@tokenoftrust/storefront-runner 2.0.18 → 2.0.19

package/apps/storefront/env.d.ts

@@ -12,6 +12,7 @@ import type {
   EffectivePlan,
   ConsentSnapshot,
   ResolvedRouteTierV1,
+  PublicationRoutePlanV1,
 } from "@tot/public-runtime";
 import type { ToTClient } from "@/lib/tot/ToTClient";
 import type { ContentProvider } from "@/lib/storyblok/provider";
@@ -112,6 +113,8 @@ declare global {
        * served it. Downstream code reads this rather than re-deriving a tier.
        */
       routeTier: ResolvedRouteTierV1;
+      /** Normalized publication mount/canonical/content plan for this request. */
+      publicationRoute: PublicationRoutePlanV1;
       /**
        * Effective capability flags for the resolved tenant (commerce defaults
        * unless siteType:"marketing"/explicit features). Chrome, layout islands,

package/apps/storefront/src/lib/auth/brokerAssertion.ts

@@ -79,6 +79,17 @@ export interface MintBrokerAssertionOverrides {
   issuer?: string;
 }
 
+/** Mint a broker assertion whose subject is an opaque verified identity id. */
+export async function mintOpaqueBrokerAssertion(
+  opaqueSubject: string,
+  overrides: MintBrokerAssertionOverrides = {},
+): Promise<string> {
+  if (!opaqueSubject || opaqueSubject.trim().length === 0) {
+    throw new BrokerAssertionError("broker assertion: an opaque subject is required");
+  }
+  return mintBrokerAssertionSubject(opaqueSubject, overrides);
+}
+
 // Import the signing key once per distinct PEM (importPKCS8 is not free). Keyed on
 // the base64 string so a key rotation (new env value) transparently re-imports.
 const keyCache = new Map<string, CryptoKey>();
@@ -137,6 +148,13 @@ export async function mintBrokerAssertion(
   if (!sub) {
     throw new BrokerAssertionError("broker assertion: a subject email is required");
   }
+  return mintBrokerAssertionSubject(sub, overrides);
+}
+
+async function mintBrokerAssertionSubject(
+  sub: string,
+  overrides: MintBrokerAssertionOverrides,
+): Promise<string> {
   const privateKeyB64 = overrides.privateKeyB64 ?? (await readEnv(BROKER_PRIVATE_KEY_ENV));
   if (!privateKeyB64) {
     throw new BrokerAssertionError(

package/apps/storefront/src/lib/auth/identityToken.ts

@@ -104,6 +104,10 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
   if (typeof email !== "string" || !email) {
     throw new Error("identity assertion missing `email` claim");
   }
+  const subject = payload.sub;
+  if (typeof subject !== "string" || subject.trim().length === 0) {
+    throw new Error("identity assertion missing `sub` claim");
+  }
   const tenantsRaw = Array.isArray(payload.tenants) ? payload.tenants : [];
   const tenants: TenantMembership[] = tenantsRaw.map((t): TenantMembership => {
     const entry = t as { resource?: unknown; role?: unknown };
@@ -118,7 +122,7 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
 
   const claims: IdentityClaims = {
     iss: String(payload.iss ?? ""),
-    sub: String(payload.sub ?? email),
+    sub: subject,
     aud: String(payload.aud ?? ""),
     iat: Number(payload.iat ?? 0),
     exp: Number(payload.exp ?? 0),
@@ -281,6 +285,8 @@ export async function getFederatedVerifier(
 
 /** The session fields derived from the VERIFIED token — the Phase-3 source of truth. */
 export interface DerivedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   resource: string;
   /** Coarse standing on THIS resource, surfaced as the display capability. */
@@ -307,6 +313,7 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
     throw new Error(`verified assertion carries no membership for resource "${resource}"`);
   }
   return {
+    subject: claims.sub,
     email: claims.email,
     resource,
     capability: membership.role,
@@ -318,6 +325,8 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
 
 /** The multi-tenant fields derived from a verified FEDERATED assertion. */
 export interface FederatedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   /** The verified `aud` — the storefront app identity this console session is for. */
   resource: string;
@@ -341,6 +350,7 @@ export interface FederatedSessionFields {
  */
 export function sessionFromFederatedClaims(claims: IdentityClaims): FederatedSessionFields {
   const fields: FederatedSessionFields = {
+    subject: claims.sub,
     email: claims.email,
     resource: claims.aud,
     tenants: claims.tenants,

package/apps/storefront/src/lib/auth/internalContentAuthority.ts

@@ -0,0 +1,153 @@
+import type { PublicationRoutePlanV1, ResolvedRouteTierV1 } from "@tot/public-runtime";
+import type { SessionRecord, SessionStore } from "./session.js";
+import { readSession } from "./session.js";
+
+export const INTERNAL_CONTENT_CAPABILITY = "internal-content-reader" as const;
+export const INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS = 5_000;
+
+export type InternalContentAuthorityDecision =
+  | { allowed: true; tenant: string; spaceId: string; audience: "owner" | "developer" }
+  | { allowed: false; reason: "denied" | "unavailable" };
+
+export type InternalContentGrant = Extract<InternalContentAuthorityDecision, { allowed: true }>;
+
+interface BrokerContext {
+  appDomain: string;
+  audience: string;
+}
+
+export interface InternalContentAuthorityInput {
+  route: ResolvedRouteTierV1;
+  sessionStore?: SessionStore;
+  sessionId?: string | null;
+  coreUrl?: string | null;
+  mintAssertion: (subject: string) => Promise<string>;
+  fetchImpl?: typeof fetch;
+  nowSeconds?: number;
+}
+
+function routeIsDeclaredInternal(route: ResolvedRouteTierV1): route is ResolvedRouteTierV1 & {
+  space: NonNullable<ResolvedRouteTierV1["space"]>;
+} {
+  return route.origin === "publication-space" &&
+    route.requiresAuthorization &&
+    route.visibility === "internal" &&
+    route.authorization.policy === "capability" &&
+    route.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    route.assets.access === "authorized" &&
+    !!route.space &&
+    route.space.tenant === route.tenant;
+}
+
+function brokerContexts(value: unknown): BrokerContext[] | null {
+  const unwrapped = value && typeof value === "object" && "content" in value
+    ? (value as { content?: unknown }).content
+    : value;
+  if (!unwrapped || typeof unwrapped !== "object") return null;
+  const contexts = (unwrapped as { contexts?: unknown }).contexts;
+  if (!Array.isArray(contexts)) return null;
+  const parsed: BrokerContext[] = [];
+  for (const context of contexts) {
+    if (!context || typeof context !== "object") return null;
+    const appDomain = (context as { appDomain?: unknown }).appDomain;
+    const audience = (context as { audience?: unknown }).audience;
+    if (typeof appDomain !== "string" || typeof audience !== "string") return null;
+    parsed.push({ appDomain, audience });
+  }
+  return parsed;
+}
+
+/**
+ * Resolve internal-content authority from fresh broker state. The session is
+ * identity proof only: cached memberships, roles, headers, and preview state do
+ * not grant access. Every store/read/signing fault is an explicit unavailable
+ * result and callers serve the same non-disclosing denial response.
+ */
+export async function authorizeInternalContentRequest(
+  input: InternalContentAuthorityInput,
+): Promise<InternalContentAuthorityDecision> {
+  if (!routeIsDeclaredInternal(input.route)) return { allowed: false, reason: "denied" };
+  if (!input.sessionStore || !input.sessionId) return { allowed: false, reason: "denied" };
+
+  let session: SessionRecord | null;
+  try {
+    session = await readSession(
+      input.sessionStore,
+      input.sessionId,
+      input.nowSeconds ?? Math.floor(Date.now() / 1000),
+    );
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  const subject = session?.subject;
+  if (!subject || subject.trim().length === 0) {
+    return { allowed: false, reason: "denied" };
+  }
+
+  const coreUrl = (input.coreUrl ?? "").replace(/\/+$/, "");
+  if (!coreUrl) return { allowed: false, reason: "unavailable" };
+
+  let assertion: string;
+  try {
+    assertion = await input.mintAssertion(subject);
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+
+  let response: Response;
+  try {
+    response = await (input.fetchImpl ?? fetch)(`${coreUrl}/api/broker/appDomains`, {
+      method: "GET",
+      headers: {
+        accept: "application/json",
+        "X-ToT-Broker-Assertion": assertion,
+      },
+      signal: AbortSignal.timeout(INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS),
+    });
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  if (!response.ok) return { allowed: false, reason: "unavailable" };
+
+  let contexts: BrokerContext[] | null;
+  try {
+    contexts = brokerContexts(await response.json());
+  } catch {
+    contexts = null;
+  }
+  if (!contexts) return { allowed: false, reason: "unavailable" };
+
+  const matching = contexts.filter((context) => context.appDomain === input.route.tenant);
+  if (matching.length !== 1) return { allowed: false, reason: "denied" };
+  const audience = matching[0]!.audience;
+  if (audience !== "owner" && audience !== "developer") {
+    return { allowed: false, reason: "denied" };
+  }
+  return {
+    allowed: true,
+    tenant: input.route.tenant,
+    spaceId: input.route.space.spaceId,
+    audience,
+  };
+}
+
+/** Prove the carried grant still names the exact server-resolved F2 space. */
+export function internalContentGrantMatchesPlan(
+  grant: InternalContentGrant | undefined,
+  plan: PublicationRoutePlanV1,
+): boolean {
+  return !!grant && plan.action === "render" &&
+    plan.manifest.visibility === "internal" &&
+    plan.manifest.authorization.policy === "capability" &&
+    plan.manifest.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    plan.manifest.assets.access === "authorized" &&
+    grant.tenant === plan.route.tenant &&
+    grant.tenant === plan.manifest.tenant &&
+    grant.spaceId === plan.manifest.id;
+}
+
+/** Internal responses are never indexable or eligible for shared storage. */
+export function applyInternalContentResponsePolicy(headers: Headers): void {
+  headers.set("Cache-Control", "private, no-store");
+  headers.set("X-Robots-Tag", "noindex, nofollow");
+}

package/apps/storefront/src/lib/auth/session.ts

@@ -50,6 +50,8 @@ export const DEFAULT_SESSION_TTL_SECONDS = 7 * 24 * 3600;
  * are the multi-tenant claims carried in the verified token.
  */
 export interface SessionRecord {
+  /** Opaque identity-provider subject from the verified assertion. */
+  subject?: string;
   /** Verified email (lowercased) — the principal that passed the grant check. */
   email: string;
   /** The resource (appDomain/tenant, e.g. "sample-store.example") this session authorizes. */
@@ -166,6 +168,7 @@ export async function readSession(
     !record ||
     typeof record.email !== "string" ||
     typeof record.resource !== "string" ||
+    (record.subject !== undefined && typeof record.subject !== "string") ||
     typeof record.exp !== "number"
   ) {
     await store.delete(id);

package/apps/storefront/src/lib/edgeCache.ts

@@ -64,6 +64,13 @@ export function pageCacheKey(
   search: string,
   version: number,
   planRevision?: string,
+  publication?: {
+    spaceId: string;
+    channel: "preview" | "live";
+    pointerRevision: number;
+    versionId: string;
+    artifactDigest: string;
+  },
 ): Request {
   // A stored page carries the CSP header it was rendered with, INCLUDING any
   // version-scoped integration origins. Folding the resolved `planRevision` into
@@ -73,8 +80,17 @@ export function pageCacheKey(
   // integration plane resolved) the key is byte-identical to the non-integration
   // form, so a plain tenant pays nothing and its cache is never busted.
   const planSegment = planRevision ? `/pr:${planRevision}` : "";
+  const publicationSegment = publication
+    ? `/publication:${encodeURIComponent([
+        publication.spaceId,
+        publication.channel,
+        publication.pointerRevision,
+        publication.versionId,
+        publication.artifactDigest,
+      ].join(":"))}`
+    : "";
   return new Request(
-    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${pathname}${search}`,
+    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${publicationSegment}${pathname}${search}`,
   );
 }
 

package/apps/storefront/src/lib/publication/contentProvider.ts

@@ -0,0 +1,159 @@
+import type {
+  OpenPublicationArtifactV1,
+  PublicationRouteRenderPlanV1,
+} from "@tot/public-runtime";
+import type { EditorialPage, HomeContent } from "@/lib/storyblok/content-model.js";
+import type { ChromeConfig } from "@/lib/chrome/model.js";
+import { parseChromeConfig } from "@/lib/chrome/parseConfig.js";
+import { parseChromeAssignments } from "@/lib/chrome/model.js";
+import { renderRawChrome } from "@/lib/rawChrome.js";
+import { stampTrackingIdsAtPublish } from "@/lib/tracking/publishSafetyNet.js";
+import type { ContentProvider } from "@/lib/storyblok/provider.js";
+
+const EMPTY_CHROME_CONFIG: ChromeConfig = {
+  header: { variant: "primary", brand: { label: "" }, nav: [] },
+  footer: { variant: "default", columns: [] },
+};
+
+function parseJson<T>(raw: string | null): T | null {
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+function stripSlashes(value: string): string {
+  return value.replace(/^\/+|\/+$/g, "");
+}
+
+/**
+ * Map the canonical Astro catch-all slug back to the already-resolved source
+ * root. The plan, not string-prefix guessing, owns which mount is stripped.
+ */
+function selectedPageSlug(plan: PublicationRouteRenderPlanV1, slug: string): string | null {
+  const requested = stripSlashes(slug);
+  const canonical = stripSlashes(plan.canonicalPath);
+  if (requested !== canonical) return null;
+  return stripSlashes(plan.contentPath);
+}
+
+function canonicalSlugForMount(plan: PublicationRouteRenderPlanV1, sourceSlug: string): string {
+  const mount = stripSlashes(plan.manifest.routes.canonicalMount);
+  const source = stripSlashes(sourceSlug);
+  return [mount, source].filter(Boolean).join("/");
+}
+
+function rebasePage(
+  plan: PublicationRouteRenderPlanV1,
+  page: EditorialPage,
+  canonicalSlug = canonicalSlugForMount(plan, page.slug),
+): EditorialPage {
+  return { ...page, slug: canonicalSlug };
+}
+
+/**
+ * Existing Storefront renderer adapter for one already-opened publication
+ * version. Selected page/blog artifacts never fall through to another source;
+ * a mounted space reuses only the root space's shared chrome/home services.
+ */
+export class PublicationSpaceContentProvider implements ContentProvider {
+  constructor(
+    private readonly sharedRoot: ContentProvider,
+    private readonly publication: OpenPublicationArtifactV1,
+  ) {}
+
+  private get plan(): PublicationRouteRenderPlanV1 {
+    return this.publication.selection;
+  }
+
+  private get ownsRoot(): boolean {
+    return this.plan.manifest.routes.canonicalMount === "/";
+  }
+
+  async getHome(): Promise<HomeContent> {
+    if (!this.ownsRoot) return this.sharedRoot.getHome();
+    const home = parseJson<HomeContent>(this.publication.readContent("home.json"));
+    if (!home) throw new Error("selected root publication home is unavailable");
+    return home;
+  }
+
+  async getHomeHtml(): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getHomeHtml();
+    const raw = this.publication.readContent("home.html");
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async getPageHtml(slug: string): Promise<string | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (selected === null) return null;
+    const raw = this.publication.readContent(
+      selected ? `pages-html/${selected}.html` : "home.html",
+    );
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async listPageHtmlSlugs(): Promise<string[]> {
+    return this.publication.listContentPaths("pages-html/")
+      .filter((path) => path.endsWith(".html"))
+      .map((path) => canonicalSlugForMount(
+        this.plan,
+        path.slice("pages-html/".length, -".html".length),
+      ));
+  }
+
+  async getChromeHtml(currentPath?: string): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getChromeHtml(currentPath);
+    const html = this.publication.readContent("chrome.html");
+    if (html !== null) return stampTrackingIdsAtPublish(html);
+    const config = parseChromeConfig(parseJson(this.publication.readContent("chrome.json")));
+    if (!config) return null;
+    const assignments = parseChromeAssignments(
+      parseJson(this.publication.readContent("chrome-assignments.json")),
+    );
+    return renderRawChrome(config, currentPath, assignments);
+  }
+
+  async getChrome(): Promise<ChromeConfig> {
+    if (!this.ownsRoot) return this.sharedRoot.getChrome();
+    return parseChromeConfig(parseJson(this.publication.readContent("chrome.json"))) ??
+      EMPTY_CHROME_CONFIG;
+  }
+
+  async getPage(slug: string): Promise<EditorialPage | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (!selected) return null;
+    const page = (await this.sourcePages()).find((candidate) => candidate.slug === selected);
+    return page ? rebasePage(this.plan, page, stripSlashes(this.plan.canonicalPath)) : null;
+  }
+
+  async listPages(): Promise<EditorialPage[]> {
+    return (await this.sourcePages()).map((page) => rebasePage(this.plan, page));
+  }
+
+  private async sourcePages(): Promise<EditorialPage[]> {
+    return this.publication.listContentPaths("pages/")
+      .filter((path) => path.endsWith(".json"))
+      .map((path) => parseJson<EditorialPage>(this.publication.readContent(path)))
+      .filter((page): page is EditorialPage => page !== null);
+  }
+
+  async readArtifact(relative: string): Promise<string | null> {
+    return this.publication.readContent(relative);
+  }
+
+  async listArtifactPaths(prefix = ""): Promise<string[]> {
+    return this.publication.listContentPaths(prefix);
+  }
+}
+
+/** Bind an opened exact publication into the existing renderer provider chain. */
+export function bindPublicationSpaceContentProviderV1(
+  sharedRoot: ContentProvider,
+  publication?: OpenPublicationArtifactV1,
+): ContentProvider {
+  return publication
+    ? new PublicationSpaceContentProvider(sharedRoot, publication)
+    : sharedRoot;
+}

package/apps/storefront/src/lib/publication/runtimeSource.ts

@@ -0,0 +1,97 @@
+import {
+  openPublicationArtifactV1,
+  parsePublicationVersionStateV1Json,
+  publicationRoutePlanIsCurrentV1,
+  publicationVersionStateKey,
+  type OpenPublicationArtifactV1,
+  type PublicationArtifactBucketV1,
+  type PublicationArtifactOpenFailureCodeV1,
+  type PublicationChannelV1,
+  type PublicationRoutePlanV1,
+  type RouteTierIndexV1,
+} from "@tot/public-runtime";
+
+export interface PublicationStateStoreV1 {
+  get(key: string): Promise<string | null>;
+}
+
+export interface PublicationPageCacheScopeV1 {
+  spaceId: string;
+  channel: PublicationChannelV1;
+  pointerRevision: number;
+  versionId: string;
+  artifactDigest: string;
+}
+
+export type PublicationRuntimeSourceV1 =
+  | { status: "legacy-root" }
+  | {
+      status: "selected";
+      artifact: OpenPublicationArtifactV1;
+      cacheScope: PublicationPageCacheScopeV1;
+    }
+  | { status: "unavailable"; code: PublicationArtifactOpenFailureCodeV1 };
+
+/**
+ * Resolve one live request from the public KV state projection into its exact
+ * immutable artifact. A carried plan is checked against current route authority
+ * before state or object-store I/O. Only an unselected root keeps the legacy
+ * adapter; a mounted space never falls through to root content.
+ */
+export async function resolvePublicationRuntimeSourceV1(input: {
+  index: RouteTierIndexV1;
+  requestPath: string;
+  plan: PublicationRoutePlanV1;
+  channel: PublicationChannelV1;
+  store?: PublicationStateStoreV1;
+  bucket?: PublicationArtifactBucketV1;
+}): Promise<PublicationRuntimeSourceV1> {
+  if (input.plan.action !== "render") return { status: "legacy-root" };
+  if (!publicationRoutePlanIsCurrentV1(input.index, input.requestPath, input.plan)) {
+    return { status: "unavailable", code: "publication_route_authority_mismatch" };
+  }
+  const isRoot = input.plan.manifest.routes.canonicalMount === "/";
+  if (!input.store) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+
+  let stateJson: string | null;
+  try {
+    stateJson = await input.store.get(publicationVersionStateKey(input.plan.manifest.tenant));
+  } catch {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  if (stateJson === null) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+  const state = parsePublicationVersionStateV1Json(stateJson);
+  if (!state.ok) return { status: "unavailable", code: "publication_state_malformed" };
+  if (!input.bucket) {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  const opened = await openPublicationArtifactV1({
+    index: input.index,
+    requestPath: input.requestPath,
+    plan: input.plan,
+    state: state.value,
+    channel: input.channel,
+    bucket: input.bucket,
+  });
+  if (!opened.ok) return { status: "unavailable", code: opened.code };
+  const { selection } = opened.value;
+  return {
+    status: "selected",
+    artifact: opened.value,
+    cacheScope: {
+      spaceId: selection.manifest.id,
+      channel: selection.channel,
+      pointerRevision: selection.pointer.revision,
+      versionId: selection.publicationVersion.versionId,
+      artifactDigest: selection.publicationVersion.artifactDigest,
+    },
+  };
+}

package/apps/storefront/src/middleware/controlPlane.ts

@@ -12,7 +12,14 @@ import { fromD1, type D1Like } from "@/lib/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/apps/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
 import { buildTenantConsentBroker, verifyPreviewToken } from "@tot/public-runtime";
-import type { ConsentSnapshot, IntegrationDeclarationInput, TenantConfig } from "@tot/public-runtime";
+import type {
+  ConsentSnapshot,
+  IntegrationDeclarationInput,
+  PublicationArtifactBucketV1,
+  PublicationRoutePlanV1,
+  RouteTierIndexV1,
+  TenantConfig,
+} from "@tot/public-runtime";
 import {
   evaluateLoginGate,
   isAuthPath,
@@ -27,6 +34,7 @@ import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { runRenderChain } from "./renderChain.js";
+import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
   context: APIContext;
@@ -38,11 +46,17 @@ export interface ControlPlaneInput {
   renderPath: string;
   cache: Cache | undefined;
   kv: KVNamespace | undefined;
+  routeTierIndex: RouteTierIndexV1;
+  publicationRequestPath: string;
+  publicationRoute: PublicationRoutePlanV1;
+  publicationBucket: PublicationArtifactBucketV1 | undefined;
   gateMode: GateMode;
   /** `DEMO_GATE_HOSTS`, raw. */
   demoGateHosts: string | null | undefined;
   /** True when this host is withheld behind sign-in — see `resolveMiddlewareBranchV1`. */
   hostLoginGated: boolean;
+  /** Exact per-request authorization for an F2-selected internal space. */
+  internalContentGrant?: InternalContentGrant;
 }
 
 export async function serveControlPlane(input: ControlPlaneInput): Promise<Response> {
@@ -57,7 +71,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
   // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
   // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
   // grant `resource` is the tenant's appDomain — never input.
-  if (input.hostLoginGated) {
+  if (input.hostLoginGated && !input.internalContentGrant) {
     const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
     // UNIFIED on the federated session: read the FULL session (no resource filter —
     // federated sign-in's aud is the storefront app, not this tenant) and admit the
@@ -232,8 +246,14 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     tenant,
     basePath,
     renderPath,
-    cache,
+    // Internal output never receives a shared-cache handle. The render chain
+    // also refuses its page-cache predicate, making this a two-sided invariant.
+    cache: input.internalContentGrant ? undefined : cache,
     kv,
+    routeTierIndex: input.routeTierIndex,
+    publicationRequestPath: input.publicationRequestPath,
+    publicationRoute: input.publicationRoute,
+    publicationBucket: input.publicationBucket,
     managedIntegrationDeclarations,
     readTenantConsentSnapshot: () => readSavedConsentSnapshot(tenant.tenant_id),
     // The D1 catalog edge read replica, when this deploy opts into it. Deferred to
@@ -242,6 +262,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     // — see `publicRender`.
     readCatalogD1: async (): Promise<D1Like | undefined> =>
       (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined,
+    internalContentGrant: input.internalContentGrant,
   });
 }