@tokenoftrust/storefront-runner 2.4.89 → 2.4.91

package/apps/storefront/.runner-dependency-cruiser.cjs

@@ -0,0 +1,38 @@
+module.exports = {
+  "forbidden": [
+    {
+      "name": "renderer-no-controlplane",
+      "severity": "error",
+      "from": {},
+      "to": {
+        "path": "(^|/)packages/private-controlplane/|^@tot/private-controlplane(/|$)|^@tokenoftrust/private-apps-devkit(/|$)"
+      }
+    }
+  ],
+  "options": {
+    "tsConfig": {
+      "fileName": "tsconfig.json"
+    },
+    "tsPreCompilationDeps": true,
+    "doNotFollow": {
+      "path": "node_modules"
+    },
+    "enhancedResolveOptions": {
+      "exportsFields": [
+        "exports"
+      ],
+      "conditionNames": [
+        "import",
+        "types",
+        "node",
+        "default"
+      ],
+      "extensions": [
+        ".ts",
+        ".tsx",
+        ".js",
+        ".mjs"
+      ]
+    }
+  }
+};

package/apps/storefront/astro.config.mjs

@@ -87,7 +87,7 @@ export default defineConfig({
   // Small first-paint tradeoff, offset by cross-page caching (see LIMITATIONS).
   build: { inlineStylesheets: "never" },
   // The cross-site form check runs in the front door (src/middleware/index.ts,
-  // lib/cdnForward.ts `crossSiteFormRefusal`) with the same rule, against the
+  // lib/publication/shared/cdnForward.ts `crossSiteFormRefusal`) with the same rule, against the
   // origin the viewer used. Astro's own check compares with the request URL, which
   // for a CloudFront-forwarded Tier 3 request is this Worker's host, not the viewer's.
   security: { checkOrigin: false },

package/apps/storefront/drizzle.config.apps.ts

@@ -8,6 +8,6 @@ import { defineConfig } from "drizzle-kit";
 // lineage/journal — the whole point of splitting the database.
 export default defineConfig({
   dialect: "sqlite",
-  schema: "./src/lib/d1/schema-apps.ts",
+  schema: "./src/lib/publication/d1/schema-apps.ts",
   out: "./migrations-apps",
 });

package/apps/storefront/env.d.ts

@@ -226,7 +226,7 @@ declare global {
        * the opaque subject, email + role(s)/capability tot20 resolved on this tenant, so chrome
        * can show "signed in as … — owner/developer/staff". Absent on open or
        * password-gated hosts. Chrome only: authorization reads the session record for the
-       * routed tenant (lib/pipeline/admission-request), never this.
+       * routed tenant (lib/publication/pipeline/admission-request), never this.
        */
       viewer?: {
         /** Opaque identity-provider subject from the verified session assertion. */

package/apps/storefront/migrations/README.md

@@ -10,20 +10,20 @@ by **Drizzle Kit** (ADR-0002), applied by `wrangler d1 migrations apply`.
 
 ## Source of truth
 
-- **`src/lib/d1/schema.ts`** (Drizzle schema, catalog + customization ONLY) is the
+- **`src/lib/publication/d1/schema.ts`** (Drizzle schema, catalog + customization ONLY) is the
   source of truth for migration *generation*. `drizzle-kit generate` diffs it into
   numbered `migrations/*.sql` (+ `meta/` journal) and owns the SQLite table-rebuild
   logic for `ALTER`s.
 - **`products_fts`** (FTS5 virtual table) can't be modelled by Drizzle — it's a custom
   migration (`0001_products_fts.sql`), hand-maintained.
 - The raw-SQL read model + ETL still consume `CATALOG_D1_SCHEMA`/`CUSTOMIZATION_D1_SCHEMA`
-  (`@tot/private-controlplane`). A **structural** equivalence test (`src/lib/d1/schema.test.ts`,
+  (`@tot/private-controlplane`). A **structural** equivalence test (`src/lib/publication/d1/schema.test.ts`,
   PRAGMA-based) asserts the migrations reproduce that contract, so generator and read
   model can't drift.
 
 ## Safety (D1 has no rollback)
 
-`src/lib/d1/migrationSafety.ts` + its test **fail CI** on any unmarked `DROP TABLE` /
+`src/lib/publication/d1/migrationSafety.ts` + its test **fail CI** on any unmarked `DROP TABLE` /
 `DROP COLUMN` (which also catches SQLite column-dropping rebuilds), because the
 equivalence test only proves *end-state* correctness, not a safe transition. An
 *intended* destructive change must opt in, in the migration file:
@@ -35,7 +35,7 @@ equivalence test only proves *end-state* correctness, not a safe transition. An
 ## Workflows
 
 **Regular change (add/alter a column, table):**
-1. Edit `src/lib/d1/schema.ts`.
+1. Edit `src/lib/publication/d1/schema.ts`.
 2. `pnpm --filter @tot/storefront gen:migrations` (Drizzle emits the next numbered SQL,
    including SQLite table-rebuilds for unsupported `ALTER`s).
 3. If a column was removed, add `-- allow-destructive: <reason>` to the generated file.
@@ -56,5 +56,5 @@ wrangler d1 migrations apply CATALOG_DB --env <env> [--remote|--local]
 ```
 
 > Catalog + customization tables share the **one** `CATALOG_DB` binding (one edge DB),
-> per `src/lib/customization/d1Store.ts`. The storefront-apps tables are a SEPARATE D1
+> per `src/lib/publication/customization/d1Store.ts`. The storefront-apps tables are a SEPARATE D1
 > (`STOREFRONT_APPS_DB`) applied the same way, from `../migrations-apps/`.

package/apps/storefront/package.json

@@ -14,7 +14,8 @@
     "preview": "wrangler dev",
     "typecheck": "astro check && tsc --noEmit",
     "astro": "astro",
-    "test": "NODE_OPTIONS=--experimental-sqlite vitest run --exclude src/lib/integrations/apps/v84CleanCloneReplay.test.ts --exclude src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite vitest run src/lib/integrations/apps/v84CleanCloneReplay.test.ts src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults"
+    "test": "NODE_OPTIONS=--experimental-sqlite vitest run --exclude src/lib/integrations/apps/v84CleanCloneReplay.test.ts --exclude src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite vitest run src/lib/integrations/apps/v84CleanCloneReplay.test.ts src/lib/integrations/apps/v84NonportableRouteDogfood.test.ts src/lib/integrations/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults",
+    "depcruise": "depcruise src --config .runner-dependency-cruiser.cjs"
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.1",

package/apps/storefront/src/components/catalog/storefront/CollectionCard.astro

@@ -6,7 +6,7 @@
  */
 import type { CatalogCollection } from "@tot/public-runtime";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/ProductCard.astro

@@ -14,7 +14,7 @@ import Img from "@/components/assets/storefront/Img.astro";
 import Badge from "@/components/content/storefront/Badge.astro";
 import PriceDisplay from "@/components/catalog/storefront/commerce/PriceDisplay.astro";
 import RatingStars from "@/components/catalog/storefront/commerce/RatingStars.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/commerce/BrandGrid.astro

@@ -15,7 +15,7 @@
  */
 import Section from "@/components/content/storefront/Section.astro";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface Brand {
   /** Brand name — the link label, image alt, and text-fallback wordmark. */

package/apps/storefront/src/components/catalog/storefront/commerce/TagFilterCloud.astro

@@ -10,7 +10,7 @@
  * raw-chrome `.tag-cloud` / `.tag-chip` block in
  * public/shared/commerce-chrome.css — same token vocabulary, same look.
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface TagItem {
   /** Display label. */

package/apps/storefront/src/components/catalog/storefront/islands/QuickView.tsx

@@ -9,7 +9,7 @@
 import { useEffect, useRef, useState } from "preact/hooks";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface QV {
   handle: string;

package/apps/storefront/src/components/catalog/storefront/islands/RecentlyViewed.tsx

@@ -8,7 +8,7 @@
 import { useEffect, useState } from "preact/hooks";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 export interface RVItem {
   handle: string;

package/apps/storefront/src/components/catalog/storefront/islands/SearchTypeahead.tsx

@@ -14,7 +14,7 @@ import { useCallback, useEffect, useRef, useState } from "preact/hooks";
 import type { TypeaheadDoc } from "@/lib/catalog/search/index";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   action?: string;

package/apps/storefront/src/components/catalog/storefront/plp/ActiveFilters.astro

@@ -2,10 +2,10 @@
 /**
  * Active-filter chips (Shopify-style). Shows what's applied as removable pills
  * above the grid — each chip is a link that drops exactly one filter, so it's
- * URL-addressable and back-button safe like the rest of faceting (src/lib/url.ts).
+ * URL-addressable and back-button safe like the rest of faceting (src/lib/publication/shared/url.ts).
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import { toggleFacet, buildQueryString } from "@/lib/url";
+import { toggleFacet, buildQueryString } from "@/lib/publication/shared/url";
 
 interface Props {
   query: ListProductsQuery;

package/apps/storefront/src/components/catalog/storefront/plp/FacetSidebar.astro

@@ -4,10 +4,10 @@
  * facet is a real link that toggles a querystring param (no JS required for
  * filtering). The optional mobile drawer toggle is the only island.
  *
- * Encoding handled by src/lib/url.ts (opt.<Name>=<value>, tag=, price, avail).
+ * Encoding handled by src/lib/publication/shared/url.ts (opt.<Name>=<value>, tag=, price, avail).
  */
 import type { Facet, ListProductsQuery } from "@tot/public-runtime";
-import { toggleFacet, buildQueryString, isPriceBucketActive, togglePriceBucket } from "@/lib/url";
+import { toggleFacet, buildQueryString, isPriceBucketActive, togglePriceBucket } from "@/lib/publication/shared/url";
 import { PRICE_BUCKETS, bucketByKey } from "@/lib/catalog/shared/priceBuckets";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/plp/Pagination.astro

@@ -6,7 +6,7 @@
  * be progressively enhanced to append, but the no-JS path stays correct.
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import { buildQueryString } from "@/lib/url";
+import { buildQueryString } from "@/lib/publication/shared/url";
 
 interface Props {
   query: ListProductsQuery;

package/apps/storefront/src/components/content/storefront/Breadcrumbs.astro

@@ -13,7 +13,7 @@
  * Build `crumbs` with `siteTrail` (lib/content/shared/breadcrumbs.ts) and pass the SAME array to `breadcrumbLd`.
  * `class` adds a hook for the page's own styles (`breadcrumbs` on the blog templates).
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import type { Crumb } from "@/lib/content/shared/breadcrumbs";
 

package/apps/storefront/src/components/content/storefront/EmptyState.astro

@@ -3,7 +3,7 @@
  * <EmptyState> — intentional empty result (search/PLP). Copy is passed in by
  * the parent (kept in the tenant's editorial voice).
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   title: string;

package/apps/storefront/src/components/content/storefront/blog/ReactionBar.astro

@@ -9,8 +9,8 @@
  * view counts). Tenant/collection-generic: mounts on any post route.
  */
 import { getReactionCounts, REACTIONS, type Reaction } from "@/lib/content/blog/reactions.js";
-import { readKv } from "@/lib/runtimeEnv";
-import { withBase } from "@/lib/basePath";
+import { readKv } from "@/lib/publication/shared/runtimeEnv";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   /** Collection id the post lives in (e.g. "blog", "the-build"). */

package/apps/storefront/src/components/content/storefront/chrome/NavDropdown.astro

@@ -16,7 +16,7 @@
  * Tenant-agnostic; theme-token skinned.
  */
 import type { ChromeNavItem, ChromeLink } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { isCurrentNavHref } from "@/lib/content/chrome/navCurrent";
 import { trackingAttributes } from "@tot/public-runtime";
 

package/apps/storefront/src/components/content/storefront/chrome/SiteFooter.astro

@@ -8,7 +8,7 @@
  * or checkout logic (commerce boundary).
  */
 import type { ChromeLink, FooterColumn, FooterNewsletter, SocialLink, ChromeLogo, FooterVariant } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { resolveNewsletterAgeAttestation } from "@/lib/content/chrome/newsletterAgeAttestation";
 import { trackingAttributes } from "@tot/public-runtime";

package/apps/storefront/src/components/content/storefront/chrome/SiteHeader.astro

@@ -18,7 +18,7 @@ import MegaMenu from "@/components/content/storefront/chrome/MegaMenu.astro";
 import NavDropdown from "@/components/content/storefront/chrome/NavDropdown.astro";
 import SearchTypeahead from "@/components/catalog/storefront/islands/SearchTypeahead.tsx";
 import MobileNav from "@/components/content/storefront/islands/MobileNav.tsx";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { ctaIdentityAttr } from "@/lib/content/chrome/ctaIdentity";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { trackingAttributes } from "@tot/public-runtime";

package/apps/storefront/src/components/content/storefront/chrome/UtilityNav.astro

@@ -6,7 +6,7 @@
  * convenience — the mobile menu carries these links).
  */
 import type { ChromeLink, SocialLink } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { trackingAttributes } from "@tot/public-runtime";
 

package/apps/storefront/src/components/content/storefront/commerce/ArticleCard.astro

@@ -17,7 +17,7 @@
  * excerpts — omit a field and its row simply doesn't render.
  */
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface ArticleImage {
   src: string;

package/apps/storefront/src/components/content/storefront/home/Hero.astro

@@ -22,7 +22,7 @@
 import type { HeroBlock } from "@/lib/content/storyblok/content-model";
 import type { CatalogProduct } from "@tot/public-runtime";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import { heroSlideshowView } from "@/lib/content/shared/heroSlideshow";
 

package/apps/storefront/src/components/content/storefront/marketing/CardGrid.astro

@@ -6,7 +6,7 @@
  */
 import Section from "@/components/content/storefront/Section.astro";
 import type { CardGridBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   block: CardGridBlock;

package/apps/storefront/src/components/content/storefront/marketing/Integrations.astro

@@ -7,7 +7,7 @@
 import Section from "@/components/content/storefront/Section.astro";
 import CodeSample from "@/components/content/storefront/marketing/CodeSample.astro";
 import type { IntegrationsBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   block: IntegrationsBlock;

package/apps/storefront/src/components/content/storefront/marketing/MarketingCtas.astro

@@ -6,7 +6,7 @@
  * base-path prefix so path-routed tenants stay in-tenant.
  */
 import type { MarketingCta } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   ctas?: MarketingCta[];

package/apps/storefront/src/components/customers/storefront/islands/SavedList.tsx

@@ -13,7 +13,7 @@ import {
 } from "@/lib/customers/shared/wishlist";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   locale: string;

package/apps/storefront/src/config/resolver.ts

@@ -21,7 +21,7 @@
  * default is configurable, not hardcoded.
  */
 import { tenantIdFromPath, type TenantResolver } from "@tot/public-runtime";
-import { readEnv, readKv } from "@/lib/env";
+import { readEnv, readKv } from "@/lib/publication/shared/env";
 import {
   tenantResolver as staticResolver,
   staticTenants,

package/apps/storefront/src/layouts/Layout.astro

@@ -542,7 +542,7 @@ const footerWidgets = await renderWidgetSlot(
         root-absolute links inside that prefix so navigation stays on the
         tenant. Host-routed requests have no base path and skip this entirely. */}
     <script>
-      import { bindBasePathAnchors } from "@/lib/basePath";
+      import { bindBasePathAnchors } from "@/lib/publication/shared/basePath";
       bindBasePathAnchors();
     </script>
 

package/apps/storefront/src/lib/access/auth/adminEntry.ts

@@ -4,7 +4,7 @@
  * keeps a non-member / unauthenticated visitor on the legitimate sign-in gate.
  *
  * NARROW to auth/session ENTRY: it CONSUMES the admin tab UX
- * (`pages/admin.astro` + `components/admin/AdminPublishTab.astro`) and the
+ * (`pages/admin.astro` + `components/publication/admin/AdminPublishTab.astro`) and the
  * ship-capability model (`change/shipCapabilities` + `change/route` decideIsOwner)
  * rather than reimplementing either. Everything it resolves is bound to the
  * RESOLVED tenant, never taken from client input, and never requires a

package/apps/storefront/src/lib/access/auth/brokerAssertion.ts

@@ -23,7 +23,7 @@
  * direction of the same decoupled-authZ pattern).
  */
 import { SignJWT, importPKCS8, type CryptoKey } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The audience tot20's broker verifier pins. */
 export const BROKER_AUDIENCE = "tot20-broker";

package/apps/storefront/src/lib/access/auth/devAuth.ts

@@ -16,7 +16,7 @@
  * Keeping the bypass in one file means "does prod contain the bypass?" is a single
  * grep (`devAuth`), and the production path in send/verify is never weakened.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { devTenantResources } from "@/config/devTenants";
 import { createSession } from "./session.js";
 

package/apps/storefront/src/lib/access/auth/identityToken.ts

@@ -26,7 +26,7 @@ import {
   type JWTVerifyGetKey,
   type JSONWebKeySet,
 } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   TENANT_ROLES,
   isTenantRole,

package/apps/storefront/src/lib/access/auth/mcpClientAssertion.ts

@@ -34,7 +34,7 @@
  * `devbook/app-binding.md` Recipe A ("multiple execution environments").
  */
 import { importPKCS8, exportJWK, SignJWT, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The only algorithm this assertion is signed with (the MCP verifier rejects anything else). */
 export const MCP_CLIENT_ASSERTION_ALG = "RS256";

package/apps/storefront/src/lib/access/auth/route.ts

@@ -14,7 +14,7 @@
  * tenant — never from request input.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import { createTotAccessClient, type TotAccessClient } from "./totAccessClient.js";
 import {
   KvSessionStore,

package/apps/storefront/src/lib/access/auth/totAccessClient.ts

@@ -26,7 +26,7 @@
  * to `credentialFields()` below — the ONLY spot to touch. Everything else (paths,
  * bodies, response shapes) is contract-fixed.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { diagEmail } from "@/lib/observability/diag/redact";
 import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 import { classifyStepUp, type StepUpChallenge, type StepUpObligation } from "./stepUpChallenge.js";

package/apps/storefront/src/lib/access/dashboard/delegateGate.ts

@@ -37,7 +37,7 @@ export type DelegateSection = { mode: "unpaid"; role: null; explanation: string
 /**
  * Resolve the whole delegate section. Before a store is paid, an invited developer can
  * already add changes AND publish them (both `merge-to-preview` and `publish-live` admit the
- * "unpaid-store-developer" basis, lib/pipeline/admission.ts), so delegation has nothing to
+ * "unpaid-store-developer" basis, lib/publication/pipeline/admission.ts), so delegation has nothing to
  * grant: every viewer, the owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store
  * resolves {@link resolveDelegateGate} unchanged.
  */

package/apps/storefront/src/lib/access/dashboard/staffVendorAccess.ts

@@ -30,7 +30,7 @@
  * factory) so the routes develop/test against `MockStaffVendorAccessClient` and
  * swap in the Http client with no call-site change.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { decodeJwt } from "jose";
 
 /**

package/apps/storefront/src/lib/access/shared/developerInvites.ts

@@ -52,7 +52,7 @@
  * seam is duplicated locally rather than imported from `@/lib/auth` so the grants
  * control-plane cluster stays self-contained (see `.dependency-cruiser.cjs`).
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 import { diagEmail } from "@/lib/observability/diag/redact";
 import { checkStorePreviewReady, type PreflightDecision } from "@/lib/access/shared/invitePreflight";

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -75,7 +75,7 @@
  * factory) so the route develops/tests against `MockPrincipalGrantClient` and
  * swaps in the Http client with no call-site change.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { diagEmail } from "@/lib/observability/diag/redact";
 import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
 

package/apps/storefront/src/lib/access/shared/tenantRouting.ts

@@ -55,7 +55,7 @@ function normalizePath(path: string): string {
 }
 
 /**
- * Routing for an authenticated CDN forward (lib/cdnForward.ts). The forward names
+ * Routing for an authenticated CDN forward (lib/publication/shared/cdnForward.ts). The forward names
  * its tenant outright and renders at the apex, as the tenant's own host would.
  * Only a tenant served from CloudFront static storage (`serving.provider:
  * "s3-overwrite"`) has a distribution that forwards here; any other resolves to

package/apps/storefront/src/lib/activity/killSwitch.ts

@@ -24,7 +24,7 @@
  * dev/tests immediately, and a Worker secret takes effect from the first primed
  * request of each isolate.
  */
-import { readEnv } from "../runtimeEnv.js";
+import { readEnv } from "../publication/shared/runtimeEnv.js";
 
 /** The one canonical flag name — shared verbatim by the server and the CLI mirror. */
 export const ACTIVITY_KILL_SWITCH_FLAG = "ACTIVITY_TELEMETRY_DISABLED";

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -51,7 +51,7 @@ import type { ActionKey } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/access/auth/route";
 import { sessionHostCapability } from "@/lib/access/auth/loginGate";
 import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { isOwnerCapability } from "@/lib/access/shared/capability";
 import { hashActorId, recordActivity } from "./recordActivity";
 

package/apps/storefront/src/lib/assets/durableR2Bindings.ts

@@ -4,7 +4,7 @@
  * with) and TENANT_CACHE for the durable-image status record. Unbound ⇒ every pre-flip stage
  * refuses, so a pointer-served version can never go live missing its captured images.
  */
-import { readKv, readR2 } from "@/lib/env";
+import { readKv, readR2 } from "@/lib/publication/shared/env";
 import { makeWorkerR2PinnedOriginalStager, R2StagingError, type R2BucketLike, type StatusKvLike } from "./durableR2.js";
 
 export async function workerR2PinnedOriginalStagerFromEnv(): Promise<

package/apps/storefront/src/lib/checkout/commerce/checkoutHandoffCorrelation.ts

@@ -33,7 +33,7 @@ import {
   type HandoffCorrelation,
   type IntegrationEnvironment,
 } from "@tot/public-runtime";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The server-only correlation-signing key binding — distinct from the cart secret
  * (key separation), and the SAME binding the order join verifies against. */

package/apps/storefront/src/lib/checkout/shared/checkoutCommerce.ts

@@ -29,7 +29,7 @@ import {
   resolveManagedCheckout,
   SHARED_DEMO_CHECKOUT,
 } from "@tot/public-runtime";
-import { readEnv } from "@/lib/runtimeEnv";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 
 /**
  * Resolve the effective checkout facts for a tenant, or null when the tenant has

package/apps/storefront/src/lib/compliance/enforcement.ts

@@ -18,7 +18,7 @@ import type {
   EnforcementEvidenceSignals,
 } from "@tot/public-runtime";
 import { enforcementSignals } from "@tot/public-runtime";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { COMPLIANCE_RULE_PROFILES } from "@/config/compliance/rulesets";
 
 /** True when the tenant sells age/nicotine-restricted goods (drives fail-closed). */

package/apps/storefront/src/lib/compliance/tamper-sentinel-boot.ts

@@ -24,7 +24,7 @@ import type {
   IntegrationSiteSurface,
 } from "@tot/public-runtime";
 import { INTEGRATION_PLAN_GLOBAL } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** Where the browser posts a tamper beacon; the server receiver records + suspends. */
 export const TAMPER_BEACON_ENDPOINT = "/api/compliance/tamper";

package/apps/storefront/src/lib/compliance/verification/totVerificationClient.ts

@@ -34,7 +34,7 @@
  * Structure mirrors `@/lib/auth/totAccessClient`: interface + Http impl + Mock +
  * env factory, with the wire-credential shape isolated to `credentialFields()`.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   FetchHttpTransport,
   type HttpGetTransport,

package/apps/storefront/src/lib/content/blog/collection.ts

@@ -6,7 +6,7 @@ import {
 } from "@tot/public-runtime";
 import type { AuthorBio, BlogPost, BlogPostSummary, BlogSettings, PostStatus } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 type ArtifactSource = Pick<ContentProvider, "readArtifact" | "listArtifactPaths">;
 function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactSource {

package/apps/storefront/src/lib/content/blog/provider.ts

@@ -13,7 +13,7 @@ import {
 import { getIndexSettings, listPosts } from "./collection.js";
 import type { BlogPost, BlogPostSummary, BlogSettings } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 /** The collection id `/blog` reads — the derived fallback's second argument. */
 const BLOG_COLLECTION = "blog";