@tokenoftrust/storefront-runner 2.4.44 → 2.4.46

package/apps/storefront/src/components/blog/ReactionBar.astro

@@ -20,7 +20,7 @@ interface Props {
 }
 
 const { collection, slug } = Astro.props;
-const { tenant, basePath, cspNonce } = Astro.locals;
+const { tenant, apiBasePath, cspNonce } = Astro.locals;
 
 const META: Record<Reaction, { emoji: string; label: string }> = {
   like: { emoji: "👍", label: "Like" },
@@ -31,10 +31,13 @@ const META: Record<Reaction, { emoji: string; label: string }> = {
 const kv = await readKv("TENANT_CACHE");
 const counts = await getReactionCounts(kv, tenant.tenant_id, collection, slug);
 
-// The react endpoint is base-path-scoped like every other same-origin POST
-// (mirrors the newsletter form action); host-routed tenants get an empty prefix.
+// The react endpoint is api-base-scoped like every other same-origin POST
+// (mirrors the newsletter form action); host-routed tenants get an empty
+// prefix. Uses apiBasePath, never basePath — basePath is overridden to a
+// preview/candidate pin's own render prefix, which has no `/api/...` mirror
+// (fb-1791905696516-ubw8a3's class).
 const endpoint = withBase(
-  basePath,
+  apiBasePath,
   `/api/blog/${encodeURIComponent(collection)}/${encodeURIComponent(slug)}/react`,
 );
 ---

package/apps/storefront/src/components/the-build/TheBuildIndexView.astro

@@ -13,6 +13,13 @@ import { collectionPathsV1 } from "@/lib/blog/collectionPaths.js";
 
 interface Props {
   basePath: string;
+  /**
+   * The tenant's REAL api prefix (`Astro.locals.apiBasePath`), used ONLY for
+   * the newsletter form's `/api/...` action — never `basePath`, which is
+   * overridden to a preview/candidate pin's own render prefix with no
+   * `/api/...` mirror (fb-1791905696516-ubw8a3's class).
+   */
+  apiBasePath: string;
   canonicalBase: string;
   copy: TheBuildIndexCopy;
   presentation: BlogPresentation;
@@ -21,7 +28,8 @@ interface Props {
   totalPages: number;
 }
 
-const { basePath, canonicalBase, copy, presentation, pagePosts, page, totalPages } = Astro.props;
+const { basePath, apiBasePath, canonicalBase, copy, presentation, pagePosts, page, totalPages } =
+  Astro.props;
 const buildPaths = collectionPathsV1(Astro.locals, "the-build");
 
 const href = (path: string) => `${basePath}${path}` || "/";
@@ -105,7 +113,11 @@ const itemList = {
     <section class="news-signup" aria-labelledby="news-signup-title">
       <h2 id="news-signup-title">Get {copy.title} in your inbox</h2>
       <p>A short note when something worth reading lands. Double opt-in — we'll email a link to confirm.</p>
-      <form class="news-form" method="post" action={href("/api/newsletter/the-build/subscribe")}>
+      <form
+        class="news-form"
+        method="post"
+        action={`${apiBasePath}/api/newsletter/the-build/subscribe`}
+      >
         <label class="sr-only" for="news-email">Email address</label>
         <input id="news-email" name="email" type="email" inputmode="email" autocomplete="email"
           required placeholder="you@example.com" />

package/apps/storefront/src/layouts/Layout.astro

@@ -25,7 +25,7 @@ import AuthBadge from "@/components/auth/AuthBadge.astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
 import { organizationLd, websiteLd } from "@/lib/jsonld";
-import { nonceInlineTags, CHROME_BODY_MARKER } from "@/lib/rawMarketingHtml";
+import { nonceInlineTags, prefixApiFormActions, CHROME_BODY_MARKER } from "@/lib/rawMarketingHtml";
 import { CHROME_BEHAVIOR_JS, CHROME_HEAD_JS, sanitizeSharedChromeFragment } from "@/lib/rawChrome";
 import { ASYNC_CSS_SWAP_JS } from "@/lib/asyncCss";
 import { reportTrackingChainHealth } from "@/lib/tracking/interactionHealth";
@@ -106,7 +106,7 @@ const {
   headerVariant,
   footerVariant,
 } = Astro.props;
-const { tenant, themeStyle, canonicalBase, basePath, cspNonce, features, capabilities } =
+const { tenant, themeStyle, canonicalBase, basePath, apiBasePath, cspNonce, features, capabilities } =
   Astro.locals;
 
 // Fixed-phase integration engine (ext-kernel-04): ONE engine emits the
@@ -175,12 +175,18 @@ if (chromeHtml && chromeHtml.includes(CHROME_BODY_MARKER)) {
   const bodyEnd = chromeHtml.lastIndexOf("</body>");
   sharedChrome = {
     header: nonceInlineTags(
-      sanitizeSharedChromeFragment(chromeHtml.slice(bodyOpen, marker)),
+      prefixApiFormActions(
+        sanitizeSharedChromeFragment(chromeHtml.slice(bodyOpen, marker)),
+        apiBasePath,
+      ),
       cspNonce,
     ),
     footer: nonceInlineTags(
-      sanitizeSharedChromeFragment(
-        chromeHtml.slice(marker + CHROME_BODY_MARKER.length, bodyEnd >= 0 ? bodyEnd : undefined),
+      prefixApiFormActions(
+        sanitizeSharedChromeFragment(
+          chromeHtml.slice(marker + CHROME_BODY_MARKER.length, bodyEnd >= 0 ? bodyEnd : undefined),
+        ),
+        apiBasePath,
       ),
       cspNonce,
     ),
@@ -268,7 +274,11 @@ const footerWidgets = await renderWidgetSlot(
 ---
 
 <!doctype html>
-<html lang={lang ?? tenant.locale.split("-")[0] ?? "en"} data-base-path={basePath || undefined}>
+<html
+  lang={lang ?? tenant.locale.split("-")[0] ?? "en"}
+  data-base-path={basePath || undefined}
+  data-api-base={apiBasePath || undefined}
+>
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />

package/apps/storefront/src/lib/analytics/webVitals.ts

@@ -34,6 +34,7 @@ import {
   isPurposeEligible,
   parseConsentSnapshot,
 } from "@tot/public-runtime";
+import { withClientApiBase } from "@/lib/basePath";
 
 /** The three field metrics we collect. INP is field-only (no lab equivalent). */
 export type WebVitalName = "lcp" | "inp" | "cls";
@@ -119,7 +120,7 @@ export const RUM_BEACON_PATH = "/api/rum/vitals";
  * `sendBeacon` is fire-and-forget and survives page unload — the moment CWV are
  * finalized. Falls back to a keepalive `fetch` where `sendBeacon` is absent.
  */
-export function beaconReporter(endpoint: string = RUM_BEACON_PATH): WebVitalsReporter {
+export function beaconReporter(endpoint: string = withClientApiBase(RUM_BEACON_PATH)): WebVitalsReporter {
   return (sample) => {
     if (typeof navigator === "undefined") return;
     const body = JSON.stringify(sample);

package/apps/storefront/src/lib/basePath.ts

@@ -80,6 +80,28 @@ export function withClientBase(href: string): string {
   return withBase(clientBasePath(), href);
 }
 
+/**
+ * The active tenant's REAL api prefix as seen from the browser, read from the
+ * `<html data-api-base>` attribute Layout.astro emits (mirrors
+ * `locals.apiBasePath`, middleware/renderChain.ts — never a preview/candidate
+ * pin's base path). Returns "" on the server, for host-routed tenants, or
+ * before hydration.
+ */
+export function clientApiBasePath(): string {
+  if (typeof document === "undefined") return "";
+  return document.documentElement.dataset.apiBase ?? "";
+}
+
+/**
+ * Convenience for client beacons that POST to a same-origin `/api/...`
+ * endpoint: prefix `path` with the client api base path so the request
+ * reaches the tenant's own routed prefix instead of 404ing at the platform
+ * host root (fb-1791984159097-jt5w3y's class).
+ */
+export function withClientApiBase(path: string): string {
+  return withBase(clientApiBasePath(), path);
+}
+
 /**
  * Keep same-origin root-absolute anchors inside the tenant prefix, so navigation on a
  * path-routed page stays on the tenant. Covers anchors in raw tenant HTML and chrome,

package/apps/storefront/src/lib/compliance/tamper-sentinel-boot.ts

@@ -24,6 +24,7 @@ import type {
   IntegrationSiteSurface,
 } from "@tot/public-runtime";
 import { INTEGRATION_PLAN_GLOBAL } from "@tot/public-runtime";
+import { withClientApiBase } from "@/lib/basePath";
 
 /** Where the browser posts a tamper beacon; the server receiver records + suspends. */
 export const TAMPER_BEACON_ENDPOINT = "/api/compliance/tamper";
@@ -91,14 +92,15 @@ function beaconSink(win: Window): TamperSink {
   const post = (beacon: TamperEvidenceBeacon): void => {
     try {
       const body = JSON.stringify(beacon);
+      const endpoint = withClientApiBase(TAMPER_BEACON_ENDPOINT);
       const nav = win.navigator as Navigator & {
         sendBeacon?: (url: string, data?: BodyInit) => boolean;
       };
       if (typeof nav.sendBeacon === "function") {
-        nav.sendBeacon(TAMPER_BEACON_ENDPOINT, new Blob([body], { type: "application/json" }));
+        nav.sendBeacon(endpoint, new Blob([body], { type: "application/json" }));
         return;
       }
-      void fetch(TAMPER_BEACON_ENDPOINT, {
+      void fetch(endpoint, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body,

package/apps/storefront/src/lib/dashboard/delegateGate.ts

@@ -27,18 +27,19 @@ import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSel
 
 /** What every viewer of an unpaid store is told in place of the delegate section. */
 export const UNPAID_DELEGATION_NOTE =
-  "Developers with preview access can already add changes to the site. Ship-on-behalf " +
-  "delegation becomes available once the live site is activated.";
+  "Developers you've invited can already add changes and publish them while the store is " +
+  "unpaid — no delegation needed. Ship-on-behalf delegation becomes available once the live " +
+  "site is activated.";
 
 /** The delegate section: an unpaid store's note, or the paid store's {@link DelegateGate}. */
 export type DelegateSection = { mode: "unpaid"; role: null; explanation: string } | DelegateGate;
 
 /**
- * Resolve the whole delegate section. Before a store is paid there is no live
- * site and preview-access developers can already add changes to the release
- * (the `merge-to-preview` admission class, lib/pipeline/admission.ts), so delegation has nothing to grant: every viewer, the
- * owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store resolves
- * {@link resolveDelegateGate} unchanged.
+ * Resolve the whole delegate section. Before a store is paid, an invited developer can
+ * already add changes AND publish them (both `merge-to-preview` and `publish-live` admit the
+ * "unpaid-store-developer" basis, lib/pipeline/admission.ts), so delegation has nothing to
+ * grant: every viewer, the owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store
+ * resolves {@link resolveDelegateGate} unchanged.
  */
 export function resolveDelegateSection(
   storefrontMode: string | null | undefined,

package/apps/storefront/src/lib/rawMarketingHtml.ts

@@ -180,6 +180,31 @@ export function prefixTenantLinks(html: string, basePath: string): string {
   return html.replace(ROOT_SERVED_HREF_RE, `href="${basePath}/`);
 }
 
+/**
+ * Matches `action="/api/…` and `formaction="/api/…`, excluding `/api/auth/` —
+ * that surface is platform-global and always host-root regardless of tenant
+ * routing, mirroring `loginGate.ts`'s `isAuthPath` carve-out (`/api/auth/`).
+ */
+const API_FORM_ACTION_RE = /\b(action|formaction)="\/api\/(?!auth\/)/g;
+
+/**
+ * Prefix root-absolute `/api/…` form targets (`action`/`formaction`) with the
+ * tenant's REAL api base path, so a raw/shared-chrome tenant's forms (footer
+ * newsletter signup, …) POST to the tenant's own path instead of 404ing at the
+ * platform host root under path-prefix routing (fb-1791984159097-jt5w3y).
+ *
+ * Mirrors {@link prefixTenantLinks}, but keyed on `apiBasePath`, never a
+ * preview/candidate pin's `basePath` — a pinned render's own `/api/...` POSTs
+ * have no mirror under that pin's prefix and would 404 there too (same class
+ * as fb-1791905696516-ubw8a3; see `middleware/renderChain.ts`'s
+ * `locals.apiBasePath`). No-op when apiBasePath is empty (host-routed prod,
+ * subdomain, custom domain).
+ */
+export function prefixApiFormActions(html: string, apiBasePath: string): string {
+  if (!apiBasePath) return html;
+  return html.replace(API_FORM_ACTION_RE, (_match, attr: string) => `${attr}="${apiBasePath}/api/`);
+}
+
 /** Raw pages with a robots `noindex` directive remain routable but stay out of discovery. */
 export function isIndexableHtml(html: string): boolean {
   for (const match of html.matchAll(/<meta\b([^>]*)>/gi)) {
@@ -275,6 +300,15 @@ export function rawHtmlResponse(
   opts: {
     nonce: string;
     basePath: string;
+    /**
+     * The tenant's REAL routed api prefix (`locals.apiBasePath`), used ONLY to
+     * rewrite `/api/...` form actions ({@link prefixApiFormActions}) — never
+     * the same value as `basePath` under a preview/candidate pin, where
+     * `basePath` is overridden to the pin's own render prefix. Omitted (the
+     * default, "") is a no-op, so every existing caller that hasn't threaded
+     * it through yet is unchanged.
+     */
+    apiBasePath?: string;
     chromeWrapper?: string | null;
     /**
      * The resolved effective plan for this request — the raw-mount half of the
@@ -363,7 +397,10 @@ export function rawHtmlResponse(
   composed = injectBodyEnd(composed, interactionTrackingScript(opts.nonce));
   composed = injectBodyEnd(composed, asyncCssSwapScript(opts.nonce));
   composed = resolveCanonicalHref(composed, opts.canonicalUrl);
-  const doc = prefixTenantLinks(composed, opts.basePath);
+  const doc = prefixApiFormActions(
+    prefixTenantLinks(composed, opts.basePath),
+    opts.apiBasePath ?? "",
+  );
   return new Response(doc, {
     headers: { "content-type": "text/html; charset=utf-8" },
   });

package/apps/storefront/src/lib/tracking/interactionCollector.ts

@@ -26,6 +26,7 @@
  * violate either.
  */
 import type { TotInteraction } from "@tot/public-runtime";
+import { withClientApiBase } from "@/lib/basePath";
 
 /** Where the browser beacon POSTs interaction batches. */
 export const INTERACTION_BEACON_PATH = "/api/tracking/interaction";
@@ -81,7 +82,9 @@ export type InteractionBatchSender = (events: InteractionWireEvent[]) => void;
 /** Default sender: one `sendBeacon` per flushed batch, falling back to a
  *  keepalive `fetch` where `sendBeacon` is absent (mirrors
  *  `analytics/webVitals.ts`'s `beaconReporter`). Never throws into the page. */
-export function beaconBatchSender(endpoint: string = INTERACTION_BEACON_PATH): InteractionBatchSender {
+export function beaconBatchSender(
+  endpoint: string = withClientApiBase(INTERACTION_BEACON_PATH),
+): InteractionBatchSender {
   return (events) => {
     if (events.length === 0 || typeof navigator === "undefined") return;
     const body = JSON.stringify({ events });

package/apps/storefront/src/pages/[...slug].astro

@@ -16,7 +16,8 @@ import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMa
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import { styleGuideAliasRewrite } from "@/lib/styleGuidePaths";
 
-const { tenant, canonicalBase, content, basePath, capabilities, features } = Astro.locals;
+const { tenant, canonicalBase, content, basePath, apiBasePath, capabilities, features } =
+  Astro.locals;
 const slug = (Astro.params.slug ?? "").replace(/^\/+|\/+$/g, "");
 
 // Defensive: never let the catch-all answer for first-class route namespaces.
@@ -60,6 +61,7 @@ if (rawHtml && rawPolicy.allowed) {
   return rawHtmlResponse(rawHtml, {
     nonce: Astro.locals.cspNonce,
     basePath,
+    apiBasePath,
     chromeWrapper,
     plan: Astro.locals.integrationPlan,
     consentSnapshot: Astro.locals.consentSnapshot,

package/apps/storefront/src/pages/index.astro

@@ -76,6 +76,7 @@ if (rawHtml && rawPolicy.allowed) {
   return rawHtmlResponse(rawHtml, {
     nonce: Astro.locals.cspNonce,
     basePath,
+    apiBasePath,
     chromeWrapper,
     plan: Astro.locals.integrationPlan,
     consentSnapshot: Astro.locals.consentSnapshot,

package/apps/storefront/src/pages/the-build/index.astro

@@ -10,7 +10,8 @@ import { getTheBuildSettings, listBuildPosts } from "@/lib/the-build/provider.js
 import { paginateBlogPosts } from "@/lib/blog/pagination.js";
 import { resolveTheBuildIndexCopy } from "@/lib/the-build/pagination.js";
 
-const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const { tenant, basePath, apiBasePath, canonicalBase, content, publicationTimestamp } =
+  Astro.locals;
 const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
 if (posts.length === 0) return new Response(null, { status: 404 });
 
@@ -23,6 +24,7 @@ const { posts: pagePosts, totalPages } = paginateBlogPosts(posts, copy.pageSize,
 
 <TheBuildIndexView
   basePath={basePath}
+  apiBasePath={apiBasePath}
   canonicalBase={canonicalBase}
   copy={copy}
   presentation={resolveBlogPresentation(settings)}

package/apps/storefront/src/pages/the-build/page/[n].astro

@@ -12,7 +12,8 @@ import { parseTheBuildPageParam, resolveTheBuildIndexCopy } from "@/lib/the-buil
 const page = parseTheBuildPageParam(Astro.params.n);
 if (page === null) return new Response(null, { status: 404 });
 
-const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
+const { tenant, basePath, apiBasePath, canonicalBase, content, publicationTimestamp } =
+  Astro.locals;
 const posts = await listBuildPosts(tenant.tenant_id, { content, now: publicationTimestamp });
 if (posts.length === 0) return new Response(null, { status: 404 });
 
@@ -27,6 +28,7 @@ if (!sliced) return new Response(null, { status: 404 });
 
 <TheBuildIndexView
   basePath={basePath}
+  apiBasePath={apiBasePath}
   canonicalBase={canonicalBase}
   copy={copy}
   presentation={resolveBlogPresentation(settings)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.44",
+  "version": "2.4.46",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",