@tokenoftrust/storefront-runner 2.5.0 → 2.5.2

package/apps/storefront/src/lib/assets/captured-original-serve.ts

@@ -5,7 +5,10 @@
  * when the sealed revision manifest names the address.
  */
 import { sha256Hex } from "@tot/public-runtime";
+import { CAPTURABLE_RASTER_MEDIA_TYPES, PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE } from "@tot/public-runtime/hosted-image-media-types";
+import { durableAssetsStatusKey, durableCaptureRevisionId, durableRequiredStores, parseDurableAssetsStatus } from "@tot/public-runtime/durable-assets";
 
+const CAPTURE_TYPES = new Set<string>(CAPTURABLE_RASTER_MEDIA_TYPES);
 const ADDRESS_RE = /^[0-9a-f]{64}$/;
 /** Hostname-like tenant ids (no scheme, no path separators). */
 const TENANT_ID_RE = /^[a-z0-9](?:[a-z0-9._-]{0,126}[a-z0-9])?$/i;
@@ -37,10 +40,11 @@ export type CapturedOriginalBucket = {
   get(key: string): Promise<unknown>;
 };
 
-type ManifestEntry = {
+export type ManifestEntry = {
   address: string;
   byteLength: number;
   mediaType: string;
+  provenance?: { kind: "local" | "remote"; locator: string };
 };
 
 function objectKey(tenantId: string, address: string): string {
@@ -60,12 +64,13 @@ async function readManifestEntries(
   revisionId: string,
 ): Promise<ManifestEntry[] | null> {
   if (!isSafeTenantId(tenantId) || !isSafeRevisionId(revisionId)) return null;
+  const object = await bucket.get(originalImageManifestObjectKey(tenantId, revisionId));
+  if (!object || typeof object !== "object") return null;
+  const body = object as { arrayBuffer?: () => Promise<ArrayBuffer> };
+  if (typeof body.arrayBuffer !== "function") return null;
+  const bytes = await body.arrayBuffer();
   try {
-    const object = await bucket.get(originalImageManifestObjectKey(tenantId, revisionId));
-    if (!object || typeof object !== "object") return null;
-    const body = object as { arrayBuffer?: () => Promise<ArrayBuffer> };
-    if (typeof body.arrayBuffer !== "function") return null;
-    const parsed = JSON.parse(new TextDecoder().decode(new Uint8Array(await body.arrayBuffer()))) as {
+    const parsed = JSON.parse(new TextDecoder().decode(new Uint8Array(bytes))) as {
       version?: unknown;
       revisionId?: unknown;
       entries?: unknown;
@@ -78,11 +83,13 @@ async function readManifestEntries(
       if (!raw || typeof raw !== "object") return null;
       const entry = raw as Partial<ManifestEntry>;
       if (typeof entry.address !== "string" || !ADDRESS_RE.test(entry.address)) return null;
-      if (typeof entry.byteLength !== "number" || typeof entry.mediaType !== "string") return null;
+      if (!Number.isSafeInteger(entry.byteLength) || entry.byteLength! < 1 || entry.byteLength! > 8 * 1024 * 1024 ||
+          typeof entry.mediaType !== "string" || !CAPTURE_TYPES.has(entry.mediaType)) return null;
       entries.push({
         address: entry.address,
-        byteLength: entry.byteLength,
-        mediaType: entry.mediaType,
+        byteLength: entry.byteLength!,
+        mediaType: entry.mediaType!,
+        provenance: entry.provenance,
       });
     }
     return entries;
@@ -91,6 +98,31 @@ async function readManifestEntries(
   }
 }
 
+/** Resolve an active, provider-verified designation through its tenant-scoped sealed capture. */
+export async function readDurableCapturedEntry(input: {
+  bucket: CapturedOriginalBucket;
+  kv: { get(key: string): Promise<string | null> };
+  tenantId: string;
+  provider: string | null | undefined;
+  address: string;
+}): Promise<ManifestEntry | null> {
+  if (!isSafeTenantId(input.tenantId) || !ADDRESS_RE.test(input.address)) return null;
+  const required = durableRequiredStores(input.provider);
+  if (!required) return null;
+  const record = parseDurableAssetsStatus(await input.kv.get(durableAssetsStatusKey(input.tenantId)), input.tenantId);
+  if (!record) return null;
+  for (const designation of record.entries) {
+    if (typeof designation.entry !== "string" || !designation.entry.startsWith(`${input.address}.`) ||
+        !Array.isArray(designation.verifiedStores) || !required.every((store) => designation.verifiedStores.includes(store)) ||
+        typeof designation.designatedRevision !== "string" || !isSafeRevisionId(designation.designatedRevision)) continue;
+    const entries = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(designation.designatedRevision));
+    const entry = entries?.find((entry) => entry.address === input.address &&
+      designation.entry === `${entry.address}${PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE[entry.mediaType]}`);
+    if (entry) return entry;
+  }
+  return null;
+}
+
 /**
  * Serve a captured original for the exact tenant+revision, or null to fall through.
  * Missing/unbound/tampered addresses are 404 with no locator or digest in the body.
@@ -98,18 +130,33 @@ async function readManifestEntries(
 export async function tryServeCapturedOriginal(input: {
   bucket: CapturedOriginalBucket;
   tenantId: string;
-  revisionId: string;
+  revisionId?: string;
+  durable?: { kv: { get(key: string): Promise<string | null> }; provider: string | null | undefined };
   pathname: string;
   method?: string;
 }): Promise<Response | null> {
   const parsed = parsePinnedImagePath(input.pathname);
   if (!parsed) return null;
-  if (!isSafeTenantId(input.tenantId) || !isSafeRevisionId(input.revisionId)) {
+  if (!isSafeTenantId(input.tenantId) || (input.revisionId !== undefined && !isSafeRevisionId(input.revisionId))) {
     return new Response("Not found", { status: 404, headers: { "cache-control": "no-store" } });
   }
 
-  const entries = await readManifestEntries(input.bucket, input.tenantId, input.revisionId);
-  const entry = entries?.find((item) => item.address === parsed.address);
+  const entries = input.revisionId ? await readManifestEntries(input.bucket, input.tenantId, input.revisionId).catch(() => null) : null;
+  let entry = entries?.find((item) => item.address === parsed.address);
+  let durable = false;
+  if (!entry && input.revisionId) {
+    const declared = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(input.revisionId)).catch(() => null);
+    entry = declared?.find((item) => item.address === parsed.address);
+    durable = !!entry;
+  }
+  if (!entry && input.durable) {
+    try {
+      entry = await readDurableCapturedEntry({ bucket: input.bucket, tenantId: input.tenantId,
+        address: parsed.address, ...input.durable }) ?? undefined;
+      durable = !!entry;
+    } catch { /* Unreadable durable authority fails closed. */ }
+  }
+  if (entry && parsed.ext && EXT_TYPE[parsed.ext.toLowerCase()] !== entry.mediaType) entry = undefined;
   if (!entry) {
     return new Response("Not found", { status: 404, headers: { "cache-control": "no-store" } });
   }
@@ -134,8 +181,8 @@ export async function tryServeCapturedOriginal(input: {
     const contentType = EXT_TYPE[parsed.ext.toLowerCase()] ?? entry.mediaType;
     const headers: Record<string, string> = {
       "content-type": contentType,
-      "cache-control": "public, max-age=31536000, immutable",
-      "x-tot-original-image": "revision-bound",
+      "cache-control": durable ? "no-store" : "public, max-age=31536000, immutable",
+      "x-tot-original-image": durable ? "durable" : "revision-bound",
       "content-length": String(bytes.byteLength),
     };
     const method = (input.method ?? "GET").toUpperCase();

package/apps/storefront/src/lib/assets/preview-pinned-image-urls.ts

@@ -0,0 +1,25 @@
+/** Keep captured-image requests inside the selected tenant on path-routed hosted previews. */
+export async function scopePreviewPinnedImageUrls(response: Response, basePath: string): Promise<Response> {
+  if (!basePath || !response.body || !(response.headers.get("content-type") ?? "").includes("text/html")) return response;
+  const html = await response.text();
+  const scoped = prefixPreviewPinnedImageUrls(html, basePath);
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  headers.delete("etag");
+  return new Response(scoped, { status: response.status, statusText: response.statusText, headers });
+}
+
+/** Scope only exact captured-image addresses; platform assets and external URLs retain their host. */
+export function prefixPreviewPinnedImageUrls(html: string, basePath: string): string {
+  if (!basePath) return html;
+  return html.replace(/([\s"'(=,])\/_a\/([0-9a-f]{64}(?:\.[A-Za-z0-9]+)?)(?=[\s"'?#),<>]|$)/g,
+    (_match, before: string, entry: string) => `${before}${basePath}/_a/${entry}`);
+}
+
+/** Choose asset routing from the resolved request tenant, never a second host-membership check. */
+export function previewPinnedImageBasePath(tenant: {
+  tenant_id: string; appDomain?: string;
+}, routing: { tenantId: string | undefined; basePath: string }): string {
+  if (routing.tenantId === tenant.tenant_id) return routing.basePath;
+  return tenant.appDomain && /^[a-z0-9.-]+$/i.test(tenant.appDomain) ? `/${tenant.appDomain}` : "";
+}

package/apps/storefront/src/lib/fulfillment/admin/commerceDesk.ts

@@ -1,12 +1,21 @@
 /** Operational browser client. All authority and state changes remain in the authenticated APIs. */
 import type { FulfillmentView } from "../fulfillmentService.js";
+import { parseCommerceDeskApiRoot } from "./commerceDeskRouting.js";
 export function mountCommerceDesk(root: HTMLElement): void {
   const status = root.querySelector<HTMLElement>("[data-desk-status]")!;
   const rows = root.querySelector<HTMLElement>("[data-desk-orders]")!;
   const next = root.querySelector<HTMLButtonElement>("[data-desk-next]")!;
+  const api = parseCommerceDeskApiRoot(root.dataset.commerceApi, root.dataset.targetTenant);
+  if (!api) {
+    rows.replaceChildren();
+    next.hidden = true;
+    root.querySelector<HTMLButtonElement>("[data-desk-refresh]")!.disabled = true;
+    status.textContent = "Open the selected store to view its fulfillment orders.";
+    return;
+  }
   let cursor: string | null = null;
   async function request(url: string, body?: unknown): Promise<unknown> {
-    const response = await fetch(url, {
+    const response = await fetch(`${api}${url}`, {
       credentials: "same-origin",
       cache: "no-store",
       ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}),
@@ -45,8 +54,8 @@ export function mountCommerceDesk(root: HTMLElement): void {
         try {
           await request(
             action === "claim"
-              ? "/api/admin/fulfillment/batches"
-              : `/api/admin/fulfillment/orders/${encodeURIComponent(order.orderId)}`,
+              ? "/batches"
+              : `/orders/${encodeURIComponent(order.orderId)}`,
             action === "claim"
               ? { orderIds: [order.orderId], expectedVersions: { [order.orderId]: order.eventVersion } }
               : { action, expectedVersion: order.eventVersion, scope: "whole-order" },
@@ -86,10 +95,11 @@ export function mountCommerceDesk(root: HTMLElement): void {
     status.textContent = "Loading orders…";
     try {
       const page = (await request(
-        `/api/admin/fulfillment/orders?limit=25${after ? `&cursor=${encodeURIComponent(after)}` : ""}`,
+        `/orders?limit=25${after ? `&cursor=${encodeURIComponent(after)}` : ""}`,
       )) as { tenantId: string; orders: FulfillmentView[]; nextCursor: string | null };
       if (page.tenantId !== root.dataset.targetTenant) {
         rows.replaceChildren();
+        cursor = null;
         next.hidden = true;
         status.textContent = "Open the selected store to view its fulfillment orders.";
         return;

package/apps/storefront/src/lib/fulfillment/admin/commerceDeskRouting.ts

@@ -0,0 +1,45 @@
+/** Same-origin navigation only; fulfillment APIs independently authorize the routed tenant. */
+import { withBase } from "../../publication/shared/basePath.js";
+
+const API_ROOT = "/api/admin/fulfillment";
+
+function canonicalHost(value: string): boolean {
+  if (!value || value.length > 253 || value.split(".").some((part) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(part))) {
+    return false;
+  }
+  try {
+    const url = new URL(`https://${value}/`);
+    return url.host === value && url.pathname === "/";
+  } catch {
+    return false;
+  }
+}
+
+/** Explicit server API metadata, never a preview/revision URL or request query. */
+export function commerceDeskApiRoot(input: {
+  routedTenant: { appDomain: string; pathPrefixTenants?: boolean };
+  apiBasePath: string | undefined;
+  targetTenant: string;
+  registeredTarget: { appDomain: string } | null;
+}): string | null {
+  const { routedTenant, apiBasePath, targetTenant, registeredTarget } = input;
+  if (
+    !canonicalHost(routedTenant.appDomain) || !canonicalHost(targetTenant) ||
+    registeredTarget?.appDomain !== targetTenant || typeof apiBasePath !== "string"
+  ) return null;
+  if (apiBasePath && (
+    !apiBasePath.startsWith("/") || !apiBasePath.slice(1).includes(".") ||
+    !canonicalHost(apiBasePath.slice(1))
+  )) return null;
+  if (!apiBasePath && targetTenant === routedTenant.appDomain) return API_ROOT;
+  if (!apiBasePath && !routedTenant.pathPrefixTenants) return null;
+  if (!targetTenant.includes(".")) return null;
+  return withBase(`/${targetTenant}`, API_ROOT);
+}
+
+/** The SSR endpoint must agree with the displayed canonical tenant; malformed metadata stays inert. */
+export function parseCommerceDeskApiRoot(value: string | undefined, targetTenant: string | undefined): string | null {
+  if (!targetTenant || !canonicalHost(targetTenant)) return null;
+  if (value === API_ROOT) return value;
+  return targetTenant.includes(".") && value === withBase(`/${targetTenant}`, API_ROOT) ? value : null;
+}

package/apps/storefront/src/middleware/index.ts

@@ -73,10 +73,12 @@ function routeTierIndexFor(tenant: TenantConfig): RouteTierIndexV1 {
  * appended after the branch has read or written any edge cache.
  */
 export const onRequest = defineMiddleware(async (context, next) => {
-  const seen = { cdnForwarded: false };
+  const seen: { cdnForwarded: boolean; assetBasePath?: string } = { cdnForwarded: false };
   const response = await serveRequest(context, next, seen);
+  const { scopePreviewPinnedImageUrls } = await import("@/lib/assets/preview-pinned-image-urls");
+  const scoped = await scopePreviewPinnedImageUrls(response, context.locals.apiBasePath ?? seen.assetBasePath ?? "");
   return withVisitorRegionCookie(
-    response,
+    scoped,
     visitorRegionFor(context.request, { cdnForwarded: seen.cdnForwarded, dev: import.meta.env.DEV }),
   );
 });
@@ -84,7 +86,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 async function serveRequest(
   context: APIContext,
   next: MiddlewareNext,
-  seen: { cdnForwarded: boolean },
+  seen: { cdnForwarded: boolean; assetBasePath?: string },
 ): Promise<Response> {
   const { request, locals } = context;
   const url = new URL(request.url);
@@ -163,6 +165,7 @@ async function serveRequest(
   if (!tenant) {
     return new Response("Unknown host", { status: 404 });
   }
+  seen.assetBasePath = basePath;
 
   // ---- The one route classification -----------------------------------------
   // An EXPLICITLY unpaid store is never fully public: the ONLY way to reach its
@@ -282,7 +285,7 @@ async function serveRequest(
     });
     const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
     const originalsBucket =
-      capturedRevisionId
+      (capturedRevisionId || renderPath.startsWith("/_a/"))
         ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)
         : null;
     const bundled = await tryServeStaticBundle({
@@ -298,11 +301,11 @@ async function serveRequest(
       hasCandidatePin: !!candidatePin,
       hasDraftCookie: !!context.cookies.get(DEV_DRAFT_COOKIE)?.value,
       hasManagedInstalls: false,
-      ...(capturedRevisionId && originalsBucket
+      ...(originalsBucket
         ? {
             capturedOriginal: {
               bucket: originalsBucket as { get(key: string): Promise<unknown> },
-              revisionId: capturedRevisionId,
+              ...(capturedRevisionId ? { revisionId: capturedRevisionId } : {}),
             },
           }
         : {}),

package/apps/storefront/src/middleware/renderChain.ts

@@ -301,7 +301,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   });
   const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
   const originalsBucket =
-    capturedRevisionId
+    (capturedRevisionId || renderPath.startsWith("/_a/"))
       ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)
       : null;
   const bundled = publicationSource.status === "legacy-root" ? await tryServeStaticBundle({
@@ -316,11 +316,11 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     hasCandidatePin: !!candidatePin,
     hasDraftCookie: !!draftCookie,
     hasManagedInstalls: managedIntegrationDeclarations.length > 0,
-    ...(capturedRevisionId && originalsBucket
+    ...(originalsBucket
       ? {
           capturedOriginal: {
             bucket: originalsBucket as { get(key: string): Promise<unknown> },
-            revisionId: capturedRevisionId,
+            ...(capturedRevisionId ? { revisionId: capturedRevisionId } : {}),
           },
         }
       : {}),

package/apps/storefront/src/middleware/staticBundle.ts

@@ -37,7 +37,7 @@ export interface StaticBundleAttemptInput {
    */
   capturedOriginal?: {
     bucket: { get(key: string): Promise<unknown> };
-    revisionId: string;
+    revisionId?: string;
   };
 }
 
@@ -60,15 +60,17 @@ export async function tryServeStaticBundle(
 ): Promise<Response | null> {
   const { request, url, tenant, cache, kv } = input;
   const method = request.method.toUpperCase();
+  const assetPath = input.basePath && url.pathname.startsWith(`${input.basePath}/_a/`)
+    ? url.pathname.slice(input.basePath.length) : url.pathname;
 
   // Version-independent assets (`/_a/<sha256>`, `/_astro/<name>`) are exact addresses: the same
   // bytes for every viewer, preview or not, whatever the live pointer says. A page from an
   // older version — or a preview of one — keeps resolving its own sub-resources.
-  if ((method === "GET" || method === "HEAD") && versionIndependentAssetKey(url.pathname)) {
+  if ((method === "GET" || method === "HEAD") && versionIndependentAssetKey(assetPath)) {
     const bucket = await readR2("STATIC_BUNDLES");
     if (bucket) {
       const pinnedKey = cache && method === "GET"
-        ? staticBundleCacheKey(tenant.tenant_id, "pinned", url.pathname, "")
+        ? staticBundleCacheKey(tenant.tenant_id, "pinned", assetPath, "")
         : null;
       if (pinnedKey && cache) {
         const hit = await getCachedPage(cache, pinnedKey);
@@ -76,7 +78,7 @@ export async function tryServeStaticBundle(
       }
       const pinned = await serveVersionIndependentAsset(
         bucket as unknown as StaticBundleR2BucketLike,
-        url.pathname,
+        assetPath,
         method,
       );
       if (pinned && pinned.ok) {
@@ -84,26 +86,28 @@ export async function tryServeStaticBundle(
         return pinned;
       }
       // `/_a/` miss: try revision-bound captured originals before the pinned 404.
-      if (input.capturedOriginal && url.pathname.startsWith("/_a/")) {
+      if (input.capturedOriginal && assetPath.startsWith("/_a/")) {
         const { tryServeCapturedOriginal } = await import("@/lib/assets/captured-original-serve");
         const captured = await tryServeCapturedOriginal({
           bucket: input.capturedOriginal.bucket,
           tenantId: tenant.tenant_id,
           revisionId: input.capturedOriginal.revisionId,
-          pathname: url.pathname,
+          pathname: assetPath,
           method,
+          ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
         });
         if (captured) return captured;
       }
       if (pinned) return pinned;
-    } else if (input.capturedOriginal && url.pathname.startsWith("/_a/")) {
+    } else if (input.capturedOriginal && assetPath.startsWith("/_a/")) {
       const { tryServeCapturedOriginal } = await import("@/lib/assets/captured-original-serve");
       const captured = await tryServeCapturedOriginal({
         bucket: input.capturedOriginal.bucket,
         tenantId: tenant.tenant_id,
         revisionId: input.capturedOriginal.revisionId,
-        pathname: url.pathname,
+        pathname: assetPath,
         method,
+        ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
       });
       if (captured) return captured;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",