@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/lib/search/index.ts

@@ -3,8 +3,8 @@
  *
  * Used by FixtureToTClient.search (no D1 binding): typo-tolerant, relevance-ranked
  * search over the bundled catalog snapshot, zero infra. When a D1 binding is wired
- * (D1ToTClient), search instead goes through FTS5 — see lib/d1/catalog.ts and
- * epics/edge-read-replica.md. This module is the portable floor an extracted
+ * (D1ToTClient), search instead goes through FTS5 — see lib/d1/catalog.ts.
+ * This module is the portable floor an extracted
  * merchant gets out of the box (docs/extraction-runbook.md).
  */
 import Fuse, { type IFuseOptions } from "fuse.js";

package/apps/storefront/src/lib/seo/alternates.ts

@@ -0,0 +1,42 @@
+/**
+ * hreflang alternates for a translated article. Two pure helpers so the
+ * article route and <Seo> stay thin and the "singleton emits nothing" guard is
+ * unit-testable without an Astro render harness.
+ */
+export interface Alternate {
+  hreflang: string;
+  href: string;
+}
+
+/**
+ * Build the per-variant alternate set for an article's translation group. Returns
+ * `[]` for a singleton (≤1 variant) so a non-translated post emits no `hreflang`
+ * links and renders byte-identically to today. Each variant maps to its own
+ * localized canonical via `hrefForSlug`; `inLanguage` is the per-variant language
+ * key (defaulting "en", matching the field's repo-wide default).
+ */
+export function buildAlternates(
+  variants: { slug: string; inLanguage?: string }[],
+  hrefForSlug: (slug: string) => string,
+): Alternate[] {
+  if (variants.length <= 1) return [];
+  return variants.map((v) => ({
+    hreflang: v.inLanguage ?? "en",
+    href: hrefForSlug(v.slug),
+  }));
+}
+
+/**
+ * Append the `x-default` entry to a per-variant alternate set. It points at the
+ * English variant (`en` or an `en-*` region variant); with no English variant it
+ * falls back to the first entry — a deterministic primary rather than none, so
+ * search engines always have a language-agnostic default. Returns `[]` unchanged
+ * for an empty input (nothing to default to).
+ */
+export function withXDefault(alternates: Alternate[]): Alternate[] {
+  if (alternates.length === 0) return [];
+  const primary =
+    alternates.find((a) => a.hreflang === "en" || a.hreflang.startsWith("en-")) ??
+    alternates[0]!;
+  return [...alternates, { hreflang: "x-default", href: primary.href }];
+}

package/apps/storefront/src/lib/seo/meta.ts

@@ -0,0 +1,65 @@
+/**
+ * Pure builders for the extra <meta> tags `<Seo>` emits on article pages
+ * (B1.6). Kept as a pure function so the "no article meta leaks onto
+ * website/product pages" invariant is unit-testable without rendering Astro.
+ */
+
+/** Open Graph `article:*` fields — only meaningful when `ogType === "article"`. */
+export interface ArticleMeta {
+  publishedTime?: string;
+  modifiedTime?: string;
+  /** Author name or author-page URL → article:author. */
+  author?: string;
+  /** The category/pillar → article:section. */
+  section?: string;
+  /** One <meta property="article:tag"> per entry. */
+  tags?: string[];
+}
+
+/** A meta tag is keyed by either `property` (OG) or `name` (Twitter/std). */
+export interface MetaTag {
+  property?: string;
+  name?: string;
+  content: string;
+}
+
+export interface ArticleSeoInput {
+  ogType?: "website" | "product" | "article";
+  article?: ArticleMeta;
+  /** og:image:alt — the accessible description of the OG image. */
+  imageAlt?: string;
+  imageWidth?: number;
+  imageHeight?: number;
+  twitterSite?: string;
+  twitterCreator?: string;
+}
+
+/**
+ * The article-only OG/Twitter meta tags. Returns `[]` for any non-article page
+ * so `article:*`, `og:image:alt`, and `twitter:site`/`creator` can never leak
+ * onto website/product pages (guarded here, asserted in meta.test.ts).
+ */
+export function articleSeoMetaTags(input: ArticleSeoInput): MetaTag[] {
+  if (input.ogType !== "article") return [];
+  const tags: MetaTag[] = [];
+  const a = input.article;
+  if (a?.publishedTime)
+    tags.push({ property: "article:published_time", content: a.publishedTime });
+  if (a?.modifiedTime)
+    tags.push({ property: "article:modified_time", content: a.modifiedTime });
+  if (a?.author) tags.push({ property: "article:author", content: a.author });
+  if (a?.section) tags.push({ property: "article:section", content: a.section });
+  for (const tag of a?.tags ?? [])
+    tags.push({ property: "article:tag", content: tag });
+  if (input.imageAlt)
+    tags.push({ property: "og:image:alt", content: input.imageAlt });
+  if (input.imageWidth)
+    tags.push({ property: "og:image:width", content: String(input.imageWidth) });
+  if (input.imageHeight)
+    tags.push({ property: "og:image:height", content: String(input.imageHeight) });
+  if (input.twitterSite)
+    tags.push({ name: "twitter:site", content: input.twitterSite });
+  if (input.twitterCreator)
+    tags.push({ name: "twitter:creator", content: input.twitterCreator });
+  return tags;
+}

package/apps/storefront/src/lib/social/golive.ts

@@ -0,0 +1,212 @@
+/**
+ * S1 — the social go-live hook + idempotency.
+ *
+ * WHERE IT FIRES: at the true go-live edge — after `AggregateShipOrchestrator`
+ * flips a tenant's `live` channel to a freshly-shipped version and records the
+ * release ledger. NOT on `POST /api/admin/blog`'s `publish` (which only opens a
+ * candidate PR a human still promotes) and NOT on accept-to-preview
+ * (`/api/changes/accept` → `integrate`, which only advances the `preview`
+ * aggregate). Go-live is where a post's file actually becomes public, so it is the
+ * only truthful "it went live" edge.
+ *
+ * WHAT IT DETECTS: a blog post that transitioned INTO a live-visible status — was
+ * absent or not-live in the version live before this ship (`fromVersionId`), and
+ * is live-visible in the version just promoted (`toVersionId`). Visibility is the
+ * ONE chokepoint `isVisibleOnLive` (published / unlisted / due-scheduled), reused
+ * so this never drifts from the render path.
+ *
+ * DISCIPLINE (mirrors `webhooks/emit.ts`): BEST-EFFORT and fire-and-forget — every
+ * failure is logged and swallowed. A social outage must NEVER fail or roll back a
+ * completed go-live.
+ *
+ * IDEMPOTENCY: a check-and-set posted-state key per `(tenant, collection, slug,
+ * network)` fires each post AT MOST ONCE, so a re-ship / re-run never re-posts. The
+ * transition guard also marks already-live posts as "primed" (key set, not fired)
+ * so the first ship after this hook deploys does NOT retro-announce the tenant's
+ * whole back-catalog.
+ */
+import { isVisibleOnLive } from "../blog/collection.js";
+import type { BlogPost, PostStatus } from "../blog/types.js";
+import { notifyPostPublished } from "./notify.js";
+
+/**
+ * The minimal version-read surface this hook needs — a structural subset of the
+ * control-plane `SiteVersionStore`. Declared locally (not imported) so `lib/social`
+ * stays inside the source-available renderer carve and never edges onto
+ * `@tot/private-controlplane`; the caller (the control-plane-cluster orchestrator)
+ * passes its real store in.
+ */
+export interface VersionReadStore {
+  getSiteVersion(
+    tenantId: string,
+    versionId: string,
+  ): Promise<{ artifacts: Record<string, string> } | null>;
+  getVersionContent(
+    tenantId: string,
+    path: string,
+    versionId: string,
+  ): Promise<string | Uint8Array | null>;
+}
+
+/**
+ * The v1 idempotency network token — a single whole-post gate. S3/S4 replace this
+ * with the real per-network id (`x` / `linkedin` / …) and iterate networks; the key
+ * shape is ALREADY per-network so that extension needs no rework here.
+ */
+export const SOCIAL_NETWORK = "social";
+
+/** The posted-once key for one post on one network. */
+export function socialPostedKey(
+  tenantId: string,
+  collection: string,
+  slug: string,
+  network: string,
+): string {
+  return `social:posted:${tenantId}:${collection}:${slug}:${network}`;
+}
+
+/** The minimal KV surface the idempotency store needs (TENANT_CACHE in prod). */
+export interface SocialIdempotencyKv {
+  get(key: string): Promise<string | null>;
+  put(key: string, value: string): Promise<void>;
+}
+
+// `.../content/<collection>/posts/<slug>.json` — capture collection + slug from a
+// version-manifest artifact path (robust to the leading `tenants/<id>/` prefix).
+const POST_PATH_RE = /(?:^|\/)content\/([a-z0-9][a-z0-9._-]*)\/posts\/([a-z0-9][a-z0-9-]*)\.json$/;
+
+function logDiag(fields: Record<string, unknown>): void {
+  try {
+    console.warn("[diag:social:golive]", JSON.stringify(fields));
+  } catch {
+    /* diagnostics must never break the caller */
+  }
+}
+
+// Legacy/seeded post JSON may omit `status`; default it to "published" on load, the
+// same normalization `blog/collection.ts` applies so visibility matches the render path.
+function normalizeStatus(raw: unknown): PostStatus {
+  return raw === "draft" || raw === "unlisted" || raw === "published" || raw === "scheduled"
+    ? raw
+    : "published";
+}
+
+// `contentVersionId` is the artifact's content hash (`manifest.artifacts[path]`) —
+// the version store keys blob content by that hash, not by the site version id.
+async function readPost(
+  store: VersionReadStore,
+  tenantId: string,
+  artifactPath: string,
+  contentVersionId: string,
+): Promise<BlogPost | null> {
+  const raw = await store.getVersionContent(tenantId, artifactPath, contentVersionId);
+  if (typeof raw !== "string") return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object") return null;
+  const post = parsed as BlogPost;
+  return { ...post, status: normalizeStatus((post as { status?: unknown }).status) };
+}
+
+export interface NotifyPostsWentLiveDeps {
+  /** The version store the shipped tenant publishes to (a control-plane `SiteVersionStore`). */
+  store: VersionReadStore;
+  /** Idempotency store — TENANT_CACHE in prod. */
+  kv: SocialIdempotencyKv;
+  now?: () => string;
+  /** Override the publish seam (tests + S3/S4 injection). Defaults to {@link notifyPostPublished}. */
+  notify?: (tenantId: string, collection: string, slug: string, post: BlogPost) => Promise<void>;
+}
+
+export interface NotifyPostsWentLiveInput {
+  tenantId: string;
+  /** The version just promoted to `live`. */
+  toVersionId: string;
+  /** The version live immediately BEFORE this ship, or null on the first-ever ship. */
+  fromVersionId: string | null;
+}
+
+/**
+ * For each blog post that went live in `toVersionId`, fire {@link notifyPostPublished}
+ * at most once. NEVER throws — the whole body is guarded so a completed go-live is
+ * never failed or rolled back by this hook.
+ */
+export async function notifyPostsWentLive(
+  deps: NotifyPostsWentLiveDeps,
+  input: NotifyPostsWentLiveInput,
+): Promise<void> {
+  try {
+    const { store, kv } = deps;
+    const now = (deps.now ?? (() => new Date().toISOString()))();
+    const notify = deps.notify ?? notifyPostPublished;
+
+    const toManifest = await store.getSiteVersion(input.tenantId, input.toVersionId);
+    if (!toManifest) return;
+    const fromManifest = input.fromVersionId
+      ? await store.getSiteVersion(input.tenantId, input.fromVersionId)
+      : null;
+
+    for (const [artifactPath, contentHash] of Object.entries(toManifest.artifacts)) {
+      const match = POST_PATH_RE.exec(artifactPath);
+      if (!match) continue;
+      const collection = match[1]!;
+      const slug = match[2]!;
+      const key = socialPostedKey(input.tenantId, collection, slug, SOCIAL_NETWORK);
+
+      // Already posted (or primed) — skip before any content read (cheap steady state).
+      let already: string | null = null;
+      try {
+        already = await kv.get(key);
+      } catch {
+        already = null;
+      }
+      if (already) continue;
+
+      const post = await readPost(store, input.tenantId, artifactPath, contentHash);
+      // Not live now (draft / not-yet-due scheduled) — do NOT set the key, so it is
+      // re-checked on the ship that eventually takes it live.
+      if (!post || !isVisibleOnLive(post, now)) continue;
+
+      // Transition guard: if the post was ALREADY live in the prior version, this ship
+      // did not take it live — PRIME the key (so we never re-read it) but do NOT notify.
+      const prevHash = fromManifest?.artifacts[artifactPath];
+      if (prevHash) {
+        const prev = await readPost(store, input.tenantId, artifactPath, prevHash);
+        if (prev && isVisibleOnLive(prev, now)) {
+          try {
+            await kv.put(key, now);
+          } catch {
+            /* best-effort prime */
+          }
+          continue;
+        }
+      }
+
+      // Genuine went-live transition — fire once, THEN set the posted key. If notify
+      // throws, the key is left unset so the next ship retries (at-least-check, at-most-post).
+      try {
+        await notify(input.tenantId, collection, slug, post);
+        await kv.put(key, now);
+      } catch (err) {
+        logDiag({
+          event: "notify_failed",
+          tenantId: input.tenantId,
+          collection,
+          slug,
+          error: (err as Error).message,
+        });
+      }
+    }
+  } catch (err) {
+    logDiag({
+      event: "hook_failed",
+      tenantId: input.tenantId,
+      toVersionId: input.toVersionId,
+      error: (err as Error).message,
+    });
+  }
+}

package/apps/storefront/src/lib/social/notify.ts

@@ -0,0 +1,32 @@
+import type { BlogPost } from "../blog/types.js";
+
+/** Swallow-and-log a soft failure — logging itself must never throw (mirrors `webhooks/emit.ts`). */
+function logDiag(fields: Record<string, unknown>): void {
+  try {
+    console.warn("[diag:social:notify]", JSON.stringify(fields));
+  } catch {
+    /* diagnostics must never break the caller */
+  }
+}
+
+/**
+ * The seam — the single call the go-live hook makes when a blog post
+ * transitions INTO a live-visible state (see {@link notifyPostsWentLive}). This
+ * ships the HOOK + the at-most-once idempotency key, NOT the network
+ * last-mile: v1 is a no-op announcement (logs only).
+ *
+ * A `SocialPublisher` interface + X adapter, and per-`(tenant,network)`
+ * config + encrypted token store, replace THIS body to compose a per-network
+ * payload — title, canonical URL, excerpt, featured image, `categories[0]` →
+ * hashtags — and POST it to each configured network's publish API. The signature
+ * is deliberately per-POST; per-network fan-out and the per-network idempotency
+ * key live one layer up in the hook, so extending to X + LinkedIn is additive.
+ */
+export async function notifyPostPublished(
+  tenantId: string,
+  collection: string,
+  slug: string,
+  post: BlogPost,
+): Promise<void> {
+  logDiag({ event: "post_published", tenantId, collection, slug, title: post.title });
+}

package/apps/storefront/src/lib/social/tokenStore.ts

@@ -0,0 +1,171 @@
+/**
+ * Encrypted per-`(tenant, network)` outbound social OAuth token store
+ * (social-autopost epic, S2). The one RETRIEVABLE secret store in the
+ * storefront: unlike `app_credentials` (one-way `sha256Hex` for INBOUND auth),
+ * these are access/refresh tokens we must REPLAY to X/LinkedIn, so they are
+ * encrypted-at-rest and decrypted at post time — never hashed.
+ *
+ * Envelope encryption, Workers-native Web Crypto `AES-GCM` (no Node `crypto`):
+ *   - The data-encrypting step runs per write with a fresh random 96-bit IV.
+ *   - The key-encrypting key (KEK) is a Worker env binding (`SOCIAL_TOKEN_KEK`,
+ *     a base64-encoded 256-bit key), imported to a non-extractable `CryptoKey`.
+ *     It is NEVER a column — mirroring how every other real secret here is an
+ *     env binding, not row data (see the `social_tokens` note in schema-apps.ts).
+ *
+ * PURE over injected seams (a `Queryable` for D1, a `CryptoKey` for the KEK) so
+ * the same code serves the real Worker bindings and an in-memory test — the
+ * activity/store.ts convention. `resolveSocialTokenStore()` is the composition
+ * root that wires the real bindings (mirrors `getDispatcher()`); it returns
+ * `null` when either binding is absent so callers degrade rather than throw.
+ */
+import type { Queryable } from "../d1/catalog.js";
+import { readD1, readEnv } from "../env.js";
+
+/** The decrypted token material we persist as one JSON blob under AES-GCM. */
+export interface SocialTokenPayload {
+  accessToken: string;
+  /** OAuth refresh token, when the network issues one (X app-passwords don't). */
+  refreshToken?: string;
+  /** Token expiry, ISO-8601. Absent for long-lived manual creds. */
+  expiresAt?: string;
+}
+
+/** Injected seams a store operation runs over. */
+export interface SocialTokenStoreDeps {
+  db: Queryable;
+  /** AES-GCM key imported from the `SOCIAL_TOKEN_KEK` binding via {@link importKek}. */
+  kek: CryptoKey;
+  /** Clock seam (ISO-8601), overridable in tests. Defaults to `Date.now`. */
+  now?: () => string;
+}
+
+const IV_BYTES = 12; // AES-GCM standard 96-bit nonce.
+
+function nowIso(deps: SocialTokenStoreDeps): string {
+  return (deps.now ?? (() => new Date().toISOString()))();
+}
+
+function toBase64(bytes: Uint8Array): string {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s);
+}
+
+function fromBase64(b64: string): Uint8Array<ArrayBuffer> {
+  const s = atob(b64);
+  const bytes = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) bytes[i] = s.charCodeAt(i);
+  return bytes;
+}
+
+/**
+ * Import the raw `SOCIAL_TOKEN_KEK` secret (base64 of a 256-bit key) into a
+ * non-extractable AES-GCM `CryptoKey`. Throws if the decoded key isn't 32 bytes
+ * — a misprovisioned KEK must fail loudly at the composition root, not silently
+ * produce unopenable ciphertext.
+ */
+export async function importKek(rawBase64Key: string): Promise<CryptoKey> {
+  const raw = fromBase64(rawBase64Key.trim());
+  if (raw.length !== 32) {
+    throw new Error(`SOCIAL_TOKEN_KEK must decode to 32 bytes (got ${raw.length})`);
+  }
+  return crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+
+/** Encrypt a token payload → `{ ciphertext, iv }` (both base64). Fresh IV each call. */
+export async function encryptTokenPayload(
+  kek: CryptoKey,
+  payload: SocialTokenPayload,
+): Promise<{ ciphertext: string; iv: string }> {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, kek, plaintext);
+  return { ciphertext: toBase64(new Uint8Array(ct)), iv: toBase64(iv) };
+}
+
+/** Decrypt a stored `{ ciphertext, iv }` back to the token payload. */
+export async function decryptTokenPayload(
+  kek: CryptoKey,
+  ciphertext: string,
+  iv: string,
+): Promise<SocialTokenPayload> {
+  const pt = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: fromBase64(iv) },
+    kek,
+    fromBase64(ciphertext),
+  );
+  return JSON.parse(new TextDecoder().decode(pt)) as SocialTokenPayload;
+}
+
+/**
+ * Store (or overwrite) the token for `(tenantId, network)`. `INSERT OR REPLACE`
+ * on the composite PK, so this is an idempotent upsert; `created_at` follows the
+ * row's replacement (the natural key is the identity, not a birth timestamp).
+ */
+export async function putSocialToken(
+  deps: SocialTokenStoreDeps,
+  tenantId: string,
+  network: string,
+  payload: SocialTokenPayload,
+): Promise<void> {
+  const { ciphertext, iv } = await encryptTokenPayload(deps.kek, payload);
+  const at = nowIso(deps);
+  await deps.db.run(
+    `INSERT OR REPLACE INTO social_tokens
+       (tenant_id, network, ciphertext, iv, expires_at, created_at, updated_at)
+     VALUES (?,?,?,?,?,?,?)`,
+    tenantId,
+    network,
+    ciphertext,
+    iv,
+    payload.expiresAt ?? null,
+    at,
+    at,
+  );
+}
+
+/** Decrypt and return the token for `(tenantId, network)`, or `null` if none stored. */
+export async function getSocialToken(
+  deps: SocialTokenStoreDeps,
+  tenantId: string,
+  network: string,
+): Promise<SocialTokenPayload | null> {
+  const row = await deps.db.first<{ ciphertext: string; iv: string }>(
+    `SELECT ciphertext, iv FROM social_tokens WHERE tenant_id = ? AND network = ?`,
+    tenantId,
+    network,
+  );
+  if (!row) return null;
+  return decryptTokenPayload(deps.kek, row.ciphertext, row.iv);
+}
+
+/**
+ * Overwrite the token for `(tenantId, network)` with rotated material — the
+ * explicit name for the refresh-token-rotation path. Same write as
+ * {@link putSocialToken}; distinct export so a caller's intent reads at the seam.
+ */
+export async function rotateSocialToken(
+  deps: SocialTokenStoreDeps,
+  tenantId: string,
+  network: string,
+  newPayload: SocialTokenPayload,
+): Promise<void> {
+  await putSocialToken(deps, tenantId, network, newPayload);
+}
+
+/**
+ * Composition root: wire the real Worker bindings into a `SocialTokenStoreDeps`.
+ * Returns `null` when the D1 binding or the `SOCIAL_TOKEN_KEK` secret is absent
+ * (unprovisioned runtime / dev), so a caller degrades to "social posting
+ * unavailable" rather than throwing — the KEK is a runtime secret that must be
+ * provisioned out of band (`wrangler secret put SOCIAL_TOKEN_KEK`).
+ */
+export async function resolveSocialTokenStore(): Promise<SocialTokenStoreDeps | null> {
+  const [{ fromD1 }, d1, rawKek] = await Promise.all([
+    import("../d1/catalog.js"),
+    readD1("STOREFRONT_APPS_DB"),
+    readEnv("SOCIAL_TOKEN_KEK"),
+  ]);
+  if (!d1 || !rawKek) return null;
+  return { db: fromD1(d1), kek: await importKek(rawKek) };
+}

package/apps/storefront/src/lib/storyblok/content-model.ts

@@ -64,7 +64,7 @@ export interface FeaturedProductsBlock {
 
 /**
  * Membership "band" on the commerce home — the Guest / Member / Autopilot tier
- * comparison, driven by the platform <TierCards> (F4) widget from tenant data.
+ * comparison, driven by the platform <TierCards> widget from tenant data.
  * The widget owns the illustrative-figures affordance (a tier is an EXAMPLE
  * unless it asserts `real: true`), so a tenant surfaces its membership model on
  * the home page without copying tier-card HTML. The block carries the same
@@ -271,11 +271,11 @@ export interface EditorialPage {
   /**
    * Sanitized HTML body (legacy / raw path). Optional: a page authored with
    * structured {@link ProseSection}s omits it and drives the body from `sections`
-   * instead (spec §F4). The renderer prefers `sections` when present.
+   * instead. The renderer prefers `sections` when present.
    */
   body_html?: string;
   /**
-   * Structured policy/prose body (spec §F4) — headings, paragraphs, lists,
+   * Structured policy/prose body — headings, paragraphs, lists,
    * callouts, a contact block, needs-review flags. When present, the page route
    * renders <ProseSections> from this instead of `set:html(body_html)`, so a
    * tenant drives a full policy page from JSON with no HTML/CSS to copy.
@@ -290,33 +290,7 @@ export interface EditorialPage {
   isPolicy?: boolean;
 }
 
-export interface SiteNavItem {
-  label: string;
-  href: string;
-  /** Mega-menu children, e.g. collection links grouped under a category. */
-  children?: { label: string; href: string }[];
-}
-
-export interface SiteChrome {
-  nav: SiteNavItem[];
-  /**
-   * Header conversion buttons (marketing tenants). Rendered in the header's
-   * right cluster in place of the commerce search/saved controls. Commerce
-   * tenants omit this and keep the search + saved affordances.
-   */
-  headerCtas?: MarketingCta[];
-  footer: {
-    columns: { title: string; links: { label: string; href: string }[] }[];
-    social: { label: string; href: string }[];
-    tagline?: string;
-    /** Bottom-bar legal/compliance line (marketing tenants). Plain text. */
-    legal?: string;
-  };
-  announcement?: string;
-  /** Default legal/safety disclaimer HTML (fallback for unknown categories). */
-  disclaimer?: string;
-  /** Per-product-category disclaimer HTML, keyed by product_type (or
-   * compliance.product_category) — the source store renders a different legal
-   * block per type (sub-ohm on salts, battery on devices). */
-  disclaimers?: Record<string, string>;
-}
+// Site chrome (header/footer) is the ONE consolidated schema in
+// lib/chrome/model.ts (`ChromeConfig`) — see that file's header comment for
+// why the old `SiteChrome`/`SiteNavItem` pair that used to live here was
+// retired.