@tokenoftrust/storefront-runner 4.11.16 → 4.12.0

package/agency-kit/tools/lib/public-binaries.mjs

@@ -1,8 +1,8 @@
 /**
  * Tenant binaries never live in the tenant repo. The platform's content-addressed `/_a/<sha256>`
- * pool owns them and the store's repo holds references only. Platform capture of catalog images
- * is pending: until it owns them, an image stays at its source URL, go-live requires 0 uncaptured
- * catalog images, and the source store is never shut down before that check passes. This decides,
+ * pool owns them and the store's repo holds references only. Publication captures source images;
+ * go-live requires zero uncaptured images in every type and sampled live owned-image responses
+ * before the source store is shut down. This decides,
  * from a listing of the store's `public/` tree, whether the repo is carrying binaries it must not.
  *
  * Findings, each naming its remedy:

package/apps/storefront/src/middleware/index.ts

@@ -28,6 +28,7 @@ import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/publication/shared
 import { SAMPLE_CART_HANDOFF_URL, commerceTenantId, compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { HTML_CACHE_POLICY_CAPTURE_PROBE } from "@tot/public-runtime";
+import { resolveCapturedRequestVersion, resolveCustomizationEnv } from "@tot/public-runtime";
 import type { RenditionRegistryBucket } from "@/lib/assets/registeredRenditions";
 import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
@@ -317,7 +318,16 @@ async function serveRequest(
       previewTokenCookie: context.cookies.get("tot_preview")?.value,
       secret: await readEnv("CUSTOMIZATION_PREVIEW_SECRET"),
     });
-    const capturedRevisionId = candidatePin?.versionId ?? cookieRevision;
+    const captureEnvironment = await resolveCustomizationEnv({
+      isPreviewHost: host.toLowerCase().startsWith("preview."), tenantId: tenant.tenant_id,
+      token: url.searchParams.get("__preview") ?? context.cookies.get("tot_preview")?.value,
+      secret: await readEnv("CUSTOMIZATION_PREVIEW_SECRET"), pathname: url.pathname,
+      nowSeconds: Math.floor(Date.now() / 1000),
+    });
+    const capturedRevisionId = renderPath.startsWith("/_a/") && !captureEnvironment.reject
+      ? await resolveCapturedRequestVersion({ get: (key) => kv?.get(key) ?? Promise.resolve(null), tenantId: tenant.tenant_id,
+          env: captureEnvironment.env, candidateVersionId: candidatePin?.versionId, cookieVersionId: cookieRevision })
+      : candidatePin?.versionId ?? cookieRevision;
     const originalsBucket =
       (capturedRevisionId || renderPath.startsWith("/_a/"))
         ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)

package/apps/storefront/src/middleware/renderChain.ts

@@ -49,6 +49,7 @@ import {
   resolveCapabilities,
   capabilitiesArtifactPath,
   resolveServableChannelVersion,
+  resolveCapturedRequestVersion,
   resolveChannelVersion,
   serveTenantAsset,
   parseTenantAssetPath,
@@ -399,13 +400,10 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     secret: previewSecret,
     nowSeconds,
   });
-  // The shared preview sets no version cookie, yet its documents name `/_a/` captures of the
-  // version the preview channel serves (capture overlay); those resolve against that version.
-  const sharedPreviewRevision = !candidatePin && !cookieRevision && customization.env === "test" &&
-    renderPath.startsWith("/_a/")
-    ? (await resolveServableChannelVersion(kvGet, tenant.tenant_id, "preview")).versionId
-    : null;
-  const capturedRevisionId = candidatePin?.versionId ?? cookieRevision ?? sharedPreviewRevision;
+  const capturedRevisionId = renderPath.startsWith("/_a/")
+    ? await resolveCapturedRequestVersion({ get: kvGet, tenantId: tenant.tenant_id, env: customization.env,
+        candidateVersionId: candidatePin?.versionId, cookieVersionId: cookieRevision })
+    : candidatePin?.versionId ?? cookieRevision;
   const originalsBucket =
     (capturedRevisionId || renderPath.startsWith("/_a/"))
       ? ((await readR2("PRODUCT_IMAGES")) ?? (await readR2("TENANT_ASSETS")) ?? null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.16",
+  "version": "4.12.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/capture-rewrites.ts

@@ -10,6 +10,17 @@
  */
 import type { ImageDependency, ImageDependencyArtifact } from "./image-dependencies.js";
 
+/** Fingerprint exact source bytes without copying a whole revision into one JSON string. */
+export async function fingerprintCaptureArtifacts(artifacts: readonly ImageDependencyArtifact[]): Promise<string> {
+  const hash = async (value: string) => [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)))]
+    .map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const identities: Array<{ path: string; kind: ImageDependencyArtifact["kind"]; digest: string }> = [];
+  for (const artifact of [...artifacts].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) {
+    identities.push({ path: artifact.path, kind: artifact.kind, digest: await hash(artifact.content) });
+  }
+  return `sha256:${await hash(JSON.stringify(identities))}`;
+}
+
 export type CaptureRewrite = {
   /** Effect-only; never log or render. */
   canonicalLocator: string;
@@ -539,7 +550,12 @@ export function applyCaptureRewrites(
   artifacts: readonly ImageDependencyArtifact[],
   rewrites: readonly CaptureRewrite[],
 ): ImageDependencyArtifact[] {
-  if (rewrites.length === 0) return artifacts.map((a) => ({ ...a }));
+  return artifacts.map(createCaptureArtifactRewriter(rewrites));
+}
+
+/** Prepare locator matching once while allowing callers to persist one rewritten artifact at a time. */
+export function createCaptureArtifactRewriter(rewrites: readonly CaptureRewrite[]): (artifact: ImageDependencyArtifact) => ImageDependencyArtifact {
+  if (rewrites.length === 0) return (artifact) => ({ ...artifact });
   const prepared = rewrites.map((rewrite) => {
     // Longer needles first so `/path?v=1` wins over slash-stripped `path`.
     // Include `&amp;` spellings so HTML-escaped query joins still match.
@@ -554,7 +570,7 @@ export function applyCaptureRewrites(
     const exact = new Set((rewrite.exactAliases ?? []).flatMap((n) => [n, ...htmlAmpVariants(n)]));
     return { rewrite, needles, key, exact };
   });
-  return artifacts.map((artifact) => {
+  return (artifact) => {
     let content = artifact.content;
     for (const { rewrite, needles, key, exact } of prepared) {
       if (key !== null && !content.includes(key)) continue;
@@ -565,7 +581,7 @@ export function applyCaptureRewrites(
     // Guard: slash-stripped local needles must not leave a protocol-relative URL.
     content = content.replace(/\/{2,}_a\//g, "/_a/");
     return { ...artifact, content };
-  });
+  };
 }
 
 /**

package/packages/public-runtime/src/customization-runtime.ts

@@ -366,14 +366,18 @@ export async function resolvePublishedArtifactKey(
   if (!selection) return null;
   if (selection.source !== "channel") return customizationArtifactKey(tenantId, selection.versionId);
 
-  // Versioned model engaged for this channel — authoritative. The shared preview renders a
-  // version's captured images the way a pinned preview of it does; `live` never reads the
-  // overlay (its public path is the published bundle, which carries its own rewrites).
+  // Both hosted live and preview render the exact channel revision's sealed capture.
   const { versionId } = await resolveServableChannelVersion(get, tenantId, selection.channel);
   if (!versionId) return null;
-  return selection.channel === "preview"
-    ? resolveCapturedVersionArtifactKey(get, tenantId, versionId, path)
-    : resolveVersionArtifactKey(get, tenantId, versionId, path);
+  return resolveCapturedVersionArtifactKey(get, tenantId, versionId, path);
+}
+
+/** Exact revision whose sealed originals a hosted request may read. */
+export async function resolveCapturedRequestVersion(input: {
+  get: KvGet; tenantId: string; env: CustomizationEnv; candidateVersionId?: string | null; cookieVersionId?: string | null;
+}): Promise<string | null> {
+  return input.candidateVersionId ?? input.cookieVersionId ??
+    (await resolveServableChannelVersion(input.get, input.tenantId, channelFromEnv(input.env))).versionId;
 }
 
 /**

package/packages/public-runtime/src/image-dependencies.ts

@@ -32,6 +32,37 @@ export interface ImageDependencyArtifact {
   kind?: ImageArtifactKind;
 }
 
+export const IMAGE_TYPES = ["catalog", "blog", "pages", "other"] as const;
+export type ImageType = typeof IMAGE_TYPES[number];
+export type ImageTypeCounts = Record<ImageType, { files: number; references: number; uncaptured: number }>;
+
+export function imageTypeOf(path: string): ImageType {
+  if (path.startsWith("content/catalog/")) return "catalog";
+  if (path.startsWith("content/blog/")) return "blog";
+  if (path.startsWith("content/pages/") || path.startsWith("content/pages-html/")) return "pages";
+  return "other";
+}
+
+export function imageCensusByType(input: {
+  artifacts: readonly ImageDependencyArtifact[]; tenantId: string; tenantOrigins: readonly string[]; skipped?: readonly string[];
+}): ImageTypeCounts {
+  if (!Array.isArray(input.tenantOrigins)) throw new TypeError("tenantOrigins is required");
+  const out = {} as ImageTypeCounts;
+  for (const type of IMAGE_TYPES) {
+    const group = input.artifacts.filter((artifact) => imageTypeOf(artifact.path) === type);
+    const skipped = (input.skipped ?? []).filter((path) => imageTypeOf(path) === type).length;
+    const census = scanImageDependencies(group, { tenantId: input.tenantId, tenantOrigins: input.tenantOrigins }).census;
+    out[type] = { files: group.length + skipped, references: census.references + skipped,
+      uncaptured: census.captureRequired + census.securityErrors + census.deferred + skipped };
+  }
+  return out;
+}
+
+/** Separate from mutable dual-run evidence: one immutable source revision's measured image ownership. */
+export function hostedImageCensusKey(tenantId: string, revisionId: string): string {
+  return `image-census:${tenantId}:${revisionId}`;
+}
+
 export interface PlatformHostedImageConfig {
   /** Exact already-hosted references. Query/fragment spelling is ignored. */
   references?: readonly string[];

package/packages/public-runtime/src/image-preview-rewrite-overlay.ts

@@ -2,8 +2,8 @@
  * Revision-bound overlay of capture-rewritten preview artifacts (read path).
  *
  * Site-version manifests are immutable; successful `/_a/<sha>` rewrites are
- * stored as content-addressed artifact bytes plus this overlay map. Preview
- * reads prefer the overlay so candidate documents reference platform-owned URLs.
+ * stored as content-addressed artifact bytes plus this overlay map. Hosted live and preview
+ * reads prefer their exact revision's overlay so documents reference platform-owned URLs.
  * The record and its key-level resolution live in `customization-runtime.ts`,
  * which every versioned read goes through.
  */
@@ -12,7 +12,9 @@ import {
   customizationArtifactKey,
   readImagePreviewRewriteOverlay,
   themeArtifactPath,
+  type ImagePreviewRewriteOverlay,
 } from "./customization-runtime.js";
+import { sha256Hex } from "./hash.js";
 
 export {
   imagePreviewRewriteOverlayKey,
@@ -20,6 +22,13 @@ export {
   type ImagePreviewRewriteOverlay,
 } from "./customization-runtime.js";
 
+/** Bind measured counts to the exact immutable rewrite map used by live reads. */
+export async function digestImagePreviewRewriteOverlay(overlay: ImagePreviewRewriteOverlay | null): Promise<string | null> {
+  if (!overlay) return null;
+  const artifacts = Object.entries(overlay.artifacts).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `sha256:${await sha256Hex(JSON.stringify({ revisionId: overlay.revisionId, captureManifestDigest: overlay.captureManifestDigest, artifacts }))}`;
+}
+
 /** Map a repo-relative capture artifact path to the preview manifest artifact path. */
 export function previewManifestPathFor(tenantId: string, repoPath: string): string {
   if (repoPath === "theme.json") return themeArtifactPath(tenantId);