@tokenoftrust/storefront-runner 2.0.17 → 2.0.18

package/apps/storefront/src/middleware/publicRender.ts

@@ -0,0 +1,43 @@
+/**
+ * The public-render branch: anonymous tenant output, served with NO request-time
+ * D1 read.
+ *
+ * This module's whole job is to hand the shared chain the empty forms of every
+ * D1-derived input, so a control-plane read cannot reach the public path by
+ * accident. That absence is the contract, and it is held structurally rather
+ * than by review: `public-render-no-request-time-d1` (.dependency-cruiser.cjs)
+ * fails `pnpm run check` if ANY module reachable from this one reaches
+ * `lib/env.ts`, the sole accessor for a live D1 handle. The public path reaches
+ * `lib/runtimeEnv.ts` instead — readEnv/readKv/readR2, the substrate that serves
+ * published bytes.
+ *
+ * Two companions cover what a forward graph walk from this module cannot see:
+ * `middleware-front-door-no-d1-handle` (same config) fences `index.ts` and
+ * `routeBranch.ts`, which call INTO this branch and so run before it on every
+ * request; `scripts/playbooks/check-public-render-d1.sh` fences the `.astro` pages
+ * and components the chain reaches through Astro's `next()` dispatch rather than
+ * an import.
+ *
+ * What the empty forms mean, per ADR 0013:
+ *   - managed installs — admin-installed state, baked at publish, never read per
+ *     request on a public page.
+ *   - consent — the fail-closed essential-only default here; the tenant's real
+ *     snapshot reaches a public page baked into the static bundle (the signed
+ *     materialize-mode header the shared chain still honors).
+ *   - catalog — the bundled JSON snapshot, never the D1 edge replica.
+ */
+import { runRenderChain, type RenderChainInput } from "./renderChain.js";
+
+export type PublicRenderInput = Omit<
+  RenderChainInput,
+  "managedIntegrationDeclarations" | "readTenantConsentSnapshot" | "readCatalogD1"
+>;
+
+export function servePublicRender(input: PublicRenderInput): Promise<Response> {
+  return runRenderChain({
+    ...input,
+    managedIntegrationDeclarations: [],
+    readTenantConsentSnapshot: null,
+    readCatalogD1: null,
+  });
+}