@tokenoftrust/storefront-runner 3.3.0 → 3.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/page-csp.d.mts

@@ -0,0 +1,5 @@
+/** Types for the shared (S3 publish + Cloudflare serve) per-page CSP resolution. */
+export declare function pageCspFor(
+  manifest: { csp?: unknown; perRouteCsp?: Record<string, unknown> | null } | null | undefined,
+  relPath: string,
+): { headerName: string; value: string } | null;

package/packages/public-runtime/src/page-csp.mjs

@@ -0,0 +1,27 @@
+import { NATIVE_GA4_SANDBOX_ASSET_PATH } from "./integration/native-ga4-sandbox-asset.mjs";
+
+/** @param {unknown} value */
+function captureOrNull(value) {
+  const capture = /** @type {{headerName?: unknown, value?: unknown} | null | undefined} */ (value);
+  return capture && typeof capture.headerName === "string" && typeof capture.value === "string"
+    ? /** @type {{headerName: string, value: string}} */ (capture)
+    : null;
+}
+
+/**
+ * The tenant CSP one HTML document carries, shared by every plane that applies it: the S3 version
+ * upload stamps it as object metadata (`planVersionUpload`) and the Cloudflare static-bundle serve
+ * emits it as a response header (`serveStaticBundle`), so the two cannot answer differently.
+ *
+ * A page's own captured policy (`manifest.perRouteCsp[<bundlePath>]`) wins; the home-route
+ * `manifest.csp` is only the fallback for a document with no entry of its own. The platform-owned
+ * GA4 sandbox document enforces its own hash-pinned meta CSP and takes none.
+ * @param {{csp?: unknown, perRouteCsp?: Record<string, unknown> | null} | null | undefined} manifest
+ * @param {string} relPath the bundle-relative path of the document
+ * @returns {{headerName: string, value: string} | null}
+ */
+export function pageCspFor(manifest, relPath) {
+  if (relPath === NATIVE_GA4_SANDBOX_ASSET_PATH) return null;
+  const own = manifest?.perRouteCsp ? captureOrNull(manifest.perRouteCsp[relPath]) : null;
+  return own ?? captureOrNull(manifest?.csp);
+}

package/packages/public-runtime/src/static-bundle.ts

@@ -42,9 +42,9 @@
  */
 import { assetContentType } from "./tenant-assets.js";
 import { formatHtmlCacheControl } from "./html-cache-policy.js";
-import { NATIVE_GA4_SANDBOX_ASSET_PATH } from "./integration/native-ga4-sandbox-asset.mjs";
 import { CONTENT_NAMED_ASSET_PREFIXES } from "./content-named-asset-prefixes.mjs";
 import { resolveRedirect } from "./publication-redirects.mjs";
+import { pageCspFor } from "./page-csp.mjs";
 import { POOL_ASSET_SECURITY_HEADERS } from "./pool-asset-headers.js";
 
 // ---------------------------------------------------------------------------
@@ -161,6 +161,8 @@ export interface StaticBundleManifest {
   treeDigest: string;
   pinnedNonce: string;
   csp: { headerName: string; value: string } | null;
+  /** Each HTML document's OWN captured CSP, keyed by bundle path; `csp` is the fallback (see `pageCspFor`). */
+  perRouteCsp?: Record<string, { headerName: string; value: string }>;
   /**
    * The route-document `Cache-Control` this bundle's tenant declared (ADR 0013
    * `serving.htmlCachePolicy`, formatted by `formatHtmlCacheControl` at materialize).
@@ -222,6 +224,16 @@ function parseManifest(raw: string): StaticBundleManifest | null {
       typeof (m.csp as { value?: unknown }).value === "string"
         ? (m.csp as { headerName: string; value: string })
         : null;
+    let perRouteCsp: StaticBundleManifest["perRouteCsp"];
+    if (m.perRouteCsp && typeof m.perRouteCsp === "object") {
+      perRouteCsp = {};
+      for (const [rel, value] of Object.entries(m.perRouteCsp as Record<string, unknown>)) {
+        const capture = value as { headerName?: unknown; value?: unknown } | null;
+        if (capture && typeof capture.headerName === "string" && typeof capture.value === "string") {
+          perRouteCsp[rel] = { headerName: capture.headerName, value: capture.value };
+        }
+      }
+    }
     let files: StaticBundleManifest["files"];
     if (m.files && typeof m.files === "object") {
       files = {};
@@ -253,7 +265,7 @@ function parseManifest(raw: string): StaticBundleManifest | null {
       }
     }
     const htmlCacheControl = typeof m.htmlCacheControl === "string" ? m.htmlCacheControl : undefined;
-    return { treeDigest: m.treeDigest, pinnedNonce: m.pinnedNonce, csp, htmlCacheControl, files, redirects };
+    return { treeDigest: m.treeDigest, pinnedNonce: m.pinnedNonce, csp, perRouteCsp, htmlCacheControl, files, redirects };
   } catch {
     return null;
   }
@@ -504,9 +516,8 @@ export async function serveStaticBundle(
   // The reviewed GA4 transport frame is a platform-owned security boundary with
   // its own generated, hash-pinned meta CSP. Applying the tenant page CSP as a
   // second policy would intersect the two and block the reviewed gtag.js origin.
-  if (isHtml && rel !== NATIVE_GA4_SANDBOX_ASSET_PATH && manifest.csp) {
-    headers[manifest.csp.headerName] = manifest.csp.value;
-  }
+  const pageCsp = isHtml ? pageCspFor(manifest, rel) : null;
+  if (pageCsp) headers[pageCsp.headerName] = pageCsp.value;
 
   if (typeof object.size === "number") {
     headers["content-length"] = String(object.size);