@tokenoftrust/storefront-runner 2.0.18 → 2.0.20

package/apps/storefront/src/middleware/index.ts

@@ -5,9 +5,9 @@
  * ADR 0013 splits a tenant's surface in two — a public path that is CDN →
  * content-addressed storage with no origin compute, and a control plane the
  * Worker keeps (preview, draft overlay, admin, the dev loop, gated member areas).
- * This file is where that split is taken: `resolveMiddlewareBranchV1` asks
- * `resolveRouteTierV1` (packages/public-runtime) for the tier and returns the
- * branch, and nothing downstream re-derives it.
+ * This file is where that split is taken: `resolveMiddlewareBranchV1` asks the
+ * publication route planner for its route-tier answer and returns the branch,
+ * and nothing downstream re-derives it.
  *
  *   static-passthrough → platform bytes; `next()` plus baseline headers.
  *   public-render      → ./publicRender — anonymous output, no request-time D1.
@@ -21,10 +21,10 @@
  */
 import { defineMiddleware } from "astro:middleware";
 import { getTenantResolver } from "@/config/resolver";
-import { readEnv, readKv } from "@/lib/runtimeEnv";
+import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
 import { resolveTenantRouting } from "@/lib/tenantRouting";
 import { compileRouteTierIndexV1, type RouteTierIndexV1 } from "@tot/public-runtime";
-import type { TenantConfig } from "@tot/public-runtime";
+import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
 import { tryServeStaticBundle } from "./staticBundle.js";
@@ -35,9 +35,19 @@ import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
 import { HEALTH_PATH, healthResponse } from "@/lib/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
-import { resolveMiddlewareBranchV1 } from "./routeBranch.js";
+import {
+  publicationRedirectLocationV1,
+  resolveMiddlewareBranchV1,
+} from "./routeBranch.js";
 import { servePublicRender } from "./publicRender.js";
 import { serveControlPlane } from "./controlPlane.js";
+import { KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+import { mintOpaqueBrokerAssertion } from "@/lib/auth/brokerAssertion";
+import {
+  applyInternalContentResponsePolicy,
+  authorizeInternalContentRequest,
+  type InternalContentGrant,
+} from "@/lib/auth/internalContentAuthority";
 
 /**
  * Compiled once per tenant-config object, as the resolver's contract asks —
@@ -124,12 +134,83 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
   // ---- The one route classification -----------------------------------------
   const hostLoginGated = gateMode === "login" && hostInGateList(host, demoGateHosts);
-  const { branch, route } = resolveMiddlewareBranchV1({
+  const { branch, route, publication } = resolveMiddlewareBranchV1({
     index: routeTierIndexFor(tenant),
     renderPath,
     hostLoginGated,
   });
   locals.routeTier = route;
+  locals.publicationRoute = publication;
+
+  // Public aliases are an edge decision from the same normalized publication
+  // plan. Preserve the path-routing tenant prefix and request query while the
+  // canonical target itself remains tenant-relative. Authorization-gated alias
+  // redirects stay on the control-plane branch for S1 to admit before revealing
+  // a private canonical route.
+  if (branch === "public-render" && publication.action === "redirect-308") {
+    const response = new Response(null, {
+      status: 308,
+      headers: {
+        location: publicationRedirectLocationV1({
+          origin: url.origin,
+          basePath,
+          plan: publication,
+          search: url.search,
+        }),
+      },
+    });
+    applySecurityHeaders(response.headers);
+    return response;
+  }
+
+  // Internal publication admission is bound to the exact F2 route before any
+  // artifact, public-bundle, shared-cache, render, or redirect operation. The
+  // session contributes only its verified opaque subject; current tenant scope
+  // comes from the live broker response on every request.
+  let internalContentGrant: InternalContentGrant | undefined;
+  if (publication.action !== "fail-closed" && route.requiresAuthorization) {
+    const sessionKv = await readKv("SESSION");
+    const decision = await authorizeInternalContentRequest({
+      route,
+      sessionStore: sessionKv ? new KvSessionStore(sessionKv) : undefined,
+      sessionId: context.cookies.get(SESSION_COOKIE)?.value ?? null,
+      coreUrl: await readEnv("TOT_CORE_URL"),
+      mintAssertion: mintOpaqueBrokerAssertion,
+    });
+    if (decision.allowed) internalContentGrant = decision;
+    if (!internalContentGrant) {
+      const response = new Response("Not Found", { status: 404 });
+      applyInternalContentResponsePolicy(response.headers);
+      applySecurityHeaders(response.headers);
+      return response;
+    }
+
+    // An internal alias reveals its target only after the same live decision as
+    // HTML/data/assets. It never becomes a public edge redirect.
+    if (publication.action === "redirect-308") {
+      const response = new Response(null, {
+        status: 308,
+        headers: {
+          location: publicationRedirectLocationV1({
+            origin: url.origin,
+            basePath,
+            plan: publication,
+            search: url.search,
+          }),
+        },
+      });
+      applyInternalContentResponsePolicy(response.headers);
+      applySecurityHeaders(response.headers);
+      return response;
+    }
+  }
+
+  // A render alias dispatches the same existing Astro route as its canonical
+  // mount. Content lookup keeps its separate mount-relative `contentPath` on the
+  // plan; no downstream layer decodes or strips the request again.
+  const publicationRenderPath = publication.action === "render"
+    ? publication.canonicalPath
+    : renderPath;
 
   // Workers Cache API: backs the full-page edge cache in the render chain, and
   // the bundle read below. Undefined in `astro dev` (Node) — a no-op there.
@@ -138,6 +219,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
       ? (caches as unknown as { default: Cache }).default
       : undefined;
   const kv = await readKv("TENANT_CACHE");
+  const publicationBucket = publication.action === "render"
+    ? await readR2("TENANT_ASSETS") as unknown as PublicationArtifactBucketV1 | undefined
+    : undefined;
 
   // Platform bytes: the tenant's own bundle owns them when it has one — a
   // published `/_astro/<hash>.css` exists ONLY in R2, never in this Worker's build
@@ -174,24 +258,43 @@ export const onRequest = defineMiddleware(async (context, next) => {
       url,
       tenant,
       basePath,
-      renderPath,
+      renderPath: publicationRenderPath,
       cache,
       kv,
+      routeTierIndex: routeTierIndexFor(tenant),
+      publicationRequestPath: renderPath,
+      publicationRoute: publication,
+      publicationBucket,
     });
   }
 
-  return await serveControlPlane({
-    context,
-    next,
-    host,
-    url,
-    tenant,
-    basePath,
-    renderPath,
-    cache,
-    kv,
-    gateMode,
-    demoGateHosts,
-    hostLoginGated,
-  });
+  try {
+    const response = await serveControlPlane({
+      context,
+      next,
+      host,
+      url,
+      tenant,
+      basePath,
+      renderPath: publicationRenderPath,
+      cache,
+      kv,
+      routeTierIndex: routeTierIndexFor(tenant),
+      publicationRequestPath: renderPath,
+      publicationRoute: publication,
+      publicationBucket,
+      gateMode,
+      demoGateHosts,
+      hostLoginGated,
+      internalContentGrant,
+    });
+    if (internalContentGrant) applyInternalContentResponsePolicy(response.headers);
+    return response;
+  } catch (error) {
+    if (!internalContentGrant) throw error;
+    const response = new Response("Not Found", { status: 404 });
+    applyInternalContentResponsePolicy(response.headers);
+    applySecurityHeaders(response.headers);
+    return response;
+  }
 });

package/apps/storefront/src/middleware/renderChain.ts

@@ -16,6 +16,8 @@ import { readEnv } from "@/lib/runtimeEnv";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
 import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
+import { bindPublicationSpaceContentProviderV1 } from "@/lib/publication/contentProvider.js";
+import { resolvePublicationRuntimeSourceV1 } from "@/lib/publication/runtimeSource.js";
 import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
 import {
   isCacheablePath,
@@ -52,6 +54,7 @@ import {
   collectDeclaredCspProfiles,
   INTEGRATION_NONCE_PLACEHOLDER,
   defaultConsentSnapshot,
+  exactPublicationTimestamp,
   parseConsentSnapshot,
   CONSENT_SNAPSHOT_INPUT_HEADER,
   CONSENT_SNAPSHOT_SIG_HEADER,
@@ -67,6 +70,9 @@ import type {
   TenantConfig,
   ThemeTokens,
   BrowserEnvironment,
+  PublicationArtifactBucketV1,
+  PublicationRoutePlanV1,
+  RouteTierIndexV1,
 } from "@tot/public-runtime";
 import {
   formatHtmlCacheControl,
@@ -78,6 +84,12 @@ import { resolveTenantCommerce } from "@/lib/checkoutCommerce";
 import { requestBrowserEnvironment, deriveSiteSurface, cspHeaderName } from "@/lib/integration/browserEnvironment";
 import { freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
 import { recordActivity } from "@/lib/activity/recordActivity";
+import { middlewareRewriteTargetV1 } from "./routeBranch.js";
+import {
+  applyInternalContentResponsePolicy,
+  internalContentGrantMatchesPlan,
+  type InternalContentGrant,
+} from "@/lib/auth/internalContentAuthority";
 
 export interface RenderChainInput {
   context: APIContext;
@@ -91,6 +103,10 @@ export interface RenderChainInput {
   /** Workers Cache API default cache; undefined under `astro dev`. */
   cache: Cache | undefined;
   kv: KVNamespace | undefined;
+  routeTierIndex: RouteTierIndexV1;
+  publicationRequestPath: string;
+  publicationRoute: PublicationRoutePlanV1;
+  publicationBucket: PublicationArtifactBucketV1 | undefined;
   /**
    * Managed-install declarations, read from D1 by the caller. Empty on the public
    * branch: a managed install is admin-installed state, and ADR 0013 puts that
@@ -111,11 +127,22 @@ export interface RenderChainInput {
    * parameter rather than the D1 module, so this file names no D1 type at all.
    */
   readCatalogD1: (() => Promise<Parameters<typeof createToTClient>[1]>) | null;
+  /** Exact per-request grant for an F2-selected internal publication space. */
+  internalContentGrant?: InternalContentGrant;
 }
 
 export async function runRenderChain(input: RenderChainInput): Promise<Response> {
   const { context, next, host, url, tenant, basePath, renderPath, cache, kv } = input;
   const { request, locals } = context;
+  const isInternalPublication = input.publicationRoute.action !== "fail-closed" &&
+    input.publicationRoute.manifest.visibility === "internal";
+  if (isInternalPublication &&
+    !internalContentGrantMatchesPlan(input.internalContentGrant, input.publicationRoute)) {
+    const response = new Response("Not Found", { status: 404 });
+    applyInternalContentResponsePolicy(response.headers);
+    applySecurityHeaders(response.headers);
+    return response;
+  }
 
   // Preview/test detection (also reused for the customization env below). A
   // production read is one with no preview host, query token, or preview cookie.
@@ -142,13 +169,62 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // signature, expiry, tenant binding — before the overlay is applied further down.
   const draftCookie = context.cookies.get(DEV_DRAFT_COOKIE)?.value ?? null;
 
+  // Resolve preview/live once before any publication source, static-bundle, or
+  // page-cache read. An exact publication selection is therefore authoritative
+  // for the whole request and can scope every downstream cache decision.
+  const previewToken = queryToken ?? cookieToken;
+  const previewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const customization = await resolveCustomizationEnv({
+    isPreviewHost,
+    tenantId: tenant.tenant_id,
+    token: previewToken,
+    secret: previewSecret,
+    nowSeconds,
+    pathname: url.pathname,
+  });
+  if (customization.reject) {
+    return new Response(customization.reject.message, {
+      status: customization.reject.status,
+    });
+  }
+  if (customization.env === "test" && queryToken) {
+    context.cookies.set("tot_preview", queryToken, {
+      httpOnly: true,
+      secure: true,
+      sameSite: "lax",
+      path: "/",
+      maxAge: 3600,
+    });
+  }
+
+  const publicationSource = await resolvePublicationRuntimeSourceV1({
+    index: input.routeTierIndex,
+    requestPath: input.publicationRequestPath,
+    plan: input.publicationRoute,
+    channel: channelFromEnv(customization.env),
+    store: kv ? { get: (key) => kv.get(key) } : undefined,
+    bucket: input.publicationBucket,
+  });
+  if (publicationSource.status === "unavailable") {
+    const response = new Response("Not Found", {
+      status: 404,
+      headers: { "Cache-Control": "private, no-store" },
+    });
+    applySecurityHeaders(response.headers);
+    if (isInternalPublication) applyInternalContentResponsePolicy(response.headers);
+    return response;
+  }
+  const publicationTimestamp = publicationSource.status === "selected"
+    ? publicationSource.publicationTimestamp
+    : exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
+
   const managedIntegrationDeclarations = input.managedIntegrationDeclarations;
 
-  // Digest-addressed static-bundle serving. Deliberately BEFORE the edge page
-  // cache / catalog / theme / customization machinery below: none of that applies
-  // to bundle bytes served verbatim, and once eligible that path must fully own
-  // the response rather than degrade into the normal render.
-  const bundled = await tryServeStaticBundle({
+  // Digest-addressed static-bundle serving. Deliberately before the edge page
+  // cache/catalog/theme machinery. A selected publication bypasses this legacy
+  // whole-site bundle until B1 can compose mounted spaces into it reproducibly.
+  const bundled = publicationSource.status === "legacy-root" ? await tryServeStaticBundle({
     request,
     url,
     tenant,
@@ -160,7 +236,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     hasCandidatePin: !!candidatePin,
     hasDraftCookie: !!draftCookie,
     hasManagedInstalls: managedIntegrationDeclarations.length > 0,
-  });
+  }) : null;
   if (bundled) return bundled;
 
   // ---- Tenant-local integration materialization (ext-kernel-09) --------------
@@ -182,20 +258,11 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ...managedIntegrationDeclarations,
   ];
   if (integrationDeclarations.length > 0) {
-    const declPreviewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-    const declEnv = await resolveCustomizationEnv({
-      isPreviewHost,
-      tenantId: tenant.tenant_id,
-      token: queryToken ?? cookieToken,
-      secret: declPreviewSecret,
-      nowSeconds: Math.floor(Date.now() / 1000),
-      pathname: url.pathname,
-    });
     const declFeatures = resolveTenantFeatures(tenant);
     resolvedBrowserEnvironment = requestBrowserEnvironment({
       host,
       isPreviewHost,
-      customizationEnv: declEnv.env,
+      customizationEnv: customization.env,
       canonicalHost: tenant.canonicalDomain || host,
       siteSurface: deriveSiteSurface({ catalog: declFeatures.catalog, pathname: renderPath }),
     });
@@ -275,6 +342,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     !cookieToken &&
     !candidatePin &&
     !draftCookie &&
+    !isInternalPublication &&
     isCacheablePath(url.pathname, url.searchParams);
   let pageKey: Request | null = null;
   if (pageCacheEligible && cache && kv) {
@@ -291,6 +359,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       url.search,
       version,
       locals.integrationCsp?.planRevision,
+      publicationSource.status === "selected" ? publicationSource.cacheScope : undefined,
     );
     const hit = await getCachedPage(cache, pageKey);
     // The cached artifact is nonce-free (carries the placeholder). Stamp a fresh
@@ -317,37 +386,6 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? `${proto}://${host}${basePath}`
     : `https://${tenant.canonicalDomain}`;
 
-  // Live vs test customization. Production hosts always serve "live" and
-  // ignore any token; a "preview." host is auth-gated by a signed, tenant-bound,
-  // short-TTL preview token (?__preview= on first hit, then the tot_preview
-  // cookie). Test is never indexable (X-Robots-Tag below).
-  const previewToken = queryToken ?? cookieToken;
-  const previewSecret = (await readEnv("CUSTOMIZATION_PREVIEW_SECRET")) ?? null;
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  const customization = await resolveCustomizationEnv({
-    isPreviewHost,
-    tenantId: tenant.tenant_id,
-    token: previewToken,
-    secret: previewSecret,
-    nowSeconds,
-    pathname: url.pathname,
-  });
-  if (customization.reject) {
-    return new Response(customization.reject.message, {
-      status: customization.reject.status,
-    });
-  }
-  // Persist a query-supplied token as a cookie so later navigations stay in test.
-  if (customization.env === "test" && queryToken) {
-    context.cookies.set("tot_preview", queryToken, {
-      httpOnly: true,
-      secure: true,
-      sameSite: "lax",
-      path: "/",
-      maxAge: 3600,
-    });
-  }
-
   // Apply a published theme override for the resolved environment (store->app).
   // The live domain serves `live`; a gated preview serves `test`. When nothing
   // is published the build-time tenant theme is used unchanged.
@@ -469,6 +507,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   const cspNonce = INTEGRATION_NONCE_PLACEHOLDER;
 
   locals.tenant = tenant;
+  // One immutable clock for every visibility consumer in this render. Selected
+  // Worker content uses its audited pointer transition; materialization uses the
+  // signed build input; an ordinary legacy request has no clock and schedules stay hidden.
+  locals.publicationTimestamp = publicationTimestamp;
   // Effective capability flags for this tenant (commerce defaults unless the
   // tenant declares siteType:"marketing" / explicit features). Pages and chrome
   // read these instead of hard-coding tenant identity checks.
@@ -483,15 +525,19 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       : null;
   locals.commerce = commerce ?? undefined;
   locals.tot = tot;
-  // A verified candidate content pin takes priority over the channel-resolved
-  // read — a pinned candidate/revision render must never fall through to the
-  // shared `{live,test}` content (see `pinnedRouteRender.ts`).
-  locals.content = candidatePin
+  // Resolve the shared root adapter first. An opened publication version then
+  // becomes authoritative for selected content while a mounted space may still
+  // reuse root-owned chrome. Neither source falls through to another space.
+  const sharedRootContent = candidatePin
     ? createContentProvider(tenant, undefined, { get: kvGet, versionId: candidatePin.versionId })
     : createContentProvider(tenant, {
         get: kvGet,
         env: customization.env,
       });
+  locals.content = bindPublicationSpaceContentProviderV1(
+    sharedRootContent,
+    publicationSource.status === "selected" ? publicationSource.artifact : undefined,
+  );
   // Developer-draft content overlay — serves the AI-edited artifacts to the draft
   // owner only; every other viewer keeps the published/base chain above.
   if (draft) {
@@ -543,11 +589,17 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     locals.integrationPlan ??
     resolveEnvironmentOnlyPlan(locals.browserEnvironment, tenant.tenant_id);
 
-  // When a /<domain>/ prefix selected the tenant, rewrite to the stripped route
-  // so the existing file-based routes match. next(path) rewrites WITHOUT
-  // re-running middleware, so the locals set above are preserved.
-  let response = basePath
-    ? await next(`${renderPath}${url.search}`)
+  // Rewrite when a /<domain>/ prefix was stripped OR a publication render alias
+  // resolved to its canonical mount. next(path) does not re-run middleware, so
+  // the one route plan and locals above remain authoritative.
+  const rewriteTarget = middlewareRewriteTargetV1({
+    requestPath: url.pathname,
+    basePath,
+    renderPath,
+    search: url.search,
+  });
+  let response = rewriteTarget !== undefined
+    ? await next(rewriteTarget)
     : await next();
 
   // On-publish auto-refresh: inject the live-reload client into SHARED preview
@@ -678,6 +730,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       formatHtmlCacheControl(locals.tenant?.serving?.htmlCachePolicy),
     );
   }
+  if (isInternalPublication) applyInternalContentResponsePolicy(response.headers);
   // Stamp a fresh per-response nonce into this cold response's body + CSP header
   // (the warm-hit path above stamps its own). Both paths therefore serve a fresh,
   // matching nonce/CSP pair, and no nonce is reused across responses (ADR 0018).

package/apps/storefront/src/middleware/routeBranch.ts

@@ -1,8 +1,8 @@
 /**
  * Which of the three middleware branches serves this request.
  *
- * The TIER answer is F2's — `resolveRouteTierV1` (packages/public-runtime) — and
- * is never re-derived here. This module only maps that one answer onto the three
+ * The TIER answer is F2's, carried by `resolvePublicationRoutePlanV1`, and is
+ * never re-derived here. This module only maps that one answer onto the three
  * serving shapes the Worker actually has, and applies the literal path tables
  * that correct the resolver's deliberate fail-closed over-restriction of
  * platform-reserved paths.
@@ -26,7 +26,13 @@
  *
  * Contract: docs/architecture/decisions/0013-public-serving-contract.md
  */
-import { resolveRouteTierV1, type RouteTierIndexV1, type ResolvedRouteTierV1 } from "@tot/public-runtime";
+import {
+  resolvePublicationRoutePlanV1,
+  type PublicationRoutePlanV1,
+  type PublicationRouteRedirectPlanV1,
+  type RouteTierIndexV1,
+  type ResolvedRouteTierV1,
+} from "@tot/public-runtime";
 
 /**
  * The three serving shapes.
@@ -132,6 +138,30 @@ export interface ResolvedMiddlewareBranchV1 {
   branch: MiddlewareBranchV1;
   /** F2's answer for this request, surfaced on `locals.routeTier`. */
   route: ResolvedRouteTierV1;
+  /** One normalized publication-space answer shared by dispatch and rendering. */
+  publication: PublicationRoutePlanV1;
+}
+
+/** Astro rewrite target for tenant-prefix stripping or canonical render aliases. */
+export function middlewareRewriteTargetV1(input: {
+  requestPath: string;
+  basePath: string;
+  renderPath: string;
+  search: string;
+}): string | undefined {
+  return input.basePath !== "" || input.renderPath !== input.requestPath
+    ? `${input.renderPath}${input.search}`
+    : undefined;
+}
+
+/** Absolute 308 location for host- and path-routed publication aliases. */
+export function publicationRedirectLocationV1(input: {
+  origin: string;
+  basePath: string;
+  plan: PublicationRouteRedirectPlanV1;
+  search: string;
+}): string {
+  return `${input.origin}${input.basePath}${input.plan.locationPath}${input.search}`;
 }
 
 /**
@@ -142,19 +172,21 @@ export interface ResolvedMiddlewareBranchV1 {
 export function resolveMiddlewareBranchV1(
   input: MiddlewareBranchInputV1,
 ): ResolvedMiddlewareBranchV1 {
-  const route = resolveRouteTierV1(input.index, input.renderPath);
-  if (input.hostLoginGated) return { branch: "control-plane", route };
+  const publication = resolvePublicationRoutePlanV1(input.index, input.renderPath);
+  const route = publication.route;
+  if (input.hostLoginGated) return { branch: "control-plane", route, publication };
   if (isPlatformStaticAssetPath(input.renderPath)) {
-    return { branch: "static-passthrough", route };
+    return { branch: "static-passthrough", route, publication };
   }
   if (
     isPlatformPublicDiscoveryPath(input.renderPath) ||
     isPlatformPublicAppRoutePath(input.renderPath)
   ) {
-    return { branch: "public-render", route };
+    return { branch: "public-render", route, publication };
   }
   return {
     branch: route.requiresAuthorization ? "control-plane" : "public-render",
     route,
+    publication,
   };
 }

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -125,6 +125,7 @@ export async function POST(context: APIContext): Promise<Response> {
   const { id } = await createSession(
     store,
     {
+      subject: derived.subject,
       email: derived.email,
       resource: derived.resource,
       roles: [],

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -110,6 +110,7 @@ export async function POST(context: APIContext): Promise<Response> {
   const { id } = await createSession(
     store,
     {
+      subject: derived.subject,
       email: derived.email,
       resource: derived.resource,
       roles: [],

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -137,6 +137,7 @@ export async function POST(context: APIContext): Promise<Response> {
   const { id } = await createSession(
     store,
     {
+      subject: derived.subject,
       email: derived.email,
       // The verified aud (storefront app identity) — the console session's scope.
       resource: derived.resource,

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -98,7 +98,10 @@ export const POST: APIRoute = async (context) => {
   // Best-effort: no-ops for a non-live post; never throws. When there is no KV
   // binding (local dev) the increment can't persist, but we still return the
   // (all-zero) tallies so the client has a consistent shape.
-  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction);
+  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction, {
+    content: context.locals.content,
+    now: context.locals.publicationTimestamp,
+  });
 
   return json({ ok: true, counts: await getReactionCounts(kv, tenantId, collection, slug) });
 };

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -61,7 +61,10 @@ export const POST: APIRoute = async (context) => {
         if (tenantId && kv) {
           const cfContext =
             (context.locals as { cfContext?: CfExecutionContextLike })?.cfContext ?? null;
-          runAfterResponse(recordBlogView(kv, tenantId, sample.path), cfContext);
+          runAfterResponse(recordBlogView(kv, tenantId, sample.path, {
+            content: context.locals.content,
+            now: context.locals.publicationTimestamp,
+          }), cfContext);
         }
       }
     }

package/apps/storefront/src/pages/blog/[slug].astro

@@ -11,9 +11,9 @@ import { buildAlternates } from "@/lib/seo/alternates.js";
 import { languageLabel } from "@/lib/i18n.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/jsonld.js";
 
-const { tenant, canonicalBase, basePath, content } = Astro.locals;
+const { tenant, canonicalBase, basePath, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.slug ?? "";
-const post = await getBlogPost(tenant.tenant_id, slug, content);
+const post = await getBlogPost(tenant.tenant_id, slug, content, publicationTimestamp);
 if (!post) {
   const redirect = await resolveBlogRedirect(tenant.tenant_id, slug, content);
   if (redirect) return Astro.redirect(`${basePath}/blog/${redirect}/`, 301);
@@ -38,7 +38,7 @@ const canonical = new URL(`/blog/${post.slug}/`, canonicalBase + "/").toString()
 // (the invariant `blog/author/[author].astro` documents). Same slug + same source
 // the archive itself filters on, so the two can't disagree.
 const authorArchiveSlug = authorSlug(post.author);
-const authorHasArchive = (await listBlogPosts(tenant.tenant_id, content)).some(
+const authorHasArchive = (await listBlogPosts(tenant.tenant_id, content, publicationTimestamp)).some(
   (p) => authorSlug(p.author) === authorArchiveSlug,
 );
 const authorUrl = authorHasArchive
@@ -63,7 +63,7 @@ const authorHref = authorHasArchive
 // I2 — hreflang alternates + per-variant <html lang>. Singleton ⇒ [] alternates
 // and no `lang` override, so a non-translated post is byte-identical to today.
 const translations = post.translationGroupId
-  ? await getTranslations(tenant.tenant_id, "blog", post.slug, { content })
+  ? await getTranslations(tenant.tenant_id, "blog", post.slug, { content, now: publicationTimestamp })
   : [];
 const alternates = buildAlternates(translations, (s) =>
   new URL(`/blog/${s}/`, canonicalBase + "/").toString(),
@@ -77,6 +77,7 @@ const lang = alternates.length ? (post.inLanguage ?? "en") : undefined;
   path={`/blog/${post.slug}/`}
   ogType="article"
   ogImage={post.featuredImage?.src}
+  noindex={post.status === "unlisted"}
   jsonLd={[crumbs, articleLd]}
   article={{
     publishedTime: post.publishedAt,