@tokenoftrust/storefront-runner 2.0.19 → 2.0.21

package/apps/storefront/env.d.ts

@@ -115,6 +115,8 @@ declare global {
       routeTier: ResolvedRouteTierV1;
       /** Normalized publication mount/canonical/content plan for this request. */
       publicationRoute: PublicationRoutePlanV1;
+      /** Audited selected aggregate transition instant; null means schedules stay hidden. */
+      publicationTimestamp: string | null;
       /**
        * Effective capability flags for the resolved tenant (commerce defaults
        * unless siteType:"marketing"/explicit features). Chrome, layout islands,
@@ -195,11 +197,13 @@ declare global {
       /**
        * Signed-in viewer for a login-gated preview host (set by the demo login
        * gate once a valid, resource-bound `tot_session` cookie is present). Carries
-       * the email + the role(s)/capability tot20 resolved on this tenant, so chrome
+       * the opaque subject, email + role(s)/capability tot20 resolved on this tenant, so chrome
        * can show "signed in as … — owner/developer/staff". Absent on open or
        * password-gated hosts.
        */
       viewer?: {
+        /** Opaque identity-provider subject from the verified session assertion. */
+        subject?: string;
         email: string;
         roles: string[];
         capability: string;

package/apps/storefront/migrations-apps/0013_publication_space_editorial.sql

@@ -0,0 +1,64 @@
+CREATE TABLE `publication_space_versions` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `version_id` text NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `version_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `publication_space_reviews` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `version_id` text NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `version_id`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_reviews_tenant`
+  ON `publication_space_reviews` (`tenant_id`, `space_id`);
+--> statement-breakpoint
+CREATE TABLE `publication_space_pointers` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `channel`)
+);
+--> statement-breakpoint
+CREATE TABLE `publication_space_transitions` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `transition_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `transition_id`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_publication_space_transition_revision`
+  ON `publication_space_transitions` (`tenant_id`, `space_id`, `channel`, `revision`);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_transitions_tenant`
+  ON `publication_space_transitions` (`tenant_id`, `space_id`, `channel`);
+--> statement-breakpoint
+CREATE TABLE `publication_space_projections` (
+  `tenant_id` text NOT NULL,
+  `space_id` text NOT NULL,
+  `channel` text NOT NULL,
+  `revision` integer NOT NULL,
+  `transition_id` text NOT NULL,
+  `operation` text NOT NULL,
+  `provider` text NOT NULL,
+  `status` text NOT NULL DEFAULT 'pending',
+  `attempts` integer NOT NULL DEFAULT 0,
+  `last_error` text,
+  `record` text NOT NULL,
+  PRIMARY KEY(`tenant_id`, `space_id`, `channel`, `revision`)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `uq_publication_space_projection_transition`
+  ON `publication_space_projections` (`tenant_id`, `space_id`, `transition_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_publication_space_projections_pending`
+  ON `publication_space_projections` (`tenant_id`, `status`, `revision`);

package/apps/storefront/src/config/publicationSpaceRegistry.ts

@@ -0,0 +1,19 @@
+import type { PublicationSpaceManifestV1, PublicationSpaceSourceV1 } from "@tot/public-runtime";
+import { rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+
+const ROOT_SOURCES: Readonly<Record<string, PublicationSpaceSourceV1>> = {
+  home: { forge: "fixture", repo: "home", defaultBranch: "main" },
+  "tokenoftrust.com": { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" },
+  "sample-store.com": { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" },
+  "sample-store.e2e.test": { forge: "fixture", repo: "sample-store.e2e.test", defaultBranch: "main" },
+  "verify.e2e.test": { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" },
+  "fixture.e2e.test": { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" },
+  "chrome.e2e.test": { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" },
+};
+
+/** Node-safe publication topology authority shared by runtime config and CI composition. */
+export function publicationSpacesForTenant(tenant: string): PublicationSpaceManifestV1[] {
+  const source = ROOT_SOURCES[tenant];
+  if (!source) return [];
+  return [rootPublicationSpaceConfig(tenant, source)];
+}

package/apps/storefront/src/lib/blog/collection.ts

@@ -1,6 +1,12 @@
-import { tenantDirSegment } from "@tot/public-runtime";
+import {
+  exactPublicationTimestamp,
+  isBlogPostListableOnLive,
+  isBlogPostVisibleOnLive,
+  tenantDirSegment,
+} from "@tot/public-runtime";
 import type { AuthorBio, BlogPost, BlogPostSummary, PostStatus } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
+import { readEnv } from "../env.js";
 
 type ArtifactSource = Pick<ContentProvider, "readArtifact" | "listArtifactPaths">;
 function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactSource {
@@ -8,7 +14,7 @@ function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactS
 }
 export interface CollectionReadOptions {
   includeUnpublished?: boolean;
-  now?: string;
+  now?: string | null;
   content?: ArtifactSource;
 }
 
@@ -50,15 +56,9 @@ const SEGMENT_RE = /^[a-z0-9][a-z0-9._-]*$/;
  * A "scheduled" post whose `scheduledAt` instant has passed behaves exactly like
  * "published". Before that instant it is treated like a draft (invisible, unlisted).
  * A scheduled post with a missing/unparseable `scheduledAt` is never due (safe: it
- * stays hidden rather than leaking). Because visibility is computed at build/request
- * time, a post committed ahead of time simply needs a build after its instant.
+ * stays hidden rather than leaking). Scheduled visibility is evaluated only against
+ * an explicit publication timestamp; wall-clock passage never changes a live release.
  */
-function isDueScheduled(p: { status: PostStatus; scheduledAt?: string }, now: string): boolean {
-  if (p.status !== "scheduled" || typeof p.scheduledAt !== "string") return false;
-  const due = Date.parse(p.scheduledAt);
-  return !Number.isNaN(due) && due <= Date.parse(now);
-}
-
 /**
  * The single visibility chokepoint: is a post reachable at its URL on the live
  * site? Published, unlisted, and due-scheduled resolve; drafts and not-yet-due
@@ -68,9 +68,9 @@ function isDueScheduled(p: { status: PostStatus; scheduledAt?: string }, now: st
  */
 export function isVisibleOnLive(
   p: { status: PostStatus; scheduledAt?: string },
-  now: string = new Date().toISOString(),
+  now?: string | null,
 ): boolean {
-  return p.status === "published" || p.status === "unlisted" || isDueScheduled(p, now);
+  return isBlogPostVisibleOnLive(p, now);
 }
 
 /** "Category Insurance" -> "category-insurance" */
@@ -166,6 +166,11 @@ function toSummary(p: BlogPost): BlogPostSummary {
   };
 }
 
+async function visibilityTimestamp(explicit?: string | null): Promise<string | null> {
+  if (explicit !== undefined) return exactPublicationTimestamp(explicit);
+  return exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
+}
+
 /**
  * The collection ids that actually have post content for a tenant, derived from
  * the same glob the index is built from (no per-tenant config needed). Sorted for
@@ -233,9 +238,9 @@ export async function listPosts(
           .map((key) => postGlobs[key]!()),
       )).map(normalize);
   const includeUnpublished = opts?.includeUnpublished ?? false;
-  const now = opts?.now ?? new Date().toISOString();
+  const now = await visibilityTimestamp(opts?.now);
   return posts
-    .filter((p) => includeUnpublished || p.status === "published" || isDueScheduled(p, now))
+    .filter((p) => includeUnpublished || isBlogPostListableOnLive(p, now))
     .sort((a, b) => (a.publishedAt < b.publishedAt ? 1 : a.publishedAt > b.publishedAt ? -1 : 0))
     .map(toSummary);
 }
@@ -258,7 +263,7 @@ export async function getPost(
     if (raw) {
       try {
         const post = normalize(JSON.parse(raw) as BlogPost);
-        if (!(opts.includeUnpublished ?? false) && !isVisibleOnLive(post, opts.now)) return null;
+        if (!(opts.includeUnpublished ?? false) && !isVisibleOnLive(post, await visibilityTimestamp(opts.now))) return null;
         return post;
       } catch {
         return null;
@@ -272,7 +277,7 @@ export async function getPost(
   );
   if (!key) return null;
   const post = normalize(await postGlobs[key]!());
-  if (!(opts?.includeUnpublished ?? false) && !isVisibleOnLive(post, opts?.now)) return null;
+  if (!(opts?.includeUnpublished ?? false) && !isVisibleOnLive(post, await visibilityTimestamp(opts?.now))) return null;
   return post;
 }
 
@@ -325,9 +330,10 @@ export async function relatedPosts(
   slug: string,
   n = 3,
   content?: ArtifactSource,
+  now?: string | null,
 ): Promise<BlogPostSummary[]> {
-  const pool = (await listPosts(tenantId, collection, { content })).filter((p) => p.slug !== slug);
-  const current = await getPost(tenantId, collection, slug, { content });
+  const pool = (await listPosts(tenantId, collection, { content, now })).filter((p) => p.slug !== slug);
+  const current = await getPost(tenantId, collection, slug, { content, now });
   const category = current?.categories[0];
   const result = category ? pool.filter((p) => p.categories.includes(category)) : [];
   for (const p of pool) {

package/apps/storefront/src/lib/blog/provider.ts

@@ -4,10 +4,16 @@
 // collection, and backs `/blog` whenever that curated index is unusable;
 // switching `/blog` onto it outright is a later migration once order is
 // encoded as data (see B0.1 §"/blog migration caution").
-import { tenantDirSegment } from "@tot/public-runtime";
+import {
+  exactPublicationTimestamp,
+  isBlogPostListableOnLive,
+  isBlogPostVisibleOnLive,
+  tenantDirSegment,
+} from "@tot/public-runtime";
 import { listPosts } from "./collection.js";
 import type { BlogPost, BlogPostSummary } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
+import { readEnv } from "../env.js";
 
 /** The collection id `/blog` reads — the derived fallback's second argument. */
 const BLOG_COLLECTION = "blog";
@@ -18,6 +24,11 @@ function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactS
   return typeof value?.listArtifactPaths === "function" && typeof value.readArtifact === "function";
 }
 
+async function visibilityTimestamp(explicit?: string | null): Promise<string | null> {
+  if (explicit !== undefined) return exactPublicationTimestamp(explicit);
+  return exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
+}
+
 // Both tenant tiers: real at `tenants/<id>/`, platform test one level deeper at
 // `tenants/e2e/<id>/`. `tenantDirSegment` is the one inverse used to look a
 // tenant's keys back up.
@@ -69,6 +80,10 @@ async function readCuratedIndex(
   if (canReadArtifacts(source)) {
     const raw = await source.readArtifact("blog/index.json");
     if (raw) return parseCuratedIndex(raw);
+    // A selected immutable publication artifact is authoritative. Missing or
+    // malformed curated metadata falls through to its own posts, never to stale
+    // build-time globs for the same tenant.
+    return null;
   }
   const key = tenantKey(Object.keys(indexGlobs), tenantId, "/index.json")
     ?? Object.keys(indexGlobs).find((candidate) => candidate.includes(`${tenantDirSegment(tenantId)}content/blog/index.json`));
@@ -92,16 +107,19 @@ async function readCuratedIndex(
 export async function listBlogPosts(
   tenantId: string,
   source?: ArtifactSource,
+  publicationTimestamp?: string | null,
 ): Promise<BlogPostSummary[]> {
+  const now = await visibilityTimestamp(publicationTimestamp);
   const curated = await readCuratedIndex(tenantId, source);
-  if (curated && curated.length > 0) return curated;
-  return listPosts(tenantId, BLOG_COLLECTION, { content: source });
+  if (curated && curated.length > 0) return curated.filter((post) => isBlogPostListableOnLive(post, now));
+  return listPosts(tenantId, BLOG_COLLECTION, { content: source, now });
 }
 
 export async function getBlogPost(
   tenantId: string,
   slug: string,
   source?: ArtifactSource,
+  publicationTimestamp?: string | null,
 ): Promise<BlogPost | null> {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) return null;
   if (canReadArtifacts(source)) {
@@ -109,7 +127,9 @@ export async function getBlogPost(
     const raw = await source.readArtifact(`blog/posts/${slug}.json`);
     if (raw) {
       try {
-        return JSON.parse(raw) as BlogPost;
+        const post = JSON.parse(raw) as BlogPost;
+        const now = await visibilityTimestamp(publicationTimestamp);
+        return isBlogPostVisibleOnLive(post, now) ? post : null;
       } catch {
         return null;
       }
@@ -117,7 +137,10 @@ export async function getBlogPost(
     if (paths !== null) return null;
   }
   const key = tenantKey(Object.keys(postGlobs), tenantId, `/posts/${slug}.json`);
-  return key ? postGlobs[key]!() : null;
+  if (!key) return null;
+  const post = await postGlobs[key]!();
+  const now = await visibilityTimestamp(publicationTimestamp);
+  return isBlogPostVisibleOnLive(post, now) ? post : null;
 }
 
 export async function resolveBlogRedirect(

package/apps/storefront/src/lib/blog/reactions.ts

@@ -14,6 +14,7 @@
  * specific tenant or collection.
  */
 import { getPost } from "./collection.js";
+import type { ContentProvider } from "../storyblok/provider.js";
 
 /** The fixed reaction vocabulary. Not free-form — a closed set like the pillar vocabulary. */
 export const REACTIONS = ["like", "insightful", "celebrate"] as const;
@@ -42,7 +43,7 @@ async function readCount(kv: KVNamespace, key: string): Promise<number> {
 
 /**
  * Increment the tally for `reaction` on a post IF the reaction is in the vocab
- * AND the post is live (published/unlisted/due-scheduled) for this tenant —
+ * AND the post is live (published/unlisted/scheduled due at publication) for this tenant —
  * `getPost` returns null on the live path for a draft/404/non-post. Best-effort:
  * never throws (a reaction must never fail the reader's request).
  */
@@ -52,10 +53,11 @@ export async function recordReaction(
   collection: string,
   slug: string,
   reaction: string,
+  visibility?: { content?: ContentProvider; now?: string | null },
 ): Promise<void> {
   try {
     if (!isReaction(reaction)) return;
-    const post = await getPost(tenantId, collection, slug);
+    const post = await getPost(tenantId, collection, slug, visibility);
     if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
     const key = reactionsKey(tenantId, collection, slug, reaction);
     const next = (await readCount(kv, key)) + 1;

package/apps/storefront/src/lib/blog/types.ts

@@ -29,7 +29,7 @@ export interface BlogPostSummary {
   tags: string[];
   featuredImage?: BlogImage;
   status: PostStatus; // seeded/legacy posts without this field default to "published"
-  scheduledAt?: string; // ISO date; when status === "scheduled", the post goes live once this instant has passed
+  scheduledAt?: string; // ISO date; eligible in an explicit publication at or after this instant
   canonicalUrl?: string; // syndication override
   inLanguage?: string; // default "en"
   access?: BlogAccess; // entitlement gate; default "public". Orthogonal to `status`

package/apps/storefront/src/lib/blog/viewCounts.ts

@@ -24,6 +24,7 @@
  * `the-build` or `tokenoftrust.com`.
  */
 import { getPost, listPosts } from "./collection.js";
+import type { ContentProvider } from "../storyblok/provider.js";
 
 // Mirror the engine's guards (collection.ts): a collection is one path segment;
 // a slug is lower-kebab. Keeping them local avoids widening the engine's surface.
@@ -96,11 +97,12 @@ export async function recordBlogView(
   kv: KVNamespace,
   tenantId: string,
   path: string,
+  visibility?: { content?: ContentProvider; now?: string | null },
 ): Promise<void> {
   try {
     const ref = parseBlogPostPath(path);
     if (!ref) return;
-    const post = await getPost(tenantId, ref.collection, ref.slug);
+    const post = await getPost(tenantId, ref.collection, ref.slug, visibility);
     if (!post) return; // not a live post (draft / 404 / non-blog) — do not count
     const key = blogViewsKey(tenantId, ref.collection, ref.slug);
     const dayKey = blogViewsDayKey(tenantId, ref.collection, ref.slug, dayStamp(new Date()));

package/apps/storefront/src/lib/d1/catalog.ts

@@ -29,6 +29,8 @@ export interface Queryable {
   exec(sql: string): Promise<void>;
   /** D1 executes a batch sequentially inside one implicit transaction. */
   batch?(statements: readonly QueryStatement[]): Promise<void>;
+  /** D1 batch results, including SELECT rows, from that same implicit transaction. */
+  batchResults?(statements: readonly QueryStatement[]): Promise<readonly QueryBatchResult[]>;
 }
 
 export interface QueryStatement {
@@ -36,6 +38,10 @@ export interface QueryStatement {
   params?: readonly unknown[];
 }
 
+export interface QueryBatchResult {
+  results: readonly Record<string, unknown>[];
+}
+
 /** The slice of the Cloudflare D1Database we use (kept local to avoid a types dep). */
 export interface D1Like {
   prepare(sql: string): {
@@ -51,6 +57,8 @@ export interface D1Like {
 
 /** Adapt a Cloudflare D1Database to the Queryable seam. */
 export function fromD1(db: D1Like): Queryable {
+  const prepareBatch = (statements: readonly QueryStatement[]) =>
+    statements.map(({ sql, params = [] }) => db.prepare(sql).bind(...params));
   return {
     all: async <T>(sql: string, ...params: unknown[]) =>
       (await db.prepare(sql).bind(...params).all()).results as T[],
@@ -64,7 +72,16 @@ export function fromD1(db: D1Like): Queryable {
     },
     batch: async (statements) => {
       if (!db.batch) throw new Error("D1 batch is unavailable");
-      await db.batch(statements.map(({ sql, params = [] }) => db.prepare(sql).bind(...params)));
+      await db.batch(prepareBatch(statements));
+    },
+    batchResults: async (statements) => {
+      if (!db.batch) throw new Error("D1 batch is unavailable");
+      const raw = await db.batch(prepareBatch(statements));
+      return raw.map((result) => {
+        if (!result || typeof result !== "object") return { results: [] };
+        const rows = Reflect.get(result, "results") as unknown;
+        return { results: Array.isArray(rows) ? rows as Record<string, unknown>[] : [] };
+      });
     },
   };
 }

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -250,6 +250,99 @@ export const testDestinationDeliveries = sqliteTable(
   }),
 );
 
+// --- Publication-space editorial control -----------------------------------
+// Immutable reviewed versions plus one CAS pointer/audit chain per space. The
+// API always derives tenant+space from its authenticated route; the composite
+// keys make cross-tenant aliases impossible in persistence.
+export const publicationSpaceVersions = sqliteTable(
+  "publication_space_versions",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    versionId: text("version_id").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.versionId] }) }),
+);
+
+export const publicationSpaceReviews = sqliteTable(
+  "publication_space_reviews",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    versionId: text("version_id").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.versionId] }),
+    idxTenant: index("idx_publication_space_reviews_tenant").on(t.tenantId, t.spaceId),
+  }),
+);
+
+export const publicationSpacePointers = sqliteTable(
+  "publication_space_pointers",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({ pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.channel] }) }),
+);
+
+export const publicationSpaceTransitions = sqliteTable(
+  "publication_space_transitions",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    transitionId: text("transition_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.transitionId] }),
+    uqRevision: uniqueIndex("uq_publication_space_transition_revision").on(
+      t.tenantId,
+      t.spaceId,
+      t.channel,
+      t.revision,
+    ),
+    idxTenant: index("idx_publication_space_transitions_tenant").on(
+      t.tenantId,
+      t.spaceId,
+      t.channel,
+    ),
+  }),
+);
+
+export const publicationSpaceProjections = sqliteTable(
+  "publication_space_projections",
+  {
+    tenantId: text("tenant_id").notNull(),
+    spaceId: text("space_id").notNull(),
+    channel: text("channel").notNull(),
+    revision: integer("revision").notNull(),
+    transitionId: text("transition_id").notNull(),
+    operation: text("operation").notNull(),
+    provider: text("provider").notNull(),
+    status: text("status").notNull().default("pending"),
+    attempts: integer("attempts").notNull().default(0),
+    lastError: text("last_error"),
+    record: text("record").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.tenantId, t.spaceId, t.channel, t.revision] }),
+    uqTransition: uniqueIndex("uq_publication_space_projection_transition").on(
+      t.tenantId, t.spaceId, t.transitionId,
+    ),
+    idxPending: index("idx_publication_space_projections_pending").on(
+      t.tenantId, t.status, t.revision,
+    ),
+  }),
+);
+
 // --- Webhook event spine ----------------------------------------------------
 // Immutable event log. `id` is the semantic event id we mint — distinct from
 // any per-delivery wire envelope id (see `webhookDeliveries.deliveryId` below).

package/apps/storefront/src/lib/edgeCache.ts

@@ -70,6 +70,7 @@ export function pageCacheKey(
     pointerRevision: number;
     versionId: string;
     artifactDigest: string;
+    publicationTimestamp: string | null;
   },
 ): Request {
   // A stored page carries the CSP header it was rendered with, INCLUDING any
@@ -87,6 +88,7 @@ export function pageCacheKey(
         publication.pointerRevision,
         publication.versionId,
         publication.artifactDigest,
+        publication.publicationTimestamp ?? "unclocked",
       ].join(":"))}`
     : "";
   return new Request(

package/apps/storefront/src/lib/publication/runtimeSource.ts

@@ -1,4 +1,5 @@
 import {
+  exactPublicationTimestamp,
   openPublicationArtifactV1,
   parsePublicationVersionStateV1Json,
   publicationRoutePlanIsCurrentV1,
@@ -7,6 +8,7 @@ import {
   type PublicationArtifactBucketV1,
   type PublicationArtifactOpenFailureCodeV1,
   type PublicationChannelV1,
+  type PublicationChannelPointerV1,
   type PublicationRoutePlanV1,
   type RouteTierIndexV1,
 } from "@tot/public-runtime";
@@ -21,6 +23,76 @@ export interface PublicationPageCacheScopeV1 {
   pointerRevision: number;
   versionId: string;
   artifactDigest: string;
+  publicationTimestamp: string | null;
+}
+
+export interface PublicationRuntimeClockV1 {
+  version: 1;
+  tenant: string;
+  spaceId: string;
+  channel: PublicationChannelV1;
+  revision: number;
+  versionId: string;
+  sourceSha: string;
+  artifactDigest: string;
+  publicationTimestamp: string;
+}
+
+export function publicationRuntimeClockKeyV1(
+  tenant: string,
+  spaceId: string,
+  channel: PublicationChannelV1,
+  revision: number,
+): string {
+  return `cust:publication-clock:${tenant}:${spaceId}:${channel}:${revision}`;
+}
+
+export function publicationRuntimeClockV1(input: {
+  pointer: PublicationChannelPointerV1;
+  publicationTimestamp: string;
+}): PublicationRuntimeClockV1 | null {
+  const publicationTimestamp = exactPublicationTimestamp(input.publicationTimestamp);
+  const pointer = input.pointer;
+  if (!publicationTimestamp || !Number.isSafeInteger(pointer.revision) || pointer.revision < 1) return null;
+  return {
+    version: 1,
+    tenant: pointer.tenant,
+    spaceId: pointer.spaceId,
+    channel: pointer.channel,
+    revision: pointer.revision,
+    versionId: pointer.versionId,
+    sourceSha: pointer.sourceSha,
+    artifactDigest: pointer.artifactDigest,
+    publicationTimestamp,
+  };
+}
+
+export function parsePublicationRuntimeClockV1(json: string): PublicationRuntimeClockV1 | null {
+  try {
+    const value = JSON.parse(json) as Record<string, unknown>;
+    if (!value || typeof value !== "object" || Array.isArray(value) ||
+      Object.keys(value).sort().join("\0") !==
+        ["artifactDigest", "channel", "publicationTimestamp", "revision", "sourceSha", "spaceId", "tenant", "version", "versionId"].sort().join("\0") ||
+      value.version !== 1 || typeof value.tenant !== "string" || typeof value.spaceId !== "string" ||
+      (value.channel !== "live" && value.channel !== "preview") ||
+      !Number.isSafeInteger(value.revision) || Number(value.revision) < 1 ||
+      typeof value.versionId !== "string" || typeof value.sourceSha !== "string" ||
+      typeof value.artifactDigest !== "string" || !exactPublicationTimestamp(value.publicationTimestamp)) return null;
+    return value as unknown as PublicationRuntimeClockV1;
+  } catch {
+    return null;
+  }
+}
+
+export function publicationRuntimeClockMatchesStateV1(input: {
+  clock: PublicationRuntimeClockV1;
+  pointer: PublicationChannelPointerV1;
+}): boolean {
+  const expected = publicationRuntimeClockV1({
+    pointer: input.pointer,
+    publicationTimestamp: input.clock.publicationTimestamp,
+  });
+  return !!expected && JSON.stringify(expected) === JSON.stringify(input.clock);
 }
 
 export type PublicationRuntimeSourceV1 =
@@ -29,6 +101,8 @@ export type PublicationRuntimeSourceV1 =
       status: "selected";
       artifact: OpenPublicationArtifactV1;
       cacheScope: PublicationPageCacheScopeV1;
+      /** Exact audited transition instant bound to this selected space revision. */
+      publicationTimestamp: string | null;
     }
   | { status: "unavailable"; code: PublicationArtifactOpenFailureCodeV1 };
 
@@ -83,15 +157,38 @@ export async function resolvePublicationRuntimeSourceV1(input: {
   });
   if (!opened.ok) return { status: "unavailable", code: opened.code };
   const { selection } = opened.value;
+  let clock: PublicationRuntimeClockV1 | null = null;
+  if (selection.manifest.visibility === "public") {
+    try {
+      const clockJson = await input.store.get(publicationRuntimeClockKeyV1(
+        selection.pointer.tenant,
+        selection.pointer.spaceId,
+        selection.channel,
+        selection.pointer.revision,
+      ));
+      const candidate = clockJson ? parsePublicationRuntimeClockV1(clockJson) : null;
+      if (candidate && publicationRuntimeClockMatchesStateV1({
+        clock: candidate,
+        pointer: selection.pointer,
+      })) clock = candidate;
+    } catch {
+      // The content remains selectable, but scheduled visibility fails closed.
+    }
+  }
+  const publicationTimestamp = selection.manifest.visibility === "public"
+    ? clock?.publicationTimestamp ?? null
+    : exactPublicationTimestamp(selection.pointer.updatedAt);
   return {
     status: "selected",
     artifact: opened.value,
+    publicationTimestamp,
     cacheScope: {
       spaceId: selection.manifest.id,
       channel: selection.channel,
       pointerRevision: selection.pointer.revision,
       versionId: selection.publicationVersion.versionId,
       artifactDigest: selection.publicationVersion.artifactDigest,
+      publicationTimestamp,
     },
   };
 }

package/apps/storefront/src/lib/the-build/provider.ts

@@ -10,7 +10,7 @@ export const THE_BUILD: Collection = { id: "the-build", base: "/the-build" };
 
 export function listBuildPosts(
   tenantId: string,
-  opts?: { includeUnpublished?: boolean; now?: string; content?: ContentProvider },
+  opts?: { includeUnpublished?: boolean; now?: string | null; content?: ContentProvider },
 ): Promise<BlogPostSummary[]> {
   return listPosts(tenantId, THE_BUILD.id, opts);
 }
@@ -18,7 +18,7 @@ export function listBuildPosts(
 export function getBuildPost(
   tenantId: string,
   slug: string,
-  opts?: { includeUnpublished?: boolean; now?: string; content?: ContentProvider },
+  opts?: { includeUnpublished?: boolean; now?: string | null; content?: ContentProvider },
 ): Promise<BlogPost | null> {
   return getPost(tenantId, THE_BUILD.id, slug, opts);
 }

package/apps/storefront/src/middleware/controlPlane.ts

@@ -206,6 +206,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
         : tenant.appDomain;
       const hostCapability = sessionHostCapability(viewerRecord, capabilityHost, nowSeconds);
       locals.viewer = {
+        ...(viewerRecord.subject ? { subject: viewerRecord.subject } : {}),
         email: viewerRecord.email,
         roles: hostCapability ? [hostCapability] : viewerRecord.roles,
         capability: hostCapability ?? viewerRecord.capability,

package/apps/storefront/src/middleware/renderChain.ts

@@ -54,6 +54,7 @@ import {
   collectDeclaredCspProfiles,
   INTEGRATION_NONCE_PLACEHOLDER,
   defaultConsentSnapshot,
+  exactPublicationTimestamp,
   parseConsentSnapshot,
   CONSENT_SNAPSHOT_INPUT_HEADER,
   CONSENT_SNAPSHOT_SIG_HEADER,
@@ -214,6 +215,9 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     if (isInternalPublication) applyInternalContentResponsePolicy(response.headers);
     return response;
   }
+  const publicationTimestamp = publicationSource.status === "selected"
+    ? publicationSource.publicationTimestamp
+    : exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
 
   const managedIntegrationDeclarations = input.managedIntegrationDeclarations;
 
@@ -503,6 +507,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   const cspNonce = INTEGRATION_NONCE_PLACEHOLDER;
 
   locals.tenant = tenant;
+  // One immutable clock for every visibility consumer in this render. Selected
+  // Worker content uses its audited pointer transition; materialization uses the
+  // signed build input; an ordinary legacy request has no clock and schedules stay hidden.
+  locals.publicationTimestamp = publicationTimestamp;
   // Effective capability flags for this tenant (commerce defaults unless the
   // tenant declares siteType:"marketing" / explicit features). Pages and chrome
   // read these instead of hard-coding tenant identity checks.

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -98,7 +98,10 @@ export const POST: APIRoute = async (context) => {
   // Best-effort: no-ops for a non-live post; never throws. When there is no KV
   // binding (local dev) the increment can't persist, but we still return the
   // (all-zero) tallies so the client has a consistent shape.
-  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction);
+  if (kv) await recordReaction(kv, tenantId, collection, slug, reaction, {
+    content: context.locals.content,
+    now: context.locals.publicationTimestamp,
+  });
 
   return json({ ok: true, counts: await getReactionCounts(kv, tenantId, collection, slug) });
 };

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -61,7 +61,10 @@ export const POST: APIRoute = async (context) => {
         if (tenantId && kv) {
           const cfContext =
             (context.locals as { cfContext?: CfExecutionContextLike })?.cfContext ?? null;
-          runAfterResponse(recordBlogView(kv, tenantId, sample.path), cfContext);
+          runAfterResponse(recordBlogView(kv, tenantId, sample.path, {
+            content: context.locals.content,
+            now: context.locals.publicationTimestamp,
+          }), cfContext);
         }
       }
     }

package/apps/storefront/src/pages/blog/[slug].astro

@@ -11,9 +11,9 @@ import { buildAlternates } from "@/lib/seo/alternates.js";
 import { languageLabel } from "@/lib/i18n.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/jsonld.js";
 
-const { tenant, canonicalBase, basePath, content } = Astro.locals;
+const { tenant, canonicalBase, basePath, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.slug ?? "";
-const post = await getBlogPost(tenant.tenant_id, slug, content);
+const post = await getBlogPost(tenant.tenant_id, slug, content, publicationTimestamp);
 if (!post) {
   const redirect = await resolveBlogRedirect(tenant.tenant_id, slug, content);
   if (redirect) return Astro.redirect(`${basePath}/blog/${redirect}/`, 301);
@@ -38,7 +38,7 @@ const canonical = new URL(`/blog/${post.slug}/`, canonicalBase + "/").toString()
 // (the invariant `blog/author/[author].astro` documents). Same slug + same source
 // the archive itself filters on, so the two can't disagree.
 const authorArchiveSlug = authorSlug(post.author);
-const authorHasArchive = (await listBlogPosts(tenant.tenant_id, content)).some(
+const authorHasArchive = (await listBlogPosts(tenant.tenant_id, content, publicationTimestamp)).some(
   (p) => authorSlug(p.author) === authorArchiveSlug,
 );
 const authorUrl = authorHasArchive
@@ -63,7 +63,7 @@ const authorHref = authorHasArchive
 // I2 — hreflang alternates + per-variant <html lang>. Singleton ⇒ [] alternates
 // and no `lang` override, so a non-translated post is byte-identical to today.
 const translations = post.translationGroupId
-  ? await getTranslations(tenant.tenant_id, "blog", post.slug, { content })
+  ? await getTranslations(tenant.tenant_id, "blog", post.slug, { content, now: publicationTimestamp })
   : [];
 const alternates = buildAlternates(translations, (s) =>
   new URL(`/blog/${s}/`, canonicalBase + "/").toString(),
@@ -77,6 +77,7 @@ const lang = alternates.length ? (post.inLanguage ?? "en") : undefined;
   path={`/blog/${post.slug}/`}
   ogType="article"
   ogImage={post.featuredImage?.src}
+  noindex={post.status === "unlisted"}
   jsonLd={[crumbs, articleLd]}
   article={{
     publishedTime: post.publishedAt,

package/apps/storefront/src/pages/blog/author/[author].astro

@@ -8,10 +8,10 @@ import { breadcrumbLd } from "@/lib/jsonld.js";
 // Author archive for the `/blog` collection. Lists exactly the posts whose
 // bylines link here (same source as /blog/index.astro + /blog/[slug].astro),
 // so a byline never points at a page missing its post.
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.author ?? "";
 
-const allPosts = await listBlogPosts(tenant.tenant_id, content);
+const allPosts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const posts = allPosts.filter((post) => authorSlug(post.author) === slug);
 if (posts.length === 0) return new Response(null, { status: 404 });
 

package/apps/storefront/src/pages/blog/category/[category].astro

@@ -5,12 +5,12 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const param = Astro.params.category ?? "";
 
 // Same source as the /blog index (the collection's curated list), filtered to
 // one category — so a post can never appear here that isn't already live on /blog.
-const all = await listBlogPosts(tenant.tenant_id, content);
+const all = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const match = collectPostsByTerm(all, "categories", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;

package/apps/storefront/src/pages/blog/index.astro

@@ -3,8 +3,8 @@ import Layout from "@/layouts/Layout.astro";
 import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
 import { listBlogPosts } from "@/lib/blog/provider.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
-const posts = await listBlogPosts(tenant.tenant_id, content);
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const posts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 // A tenant with no blog content has no blog index, so this is still a 404 — but
 // it is a DIFFERENT 404 from "no such route", and telling them apart from the
 // outside used to be impossible (both were bare and byte-identical). The header

package/apps/storefront/src/pages/blog/tag/[tag].astro

@@ -5,10 +5,10 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 import { collectPostsByTerm } from "@/lib/blog/collection.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const param = Astro.params.tag ?? "";
 
-const all = await listBlogPosts(tenant.tenant_id, content);
+const all = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
 const match = collectPostsByTerm(all, "tags", param);
 if (!match) return new Response(null, { status: 404 });
 const { label, posts } = match;

package/apps/storefront/src/pages/llms.txt.ts

@@ -22,7 +22,7 @@ function oneLine(s: string | undefined, max = 140): string | undefined {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, tenant, canonicalBase, content } = context.locals;
+  const { tot, tenant, canonicalBase, content, publicationTimestamp } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
 
   // Use the request-resolved ContentProvider (locals.content) so any published /
@@ -34,7 +34,7 @@ export async function GET(context: APIContext): Promise<Response> {
       content.listPages(),
       tot.getFeatured(12),
       content.getHome().catch(() => null),
-      listBlogPosts(tenant.tenant_id, content),
+      listBlogPosts(tenant.tenant_id, content, publicationTimestamp),
     ]);
   // Empty synthesized collections (no active members) never make the guide —
   // an LLM shouldn't be pointed at a URL that resolves to zero products.

package/apps/storefront/src/pages/sitemap.xml.ts

@@ -11,7 +11,7 @@
 import type { APIContext } from "astro";
 import { nonEmptyCollections } from "@/lib/tot/query.js";
 import { listBlogPosts } from "@/lib/blog/provider.js";
-import { authorSlug } from "@/lib/blog/collection.js";
+import { authorSlug, categorySlug } from "@/lib/blog/collection.js";
 import { listBuildPosts } from "@/lib/the-build/provider.js";
 
 interface SitemapUrl {
@@ -30,7 +30,7 @@ function escapeXml(value: string): string {
 }
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tot, tenant, canonicalBase, content, features } = context.locals;
+  const { tot, tenant, canonicalBase, content, features, publicationTimestamp } = context.locals;
   const base = canonicalBase.replace(/\/$/, "");
 
   const urls: SitemapUrl[] = [{ loc: `${base}/` }];
@@ -67,7 +67,7 @@ export async function GET(context: APIContext): Promise<Response> {
     urls.push({ loc: `${base}/${page.slug}` });
   }
 
-  const blogPosts = await listBlogPosts(tenant.tenant_id, content);
+  const blogPosts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);
   if (blogPosts.length > 0) {
     urls.push({ loc: `${base}/blog/` });
     for (const post of blogPosts) {
@@ -83,9 +83,13 @@ export async function GET(context: APIContext): Promise<Response> {
     for (const slug of authorSlugs) {
       urls.push({ loc: `${base}/blog/author/${slug}/` });
     }
+    const categorySlugs = [...new Set(blogPosts.flatMap((post) => post.categories.map(categorySlug)).filter(Boolean))].sort();
+    const tagSlugs = [...new Set(blogPosts.flatMap((post) => post.tags.map(categorySlug)).filter(Boolean))].sort();
+    for (const slug of categorySlugs) urls.push({ loc: `${base}/blog/category/${slug}/` });
+    for (const slug of tagSlugs) urls.push({ loc: `${base}/blog/tag/${slug}/` });
   }
 
-  const buildPosts = await listBuildPosts(tenant.tenant_id, { content });
+  const buildPosts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
   if (buildPosts.length > 0) {
     urls.push({ loc: `${base}/the-build/` });
     for (const post of buildPosts) {

package/apps/storefront/src/pages/the-build/[slug].astro

@@ -11,9 +11,9 @@ import { getTranslations } from "@/lib/blog/collection.js";
 import { buildAlternates } from "@/lib/seo/alternates.js";
 import { breadcrumbLd } from "@/lib/jsonld.js";
 
-const { tenant, canonicalBase, basePath, content } = Astro.locals;
+const { tenant, canonicalBase, basePath, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.slug ?? "";
-const post = await getBuildPost(tenant.tenant_id, slug, { content });
+const post = await getBuildPost(tenant.tenant_id, slug, { content, now: publicationTimestamp });
 if (!post) {
   const redirect = await resolveBuildRedirect(tenant.tenant_id, slug, content);
   if (redirect) return Astro.redirect(`${basePath}/the-build/${redirect}/`, 301);
@@ -45,7 +45,10 @@ const buildHref = `${basePath}/the-build/`;
 // the live-visible variant set (self + siblings); `buildAlternates` yields [] for
 // a singleton, so a non-translated post gets no alternates and no `lang` override
 // (byte-identical to today).
-const translations = await getTranslations(tenant.tenant_id, THE_BUILD.id, post.slug, { content });
+const translations = await getTranslations(tenant.tenant_id, THE_BUILD.id, post.slug, {
+  content,
+  now: publicationTimestamp,
+});
 const alternates = buildAlternates(translations, (s) =>
   new URL(`/the-build/${s}/`, canonicalBase + "/").toString(),
 );

package/apps/storefront/src/pages/the-build/index.astro

@@ -8,8 +8,8 @@ import Layout from "@/layouts/Layout.astro";
 import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
 import { listBuildPosts } from "@/lib/the-build/provider.js";
 
-const { tenant, basePath, canonicalBase, content } = Astro.locals;
-const posts = await listBuildPosts(tenant.tenant_id, { content });
+const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
 if (posts.length === 0) return new Response(null, { status: 404 });
 
 const href = (path: string) => `${basePath}${path}` || "/";

package/apps/storefront/src/pages/the-build/rss.xml.ts

@@ -11,8 +11,8 @@ import { listBuildPosts, THE_BUILD } from "@/lib/the-build/provider.js";
 import { renderRssFeed } from "@/lib/blog/rss.js";
 
 export async function GET(context: APIContext): Promise<Response> {
-  const { tenant, canonicalBase, content } = context.locals;
-  const posts = await listBuildPosts(tenant.tenant_id, { content });
+  const { tenant, canonicalBase, content, publicationTimestamp } = context.locals;
+  const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
   if (posts.length === 0) return new Response(null, { status: 404 });
 
   const body = renderRssFeed({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.19",
+  "version": "2.0.21",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -8,7 +8,8 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./blog-visibility": "./src/blog-visibility.mjs"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",

package/packages/public-runtime/src/blog-visibility.d.mts

@@ -0,0 +1,8 @@
+export interface BlogVisibilityInput {
+  status?: unknown;
+  scheduledAt?: unknown;
+}
+
+export declare function exactPublicationTimestamp(value: unknown): string | null;
+export declare function isBlogPostVisibleOnLive(post: BlogVisibilityInput, now?: string | null): boolean;
+export declare function isBlogPostListableOnLive(post: BlogVisibilityInput, now?: string | null): boolean;

package/packages/public-runtime/src/blog-visibility.mjs

@@ -0,0 +1,32 @@
+// @ts-check
+
+/** @param {unknown} value */
+export function exactPublicationTimestamp(value) {
+  if (typeof value !== "string") return null;
+  try {
+    return new Date(value).toISOString() === value ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** @param {{status?: unknown, scheduledAt?: unknown}} post @param {unknown} now */
+function scheduledIsDue(post, now) {
+  const publicationTimestamp = exactPublicationTimestamp(now);
+  if (post.status !== "scheduled" || typeof post.scheduledAt !== "string" ||
+    !publicationTimestamp) return false;
+  const due = Date.parse(post.scheduledAt);
+  return !Number.isNaN(due) && due <= Date.parse(publicationTimestamp);
+}
+
+/** Canonical direct-route visibility: unlisted resolves but never enters a listing. */
+export function isBlogPostVisibleOnLive(post, now) {
+  const status = post.status ?? "published";
+  return status === "published" || status === "unlisted" || scheduledIsDue({ ...post, status }, now);
+}
+
+/** Canonical archive/feed/sitemap visibility. Missing legacy status means published. */
+export function isBlogPostListableOnLive(post, now) {
+  const status = post.status ?? "published";
+  return status === "published" || scheduledIsDue({ ...post, status }, now);
+}

package/packages/public-runtime/src/index.ts

@@ -16,6 +16,7 @@
 export * from "./product.js";
 export * from "./tenant.js";
 export * from "./publication-space.js";
+export * from "./blog-visibility.mjs";
 export * from "./publication-routing.js";
 export * from "./publication-version.js";
 export * from "./publication-artifact.js";