Stage M2

apps/storefront/src/lib/api.ts

@@ -1,6 +1,6 @@
 import { createApiClient, type RequestOptions } from '@sport/api-client';
 
-import { clientEnv, getServerEnv } from './env';
+import { getServerEnv } from './env';
 
 /**
  * Two clients, because the two runtimes have different needs:
@@ -22,9 +22,21 @@ export function getServerApi() {
   });
 }
 
+/**
+ * Browser client.
+ *
+ * `baseUrl: ''` means same-origin: requests go through this app's own host and
+ * are proxied to the API (Next rewrite in development, Nginx in production).
+ * That is what makes the refresh cookie first-party — see ADR-0015 and the
+ * `rewrites()` comment in next.config.ts.
+ *
+ * Pointing this at the API host directly would work for anonymous catalog reads
+ * and then break the moment customer sign-in lands in M8, which is precisely
+ * the kind of latent inconsistency worth removing now.
+ */
 export const browserApi = createApiClient({
-  baseUrl: clientEnv.NEXT_PUBLIC_API_URL,
-  getAccessToken: () => null, // wired to the auth store in the auth milestone
+  baseUrl: '',
+  getAccessToken: () => null, // wired to the customer auth store in M8
 });
 
 /**