@tokenoftrust/storefront-runner 2.0.16 → 2.0.18

package/apps/storefront/src/components/islands/checkoutVerificationFlow.ts

@@ -0,0 +1,251 @@
+/**
+ * Live-provider checkout verification flow — the CLIENT half of the
+ * `/api/compliance/preflight` contract.
+ *
+ * On a tenant wired to the real Token of Trust verification provider, preflight
+ * echoes a `verification` meta block alongside the decision: the correlation ref
+ * for this checkout attempt, the provider's status, and (for an interactive step)
+ * the continuation URL the shopper completes verification at. Sandbox and
+ * no-provider tenants never get that block, so its PRESENCE is the live-provider
+ * tell and the only thing that branches the checkout dialog into the live flow.
+ *
+ * Everything here is pure or dependency-injected so the state machine is unit
+ * tested directly (the storefront's vitest run is node-only by design — see
+ * `vitest.config.ts`; render logic lives in components, decisions live here).
+ *
+ * Fail-closed by construction:
+ *   - an unreadable/malformed preflight body parses to `null`, never to a pass;
+ *   - the ONLY thing that releases checkout is the server's own
+ *     `decision.status === "clear"` — this module never infers a pass from a
+ *     provider status, an affirmation, or a client-side timer;
+ *   - a transport error, a malformed poll response, or the poll deadline stops
+ *     the flow and surfaces a paused state.
+ */
+import type { CartComplianceDecision } from "@tot/public-runtime";
+
+/** Provider status vocabulary echoed by `/api/compliance/preflight`. */
+export type LiveVerificationStatus =
+  | "cleared"
+  | "rejected"
+  | "pending"
+  | "not_started"
+  | "conditions_met"
+  | "interactive";
+
+const LIVE_STATUSES: ReadonlySet<string> = new Set<LiveVerificationStatus>([
+  "cleared",
+  "rejected",
+  "pending",
+  "not_started",
+  "conditions_met",
+  "interactive",
+]);
+
+/** The live-provider meta block. Informational — the DECISION is `decision`. */
+export interface LiveVerificationMeta {
+  ref?: string;
+  status?: LiveVerificationStatus;
+  continuationUrl?: string;
+}
+
+export interface PreflightResponse {
+  decision: CartComplianceDecision;
+  /** Present only on the live-provider path; `null` on sandbox / no provider. */
+  verification: LiveVerificationMeta | null;
+}
+
+/**
+ * Where the shopper is in the live verification trip. `"none"` is the
+ * sandbox/no-provider path — the dialog then behaves EXACTLY as it did before
+ * this flow existed.
+ */
+export type VerificationPhase =
+  | "none"
+  | "collect"
+  | "continue"
+  | "waiting"
+  | "denied"
+  | "cleared";
+
+const DECISION_STATUSES: ReadonlySet<string> = new Set([
+  "clear",
+  "action_required",
+  "blocked",
+]);
+
+const AGE_STATUSES: ReadonlySet<string> = new Set([
+  "satisfied",
+  "required",
+  "blocked",
+  "not_required",
+]);
+
+/** Read the `verification` meta fail-closed. Returns `null` when absent/unusable. */
+export function parseVerificationMeta(raw: unknown): LiveVerificationMeta | null {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw as Record<string, unknown>;
+  const meta: LiveVerificationMeta = {};
+  if (typeof r.ref === "string" && r.ref.trim()) meta.ref = r.ref.trim();
+  if (typeof r.status === "string" && LIVE_STATUSES.has(r.status)) {
+    meta.status = r.status as LiveVerificationStatus;
+  }
+  if (typeof r.continuationUrl === "string" && r.continuationUrl.trim()) {
+    meta.continuationUrl = r.continuationUrl.trim();
+  }
+  // An empty-but-present block still means "live provider" — that is the tell.
+  return meta;
+}
+
+function isDecision(raw: unknown): raw is CartComplianceDecision {
+  if (!raw || typeof raw !== "object") return false;
+  const d = raw as Record<string, unknown>;
+  if (typeof d.status !== "string" || !DECISION_STATUSES.has(d.status)) return false;
+  if (!Array.isArray(d.blocks)) return false;
+  const req = d.requirements as Record<string, unknown> | undefined;
+  if (!req || typeof req !== "object") return false;
+  return typeof req.ageVerification === "string" && AGE_STATUSES.has(req.ageVerification);
+}
+
+/**
+ * Parse a preflight body. `null` for ANY shape we cannot fully read — the caller
+ * treats that exactly like a transport failure and does not proceed.
+ */
+export function parsePreflightResponse(raw: unknown): PreflightResponse | null {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw as Record<string, unknown>;
+  if (!isDecision(r.decision)) return null;
+  return {
+    decision: r.decision,
+    verification: "verification" in r ? parseVerificationMeta(r.verification) : null,
+  };
+}
+
+/** True when the decision carries the provider's real "did not pass" block. */
+function hasVerificationFailure(decision: CartComplianceDecision): boolean {
+  return decision.blocks.some(
+    (b) => b.code === "verification_failed" && b.failedClosed !== true,
+  );
+}
+
+/**
+ * Where a preflight result leaves the shopper. Pure.
+ *
+ * No `verification` block → `"none"`: the sandbox / no-provider path, whose UI
+ * must stay byte-for-byte what it was.
+ */
+export function verificationPhase(res: PreflightResponse): VerificationPhase {
+  const v = res.verification;
+  if (!v) return "none";
+  if (v.status === "rejected" || hasVerificationFailure(res.decision)) return "denied";
+  if (res.decision.status === "clear") return "cleared";
+  if (res.decision.requirements.ageVerification === "satisfied") return "cleared";
+  if (v.status === "interactive" && v.continuationUrl) return "continue";
+  if (v.status === "pending" || v.status === "conditions_met" || v.status === "cleared") {
+    return "waiting";
+  }
+  // "not_started", or nothing started at all: we still need shopper details to
+  // START a verification. A stale ref with no provider record starts over.
+  return "collect";
+}
+
+// --- Polling -----------------------------------------------------------------
+
+/** Re-read cadence while the shopper completes verification on their own device. */
+export const POLL_INTERVAL_MS = 4_000;
+/** Hard ceiling on a single wait. Never poll forever. */
+export const POLL_TIMEOUT_MS = 4 * 60_000;
+
+export type PollOutcome =
+  | { kind: "cleared"; response: PreflightResponse }
+  | { kind: "denied"; response: PreflightResponse }
+  | { kind: "halted"; response: PreflightResponse }
+  | { kind: "error" }
+  | { kind: "timeout" }
+  | { kind: "cancelled" };
+
+export interface PollDeps {
+  /** Re-POST preflight with the persisted ref. `null` = unusable result. */
+  poll: () => Promise<PreflightResponse | null>;
+  sleep: (ms: number) => Promise<void>;
+  now: () => number;
+  cancelled?: () => boolean;
+  intervalMs?: number;
+  timeoutMs?: number;
+}
+
+/**
+ * Re-read the server's decision until it resolves. The client NEVER decides the
+ * shopper passed — it only relays `decision.status === "clear"`.
+ *
+ * Stops on: cleared, denied, any other resolved/blocked decision, an unusable
+ * response (fail closed), cancellation, or the deadline.
+ */
+export async function pollVerification(deps: PollDeps): Promise<PollOutcome> {
+  const intervalMs = deps.intervalMs ?? POLL_INTERVAL_MS;
+  const timeoutMs = deps.timeoutMs ?? POLL_TIMEOUT_MS;
+  const startedAt = deps.now();
+
+  for (;;) {
+    if (deps.cancelled?.()) return { kind: "cancelled" };
+    await deps.sleep(intervalMs);
+    if (deps.cancelled?.()) return { kind: "cancelled" };
+
+    let res: PreflightResponse | null;
+    try {
+      res = await deps.poll();
+    } catch {
+      return { kind: "error" };
+    }
+    if (!res) return { kind: "error" };
+
+    const phase = verificationPhase(res);
+    if (phase === "denied") return { kind: "denied", response: res };
+    if (res.decision.status === "clear") return { kind: "cleared", response: res };
+    // Verification itself is settled (or the cart is blocked for another reason)
+    // but checkout still isn't clear — nothing more polling can change.
+    if (phase === "cleared" || res.decision.status === "blocked") {
+      return { kind: "halted", response: res };
+    }
+    if (deps.now() - startedAt >= timeoutMs) return { kind: "timeout" };
+  }
+}
+
+// --- Ref persistence ---------------------------------------------------------
+
+/**
+ * sessionStorage key for a checkout attempt's verification ref, so a reload
+ * during the verification trip keeps the correlation. Scoped by the preflight
+ * URL (tenant/base path) and the exact cart line, so refs never cross carts.
+ */
+export function verificationRefKey(
+  preflightUrl: string,
+  line: { handle: string; sku?: string; variantId?: string },
+): string {
+  const variant = line.variantId ?? line.sku ?? "";
+  return `tot:verify-ref:${preflightUrl}:${line.handle}:${variant}`;
+}
+
+export function readStoredRef(key: string): string | null {
+  try {
+    const v = sessionStorage.getItem(key);
+    return v && v.trim() ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+export function writeStoredRef(key: string, ref: string): void {
+  try {
+    sessionStorage.setItem(key, ref);
+  } catch {
+    /* storage disabled — the flow still works, it just can't survive a reload */
+  }
+}
+
+export function clearStoredRef(key: string): void {
+  try {
+    sessionStorage.removeItem(key);
+  } catch {
+    /* storage disabled */
+  }
+}

package/apps/storefront/src/config/compliance/rulesets.ts

@@ -1,9 +1,13 @@
 /**
- * Per-tenant compliance RULE DATA — the data-driven substance the enforcement
+ * Compliance RULE DATA by PROFILE — the data-driven substance the enforcement
  * engine (`@tot/public-runtime` compliance) evaluates. Keeping the rules here as
  * DATA (not `if` branches in code) is the whole point: a jurisdiction change is a
  * data edit reviewed against the ruleset shape, not a code change.
  *
+ * A tenant selects a profile via `compliance.ruleProfile`; this file never names
+ * tenants. Onboarding a regulated merchant is therefore a declaration in that
+ * merchant's own tenant config, not an edit here.
+ *
  * ⚠️ LEGAL PROVENANCE: the state rules below are a REPRESENTATIVE starter set for
  * the pilot vape tenants, not legal advice and not a guaranteed-current list. The
  * authoritative flavor-ban / no-ship / per-order-limit / excise data and the PACT
@@ -16,7 +20,7 @@
  * A regulated tenant with no provider configured FAILS CLOSED (checkout blocks,
  * evidence is not promotable), which is the correct safe default.
  */
-import type { ComplianceRuleset } from "@tot/public-runtime";
+import type { ComplianceRuleset, ComplianceRuleProfile } from "@tot/public-runtime";
 
 /**
  * Shared vape/ENDS rule template. `tenantId` is filled per tenant. The state list
@@ -71,9 +75,16 @@ function vapeRuleset(tenantId: string): ComplianceRuleset {
   };
 }
 
-/** Ruleset data keyed by tenant_id. Regulated tenants MUST have an entry. */
-export const COMPLIANCE_RULESETS: Record<string, ComplianceRuleset> = {
-  "sample-store.com": vapeRuleset("sample-store.com"),
-  "sample-store-2.net": vapeRuleset("sample-store-2.net"),
-  "sample-store-3.com": vapeRuleset("sample-store-3.com"),
+/**
+ * Rule data keyed by the PROFILE a tenant declares (`compliance.ruleProfile`),
+ * never by which tenant it is. Any tenant declaring a profile gets that profile's
+ * rules; a tenant declaring none resolves to no ruleset and fails closed. Onboarding
+ * a regulated merchant is a declaration in that tenant's own config, not an edit
+ * here — this file holds only the reviewed rule bodies.
+ */
+export const COMPLIANCE_RULE_PROFILES: Record<
+  ComplianceRuleProfile,
+  (tenantId: string) => ComplianceRuleset
+> = {
+  "vape-nicotine-us": vapeRuleset,
 };

package/apps/storefront/src/config/devTenantSeed.ts

@@ -23,6 +23,8 @@
  * tenancy-resolver-fence — the concrete registry stays behind the config boundary.
  */
 import type { DeepPartial, TenantConfig, ThemeTokens } from "@tot/public-runtime";
+import { rootPublicationSpaceConfig } from "./publicationSpaceConfig";
+import { loadTenantAnalyticsDeclarations } from "@/lib/integration/tenantAnalyticsDeclarations";
 
 /** Per-dir overrides the resolver derives from disk before synthesis. */
 export interface DevTenantHints {
@@ -40,6 +42,13 @@ export interface DevTenantHints {
    * render from them; when false we degrade to a marketing home (no catalog).
    */
   hasCatalog?: boolean;
+  /**
+   * The tenant's own `tenants/<id>/analytics.json` content (already-parsed JSON),
+   * or undefined when the tenant declares none. Materialized into `integrations`
+   * fail-closed, so a developer self-serves a reviewed measurement destination from
+   * their OWN tree — the TIER 1 tenant-owned analytics surface — with no platform edit.
+   */
+  analyticsRaw?: unknown;
 }
 
 /**
@@ -59,6 +68,9 @@ export function synthesizeDevTenant(
 ): TenantConfig {
   // Prefer the .tot/config.json scope for a slug tenant; else colocation.
   const appDomain = hints.appDomain ?? id;
+  // The tenant's OWN tree analytics.json → the render plane's declaration seam,
+  // fail-closed (a missing/invalid file yields no declarations, never a throw).
+  const integrations = loadTenantAnalyticsDeclarations(hints.analyticsRaw, id);
   const base: TenantConfig = {
     tenant_id: id,
     appDomain,
@@ -72,6 +84,14 @@ export function synthesizeDevTenant(
     currency: "USD",
     locale: "en-US",
     theme_tokens: themeTokens,
+    publicationSpaces: [rootPublicationSpaceConfig(id, {
+      forge: "fixture",
+      repo: id,
+      defaultBranch: "main",
+    })],
+    // Only set when the tenant actually declared one — an undeclared tenant keeps
+    // `integrations` absent, so its resolved plan is byte-identical to before.
+    ...(integrations.length > 0 ? { integrations } : {}),
   };
   if (hints.hasCatalog) {
     // Catalog fixtures on disk → a real commerce tenant (siteType omitted ==
@@ -94,6 +114,8 @@ export interface DevTenantSeedOptions {
   scopeFor?: (id: string) => string | undefined;
   /** Whether catalog fixtures are committed on disk for a given data scope. */
   hasCatalog?: (scope: string) => boolean;
+  /** The tenant's parsed `tenants/<id>/analytics.json`, or undefined when it has none. */
+  analyticsFor?: (id: string) => unknown;
 }
 
 /**
@@ -121,7 +143,8 @@ export function devTenantsToSeed(
     const appDomain = opts.scopeFor?.(id);
     const scope = appDomain ?? id;
     const hasCatalog = opts.hasCatalog?.(scope) ?? false;
-    out.push(synthesizeDevTenant(id, themeFor(id), { appDomain, hasCatalog }));
+    const analyticsRaw = opts.analyticsFor?.(id);
+    out.push(synthesizeDevTenant(id, themeFor(id), { appDomain, hasCatalog, analyticsRaw }));
   }
   return out;
 }

package/apps/storefront/src/config/evidenceTenantRoster.ts

@@ -0,0 +1,25 @@
+/**
+ * The evidence-URL tenant roster, derived from the live tenant registry.
+ *
+ * Lives in `src/config` (not a `pages`/`lib` file) so it — not the `.well-known` route — is the
+ * one place allowed to import the concrete `staticTenants` map (`tenancy-resolver-fence`:
+ * pages/components/layouts/lib may depend only on the `TenantResolver` interface, never the
+ * concrete static map, so a constant single-tenant resolver stays a drop-in).
+ */
+import { listedTenants } from "@tot/public-runtime";
+import { staticTenants } from "@/config/tenants";
+
+/**
+ * Tenant id -> canonical domain for every real, registered tenant. For a real tenant
+ * `tenant_id === appDomain === canonicalDomain` (see `config/tenants.ts`), so onboarding a
+ * tenant in the registry is enough to publish its evidence URL — no separate hand-maintained
+ * map to update. Internal/e2e test tenants are excluded (never real merchants, never a real
+ * evidence surface).
+ */
+export function evidenceRegistryRoster(): Record<string, string> {
+  const roster: Record<string, string> = {};
+  for (const tenant of listedTenants(staticTenants)) {
+    roster[tenant.tenant_id] = tenant.canonicalDomain;
+  }
+  return roster;
+}

package/apps/storefront/src/config/publicationSpaceConfig.ts

@@ -0,0 +1,25 @@
+import type {
+  PublicationSpaceManifestV1,
+  PublicationSpaceSourceV1,
+} from "@tot/public-runtime";
+
+export function rootPublicationSpaceConfig(
+  tenant: string,
+  source: PublicationSpaceSourceV1,
+): PublicationSpaceManifestV1 {
+  return {
+    version: 1,
+    id: "root",
+    tenant,
+    source,
+    routes: { canonicalMount: "/" },
+    visibility: "public",
+    authorization: { policy: "public" },
+    discovery: { sitemap: true, feeds: true, publicSearch: true, llms: true },
+    assets: { namespace: "root", access: "public" },
+    renderer: {
+      contractVersion: "storefront-v1",
+      themeContractVersion: "tenant-theme-v1",
+    },
+  };
+}

package/apps/storefront/src/config/resolver.ts

@@ -30,6 +30,7 @@ import {
 import { KvTenantResolver, putTenant } from "@/config/kvTenantResolver";
 import { getTenantTheme } from "@/themes/tenants";
 import { devTenantsToSeed } from "@/config/devTenantSeed";
+import { tenantAnalyticsRawById } from "@/config/tenantAnalyticsFiles";
 import { MemoryKv } from "@/lib/memoryKv";
 
 // LOCAL dev loop discovery: enumerate the colocated tenant dirs on disk,
@@ -120,9 +121,13 @@ function devFallbackResolver(): TenantResolver {
   const staticIds = new Set(staticTenants.map((t) => t.tenant_id));
   const withCatalog = catalogScopes();
   const scopes = slugScopes();
+  // The SAME tenant-owned analytics read the static registry uses; here it serves only
+  // the tenants that have NO registry entry (see config/tenantAnalyticsFiles.ts).
+  const analytics = tenantAnalyticsRawById();
   const dev = devTenantsToSeed(localTenantDirIds(), staticIds, getTenantTheme, {
     scopeFor: (id) => scopes.get(id),
     hasCatalog: (scope) => withCatalog.has(scope),
+    analyticsFor: (id) => analytics.get(id),
   });
   if (dev.length === 0) return staticResolver;
   // registry[0] stays the static default (HOME_TENANT) for unknown-host fallback.

package/apps/storefront/src/config/tenantAnalyticsFiles.ts

@@ -0,0 +1,43 @@
+/**
+ * The colocated tenant-owned analytics declarations on disk (TIER 1), keyed by tenant id.
+ *
+ * A tenant declares its measurement destinations in its OWN tree, at
+ * `tenants/<id>/analytics.json` — the self-serve surface a merchant edits without a
+ * platform change. This module is the SINGLE build-time read of that surface, shared by
+ * both producers of a `TenantConfig`: the static registry (config/tenants.ts, which
+ * attaches a declaration to the matching registry entry) and dev-loop synthesis
+ * (config/resolver.ts, which synthesizes a config for a local dir that has no registry
+ * entry). One read, one key space, so a tenant is never reachable by one producer and
+ * invisible to the other.
+ *
+ * `import.meta.glob` is a build-time PATTERN match, not a module resolution: a registered
+ * tenant's tree is Gitea-materialized and gitignored, so it does NOT exist in a bare
+ * checkout or CI, and zero matches is a valid, typed result (an empty object) rather than
+ * a compile error. Absent ⇒ that tenant declares nothing, which is the undeclared norm.
+ *
+ * Both colocation tiers are globbed: real tenants at `tenants/<id>/`, platform test
+ * tenants one level deeper at `tenants/e2e/<id>/` (`tenantDirRelative`). Vite needs
+ * literal patterns, so the nesting is spelled out and `tenantIdFromPath` — the one inverse
+ * of that mapping — recovers the id from either shape. Depth: from `src/config/` the repo
+ * root is four levels up (config→src→storefront→apps→root).
+ */
+import { tenantIdFromPath } from "@tot/public-runtime";
+
+const tenantAnalyticsFiles = import.meta.glob<unknown>(
+  ["../../../../tenants/*/analytics.json", "../../../../tenants/e2e/*/analytics.json"],
+  { eager: true, import: "default" },
+);
+
+/**
+ * Tenant id → the parsed `analytics.json` content, for every tenant that ships one in
+ * this checkout. The key is the colocated dir name, which IS the tenant id
+ * (dir == tenant_id == appDomain). A tenant with no file is simply absent from the map.
+ */
+export function tenantAnalyticsRawById(): Map<string, unknown> {
+  const map = new Map<string, unknown>();
+  for (const [key, raw] of Object.entries(tenantAnalyticsFiles)) {
+    const id = tenantIdFromPath(key);
+    if (id) map.set(id, raw);
+  }
+  return map;
+}

package/apps/storefront/src/config/tenants.ts

@@ -13,6 +13,7 @@
  */
 import type { TenantConfig, TenantResolver } from "@tot/public-runtime";
 import { getTenantTheme } from "@/themes/tenants";
+import { rootPublicationSpaceConfig } from "@/config/publicationSpaceConfig";
 
 // Default landing tenant — the fallback for unmatched hosts / bare localhost.
 // Non-commerce "coming soon" placeholder; never a fake merchant. Registered first
@@ -31,6 +32,11 @@ export const HOME_TENANT: TenantConfig = {
   currency: "USD",
   locale: "en-US",
   theme_tokens: getTenantTheme("home"),
+  publicationSpaces: [rootPublicationSpaceConfig("home", {
+    forge: "fixture",
+    repo: "home",
+    defaultBranch: "main",
+  })],
   siteType: "marketing",
 };
 
@@ -50,6 +56,11 @@ export const SAMPLE_TENANT: TenantConfig = {
   currency: "USD",
   locale: "en-US",
   theme_tokens: getTenantTheme("sample-store.example"),
+  publicationSpaces: [rootPublicationSpaceConfig("sample-store.example", {
+    forge: "fixture",
+    repo: "sample-store.example",
+    defaultBranch: "main",
+  })],
   // Regulated-store demo: shows the 21+/PACT compliance gate is CONFIG-driven.
   compliance: {
     minAge: 21,

package/apps/storefront/src/layouts/Layout.astro

@@ -103,7 +103,11 @@ const { tenant, themeStyle, canonicalBase, basePath, cspNonce, features, capabil
 // boundaries. `rawHtmlResponse` is the other mount of the SAME engine, so both
 // documents carry byte-identical phase markup. The nonce is stamped per response
 // from a placeholder by the middleware, never serialized (ADR 0018).
-const integrationPhases = renderIntegrationPhases(Astro.locals.integrationPlan, cspNonce);
+const integrationPhases = renderIntegrationPhases(
+  Astro.locals.integrationPlan,
+  cspNonce,
+  Astro.locals.consentSnapshot,
+);
 
 // Organization JSON-LD is emitted site-wide (brief §8); pages add their own
 // graphs (Product, BreadcrumbList…) via the jsonLd prop.

package/apps/storefront/src/lib/activity/killSwitch.ts

@@ -24,7 +24,7 @@
  * dev/tests immediately, and a Worker secret takes effect from the first primed
  * request of each isolate.
  */
-import { readEnv } from "../env.js";
+import { readEnv } from "../runtimeEnv.js";
 
 /** The one canonical flag name — shared verbatim by the server and the CLI mirror. */
 export const ACTIVITY_KILL_SWITCH_FLAG = "ACTIVITY_TELEMETRY_DISABLED";

package/apps/storefront/src/lib/admin/consentSettingsClient.ts

@@ -0,0 +1,113 @@
+/**
+ * Client-side wiring for `/admin/consent` (ADR 0013 client-island pattern: a
+ * typed `lib/` module imported from a processed `<script>`, never mirrored
+ * inline). Reads/writes `GET`/`POST /api/admin/consent-config`.
+ */
+
+interface ConsentConfigRevision {
+  revision: number;
+  createdAt: string;
+  actor: string;
+  note: string | null;
+}
+
+/** Builds the history table with safe DOM methods only — `note` is admin-authored free text and must never be interpolated as HTML. */
+function renderHistoryTable(rows: ConsentConfigRevision[]): HTMLTableElement {
+  const table = document.createElement("table");
+  const thead = document.createElement("thead");
+  const headRow = document.createElement("tr");
+  for (const label of ["Rev", "When", "Actor", "Note"]) {
+    const th = document.createElement("th");
+    th.textContent = label;
+    headRow.appendChild(th);
+  }
+  thead.appendChild(headRow);
+  table.appendChild(thead);
+
+  const tbody = document.createElement("tbody");
+  for (const r of rows) {
+    const tr = document.createElement("tr");
+    const cells = [`#${r.revision}`, new Date(r.createdAt).toLocaleString(), r.actor, r.note ?? ""];
+    for (const value of cells) {
+      const td = document.createElement("td");
+      td.textContent = value;
+      tr.appendChild(td);
+    }
+    tbody.appendChild(tr);
+  }
+  table.appendChild(tbody);
+  return table;
+}
+
+/**
+ * Wire the consent settings form + history panel. A no-op when the page did
+ * not render the authorized form (e.g. a signed-in non-owner) — the elements
+ * this looks for simply won't exist.
+ */
+export function initConsentSettingsPage(apiPath: string): void {
+  const form = document.getElementById("consent-form") as HTMLFormElement | null;
+  const statusEl = document.getElementById("status");
+  const historyBody = document.getElementById("history-body");
+  if (!form || !statusEl || !historyBody) return;
+
+  function setStatus(text: string, tone: "ok" | "error" | null): void {
+    statusEl!.textContent = text;
+    if (tone) statusEl!.setAttribute("data-tone", tone);
+    else statusEl!.removeAttribute("data-tone");
+  }
+
+  form.querySelectorAll<HTMLInputElement>(".enable-toggle").forEach((toggle) => {
+    toggle.addEventListener("change", () => {
+      const group = toggle.closest(".purpose")?.querySelector<HTMLElement>(".bases");
+      group?.setAttribute("data-disabled", toggle.checked ? "false" : "true");
+    });
+  });
+
+  async function loadHistory(): Promise<void> {
+    try {
+      const res = await fetch(apiPath, { headers: { accept: "application/json" } });
+      const data = (await res.json()) as { ok: boolean; history?: ConsentConfigRevision[] };
+      if (!data.ok || !data.history || data.history.length === 0) {
+        historyBody!.textContent = "No saved revisions yet.";
+        return;
+      }
+      historyBody!.replaceChildren(renderHistoryTable(data.history));
+    } catch {
+      historyBody!.textContent = "Could not load history.";
+    }
+  }
+  void loadHistory();
+
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const purposes: Array<{ purpose: string; legalBasis: string }> = [];
+    form.querySelectorAll<HTMLInputElement>(".enable-toggle").forEach((toggle) => {
+      if (!toggle.checked) return;
+      const purpose = toggle.getAttribute("data-purpose") ?? "";
+      const checkedBasis = form.querySelector<HTMLInputElement>(`input[name="basis-${purpose}"]:checked`);
+      purposes.push({ purpose, legalBasis: checkedBasis?.value ?? "consent" });
+    });
+
+    setStatus("Saving…", null);
+    const saveButton = form.querySelector<HTMLButtonElement>("button.save");
+    if (saveButton) saveButton.disabled = true;
+    try {
+      const res = await fetch(apiPath, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ purposes }),
+      });
+      const data = (await res.json()) as { ok: boolean; message?: string; revision?: { revision: number } };
+      if (!data.ok) {
+        setStatus(data.message || "Save failed.", "error");
+      } else {
+        setStatus(`Saved as revision #${data.revision?.revision}.`, "ok");
+        void loadHistory();
+      }
+    } catch {
+      setStatus("Save failed — network error.", "error");
+    } finally {
+      if (saveButton) saveButton.disabled = false;
+    }
+  });
+}

package/apps/storefront/src/lib/apps/consentConfigRead.ts

@@ -0,0 +1,24 @@
+/**
+ * Read the current tenant consent configuration for rendering.
+ *
+ * This is the renderer-shared half of consent persistence: it exposes only the
+ * latest validated configuration and none of the authoring or history surface.
+ */
+import type { TenantConsentConfig } from "@tot/public-runtime";
+import type { Queryable } from "../d1/catalog.js";
+
+interface CurrentConsentConfigRow {
+  config: string;
+}
+
+export async function readCurrentTenantConsentConfig(
+  db: Queryable,
+  tenantId: string,
+): Promise<TenantConsentConfig | null> {
+  const row = await db.first<CurrentConsentConfigRow>(
+    `SELECT config FROM consent_config_revisions WHERE tenant_id = ?
+      ORDER BY revision DESC LIMIT 1`,
+    tenantId,
+  );
+  return row ? (JSON.parse(row.config) as TenantConsentConfig) : null;
+}