@tokenoftrust/storefront-runner 2.4.43 → 2.4.45

package/apps/storefront/src/lib/dashboard/delegateGate.ts

@@ -27,18 +27,19 @@ import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSel
 
 /** What every viewer of an unpaid store is told in place of the delegate section. */
 export const UNPAID_DELEGATION_NOTE =
-  "Developers with preview access can already add changes to the site. Ship-on-behalf " +
-  "delegation becomes available once the live site is activated.";
+  "Developers you've invited can already add changes and publish them while the store is " +
+  "unpaid — no delegation needed. Ship-on-behalf delegation becomes available once the live " +
+  "site is activated.";
 
 /** The delegate section: an unpaid store's note, or the paid store's {@link DelegateGate}. */
 export type DelegateSection = { mode: "unpaid"; role: null; explanation: string } | DelegateGate;
 
 /**
- * Resolve the whole delegate section. Before a store is paid there is no live
- * site and preview-access developers can already add changes to the release
- * (the `merge-to-preview` admission class, lib/pipeline/admission.ts), so delegation has nothing to grant: every viewer, the
- * owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store resolves
- * {@link resolveDelegateGate} unchanged.
+ * Resolve the whole delegate section. Before a store is paid, an invited developer can
+ * already add changes AND publish them (both `merge-to-preview` and `publish-live` admit the
+ * "unpaid-store-developer" basis, lib/pipeline/admission.ts), so delegation has nothing to
+ * grant: every viewer, the owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store
+ * resolves {@link resolveDelegateGate} unchanged.
  */
 export function resolveDelegateSection(
   storefrontMode: string | null | undefined,

package/apps/storefront/src/middleware/renderChain.ts

@@ -752,11 +752,6 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // store below so cached copies carry them too.
   applySecurityHeaders(response.headers);
 
-  // Preview (test) output must never be indexed.
-  if (customization.noindex) {
-    response.headers.set("X-Robots-Tag", "noindex, nofollow");
-  }
-
   // Strict CSP — now ENFORCED in every environment (Epic S2). The report-only
   // rollout is complete: platform output is CSP-clean — inline styles are
   // externalized (`inlineStylesheets: "never"`), Astro's static inline scripts +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.43",
+  "version": "2.4.45",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/customization-preview.ts

@@ -15,8 +15,6 @@
  *   - **Tokens are tenant-bound.** A token minted for tenant A cannot preview
  *     tenant B (no cross-tenant leakage).
  *   - **Tokens expire.** `exp` is checked against the caller-supplied clock.
- *   - **Test is never indexable.** The resolution carries `noindex: true` so the
- *     middleware can set `X-Robots-Tag: noindex`.
  */
 
 /** Claims carried by a preview token. */
@@ -251,8 +249,6 @@ export interface EnvResolutionInput {
 
 export interface EnvResolution {
   env: CustomizationEnv;
-  /** Set `X-Robots-Tag: noindex` when true (test is never indexable). */
-  noindex: boolean;
   /** When set, the middleware should short-circuit with this status. */
   reject?: { status: number; message: string };
 }
@@ -277,12 +273,12 @@ export function isPreviewDispatcherPath(pathname: string): boolean {
 
 /**
  * Decide which customization environment to serve. A valid, unexpired,
- * tenant-matching `__preview`/`tot_preview` token grants `test` (noindex) on
- * ANY host — the token is checked before the host is, so a signed preview
- * link keeps working even when opened on the tenant's normal (non-`preview.*`)
- * host. Without such a token, production hosts always get `live`; preview
- * hosts are auth-gated and reject a missing/invalid/cross-tenant token. The
- * one exception is the token-dispenser path itself (see
+ * tenant-matching `__preview`/`tot_preview` token grants `test` on ANY host —
+ * the token is checked before the host is, so a signed preview link keeps
+ * working even when opened on the tenant's normal (non-`preview.*`) host.
+ * Without such a token, production hosts always get `live`; preview hosts
+ * are auth-gated and reject a missing/invalid/cross-tenant token. The one
+ * exception is the token-dispenser path itself (see
  * {@link isPreviewDispatcherPath}) — it renders the dispatcher's own minimal
  * page, never tenant content, so it's always `live`/no-token regardless of
  * host or token, rather than 401ing on the very request that would otherwise
@@ -292,7 +288,7 @@ export async function resolveCustomizationEnv(
   input: EnvResolutionInput,
 ): Promise<EnvResolution> {
   if (isPreviewDispatcherPath(input.pathname ?? "")) {
-    return { env: "live", noindex: false };
+    return { env: "live" };
   }
 
   const tokenResult =
@@ -300,36 +296,32 @@ export async function resolveCustomizationEnv(
       ? await verifyPreviewToken(input.secret, input.token, input.nowSeconds)
       : null;
   if (tokenResult?.ok && tokenResult.claims.tenantId === input.tenantId) {
-    return { env: "test", noindex: true };
+    return { env: "test" };
   }
 
   if (!input.isPreviewHost) {
-    return { env: "live", noindex: false };
+    return { env: "live" };
   }
   if (!input.secret) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 503, message: "Preview is not configured." },
     };
   }
   if (!input.token) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 401, message: "Preview token required." },
     };
   }
   if (!tokenResult!.ok) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 401, message: `Invalid preview token (${tokenResult!.reason}).` },
     };
   }
   return {
     env: "live",
-    noindex: true,
     reject: { status: 403, message: "Preview token is for a different tenant." },
   };
 }