@tokenoftrust/storefront-runner 4.11.15 → 4.12.0

package/agency-kit/tools/lib/public-binaries.mjs

@@ -1,8 +1,8 @@
 /**
  * Tenant binaries never live in the tenant repo. The platform's content-addressed `/_a/<sha256>`
- * pool owns them and the store's repo holds references only. Platform capture of catalog images
- * is pending: until it owns them, an image stays at its source URL, go-live requires 0 uncaptured
- * catalog images, and the source store is never shut down before that check passes. This decides,
+ * pool owns them and the store's repo holds references only. Publication captures source images;
+ * go-live requires zero uncaptured images in every type and sampled live owned-image responses
+ * before the source store is shut down. This decides,
  * from a listing of the store's `public/` tree, whether the repo is carrying binaries it must not.
  *
  * Findings, each naming its remedy:

package/apps/storefront/src/lib/access/auth/session.ts

@@ -204,6 +204,18 @@ export async function updateSession(
   return next;
 }
 
+/** Persist an authenticated record under a fresh id without extending its lifetime. */
+export async function rotateSession(
+  store: SessionStore,
+  record: SessionRecord,
+  nowSeconds: number,
+): Promise<{ id: string; record: SessionRecord } | null> {
+  if (record.exp <= nowSeconds) return null;
+  const id = newSessionId();
+  await store.put(id, JSON.stringify(record), record.exp - nowSeconds);
+  return { id, record };
+}
+
 /** Revoke a session (logout / admin kill). Idempotent. */
 export async function revokeSession(
   store: SessionStore,

package/apps/storefront/src/lib/access/dashboard/staffStoreEntry.ts

@@ -10,15 +10,15 @@
  *      minted from the VERIFIED session email (no plaintext email on the wire);
  *   2. tot20 re-checks staff scope, scopes the capability, and writes the AUDIT row —
  *      it is the authority, and nothing is admitted without its ok;
- *   3. stamp the short-lived {@link StaffSelection} on the session (never a `tenants[]`
- *      entry), so re-entering after it lapses re-audits;
+ *   3. persist the short-lived {@link StaffSelection} under a fresh session id (never a
+ *      `tenants[]` entry), preserving the original expiry; re-entry re-audits;
  *   4. hand every exit's outcome to the caller's `emit`, which records it as
  *      `dashboard.vendor_entered` against its opaque admin actor id (the email is
  *      never stored).
  */
 import type { SessionRecord, SessionStore, StaffSelection } from "@/lib/access/auth/session";
-import { updateSession } from "@/lib/access/auth/session";
-import { isStaffSession, buildStaffSelection } from "./staffAdmission";
+import { readSession, rotateSession } from "@/lib/access/auth/session";
+import { isStaffSession, buildStaffSelection, STAFF_SELECTION_TTL_SECONDS } from "./staffAdmission";
 import {
   createStaffVendorAccessClient,
   staffAccessFailureMessage,
@@ -41,18 +41,19 @@ export interface StaffStoreEntryInput {
   /** Records each entry outcome; the route binds it to its opaque admin actor. */
   emit: (event: StaffEntryEvent) => void;
   /** The persisted session to stamp the selection on; null when there is no store. */
-  sessionHandle: () => Promise<{ store: SessionStore; id: string } | null>;
+  /** A null id is a freshly verified, not-yet-persisted sign-in record. */
+  sessionHandle: () => Promise<{ store: SessionStore; id: string | null } | null>;
 }
 
 export type StaffStoreEntryResult =
-  | { ok: true; selection: StaffSelection; capability: string }
+  | { ok: true; selection: StaffSelection; capability: string; sessionId: string; expiresIn: number }
   | {
       ok: false;
       status: number;
       body: { error: string; reason?: string; code?: string };
     };
 
-/** Enter `vendorAppDomain` as ToT staff: audit with tot20, then persist the selection. */
+/** Audit with tot20, then persist the selection under a fresh, expiry-preserving id. */
 export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<StaffStoreEntryResult> {
   const { session, emit } = input;
   const vendorAppDomain = input.vendorAppDomain.trim();
@@ -99,6 +100,7 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     resource: vendorAppDomain,
     capability: result.capability,
     nowSeconds,
+    ttlSeconds: Math.max(1, Math.min(STAFF_SELECTION_TTL_SECONDS, session.exp - nowSeconds)),
   });
   const handle = await input.sessionHandle();
   if (!handle) {
@@ -111,12 +113,25 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     });
     return { ok: false, status: 503, body: { error: "session store unavailable; cannot persist admission" } };
   }
-  const updated = await updateSession(
-    handle.store,
-    handle.id,
-    (rec) => ({ ...rec, staffSelection: selection }),
-    nowSeconds,
-  );
+  let updated;
+  try {
+    const current = handle.id ? await readSession(handle.store, handle.id, nowSeconds) : session;
+    updated = current && current.email === session.email && current.subject === session.subject && isStaffSession(current) && current.exp > nowSeconds
+      ? await rotateSession(handle.store, {
+          ...current,
+          createdAt: session.createdAt,
+          exp: Math.min(current.exp, session.exp),
+          staffSelection: { ...selection, exp: Math.min(selection.exp, current.exp, session.exp) },
+        }, nowSeconds)
+      : null;
+  } catch {
+    emit({
+      outcome: { status: "failed", errorClass: "session_store_unavailable" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
+    return { ok: false, status: 503, body: { error: "session store unavailable; cannot persist admission" } };
+  }
   if (!updated) {
     emit({
       outcome: { status: "failed", errorClass: "session_expired" },
@@ -131,5 +146,5 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     scope: { tenantId: vendorAppDomain },
     payload: { args: { resource: vendorAppDomain, capability: result.capability } },
   });
-  return { ok: true, selection, capability: result.capability };
+  return { ok: true, selection, capability: result.capability, sessionId: updated.id, expiresIn: updated.record.exp - nowSeconds };
 }

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -49,6 +49,7 @@ import type {
 } from "@tot/public-runtime";
 import type { ActionKey } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/access/auth/route";
+import type { SessionRecord } from "@/lib/access/auth/session";
 import { sessionHostCapability } from "@/lib/access/auth/loginGate";
 import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
 import { readEnv } from "@/lib/publication/shared/env";
@@ -85,6 +86,8 @@ export function classifyActorKind(
 }
 
 export interface ResolveUiActorInput {
+  /** An already verified record for sign-in paths that do not yet have a cookie. */
+  session?: SessionRecord;
   /**
    * Fallback acting identity for the HEADLESS path (no signed-in viewer) — typically
    * the resolved tenant owner (`auth.owner`). Only used to seed the opaque id when
@@ -107,12 +110,12 @@ export async function resolveUiActor(
 ): Promise<ActivityActor> {
   // The host-bound `locals.viewer` chrome omits `staff[]`, so read the full session
   // to tell a ToT-staff (admin) actor from a store owner (merchant). Best-effort.
-  const session = await readViewerSession(context).catch(() => null);
+  const session = input.session ?? await readViewerSession(context).catch(() => null);
   // The signed-in identity is the host gate's `locals.viewer`, else the raw session (a
   // route that never went through that gate, e.g. the /dev cockpit's rendezvous
   // approval). Ownership is the session's standing on the ROUTED tenant only — a
   // session that owns another store is not this store's merchant.
-  const email = context.locals?.viewer?.email ?? session?.email;
+  const email = input.session ? input.session.email : context.locals?.viewer?.email ?? session?.email;
   const viewer: ViewerLike | undefined = email
     ? { email, capability: sessionHostCapability(session, context.locals?.tenant?.appDomain ?? "") }
     : undefined;

package/apps/storefront/src/lib/developer-experience/http/fetchTransport.ts

@@ -52,6 +52,7 @@ export class FetchHttpTransport implements HttpTransport, HttpGetTransport {
       // body). A per-call or per-transport header of the same name still wins.
       headers: { "content-type": "application/json", ...this.defaultHeaders, ...headers },
       body: JSON.stringify(body),
+      redirect: "manual",
       signal: this.signal(),
     });
     return { status: res.status, json: () => res.json() };
@@ -60,6 +61,7 @@ export class FetchHttpTransport implements HttpTransport, HttpGetTransport {
   async get(url: string, headers: Record<string, string>): Promise<HttpResponseLike> {
     const res = await fetch(url, {
       method: "GET",
+      redirect: "manual",
       headers: { ...this.defaultHeaders, ...headers },
       signal: this.signal(),
     });

package/apps/storefront/src/middleware/index.ts

@@ -28,6 +28,7 @@ import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/publication/shared
 import { SAMPLE_CART_HANDOFF_URL, commerceTenantId, compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { HTML_CACHE_POLICY_CAPTURE_PROBE } from "@tot/public-runtime";
+import { resolveCapturedRequestVersion, resolveCustomizationEnv } from "@tot/public-runtime";
 import type { RenditionRegistryBucket } from "@/lib/assets/registeredRenditions";
 import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
@@ -317,7 +318,16 @@ async function serveRequest(
       previewTokenCookie: context.cookies.get("tot_preview")?.value,
       secret: await readEnv("CUSTOMIZATION_PREVIEW_SECRET"),
     });
-    const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
+    const captureEnvironment = await resolveCustomizationEnv({
+      isPreviewHost: host.toLowerCase().startsWith("preview."), tenantId: tenant.tenant_id,
+      token: url.searchParams.get("__preview") ?? context.cookies.get("tot_preview")?.value,
+      secret: await readEnv("CUSTOMIZATION_PREVIEW_SECRET"), pathname: url.pathname,
+      nowSeconds: Math.floor(Date.now() / 1000),
+    });
+    const capturedRevisionId = renderPath.startsWith("/_a/") && !captureEnvironment.reject
+      ? await resolveCapturedRequestVersion({ get: (key) => kv?.get(key) ?? Promise.resolve(null), tenantId: tenant.tenant_id,
+          env: captureEnvironment.env, candidateVersionId: candidatePin?.versionId, cookieVersionId: cookieRevision })
+      : candidatePin?.versionId ?? cookieRevision;
     const originalsBucket =
       (capturedRevisionId || renderPath.startsWith("/_a/"))
         ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)

package/apps/storefront/src/middleware/renderChain.ts

@@ -49,6 +49,7 @@ import {
   resolveCapabilities,
   capabilitiesArtifactPath,
   resolveServableChannelVersion,
+  resolveCapturedRequestVersion,
   resolveChannelVersion,
   serveTenantAsset,
   parseTenantAssetPath,
@@ -399,13 +400,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     secret: previewSecret,
     nowSeconds,
   });
-  // The shared preview sets no version cookie, yet its documents name `/_a/` captures of the
-  // version the preview channel serves (capture overlay); those resolve against that version.
-  const sharedPreviewRevision = !candidatePin && !cookieRevision && customization.env === "test" &&
-    renderPath.startsWith("/_a/")
-    ? (await resolveServableChannelVersion(kvGet, tenant.tenant_id, "preview")).versionId
-    : null;
-  const capturedRevisionId = candidatePin?.versionId ?? cookieRevision ?? sharedPreviewRevision;
+  const capturedRevisionId = renderPath.startsWith("/_a/")
+    ? await resolveCapturedRequestVersion({ get: kvGet, tenantId: tenant.tenant_id, env: customization.env,
+        candidateVersionId: candidatePin?.versionId, cookieVersionId: cookieRevision })
+    : candidatePin?.versionId ?? cookieRevision;
   const originalsBucket =
     (capturedRevisionId || renderPath.startsWith("/_a/"))
       ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.15",
+  "version": "4.12.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/capture-rewrites.ts

@@ -10,6 +10,17 @@
  */
 import type { ImageDependency, ImageDependencyArtifact } from "./image-dependencies.js";
 
+/** Fingerprint exact source bytes without copying a whole revision into one JSON string. */
+export async function fingerprintCaptureArtifacts(artifacts: readonly ImageDependencyArtifact[]): Promise<string> {
+  const hash = async (value: string) => [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)))]
+    .map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const identities: Array<{ path: string; kind: ImageDependencyArtifact["kind"]; digest: string }> = [];
+  for (const artifact of [...artifacts].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) {
+    identities.push({ path: artifact.path, kind: artifact.kind, digest: await hash(artifact.content) });
+  }
+  return `sha256:${await hash(JSON.stringify(identities))}`;
+}
+
 export type CaptureRewrite = {
   /** Effect-only; never log or render. */
   canonicalLocator: string;
@@ -539,7 +550,12 @@ export function applyCaptureRewrites(
   artifacts: readonly ImageDependencyArtifact[],
   rewrites: readonly CaptureRewrite[],
 ): ImageDependencyArtifact[] {
-  if (rewrites.length === 0) return artifacts.map((a) => ({ ...a }));
+  return artifacts.map(createCaptureArtifactRewriter(rewrites));
+}
+
+/** Prepare locator matching once while allowing callers to persist one rewritten artifact at a time. */
+export function createCaptureArtifactRewriter(rewrites: readonly CaptureRewrite[]): (artifact: ImageDependencyArtifact) => ImageDependencyArtifact {
+  if (rewrites.length === 0) return (artifact) => ({ ...artifact });
   const prepared = rewrites.map((rewrite) => {
     // Longer needles first so `/path?v=1` wins over slash-stripped `path`.
     // Include `&amp;` spellings so HTML-escaped query joins still match.
@@ -554,7 +570,7 @@ export function applyCaptureRewrites(
     const exact = new Set((rewrite.exactAliases ?? []).flatMap((n) => [n, ...htmlAmpVariants(n)]));
     return { rewrite, needles, key, exact };
   });
-  return artifacts.map((artifact) => {
+  return (artifact) => {
     let content = artifact.content;
     for (const { rewrite, needles, key, exact } of prepared) {
       if (key !== null && !content.includes(key)) continue;
@@ -565,7 +581,7 @@ export function applyCaptureRewrites(
     // Guard: slash-stripped local needles must not leave a protocol-relative URL.
     content = content.replace(/\/{2,}_a\//g, "/_a/");
     return { ...artifact, content };
-  });
+  };
 }
 
 /**

package/packages/public-runtime/src/customization-runtime.ts

@@ -366,14 +366,18 @@ export async function resolvePublishedArtifactKey(
   if (!selection) return null;
   if (selection.source !== "channel") return customizationArtifactKey(tenantId, selection.versionId);
 
-  // Versioned model engaged for this channel — authoritative. The shared preview renders a
-  // version's captured images the way a pinned preview of it does; `live` never reads the
-  // overlay (its public path is the published bundle, which carries its own rewrites).
+  // Both hosted live and preview render the exact channel revision's sealed capture.
   const { versionId } = await resolveServableChannelVersion(get, tenantId, selection.channel);
   if (!versionId) return null;
-  return selection.channel === "preview"
-    ? resolveCapturedVersionArtifactKey(get, tenantId, versionId, path)
-    : resolveVersionArtifactKey(get, tenantId, versionId, path);
+  return resolveCapturedVersionArtifactKey(get, tenantId, versionId, path);
+}
+
+/** Exact revision whose sealed originals a hosted request may read. */
+export async function resolveCapturedRequestVersion(input: {
+  get: KvGet; tenantId: string; env: CustomizationEnv; candidateVersionId?: string | null; cookieVersionId?: string | null;
+}): Promise<string | null> {
+  return input.candidateVersionId ?? input.cookieVersionId ??
+    (await resolveServableChannelVersion(input.get, input.tenantId, channelFromEnv(input.env))).versionId;
 }
 
 /**

package/packages/public-runtime/src/image-dependencies.ts

@@ -32,6 +32,37 @@ export interface ImageDependencyArtifact {
   kind?: ImageArtifactKind;
 }
 
+export const IMAGE_TYPES = ["catalog", "blog", "pages", "other"] as const;
+export type ImageType = typeof IMAGE_TYPES[number];
+export type ImageTypeCounts = Record<ImageType, { files: number; references: number; uncaptured: number }>;
+
+export function imageTypeOf(path: string): ImageType {
+  if (path.startsWith("content/catalog/")) return "catalog";
+  if (path.startsWith("content/blog/")) return "blog";
+  if (path.startsWith("content/pages/") || path.startsWith("content/pages-html/")) return "pages";
+  return "other";
+}
+
+export function imageCensusByType(input: {
+  artifacts: readonly ImageDependencyArtifact[]; tenantId: string; tenantOrigins: readonly string[]; skipped?: readonly string[];
+}): ImageTypeCounts {
+  if (!Array.isArray(input.tenantOrigins)) throw new TypeError("tenantOrigins is required");
+  const out = {} as ImageTypeCounts;
+  for (const type of IMAGE_TYPES) {
+    const group = input.artifacts.filter((artifact) => imageTypeOf(artifact.path) === type);
+    const skipped = (input.skipped ?? []).filter((path) => imageTypeOf(path) === type).length;
+    const census = scanImageDependencies(group, { tenantId: input.tenantId, tenantOrigins: input.tenantOrigins }).census;
+    out[type] = { files: group.length + skipped, references: census.references + skipped,
+      uncaptured: census.captureRequired + census.securityErrors + census.deferred + skipped };
+  }
+  return out;
+}
+
+/** Separate from mutable dual-run evidence: one immutable source revision's measured image ownership. */
+export function hostedImageCensusKey(tenantId: string, revisionId: string): string {
+  return `image-census:${tenantId}:${revisionId}`;
+}
+
 export interface PlatformHostedImageConfig {
   /** Exact already-hosted references. Query/fragment spelling is ignored. */
   references?: readonly string[];

package/packages/public-runtime/src/image-preview-rewrite-overlay.ts

@@ -2,8 +2,8 @@
  * Revision-bound overlay of capture-rewritten preview artifacts (read path).
  *
  * Site-version manifests are immutable; successful `/_a/<sha>` rewrites are
- * stored as content-addressed artifact bytes plus this overlay map. Preview
- * reads prefer the overlay so candidate documents reference platform-owned URLs.
+ * stored as content-addressed artifact bytes plus this overlay map. Hosted live and preview
+ * reads prefer their exact revision's overlay so documents reference platform-owned URLs.
  * The record and its key-level resolution live in `customization-runtime.ts`,
  * which every versioned read goes through.
  */
@@ -12,7 +12,9 @@ import {
   customizationArtifactKey,
   readImagePreviewRewriteOverlay,
   themeArtifactPath,
+  type ImagePreviewRewriteOverlay,
 } from "./customization-runtime.js";
+import { sha256Hex } from "./hash.js";
 
 export {
   imagePreviewRewriteOverlayKey,
@@ -20,6 +22,13 @@ export {
   type ImagePreviewRewriteOverlay,
 } from "./customization-runtime.js";
 
+/** Bind measured counts to the exact immutable rewrite map used by live reads. */
+export async function digestImagePreviewRewriteOverlay(overlay: ImagePreviewRewriteOverlay | null): Promise<string | null> {
+  if (!overlay) return null;
+  const artifacts = Object.entries(overlay.artifacts).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `sha256:${await sha256Hex(JSON.stringify({ revisionId: overlay.revisionId, captureManifestDigest: overlay.captureManifestDigest, artifacts }))}`;
+}
+
 /** Map a repo-relative capture artifact path to the preview manifest artifact path. */
 export function previewManifestPathFor(tenantId: string, repoPath: string): string {
   if (repoPath === "theme.json") return themeArtifactPath(tenantId);