@tokenoftrust/storefront-runner 2.2.3 → 2.2.5

package/apps/storefront/src/themes/reference.ts

@@ -59,14 +59,16 @@ export const referenceTheme: ThemeTokens = {
     },
   },
   brand: {
-    logoLight: "/brand/northwind-logo-light.svg",
-    logoDark: "/brand/northwind-logo-dark.svg",
     favicon: "/favicon.svg",
-    // No ogImage default: this object is the merge BASE for every tenant
-    // (schema.ts mergeTheme(referenceTheme, tenant.theme_tokens)), not just the
-    // reference/demo tenant's own theme. A hardcoded default here silently
-    // became every tenant's og:image unless they declared their own -- the
-    // northwind-og.svg placeholder shipped live on tokenoftrust.com this way.
+    // No logoLight/logoDark/ogImage default: this object is the merge BASE for every
+    // tenant (schema.ts mergeTheme(referenceTheme, tenant.theme_tokens)), not just the
+    // reference/demo tenant's own theme. A hardcoded default here silently becomes
+    // every tenant's value unless they declare their own -- exactly how the
+    // northwind-og.svg og:image placeholder shipped live on tokenoftrust.com. The two
+    // northwind logo SVGs removed here were the same bug, caught on the same sweep:
+    // any dark-header tenant with no declared logo would silently show "Northwind"
+    // branding in its own site header (Layout.astro) and Organization JSON-LD
+    // (jsonld.ts) instead of falling back to its text wordmark / generic favicon.
     motion: "full",
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/package.json

@@ -15,6 +15,7 @@
     "./image-finding-dependencies": "./src/image-finding-dependencies.ts",
     "./image-finding-acceptance": "./src/image-finding-acceptance.ts",
     "./image-preview-rewrite-overlay": "./src/image-preview-rewrite-overlay.ts",
+    "./hosted-image-media-types": "./src/hosted-image-media-types.ts",
     "./tenant-embed-defaults": "./src/tenant-embed-defaults.mjs",
     "./integration/lifecycle-host-asset": "./src/integration/lifecycle-host-asset.mjs",
     "./integration/native-ga4-sandbox-asset": "./src/integration/native-ga4-sandbox-asset.mjs"

package/packages/public-runtime/src/hosted-image-media-types.ts

@@ -0,0 +1,45 @@
+/**
+ * Single source of truth for hosted-image media-type <-> extension tables.
+ *
+ * These used to be independent literal objects copy-pasted across the S3 and
+ * R2 publish paths -- which is exactly how one of them silently fell out of
+ * sync (the SVG entry landed in scripts/publish/lib/hosted-original-publication.mjs's
+ * EXT map but not apps/storefront/src/lib/change/publication/hostedOriginalPoolStage.ts's
+ * MEDIA_TYPES map, so a tenant with a pinned SVG favicon staged to CloudFront but
+ * was silently rejected on the Cloudflare/R2 mirror). Importing from here instead
+ * of re-declaring the literal is what makes that class of drift impossible, not just
+ * tested against.
+ *
+ * Two separate tables, two separate trust boundaries -- do not merge them:
+ *
+ * - PINNED_ASSET_*: a tenant's locally-pinned bundle asset (/_a/<sha256>.<ext>,
+ *   e.g. a favicon) -- a hash-verified, already-reviewed file. Includes SVG.
+ * - CAPTURABLE_RASTER_MEDIA_TYPES: what a *remote* capture (original-image-capture.ts)
+ *   may fetch and rehost. Deliberately EXCLUDES svg: an externally-sourced SVG can
+ *   embed <script> and is an XSS vector, so only local, already-reviewed SVGs may
+ *   ever reach the pinned-asset path above.
+ */
+
+export const PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE: Readonly<Record<string, string>> = Object.freeze({
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "image/avif": ".avif",
+  "image/svg+xml": ".svg",
+});
+
+export const PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries(
+    Object.entries(PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE).map(([mediaType, ext]) => [ext, mediaType]),
+  ),
+);
+
+export const CAPTURABLE_RASTER_MEDIA_TYPES = Object.freeze([
+  "image/png", "image/jpeg", "image/gif", "image/webp", "image/avif",
+] as const);
+
+export type CapturableRasterMediaType = (typeof CAPTURABLE_RASTER_MEDIA_TYPES)[number];
+
+/** Comma-joined for an HTTP `Accept` header -- derived, never a second literal. */
+export const CAPTURABLE_RASTER_ACCEPT_HEADER = CAPTURABLE_RASTER_MEDIA_TYPES.join(",");

package/packages/public-runtime/src/tenant.ts

@@ -136,8 +136,9 @@ export interface ThemeShapeTokens {
 }
 
 export interface ThemeBrandTokens {
-  logoLight: string;
-  logoDark: string;
+  /** No platform default: a tenant with no declared logo gets the text wordmark, never a shared placeholder image (same rule as ogImage below). */
+  logoLight?: string;
+  logoDark?: string;
   favicon: string;
   /** No platform default: a tenant with no declared og:image gets no og:image tag, never a shared placeholder. */
   ogImage?: string;