@tokenoftrust/storefront-runner 3.6.1 → 3.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/asset-registry.ts

@@ -24,6 +24,14 @@ export const MAX_ASSET_REGISTRY_BYTES = 32 * 1024 * 1024;
 export type VerificationMethod = "byte-read" | "create-readback" | "audit";
 export interface VerifiedFacet { size: number; etag: string; at: string; how: VerificationMethod }
 
+/**
+ * The response policy a stored pool image carries as object metadata (S3 only: CloudFront emits it;
+ * the Worker sets R2's itself). `csp` is the digest (`sha256:<hex>`) of the policy that was observed
+ * on the object, `etag` the object it was observed on. It describes that stored object, so a
+ * different ETag or a different policy digest makes it stale.
+ */
+export interface HeadersFacet { csp: string; etag: string; at: string }
+
 export type AssetProvenanceKind = "capture" | "upload" | "repo" | "variant";
 export interface AssetProvenance {
   kind: AssetProvenanceKind;
@@ -74,6 +82,7 @@ export interface AssetRecord {
   /** Entries (`<sha256><ext>`) derived from this one. */
   renditions?: string[];
   verified?: VerifiedFacet;
+  headers?: HeadersFacet;
   retention?: RetentionFacet;
 }
 
@@ -97,12 +106,14 @@ export interface AssetWrite {
   recipe?: AssetRecipe;
   rendition?: string;
   verified?: VerifiedFacet;
+  headers?: HeadersFacet;
   retention?: { to: RetentionClass; at: string; how: string; actor?: string };
 }
 
 const ENTRY_RE = /^([0-9a-f]{64})(\.[A-Za-z0-9]+)?$/;
 const POOL_KEY_RE = /^assets\/([0-9a-f]{64})(\.[A-Za-z0-9]+)?$/;
 const ETAG_RE = /^[A-Za-z0-9-]{1,128}$/;
+const POLICY_DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 const TENANT_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 const ACTOR_RE = /^[A-Za-z0-9._:-]{1,128}$/;
 const REVISION_RE = /^[A-Za-z0-9._-]{1,128}$/;
@@ -172,6 +183,12 @@ function normalizeVerified(raw: unknown): VerifiedFacet | null {
   return { size: raw.size as number, etag: raw.etag, at: raw.at, how: raw.how as VerificationMethod };
 }
 
+function normalizeHeaders(raw: unknown): HeadersFacet | null {
+  if (!isObject(raw) || typeof raw.csp !== "string" || !POLICY_DIGEST_RE.test(raw.csp) ||
+      typeof raw.etag !== "string" || !ETAG_RE.test(raw.etag) || !validTime(raw.at)) return null;
+  return { csp: raw.csp, etag: raw.etag, at: raw.at };
+}
+
 function normalizeProvenance(raw: unknown): AssetProvenance | null {
   if (!isObject(raw) || typeof raw.kind !== "string" || !PROVENANCE_KINDS.has(raw.kind) || !validTime(raw.at)) return null;
   if (raw.locator !== undefined && !validLocator(raw.locator)) return null;
@@ -266,6 +283,8 @@ export function normalizeAssetRecord(entry: string, raw: unknown): AssetRecord |
   }
   const verified = normalizeVerified(raw.verified);
   if (verified) record.verified = verified;
+  const headers = normalizeHeaders(raw.headers);
+  if (headers) record.headers = headers;
   const retention = normalizeRetention(raw.retention);
   if (retention) record.retention = retention;
   return record;
@@ -305,7 +324,7 @@ export function isEmptyAssetRecord(record: AssetRecord): boolean {
  * - `mediaType`, `size`, `provenance`, `owner`, `recipe`: the first writer's value stands. These
  *   describe immutable bytes, so a later writer has nothing to add.
  * - `tenants`, `renditions`: a union.
- * - `verified`: the latest verification replaces the earlier one.
+ * - `verified`, `headers`: the latest observation replaces the earlier one.
  * - `retention`: a transition is applied only when the current class allows it
  *   ({@link RETENTION_TRANSITIONS}); a write naming the current class is a no-op. `rejected` reports
  *   a transition that was not allowed.
@@ -341,6 +360,10 @@ export function applyAssetWrite(existing: AssetRecord | undefined, write: AssetW
     const verified = normalizeVerified(write.verified);
     if (verified) record.verified = verified;
   }
+  if (write.headers) {
+    const headers = normalizeHeaders(write.headers);
+    if (headers) record.headers = headers;
+  }
   let rejected: string | undefined;
   if (write.retention) {
     const from = record.retention?.class ?? "release";

package/packages/public-runtime/src/image-release-gate.ts

@@ -59,6 +59,8 @@ export interface ReleaseImageFacts {
   heldPoolBytes(entry: string): Uint8Array | null;
   /** True when the release records `entry` as a sealed capture (`capturedOriginals`). */
   captured(entry: string): boolean;
+  /** True when the release declares `entry` a rendition its build left in the pool, proven by recorded evidence. */
+  pooledRendition?(entry: string): boolean;
   /**
    * A bundle path (decoded, no leading slash): absent from the release, present but not pinned, or
    * pinned to the pool entry its bytes hash to.
@@ -181,7 +183,7 @@ export function judgeReleaseImages(input: {
       const pool = POOL_REF.exec(ref);
       if (!pool) continue;
       const entry = `${pool[1]}${pool[2] ?? ""}`;
-      if (!input.facts.heldPoolBytes(entry) && !input.facts.captured(entry)) add("unregistered", ref);
+      if (!input.facts.heldPoolBytes(entry) && !input.facts.captured(entry) && !input.facts.pooledRendition?.(entry)) add("unregistered", ref);
       else if (!supportedPoolEntry(entry, input.facts, input.formats)) add("unsupported-format", ref);
       else poolEntries.add(entry);
     } else if (dependency.disposition === "tenant-hosted") {