@tokenoftrust/storefront-runner 2.4.89 → 2.4.91

package/apps/storefront/src/lib/content/shared/heroSlideshow.ts

@@ -1,5 +1,5 @@
 import type { HeroBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export function heroAutoplayAllowed(input: {
   enabled: boolean;

package/apps/storefront/src/lib/content/shared/homeVisualParity.ts

@@ -2,7 +2,7 @@ import {
   isSafeRehostedAssetPathForTenant,
   isSafeStorefrontHref,
 } from "@tot/public-runtime";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import type {
   CommerceTrustStripBlock,
   EditorialBlock,

package/apps/storefront/src/lib/content/shared/rawMarketingHtml.ts

@@ -24,7 +24,7 @@ import {
 } from "@tot/public-runtime";
 import { reportTrackingChainHealth } from "../../measurement/tracking/interactionHealth.js";
 import { ASYNC_CSS_SWAP_JS } from "./asyncCss.js";
-import { ROOT_SERVED_HREF_NAMESPACES } from "../../basePath.js";
+import { ROOT_SERVED_HREF_NAMESPACES } from "../../publication/shared/basePath.js";
 
 export { rawHtmlPolicy } from "@tot/public-runtime";
 

package/apps/storefront/src/lib/developer-experience/dev/cliSignInCode.ts

@@ -22,7 +22,7 @@
  * flags — no second browser round-trip. Omitted entirely when the caller has no SESSION KV
  * to mint against — the local loop then simply runs with no hosted signal.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { redactEmailForHint } from "@/lib/access/privacy/emailHint";
 import { createRendezvous, type RendezvousDeps } from "@/lib/developer-experience/dev/rendezvousBroker";
 

package/apps/storefront/src/lib/developer-experience/dev/rendezvousBroker.ts

@@ -19,7 +19,7 @@
  * (the MCP derives the expected audience from that fixed path, not the sub-path), so
  * one minted assertion shape covers every call. SERVER-SIDE ONLY.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/access/auth/mcpClientAssertion";
 import { FetchHttpTransport, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -10,7 +10,7 @@
  * (a non-skipped failure), while each caller keeps its own fail-open / fail-closed mapping
  * for the outcome.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export interface McpServiceResponse {
   status: number;

package/apps/storefront/src/lib/developer-experience/types/cloudflare-workers.d.ts

@@ -4,7 +4,7 @@
  * The storefront does not depend on @cloudflare/workers-types (its globals collide with the DOM
  * lib Astro compiles against), so the Durable Object surface the pipeline needs is declared here.
  * The module only resolves inside workerd; under Node it is imported lazily and guarded
- * (`lib/runtimeEnv.ts`).
+ * (`lib/publication/shared/runtimeEnv.ts`).
  */
 declare module "cloudflare:workers" {
   export type SqlStorageValue = ArrayBuffer | string | number | null;

package/apps/storefront/src/lib/engagement/messaging/messagesClient.ts

@@ -15,7 +15,7 @@
  *
  * Built like `@/lib/grants/developerInvites` (interface + Http impl + Mock + env factory).
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export interface InlineEmail {
   /** Recipient address. */

package/apps/storefront/src/lib/engagement/newsletter/resendClient.ts

@@ -5,7 +5,7 @@
  * (`POST /emails/batch`, up to 100 messages/call); audience/consent/unsubscribe
  * state stays first-party in our D1, never in a vendor list.
  */
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 /** Resend's batch limit: at most 100 messages per `/emails/batch` call. */
 export const RESEND_BATCH_LIMIT = 100;

package/apps/storefront/src/lib/engagement/social/tokenStore.ts

@@ -19,7 +19,7 @@
  * `null` when either binding is absent so callers degrade rather than throw.
  */
 import type { Queryable } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv } from "../../env.js";
+import { readD1, readEnv } from "../../publication/shared/env.js";
 
 /** The decrypted token material we persist as one JSON blob under AES-GCM. */
 export interface SocialTokenPayload {

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -30,7 +30,7 @@ import {
   type ProviderOutcome,
   type StockState,
 } from "@tot/public-runtime";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { decideAdminApiAccess } from "@/lib/access/auth/adminApiGuard";
 import { readViewerSession } from "@/lib/access/auth/route";
 import type { SessionRecord } from "@/lib/access/auth/session";

package/apps/storefront/src/lib/integrations/apps/gatewayKeys.ts

@@ -19,7 +19,7 @@
  * shape change.
  */
 import { importPKCS8, exportJWK, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The only algorithm the gateway signs with (verifiers reject anything else). */
 export const APP_GATEWAY_ALG = "RS256";

package/apps/storefront/src/lib/integrations/apps/registryAccess.ts

@@ -17,7 +17,7 @@ import { AppRegistryService } from "./registryService.js";
 import { D1CredentialStore } from "./credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "./gatewayKeys.js";
 import { fromD1 } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv } from "../../env.js";
+import { readD1, readEnv } from "../../publication/shared/env.js";
 
 /**
  * No-store JSON response — install/rotate bodies carry a one-time client

package/apps/storefront/src/lib/integrations/webhooks/emit.ts

@@ -51,7 +51,7 @@ import { getDispatcher } from "./getDispatcher.js";
 import { getRegistryService } from "../apps/registryAccess.js";
 import type { AppInstall } from "../apps/registryService.js";
 import { fromD1 } from "../../catalog/d1/catalog.js";
-import { readD1 } from "../../env.js";
+import { readD1 } from "../../publication/shared/env.js";
 
 /** Contract-scoped payload schema version — `asyncapi.yaml`'s `dataschemaversion` is `const: "1"` for V1. */
 const DATASCHEMA_VERSION = "1";

package/apps/storefront/src/lib/integrations/webhooks/getDispatcher.ts

@@ -23,7 +23,7 @@ import { D1CredentialStore } from "../apps/credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "../apps/gatewayKeys.js";
 import { json } from "../apps/registryAccess.js";
 import { fromD1, type Queryable } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv, readQueue } from "../../env.js";
+import { readD1, readEnv, readQueue } from "../../publication/shared/env.js";
 import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
 
 /** Binding name `getDispatcher()` checks to pick the Cloudflare Queues adapter. Not yet declared in `wrangler.toml`. */

package/apps/storefront/src/lib/measurement/attribution/orderConversionD1.ts

@@ -16,7 +16,7 @@
  * in-memory `node:sqlite` in tests unchanged.
  */
 import type { Queryable } from "../../catalog/d1/catalog.js";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   computeOrderConversion,
   resolveConversionEnvironment,

package/apps/storefront/src/lib/measurement/tracking/d1Control.ts

@@ -21,7 +21,7 @@
  * stores use (`d1/catalog.ts`), so the insert code in `interactionStore.ts` is
  * transport-agnostic and unit-testable against an in-memory sqlite.
  */
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 import type { Queryable, QueryStatement } from "../../catalog/d1/catalog.js";
 
 const CF_API_BASE = "https://api.cloudflare.com/client/v4";

package/apps/storefront/src/lib/measurement/tracking/interactionCollector.ts

@@ -26,7 +26,7 @@
  * violate either.
  */
 import type { TotInteraction } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** Where the browser beacon POSTs interaction batches. */
 export const INTERACTION_BEACON_PATH = "/api/tracking/interaction";

package/apps/storefront/src/lib/measurement/tracking/tenantD1Registry.ts

@@ -31,7 +31,7 @@
  * never fail because storage is unconfigured.
  */
 import { sha256Hex } from "@tot/public-runtime";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 import type { Queryable } from "../../catalog/d1/catalog.js";
 import {
   ensureDatabase,

package/apps/storefront/src/lib/observability/performance/webVitals.ts

@@ -34,7 +34,7 @@ import {
   isPurposeEligible,
   parseConsentSnapshot,
 } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** The three field metrics we collect. INP is field-only (no lab equivalent). */
 export type WebVitalName = "lcp" | "inp" | "cls";

package/apps/storefront/src/lib/orders/providers/foxyOrderClient.ts

@@ -23,7 +23,7 @@
  * `messagesClient.ts`, is a shared singleton that multiple callers (read
  * routes, event receiver) each independently resolve.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** One order line item, as tot-foxycart's `buildOrderPayload()` returns it. */
 export interface FoxyOrderLineItem {

package/apps/storefront/src/lib/{env.ts → publication/shared/env.ts}

@@ -12,7 +12,7 @@
  * all, so a request-time D1 handle is unobtainable there rather than merely
  * unused.
  */
-import type { D1Like } from "./catalog/d1/catalog.js";
+import type { D1Like } from "../../catalog/d1/catalog.js";
 
 export * from "./runtimeEnv.js";
 

package/apps/storefront/src/lib/{previewReload.ts → publication/shared/previewReload.ts}

@@ -6,7 +6,7 @@
  * A tiny live-reload client is injected (by src/middleware) into `test`-env HTML
  * pages ONLY — never `live`. It polls `GET /api/preview/version?tenant=<id>` (the
  * per-tenant edge cache-version integer, which bumps on every reconcile/publish;
- * see lib/edgeCache.ts + api/preview/reconcile.ts) and reloads the page when the
+ * see lib/publication/shared/edgeCache.ts + api/preview/reconcile.ts) and reloads the page when the
  * version changes. Poll-based v1; an SSE / Durable-Object PUSH is the later
  * upgrade (TODO below) that removes the ~1s poll latency.
  *

package/apps/storefront/src/lib/{url.ts → publication/shared/url.ts}

@@ -8,7 +8,7 @@
  *   &opt.Size=M&tag=sale&priceMin=50&priceMax=200&q=wool
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import type { PriceBucket } from "./catalog/shared/priceBuckets.js";
+import type { PriceBucket } from "../../catalog/shared/priceBuckets.js";
 
 export function parseQuery(url: URL): ListProductsQuery {
   const sp = url.searchParams;

package/apps/storefront/src/middleware/candidatePin.ts

@@ -8,7 +8,7 @@
  * `hasCandidatePin` means the same thing at both: a pin this tenant actually
  * verified, never the mere presence of a query param a client can type.
  */
-import { readEnv } from "@/lib/runtimeEnv";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 import { CANDIDATE_CONTENT_PIN_PARAM, verifyContentPinToken } from "@tot/public-runtime";
 
 export interface CandidateContentPin {

package/apps/storefront/src/middleware/controlPlane.ts

@@ -7,7 +7,7 @@
  * then delegates to the shared render chain with those values supplied.
  */
 import type { APIContext, MiddlewareNext } from "astro";
-import { readEnv, readD1, readKv } from "@/lib/env";
+import { readEnv, readD1, readKv } from "@/lib/publication/shared/env";
 import { fromD1, type D1Like } from "@/lib/catalog/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/measurement/consent/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integrations/integration/managedInstallDeclarations";
@@ -209,7 +209,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
       // with no standing here (staff browsing without a selection) carries none —
       // the session's standing on any other store never appears on this host.
       // Authorization never reads this chrome: admission resolves standing from the
-      // session record for the routed tenant (lib/pipeline/admission-request).
+      // session record for the routed tenant (lib/publication/pipeline/admission-request).
       //
       // On an admin path, "the host" a staff viewer is really acting on is the
       // ?asTenant= impersonation target (mirrors admin.astro/AdminPublishTab.astro's

package/apps/storefront/src/middleware/index.ts

@@ -22,9 +22,9 @@
 import { defineMiddleware } from "astro:middleware";
 import type { APIContext, MiddlewareNext } from "astro";
 import { getTenantResolver } from "@/config/resolver";
-import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
+import { readEnv, readKv, readR2 } from "@/lib/publication/shared/runtimeEnv";
 import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/access/shared/tenantRouting";
-import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
+import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/publication/shared/cdnForward";
 import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";

package/apps/storefront/src/middleware/publicRender.ts

@@ -7,8 +7,8 @@
  * accident. That absence is the contract, and it is held structurally rather
  * than by review: `public-render-no-request-time-d1` (.dependency-cruiser.cjs)
  * fails `pnpm run check` if ANY module reachable from this one reaches
- * `lib/env.ts`, the sole accessor for a live D1 handle. The public path reaches
- * `lib/runtimeEnv.ts` instead — readEnv/readKv/readR2, the substrate that serves
+ * `lib/publication/shared/env.ts`, the sole accessor for a live D1 handle. The public path reaches
+ * `lib/publication/shared/runtimeEnv.ts` instead — readEnv/readKv/readR2, the substrate that serves
  * published bytes.
  *
  * Two companions cover what a forward graph walk from this module cannot see:

package/apps/storefront/src/middleware/renderChain.ts

@@ -12,7 +12,7 @@ import type { APIContext, MiddlewareNext } from "astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme, themeToCssVars } from "@/themes/schema";
 import { createToTClient } from "@/lib/catalog/tot/ToTClient";
-import { readEnv, readR2 } from "@/lib/runtimeEnv";
+import { readEnv, readR2 } from "@/lib/publication/shared/runtimeEnv";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { isPlatformPublicDiscoveryPath } from "./routeBranch.js";
 import { resolveCandidateContentPin, type CandidateContentPin } from "./candidatePin.js";
@@ -26,10 +26,10 @@ import {
   readCacheVersion,
   getCachedPage,
   putCachedPage,
-} from "@/lib/edgeCache";
+} from "@/lib/publication/shared/edgeCache";
 import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/access/shared/cspStaticHashes";
 import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
-import { maybeInjectPreviewReload } from "@/lib/previewReload";
+import { maybeInjectPreviewReload } from "@/lib/publication/shared/previewReload";
 import {
   resolveCustomizationEnv,
   buildCsp,
@@ -178,7 +178,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
 
   // Candidate-render CONTENT PIN (`__tot_candidate_pin`): a signed, tenant- and
   // expiry-bound token minted ONLY by the control-plane candidate/revision
-  // renderers (`src/lib/preview/pinnedRouteRender.ts`, never client-forgeable)
+  // renderers (`src/lib/publication/preview/pinnedRouteRender.ts`, never client-forgeable)
   // that pins THIS one render's content resolution to an exact immutable
   // `versionId`, bypassing the shared `{live,test}` channel entirely. It rides
   // an in-process `context.rewrite()` from those renderers so a real Astro

package/apps/storefront/src/middleware/staticBundle.ts

@@ -7,8 +7,8 @@
  * hashed names exist only inside a tenant's bundle, never in the Worker's own
  * build output). It reads R2 and KV and never D1.
  */
-import { readR2 } from "@/lib/runtimeEnv";
-import { getCachedPage, putCachedPage, staticBundleCacheKey } from "@/lib/edgeCache";
+import { readR2 } from "@/lib/publication/shared/runtimeEnv";
+import { getCachedPage, putCachedPage, staticBundleCacheKey } from "@/lib/publication/shared/edgeCache";
 import {
   resolveChannelDigest,
   serveStaticBundle,

package/apps/storefront/src/pages/404.astro

@@ -13,7 +13,7 @@ export const prerender = false;
 
 import Layout from "@/layouts/Layout.astro";
 import CollectionCard from "@/components/catalog/storefront/CollectionCard.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 const { tenant, tot, basePath, features } = Astro.locals;
 

package/apps/storefront/src/pages/api/activity.ts

@@ -28,7 +28,7 @@
  * origin check, so the server-to-server callers work.
  */
 import type { APIContext } from "astro";
-import { readD1, readEnv, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { readD1, readEnv, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { verifyIngestAuth } from "@/lib/activity/ingestAuth";
 import { ingestEvents, type IngestRejection } from "@/lib/activity/ingest";

package/apps/storefront/src/pages/api/admin/activity-alerts.ts

@@ -26,7 +26,7 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { checkActivityAlerts } from "@/lib/activity/alerts";
 

package/apps/storefront/src/pages/api/admin/interaction-insights.ts

@@ -29,7 +29,7 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { resolveTenantStore, trackingNamePrefix } from "@/lib/measurement/tracking/tenantD1Registry";
 import { readD1Control } from "@/lib/measurement/tracking/d1Control";

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -7,7 +7,7 @@
  * Read-only.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   commerceActorForAdmin,

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -10,7 +10,7 @@
  * host/approver layer) — same posture as `api/evidence.json.ts`; no new gate here.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   createCheckoutOrderClient,

package/apps/storefront/src/pages/api/auth/send.ts

@@ -9,7 +9,7 @@
  * redirect to the "enter your code" step. Accepts an HTML form post (no JS needed).
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   EMAIL_RE,
   getAccessClient,

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -14,7 +14,7 @@
  * flat JSON). See `@/lib/auth/identityToken`.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   getAccessClient,
   getSessionStore,

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -12,7 +12,7 @@
  *     itself best-effort and never throws.
  */
 import type { APIRoute } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   getReactionCounts,
   isReaction,

package/apps/storefront/src/pages/api/checkout-style.css.ts

@@ -16,7 +16,7 @@
  */
 import type { APIContext } from "astro";
 import { buildCheckoutStyleCss } from "@tot/public-runtime";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/cli/policy.ts

@@ -21,7 +21,7 @@
  * the idiomatic write path today. See docs/architecture/dev-experience-hosted-vs-local.md.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -18,7 +18,7 @@ import {
   type StockState,
 } from "@tot/public-runtime";
 import { fromD1, listAllActiveProducts } from "@/lib/catalog/d1/catalog.js";
-import { readD1, readEnv } from "@/lib/env";
+import { readD1, readEnv } from "@/lib/publication/shared/env";
 import { evaluateFinalCart, type SeamView } from "@/lib/checkout/commerce/finalCartAuthorization.js";
 import { d1CommerceRunner, mirrorOnHand, reserveAllocation } from "@/lib/inventory/allocations.js";
 import { POST as compliancePreflight } from "../compliance/preflight.js";

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -15,7 +15,7 @@
  *     is redirected back to the referrer so the page can show its own thanks.
  */
 import type { APIRoute } from "astro";
-import { readD1, readKv, readEnv } from "@/lib/env";
+import { readD1, readKv, readEnv } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";

package/apps/storefront/src/pages/api/newsletter/confirm.ts

@@ -10,7 +10,7 @@
  * stale token renders a clean "invalid link" page — never a 500.
  */
 import type { APIRoute } from "astro";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
 

package/apps/storefront/src/pages/api/newsletter/unsubscribe.ts

@@ -14,12 +14,12 @@
  * (re-unsubscribing is a no-op success) and NON-LEAKING: an unknown token gets the exact
  * same response as a real one, so an observer can't probe which tokens exist.
  *
- * NOTE (integration): The front door.s cross-site form check (lib/cdnForward.ts `crossSiteFormRefusal`,
+ * NOTE (integration): The front door.s cross-site form check (lib/publication/shared/cdnForward.ts `crossSiteFormRefusal`,
  * the rule Astro.s `security.checkOrigin` applies) 403s a cross-origin form-encoded POST before it reaches this handler, which
  * would break the RFC 8058 one-click POST from a mailbox provider. See the unit report.
  */
 import type { APIContext } from "astro";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { unsubscribeByToken } from "@/lib/engagement/newsletter/subscribers";
 

package/apps/storefront/src/pages/api/newsletter.ts

@@ -15,8 +15,8 @@
  * 500. All failures degrade to a friendly thank-you.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
-import { withBase } from "@/lib/basePath";
+import { readKv } from "@/lib/publication/shared/env";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 // Minimal, permissive email shape check — we are not the source of truth for
 // deliverability; the ESP validates properly downstream.

package/apps/storefront/src/pages/api/request-access.ts

@@ -21,7 +21,7 @@
  * this must work on the storefront marketing tenant.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -14,7 +14,7 @@
  */
 import type { APIRoute } from "astro";
 import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/observability/performance/webVitals";
-import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { recordBlogView } from "@/lib/content/blog/viewCounts";
 
 export const prerender = false;

package/apps/storefront/src/pages/api/tracking/interaction.ts

@@ -37,7 +37,7 @@
  * stream is ever added.
  */
 import type { APIContext } from "astro";
-import { readD1, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { readD1, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { ingestInteractions, type StampedInteractionEvent } from "@/lib/measurement/tracking/collectorIngest";
 import { readD1Control } from "@/lib/measurement/tracking/d1Control";

package/apps/storefront/src/pages/auth/login.astro

@@ -62,7 +62,7 @@ const showCodeStep = sent && errorCode !== "expired" && errorCode !== "too_many_
 const devMode = import.meta.env.DEV;
 let devAuthOn = false;
 if (devMode) {
-  const { readEnv } = await import("@/lib/env");
+  const { readEnv } = await import("@/lib/publication/shared/env");
   devAuthOn = (await readEnv("DEV_AUTH")) === "1";
 }
 ---

package/apps/storefront/src/pages/capabilities.astro

@@ -18,7 +18,7 @@
  */
 export const prerender = false;
 
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   readPublishedArtifact,
   capabilitiesArtifactPath,

package/apps/storefront/src/pages/collections/[handle].astro

@@ -15,12 +15,12 @@ import ActiveFilters from "@/components/catalog/storefront/plp/ActiveFilters.ast
 import SortSelect from "@/components/catalog/storefront/plp/SortSelect.astro";
 import Pagination from "@/components/catalog/storefront/plp/Pagination.astro";
 import Img from "@/components/assets/storefront/Img.astro";
-import { parseQuery, buildQueryString } from "@/lib/url";
+import { parseQuery, buildQueryString } from "@/lib/publication/shared/url";
 import { breadcrumbLd, itemListLd } from "@/lib/content/shared/jsonld";
 import { truncate } from "@/lib/content/shared/format";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import { sourceSeoTitle } from "@/lib/content/seo/documentTitle";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { isBlankDescriptionHtml, sanitizeDescriptionHtml } from "@/lib/content/sanitizeDescriptionHtml";
 
 const { handle } = Astro.params;

package/apps/storefront/src/pages/feed.json.ts

@@ -7,7 +7,7 @@
  */
 import type { APIContext } from "astro";
 import { compileRouteTierIndexV1 } from "@tot/public-runtime";
-import { readKv } from "@/lib/runtimeEnv.js";
+import { readKv } from "@/lib/publication/shared/runtimeEnv.js";
 import {
   declaresMountedSpacesV1,
   feedInstantV1,

package/apps/storefront/src/pages/index.astro

@@ -18,7 +18,7 @@ import TrustStrip from "@/components/content/storefront/content/TrustStrip.astro
 import Faq from "@/components/content/storefront/marketing/Faq.astro";
 import MarketingBlocks from "@/components/content/storefront/marketing/MarketingBlocks.astro";
 import TierCards from "@/components/membership/storefront/membership/TierCards.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/content/shared/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";