@tokenoftrust/storefront-runner 2.2.112 → 2.2.114

package/apps/storefront/src/middleware/renderChain.ts

@@ -42,6 +42,7 @@ import {
   CSP_REPORT_GROUP,
   CSP_REPORT_PATH,
   readPublishedArtifact,
+  readVersionArtifact,
   themeArtifactPath,
   resolveTenantFeatures,
   resolveCapabilities,
@@ -63,6 +64,7 @@ import {
   resolveNativeGa4SandboxUrl,
 } from "@tot/public-runtime";
 import { readBakedManagedInstalls } from "@/lib/integration/bakedManagedInstalls";
+import { readWithImagePreviewRewriteOverlay } from "@tot/public-runtime/image-preview-rewrite-overlay";
 import type {
   CapabilityConfig,
   ConsentSnapshot,
@@ -451,15 +453,13 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? `${proto}://${host}${basePath}`
     : `https://${tenant.canonicalDomain}`;
 
-  // Apply a published theme override for the resolved environment (store->app).
-  // The live domain serves `live`; a gated preview serves `test`. When nothing
-  // is published the build-time tenant theme is used unchanged.
+  // Apply the theme selected for this render. A candidate route reads its exact
+  // version; an ordinary route resolves the environment's published channel.
   //
-  // Resolution is versioned-aware inside readPublishedArtifact: env maps to a
-  // publish channel (live->live, test->preview); if the tenant has a channel
-  // pointer, the artifact is resolved through the immutable site version
-  // (channel -> versionId -> manifest -> content). Tenants with no channel
-  // pointer fall back to the legacy per-path selection — no behavior change.
+  // readPublishedArtifact maps env to a publish channel (live->live,
+  // test->preview) and resolves it through the immutable site version. A
+  // candidate must bypass that pointer so a reviewer sees the candidate's own
+  // theme, capabilities, and embed opt-in with its content.
   // Request-scoped read memo: every content read resolves the same pointer and
   // version manifest, and a catalog render reads one artifact per catalog file.
   const kvReads = new Map<string, Promise<string | null>>();
@@ -473,6 +473,15 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
         return read;
       }
     : async () => null;
+  const readRuntimeArtifact = (path: string) => candidatePin
+    ? readWithImagePreviewRewriteOverlay(
+        kvGet,
+        tenant.tenant_id,
+        candidatePin.versionId,
+        path,
+        () => readVersionArtifact(kvGet, tenant.tenant_id, candidatePin.versionId, path),
+      )
+    : readPublishedArtifact(kvGet, tenant.tenant_id, customization.env, path);
 
   // Self-heal a DANGLING channel pointer: the pointer for this env's channel may
   // name a version that was never built (or whose manifest was evicted).
@@ -480,7 +489,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // the surface; here we do the once-per-request detection to ENQUEUE a rebuild of
   // the dangling version. Fail-open: a KV hiccup never blocks the render (the reads
   // below still run).
-  if (kv) {
+  if (kv && !candidatePin) {
     const channel = channelFromEnv(customization.env);
     await resolveServableChannelVersion(kvGet, tenant.tenant_id, channel, ({ versionId }) => {
       recordActivity({
@@ -508,12 +517,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     draftClaims && draftClaims.tenantId === tenant.tenant_id ? draftClaims : null;
 
   let theme = mergeTheme(referenceTheme, tenant.theme_tokens);
-  const publishedTheme = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    themeArtifactPath(tenant.tenant_id),
-  );
+  const publishedTheme = await readRuntimeArtifact(themeArtifactPath(tenant.tenant_id));
   if (publishedTheme) {
     try {
       theme = mergeTheme(theme, JSON.parse(publishedTheme) as DeepPartial<ThemeTokens>);
@@ -539,12 +543,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // commit (localhost=working tree, preview=PR head, live=promoted). So a
   // capability change is PR-gated and separable per environment.
   let publishedCaps: Partial<CapabilityConfig> | null = null;
-  const publishedCapsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    capabilitiesArtifactPath(tenant.tenant_id),
-  );
+  const publishedCapsRaw = await readRuntimeArtifact(capabilitiesArtifactPath(tenant.tenant_id));
   if (publishedCapsRaw) {
     try {
       publishedCaps = JSON.parse(publishedCapsRaw) as Partial<CapabilityConfig>;
@@ -560,12 +559,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // tenant enables a catalogued embed by committing embeds.json — no platform
   // change — but can never introduce a non-catalog origin.
   let publishedEmbeds: string[] | null = null;
-  const publishedEmbedsRaw = await readPublishedArtifact(
-    kvGet,
-    tenant.tenant_id,
-    customization.env,
-    embedsArtifactPath(tenant.tenant_id),
-  );
+  const publishedEmbedsRaw = await readRuntimeArtifact(embedsArtifactPath(tenant.tenant_id));
   if (publishedEmbedsRaw) {
     try {
       const parsed = JSON.parse(publishedEmbedsRaw);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.112",
+  "version": "2.2.114",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",