@tokenoftrust/storefront-runner 2.4.18 → 2.4.20

package/apps/storefront/src/config/publicationSpaceTopology.ts

@@ -64,6 +64,24 @@ export const PUBLICATION_SPACE_TOPOLOGY: Readonly<Record<string, PublicationTopo
       },
     ],
   },
+  // The same three-space shape, served by CloudFront: certifies the s3-overwrite publication path.
+  "fixture-cloudfront.e2e.test": {
+    root: { source: { forge: "fixture", repo: "fixture-cloudfront.e2e.test", defaultBranch: "main" } },
+    mounted: [
+      {
+        id: "fixture-cloudfront-docs",
+        source: { forge: "fixture", repo: "fixture-cloudfront.e2e.test-docs", defaultBranch: "main" },
+        mount: "/docs",
+        visibility: "public",
+      },
+      {
+        id: "fixture-cloudfront-internal",
+        source: { forge: "fixture", repo: "fixture-cloudfront.e2e.test-internal", defaultBranch: "main" },
+        mount: "/internal-docs",
+        visibility: "internal",
+      },
+    ],
+  },
   "chrome.e2e.test": {
     root: { source: { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" } },
   },

package/apps/storefront/src/lib/publication/mountedDiscovery.ts

@@ -0,0 +1,188 @@
+/**
+ * Mounted publication spaces in the tenant's discovery surfaces (sitemap.xml,
+ * llms.txt, feed.json, search-index.json).
+ *
+ * The root routes emit the root's own discovery; this module adds the mounted
+ * public spaces. Their entries are composed once per pointer change by the
+ * control plane (`composeMountedPublicationDiscoveryV1`, written by the
+ * Cloudflare projection and by the CloudFront aggregate render) and stored at
+ * {@link publicationMountedDiscoveryKeyV1}. Serving reads that projection and
+ * never composes: ADR 0013, recompute per change rather than per request.
+ *
+ * Reading re-checks every entry against current authority, so a stale or
+ * tampered projection cannot list anything the route plan does not serve
+ * publicly right now: the space must be a declared public mount whose live
+ * pointer is still the revision the entry was composed from, and the entry's
+ * path must resolve to that same space. Internal spaces fail every one of those
+ * checks, so they are excluded structurally, not by a flag.
+ */
+import {
+  compileRouteTierIndexV1,
+  parsePublicationVersionStateV1Json,
+  publicationVersionStateKey,
+  resolvePublicationRoutePlanV1,
+  resolveRouteTierV1,
+  type PublicationSpaceManifestV1,
+  type RouteTierIndexV1,
+  type TenantConfig,
+} from "@tot/public-runtime";
+
+export type DiscoverySurfaceV1 = "sitemap" | "feeds" | "publicSearch" | "llms";
+
+/** One mounted-space document listed on a discovery surface. */
+export interface MountedDiscoveryEntryV1 {
+  spaceId: string;
+  /** Tenant-relative canonical route (no trailing slash). */
+  canonicalPath: string;
+  title: string;
+  summary: string;
+  searchText: string;
+  publishedAt?: string;
+  updatedAt?: string;
+  surfaces: Record<DiscoverySurfaceV1, boolean>;
+}
+
+const MAX_ENTRIES = 10_000;
+const MAX_TEXT = 256 * 1024;
+const MAX_PROJECTION_CHARS = 32 * 1024 * 1024;
+const SURFACES: readonly DiscoverySurfaceV1[] = ["sitemap", "feeds", "publicSearch", "llms"];
+
+/** KV key of a tenant's composed mounted-space discovery projection. */
+export function publicationMountedDiscoveryKeyV1(tenant: string): string {
+  return `cust:publication-discovery:${tenant}`;
+}
+
+type DiscoveryTenantV1 = Pick<TenantConfig, "tenant_id" | "publicationSpaces">;
+
+function isPublicMount(manifest: PublicationSpaceManifestV1): boolean {
+  return manifest.routes.canonicalMount !== "/" && manifest.visibility === "public" &&
+    manifest.authorization.policy === "public" && manifest.assets.access === "public";
+}
+
+/** True when the tenant declares any space beside its root. */
+export function declaresMountedSpacesV1(tenant: DiscoveryTenantV1): boolean {
+  return (tenant.publicationSpaces ?? []).some((manifest) => manifest.routes.canonicalMount !== "/");
+}
+
+/**
+ * Whether a root route row may be listed. A path inside a mounted space belongs
+ * to that space: its own entries list it when it is public, and nothing does when
+ * it is internal. Root content can never list into a mount.
+ */
+export function rootOwnsDiscoveryPathV1(index: RouteTierIndexV1, path: string): boolean {
+  const route = resolveRouteTierV1(index, path);
+  return route.origin !== "publication-space" ||
+    (route.mount?.mount === "/" && route.visibility === "public");
+}
+
+function exactKeys(value: object, required: readonly string[], optional: readonly string[] = []): boolean {
+  const keys = Object.keys(value);
+  return required.every((key) => keys.includes(key)) &&
+    keys.every((key) => required.includes(key) || optional.includes(key));
+}
+
+function boundedString(value: unknown, allowEmpty = true): value is string {
+  return typeof value === "string" && value.length <= MAX_TEXT && (allowEmpty || value.length > 0);
+}
+
+function parseEntry(value: unknown): MountedDiscoveryEntryV1 | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const raw = value as Record<string, unknown>;
+  if (!exactKeys(raw, ["spaceId", "canonicalPath", "title", "summary", "searchText", "surfaces"],
+    ["publishedAt", "updatedAt"])) return null;
+  const surfaces = raw.surfaces;
+  if (!surfaces || typeof surfaces !== "object" || Array.isArray(surfaces) ||
+    !exactKeys(surfaces, SURFACES) ||
+    SURFACES.some((surface) => typeof (surfaces as Record<string, unknown>)[surface] !== "boolean")) return null;
+  if (!boundedString(raw.spaceId, false) || !boundedString(raw.canonicalPath, false) ||
+    !raw.canonicalPath.startsWith("/") || !boundedString(raw.title, false) ||
+    !boundedString(raw.summary) || !boundedString(raw.searchText) ||
+    (raw.publishedAt !== undefined && !boundedString(raw.publishedAt, false)) ||
+    (raw.updatedAt !== undefined && !boundedString(raw.updatedAt, false))) return null;
+  return {
+    spaceId: raw.spaceId,
+    canonicalPath: raw.canonicalPath,
+    title: raw.title,
+    summary: raw.summary,
+    searchText: raw.searchText,
+    ...(raw.publishedAt !== undefined ? { publishedAt: raw.publishedAt as string } : {}),
+    ...(raw.updatedAt !== undefined ? { updatedAt: raw.updatedAt as string } : {}),
+    surfaces: { ...(surfaces as Record<DiscoverySurfaceV1, boolean>) },
+  };
+}
+
+/**
+ * The mounted public spaces' entries currently servable for `tenant`, in
+ * canonical path order. Empty — the root routes then emit root-only output —
+ * whenever the tenant declares no public mount, no projection or state is
+ * readable, or the projection is malformed.
+ */
+export async function readMountedPublicationDiscoveryV1(input: {
+  tenant: DiscoveryTenantV1;
+  store?: { get(key: string): Promise<string | null> };
+  index?: RouteTierIndexV1;
+}): Promise<MountedDiscoveryEntryV1[]> {
+  const mounts = new Map((input.tenant.publicationSpaces ?? [])
+    .filter((manifest) => manifest.tenant === input.tenant.tenant_id && isPublicMount(manifest))
+    .map((manifest) => [manifest.id, manifest]));
+  if (mounts.size === 0 || !input.store) return [];
+  let projectionJson: string | null;
+  let stateJson: string | null;
+  try {
+    [projectionJson, stateJson] = await Promise.all([
+      input.store.get(publicationMountedDiscoveryKeyV1(input.tenant.tenant_id)),
+      input.store.get(publicationVersionStateKey(input.tenant.tenant_id)),
+    ]);
+  } catch {
+    return [];
+  }
+  if (!projectionJson || !stateJson || projectionJson.length > MAX_PROJECTION_CHARS) return [];
+  const state = parsePublicationVersionStateV1Json(stateJson);
+  if (!state.ok) return [];
+  let projection: unknown;
+  try {
+    projection = JSON.parse(projectionJson);
+  } catch {
+    return [];
+  }
+  if (!projection || typeof projection !== "object" || Array.isArray(projection) ||
+    !exactKeys(projection, ["version", "tenant", "spaces", "entries"])) return [];
+  const raw = projection as Record<string, unknown>;
+  if (raw.version !== 1 || raw.tenant !== input.tenant.tenant_id || !Array.isArray(raw.spaces) ||
+    !Array.isArray(raw.entries) || raw.entries.length > MAX_ENTRIES) return [];
+
+  // A space is listed only while its live pointer is the exact revision composed.
+  const current = new Set<string>();
+  for (const space of raw.spaces as unknown[]) {
+    if (!space || typeof space !== "object" || Array.isArray(space)) return [];
+    const { spaceId, revision, versionId } = space as Record<string, unknown>;
+    if (typeof spaceId !== "string" || !mounts.has(spaceId)) continue;
+    const live = state.value.pointers.find((pointer) => pointer.tenant === input.tenant.tenant_id &&
+      pointer.spaceId === spaceId && pointer.channel === "live");
+    if (live && live.revision === revision && live.versionId === versionId) current.add(spaceId);
+  }
+  if (current.size === 0) return [];
+
+  const index = input.index ?? compileRouteTierIndexV1(input.tenant);
+  const entries: MountedDiscoveryEntryV1[] = [];
+  const seen = new Set<string>();
+  for (const value of raw.entries as unknown[]) {
+    const entry = parseEntry(value);
+    if (!entry) return [];
+    if (!current.has(entry.spaceId) || seen.has(entry.canonicalPath)) continue;
+    const plan = resolvePublicationRoutePlanV1(index, entry.canonicalPath);
+    if (plan.action !== "render" || plan.manifest.id !== entry.spaceId ||
+      plan.canonicalPath !== entry.canonicalPath || !isPublicMount(plan.manifest)) continue;
+    seen.add(entry.canonicalPath);
+    entries.push(entry);
+  }
+  return entries.sort((left, right) =>
+    left.canonicalPath < right.canonicalPath ? -1 : left.canonicalPath > right.canonicalPath ? 1 : 0);
+}
+
+/** An RFC 3339 instant for a feed, or undefined when the value is not a date. */
+export function feedInstantV1(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? new Date(parsed).toISOString() : undefined;
+}

package/apps/storefront/src/lib/publication/rootDiscovery.ts

@@ -0,0 +1,97 @@
+/**
+ * The root site's own documents for the JSON discovery surfaces (feed.json,
+ * search-index.json), read through the request's resolved content provider so
+ * they follow the same published channel and visibility clock as the pages.
+ * Paths are spelled exactly as the root sitemap lists them.
+ */
+import type { APIContext } from "astro";
+import { listBlogPosts } from "@/lib/blog/provider.js";
+import { listBuildPosts } from "@/lib/the-build/provider.js";
+import { isIndexableHtml, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml.js";
+
+export interface RootDiscoveryDocumentV1 {
+  kind: "home" | "page" | "post";
+  /** Tenant-relative path as the root sitemap spells it. */
+  path: string;
+  title: string;
+  summary: string;
+  searchText: string;
+  publishedAt?: string;
+  updatedAt?: string;
+}
+
+function plain(value: string | undefined | null): string {
+  return (value ?? "").replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim();
+}
+
+function htmlTitle(html: string): string {
+  const match = /<title\b[^>]*>([\s\S]*?)<\/title\s*>/i.exec(html);
+  return plain(match?.[1]);
+}
+
+/** Root listable posts (blog and the-build), newest first as the collections list them. */
+export async function rootPostDocumentsV1(locals: APIContext["locals"]): Promise<RootDiscoveryDocumentV1[]> {
+  const { tenant, content, publicationTimestamp } = locals;
+  const [blogPosts, buildPosts] = await Promise.all([
+    listBlogPosts(tenant.tenant_id, content, publicationTimestamp),
+    listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp }),
+  ]);
+  return [
+    ...blogPosts.map((post) => ({ post, base: "/blog" })),
+    ...buildPosts.map((post) => ({ post, base: "/the-build" })),
+  ].map(({ post, base }) => {
+    const summary = plain(post.description || post.excerpt);
+    return {
+      kind: "post" as const,
+      path: `${base}/${post.slug}/`,
+      title: plain(post.title) || post.slug,
+      summary,
+      searchText: [plain(post.title), summary].filter(Boolean).join(" "),
+      ...(post.publishedAt ? { publishedAt: post.publishedAt } : {}),
+      ...(post.modifiedAt ? { updatedAt: post.modifiedAt } : {}),
+    };
+  });
+}
+
+/** Root home, editorial pages, indexable raw pages, and posts. */
+export async function rootSearchDocumentsV1(locals: APIContext["locals"]): Promise<RootDiscoveryDocumentV1[]> {
+  const { tenant, content, canonicalBase } = locals;
+  const base = canonicalBase.replace(/\/$/, "");
+  const [home, pages, rawSlugs, posts] = await Promise.all([
+    content.getHome().catch(() => null),
+    content.listPages(),
+    content.listPageHtmlSlugs(),
+    rootPostDocumentsV1(locals),
+  ]);
+  const homeSummary = plain(home?.seoDescription);
+  const documents: RootDiscoveryDocumentV1[] = [{
+    kind: "home",
+    path: "/",
+    title: plain(home?.seoTitle) || tenant.displayName,
+    summary: homeSummary,
+    searchText: [plain(home?.seoTitle) || tenant.displayName, homeSummary].filter(Boolean).join(" "),
+  }];
+  for (const page of pages) {
+    const summary = plain(page.seoDescription);
+    documents.push({
+      kind: "page",
+      path: `/${page.slug}`,
+      title: plain(page.seoTitle || page.title) || page.slug,
+      summary,
+      searchText: [plain(page.title), summary].filter(Boolean).join(" "),
+    });
+  }
+  const rawPages = await Promise.all(rawSlugs.map(async (slug) => ({ slug, html: await content.getPageHtml(slug) })));
+  for (const { slug, html } of rawPages) {
+    if (!html || !isIndexableHtml(html)) continue;
+    const title = htmlTitle(html) || slug;
+    documents.push({
+      kind: "page",
+      path: rawPageCanonicalUrl(canonicalBase, slug).slice(base.length) || "/",
+      title,
+      summary: "",
+      searchText: title,
+    });
+  }
+  return [...documents, ...posts];
+}

package/apps/storefront/src/pages/feed.json.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-tenant JSON Feed 1.1 (https://jsonfeed.org/version/1.1). The root
+ * syndicates its listable posts — the same visibility chokepoint the sitemap
+ * and `/the-build/rss.xml` ride, so drafts, unlisted and not-yet-due posts never
+ * appear — and each public mounted publication space adds the entries it
+ * declares for feeds. An internal space lists nothing.
+ */
+import type { APIContext } from "astro";
+import { compileRouteTierIndexV1 } from "@tot/public-runtime";
+import { readKv } from "@/lib/runtimeEnv.js";
+import {
+  declaresMountedSpacesV1,
+  feedInstantV1,
+  readMountedPublicationDiscoveryV1,
+  rootOwnsDiscoveryPathV1,
+} from "@/lib/publication/mountedDiscovery.js";
+import { rootPostDocumentsV1 } from "@/lib/publication/rootDiscovery.js";
+
+interface FeedItem {
+  id: string;
+  url: string;
+  title: string;
+  summary?: string;
+  content_text: string;
+  date_published?: string;
+  date_modified?: string;
+}
+
+function item(url: string, title: string, summary: string, text: string,
+  publishedAt?: string, updatedAt?: string): FeedItem {
+  const published = feedInstantV1(publishedAt);
+  const modified = feedInstantV1(updatedAt);
+  return {
+    id: url,
+    url,
+    title,
+    ...(summary ? { summary } : {}),
+    content_text: text || summary || title,
+    ...(published ? { date_published: published } : {}),
+    ...(modified ? { date_modified: modified } : {}),
+  };
+}
+
+export async function GET(context: APIContext): Promise<Response> {
+  const { tenant, canonicalBase } = context.locals;
+  const base = canonicalBase.replace(/\/$/, "");
+  const index = declaresMountedSpacesV1(tenant) ? compileRouteTierIndexV1(tenant) : null;
+
+  const items: FeedItem[] = (await rootPostDocumentsV1(context.locals))
+    .filter((doc) => !index || rootOwnsDiscoveryPathV1(index, doc.path))
+    .map((doc) => item(`${base}${doc.path}`, doc.title, doc.summary, doc.searchText, doc.publishedAt, doc.updatedAt));
+  if (index) {
+    const mounted = await readMountedPublicationDiscoveryV1({ tenant, store: await readKv("TENANT_CACHE"), index });
+    for (const entry of mounted) {
+      if (!entry.surfaces.feeds) continue;
+      items.push(item(`${base}${entry.canonicalPath}`, entry.title, entry.summary, entry.searchText,
+        entry.publishedAt, entry.updatedAt));
+    }
+  }
+
+  const body = `${JSON.stringify({
+    version: "https://jsonfeed.org/version/1.1",
+    title: tenant.displayName,
+    home_page_url: `${base}/`,
+    feed_url: `${base}/feed.json`,
+    items,
+  }, null, 2)}\n`;
+  return new Response(body, {
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "public, max-age=300, s-maxage=3600",
+    },
+  });
+}

package/apps/storefront/src/pages/llms.txt.ts

@@ -12,6 +12,13 @@
 import type { APIContext } from "astro";
 import { nonEmptyCollections } from "@/lib/tot/query.js";
 import { listBlogPosts } from "@/lib/blog/provider.js";
+import { compileRouteTierIndexV1 } from "@tot/public-runtime";
+import { readKv } from "@/lib/runtimeEnv.js";
+import {
+  declaresMountedSpacesV1,
+  readMountedPublicationDiscoveryV1,
+  rootOwnsDiscoveryPathV1,
+} from "@/lib/publication/mountedDiscovery.js";
 
 /** Collapse HTML/whitespace to a single trimmed line for a link description. */
 function oneLine(s: string | undefined, max = 140): string | undefined {
@@ -27,7 +34,7 @@ export async function GET(context: APIContext): Promise<Response> {
 
   // Use the request-resolved ContentProvider (locals.content) so any published /
   // dev-draft overlay is reflected, matching sitemap.xml.ts (not a fresh provider).
-  const [allCollections, activeProducts, pages, featured, home, blogPosts] =
+  const [allCollections, activeProducts, rootPages, featured, home, rootBlogPosts] =
     await Promise.all([
       tot.listCollections(),
       tot.getAllActiveProducts(),
@@ -39,6 +46,21 @@ export async function GET(context: APIContext): Promise<Response> {
   // Empty synthesized collections (no active members) never make the guide —
   // an LLM shouldn't be pointed at a URL that resolves to zero products.
   const collections = nonEmptyCollections(allCollections, activeProducts);
+  // Mounted publication spaces: root pages never list into a mount; each public
+  // mount's own entries follow the root sections (an internal mount lists nothing).
+  const hasMounts = declaresMountedSpacesV1(tenant);
+  const index = hasMounts ? compileRouteTierIndexV1(tenant) : null;
+  const pages = index
+    ? rootPages.filter((pg) => rootOwnsDiscoveryPathV1(index, `/${pg.slug}`))
+    : rootPages;
+  const rootOwnsBlogIndex = !index || rootOwnsDiscoveryPathV1(index, "/blog/");
+  const blogPosts = index
+    ? rootBlogPosts.filter((post) => rootOwnsDiscoveryPathV1(index, `/blog/${post.slug}/`))
+    : rootBlogPosts;
+  const mounted = index
+    ? (await readMountedPublicationDiscoveryV1({ tenant, store: await readKv("TENANT_CACHE"), index }))
+      .filter((entry) => entry.surfaces.llms)
+    : [];
 
   const lines: string[] = [`# ${tenant.displayName}`, ""];
 
@@ -85,7 +107,7 @@ export async function GET(context: APIContext): Promise<Response> {
 
   if (blogPosts.length) {
     lines.push("## Blog");
-    lines.push(`- [All articles](${base}/blog/)`);
+    if (rootOwnsBlogIndex) lines.push(`- [All articles](${base}/blog/)`);
     for (const post of blogPosts) {
       const desc = oneLine(post.description || post.excerpt);
       lines.push(`- [${post.title}](${base}/blog/${post.slug}/)${desc ? `: ${desc}` : ""}`);
@@ -93,6 +115,15 @@ export async function GET(context: APIContext): Promise<Response> {
     lines.push("");
   }
 
+  if (mounted.length) {
+    lines.push("## More content");
+    for (const entry of mounted) {
+      const desc = oneLine(entry.summary);
+      lines.push(`- [${oneLine(entry.title, 200) ?? entry.title}](${base}${entry.canonicalPath})${desc ? `: ${desc}` : ""}`);
+    }
+    lines.push("");
+  }
+
   lines.push("## Optional");
   lines.push(`- [Full product catalog (XML sitemap)](${base}/sitemap.xml)`);
   lines.push(`- [Search](${base}/search)`);

package/apps/storefront/src/pages/search-index.json.ts

@@ -0,0 +1,49 @@
+/**
+ * Per-tenant public search index: the root's home, editorial and indexable raw
+ * pages, and listable posts, plus every entry a public mounted publication
+ * space declares for public search. An internal space lists nothing. Catalog
+ * search stays on `/search`; products are not indexed here.
+ */
+import type { APIContext } from "astro";
+import { compileRouteTierIndexV1 } from "@tot/public-runtime";
+import { readKv } from "@/lib/runtimeEnv.js";
+import {
+  declaresMountedSpacesV1,
+  readMountedPublicationDiscoveryV1,
+  rootOwnsDiscoveryPathV1,
+} from "@/lib/publication/mountedDiscovery.js";
+import { rootSearchDocumentsV1 } from "@/lib/publication/rootDiscovery.js";
+
+interface SearchEntry {
+  canonicalPath: string;
+  canonicalUrl: string;
+  title: string;
+  summary: string;
+  searchText: string;
+}
+
+export async function GET(context: APIContext): Promise<Response> {
+  const { tenant, canonicalBase } = context.locals;
+  const base = canonicalBase.replace(/\/$/, "");
+  const index = declaresMountedSpacesV1(tenant) ? compileRouteTierIndexV1(tenant) : null;
+
+  const entries: SearchEntry[] = (await rootSearchDocumentsV1(context.locals))
+    .filter((doc) => !index || rootOwnsDiscoveryPathV1(index, doc.path))
+    .map((doc) => ({ canonicalPath: doc.path, canonicalUrl: `${base}${doc.path}`, title: doc.title,
+      summary: doc.summary, searchText: doc.searchText }));
+  if (index) {
+    const mounted = await readMountedPublicationDiscoveryV1({ tenant, store: await readKv("TENANT_CACHE"), index });
+    for (const entry of mounted) {
+      if (!entry.surfaces.publicSearch) continue;
+      entries.push({ canonicalPath: entry.canonicalPath, canonicalUrl: `${base}${entry.canonicalPath}`,
+        title: entry.title, summary: entry.summary, searchText: entry.searchText });
+    }
+  }
+
+  return new Response(`${JSON.stringify({ version: 1, entries }, null, 2)}\n`, {
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "public, max-age=300, s-maxage=3600",
+    },
+  });
+}

package/apps/storefront/src/pages/sitemap.xml.ts

@@ -16,6 +16,13 @@ import { resolveBlogIndexCopy } from "@/lib/blog/pagination.js";
 import { getTheBuildSettings, listBuildPosts } from "@/lib/the-build/provider.js";
 import { resolveTheBuildIndexCopy } from "@/lib/the-build/pagination.js";
 import { isIndexableHtml, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml.js";
+import { compileRouteTierIndexV1 } from "@tot/public-runtime";
+import { readKv } from "@/lib/runtimeEnv.js";
+import {
+  declaresMountedSpacesV1,
+  readMountedPublicationDiscoveryV1,
+  rootOwnsDiscoveryPathV1,
+} from "@/lib/publication/mountedDiscovery.js";
 
 interface SitemapUrl {
   loc: string;
@@ -119,6 +126,25 @@ export async function GET(context: APIContext): Promise<Response> {
     }
   }
 
+  // Mounted publication spaces: root rows never list into a mount, and each
+  // public mount lists its own entries (an internal mount lists nothing).
+  if (declaresMountedSpacesV1(tenant)) {
+    const index = compileRouteTierIndexV1(tenant);
+    const rootRows = urls.filter((u) => rootOwnsDiscoveryPathV1(index, u.loc.slice(base.length) || "/"));
+    urls.length = 0;
+    urls.push(...rootRows);
+    const listed = new Set(urls.map((u) => u.loc));
+    const mounted = await readMountedPublicationDiscoveryV1({ tenant, store: await readKv("TENANT_CACHE"), index });
+    for (const entry of mounted) {
+      if (!entry.surfaces.sitemap) continue;
+      const loc = `${base}${entry.canonicalPath}`;
+      if (listed.has(loc)) continue;
+      listed.add(loc);
+      const lastmod = entry.updatedAt ?? entry.publishedAt;
+      urls.push(lastmod ? { loc, lastmod } : { loc });
+    }
+  }
+
   const body = `<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
 ${urls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.18",
+  "version": "2.4.20",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",