@tokenoftrust/storefront-runner 2.4.24 → 2.4.26

package/packages/public-runtime/src/publication-artifact.ts

@@ -42,8 +42,8 @@ export interface PublicationArtifactBundleExpectationV1 {
 
 /** Locale-independent canonical order for immutable publication files. */
 export function comparePublicationArtifactFilesV1(
-  left: PublicationArtifactFileV1,
-  right: PublicationArtifactFileV1,
+  left: Pick<PublicationArtifactFileV1, "lane" | "path">,
+  right: Pick<PublicationArtifactFileV1, "lane" | "path">,
 ): number {
   const leftIdentity = `${left.lane}\0${left.path}`;
   const rightIdentity = `${right.lane}\0${right.path}`;
@@ -96,10 +96,28 @@ export function publicationArtifactFileBytesV1(file: PublicationArtifactFileV1):
   }
 }
 
+/** The identity fields a bundle or its index must carry for `expected`. */
+function identityMatches(
+  value: Omit<PublicationArtifactBundleV1, "files">,
+  expected: PublicationArtifactBundleExpectationV1,
+): boolean {
+  return value.tenant === expected.tenant && value.spaceId === expected.spaceId &&
+    value.versionId === expected.versionId && value.sourceSha === expected.sourceSha &&
+    /^[0-9a-f]{40}$/.test(value.sourceSha) && value.artifactDigest === expected.artifactDigest &&
+    /^[0-9a-f]{64}$/.test(value.artifactDigest) && typeof value.sourceLock === "string" &&
+    /^[0-9a-f]{64}$/.test(value.sourceLock) &&
+    ["public", "internal"].includes(value.visibility) && typeof value.assetNamespace === "string" &&
+    !!value.assetNamespace && ["public", "authorized"].includes(value.assetAccess) &&
+    (expected.visibility === undefined || value.visibility === expected.visibility) &&
+    (expected.assetNamespace === undefined || value.assetNamespace === expected.assetNamespace) &&
+    (expected.assetAccess === undefined || value.assetAccess === expected.assetAccess);
+}
+
 /**
- * Canonical marker admission shared by the writer-side activation gate and the
- * renderer. It validates shape, identity, source provenance/lock, and recomputes
- * the complete file-list digest; a marker cannot define its own admission facts.
+ * Full in-memory bundle admission: the producer side (a freshly built version, a CI composition)
+ * holds every file's bytes. It validates shape, identity and source lock, and recomputes the digest;
+ * a bundle cannot define its own admission facts. A stored artifact is admitted by its index
+ * (`validatePublicationArtifactIndexV1`).
  */
 export async function validatePublicationArtifactBundleV1(
   value: unknown,
@@ -109,17 +127,7 @@ export async function validatePublicationArtifactBundleV1(
   const bundle = value as PublicationArtifactBundleV1;
   if (!hasExactKeys(bundle, ["tenant", "spaceId", "versionId", "sourceSha", "artifactDigest",
     "sourceLock", "visibility", "assetNamespace", "assetAccess", "files"]) ||
-    bundle.tenant !== expected.tenant || bundle.spaceId !== expected.spaceId ||
-    bundle.versionId !== expected.versionId || bundle.sourceSha !== expected.sourceSha ||
-    !/^[0-9a-f]{40}$/.test(bundle.sourceSha) || bundle.artifactDigest !== expected.artifactDigest ||
-    !/^[0-9a-f]{64}$/.test(bundle.artifactDigest) || typeof bundle.sourceLock !== "string" ||
-    !/^[0-9a-f]{64}$/.test(bundle.sourceLock) ||
-    !["public", "internal"].includes(bundle.visibility) || typeof bundle.assetNamespace !== "string" ||
-    !bundle.assetNamespace ||
-    !["public", "authorized"].includes(bundle.assetAccess) || !Array.isArray(bundle.files) ||
-    (expected.visibility !== undefined && bundle.visibility !== expected.visibility) ||
-    (expected.assetNamespace !== undefined && bundle.assetNamespace !== expected.assetNamespace) ||
-    (expected.assetAccess !== undefined && bundle.assetAccess !== expected.assetAccess)) return { ok: false };
+    !identityMatches(bundle, expected) || !Array.isArray(bundle.files)) return { ok: false };
   const paths = new Set<string>();
   for (const file of bundle.files) {
     if (!validPublicationArtifactFileV1(file) || !publicationArtifactFileBytesV1(file)) {
@@ -148,23 +156,114 @@ export async function validatePublicationArtifactBundleV1(
   }
 }
 
+/**
+ * One file as the artifact INDEX records it: its identity and the sha256 of its bytes, never the
+ * bytes themselves. The artifact digest is computed over exactly these rows, so an index proves
+ * its version without carrying any content.
+ */
+export interface PublicationArtifactIndexFileV1 {
+  lane: PublicationArtifactFileV1["lane"];
+  path: string;
+  encoding: PublicationArtifactFileV1["encoding"];
+  byteSize: number;
+  sha256: string;
+}
+
+/**
+ * The stored marker for one tenant+space+version: the bundle's identity and its file index. It grows
+ * with the number of files, never with their bytes; each file's bytes are their own object, addressed
+ * by sha256 (`publicationArtifactObjectKeyV1`), and a reader fetches only the files it serves.
+ */
+export interface PublicationArtifactIndexV1 extends Omit<PublicationArtifactBundleV1, "files"> {
+  files: PublicationArtifactIndexFileV1[];
+}
+
+/** The digest over index rows: the one formula the writer, the index validator and readers share. */
+async function publicationArtifactIndexDigestV1(files: readonly PublicationArtifactIndexFileV1[]): Promise<string> {
+  const rows = [...files].sort(comparePublicationArtifactFilesV1)
+    .map((file) => `${file.lane}\0${file.path}\0${file.encoding}\0${file.byteSize}\0${file.sha256}`);
+  return sha256Hex(rows.join("\n"));
+}
+
+/** The index row for one complete file. */
+export async function publicationArtifactIndexFileV1(
+  file: PublicationArtifactFileV1,
+): Promise<PublicationArtifactIndexFileV1> {
+  const bytes = publicationArtifactFileBytesV1(file);
+  if (!bytes) throw new Error("publication artifact file is malformed");
+  return { lane: file.lane, path: file.path, encoding: file.encoding, byteSize: file.byteSize,
+    sha256: await sha256Hex(bytes) };
+}
+
 /** Canonical content digest shared by the trusted writer and renderer readback. */
 export async function publicationArtifactDigestV1(
   files: readonly PublicationArtifactFileV1[],
 ): Promise<string> {
   if (!Array.isArray(files)) throw new Error("publication artifact file list is malformed");
-  const ordered = [...files].sort(comparePublicationArtifactFilesV1);
   const paths = new Set<string>();
-  const rows = await Promise.all(ordered.map(async (file) => {
+  const rows = await Promise.all(files.map(async (file) => {
     if (!validPublicationArtifactFileV1(file) || paths.has(file.path)) {
       throw new Error("publication artifact file is malformed or duplicated");
     }
     paths.add(file.path);
-    const bytes = publicationArtifactFileBytesV1(file);
-    if (!bytes) throw new Error("publication artifact file is malformed");
-    return `${file.lane}\0${file.path}\0${file.encoding}\0${file.byteSize}\0${await sha256Hex(bytes)}`;
+    return publicationArtifactIndexFileV1(file);
   }));
-  return sha256Hex(rows.join("\n"));
+  return publicationArtifactIndexDigestV1(rows);
+}
+
+/** The index a complete bundle stores as its marker. */
+export async function publicationArtifactIndexV1(
+  bundle: PublicationArtifactBundleV1,
+): Promise<PublicationArtifactIndexV1> {
+  const { files, ...identity } = bundle;
+  const rows = await Promise.all([...files].sort(comparePublicationArtifactFilesV1)
+    .map((file) => publicationArtifactIndexFileV1(file)));
+  return { ...identity, files: rows };
+}
+
+function validIndexFile(value: unknown): value is PublicationArtifactIndexFileV1 {
+  if (!value || typeof value !== "object" || !hasExactKeys(value,
+    ["lane", "path", "encoding", "byteSize", "sha256"])) return false;
+  const file = value as PublicationArtifactIndexFileV1;
+  return ["content", "public-asset", "authorized-asset"].includes(file.lane) &&
+    ["utf8", "base64"].includes(file.encoding) && typeof file.path === "string" &&
+    safeArtifactPath(file.path) && Number.isSafeInteger(file.byteSize) && file.byteSize >= 0 &&
+    typeof file.sha256 === "string" && /^[0-9a-f]{64}$/.test(file.sha256);
+}
+
+/**
+ * Admission for a stored index, shared by review admission, the renderer and every off-path reader.
+ * It validates shape and identity, recomputes the artifact digest from the rows and the source lock
+ * from that digest: an index cannot define its own admission facts, exactly as a full bundle could not.
+ */
+export async function validatePublicationArtifactIndexV1(
+  value: unknown,
+  expected: PublicationArtifactBundleExpectationV1,
+): Promise<{ ok: true; value: PublicationArtifactIndexV1 } | { ok: false }> {
+  if (!value || typeof value !== "object") return { ok: false };
+  const index = value as PublicationArtifactIndexV1;
+  if (!hasExactKeys(index, ["tenant", "spaceId", "versionId", "sourceSha", "artifactDigest",
+    "sourceLock", "visibility", "assetNamespace", "assetAccess", "files"]) ||
+    !identityMatches(index, expected) || !Array.isArray(index.files)) return { ok: false };
+  const paths = new Set<string>();
+  for (const file of index.files) {
+    if (!validIndexFile(file)) return { ok: false };
+    if ((file.lane === "public-asset" && index.assetAccess !== "public") ||
+      (file.lane === "authorized-asset" && index.assetAccess !== "authorized")) return { ok: false };
+    if (paths.has(file.path)) return { ok: false };
+    paths.add(file.path);
+  }
+  try {
+    const digest = await publicationArtifactIndexDigestV1(index.files);
+    if (digest !== expected.artifactDigest) return { ok: false };
+    const sourceLock = await publicationArtifactSourceLockV1({
+      tenant: expected.tenant, spaceId: expected.spaceId, forge: expected.forge, repo: expected.repo,
+      sourceSha: expected.sourceSha, versionId: expected.versionId, artifactDigest: digest,
+    });
+    return sourceLock === index.sourceLock ? { ok: true, value: index } : { ok: false };
+  } catch {
+    return { ok: false };
+  }
 }
 
 /** Canonical source lock binds one immutable artifact to its configured source. */
@@ -183,41 +282,174 @@ export function publicationArtifactSourceLockV1(input: {
   ].join("\0"));
 }
 
-/** Physical immutable namespace. Logical artifact paths are always relative. */
-export function publicationArtifactKeyV1(
-  tenant: string,
-  spaceId: string,
-  versionId: string,
-  lane: PublicationArtifactFileV1["lane"],
-  relativePath: string,
-): string {
+function assertSafeIdentity(tenant: string, spaceId: string, versionId: string): void {
   if (!PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(tenant) ||
     !PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(spaceId) ||
     !PUBLICATION_ARTIFACT_VERSION_RE.test(versionId)) {
     throw new Error("publication artifact identity is unsafe");
   }
-  if (!["content", "public-asset", "authorized-asset"].includes(lane) ||
-    !relativePath || relativePath.startsWith("/") || relativePath.includes("\\") ||
-    relativePath.includes("\0") ||
-    relativePath.split("/").some((part) => !part || part === "." || part === "..")) {
-    throw new Error("publication artifact path is unsafe");
-  }
-  return `publications/${tenant}/${spaceId}/${versionId}/${lane}/${relativePath}`;
 }
 
-/** The largest `bundle.json` marker review admission reads; a larger one is never built. */
-export const PUBLICATION_ARTIFACT_MARKER_MAX_BYTES = 16 * 1024 * 1024;
+/**
+ * Physical address of one file's bytes: its sha256 under the version. A tenant's file names never
+ * reach an object key, so a key is ASCII by construction and no tool between writer and reader can
+ * re-encode it (a store CLI percent-encodes a non-ASCII key, which strands the object under a name
+ * the reader never asks for).
+ */
+export function publicationArtifactObjectKeyV1(
+  tenant: string,
+  spaceId: string,
+  versionId: string,
+  sha256: string,
+): string {
+  assertSafeIdentity(tenant, spaceId, versionId);
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw new Error("publication artifact object address is unsafe");
+  return `publications/${tenant}/${spaceId}/${versionId}/objects/${sha256}`;
+}
 
-/** Marker address for one immutable tenant+space+version bundle. */
-export function publicationArtifactBundleKeyV1(
+/**
+ * The largest index review admission and readers accept. An index row costs about 200 bytes, so this
+ * admits tens of thousands of files whatever their size.
+ */
+export const PUBLICATION_ARTIFACT_INDEX_MAX_BYTES = 16 * 1024 * 1024;
+
+/** Index (marker) address for one immutable tenant+space+version artifact. */
+export function publicationArtifactIndexKeyV1(
   tenant: string,
   spaceId: string,
   versionId: string,
 ): string {
-  if (!PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(tenant) ||
-    !PUBLICATION_ARTIFACT_IDENTIFIER_RE.test(spaceId) ||
-    !PUBLICATION_ARTIFACT_VERSION_RE.test(versionId)) {
-    throw new Error("publication artifact identity is unsafe");
+  assertSafeIdentity(tenant, spaceId, versionId);
+  return `publications/${tenant}/${spaceId}/${versionId}/index.json`;
+}
+
+/**
+ * Every object one bundle stores, in write order: one per distinct file content (addressed by
+ * sha256), then its index. The single definition of the stored layout, shared by the writer and
+ * every reader's test fixtures.
+ */
+export async function publicationArtifactObjectsV1(
+  bundle: PublicationArtifactBundleV1,
+): Promise<Array<{ key: string; bytes: Uint8Array }>> {
+  const index = await publicationArtifactIndexV1(bundle);
+  const objects = new Map<string, Uint8Array>();
+  for (const file of bundle.files) {
+    const bytes = publicationArtifactFileBytesV1(file);
+    if (!bytes) throw new Error("publication bundle contained malformed file bytes");
+    const key = publicationArtifactObjectKeyV1(bundle.tenant, bundle.spaceId, bundle.versionId, await sha256Hex(bytes));
+    if (!objects.has(key)) objects.set(key, bytes);
+  }
+  return [...[...objects].map(([key, bytes]) => ({ key, bytes })), {
+    key: publicationArtifactIndexKeyV1(bundle.tenant, bundle.spaceId, bundle.versionId),
+    bytes: new TextEncoder().encode(JSON.stringify(index)),
+  }];
+}
+
+/** One stored object, as R2 and test stores both expose it. */
+export interface PublicationArtifactStoredObjectV1 {
+  text(): Promise<string>;
+  arrayBuffer(): Promise<ArrayBuffer>;
+  size?: number;
+}
+
+/** Provider-neutral object-store read surface. */
+export interface PublicationArtifactReadBucketV1 {
+  get(key: string): Promise<PublicationArtifactStoredObjectV1 | null>;
+}
+
+export type PublicationArtifactIndexReadV1 =
+  | { ok: true; index: PublicationArtifactIndexV1 }
+  | { ok: false; code: "publication_artifact_marker_missing" | "publication_artifact_marker_malformed" |
+    "publication_artifact_source_unavailable" };
+
+/** Read and admit the index for `expected`. Never reads a file's bytes. */
+export async function readPublicationArtifactIndexV1(
+  bucket: PublicationArtifactReadBucketV1,
+  expected: PublicationArtifactBundleExpectationV1,
+): Promise<PublicationArtifactIndexReadV1> {
+  let stored: PublicationArtifactStoredObjectV1 | null;
+  try {
+    stored = await bucket.get(publicationArtifactIndexKeyV1(expected.tenant, expected.spaceId, expected.versionId));
+  } catch {
+    return { ok: false, code: "publication_artifact_source_unavailable" };
+  }
+  if (!stored) return { ok: false, code: "publication_artifact_marker_missing" };
+  if (typeof stored.size === "number" && stored.size > PUBLICATION_ARTIFACT_INDEX_MAX_BYTES) {
+    return { ok: false, code: "publication_artifact_marker_malformed" };
+  }
+  let value: unknown;
+  try {
+    const text = await stored.text();
+    if (new TextEncoder().encode(text).byteLength > PUBLICATION_ARTIFACT_INDEX_MAX_BYTES) {
+      return { ok: false, code: "publication_artifact_marker_malformed" };
+    }
+    value = JSON.parse(text);
+  } catch {
+    return { ok: false, code: "publication_artifact_marker_malformed" };
+  }
+  const checked = await validatePublicationArtifactIndexV1(value, expected);
+  return checked.ok ? { ok: true, index: checked.value } : { ok: false, code: "publication_artifact_marker_malformed" };
+}
+
+export type PublicationArtifactFileReadV1 =
+  | { ok: true; bytes: Uint8Array }
+  | { ok: false; code: "publication_artifact_file_missing" | "publication_artifact_file_mismatch" |
+    "publication_artifact_source_unavailable" };
+
+/** Fetch one indexed file's bytes and prove them against its row (length and sha256). */
+export async function readPublicationArtifactFileV1(
+  bucket: PublicationArtifactReadBucketV1,
+  index: Pick<PublicationArtifactIndexV1, "tenant" | "spaceId" | "versionId">,
+  file: PublicationArtifactIndexFileV1,
+): Promise<PublicationArtifactFileReadV1> {
+  let stored: PublicationArtifactStoredObjectV1 | null;
+  try {
+    stored = await bucket.get(publicationArtifactObjectKeyV1(index.tenant, index.spaceId, index.versionId, file.sha256));
+  } catch {
+    return { ok: false, code: "publication_artifact_source_unavailable" };
+  }
+  if (!stored) return { ok: false, code: "publication_artifact_file_missing" };
+  let bytes: Uint8Array;
+  try {
+    bytes = new Uint8Array(await stored.arrayBuffer());
+  } catch {
+    return { ok: false, code: "publication_artifact_file_missing" };
+  }
+  if (bytes.byteLength !== file.byteSize || await sha256Hex(bytes) !== file.sha256) {
+    return { ok: false, code: "publication_artifact_file_mismatch" };
+  }
+  return { ok: true, bytes };
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  let binary = "";
+  for (let offset = 0; offset < bytes.byteLength; offset += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(offset, offset + 0x8000));
+  }
+  return btoa(binary);
+}
+
+/**
+ * The files of an admitted index that `include` selects, with their proven bytes, as a bundle whose
+ * `files` list is exactly that selection. Off-path readers (review evidence, original staging) select
+ * the text they scan and the originals they stage instead of loading a whole site into memory.
+ * Null when any selected file is missing or does not match its row.
+ */
+export async function readPublicationArtifactSelectionV1(
+  bucket: PublicationArtifactReadBucketV1,
+  index: PublicationArtifactIndexV1,
+  include: (file: PublicationArtifactIndexFileV1) => boolean,
+): Promise<PublicationArtifactBundleV1 | null> {
+  const files: PublicationArtifactFileV1[] = [];
+  for (const row of index.files) {
+    if (!include(row)) continue;
+    const read = await readPublicationArtifactFileV1(bucket, index, row);
+    if (!read.ok) return null;
+    const content = row.encoding === "utf8"
+      ? new TextDecoder("utf-8", { fatal: true }).decode(read.bytes)
+      : bytesToBase64(read.bytes);
+    files.push({ lane: row.lane, path: row.path, encoding: row.encoding, content, byteSize: row.byteSize });
   }
-  return `publications/${tenant}/${spaceId}/${versionId}/bundle.json`;
+  const { files: _rows, ...identity } = index;
+  return { ...identity, files };
 }

package/packages/public-runtime/src/publication-content-redirects.ts

@@ -0,0 +1,61 @@
+/**
+ * A publication space's content-declared redirects on the Worker: `content/redirects.json` and every
+ * `content/<collection>/redirects.json` of the version the request opened, matched by the redirect
+ * contract's own resolver. The same set the aggregate writes to the CloudFront redirect plane, so
+ * the two CDNs answer one request the same way.
+ *
+ * Only the space that OWNS the request path is consulted (its artifact is the one the request
+ * opened), which is the composition's precedence rule: a mount owns every path under it. Only the
+ * root space may send a visitor to another origin; a mounted space's off-site entry never applies.
+ */
+import {
+  buildRedirectSet,
+  COLLECTION_REDIRECTS_PATH,
+  declaredRedirectsFromContent,
+  redirectResolver,
+} from "./publication-redirects.mjs";
+import type { OpenPublicationArtifactV1 } from "./publication-reader.js";
+
+type Resolve = (path: string) => string | null;
+
+/** Resolvers per immutable version; a version's declarations never change once stored. */
+const resolvers = new Map<string, Resolve>();
+const MAX_CACHED_VERSIONS = 64;
+
+function compile(artifact: OpenPublicationArtifactV1): Resolve {
+  const entries: { path: string; json: unknown }[] = [];
+  const read = (relative: string) => {
+    const text = artifact.readContent(relative);
+    if (text !== null) entries.push({ path: `content/${relative}`, json: JSON.parse(text) as unknown });
+  };
+  try {
+    read("redirects.json");
+    for (const relative of artifact.listContentPaths()) {
+      if (COLLECTION_REDIRECTS_PATH.test(`content/${relative}`)) read(relative);
+    }
+    const set = buildRedirectSet(declaredRedirectsFromContent(entries));
+    // A declaration composition would refuse publishes nothing here either.
+    if (!set.ok) return () => null;
+    const isRoot = artifact.selection.manifest.routes.canonicalMount === "/";
+    const resolve = redirectResolver(set.redirects.filter(({ to }) => isRoot || to.startsWith("/")));
+    return (path) => resolve(path)?.location ?? null;
+  } catch {
+    return () => null;
+  }
+}
+
+/** Where `requestPath` redirects within its own space's declarations, or null. */
+export function publicationContentRedirectLocationV1(
+  artifact: OpenPublicationArtifactV1,
+  requestPath: string,
+): string | null {
+  const { tenant, spaceId, versionId, artifactDigest } = artifact.index;
+  const key = `${tenant}\0${spaceId}\0${versionId}\0${artifactDigest}`;
+  let resolve = resolvers.get(key);
+  if (!resolve) {
+    resolve = compile(artifact);
+    if (resolvers.size >= MAX_CACHED_VERSIONS) resolvers.delete(resolvers.keys().next().value!);
+    resolvers.set(key, resolve);
+  }
+  return resolve(requestPath);
+}