@tokenoftrust/storefront-runner 2.0.40 → 2.0.42

package/apps/storefront/src/config/publicationSpaceConfig.ts

@@ -1,18 +1,29 @@
 import type {
+  PublicationSpaceAliasV1,
   PublicationSpaceManifestV1,
   PublicationSpaceSourceV1,
 } from "@tot/public-runtime";
 
+/**
+ * The root publication space for a tenant.
+ *
+ * `aliases` are the tenant's declared redirects, in the one `redirect-308` contract that carries
+ * them the whole way: `publicationRedirects()` lifts them into the aggregate metadata,
+ * `cloudfront-live-pointer.mjs` writes them into the live pointer value, and the edge function
+ * serves the 308. A tenant declaring none gets a `routes` object without the key at all, so its
+ * manifest — and therefore its digest — is unchanged by this parameter existing.
+ */
 export function rootPublicationSpaceConfig(
   tenant: string,
   source: PublicationSpaceSourceV1,
+  aliases: readonly PublicationSpaceAliasV1[] = [],
 ): PublicationSpaceManifestV1 {
   return {
     version: 1,
     id: "root",
     tenant,
     source,
-    routes: { canonicalMount: "/" },
+    routes: aliases.length ? { canonicalMount: "/", aliases: [...aliases] } : { canonicalMount: "/" },
     visibility: "public",
     authorization: { policy: "public" },
     discovery: { sitemap: true, feeds: true, publicSearch: true, llms: true },

package/apps/storefront/src/config/publicationSpaceRegistry.ts

@@ -4,6 +4,11 @@ import { rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
 const ROOT_SOURCES: Readonly<Record<string, PublicationSpaceSourceV1>> = {
   home: { forge: "fixture", repo: "home", defaultBranch: "main" },
   "tokenoftrust.com": { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" },
+  "storefront.tokenoftrust.store": {
+    forge: "gitea",
+    repo: "storefront.tokenoftrust.store",
+    defaultBranch: "main",
+  },
   "sample-store.com": { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" },
   "sample-store.e2e.test": { forge: "fixture", repo: "sample-store.e2e.test", defaultBranch: "main" },
   "verify.e2e.test": { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" },

package/apps/storefront/src/config/tenants.ts

@@ -12,6 +12,7 @@
  * StaticTenantResolver, tenantResolver) is unchanged — only the data is generic.
  */
 import type { TenantConfig, TenantResolver } from "@tot/public-runtime";
+import { tenantRendersPublicly } from "@tot/public-runtime";
 import { getTenantTheme } from "@/themes/tenants";
 import { rootPublicationSpaceConfig } from "@/config/publicationSpaceConfig";
 
@@ -96,3 +97,24 @@ export class StaticTenantResolver implements TenantResolver {
 }
 
 export const tenantResolver: TenantResolver = new StaticTenantResolver();
+
+const COMPOSED_PLATFORM_FIELDS = ["access", "pathPrefixTenants"] as const;
+
+/** Same contract as the real registry's withPlatformPolicy — kept in sync by hand. */
+export function withPlatformPolicy(record: TenantConfig): TenantConfig {
+  const declared = REGISTRY.find((t) => t.tenant_id === record.tenant_id);
+  const out = { ...record };
+  for (const field of COMPOSED_PLATFORM_FIELDS) {
+    const value = declared?.[field];
+    if (value === undefined) delete out[field];
+    else (out[field] as unknown) = value;
+  }
+  return out;
+}
+
+/** Same contract as the real registry's tenantIsDeclaredPublic — kept in sync by hand. */
+export function tenantIsDeclaredPublic(tenantId: string): boolean {
+  return REGISTRY.some(
+    (t) => t.tenant_id === tenantId && tenantRendersPublicly(t),
+  );
+}

package/apps/storefront/src/layouts/Layout.astro

@@ -23,9 +23,12 @@ import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
 import { organizationLd, websiteLd } from "@/lib/jsonld";
 import { nonceInlineTags, CHROME_BODY_MARKER } from "@/lib/rawMarketingHtml";
+import { CHROME_BEHAVIOR_JS, sanitizeSharedChromeFragment } from "@/lib/rawChrome";
+import { ASYNC_CSS_SWAP_JS } from "@/lib/asyncCss";
 import { reportTrackingChainHealth } from "@/lib/tracking/interactionHealth";
 import { resolveHeaderVariant, resolveFooterVariant } from "@/lib/chrome/variant";
 import { splitFooterLegal } from "@/lib/chrome/footerLegal";
+import { bindManagedCartAnchors, managedCartHref } from "@/lib/chrome/managedCart";
 import type { HeaderVariant, FooterVariant } from "@/lib/chrome/model";
 import { renderIntegrationPhases, INTERACTION_TRACKING_BOOT_JS } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/auth/route";
@@ -127,6 +130,9 @@ const chrome = await Astro.locals.content.getChrome();
 // actionable message rather than silently falling back (lib/chrome/variant.ts).
 const resolvedHeaderVariant = resolveHeaderVariant(headerVariant, chrome.header.variant);
 const resolvedFooterVariant = resolveFooterVariant(footerVariant, chrome.footer.variant);
+const footerCompliance = [chrome.footer.warning, chrome.complianceStrip]
+  .filter((line): line is string => Boolean(line))
+  .join(" ") || undefined;
 
 // SHARED CHROME: if the tenant ships content/<id>/chrome.html (the pixel-perfect
 // header/footer the raw marketing pages use), render THAT chrome around the
@@ -135,7 +141,10 @@ const resolvedFooterVariant = resolveFooterVariant(footerVariant, chrome.footer.
 // <!--PAGE_BODY-->: everything before = header, after = footer; pull its tenant
 // stylesheet links into <head>; nonce its inline tags for CSP. Tenants without a
 // chrome.html keep the token-driven Header/Footer (below).
-const chromeHtml = await Astro.locals.content.getChromeHtml(path);
+const chromeHtml = bindManagedCartAnchors(
+  (await Astro.locals.content.getChromeHtml(path)) ?? "",
+  Astro.locals.commerce,
+) || null;
 if (chromeHtml) {
   // HEALTH: this is the sharedChrome BYPASS path — a hand-authored chrome.html
   // wins outright over the governed chrome components below, so nothing
@@ -156,13 +165,22 @@ if (chromeHtml && chromeHtml.includes(CHROME_BODY_MARKER)) {
   const marker = chromeHtml.indexOf(CHROME_BODY_MARKER);
   const bodyEnd = chromeHtml.lastIndexOf("</body>");
   sharedChrome = {
-    header: nonceInlineTags(chromeHtml.slice(bodyOpen, marker), cspNonce),
-    footer: nonceInlineTags(chromeHtml.slice(marker + CHROME_BODY_MARKER.length, bodyEnd >= 0 ? bodyEnd : undefined), cspNonce),
+    header: nonceInlineTags(
+      sanitizeSharedChromeFragment(chromeHtml.slice(bodyOpen, marker)),
+      cspNonce,
+    ),
+    footer: nonceInlineTags(
+      sanitizeSharedChromeFragment(
+        chromeHtml.slice(marker + CHROME_BODY_MARKER.length, bodyEnd >= 0 ? bodyEnd : undefined),
+      ),
+      cspNonce,
+    ),
     css,
   };
 }
 
 const compliance = tenant.compliance;
+const cartHref = managedCartHref(Astro.locals.commerce);
 
 // Site-chrome data resolution (chrome/* is the canonical, prop-driven
 // component set; this Layout is the ONE place that resolves session/feature/
@@ -310,7 +328,7 @@ const footerWidgets = await renderWidgetSlot(
       <Fragment set:html={sharedChrome.header} />
     ) : (
       <>
-        <div class="sticky top-0 z-40">
+        <div class:list={[resolvedHeaderVariant !== "compact-centered" && "sticky top-0 z-40"]}>
           {chrome.header.announcement?.messages[0] && (
             <AnnouncementBar text={chrome.header.announcement.messages[0]} variant="static" />
           )}
@@ -322,10 +340,16 @@ const footerWidgets = await renderWidgetSlot(
             variant={headerDark ? "dark" : "light"}
             layout={resolvedHeaderVariant}
             announcement={chrome.header.announcement?.messages[0]}
-            searchAction={features.productSearch ? "/search" : undefined}
+            searchAction={
+              features.productSearch ? (chrome.header.search?.action ?? "/search") : undefined
+            }
+            searchPlaceholder={chrome.header.search?.placeholder}
+            searchLabel={chrome.header.search?.label}
             savedItemsHref={features.savedItems ? "/saved" : undefined}
             headerCtas={chrome.header.ctas}
-            authLink={authLink}
+            accountHref={chrome.header.accountHref}
+            authLink={chrome.header.accountHref ? undefined : authLink}
+            cartHref={cartHref}
             sticky={false}
           />
         </div>
@@ -339,18 +363,35 @@ const footerWidgets = await renderWidgetSlot(
     <ShippingRestrictionNotice text={compliance?.shippingRestriction} />
 
     {sharedChrome ? (
-      <Fragment set:html={sharedChrome.footer} />
+      <>
+        <Fragment set:html={sharedChrome.footer} />
+        {/* Shared chrome is declarative tenant markup. Its supported behavior is
+            supplied from this platform-owned module, never from tenant scripts. */}
+        <script is:inline nonce={cspNonce} set:html={CHROME_BEHAVIOR_JS}></script>
+      </>
     ) : (
       <>
         <SiteFooter
           brand={{
-            wordmark: tenant.displayName,
-            contact: chrome.footer.brand?.text ? [chrome.footer.brand.text] : undefined,
+            logo: chrome.footer.brand?.logo,
+            wordmark:
+              chrome.footer.brand?.wordmark?.map((part) => part.text).join("") ??
+              tenant.displayName,
+            contact: chrome.footer.brand?.text?.split(/\r?\n/),
           }}
           variant={resolvedFooterVariant}
           columns={footerColumns}
-          newsletter={features.newsletter ? { title: "Newsletter", placeholder: "you@example.com" } : undefined}
+          newsletter={
+            features.newsletter
+              ? (chrome.footer.newsletter ?? {
+                  title: "Newsletter",
+                  placeholder: "you@example.com",
+                })
+              : undefined
+          }
+          payments={chrome.footer.payments}
           social={chrome.footer.social}
+          compliance={footerCompliance}
           legal={legalLine}
           bottomLinks={bottomLinks}
         />
@@ -372,7 +413,13 @@ const footerWidgets = await renderWidgetSlot(
     ))}
 
     {capabilities.ageVerification.enabled && compliance?.minAge && (
-      <IsolatedAgeGate client:load minAge={compliance.minAge} brand={tenant.displayName} />
+      <IsolatedAgeGate
+        client:load
+        minAge={compliance.minAge}
+        brand={tenant.displayName}
+        tenantId={tenant.tenant_id}
+        presentation={chrome.ageGate}
+      />
     )}
 
     {/* Global quick-view dialog (opened by any [data-quickview] card button).
@@ -451,39 +498,10 @@ const footerWidgets = await renderWidgetSlot(
         /<domain>/ path segment (locals.basePath), keep same-origin
         root-absolute links inside that prefix so navigation stays on the
         tenant. Host-routed requests have no base path and skip this entirely. */}
-    {basePath && (
-      <script is:inline nonce={cspNonce} define:vars={{ basePath }}>
-        (function () {
-          var base = basePath;
-          if (!base) return;
-          function fix(a) {
-            var href = a.getAttribute("href");
-            if (!href || href.charAt(0) !== "/" || href.charAt(1) === "/") return;
-            // Global asset namespaces are root-served under every tenant.
-            if (href.indexOf("/tenants/") === 0 || href.indexOf("/shared/") === 0) return;
-            if (href === base || href.indexOf(base + "/") === 0) return;
-            a.setAttribute("href", base + href);
-          }
-          function fixAll() {
-            document.querySelectorAll('a[href^="/"]').forEach(fix);
-          }
-          if (document.readyState === "loading") {
-            document.addEventListener("DOMContentLoaded", fixAll);
-          } else {
-            fixAll();
-          }
-          // Late/island-rendered anchors: fix just-in-time before navigation.
-          document.addEventListener(
-            "pointerdown",
-            function (e) {
-              var a = e.target && e.target.closest && e.target.closest('a[href^="/"]');
-              if (a) fix(a);
-            },
-            true,
-          );
-        })();
-      </script>
-    )}
+    <script>
+      import { bindBasePathAnchors } from "@/lib/basePath";
+      bindBasePathAnchors();
+    </script>
 
     {/* Dev-loop theme hot-patch: tenant-hot-reload.mjs broadcasts a
         `tot:theme-vars` HMR custom event on every theme.json save instead of
@@ -573,6 +591,13 @@ const footerWidgets = await renderWidgetSlot(
         entry in lib/cspStaticHashes.ts. */}
     <script is:inline nonce={cspNonce} set:html={INTERACTION_TRACKING_BOOT_JS}></script>
 
+    {/* Swaps every <AsyncStylesheet>-rendered preload link to rel="stylesheet"
+        once fetched. ONE nonced script per document handles every such link,
+        however many <AsyncStylesheet> instances rendered (lib/asyncCss.ts —
+        the onload="" attribute trick can't carry a nonce under this CSP). A
+        no-op when the page has none. */}
+    <script is:inline nonce={cspNonce} set:html={ASYNC_CSS_SWAP_JS}></script>
+
     {/* document.deferred global-entry boundary (ext-kernel-04) — the last phase, the
         renderer-owned mount point for the deferred integration entry. This region also
         CARRIES the lifecycle host tag (ext-kernel-05), which initializes the plan's

package/apps/storefront/src/lib/activity/changeActorAttribution.ts

@@ -60,22 +60,38 @@ function submitAuthorizationKey(
  * Persist who took `action` on `subjectId` (a `changeId` for reject/accept/build,
  * or the aggregate id for ship). Best-effort — never blocks or fails the
  * mutation it describes; a write fault is swallowed, mirroring `recordActivity`.
+ *
+ * `email: null` means the request carried no real per-person identity — the
+ * headless Bearer/CLI operator path, which authenticates a shared tenant-level
+ * secret, never a signed-in developer (the CLI holds no storefront viewer
+ * session). Recording that case under the tenant OWNER's email would credit
+ * the owner's account for an action any operator-secret holder could have
+ * taken — a real misattribution, not a display nicety — so it is recorded as
+ * a distinct `service` identity instead.
  */
 export async function recordChangeActor(
   kv: ChangeActorKv,
   tenantId: string,
   subjectId: string,
   action: ChangeActorAction,
-  email: string,
+  email: string | null,
 ): Promise<void> {
   try {
-    const record: ChangeActorRecord = {
-      kind: "human",
-      subject: `email:${email.trim().toLowerCase()}`,
-      email,
-      name: displayNameFromEmail(email),
-      at: new Date().toISOString(),
-    };
+    const record: ChangeActorRecord = email
+      ? {
+          kind: "human",
+          subject: `email:${email.trim().toLowerCase()}`,
+          email,
+          name: displayNameFromEmail(email),
+          at: new Date().toISOString(),
+        }
+      : {
+          kind: "service",
+          subject: "service:cli-operator",
+          email: null,
+          name: "CLI (operator credential)",
+          at: new Date().toISOString(),
+        };
     await kv.put(attributionKey(tenantId, subjectId, action), JSON.stringify(record));
   } catch {
     /* best-effort — the mutation it describes already succeeded */

package/apps/storefront/src/lib/activity/recordActivity.ts

@@ -87,6 +87,21 @@ export function actorEmailFor(context: APIContext, auth: { owner: string }): str
   return context.locals?.viewer?.email ?? auth.owner;
 }
 
+/**
+ * The real per-person identity to CREDIT for an owner-facing "who did this"
+ * record — DELIBERATELY narrower than {@link actorEmailFor}. That helper's
+ * owner fallback exists only to give the anonymized activity hash and
+ * authorization checks a valid bucket/identity to reason about; crediting the
+ * SAME fallback to `recordChangeActor` would misattribute every action taken
+ * over the headless Bearer/CLI operator path (a shared tenant-level secret,
+ * never a signed-in developer — the CLI holds no storefront viewer session)
+ * to the tenant owner personally. `null` means exactly that: no real person
+ * to credit, not "credit the owner." See `changeActorAttribution.ts`.
+ */
+export function attributedActorEmailFor(context: APIContext): string | null {
+  return context.locals?.viewer?.email ?? null;
+}
+
 /**
  * Best-effort, deterministic display name from an email — a real name is NOT
  * captured anywhere in the current session/grant model. A placeholder good enough

package/apps/storefront/src/lib/asyncCss.ts

@@ -0,0 +1,23 @@
+/**
+ * CSP-safe async (non-render-blocking) CSS loading.
+ *
+ * The classic `<link rel="preload" as="style" onload="this.rel='stylesheet'">`
+ * trick doesn't work under this storefront's CSP (docs/architecture/async-css.md):
+ * `onload="…"` is an inline EVENT-HANDLER ATTRIBUTE, governed by `script-src`
+ * (there is no separate `script-src-attr` directive here), and an attribute
+ * can't carry a per-request nonce — only a `<script nonce>` TAG can. So the
+ * swap has to happen from a nonced `<script>`, not an attribute.
+ *
+ * Rather than emit one nonced script per stylesheet, `<AsyncStylesheet>`
+ * (../components/AsyncStylesheet.astro) tags its `<link rel="preload">` with
+ * `data-async-css`, and Layout.astro renders `ASYNC_CSS_SWAP_JS` ONCE per page
+ * — it flips every matching link's `rel` to `stylesheet` no matter how many
+ * `<AsyncStylesheet>` instances rendered. A `<noscript>` fallback covers
+ * no-JS. fb-1789228922973-oidvf5.
+ */
+export const ASYNC_CSS_ATTR = "data-async-css";
+
+export const ASYNC_CSS_SWAP_JS = `(function () {
+  var links = document.querySelectorAll('link[rel="preload"][as="style"][${ASYNC_CSS_ATTR}]');
+  for (var i = 0; i < links.length; i++) links[i].rel = 'stylesheet';
+})();`;

package/apps/storefront/src/lib/auth/loginGate.ts

@@ -19,14 +19,6 @@ import type { SessionRecord } from "./session.js";
 
 export type GateMode = "password" | "login";
 
-/**
- * The platform's own "self" home tenant (tenants.ts `HOME_TENANT`, registry
- * default). It is NEVER login-gated — `storefront.tokenoftrust.store` renders its
- * public home so people can browse + sign up. Every OTHER tenant on a gated host
- * (path-prefix or per-tenant subdomain) is gated behind sign-in.
- */
-export const PUBLIC_HOME_TENANT_ID = "home";
-
 /**
  * The record fields the host-admission + host-capability checks read. All optional
  * — these readers tolerate a partial record and are deny-closed on absence.
@@ -139,9 +131,27 @@ export function isAuthPath(pathname: string): boolean {
  * unauthenticated `tot` install (src/pages/api/cli/policy.ts). Kept exact (not a
  * broad `/api/cli/` prefix) so a future authed CLI endpoint isn't accidentally
  * exposed.
+ *
+ * `/api/preview/version` is the shared preview's on-publish refresh SIGNAL
+ * (src/pages/api/preview/version.ts): a read-only per-tenant edge cache-version
+ * integer, no-store and noindex, carrying nothing a viewer of the preview cannot
+ * already see. It must be exempt HERE rather than by relaxing
+ * {@link isBypassPrivilegedPath}, which excludes every `/api/` route from the
+ * preview-token and QA bypasses on purpose — that exclusion is the security
+ * boundary and stays intact.
+ *
+ * Matched in BOTH addressing forms, because the injected reload client fetches it
+ * under the page's basePath: a path-routed preview sends `/<tenant>/api/preview/
+ * version`, so a bare-only match leaves the gate answering the "Coming soon"
+ * holding page with a 200. The client reads `(await res.json()).version` inside a
+ * catch that treats every failure as transient, so an HTML body there is swallowed
+ * silently and the reload can never fire while the tab polls once a second forever.
  */
 export function isPublicPath(pathname: string): boolean {
-  return pathname === "/api/cli/policy";
+  if (pathname === "/api/cli/policy") return true;
+  if (pathname === "/api/preview/version") return true;
+  if (/^\/[^/]+\/api\/preview\/version$/.test(pathname)) return true;
+  return false;
 }
 
 /**
@@ -277,8 +287,9 @@ export interface LoginGateInput {
   /** True when a valid, resource-bound session was resolved for this request. */
   hasValidSession: boolean;
   /**
-   * True when the resolved tenant is the platform's own public home (self) —
-   * exempt from the gate so it renders publicly. See {@link PUBLIC_HOME_TENANT_ID}.
+   * True when the resolved tenant declares itself publicly accessible, exempting
+   * it from the gate so it renders to anyone. Sourced from the tenant's own
+   * `access.public` declaration via `tenantRendersPublicly` — never a tenant id.
    */
   tenantExempt?: boolean;
   /**

package/apps/storefront/src/lib/basePath.ts

@@ -13,20 +13,53 @@
  *
  * It is idempotent and conservative: only root-absolute single-slash paths are
  * prefixed. Protocol-relative URLs ("//cdn…"), absolute URLs ("https://…"),
- * fragments/queries ("#x", "?x"), and already-prefixed paths pass through. The
- * GLOBAL static-asset namespaces are also left untouched — they are served at root
- * under both routing modes and must NOT carry a tenant prefix:
- *   - `/tenants/…` — per-tenant static assets (logo, favicon, theme/mkt css);
- *   - `/shared/…`  — platform-shipped shared assets (shared commerce-chrome css).
- * This mirrors both `prefixTenantLinks` (lib/rawMarketingHtml.ts) and the
- * defense-in-depth client script in Layout.astro.
+ * fragments/queries ("#x", "?x"), already-prefixed paths, and every
+ * {@link ROOT_SERVED_HREF_NAMESPACES} path pass through.
  */
+
+/**
+ * Root-served namespaces that a tenant prefix must never be applied to.
+ *
+ * These are served at the ORIGIN ROOT under both routing modes: host-routed, the
+ * platform's static handler answers them before the Worker; path-routed, the same
+ * bytes still live at the root. A prefixed `/<tenant>/favicon.svg` is not a static
+ * asset, so it costs a redirect at best.
+ *
+ * `tenants` is per-tenant static assets (already tenant-scoped in the path, so a
+ * second prefix would double it). The rest mirror `PLATFORM_STATIC_ASSET_PREFIXES`
+ * in `src/middleware/routeBranch.ts` — the serving-side authority for the same set.
+ * They are restated here rather than imported because this module ships to the
+ * browser and in the published runner tree, which is assembled from a COPY LIST
+ * rather than a dependency graph. `rawMarketingHtml.test.ts` asserts this list
+ * covers that one, so the two cannot drift apart unnoticed.
+ *
+ * Consumers: {@link withBase} (and through it {@link bindBasePathAnchors}) and
+ * `prefixTenantLinks` (lib/rawMarketingHtml.ts).
+ */
+export const ROOT_SERVED_HREF_NAMESPACES = [
+  "_a",
+  "_astro",
+  "apps",
+  "assets",
+  "brand",
+  "favicon.svg",
+  "js",
+  "platform",
+  "shared",
+  "tenants",
+] as const;
+
+/** True when root-absolute `href` names a {@link ROOT_SERVED_HREF_NAMESPACES} path. */
+export function isRootServedHref(href: string): boolean {
+  const path = href.slice(1).split(/[?#]/, 1)[0] ?? "";
+  return ROOT_SERVED_HREF_NAMESPACES.some((ns) => path === ns || path.startsWith(`${ns}/`));
+}
+
 export function withBase(basePath: string, href: string): string {
   if (!basePath || !href) return href;
   // Only same-origin root-absolute paths; skip protocol-relative "//".
   if (href.charAt(0) !== "/" || href.charAt(1) === "/") return href;
-  // Global asset namespaces are root-served under every tenant; never prefix them.
-  if (href.startsWith("/tenants/") || href.startsWith("/shared/")) return href;
+  if (isRootServedHref(href)) return href;
   // Already inside the prefix.
   if (href === basePath || href.startsWith(`${basePath}/`)) return href;
   return `${basePath}${href}`;
@@ -46,3 +79,31 @@ export function clientBasePath(): string {
 export function withClientBase(href: string): string {
   return withBase(clientBasePath(), href);
 }
+
+/**
+ * Keep same-origin root-absolute anchors inside the tenant prefix, so navigation on a
+ * path-routed page stays on the tenant. Covers anchors in raw tenant HTML and chrome,
+ * which never pass through {@link withBase}. A no-op when host-routed.
+ */
+export function bindBasePathAnchors(doc: Document = document): void {
+  const base = doc.documentElement.dataset.basePath ?? "";
+  if (!base) return;
+  const fix = (a: Element) => {
+    const href = a.getAttribute("href");
+    if (!href) return;
+    const next = withBase(base, href);
+    if (next !== href) a.setAttribute("href", next);
+  };
+  const fixAll = () => doc.querySelectorAll('a[href^="/"]').forEach(fix);
+  if (doc.readyState === "loading") doc.addEventListener("DOMContentLoaded", fixAll);
+  else fixAll();
+  // Late/island-rendered anchors: fix just-in-time before navigation.
+  doc.addEventListener(
+    "pointerdown",
+    (e) => {
+      const a = e.target instanceof Element ? e.target.closest('a[href^="/"]') : null;
+      if (a) fix(a);
+    },
+    true,
+  );
+}

package/apps/storefront/src/lib/chrome/managedCart.ts

@@ -0,0 +1,50 @@
+import type { ResolvedManagedCheckout } from "@tot/public-runtime";
+
+/** The managed checkout is the sole cart destination when it is available. */
+export function managedCartHref(
+  commerce: ResolvedManagedCheckout | null | undefined,
+): string | undefined {
+  return commerce?.cartUrl;
+}
+
+const ANCHOR_RE = /<a\b[^>]*>[\s\S]*?<\/a>/gi;
+
+function isCartAnchor(anchor: string): boolean {
+  const openingTag = anchor.slice(0, anchor.indexOf(">") + 1);
+  const classValue = openingTag.match(/\bclass=(?:"([^"]*)"|'([^']*)')/i);
+  const classes = (classValue?.[1] ?? classValue?.[2] ?? "").split(/\s+/);
+  const ariaLabel = openingTag.match(/\baria-label=(?:"([^"]*)"|'([^']*)')/i);
+  const label = ariaLabel?.[1] ?? ariaLabel?.[2] ?? "";
+  return classes.includes("cart") || /^Cart(?:\b|,)/i.test(label);
+}
+
+function escapeAttribute(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+/**
+ * Bind raw/shared chrome cart affordances to the same request-scoped checkout
+ * destination used by product forms. If checkout is unavailable, remove the
+ * affordance instead of sending shoppers to the storefront's nonexistent
+ * `/cart` page. Works on rendered HTML, so generated and tenant-authored shared
+ * chrome follow the same rule without tenant-specific branches.
+ */
+export function bindManagedCartAnchors(
+  html: string,
+  commerce: ResolvedManagedCheckout | null | undefined,
+): string {
+  const href = managedCartHref(commerce);
+  return html.replace(ANCHOR_RE, (anchor) => {
+    if (!isCartAnchor(anchor)) return anchor;
+    if (!href) return "";
+    const escaped = escapeAttribute(href);
+    if (/\bhref=(?:"[^"]*"|'[^']*')/i.test(anchor)) {
+      return anchor.replace(/\bhref=(?:"[^"]*"|'[^']*')/i, `href="${escaped}"`);
+    }
+    return anchor.replace(/^<a\b/i, `<a href="${escaped}"`);
+  });
+}

package/apps/storefront/src/lib/chrome/model.ts

@@ -26,6 +26,10 @@ export {
   type ChromeUtilityNav,
   type ChromeAnnouncement,
   type ChromeAgeGate,
+  CHROME_AGE_GATE_VARIANTS,
+  type ChromeAgeGateVariant,
+  deriveAgeGateStorageKey,
+  resolveAgeGateCopy,
   type ChromeFooterBrand,
   type ChromeTrustMark,
   type ChromeHead,

package/apps/storefront/src/lib/chrome/newsletterAgeAttestation.ts

@@ -0,0 +1,9 @@
+export const NEWSLETTER_AGE_ATTESTATION = Object.freeze({
+  name: "age_attestation",
+  value: "21plus",
+  label: "I confirm I am 21 years of age or older and agree to receive marketing emails.",
+});
+
+export function resolveNewsletterAgeAttestation(enabled: boolean | undefined) {
+  return enabled ? NEWSLETTER_AGE_ATTESTATION : undefined;
+}