@tokenoftrust/storefront-runner 2.0.41 → 2.0.43

package/packages/public-runtime/src/integration/render-phases.ts

@@ -159,6 +159,7 @@ export function renderIntegrationPhases(
   assertRenderablePlan(plan);
 
   const head =
+    integrationEntryPreloadLinks(plan) +
     phaseBoundary("platform.environment") +
     renderBrowserEnvironmentScript(plan.environment, nonce) +
     phaseBoundary("consent.defaults") +
@@ -197,6 +198,31 @@ export function renderIntegrationPhases(
  * under the raw mount, which stamps nonces onto the tenant's own inline tags BEFORE
  * splicing engine bytes.
  */
+/**
+ * `modulepreload` hints for every declared integration's own same-origin entry
+ * asset (e.g. `/platform/google-measurement/v2/entry.mjs`,
+ * `/platform/amplitude-http/v1/entry.mjs`) — never a vendor/third-party URL, since
+ * `entry.url` is always the plan's own resolved, same-origin, exact-version asset.
+ *
+ * This is a pure network-timing hint: it lets the browser start fetching an
+ * integration's entry module WHILE the document.deferred lifecycle host
+ * (`boot.mjs`) is still being fetched/parsed, instead of only starting that fetch
+ * after the host finishes executing its sequential per-integration load loop. It
+ * changes nothing about WHEN or WHETHER an integration actually initializes: the
+ * consent gate and the lifecycle runtime's own dynamic `import()` are unchanged,
+ * so a preloaded-but-consent-gated module still never runs, and a preload can
+ * only ever fetch bytes this document would fetch anyway once eligible.
+ */
+function integrationEntryPreloadLinks(plan: EffectivePlan): string {
+  const urls = new Set<string>();
+  for (const integration of plan.integrations) {
+    if (integration.entry.format === "module") urls.add(integration.entry.url);
+  }
+  let out = "";
+  for (const url of urls) out += `<link rel="modulepreload" href="${url}">`;
+  return out;
+}
+
 function lifecycleHostScript(): string {
   return `<script type="module" src="${LIFECYCLE_HOST_ASSET_URL}"></script>`;
 }
@@ -208,12 +234,12 @@ function inlineScript(source: string, nonce: string): string {
 
 /** Renderer-owned, provider-neutral viewer control: identical in both document mounts. */
 function viewerAnalyticsConsentStyle(nonce: string): string {
-  const style = `.tot-analytics-consent{position:fixed;z-index:900;right:1rem;bottom:1rem;display:flex;max-width:min(30rem,calc(100vw - 2rem));align-items:center;gap:.65rem;padding:.7rem .8rem;border:1px solid var(--color-border,#cbd5e1);border-radius:.75rem;background:var(--color-bg,#fff);color:var(--color-text,#111827);box-shadow:0 8px 30px rgba(15,23,42,.18);font:500 .75rem/1.25 system-ui,sans-serif}.tot-analytics-consent__copy{display:grid;gap:.15rem;min-width:8rem}.tot-analytics-consent__detail{color:var(--color-muted,#475569);font-size:.68rem}.tot-analytics-consent__actions{display:flex;gap:.4rem}.tot-analytics-consent button{border:1px solid currentColor;border-radius:999px;background:transparent;color:inherit;padding:.4rem .65rem;font:inherit;cursor:pointer}.tot-analytics-consent button:disabled{cursor:default;opacity:.45}@media(max-width:34rem){.tot-analytics-consent{left:1rem;right:1rem;align-items:flex-start;flex-direction:column}.tot-analytics-consent__actions{width:100%}.tot-analytics-consent button{flex:1}}`;
+  const style = `.tot-analytics-consent{position:fixed;z-index:900;right:1rem;bottom:1rem;display:flex;max-width:min(30rem,calc(100vw - 2rem));align-items:center;gap:.65rem;padding:.7rem .8rem;border:1px solid var(--color-border,#cbd5e1);border-radius:.75rem;background:var(--color-bg,#fff);color:var(--color-text,#111827);box-shadow:0 8px 30px rgba(15,23,42,.18);font:500 .75rem/1.25 system-ui,sans-serif}.tot-analytics-consent__copy{display:grid;gap:.15rem;min-width:8rem}.tot-analytics-consent__detail{color:var(--color-muted,#475569);font-size:.68rem}.tot-analytics-consent__actions{display:flex;gap:.4rem}.tot-analytics-consent button{border:1px solid currentColor;border-radius:999px;background:transparent;color:inherit;padding:.4rem .65rem;font:inherit;cursor:pointer}.tot-analytics-consent button:disabled{cursor:default;opacity:.45}@media(max-width:34rem){.tot-analytics-consent{left:1rem;right:1rem;align-items:flex-start;flex-direction:column}.tot-analytics-consent__actions{width:100%}.tot-analytics-consent button{flex:1}}.tot-analytics-consent[hidden]{display:none}`;
   return `<style${nonce ? ` nonce="${nonce}"` : ""}>${style}</style>`;
 }
 
 function viewerAnalyticsConsentControl(): string {
-  return `<aside class="tot-analytics-consent" data-tot-analytics-consent-control aria-label="Analytics privacy settings">` +
+  return `<aside class="tot-analytics-consent" data-tot-analytics-consent-control aria-label="Analytics privacy settings" hidden>` +
     `<span class="tot-analytics-consent__copy"><strong data-tot-analytics-consent-status aria-live="polite">Analytics off</strong>` +
     `<span class="tot-analytics-consent__detail">Choose whether anonymous analytics may run.</span></span>` +
     `<span class="tot-analytics-consent__actions">` +

package/packages/public-runtime/src/publication-redirects.d.mts

@@ -0,0 +1,45 @@
+/** Types for the dependency-free redirect decision core (publication-redirects.mjs). */
+
+export const REDIRECT_STATUS: 308;
+export const EDGE_FUNCTION_CODE_LIMIT_BYTES: number;
+export const EDGE_FUNCTION_RESERVED_BYTES: number;
+export const REDIRECT_MAP_BUDGET_BYTES: number;
+export const COLLECTION_REDIRECTS_PATH: RegExp;
+export const SITE_REDIRECTS_PATH: "content/redirects.json";
+export const WHOLE_SITE_DELIVERY_CONTRACT: string;
+
+export interface DeclaredRedirect {
+  from: string;
+  to: string;
+  /** Which declaration produced it, named in any refusal. */
+  source: string;
+}
+
+export interface RedirectSet {
+  ok: boolean;
+  redirects: { from: string; to: string }[];
+  violations: string[];
+  bytes: number;
+  budget: number;
+}
+
+export function normalizeRedirectPath(raw: string): string | null;
+export function redirectsFromCollection(
+  collection: string,
+  rows: Record<string, unknown>,
+): DeclaredRedirect[];
+export function redirectsFromSiteMap(rows: Record<string, unknown>): DeclaredRedirect[];
+export function isRedirectDeclarationPath(path: string): boolean;
+export function declaredRedirectsFromContent(
+  entries: { path: string; json: unknown }[],
+): DeclaredRedirect[];
+export function redirectsFromAliases(
+  aliases: readonly { from?: string; behavior?: string; to?: string }[],
+  source?: string,
+): DeclaredRedirect[];
+export function buildRedirectSet(declared: DeclaredRedirect[], budget?: number): RedirectSet;
+export function serializeRedirectMap(redirects: { from: string; to: string }[]): string;
+export function aliasesFromRedirectSet(
+  set: RedirectSet,
+): { from: string; behavior: "redirect-308"; to: string }[];
+export function formatRedirectSetReport(set: RedirectSet): string;

package/packages/public-runtime/src/publication-redirects.mjs

@@ -0,0 +1,379 @@
+// @ts-check
+// The pure core that turns a tenant's DECLARED redirects into a substrate-neutral redirect set
+// the publish pipeline can emit.
+//
+// A tenant's public site is served CDN -> static object (ADR 0013), so a redirect cannot be a
+// request-time decision in the Worker: it must exist in the published artifact. Both substrates
+// express it the same way — a precomputed map consulted by the single permitted edge function —
+// so the set below is substrate-neutral and the adapters only serialize it.
+//
+// Redirects are DECLARED, never derived from a tenant id. Three declaration sources normalize into
+// the one `redirect-308` contract `PublicationSpaceAliasV1` already defines:
+//   - publication-space `routes.aliases` entries whose behavior is `redirect-308`;
+//   - a content collection's `redirects.json` (old slug -> new slug), which becomes
+//     `/<collection>/<old>/` -> `/<collection>/<new>/`;
+//   - the tenant-wide `content/redirects.json` (relative path -> relative path or an explicit
+//     HTTPS destination), for legacy URLs that belong to no single collection.
+// Adding a tenant is a declaration, not a code change.
+//
+// 308 rather than 301 throughout: both pass ranking signal, and 308 additionally preserves the
+// request method, so a redirected non-GET is not silently rewritten. The declared alias contract
+// already specifies 308; collection renames join it rather than introducing a second status.
+//
+// Fails closed. An ambiguous declaration (one `from`, two targets), a cycle, or a set that exceeds
+// the substrate's ceiling REFUSES rather than emitting a partial map — a redirect that silently
+// does not exist is the failure this mechanism exists to prevent.
+
+/** The status every materialized redirect carries. */
+export const REDIRECT_STATUS = 308;
+
+/**
+ * CloudFront Functions cap total code size at 10 KB, and the map is baked into the one
+ * viewer-request function the public path already carries. The emitter refuses above the budget
+ * left for it rather than shipping a function that cannot publish.
+ */
+export const EDGE_FUNCTION_CODE_LIMIT_BYTES = 10240;
+/** Bump only when the meaning of a whole-site delivery manifest changes without changing its values. */
+export const WHOLE_SITE_DELIVERY_CONTRACT = "whole-site-delivery-v1";
+/** Reserved for the function's own logic, so the map gets the rest. */
+export const EDGE_FUNCTION_RESERVED_BYTES = 2048;
+/** Bytes available to the serialized map. */
+export const REDIRECT_MAP_BUDGET_BYTES =
+  EDGE_FUNCTION_CODE_LIMIT_BYTES - EDGE_FUNCTION_RESERVED_BYTES;
+
+/** JSON is not quite JS: these are legal in a JSON string but terminate a line to a JS parser. */
+const LINE_SEPARATOR = "
";
+const PARAGRAPH_SEPARATOR = "
";
+
+/**
+ * @typedef {Object} DeclaredRedirect
+ * @property {string} from    root-absolute request path
+ * @property {string} to      root-absolute destination path
+ * @property {string} source  which declaration produced it, for the report
+ */
+
+/**
+ * @typedef {Object} RedirectSet
+ * @property {boolean} ok
+ * @property {{from: string, to: string}[]} redirects  normalized, deduped, chain-collapsed
+ * @property {string[]} violations  why it refused; empty when ok
+ * @property {number} bytes         serialized size of the map
+ * @property {number} budget        bytes available to the map
+ */
+
+/**
+ * Normalize a declared path to the form the edge function compares against: root-absolute, no
+ * query or fragment, with a trailing slash unless the last segment names a file.
+ * Returns null when the value cannot be a same-origin request path.
+ * @param {string} raw
+ * @returns {string | null}
+ */
+export function normalizeRedirectPath(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith("/")) return null;
+  // Protocol-relative (`//host/...`) would leave the origin.
+  if (trimmed.startsWith("//")) return null;
+  const withoutSuffix = trimmed.split("?")[0].split("#")[0];
+  if (withoutSuffix.includes("..")) return null;
+  const collapsed = withoutSuffix.replace(/\/{2,}/g, "/");
+  if (collapsed === "/") return "/";
+  // The last NON-EMPTY segment: a trailing slash otherwise hides the filename from this test.
+  const segments = collapsed.split("/").filter(Boolean);
+  const last = segments[segments.length - 1] ?? "";
+  const namesFile = last.includes(".");
+  if (namesFile) return collapsed.replace(/\/$/, "");
+  return collapsed.endsWith("/") ? collapsed : `${collapsed}/`;
+}
+
+/**
+ * Turn a content collection's `redirects.json` (old slug -> new slug) into declared redirects
+ * under that collection's route prefix.
+ * @param {string} collection  e.g. "blog"
+ * @param {Record<string, unknown>} rows
+ * @returns {DeclaredRedirect[]}
+ */
+export function redirectsFromCollection(collection, rows) {
+  if (!rows || typeof rows !== "object") return [];
+  /** @type {DeclaredRedirect[]} */
+  const out = [];
+  for (const [oldSlug, newSlug] of Object.entries(rows)) {
+    if (typeof newSlug !== "string" || !oldSlug || !newSlug) continue;
+    out.push({
+      from: `/${collection}/${oldSlug}/`,
+      to: `/${collection}/${newSlug}/`,
+      source: `content/${collection}/redirects.json`,
+    });
+  }
+  return out;
+}
+
+/**
+ * Turn the tenant-wide `content/redirects.json` map into root-relative declarations.
+ * Its keys and same-origin values are repository paths without a leading slash; an
+ * explicit HTTPS destination remains absolute and is validated by `buildRedirectSet`.
+ * @param {Record<string, unknown>} rows
+ * @returns {DeclaredRedirect[]}
+ */
+export function redirectsFromSiteMap(rows) {
+  if (!rows || typeof rows !== "object" || Array.isArray(rows)) {
+    throw new TypeError(
+      "content/redirects.json must be an object mapping relative paths to destinations",
+    );
+  }
+  /** @type {DeclaredRedirect[]} */
+  const out = [];
+  for (const [from, rawTo] of Object.entries(rows)) {
+    if (
+      !from || from.startsWith("/") || typeof rawTo !== "string" || !rawTo || rawTo.startsWith("/")
+    ) {
+      throw new TypeError(
+        "content/redirects.json keys and same-origin destinations must be non-empty paths without a leading slash",
+      );
+    }
+    const rootedFrom = `/${from}`;
+    const isExternal = /^[A-Za-z][A-Za-z0-9+.-]*:/.test(rawTo);
+    const rootedTo = isExternal ? rawTo : `/${rawTo}`;
+    out.push({
+      from: normalizeRedirectPath(rootedFrom) ?? rootedFrom,
+      to: isExternal ? rawTo : normalizeRedirectPath(rootedTo) ?? rootedTo,
+      source: SITE_REDIRECTS_PATH,
+    });
+  }
+  return out;
+}
+
+/**
+ * A content collection's redirect declaration, as it appears in a composed bundle's file list.
+ * `content/blog/redirects.json` declares redirects for the `blog` collection.
+ */
+export const COLLECTION_REDIRECTS_PATH = /^content\/([A-Za-z0-9][A-Za-z0-9_-]*)\/redirects\.json$/;
+
+/** The tenant-wide redirect declaration, for legacy URLs that belong to no single collection. */
+export const SITE_REDIRECTS_PATH = "content/redirects.json";
+
+/**
+ * Does this composed file declare redirects the composition lifts into `routes.aliases`?
+ * @param {string} path
+ * @returns {boolean}
+ */
+export function isRedirectDeclarationPath(path) {
+  return path === SITE_REDIRECTS_PATH || COLLECTION_REDIRECTS_PATH.test(path ?? "");
+}
+
+/**
+ * Declared redirects for every content collection present in a composed revision.
+ *
+ * Reads the COMPOSED files rather than a working tree, so the redirects are bound to the same
+ * revision as the pages they point at — a rename and its redirect can never publish apart.
+ *
+ * @param {{path: string, json: unknown}[]} entries  composed files, already parsed
+ * @returns {DeclaredRedirect[]}
+ */
+export function declaredRedirectsFromContent(entries) {
+  /** @type {DeclaredRedirect[]} */
+  const out = [];
+  for (const entry of entries ?? []) {
+    if (entry?.path === SITE_REDIRECTS_PATH) {
+      out.push(...redirectsFromSiteMap(/** @type {Record<string, unknown>} */ (entry.json)));
+      continue;
+    }
+    const match = COLLECTION_REDIRECTS_PATH.exec(entry?.path ?? "");
+    if (!match) continue;
+    out.push(
+      ...redirectsFromCollection(
+        /** @type {string} */ (match[1]),
+        /** @type {Record<string, unknown>} */ (entry.json),
+      ),
+    );
+  }
+  return out;
+}
+
+/**
+ * Normalize a same-origin path or a deliberately external HTTPS destination.
+ *
+ * A source is always same-origin; a TARGET may leave the origin, but only when the declaration
+ * says so in full: `https:` only, no credentials, no query, no fragment. Anything else — including
+ * every shape that merely looks absolute — is not a usable destination and refuses.
+ * @param {string} raw
+ * @returns {string | null}
+ */
+function normalizeRedirectDestination(/** @type {string} */ raw) {
+  const sameOrigin = normalizeRedirectPath(raw);
+  if (sameOrigin !== null) return sameOrigin;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
+      return null;
+    }
+    return url.toString().replace(/\/$/, url.pathname === "/" ? "/" : "");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Turn publication-space aliases into declared redirects. Only `redirect-308` aliases produce a
+ * redirect; a `render` alias is served, not redirected.
+ * @param {{from?: string, behavior?: string, to?: string}[]} aliases
+ * @param {string} [source]
+ * @returns {DeclaredRedirect[]}
+ */
+export function redirectsFromAliases(aliases, source = "publication-space routes.aliases") {
+  if (!Array.isArray(aliases)) return [];
+  /** @type {DeclaredRedirect[]} */
+  const out = [];
+  for (const alias of aliases) {
+    if (!alias || alias.behavior !== "redirect-308") continue;
+    if (typeof alias.from !== "string" || typeof alias.to !== "string") continue;
+    out.push({ from: alias.from, to: alias.to, source });
+  }
+  return out;
+}
+
+/**
+ * Follow `from -> to` through the declared map so a rename chain (a -> b, b -> c) resolves to a
+ * single hop (a -> c). A chain costs an extra round trip on every visit and dilutes the signal the
+ * redirect exists to preserve. A cycle is unresolvable and refuses.
+ * @param {Map<string, string>} direct
+ * @param {string} from
+ * @returns {{to: string} | {cycle: string[]}}
+ */
+function collapseChain(direct, from) {
+  const seen = [from];
+  let to = /** @type {string} */ (direct.get(from));
+  while (direct.has(to)) {
+    if (seen.includes(to)) return { cycle: [...seen, to] };
+    seen.push(to);
+    to = /** @type {string} */ (direct.get(to));
+  }
+  return { to };
+}
+
+/**
+ * Build the substrate-neutral redirect set from every declared source.
+ * @param {DeclaredRedirect[]} declared
+ * @param {number} [budget]
+ * @returns {RedirectSet}
+ */
+export function buildRedirectSet(declared, budget = REDIRECT_MAP_BUDGET_BYTES) {
+  /** @type {string[]} */
+  const violations = [];
+  /** @type {Map<string, string>} */
+  const direct = new Map();
+  /** @type {Map<string, string>} */
+  const origin = new Map();
+
+  for (const entry of declared) {
+    const from = normalizeRedirectPath(entry.from);
+    const to = normalizeRedirectDestination(entry.to);
+    if (from === null) {
+      violations.push(`${entry.source}: redirect source is not a usable request path`);
+      continue;
+    }
+    if (to === null) {
+      violations.push(`${entry.source}: redirect target is not a usable destination path`);
+      continue;
+    }
+    if (from === to) {
+      violations.push(`${entry.source}: "${from}" redirects to itself`);
+      continue;
+    }
+    const existing = direct.get(from);
+    if (existing !== undefined && existing !== to) {
+      violations.push(
+        `"${from}" is declared twice with different targets ("${existing}" in ${origin.get(from)}, "${to}" in ${entry.source})`,
+      );
+      continue;
+    }
+    direct.set(from, to);
+    origin.set(from, entry.source);
+  }
+
+  /** @type {{from: string, to: string}[]} */
+  const redirects = [];
+  for (const from of [...direct.keys()].sort()) {
+    const resolved = collapseChain(direct, from);
+    if ("cycle" in resolved) {
+      violations.push(`redirect cycle: ${resolved.cycle.join(" -> ")}`);
+      continue;
+    }
+    redirects.push({ from, to: resolved.to });
+  }
+
+  const bytes = serializeRedirectMap(redirects).length;
+  if (bytes > budget) {
+    violations.push(
+      `redirect map is ${bytes} bytes, over the ${budget}-byte edge budget (${redirects.length} redirects) — move the map to a key-value store before declaring more`,
+    );
+  }
+
+  return { ok: violations.length === 0, redirects, violations, bytes, budget };
+}
+
+/**
+ * The map exactly as an edge function embeds it: compact JSON, keys sorted, so the same declared
+ * input always produces byte-identical output and the published artifact stays deterministic.
+ *
+ * The output is embedded as a JS literal in generated edge-function source, and its keys and values
+ * are tenant-declared strings. `JSON.stringify` escapes quotes and backslashes, which closes the
+ * obvious break-out; the escapes below close the rest of the JSON-is-not-quite-JS gap — the two
+ * separator code points are legal in JSON strings but are line terminators to a JS parser, and `<`
+ * is neutralized so the same bytes stay inert if the map is ever inlined into markup.
+ * @param {{from: string, to: string}[]} redirects
+ * @returns {string}
+ */
+export function serializeRedirectMap(redirects) {
+  /** @type {Record<string, string>} */
+  const map = {};
+  for (const { from, to } of [...redirects].sort((a, b) => a.from.localeCompare(b.from))) {
+    map[from] = to;
+  }
+  return JSON.stringify(map)
+    .split(LINE_SEPARATOR)
+    .join("\\u2028")
+    .split(PARAGRAPH_SEPARATOR)
+    .join("\\u2029")
+    .split("<")
+    .join("\\u003c");
+}
+
+/**
+ * The declared set as publication-space aliases — the shape `routes.aliases` already carries and
+ * `publicationRedirects()` (scripts/publish/lib/publication-space-release.mjs) already consumes on
+ * its way into the live pointer. Emitting this rather than a parallel structure is what keeps
+ * redirects ONE contract: the edge function, the pointer value, and the declaration all agree
+ * because there is only one of them.
+ *
+ * Returns an empty array when the set refused, so a caller that ignores `ok` cannot publish a
+ * half-built topology.
+ * @param {RedirectSet} set
+ * @returns {{from: string, behavior: "redirect-308", to: string}[]}
+ */
+export function aliasesFromRedirectSet(set) {
+  if (!set.ok) return [];
+  return set.redirects.map(({ from, to }) => ({
+    from,
+    behavior: /** @type {"redirect-308"} */ ("redirect-308"),
+    to,
+  }));
+}
+
+/**
+ * @param {RedirectSet} set
+ * @returns {string}
+ */
+export function formatRedirectSetReport(set) {
+  const lines = [];
+  lines.push(
+    `== Redirect materialization == ${set.redirects.length} redirect(s), ${set.bytes}/${set.budget} bytes`,
+  );
+  for (const violation of set.violations) lines.push(`  REFUSE: ${violation}`);
+  lines.push(
+    set.ok
+      ? `OK — every declared redirect materializes at ${REDIRECT_STATUS}.`
+      : `REFUSED — ${set.violations.length} violation(s); nothing emitted.`,
+  );
+  return lines.join("\n");
+}

package/packages/public-runtime/src/publication-space.ts

@@ -27,11 +27,32 @@ export const PUBLICATION_MOUNT_ENTRY_VERSION = 1 as const;
 export const PUBLICATION_SPACE_PATH_CASE_POLICY = "sensitive" as const;
 export const PUBLICATION_SPACE_UNICODE_POLICY = "nfc" as const;
 
+/** Static public-discovery outputs generated from exact live publication versions. */
+export const PUBLICATION_DISCOVERY_OUTPUT_PATHS_V1 = [
+  "/feed.json",
+  "/llms.txt",
+  "/publication-discovery/manifest.json",
+  "/publication-discovery/redirects.json",
+  "/publication-discovery/seo.json",
+  "/search-index.json",
+  "/sitemap.xml",
+] as const;
+
+/** Platform route roots that reserve every generated discovery output. */
+export const PUBLICATION_DISCOVERY_RESERVED_MOUNTS_V1 = [
+  "/feed.json",
+  "/llms.txt",
+  "/publication-discovery",
+  "/search-index.json",
+  "/sitemap.xml",
+] as const;
+
 /** Platform-owned path segments that tenant publication mounts may not claim. */
 export const PUBLICATION_SPACE_RESERVED_MOUNTS = [
   "/.well-known",
   "/__evidence",
   "/__preview",
+  "/_a",
   "/_astro",
   "/_style-guide",
   "/admin",
@@ -47,7 +68,7 @@ export const PUBLICATION_SPACE_RESERVED_MOUNTS = [
   "/favicon.svg",
   "/health",
   "/js",
-  "/llms.txt",
+  ...PUBLICATION_DISCOVERY_RESERVED_MOUNTS_V1,
   "/platform",
   "/preview",
   "/products",
@@ -56,7 +77,6 @@ export const PUBLICATION_SPACE_RESERVED_MOUNTS = [
   "/saved",
   "/robots.txt",
   "/shared",
-  "/sitemap.xml",
   "/style-guide",
   "/tenants",
 ] as const;
@@ -280,7 +300,8 @@ function validateIdentifier(value: string | undefined, v: Violations, path: stri
 }
 
 function isReservedMount(mount: string): boolean {
-  return PUBLICATION_SPACE_RESERVED_MOUNTS.some((reserved) => publicationMountMatchesPath(reserved, mount));
+  const caseFolded = mount.toLowerCase();
+  return PUBLICATION_SPACE_RESERVED_MOUNTS.some((reserved) => publicationMountMatchesPath(reserved, caseFolded));
 }
 
 function validateSource(raw: unknown, v: Violations, path: string): PublicationSpaceSourceV1 | undefined {