@tokenoftrust/storefront-runner 2.2.85 → 2.2.87

package/apps/storefront/src/config/declaredTenantConfig.ts

@@ -0,0 +1,94 @@
+/**
+ * The render-time read of a tenant's declared platform config (`.tot/config.json`
+ * → siteType/compliance/capabilities/features; see
+ * `@tot/public-runtime/declared-tenant-config`). Every render applies it the same
+ * way, on top of the resolved tenant record:
+ *
+ *   1. the checkout's own file in the build tree — what `tot dev` grafts in and
+ *      what the static-publish build materializes from the tenant repo;
+ *   2. the per-environment artifact the reconcile derived from the same file at the
+ *      reconciled commit — what the hosted Worker serves preview and live from.
+ *
+ * Both are the same file at the same commit, so a tenant renders identically on
+ * every surface; a field honored by one is honored by all.
+ */
+import {
+  applyDeclaredTenantConfig,
+  declaredTenantConfig,
+  declaredTenantConfigArtifactPath,
+  type DeclaredTenantConfig,
+} from "@tot/public-runtime/declared-tenant-config";
+import {
+  readPublishedArtifact,
+  readVersionArtifact,
+  tenantIdFromPath,
+  type CustomizationEnv,
+  type TenantConfig,
+} from "@tot/public-runtime";
+
+// The checkout's own `.tot/config.json`, read eagerly (tiny JSON). From src/config/
+// the repo root is four levels up; both tenant tiers are globbed, and the explicit
+// `.tot` literal matches the dotdir.
+const checkoutConfigFiles = import.meta.glob<Record<string, unknown>>(
+  ["../../../../tenants/*/.tot/config.json", "../../../../tenants/e2e/*/.tot/config.json"],
+  { eager: true, import: "default" },
+);
+
+/** dir id → that checkout's parsed `.tot/config.json`. */
+export function checkoutTotConfigs(): Map<string, Record<string, unknown>> {
+  const map = new Map<string, Record<string, unknown>>();
+  for (const [key, config] of Object.entries(checkoutConfigFiles)) {
+    const id = tenantIdFromPath(key);
+    if (id && config && typeof config === "object") map.set(id, config);
+  }
+  return map;
+}
+
+/** The declaration in the checkout's own `.tot/config.json`, or `{}` when it has none. */
+export function checkoutDeclaredTenantConfig(tenantId: string): DeclaredTenantConfig {
+  return declaredTenantConfig(checkoutConfigFiles[`../../../../tenants/${tenantId}/.tot/config.json`]
+    ?? checkoutConfigFiles[`../../../../tenants/e2e/${tenantId}/.tot/config.json`]);
+}
+
+/** The declaration the reconcile published for this environment, or `{}`. */
+export async function publishedDeclaredTenantConfig(
+  kvGet: (key: string) => Promise<string | null>,
+  tenantId: string,
+  env: CustomizationEnv,
+): Promise<DeclaredTenantConfig> {
+  const raw = await readPublishedArtifact(kvGet, tenantId, env, declaredTenantConfigArtifactPath(tenantId));
+  if (!raw) return {};
+  try {
+    return declaredTenantConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+/** The declaration pinned to one immutable version (a candidate under review), or `{}`. */
+export async function versionDeclaredTenantConfig(
+  kvGet: (key: string) => Promise<string | null>,
+  tenantId: string,
+  versionId: string,
+): Promise<DeclaredTenantConfig> {
+  const raw = await readVersionArtifact(kvGet, tenantId, versionId, declaredTenantConfigArtifactPath(tenantId));
+  if (!raw) return {};
+  try {
+    return declaredTenantConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+/** The tenant as it renders in `env`: its record with every declaration applied. */
+export async function withDeclaredTenantConfig(
+  tenant: TenantConfig,
+  kvGet: (key: string) => Promise<string | null>,
+  env: CustomizationEnv,
+): Promise<TenantConfig> {
+  const fromCheckout = applyDeclaredTenantConfig(tenant, checkoutDeclaredTenantConfig(tenant.tenant_id));
+  return applyDeclaredTenantConfig(
+    fromCheckout,
+    await publishedDeclaredTenantConfig(kvGet, tenant.tenant_id, env),
+  );
+}

package/apps/storefront/src/middleware/renderChain.ts

@@ -97,6 +97,7 @@ import {
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
 import { declaredTenantOrigins } from "@/lib/tenantOrigins";
+import { withDeclaredTenantConfig } from "@/config/declaredTenantConfig";
 import {
   applyInternalContentResponsePolicy,
   internalContentGrantMatchesPlan,
@@ -147,7 +148,7 @@ export interface RenderChainInput {
 export const TENANT_ORIGINS_CAPTURE_HEADER = "x-tot-tenant-origins";
 
 export async function runRenderChain(input: RenderChainInput): Promise<Response> {
-  const { context, next, host, url, tenant, basePath, renderPath, cache, kv } = input;
+  const { context, next, host, url, tenant: tenantRecord, basePath, renderPath, cache, kv } = input;
   const { request, locals } = context;
   const isInternalPublication = input.publicationRoute.action !== "fail-closed" &&
     input.publicationRoute.manifest.visibility === "internal";
@@ -177,7 +178,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // pin can only ever name its own version; a mismatched/expired/absent token
   // falls through to the normal channel-resolved read below, same fail-closed
   // posture as the `__preview` token.
-  const candidatePin = await resolveCandidateContentPin(url, tenant.tenant_id);
+  const candidatePin = await resolveCandidateContentPin(url, tenantRecord.tenant_id);
   // Per-developer AI-edit draft: the signed
   // tot_dev_draft cookie's mere PRESENCE opts the request out of the shared page
   // cache below (a draft view must never be cached publicly); it's verified —
@@ -192,7 +193,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   const nowSeconds = Math.floor(Date.now() / 1000);
   const customization = await resolveCustomizationEnv({
     isPreviewHost,
-    tenantId: tenant.tenant_id,
+    tenantId: tenantRecord.tenant_id,
     token: previewToken,
     secret: previewSecret,
     nowSeconds,
@@ -230,6 +231,16 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     if (isInternalPublication) applyInternalContentResponsePolicy(response.headers);
     return response;
   }
+
+  // The tenant as it renders in THIS environment: its record with the declared
+  // `.tot/config.json` fields applied (compliance, siteType, capabilities,
+  // features). Everything below — static bundle, notices, gates, features,
+  // capabilities — reads this, never the bare record.
+  const tenant = await withDeclaredTenantConfig(
+    tenantRecord,
+    kv ? (key: string) => kv.get(key) : async () => null,
+    customization.env,
+  );
   const publicationTimestamp = publicationSource.status === "selected"
     ? publicationSource.publicationTimestamp
     : exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.85",
+  "version": "2.2.87",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -19,6 +19,7 @@
     "./durable-assets": "./src/durable-assets.ts",
     "./retention-holds": "./src/retention-holds.ts",
     "./tenant-embed-defaults": "./src/tenant-embed-defaults.mjs",
+    "./declared-tenant-config": "./src/declared-tenant-config.mjs",
     "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
     "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs",
     "./integration/visitor-region": "./src/integration/visitor-region.mjs"

package/packages/public-runtime/src/declared-tenant-config.d.mts

@@ -0,0 +1,22 @@
+/** Types for the dependency-free declared-tenant-config module (declared-tenant-config.mjs). */
+import type { TenantConfig } from "./tenant.js";
+
+export type DeclaredTenantConfigField = "siteType" | "compliance" | "capabilities" | "features";
+export type DeclaredTenantConfig = Partial<Pick<TenantConfig, DeclaredTenantConfigField>>;
+
+export const DECLARED_TENANT_CONFIG_FIELDS: readonly DeclaredTenantConfigField[];
+export const TOT_CONFIG_KEYS: readonly string[];
+export const COMPLIANCE_KEYS: readonly string[];
+export const FEATURE_KEYS: readonly string[];
+export const SITE_TYPES_LIST: readonly string[];
+export function declaredTenantConfig(config: unknown): DeclaredTenantConfig;
+export function isEmptyDeclaredTenantConfig(declared: DeclaredTenantConfig | null | undefined): boolean;
+export function applyDeclaredTenantConfig<T extends Partial<Pick<TenantConfig, DeclaredTenantConfigField>>>(
+  tenant: T,
+  declared: DeclaredTenantConfig | null | undefined,
+): T;
+export function readDeclaredTenantConfigAt(
+  source: { readFile(path: string, ref: string): Promise<string | null> },
+  ref: string,
+): Promise<DeclaredTenantConfig>;
+export function declaredTenantConfigArtifactPath(tenantId: string): string;

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -0,0 +1,150 @@
+/**
+ * The tenant's declared platform config: the `.tot/config.json` fields that become
+ * TenantConfig fields on every surface that renders the tenant.
+ *
+ * `.tot/config.json` is the ONE declared source for these fields. Every reader goes
+ * through this module:
+ *   - `tot dev` and the static-publish build read the checkout's own file from the
+ *     build tree (apps/storefront/src/config/resolver.ts `declaredConfigFor`);
+ *   - the hosted Worker reads the per-environment artifact the reconcile derives from
+ *     the same file at the reconciled commit (`declaredTenantConfigArtifactPath`);
+ *   - `tot validate` refuses any top-level key not in `TOT_CONFIG_KEYS`, so a field
+ *     no surface reads cannot pass validation.
+ * All of them apply it with `applyDeclaredTenantConfig`, so a field honored on one
+ * surface is honored on all of them.
+ *
+ * Plain JS on purpose (same reason as embed-catalog.mjs): plain-`node` tooling and
+ * the CLI's parity test read it alongside the TypeScript runtime.
+ */
+
+/** `.tot/config.json` keys that become TenantConfig fields. */
+export const DECLARED_TENANT_CONFIG_FIELDS = Object.freeze([
+  "siteType",
+  "compliance",
+  "capabilities",
+  "features",
+]);
+
+/**
+ * Every top-level `.tot/config.json` key the platform reads: the reconcile mapping
+ * keys, the CLI's host hint, provenance markers (`sample` from `tot dev --sample`,
+ * `seed` from the tot-mcp repo seed), an editor's `$schema`, and the declared
+ * TenantConfig fields.
+ */
+export const TOT_CONFIG_KEYS = Object.freeze([
+  "$schema",
+  "tenant",
+  "scope",
+  "mappings",
+  "hostPlatform",
+  "sample",
+  "seed",
+  ...DECLARED_TENANT_CONFIG_FIELDS,
+]);
+
+/** Every `compliance` key the platform renders or enforces (ComplianceConfig, tenant.ts). */
+export const COMPLIANCE_KEYS = Object.freeze([
+  "ruleProfile",
+  "minAge",
+  "nicotineWarning",
+  "shippingRestriction",
+  "pactAct",
+  "adultSignature",
+  "prop65",
+  "purchaseLimit",
+  "stateEligibility",
+  "exciseTax",
+]);
+
+/** Every `features` key (TenantFeatures, tenant.ts). */
+export const FEATURE_KEYS = Object.freeze([
+  "catalog",
+  "productSearch",
+  "savedItems",
+  "quickView",
+  "newsletter",
+  "commerceSitemap",
+  "productJsonLd",
+  "ageGate",
+]);
+
+/** Every `siteType` value (SiteType, tenant.ts). */
+export const SITE_TYPES_LIST = Object.freeze(["commerce", "marketing"]);
+
+const SITE_TYPES = new Set(SITE_TYPES_LIST);
+
+const isPlainObject = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+
+/**
+ * The declared TenantConfig fields from a parsed `.tot/config.json`. A field whose
+ * value has the wrong shape is omitted, never coerced (`tot validate` reports it).
+ *
+ * @param {unknown} config
+ */
+export function declaredTenantConfig(config) {
+  /** @type {Record<string, unknown>} */
+  const out = {};
+  if (!isPlainObject(config)) return out;
+  const { siteType, compliance, capabilities, features } = /** @type {Record<string, unknown>} */ (config);
+  if (typeof siteType === "string" && SITE_TYPES.has(siteType)) out.siteType = siteType;
+  if (isPlainObject(compliance)) out.compliance = compliance;
+  if (isPlainObject(capabilities)) out.capabilities = capabilities;
+  if (isPlainObject(features)) out.features = features;
+  return out;
+}
+
+/** True when the declaration sets nothing. */
+export function isEmptyDeclaredTenantConfig(declared) {
+  return !declared || Object.keys(declared).length === 0;
+}
+
+/**
+ * Overlay a declaration onto a resolved tenant. `siteType` is replaced; the object
+ * fields merge key by key, so a declaration adds to — and can set individual keys
+ * of — what the platform record already carries, but never erases a key it omits.
+ *
+ * @template T
+ * @param {T} tenant
+ * @param {Record<string, unknown> | null | undefined} declared
+ * @returns {T}
+ */
+export function applyDeclaredTenantConfig(tenant, declared) {
+  if (isEmptyDeclaredTenantConfig(declared)) return tenant;
+  const out = /** @type {Record<string, unknown>} */ ({ ...tenant });
+  for (const field of DECLARED_TENANT_CONFIG_FIELDS) {
+    const value = declared[field];
+    if (value === undefined) continue;
+    out[field] = isPlainObject(value) && isPlainObject(out[field])
+      ? { ...out[field], ...value }
+      : value;
+  }
+  return /** @type {T} */ (out);
+}
+
+/**
+ * The declaration a tenant repo commits at `ref`, read through any source with the
+ * reconcile's `readFile(path, ref)` shape. `{}` when the file is absent or unreadable.
+ *
+ * @param {{ readFile(path: string, ref: string): Promise<string | null> }} source
+ * @param {string} ref
+ */
+export async function readDeclaredTenantConfigAt(source, ref) {
+  try {
+    const raw = await source.readFile(".tot/config.json", ref);
+    return raw ? declaredTenantConfig(JSON.parse(raw)) : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Artifact path of the declaration the reconcile derives by reading `.tot/config.json`,
+ * in the same colocated `tenants/<id>/…` space as theme/capabilities so it is
+ * pinned per version and resolved per environment like every other artifact.
+ *
+ * @param {string} tenantId
+ */
+export function declaredTenantConfigArtifactPath(tenantId) {
+  return `tenants/${tenantId}/tenant-config.json`;
+}

package/packages/public-runtime/src/publication-redirects.d.mts

@@ -1,14 +1,19 @@
-/** Types for the dependency-free redirect decision core (publication-redirects.mjs). */
+/** Types for the redirect contract (agency-kit/tools/lib/redirect-declaration.mjs), re-exported here. */
 
 export const REDIRECT_STATUS: 308;
-export const EDGE_FUNCTION_CODE_LIMIT_BYTES: number;
-export const EDGE_FUNCTION_RESERVED_BYTES: number;
+export const KVS_STORE_LIMIT_BYTES: number;
+export const KVS_KEY_LIMIT_BYTES: number;
+export const KVS_VALUE_LIMIT_BYTES: number;
+export const KVS_RESERVED_BYTES: number;
 export const REDIRECT_MAP_BUDGET_BYTES: number;
+export const REDIRECT_KEY_OVERHEAD_BYTES: number;
+export const REDIRECT_RULE_MAX_DEPTHS: number;
 export const COLLECTION_REDIRECTS_PATH: RegExp;
 export const SITE_REDIRECTS_PATH: "content/redirects.json";
 export const WHOLE_SITE_DELIVERY_CONTRACT: string;
 
 export interface DeclaredRedirect {
+  /** An exact request path, or a `/<dir>/*` rule. */
   from: string;
   to: string;
   /** Which declaration produced it, named in any refusal. */
@@ -21,9 +26,24 @@ export interface RedirectSet {
   violations: string[];
   bytes: number;
   budget: number;
+  /** How many entries are `/<dir>/*` rules. */
+  rules: number;
 }
 
 export function normalizeRedirectPath(raw: string): string | null;
+export function normalizeRedirectSource(raw: string): string | null;
+export function ruleDirectory(raw: string): string | null;
+export function isRedirectRule(from: string): boolean;
+export function redirectRequestPath(pathname: string): string;
+export function ruleLocation(to: string, capture: string): string | null;
+export function resolveRedirect(
+  redirects: readonly { from: string; to: string }[],
+  pathname: string,
+): { from: string; to: string; location: string } | null;
+export function redirectResolver(
+  entries: readonly { from: string; to: string }[],
+): (pathname: string) => { from: string; to: string; location: string } | null;
+export function redirectRuleDepths(redirects: readonly { from: string }[]): number[];
 export function redirectsFromCollection(
   collection: string,
   rows: Record<string, unknown>,
@@ -38,7 +58,6 @@ export function redirectsFromAliases(
   source?: string,
 ): DeclaredRedirect[];
 export function buildRedirectSet(declared: DeclaredRedirect[], budget?: number): RedirectSet;
-export function serializeRedirectMap(redirects: { from: string; to: string }[]): string;
 export function aliasesFromRedirectSet(
   set: RedirectSet,
 ): { from: string; behavior: "redirect-308"; to: string }[];