@tokenoftrust/storefront-runner 4.3.3 → 4.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.3.3",
+  "version": "4.3.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/csp.ts

@@ -23,6 +23,8 @@ export interface CspOptions {
   styleSrc?: readonly string[];
   fontSrc?: readonly string[];
   imgSrc?: readonly string[];
+  /** `<video>`/`<audio>` sources (`media-src`). */
+  mediaSrc?: readonly string[];
   connectSrc?: readonly string[];
   /** Sandboxed-widget origins. */
   frameSrc?: readonly string[];
@@ -68,6 +70,9 @@ export function buildCsp(opts: CspOptions): string {
     // so allowing `data:` here is the same tolerated relaxation as img-src.
     "font-src": ["'self'", "data:", ...(opts.fontSrc ?? [])],
     "img-src": ["'self'", "data:", ...(opts.imgSrc ?? [])],
+    // Without an explicit media-src, `<video>`/`<audio>` fall back to
+    // `default-src 'self'` and every cross-origin clip is refused.
+    "media-src": ["'self'", ...(opts.mediaSrc ?? [])],
     "connect-src": ["'self'", ...(opts.connectSrc ?? [])],
     "frame-src": ["'self'", ...(opts.frameSrc ?? [])],
   };
@@ -98,6 +103,10 @@ export const STOREFRONT_CSP_ALLOWLIST = {
   fontSrc: [],
   // Product imagery is rehosted to R2 or served from remote CDNs.
   imgSrc: ["https:"],
+  // Tenant video and audio stay at their source URLs (the tenant repo holds no
+  // media binaries), so media is granted over https exactly like imagery. Media
+  // cannot execute script, so this is the same tolerated relaxation as img-src.
+  mediaSrc: ["https:"],
   connectSrc: [],
 } as const;