@tokenoftrust/storefront-runner 2.0.18 → 2.0.20

package/apps/storefront/src/pages/blog/author/[author].astro

@@ -8,10 +8,10 @@ import { breadcrumbLd } from "@/lib/jsonld.js";
 // Author archive for the `/blog` collection. Lists exactly the posts whose
 // bylines link here (same source as /blog/index.astro + /blog/[slug].astro),
 // so a byline never points at a page missing its post.
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.author ?? "";
 
-const allPosts = await listBlogPosts(tenant.tenant_id, content);
+const allPosts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const posts = allPosts.filter((post) => authorSlug(post.author) === slug);
 if (posts.length === 0) return new Response(null, { status: 404 });
 

package/apps/storefront/src/pages/blog/category/[category].astro

@@ -5,12 +5,12 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const param = Astro.params.category ?? "";
 
 // Same source as the /blog index (the collection's curated list), filtered to
 // one category — so a post can never appear here that isn't already live on /blog.
-const all = await listBlogPosts(tenant.tenant_id, content);
+const all = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const match = collectPostsByTerm(all, "categories", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;

package/apps/storefront/src/pages/blog/index.astro

@@ -3,8 +3,8 @@ import Layout from "@/layouts/Layout.astro";
 import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
 import { listBlogPosts } from "@/lib/blog/provider.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
-const posts = await listBlogPosts(tenant.tenant_id, content);
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const posts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 // A tenant with no blog content has no blog index, so this is still a 404 — but
 // it is a DIFFERENT 404 from "no such route", and telling them apart from the
 // outside used to be impossible (both were bare and byte-identical). The header

package/apps/storefront/src/pages/blog/tag/[tag].astro

@@ -5,10 +5,10 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const param = Astro.params.tag ?? "";
 
-const all = await listBlogPosts(tenant.tenant_id, content);
+const all = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const match = collectPostsByTerm(all, "tags", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;

package/apps/storefront/src/pages/llms.txt.ts

@@ -22,7 +22,7 @@ function oneLine(s: string | undefined, max = 140): string | undefined {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, tenant, canonicalBase, content } = context.locals;
+  const { tot, tenant, canonicalBase, content, publicationTimestamp } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
 
   // Use the request-resolved ContentProvider (locals.content) so any published /
@@ -34,7 +34,7 @@ export async function GET(context: APIContext): Promise<Response> {
       content.listPages(),
       tot.getFeatured(12),
       content.getHome().catch(() => null),
-      listBlogPosts(tenant.tenant_id, content),
+      listBlogPosts(tenant.tenant_id, content, publicationTimestamp),
     ]);
   // Empty synthesized collections (no active members) never make the guide —
   // an LLM shouldn't be pointed at a URL that resolves to zero products.

package/apps/storefront/src/pages/sitemap.xml.ts

@@ -11,7 +11,7 @@
 import type { APIContext } from "astro";
 import { nonEmptyCollections } from "@/lib/tot/query.js";
 import { listBlogPosts } from "@/lib/blog/provider.js";
-import { authorSlug } from "@/lib/blog/collection.js";
+import { authorSlug, categorySlug } from "@/lib/blog/collection.js";
 import { listBuildPosts } from "@/lib/the-build/provider.js";
 
 interface SitemapUrl {
@@ -30,7 +30,7 @@ function escapeXml(value: string): string {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, tenant, canonicalBase, content, features } = context.locals;
+  const { tot, tenant, canonicalBase, content, features, publicationTimestamp } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
 
   const urls: SitemapUrl[] = [{ loc: `${base}/` }];
@@ -67,7 +67,7 @@ export async function GET(context: APIContext): Promise<Response> {
     urls.push({ loc: `${base}/${page.slug}` });
   }
 
-  const blogPosts = await listBlogPosts(tenant.tenant_id, content);
+  const blogPosts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
   if (blogPosts.length > 0) {
     urls.push({ loc: `${base}/blog/` });
     for (const post of blogPosts) {
@@ -83,9 +83,13 @@ export async function GET(context: APIContext): Promise<Response> {
     for (const slug of authorSlugs) {
       urls.push({ loc: `${base}/blog/author/${slug}/` });
     }
+    const categorySlugs = [...new Set(blogPosts.flatMap((post) => post.categories.map(categorySlug)).filter(Boolean))].sort();
+    const tagSlugs = [...new Set(blogPosts.flatMap((post) => post.tags.map(categorySlug)).filter(Boolean))].sort();
+    for (const slug of categorySlugs) urls.push({ loc: `${base}/blog/category/${slug}/` });
+    for (const slug of tagSlugs) urls.push({ loc: `${base}/blog/tag/${slug}/` });
   }
 
-  const buildPosts = await listBuildPosts(tenant.tenant_id, { content });
+  const buildPosts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
   if (buildPosts.length > 0) {
     urls.push({ loc: `${base}/the-build/` });
     for (const post of buildPosts) {

package/apps/storefront/src/pages/the-build/[slug].astro

@@ -11,9 +11,9 @@ import { getTranslations } from "@/lib/blog/collection.js";
 import { buildAlternates } from "@/lib/seo/alternates.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, canonicalBase, basePath, content } = Astro.locals;
+const { tenant, canonicalBase, basePath, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.slug ?? "";
-const post = await getBuildPost(tenant.tenant_id, slug, { content });
+const post = await getBuildPost(tenant.tenant_id, slug, { content, now: publicationTimestamp });
 if (!post) {
   const redirect = await resolveBuildRedirect(tenant.tenant_id, slug, content);
   if (redirect) return Astro.redirect(`${basePath}/the-build/${redirect}/`, 301);
@@ -45,7 +45,10 @@ const buildHref = `${basePath}/the-build/`;
 // the live-visible variant set (self + siblings); `buildAlternates` yields [] for
 // a singleton, so a non-translated post gets no alternates and no `lang` override
 // (byte-identical to today).
-const translations = await getTranslations(tenant.tenant_id, THE_BUILD.id, post.slug, { content });
+const translations = await getTranslations(tenant.tenant_id, THE_BUILD.id, post.slug, {
+  content,
+  now: publicationTimestamp,
+});
 const alternates = buildAlternates(translations, (s) =>
   new URL(`/the-build/${s}/`, canonicalBase + "/").toString(),
 );

package/apps/storefront/src/pages/the-build/index.astro

@@ -8,8 +8,8 @@ import Layout from "@/layouts/Layout.astro";
 import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
 import { listBuildPosts } from "@/lib/the-build/provider.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
-const posts = await listBuildPosts(tenant.tenant_id, { content });
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
 if (posts.length === 0) return new Response(null, { status: 404 });
 
 const href = (path: string) => `${basePath}${path}` || "/";

package/apps/storefront/src/pages/the-build/rss.xml.ts

@@ -11,8 +11,8 @@ import { listBuildPosts, THE_BUILD } from "@/lib/the-build/provider.js";
 import { renderRssFeed } from "@/lib/blog/rss.js";
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tenant, canonicalBase, content } = context.locals;
-  const posts = await listBuildPosts(tenant.tenant_id, { content });
+  const { tenant, canonicalBase, content, publicationTimestamp } = context.locals;
+  const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
   if (posts.length === 0) return new Response(null, { status: 404 });
 
   const body = renderRssFeed({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.18",
+  "version": "2.0.20",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -8,7 +8,8 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./blog-visibility": "./src/blog-visibility.mjs"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/packages/public-runtime/src/blog-visibility.d.mts

@@ -0,0 +1,8 @@
+export interface BlogVisibilityInput {
+  status?: unknown;
+  scheduledAt?: unknown;
+}
+
+export declare function exactPublicationTimestamp(value: unknown): string | null;
+export declare function isBlogPostVisibleOnLive(post: BlogVisibilityInput, now?: string | null): boolean;
+export declare function isBlogPostListableOnLive(post: BlogVisibilityInput, now?: string | null): boolean;

package/packages/public-runtime/src/blog-visibility.mjs

@@ -0,0 +1,32 @@
+// @ts-check
+
+/** @param {unknown} value */
+export function exactPublicationTimestamp(value) {
+  if (typeof value !== "string") return null;
+  try {
+    return new Date(value).toISOString() === value ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** @param {{status?: unknown, scheduledAt?: unknown}} post @param {unknown} now */
+function scheduledIsDue(post, now) {
+  const publicationTimestamp = exactPublicationTimestamp(now);
+  if (post.status !== "scheduled" || typeof post.scheduledAt !== "string" ||
+    !publicationTimestamp) return false;
+  const due = Date.parse(post.scheduledAt);
+  return !Number.isNaN(due) && due <= Date.parse(publicationTimestamp);
+}
+
+/** Canonical direct-route visibility: unlisted resolves but never enters a listing. */
+export function isBlogPostVisibleOnLive(post, now) {
+  const status = post.status ?? "published";
+  return status === "published" || status === "unlisted" || scheduledIsDue({ ...post, status }, now);
+}
+
+/** Canonical archive/feed/sitemap visibility. Missing legacy status means published. */
+export function isBlogPostListableOnLive(post, now) {
+  const status = post.status ?? "published";
+  return status === "published" || scheduledIsDue({ ...post, status }, now);
+}

package/packages/public-runtime/src/index.ts

@@ -16,8 +16,11 @@
 export * from "./product.js";
 export * from "./tenant.js";
 export * from "./publication-space.js";
+export * from "./blog-visibility.mjs";
+export * from "./publication-routing.js";
 export * from "./publication-version.js";
 export * from "./publication-artifact.js";
+export * from "./publication-reader.js";
 // The ONE route-tier authority: route -> mount -> publication space ->
 // {visibility, authorization} -> an ADR 0013 tier. No consumer derives its own.
 export * from "./route-tier.js";

package/packages/public-runtime/src/publication-artifact.ts

@@ -1,6 +1,9 @@
 import type { PublicationSpaceManifestV1 } from "./publication-space.js";
 import { sha256Hex } from "./hash.js";
 
+const PUBLICATION_ARTIFACT_IDENTIFIER_RE = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/;
+const PUBLICATION_ARTIFACT_VERSION_RE = /^pv_[a-z0-9](?:[a-z0-9._:-]{4,122}[a-z0-9])$/;
+
 /** Renderer-safe description of one immutable publication artifact file. */
 export interface PublicationArtifactFileV1 {
   lane: "content" | "public-asset" | "authorized-asset";
@@ -188,9 +191,9 @@ export function publicationArtifactKeyV1(
   lane: PublicationArtifactFileV1["lane"],
   relativePath: string,
 ): string {
-  const identifier = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/;
-  const version = /^pv_[a-z0-9](?:[a-z0-9._:-]{4,122}[a-z0-9])$/;
-  if (!identifier.test(tenant) || !identifier.test(spaceId) || !version.test(versionId)) {
+  if (!PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(tenant) ||
+    !PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(spaceId) ||
+    !PUBLICATION_ARTIFACT_VERSION_RE.test(versionId)) {
     throw new Error("publication artifact identity is unsafe");
   }
   if (!["content", "public-asset", "authorized-asset"].includes(lane) ||
@@ -201,3 +204,17 @@ export function publicationArtifactKeyV1(
   }
   return `publications/${tenant}/${spaceId}/${versionId}/${lane}/${relativePath}`;
 }
+
+/** Marker address for one immutable tenant+space+version bundle. */
+export function publicationArtifactBundleKeyV1(
+  tenant: string,
+  spaceId: string,
+  versionId: string,
+): string {
+  if (!PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(tenant) ||
+    !PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(spaceId) ||
+    !PUBLICATION_ARTIFACT_VERSION_RE.test(versionId)) {
+    throw new Error("publication artifact identity is unsafe");
+  }
+  return `publications/${tenant}/${spaceId}/${versionId}/bundle.json`;
+}

package/packages/public-runtime/src/publication-reader.ts

@@ -0,0 +1,187 @@
+import {
+  publicationArtifactBundleKeyV1,
+  publicationArtifactFileBytesV1,
+  publicationArtifactKeyV1,
+  validatePublicationArtifactBundleV1,
+  type PublicationArtifactBundleV1,
+  type PublicationArtifactFileV1,
+} from "./publication-artifact.js";
+import {
+  selectPublicationRouteVersionV1,
+  type PublicationRouteFailureCodeV1,
+  type PublicationRoutePlanV1,
+  type SelectedPublicationRouteV1,
+} from "./publication-routing.js";
+import type {
+  PublicationChannelV1,
+  PublicationVersionStateV1,
+} from "./publication-version.js";
+import type { RouteTierIndexV1 } from "./route-tier.js";
+
+export interface PublicationStoredObjectV1 {
+  text(): Promise<string>;
+  arrayBuffer(): Promise<ArrayBuffer>;
+}
+
+/** Provider-neutral object-store read surface; R2 and test stores both satisfy it. */
+export interface PublicationArtifactBucketV1 {
+  get(key: string): Promise<PublicationStoredObjectV1 | null>;
+}
+
+export type PublicationArtifactOpenFailureCodeV1 =
+  | PublicationRouteFailureCodeV1
+  | "publication_artifact_marker_missing"
+  | "publication_artifact_marker_malformed"
+  | "publication_artifact_file_missing"
+  | "publication_artifact_file_mismatch"
+  | "publication_artifact_source_unavailable";
+
+export interface OpenPublicationArtifactV1 {
+  selection: SelectedPublicationRouteV1;
+  bundle: PublicationArtifactBundleV1;
+  /** Read a UTF-8 artifact relative to the selected space's content/ root. */
+  readContent(relativePath: string): string | null;
+  /** List paths relative to the selected space's content/ root. */
+  listContentPaths(prefix?: string): string[];
+  /** Read bytes relative to this space's declared asset namespace. */
+  readAsset(relativePath: string): Uint8Array | null;
+}
+
+export type OpenPublicationArtifactResultV1 =
+  | { ok: true; value: OpenPublicationArtifactV1 }
+  | { ok: false; code: PublicationArtifactOpenFailureCodeV1 };
+
+function safeRelativePath(path: string, allowEmpty = false): boolean {
+  if (path === "") return allowEmpty;
+  return !path.startsWith("/") && !path.includes("\\") && !path.includes("\0") &&
+    path.split("/").every((part) => !!part && part !== "." && part !== "..");
+}
+
+function equalBytes(left: Uint8Array, right: Uint8Array): boolean {
+  return left.byteLength === right.byteLength &&
+    left.every((value, index) => value === right[index]);
+}
+
+/**
+ * Open exactly one selected publication version and validate every physical
+ * object before rendering from it. A route/state/provenance/object failure is
+ * terminal for this source; callers must not fall through to another space.
+ */
+export async function openPublicationArtifactV1(input: {
+  index: RouteTierIndexV1;
+  requestPath: string;
+  plan: PublicationRoutePlanV1;
+  state: PublicationVersionStateV1;
+  channel: PublicationChannelV1;
+  bucket: PublicationArtifactBucketV1;
+}): Promise<OpenPublicationArtifactResultV1> {
+  const selected = selectPublicationRouteVersionV1(
+    input.index,
+    input.requestPath,
+    input.plan,
+    input.state,
+    input.channel,
+  );
+  if (!selected.ok) return { ok: false, code: selected.code };
+  return openSelectedPublicationArtifactV1(selected.value, input.bucket);
+}
+
+async function openSelectedPublicationArtifactV1(
+  selection: SelectedPublicationRouteV1,
+  bucket: PublicationArtifactBucketV1,
+): Promise<OpenPublicationArtifactResultV1> {
+  const { manifest, publicationVersion } = selection;
+  let marker: PublicationStoredObjectV1 | null;
+  try {
+    marker = await bucket.get(publicationArtifactBundleKeyV1(
+      manifest.tenant,
+      manifest.id,
+      publicationVersion.versionId,
+    ));
+  } catch {
+    return { ok: false, code: "publication_artifact_source_unavailable" };
+  }
+  if (!marker) return { ok: false, code: "publication_artifact_marker_missing" };
+
+  let markerValue: unknown;
+  try {
+    markerValue = JSON.parse(await marker.text());
+  } catch {
+    return { ok: false, code: "publication_artifact_marker_malformed" };
+  }
+  const checked = await validatePublicationArtifactBundleV1(markerValue, {
+    tenant: manifest.tenant,
+    spaceId: manifest.id,
+    versionId: publicationVersion.versionId,
+    sourceSha: publicationVersion.source.commitSha,
+    artifactDigest: publicationVersion.artifactDigest,
+    forge: manifest.source.forge,
+    repo: manifest.source.repo,
+    visibility: manifest.visibility,
+    assetNamespace: manifest.assets.namespace,
+    assetAccess: manifest.assets.access,
+  });
+  if (!checked.ok) return { ok: false, code: "publication_artifact_marker_malformed" };
+
+  const physical = new Map<string, Uint8Array>();
+  for (const file of checked.value.files) {
+    const expected = publicationArtifactFileBytesV1(file);
+    if (!expected) return { ok: false, code: "publication_artifact_marker_malformed" };
+    let stored: PublicationStoredObjectV1 | null;
+    try {
+      stored = await bucket.get(publicationArtifactKeyV1(
+        manifest.tenant,
+        manifest.id,
+        publicationVersion.versionId,
+        file.lane,
+        file.path,
+      ));
+    } catch {
+      return { ok: false, code: "publication_artifact_source_unavailable" };
+    }
+    if (!stored) return { ok: false, code: "publication_artifact_file_missing" };
+    let actual: Uint8Array;
+    try {
+      actual = new Uint8Array(await stored.arrayBuffer());
+    } catch {
+      return { ok: false, code: "publication_artifact_file_missing" };
+    }
+    if (!equalBytes(actual, expected)) {
+      return { ok: false, code: "publication_artifact_file_mismatch" };
+    }
+    physical.set(`${file.lane}\0${file.path}`, actual);
+  }
+
+  const contentFiles = checked.value.files.filter(
+    (file): file is PublicationArtifactFileV1 & { encoding: "utf8" } =>
+      file.lane === "content" && file.encoding === "utf8" && file.path.startsWith("content/"),
+  );
+  const assetLane = manifest.assets.access === "public" ? "public-asset" : "authorized-asset";
+  const assetPrefix = `${manifest.assets.namespace}/`;
+  return {
+    ok: true,
+    value: {
+      selection,
+      bundle: checked.value,
+      readContent(relativePath) {
+        if (!safeRelativePath(relativePath)) return null;
+        const path = `content/${relativePath}`;
+        const file = contentFiles.find((candidate) => candidate.path === path);
+        if (!file) return null;
+        const bytes = physical.get(`content\0${path}`);
+        return bytes ? new TextDecoder().decode(bytes) : null;
+      },
+      listContentPaths(prefix = "") {
+        if (!safeRelativePath(prefix.replace(/\/$/, ""), true)) return [];
+        return contentFiles
+          .map((file) => file.path.slice("content/".length))
+          .filter((path) => path.startsWith(prefix))
+          .sort();
+      },
+      readAsset(relativePath) {
+        if (!safeRelativePath(relativePath)) return null;
+        return physical.get(`${assetLane}\0${assetPrefix}${relativePath}`) ?? null;
+      },
+    },
+  };
+}