@tokenoftrust/storefront-runner 2.0.17 → 2.0.19

package/apps/storefront/src/lib/env.ts

@@ -1,123 +1,25 @@
 /**
- * Runtime env access that works in BOTH contexts:
- *   - `astro dev` (Node): reads import.meta.env / process.env.
- *   - Cloudflare Workers (prod): reads the `cloudflare:workers` env module.
+ * The FULL runtime binding surface: everything in `./runtimeEnv.js` plus the D1
+ * binding. Control-plane code imports this one and gets all of it.
  *
- * Astro v6+/@astrojs/cloudflare v14 REMOVED `Astro.locals.runtime.env`; the
- * supported path is `import { env } from "cloudflare:workers"`. That module only
- * exists in the worker runtime, so we import it lazily + guarded and fall back
- * to build-time env in dev. See DECISIONS.md.
+ * The D1 accessor lives HERE rather than in `runtimeEnv.js` because ADR 0013
+ * keeps a live control-plane read off a tenant's public path, and a
+ * dependency-cruiser fence can only forbid a MODULE — never a symbol. Splitting
+ * `readD1` onto its own import graph is what gives
+ * `public-render-no-request-time-d1` (.dependency-cruiser.cjs) something to
+ * name: the public-render branch reaches `runtimeEnv.js` for the bindings that
+ * serve published bytes (KV cache, R2 bundles) and cannot reach this module at
+ * all, so a request-time D1 handle is unobtainable there rather than merely
+ * unused.
  */
 import type { D1Like } from "./d1/catalog.js";
 
-let workerEnv: Record<string, unknown> | null | undefined;
+export * from "./runtimeEnv.js";
 
-async function getWorkerEnv(): Promise<Record<string, unknown> | null> {
-  if (workerEnv !== undefined) return workerEnv;
-  try {
-    // @ts-expect-error — virtual module, only resolvable in the Workers runtime.
-    const mod = await import("cloudflare:workers");
-    workerEnv = (mod.env ?? null) as Record<string, unknown> | null;
-  } catch {
-    workerEnv = null;
-  }
-  return workerEnv;
-}
-
-function fromBuild(key: string): string | undefined {
-  const meta = import.meta.env as Record<string, string | undefined>;
-  if (meta[key] != null) return meta[key];
-  if (typeof process !== "undefined" && process.env && process.env[key] != null) {
-    return process.env[key];
-  }
-  return undefined;
-}
-
-export async function readEnv(key: string): Promise<string | undefined> {
-  const w = await getWorkerEnv();
-  const wv = w?.[key];
-  if (typeof wv === "string" && wv.length) return wv;
-  return fromBuild(key);
-}
-
-/** The slice of the Workers ExecutionContext runAfterResponse needs — the
- *  @astrojs/cloudflare adapter exposes it to routes as `locals.cfContext`. */
-export interface CfExecutionContextLike {
-  waitUntil(promise: Promise<unknown>): void;
-}
-
-/**
- * Run `work` PAST the response — the request's `ExecutionContext.waitUntil`
- * when the caller passes it, else a detached floating promise (dev/Node). For
- * webhook RECEIVERS that must ACK fast: the upstream forwarder (tot-mcp
- * gitea-webhook proxy) aborts its forward at 15s and Gitea bounds its delivery
- * wait too, while a real reconcile takes tens of seconds — running it inside
- * the request meant every healthy reconcile was killed mid-flight and recorded
- * as `forward_failed` (a layer of Trello 13075, behind the auth fix).
- *
- * CALLERS MUST PASS `locals.cfContext` (the @astrojs/cloudflare adapter's
- * per-request ExecutionContext, `createLocals: { cfContext: ctx }`): in the
- * Workers runtime a merely-floating promise is CANCELLED the moment the
- * response returns — an earlier revision here imported `waitUntil` from
- * `cloudflare:workers` (not exported by this adapter/runtime version), silently
- * degraded to the floating promise, and the async reconcile died unobserved
- * right after its 202. The floating-promise branch is a DEV-ONLY fallback.
- * Errors are the caller's to handle inside `work` (this never throws).
- */
-export function runAfterResponse(
-  work: Promise<unknown>,
-  cfContext?: CfExecutionContextLike | null,
-): void {
-  const swallowed = work.catch(() => {});
-  if (cfContext && typeof cfContext.waitUntil === "function") {
-    cfContext.waitUntil(swallowed);
-    return;
-  }
-  // dev/Node only — in the Workers runtime this promise would be cancelled at
-  // response end, which is exactly the bug the parameter above exists to avoid.
-  void swallowed;
-}
-
-/** KV binding for the newsletter stub / tenant cache, if present in the runtime. */
-export async function readKv(binding: string): Promise<KVNamespace | undefined> {
-  const w = await getWorkerEnv();
-  const b = w?.[binding];
-  return (b as KVNamespace | undefined) ?? undefined;
-}
+import { getWorkerEnv } from "./runtimeEnv.js";
 
 /** D1 catalog binding for the edge read replica, if present in the runtime. */
 export async function readD1(binding: string): Promise<D1Like | undefined> {
   const w = await getWorkerEnv();
   return (w?.[binding] as D1Like | undefined) ?? undefined;
 }
-
-/** R2 bucket binding (e.g. TENANT_ASSETS, PRODUCT_IMAGES), if present. */
-export async function readR2(binding: string): Promise<R2Bucket | undefined> {
-  const w = await getWorkerEnv();
-  return (w?.[binding] as R2Bucket | undefined) ?? undefined;
-}
-
-/**
- * Cloudflare Analytics Engine dataset binding (e.g. ACTIVITY_ANALYTICS), if
- * present. Untyped (`unknown`) deliberately — the caller casts to its own
- * minimal `writeDataPoint` shape (see `activity/store.ts`'s
- * `AnalyticsEngineLike`) rather than this module taking a types dep. Absent in
- * dev/Node and until the binding is provisioned; callers treat undefined as
- * "analytics sink unavailable, skip it" (never an error).
- */
-export async function readAnalytics(binding: string): Promise<unknown | undefined> {
-  const w = await getWorkerEnv();
-  return w?.[binding] ?? undefined;
-}
-
-/**
- * Cloudflare Queue producer binding (e.g. WEBHOOK_DELIVERY_QUEUE), if present.
- * Untyped (`unknown`) deliberately — callers cast to their own minimal
- * queue-shape interface (see `webhooks/cloudflareQueueDispatcher.ts`'s
- * `CloudflareQueueSender`) rather than this module taking a types dep on a
- * specific binding's shape.
- */
-export async function readQueue(binding: string): Promise<unknown | undefined> {
-  const w = await getWorkerEnv();
-  return w?.[binding] ?? undefined;
-}

package/apps/storefront/src/lib/integration/tenantAnalyticsDeclarations.ts

@@ -0,0 +1,198 @@
+/**
+ * Tenant-owned analytics declaration surface (TIER 1).
+ *
+ * Today a tenant cannot declare a measurement destination from its OWN tree: the
+ * declaration lives in `tenant.integrations` (apps/storefront/src/config/tenants.ts),
+ * which is platform code a tenant may not touch (customization golden rule #1). So a
+ * merchant must file a request for what should be a self-serve, versioned, publishable
+ * edit — exactly like `theme.json` or `content/*`.
+ *
+ * This module is the tenant-tree producer that closes that gap. A tenant commits an
+ * `analytics.json` in its own tree (the tenant-owned surface, `tenants/<id>/**`), and
+ * this materializes it into the SAME already-consumed declaration seam
+ * ({@link IntegrationDeclarationInput}[], read by
+ * {@link loadTenantIntegrationDeclarations} and merged into the render plan by the
+ * interim bridge). It adds NO new runtime: it is a THIRD producer into an existing
+ * consumer, alongside the platform-authored `tenant.integrations` and the D1-backed
+ * managed installs.
+ *
+ * The heavy validation is NOT hand-rolled — each declared destination is built by the
+ * shipped, reviewed {@link buildPlatformAdapterDeclaration}, which fail-closes on an
+ * unknown adapter, a missing/invalid live id, an invalid per-stage id, or a non-live
+ * stage that reuses the live id. That is the whole point: a tenant supplies only public
+ * per-stage destination ids and gets a working, consent-gated, CSP-clean, non-live-safe
+ * measurement integration with no renderer change.
+ *
+ * Two callers, one core:
+ *   - PUBLISH validation — {@link materializeTenantAnalyticsDeclarations} returns
+ *     structured {@link ContractViolation}s so the ship/customization pipeline can
+ *     REFUSE an invalid `analytics.json` with an actionable, per-field message, exactly
+ *     as it refuses an invalid `theme.json`.
+ *   - RUNTIME materialization — {@link loadTenantAnalyticsDeclarations} is fail-closed:
+ *     a missing or (defensively) invalid file yields the empty set, never a throw, so an
+ *     undeclared tenant resolves the environment-only plan and a byte-identical page.
+ */
+import {
+  buildPlatformAdapterDeclaration,
+  ENVIRONMENT_SCHEMA_VERSION,
+  Violations,
+  isPlainObject,
+  rejectUnknownKeys,
+  type BrowserEnvironment,
+  type ContractViolation,
+  type IntegrationDeclarationInput,
+} from "@tot/public-runtime";
+
+/** The tenant-owned file that declares measurement destinations, in the tenant tree. */
+export const TENANT_ANALYTICS_FILE = "analytics.json";
+
+/** The current `analytics.json` contract version. */
+export const TENANT_ANALYTICS_SCHEMA_VERSION = 1 as const;
+
+/** One declared measurement destination: a first-class adapter + its per-stage public ids. */
+export interface TenantAnalyticsDestination {
+  /** The first-class platform adapter id, e.g. `platform.google-measurement`. */
+  adapter: string;
+  /** Public per-stage destination ids. `live` is required; non-live stages take SEPARATE test ids. */
+  ids: Record<string, unknown>;
+}
+
+/** The result of materializing a tenant's `analytics.json` into declarations. */
+export interface TenantAnalyticsMaterialization {
+  /** True only when EVERY declared destination validated; false surfaces `violations`. */
+  ok: boolean;
+  /** The materialized declarations, in declared order. Empty whenever `ok` is false. */
+  declarations: readonly IntegrationDeclarationInput[];
+  /** Per-field violations for the publish surface. Empty whenever `ok` is true. */
+  violations: readonly ContractViolation[];
+}
+
+/**
+ * The fixed environment the declaration is CONSTRUCTED against. A first-class adapter
+ * declaration is environment-INDEPENDENT in content — its per-stage ids are all baked
+ * into `publicConfig` and the client picks the current stage at render time — so the
+ * environment here only satisfies {@link buildPlatformAdapterDeclaration}'s validation
+ * and its (discarded) plan resolution. `canonicalHost` is a fixed placeholder, never the
+ * tenant id, so a clone id (which is not a legal hostname) can never fail construction.
+ */
+const CONSTRUCTION_ENVIRONMENT: BrowserEnvironment = {
+  schemaVersion: ENVIRONMENT_SCHEMA_VERSION,
+  siteSurface: "storefront",
+  environment: "live",
+  canonicalHost: "tenant-analytics.invalid",
+  revision: "tenant-analytics-declaration",
+};
+
+const EMPTY: readonly IntegrationDeclarationInput[] = Object.freeze([]);
+
+/** Re-anchor a builder violation path under the declaring `destinations[i]` element. */
+function reanchor(violation: ContractViolation, index: number): ContractViolation {
+  const base = `destinations[${index}]`;
+  const path =
+    violation.path === "(root)" || violation.path === ""
+      ? base
+      : violation.path === "adapterId"
+        ? `${base}.adapter`
+        : violation.path.startsWith("adapterId.")
+          ? `${base}.adapter${violation.path.slice("adapterId".length)}`
+          : `${base}.${violation.path}`;
+  return { path, code: violation.code, message: violation.message };
+}
+
+/** Validate the closed shape of one declared destination before it reaches the builder. */
+function readDestination(
+  raw: unknown,
+  index: number,
+  v: Violations,
+): TenantAnalyticsDestination | undefined {
+  const base = `destinations[${index}]`;
+  if (!isPlainObject(raw)) {
+    v.add(base, "type", "A destination must be an object of { adapter, ids }.");
+    return undefined;
+  }
+  rejectUnknownKeys(raw, ["adapter", "ids"], v, base);
+  const adapter = raw["adapter"];
+  if (typeof adapter !== "string" || adapter.length === 0) {
+    v.add(`${base}.adapter`, "type", "A destination adapter must be a non-empty string.");
+    return undefined;
+  }
+  if (!isPlainObject(raw["ids"])) {
+    v.add(`${base}.ids`, "type", "ids must be an object of { stage: destinationId }.");
+    return undefined;
+  }
+  return { adapter, ids: raw["ids"] };
+}
+
+/**
+ * Parse and materialize a tenant's `analytics.json` content into first-class adapter
+ * declarations. `raw` is the already-parsed JSON value (or `undefined`/`null` when the
+ * tenant declares none). Fail-closed and whole-file: if ANY declared destination is
+ * invalid, NO declaration is produced and the violations name every offending field —
+ * a half-valid analytics file never partially materializes.
+ */
+export function materializeTenantAnalyticsDeclarations(input: {
+  raw: unknown;
+  tenantPublicId: string;
+}): TenantAnalyticsMaterialization {
+  const { raw, tenantPublicId } = input;
+  // An undeclared tenant (no file) is the zero-cost norm, not an error.
+  if (raw === undefined || raw === null) {
+    return { ok: true, declarations: EMPTY, violations: [] };
+  }
+
+  const v = new Violations();
+  if (!isPlainObject(raw)) {
+    v.add("(root)", "type", "analytics.json must be a JSON object with a `destinations` array.");
+    return { ok: false, declarations: EMPTY, violations: v.items };
+  }
+  rejectUnknownKeys(raw, ["schemaVersion", "destinations"], v, "");
+  if ("schemaVersion" in raw && raw["schemaVersion"] !== TENANT_ANALYTICS_SCHEMA_VERSION) {
+    v.add(
+      "schemaVersion",
+      "unsupported_version",
+      `schemaVersion must equal ${TENANT_ANALYTICS_SCHEMA_VERSION}.`,
+    );
+  }
+  const destinationsRaw = raw["destinations"];
+  if (!Array.isArray(destinationsRaw)) {
+    v.add("destinations", "type", "`destinations` must be an array.");
+    return { ok: false, declarations: EMPTY, violations: v.items };
+  }
+
+  const declarations: IntegrationDeclarationInput[] = [];
+  destinationsRaw.forEach((destinationRaw, index) => {
+    const destination = readDestination(destinationRaw, index, v);
+    if (!destination) return;
+    const built = buildPlatformAdapterDeclaration({
+      adapterId: destination.adapter,
+      ids: destination.ids,
+      tenantPublicId,
+      environment: CONSTRUCTION_ENVIRONMENT,
+    });
+    if (!built.ok) {
+      for (const violation of built.violations) v.items.push(reanchor(violation, index));
+      return;
+    }
+    // Namespace the ref so a tenant-declared adapter can never be mistaken for — or
+    // collide with — the same adapter installed through the managed D1 path.
+    declarations.push({ ...built.declaration, ref: `tenant-analytics:${destination.adapter}` });
+  });
+
+  if (!v.ok) return { ok: false, declarations: EMPTY, violations: v.items };
+  return { ok: true, declarations, violations: [] };
+}
+
+/**
+ * Read a tenant's already-materialized analytics declarations for the render hot path,
+ * fail-closed: a missing OR invalid file yields the empty set (never throws), so an
+ * undeclared tenant resolves the environment-only plan and a defensively-invalid file
+ * darks its own analytics rather than the page. Publish validation
+ * ({@link materializeTenantAnalyticsDeclarations}) is what keeps an invalid file from
+ * ever reaching here.
+ */
+export function loadTenantAnalyticsDeclarations(
+  raw: unknown,
+  tenantPublicId: string,
+): readonly IntegrationDeclarationInput[] {
+  return materializeTenantAnalyticsDeclarations({ raw, tenantPublicId }).declarations;
+}

package/apps/storefront/src/lib/monitoring/manifest.ts

@@ -115,7 +115,7 @@ export const MONITORS: readonly Monitor[] = [
     title: "Page / Worker errors (5xx + unhandled exceptions)",
     category: "availability",
     signal: {
-      source: "Cloudflare Worker exceptions + non-2xx responses from middleware/index.ts render path",
+      source: "Cloudflare Worker exceptions + non-2xx responses from the middleware render path",
       observe: "Workers 'Errors' metric + Logpush; alert on error-rate over the request baseline",
     },
     threshold: "5xx rate > 1% over 5m, or any sustained unhandled-exception stream",

package/apps/storefront/src/lib/publication/contentProvider.ts

@@ -0,0 +1,159 @@
+import type {
+  OpenPublicationArtifactV1,
+  PublicationRouteRenderPlanV1,
+} from "@tot/public-runtime";
+import type { EditorialPage, HomeContent } from "@/lib/storyblok/content-model.js";
+import type { ChromeConfig } from "@/lib/chrome/model.js";
+import { parseChromeConfig } from "@/lib/chrome/parseConfig.js";
+import { parseChromeAssignments } from "@/lib/chrome/model.js";
+import { renderRawChrome } from "@/lib/rawChrome.js";
+import { stampTrackingIdsAtPublish } from "@/lib/tracking/publishSafetyNet.js";
+import type { ContentProvider } from "@/lib/storyblok/provider.js";
+
+const EMPTY_CHROME_CONFIG: ChromeConfig = {
+  header: { variant: "primary", brand: { label: "" }, nav: [] },
+  footer: { variant: "default", columns: [] },
+};
+
+function parseJson<T>(raw: string | null): T | null {
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+function stripSlashes(value: string): string {
+  return value.replace(/^\/+|\/+$/g, "");
+}
+
+/**
+ * Map the canonical Astro catch-all slug back to the already-resolved source
+ * root. The plan, not string-prefix guessing, owns which mount is stripped.
+ */
+function selectedPageSlug(plan: PublicationRouteRenderPlanV1, slug: string): string | null {
+  const requested = stripSlashes(slug);
+  const canonical = stripSlashes(plan.canonicalPath);
+  if (requested !== canonical) return null;
+  return stripSlashes(plan.contentPath);
+}
+
+function canonicalSlugForMount(plan: PublicationRouteRenderPlanV1, sourceSlug: string): string {
+  const mount = stripSlashes(plan.manifest.routes.canonicalMount);
+  const source = stripSlashes(sourceSlug);
+  return [mount, source].filter(Boolean).join("/");
+}
+
+function rebasePage(
+  plan: PublicationRouteRenderPlanV1,
+  page: EditorialPage,
+  canonicalSlug = canonicalSlugForMount(plan, page.slug),
+): EditorialPage {
+  return { ...page, slug: canonicalSlug };
+}
+
+/**
+ * Existing Storefront renderer adapter for one already-opened publication
+ * version. Selected page/blog artifacts never fall through to another source;
+ * a mounted space reuses only the root space's shared chrome/home services.
+ */
+export class PublicationSpaceContentProvider implements ContentProvider {
+  constructor(
+    private readonly sharedRoot: ContentProvider,
+    private readonly publication: OpenPublicationArtifactV1,
+  ) {}
+
+  private get plan(): PublicationRouteRenderPlanV1 {
+    return this.publication.selection;
+  }
+
+  private get ownsRoot(): boolean {
+    return this.plan.manifest.routes.canonicalMount === "/";
+  }
+
+  async getHome(): Promise<HomeContent> {
+    if (!this.ownsRoot) return this.sharedRoot.getHome();
+    const home = parseJson<HomeContent>(this.publication.readContent("home.json"));
+    if (!home) throw new Error("selected root publication home is unavailable");
+    return home;
+  }
+
+  async getHomeHtml(): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getHomeHtml();
+    const raw = this.publication.readContent("home.html");
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async getPageHtml(slug: string): Promise<string | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (selected === null) return null;
+    const raw = this.publication.readContent(
+      selected ? `pages-html/${selected}.html` : "home.html",
+    );
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async listPageHtmlSlugs(): Promise<string[]> {
+    return this.publication.listContentPaths("pages-html/")
+      .filter((path) => path.endsWith(".html"))
+      .map((path) => canonicalSlugForMount(
+        this.plan,
+        path.slice("pages-html/".length, -".html".length),
+      ));
+  }
+
+  async getChromeHtml(currentPath?: string): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getChromeHtml(currentPath);
+    const html = this.publication.readContent("chrome.html");
+    if (html !== null) return stampTrackingIdsAtPublish(html);
+    const config = parseChromeConfig(parseJson(this.publication.readContent("chrome.json")));
+    if (!config) return null;
+    const assignments = parseChromeAssignments(
+      parseJson(this.publication.readContent("chrome-assignments.json")),
+    );
+    return renderRawChrome(config, currentPath, assignments);
+  }
+
+  async getChrome(): Promise<ChromeConfig> {
+    if (!this.ownsRoot) return this.sharedRoot.getChrome();
+    return parseChromeConfig(parseJson(this.publication.readContent("chrome.json"))) ??
+      EMPTY_CHROME_CONFIG;
+  }
+
+  async getPage(slug: string): Promise<EditorialPage | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (!selected) return null;
+    const page = (await this.sourcePages()).find((candidate) => candidate.slug === selected);
+    return page ? rebasePage(this.plan, page, stripSlashes(this.plan.canonicalPath)) : null;
+  }
+
+  async listPages(): Promise<EditorialPage[]> {
+    return (await this.sourcePages()).map((page) => rebasePage(this.plan, page));
+  }
+
+  private async sourcePages(): Promise<EditorialPage[]> {
+    return this.publication.listContentPaths("pages/")
+      .filter((path) => path.endsWith(".json"))
+      .map((path) => parseJson<EditorialPage>(this.publication.readContent(path)))
+      .filter((page): page is EditorialPage => page !== null);
+  }
+
+  async readArtifact(relative: string): Promise<string | null> {
+    return this.publication.readContent(relative);
+  }
+
+  async listArtifactPaths(prefix = ""): Promise<string[]> {
+    return this.publication.listContentPaths(prefix);
+  }
+}
+
+/** Bind an opened exact publication into the existing renderer provider chain. */
+export function bindPublicationSpaceContentProviderV1(
+  sharedRoot: ContentProvider,
+  publication?: OpenPublicationArtifactV1,
+): ContentProvider {
+  return publication
+    ? new PublicationSpaceContentProvider(sharedRoot, publication)
+    : sharedRoot;
+}

package/apps/storefront/src/lib/publication/runtimeSource.ts

@@ -0,0 +1,97 @@
+import {
+  openPublicationArtifactV1,
+  parsePublicationVersionStateV1Json,
+  publicationRoutePlanIsCurrentV1,
+  publicationVersionStateKey,
+  type OpenPublicationArtifactV1,
+  type PublicationArtifactBucketV1,
+  type PublicationArtifactOpenFailureCodeV1,
+  type PublicationChannelV1,
+  type PublicationRoutePlanV1,
+  type RouteTierIndexV1,
+} from "@tot/public-runtime";
+
+export interface PublicationStateStoreV1 {
+  get(key: string): Promise<string | null>;
+}
+
+export interface PublicationPageCacheScopeV1 {
+  spaceId: string;
+  channel: PublicationChannelV1;
+  pointerRevision: number;
+  versionId: string;
+  artifactDigest: string;
+}
+
+export type PublicationRuntimeSourceV1 =
+  | { status: "legacy-root" }
+  | {
+      status: "selected";
+      artifact: OpenPublicationArtifactV1;
+      cacheScope: PublicationPageCacheScopeV1;
+    }
+  | { status: "unavailable"; code: PublicationArtifactOpenFailureCodeV1 };
+
+/**
+ * Resolve one live request from the public KV state projection into its exact
+ * immutable artifact. A carried plan is checked against current route authority
+ * before state or object-store I/O. Only an unselected root keeps the legacy
+ * adapter; a mounted space never falls through to root content.
+ */
+export async function resolvePublicationRuntimeSourceV1(input: {
+  index: RouteTierIndexV1;
+  requestPath: string;
+  plan: PublicationRoutePlanV1;
+  channel: PublicationChannelV1;
+  store?: PublicationStateStoreV1;
+  bucket?: PublicationArtifactBucketV1;
+}): Promise<PublicationRuntimeSourceV1> {
+  if (input.plan.action !== "render") return { status: "legacy-root" };
+  if (!publicationRoutePlanIsCurrentV1(input.index, input.requestPath, input.plan)) {
+    return { status: "unavailable", code: "publication_route_authority_mismatch" };
+  }
+  const isRoot = input.plan.manifest.routes.canonicalMount === "/";
+  if (!input.store) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+
+  let stateJson: string | null;
+  try {
+    stateJson = await input.store.get(publicationVersionStateKey(input.plan.manifest.tenant));
+  } catch {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  if (stateJson === null) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+  const state = parsePublicationVersionStateV1Json(stateJson);
+  if (!state.ok) return { status: "unavailable", code: "publication_state_malformed" };
+  if (!input.bucket) {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  const opened = await openPublicationArtifactV1({
+    index: input.index,
+    requestPath: input.requestPath,
+    plan: input.plan,
+    state: state.value,
+    channel: input.channel,
+    bucket: input.bucket,
+  });
+  if (!opened.ok) return { status: "unavailable", code: opened.code };
+  const { selection } = opened.value;
+  return {
+    status: "selected",
+    artifact: opened.value,
+    cacheScope: {
+      spaceId: selection.manifest.id,
+      channel: selection.channel,
+      pointerRevision: selection.pointer.revision,
+      versionId: selection.publicationVersion.versionId,
+      artifactDigest: selection.publicationVersion.artifactDigest,
+    },
+  };
+}

package/apps/storefront/src/lib/rawMarketingHtml.ts

@@ -19,6 +19,7 @@ import {
   renderIntegrationPhases,
   INTERACTION_TRACKING_BOOT_JS,
   type EffectivePlan,
+  type ConsentSnapshot,
 } from "@tot/public-runtime";
 import { reportTrackingChainHealth } from "./tracking/interactionHealth.js";
 
@@ -180,6 +181,13 @@ export function rawHtmlResponse(
      * silently omit it. Nonces are stamped per response, never serialized (ADR 0018).
      */
     plan: EffectivePlan;
+    /**
+     * The tenant's actual initial consent snapshot (see Layout.astro's identical
+     * prop). Optional: omitting it falls back to the fail-closed essential-only
+     * default, matching every render path that has not resolved a tenant consent
+     * config (candidate/preview renders).
+     */
+    consentSnapshot?: ConsentSnapshot;
   },
 ): Response {
   let composed =
@@ -222,7 +230,7 @@ export function rawHtmlResponse(
   // per-response nonce placeholder; the middleware substitutes a fresh nonce at serve
   // time (ADR 0018), so the same engine output feeds both mounts identically.
   composed = nonceInlineTags(composed, opts.nonce);
-  const phases = renderIntegrationPhases(opts.plan, opts.nonce);
+  const phases = renderIntegrationPhases(opts.plan, opts.nonce, opts.consentSnapshot);
   composed = injectHeadStart(composed, phases.head);
   composed = injectBodyStart(composed, phases.bodyStart);
   composed = injectBodyEnd(composed, phases.bodyDeferred);