 export function prefixTenantLinks(html: string, basePath: string): string {
@@ -100,7 +149,19 @@ export function prefixTenantLinks(html: string, basePath: string): string {
  */
 export function rawHtmlResponse(
   html: string,
-  opts: { nonce: string; basePath: string; chromeWrapper?: string | null },
+  opts: {
+    nonce: string;
+    basePath: string;
+    chromeWrapper?: string | null;
+    /**
+     * The resolved effective plan for this request — the raw-mount half of the
+     * "one engine, two mounts" contract (Layout.astro is the other). The SAME
+     * render engine emits the renderer-owned phases into this document, so its
+     * phase markup is byte-identical to Layout's. Required: no render path may
+     * silently omit it. Nonces are stamped per response, never serialized (ADR 0018).
+     */
+    plan: EffectivePlan;
+  },
 ): Response {
   let composed =
     isFullDocument(html) || !opts.chromeWrapper
@@ -130,7 +191,17 @@ export function rawHtmlResponse(
       ? composed.replace("</body>", `${widget}</body>`)
       : `${composed}${widget}`;
   }
-  const doc = prefixTenantLinks(nonceInlineTags(composed, opts.nonce), opts.basePath);
+  // Stamp the page nonce onto the TENANT's inline tags first, then splice the render
+  // engine's phase markup — which already carries the nonce — so the engine bytes are
+  // never double-stamped and match Layout.astro's mount exactly. `opts.nonce` is the
+  // per-response nonce placeholder; the middleware substitutes a fresh nonce at serve
+  // time (ADR 0018), so the same engine output feeds both mounts identically.
+  composed = nonceInlineTags(composed, opts.nonce);
+  const phases = renderIntegrationPhases(opts.plan, opts.nonce);
+  composed = injectHeadStart(composed, phases.head);
+  composed = injectBodyStart(composed, phases.bodyStart);
+  composed = injectBodyEnd(composed, phases.bodyDeferred);
+  const doc = prefixTenantLinks(composed, opts.basePath);
   return new Response(doc, {
     headers: { "content-type": "text/html; charset=utf-8" },
   });

package/apps/storefront/src/lib/seo/alternates.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
- * hreflang alternates for a translated article (I2). Two pure helpers so the
+ * hreflang alternates for a translated article. Two pure helpers so the
  * article route and <Seo> stay thin and the "singleton emits nothing" guard is
  * unit-testable without an Astro render harness.
  */

package/apps/storefront/src/lib/social/notify.ts CHANGED Viewed

@@ -10,13 +10,13 @@ function logDiag(fields: Record<string, unknown>): void {
 }
 /**
- * The S3/S4 SEAM — the single call the go-live hook makes when a blog post
+ * The seam — the single call the go-live hook makes when a blog post
  * transitions INTO a live-visible state (see {@link notifyPostsWentLive}). This
- * unit (S1) ships the HOOK + the at-most-once idempotency key, NOT the network
+ * ships the HOOK + the at-most-once idempotency key, NOT the network
  * last-mile: v1 is a no-op announcement (logs only).
  *
- * S3 (the `SocialPublisher` interface + X adapter) and S4 (per-`(tenant,network)`
- * config + encrypted token store) replace THIS body to compose a per-network
+ * A `SocialPublisher` interface + X adapter, and per-`(tenant,network)`
+ * config + encrypted token store, replace THIS body to compose a per-network
  * payload — title, canonical URL, excerpt, featured image, `categories[0]` →
  * hashtags — and POST it to each configured network's publish API. The signature
  * is deliberately per-POST; per-network fan-out and the per-network idempotency

package/apps/storefront/src/lib/storyblok/content-model.ts CHANGED Viewed

@@ -64,7 +64,7 @@ export interface FeaturedProductsBlock {
 /**
  * Membership "band" on the commerce home — the Guest / Member / Autopilot tier
- * comparison, driven by the platform <TierCards> (F4) widget from tenant data.
+ * comparison, driven by the platform <TierCards> widget from tenant data.
  * The widget owns the illustrative-figures affordance (a tier is an EXAMPLE
  * unless it asserts `real: true`), so a tenant surfaces its membership model on
  * the home page without copying tier-card HTML. The block carries the same
@@ -271,11 +271,11 @@ export interface EditorialPage {
   /**
    * Sanitized HTML body (legacy / raw path). Optional: a page authored with
    * structured {@link ProseSection}s omits it and drives the body from `sections`
-   * instead (spec §F4). The renderer prefers `sections` when present.
+   * instead. The renderer prefers `sections` when present.
    */
   body_html?: string;
   /**
-   * Structured policy/prose body (spec §F4) — headings, paragraphs, lists,
+   * Structured policy/prose body — headings, paragraphs, lists,
    * callouts, a contact block, needs-review flags. When present, the page route
    * renders <ProseSections> from this instead of `set:html(body_html)`, so a
    * tenant drives a full policy page from JSON with no HTML/CSS to copy.
@@ -290,33 +290,7 @@ export interface EditorialPage {
   isPolicy?: boolean;
 }
-export interface SiteNavItem {
-  label: string;
-  href: string;
-  /** Mega-menu children, e.g. collection links grouped under a category. */
-  children?: { label: string; href: string }[];
-}
-export interface SiteChrome {
-  nav: SiteNavItem[];
-  /**
-   * Header conversion buttons (marketing tenants). Rendered in the header's
-   * right cluster in place of the commerce search/saved controls. Commerce
-   * tenants omit this and keep the search + saved affordances.
-   */
-  headerCtas?: MarketingCta[];
-  footer: {
-    columns: { title: string; links: { label: string; href: string }[] }[];
-    social: { label: string; href: string }[];
-    tagline?: string;
-    /** Bottom-bar legal/compliance line (marketing tenants). Plain text. */
-    legal?: string;
-  };
-  announcement?: string;
-  /** Default legal/safety disclaimer HTML (fallback for unknown categories). */
-  disclaimer?: string;
-  /** Per-product-category disclaimer HTML, keyed by product_type (or
-   * compliance.product_category) — the source store renders a different legal
-   * block per type (sub-ohm on salts, battery on devices). */
-  disclaimers?: Record<string, string>;
-}
+// Site chrome (header/footer) is the ONE consolidated schema in
+// lib/chrome/model.ts (`ChromeConfig`) — see that file's header comment for
+// why the old `SiteChrome`/`SiteNavItem` pair that used to live here was
+// retired.

package/apps/storefront/src/lib/storyblok/provider.ts CHANGED Viewed

@@ -17,12 +17,26 @@
 import type {
   EditorialPage,
   HomeContent,
-  SiteChrome,
 } from "./content-model.js";
+import type { ChromeConfig } from "../chrome/model.js";
 import type { CustomizationEnv, KvGet, TenantConfig } from "@tot/public-runtime";
-import { contentArtifactPath, readPublishedArtifact } from "@tot/public-runtime";
+import {
+  contentArtifactPath,
+  listPublishedArtifactPaths,
+  readPublishedArtifact,
+  tenantDirRelative,
+  tenantDirSegment,
+} from "@tot/public-runtime";
 import { renderRawChrome } from "../rawChrome.js";
 import { parseChromeConfig } from "../chrome/parseConfig.js";
+import { parseChromeAssignments } from "../chrome/model.js";
+/** Safe, always-valid fallback when neither the tenant's own chrome.json nor
+ * the default scope's validates — the storefront must always render. */
+const EMPTY_CHROME_CONFIG: ChromeConfig = {
+  header: { variant: "primary", brand: { label: "" }, nav: [] },
+  footer: { variant: "default", columns: [] },
+};
 export interface ContentProvider {
   getHome(): Promise<HomeContent>;
@@ -48,11 +62,21 @@ export interface ContentProvider {
    * spliced in (see lib/rawMarketingHtml.ts). Lets raw pages stop duplicating
    * chrome: chrome lives once here, pages become fragments. File:
    * `content/<tenant>/chrome.html`. Tenant-owned (no cross-tenant fallback).
+   *
+   * `currentPath`, when given, is the tenant-relative request path (e.g. "/"
+   * or "/collections/all") in the same unprefixed form the chrome config's
+   * own nav `href`s are authored in — drives `aria-current="page"` on the
+   * matching primary-nav link when the wrapper is rendered from chrome.json
+   * (rawChrome.ts). Omitted ⇒ no item is marked current.
    */
-  getChromeHtml(): Promise<string | null>;
-  getChrome(): Promise<SiteChrome>;
+  getChromeHtml(currentPath?: string): Promise<string | null>;
+  getChrome(): Promise<ChromeConfig>;
   getPage(slug: string): Promise<EditorialPage | null>;
   listPages(): Promise<EditorialPage[]>;
+  /** Raw tenant-content artifact, relative to `content/`. */
+  readArtifact(relative: string): Promise<string | null>;
+  /** Artifact paths relative to `content/`; null means use a legacy fallback. */
+  listArtifactPaths(prefix?: string): Promise<string[] | null>;
 }
 // ---------------------------------------------------------------------------
@@ -64,30 +88,65 @@ export interface ContentProvider {
 // time; a file missing for a tenant falls back to the default scope, so a
 // partially-adopted tenant still renders. Depth: from src/lib/storyblok/ the
 // repo root is five levels up (storyblok→lib→src→storefront→apps→root).
-const homeGlobs = import.meta.glob<HomeContent>("../../../../../tenants/*/content/home.json", {
+const homeGlobs = import.meta.glob<HomeContent>([
+  "../../../../../tenants/*/content/home.json",
+  "../../../../../tenants/e2e/*/content/home.json",
+], {
   import: "default",
 });
-const chromeGlobs = import.meta.glob<SiteChrome>("../../../../../tenants/*/content/chrome.json", {
+const chromeGlobs = import.meta.glob<unknown>([
+  "../../../../../tenants/*/content/chrome.json",
+  "../../../../../tenants/e2e/*/content/chrome.json",
+], {
   import: "default",
 });
-const pageGlobs = import.meta.glob<EditorialPage>("../../../../../tenants/*/content/pages/*.json", {
+// Per-page header/footer variant overrides for the raw-HTML chrome path (see
+// lib/chrome/assignments.ts). Tenant-owned, no cross-tenant fallback — same
+// convention as chromeGlobs above.
+const chromeAssignmentGlobs = import.meta.glob<unknown>(
+  [
+    "../../../../../tenants/*/content/chrome-assignments.json",
+    "../../../../../tenants/e2e/*/content/chrome-assignments.json",
+  ],
+  { import: "default" },
+);
+const pageGlobs = import.meta.glob<EditorialPage>([
+  "../../../../../tenants/*/content/pages/*.json",
+  "../../../../../tenants/e2e/*/content/pages/*.json",
+], {
   import: "default",
 });
 // Raw self-authored home documents (marketing tenants). `?raw` bundles the file
 // as a string; a tenant with no home.html simply has no entry here.
-const homeHtmlGlobs = import.meta.glob<string>("../../../../../tenants/*/content/home.html", {
+const homeHtmlGlobs = import.meta.glob<string>([
+  "../../../../../tenants/*/content/home.html",
+  "../../../../../tenants/e2e/*/content/home.html",
+], {
   query: "?raw",
   import: "default",
 });
 // Raw self-authored SUBPAGE documents: tenants/<tenant>/content/pages-html/<slug>.html
 // (e.g. pages-html/pricing.html -> /pricing/). `**` supports nested slugs.
-const pageHtmlGlobs = import.meta.glob<string>("../../../../../tenants/*/content/pages-html/**/*.html", {
+const pageHtmlGlobs = import.meta.glob<string>([
+  "../../../../../tenants/*/content/pages-html/**/*.html",
+  "../../../../../tenants/e2e/*/content/pages-html/**/*.html",
+], {
   query: "?raw",
   import: "default",
 });
 // Shared-chrome wrapper document (marketing tenants that author body-only page
 // fragments). One per tenant; a tenant without it keeps serving full documents.
-const chromeHtmlGlobs = import.meta.glob<string>("../../../../../tenants/*/content/chrome.html", {
+const chromeHtmlGlobs = import.meta.glob<string>([
+  "../../../../../tenants/*/content/chrome.html",
+  "../../../../../tenants/e2e/*/content/chrome.html",
+], {
+  query: "?raw",
+  import: "default",
+});
+const artifactGlobs = import.meta.glob<string>([
+  "../../../../../tenants/*/content/**/*",
+  "../../../../../tenants/e2e/*/content/**/*",
+], {
   query: "?raw",
   import: "default",
 });
@@ -98,13 +157,13 @@ function pickContent<T>(
   globs: Record<string, () => Promise<T>>,
   scope: string,
 ): (() => Promise<T>) | null {
-  const seg = `/tenants/${scope}/content/`;
+  const seg = `${tenantDirSegment(scope)}content/`;
   const key = Object.keys(globs).find((k) => k.includes(seg));
   return (key ? globs[key] : null) ?? null;
 }
 function pickPages(scope: string): Array<() => Promise<EditorialPage>> {
-  const seg = `/tenants/${scope}/content/pages/`;
+  const seg = `${tenantDirSegment(scope)}content/pages/`;
   return Object.keys(pageGlobs)
     .filter((k) => k.includes(seg))
     .map((k) => pageGlobs[k]!);
@@ -117,7 +176,7 @@ function normalizeRawPageSlug(slug: string): string {
 /** The subpage slug a glob key encodes for `scope`, or null if it's not one. */
 function rawPageSlugForKey(scope: string, key: string): string | null {
-  const seg = `/tenants/${scope}/content/pages-html/`;
+  const seg = `${tenantDirSegment(scope)}content/pages-html/`;
   const start = key.indexOf(seg);
   if (start < 0 || !key.endsWith(".html")) return null;
   return key.slice(start + seg.length, -".html".length);
@@ -154,7 +213,7 @@ async function readRawDevFile(scope: string, relative: string): Promise<string |
     // provider.ts lives at apps/storefront/src/lib/storyblok/ — the repo root is five
     // levels up, mirroring the import.meta.glob prefix ("../../../../../tenants/...").
     const here = dirname(fileURLToPath(import.meta.url));
-    const abs = resolve(here, "../../../../..", "tenants", scope, "content", relative);
+    const abs = resolve(here, "../../../../..", ...tenantDirRelative(scope).split("/"), "content", relative);
     return await readFile(abs, "utf8");
   } catch {
     return null;
@@ -196,18 +255,22 @@ export class LocalContentProvider implements ContentProvider {
       .sort((a, b) => a.localeCompare(b));
   }
-  async getChromeHtml(): Promise<string | null> {
+  async getChromeHtml(currentPath?: string): Promise<string | null> {
     // (1) A hand-authored chrome.html wins — keeps a not-yet-adopted tenant's chrome
     //     byte-identical (dev: fresh from disk so an edit previews on save).
     const dev = await readRawDevFile(this.scope, "chrome.html");
     if (dev !== null) return dev;
     const loader = pickContent(chromeHtmlGlobs, this.scope);
     if (loader) return loader();
-    // (2) No chrome.html: render the CANONICAL shared chrome (unit F3) from the
-    //     tenant's chrome.json — but only when it opted in (sharedChrome: true).
-    //     Tenant-owned only, like the raw HTML above (no cross-tenant fallback).
+    // (2) No chrome.html: render the CANONICAL shared chrome from the
+    //     tenant's chrome.json — but only when it validates whole against the
+    //     consolidated ChromeConfig schema (lib/chrome/parseConfig.ts). Tenant-
+    //     owned only, like the raw HTML above (no cross-tenant fallback).
     const config = await this.loadChromeConfig();
-    return config ? renderRawChrome(config) : null;
+    if (!config) return null;
+    // Per-page variant override — a page not listed in chrome-assignments.json
+    // keeps chrome.json's default variant. renderRawChrome resolves it.
+    return renderRawChrome(config, currentPath, await this.loadChromeAssignments());
   }
   /** The tenant's parsed raw-chrome config (chrome.json), or null if not adopted. */
@@ -225,31 +288,33 @@ export class LocalContentProvider implements ContentProvider {
     return loader ? parseChromeConfig(await loader()) : null;
   }
-  async getChrome(): Promise<SiteChrome> {
+  /** The tenant's parsed page-assignment manifest (chrome-assignments.json),
+   * or null if absent/invalid — same dev-hot-reload + tenant-owned-only
+   * discipline as loadChromeConfig. */
+  private async loadChromeAssignments(): Promise<ReturnType<typeof parseChromeAssignments>> {
+    const devRaw = await readRawDevFile(this.scope, "chrome-assignments.json");
+    if (devRaw !== null) {
+      try {
+        return parseChromeAssignments(JSON.parse(devRaw));
+      } catch {
+        return null;
+      }
+    }
+    const loader = pickContent(chromeAssignmentGlobs, this.scope);
+    return loader ? parseChromeAssignments(await loader()) : null;
+  }
+  async getChrome(): Promise<ChromeConfig> {
+    // The full config is validated as ONE document now (header/footer are
+    // both required) — there is no more partial-field merge across scopes; a
+    // tenant's own chrome.json either validates whole, or the default scope's
+    // does, or the storefront falls back to an empty-but-valid config.
+    const own = await this.loadChromeConfig();
+    if (own) return own;
+    if (this.scope === DEFAULT_SCOPE) return EMPTY_CHROME_CONFIG;
     const defL = pickContent(chromeGlobs, DEFAULT_SCOPE);
-    const def: SiteChrome = defL
-      ? await defL()
-      : { nav: [], footer: { columns: [], social: [] } };
-    const ownL = pickContent(chromeGlobs, this.scope);
-    if (!ownL) return def;
-    const c = await ownL();
-    if (this.scope === DEFAULT_SCOPE) return c;
-    // Per-field fallback fills only STRUCTURAL scaffolding (nav/footer) so a
-    // partially-adopted tenant still renders. Promotional/identity/legal fields
-    // (announcement, headerCtas, disclaimers) are tenant-OWNED and never inherit
-    // from the default scope — otherwise e.g. a marketing tenant would show the
-    // default store's shipping banner or nicotine disclaimers.
-    return {
-      nav: c.nav?.length ? c.nav : def.nav,
-      footer:
-        c.footer && (c.footer.columns?.length || c.footer.social?.length)
-          ? c.footer
-          : def.footer,
-      headerCtas: c.headerCtas,
-      announcement: c.announcement,
-      disclaimer: c.disclaimer,
-      disclaimers: c.disclaimers,
-    };
+    const def = defL ? parseChromeConfig(await defL()) : null;
+    return def ?? EMPTY_CHROME_CONFIG;
   }
   async getPage(slug: string): Promise<EditorialPage | null> {
@@ -264,6 +329,24 @@ export class LocalContentProvider implements ContentProvider {
     const loaders = pickPages(this.scope);
     return Promise.all(loaders.map((l) => l()));
   }
+  async readArtifact(relative: string): Promise<string | null> {
+    const normalized = relative.replace(/^\/+/, "");
+    const marker = `${tenantDirSegment(this.scope)}content/${normalized}`;
+    const key = Object.keys(artifactGlobs).find((candidate) => candidate.endsWith(marker));
+    return key ? artifactGlobs[key]!() : null;
+  }
+  async listArtifactPaths(prefix = ""): Promise<string[]> {
+    const marker = `${tenantDirSegment(this.scope)}content/`;
+    return Object.keys(artifactGlobs)
+      .flatMap((key) => {
+        const at = key.indexOf(marker);
+        return at < 0 ? [] : [key.slice(at + marker.length)];
+      })
+      .filter((path) => path.startsWith(prefix))
+      .sort((a, b) => a.localeCompare(b));
+  }
 }
 // ---------------------------------------------------------------------------
@@ -405,26 +488,24 @@ export class StoryblokContentProvider implements ContentProvider {
     return this.fallback.listPageHtmlSlugs();
   }
-  getChromeHtml(): Promise<string | null> {
+  getChromeHtml(currentPath?: string): Promise<string | null> {
     // The chrome wrapper lives in tenant content files, not Storyblok — delegate.
-    return this.fallback.getChromeHtml();
+    return this.fallback.getChromeHtml(currentPath);
   }
-  async getChrome(): Promise<SiteChrome> {
-    // Editorial chrome (nav/footer/tagline) is authored in Storyblok; the
-    // announcement + legal disclaimers are MIGRATION-sourced (written to local
-    // chrome.json), so overlay those from the fallback regardless.
+  async getChrome(): Promise<ChromeConfig> {
+    // Editorial chrome (nav/footer) is authored in Storyblok; brand/variant
+    // and everything else stay MIGRATION-sourced (the local chrome.json), so
+    // overlay only nav + footer from Storyblok when present.
     const local = await this.fallback.getChrome();
     try {
       const story = await fetchStory(this.token, "chrome");
       const c = story?.content;
       if (c && Array.isArray(c.nav)) {
         return {
-          nav: c.nav,
-          footer: c.footer ?? local.footer,
-          announcement: local.announcement ?? c.announcement,
-          disclaimer: local.disclaimer,
-          disclaimers: local.disclaimers,
+          ...local,
+          header: { ...local.header, nav: c.nav },
+          footer: c.footer ? { ...local.footer, ...c.footer } : local.footer,
         };
       }
     } catch {
@@ -461,6 +542,14 @@ export class StoryblokContentProvider implements ContentProvider {
     }
     return this.fallback.listPages();
   }
+  readArtifact(relative: string): Promise<string | null> {
+    return this.fallback.readArtifact(relative);
+  }
+  listArtifactPaths(prefix?: string): Promise<string[] | null> {
+    return this.fallback.listArtifactPaths(prefix);
+  }
 }
 // ---------------------------------------------------------------------------
@@ -468,7 +557,8 @@ export class StoryblokContentProvider implements ContentProvider {
 // resolved environment (store->app wiring). For each content artifact it checks
 // the customization store ({live,test} pointer -> versioned JSON); if present it
 // serves that, otherwise it delegates to the base provider (Storyblok/local).
-// listPages() stays from the base (per-page overrides flow through getPage).
+// Enumeration also follows the selected immutable manifest, so sitemap/blog/page
+// indexes do not need a build-time tenant checkout.
 // ---------------------------------------------------------------------------
 export interface ContentCustomization {
@@ -517,34 +607,72 @@ export class PublishedContentProvider implements ContentProvider {
     return (await this.publishedRaw(rel)) ?? this.base.getPageHtml(slug);
   }
   listPageHtmlSlugs(): Promise<string[]> {
-    return this.base.listPageHtmlSlugs();
+    return this.listArtifactPaths("pages-html/").then((paths) =>
+      paths === null
+        ? this.base.listPageHtmlSlugs()
+        : paths
+            .filter((path) => path.endsWith(".html"))
+            .map((path) => path.slice("pages-html/".length, -".html".length)),
+    );
   }
-  async getChromeHtml(): Promise<string | null> {
+  async getChromeHtml(currentPath?: string): Promise<string | null> {
     // A published raw chrome.html override (parallels the home.html/pages-html
     // publish path) wins, so a vendor edit previews / goes live with no rebuild.
     const publishedHtml = await this.publishedRaw("chrome.html");
     if (publishedHtml) return publishedHtml;
-    // Else, if the PUBLISHED chrome.json opts into shared chrome (unit F3), render
+    // Else, if the PUBLISHED chrome.json opts into shared chrome, render
     // the canonical wrapper from it — so a config edit previews without a rebuild.
     const config = parseChromeConfig(await this.published<unknown>("chrome.json"));
-    if (config) return renderRawChrome(config);
+    if (config) {
+      // Per-page variant override, resolved against the PUBLISHED assignment
+      // manifest (mirrors chrome.json itself — each source resolves fully
+      // within itself, no mixing published/base artifacts).
+      const assignments = parseChromeAssignments(await this.published<unknown>("chrome-assignments.json"));
+      return renderRawChrome(config, currentPath, assignments);
+    }
     // Otherwise fall back to the base chain (bundled chrome.html or config render).
-    return this.base.getChromeHtml();
+    return this.base.getChromeHtml(currentPath);
   }
-  async getChrome(): Promise<SiteChrome> {
-    return (await this.published<SiteChrome>("chrome.json")) ?? this.base.getChrome();
+  async getChrome(): Promise<ChromeConfig> {
+    // Runs through the SAME fail-closed schema validator as getChromeHtml's
+    // chrome.json branch (lib/chrome/parseConfig.ts) — a published artifact is
+    // no longer trusted blind (was: JSON.parse + a raw cast to SiteChrome).
+    const config = parseChromeConfig(await this.published<unknown>("chrome.json"));
+    return config ?? this.base.getChrome();
   }
   async getPage(slug: string): Promise<EditorialPage | null> {
     return (await this.published<EditorialPage>(`pages/${slug}.json`)) ?? this.base.getPage(slug);
   }
-  listPages(): Promise<EditorialPage[]> {
-    return this.base.listPages();
+  async listPages(): Promise<EditorialPage[]> {
+    const paths = await this.listArtifactPaths("pages/");
+    if (paths === null) return this.base.listPages();
+    const pages = await Promise.all(
+      paths
+        .filter((path) => path.endsWith(".json"))
+        .map(async (path) => this.published<EditorialPage>(path)),
+    );
+    return pages.filter((page): page is EditorialPage => page !== null);
+  }
+  readArtifact(relative: string): Promise<string | null> {
+    return this.publishedRaw(relative);
+  }
+  async listArtifactPaths(prefix = ""): Promise<string[] | null> {
+    const root = contentArtifactPath(this.tenantId, "");
+    const paths = await listPublishedArtifactPaths(
+      this.cust.get,
+      this.tenantId,
+      this.cust.env,
+      `${root}${prefix}`,
+    );
+    return paths?.map((path) => path.slice(root.length)) ?? null;
   }
 }
 // ---------------------------------------------------------------------------
-// DevDraftContentProvider — the per-developer DRAFT overlay (decision
-// draft-overlay-same-origin). Wraps the resolved provider chain and serves a
+// DevDraftContentProvider — the per-developer DRAFT overlay. Wraps the
+// resolved provider chain and serves a
 // draft artifact (written by /api/content-edit/ai-edit into TENANT_CACHE under
 // `dev-draft:<tenantId>:<draftId>:<path>`) when one exists, else delegates.
 // The middleware constructs this ONLY for a request whose signed tot_dev_draft
@@ -581,10 +709,10 @@ export class DevDraftContentProvider implements ContentProvider {
   listPageHtmlSlugs(): Promise<string[]> {
     return this.base.listPageHtmlSlugs();
   }
-  getChromeHtml(): Promise<string | null> {
-    return this.base.getChromeHtml();
+  getChromeHtml(currentPath?: string): Promise<string | null> {
+    return this.base.getChromeHtml(currentPath);
   }
-  getChrome(): Promise<SiteChrome> {
+  getChrome(): Promise<ChromeConfig> {
     return this.base.getChrome();
   }
   getPage(slug: string): Promise<EditorialPage | null> {
@@ -593,6 +721,12 @@ export class DevDraftContentProvider implements ContentProvider {
   listPages(): Promise<EditorialPage[]> {
     return this.base.listPages();
   }
+  readArtifact(relative: string): Promise<string | null> {
+    return this.base.readArtifact(relative);
+  }
+  listArtifactPaths(prefix?: string): Promise<string[] | null> {
+    return this.base.listArtifactPaths(prefix);
+  }
 }
 const PLACEHOLDER_TOKEN_RE = /PLACEHOLDER|^$/i;