@tokenoftrust/storefront-runner 2.0.16 → 2.0.18

package/apps/storefront/src/middleware/index.ts

@@ -1,87 +1,57 @@
 /**
- * Tenant-resolution middleware (brief §7).
+ * The storefront front door: resolve the tenant, resolve the route ONCE through
+ * the route-tier authority, and dispatch to the one branch that serves it.
  *
- * Per request: Host -> TenantConfig (via TenantResolver) -> resolve theme ->
- * bind a ToTClient to the tenant's data scope -> stash everything on
- * Astro.locals so pages/components stay tenant-agnostic. The serialized theme
- * CSS-var block is injected into <head> by Layout.astro from locals.themeStyle.
+ * ADR 0013 splits a tenant's surface in two — a public path that is CDN →
+ * content-addressed storage with no origin compute, and a control plane the
+ * Worker keeps (preview, draft overlay, admin, the dev loop, gated member areas).
+ * This file is where that split is taken: `resolveMiddlewareBranchV1` asks
+ * `resolveRouteTierV1` (packages/public-runtime) for the tier and returns the
+ * branch, and nothing downstream re-derives it.
+ *
+ *   static-passthrough → platform bytes; `next()` plus baseline headers.
+ *   public-render      → ./publicRender — anonymous output, no request-time D1.
+ *   control-plane      → ./controlPlane — the gate, the D1 reads, then the render.
+ *
+ * The resolver is fed `renderPath`, the TENANT-RELATIVE path. `url.pathname` is
+ * not tenant-relative on a path-routed deployment, and feeding it in would let
+ * `/<tenant>/admin` miss the reserved-mount check and resolve as public Tier 0.
+ *
+ * Contract: docs/architecture/decisions/0013-public-serving-contract.md
  */
 import { defineMiddleware } from "astro:middleware";
 import { getTenantResolver } from "@/config/resolver";
-import { referenceTheme } from "@/themes/reference";
-import { mergeTheme, themeToCssVars } from "@/themes/schema";
-import { createToTClient } from "@/lib/tot/ToTClient";
-import { readEnv, readKv, readD1, readR2 } from "@/lib/env";
+import { readEnv, readKv } from "@/lib/runtimeEnv";
 import { resolveTenantRouting } from "@/lib/tenantRouting";
-import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
-import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
-import {
-  isCacheablePath,
-  pageCacheKey,
-  readCacheVersion,
-  getCachedPage,
-  putCachedPage,
-  staticBundleCacheKey,
-} from "@/lib/edgeCache";
-import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
+import { compileRouteTierIndexV1, type RouteTierIndexV1 } from "@tot/public-runtime";
+import type { TenantConfig } from "@tot/public-runtime";
+import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
-import { maybeInjectPreviewReload } from "@/lib/previewReload";
-import {
-  CANDIDATE_CONTENT_PIN_PARAM,
-  verifyContentPinToken,
-  resolveCustomizationEnv,
-  buildCsp,
-  STOREFRONT_CSP_ALLOWLIST,
-  checkoutCspAdditions,
-  appWidgetCspAdditions,
-  embedCspAdditions,
-  foldIntegrationCsp,
-  embedsArtifactPath,
-  resolveEffectiveEmbeds,
-  CSP_REPORT_GROUP,
-  CSP_REPORT_PATH,
-  readPublishedArtifact,
-  themeArtifactPath,
-  resolveTenantFeatures,
-  resolveCapabilities,
-  capabilitiesArtifactPath,
-  resolveChannelDigest,
-  resolveServableChannelVersion,
-  channelFromEnv,
-  serveStaticBundle,
-  resolveEnvironmentOnlyPlan,
-  resolveInterimBridgePlan,
-  compileIntegrationCspFromPlan,
-  collectDeclaredCspProfiles,
-  INTEGRATION_NONCE_PLACEHOLDER,
-} from "@tot/public-runtime";
-import type { CapabilityConfig, StaticBundleR2BucketLike, BrowserEnvironment } from "@tot/public-runtime";
-import { loadTenantIntegrationDeclarations } from "@/lib/integration/tenantDeclarations";
-import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
-import { fromD1 } from "@/lib/d1/catalog";
-import { resolveTenantCommerce } from "@/lib/checkoutCommerce";
+import { tryServeStaticBundle } from "./staticBundle.js";
+import { resolveCandidateContentPin } from "./candidatePin.js";
+import { parseGateMode } from "@/lib/auth/loginGate";
 import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
-import {
-  evaluateLoginGate,
-  parseGateMode,
-  isAuthPath,
-  isAdminPath,
-  sessionAdmitsHost,
-  sessionHostCapability,
-  PUBLIC_HOME_TENANT_ID,
-} from "@/lib/auth/loginGate";
-import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import { gatedHoldingResponse } from "@/lib/auth/gatePage";
-import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
 import { HEALTH_PATH, healthResponse } from "@/lib/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
-import { requestBrowserEnvironment, deriveSiteSurface, cspHeaderName } from "@/lib/integration/browserEnvironment";
-import { freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
-import { recordActivity } from "@/lib/activity/recordActivity";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
-import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
+import { resolveMiddlewareBranchV1 } from "./routeBranch.js";
+import { servePublicRender } from "./publicRender.js";
+import { serveControlPlane } from "./controlPlane.js";
+
+/**
+ * Compiled once per tenant-config object, as the resolver's contract asks —
+ * validation is pure and its inputs only change when the config object does.
+ */
+const routeTierIndexes = new WeakMap<TenantConfig, RouteTierIndexV1>();
+
+function routeTierIndexFor(tenant: TenantConfig): RouteTierIndexV1 {
+  const cached = routeTierIndexes.get(tenant);
+  if (cached) return cached;
+  const compiled = compileRouteTierIndexV1(tenant);
+  routeTierIndexes.set(tenant, compiled);
+  return compiled;
+}
 
 export const onRequest = defineMiddleware(async (context, next) => {
   const { request, locals } = context;
@@ -126,9 +96,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
   //   "password" (default) — interim Basic-Auth gate, enforced HERE (host-level,
   //     no tenant/session needed) so a blocked host never reaches tenant
   //     resolution, the edge cache, or any render.
-  //   "login" — "Sign in with ToT" gate, enforced just below (needs the resolved
-  //     tenant as the grant `resource` + the SESSION KV), redirecting to
-  //     /auth/login unless a valid, resource-bound tot_session cookie is present.
+  //   "login" — "Sign in with ToT" gate, enforced on the control-plane branch
+  //     (it needs the resolved tenant as the grant `resource` + the SESSION KV).
   const gateMode = parseGateMode(await readEnv("DEMO_GATE_MODE"));
   const demoGateHosts = await readEnv("DEMO_GATE_HOSTS");
   if (gateMode === "password") {
@@ -153,741 +122,76 @@ export const onRequest = defineMiddleware(async (context, next) => {
     return new Response("Unknown host", { status: 404 });
   }
 
-  // Workers Cache API: backs the full-page edge cache below. Undefined in
-  // `astro dev` (Node) — every use is a no-op there.
+  // ---- The one route classification -----------------------------------------
+  const hostLoginGated = gateMode === "login" && hostInGateList(host, demoGateHosts);
+  const { branch, route } = resolveMiddlewareBranchV1({
+    index: routeTierIndexFor(tenant),
+    renderPath,
+    hostLoginGated,
+  });
+  locals.routeTier = route;
+
+  // Workers Cache API: backs the full-page edge cache in the render chain, and
+  // the bundle read below. Undefined in `astro dev` (Node) — a no-op there.
   const cache =
     typeof caches !== "undefined" && "default" in caches
       ? (caches as unknown as { default: Cache }).default
       : undefined;
   const kv = await readKv("TENANT_CACHE");
 
-  // Login-gate enforcement (DEMO_GATE_MODE="login"): runs before the edge cache
-  // so a gated page is never served to an unauthenticated viewer. The platform's
-  // own "self" home tenant is EXEMPT — it renders publicly (browse + sign up);
-  // every other tenant on a gated host is withheld behind sign-in. A valid,
-  // resource-bound tot_session sets locals.viewer (email + roles) for chrome;
-  // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
-  // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
-  // grant `resource` is the tenant's appDomain — never input.
-  const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
-  if (gateMode === "login" && hostInGateList(host, demoGateHosts)) {
-    // UNIFIED on the federated session: read the FULL session (no resource filter —
-    // federated sign-in's aud is the storefront app, not this tenant) and admit the
-    // viewer iff they hold a MEMBERSHIP for the host's tenant. One session model for
-    // the console + the preview gate. Deny-closed: no session / no membership → gate.
-    let viewerRecord = null;
-    if (!isAuthPath(url.pathname)) {
-      const sessionKv = await readKv("SESSION");
-      if (sessionKv) {
-        const sid = context.cookies.get(SESSION_COOKIE)?.value ?? null;
-        viewerRecord = await readSession(
-          new KvSessionStore(sessionKv),
-          sid,
-          Math.floor(Date.now() / 1000),
-        );
-      }
-    }
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    const admitted = sessionAdmitsHost(viewerRecord, tenant.appDomain, nowSeconds);
-    // QA content-bypass: only when the server has configured DEMO_GATE_BYPASS_TOKEN
-    // (never in a prod slot) AND the request presents a matching X-Demo-Gate-Bypass
-    // header. Unset token ⇒ false ⇒ fully inert; a client cannot self-grant. The
-    // public-content-only restriction (admin/cockpit/api excluded) is enforced
-    // inside evaluateLoginGate via isBypassPrivilegedPath.
-    const bypassToken = await readEnv("DEMO_GATE_BYPASS_TOKEN");
-    const qaBypass =
-      !!bypassToken && request.headers.get("x-demo-gate-bypass") === bypassToken;
-
-    // Canonical admin tenant landing: an AUTHENTICATED viewer who is not a
-    // member/staff of THIS host's tenant must be routed to their OWN tenant
-    // (auto when sole) or the tenant picker (when several / none) — never bounced
-    // into a sign-in loop and never silently shown the wrong tenant. Only for
-    // admin paths, only for an authed non-member, and never on the /admin/select
-    // picker itself (whose whole purpose is to be reachable by such a viewer).
-    if (
-      isAdminPath(url.pathname) &&
-      !isAdminSelectPath(url.pathname) &&
-      !admitted &&
-      viewerRecord &&
-      !qaBypass
-    ) {
-      const landing = resolveAdminLanding({
-        record: viewerRecord,
-        routedTenant: tenant.appDomain,
-        basePath,
-        intended: url.pathname + url.search,
-        nowSeconds,
-      });
-      if (landing.action === "auto" || landing.action === "select") {
-        return context.redirect(landing.location, 303);
-      }
-    }
-
-    // The /admin/select picker requires only a VALID SESSION (any authed viewer),
-    // not membership of the routed tenant — it lists the viewer's OWN tenants. So
-    // it passes the gate on the strength of the session alone.
-    const hasValidSession =
-      admitted || (isAdminSelectPath(url.pathname) && !!viewerRecord);
-    const decision = evaluateLoginGate({
-      host,
-      pathname: url.pathname,
-      search: url.search,
-      mode: gateMode,
-      gatedHosts: demoGateHosts,
-      hasValidSession,
-      tenantExempt,
-      qaBypass,
-    });
-    if (decision.action === "redirect") {
-      // ADMIN (and any privileged surface) hard-redirects to sign-in rather than
-      // rendering the merchant-facing "Coming soon" holding page: an unauthenticated
-      // admin visitor must land on the sign-in prompt, never an ambiguous 200 that
-      // reads as "this store isn't ready." The holding page's whole audience is a
-      // public browser of a gated STOREFRONT; it is the wrong signal for /admin. The
-      // gate already decided to withhold — this only changes HOW (303 vs holding
-      // page); it never weakens the gate. `decision.location` already carries
-      // `?next=` so the admin returns to exactly where they were headed.
-      if (isAdminPath(url.pathname)) {
-        return context.redirect(decision.location, 303);
-      }
-      // Withhold content but offer sign-in (carrying the intended destination).
-      return gatedHoldingResponse(decision.location);
-    }
-    if (admitted && viewerRecord) {
-      // Surface the viewer's standing FOR THIS host's tenant as chrome, BOUND to
-      // the host so a capability the session holds for another tenant never leaks
-      // in: a member sees their tenants[] role; the owner of their own tenant sees
-      // the resource-scoped session's capability; a ToT-staff viewer admitted via
-      // an explicit vendor selection sees the staffRoles-scoped capability. The
-      // ship gates (decideIsOwner/resolveShipPrincipal) read this capability,
-      // so binding it here keeps owner-resolution server-side + tenant-correct.
-      //
-      // On an admin path, "the host" a staff viewer is really acting on is the
-      // ?asTenant= impersonation target (mirrors admin.astro/AdminPublishTab.astro's
-      // own resolveAdminTenantMode call) — resolving capability against the routed
-      // host instead left a staff viewer who selected another tenant reading as
-      // "not an owner" of it even while holding a real grant, because their
-      // staffSelection is bound to the SELECTED tenant, never the host app.
-      const capabilityHost = isAdminPath(url.pathname)
-        ? resolveAdminTenantMode({
-            session: viewerRecord,
-            adminAppTenant: tenant.appDomain,
-            requestedTarget: url.searchParams.get("asTenant"),
-            nowSeconds,
-          }).envelope.targetTenant
-        : tenant.appDomain;
-      const hostCapability = sessionHostCapability(viewerRecord, capabilityHost, nowSeconds);
-      locals.viewer = {
-        email: viewerRecord.email,
-        roles: hostCapability ? [hostCapability] : viewerRecord.roles,
-        capability: hostCapability ?? viewerRecord.capability,
-      };
-    }
-  }
-
-  // Preview/test detection (also reused for the customization env below). A
-  // production read is one with no preview host, query token, or preview cookie.
-  const isPreviewHost = host.toLowerCase().startsWith("preview.");
-  const queryToken = url.searchParams.get("__preview");
-  const cookieToken = context.cookies.get("tot_preview")?.value ?? null;
-
-  // Candidate-render CONTENT PIN (`__tot_candidate_pin`): a signed, tenant- and
-  // expiry-bound token minted ONLY by the control-plane candidate/revision
-  // renderers (`src/lib/preview/pinnedRouteRender.ts`, never client-forgeable)
-  // that pins THIS one render's content resolution to an exact immutable
-  // `versionId`, bypassing the shared `{live,test}` channel entirely. It rides
-  // an in-process `context.rewrite()` from those renderers so a real Astro
-  // route (blog, editorial pages, …) — not just the raw `home.html`/
-  // `pages-html/*` documents they serve directly — renders pinned to the
-  // candidate under review (fb-1788536381607). Verified here so it can only
-  // ever name the resolved tenant's own version; a mismatched/expired/absent
-  // token falls through to the normal channel-resolved read below, same
-  // fail-closed posture as the `__preview` token.
-  const candidatePinParam = url.searchParams.get(CANDIDATE_CONTENT_PIN_PARAM);
-  let candidatePin: { versionId: string; basePath: string } | null = null;
-  if (candidatePinParam) {
-    const pinSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-    if (pinSecret) {
-      const verified = await verifyContentPinToken(
-        pinSecret,
-        candidatePinParam,
-        Math.floor(Date.now() / 1000),
-      );
-      if (verified.ok && verified.claims.tenantId === tenant.tenant_id) {
-        candidatePin = { versionId: verified.claims.versionId, basePath: verified.claims.basePath };
-      }
-    }
-  }
-  // Per-developer AI-edit draft: the signed
-  // tot_dev_draft cookie's mere PRESENCE opts the request out of the shared page
-  // cache below (a draft view must never be cached publicly); it's verified —
-  // signature, expiry, tenant binding — before the overlay is applied further down.
-  const draftCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
-
-  // Active managed installs share the same declaration/resolver/CSP/broker/cache
-  // plane as tenant-config integrations. Read only canonical active rows and their
-  // current immutable snapshot; candidates, suspended rows, and drafts produce no
-  // declaration. A missing/unmigrated binding fails closed to no managed effects.
-  const appsD1 = await readD1("STOREFRONT_APPS_DB");
-  let managedIntegrationDeclarations = [] as Awaited<ReturnType<typeof loadActiveManagedInstallDeclarations>>;
-  if (appsD1) {
-    try {
-      managedIntegrationDeclarations = await loadActiveManagedInstallDeclarations(fromD1(appsD1), tenant.tenant_id);
-    } catch {
-      managedIntegrationDeclarations = [];
-    }
-  }
-
-  // ---- Digest-addressed static-bundle serving (ADR 0012) --------------------
-  // For a static-publish tenant's PRODUCTION reads only (never preview/test — the
-  // "Worker serves interactive preview, R2 serves prod" split), read the live
-  // bundle straight out of R2 instead of falling through to SSR. Deliberately
-  // BEFORE the edge page cache / catalog / theme / customization machinery below:
-  // none of that applies to bundle bytes served verbatim, and this path must
-  // never SSR-fallthrough once it's eligible (a missing digest/object fails
-  // closed, see `serveStaticBundle`), so it has to fully own the response, not
-  // degrade into the normal render.
-  // Host-resolved reads only (`basePath === ""`): bundle bytes are served
-  // VERBATIM with root-absolute links, so a path-prefixed view
-  // (/<domain>/… on the shared .store host) would escape its prefix on every
-  // href — those views keep SSR, which rewrites hrefs through basePath.
-  const staticBundleEligible =
-    tenant.staticPublish != null &&
-    tenant.staticPublish.enabled !== false &&
-    basePath === "" &&
-    request.method.toUpperCase() === "GET" &&
-    !isPreviewHost &&
-    !queryToken &&
-    !cookieToken &&
-    !candidatePin &&
-    !draftCookie &&
-    managedIntegrationDeclarations.length === 0 &&
-    !url.pathname.startsWith("/api/");
-  if (staticBundleEligible) {
-    const bundleBucket = await readR2("STATIC_BUNDLES");
-    if (bundleBucket) {
-      const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
-      // The R2 bundle key is the `treeDigest`, NOT the `live` channel versionId
-      // (the Gitea sha). Read the reconciled digest companion (`channelDigests.live`)
-      // — `gatedPromote`/`rollbackCandidateAtomic` write it in the same CAS flip as
-      // the versionId. No digest = this tenant has never staged a bundle — SSR
-      // serves it (a static-publish tenant must be able to bootstrap, and its
-      // app surfaces must never be downed by an unstaged static plane).
-      const digest = await resolveChannelDigest(kvGet, tenant.tenant_id, "live");
-      if (digest) {
-        const bundleCacheKey = cache
-          ? staticBundleCacheKey(tenant.tenant_id, digest, url.pathname, url.search)
-          : null;
-        if (bundleCacheKey && cache) {
-          const hit = await getCachedPage(cache, bundleCacheKey);
-          if (hit) return hit;
-        }
-        const bundleResponse = await serveStaticBundle(
-          {
-            bucket: bundleBucket as unknown as StaticBundleR2BucketLike,
-            digest,
-            onFailClosed: (detail) => {
-              console.error(
-                `[static-bundle] fail-closed for ${tenant.tenant_id} ${url.pathname}: ${detail}`,
-              );
-            },
-          },
-          url.pathname,
-        );
-        // `null` = the manifest proves this path is outside the bundle's static
-        // surface (an app surface like /admin) — SSR owns it below.
-        if (bundleResponse) {
-          if (bundleCacheKey && cache) {
-            await putCachedPage(cache, bundleCacheKey, bundleResponse);
-          }
-          return bundleResponse;
-        }
-      } else {
-        console.error(
-          `[static-bundle] no live digest for ${tenant.tenant_id} — SSR until a bundle is staged`,
-        );
-      }
-    }
-    // No STATIC_BUNDLES binding (plain `astro dev`, or unconfigured) —
-    // degrading to SSR here rather than a hard failure keeps `astro dev`/tests
-    // usable without provisioning R2.
-  }
-
-  // ---- Tenant-local integration materialization (ext-kernel-09) --------------
-  // Resolve a tenant's OWN declared, exact-version integrations into the effective
-  // plan the render engine serves, THROUGH the interim marketing bridge (which
-  // refuses a regulated tenant and fail-closes an invalid declaration set). Done
-  // HERE, before the edge-cache read, so a declared tenant's `planRevision` folds
-  // into the page-cache key below (a rollback/uninstall resolves a new revision →
-  // the old warm entry is unreachable → a clean re-render without the removed
-  // origins, never a TTL wait) AND its reviewed CSP origins reach the strict header.
-  //
-  // An UNDECLARED tenant does NONE of this: `loadTenantIntegrationDeclarations`
-  // returns the empty set, so `integrationCsp` stays undefined (the page-cache key
-  // is byte-identical to the non-integration form) and the environment-only plan is
-  // resolved below exactly as before — zero cost.
-  let resolvedBrowserEnvironment: BrowserEnvironment | null = null;
-  const integrationDeclarations = [
-    ...loadTenantIntegrationDeclarations(tenant),
-    ...managedIntegrationDeclarations,
-  ];
-  if (integrationDeclarations.length > 0) {
-    const declPreviewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-    const declEnv = await resolveCustomizationEnv({
-      isPreviewHost,
-      tenantId: tenant.tenant_id,
-      token: queryToken ?? cookieToken,
-      secret: declPreviewSecret,
-      nowSeconds: Math.floor(Date.now() / 1000),
-      pathname: url.pathname,
-    });
-    const declFeatures = resolveTenantFeatures(tenant);
-    resolvedBrowserEnvironment = requestBrowserEnvironment({
-      host,
-      isPreviewHost,
-      customizationEnv: declEnv.env,
-      canonicalHost: tenant.canonicalDomain || host,
-      siteSurface: deriveSiteSurface({ catalog: declFeatures.catalog, pathname: renderPath }),
-    });
-    const bridge = resolveInterimBridgePlan({
-      tenantPublicId: tenant.tenant_id,
+  // Platform bytes: the tenant's own bundle owns them when it has one — a
+  // published `/_astro/<hash>.css` exists ONLY in R2, never in this Worker's build
+  // output — and otherwise `next()` hands back the built asset. Either way nothing
+  // tenant-shaped renders over it, which is the origin compute ADR 0013 exists to
+  // keep off the public path. Managed installs are not consulted: they inject
+  // document markup, never asset bytes, so this stays a D1-free path.
+  if (branch === "static-passthrough") {
+    const bundled = await tryServeStaticBundle({
+      request,
+      url,
       tenant,
-      environment: resolvedBrowserEnvironment,
-      declarations: integrationDeclarations,
+      basePath,
+      cache,
+      kv,
+      isPreviewHost: host.toLowerCase().startsWith("preview."),
+      hasPreviewToken:
+        url.searchParams.has("__preview") || !!context.cookies.get("tot_preview")?.value,
+      hasCandidatePin: !!(await resolveCandidateContentPin(url, tenant.tenant_id)),
+      hasDraftCookie: !!context.cookies.get(DEV_DRAFT_COOKIE)?.value,
+      hasManagedInstalls: false,
     });
-    if (bridge.ok) {
-      // A resolved plan serves; its compiled CSP additions + `planRevision` reach the
-      // cache key and the header. A refusal (regulated) or an invalid set leaves the
-      // plan unset here → the environment-only fallback below fills it (nothing loads).
-      locals.integrationPlan = bridge.plan;
-      const compiled = compileIntegrationCspFromPlan(
-        bridge.plan,
-        collectDeclaredCspProfiles(integrationDeclarations),
-      );
-      if (compiled.ok) locals.integrationCsp = compiled.value;
-    }
+    if (bundled) return bundled;
+    const asset = basePath ? await next(`${renderPath}${url.search}`) : await next();
+    applySecurityHeaders(asset.headers);
+    return asset;
   }
 
-  // ---- Edge page cache: short-circuit production browse reads on a hit,
-  // BEFORE building the client / theme / rendering. Misses store the final
-  // response at the end of this middleware.
-  //
-  // NEVER in dev (`astro dev`): the workerd dev runtime persists the Workers Cache
-  // API in .wrangler/state, so a cached page would be served stale across edits AND
-  // restarts — silently defeating hot-reload (edits look "lost"). Dev must always
-  // re-render. import.meta.env.DEV statically drops this guard from the prod build.
-  const pageCacheEligible =
-    !import.meta.env.DEV &&
-    request.method.toUpperCase() === "GET" &&
-    !isPreviewHost &&
-    !queryToken &&
-    !cookieToken &&
-    !candidatePin &&
-    !draftCookie &&
-    isCacheablePath(url.pathname, url.searchParams);
-  let pageKey: Request | null = null;
-  if (pageCacheEligible && cache && kv) {
-    const version = await readCacheVersion(kv, tenant.tenant_id);
-    // Fold the resolved integration plan revision into the key so a warm entry is
-    // version-scoped: a rollback/uninstall resolves a new revision → old entry
-    // unreachable → clean re-render without the removed origins (never a TTL wait).
-    // Undefined until the integration plane is resolved for this tenant — the key
-    // is then byte-identical to the non-integration form. The store below reuses
-    // this same `pageKey`, so read and write stay consistent.
-    pageKey = pageCacheKey(
-      tenant.tenant_id,
-      url.pathname,
-      url.search,
-      version,
-      locals.integrationCsp?.planRevision,
-    );
-    const hit = await getCachedPage(cache, pageKey);
-    // The cached artifact is nonce-free (carries the placeholder). Stamp a fresh
-    // per-response nonce into its body + CSP header so a warm hit is served with a
-    // brand-new nonce, never the one an earlier response rendered with.
-    if (hit) return await stampResponseNonce(hit, freshNonce());
-  }
-
-  // Catalog source selection (docs/architecture/product-catalog.md).
-  // A store's product source graduates over its life: JSON fixtures (dev default) ->
-  // D1 edge replica (staging) -> hosted ToT catalog (go-live). Here we pick the read
-  // backend: USE_D1_CATALOG=1 (+ a CATALOG_DB binding) reads the D1 edge replica;
-  // otherwise createToTClient falls back to the bundled JSON fixture snapshot. The
-  // hosted catalog graduates the SAME canonical records into the D1 read model
-  // (emitCatalogSql), so JSON/D1/hosted render identically — pinned by
-  // lib/tot/sourceSelection.test.ts.
-  const d1 =
-    (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined;
-  const tot = await createToTClient(tenant, d1);
-
-  const proto = url.protocol === "http:" ? "http" : "https";
-  // Canonical base uses the tenant's canonical domain in prod; for local dev we
-  // keep the actual host (plus any /<domain> base path) so links resolve.
-  const isLocal = host.startsWith("localhost") || host.startsWith("127.0.0.1");
-  const canonicalBase = isLocal
-    ? `${proto}://${host}${basePath}`
-    : `https://${tenant.canonicalDomain}`;
-
-  // Live vs test customization. Production hosts always serve "live" and
-  // ignore any token; a "preview." host is auth-gated by a signed, tenant-bound,
-  // short-TTL preview token (?__preview= on first hit, then the tot_preview
-  // cookie). Test is never indexable (X-Robots-Tag below).
-  const previewToken = queryToken ?? cookieToken;
-  const previewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  const customization = await resolveCustomizationEnv({
-    isPreviewHost,
-    tenantId: tenant.tenant_id,
-    token: previewToken,
-    secret: previewSecret,
-    nowSeconds,
-    pathname: url.pathname,
-  });
-  if (customization.reject) {
-    return new Response(customization.reject.message, {
-      status: customization.reject.status,
-    });
-  }
-  // Persist a query-supplied token as a cookie so later navigations stay in test.
-  if (customization.env === "test" && queryToken) {
-    context.cookies.set("tot_preview", queryToken, {
-      httpOnly: true,
-      secure: true,
-      sameSite: "lax",
-      path: "/",
-      maxAge: 3600,
-    });
-  }
-
-  // Apply a published theme override for the resolved environment (store->app).
-  // The live domain serves `live`; a gated preview serves `test`. When nothing
-  // is published the build-time tenant theme is used unchanged.
-  //
-  // Resolution is versioned-aware inside readPublishedArtifact: env maps to a
-  // publish channel (live->live, test->preview); if the tenant has a channel
-  // pointer, the artifact is resolved through the immutable site version
-  // (channel -> versionId -> manifest -> content). Tenants with no channel
-  // pointer fall back to the legacy per-path selection — no behavior change.
-  const kvGet = kv ? (key: string) => kv.get(key) : async () => null;
-
-  // Self-heal a DANGLING channel pointer: the pointer for this env's channel may
-  // name a version that was never built (or whose manifest was evicted).
-  // `readVersionedArtifact` already serves last-built content instead of emptying
-  // the surface; here we do the once-per-request detection to ENQUEUE a rebuild of
-  // the dangling version. Fail-open: a KV hiccup never blocks the render (the reads
-  // below still run).
-  if (kv) {
-    const channel = channelFromEnv(customization.env);
-    await resolveServableChannelVersion(kvGet, tenant.tenant_id, channel, ({ versionId }) => {
-      recordActivity({
-        action: "preview.build.requested",
-        actor: { kind: "system", id: "storefront" },
-        source: "server",
-        outcome: { status: "succeeded" },
-        scope: { tenantId: tenant.tenant_id },
-        payload: { args: { changeId: versionId } },
-      });
-    }).catch(() => {
-      /* fail-open: self-heal detection never breaks the request */
-    });
-  }
-
-  // Verify the developer-draft cookie (signature + expiry + tenant binding) — the
-  // overlay below only engages for the developer who minted the draft, on THIS
-  // tenant. Same secret + trust model as the preview token; invalid/expired/foreign
-  // tokens degrade silently to the base chain (never an error page).
-  const draftClaims =
-    draftCookie && previewSecret && kv
-      ? await verifyDevDraftToken(previewSecret, draftCookie, nowSeconds)
-      : null;
-  const draft =
-    draftClaims && draftClaims.tenantId === tenant.tenant_id ? draftClaims : null;
-
-  let theme = mergeTheme(referenceTheme, tenant.theme_tokens);
-  const publishedTheme = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    themeArtifactPath(tenant.tenant_id),
-  );
-  if (publishedTheme) {
-    try {
-      theme = mergeTheme(theme, JSON.parse(publishedTheme) as DeepPartial<ThemeTokens>);
-    } catch {
-      /* malformed published artifact — keep the build-time theme */
-    }
-  }
-  // Developer-draft theme overlay (on top of published) — only for the draft owner.
-  if (draft) {
-    const draftTheme = await kvGet(devDraftKey(tenant.tenant_id, draft.draftId, "theme.json"));
-    if (draftTheme) {
-      try {
-        theme = mergeTheme(theme, JSON.parse(draftTheme) as DeepPartial<ThemeTokens>);
-      } catch {
-        /* malformed draft artifact — keep the resolved theme */
-      }
-    }
-  }
-
-  // Per-environment capabilities (Track A/B). Config-as-code: the build-time
-  // TenantConfig default is overridden by the published capabilities artifact for
-  // THIS environment — materialized from the tenant repo's .tot/config.json per
-  // commit (localhost=working tree, preview=PR head, live=promoted). So a
-  // capability change is PR-gated and separable per environment.
-  let publishedCaps: Partial<CapabilityConfig> | null = null;
-  const publishedCapsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    capabilitiesArtifactPath(tenant.tenant_id),
-  );
-  if (publishedCapsRaw) {
-    try {
-      publishedCaps = JSON.parse(publishedCapsRaw) as Partial<CapabilityConfig>;
-    } catch {
-      /* malformed published artifact — keep the build-time default */
-    }
-  }
-  const capabilities = resolveCapabilities(tenant, publishedCaps);
-
-  // Embed opt-in (self-serve, config-as-code on the same spine as capabilities):
-  // the build-time TenantConfig.embeds default is overlaid with the tenant's
-  // published embeds.json for THIS env, then filtered to the vetted catalog. A
-  // tenant enables a catalogued embed by committing embeds.json — no platform
-  // change — but can never introduce a non-catalog origin.
-  let publishedEmbeds: string[] | null = null;
-  const publishedEmbedsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    embedsArtifactPath(tenant.tenant_id),
-  );
-  if (publishedEmbedsRaw) {
-    try {
-      const parsed = JSON.parse(publishedEmbedsRaw);
-      if (Array.isArray(parsed)) publishedEmbeds = parsed.filter((s) => typeof s === "string");
-    } catch {
-      /* malformed published artifact — keep the build-time default */
-    }
-  }
-  const effectiveEmbeds = resolveEffectiveEmbeds(tenant.embeds, publishedEmbeds);
-
-  // Nonce placeholder: the platform's inline tags AND the CSP header are rendered
-  // with this sentinel, never a live nonce (ADR 0018). A fresh per-response nonce
-  // is stamped in at serve time (stampResponseNonce below), so the cached artifact
-  // is nonce-free and every response — cold render or warm cache hit — gets a fresh
-  // matching nonce/CSP pair.
-  const cspNonce = INTEGRATION_NONCE_PLACEHOLDER;
-
-  locals.tenant = tenant;
-  // Effective capability flags for this tenant (commerce defaults unless the
-  // tenant declares siteType:"marketing" / explicit features). Pages and chrome
-  // read these instead of hard-coding tenant identity checks.
-  locals.features = resolveTenantFeatures(tenant);
-  locals.capabilities = capabilities;
-  // Cart/checkout facts (Track A) — only when the tenant has a catalog
-  // AND the cartCheckout capability is enabled for THIS environment. Drives the
-  // loader + signed add-to-cart, and the CSP additions below.
-  const commerce =
-    locals.features.catalog && capabilities.cartCheckout.enabled
-      ? await resolveTenantCommerce(tenant)
-      : null;
-  locals.commerce = commerce ?? undefined;
-  locals.tot = tot;
-  // A verified candidate content pin takes priority over the channel-resolved
-  // read — a pinned candidate/revision render must never fall through to the
-  // shared `{live,test}` content (see `pinnedRouteRender.ts`).
-  locals.content = candidatePin
-    ? createContentProvider(tenant, undefined, { get: kvGet, versionId: candidatePin.versionId })
-    : createContentProvider(tenant, {
-        get: kvGet,
-        env: customization.env,
-      });
-  // Developer-draft content overlay — serves the AI-edited artifacts to the draft
-  // owner only; every other viewer keeps the published/base chain above.
-  if (draft) {
-    locals.content = new DevDraftContentProvider(
-      locals.content,
-      tenant.tenant_id,
-      draft.draftId,
-      kvGet,
-    );
-  }
-  locals.themeStyle = themeToCssVars(theme);
-  locals.canonicalBase = canonicalBase;
-  locals.customizationEnv = customization.env;
-  locals.cspNonce = cspNonce;
-  // Seeded here, filled in by whichever page/layout renders a widget slot
-  // (renderSlot.ts) as the page renders inside next() below — read back out
-  // after next() resolves so the CSP frame-src reflects exactly what rendered.
-  locals.activeWidgetPlacements = [];
-  // Prefix that path-routed pages live under ("" for host-routed). Pages stay
-  // tenant-agnostic; the Layout uses this to keep root-absolute links inside
-  // the tenant prefix on the client. A candidate content pin overrides this to
-  // the PINNING render's own prefix (`/preview/rev/<sha>` or
-  // `/preview/render/<tenant>/<changeId>`) so a pinned page's OWN generated
-  // links stay inside that candidate instead of escaping to the live host.
-  locals.basePath = candidatePin ? candidatePin.basePath : basePath;
-  // Renderer-owned four-stage browser environment (ADR 0014 E1 / 0017), computed
-  // ONCE here from authoritative request state and serialized before app code by
-  // both document mounts (Layout.astro + rawHtmlResponse). The candidate render
-  // paths build their own `candidate`-stage object instead of this one.
-  // Reuse the environment resolved for a declared tenant's integration plane above
-  // (identical inputs → identical object) so the plan's environment and this object
-  // never diverge; an undeclared tenant computes it here for the first time.
-  locals.browserEnvironment =
-    resolvedBrowserEnvironment ??
-    requestBrowserEnvironment({
+  if (branch === "public-render") {
+    return await servePublicRender({
+      context,
+      next,
       host,
-      isPreviewHost,
-      customizationEnv: customization.env,
-      canonicalHost: tenant.canonicalDomain || host,
-      siteSurface: deriveSiteSurface({ catalog: locals.features.catalog, pathname: renderPath }),
+      url,
+      tenant,
+      basePath,
+      renderPath,
+      cache,
+      kv,
     });
-  // Resolved effective plan (ext-kernel-03) for this request — the fixed-phase
-  // render engine (ext-kernel-04) consumes it in BOTH document mounts (Layout.astro
-  // + rawHtmlResponse). A declared tenant's plan is already resolved above (through
-  // the interim bridge); an undeclared tenant — or one the bridge refused / failed
-  // closed — resolves the environment-only plan here, so a page with no serving
-  // integration emits no vendor runtime/markup.
-  locals.integrationPlan =
-    locals.integrationPlan ??
-    resolveEnvironmentOnlyPlan(locals.browserEnvironment, tenant.tenant_id);
-
-  // /dev was renamed to /cockpit (2026-07-20). 302-redirect any old /dev link —
-  // host-routed (/dev) or path-routed (/<vendor>/dev) — to the new path, preserving
-  // the tenant prefix + query. Temporary (302) while the cockpit UX is still evolving.
-  if (renderPath === "/dev" || renderPath.startsWith("/dev/")) {
-    const rest = renderPath.slice("/dev".length); // "" or "/sub…"
-    return Response.redirect(`${url.origin}${basePath}/cockpit${rest}${url.search}`, 302);
   }
 
-  // When a /<domain>/ prefix selected the tenant, rewrite to the stripped route
-  // so the existing file-based routes match. next(path) rewrites WITHOUT
-  // re-running middleware, so the locals set above are preserved.
-  let response = basePath
-    ? await next(`${renderPath}${url.search}`)
-    : await next();
-
-  // On-publish auto-refresh: inject the live-reload client into SHARED preview
-  // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).
-  // It polls /__preview/version and reloads when this tenant's cache-version
-  // bumps on publish/reconcile. Injection happens before the CSP header is set so
-  // the script's per-request nonce (cspNonce) matches the enforced policy.
-  response = await maybeInjectPreviewReload(response, {
-    env: customization.env,
-    tenantId: tenant.tenant_id,
+  return await serveControlPlane({
+    context,
+    next,
+    host,
+    url,
+    tenant,
     basePath,
-    nonce: cspNonce,
+    renderPath,
+    cache,
+    kv,
+    gateMode,
+    demoGateHosts,
+    hostLoginGated,
   });
-
-  // Baseline security headers on every response — set before the page-cache
-  // store below so cached copies carry them too.
-  applySecurityHeaders(response.headers);
-
-  // Preview (test) output must never be indexed.
-  if (customization.noindex) {
-    response.headers.set("X-Robots-Tag", "noindex, nofollow");
-  }
-
-  // Strict CSP — now ENFORCED in every environment (Epic S2). The report-only
-  // rollout is complete: platform output is CSP-clean — inline styles are
-  // externalized (`inlineStylesheets: "never"`), Astro's static inline scripts +
-  // island style are hash-pinned (cspStaticHashes), our dynamic inline tags carry
-  // the per-request nonce, and the last inline event handler (SortSelect's
-  // `onchange`) is now a bundled 'self' script. Reporting endpoints stay attached
-  // (report-to/report-uri work in enforce mode), so we keep telemetry as tenant
-  // client JS arrives — those per-version tenant hashes extend `scriptSrc` per
-  // request (the mechanism below already supports it).
-  //
-  // DEV EXCEPTION: `astro dev` serves CSS/HMR as UN-nonced inline <style>/<script>
-  // (Vite injects them); the strict nonce policy blocks those, leaving the dev
-  // site unstyled. The BUILD is CSP-clean (styles are externalized via
-  // `inlineStylesheets:"never"`), so we enforce there and only REPORT in dev —
-  // violations are still surfaced, but styling/HMR work locally.
-  const cspHeader = cspHeaderName(import.meta.env.DEV);
-  response.headers.set(
-    "Reporting-Endpoints",
-    `${CSP_REPORT_GROUP}="${CSP_REPORT_PATH}"`,
-  );
-  // Checkout origins (loader CDN + the store's cart/checkout host) added to the
-  // strict policy only when this tenant has a store — so add-to-cart, the
-  // sidecart iframe/XHR, and the cross-origin form POST all pass.
-  const checkoutCsp = commerce ? checkoutCspAdditions(commerce.origin) : null;
-  // Private-app widget origins — read back AFTER next() so this reflects
-  // exactly the placements that rendered on THIS page, never a wildcard.
-  const widgetCsp = appWidgetCspAdditions(locals.activeWidgetPlacements ?? []);
-  // Third-party marketing embeds (e.g. a Pipedrive form) the tenant opted into
-  // via .tot/config.json `embeds:`. Only scan the HTML body when the tenant
-  // declared at least one embed — zero cost for everyone else — and add each
-  // provider's origins ONLY if its marker is actually on THIS page.
-  // Prefer an opt-in the render handler resolved for a tenant the URL router
-  // couldn't (the candidate renderer sets locals.embedOptIn — see candidateRender);
-  // otherwise use the router-resolved tenant's effective embeds.
-  const embedsForScan = locals.embedOptIn ?? effectiveEmbeds;
-  let embedCsp = { scriptSrc: [] as string[], connectSrc: [] as string[], frameSrc: [] as string[] };
-  if (
-    embedsForScan.length > 0 &&
-    (response.headers.get("content-type") ?? "").includes("text/html")
-  ) {
-    embedCsp = embedCspAdditions(embedsForScan, await response.clone().text());
-  }
-  const cspOptions = {
-    nonce: cspNonce,
-    ...STOREFRONT_CSP_ALLOWLIST,
-    // Pin Astro's static inline hydration scripts + island style by hash
-    // (they're identical every request); my dynamic inline tags use the nonce.
-    scriptSrc: [
-      ...STOREFRONT_CSP_ALLOWLIST.scriptSrc,
-      ...STATIC_SCRIPT_HASHES,
-      ...(checkoutCsp?.scriptSrc ?? []),
-      ...embedCsp.scriptSrc,
-    ],
-    styleSrc: [
-      ...STOREFRONT_CSP_ALLOWLIST.styleSrc,
-      ...STATIC_STYLE_HASHES,
-      ...(checkoutCsp?.styleSrc ?? []),
-    ],
-    fontSrc: [...STOREFRONT_CSP_ALLOWLIST.fontSrc, ...(checkoutCsp?.fontSrc ?? [])],
-    connectSrc: [
-      ...STOREFRONT_CSP_ALLOWLIST.connectSrc,
-      ...(checkoutCsp?.connectSrc ?? []),
-      ...embedCsp.connectSrc,
-    ],
-    imgSrc: [...STOREFRONT_CSP_ALLOWLIST.imgSrc, ...(checkoutCsp?.imgSrc ?? [])],
-    frameSrc: [
-      ...(checkoutCsp?.frameSrc ?? []),
-      ...widgetCsp.frameSrc,
-      ...embedCsp.frameSrc,
-    ],
-    formAction: checkoutCsp?.formAction ?? [],
-    reportGroup: CSP_REPORT_GROUP,
-    reportUri: CSP_REPORT_PATH,
-  };
-  // Version-scoped integration plane: APPEND the resolved plan's compiled origins
-  // (curated adapter profiles + advanced exact origins) to the six contributable
-  // directives only — never the base. Absent (no integration) this is a no-op, so
-  // the header is byte-identical to a non-integration tenant's.
-  response.headers.set(
-    cspHeader,
-    buildCsp(foldIntegrationCsp(cspOptions, locals.integrationCsp?.additions ?? {})),
-  );
-
-  // Store the fully-rendered, CSP-stamped response for the next reader. Only
-  // production (no preview token reached here) cacheable GETs have a pageKey;
-  // putCachedPage additionally skips non-200, non-HTML, and cookie-bearing
-  // responses. Also expose Cache-Control to any fronting CDN.
-  if (pageKey && cache && customization.env === "live") {
-    response.headers.set(
-      "Cache-Control",
-      "public, s-maxage=300, stale-while-revalidate=86400",
-    );
-    // Store the nonce-free artifact (the placeholder is still in the body + CSP
-    // header) BEFORE stamping — so the cache never holds a live/reusable nonce.
-    await putCachedPage(cache, pageKey, response);
-  }
-  // Stamp a fresh per-response nonce into this cold response's body + CSP header
-  // (the warm-hit path above stamps its own). Both paths therefore serve a fresh,
-  // matching nonce/CSP pair, and no nonce is reused across responses (ADR 0018).
-  return await stampResponseNonce(response, freshNonce());
 });