@tokenoftrust/storefront-runner 2.0.17 → 2.0.19

package/apps/storefront/src/lib/apps/gtmMigrationDraft.ts

@@ -0,0 +1,103 @@
+/**
+ * Pure, transport-free bridge from an uploaded GTM export to a REVIEWABLE
+ * migration-draft PROPOSAL — the connective tissue that makes the self-serve
+ * import→draft→review→install flow usable by a tenant developer.
+ *
+ * The analyze surface returns only a REDACTED report, so a developer can never
+ * reconstruct the `createMigrationDraft` body (proposedAdapterId /
+ * proposedConfiguration / findings) from it — those derive from the UNREDACTED
+ * container. This helper runs the same safe pipeline analyze uses
+ * (`parseGtmExport` → `buildMigrationGraph` → `classifyMigration`) and then the
+ * pure `generateDisabledMigrationDraft`, returning exactly the
+ * `CreateMigrationDraftBody` the developer submits, plus an inert review summary.
+ *
+ * SAFE-BY-CONSTRUCTION: the produced draft is `enabled:false, publishes:false`;
+ * the proposal carries only validator-safe values (the generator validates its
+ * own output against the pinned schema, and throws rather than emit an invalid
+ * one). Nothing here writes, enables, or publishes — it returns a plain data
+ * object, like the analyze builder.
+ */
+import {
+  parseGtmExport,
+  buildMigrationGraph,
+  classifyMigration,
+  generateDisabledMigrationDraft,
+  NO_ADAPTER_SELECTED_ID,
+  type CreateMigrationDraftBody,
+  type GtmViolation,
+  type MigrationFindingCode,
+} from "@tot/public-runtime";
+
+/** The inert, review-friendly summary of what installing the proposal would stage. */
+export interface GtmDraftProposalSummary {
+  /** Whether a managed-analytics adapter was matched (false = nothing auto-portable). */
+  readonly adapterSelected: boolean;
+  /** Count of GTM objects that mapped confidently into the managed adapter. */
+  readonly mappedCount: number;
+  /** Count of GTM objects that could not be automatically ported (needs review). */
+  readonly unresolvedCount: number;
+  /** Whether a destination id was carried into the proposed configuration. */
+  readonly destinationConfigured: boolean;
+  /** Stable redacted finding codes (no source text). */
+  readonly findings: MigrationFindingCode[];
+}
+
+export interface GtmProposeOk {
+  readonly ok: true;
+  readonly correlationId: string;
+  /** The exact body a caller POSTs to `createMigrationDraft`. */
+  readonly proposal: CreateMigrationDraftBody;
+  readonly summary: GtmDraftProposalSummary;
+}
+
+export interface GtmProposeErr {
+  readonly ok: false;
+  readonly correlationId: string;
+  readonly error: string;
+  readonly violations: GtmViolation[];
+}
+
+/**
+ * Parse + graph + classify an uploaded export into a disabled migration-draft
+ * PROPOSAL, or return the structured parse violations with a stable, safe error.
+ * NEVER throws on bad input, NEVER executes any part of the export.
+ *
+ * `draftId` is a placeholder the pure generator requires for its own provenance
+ * stamp; the authoritative draft id is assigned server-side by
+ * `createMigrationDraft`, so the caller only reads the returned `proposal`.
+ */
+export function proposeGtmMigrationDraft(
+  input: string | Uint8Array,
+  opts: { correlationId: string; generatedAt: string; draftId: string },
+): GtmProposeOk | GtmProposeErr {
+  const parsed = parseGtmExport(input);
+  if (!parsed.ok) {
+    return {
+      ok: false,
+      correlationId: opts.correlationId,
+      error: "The uploaded file is not a valid GTM container export.",
+      violations: parsed.violations,
+    };
+  }
+  const graph = buildMigrationGraph(parsed.container);
+  const disposition = classifyMigration(graph);
+  const result = generateDisabledMigrationDraft({
+    container: parsed.container,
+    graph,
+    disposition,
+    provenance: { draftId: opts.draftId, generatedAt: opts.generatedAt },
+  });
+  const { proposedAdapterId, proposedConfiguration, findings } = result.draft;
+  return {
+    ok: true,
+    correlationId: opts.correlationId,
+    proposal: { proposedAdapterId, proposedConfiguration, findings },
+    summary: {
+      adapterSelected: proposedAdapterId !== NO_ADAPTER_SELECTED_ID,
+      mappedCount: result.mappedConcepts.length,
+      unresolvedCount: result.unresolvedInventory.length,
+      destinationConfigured: findings.includes("ga4-destination-id-configured"),
+      findings,
+    },
+  };
+}

package/apps/storefront/src/lib/auth/brokerAssertion.ts

@@ -79,6 +79,17 @@ export interface MintBrokerAssertionOverrides {
   issuer?: string;
 }
 
+/** Mint a broker assertion whose subject is an opaque verified identity id. */
+export async function mintOpaqueBrokerAssertion(
+  opaqueSubject: string,
+  overrides: MintBrokerAssertionOverrides = {},
+): Promise<string> {
+  if (!opaqueSubject || opaqueSubject.trim().length === 0) {
+    throw new BrokerAssertionError("broker assertion: an opaque subject is required");
+  }
+  return mintBrokerAssertionSubject(opaqueSubject, overrides);
+}
+
 // Import the signing key once per distinct PEM (importPKCS8 is not free). Keyed on
 // the base64 string so a key rotation (new env value) transparently re-imports.
 const keyCache = new Map<string, CryptoKey>();
@@ -137,6 +148,13 @@ export async function mintBrokerAssertion(
   if (!sub) {
     throw new BrokerAssertionError("broker assertion: a subject email is required");
   }
+  return mintBrokerAssertionSubject(sub, overrides);
+}
+
+async function mintBrokerAssertionSubject(
+  sub: string,
+  overrides: MintBrokerAssertionOverrides,
+): Promise<string> {
   const privateKeyB64 = overrides.privateKeyB64 ?? (await readEnv(BROKER_PRIVATE_KEY_ENV));
   if (!privateKeyB64) {
     throw new BrokerAssertionError(

package/apps/storefront/src/lib/auth/identityToken.ts

@@ -104,6 +104,10 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
   if (typeof email !== "string" || !email) {
     throw new Error("identity assertion missing `email` claim");
   }
+  const subject = payload.sub;
+  if (typeof subject !== "string" || subject.trim().length === 0) {
+    throw new Error("identity assertion missing `sub` claim");
+  }
   const tenantsRaw = Array.isArray(payload.tenants) ? payload.tenants : [];
   const tenants: TenantMembership[] = tenantsRaw.map((t): TenantMembership => {
     const entry = t as { resource?: unknown; role?: unknown };
@@ -118,7 +122,7 @@ export function toIdentityClaims(payload: Record<string, unknown>): IdentityClai
 
   const claims: IdentityClaims = {
     iss: String(payload.iss ?? ""),
-    sub: String(payload.sub ?? email),
+    sub: subject,
     aud: String(payload.aud ?? ""),
     iat: Number(payload.iat ?? 0),
     exp: Number(payload.exp ?? 0),
@@ -281,6 +285,8 @@ export async function getFederatedVerifier(
 
 /** The session fields derived from the VERIFIED token — the Phase-3 source of truth. */
 export interface DerivedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   resource: string;
   /** Coarse standing on THIS resource, surfaced as the display capability. */
@@ -307,6 +313,7 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
     throw new Error(`verified assertion carries no membership for resource "${resource}"`);
   }
   return {
+    subject: claims.sub,
     email: claims.email,
     resource,
     capability: membership.role,
@@ -318,6 +325,8 @@ export function sessionFromClaims(claims: IdentityClaims, resource: string): Der
 
 /** The multi-tenant fields derived from a verified FEDERATED assertion. */
 export interface FederatedSessionFields {
+  /** Opaque identity-provider subject, preserved exactly for live authorization. */
+  subject: string;
   email: string;
   /** The verified `aud` — the storefront app identity this console session is for. */
   resource: string;
@@ -341,6 +350,7 @@ export interface FederatedSessionFields {
  */
 export function sessionFromFederatedClaims(claims: IdentityClaims): FederatedSessionFields {
   const fields: FederatedSessionFields = {
+    subject: claims.sub,
     email: claims.email,
     resource: claims.aud,
     tenants: claims.tenants,

package/apps/storefront/src/lib/auth/internalContentAuthority.ts

@@ -0,0 +1,153 @@
+import type { PublicationRoutePlanV1, ResolvedRouteTierV1 } from "@tot/public-runtime";
+import type { SessionRecord, SessionStore } from "./session.js";
+import { readSession } from "./session.js";
+
+export const INTERNAL_CONTENT_CAPABILITY = "internal-content-reader" as const;
+export const INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS = 5_000;
+
+export type InternalContentAuthorityDecision =
+  | { allowed: true; tenant: string; spaceId: string; audience: "owner" | "developer" }
+  | { allowed: false; reason: "denied" | "unavailable" };
+
+export type InternalContentGrant = Extract<InternalContentAuthorityDecision, { allowed: true }>;
+
+interface BrokerContext {
+  appDomain: string;
+  audience: string;
+}
+
+export interface InternalContentAuthorityInput {
+  route: ResolvedRouteTierV1;
+  sessionStore?: SessionStore;
+  sessionId?: string | null;
+  coreUrl?: string | null;
+  mintAssertion: (subject: string) => Promise<string>;
+  fetchImpl?: typeof fetch;
+  nowSeconds?: number;
+}
+
+function routeIsDeclaredInternal(route: ResolvedRouteTierV1): route is ResolvedRouteTierV1 & {
+  space: NonNullable<ResolvedRouteTierV1["space"]>;
+} {
+  return route.origin === "publication-space" &&
+    route.requiresAuthorization &&
+    route.visibility === "internal" &&
+    route.authorization.policy === "capability" &&
+    route.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    route.assets.access === "authorized" &&
+    !!route.space &&
+    route.space.tenant === route.tenant;
+}
+
+function brokerContexts(value: unknown): BrokerContext[] | null {
+  const unwrapped = value && typeof value === "object" && "content" in value
+    ? (value as { content?: unknown }).content
+    : value;
+  if (!unwrapped || typeof unwrapped !== "object") return null;
+  const contexts = (unwrapped as { contexts?: unknown }).contexts;
+  if (!Array.isArray(contexts)) return null;
+  const parsed: BrokerContext[] = [];
+  for (const context of contexts) {
+    if (!context || typeof context !== "object") return null;
+    const appDomain = (context as { appDomain?: unknown }).appDomain;
+    const audience = (context as { audience?: unknown }).audience;
+    if (typeof appDomain !== "string" || typeof audience !== "string") return null;
+    parsed.push({ appDomain, audience });
+  }
+  return parsed;
+}
+
+/**
+ * Resolve internal-content authority from fresh broker state. The session is
+ * identity proof only: cached memberships, roles, headers, and preview state do
+ * not grant access. Every store/read/signing fault is an explicit unavailable
+ * result and callers serve the same non-disclosing denial response.
+ */
+export async function authorizeInternalContentRequest(
+  input: InternalContentAuthorityInput,
+): Promise<InternalContentAuthorityDecision> {
+  if (!routeIsDeclaredInternal(input.route)) return { allowed: false, reason: "denied" };
+  if (!input.sessionStore || !input.sessionId) return { allowed: false, reason: "denied" };
+
+  let session: SessionRecord | null;
+  try {
+    session = await readSession(
+      input.sessionStore,
+      input.sessionId,
+      input.nowSeconds ?? Math.floor(Date.now() / 1000),
+    );
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  const subject = session?.subject;
+  if (!subject || subject.trim().length === 0) {
+    return { allowed: false, reason: "denied" };
+  }
+
+  const coreUrl = (input.coreUrl ?? "").replace(/\/+$/, "");
+  if (!coreUrl) return { allowed: false, reason: "unavailable" };
+
+  let assertion: string;
+  try {
+    assertion = await input.mintAssertion(subject);
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+
+  let response: Response;
+  try {
+    response = await (input.fetchImpl ?? fetch)(`${coreUrl}/api/broker/appDomains`, {
+      method: "GET",
+      headers: {
+        accept: "application/json",
+        "X-ToT-Broker-Assertion": assertion,
+      },
+      signal: AbortSignal.timeout(INTERNAL_CONTENT_AUTHORITY_TIMEOUT_MS),
+    });
+  } catch {
+    return { allowed: false, reason: "unavailable" };
+  }
+  if (!response.ok) return { allowed: false, reason: "unavailable" };
+
+  let contexts: BrokerContext[] | null;
+  try {
+    contexts = brokerContexts(await response.json());
+  } catch {
+    contexts = null;
+  }
+  if (!contexts) return { allowed: false, reason: "unavailable" };
+
+  const matching = contexts.filter((context) => context.appDomain === input.route.tenant);
+  if (matching.length !== 1) return { allowed: false, reason: "denied" };
+  const audience = matching[0]!.audience;
+  if (audience !== "owner" && audience !== "developer") {
+    return { allowed: false, reason: "denied" };
+  }
+  return {
+    allowed: true,
+    tenant: input.route.tenant,
+    spaceId: input.route.space.spaceId,
+    audience,
+  };
+}
+
+/** Prove the carried grant still names the exact server-resolved F2 space. */
+export function internalContentGrantMatchesPlan(
+  grant: InternalContentGrant | undefined,
+  plan: PublicationRoutePlanV1,
+): boolean {
+  return !!grant && plan.action === "render" &&
+    plan.manifest.visibility === "internal" &&
+    plan.manifest.authorization.policy === "capability" &&
+    plan.manifest.authorization.capability === INTERNAL_CONTENT_CAPABILITY &&
+    plan.manifest.assets.access === "authorized" &&
+    grant.tenant === plan.route.tenant &&
+    grant.tenant === plan.manifest.tenant &&
+    grant.spaceId === plan.manifest.id;
+}
+
+/** Internal responses are never indexable or eligible for shared storage. */
+export function applyInternalContentResponsePolicy(headers: Headers): void {
+  headers.set("Cache-Control", "private, no-store");
+  headers.set("X-Robots-Tag", "noindex, nofollow");
+}

package/apps/storefront/src/lib/auth/loginGate.ts

@@ -244,6 +244,11 @@ export function isAdminPath(pathname: string): boolean {
  *   - every `/api/` route (tenant-state mutation). Genuinely-public API endpoints
  *     are already gate-exempt via {@link isPublicPath}/{@link isAuthPath}, so
  *     excluding all of `/api/` here costs nothing and fails safe.
+ *
+ * Every entry is matched in BOTH addressing forms — bare (`/api/...`) and
+ * tenant-prefixed (`/<tenant>/api/...`) — because the storefront serves the same
+ * route under both, so matching only one leaves the other reachable on a token or
+ * bypass header alone.
  */
 export function isBypassPrivilegedPath(pathname: string): boolean {
   if (isAdminPath(pathname)) return true;
@@ -252,6 +257,7 @@ export function isBypassPrivilegedPath(pathname: string): boolean {
   if (pathname === "/dev" || pathname.startsWith("/dev/")) return true;
   if (/^\/[^/]+\/dev(?:\/|$)/.test(pathname)) return true;
   if (pathname === "/api" || pathname.startsWith("/api/")) return true;
+  if (/^\/[^/]+\/api(?:\/|$)/.test(pathname)) return true;
   return false;
 }
 
@@ -281,6 +287,19 @@ export interface LoginGateInput {
    * (admin, cockpit, /api) are never bypassed regardless of this flag.
    */
   qaBypass?: boolean;
+  /**
+   * True when the request presented a signed, unexpired customization-preview
+   * token (`?__preview=` or the `tot_preview` cookie) whose `tenantId` claim is
+   * THIS request's tenant. The token is HMAC-signed with
+   * `CUSTOMIZATION_PREVIEW_SECRET` and tenant-bound, so it is not client-forgeable
+   * and one tenant's token never admits a viewer to another's content.
+   *
+   * Available to EVERY tenant: previewing an unpublished storefront is platform
+   * functionality, not a property of which tenant is being viewed. Passes the gate
+   * for PUBLIC CONTENT paths only; {@link isBypassPrivilegedPath} paths (admin,
+   * cockpit, /api) still require a real session.
+   */
+  previewTokenValid?: boolean;
 }
 
 /**
@@ -305,6 +324,12 @@ export function evaluateLoginGate(input: LoginGateInput): LoginGateDecision {
   // public content only. NEVER for admin/cockpit/api — that guard lives here (not
   // just in middleware) so /admin stays gated even if the flag is set upstream.
   if (input.qaBypass && !isBypassPrivilegedPath(input.pathname)) return { action: "pass" };
+  // Customization preview: a signed, tenant-bound preview token admits a viewer to
+  // that tenant's public content on any tenant. Same privileged-path exclusion as
+  // the QA bypass — admin/cockpit/api are never reachable on a token alone.
+  if (input.previewTokenValid && !isBypassPrivilegedPath(input.pathname)) {
+    return { action: "pass" };
+  }
   if (input.hasValidSession) return { action: "pass" };
   const next = input.pathname + (input.search ?? "");
   return { action: "redirect", location: `/auth/login?next=${encodeURIComponent(next)}` };

package/apps/storefront/src/lib/auth/session.ts

@@ -50,6 +50,8 @@ export const DEFAULT_SESSION_TTL_SECONDS = 7 * 24 * 3600;
  * are the multi-tenant claims carried in the verified token.
  */
 export interface SessionRecord {
+  /** Opaque identity-provider subject from the verified assertion. */
+  subject?: string;
   /** Verified email (lowercased) — the principal that passed the grant check. */
   email: string;
   /** The resource (appDomain/tenant, e.g. "sample-store.example") this session authorizes. */
@@ -166,6 +168,7 @@ export async function readSession(
     !record ||
     typeof record.email !== "string" ||
     typeof record.resource !== "string" ||
+    (record.subject !== undefined && typeof record.subject !== "string") ||
     typeof record.exp !== "number"
   ) {
     await store.delete(id);

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -14,7 +14,7 @@
  */
 import type { TenantConfig, ResolvedManagedCheckout } from "@tot/public-runtime";
 import { resolveManagedCheckout } from "@tot/public-runtime";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/runtimeEnv";
 
 /**
  * Resolve the effective checkout facts for a tenant, or null when the tenant has

package/apps/storefront/src/lib/compliance/enforcement.ts

@@ -19,7 +19,7 @@ import type {
 } from "@tot/public-runtime";
 import { enforcementSignals } from "@tot/public-runtime";
 import { readEnv } from "@/lib/env";
-import { COMPLIANCE_RULESETS } from "@/config/compliance/rulesets";
+import { COMPLIANCE_RULE_PROFILES } from "@/config/compliance/rulesets";
 
 /** True when the tenant sells age/nicotine-restricted goods (drives fail-closed). */
 export function isRegulatedTenant(
@@ -55,6 +55,26 @@ export function isSandboxVerificationProvider(
   return !!provider && SANDBOX_VERIFICATION_PROVIDERS.has(provider.toLowerCase());
 }
 
+/**
+ * The LIVE Token of Trust verification provider. When `TOT_VERIFICATION_PROVIDER`
+ * resolves to this, `/api/compliance/preflight` calls the real ToT verification
+ * API server-side (`@/lib/verification/totVerificationClient`) and derives the
+ * verification state from that call ALONE — never from a client-supplied
+ * `verification` field and never from the front-door affirmation.
+ *
+ * Deliberately DISJOINT from {@link SANDBOX_VERIFICATION_PROVIDERS}: the
+ * affirmation-simulates-verification shortcut must be unreachable under the live
+ * provider (asserted in enforcement.test.ts).
+ */
+export const LIVE_TOT_VERIFICATION_PROVIDER = "tot";
+
+/** True when the resolved provider is the live ToT verification integration. */
+export function isLiveTotVerificationProvider(
+  provider: string | undefined | null,
+): boolean {
+  return !!provider && provider.toLowerCase() === LIVE_TOT_VERIFICATION_PROVIDER;
+}
+
 /**
  * The PACT reporting CAPTURE sink status. The record BUILDER
  * (`buildPactReportRecord`) ships in this unit and the capture point is wired at
@@ -73,8 +93,10 @@ const PACT_REPORTING_CAPTURE_WIRED = true;
 export async function resolveTenantRuleset(
   tenant: Pick<TenantConfig, "tenant_id" | "compliance">,
 ): Promise<ComplianceRuleset | null> {
-  const base = COMPLIANCE_RULESETS[tenant.tenant_id];
-  if (!base) return null;
+  const profile = tenant.compliance?.ruleProfile;
+  const buildRuleset = profile ? COMPLIANCE_RULE_PROFILES[profile] : undefined;
+  if (!buildRuleset) return null;
+  const base = buildRuleset(tenant.tenant_id);
   const provider = (await readEnv("TOT_VERIFICATION_PROVIDER")) || undefined;
   return {
     ...base,

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -206,6 +206,50 @@ export const trackingTenantDatabases = sqliteTable(
   }),
 );
 
+// --- Managed-analytics test destinations -------------------------------------
+// A tenant-owned, NON-LIVE-ONLY destination a developer registers to prove
+// exactly-once delivery for a new marketing action before wiring a real vendor
+// adapter (GA4/Meta/Amplitude fire directly to the vendor with no server-side
+// readback). `environment` is never `live` — enforced by the managed-analytics
+// service, not by this table. Deliberately its OWN table, not `app_installs` —
+// this is not an integration install (no adapter, no manifest, no CSP/consent
+// plan); it is a disposable proving fixture for the action registry.
+export const testDestinations = sqliteTable(
+  "test_destinations",
+  {
+    destinationId: text("destination_id").primaryKey(),
+    tenantId: text("tenant_id").notNull(),
+    environment: text("environment").notNull(),
+    createdAt: text("created_at").notNull(),
+  },
+  (t) => ({
+    idxTestDestinationsTenant: index(
+      "idx_test_destinations_tenant",
+    ).on(t.tenantId),
+  }),
+);
+
+// The delivered-event ledger a test destination reads back. Keyed by
+// (destination_id, event_id): a retried/duplicate delivery of the same event id
+// is `INSERT OR IGNORE`, so the row a caller reads back always reflects the
+// FIRST delivery only — the proof that delivery landed exactly once.
+export const testDestinationDeliveries = sqliteTable(
+  "test_destination_deliveries",
+  {
+    destinationId: text("destination_id").notNull(),
+    eventId: text("event_id").notNull(),
+    tenantId: text("tenant_id").notNull(),
+    actionName: text("action_name").notNull(),
+    deliveredAt: text("delivered_at").notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.destinationId, t.eventId] }),
+    idxTestDestinationDeliveriesTenant: index(
+      "idx_test_destination_deliveries_tenant",
+    ).on(t.tenantId),
+  }),
+);
+
 // --- Webhook event spine ----------------------------------------------------
 // Immutable event log. `id` is the semantic event id we mint — distinct from
 // any per-delivery wire envelope id (see `webhookDeliveries.deliveryId` below).

package/apps/storefront/src/lib/edgeCache.ts

@@ -64,6 +64,13 @@ export function pageCacheKey(
   search: string,
   version: number,
   planRevision?: string,
+  publication?: {
+    spaceId: string;
+    channel: "preview" | "live";
+    pointerRevision: number;
+    versionId: string;
+    artifactDigest: string;
+  },
 ): Request {
   // A stored page carries the CSP header it was rendered with, INCLUDING any
   // version-scoped integration origins. Folding the resolved `planRevision` into
@@ -73,8 +80,17 @@ export function pageCacheKey(
   // integration plane resolved) the key is byte-identical to the non-integration
   // form, so a plain tenant pays nothing and its cache is never busted.
   const planSegment = planRevision ? `/pr:${planRevision}` : "";
+  const publicationSegment = publication
+    ? `/publication:${encodeURIComponent([
+        publication.spaceId,
+        publication.channel,
+        publication.pointerRevision,
+        publication.versionId,
+        publication.artifactDigest,
+      ].join(":"))}`
+    : "";
   return new Request(
-    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${pathname}${search}`,
+    `${CACHE_ORIGIN}/${tenantId}/v${version}${planSegment}${publicationSegment}${pathname}${search}`,
   );
 }