@tokenoftrust/storefront-runner 2.0.18 → 2.0.20

package/apps/storefront/env.d.ts

@@ -12,6 +12,7 @@ import type {
   EffectivePlan,
   ConsentSnapshot,
   ResolvedRouteTierV1,
+  PublicationRoutePlanV1,
 } from "@tot/public-runtime";
 import type { ToTClient } from "@/lib/tot/ToTClient";
 import type { ContentProvider } from "@/lib/storyblok/provider";
@@ -112,6 +113,10 @@ declare global {
        * served it. Downstream code reads this rather than re-deriving a tier.
        */
       routeTier: ResolvedRouteTierV1;
+      /** Normalized publication mount/canonical/content plan for this request. */
+      publicationRoute: PublicationRoutePlanV1;
+      /** Audited selected aggregate transition instant; null means schedules stay hidden. */
+      publicationTimestamp: string | null;
       /**
        * Effective capability flags for the resolved tenant (commerce defaults
        * unless siteType:"marketing"/explicit features). Chrome, layout islands,

package/apps/storefront/migrations-apps/0013_publication_space_editorial.sql

@@ -0,0 +1,64 @@
+CREATE TABLE `publication_space_versions` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `version_id` text NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `version_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `publication_space_reviews` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `version_id` text NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `version_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_reviews_tenant`
+  ON `publication_space_reviews` (`tenant_id`, `space_id`);
+--> statement-breakpoint
+CREATE TABLE `publication_space_pointers` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `channel`)
+);
+--> statement-breakpoint
+CREATE TABLE `publication_space_transitions` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `transition_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `transition_id`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_publication_space_transition_revision`
+  ON `publication_space_transitions` (`tenant_id`, `space_id`, `channel`, `revision`);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_transitions_tenant`
+  ON `publication_space_transitions` (`tenant_id`, `space_id`, `channel`);
+--> statement-breakpoint
+CREATE TABLE `publication_space_projections` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `transition_id` text NOT NULL,
+  `operation` text NOT NULL,
+  `provider` text NOT NULL,
+  `status` text NOT NULL DEFAULT 'pending',
+  `attempts` integer NOT NULL DEFAULT 0,
+  `last_error` text,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `channel`, `revision`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_publication_space_projection_transition`
+  ON `publication_space_projections` (`tenant_id`, `space_id`, `transition_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_projections_pending`
+  ON `publication_space_projections` (`tenant_id`, `status`, `revision`);

package/apps/storefront/src/config/publicationSpaceRegistry.ts

@@ -0,0 +1,19 @@
+import type { PublicationSpaceManifestV1, PublicationSpaceSourceV1 } from "@tot/public-runtime";
+import { rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+
+const ROOT_SOURCES: Readonly<Record<string, PublicationSpaceSourceV1>> = {
+  home: { forge: "fixture", repo: "home", defaultBranch: "main" },
+  "tokenoftrust.com": { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" },
+  "sample-store.com": { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" },
+  "sample-store.e2e.test": { forge: "fixture", repo: "sample-store.e2e.test", defaultBranch: "main" },
+  "verify.e2e.test": { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" },
+  "fixture.e2e.test": { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" },
+  "chrome.e2e.test": { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" },
+};
+
+/** Node-safe publication topology authority shared by runtime config and CI composition. */
+export function publicationSpacesForTenant(tenant: string): PublicationSpaceManifestV1[] {
+  const source = ROOT_SOURCES[tenant];
+  if (!source) return [];
+  return [rootPublicationSpaceConfig(tenant, source)];
+}

package/apps/storefront/src/lib/auth/brokerAssertion.ts

@@ -79,6 +79,17 @@ export interface MintBrokerAssertionOverrides {
   issuer?: string;
 }
 
+/** Mint a broker assertion whose subject is an opaque verified identity id. */
+export async function mintOpaqueBrokerAssertion(
+  opaqueSubject: string,
+  overrides: MintBrokerAssertionOverrides = {},
+): Promise<string> {
+  if (!opaqueSubject || opaqueSubject.trim().length === 0) {
+    throw new BrokerAssertionError("broker assertion: an opaque subject is required");
+  }
+  return mintBrokerAssertionSubject(opaqueSubject, overrides);
+}
+
 // Import the signing key once per distinct PEM (importPKCS8 is not free). Keyed on
 // the base64 string so a key rotation (new env value) transparently re-imports.
 const keyCache = new Map<string, CryptoKey>();
@@ -137,6 +148,13 @@ export async function mintBrokerAssertion(
   if (!sub) {
     throw new BrokerAssertionError("broker assertion: a subject email is required");
   }
+  return mintBrokerAssertionSubject(sub, overrides);
+}
+
+async function mintBrokerAssertionSubject(
+  sub: string,
+  overrides: MintBrokerAssertionOverrides,
+): Promise<string> {
   const privateKeyB64 = overrides.privateKeyB64 ?? (await readEnv(BROKER_PRIVATE_KEY_ENV));
   if (!privateKeyB64) {
     throw new BrokerAssertionError(

package/apps/storefront/src/lib/auth/identityToken.ts

@@ -104,6 +104,10 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
   if (typeof email !== "string" || !email) {
     throw new Error("identity assertion missing `email` claim");
   }
+  const subject = payload.sub;
+  if (typeof subject !== "string" || subject.trim().length === 0) {
+    throw new Error("identity assertion missing `sub` claim");
+  }
   const tenantsRaw = Array.isArray(payload.tenants) ? payload.tenants : [];
   const tenants: TenantMembership[] = tenantsRaw.map((t): TenantMembership => {
     const entry = t as { resource?: unknown; role?: unknown };
@@ -118,7 +122,7 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
 
   const claims: IdentityClaims = {
     iss: String(payload.iss ?? ""),
-    sub: String(payload.sub ?? email),
+    sub: subject,
     aud: String(payload.aud ?? ""),
     iat: Number(payload.iat ?? 0),
     exp: Number(payload.exp ?? 0),
@@ -281,6 +285,8 @@ export async function getFederatedVerifier(
 
 /** The session fields derived from the VERIFIED token — the Phase-3 source of truth. */
 export interface DerivedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   resource: string;
   /** Coarse standing on THIS resource, surfaced as the display capability. */
@@ -307,6 +313,7 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
     throw new Error(`verified assertion carries no membership for resource "${resource}"`);
   }
   return {
+    subject: claims.sub,
     email: claims.email,
     resource,
     capability: membership.role,
@@ -318,6 +325,8 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
 
 /** The multi-tenant fields derived from a verified FEDERATED assertion. */
 export interface FederatedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   /** The verified `aud` — the storefront app identity this console session is for. */
   resource: string;
@@ -341,6 +350,7 @@ export interface FederatedSessionFields {
  */
 export function sessionFromFederatedClaims(claims: IdentityClaims): FederatedSessionFields {
   const fields: FederatedSessionFields = {
+    subject: claims.sub,
     email: claims.email,
     resource: claims.aud,
     tenants: claims.tenants,

package/apps/storefront/src/lib/auth/internalContentAuthority.ts

@@ -0,0 +1,153 @@
+import type { PublicationRoutePlanV1, ResolvedRouteTierV1 } from "@tot/public-runtime";
+import type { SessionRecord, SessionStore } from "./session.js";
+import { readSession } from "./session.js";
+
+export const INTERNAL_CONTENT_CAPABILITY = "internal-content-reader" as const;
+export const INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS = 5_000;
+
+export type InternalContentAuthorityDecision =
+  | { allowed: true; tenant: string; spaceId: string; audience: "owner" | "developer" }
+  | { allowed: false; reason: "denied" | "unavailable" };
+
+export type InternalContentGrant = Extract<InternalContentAuthorityDecision, { allowed: true }>;
+
+interface BrokerContext {
+  appDomain: string;
+  audience: string;
+}
+
+export interface InternalContentAuthorityInput {
+  route: ResolvedRouteTierV1;
+  sessionStore?: SessionStore;
+  sessionId?: string | null;
+  coreUrl?: string | null;
+  mintAssertion: (subject: string) => Promise<string>;
+  fetchImpl?: typeof fetch;
+  nowSeconds?: number;
+}
+
+function routeIsDeclaredInternal(route: ResolvedRouteTierV1): route is ResolvedRouteTierV1 & {
+  space: NonNullable<ResolvedRouteTierV1["space"]>;
+} {
+  return route.origin === "publication-space" &&
+    route.requiresAuthorization &&
+    route.visibility === "internal" &&
+    route.authorization.policy === "capability" &&
+    route.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    route.assets.access === "authorized" &&
+    !!route.space &&
+    route.space.tenant === route.tenant;
+}
+
+function brokerContexts(value: unknown): BrokerContext[] | null {
+  const unwrapped = value && typeof value === "object" && "content" in value
+    ? (value as { content?: unknown }).content
+    : value;
+  if (!unwrapped || typeof unwrapped !== "object") return null;
+  const contexts = (unwrapped as { contexts?: unknown }).contexts;
+  if (!Array.isArray(contexts)) return null;
+  const parsed: BrokerContext[] = [];
+  for (const context of contexts) {
+    if (!context || typeof context !== "object") return null;
+    const appDomain = (context as { appDomain?: unknown }).appDomain;
+    const audience = (context as { audience?: unknown }).audience;
+    if (typeof appDomain !== "string" || typeof audience !== "string") return null;
+    parsed.push({ appDomain, audience });
+  }
+  return parsed;
+}
+
+/**
+ * Resolve internal-content authority from fresh broker state. The session is
+ * identity proof only: cached memberships, roles, headers, and preview state do
+ * not grant access. Every store/read/signing fault is an explicit unavailable
+ * result and callers serve the same non-disclosing denial response.
+ */
+export async function authorizeInternalContentRequest(
+  input: InternalContentAuthorityInput,
+): Promise<InternalContentAuthorityDecision> {
+  if (!routeIsDeclaredInternal(input.route)) return { allowed: false, reason: "denied" };
+  if (!input.sessionStore || !input.sessionId) return { allowed: false, reason: "denied" };
+
+  let session: SessionRecord | null;
+  try {
+    session = await readSession(
+      input.sessionStore,
+      input.sessionId,
+      input.nowSeconds ?? Math.floor(Date.now() / 1000),
+    );
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  const subject = session?.subject;
+  if (!subject || subject.trim().length === 0) {
+    return { allowed: false, reason: "denied" };
+  }
+
+  const coreUrl = (input.coreUrl ?? "").replace(/\/+$/, "");
+  if (!coreUrl) return { allowed: false, reason: "unavailable" };
+
+  let assertion: string;
+  try {
+    assertion = await input.mintAssertion(subject);
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+
+  let response: Response;
+  try {
+    response = await (input.fetchImpl ?? fetch)(`${coreUrl}/api/broker/appDomains`, {
+      method: "GET",
+      headers: {
+        accept: "application/json",
+        "X-ToT-Broker-Assertion": assertion,
+      },
+      signal: AbortSignal.timeout(INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS),
+    });
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  if (!response.ok) return { allowed: false, reason: "unavailable" };
+
+  let contexts: BrokerContext[] | null;
+  try {
+    contexts = brokerContexts(await response.json());
+  } catch {
+    contexts = null;
+  }
+  if (!contexts) return { allowed: false, reason: "unavailable" };
+
+  const matching = contexts.filter((context) => context.appDomain === input.route.tenant);
+  if (matching.length !== 1) return { allowed: false, reason: "denied" };
+  const audience = matching[0]!.audience;
+  if (audience !== "owner" && audience !== "developer") {
+    return { allowed: false, reason: "denied" };
+  }
+  return {
+    allowed: true,
+    tenant: input.route.tenant,
+    spaceId: input.route.space.spaceId,
+    audience,
+  };
+}
+
+/** Prove the carried grant still names the exact server-resolved F2 space. */
+export function internalContentGrantMatchesPlan(
+  grant: InternalContentGrant | undefined,
+  plan: PublicationRoutePlanV1,
+): boolean {
+  return !!grant && plan.action === "render" &&
+    plan.manifest.visibility === "internal" &&
+    plan.manifest.authorization.policy === "capability" &&
+    plan.manifest.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    plan.manifest.assets.access === "authorized" &&
+    grant.tenant === plan.route.tenant &&
+    grant.tenant === plan.manifest.tenant &&
+    grant.spaceId === plan.manifest.id;
+}
+
+/** Internal responses are never indexable or eligible for shared storage. */
+export function applyInternalContentResponsePolicy(headers: Headers): void {
+  headers.set("Cache-Control", "private, no-store");
+  headers.set("X-Robots-Tag", "noindex, nofollow");
+}

package/apps/storefront/src/lib/auth/session.ts

@@ -50,6 +50,8 @@ export const DEFAULT_SESSION_TTL_SECONDS = 7 * 24 * 3600;
  * are the multi-tenant claims carried in the verified token.
  */
 export interface SessionRecord {
+  /** Opaque identity-provider subject from the verified assertion. */
+  subject?: string;
   /** Verified email (lowercased) — the principal that passed the grant check. */
   email: string;
   /** The resource (appDomain/tenant, e.g. "sample-store.example") this session authorizes. */
@@ -166,6 +168,7 @@ export async function readSession(
     !record ||
     typeof record.email !== "string" ||
     typeof record.resource !== "string" ||
+    (record.subject !== undefined && typeof record.subject !== "string") ||
     typeof record.exp !== "number"
   ) {
     await store.delete(id);

package/apps/storefront/src/lib/blog/collection.ts

@@ -1,6 +1,12 @@
-import { tenantDirSegment } from "@tot/public-runtime";
+import {
+  exactPublicationTimestamp,
+  isBlogPostListableOnLive,
+  isBlogPostVisibleOnLive,
+  tenantDirSegment,
+} from "@tot/public-runtime";
 import type { AuthorBio, BlogPost, BlogPostSummary, PostStatus } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
+import { readEnv } from "../env.js";
 
 type ArtifactSource = Pick<ContentProvider, "readArtifact" | "listArtifactPaths">;
 function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactSource {
@@ -8,7 +14,7 @@ function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactS
 }
 export interface CollectionReadOptions {
   includeUnpublished?: boolean;
-  now?: string;
+  now?: string | null;
   content?: ArtifactSource;
 }
 
@@ -50,15 +56,9 @@ const SEGMENT_RE = /^[a-z0-9][a-z0-9._-]*$/;
  * A "scheduled" post whose `scheduledAt` instant has passed behaves exactly like
  * "published". Before that instant it is treated like a draft (invisible, unlisted).
  * A scheduled post with a missing/unparseable `scheduledAt` is never due (safe: it
- * stays hidden rather than leaking). Because visibility is computed at build/request
- * time, a post committed ahead of time simply needs a build after its instant.
+ * stays hidden rather than leaking). Scheduled visibility is evaluated only against
+ * an explicit publication timestamp; wall-clock passage never changes a live release.
  */
-function isDueScheduled(p: { status: PostStatus; scheduledAt?: string }, now: string): boolean {
-  if (p.status !== "scheduled" || typeof p.scheduledAt !== "string") return false;
-  const due = Date.parse(p.scheduledAt);
-  return !Number.isNaN(due) && due <= Date.parse(now);
-}
-
 /**
  * The single visibility chokepoint: is a post reachable at its URL on the live
  * site? Published, unlisted, and due-scheduled resolve; drafts and not-yet-due
@@ -68,9 +68,9 @@ function isDueScheduled(p: { status: PostStatus; scheduledAt?: string }, now: st
  */
 export function isVisibleOnLive(
   p: { status: PostStatus; scheduledAt?: string },
-  now: string = new Date().toISOString(),
+  now?: string | null,
 ): boolean {
-  return p.status === "published" || p.status === "unlisted" || isDueScheduled(p, now);
+  return isBlogPostVisibleOnLive(p, now);
 }
 
 /** "Category Insurance" -> "category-insurance" */
@@ -166,6 +166,11 @@ function toSummary(p: BlogPost): BlogPostSummary {
   };
 }
 
+async function visibilityTimestamp(explicit?: string | null): Promise<string | null> {
+  if (explicit !== undefined) return exactPublicationTimestamp(explicit);
+  return exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
+}
+
 /**
  * The collection ids that actually have post content for a tenant, derived from
  * the same glob the index is built from (no per-tenant config needed). Sorted for
@@ -233,9 +238,9 @@ export async function listPosts(
           .map((key) => postGlobs[key]!()),
       )).map(normalize);
   const includeUnpublished = opts?.includeUnpublished ?? false;
-  const now = opts?.now ?? new Date().toISOString();
+  const now = await visibilityTimestamp(opts?.now);
   return posts
-    .filter((p) => includeUnpublished || p.status === "published" || isDueScheduled(p, now))
+    .filter((p) => includeUnpublished || isBlogPostListableOnLive(p, now))
     .sort((a, b) => (a.publishedAt < b.publishedAt ? 1 : a.publishedAt > b.publishedAt ? -1 : 0))
     .map(toSummary);
 }
@@ -258,7 +263,7 @@ export async function getPost(
     if (raw) {
       try {
         const post = normalize(JSON.parse(raw) as BlogPost);
-        if (!(opts.includeUnpublished ?? false) && !isVisibleOnLive(post, opts.now)) return null;
+        if (!(opts.includeUnpublished ?? false) && !isVisibleOnLive(post, await visibilityTimestamp(opts.now))) return null;
         return post;
       } catch {
         return null;
@@ -272,7 +277,7 @@ export async function getPost(
   );
   if (!key) return null;
   const post = normalize(await postGlobs[key]!());
-  if (!(opts?.includeUnpublished ?? false) && !isVisibleOnLive(post, opts?.now)) return null;
+  if (!(opts?.includeUnpublished ?? false) && !isVisibleOnLive(post, await visibilityTimestamp(opts?.now))) return null;
   return post;
 }
 
@@ -325,9 +330,10 @@ export async function relatedPosts(
   slug: string,
   n = 3,
   content?: ArtifactSource,
+  now?: string | null,
 ): Promise<BlogPostSummary[]> {
-  const pool = (await listPosts(tenantId, collection, { content })).filter((p) => p.slug !== slug);
-  const current = await getPost(tenantId, collection, slug, { content });
+  const pool = (await listPosts(tenantId, collection, { content, now })).filter((p) => p.slug !== slug);
+  const current = await getPost(tenantId, collection, slug, { content, now });
   const category = current?.categories[0];
   const result = category ? pool.filter((p) => p.categories.includes(category)) : [];
   for (const p of pool) {

package/apps/storefront/src/lib/blog/provider.ts

@@ -4,10 +4,16 @@
 // collection, and backs `/blog` whenever that curated index is unusable;
 // switching `/blog` onto it outright is a later migration once order is
 // encoded as data (see B0.1 §"/blog migration caution").
-import { tenantDirSegment } from "@tot/public-runtime";
+import {
+  exactPublicationTimestamp,
+  isBlogPostListableOnLive,
+  isBlogPostVisibleOnLive,
+  tenantDirSegment,
+} from "@tot/public-runtime";
 import { listPosts } from "./collection.js";
 import type { BlogPost, BlogPostSummary } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
+import { readEnv } from "../env.js";
 
 /** The collection id `/blog` reads — the derived fallback's second argument. */
 const BLOG_COLLECTION = "blog";
@@ -18,6 +24,11 @@ function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactS
   return typeof value?.listArtifactPaths === "function" && typeof value.readArtifact === "function";
 }
 
+async function visibilityTimestamp(explicit?: string | null): Promise<string | null> {
+  if (explicit !== undefined) return exactPublicationTimestamp(explicit);
+  return exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
+}
+
 // Both tenant tiers: real at `tenants/<id>/`, platform test one level deeper at
 // `tenants/e2e/<id>/`. `tenantDirSegment` is the one inverse used to look a
 // tenant's keys back up.
@@ -69,6 +80,10 @@ async function readCuratedIndex(
   if (canReadArtifacts(source)) {
     const raw = await source.readArtifact("blog/index.json");
     if (raw) return parseCuratedIndex(raw);
+    // A selected immutable publication artifact is authoritative. Missing or
+    // malformed curated metadata falls through to its own posts, never to stale
+    // build-time globs for the same tenant.
+    return null;
   }
   const key = tenantKey(Object.keys(indexGlobs), tenantId, "/index.json")
     ?? Object.keys(indexGlobs).find((candidate) => candidate.includes(`${tenantDirSegment(tenantId)}content/blog/index.json`));
@@ -92,16 +107,19 @@ async function readCuratedIndex(
 export async function listBlogPosts(
   tenantId: string,
   source?: ArtifactSource,
+  publicationTimestamp?: string | null,
 ): Promise<BlogPostSummary[]> {
+  const now = await visibilityTimestamp(publicationTimestamp);
   const curated = await readCuratedIndex(tenantId, source);
-  if (curated && curated.length > 0) return curated;
-  return listPosts(tenantId, BLOG_COLLECTION, { content: source });
+  if (curated && curated.length > 0) return curated.filter((post) => isBlogPostListableOnLive(post, now));
+  return listPosts(tenantId, BLOG_COLLECTION, { content: source, now });
 }
 
 export async function getBlogPost(
   tenantId: string,
   slug: string,
   source?: ArtifactSource,
+  publicationTimestamp?: string | null,
 ): Promise<BlogPost | null> {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) return null;
   if (canReadArtifacts(source)) {
@@ -109,7 +127,9 @@ export async function getBlogPost(
     const raw = await source.readArtifact(`blog/posts/${slug}.json`);
     if (raw) {
       try {
-        return JSON.parse(raw) as BlogPost;
+        const post = JSON.parse(raw) as BlogPost;
+        const now = await visibilityTimestamp(publicationTimestamp);
+        return isBlogPostVisibleOnLive(post, now) ? post : null;
       } catch {
         return null;
       }
@@ -117,7 +137,10 @@ export async function getBlogPost(
     if (paths !== null) return null;
   }
   const key = tenantKey(Object.keys(postGlobs), tenantId, `/posts/${slug}.json`);
-  return key ? postGlobs[key]!() : null;
+  if (!key) return null;
+  const post = await postGlobs[key]!();
+  const now = await visibilityTimestamp(publicationTimestamp);
+  return isBlogPostVisibleOnLive(post, now) ? post : null;
 }
 
 export async function resolveBlogRedirect(

package/apps/storefront/src/lib/blog/reactions.ts

@@ -14,6 +14,7 @@
  * specific tenant or collection.
  */
 import { getPost } from "./collection.js";
+import type { ContentProvider } from "../storyblok/provider.js";
 
 /** The fixed reaction vocabulary. Not free-form — a closed set like the pillar vocabulary. */
 export const REACTIONS = ["like", "insightful", "celebrate"] as const;
@@ -42,7 +43,7 @@ async function readCount(kv: KVNamespace, key: string): Promise<number> {
 
 /**
  * Increment the tally for `reaction` on a post IF the reaction is in the vocab
- * AND the post is live (published/unlisted/due-scheduled) for this tenant —
+ * AND the post is live (published/unlisted/scheduled due at publication) for this tenant —
  * `getPost` returns null on the live path for a draft/404/non-post. Best-effort:
  * never throws (a reaction must never fail the reader's request).
  */
@@ -52,10 +53,11 @@ export async function recordReaction(
   collection: string,
   slug: string,
   reaction: string,
+  visibility?: { content?: ContentProvider; now?: string | null },
 ): Promise<void> {
   try {
     if (!isReaction(reaction)) return;
-    const post = await getPost(tenantId, collection, slug);
+    const post = await getPost(tenantId, collection, slug, visibility);
     if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
     const key = reactionsKey(tenantId, collection, slug, reaction);
     const next = (await readCount(kv, key)) + 1;

package/apps/storefront/src/lib/blog/types.ts

@@ -29,7 +29,7 @@ export interface BlogPostSummary {
   tags: string[];
   featuredImage?: BlogImage;
   status: PostStatus; // seeded/legacy posts without this field default to "published"
-  scheduledAt?: string; // ISO date; when status === "scheduled", the post goes live once this instant has passed
+  scheduledAt?: string; // ISO date; eligible in an explicit publication at or after this instant
   canonicalUrl?: string; // syndication override
   inLanguage?: string; // default "en"
   access?: BlogAccess; // entitlement gate; default "public". Orthogonal to `status`

package/apps/storefront/src/lib/blog/viewCounts.ts

@@ -24,6 +24,7 @@
  * `the-build` or `tokenoftrust.com`.
  */
 import { getPost, listPosts } from "./collection.js";
+import type { ContentProvider } from "../storyblok/provider.js";
 
 // Mirror the engine's guards (collection.ts): a collection is one path segment;
 // a slug is lower-kebab. Keeping them local avoids widening the engine's surface.
@@ -96,11 +97,12 @@ export async function recordBlogView(
   kv: KVNamespace,
   tenantId: string,
   path: string,
+  visibility?: { content?: ContentProvider; now?: string | null },
 ): Promise<void> {
   try {
     const ref = parseBlogPostPath(path);
     if (!ref) return;
-    const post = await getPost(tenantId, ref.collection, ref.slug);
+    const post = await getPost(tenantId, ref.collection, ref.slug, visibility);
     if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
     const key = blogViewsKey(tenantId, ref.collection, ref.slug);
     const dayKey = blogViewsDayKey(tenantId, ref.collection, ref.slug, dayStamp(new Date()));

package/apps/storefront/src/lib/d1/catalog.ts

@@ -29,6 +29,8 @@ export interface Queryable {
   exec(sql: string): Promise<void>;
   /** D1 executes a batch sequentially inside one implicit transaction. */
   batch?(statements: readonly QueryStatement[]): Promise<void>;
+  /** D1 batch results, including SELECT rows, from that same implicit transaction. */
+  batchResults?(statements: readonly QueryStatement[]): Promise<readonly QueryBatchResult[]>;
 }
 
 export interface QueryStatement {
@@ -36,6 +38,10 @@ export interface QueryStatement {
   params?: readonly unknown[];
 }
 
+export interface QueryBatchResult {
+  results: readonly Record<string, unknown>[];
+}
+
 /** The slice of the Cloudflare D1Database we use (kept local to avoid a types dep). */
 export interface D1Like {
   prepare(sql: string): {
@@ -51,6 +57,8 @@ export interface D1Like {
 
 /** Adapt a Cloudflare D1Database to the Queryable seam. */
 export function fromD1(db: D1Like): Queryable {
+  const prepareBatch = (statements: readonly QueryStatement[]) =>
+    statements.map(({ sql, params = [] }) => db.prepare(sql).bind(...params));
   return {
     all: async <T>(sql: string, ...params: unknown[]) =>
       (await db.prepare(sql).bind(...params).all()).results as T[],
@@ -64,7 +72,16 @@ export function fromD1(db: D1Like): Queryable {
     },
     batch: async (statements) => {
       if (!db.batch) throw new Error("D1 batch is unavailable");
-      await db.batch(statements.map(({ sql, params = [] }) => db.prepare(sql).bind(...params)));
+      await db.batch(prepareBatch(statements));
+    },
+    batchResults: async (statements) => {
+      if (!db.batch) throw new Error("D1 batch is unavailable");
+      const raw = await db.batch(prepareBatch(statements));
+      return raw.map((result) => {
+        if (!result || typeof result !== "object") return { results: [] };
+        const rows = Reflect.get(result, "results") as unknown;
+        return { results: Array.isArray(rows) ? rows as Record<string, unknown>[] : [] };
+      });
     },
   };
 }