@tokenoftrust/storefront-runner 2.0.41 → 2.0.43

package/apps/storefront/src/lib/tenantRouting.ts

@@ -59,13 +59,18 @@ export async function resolveTenantRouting(
   pathname: string,
   resolver: TenantResolver,
 ): Promise<TenantRouting> {
-  // 1. Host wins when it explicitly owns a tenant.
+  // 1. Host wins when it explicitly owns a tenant — UNLESS it declares
+  //    `pathPrefixTenants`, the platform's shared preview host, which serves its
+  //    own content at the root AND dispatches other tenants by path prefix.
+  //    Returning early for that host turns every /<domain>/* URL into a path on
+  //    its own site, which is how giving it a tenant of its own silently 404'd
+  //    the dev loop, the admin preview links and the post-deploy chrome canary.
   const byHost = await resolver.resolveStrict(host);
-  if (byHost) {
+  if (byHost && !byHost.pathPrefixTenants) {
     return { tenant: byHost, basePath: "", renderPath: normalizePath(pathname) };
   }
 
-  // 2. Unknown host -> try a /<domain>/* path prefix.
+  // 2. Unknown host, or a declared path-prefix host -> try a /<domain>/* prefix.
   const segments = pathname.replace(/^\/+/, "").split("/");
   const firstRaw = segments[0] ?? "";
   let first = firstRaw;
@@ -85,7 +90,13 @@ export async function resolveTenantRouting(
     }
   }
 
-  // 3. Fall back to the registry default for this (unknown) host.
+  // 3. A path-prefix host whose prefix named no known tenant serves its OWN
+  //    content — that is the root case, and any other path on it.
+  if (byHost) {
+    return { tenant: byHost, basePath: "", renderPath: normalizePath(pathname) };
+  }
+
+  // 4. Fall back to the registry default for this (unknown) host.
   const fallback = await resolver.resolveByHost(host);
   return { tenant: fallback, basePath: "", renderPath: normalizePath(pathname) };
 }

package/apps/storefront/src/lib/tot/syncState.ts

@@ -57,6 +57,20 @@ export interface SyncStateSweepChanges {
   collections: SyncStateEntityChangeSet;
 }
 
+/** Mirrors packages/migration/src/load/sync-state.ts's `ImageRehostRecord`. */
+export interface SyncStateImageRehost {
+  computedAt: string;
+  mode: "rehost" | "reference";
+  sink: string | null;
+  considered: number;
+  rehosted: number;
+  alreadyRehosted: number;
+  referenced: number;
+  errors: number;
+  products: string[];
+  collections: string[];
+}
+
 /** The on-disk shape written by the migration CLI (schema "tot.sync-state/1"). */
 export interface CatalogSyncState {
   schema: string;
@@ -74,6 +88,13 @@ export interface CatalogSyncState {
    * migrated before hsby-B2 (change detection) has no `lastChanges`.
    */
   lastChanges?: SyncStateSweepChanges;
+  /**
+   * What the most recent sync's image rehost moved. Absent when that run moved
+   * no imagery. Recorded separately from `lastChanges` because a rehost rewrites
+   * image urls without touching `source_checksum` — so the content-hash delta
+   * reports those records as unchanged, and this is the only account of the move.
+   */
+  lastImageRehost?: SyncStateImageRehost;
 }
 
 // Vite resolves this glob at build time and bundles every tenant's sync-state

package/apps/storefront/src/lib/tracking/publishSafetyNet.ts

@@ -119,7 +119,21 @@ function attrsOf(element: RewriterElement): Record<string, string> {
  * shipping no identity for this content at all.
  *
  * No-op (returns `html` unchanged) when `HTMLRewriter` isn't available in
- * this runtime.
+ * this runtime, and equally when the rewrite itself cannot complete.
+ *
+ * FAIL-OPEN, ALWAYS. This is a safety net over content the platform does not
+ * author, so it must never be able to take a page down. `onEndTag` registers a
+ * callback for an end tag the parser is not obliged to produce: `<li>`, `<p>`,
+ * `<td>` and friends may legally omit theirs, and `HTMLRewriter` then aborts the
+ * stream with `TypeError: Parser error: No end tag.` — mid-transform, so no
+ * guard at registration can catch it. That throw propagated out of
+ * `getHomeHtml`/`getPageHtml` and cost the whole route: `/` and `/sitemap.xml`
+ * served a zero-byte 404 for a tenant whose HTML was valid.
+ *
+ * An unstamped document loses derived click identity — the exact loss the
+ * absence of any stamp already represents, and what `reportTrackingChainHealth`
+ * exists to surface. A 404 is not a smaller loss than that, so the original HTML
+ * wins whenever the pass cannot finish.
  */
 export async function stampTrackingIdsAtPublish(html: string): Promise<string> {
   const HTMLRewriter = getHtmlRewriterCtor();
@@ -157,6 +171,18 @@ export async function stampTrackingIdsAtPublish(html: string): Promise<string> {
     },
   });
 
-  const rewritten = rewriter.transform(new Response(html));
-  return await rewritten.text();
+  try {
+    const rewritten = rewriter.transform(new Response(html));
+    return await rewritten.text();
+  } catch (error) {
+    // One structured line, never a throw — the same posture the raw-surface
+    // health report takes. The document still serves; only its derived ids are
+    // absent, and that absence is what the health signal already reports.
+    console.error(
+      `[tracking] publish-time id stamping skipped — the document is served unstamped: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+    return html;
+  }
 }

package/apps/storefront/src/middleware/controlPlane.ts

@@ -12,6 +12,7 @@ import { fromD1, type D1Like } from "@/lib/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/apps/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integration/managedInstallDeclarations";
 import { buildTenantConsentBroker, verifyPreviewToken } from "@tot/public-runtime";
+import { tenantIsDeclaredPublic } from "@/config/tenants";
 import type {
   ConsentSnapshot,
   IntegrationDeclarationInput,
@@ -26,7 +27,6 @@ import {
   isAdminPath,
   sessionAdmitsHost,
   sessionHostCapability,
-  PUBLIC_HOME_TENANT_ID,
   type GateMode,
 } from "@/lib/auth/loginGate";
 import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
@@ -64,15 +64,19 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
   const { request, locals } = context;
 
   // Login-gate enforcement (DEMO_GATE_MODE="login"): runs before the render so a
-  // gated page is never served to an unauthenticated viewer. The platform's own
-  // "self" home tenant is EXEMPT — it renders publicly (browse + sign up); every
-  // other tenant on a gated host is withheld behind sign-in. A valid,
+  // gated page is never served to an unauthenticated viewer. A tenant that
+  // DECLARES `access.public` is EXEMPT — it renders publicly (browse + sign up);
+  // every other tenant on a gated host is withheld behind sign-in. A valid,
   // resource-bound tot_session sets locals.viewer (email + roles) for chrome;
   // otherwise an unauthenticated visitor gets a "Coming soon" holding page with
   // a Sign-in button (auth paths are exempt so sign-in itself is reachable). The
   // grant `resource` is the tenant's appDomain — never input.
   if (input.hostLoginGated && !input.internalContentGrant) {
-    const tenantExempt = tenant.tenant_id === PUBLIC_HOME_TENANT_ID;
+    // From the platform registry by id, NOT off `tenant` — that object resolves
+    // from TENANT_CACHE KV first, so a record written before this field existed
+    // would silently gate a page the platform declares public, and a KV write
+    // must never be able to make a store public. See tenantIsDeclaredPublic.
+    const tenantExempt = tenantIsDeclaredPublic(tenant.tenant_id);
     // UNIFIED on the federated session: read the FULL session (no resource filter —
     // federated sign-in's aud is the storefront app, not this tenant) and admit the
     // viewer iff they hold a MEMBERSHIP for the host's tenant. One session model for

package/apps/storefront/src/middleware/index.ts

@@ -36,6 +36,7 @@ import { HEALTH_PATH, healthResponse } from "@/lib/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
 import {
+  platformStaticRootLocationV1,
   publicationRedirectLocationV1,
   resolveMiddlewareBranchV1,
 } from "./routeBranch.js";
@@ -245,7 +246,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
       hasManagedInstalls: false,
     });
     if (bundled) return bundled;
-    const asset = basePath ? await next(`${renderPath}${url.search}`) : await next();
+    const rootLocation = platformStaticRootLocationV1({
+      origin: url.origin,
+      basePath,
+      renderPath,
+      search: url.search,
+    });
+    if (rootLocation) {
+      const response = new Response(null, { status: 308, headers: { location: rootLocation } });
+      applySecurityHeaders(response.headers);
+      return response;
+    }
+    const asset = await next();
     applySecurityHeaders(asset.headers);
     return asset;
   }

package/apps/storefront/src/middleware/renderChain.ts

@@ -51,6 +51,8 @@ import {
   resolveEnvironmentOnlyPlan,
   INTEGRATION_NONCE_PLACEHOLDER,
   defaultConsentSnapshot,
+  defaultAnalyticsConsentConfig,
+  buildTenantConsentBroker,
   exactPublicationTimestamp,
   parseConsentSnapshot,
   CONSENT_SNAPSHOT_INPUT_HEADER,
@@ -58,6 +60,7 @@ import {
   CONSENT_SNAPSHOT_HMAC_SECRET_BINDING,
   MATERIALIZE_MODE_BINDING,
   verifyConsentSnapshotSig,
+  resolveNativeGa4SandboxUrl,
 } from "@tot/public-runtime";
 import { readBakedManagedInstalls } from "@/lib/integration/bakedManagedInstalls";
 import type {
@@ -86,7 +89,11 @@ import {
   cspHeaderName,
 } from "@/lib/integration/browserEnvironment";
 import { freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
-import { resolveIntegrationRenderState } from "@/lib/integration/renderIntegrationState";
+import { takePinnedRouteRewriteResponse } from "@/lib/pinnedRouteRewriteBoundary";
+import {
+  composeIntegrationDeclarations,
+  resolveIntegrationRenderState,
+} from "@/lib/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
 import {
@@ -119,8 +126,8 @@ export interface RenderChainInput {
   managedIntegrationDeclarations: readonly IntegrationDeclarationInput[];
   /**
    * Reads the tenant's saved consent revision (D1). `null` on the public branch,
-   * which falls back to the fail-closed essential-only default — the posture the
-   * baked-snapshot path already documents for the public/materialize render.
+   * which falls back to the configured-analytics platform default when no saved
+   * tenant override exists.
    */
   readTenantConsentSnapshot: (() => Promise<ConsentSnapshot | null>) | null;
   /**
@@ -270,10 +277,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // is byte-identical to the non-integration form) and the environment-only plan is
   // resolved below exactly as before — zero cost.
   let resolvedBrowserEnvironment: BrowserEnvironment | null = null;
-  const integrationDeclarations = [
-    ...loadTenantIntegrationDeclarations(tenant),
-    ...managedIntegrationDeclarations,
-  ];
+  const integrationDeclarations = composeIntegrationDeclarations(
+    loadTenantIntegrationDeclarations(tenant),
+    managedIntegrationDeclarations,
+  );
   locals.integrationDeclarations = integrationDeclarations;
   if (integrationDeclarations.length > 0) {
     const declFeatures = resolveTenantFeatures(tenant);
@@ -304,8 +311,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
 
   // ---- Consent snapshot: the tenant's ACTUAL initial consent state, not a
   // hardcoded default. Both document mounts (Layout.astro, rawHtmlResponse) inline
-  // THIS value; an unresolved tenant stays on the fail-closed essential-only default.
+  // THIS value. Configured analytics defaults on unless an authoritative saved or
+  // baked tenant consent snapshot overrides it.
   locals.consentSnapshot = defaultConsentSnapshot();
+  let tenantConsentResolved = false;
   // BAKED-SNAPSHOT INPUT (ADR 0013), honored ONLY on the materialize render, ONLY
   // under a valid tenant-bound signature. The go-live bake pipeline resolves the
   // tenant's REAL snapshot from D1 ONCE on the Worker, signs it, and provides
@@ -338,9 +347,20 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   }
   if (bakedConsent) {
     locals.consentSnapshot = bakedConsent;
+    tenantConsentResolved = true;
   } else if (input.readTenantConsentSnapshot) {
     const saved = await input.readTenantConsentSnapshot();
-    if (saved) locals.consentSnapshot = saved;
+    if (saved) {
+      locals.consentSnapshot = saved;
+      tenantConsentResolved = true;
+    }
+  }
+  if (
+    !tenantConsentResolved &&
+    integrationDeclarations.some((declaration) =>
+      declaration.manifest.browser.consent.purposes.includes("analytics"))
+  ) {
+    locals.consentSnapshot = buildTenantConsentBroker(defaultAnalyticsConsentConfig()).getSnapshot();
   }
 
   // ---- Edge page cache: short-circuit production browse reads on a hit,
@@ -523,7 +543,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // matching nonce/CSP pair.
   const cspNonce = INTEGRATION_NONCE_PLACEHOLDER;
 
-  locals.tenant = tenant;
+  // Components read non-CSS brand choices (for example hero/header variants)
+  // from the tenant object. Expose the same effective theme that produced the
+  // CSS variables so a reconciled theme.json controls both surfaces.
+  locals.tenant = { ...tenant, theme_tokens: theme };
   // One immutable clock for every visibility consumer in this render. Selected
   // Worker content uses its audited pointer transition; materialization uses the
   // signed build input; an ordinary legacy request has no clock and schedules stay hidden.
@@ -621,14 +644,25 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     basePath,
     renderPath,
     search: url.search,
+    // Astro re-runs this middleware for its error route, against the ORIGINAL
+    // request. Rewriting there discards the route it already chose.
+    routePattern: context.routePattern,
   });
   let response = rewriteTarget !== undefined
     ? await next(rewriteTarget)
     : await next();
 
+  // A pinned generic-route fallback uses `context.rewrite()`, which runs the
+  // rewritten route through this middleware and hands back a fully decorated,
+  // CSP-stamped response. Preserve that inner response verbatim. Running the
+  // outer decoration path again would inject preview helpers twice and replace
+  // the CSP nonce without replacing the already-live nonce in the document.
+  const pinnedRewriteResponse = takePinnedRouteRewriteResponse(response);
+  if (pinnedRewriteResponse) return pinnedRewriteResponse;
+
   // On-publish auto-refresh: inject the live-reload client into SHARED preview
   // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).
-  // It polls /__preview/version and reloads when this tenant's cache-version
+  // It polls /api/preview/version and reloads when this tenant's cache-version
   // bumps on publish/reconcile. Injection happens before the CSP header is set so
   // the script's per-request nonce (cspNonce) matches the enforced policy.
   response = await maybeInjectPreviewReload(response, {
@@ -717,6 +751,15 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       ...widgetCsp.frameSrc,
       ...embedCsp.frameSrc,
     ],
+    // The native GA4 sandbox mounts on this tenant's OTHER apex/www host (see
+    // resolveNativeGa4SandboxUrl) so gtag.js runs on a real, non-opaque origin.
+    // frame-src (above) lets this page frame that sandbox; frame-ancestors is
+    // evaluated by the FRAMED document, so the sandbox origin must separately be
+    // allowed to frame this one back, or the site's own strict `frame-ancestors
+    // 'self'` blocks its own sandbox (apex and www are different origins).
+    // Derived from this request's own hostname — never a hardcoded tenant literal
+    // — so it's correct for every custom-domain tenant, not just one (ADR 0032).
+    frameAncestors: [new URL(resolveNativeGa4SandboxUrl(url.href)).origin],
     formAction: checkoutCsp?.formAction ?? [],
     reportGroup: CSP_REPORT_GROUP,
     reportUri: CSP_REPORT_PATH,

package/apps/storefront/src/middleware/routeBranch.ts

@@ -15,10 +15,9 @@
  *   - {@link PLATFORM_STATIC_ASSET_PREFIXES} — built and public/ bytes. Identical
  *     for every visitor, no tenant state at all. Serving them through origin
  *     compute is exactly what ADR 0013 exists to prevent.
- *   - {@link PLATFORM_PUBLIC_DISCOVERY_PATHS} — robots/sitemap/llms. Anonymous-
- *     identical, but rendered from the tenant's own catalog + content, so they
- *     are not raw bytes; they are ordinary Tier 0 public output that happens to
- *     live on a reserved mount.
+ *   - {@link PLATFORM_PUBLIC_DISCOVERY_PATHS} — anonymous-identical discovery
+ *     output. Production serves materialized bytes from content-addressed
+ *     storage; local and preview rendering keeps the same Tier 0 route shape.
  *   - {@link PLATFORM_PUBLIC_APP_ROUTE_PREFIXES} — the app's own catalog browse
  *     pages. Reserved so a tenant mount cannot claim them, which is a different
  *     question from who may read them: they are the storefront's most public
@@ -27,6 +26,7 @@
  * Contract: docs/architecture/decisions/0013-public-serving-contract.md
  */
 import {
+  PUBLICATION_DISCOVERY_OUTPUT_PATHS_V1,
   resolvePublicationRoutePlanV1,
   type PublicationRoutePlanV1,
   type PublicationRouteRedirectPlanV1,
@@ -50,6 +50,7 @@ export type MiddlewareBranchV1 = "static-passthrough" | "public-render" | "contr
  * front of bytes that never vary.
  */
 export const PLATFORM_STATIC_ASSET_PREFIXES = [
+  "/_a",
   "/_astro",
   "/apps",
   "/assets",
@@ -61,15 +62,13 @@ export const PLATFORM_STATIC_ASSET_PREFIXES = [
 ] as const;
 
 /**
- * Per-tenant discovery documents. Every one is generated from `locals.tot` +
- * `locals.content` (see src/pages/robots.txt.ts, sitemap.xml.ts, llms.txt.ts),
- * so they need the public render chain — they are not static bytes and cannot be
- * passed through.
+ * Per-tenant public discovery documents. Production publication materializes
+ * these routes into content-addressed storage; local and preview rendering use
+ * the public render chain. They never enter the authorization control plane.
  */
 export const PLATFORM_PUBLIC_DISCOVERY_PATHS = [
-  "/llms.txt",
+  ...PUBLICATION_DISCOVERY_OUTPUT_PATHS_V1,
   "/robots.txt",
-  "/sitemap.xml",
 ] as const;
 
 /**
@@ -105,7 +104,8 @@ export function isPlatformStaticAssetPath(renderPath: string): boolean {
 }
 
 export function isPlatformPublicDiscoveryPath(renderPath: string): boolean {
-  return PLATFORM_PUBLIC_DISCOVERY_PATHS.some((entry) => matchesPathOrPrefix(renderPath, entry));
+  const caseFolded = renderPath.toLowerCase();
+  return PLATFORM_PUBLIC_DISCOVERY_PATHS.some((entry) => caseFolded === entry);
 }
 
 export function isPlatformPublicAppRoutePath(renderPath: string): boolean {
@@ -142,18 +142,64 @@ export interface ResolvedMiddlewareBranchV1 {
   publication: PublicationRoutePlanV1;
 }
 
-/** Astro rewrite target for tenant-prefix stripping or canonical render aliases. */
+/**
+ * Astro route patterns the error pipeline pins. When Astro renders one of these it
+ * has ALREADY chosen the route, and re-runs this middleware against the ORIGINAL
+ * request — same URL, so the same tenant prefix, so the same rewrite target.
+ * Rewriting then throws that choice away and sends the render back to the
+ * catch-all, which 404s again with a null body. The error page never renders.
+ */
+const ASTRO_ERROR_ROUTE_PATTERNS: readonly string[] = ["/404", "/500"];
+
+/** True when Astro is rendering its error route, not the request's own route. */
+export function isAstroErrorRouteV1(routePattern: string | undefined): boolean {
+  return routePattern !== undefined && ASTRO_ERROR_ROUTE_PATTERNS.includes(routePattern);
+}
+
+/**
+ * Astro rewrite target for tenant-prefix stripping or canonical render aliases.
+ *
+ * Returns `undefined` — do not rewrite — while the error route is rendering.
+ * Astro's error handler builds a state pinned to `/404` but carrying the ORIGINAL
+ * pathname, then re-runs middleware over it; a prefix rewrite there re-dispatches
+ * to the tenant path, which resolves to the catch-all and answers 404 with a null
+ * body. The merged result is a zero-byte 404: every path-routed 404 on this
+ * deployment, while the same 404 host-routed returns the full page.
+ */
 export function middlewareRewriteTargetV1(input: {
   requestPath: string;
   basePath: string;
   renderPath: string;
   search: string;
+  /** `context.routePattern` — the route Astro is currently rendering. */
+  routePattern?: string;
 }): string | undefined {
+  if (isAstroErrorRouteV1(input.routePattern)) return undefined;
   return input.basePath !== "" || input.renderPath !== input.requestPath
     ? `${input.renderPath}${input.search}`
     : undefined;
 }
 
+/**
+ * Where a path-routed platform static request belongs: its root-served URL.
+ *
+ * Platform bytes live at the origin root under every routing mode, and the
+ * platform's static handler answers them only there. `/<tenant>/shared/x.css` is
+ * not a file, and an Astro rewrite to `/shared/x.css` does not reach the static
+ * handler either: rewrites dispatch through the ROUTER, whose only match is the
+ * `[...slug]` catch-all. So the prefixed request is redirected to the root, which
+ * is correct on every substrate. Returns `undefined` when host-routed.
+ */
+export function platformStaticRootLocationV1(input: {
+  origin: string;
+  basePath: string;
+  renderPath: string;
+  search: string;
+}): string | undefined {
+  if (!input.basePath) return undefined;
+  return `${input.origin}${input.renderPath}${input.search}`;
+}
+
 /** Absolute 308 location for host- and path-routed publication aliases. */
 export function publicationRedirectLocationV1(input: {
   origin: string;

package/apps/storefront/src/middleware/staticBundle.ts

@@ -9,7 +9,12 @@
  */
 import { readR2 } from "@/lib/runtimeEnv";
 import { getCachedPage, putCachedPage, staticBundleCacheKey } from "@/lib/edgeCache";
-import { resolveChannelDigest, serveStaticBundle } from "@tot/public-runtime";
+import {
+  resolveChannelDigest,
+  serveStaticBundle,
+  serveVersionIndependentAsset,
+  versionIndependentAssetKey,
+} from "@tot/public-runtime";
 import type { StaticBundleR2BucketLike, TenantConfig } from "@tot/public-runtime";
 
 export interface StaticBundleAttemptInput {
@@ -46,11 +51,38 @@ export async function tryServeStaticBundle(
   input: StaticBundleAttemptInput,
 ): Promise<Response | null> {
   const { request, url, tenant, cache, kv } = input;
+  const method = request.method.toUpperCase();
+
+  // Version-independent assets (`/_a/<sha256>`, `/_astro/<name>`) are exact addresses: the same
+  // bytes for every viewer, preview or not, whatever the live pointer says. A page from an
+  // older version — or a preview of one — keeps resolving its own sub-resources.
+  if ((method === "GET" || method === "HEAD") && versionIndependentAssetKey(url.pathname)) {
+    const bucket = await readR2("STATIC_BUNDLES");
+    if (bucket) {
+      const pinnedKey = cache && method === "GET"
+        ? staticBundleCacheKey(tenant.tenant_id, "pinned", url.pathname, "")
+        : null;
+      if (pinnedKey && cache) {
+        const hit = await getCachedPage(cache, pinnedKey);
+        if (hit) return hit;
+      }
+      const pinned = await serveVersionIndependentAsset(
+        bucket as unknown as StaticBundleR2BucketLike,
+        url.pathname,
+        method,
+      );
+      if (pinned) {
+        if (pinnedKey && cache && pinned.ok) await putCachedPage(cache, pinnedKey, pinned);
+        return pinned;
+      }
+    }
+  }
+
   const eligible =
     tenant.staticPublish != null &&
     tenant.staticPublish.enabled !== false &&
     input.basePath === "" &&
-    request.method.toUpperCase() === "GET" &&
+    (method === "GET" || method === "HEAD") &&
     !input.isPreviewHost &&
     !input.hasPreviewToken &&
     !input.hasCandidatePin &&
@@ -80,7 +112,7 @@ export async function tryServeStaticBundle(
     return null;
   }
 
-  const bundleCacheKey = cache
+  const bundleCacheKey = cache && method === "GET"
     ? staticBundleCacheKey(tenant.tenant_id, digest, url.pathname, url.search)
     : null;
   if (bundleCacheKey && cache) {
@@ -98,6 +130,8 @@ export async function tryServeStaticBundle(
       },
     },
     url.pathname,
+    url.search,
+    method,
   );
   // `null` = the manifest proves this path is outside the bundle's static surface
   // (an app surface like /admin) — the caller owns it.

package/apps/storefront/src/pages/[...slug].astro

@@ -11,7 +11,8 @@ import ProseSections from "@/components/content/ProseSections.astro";
 import ProseToc from "@/components/content/ProseToc.astro";
 import { breadcrumbLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
-import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/rawMarketingHtml";
+import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
+import { markPinnedRouteRewriteComplete } from "@/lib/pinnedRouteRewriteBoundary";
 
 const { tenant, canonicalBase, content, basePath } = Astro.locals;
 const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
@@ -32,7 +33,9 @@ if (
 // dir, so the pages live under `/style-guide/…` and we rewrite the underscored URL
 // onto them. These are noindex + sitemap-excluded and never reskin the live site.
 if (slug === "_style-guide" || slug.startsWith("_style-guide/")) {
-  return Astro.rewrite("/style-guide/" + slug.slice("_style-guide".length + 1));
+  return markPinnedRouteRewriteComplete(
+    await Astro.rewrite("/style-guide/" + slug.slice("_style-guide".length + 1)),
+  );
 }
 
 // Raw tenant-authored marketing subpage (vendor-injected HTML) — serve the
@@ -50,6 +53,7 @@ if (rawHtml && rawHtmlPolicy(tenant).allowed) {
     chromeWrapper,
     plan: Astro.locals.integrationPlan,
     consentSnapshot: Astro.locals.consentSnapshot,
+    canonicalUrl: rawPageCanonicalUrl(canonicalBase, slug),
   });
 }
 

package/apps/storefront/src/pages/api/request-access.ts

@@ -1,7 +1,7 @@
 /**
- * POST /api/request-access — early-access lead capture for the `home` landing page.
+ * POST /api/request-access — early-access lead capture for the storefront landing page.
  *
- * The browser form (tenants/home) POSTs here same-origin (CSP `connect-src 'self'`
+ * The browser form (tenants/storefront.tokenoftrust.store) POSTs here same-origin (CSP `connect-src 'self'`
  * + `form-action 'self'`). This route forwards the lead to tot20's generic
  * messaging endpoint SERVER-SIDE — the storefront's ToT credentials never reach
  * the browser. The message emails the Trello Success board so a card is created.
@@ -18,7 +18,7 @@
  * the server-side send just works and no mailto is returned.
  *
  * Deliberately NOT gated on `context.locals.features.*` — unlike newsletter.ts,
- * this must work on the `home` marketing tenant.
+ * this must work on the storefront marketing tenant.
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
@@ -26,7 +26,8 @@ import { readEnv } from "@/lib/env";
 export const prerender = false;
 
 // Trello Success board — a card is created from the forwarded email.
-// Kept in sync with the mailto: fallback in tenants/home/public/js/storefront.js.
+// Kept in sync with the mailto: fallback in
+// tenants/storefront.tokenoftrust.store/public/js/storefront.js.
 const BOARD_EMAIL = "darrin84+l6gajmvvoo1x4edew5qs@boards.trello.com";
 
 // Permissive email shape — tot20 / the mail system is the real deliverability authority.

package/apps/storefront/src/pages/blog/[slug].astro

@@ -11,12 +11,22 @@ import { buildAlternates } from "@/lib/seo/alternates.js";
 import { languageLabel } from "@/lib/i18n.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/jsonld.js";
 
+// These redirects also exist in the published artifact: the publication composition lifts this
+// file into the space's `routes.aliases`, which reach the CDN plane through the live pointer. The
+// redirect below is the pointer-served (`worker-r2-pointer`) plane's IMPLEMENTATION of those same
+// declared redirects — that plane resolves routing from tenant config, so without it a renamed
+// slug would redirect on the CDN plane and 404 here. The materialization rail verifies this names
+// a source the composition actually materializes.
+export const MATERIALIZED_REDIRECT_SOURCE = "content/blog/redirects.json";
+
 const { tenant, canonicalBase, basePath, content, publicationTimestamp } = Astro.locals;
 const slug = Astro.params.slug ?? "";
 const post = await getBlogPost(tenant.tenant_id, slug, content, publicationTimestamp);
 if (!post) {
   const redirect = await resolveBlogRedirect(tenant.tenant_id, slug, content);
-  if (redirect) return Astro.redirect(`${basePath}/blog/${redirect}/`, 301);
+  // 308, matching the `redirect-308` alias contract the published plane serves, so a renamed slug
+  // behaves identically on both substrates.
+  if (redirect) return Astro.redirect(`${basePath}/blog/${redirect}/`, 308);
   return new Response(null, { status: 404 });
 }
 

package/apps/storefront/src/pages/cart.ts

@@ -0,0 +1,23 @@
+import type { APIRoute } from "astro";
+import { managedCartHref } from "@/lib/chrome/managedCart.js";
+
+export const prerender = false;
+
+/**
+ * Backward-compatible entry for bookmarked or tenant-authored `/cart` links.
+ * Chrome now links straight to managed checkout, but this route prevents stale
+ * links from falling through the content catch-all to a misleading storefront
+ * 404. Tenant resolution and preview authorization have already run in
+ * middleware before this redirect is selected.
+ */
+export const GET: APIRoute = ({ locals }) => {
+  const location = managedCartHref(locals.commerce);
+  if (!location) return new Response(null, { status: 404 });
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location,
+      "cache-control": "private, no-store",
+    },
+  });
+};