@tokenoftrust/storefront-runner 2.4.15 → 2.4.17

package/apps/storefront/src/config/publicationSpaceConfig.ts

@@ -2,6 +2,7 @@ import type {
   PublicationSpaceAliasV1,
   PublicationSpaceManifestV1,
   PublicationSpaceSourceV1,
+  PublicationSpaceVisibilityV1,
 } from "@tot/public-runtime";
 
 /**
@@ -34,3 +35,39 @@ export function rootPublicationSpaceConfig(
     },
   };
 }
+
+/**
+ * A mounted publication space for a tenant — public or internal, at any
+ * declared, non-root mount. Visibility drives the authorization, discovery,
+ * and asset-access triad together, the same invariant
+ * `validatePublicationSpaceManifestV1` enforces: public spaces are open and
+ * discoverable, internal spaces are capability-gated and excluded from every
+ * public discovery surface.
+ */
+export function mountedPublicationSpaceConfig(
+  tenant: string,
+  id: string,
+  source: PublicationSpaceSourceV1,
+  mount: string,
+  visibility: PublicationSpaceVisibilityV1 = "public",
+  aliases: readonly PublicationSpaceAliasV1[] = [],
+): PublicationSpaceManifestV1 {
+  const internal = visibility === "internal";
+  return {
+    version: 1,
+    id,
+    tenant,
+    source,
+    routes: aliases.length ? { canonicalMount: mount, aliases: [...aliases] } : { canonicalMount: mount },
+    visibility,
+    authorization: internal ? { policy: "capability", capability: "internal-content-reader" } : { policy: "public" },
+    discovery: internal
+      ? { sitemap: false, feeds: false, publicSearch: false, llms: false }
+      : { sitemap: true, feeds: true, publicSearch: true, llms: true },
+    assets: { namespace: id, access: internal ? "authorized" : "public" },
+    renderer: {
+      contractVersion: "storefront-v1",
+      themeContractVersion: "tenant-theme-v1",
+    },
+  };
+}

package/apps/storefront/src/config/publicationSpaceRegistry.ts

@@ -1,25 +1,53 @@
 import type { PublicationSpaceManifestV1, PublicationSpaceSourceV1 } from "@tot/public-runtime";
-import { rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+import { mountedPublicationSpaceConfig, rootPublicationSpaceConfig } from "./publicationSpaceConfig.js";
+import { PUBLICATION_SPACE_TOPOLOGY, type PublicationTopologyDeclarationV1 } from "./publicationSpaceTopology.js";
 
-const ROOT_SOURCES: Readonly<Record<string, PublicationSpaceSourceV1>> = {
-  home: { forge: "fixture", repo: "home", defaultBranch: "main" },
-  "tokenoftrust.com": { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" },
-  "storefront.tokenoftrust.store": {
-    forge: "gitea",
-    repo: "storefront.tokenoftrust.store",
-    defaultBranch: "main",
-  },
-  "sample-store.com": { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" },
-  "sample-store.e2e.test": { forge: "gitea", repo: "sample-store.e2e.test", defaultBranch: "main" },
-  "verify.e2e.test": { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" },
-  "fixture.e2e.test": { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" },
-  "chrome.e2e.test": { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" },
-  "catalog.e2e.test": { forge: "fixture", repo: "catalog.e2e.test", defaultBranch: "main" },
-};
+/**
+ * A declared source belongs to its tenant when the repo IS the tenant id, or is
+ * namespaced under it (`<tenant>-<suffix>`) — the naming convention every
+ * declared source in `publicationSpaceTopology.ts` already follows. This is the
+ * one check that stops a mounted space from naming a different tenant's
+ * repository, by construction rather than by a tenant-id branch here.
+ */
+function sourceBelongsToTenant(tenant: string, source: PublicationSpaceSourceV1): boolean {
+  return source.repo === tenant || source.repo.startsWith(`${tenant}-`);
+}
+
+/**
+ * Build one tenant's full publication-space manifest set — root plus any
+ * mounted public or internal spaces — from its declared topology. Pure
+ * resolution over the declaration: no tenant identity is ever branched on
+ * here, so this function is identical for every tenant and every mount count.
+ */
+export function publicationSpacesFromTopology(
+  tenant: string,
+  declaration: PublicationTopologyDeclarationV1,
+): PublicationSpaceManifestV1[] {
+  const spaces: PublicationSpaceManifestV1[] = [
+    rootPublicationSpaceConfig(tenant, declaration.root.source, declaration.root.aliases ?? []),
+    ...(declaration.mounted ?? []).map((mounted) =>
+      mountedPublicationSpaceConfig(
+        tenant,
+        mounted.id,
+        mounted.source,
+        mounted.mount,
+        mounted.visibility ?? "public",
+        mounted.aliases ?? [],
+      )),
+  ];
+  const foreign = spaces.find((space) => !sourceBelongsToTenant(tenant, space.source));
+  if (foreign) {
+    throw new Error(
+      `publication_foreign_source: space '${foreign.id}' for tenant '${tenant}' declares a source ` +
+        `('${foreign.source.forge}:${foreign.source.repo}') that is not namespaced under its own tenant.`,
+    );
+  }
+  return spaces;
+}
 
 /** Node-safe publication topology authority shared by runtime config and CI composition. */
 export function publicationSpacesForTenant(tenant: string): PublicationSpaceManifestV1[] {
-  const source = ROOT_SOURCES[tenant];
-  if (!source) return [];
-  return [rootPublicationSpaceConfig(tenant, source)];
+  const declaration = PUBLICATION_SPACE_TOPOLOGY[tenant];
+  if (!declaration) return [];
+  return publicationSpacesFromTopology(tenant, declaration);
 }

package/apps/storefront/src/config/publicationSpaceTopology.ts

@@ -0,0 +1,73 @@
+import type { PublicationSpaceAliasV1, PublicationSpaceSourceV1, PublicationSpaceVisibilityV1 } from "@tot/public-runtime";
+
+/**
+ * One declared non-root publication space: a mount, its source, and its
+ * visibility. Defaults to "public" — an "internal" declaration is the only
+ * way a tenant gets a capability-gated space.
+ */
+export interface MountedPublicationSpaceDeclarationV1 {
+  id: string;
+  source: PublicationSpaceSourceV1;
+  mount: string;
+  visibility?: PublicationSpaceVisibilityV1;
+  aliases?: readonly PublicationSpaceAliasV1[];
+}
+
+/** A tenant's complete declared publication topology: exactly one root, plus any mounted spaces. */
+export interface PublicationTopologyDeclarationV1 {
+  root: {
+    source: PublicationSpaceSourceV1;
+    aliases?: readonly PublicationSpaceAliasV1[];
+  };
+  mounted?: readonly MountedPublicationSpaceDeclarationV1[];
+}
+
+/**
+ * The declared publication topology for every provisioned tenant — the ONLY place a tenant's
+ * publication sources are named. `publicationSpaceRegistry.ts` resolves this generically, with
+ * no branching on tenant id; runtime config, CI composition, and both CDN publish paths all
+ * consume what it resolves, never this table directly.
+ */
+export const PUBLICATION_SPACE_TOPOLOGY: Readonly<Record<string, PublicationTopologyDeclarationV1>> = {
+  home: { root: { source: { forge: "fixture", repo: "home", defaultBranch: "main" } } },
+  "tokenoftrust.com": {
+    root: { source: { forge: "gitea", repo: "tokenoftrust.com-main", defaultBranch: "main" } },
+  },
+  "storefront.tokenoftrust.store": {
+    root: { source: { forge: "gitea", repo: "storefront.tokenoftrust.store", defaultBranch: "main" } },
+  },
+  "sample-store.com": {
+    root: { source: { forge: "gitea", repo: "sample-store.com", defaultBranch: "main" } },
+  },
+  "sample-store.e2e.test": {
+    root: { source: { forge: "gitea", repo: "sample-store.e2e.test", defaultBranch: "main" } },
+  },
+  "verify.e2e.test": {
+    root: { source: { forge: "fixture", repo: "verify.e2e.test", defaultBranch: "main" } },
+  },
+  // Carries the mounted public + mounted internal coverage every tenant topology can declare —
+  // see publicationSpaces.test.ts for the 3-space resolution this exercises.
+  "fixture.e2e.test": {
+    root: { source: { forge: "fixture", repo: "fixture.e2e.test", defaultBranch: "main" } },
+    mounted: [
+      {
+        id: "fixture-docs",
+        source: { forge: "fixture", repo: "fixture.e2e.test-docs", defaultBranch: "main" },
+        mount: "/docs",
+        visibility: "public",
+      },
+      {
+        id: "fixture-internal",
+        source: { forge: "fixture", repo: "fixture.e2e.test-internal", defaultBranch: "main" },
+        mount: "/internal-docs",
+        visibility: "internal",
+      },
+    ],
+  },
+  "chrome.e2e.test": {
+    root: { source: { forge: "fixture", repo: "chrome.e2e.test", defaultBranch: "main" } },
+  },
+  "catalog.e2e.test": {
+    root: { source: { forge: "fixture", repo: "catalog.e2e.test", defaultBranch: "main" } },
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.15",
+  "version": "2.4.17",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/publication-artifact.ts

@@ -205,6 +205,9 @@ export function publicationArtifactKeyV1(
   return `publications/${tenant}/${spaceId}/${versionId}/${lane}/${relativePath}`;
 }
 
+/** The largest `bundle.json` marker review admission reads; a larger one is never built. */
+export const PUBLICATION_ARTIFACT_MARKER_MAX_BYTES = 16 * 1024 * 1024;
+
 /** Marker address for one immutable tenant+space+version bundle. */
 export function publicationArtifactBundleKeyV1(
   tenant: string,