@tokenoftrust/storefront-runner 2.5.1 → 2.5.3

package/apps/storefront/src/lib/assets/captured-original-serve.ts

@@ -5,7 +5,10 @@
  * when the sealed revision manifest names the address.
  */
 import { sha256Hex } from "@tot/public-runtime";
+import { CAPTURABLE_RASTER_MEDIA_TYPES, PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE } from "@tot/public-runtime/hosted-image-media-types";
+import { durableAssetsStatusKey, durableCaptureRevisionId, durableRequiredStores, parseDurableAssetsStatus } from "@tot/public-runtime/durable-assets";
 
+const CAPTURE_TYPES = new Set<string>(CAPTURABLE_RASTER_MEDIA_TYPES);
 const ADDRESS_RE = /^[0-9a-f]{64}$/;
 /** Hostname-like tenant ids (no scheme, no path separators). */
 const TENANT_ID_RE = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/i;
@@ -37,10 +40,11 @@ export type CapturedOriginalBucket = {
   get(key: string): Promise<unknown>;
 };
 
-type ManifestEntry = {
+export type ManifestEntry = {
   address: string;
   byteLength: number;
   mediaType: string;
+  provenance?: { kind: "local" | "remote"; locator: string };
 };
 
 function objectKey(tenantId: string, address: string): string {
@@ -60,12 +64,13 @@ async function readManifestEntries(
   revisionId: string,
 ): Promise<ManifestEntry[] | null> {
   if (!isSafeTenantId(tenantId) || !isSafeRevisionId(revisionId)) return null;
+  const object = await bucket.get(originalImageManifestObjectKey(tenantId, revisionId));
+  if (!object || typeof object !== "object") return null;
+  const body = object as { arrayBuffer?: () => Promise<ArrayBuffer> };
+  if (typeof body.arrayBuffer !== "function") return null;
+  const bytes = await body.arrayBuffer();
   try {
-    const object = await bucket.get(originalImageManifestObjectKey(tenantId, revisionId));
-    if (!object || typeof object !== "object") return null;
-    const body = object as { arrayBuffer?: () => Promise<ArrayBuffer> };
-    if (typeof body.arrayBuffer !== "function") return null;
-    const parsed = JSON.parse(new TextDecoder().decode(new Uint8Array(await body.arrayBuffer()))) as {
+    const parsed = JSON.parse(new TextDecoder().decode(new Uint8Array(bytes))) as {
       version?: unknown;
       revisionId?: unknown;
       entries?: unknown;
@@ -78,11 +83,13 @@ async function readManifestEntries(
       if (!raw || typeof raw !== "object") return null;
       const entry = raw as Partial<ManifestEntry>;
       if (typeof entry.address !== "string" || !ADDRESS_RE.test(entry.address)) return null;
-      if (typeof entry.byteLength !== "number" || typeof entry.mediaType !== "string") return null;
+      if (!Number.isSafeInteger(entry.byteLength) || entry.byteLength! < 1 || entry.byteLength! > 8 * 1024 * 1024 ||
+          typeof entry.mediaType !== "string" || !CAPTURE_TYPES.has(entry.mediaType)) return null;
       entries.push({
         address: entry.address,
-        byteLength: entry.byteLength,
-        mediaType: entry.mediaType,
+        byteLength: entry.byteLength!,
+        mediaType: entry.mediaType!,
+        provenance: entry.provenance,
       });
     }
     return entries;
@@ -91,6 +98,31 @@ async function readManifestEntries(
   }
 }
 
+/** Resolve an active, provider-verified designation through its tenant-scoped sealed capture. */
+export async function readDurableCapturedEntry(input: {
+  bucket: CapturedOriginalBucket;
+  kv: { get(key: string): Promise<string | null> };
+  tenantId: string;
+  provider: string | null | undefined;
+  address: string;
+}): Promise<ManifestEntry | null> {
+  if (!isSafeTenantId(input.tenantId) || !ADDRESS_RE.test(input.address)) return null;
+  const required = durableRequiredStores(input.provider);
+  if (!required) return null;
+  const record = parseDurableAssetsStatus(await input.kv.get(durableAssetsStatusKey(input.tenantId)), input.tenantId);
+  if (!record) return null;
+  for (const designation of record.entries) {
+    if (typeof designation.entry !== "string" || !designation.entry.startsWith(`${input.address}.`) ||
+        !Array.isArray(designation.verifiedStores) || !required.every((store) => designation.verifiedStores.includes(store)) ||
+        typeof designation.designatedRevision !== "string" || !isSafeRevisionId(designation.designatedRevision)) continue;
+    const entries = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(designation.designatedRevision));
+    const entry = entries?.find((entry) => entry.address === input.address &&
+      designation.entry === `${entry.address}${PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE[entry.mediaType]}`);
+    if (entry) return entry;
+  }
+  return null;
+}
+
 /**
  * Serve a captured original for the exact tenant+revision, or null to fall through.
  * Missing/unbound/tampered addresses are 404 with no locator or digest in the body.
@@ -98,18 +130,33 @@ async function readManifestEntries(
 export async function tryServeCapturedOriginal(input: {
   bucket: CapturedOriginalBucket;
   tenantId: string;
-  revisionId: string;
+  revisionId?: string;
+  durable?: { kv: { get(key: string): Promise<string | null> }; provider: string | null | undefined };
   pathname: string;
   method?: string;
 }): Promise<Response | null> {
   const parsed = parsePinnedImagePath(input.pathname);
   if (!parsed) return null;
-  if (!isSafeTenantId(input.tenantId) || !isSafeRevisionId(input.revisionId)) {
+  if (!isSafeTenantId(input.tenantId) || (input.revisionId !== undefined && !isSafeRevisionId(input.revisionId))) {
     return new Response("Not found", { status: 404, headers: { "cache-control": "no-store" } });
   }
 
-  const entries = await readManifestEntries(input.bucket, input.tenantId, input.revisionId);
-  const entry = entries?.find((item) => item.address === parsed.address);
+  const entries = input.revisionId ? await readManifestEntries(input.bucket, input.tenantId, input.revisionId).catch(() => null) : null;
+  let entry = entries?.find((item) => item.address === parsed.address);
+  let durable = false;
+  if (!entry && input.revisionId) {
+    const declared = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(input.revisionId)).catch(() => null);
+    entry = declared?.find((item) => item.address === parsed.address);
+    durable = !!entry;
+  }
+  if (!entry && input.durable) {
+    try {
+      entry = await readDurableCapturedEntry({ bucket: input.bucket, tenantId: input.tenantId,
+        address: parsed.address, ...input.durable }) ?? undefined;
+      durable = !!entry;
+    } catch { /* Unreadable durable authority fails closed. */ }
+  }
+  if (entry && parsed.ext && EXT_TYPE[parsed.ext.toLowerCase()] !== entry.mediaType) entry = undefined;
   if (!entry) {
     return new Response("Not found", { status: 404, headers: { "cache-control": "no-store" } });
   }
@@ -134,8 +181,8 @@ export async function tryServeCapturedOriginal(input: {
     const contentType = EXT_TYPE[parsed.ext.toLowerCase()] ?? entry.mediaType;
     const headers: Record<string, string> = {
       "content-type": contentType,
-      "cache-control": "public, max-age=31536000, immutable",
-      "x-tot-original-image": "revision-bound",
+      "cache-control": durable ? "no-store" : "public, max-age=31536000, immutable",
+      "x-tot-original-image": durable ? "durable" : "revision-bound",
       "content-length": String(bytes.byteLength),
     };
     const method = (input.method ?? "GET").toUpperCase();

package/apps/storefront/src/lib/assets/preview-pinned-image-urls.ts

@@ -0,0 +1,25 @@
+/** Keep captured-image requests inside the selected tenant on path-routed hosted previews. */
+export async function scopePreviewPinnedImageUrls(response: Response, basePath: string): Promise<Response> {
+  if (!basePath || !response.body || !(response.headers.get("content-type") ?? "").includes("text/html")) return response;
+  const html = await response.text();
+  const scoped = prefixPreviewPinnedImageUrls(html, basePath);
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  headers.delete("etag");
+  return new Response(scoped, { status: response.status, statusText: response.statusText, headers });
+}
+
+/** Scope only exact captured-image addresses; platform assets and external URLs retain their host. */
+export function prefixPreviewPinnedImageUrls(html: string, basePath: string): string {
+  if (!basePath) return html;
+  return html.replace(/([\s"'(=,])\/_a\/([0-9a-f]{64}(?:\.[A-Za-z0-9]+)?)(?=[\s"'?#),<>]|$)/g,
+    (_match, before: string, entry: string) => `${before}${basePath}/_a/${entry}`);
+}
+
+/** Choose asset routing from the resolved request tenant, never a second host-membership check. */
+export function previewPinnedImageBasePath(tenant: {
+  tenant_id: string; appDomain?: string;
+}, routing: { tenantId: string | undefined; basePath: string }): string {
+  if (routing.tenantId === tenant.tenant_id) return routing.basePath;
+  return tenant.appDomain && /^[a-z0-9.-]+$/i.test(tenant.appDomain) ? `/${tenant.appDomain}` : "";
+}

package/apps/storefront/src/lib/content/seo/structuredData.ts

@@ -88,26 +88,28 @@ export function composeStructuredData(input: ComposeInput): Node | null {
   const nameOf = (type: "Product" | "ProductGroup" | "Article" | "BlogPosting", own: string | undefined, fallback: "documentTitle" | "title") =>
     (profile.names?.[type] ?? fallback) === "documentTitle" ? documentTitle : own || documentTitle;
 
-  const siteToken = tokens.find((t) => SITE_TOKENS.has(t));
-  const siteTypes = siteToken ? siteToken.split("+") : [];
-  const siteId = `${base}/#${siteTypes.includes("Person") ? "person" : "organization"}`;
-  const imageUrl = page.image ? absolute(page.image, canonicalBase) : null;
-  const imageId = imageUrl ?? undefined;
-  const pageToken = tokens.find((t) => PAGE_ENTITY_TOKENS.has(t));
-  const pageId = `${canonical}#webpage`;
-  const authorId = page.author ? `${page.author.url ? absolute(page.author.url, canonicalBase) : canonical}#author` : undefined;
-  const ref = (id: string | undefined) => (id ? { "@id": id } : undefined);
-  const pageUrl = (href: string) => pageUrlForm(absolute(href, canonicalBase), tenant.seo);
-
   const pathOf = (value: string) => value.replace(/\/+$/, "") || "/";
   const here = pathOf(new URL(canonical).pathname);
   const scoped = (token: StructuredDataNodeToken) => {
     const paths = profile.onlyOn?.[token];
     return !paths || paths.some((p) => pathOf(p) === here);
   };
+  const imageUrl = page.image ? absolute(page.image, canonicalBase) : null;
+  // References and node emission share the same effective selection, including data availability.
+  const emittedTokens = tokens.filter(scoped).filter((token) =>
+    token === "ImageObject" ? imageUrl !== null : token === "Person:author" ? Boolean(page.author) : true);
+  const siteToken = emittedTokens.find((t) => SITE_TOKENS.has(t));
+  const siteTypes = siteToken ? siteToken.split("+") : [];
+  const siteId = `${base}/#${siteTypes.includes("Person") ? "person" : "organization"}`;
+  const imageId = emittedTokens.includes("ImageObject") ? imageUrl : undefined;
+  const pageToken = emittedTokens.find((t) => PAGE_ENTITY_TOKENS.has(t));
+  const pageId = `${canonical}#webpage`;
+  const authorId = emittedTokens.includes("Person:author") && page.author
+    ? `${page.author.url ? absolute(page.author.url, canonicalBase) : canonical}#author` : undefined;
+  const pageUrl = (href: string) => pageUrlForm(absolute(href, canonicalBase), tenant.seo);
 
   const nodes: Node[] = [];
-  for (const token of tokens.filter(scoped)) {
+  for (const token of emittedTokens) {
     const node = buildNode(token);
     if (node) nodes.push(node);
   }
@@ -120,7 +122,7 @@ export function composeStructuredData(input: ComposeInput): Node | null {
         "@type": siteTypes.length > 1 ? siteTypes : siteTypes[0],
         "@id": siteId,
         name: tenant.displayName,
-        url: base,
+        url: pageUrlForm(base, tenant.seo),
         ...(logo && siteTypes.includes("Organization") ? { logo: { "@type": "ImageObject", url: absolute(logo, canonicalBase) } } : {}),
       };
     }
@@ -131,7 +133,7 @@ export function composeStructuredData(input: ComposeInput): Node | null {
         url: canonical,
         name: documentTitle,
         ...(page.description ? { description: page.description } : {}),
-        isPartOf: { "@id": `${base}/#website` },
+        ...(emittedTokens.includes("WebSite") ? { isPartOf: { "@id": `${base}/#website` } } : {}),
         ...(imageId ? { primaryImageOfPage: { "@id": imageId } } : {}),
         ...(page.datePublished ? { datePublished: page.datePublished } : {}),
         ...(page.dateModified ? { dateModified: page.dateModified } : {}),
@@ -143,7 +145,7 @@ export function composeStructuredData(input: ComposeInput): Node | null {
         return {
           "@type": "WebSite",
           "@id": `${base}/#website`,
-          url: base,
+          url: pageUrlForm(base, tenant.seo),
           name: tenant.displayName,
           ...(siteToken ? { publisher: { "@id": siteId } } : {}),
           inLanguage: lang,

package/apps/storefront/src/lib/content/shared/jsonld.ts

@@ -3,6 +3,7 @@
  * BreadcrumbList, Organization. Kept pure so pages compose them and pass to <Seo>.
  */
 import type { CatalogProduct, Review, TenantConfig } from "@tot/public-runtime";
+import { pageUrlForm } from "../seo/urlForm.js";
 import { isAvailable } from "../../catalog/tot/query.js";
 
 export function organizationLd(tenant: TenantConfig, base: string) {
@@ -20,7 +21,7 @@ export function organizationLd(tenant: TenantConfig, base: string) {
     "@context": "https://schema.org",
     "@type": "Organization",
     name: tenant.displayName,
-    url: base,
+    url: pageUrlForm(base, tenant.seo),
     logo,
   };
 }
@@ -53,7 +54,7 @@ export function websiteLd(tenant: TenantConfig, base: string) {
     "@context": "https://schema.org",
     "@type": "WebSite",
     name: tenant.displayName,
-    url: base,
+    url: pageUrlForm(base, tenant.seo),
     potentialAction: {
       "@type": "SearchAction",
       target: {
@@ -204,7 +205,7 @@ export function productLd(
   tenant: TenantConfig,
   base: string,
 ) {
-  const url = new URL(`/products/${p.handle}`, base + "/").toString();
+  const url = pageUrlForm(new URL(`/products/${p.handle}`, base + "/").toString(), tenant.seo);
   const images = p.images
     .map((i) => i.url)
     .filter((u) => !/cdn\.shopify\.com/.test(u)); // skip dead fixture URLs

package/apps/storefront/src/lib/content/shared/redirects.ts

@@ -0,0 +1,22 @@
+/** Content redirects for ordinary preview/local renders, bound to the page's selected provider. */
+import { buildRedirectSet, COLLECTION_REDIRECTS_PATH, declaredRedirectsFromContent, resolveRedirect } from "@tot/public-runtime/publication-redirects";
+import type { ContentProvider } from "../storyblok/provider.js";
+
+export async function contentRedirectLocation(
+  content: Pick<ContentProvider, "readArtifact" | "listArtifactPaths">,
+  requestPath: string,
+): Promise<string | null> {
+  try {
+    const paths = await content.listArtifactPaths();
+    const declarations = ["redirects.json", ...(paths ?? []).filter((path) => COLLECTION_REDIRECTS_PATH.test(`content/${path}`))];
+    const entries = await Promise.all(declarations.map(async (relative) => {
+      const raw = await content.readArtifact(relative);
+      return raw === null ? null : { path: `content/${relative}`, json: JSON.parse(raw) as unknown };
+    }));
+    const set = buildRedirectSet(declaredRedirectsFromContent(entries.filter((entry) => entry !== null)));
+    return set.ok ? resolveRedirect(set.redirects, requestPath)?.location ?? null : null;
+  } catch {
+    // An unreadable/invalid map must never produce an unsafe or partial redirect set.
+    return null;
+  }
+}

package/apps/storefront/src/middleware/index.ts

@@ -73,10 +73,12 @@ function routeTierIndexFor(tenant: TenantConfig): RouteTierIndexV1 {
  * appended after the branch has read or written any edge cache.
  */
 export const onRequest = defineMiddleware(async (context, next) => {
-  const seen = { cdnForwarded: false };
+  const seen: { cdnForwarded: boolean; assetBasePath?: string } = { cdnForwarded: false };
   const response = await serveRequest(context, next, seen);
+  const { scopePreviewPinnedImageUrls } = await import("@/lib/assets/preview-pinned-image-urls");
+  const scoped = await scopePreviewPinnedImageUrls(response, context.locals.apiBasePath ?? seen.assetBasePath ?? "");
   return withVisitorRegionCookie(
-    response,
+    scoped,
     visitorRegionFor(context.request, { cdnForwarded: seen.cdnForwarded, dev: import.meta.env.DEV }),
   );
 });
@@ -84,7 +86,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 async function serveRequest(
   context: APIContext,
   next: MiddlewareNext,
-  seen: { cdnForwarded: boolean },
+  seen: { cdnForwarded: boolean; assetBasePath?: string },
 ): Promise<Response> {
   const { request, locals } = context;
   const url = new URL(request.url);
@@ -163,6 +165,7 @@ async function serveRequest(
   if (!tenant) {
     return new Response("Unknown host", { status: 404 });
   }
+  seen.assetBasePath = basePath;
 
   // ---- The one route classification -----------------------------------------
   // An EXPLICITLY unpaid store is never fully public: the ONLY way to reach its
@@ -282,7 +285,7 @@ async function serveRequest(
     });
     const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
     const originalsBucket =
-      capturedRevisionId
+      (capturedRevisionId || renderPath.startsWith("/_a/"))
         ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)
         : null;
     const bundled = await tryServeStaticBundle({
@@ -298,11 +301,11 @@ async function serveRequest(
       hasCandidatePin: !!candidatePin,
       hasDraftCookie: !!context.cookies.get(DEV_DRAFT_COOKIE)?.value,
       hasManagedInstalls: false,
-      ...(capturedRevisionId && originalsBucket
+      ...(originalsBucket
         ? {
             capturedOriginal: {
               bucket: originalsBucket as { get(key: string): Promise<unknown> },
-              revisionId: capturedRevisionId,
+              ...(capturedRevisionId ? { revisionId: capturedRevisionId } : {}),
             },
           }
         : {}),

package/apps/storefront/src/middleware/renderChain.ts

@@ -83,6 +83,7 @@ import {
   HTML_CACHE_POLICY_CAPTURE_HEADER,
   HTML_CACHE_POLICY_CAPTURE_PROBE,
 } from "@tot/public-runtime";
+import { contentRedirectLocation } from "@/lib/content/shared/redirects.js";
 import { publicationContentRedirectLocationV1 } from "@tot/public-runtime/publication-content-redirects";
 import { loadTenantIntegrationDeclarations } from "@/lib/integrations/integration/tenantDeclarations";
 import { resolveTenantCommerce } from "@/lib/checkout/shared/checkoutCommerce";
@@ -269,6 +270,57 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     kv ? (key: string) => kv.get(key) : async () => null,
     { env: customization.env, ...(candidatePin ? { pinnedVersionId: candidatePin.versionId } : {}) },
   );
+  // Request-scoped read memo: every content read resolves the same pointer and
+  // version manifest, and a catalog render reads one artifact per catalog file.
+  const kvReads = new Map<string, Promise<string | null>>();
+  const kvGet = kv
+    ? (key: string) => {
+        let read = kvReads.get(key);
+        if (!read) {
+          read = kv.get(key);
+          kvReads.set(key, read);
+        }
+        return read;
+      }
+    : async () => null;
+  const readRuntimeArtifact = (path: string) => candidatePin
+    ? readWithImagePreviewRewriteOverlay(
+        kvGet,
+        tenant.tenant_id,
+        candidatePin.versionId,
+        path,
+        () => readVersionArtifact(kvGet, tenant.tenant_id, candidatePin.versionId, path),
+      )
+    : readPublishedArtifact(kvGet, tenant.tenant_id, customization.env, path);
+
+  // Resolve the shared root adapter first. An opened publication version then
+  // becomes authoritative for selected content while a mounted space may still
+  // reuse root-owned chrome. Neither source falls through to another space.
+  const sharedRootContent = candidatePin
+    ? createContentProvider(tenant, undefined, { get: kvGet, versionId: candidatePin.versionId })
+    : createContentProvider(tenant, {
+        get: kvGet,
+        env: customization.env,
+      });
+  locals.content = bindPublicationSpaceContentProviderV1(
+    sharedRootContent,
+    publicationSource.status === "selected" ? publicationSource.artifact : undefined,
+    // A discovery document lists the whole space it is bound to, not one selected page.
+    { wholeSpace: isPlatformPublicDiscoveryPath(renderPath) },
+  );
+  // Ordinary host, path-prefixed and pinned previews read the same declarations as their pages.
+  // Public CDN redirects remain precomputed in the publication artifact.
+  if (publicationSource.status === "legacy-root") {
+    const location = await contentRedirectLocation(locals.content, renderPath);
+    if (location) {
+      const response = new Response(null, {
+        status: 308,
+        headers: { location: location.startsWith("/") ? `${url.origin}${basePath}${location}${url.search}` : location },
+      });
+      applySecurityHeaders(response.headers);
+      return response;
+    }
+  }
   const publicationTimestamp = publicationSource.status === "selected"
     ? publicationSource.publicationTimestamp
     : exactPublicationTimestamp(await readEnv("TOT_PUBLICATION_TIMESTAMP"));
@@ -301,7 +353,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   });
   const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
   const originalsBucket =
-    capturedRevisionId
+    (capturedRevisionId || renderPath.startsWith("/_a/"))
       ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)
       : null;
   const bundled = publicationSource.status === "legacy-root" ? await tryServeStaticBundle({
@@ -316,11 +368,11 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     hasCandidatePin: !!candidatePin,
     hasDraftCookie: !!draftCookie,
     hasManagedInstalls: managedIntegrationDeclarations.length > 0,
-    ...(capturedRevisionId && originalsBucket
+    ...(originalsBucket
       ? {
           capturedOriginal: {
             bucket: originalsBucket as { get(key: string): Promise<unknown> },
-            revisionId: capturedRevisionId,
+            ...(capturedRevisionId ? { revisionId: capturedRevisionId } : {}),
           },
         }
       : {}),
@@ -484,29 +536,6 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // test->preview) and resolves it through the immutable site version. A
   // candidate must bypass that pointer so a reviewer sees the candidate's own
   // theme, capabilities, and embed opt-in with its content.
-  // Request-scoped read memo: every content read resolves the same pointer and
-  // version manifest, and a catalog render reads one artifact per catalog file.
-  const kvReads = new Map<string, Promise<string | null>>();
-  const kvGet = kv
-    ? (key: string) => {
-        let read = kvReads.get(key);
-        if (!read) {
-          read = kv.get(key);
-          kvReads.set(key, read);
-        }
-        return read;
-      }
-    : async () => null;
-  const readRuntimeArtifact = (path: string) => candidatePin
-    ? readWithImagePreviewRewriteOverlay(
-        kvGet,
-        tenant.tenant_id,
-        candidatePin.versionId,
-        path,
-        () => readVersionArtifact(kvGet, tenant.tenant_id, candidatePin.versionId, path),
-      )
-    : readPublishedArtifact(kvGet, tenant.tenant_id, customization.env, path);
-
   // Self-heal a DANGLING channel pointer: the pointer for this env's channel may
   // name a version that was never built (or whose manifest was evicted).
   // `readVersionedArtifact` already serves last-built content instead of emptying
@@ -622,21 +651,6 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       ? await resolveTenantCommerce(tenant)
       : null;
   locals.commerce = commerce ?? undefined;
-  // Resolve the shared root adapter first. An opened publication version then
-  // becomes authoritative for selected content while a mounted space may still
-  // reuse root-owned chrome. Neither source falls through to another space.
-  const sharedRootContent = candidatePin
-    ? createContentProvider(tenant, undefined, { get: kvGet, versionId: candidatePin.versionId })
-    : createContentProvider(tenant, {
-        get: kvGet,
-        env: customization.env,
-      });
-  locals.content = bindPublicationSpaceContentProviderV1(
-    sharedRootContent,
-    publicationSource.status === "selected" ? publicationSource.artifact : undefined,
-    // A discovery document lists the whole space it is bound to, not one selected page.
-    { wholeSpace: isPlatformPublicDiscoveryPath(renderPath) },
-  );
   // Developer-draft content overlay — serves the AI-edited artifacts to the draft
   // owner only; every other viewer keeps the published/base chain above.
   if (draft) {

package/apps/storefront/src/middleware/staticBundle.ts

@@ -37,7 +37,7 @@ export interface StaticBundleAttemptInput {
    */
   capturedOriginal?: {
     bucket: { get(key: string): Promise<unknown> };
-    revisionId: string;
+    revisionId?: string;
   };
 }
 
@@ -60,15 +60,17 @@ export async function tryServeStaticBundle(
 ): Promise<Response | null> {
   const { request, url, tenant, cache, kv } = input;
   const method = request.method.toUpperCase();
+  const assetPath = input.basePath && url.pathname.startsWith(`${input.basePath}/_a/`)
+    ? url.pathname.slice(input.basePath.length) : url.pathname;
 
   // Version-independent assets (`/_a/<sha256>`, `/_astro/<name>`) are exact addresses: the same
   // bytes for every viewer, preview or not, whatever the live pointer says. A page from an
   // older version — or a preview of one — keeps resolving its own sub-resources.
-  if ((method === "GET" || method === "HEAD") && versionIndependentAssetKey(url.pathname)) {
+  if ((method === "GET" || method === "HEAD") && versionIndependentAssetKey(assetPath)) {
     const bucket = await readR2("STATIC_BUNDLES");
     if (bucket) {
       const pinnedKey = cache && method === "GET"
-        ? staticBundleCacheKey(tenant.tenant_id, "pinned", url.pathname, "")
+        ? staticBundleCacheKey(tenant.tenant_id, "pinned", assetPath, "")
         : null;
       if (pinnedKey && cache) {
         const hit = await getCachedPage(cache, pinnedKey);
@@ -76,7 +78,7 @@ export async function tryServeStaticBundle(
       }
       const pinned = await serveVersionIndependentAsset(
         bucket as unknown as StaticBundleR2BucketLike,
-        url.pathname,
+        assetPath,
         method,
       );
       if (pinned && pinned.ok) {
@@ -84,26 +86,28 @@ export async function tryServeStaticBundle(
         return pinned;
       }
       // `/_a/` miss: try revision-bound captured originals before the pinned 404.
-      if (input.capturedOriginal && url.pathname.startsWith("/_a/")) {
+      if (input.capturedOriginal && assetPath.startsWith("/_a/")) {
         const { tryServeCapturedOriginal } = await import("@/lib/assets/captured-original-serve");
         const captured = await tryServeCapturedOriginal({
           bucket: input.capturedOriginal.bucket,
           tenantId: tenant.tenant_id,
           revisionId: input.capturedOriginal.revisionId,
-          pathname: url.pathname,
+          pathname: assetPath,
           method,
+          ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
         });
         if (captured) return captured;
       }
       if (pinned) return pinned;
-    } else if (input.capturedOriginal && url.pathname.startsWith("/_a/")) {
+    } else if (input.capturedOriginal && assetPath.startsWith("/_a/")) {
       const { tryServeCapturedOriginal } = await import("@/lib/assets/captured-original-serve");
       const captured = await tryServeCapturedOriginal({
         bucket: input.capturedOriginal.bucket,
         tenantId: tenant.tenant_id,
         revisionId: input.capturedOriginal.revisionId,
-        pathname: url.pathname,
+        pathname: assetPath,
         method,
+        ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
       });
       if (captured) return captured;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -107,8 +107,8 @@ export function seoDeclarationProblems(seo) {
         problems.push(`\`${at}\`: unknown page type (${STRUCTURED_DATA_PAGE_TYPES.join(", ")})`);
         continue;
       }
-      if (!Array.isArray(tokens) || tokens.length === 0) {
-        problems.push(`\`${at}\` must be a non-empty array of node types`);
+      if (!Array.isArray(tokens)) {
+        problems.push(`\`${at}\` must be an array of node types (empty emits no nodes)`);
         continue;
       }
       const seen = new Set();

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -153,8 +153,8 @@ export function seoDeclarationProblems(seo) {
         problems.push(`\`${at}\`: unknown page type (${STRUCTURED_DATA_PAGE_TYPES.join(", ")})`);
         continue;
       }
-      if (!Array.isArray(tokens) || tokens.length === 0) {
-        problems.push(`\`${at}\` must be a non-empty array of node types`);
+      if (!Array.isArray(tokens)) {
+        problems.push(`\`${at}\` must be an array of node types (empty emits no nodes)`);
         continue;
       }
       const seen = new Set();

package/packages/public-runtime/src/tenant.ts

@@ -790,7 +790,7 @@ export interface SeoDeclaration {
    * The structured-data profile. When present it is the ONLY JSON-LD a declared page type
    * emits: one `@graph` holding exactly the listed nodes, in order. A node whose data the
    * page lacks (no image, no author, no FAQ) is omitted. A page type without a graph keeps
-   * the platform default.
+   * the platform default. An explicit empty list emits no nodes for that page type.
    */
   structuredData?: {
     graphs: Partial<Record<StructuredDataPageType, StructuredDataNodeToken[]>>;