@tokenoftrust/storefront-runner 2.2.126 → 2.3.0

package/apps/storefront/src/lib/compliance/rawComplianceNotices.ts

@@ -3,15 +3,17 @@
  *
  * `rawHtmlResponse` (rawMarketingHtml.ts) bypasses Astro's Layout, so these are
  * the platform-owned anchors that CAN be guaranteed on a raw document
- * independent of its content: the FDA nicotine warning, the shipping/
- * jurisdiction notice, and the excise-tax disclosure. Each mirrors the exact
+ * independent of its content: the FDA nicotine warning, the PACT Act notice, the
+ * shipping/jurisdiction notice, and the excise-tax disclosure. Each mirrors the exact
  * markup its Layout.astro sibling renders (NicotineWarning.astro "bar" variant,
- * ShippingRestrictionNotice.astro "footer" variant via ComplianceNotice.astro,
- * and Layout's own excise-tax <p>) so a raw and a block-composed page present
+ * PactActNotice.astro and ShippingRestrictionNotice.astro "footer" variants via
+ * ComplianceNotice.astro, and Layout's own excise-tax <p>) so a raw and a block-composed page present
  * these anchors identically. See `rawHtmlPolicy` for which anchors this does
  * and doesn't cover (notably: NOT `age-gate`).
  */
 
+import { nicotineWarningHtml } from "../../../../../packages/cli/src/declared-config.mjs";
+
 function escapeHtml(value: string): string {
   return value
     .replace(/&/g, "&amp;")
@@ -21,17 +23,9 @@ function escapeHtml(value: string): string {
     .replace(/'/g, "&#39;");
 }
 
-const NICOTINE_WARNING_TEXT =
-  "WARNING: This product contains nicotine. Nicotine is an addictive chemical.";
-
-/** Mirrors NicotineWarning.astro's "bar" variant. */
-export function nicotineWarningBarHtml(): string {
-  return (
-    '<div class="border-b-2 border-[var(--color-text)] bg-[var(--color-text)] text-[var(--color-bg)]" role="note" aria-label="Health warning" data-compliance="nicotine-warning">' +
-    '<p class="container-prose py-2 text-center text-[0.72rem] font-semibold uppercase tracking-[0.06em] sm:text-xs">' +
-    NICOTINE_WARNING_TEXT +
-    "</p></div>"
-  );
+/** NicotineWarning.astro's "bar" variant — the same `nicotineWarningHtml` it renders. */
+export function nicotineWarningBarHtml(declaration: unknown): string {
+  return nicotineWarningHtml(declaration, "bar");
 }
 
 /** Mirrors ShippingRestrictionNotice.astro's "footer" variant (via ComplianceNotice.astro). Empty when `text` is absent — same as the Astro component. */
@@ -45,6 +39,28 @@ export function shippingRestrictionNoticeHtml(text: string | undefined): string
   );
 }
 
+/**
+ * The PACT Act notice wording — the one copy PactActNotice.astro and the raw path
+ * both render. The federal requirements it summarizes are fixed; only the age varies.
+ */
+export function pactActNoticeText(minAge = 21): string {
+  return (
+    `In compliance with the federal PACT Act, all vapor and nicotine orders require ` +
+    `age verification (${minAge}+) and an adult signature on delivery. These products ` +
+    `cannot be shipped through the U.S. Postal Service.`
+  );
+}
+
+/** Mirrors PactActNotice.astro's "footer" variant (via ComplianceNotice.astro). */
+export function pactActNoticeHtml(minAge?: number): string {
+  return (
+    '<div class="border-t border-[var(--color-border)] bg-[var(--color-bg)]" data-compliance="pact-act">' +
+    '<p class="container-prose py-3 text-center text-sm text-[var(--color-muted)]" role="note" aria-label="PACT Act shipping compliance notice">' +
+    escapeHtml(pactActNoticeText(minAge)) +
+    "</p></div>"
+  );
+}
+
 /** Mirrors Layout.astro's excise-tax disclosure <p>. */
 export function exciseTaxNoticeHtml(): string {
   return (
@@ -54,19 +70,23 @@ export function exciseTaxNoticeHtml(): string {
 }
 
 export interface RawComplianceChromeInput {
-  nicotineWarning?: boolean;
+  /** The tenant's `compliance.nicotineWarning` declaration (`true` or a presentation). */
+  nicotineWarning?: unknown;
+  pactAct?: boolean;
+  minAge?: number;
   shippingRestriction?: string;
   exciseTaxEnabled?: boolean;
 }
 
 /** The markup to inject at `rawHtmlResponse`'s body-start boundary. */
 export function renderRawComplianceTop(input: RawComplianceChromeInput): string {
-  return input.nicotineWarning ? nicotineWarningBarHtml() : "";
+  return input.nicotineWarning ? nicotineWarningBarHtml(input.nicotineWarning) : "";
 }
 
 /** The markup to inject at `rawHtmlResponse`'s body-deferred boundary. */
 export function renderRawComplianceBottom(input: RawComplianceChromeInput): string {
-  let out = shippingRestrictionNoticeHtml(input.shippingRestriction);
+  let out = input.pactAct ? pactActNoticeHtml(input.minAge) : "";
+  out += shippingRestrictionNoticeHtml(input.shippingRestriction);
   if (input.exciseTaxEnabled) out += exciseTaxNoticeHtml();
   return out;
 }

package/apps/storefront/src/lib/dashboard/delegateGate.ts

@@ -21,9 +21,37 @@
  * PURE (no I/O, no Astro) so all four states are unit-testable without rendering
  * the page, matching `@/lib/dashboard/tenantSelection` and `@/lib/auth/loginGate`.
  */
+import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
 import { membershipFor, staffAdmits } from "@/lib/dashboard/tenantSelection";
 import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSelection";
 
+/** What every viewer of an unpaid store is told in place of the delegate section. */
+export const UNPAID_DELEGATION_NOTE =
+  "Developers with preview access can already add changes to the site. Ship-on-behalf " +
+  "delegation becomes available once the live site is activated.";
+
+/** The delegate section: an unpaid store's note, or the paid store's {@link DelegateGate}. */
+export type DelegateSection = { mode: "unpaid"; role: null; explanation: string } | DelegateGate;
+
+/**
+ * Resolve the whole delegate section. Before a store is paid there is no live
+ * site and preview-access developers can already add changes to the release
+ * (`canAddToRelease`), so delegation has nothing to grant: every viewer, the
+ * owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store resolves
+ * {@link resolveDelegateGate} unchanged.
+ */
+export function resolveDelegateSection(
+  storefrontMode: string | null | undefined,
+  tenants: readonly TenantMembership[] | undefined,
+  resource: string,
+  staff?: StaffAdmission,
+): DelegateSection {
+  if (!storefrontModeAllowsGoLive(storefrontMode)) {
+    return { mode: "unpaid", role: null, explanation: UNPAID_DELEGATION_NOTE };
+  }
+  return resolveDelegateGate(tenants, resource, staff);
+}
+
 /**
  * What the delegate section renders for this viewer.
  *

package/apps/storefront/src/lib/homeVisualParity.ts

@@ -92,6 +92,10 @@ export function promoTilesView(
   };
 }
 
+/**
+ * The editorial block's media column: the rehosted image, else generated art when
+ * the block asks for it with `imageSeed`, else none — a text-only block.
+ */
 export function editorialMediaView(block: EditorialBlock, tenantId: string) {
   if (
     isSafeRehostedAssetPathForTenant(block.image, tenantId) &&
@@ -99,9 +103,8 @@ export function editorialMediaView(block: EditorialBlock, tenantId: string) {
   ) {
     return { kind: "image" as const, src: block.image, alt: block.imageAlt };
   }
-  return {
-    kind: "placeholder" as const,
-    seed: block.imageSeed ?? block.title,
-    label: block.title,
-  };
+  if (block.imageSeed) {
+    return { kind: "placeholder" as const, seed: block.imageSeed, label: block.title };
+  }
+  return { kind: "none" as const };
 }

package/apps/storefront/src/lib/jsonld.ts

@@ -133,11 +133,11 @@ export function blogPostingLd(
     mainEntityOfPage: url,
     datePublished: post.publishedAt,
     dateModified: post.modifiedAt,
-    author: {
-      "@type": "Person",
-      name: post.author,
-      ...(authorUrl ? { url: authorUrl } : {}),
-    },
+    // A post that names no author carries no `author`: an empty Person is invalid markup, and
+    // naming anyone else would attribute the post to someone its content does not.
+    ...(post.author.trim()
+      ? { author: { "@type": "Person", name: post.author.trim(), ...(authorUrl ? { url: authorUrl } : {}) } }
+      : {}),
     publisher: { "@type": "Organization", name: publisherName, url: canonicalBase },
     wordCount: wordCount(post.contentHtml),
     ...(post.categories[0] ? { articleSection: post.categories[0] } : {}),

package/apps/storefront/src/lib/pinnedRouteRewriteBoundary.ts

@@ -1,14 +1,19 @@
 /**
- * Private response marker for the in-process pinned-route rewrite boundary.
+ * Private response marker for the in-process route rewrite boundary.
  *
  * `context.rewrite()` runs the rewritten request through middleware and returns
  * a complete response: preview helpers, security headers, CSP, and the live
  * nonce have already been applied. The outer render chain must pass those bytes
- * through instead of decorating and nonce-stamping them a second time.
+ * through instead of decorating and nonce-stamping them a second time — a second
+ * stamp replaces the CSP header's nonce while the document keeps the inner one,
+ * so the browser blocks every inline style and script on the page.
  *
  * The marker exists only while the inner response unwinds through the outer
  * middleware pass. `takePinnedRouteRewriteResponse` removes it before the
  * response reaches a client.
+ *
+ * Every in-process rewrite goes through {@link rewriteThroughRenderChain};
+ * `pinnedRouteRewriteBoundary.test.ts` refuses a bare `.rewrite(` anywhere else.
  */
 export const PINNED_ROUTE_REWRITE_COMPLETE_HEADER =
   "x-tot-internal-pinned-route-rewrite-complete";
@@ -29,3 +34,16 @@ export function takePinnedRouteRewriteResponse(response: Response): Response | n
     headers,
   });
 }
+
+/**
+ * Rewrite in-process and mark the completed response so the outer middleware pass
+ * serves it verbatim. The response a rewrite hands back may be immutable, so it is
+ * copied before the marker (and any caller headers) are set.
+ */
+export async function rewriteThroughRenderChain(
+  context: { rewrite(path: string): Promise<Response> },
+  path: string,
+): Promise<Response> {
+  const rendered = await context.rewrite(path);
+  return markPinnedRouteRewriteComplete(new Response(rendered.body, rendered));
+}

package/apps/storefront/src/lib/rawChrome.ts

@@ -39,8 +39,10 @@ import type {
   ChromeConfig,
   ChromeFooter,
   ChromeHeader,
+  ChromeHeaderActionLink,
   ChromeLink,
   ChromeNavItem,
+  ChromeSearch,
   ChromeUtilityNav,
   HeaderVariant,
   SocialLink,
@@ -273,27 +275,79 @@ function renderNavItem(item: ChromeNavItem, index: number, currentPath?: string)
  * than read off `header` so the rendered markup and its `data-variant` can
  * never disagree with the variant the assignment actually decided.
  */
+/**
+ * The header search form. `inMenu` is the copy placed inside the menu drawer
+ * (header.mobile.search "menu"); it carries its own input id so both can exist.
+ */
+function renderSearchForm(search: ChromeSearch, inMenu = false): string {
+  const id = inMenu ? "hdr-q-menu" : "hdr-q";
+  const button = search.buttonLabel
+    ? `<button type="submit" class="header-search__submit">${esc(search.buttonLabel)}</button>`
+    : `<button type="submit" aria-label="Search">${ICON_SEARCH}</button>`;
+  return (
+    `<form class="header-search${inMenu ? " header-search--menu" : ""}${search.buttonLabel ? " header-search--labelled" : ""}" action="${esc(search.action ?? "/search")}" method="get" role="search">\n` +
+    `      <label class="sr-only" for="${id}">${esc(search.label ?? "Search")}</label>\n` +
+    `      <input id="${id}" type="search" name="q" placeholder="${esc(search.placeholder ?? "Search")}" autocomplete="off">\n` +
+    `      ${button}\n` +
+    `    </form>`
+  );
+}
+
+/**
+ * Labelled header action links, in authored order. A `kind: "cart"` link carries
+ * the `cart` class, so bindManagedCartAnchors (lib/chrome/managedCart.ts) binds it
+ * to the managed checkout exactly like the icon cart.
+ */
+function renderActionLinks(links: ChromeHeaderActionLink[]): string {
+  return links
+    .map((l, i) => {
+      const kind = l.kind ?? "link";
+      const icon = !l.icon ? "" : kind === "account" ? ICON_ACCOUNT : kind === "cart" ? ICON_CART : "";
+      const stamp = trackingAttributesHtml({
+        el: l.id,
+        action: l.action,
+        tracking: l.tracking,
+        placement: CHROME_PLACEMENT.header,
+        scope: "header-actions",
+        index: i,
+      });
+      const cls = kind === "cart" ? "header-action cart" : "header-action";
+      const count = kind === "cart" ? `<span class="count">0</span>` : "";
+      return (
+        `<a class="${cls}" data-kind="${kind}" href="${esc(l.href)}"${relFor(l)}${stamp}>` +
+        `${icon}<span class="header-action__label">${esc(l.label)}</span>${count}</a>`
+      );
+    })
+    .join("");
+}
+
 function renderHeader(header: ChromeHeader, variant: HeaderVariant, currentPath?: string): string {
-  const search = header.search
-    ? `<form class="header-search" action="${esc(header.search.action ?? "/search")}" method="get" role="search">\n` +
-      `      <label class="sr-only" for="hdr-q">${esc(header.search.label ?? "Search")}</label>\n` +
-      `      <input id="hdr-q" type="search" name="q" placeholder="${esc(header.search.placeholder ?? "Search")}" autocomplete="off">\n` +
-      `      <button type="submit" aria-label="Search">${ICON_SEARCH}</button>\n` +
-      `    </form>`
-    : "";
+  const search = header.search ? renderSearchForm(header.search) : "";
   const memberCue = header.memberCue
     ? `<a class="member-cue" href="${esc(header.memberCue.href)}" aria-label="${esc(header.memberCue.label)}">${esc(header.memberCue.label)}</a>`
     : "";
-  const account = header.accountHref
+  // Labelled action links replace the icon account/cart pair rather than adding to it.
+  const actionLinks = header.actionLinks?.length ? renderActionLinks(header.actionLinks) : "";
+  const account = !actionLinks && header.accountHref
     ? `<a href="${esc(header.accountHref)}" aria-label="Account">${ICON_ACCOUNT}</a>`
     : "";
-  const cart = header.cartHref
+  const cart = !actionLinks && header.cartHref
     ? `<a class="cart" href="${esc(header.cartHref)}" aria-label="Cart">${ICON_CART}<span class="count">0</span></a>`
     : "";
   const compact = variant === "compact-centered";
   // "minimal" (e.g. checkout/policy pages): brand + a reduced action set only —
   // no primary nav bar, no search, no mobile-menu toggle. "primary": the full header.
   const minimal = variant === "minimal";
+  // Narrow-viewport arrangement, applied by commerce-chrome.css's max-width:860px
+  // block through these attributes. compact-centered already puts its menu
+  // button on the left, so `menu: "left"` moves the button only for the others.
+  const mobile = header.mobile ?? {};
+  const menuLeft = mobile.menu === "left" && !compact;
+  const searchInMenu = mobile.search === "menu" && !minimal && header.search !== undefined;
+  const mobileAttrs =
+    (mobile.menu === "left" ? ' data-mobile-menu="left"' : "") +
+    (mobile.brand === "center" ? ' data-mobile-brand="center"' : "") +
+    (searchInMenu ? ' data-mobile-search="menu"' : "");
   // Header CTAs, on the same `!minimal` rule the Astro SiteHeader applies, so the
   // two surfaces render the same governed config identically. Each carries its
   // identity attribute (ctaIdentityAttr, shared with SiteHeader.astro), so the
@@ -325,8 +379,10 @@ function renderHeader(header: ChromeHeader, variant: HeaderVariant, currentPath?
   const navItems = header.nav
     .map((item, i) => renderNavItem(item, i, currentPath))
     .join("\n          ");
+  const menuSearch = searchInMenu ? `        ${renderSearchForm(header.search!, true)}\n` : "";
   const primaryNav =
     `<nav class="primary-nav" id="primaryNav" aria-label="Primary">\n` +
+    menuSearch +
     `        <ul>\n          ${navItems}\n        </ul>\n` +
     `      </nav>`;
   const navBar = minimal
@@ -358,12 +414,13 @@ function renderHeader(header: ChromeHeader, variant: HeaderVariant, currentPath?
         `</nav>`
       : "";
   return (
-    `<header class="site-header" data-variant="${esc(variant)}">\n` +
+    `<header class="site-header" data-variant="${esc(variant)}"${mobileAttrs}>\n` +
     `  <div class="container header-row">\n` +
+    (menuLeft && hamburger ? `    ${hamburger}\n` : "") +
     (compact ? `    ${primaryNav}\n` : "") +
     `    ${renderBrand(header.brand)}\n` +
     (!minimal && !compact && search ? `    ${search}\n` : "") +
-    `    <div class="header-actions">${memberCue}${ctas}${compactSearch}${account}${cart}${hamburger}</div>\n` +
+    `    <div class="header-actions">${memberCue}${ctas}${compactSearch}${actionLinks}${account}${cart}${menuLeft ? "" : hamburger}</div>\n` +
     `  </div>\n` +
     navBar +
     `</header>` +
@@ -496,6 +553,11 @@ function renderFooter(footer: ChromeFooter): string {
         .map((p) => `<span>${esc(p)}</span>`)
         .join("")}</div>`
     : "";
+  // The merchant's own legal copy renders as written; the warning block always
+  // keeps its "WARNING:" label.
+  const disclaimer = footer.disclaimer?.trim()
+    ? `\n    <div class="footer-disclaimer"><p>${withBreaks(footer.disclaimer.trim())}</p></div>`
+    : "";
   const warning = footer.warning
     ? `\n    <div class="footer-warning"><p><strong>WARNING:</strong> ${esc(footer.warning)}</p></div>`
     : "";
@@ -525,7 +587,7 @@ function renderFooter(footer: ChromeFooter): string {
     `<footer class="site-footer" data-variant="${esc(footer.variant)}">\n` +
     `  <div class="container">\n` +
     `    <div class="footer-grid">\n${brandBlock}${columns}\n    </div>` +
-    `${trust}${social}${payments}${warning}${bottom}\n` +
+    `${trust}${social}${payments}${disclaimer}${warning}${bottom}\n` +
     `  </div>\n` +
     `</footer>`
   );

package/apps/storefront/src/lib/runtimeEnv.ts

@@ -22,7 +22,7 @@ let workerEnv: Record<string, unknown> | null | undefined;
 export async function getWorkerEnv(): Promise<Record<string, unknown> | null> {
   if (workerEnv !== undefined) return workerEnv;
   try {
-    // @ts-expect-error — virtual module, only resolvable in the Workers runtime.
+    // Only resolvable in the Workers runtime; types in lib/cloudflare-workers.d.ts.
     const mod = await import("cloudflare:workers");
     workerEnv = (mod.env ?? null) as Record<string, unknown> | null;
   } catch {

package/apps/storefront/src/lib/seo/documentTitle.ts

@@ -0,0 +1,19 @@
+/**
+ * The document `<title>` (also og:title / twitter:title).
+ *
+ * A page's own `seoTitle` is the merchant's complete title and renders verbatim,
+ * so a migrated page keeps its source title exactly ("About Us", or
+ * "Your first blog post! - Prime Vapor Club"). Without one, the page title is
+ * suffixed with the store's display name — unless it already carries it, so a
+ * title that names the store never repeats it.
+ *
+ * Pages and the home page pass their optional `seoTitle` as `seoTitle`. A blog
+ * post's `seoTitle` is required and importers default it to the post title, so
+ * posts pass it as `title`: one that names the store ("… - Prime Vapor Club")
+ * renders as written, any other is suffixed.
+ */
+export function documentTitle(title: string, seoTitle: string | undefined, storeName: string): string {
+  const verbatim = seoTitle?.trim();
+  if (verbatim) return verbatim;
+  return title.includes(storeName) ? title : `${title} — ${storeName}`;
+}

package/apps/storefront/src/lib/shared/addToRelease.ts

@@ -0,0 +1,32 @@
+/**
+ * Who may Add to release — integrate an accepted change into the store's
+ * `preview` release. Pure; shared by the integrate/resolve admission, the
+ * Publish console, and the Team page so all three answer one question.
+ */
+import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
+import { isOwnerCapability, type Capability } from "./capability";
+
+/** Pure inputs to the Add-to-release decision. */
+export interface AddToReleaseInput {
+  /** The viewer's standing over THIS tenant (owner/admin/member), if any. */
+  capability: string | null | undefined;
+  /** The viewer's live ship grant over this tenant. */
+  shipGrant: Capability;
+  /** True only when the viewer's access is bound to THIS tenant. */
+  tenantScoped: boolean;
+  /** The tenant's storefront mode — `"enabled"` means the store is paid. */
+  storefrontMode: string | null | undefined;
+}
+
+/**
+ * May this viewer add an accepted change to the store's `preview` release?
+ *
+ * Owner/admin standing or a ship-on-behalf grant always may. Before a store is
+ * paid there is no live site, so preview IS the site: a developer whose access is
+ * scoped to this tenant may add without a ship-on-behalf grant. Once the store is
+ * paid, the preview/live split and ship-on-behalf delegation apply.
+ */
+export function canAddToRelease(input: AddToReleaseInput): boolean {
+  if (isOwnerCapability(input.capability) || input.shipGrant === "ship-on-behalf") return true;
+  return input.tenantScoped && !storefrontModeAllowsGoLive(input.storefrontMode);
+}

package/apps/storefront/src/lib/storyblok/content-model.ts

@@ -59,6 +59,8 @@ export interface PromoTilesBlock {
 
 export interface HeroBlock {
   component: "hero";
+  /** Short plain-text status pill above the eyebrow (e.g. a fulfilment notice). */
+  notice?: string;
   /** The "thesis" line — the most characteristic thing about the catalog. */
   eyebrow?: string;
   headline: string;
@@ -121,6 +123,7 @@ export interface EditorialBlock {
   eyebrow?: string;
   title: string;
   body_html: string;
+  /** Generated placeholder art. With neither `image` nor `imageSeed` the block is text-only. */
   imageSeed?: string;
   /** Rehosted editorial photography; preferred over a generated placeholder. */
   image?: string;

package/apps/storefront/src/lib/styleGuideThemes.ts

@@ -17,14 +17,6 @@ const localThemeModules = import.meta.glob<Record<string, unknown>>(
   { eager: true, import: "default" },
 );
 
-const localChromeModules = import.meta.glob<Record<string, unknown>>(
-  [
-    "../../../../tenants/*/content/chrome.json",
-    "../../../../tenants/e2e/*/content/chrome.json",
-  ],
-  { eager: true, import: "default" },
-);
-
 function isTheme(value: unknown): value is StyleGuideTheme {
   return Boolean(
     value &&
@@ -89,19 +81,25 @@ export async function loadStyleGuideThemes(
   return localThemes(requestedTenant);
 }
 
-export async function loadStyleGuideChrome(
+/**
+ * Extra composition stylesheets a theme descriptor declares for its guide
+ * (`preview.stylesheets`). Only root-relative paths inside the requested
+ * tenant's own `/tenants/<tenant>/` tree are kept: a descriptor is tenant data,
+ * and the guide links nothing it cannot vouch is that tenant's.
+ */
+export function styleGuideCompositionSheets(
+  theme: Record<string, unknown>,
   requestedTenant: string,
-  resolvedTenant: { tenant_id: string; appDomain?: string },
-  content: Pick<ContentProvider, "getChrome">,
-): Promise<Record<string, unknown> | null> {
-  if (contentBelongsToRequestedTenant(requestedTenant, resolvedTenant)) {
-    try {
-      return (await content.getChrome()) as unknown as Record<string, unknown>;
-    } catch {
-      // A colocated build-time descriptor is the availability fallback.
-    }
-  }
-
-  const segment = `${tenantDirSegment(requestedTenant)}content/chrome.json`;
-  return Object.entries(localChromeModules).find(([path]) => path.includes(segment))?.[1] ?? null;
+): string[] {
+  const preview = theme.preview as { stylesheets?: unknown } | undefined;
+  const declared = Array.isArray(preview?.stylesheets) ? preview.stylesheets : [];
+  const prefix = `/tenants/${requestedTenant}/`;
+  return declared.filter(
+    (href): href is string =>
+      typeof href === "string" &&
+      href.startsWith(prefix) &&
+      href.endsWith(".css") &&
+      !href.includes("..") &&
+      !/[\s"'<>]/.test(href),
+  );
 }

package/apps/storefront/src/pages/[...slug].astro

@@ -7,13 +7,14 @@
  */
 import Layout from "@/layouts/Layout.astro";
 import Breadcrumbs from "@/components/Breadcrumbs.astro";
+import { homeCrumbLabel, siteTrail } from "@/lib/breadcrumbs";
 import ProseSections from "@/components/content/ProseSections.astro";
 import ProseToc from "@/components/content/ProseToc.astro";
 import { breadcrumbLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
 import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
-import { markPinnedRouteRewriteComplete } from "@/lib/pinnedRouteRewriteBoundary";
+import { rewriteThroughRenderChain } from "@/lib/pinnedRouteRewriteBoundary";
 
 const { tenant, canonicalBase, content, basePath, capabilities, features } = Astro.locals;
 const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
@@ -34,8 +35,9 @@ if (
 // dir, so the pages live under `/style-guide/…` and we rewrite the underscored URL
 // onto them. These are noindex + sitemap-excluded and never reskin the live site.
 if (slug === "_style-guide" || slug.startsWith("_style-guide/")) {
-  return markPinnedRouteRewriteComplete(
-    await Astro.rewrite("/style-guide/" + slug.slice("_style-guide".length + 1)),
+  return rewriteThroughRenderChain(
+    Astro,
+    "/style-guide/" + slug.slice("_style-guide".length + 1),
   );
 }
 
@@ -50,7 +52,9 @@ if (rawHtml && rawPolicy.allowed) {
   // a full document serves verbatim (backward-compatible). See rawMarketingHtml.ts.
   const chromeWrapper = await content.getChromeHtml(`/${slug}`);
   const notices = {
-    nicotineWarning: !!tenant.compliance?.nicotineWarning,
+    nicotineWarning: tenant.compliance?.nicotineWarning,
+    pactAct: !!tenant.compliance?.pactAct,
+    minAge: tenant.compliance?.minAge,
     shippingRestriction: tenant.compliance?.shippingRestriction,
     exciseTaxEnabled: capabilities.exciseTax.enabled && features.catalog,
   };
@@ -69,10 +73,10 @@ if (rawHtml && rawPolicy.allowed) {
 const page = await content.getPage(slug);
 if (!page) return new Response(null, { status: 404 });
 
-const crumbs = [
-  { label: tenant.displayName, href: "/" },
+const crumbs = siteTrail(
+  homeCrumbLabel(await Astro.locals.content.getChrome()),
   { label: page.title, href: `/${page.slug}` },
-];
+);
 
 const description =
   page.seoDescription ||
@@ -101,7 +105,8 @@ const updatedLabel = page.updated
 ---
 
 <Layout
-  title={page.seoTitle || page.title}
+  title={page.title}
+  seoTitle={page.seoTitle}
   description={description}
   path={`/${page.slug}`}
   ogType="article"