@tokenoftrust/storefront-runner 4.3.2 → 4.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/csp.ts

@@ -23,6 +23,8 @@ export interface CspOptions {
   styleSrc?: readonly string[];
   fontSrc?: readonly string[];
   imgSrc?: readonly string[];
+  /** `<video>`/`<audio>` sources (`media-src`). */
+  mediaSrc?: readonly string[];
   connectSrc?: readonly string[];
   /** Sandboxed-widget origins. */
   frameSrc?: readonly string[];
@@ -68,6 +70,9 @@ export function buildCsp(opts: CspOptions): string {
     // so allowing `data:` here is the same tolerated relaxation as img-src.
     "font-src": ["'self'", "data:", ...(opts.fontSrc ?? [])],
     "img-src": ["'self'", "data:", ...(opts.imgSrc ?? [])],
+    // Without an explicit media-src, `<video>`/`<audio>` fall back to
+    // `default-src 'self'` and every cross-origin clip is refused.
+    "media-src": ["'self'", ...(opts.mediaSrc ?? [])],
     "connect-src": ["'self'", ...(opts.connectSrc ?? [])],
     "frame-src": ["'self'", ...(opts.frameSrc ?? [])],
   };
@@ -98,6 +103,10 @@ export const STOREFRONT_CSP_ALLOWLIST = {
   fontSrc: [],
   // Product imagery is rehosted to R2 or served from remote CDNs.
   imgSrc: ["https:"],
+  // Tenant video and audio stay at their source URLs (the tenant repo holds no
+  // media binaries), so media is granted over https exactly like imagery. Media
+  // cannot execute script, so this is the same tolerated relaxation as img-src.
+  mediaSrc: ["https:"],
   connectSrc: [],
 } as const;
 

package/scripts/dev/catalog-preview-refresh.mjs

@@ -155,9 +155,9 @@ function pythonJson(mode, pid) {
       encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 3000,
     }));
   } catch (error) {
-    const detail = `${error.stderr ?? ""}${error.message ?? ""}`;
-    if (detail.includes("process_children_unbounded")) throw fixedError("refresh_process_children_unbounded");
-    if (detail.includes("process_gone")) return null;
+    const stderr = Buffer.isBuffer(error?.stderr) ? error.stderr.toString("utf8") : String(error?.stderr ?? "");
+    if (stderr.includes("process_gone")) return null;
+    if (stderr.includes("process_children_unbounded")) throw fixedError("refresh_process_children_unbounded");
     throw error;
   }
 }
@@ -183,6 +183,7 @@ function linuxIdentity(pid) {
 function childPids(pid) {
   if (process.platform === "darwin") {
     const listed = pythonJson("children", pid);
+    if (listed === null) return [];
     if (!Array.isArray(listed) || listed.some((child) => !Number.isInteger(child))) throw fixedError("refresh_process_children_unbounded");
     return listed;
   }
@@ -200,7 +201,8 @@ function childPids(pid) {
 export function processIdentity(pid) {
   if (!Number.isSafeInteger(pid) || pid < 2) throw fixedError("refresh_process_identity_invalid");
   const info = process.platform === "darwin" ? pythonJson("identity", pid) : linuxIdentity(pid);
-  if (!info || !Array.isArray(info.argv) || info.argv.some((part) => typeof part !== "string")) throw fixedError("refresh_process_identity_invalid");
+  if (info === null) return null;
+  if (!Array.isArray(info.argv) || info.argv.some((part) => typeof part !== "string")) throw fixedError("refresh_process_identity_invalid");
   if (info.uid !== process.getuid?.()) throw fixedError("refresh_process_owner_mismatch");
   let cwd;
   if (process.platform === "darwin") {
@@ -320,9 +322,10 @@ function descendantsOf(pid) {
     for (const child of childPids(parent)) {
       visit(child);
       try {
-        out.push(processIdentity(child));
+        const identity = processIdentity(child);
+        if (identity) out.push(identity);
       } catch (error) {
-        if (error?.message !== "refresh_process_identity_invalid") throw error;
+        if (error?.message !== "refresh_process_identity_invalid" && error?.message !== "refresh_process_changed") throw error;
       }
     }
   };
@@ -341,6 +344,7 @@ export const realEffects = {
     if (git(checkout, "status", "--porcelain", "--untracked-files=no")) throw fixedError("refresh_preview_tracked_dirty");
     const pid = Number(receipt?.pid ?? options.pid);
     const owned = processIdentity(pid);
+    if (!owned) throw fixedError("refresh_process_changed");
     const app = realpathSync(join(checkout, "apps/storefront"));
     const volume = privateIdentity(join(preview, "local-state"));
     const environment = privateIdentity(join(preview, "apps/storefront/.dev.vars"), true);
@@ -449,9 +453,18 @@ export const realEffects = {
       || environment.dev !== prior.environment.dev || environment.ino !== prior.environment.ino || environment.uid !== prior.environment.uid
       || environment.mode !== prior.environment.mode || environment.digest !== prior.environment.digest) throw fixedError("refresh_private_state_changed");
   },
-  async stop(owned) {
+  async stop(owned, hooks = {}) {
     const descendants = descendantsOf(owned.pid);
-    for (const identity of [...descendants, owned]) signalOwned(identity);
+    // Test seam: kill a listed descendant after enumeration and before the signal loop.
+    if (typeof hooks.afterEnumerate === "function") await hooks.afterEnumerate(descendants);
+    for (const identity of [...descendants, owned]) {
+      try {
+        signalOwned(identity);
+      } catch (error) {
+        const gone = error?.message === "refresh_process_changed" || error?.code === "ESRCH";
+        if (identity === owned || !gone) throw error;
+      }
+    }
     for (let attempt = 0; attempt < 50; attempt += 1) {
       let live = false;
       for (const identity of [...descendants, owned]) {
@@ -484,17 +497,24 @@ export const realEffects = {
     child.unref();
     for (let attempt = 0; attempt < 100; attempt += 1) {
       if (failed) {
-        try { if (child.pid) await this.stop(processIdentity(child.pid)); } catch { /* An exited root cannot be signalled. */ }
+        try {
+          const identity = child.pid ? processIdentity(child.pid) : null;
+          if (identity) await this.stop(identity);
+        } catch { /* An exited root cannot be signalled. */ }
         throw fixedError("refresh_start_failed");
       }
       try {
         const identity = processIdentity(child.pid);
+        if (!identity) throw fixedError("refresh_process_changed");
         await fetchLocal("/health", previewBase());
         return identity;
       } catch { await delay(200); }
     }
     if (child.pid) {
-      try { await this.stop(processIdentity(child.pid)); } catch { throw fixedError("refresh_start_cleanup_failed"); }
+      const identity = processIdentity(child.pid);
+      if (identity) {
+        try { await this.stop(identity); } catch { throw fixedError("refresh_start_cleanup_failed"); }
+      }
     }
     throw fixedError("refresh_start_timeout");
   },