@tokenoftrust/storefront-runner 2.0.41 → 2.0.42

package/packages/public-runtime/src/static-bundle.ts

@@ -42,6 +42,7 @@
  */
 import { assetContentType } from "./tenant-assets.js";
 import { formatHtmlCacheControl } from "./html-cache-policy.js";
+import { NATIVE_GA4_SANDBOX_ASSET_PATH } from "./integration/native-ga4-sandbox-asset.mjs";
 
 // ---------------------------------------------------------------------------
 // R2 seam — same structural subset tenant-assets.ts uses (no workers-types dep)
@@ -167,6 +168,24 @@ export interface StaticBundleManifest {
   htmlCacheControl?: string;
   /** T6 classification: relPath -> {hash, kind}. Absent on a pre-T6 manifest — every lookup then falls back to the old versions/<digest>/<rel> key (see `resolveStaticBundleObjectKey`). */
   files?: Record<string, StaticBundleFileEntry>;
+  /** Exact, version-bound whole-site redirects materialized from content/redirects.json. */
+  redirects?: Array<{ from: string; to: string }>;
+}
+
+function isManifestRedirectPath(value: string): boolean {
+  return value.startsWith("/") && !value.startsWith("//") &&
+    !value.includes("\\") && !value.includes("?") && !value.includes("#") &&
+    !value.split("/").includes("..");
+}
+
+function isManifestRedirectDestination(value: string): boolean {
+  if (isManifestRedirectPath(value)) return true;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
 }
 
 function parseManifest(raw: string): StaticBundleManifest | null {
@@ -193,8 +212,20 @@ function parseManifest(raw: string): StaticBundleManifest | null {
         }
       }
     }
+    let redirects: StaticBundleManifest["redirects"];
+    if (m.redirects !== undefined) {
+      if (!Array.isArray(m.redirects)) return null;
+      redirects = [];
+      for (const value of m.redirects) {
+        const redirect = value as { from?: unknown; to?: unknown };
+        if (!redirect || typeof redirect.from !== "string" || typeof redirect.to !== "string" ||
+            !isManifestRedirectPath(redirect.from) ||
+            !isManifestRedirectDestination(redirect.to)) return null;
+        redirects.push({ from: redirect.from, to: redirect.to });
+      }
+    }
     const htmlCacheControl = typeof m.htmlCacheControl === "string" ? m.htmlCacheControl : undefined;
-    return { treeDigest: m.treeDigest, pinnedNonce: m.pinnedNonce, csp, htmlCacheControl, files };
+    return { treeDigest: m.treeDigest, pinnedNonce: m.pinnedNonce, csp, htmlCacheControl, files, redirects };
   } catch {
     return null;
   }
@@ -260,8 +291,82 @@ function failClosed(deps: ServeStaticBundleDeps, detail: string): Response {
   });
 }
 
-/** Cache-Control for an `asset`-kind file — the pool key IS the content hash, so caching forever is always correct (epic §A). */
-const ASSET_CACHE_CONTROL = "public, max-age=31536000, immutable";
+/** Cache-Control for a content-addressed or hash-named object — its URL can never name different bytes. */
+const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+
+/**
+ * Cache-Control for an asset served at its STABLE path (`/shared/x.css`, `/brand/logo.png`). A
+ * republish can put different bytes at the same path, so it revalidates — the same tier the S3
+ * plane stamps (`s3-publish.mjs` `CACHE_CONTROL.ASSET`). Pages fetch their sub-resources by
+ * content address; the stable path serves links, crawlers and runtime-computed URLs.
+ */
+const STABLE_ASSET_CACHE_CONTROL = "public, max-age=86400, stale-while-revalidate=604800";
+
+/** Bundle prefixes whose stable paths are still immutable: hash-named build output and path-versioned platform code. */
+const IMMUTABLE_STABLE_PREFIXES = ["_astro/", "platform/"];
+
+/**
+ * URL prefix of a content-addressed asset (`/_a/<sha256><ext>`) — kept in lockstep with
+ * `scripts/publish/lib/asset-pool.mjs` `PINNED_ASSET_PREFIX` and the CloudFront function
+ * (`live-pointer-rewrite.mjs` `versionIndependentAssetUri`).
+ */
+export const PINNED_ASSET_URL_PREFIX = "/_a/";
+
+/** URL prefix of hash-named build output, served from the version-independent named store. */
+export const HASH_NAMED_URL_PREFIX = "/_astro/";
+
+/** R2 key of a hash-named file in the named store (`asset-pool.mjs` `namedStoreKey`). */
+export function staticBundleNamedStoreKey(rel: string): string {
+  return `assets/${rel}`;
+}
+
+/**
+ * The R2 key a version-independent asset URL names, or null for any other path. These URLs
+ * resolve WITHOUT the live pointer (ADR 0013, "Sub-resources are version-independent"): a page
+ * from an older version keeps fetching its own bytes after the pointer moves.
+ *   `/_a/<sha256><ext>` → `assets/<sha256><ext>`   (the content-addressed pool)
+ *   `/_astro/<name>`    → `assets/_astro/<name>`   (the named store)
+ */
+export function versionIndependentAssetKey(pathname: string): string | null {
+  if (/^\/_a\/[0-9a-f]{64}(\.[A-Za-z0-9]+)?$/.test(pathname)) return `assets/${pathname.slice(4)}`;
+  if (/^\/_astro(\/[A-Za-z0-9._@-]+)+$/.test(pathname) && !pathname.includes("/.")) {
+    return staticBundleNamedStoreKey(pathname.slice(1));
+  }
+  return null;
+}
+
+/**
+ * Serve a version-independent asset straight from R2, or return null when `pathname` is not one
+ * (or, for `/_astro/`, when the named store does not hold it — the Worker's own build also serves
+ * that prefix, so a miss belongs to the caller). A missing `/_a/` object is a 404: the address is
+ * exact, so there is nothing else it could mean.
+ */
+export async function serveVersionIndependentAsset(
+  bucket: StaticBundleR2BucketLike,
+  pathname: string,
+  method = "GET",
+): Promise<Response | null> {
+  const key = versionIndependentAssetKey(pathname);
+  if (!key) return null;
+  const object = await bucket.get(key);
+  if (!object) {
+    if (pathname.startsWith(HASH_NAMED_URL_PREFIX)) return null;
+    return new Response("Not found", {
+      status: 404,
+      headers: { "cache-control": "no-store", "x-tot-static-bundle": "pinned-miss" },
+    });
+  }
+  const headers: Record<string, string> = {
+    "content-type": assetContentType(key),
+    "cache-control": IMMUTABLE_CACHE_CONTROL,
+    "x-tot-static-bundle": "pinned",
+  };
+  if (typeof object.size === "number") headers["content-length"] = String(object.size);
+  const body: BodyInit | null = method.toUpperCase() === "HEAD"
+    ? null
+    : object.body ?? (await object.arrayBuffer());
+  return new Response(body, { status: 200, headers });
+}
 
 /**
  * Serve `pathname` from the digest-addressed static bundle in R2.
@@ -292,15 +397,20 @@ const ASSET_CACHE_CONTROL = "public, max-age=31536000, immutable";
  * manifest's file `kind` (long-lived immutable for the shared `asset` pool —
  * safe because the key itself is the content hash; short/revalidating for a
  * `route` doc, rendered fresh per version at a STABLE, non-digest url) and,
- * for an HTML response, the bundle's PINNED CSP header read back from the
- * same manifest read — never the Worker's per-request nonce middleware, per
- * the ADR's CSP-consequences note.
+ * for a tenant HTML response, the bundle's PINNED CSP header read back from
+ * the same manifest read — never the Worker's per-request nonce middleware,
+ * per the ADR's CSP-consequences note. The platform-owned GA4 sandbox is the
+ * exact-path exception because its generated document owns a hash-pinned meta CSP.
  */
 export async function serveStaticBundle(
   deps: ServeStaticBundleDeps,
   pathname: string,
+  search = "",
+  method = "GET",
 ): Promise<Response | null> {
   const { bucket, digest } = deps;
+  const pinned = await serveVersionIndependentAsset(bucket, pathname, method);
+  if (pinned) return pinned;
   if (!digest) {
     return failClosed(deps, "pointer-serving tenant has no resolved live digest");
   }
@@ -315,6 +425,18 @@ export async function serveStaticBundle(
     return failClosed(deps, `missing/unreadable manifest for digest ${digest}`);
   }
 
+  const redirectPath = pathname === "/" || pathname.split("/").pop()?.includes(".")
+    ? pathname
+    : pathname.endsWith("/") ? pathname : `${pathname}/`;
+  const redirect = manifest.redirects?.find(({ from }) => from === pathname || from === redirectPath);
+  if (redirect) {
+    const query = redirect.to.startsWith("/") ? search : "";
+    return new Response(null, {
+      status: 308,
+      headers: { location: `${redirect.to}${query}`, "cache-control": "public, max-age=300" },
+    });
+  }
+
   const entry = manifest.files?.[rel];
   if (manifest.files && !entry) {
     // Provably not in this bundle's static surface — an app surface (/admin,
@@ -333,38 +455,35 @@ export async function serveStaticBundle(
   // shared DEFAULT_HTML_CACHE_POLICY string — the SAME source the S3 plane reads, so
   // both planes emit a byte-identical header.
   const routeCacheControl = manifest.htmlCacheControl ?? formatHtmlCacheControl();
-  // Cache tier: use the manifest's `kind` classification when present.
-  // A manifest with no `files` at all falls back to the ORIGINAL
-  // isHtml-based heuristic — every non-html path used to be treated as a
-  // long-cacheable asset, which this preserves exactly for an old bundle
-  // this Worker version might still encounter mid-rollout.
-  const cacheControl = entry
-    ? entry.kind === "asset"
-      ? ASSET_CACHE_CONTROL
-      : routeCacheControl
-    : isHtml
-      ? routeCacheControl
-      : ASSET_CACHE_CONTROL;
+  // Cache tier: route documents take the tenant's policy; an asset at its stable path
+  // revalidates unless its path itself is immutable (hash-named or path-versioned).
+  const cacheControl = isHtml || entry?.kind === "route"
+    ? routeCacheControl
+    : IMMUTABLE_STABLE_PREFIXES.some((prefix) => rel.startsWith(prefix))
+      ? IMMUTABLE_CACHE_CONTROL
+      : STABLE_ASSET_CACHE_CONTROL;
   const headers: Record<string, string> = {
     "content-type": assetContentType(rel),
-    // Cache-key-by-digest lives in the caller's edge-cache layer for `route`
-    // keys (versions/<digest>/<rel> is digest-scoped — a pointer flip is a
-    // clean cache miss on the NEW digest's keys, never a stale serve of the
-    // old one); `asset` keys are ADDITIONALLY digest-independent (content-
-    // addressed by hash), so they're safe to cache forever downstream too.
-    // This header governs downstream/browser caching of the STABLE URL:
+    // Cache-key-by-digest lives in the caller's edge-cache layer (a pointer flip
+    // is a clean miss on the NEW digest's keys). This header governs downstream/
+    // browser caching of the STABLE URL:
     "cache-control": cacheControl,
     "x-tot-static-bundle": "hit",
     "x-tot-static-bundle-digest": digest,
   };
 
-  if (isHtml && manifest.csp) {
+  // The reviewed GA4 transport frame is a platform-owned security boundary with
+  // its own generated, hash-pinned meta CSP. Applying the tenant page CSP as a
+  // second policy would intersect the two and block the reviewed gtag.js origin.
+  if (isHtml && rel !== NATIVE_GA4_SANDBOX_ASSET_PATH && manifest.csp) {
     headers[manifest.csp.headerName] = manifest.csp.value;
   }
 
   if (typeof object.size === "number") {
     headers["content-length"] = String(object.size);
   }
-  const body: BodyInit = object.body ?? (await object.arrayBuffer());
+  const body: BodyInit | null = method.toUpperCase() === "HEAD"
+    ? null
+    : object.body ?? (await object.arrayBuffer());
   return new Response(body, { status: 200, headers });
 }

package/packages/public-runtime/src/tenant-embed-defaults.d.mts

@@ -0,0 +1,3 @@
+/** Types for the dependency-free tenant embed-defaults data module (tenant-embed-defaults.mjs). */
+export const TENANT_EMBED_DEFAULTS: Readonly<Record<string, readonly string[]>>;
+export function tenantEmbedDefaults(tenantId: string): string[];

package/packages/public-runtime/src/tenant-embed-defaults.mjs

@@ -0,0 +1,40 @@
+/**
+ * Build-time embed opt-in defaults, keyed by tenant id.
+ *
+ * Plain JS ON PURPOSE — the same reason as embed-catalog.mjs: this data is read
+ * both by TypeScript (`tenants.ts`, which spreads it into each TenantConfig) AND
+ * by plain-`node` tooling that cannot import TS. The static-publish pipeline
+ * (scripts/publish/lib/tenant-csp-profile.mjs) builds a CloudFront CSP off the
+ * tenant's opted-in embeds, and a CloudFront policy is applied by a dependency-light
+ * script with no TS toolchain. Keeping the declaration HERE gives both readers ONE
+ * copy: `tenants.ts` is the only consumer that turns it into a TenantConfig field,
+ * and no second constant exists to drift from it.
+ *
+ * This is the PLATFORM default only. A tenant's effective opt-in is this unioned
+ * with the tenant's own published `embeds.json` and filtered to the vetted catalog
+ * — see `resolveEffectiveEmbeds` (csp.ts), which every reader goes through. A
+ * registered tenant self-serves entirely through `embeds.json` and needs no entry
+ * here; an entry exists only for a tenant whose opt-in predates (or is independent
+ * of) its own content repo.
+ *
+ * Slugs must exist in EMBED_PROVIDERS — the platform owns each provider's exact
+ * origins, so a tenant lists a slug and never a raw host. An unknown slug is
+ * dropped by `resolveEffectiveEmbeds` (fail-safe) and flagged by the embeds lint.
+ *
+ * @type {Readonly<Record<string, readonly string[]>>}
+ */
+export const TENANT_EMBED_DEFAULTS = {
+  // The corporate site's /contact/contact-sales/ page embeds a Pipedrive Web Form.
+  "tokenoftrust.com": ["pipedrive"],
+};
+
+/**
+ * This tenant's build-time embed defaults, or `[]` when it declares none. Always
+ * returns a fresh array so a caller can't mutate the shared declaration.
+ *
+ * @param {string} tenantId
+ * @returns {string[]}
+ */
+export function tenantEmbedDefaults(tenantId) {
+  return [...(TENANT_EMBED_DEFAULTS[tenantId] ?? [])];
+}

package/packages/public-runtime/src/tenant.ts

@@ -83,6 +83,20 @@ export interface ThemeColorTokens {
   "field-border"?: string;
   /** Review/rating star fill (trust/UGC surfaces). Default: `accent`. */
   star?: string;
+
+  // --- Conversion-role aliases. These name the JOB a color does on a
+  //     conversion surface rather than its place in the palette, so a tenant can
+  //     move the buy button without dragging nav chrome, headings and
+  //     ::selection (all of which read `primary`) along with it. ---
+  /** Primary call-to-action fill (buy button, hero CTA). Default: `primary`. */
+  cta?: string;
+  /** Hover/active shade of `cta`. Default: `primary-hover`. */
+  "cta-hover"?: string;
+  /** Readable text/icon color ON `cta`. Default: `primary-contrast`. */
+  "cta-contrast"?: string;
+  /** Trust / reassurance accent — guarantee callouts, security and compliance
+   *  badges, proof strips. Default: `success`. */
+  trust?: string;
 }
 
 export interface ThemeFontFamily {
@@ -140,8 +154,12 @@ export interface ThemeBrandTokens {
    * background with the brand color used only as an accent on the headline/CTA —
    * matches merchants whose own site is a light page with color accents. The
    * brand adopter sets "light" when it captures a real hero image.
+   *
+   * "banner" renders a merchant-supplied wide hero asset edge-to-edge. It is
+   * intended for visual-parity migrations where the source artwork already
+   * contains the campaign copy and CTA treatment.
    */
-  heroVariant?: "bold" | "light";
+  heroVariant?: "bold" | "light" | "banner";
 }
 
 export interface ThemeTokens {
@@ -388,6 +406,17 @@ export function siteTypeDefaults(siteType: SiteType): TenantFeatures {
   return { ...(siteType === "marketing" ? MARKETING_FEATURES : COMMERCE_FEATURES) };
 }
 
+/**
+ * Does this tenant render publicly on a login-gated host? Deny-closed: only an
+ * explicit `access.public` declaration exempts a tenant from the gate, so an
+ * undeclared tenant stays behind sign-in.
+ */
+export function tenantRendersPublicly(
+  tenant: Pick<TenantConfig, "access">,
+): boolean {
+  return tenant.access?.public === true;
+}
+
 /**
  * Resolve a tenant's effective features: siteType defaults, with any explicit
  * `features` overrides layered on top (undefined entries ignored, so a tenant
@@ -434,6 +463,35 @@ export interface TenantConfig {
   siteType?: SiteType;
   /** Explicit feature overrides layered atop the siteType defaults. */
   features?: Partial<TenantFeatures>;
+  /**
+   * Public-access declaration read by the login gate. A tenant on a gated host
+   * (`DEMO_GATE_HOSTS`) is withheld behind sign-in unless it declares itself
+   * public here. Omitted == gated, so a new tenant is private by default and
+   * going public is an explicit, reviewable line in the tenant's config —
+   * never a tenant id the gate recognizes.
+   */
+  access?: {
+    /**
+     * Render publicly on a gated host: no Coming-Soon interstitial and no
+     * sign-in requirement, so anyone can browse and sign up.
+     */
+    public?: boolean;
+  };
+  /**
+   * This tenant's host ALSO dispatches other tenants under a `/<domain>/*` path
+   * prefix, while still serving its own content at the root. Declared by the
+   * platform's shared preview host, which is reached as `<host>/<tenant-domain>/…`
+   * by the dev loop, the admin preview links and the post-deploy chrome canary.
+   *
+   * Routing is otherwise host-first: a host owning a tenant serves only that
+   * tenant, so `/<domain>/*` is an ordinary path on its own site. That default is
+   * load-bearing — without it any merchant's hostname could serve a different
+   * tenant's storefront under a path — so this stays opt-in and platform-declared
+   * (ADR 0035), never inferred and never a tenant's to set.
+   *
+   * Omitted == the host serves only its own tenant.
+   */
+  pathPrefixTenants?: boolean;
   /**
    * Third-party embeds this tenant is allowed to render, as provider slugs from
    * the platform's `EMBED_PROVIDERS` catalog (e.g. `["pipedrive"]`) — NOT raw

package/pnpm-lock.runner.yaml

@@ -7,6 +7,10 @@ settings:
 importers:
 
   .:
+    dependencies:
+      sharp:
+        specifier: ^0.34.5
+        version: 0.34.5
     devDependencies:
       typescript:
         specifier: ^5.6.3
@@ -20,6 +24,9 @@ importers:
       '@astrojs/preact':
         specifier: ^6.0.0
         version: 6.0.0(@babel/core@7.29.7)(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(preact@10.29.2)(rollup@4.62.2)(tsx@4.22.4)(yaml@2.9.0)
+      '@fontsource/anuphan':
+        specifier: 5.3.0
+        version: 5.3.0
       '@fontsource/inter':
         specifier: 5.3.0
         version: 5.3.0
@@ -1109,6 +1116,9 @@ packages:
   '@floating-ui/utils@0.2.11':
     resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
 
+  '@fontsource/anuphan@5.3.0':
+    resolution: {integrity: sha512-1vWJrY2shVTVE4Bv1BheXKQKWI4DxNSWF64++zt7wbRuYef8QV1tJItvHHxN6+1fknwanIM8RKsXiR0RuHPlhA==}
+
   '@fontsource/inter@5.3.0':
     resolution: {integrity: sha512-RofMylZmjlJEfELXeNHFWBRcSs75rGU/6bV2S2jfnvv/3rPXPGe0LgUJTklcHZ9lM4OZmAVFhcJPnACfb91A3g==}
 
@@ -4524,6 +4534,8 @@ snapshots:
 
   '@floating-ui/utils@0.2.11': {}
 
+  '@fontsource/anuphan@5.3.0': {}
+
   '@fontsource/inter@5.3.0': {}
 
   '@fontsource/jetbrains-mono@5.3.0': {}

package/pnpm-workspace.yaml

@@ -6,3 +6,7 @@ onlyBuiltDependencies:
   - esbuild
   - sharp
   - workerd
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true

package/scripts/dev/git-status.mjs

@@ -85,7 +85,7 @@ export function classify(statusMap, relPathPosix) {
  */
 export function fileStatus(gitCwd, relPath) {
   const posix = relPath.split(sep).join("/");
-  const res = git(gitCwd, ["status", "--porcelain", "--", posix]);
+  const res = git(gitCwd, ["status", "--porcelain", "--untracked-files=all", "--", posix]);
   if (!res.ok) return "unknown";
   const line = res.stdout.split("\n").find((l) => l.length >= 2);
   if (!line) return "unchanged";

package/scripts/dev/publish.mjs

@@ -117,6 +117,12 @@ export async function publishFile(env, sourceRoot, tenantId, relPath, deps = {})
   const changeId = deriveChangeId(tenantId, session.email || session.token);
 
   try {
+    // Bind the active tenant before the candidate call, the same way `tot submit` does.
+    // candidate_open confines the target repo to the tenants the session holds, so an
+    // unbound session refuses with a cross-tenant error that reads as a permission
+    // problem rather than a missing bind. An invited developer's session already holds
+    // this tenant, so this is the explicit form of a precondition we were relying on.
+    await client.callTool("client_switch", { tenant: tenantId });
     const result = await client.callTool("candidate_open", {
       repo,
       changeId,

package/scripts/lib/tenant-asset-copy.mjs

@@ -57,13 +57,15 @@ export function copyTreeSkippingUnreadable(from, to, deps) {
       const childRel = rel ? join(rel, entry.name) : entry.name;
       const childSrc = join(src, entry.name);
       const childDst = join(dst, entry.name);
+      if (entry.isSymbolicLink()) {
+        skipped.push({ path: childRel, reason: "SYMLINK" });
+        continue;
+      }
       if (entry.isDirectory()) {
         walk(childSrc, childDst, childRel);
         continue;
       }
       try {
-        // copyFile follows symlinks, so a DANGLING link throws here and is skipped —
-        // which is the common shape of "referenced but missing".
         copyFile(childSrc, childDst);
         copied++;
       } catch (err) {

package/scripts/tenant/materialize-tenant-content.mjs

@@ -133,6 +133,7 @@ export function resolveTargetPath(root, tenant, repoPath) {
 function canonicalMappings(tenant) {
   return [
     { workspace: "theme.json", repo: `tenants/${tenant}/theme.json`, kind: "file" },
+    { workspace: "analytics.json", repo: `tenants/${tenant}/analytics.json`, kind: "file" },
     { workspace: "content/", repo: `tenants/${tenant}/content/`, kind: "tree" },
     { workspace: "public/", repo: `tenants/${tenant}/public/`, kind: "tree" },
   ];