@tokenoftrust/storefront-runner 2.4.33 → 2.4.35

package/apps/storefront/src/config/publicationSpaceTopology.ts

@@ -37,18 +37,10 @@ export interface PublicationTopologyDeclarationV1 {
  */
 export const PUBLICATION_SPACE_TOPOLOGY: Readonly<Record<string, PublicationTopologyDeclarationV1>> = {
   home: { root: { source: { forge: "fixture", repo: "home", defaultBranch: "main" } } },
+  // Root-only until its `articles` space goes live: /blog serves from root content. Go-live
+  // step 1 applies docs/playbooks/tokenoftrust-articles-mount-go-live.patch.
   "tokenoftrust.com": {
     root: { source: { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" } },
-    mounted: [
-      {
-        id: "articles",
-        source: { forge: "gitea", repo: "tokenoftrust.com-publications", defaultBranch: "main" },
-        mount: "/blog",
-        visibility: "public",
-        // Decision m1b-mount-layout-2026-10-12: posts, index and archives at /blog/..., as today.
-        collections: { blog: "" },
-      },
-    ],
   },
   "storefront.tokenoftrust.store": {
     root: { source: { forge: "gitea", repo: "storefront.tokenoftrust.store", defaultBranch: "main" } },

package/apps/storefront/src/lib/integration/nonceStamp.ts

@@ -50,6 +50,16 @@ export function carriesLiveNonce(response: Response): boolean {
   });
 }
 
+/**
+ * True for the response Astro replaces with its error page: status 404 or 500 and
+ * no body (`astro/dist/core/routing/handler.js`, REROUTABLE_STATUS_CODES). Astro
+ * renders that page in a separate middleware pass and then lets THIS response's
+ * headers override the page's own, so this response must carry no CSP.
+ */
+export function isErrorPageReroute(response: Response): boolean {
+  return response.body === null && (response.status === 404 || response.status === 500);
+}
+
 /** A fresh, non-guessable per-response nonce. */
 export function freshNonce(): string {
   return crypto.randomUUID();

package/apps/storefront/src/middleware/renderChain.ts

@@ -92,7 +92,12 @@ import {
   deriveSiteSurface,
   cspHeaderName,
 } from "@/lib/integration/browserEnvironment";
-import { carriesLiveNonce, freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
+import {
+  carriesLiveNonce,
+  freshNonce,
+  isErrorPageReroute,
+  stampResponseNonce,
+} from "@/lib/integration/nonceStamp";
 import {
   composeIntegrationDeclarations,
   resolveIntegrationRenderState,
@@ -712,12 +717,19 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? await next(rewriteTarget)
     : await next();
 
-  // A nested pass of this middleware — an in-process `rewrite()`, or Astro re-running
-  // middleware for its error route — already decorated and nonce-stamped the
-  // response. Serve it verbatim: decorating again would inject preview helpers twice
-  // and replace the header's nonce while the document keeps the inner one.
+  // A nested pass of this middleware (an in-process `rewrite()`) already decorated
+  // and nonce-stamped the response. Serve it verbatim: decorating again would inject
+  // preview helpers twice and replace the header's nonce while the document keeps
+  // the inner one.
   if (carriesLiveNonce(response)) return response;
 
+  // A body-less 404/500 is Astro's cue to render the error page in its OWN pass of
+  // this middleware and then copy THIS response's headers over that page's
+  // (astro/dist/core/errors/default-handler.js `mergeResponses`). A CSP set here
+  // would win over the error page's, naming this pass's nonce while its document
+  // carries the error pass's — so leave it to the pass that renders the document.
+  if (isErrorPageReroute(response)) return response;
+
   // On-publish auto-refresh: inject the live-reload client into SHARED preview
   // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).
   // It polls /api/preview/version and reloads when this tenant's cache-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.33",
+  "version": "2.4.35",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",