@tokenoftrust/storefront-runner 2.0.18 → 2.0.20

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -250,6 +250,99 @@ export const testDestinationDeliveries = sqliteTable(
   }),
 );
 
+// --- Publication-space editorial control -----------------------------------
+// Immutable reviewed versions plus one CAS pointer/audit chain per space. The
+// API always derives tenant+space from its authenticated route; the composite
+// keys make cross-tenant aliases impossible in persistence.
+export const publicationSpaceVersions = sqliteTable(
+  "publication_space_versions",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    versionId: text("version_id").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.versionId] }) }),
+);
+
+export const publicationSpaceReviews = sqliteTable(
+  "publication_space_reviews",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    versionId: text("version_id").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.versionId] }),
+    idxTenant: index("idx_publication_space_reviews_tenant").on(t.tenantId, t.spaceId),
+  }),
+);
+
+export const publicationSpacePointers = sqliteTable(
+  "publication_space_pointers",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.channel] }) }),
+);
+
+export const publicationSpaceTransitions = sqliteTable(
+  "publication_space_transitions",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    transitionId: text("transition_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.transitionId] }),
+    uqRevision: uniqueIndex("uq_publication_space_transition_revision").on(
+      t.tenantId,
+      t.spaceId,
+      t.channel,
+      t.revision,
+    ),
+    idxTenant: index("idx_publication_space_transitions_tenant").on(
+      t.tenantId,
+      t.spaceId,
+      t.channel,
+    ),
+  }),
+);
+
+export const publicationSpaceProjections = sqliteTable(
+  "publication_space_projections",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    transitionId: text("transition_id").notNull(),
+    operation: text("operation").notNull(),
+    provider: text("provider").notNull(),
+    status: text("status").notNull().default("pending"),
+    attempts: integer("attempts").notNull().default(0),
+    lastError: text("last_error"),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.channel, t.revision] }),
+    uqTransition: uniqueIndex("uq_publication_space_projection_transition").on(
+      t.tenantId, t.spaceId, t.transitionId,
+    ),
+    idxPending: index("idx_publication_space_projections_pending").on(
+      t.tenantId, t.status, t.revision,
+    ),
+  }),
+);
+
 // --- Webhook event spine ----------------------------------------------------
 // Immutable event log. `id` is the semantic event id we mint — distinct from
 // any per-delivery wire envelope id (see `webhookDeliveries.deliveryId` below).

package/apps/storefront/src/lib/edgeCache.ts

@@ -64,6 +64,14 @@ export function pageCacheKey(
   search: string,
   version: number,
   planRevision?: string,
+  publication?: {
+    spaceId: string;
+    channel: "preview" | "live";
+    pointerRevision: number;
+    versionId: string;
+    artifactDigest: string;
+    publicationTimestamp: string | null;
+  },
 ): Request {
   // A stored page carries the CSP header it was rendered with, INCLUDING any
   // version-scoped integration origins. Folding the resolved `planRevision` into
@@ -73,8 +81,18 @@ export function pageCacheKey(
   // integration plane resolved) the key is byte-identical to the non-integration
   // form, so a plain tenant pays nothing and its cache is never busted.
   const planSegment = planRevision ? `/pr:${planRevision}` : "";
+  const publicationSegment = publication
+    ? `/publication:${encodeURIComponent([
+        publication.spaceId,
+        publication.channel,
+        publication.pointerRevision,
+        publication.versionId,
+        publication.artifactDigest,
+        publication.publicationTimestamp ?? "unclocked",
+      ].join(":"))}`
+    : "";
   return new Request(
-    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${pathname}${search}`,
+    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${publicationSegment}${pathname}${search}`,
   );
 }
 

package/apps/storefront/src/lib/publication/contentProvider.ts

@@ -0,0 +1,159 @@
+import type {
+  OpenPublicationArtifactV1,
+  PublicationRouteRenderPlanV1,
+} from "@tot/public-runtime";
+import type { EditorialPage, HomeContent } from "@/lib/storyblok/content-model.js";
+import type { ChromeConfig } from "@/lib/chrome/model.js";
+import { parseChromeConfig } from "@/lib/chrome/parseConfig.js";
+import { parseChromeAssignments } from "@/lib/chrome/model.js";
+import { renderRawChrome } from "@/lib/rawChrome.js";
+import { stampTrackingIdsAtPublish } from "@/lib/tracking/publishSafetyNet.js";
+import type { ContentProvider } from "@/lib/storyblok/provider.js";
+
+const EMPTY_CHROME_CONFIG: ChromeConfig = {
+  header: { variant: "primary", brand: { label: "" }, nav: [] },
+  footer: { variant: "default", columns: [] },
+};
+
+function parseJson<T>(raw: string | null): T | null {
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+function stripSlashes(value: string): string {
+  return value.replace(/^\/+|\/+$/g, "");
+}
+
+/**
+ * Map the canonical Astro catch-all slug back to the already-resolved source
+ * root. The plan, not string-prefix guessing, owns which mount is stripped.
+ */
+function selectedPageSlug(plan: PublicationRouteRenderPlanV1, slug: string): string | null {
+  const requested = stripSlashes(slug);
+  const canonical = stripSlashes(plan.canonicalPath);
+  if (requested !== canonical) return null;
+  return stripSlashes(plan.contentPath);
+}
+
+function canonicalSlugForMount(plan: PublicationRouteRenderPlanV1, sourceSlug: string): string {
+  const mount = stripSlashes(plan.manifest.routes.canonicalMount);
+  const source = stripSlashes(sourceSlug);
+  return [mount, source].filter(Boolean).join("/");
+}
+
+function rebasePage(
+  plan: PublicationRouteRenderPlanV1,
+  page: EditorialPage,
+  canonicalSlug = canonicalSlugForMount(plan, page.slug),
+): EditorialPage {
+  return { ...page, slug: canonicalSlug };
+}
+
+/**
+ * Existing Storefront renderer adapter for one already-opened publication
+ * version. Selected page/blog artifacts never fall through to another source;
+ * a mounted space reuses only the root space's shared chrome/home services.
+ */
+export class PublicationSpaceContentProvider implements ContentProvider {
+  constructor(
+    private readonly sharedRoot: ContentProvider,
+    private readonly publication: OpenPublicationArtifactV1,
+  ) {}
+
+  private get plan(): PublicationRouteRenderPlanV1 {
+    return this.publication.selection;
+  }
+
+  private get ownsRoot(): boolean {
+    return this.plan.manifest.routes.canonicalMount === "/";
+  }
+
+  async getHome(): Promise<HomeContent> {
+    if (!this.ownsRoot) return this.sharedRoot.getHome();
+    const home = parseJson<HomeContent>(this.publication.readContent("home.json"));
+    if (!home) throw new Error("selected root publication home is unavailable");
+    return home;
+  }
+
+  async getHomeHtml(): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getHomeHtml();
+    const raw = this.publication.readContent("home.html");
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async getPageHtml(slug: string): Promise<string | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (selected === null) return null;
+    const raw = this.publication.readContent(
+      selected ? `pages-html/${selected}.html` : "home.html",
+    );
+    return raw === null ? null : stampTrackingIdsAtPublish(raw);
+  }
+
+  async listPageHtmlSlugs(): Promise<string[]> {
+    return this.publication.listContentPaths("pages-html/")
+      .filter((path) => path.endsWith(".html"))
+      .map((path) => canonicalSlugForMount(
+        this.plan,
+        path.slice("pages-html/".length, -".html".length),
+      ));
+  }
+
+  async getChromeHtml(currentPath?: string): Promise<string | null> {
+    if (!this.ownsRoot) return this.sharedRoot.getChromeHtml(currentPath);
+    const html = this.publication.readContent("chrome.html");
+    if (html !== null) return stampTrackingIdsAtPublish(html);
+    const config = parseChromeConfig(parseJson(this.publication.readContent("chrome.json")));
+    if (!config) return null;
+    const assignments = parseChromeAssignments(
+      parseJson(this.publication.readContent("chrome-assignments.json")),
+    );
+    return renderRawChrome(config, currentPath, assignments);
+  }
+
+  async getChrome(): Promise<ChromeConfig> {
+    if (!this.ownsRoot) return this.sharedRoot.getChrome();
+    return parseChromeConfig(parseJson(this.publication.readContent("chrome.json"))) ??
+      EMPTY_CHROME_CONFIG;
+  }
+
+  async getPage(slug: string): Promise<EditorialPage | null> {
+    const selected = selectedPageSlug(this.plan, slug);
+    if (!selected) return null;
+    const page = (await this.sourcePages()).find((candidate) => candidate.slug === selected);
+    return page ? rebasePage(this.plan, page, stripSlashes(this.plan.canonicalPath)) : null;
+  }
+
+  async listPages(): Promise<EditorialPage[]> {
+    return (await this.sourcePages()).map((page) => rebasePage(this.plan, page));
+  }
+
+  private async sourcePages(): Promise<EditorialPage[]> {
+    return this.publication.listContentPaths("pages/")
+      .filter((path) => path.endsWith(".json"))
+      .map((path) => parseJson<EditorialPage>(this.publication.readContent(path)))
+      .filter((page): page is EditorialPage => page !== null);
+  }
+
+  async readArtifact(relative: string): Promise<string | null> {
+    return this.publication.readContent(relative);
+  }
+
+  async listArtifactPaths(prefix = ""): Promise<string[]> {
+    return this.publication.listContentPaths(prefix);
+  }
+}
+
+/** Bind an opened exact publication into the existing renderer provider chain. */
+export function bindPublicationSpaceContentProviderV1(
+  sharedRoot: ContentProvider,
+  publication?: OpenPublicationArtifactV1,
+): ContentProvider {
+  return publication
+    ? new PublicationSpaceContentProvider(sharedRoot, publication)
+    : sharedRoot;
+}

package/apps/storefront/src/lib/publication/runtimeSource.ts

@@ -0,0 +1,194 @@
+import {
+  exactPublicationTimestamp,
+  openPublicationArtifactV1,
+  parsePublicationVersionStateV1Json,
+  publicationRoutePlanIsCurrentV1,
+  publicationVersionStateKey,
+  type OpenPublicationArtifactV1,
+  type PublicationArtifactBucketV1,
+  type PublicationArtifactOpenFailureCodeV1,
+  type PublicationChannelV1,
+  type PublicationChannelPointerV1,
+  type PublicationRoutePlanV1,
+  type RouteTierIndexV1,
+} from "@tot/public-runtime";
+
+export interface PublicationStateStoreV1 {
+  get(key: string): Promise<string | null>;
+}
+
+export interface PublicationPageCacheScopeV1 {
+  spaceId: string;
+  channel: PublicationChannelV1;
+  pointerRevision: number;
+  versionId: string;
+  artifactDigest: string;
+  publicationTimestamp: string | null;
+}
+
+export interface PublicationRuntimeClockV1 {
+  version: 1;
+  tenant: string;
+  spaceId: string;
+  channel: PublicationChannelV1;
+  revision: number;
+  versionId: string;
+  sourceSha: string;
+  artifactDigest: string;
+  publicationTimestamp: string;
+}
+
+export function publicationRuntimeClockKeyV1(
+  tenant: string,
+  spaceId: string,
+  channel: PublicationChannelV1,
+  revision: number,
+): string {
+  return `cust:publication-clock:${tenant}:${spaceId}:${channel}:${revision}`;
+}
+
+export function publicationRuntimeClockV1(input: {
+  pointer: PublicationChannelPointerV1;
+  publicationTimestamp: string;
+}): PublicationRuntimeClockV1 | null {
+  const publicationTimestamp = exactPublicationTimestamp(input.publicationTimestamp);
+  const pointer = input.pointer;
+  if (!publicationTimestamp || !Number.isSafeInteger(pointer.revision) || pointer.revision < 1) return null;
+  return {
+    version: 1,
+    tenant: pointer.tenant,
+    spaceId: pointer.spaceId,
+    channel: pointer.channel,
+    revision: pointer.revision,
+    versionId: pointer.versionId,
+    sourceSha: pointer.sourceSha,
+    artifactDigest: pointer.artifactDigest,
+    publicationTimestamp,
+  };
+}
+
+export function parsePublicationRuntimeClockV1(json: string): PublicationRuntimeClockV1 | null {
+  try {
+    const value = JSON.parse(json) as Record<string, unknown>;
+    if (!value || typeof value !== "object" || Array.isArray(value) ||
+      Object.keys(value).sort().join("\0") !==
+        ["artifactDigest", "channel", "publicationTimestamp", "revision", "sourceSha", "spaceId", "tenant", "version", "versionId"].sort().join("\0") ||
+      value.version !== 1 || typeof value.tenant !== "string" || typeof value.spaceId !== "string" ||
+      (value.channel !== "live" && value.channel !== "preview") ||
+      !Number.isSafeInteger(value.revision) || Number(value.revision) < 1 ||
+      typeof value.versionId !== "string" || typeof value.sourceSha !== "string" ||
+      typeof value.artifactDigest !== "string" || !exactPublicationTimestamp(value.publicationTimestamp)) return null;
+    return value as unknown as PublicationRuntimeClockV1;
+  } catch {
+    return null;
+  }
+}
+
+export function publicationRuntimeClockMatchesStateV1(input: {
+  clock: PublicationRuntimeClockV1;
+  pointer: PublicationChannelPointerV1;
+}): boolean {
+  const expected = publicationRuntimeClockV1({
+    pointer: input.pointer,
+    publicationTimestamp: input.clock.publicationTimestamp,
+  });
+  return !!expected && JSON.stringify(expected) === JSON.stringify(input.clock);
+}
+
+export type PublicationRuntimeSourceV1 =
+  | { status: "legacy-root" }
+  | {
+      status: "selected";
+      artifact: OpenPublicationArtifactV1;
+      cacheScope: PublicationPageCacheScopeV1;
+      /** Exact audited transition instant bound to this selected space revision. */
+      publicationTimestamp: string | null;
+    }
+  | { status: "unavailable"; code: PublicationArtifactOpenFailureCodeV1 };
+
+/**
+ * Resolve one live request from the public KV state projection into its exact
+ * immutable artifact. A carried plan is checked against current route authority
+ * before state or object-store I/O. Only an unselected root keeps the legacy
+ * adapter; a mounted space never falls through to root content.
+ */
+export async function resolvePublicationRuntimeSourceV1(input: {
+  index: RouteTierIndexV1;
+  requestPath: string;
+  plan: PublicationRoutePlanV1;
+  channel: PublicationChannelV1;
+  store?: PublicationStateStoreV1;
+  bucket?: PublicationArtifactBucketV1;
+}): Promise<PublicationRuntimeSourceV1> {
+  if (input.plan.action !== "render") return { status: "legacy-root" };
+  if (!publicationRoutePlanIsCurrentV1(input.index, input.requestPath, input.plan)) {
+    return { status: "unavailable", code: "publication_route_authority_mismatch" };
+  }
+  const isRoot = input.plan.manifest.routes.canonicalMount === "/";
+  if (!input.store) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+
+  let stateJson: string | null;
+  try {
+    stateJson = await input.store.get(publicationVersionStateKey(input.plan.manifest.tenant));
+  } catch {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  if (stateJson === null) {
+    return isRoot
+      ? { status: "legacy-root" }
+      : { status: "unavailable", code: "publication_channel_unselected" };
+  }
+  const state = parsePublicationVersionStateV1Json(stateJson);
+  if (!state.ok) return { status: "unavailable", code: "publication_state_malformed" };
+  if (!input.bucket) {
+    return { status: "unavailable", code: "publication_artifact_source_unavailable" };
+  }
+  const opened = await openPublicationArtifactV1({
+    index: input.index,
+    requestPath: input.requestPath,
+    plan: input.plan,
+    state: state.value,
+    channel: input.channel,
+    bucket: input.bucket,
+  });
+  if (!opened.ok) return { status: "unavailable", code: opened.code };
+  const { selection } = opened.value;
+  let clock: PublicationRuntimeClockV1 | null = null;
+  if (selection.manifest.visibility === "public") {
+    try {
+      const clockJson = await input.store.get(publicationRuntimeClockKeyV1(
+        selection.pointer.tenant,
+        selection.pointer.spaceId,
+        selection.channel,
+        selection.pointer.revision,
+      ));
+      const candidate = clockJson ? parsePublicationRuntimeClockV1(clockJson) : null;
+      if (candidate && publicationRuntimeClockMatchesStateV1({
+        clock: candidate,
+        pointer: selection.pointer,
+      })) clock = candidate;
+    } catch {
+      // The content remains selectable, but scheduled visibility fails closed.
+    }
+  }
+  const publicationTimestamp = selection.manifest.visibility === "public"
+    ? clock?.publicationTimestamp ?? null
+    : exactPublicationTimestamp(selection.pointer.updatedAt);
+  return {
+    status: "selected",
+    artifact: opened.value,
+    publicationTimestamp,
+    cacheScope: {
+      spaceId: selection.manifest.id,
+      channel: selection.channel,
+      pointerRevision: selection.pointer.revision,
+      versionId: selection.publicationVersion.versionId,
+      artifactDigest: selection.publicationVersion.artifactDigest,
+      publicationTimestamp,
+    },
+  };
+}

package/apps/storefront/src/lib/the-build/provider.ts

@@ -10,7 +10,7 @@ export const THE_BUILD: Collection = { id: "the-build", base: "/the-build" };
 
 export function listBuildPosts(
   tenantId: string,
-  opts?: { includeUnpublished?: boolean; now?: string; content?: ContentProvider },
+  opts?: { includeUnpublished?: boolean; now?: string | null; content?: ContentProvider },
 ): Promise<BlogPostSummary[]> {
   return listPosts(tenantId, THE_BUILD.id, opts);
 }
@@ -18,7 +18,7 @@ export function listBuildPosts(
 export function getBuildPost(
   tenantId: string,
   slug: string,
-  opts?: { includeUnpublished?: boolean; now?: string; content?: ContentProvider },
+  opts?: { includeUnpublished?: boolean; now?: string | null; content?: ContentProvider },
 ): Promise<BlogPost | null> {
   return getPost(tenantId, THE_BUILD.id, slug, opts);
 }

package/apps/storefront/src/middleware/controlPlane.ts

@@ -12,7 +12,14 @@ import { fromD1, type D1Like } from "@/lib/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/apps/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
 import { buildTenantConsentBroker, verifyPreviewToken } from "@tot/public-runtime";
-import type { ConsentSnapshot, IntegrationDeclarationInput, TenantConfig } from "@tot/public-runtime";
+import type {
+  ConsentSnapshot,
+  IntegrationDeclarationInput,
+  PublicationArtifactBucketV1,
+  PublicationRoutePlanV1,
+  RouteTierIndexV1,
+  TenantConfig,
+} from "@tot/public-runtime";
 import {
   evaluateLoginGate,
   isAuthPath,
@@ -27,6 +34,7 @@ import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { runRenderChain } from "./renderChain.js";
+import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
   context: APIContext;
@@ -38,11 +46,17 @@ export interface ControlPlaneInput {
   renderPath: string;
   cache: Cache | undefined;
   kv: KVNamespace | undefined;
+  routeTierIndex: RouteTierIndexV1;
+  publicationRequestPath: string;
+  publicationRoute: PublicationRoutePlanV1;
+  publicationBucket: PublicationArtifactBucketV1 | undefined;
   gateMode: GateMode;
   /** `DEMO_GATE_HOSTS`, raw. */
   demoGateHosts: string | null | undefined;
   /** True when this host is withheld behind sign-in — see `resolveMiddlewareBranchV1`. */
   hostLoginGated: boolean;
+  /** Exact per-request authorization for an F2-selected internal space. */
+  internalContentGrant?: InternalContentGrant;
 }
 
 export async function serveControlPlane(input: ControlPlaneInput): Promise<Response> {
@@ -57,7 +71,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
   // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
   // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
   // grant `resource` is the tenant's appDomain — never input.
-  if (input.hostLoginGated) {
+  if (input.hostLoginGated && !input.internalContentGrant) {
     const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
     // UNIFIED on the federated session: read the FULL session (no resource filter —
     // federated sign-in's aud is the storefront app, not this tenant) and admit the
@@ -232,8 +246,14 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     tenant,
     basePath,
     renderPath,
-    cache,
+    // Internal output never receives a shared-cache handle. The render chain
+    // also refuses its page-cache predicate, making this a two-sided invariant.
+    cache: input.internalContentGrant ? undefined : cache,
     kv,
+    routeTierIndex: input.routeTierIndex,
+    publicationRequestPath: input.publicationRequestPath,
+    publicationRoute: input.publicationRoute,
+    publicationBucket: input.publicationBucket,
     managedIntegrationDeclarations,
     readTenantConsentSnapshot: () => readSavedConsentSnapshot(tenant.tenant_id),
     // The D1 catalog edge read replica, when this deploy opts into it. Deferred to
@@ -242,6 +262,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     // — see `publicRender`.
     readCatalogD1: async (): Promise<D1Like | undefined> =>
       (await readEnv("USE_D1_CATALOG")) === "1" ? await readD1("CATALOG_DB") : undefined,
+    internalContentGrant: input.internalContentGrant,
   });
 }