@tokenoftrust/storefront-runner 2.0.40 → 2.0.42

package/packages/cli/src/visual-parity.mjs

@@ -0,0 +1,321 @@
+/**
+ * Read-only closure checks for the optional visual-parity migration module.
+ * The tenant checkout remains portable: this reads only content/, public/, and
+ * .tot/visual-parity.json, never a preview host or a delivery provider.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { extname, join, relative } from "node:path";
+
+const ERROR = "error";
+// Public routes implemented by the renderer. Authentication and cart URLs are
+// deliberately absent: they are flow-specific, not portable parity targets.
+const PLATFORM_ROUTES = ["/collections", "/collections/", "/products/", "/search", "/saved", "/account", "/account/", "/blog", "/blog/"];
+const ASSET_EXTENSIONS = new Set([".avif", ".gif", ".jpeg", ".jpg", ".png", ".svg", ".webp"]);
+
+const finding = (rule, file, message, fix) => ({ level: ERROR, rule, file, message, fix });
+const walk = (dir) => !existsSync(dir) ? [] : readdirSync(dir).flatMap((name) => {
+  const path = join(dir, name);
+  return statSync(path).isDirectory() ? walk(path) : [path];
+});
+const pointer = (parts) => parts.length ? `/${parts.map((part) => String(part).replace(/~/g, "~0").replace(/\//g, "~1")).join("/")}` : "/";
+const stripQuery = (value) => value.split(/[?#]/, 1)[0];
+const normalizeRoute = (value) => {
+  const path = stripQuery(value).replace(/\/+/g, "/").replace(/\/$/, "") || "/";
+  return path.startsWith("/") ? path : `/${path}`;
+};
+const hasDotSegment = (value) => stripQuery(value).split("/").some((part) => part === "." || part === ".." || /^%2e(?:%2e)?$/i.test(part));
+const safeLocator = (value) => {
+  try {
+    const url = new URL(value.startsWith("//") ? `https:${value}` : value);
+    return url.origin;
+  } catch {
+    if (value.startsWith("/")) return normalizeRoute(value);
+    return "[redacted authored value]";
+  }
+};
+
+function parseConfig(tenantDir) {
+  const path = join(tenantDir, ".tot", "visual-parity.json");
+  if (!existsSync(path)) return { value: {}, findings: [] };
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (!value || Array.isArray(value) || typeof value !== "object") throw new Error("must be a JSON object");
+    const findings = [];
+    if (value.externalNavigationAllowlist !== undefined && !Array.isArray(value.externalNavigationAllowlist)) {
+      findings.push(finding("parity-config-shape", ".tot/visual-parity.json", "externalNavigationAllowlist must be an array of HTTPS origins or URLs", "replace it with an explicit reviewed array, for example [\"https://partner.example\"]"));
+    }
+    for (const [index, entry] of (Array.isArray(value.externalNavigationAllowlist) ? value.externalNavigationAllowlist : []).entries()) {
+      try {
+        const url = new URL(entry);
+        if (typeof entry !== "string" || url.protocol !== "https:" || url.username || url.password || /[?#]/.test(entry)) throw new Error("invalid");
+      } catch {
+        findings.push(finding("parity-allowlist-entry", `.tot/visual-parity.json/externalNavigationAllowlist/${index}`, "allowlist entries must be HTTPS origins or exact path prefixes without credentials, query, or fragment", "use https://partner.example for an origin or https://partner.example/returns for that path boundary"));
+      }
+    }
+    return { value, findings };
+  } catch {
+    return { value: {}, findings: [finding("parity-config-parse", ".tot/visual-parity.json", "invalid JSON", "fix .tot/visual-parity.json before closing visual parity")] };
+  }
+}
+
+function tenantFromConfig(tenantDir) {
+  try {
+    const value = JSON.parse(readFileSync(join(tenantDir, ".tot", "config.json"), "utf8"));
+    return typeof value?.tenant === "string" ? value.tenant : null;
+  } catch { return null; }
+}
+
+function allowedNavigation(value, allowlist) {
+  try {
+    const url = new URL(value);
+    return allowlist.some((entry) => {
+      try {
+        const allowed = new URL(entry);
+        if (allowed.protocol !== "https:" || allowed.username || allowed.password) return false;
+        if (allowed.pathname === "/") return url.origin === allowed.origin;
+        return url.origin === allowed.origin && (url.pathname === allowed.pathname || url.pathname.startsWith(`${allowed.pathname.replace(/\/$/, "")}/`));
+      } catch { return false; }
+    });
+  } catch { return false; }
+}
+
+function assetType(bytes) {
+  const ascii = bytes.subarray(0, 256).toString("utf8").trimStart().toLowerCase();
+  if (pngValid(bytes)) return ".png";
+  if (bytes.subarray(0, 3).toString("ascii") === "GIF") return ".gif";
+  if (jpegValid(bytes)) return ".jpg";
+  if (bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP") return ".webp";
+  if (bytes.subarray(4, 8).toString("ascii") === "ftyp" && bytes.subarray(8, 12).toString("ascii").toLowerCase().includes("avif")) return ".avif";
+  if (bytes.subarray(0, 4).toString("ascii") === "wOFF") return ".woff";
+  if (bytes.subarray(0, 4).toString("ascii") === "wOF2") return ".woff2";
+  if (icoValid(bytes)) return ".ico";
+  if (ascii.startsWith("<svg") || ascii.startsWith("<?xml") && ascii.includes("<svg")) return ".svg";
+  return null;
+}
+function pngValid(bytes) {
+  if (bytes.length < 45 || !bytes.subarray(0, 8).equals(Buffer.from([137,80,78,71,13,10,26,10]))) return false;
+  let pos = 8, sawIhdr = false;
+  let sawIdat = false;
+  while (pos + 12 <= bytes.length) {
+    const length = bytes.readUInt32BE(pos); const type = bytes.subarray(pos + 4, pos + 8).toString("ascii");
+    if (length > bytes.length - pos - 12) return false;
+    if (type === "IHDR") { if (sawIhdr || length !== 13 || bytes.readUInt32BE(pos + 8) === 0 || bytes.readUInt32BE(pos + 12) === 0) return false; sawIhdr = true; }
+    if (type === "IDAT" && length > 0) sawIdat = true;
+    pos += 12 + length; if (type === "IEND") return sawIhdr && sawIdat && length === 0 && pos === bytes.length;
+  } return false;
+}
+function jpegValid(bytes) {
+  if (bytes.length < 10 || bytes[0] !== 0xff || bytes[1] !== 0xd8) return false;
+  let pos = 2, sof = false;
+  while (pos < bytes.length) {
+    if (bytes[pos++] !== 0xff) return false; while (bytes[pos] === 0xff) pos++;
+    const marker = bytes[pos++]; if (marker === 0xd9) return sof && pos === bytes.length;
+    if (marker === 0xda) { if (pos + 2 > bytes.length) return false; const length = bytes.readUInt16BE(pos); const scan = pos + length; return sof && scan < bytes.length - 2 && bytes[bytes.length - 2] === 0xff && bytes[bytes.length - 1] === 0xd9; }
+    if (marker === 0x01 || marker >= 0xd0 && marker <= 0xd7) continue;
+    if (pos + 2 > bytes.length) return false; const length = bytes.readUInt16BE(pos); if (length < 2 || pos + length > bytes.length) return false;
+    if (marker >= 0xc0 && marker <= 0xc3 && length >= 8) { if (bytes.readUInt16BE(pos + 3) === 0 || bytes.readUInt16BE(pos + 5) === 0) return false; sof = true; }
+    pos += length;
+  } return false;
+}
+function icoValid(bytes) {
+  if (bytes.length < 22 || bytes.readUInt16LE(0) !== 0 || bytes.readUInt16LE(2) !== 1) return false;
+  const count = bytes.readUInt16LE(4); if (!count || bytes.length < 6 + count * 16) return false;
+  for (let i = 0; i < count; i++) { const at = 6 + i * 16, size = bytes.readUInt32LE(at + 8), offset = bytes.readUInt32LE(at + 12); if (size && offset >= 6 + count * 16 && offset + size <= bytes.length) { const payload = bytes.subarray(offset, offset + size); if (pngValid(payload) || payload.length >= 40 && payload.readInt32LE(0) >= 40 && payload.readInt32LE(4) > 0 && payload.readInt32LE(8) > 0) return true; } }
+  return false;
+}
+
+function checkAsset(value, at, file, context) {
+  const { findings, tenantId, publicDir } = context;
+  if (!value || value.startsWith("#")) return;
+  if (/^data:/i.test(value)) {
+    findings.push(finding("parity-data-asset", `${file}${at}`, "embedded data assets are not portable parity inputs", "copy the asset into public/ and use a tenant-local path"));
+    return;
+  }
+  if (/^[a-z][a-z\d+.-]*:/i.test(value) || value.startsWith("//")) {
+    findings.push(finding("parity-external-asset", `${file}${at}`, `asset source ${safeLocator(value)} is off-host`, "copy the asset into public/ and reference it with /tenants/<tenant>/..."));
+    return;
+  }
+  const path = stripQuery(value);
+  let rel;
+  if (path.startsWith("/tenants/")) {
+    const prefix = `/tenants/${tenantId}/`;
+    if (!tenantId || !path.startsWith(prefix)) {
+      findings.push(finding("parity-cross-tenant-asset", `${file}${at}`, "asset does not belong to this tenant", "copy the asset into this tenant's public/ directory"));
+      return;
+    }
+    rel = path.slice(prefix.length);
+  } else if (path.startsWith("/")) {
+    findings.push(finding("parity-unowned-asset", `${file}${at}`, "asset is not tenant-local", "use a tenant-local asset committed under public/"));
+    return;
+  } else rel = path;
+  if (!rel || hasDotSegment(rel)) {
+    findings.push(finding("parity-asset-path", `${file}${at}`, "asset path escapes or does not name public/", "use a direct tenant-local path under public/"));
+    return;
+  }
+  const asset = join(publicDir, rel);
+  if (!existsSync(asset)) {
+    findings.push(finding("parity-asset-missing", `${file}${at}`, "tenant-local asset is absent from public/", "add the referenced asset under public/ or correct the reference"));
+    return;
+  }
+  const extension = extname(rel).toLowerCase();
+  if (!ASSET_EXTENSIONS.has(extension)) {
+    findings.push(finding("parity-asset-extension", `${file}${at}`, "asset has an unsupported extension", "re-export favicon/assets as PNG or SVG; font containers require platform-managed validation"));
+    return;
+  }
+  if (statSync(asset).isDirectory()) {
+    findings.push(finding("parity-asset-directory", `${file}${at}`, "asset names a directory", "reference a file under public/"));
+    return;
+  }
+  if (ASSET_EXTENSIONS.has(extension)) {
+    const actual = assetType(readFileSync(asset));
+    const compatible = actual === extension || actual === ".jpg" && extension === ".jpeg";
+    if (!actual) findings.push(finding("parity-asset-undecodable", `${file}${at}`, `asset does not pass bounded ${extension} structural integrity checks`, "replace it with a structurally valid file of the declared type"));
+    else if (!compatible) findings.push(finding("parity-asset-type", `${file}${at}`, `asset bytes do not match the ${extension} extension`, "export the asset in the declared format"));
+    else if ([".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg"].includes(extension)) context.decodeAssets.push({ asset, file: `${file}${at}` });
+  }
+}
+
+function decodeImages(entries) {
+  if (!entries.length) return new Set();
+  const source = "const{createRequire}=require('node:module');const sharp=createRequire(process.argv[1])('sharp');(async()=>{let a=JSON.parse(process.argv[2]);let o=[];for(const p of a){try{let r=await sharp(p,{failOn:'error'}).raw().toBuffer({resolveWithObject:true});o.push(r.info.width>0&&r.info.height>0)}catch{o.push(false)}}process.stdout.write(JSON.stringify(o))})().catch(()=>process.exit(1));";
+  const result = spawnSync(process.execPath, ["-e", source, import.meta.url, JSON.stringify(entries.map((entry) => entry.asset))], { encoding: "utf8", timeout: 15000 });
+  try { if (result.status !== 0) throw new Error(); const output = JSON.parse(result.stdout); return new Set(entries.flatMap((_, index) => output[index] ? [] : [index])); } catch { return new Set(entries.map((_, index) => index)); }
+}
+
+function inspectHtml(html, file, at, context) {
+  const attr = /\b(href|src)\s*=\s*(?:(["'])(.*?)\2|([^\s>]+))/gi;
+  let index = 0;
+  for (const match of html.matchAll(attr)) {
+    const value = (match[3] ?? match[4] ?? "").trim();
+    inspectReference(match[1].toLowerCase(), value, `${at}/html-attribute-${index++}`, file, context);
+  }
+}
+function inspectReference(kind, value, at, file, context) {
+  if (kind === "src") return checkAsset(value, at, file, context);
+  if (!value || value.startsWith("#") || /^(mailto:|tel:)/i.test(value)) return;
+  if (/^(javascript|vbscript|data):/i.test(value)) {
+    context.findings.push(finding("parity-executable-link", `${file}${at}`, "link uses an executable scheme", "replace it with a local route or a reviewed HTTPS destination"));
+    return;
+  }
+  if (/^https?:\/\//i.test(value) || value.startsWith("//")) {
+    if (!allowedNavigation(value.startsWith("//") ? `https:${value}` : value, context.allowlist)) context.findings.push(finding("parity-external-navigation", `${file}${at}`, `external navigation ${safeLocator(value)} is not on the reviewed allowlist`, "add its HTTPS origin or URL to .tot/visual-parity.json only after human review"));
+    return;
+  }
+  if (!value.startsWith("/")) {
+    context.findings.push(finding("parity-relative-link", `${file}${at}`, "relative link has no stable paired route", "use a root-absolute local route"));
+    return;
+  }
+  if (hasDotSegment(value)) {
+    context.findings.push(finding("parity-route-path", `${file}${at}`, "local route contains a dot segment", "use a canonical root-absolute route"));
+    return;
+  }
+  const route = normalizeRoute(value);
+  if (!context.routes.has(route) && !PLATFORM_ROUTES.some((platform) => platform.endsWith("/") ? route.startsWith(platform) : route === platform)) context.findings.push(finding("parity-route-missing", `${file}${at}`, "local route is not declared by a page slug or platform", "add the matching content/pages JSON record or correct the link"));
+}
+
+function inspectValue(value, file, parts, context) {
+  if (Array.isArray(value)) return value.forEach((item, index) => inspectValue(item, file, [...parts, index], context));
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    const next = [...parts, key];
+    if (key === "body_html" && typeof child === "string") inspectHtml(child, file, pointer(next), context);
+    if ((key === "href" || key === "ctaHref") && typeof child === "string") inspectReference("href", child, pointer(next), file, context);
+    if ((key === "src" || key === "image" || key === "icon" || key === "logo" || key === "logoDark" || key === "favicon") && typeof child === "string") checkAsset(child, pointer(next), file, context);
+    if (typeof child === "string" && /(?:css|style|stylesheet)$/i.test(key)) {
+      for (const match of child.matchAll(/url\(\s*(["']?)(.*?)\1\s*\)/gi)) checkAsset(match[2].trim(), `${pointer(next)}/css`, file, context);
+    }
+    inspectValue(child, file, next, context);
+  }
+}
+
+function pageShape(value, file) {
+  const findings = [];
+  const required = [["slug", "string"], ["title", "string"]];
+  for (const [key, type] of required) {
+    const valid = type === "array" ? Array.isArray(value[key]) : typeof value[key] === type;
+    if (!valid || (type === "string" && value[key].trim() === "")) findings.push(finding("parity-page-field", `${file}/${key}`, `${key} must be a non-empty ${type}`, `set ${key} to the page value expected by the renderer`));
+  }
+  if (value.isPolicy !== undefined && typeof value.isPolicy !== "boolean") findings.push(finding("parity-page-field", `${file}/isPolicy`, "isPolicy must be a boolean when present", "set isPolicy to true or false"));
+  if (value.sections !== undefined && !Array.isArray(value.sections)) findings.push(finding("parity-page-field", `${file}/sections`, "sections must be an array when present", "set sections to an array of renderer-supported sections"));
+  if (Array.isArray(value.sections)) value.sections.forEach((section, index) => {
+    const at = `${file}/sections/${index}`;
+    if (!section || typeof section !== "object" || Array.isArray(section)) return findings.push(finding("parity-section-shape", at, "section must be an object", "use a renderer-supported prose section"));
+    const string = (v) => typeof v === "string" && v.trim() !== "";
+    const rich = (v) => typeof v === "string" ? v.trim() !== "" : Array.isArray(v) && v.length > 0 && v.every((run) => run && typeof run === "object" && !Array.isArray(run) && ((run.kind === "text" && string(run.text) && (run.strong === undefined || typeof run.strong === "boolean") && (run.em === undefined || typeof run.em === "boolean")) || (run.kind === "link" && string(run.text) && string(run.href) && (run.external === undefined || typeof run.external === "boolean"))));
+    switch (section.kind) {
+      case "heading": if (!string(section.text) || section.level !== undefined && section.level !== 2 && section.level !== 3 || section.id !== undefined && !string(section.id)) findings.push(finding("parity-section-shape", at, "heading requires string text, optional id, and level 2 or 3", "supply a valid heading")); break;
+      case "paragraph": if (!rich(section.text)) findings.push(finding("parity-section-shape", at, "paragraph requires RichText", "supply a valid string or inline-run array")); break;
+      case "list": if (!Array.isArray(section.items) || !section.items.length || section.items.some((item) => !rich(item)) || section.ordered !== undefined && typeof section.ordered !== "boolean") findings.push(finding("parity-section-shape", at, "list requires RichText items and optional boolean ordered", "supply valid list items")); break;
+      case "definitions": if (!Array.isArray(section.items) || !section.items.length || section.items.some((item) => !item || !string(item.term) || !rich(item.description))) findings.push(finding("parity-section-shape", at, "definitions require string terms and RichText descriptions", "supply valid definition items")); break;
+      case "callout": if (!rich(section.body) || !["info", "warning", "legal", "success"].includes(section.tone) || section.title !== undefined && !string(section.title)) findings.push(finding("parity-section-shape", at, "callout requires supported tone, RichText body, and optional string title", "supply a valid callout")); break;
+      case "contact": if (section.heading !== undefined && !string(section.heading) || section.email !== undefined && !string(section.email) || section.phone !== undefined && !string(section.phone) || section.address !== undefined && (!Array.isArray(section.address) || section.address.some((line) => !string(line))) || !string(section.email) && !string(section.phone) && !(Array.isArray(section.address) && section.address.length)) findings.push(finding("parity-section-shape", at, "contact requires string members and email, phone, or address", "supply valid contact details")); break;
+      case "needs_review": if (!string(section.reason) || section.severity !== undefined && !["blocker", "note"].includes(section.severity) || section.owner !== undefined && !string(section.owner) || section.href !== undefined && !string(section.href)) findings.push(finding("parity-section-shape", at, "needs_review requires reason and valid optional severity/owner/href", "supply a valid needs_review section")); break;
+      default: findings.push(finding("parity-section-kind", `${at}/kind`, "section kind is not supported by the renderer", "use heading, paragraph, list, definitions, callout, contact, or needs_review"));
+    }
+  });
+  const bodyHtml = typeof value.body_html === "string" && value.body_html.trim() !== "";
+  const sections = Array.isArray(value.sections) && value.sections.length > 0;
+  if (!bodyHtml && !sections) findings.push(finding("parity-page-body", file, "page needs non-empty body_html or non-empty sections", "add rendered body_html or one or more sections"));
+  return findings;
+}
+
+function readStructured(path, file, findings) {
+  try { return JSON.parse(readFileSync(path, "utf8")); }
+  catch { findings.push(finding("parity-content-parse", file, "invalid JSON", "repair the JSON before visual-parity closure")); return null; }
+}
+
+/** @typedef {{level:string, rule:string, file:string, message:string, fix:string}} ParityFinding */
+/** @typedef {{asset:string, file:string}} DecodeAsset */
+/** @typedef {{tenantId?: string}} VisualParityOptions */
+/** Validate the portable content closure required before human visual-parity review.
+ * @param {string} tenantDir
+ * @param {VisualParityOptions} [options]
+ */
+export function validateVisualParityClosure(tenantDir, options = {}) {
+  const { tenantId } = options;
+  /** @type {ParityFinding[]} */
+  const findings = [];
+  const { value: config, findings: configFindings } = parseConfig(tenantDir);
+  findings.push(...configFindings);
+  const pagesDir = join(tenantDir, "content", "pages");
+  const files = walk(pagesDir).filter((file) => file.endsWith(".json")).sort();
+  if (files.length === 0) findings.push(finding("parity-pages-missing", "content/pages/", "no page JSON files define the visual-parity route scope", "add the paired authored page records under content/pages/ before closing parity"));
+  const pages = [];
+  for (const path of files) {
+    const file = relative(tenantDir, path);
+    try {
+      const value = JSON.parse(readFileSync(path, "utf8"));
+      if (!value || Array.isArray(value) || typeof value !== "object") {
+        findings.push(finding("parity-page-shape", file, "page JSON must be an object", "write a page object with a non-empty slug")); continue;
+      }
+      findings.push(...pageShape(value, file));
+      if (typeof value.slug !== "string" || !value.slug.trim()) continue;
+      pages.push({ file, value });
+    } catch { findings.push(finding("parity-page-parse", file, "invalid JSON", "repair the JSON before visual-parity closure")); }
+  }
+  const routes = new Set(["/"]);
+  for (const page of pages) routes.add(normalizeRoute(page.value.slug));
+  /** @type {{findings:ParityFinding[], tenantId:string|null, publicDir:string, routes:Set<string>, allowlist:string[], decodeAssets:DecodeAsset[]}} */
+  const context = { findings, tenantId: tenantId ?? tenantFromConfig(tenantDir), publicDir: join(tenantDir, "public"), routes, allowlist: Array.isArray(config.externalNavigationAllowlist) ? config.externalNavigationAllowlist : [], decodeAssets: [] };
+  if (!context.tenantId) findings.push(finding("parity-tenant-id", ".tot/config.json", "tenant id is required to verify /tenants/<tenant>/ assets", "set tenant in .tot/config.json or pass a resolved tenant id"));
+  for (const page of pages) inspectValue(page.value, page.file, [], context);
+  for (const name of ["home.json", "chrome.json"]) {
+    const path = join(tenantDir, "content", name);
+    if (existsSync(path)) {
+      const value = readStructured(path, `content/${name}`, findings);
+      if (value != null) inspectValue(value, `content/${name}`, [], context);
+    }
+  }
+  const themePath = join(tenantDir, "theme.json");
+  if (existsSync(themePath)) {
+    const value = readStructured(themePath, "theme.json", findings);
+    if (value != null) inspectValue(value, "theme.json", [], context);
+  }
+  for (const index of decodeImages(context.decodeAssets)) {
+    const entry = context.decodeAssets[index];
+    if (entry) findings.push(finding("parity-asset-decode", entry.file, "image decoder could not produce nonzero pixels", "replace the image with a decodable file"));
+  }
+  findings.sort((a, b) => `${a.file}\0${a.rule}`.localeCompare(`${b.file}\0${b.rule}`));
+  return { ok: findings.length === 0, profile: "visual-parity", findings };
+}

package/packages/public-runtime/package.json

@@ -10,6 +10,8 @@
   "exports": {
     ".": "./src/index.ts",
     "./blog-visibility": "./src/blog-visibility.mjs",
+    "./publication-redirects": "./src/publication-redirects.mjs",
+    "./tenant-embed-defaults": "./src/tenant-embed-defaults.mjs",
     "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
     "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs"
   },

package/packages/public-runtime/schemas/publication-space/v1/manifest.schema.json

@@ -182,7 +182,7 @@
     "mountPath": {
       "allOf": [
         { "$ref": "#/$defs/path" },
-        { "type": "string", "pattern": "^/(?!(?:\\.well-known|__evidence|__preview|_astro|_style-guide|admin|api|apps|assets|auth|brand|capabilities|cockpit|collections|dashboard|dev|favicon\\.svg|health|js|llms\\.txt|platform|preview|products|robots\\.txt|saved|search|shared|sitemap\\.xml|style-guide|tenants)(?:/|$))" }
+        { "type": "string", "pattern": "^/(?!(?:\\.[wW][eE][lL][lL]-[kK][nN][oO][wW][nN]|__[eE][vV][iI][dD][eE][nN][cC][eE]|__[pP][rR][eE][vV][iI][eE][wW]|_[aA]|_[aA][sS][tT][rR][oO]|_[sS][tT][yY][lL][eE]-[gG][uU][iI][dD][eE]|[aA][dD][mM][iI][nN]|[aA][pP][iI]|[aA][pP][pP][sS]|[aA][sS][sS][eE][tT][sS]|[aA][uU][tT][hH]|[bB][rR][aA][nN][dD]|[cC][aA][pP][aA][bB][iI][lL][iI][tT][iI][eE][sS]|[cC][oO][cC][kK][pP][iI][tT]|[cC][oO][lL][lL][eE][cC][tT][iI][oO][nN][sS]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[dD][eE][vV]|[fF][aA][vV][iI][cC][oO][nN]\\.[sS][vV][gG]|[fF][eE][eE][dD]\\.[jJ][sS][oO][nN]|[hH][eE][aA][lL][tT][hH]|[jJ][sS]|[lL][lL][mM][sS]\\.[tT][xX][tT]|[pP][lL][aA][tT][fF][oO][rR][mM]|[pP][rR][eE][vV][iI][eE][wW]|[pP][rR][oO][dD][uU][cC][tT][sS]|[pP][uU][bB][lL][iI][cC][aA][tT][iI][oO][nN]-[dD][iI][sS][cC][oO][vV][eE][rR][yY]|[rR][oO][bB][oO][tT][sS]\\.[tT][xX][tT]|[sS][aA][vV][eE][dD]|[sS][eE][aA][rR][cC][hH]|[sS][eE][aA][rR][cC][hH]-[iI][nN][dD][eE][xX]\\.[jJ][sS][oO][nN]|[sS][hH][aA][rR][eE][dD]|[sS][iI][tT][eE][mM][aA][pP]\\.[xX][mM][lL]|[sS][tT][yY][lL][eE]-[gG][uU][iI][dD][eE]|[tT][eE][nN][aA][nN][tT][sS])(?:/|$))" }
       ]
     },
     "aliasPath": {

package/packages/public-runtime/schemas/publication-space/v1/normalized-mount.schema.json

@@ -67,7 +67,7 @@
     "mountPath": {
       "allOf": [
         { "$ref": "#/$defs/normalizedPath" },
-        { "type": "string", "pattern": "^/(?!(?:\\.well-known|__evidence|__preview|_astro|_style-guide|admin|api|apps|assets|auth|brand|capabilities|cockpit|collections|dashboard|dev|favicon\\.svg|health|js|llms\\.txt|platform|preview|products|robots\\.txt|saved|search|shared|sitemap\\.xml|style-guide|tenants)(?:/|$))" }
+        { "type": "string", "pattern": "^/(?!(?:\\.[wW][eE][lL][lL]-[kK][nN][oO][wW][nN]|__[eE][vV][iI][dD][eE][nN][cC][eE]|__[pP][rR][eE][vV][iI][eE][wW]|_[aA]|_[aA][sS][tT][rR][oO]|_[sS][tT][yY][lL][eE]-[gG][uU][iI][dD][eE]|[aA][dD][mM][iI][nN]|[aA][pP][iI]|[aA][pP][pP][sS]|[aA][sS][sS][eE][tT][sS]|[aA][uU][tT][hH]|[bB][rR][aA][nN][dD]|[cC][aA][pP][aA][bB][iI][lL][iI][tT][iI][eE][sS]|[cC][oO][cC][kK][pP][iI][tT]|[cC][oO][lL][lL][eE][cC][tT][iI][oO][nN][sS]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[dD][eE][vV]|[fF][aA][vV][iI][cC][oO][nN]\\.[sS][vV][gG]|[fF][eE][eE][dD]\\.[jJ][sS][oO][nN]|[hH][eE][aA][lL][tT][hH]|[jJ][sS]|[lL][lL][mM][sS]\\.[tT][xX][tT]|[pP][lL][aA][tT][fF][oO][rR][mM]|[pP][rR][eE][vV][iI][eE][wW]|[pP][rR][oO][dD][uU][cC][tT][sS]|[pP][uU][bB][lL][iI][cC][aA][tT][iI][oO][nN]-[dD][iI][sS][cC][oO][vV][eE][rR][yY]|[rR][oO][bB][oO][tT][sS]\\.[tT][xX][tT]|[sS][aA][vV][eE][dD]|[sS][eE][aA][rR][cC][hH]|[sS][eE][aA][rR][cC][hH]-[iI][nN][dD][eE][xX]\\.[jJ][sS][oO][nN]|[sS][hH][aA][rR][eE][dD]|[sS][iI][tT][eE][mM][aA][pP]\\.[xX][mM][lL]|[sS][tT][yY][lL][eE]-[gG][uU][iI][dD][eE]|[tT][eE][nN][aA][nN][tT][sS])(?:/|$))" }
       ]
     },
     "aliasPath": {

package/packages/public-runtime/src/chrome.ts

@@ -180,10 +180,16 @@ export interface ChromeAnnouncement {
  * components/islands/IsolatedAgeGate.tsx uses for component pages — so tenant
  * CSS/JS can't reach the dialog.
  */
+export const CHROME_AGE_GATE_VARIANTS = ["default", "compact-modal"] as const;
+export type ChromeAgeGateVariant = (typeof CHROME_AGE_GATE_VARIANTS)[number];
+
 export interface ChromeAgeGate {
+  /** Raw-chrome fallback; component storefront enforcement uses TenantConfig.compliance.minAge. */
   minAge: number;
-  /** localStorage key remembering a pass (defaults to a stable derived key). */
+  /** Raw-chrome fallback persistence key; the component storefront derives its own scoped key. */
   storageKey?: string;
+  /** Component and raw-chrome visual presentation. */
+  variant?: ChromeAgeGateVariant;
   title?: string;
   lede?: string;
   yesLabel?: string;
@@ -195,6 +201,16 @@ export interface ChromeAgeGate {
   mark?: { text: string; className?: string }[];
 }
 
+/** Platform-owned persistence scope for a tenant's enforced age affirmation. */
+export function deriveAgeGateStorageKey(tenantId: string, minAge: number): string {
+  return `tot:age-affirmed:${encodeURIComponent(tenantId)}:${minAge}`;
+}
+
+/** Resolve the enforcement-owned age token inside governed presentation copy. */
+export function resolveAgeGateCopy(value: string | undefined, minAge: number): string | undefined {
+  return value?.replaceAll("{{minAge}}", String(minAge));
+}
+
 /** Footer brand block: identity + tagline/contact + optional inline newsletter. */
 export interface ChromeFooterBrand {
   logo?: ChromeLogo;
@@ -228,14 +244,12 @@ export interface ChromeHead {
 // existing members.
 // ---------------------------------------------------------------------------
 
-/** The only two header content shapes: a full header, or a minimal one
- * (e.g. checkout/policy pages — brand + a reduced action set, no full nav). */
-export const HEADER_VARIANTS = ["primary", "minimal"] as const;
+/** Header content shapes: full, minimal, or source-parity compact commerce chrome. */
+export const HEADER_VARIANTS = ["primary", "minimal", "compact-centered"] as const;
 export type HeaderVariant = (typeof HEADER_VARIANTS)[number];
 
-/** Footer content shapes. One member today; the type is an extensible string
- * union (not a boolean) so a future variant is an additive change. */
-export const FOOTER_VARIANTS = ["default"] as const;
+/** Footer content shapes. The string union keeps presentation explicit and validated. */
+export const FOOTER_VARIANTS = ["default", "light-collapsible"] as const;
 export type FooterVariant = (typeof FOOTER_VARIANTS)[number];
 
 export function isHeaderVariant(v: unknown): v is HeaderVariant {
@@ -503,6 +517,29 @@ function validateAgeGate(v: unknown, path: string, errors: string[]): v is Chrom
   if (typeof v.minAge !== "number" || !Number.isFinite(v.minAge)) {
     errors.push(`${path}.minAge: required number`);
   }
+  checkOptionalString(v.storageKey, `${path}.storageKey`, errors);
+  if (
+    v.variant !== undefined &&
+    !CHROME_AGE_GATE_VARIANTS.includes(v.variant as ChromeAgeGateVariant)
+  ) {
+    errors.push(`${path}.variant: must be one of ${CHROME_AGE_GATE_VARIANTS.join(", ")}`);
+  }
+  for (const field of ["title", "lede", "yesLabel", "noLabel", "denyText", "fineText"] as const) {
+    checkOptionalString(v[field], `${path}.${field}`, errors);
+  }
+  if (v.mark !== undefined) {
+    if (!Array.isArray(v.mark)) {
+      errors.push(`${path}.mark: must be an array`);
+    } else {
+      v.mark.forEach((part, i) => {
+        if (!isObject(part) || !isNonEmptyString(part.text)) {
+          errors.push(`${path}.mark[${i}].text: required non-empty string`);
+          return;
+        }
+        checkOptionalString(part.className, `${path}.mark[${i}].className`, errors);
+      });
+    }
+  }
   return errors.length === before;
 }
 

package/packages/public-runtime/src/csp.ts

@@ -26,6 +26,17 @@ export interface CspOptions {
   connectSrc?: readonly string[];
   /** Sandboxed-widget origins. */
   frameSrc?: readonly string[];
+  /**
+   * Extra origins allowed to frame this response, beyond `'self'`. Used only for
+   * the native GA4 sandbox's paired apex/www alias — the sandbox mounts on the
+   * OTHER of the tenant's apex/www hosts (see resolveNativeGa4SandboxUrl), so that
+   * host must be allowed to frame it back; `frame-src` alone only grants the
+   * reverse direction (who the page may frame), not this one. Must be computed
+   * from the platform's own request context, never from tenant/adapter-declared
+   * config — csp-compiler.ts deliberately keeps integration-plane additions off
+   * this directive.
+   */
+  frameAncestors?: readonly string[];
   /**
    * Extra `form-action` targets. Default is `'self'`; add-to-cart forms POST
    * cross-origin to the checkout store's `/cart`, so that origin is added here.
@@ -43,7 +54,7 @@ export function buildCsp(opts: CspOptions): string {
     "default-src": ["'self'"],
     "base-uri": ["'self'"],
     "object-src": ["'none'"],
-    "frame-ancestors": ["'self'"],
+    "frame-ancestors": ["'self'", ...(opts.frameAncestors ?? [])],
     "form-action": ["'self'", ...(opts.formAction ?? [])],
     "script-src": ["'self'", nonce, ...(opts.scriptSrc ?? [])],
     "style-src": ["'self'", nonce, ...(opts.styleSrc ?? [])],

package/packages/public-runtime/src/extension-contract-values.d.mts

@@ -0,0 +1,19 @@
+export declare const BLOCK_PALETTE_CURRENT_CONTRACT: "block-palette@6";
+export declare const BLOCK_PALETTE_SUPPORTED_CONTRACTS: readonly [
+  "block-palette@1",
+  "block-palette@2",
+  "block-palette@3",
+  "block-palette@4",
+  "block-palette@5",
+  "block-palette@6",
+];
+export declare const FEATURED_PRODUCT_PRESENTATIONS: readonly ["grid", "carousel"];
+export declare const PROMO_TILE_PRESENTATIONS: readonly [
+  "overlay",
+  "portrait-cards",
+  "editorial-cards",
+  "logo-strip",
+];
+export declare function isSafeRehostedAssetPath(value: unknown): value is string;
+export declare function isSafeRehostedAssetPathForTenant(value: unknown, tenantId: unknown): value is string;
+export declare function isSafeStorefrontHref(value: unknown): value is string;

package/packages/public-runtime/src/extension-contract-values.mjs

@@ -0,0 +1,62 @@
+/**
+ * Runtime values for the storefront block-palette contract.
+ *
+ * Plain JavaScript keeps one dependency-free authority consumable by the edge
+ * runtime and repository Node tooling. The separately published CLI mirrors
+ * these values and pins that mirror with a parity test.
+ */
+export const BLOCK_PALETTE_CURRENT_CONTRACT = "block-palette@6";
+
+export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = Object.freeze([
+  "block-palette@1",
+  "block-palette@2",
+  "block-palette@3",
+  "block-palette@4",
+  "block-palette@5",
+  BLOCK_PALETTE_CURRENT_CONTRACT,
+]);
+
+export const FEATURED_PRODUCT_PRESENTATIONS = Object.freeze(["grid", "carousel"]);
+
+export const PROMO_TILE_PRESENTATIONS = Object.freeze([
+  "overlay",
+  "portrait-cards",
+  "editorial-cards",
+  "logo-strip",
+]);
+
+/** True only for static assets materialized into a governed serving namespace. */
+export function isSafeRehostedAssetPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/")) return false;
+  if (value.includes("\\") || value.includes("?") || value.includes("#")) return false;
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return false;
+  }
+  if (decoded !== value || decoded.includes("..") || decoded.includes("//")) return false;
+  return /^\/(?:tenants\/[^/]+|shared)\/[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value);
+}
+
+/** Bind a tenant asset reference to the tenant currently being rendered. */
+export function isSafeRehostedAssetPathForTenant(value, tenantId) {
+  if (!isSafeRehostedAssetPath(value) || typeof tenantId !== "string" || !tenantId) return false;
+  return value.startsWith("/shared/") || value.startsWith(`/tenants/${tenantId}/`);
+}
+
+/** Navigation authored in a commerce block stays on the current storefront. */
+export function isSafeStorefrontHref(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return false;
+  if (value.includes("\\") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f]/.test(value)) return false;
+  try {
+    const decoded = decodeURIComponent(value);
+    if (decoded !== value || decoded.includes("\\") || /[\u0000-\u001f\u007f]/.test(decoded)) return false;
+    const segments = value.split("/");
+    return !segments.some((segment, index) =>
+      index > 0 && (segment === "." || segment === ".." || (segment === "" && index < segments.length - 1))
+    );
+  } catch {
+    return false;
+  }
+}

package/packages/public-runtime/src/extension-contract.ts

@@ -6,14 +6,25 @@
  * used by docs, validators, CLI checks, and the storefront app itself.
  */
 
-export const BLOCK_PALETTE_CURRENT_CONTRACT = "block-palette@4" as const;
-export const BLOCK_PALETTE_SUPPORTED_CONTRACTS = [
-  "block-palette@1",
-  "block-palette@2",
-  "block-palette@3",
+import {
+  BLOCK_PALETTE_SUPPORTED_CONTRACTS,
+  FEATURED_PRODUCT_PRESENTATIONS,
+  PROMO_TILE_PRESENTATIONS,
+} from "./extension-contract-values.mjs";
+export {
   BLOCK_PALETTE_CURRENT_CONTRACT,
-] as const;
+  BLOCK_PALETTE_SUPPORTED_CONTRACTS,
+  FEATURED_PRODUCT_PRESENTATIONS,
+  PROMO_TILE_PRESENTATIONS,
+  isSafeRehostedAssetPath,
+  isSafeRehostedAssetPathForTenant,
+  isSafeStorefrontHref,
+} from "./extension-contract-values.mjs";
+
+export type PromoTilePresentation =
+  (typeof PROMO_TILE_PRESENTATIONS)[number];
 
+/** The versioned contract accepted by the platform block palette. */
 export type BlockPaletteContract =
   (typeof BLOCK_PALETTE_SUPPORTED_CONTRACTS)[number];
 
@@ -27,6 +38,9 @@ export const FEATURED_PRODUCT_SOURCE_KEYS = [
 export type FeaturedProductSourceKey =
   (typeof FEATURED_PRODUCT_SOURCE_KEYS)[number];
 
+export type FeaturedProductPresentation =
+  (typeof FEATURED_PRODUCT_PRESENTATIONS)[number];
+
 export type ProductSectionSource =
   | FeaturedProductSourceKey
   | { collection: string }

package/packages/public-runtime/src/index.ts

@@ -17,6 +17,14 @@ export * from "./product.js";
 export * from "./tenant.js";
 export * from "./publication-space.js";
 export * from "./blog-visibility.mjs";
+// Per-tenant build-time embed defaults (tenant-embed-defaults.mjs) are deliberately
+// NOT re-exported here: this barrel is inside the v84 clean-clone ATTESTED source
+// graph, so an `export *` widens that graph's membership and takes a human-review
+// gate (`repin-v84-clean-clone.mjs` refuses a membership change, correctly). The
+// module is reached by its own subpath export instead —
+// `@tot/public-runtime/tenant-embed-defaults` — which keeps the attestation surface
+// unchanged. Adding a convenience re-export here would cost an attestation review
+// for nothing.
 export * from "./publication-routing.js";
 export * from "./publication-version.js";
 export * from "./publication-artifact.js";