@tokenoftrust/storefront-runner 5.0.1 → 6.0.0

package/apps/storefront/src/lib/assets/addons/catalog.ts

@@ -1,16 +1,11 @@
 /**
- * The add-ons a store owner can turn on or off from `/admin/addons`. Static on purpose: an add-on
- * id or mode a request names is valid only if it appears here, so the API refuses anything else.
- *
- * State lives only in the tenant record (`addOns.<id>.mode`); nothing here reads the environment.
- * High Fidelity / Large Images is read back by `resolveImageTier`, which treats every value but
- * `"enabled"` as the standard tier.
+ * The add-ons `/admin/addons` describes. A store's state for each is read from tot20 core
+ * (`getStoreEntitlements`); it is installed and changed in Token of Trust HQ, never here. High
+ * Fidelity / Large Images is read back by `resolveImageTier`, which grants the large tier only for
+ * an entitlement tot20 reports enabled.
  */
 import { IMAGE_TIERS, LARGE_IMAGES_ADDON_NAME } from "@tot/public-runtime/image-limits";
 
-export const ADDON_MODES = ["enabled", "disabled"] as const;
-export type AddOnMode = (typeof ADDON_MODES)[number];
-
 export const ADDON_IDS = ["largeImages"] as const;
 export type AddOnId = (typeof ADDON_IDS)[number];
 
@@ -18,7 +13,6 @@ export interface AddOnDefinition {
   id: AddOnId;
   name: string;
   description: string;
-  modes: readonly AddOnMode[];
 }
 
 const MiB = 1024 * 1024;
@@ -34,14 +28,21 @@ export const ADDONS: readonly AddOnDefinition[] = Object.freeze([
     description:
       `Raises this store's image limit from the standard ${limits(IMAGE_TIERS.standard)} ` +
       `to ${limits(IMAGE_TIERS.large)}. Takes effect on the next capture or upload.`,
-    modes: ADDON_MODES,
   },
 ]);
 
-export function isAddOnId(value: unknown): value is AddOnId {
-  return typeof value === "string" && (ADDON_IDS as readonly string[]).includes(value);
-}
+/** What `/admin/addons` shows for one add-on. `unavailable` means tot20 could not be read. */
+export type AddOnDisplayState = "installed" | "not-installed" | "unavailable";
 
-export function isAddOnMode(value: unknown): value is AddOnMode {
-  return typeof value === "string" && (ADDON_MODES as readonly string[]).includes(value);
+/** Each catalog add-on's display state from a tot20 read; an unavailable read is never installed. */
+export function addOnDisplayStates(
+  result: { status: "ok" | "not-entitled"; entitlements: Partial<Record<AddOnId, { enabled: boolean }>> } | { status: "unavailable" },
+): Record<AddOnId, AddOnDisplayState> {
+  const states = {} as Record<AddOnId, AddOnDisplayState>;
+  for (const addOn of ADDONS) {
+    states[addOn.id] = result.status === "unavailable"
+      ? "unavailable"
+      : result.entitlements[addOn.id]?.enabled === true ? "installed" : "not-installed";
+  }
+  return states;
 }

package/apps/storefront/src/lib/assets/addons/storeEntitlements.ts

@@ -0,0 +1,257 @@
+/**
+ * A store's add-on entitlements, read from tot20 core — the system of record for what a store has
+ * installed. The storefront never stores or writes an entitlement.
+ *
+ *   GET ${TOT_CORE_URL}/api/storefront/entitlements?tenant=<appDomain>
+ *
+ * authenticated with the storefront's own operator credential (the base64 `apiKey;secretKey`
+ * license-key header), with redirects refused.
+ *
+ * The response is untrusted. Only a 200 whose body carries `code: "storefrontEntitlements:ok"` and
+ * the requested tenant (normalized as core normalizes it) is read; its add-on set is projected to
+ * exactly the fields this module knows. Everything else — no binding, a timeout, a redirect,
+ * 401/403, 5xx, a malformed body, the wrong code or tenant — is `unavailable`. `unavailable` never
+ * raises a tier and is never cached; ingest callers refuse with a retryable 503 rather than capture
+ * at standard.
+ *
+ * Only ingest (capture, upload, catalog setup) and the admin add-ons display call this. Publication,
+ * export and serve never do: they bound accepted bytes by `IMAGE_LIMITS_CEILING`.
+ *
+ * Validated results are cached per tenant for 60 s in `caches.open("store-entitlements")`.
+ */
+import { resolveImageTier, type ImageTier } from "@tot/public-runtime/image-limits";
+import { readEnv } from "@/lib/publication/shared/env";
+
+/** The add-on set as this storefront reads it. Unknown add-ons and fields are dropped. */
+export interface StoreEntitlementSet {
+  largeImages?: { enabled: boolean; updatedAt?: string };
+}
+
+export type EntitlementFallbackReason =
+  | "missing-binding"
+  | "missing-tenant"
+  | "timeout"
+  | "network"
+  | "redirect"
+  | "forbidden"
+  | "upstream-error"
+  | "unexpected-status"
+  | "malformed-body"
+  | "wrong-code"
+  | "tenant-mismatch";
+
+export type StoreEntitlements =
+  | { status: "ok"; entitlements: StoreEntitlementSet }
+  | { status: "not-entitled"; entitlements: StoreEntitlementSet }
+  | { status: "unavailable"; fallbackReason: EntitlementFallbackReason };
+
+/** The tot20 response field that carries the add-on set (tot20's wire name; the storefront stores none). */
+export const ENTITLEMENTS_WIRE_FIELD = "addOns";
+export const ENTITLEMENTS_OK_CODE = "storefrontEntitlements:ok";
+export const ENTITLEMENTS_CACHE_NAME = "store-entitlements";
+export const ENTITLEMENTS_TTL_SECONDS = 60;
+export const ENTITLEMENTS_TIMEOUT_MS = 2_000;
+const CACHE_ORIGIN = "https://store-entitlements.tot.internal";
+
+interface CacheLike {
+  match(request: Request): Promise<Response | undefined>;
+  put(request: Request, response: Response): Promise<void>;
+}
+
+export interface StoreEntitlementsDeps {
+  fetch?: (input: string, init: RequestInit) => Promise<Response>;
+  readEnv?: (key: string) => Promise<string | undefined>;
+  /** Defaults to the runtime `caches` global; absent (dev, tests) means no cache. */
+  openCache?: () => Promise<CacheLike | undefined>;
+  warn?: (message: string, payload: { tierFallbackReason: EntitlementFallbackReason; tenant: string }) => void;
+  timeoutMs?: number;
+}
+
+/** Core's tenant key: trimmed, lowercased, without a leading `www.`. */
+export function normalizeEntitlementTenant(raw: unknown): string | undefined {
+  if (typeof raw !== "string") return undefined;
+  const value = raw.trim().toLowerCase().replace(/^www\./, "");
+  return /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(value) ? value : undefined;
+}
+
+async function defaultOpenCache(): Promise<CacheLike | undefined> {
+  const storage = (globalThis as { caches?: { open(name: string): Promise<CacheLike> } }).caches;
+  if (!storage || typeof storage.open !== "function") return undefined;
+  return storage.open(ENTITLEMENTS_CACHE_NAME);
+}
+
+/**
+ * The cache is only an optimisation: one that cannot be opened or read costs a tot20 read, never a
+ * different answer, so its failure is named and the caller reads tot20.
+ */
+type CacheRead = { kind: "hit"; set: StoreEntitlementSet } | { kind: "miss" } | { kind: "unreadable" };
+
+async function openCacheOutcome(open: () => Promise<CacheLike | undefined>): Promise<CacheLike | "unreadable" | undefined> {
+  try {
+    return await open();
+  } catch {
+    return "unreadable";
+  }
+}
+
+function cacheKey(tenant: string): Request {
+  return new Request(`${CACHE_ORIGIN}/${encodeURIComponent(tenant)}`);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Project the wire add-on set to the fields this module knows; `undefined` when malformed. */
+function projectSet(raw: unknown): StoreEntitlementSet | undefined {
+  if (!isRecord(raw)) return undefined;
+  const large = raw.largeImages;
+  if (large === undefined) return {};
+  if (!isRecord(large) || typeof large.enabled !== "boolean") return undefined;
+  return {
+    largeImages: {
+      enabled: large.enabled,
+      ...(typeof large.updatedAt === "string" ? { updatedAt: large.updatedAt } : {}),
+    },
+  };
+}
+
+function classify(entitlements: StoreEntitlementSet): StoreEntitlements {
+  return entitlements.largeImages?.enabled === true
+    ? { status: "ok", entitlements }
+    : { status: "not-entitled", entitlements };
+}
+
+function statusReason(status: number): EntitlementFallbackReason {
+  if (status >= 300 && status < 400) return "redirect";
+  if (status === 401 || status === 403) return "forbidden";
+  if (status >= 500) return "upstream-error";
+  return "unexpected-status";
+}
+
+async function readCached(cache: CacheLike | undefined, tenant: string): Promise<CacheRead> {
+  if (!cache) return { kind: "miss" };
+  try {
+    const hit = await cache.match(cacheKey(tenant));
+    const set = hit ? projectSet(await hit.json()) : undefined;
+    return set ? { kind: "hit", set } : { kind: "miss" };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+
+async function writeCached(cache: CacheLike | undefined, tenant: string, set: StoreEntitlementSet): Promise<void> {
+  if (!cache) return;
+  try {
+    await cache.put(cacheKey(tenant), new Response(JSON.stringify(set), {
+      headers: { "content-type": "application/json", "cache-control": `max-age=${ENTITLEMENTS_TTL_SECONDS}` },
+    }));
+  } catch {
+    /* a cache write failure costs one extra read next time */
+  }
+}
+
+/**
+ * The entitlements tot20 records for `config.appDomain`. Never throws.
+ */
+export async function getStoreEntitlements(
+  config: { appDomain?: string } | null | undefined,
+  deps: StoreEntitlementsDeps = {},
+): Promise<StoreEntitlements> {
+  const warn = deps.warn ?? ((message, payload) => console.warn(message, payload));
+  const tenant = normalizeEntitlementTenant(config?.appDomain);
+  const unavailable = (fallbackReason: EntitlementFallbackReason): StoreEntitlements => {
+    warn("store entitlements unavailable", { tierFallbackReason: fallbackReason, tenant: tenant ?? "" });
+    return { status: "unavailable", fallbackReason };
+  };
+  if (!tenant) return unavailable("missing-tenant");
+
+  const opened = await openCacheOutcome(deps.openCache ?? defaultOpenCache);
+  const cache = opened === "unreadable" ? undefined : opened;
+  const cached = await readCached(cache, tenant);
+  if (cached.kind === "hit") return classify(cached.set);
+
+  const env = deps.readEnv ?? readEnv;
+  const [baseUrl, apiKey, secretKey] = await Promise.all([
+    env("TOT_CORE_URL"), env("TOT_API_KEY"), env("TOT_SECRET_KEY"),
+  ]);
+  if (!baseUrl || !apiKey || !secretKey) return unavailable("missing-binding");
+
+  const doFetch = deps.fetch ?? ((input: string, init: RequestInit) => fetch(input, init));
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? ENTITLEMENTS_TIMEOUT_MS);
+  let response: Response;
+  try {
+    response = await doFetch(
+      `${baseUrl.replace(/\/+$/, "")}/api/storefront/entitlements?tenant=${encodeURIComponent(tenant)}`,
+      {
+        method: "GET",
+        headers: { accept: "application/json", authorization: btoa(`${apiKey};${secretKey}`) },
+        redirect: "manual",
+        signal: controller.signal,
+      },
+    );
+  } catch {
+    // The error is not logged: a transport error may echo the request, credential included.
+    return unavailable(controller.signal.aborted ? "timeout" : "network");
+  } finally {
+    clearTimeout(timer);
+  }
+  if (response.type === "opaqueredirect") return unavailable("redirect");
+  if (response.status !== 200) return unavailable(statusReason(response.status));
+
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    return unavailable(controller.signal.aborted ? "timeout" : "malformed-body");
+  }
+  const content = isRecord(body) && isRecord(body.content) ? body.content : body;
+  if (!isRecord(content)) return unavailable("malformed-body");
+  if (content.code !== ENTITLEMENTS_OK_CODE) return unavailable("wrong-code");
+  if (normalizeEntitlementTenant(content.tenant) !== tenant) return unavailable("tenant-mismatch");
+  const set = projectSet(content[ENTITLEMENTS_WIRE_FIELD]);
+  if (!set) return unavailable("malformed-body");
+
+  await writeCached(cache, tenant, set);
+  return classify(set);
+}
+
+export type IngestImageTier =
+  | { ok: true; tier: ImageTier }
+  | { ok: false; fallbackReason: EntitlementFallbackReason };
+
+/** The image tier ingest enforces, or the reason it cannot be known (refuse and retry). */
+export async function ingestImageTier(
+  config: { appDomain?: string } | null | undefined,
+  deps?: StoreEntitlementsDeps,
+): Promise<IngestImageTier> {
+  const result = await getStoreEntitlements(config, deps);
+  return result.status === "unavailable"
+    ? { ok: false, fallbackReason: result.fallbackReason }
+    : { ok: true, tier: resolveImageTier(result.entitlements) };
+}
+
+/** Seconds an ingest caller tells its client to wait before retrying an unavailable tier. */
+export const ENTITLEMENTS_RETRY_AFTER_SECONDS = 30;
+
+/** The body an ingest route answers with when the tier is unavailable. */
+export function entitlementsUnavailableBody(fallbackReason: EntitlementFallbackReason) {
+  return {
+    ok: false as const,
+    reason: "entitlements-unavailable" as const,
+    retryable: true as const,
+    fallbackReason,
+    message: "Image limits could not be confirmed with Token of Trust right now. Nothing was saved; try again shortly.",
+  };
+}
+
+/** Token of Trust HQ, where a store's add-ons are installed and changed. */
+export async function hqAddOnsUrl(deps: Pick<StoreEntitlementsDeps, "readEnv"> = {}): Promise<string> {
+  const base = await (deps.readEnv ?? readEnv)("TOT_CORE_URL");
+  try {
+    return new URL("/hq", base || "https://app.tokenoftrust.com").href;
+  } catch {
+    return "https://app.tokenoftrust.com/hq";
+  }
+}

package/apps/storefront/src/lib/assets/captured-original-serve.ts

@@ -2,8 +2,9 @@
  * Worker-safe serve of revision-bound captured originals.
  *
  * Does not import Node capture — R2 + Web Crypto only. Bytes are served only
- * when the sealed revision manifest names the address, within the tenant's image tier
- * (`imageTier`, resolved by the caller from the server-side tenant record).
+ * when the sealed revision manifest names the address, within the image ceiling
+ * (`IMAGE_LIMITS_CEILING`). The tenant's tier applied at capture; a serve never consults it, so a
+ * tier change or an entitlement outage never 404s an image already accepted.
  *
  * Where the runtime has `crypto.DigestStream` (workerd), the R2 body is streamed to the client
  * through a verifier that counts and hashes it and holds back the last chunk until both match, so a
@@ -11,7 +12,7 @@
  * bounded by the manifest's byte length, and verified before the first byte.
  */
 import { sha256Hex } from "@tot/public-runtime";
-import { imageLimitsFor, type ImageTier } from "@tot/public-runtime/image-limits";
+import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
 import {
   PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE, PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed,
 } from "@tot/public-runtime/hosted-image-media-types";
@@ -65,9 +66,8 @@ async function readManifestEntries(
   bucket: CapturedOriginalBucket,
   tenantId: string,
   revisionId: string,
-  imageTier: ImageTier | undefined,
 ): Promise<ManifestEntry[] | null> {
-  const maxEntryBytes = imageLimitsFor(imageTier).maxEncodedBytes;
+  const maxEntryBytes = IMAGE_LIMITS_CEILING.maxEncodedBytes;
   if (!isSafeTenantId(tenantId) || !isSafeRevisionId(revisionId)) return null;
   const object = await bucket.get(originalImageManifestObjectKey(tenantId, revisionId));
   if (!object || typeof object !== "object") return null;
@@ -110,8 +110,6 @@ export async function readDurableCapturedEntry(input: {
   tenantId: string;
   provider: string | null | undefined;
   address: string;
-  /** The tenant's image tier from its server-resolved record (`resolveImageTier`); absent is standard. */
-  imageTier?: ImageTier;
 }): Promise<ManifestEntry | null> {
   if (!isSafeTenantId(input.tenantId) || !ADDRESS_RE.test(input.address)) return null;
   const required = durableRequiredStores(input.provider);
@@ -122,7 +120,7 @@ export async function readDurableCapturedEntry(input: {
     if (typeof designation.entry !== "string" || !designation.entry.startsWith(`${input.address}.`) ||
         !Array.isArray(designation.verifiedStores) || !required.every((store) => designation.verifiedStores.includes(store)) ||
         typeof designation.designatedRevision !== "string" || !isSafeRevisionId(designation.designatedRevision)) continue;
-    const entries = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(designation.designatedRevision), input.imageTier);
+    const entries = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(designation.designatedRevision));
     const entry = entries?.find((entry) => entry.address === input.address &&
       designation.entry === `${entry.address}${PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE[entry.mediaType]}`);
     if (entry) return entry;
@@ -141,8 +139,6 @@ export async function tryServeCapturedOriginal(input: {
   durable?: { kv: { get(key: string): Promise<string | null> }; provider: string | null | undefined };
   pathname: string;
   method?: string;
-  /** The tenant's image tier from its server-resolved record (`resolveImageTier`); absent is standard. */
-  imageTier?: ImageTier;
 }): Promise<Response | null> {
   const parsed = parsePinnedImagePath(input.pathname);
   if (!parsed) return null;
@@ -151,12 +147,12 @@ export async function tryServeCapturedOriginal(input: {
   }
 
   const entries = input.revisionId
-    ? await readManifestEntries(input.bucket, input.tenantId, input.revisionId, input.imageTier).catch(() => null)
+    ? await readManifestEntries(input.bucket, input.tenantId, input.revisionId).catch(() => null)
     : null;
   let entry = entries?.find((item) => item.address === parsed.address);
   let durable = false;
   if (!entry && input.revisionId) {
-    const declared = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(input.revisionId), input.imageTier)
+    const declared = await readManifestEntries(input.bucket, input.tenantId, durableCaptureRevisionId(input.revisionId))
       .catch(() => null);
     entry = declared?.find((item) => item.address === parsed.address);
     durable = !!entry;
@@ -164,7 +160,7 @@ export async function tryServeCapturedOriginal(input: {
   if (!entry && input.durable) {
     try {
       entry = await readDurableCapturedEntry({ bucket: input.bucket, tenantId: input.tenantId,
-        address: parsed.address, ...input.durable, ...(input.imageTier ? { imageTier: input.imageTier } : {}) }) ?? undefined;
+        address: parsed.address, ...input.durable }) ?? undefined;
       durable = !!entry;
     } catch { /* Unreadable durable authority fails closed. */ }
   }

package/apps/storefront/src/lib/assets/durableR2.ts

@@ -19,7 +19,7 @@ import {
 } from "@tot/public-runtime/durable-assets";
 import { GC_LEASE_KEY, awaitGcQuiescence } from "@tot/public-runtime/retention-holds";
 import { authorizeAssetReference, type AssetRegistryStore, type AssetWrite } from "@tot/public-runtime/asset-registry";
-import { imageLimitsFor, type ImageTier } from "@tot/public-runtime/image-limits";
+import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
 import { incrementalSha256 } from "@tot/public-runtime/incremental-sha256";
 
 const MAX_MANIFEST = 1024 * 1024;
@@ -245,12 +245,15 @@ function mediaTypeOf(entry: string): string {
   return mediaType;
 }
 
-/** The tenant's captured `<sha256><ext>`, verified as a stream within its tier; never held whole. */
-async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry: string, imageTier: ImageTier | undefined): Promise<StreamSource> {
+/**
+ * The tenant's captured `<sha256><ext>`, verified as a stream within the image ceiling; never held whole.
+ * Capture already enforced the tenant's tier, so publication only bounds the read.
+ */
+async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry: string): Promise<StreamSource> {
   const address = POOL_ENTRY_RE.exec(entry)?.[1];
   if (!address) throw new R2StagingError("pool-key");
   const source = await verifiedObjectSource(captureBucket, `original-images/${tenant}/objects/${address}`, address,
-    imageLimitsFor(imageTier).maxEncodedBytes);
+    IMAGE_LIMITS_CEILING.maxEncodedBytes);
   if (!source) throw new R2StagingError("original-missing");
   return source;
 }
@@ -265,8 +268,8 @@ async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry
  * tenant's own capture store (which registers it); otherwise nothing is staged and the go-live
  * refuses `asset-unauthorized`.
  *
- * Originals are hashed and copied as streams, one at a time, within the tenant's image tier: none is
- * ever held whole.
+ * Originals are hashed and copied as streams, one at a time, within the image ceiling: none is ever
+ * held whole.
  */
 export async function stageCapturedOriginalsR2(input: {
   tenant: string;
@@ -274,15 +277,13 @@ export async function stageCapturedOriginalsR2(input: {
   captureBucket: R2BucketLike;
   publicBucket: R2BucketLike;
   registry?: AssetRegistryStore;
-  /** The tenant's image tier from its server-resolved record (`resolveImageTier`); absent is standard. */
-  imageTier?: ImageTier;
 }): Promise<number> {
   const registry = input.registry ? await input.registry.read().catch(() => null) : null;
   const owned = new Map<string, number>();
   const unauthorized: string[] = [];
   for (const entry of input.entries) {
     if (authorizeAssetReference([registry], input.tenant, entry).ok) continue;
-    const own = await capturedSource(input.captureBucket, input.tenant, entry, input.imageTier).catch((error: unknown) => {
+    const own = await capturedSource(input.captureBucket, input.tenant, entry).catch((error: unknown) => {
       if (error instanceof R2StagingError) return null;
       throw error;
     });
@@ -299,10 +300,10 @@ export async function stageCapturedOriginalsR2(input: {
   let staged = 0;
   for (const entry of input.entries) {
     const key = `assets/${entry}`;
-    const present = await digestBounded(input.publicBucket, key, imageLimitsFor(input.imageTier).maxEncodedBytes);
+    const present = await digestBounded(input.publicBucket, key, IMAGE_LIMITS_CEILING.maxEncodedBytes);
     const address = POOL_ENTRY_RE.exec(entry)?.[1];
     if (present && address && present.sha256 === address) continue;
-    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry, input.imageTier), mediaTypeOf(entry));
+    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry), mediaTypeOf(entry));
     staged++;
   }
   return staged;
@@ -351,8 +352,6 @@ export async function designateDurableR2(input: {
   awaitQuiescence?: QuiescenceWaiter;
   /** The pool's asset registry: each verified designation is recorded as a transition to `durable`. */
   registry?: AssetRegistryStore;
-  /** The tenant's image tier from its server-resolved record (`resolveImageTier`); absent is standard. */
-  imageTier?: ImageTier;
 }): Promise<DurableDesignationResult> {
   if (input.images.length === 0) return { ok: true, designated: [] };
   const revision = durableCaptureRevisionId(input.revision);
@@ -396,7 +395,7 @@ export async function designateDurableR2(input: {
   for (const item of prepared) {
     await createHold(input.publicBucket, item.holdKey, item.holdBody);
     await ensurePoolObject(input.publicBucket, `assets/${item.entry}`,
-      await capturedSource(input.captureBucket, input.tenant, item.entry, input.imageTier), item.mediaType);
+      await capturedSource(input.captureBucket, input.tenant, item.entry), item.mediaType);
   }
   await recordDurableStatusKv(input.kv, input.tenant, { revision: input.revision, at: now().toISOString(), declared,
     designated: prepared.map((item) => ({ entry: item.entry, name: item.image.name, source: item.image.source, verifiedStores: ["r2"] })) });
@@ -421,8 +420,6 @@ export function makeWorkerR2PinnedOriginalStager(deps: {
   kv: StatusKvLike;
   /** The pool's asset registry (`STATIC_BUNDLES` `registry/assets.json`). */
   registry?: AssetRegistryStore;
-  /** The tier of the tenant this Worker resolves for `tenantId`, from its server-side record. */
-  imageTier?: (tenantId: string) => Promise<ImageTier>;
   now?: () => Date;
   awaitQuiescence?: QuiescenceWaiter;
 }) {
@@ -439,17 +436,15 @@ export function makeWorkerR2PinnedOriginalStager(deps: {
     if (!Array.isArray(entries) || entries.some((entry) => typeof entry !== "string" || !POOL_ENTRY_RE.test(entry))) {
       throw new R2StagingError("manifest-invalid");
     }
-    const imageTier = deps.imageTier ? await deps.imageTier(tenantId) : undefined;
     await awaitR2Quiescence(deps.publicBucket, deps.awaitQuiescence);
     await stageCapturedOriginalsR2({ tenant: tenantId, entries: entries as string[],
-      captureBucket: deps.captureBucket, publicBucket: deps.publicBucket, ...(deps.registry ? { registry: deps.registry } : {}),
-      ...(imageTier ? { imageTier } : {}) });
+      captureBucket: deps.captureBucket, publicBucket: deps.publicBucket, ...(deps.registry ? { registry: deps.registry } : {}) });
     const images = manifest.durableAssets?.images ?? [];
     if (images.length > 0) {
       if (typeof manifest.sourceSha !== "string") throw new R2StagingError("manifest-invalid");
       const result = await designateDurableR2({ tenant: tenantId, revision: manifest.sourceSha, images,
         captureBucket: deps.captureBucket, publicBucket: deps.publicBucket, kv: deps.kv,
-        ...(deps.registry ? { registry: deps.registry } : {}), ...(imageTier ? { imageTier } : {}),
+        ...(deps.registry ? { registry: deps.registry } : {}),
         ...(deps.now ? { now: deps.now } : {}), ...(deps.awaitQuiescence ? { awaitQuiescence: deps.awaitQuiescence } : {}) });
       if (!result.ok) throw new R2StagingError(result.reason);
     }

package/apps/storefront/src/lib/assets/durableR2Bindings.ts

@@ -7,10 +7,8 @@
 import { readKv, readR2 } from "@/lib/publication/shared/env";
 import { makeWorkerR2PinnedOriginalStager, R2StagingError, type R2BucketLike, type StatusKvLike } from "./durableR2.js";
 import { createR2AssetRegistry, type AssetRegistryBucket } from "./assetRegistryR2.js";
-import type { ImageTier } from "@tot/public-runtime/image-limits";
 
-/** `imageTier` resolves a tenant's tier from its server-side record; the caller owns that lookup. */
-export async function workerR2PinnedOriginalStagerFromEnv(imageTier: (tenantId: string) => Promise<ImageTier>): Promise<
+export async function workerR2PinnedOriginalStagerFromEnv(): Promise<
   (args: { tenantId: string; versionId: string; treeDigest?: string | null }) => Promise<void>
 > {
   const [publicBucket, productImages, tenantAssets, kv] = await Promise.all([
@@ -31,6 +29,5 @@ export async function workerR2PinnedOriginalStagerFromEnv(imageTier: (tenantId:
     captureBucket: captureBucket as unknown as R2BucketLike,
     kv: kv as unknown as StatusKvLike,
     registry: createR2AssetRegistry(publicBucket as unknown as AssetRegistryBucket),
-    imageTier,
   });
 }

package/apps/storefront/src/middleware/staticBundle.ts

@@ -16,7 +16,6 @@ import {
   versionIndependentAssetKey,
 } from "@tot/public-runtime";
 import type { StaticBundleR2BucketLike, TenantConfig } from "@tot/public-runtime";
-import { resolveImageTier } from "@tot/public-runtime/image-limits";
 
 export interface StaticBundleAttemptInput {
   request: Request;
@@ -95,7 +94,6 @@ export async function tryServeStaticBundle(
           revisionId: input.capturedOriginal.revisionId,
           pathname: assetPath,
           method,
-          imageTier: resolveImageTier(tenant),
           ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
         });
         if (captured) return captured;
@@ -109,7 +107,6 @@ export async function tryServeStaticBundle(
         revisionId: input.capturedOriginal.revisionId,
         pathname: assetPath,
         method,
-        imageTier: resolveImageTier(tenant),
         ...(kv ? { durable: { kv, provider: tenant.serving?.provider } } : {}),
       });
       if (captured) return captured;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/image-limits.d.mts

@@ -10,8 +10,7 @@ export declare const IMAGE_TIERS: Readonly<Record<ImageTier, ImageLimits>>;
 export declare const IMAGE_LIMITS_CEILING: ImageLimits;
 export declare const LARGE_IMAGES_ADDON_NAME: string;
 export declare function imageLimitsFor(tier: unknown): ImageLimits;
-export declare function resolveImageTier(tenant: unknown): ImageTier;
-export declare function imageLimitsForTenant(tenant: unknown): ImageLimits;
+export declare function resolveImageTier(entitlements: unknown): ImageTier;
 export declare function imageLimitSummary(tier: ImageTier): string;
 export declare function withinImagePixels(
   width: number, height: number, frames: number, limits: Pick<ImageLimits, "maxPixels" | "maxDimension">,

package/packages/public-runtime/src/image-limits.mjs

@@ -1,12 +1,16 @@
 /**
- * The one source of storefront image size limits. Every capture, upload, publication and serving
- * path takes its byte, pixel and dimension caps from `imageLimitsFor(resolveImageTier(tenant))`;
- * no path restates a literal (`image-limits-contract.test.mjs` scans the tree for one).
+ * The one source of storefront image size limits. No path restates a literal
+ * (`image-limits-contract.test.mjs` scans the tree for one).
  *
- * Tiers are per tenant. `large` is the High Fidelity / Large Images add-on, read only from the
- * server-resolved tenant record (`addOns.largeImages.mode === "enabled"`); every other value,
- * including absent or malformed, is `standard` (fail closed, the same contract as
- * `storefront.mode`).
+ * The tier ends at ingest. Capture and upload take their caps from
+ * `imageLimitsFor(resolveImageTier(entitlements))`, where `entitlements` is the store's add-on set as
+ * tot20 reports it (the storefront reads it with `getStoreEntitlements`). Every publication, export
+ * and serve path handles bytes that were already accepted, so it bounds them by
+ * `IMAGE_LIMITS_CEILING` and never consults the tier: a downgrade or an entitlement outage never
+ * invalidates accepted content.
+ *
+ * `large` is the High Fidelity / Large Images add-on: `largeImages.enabled === true` exactly. Every
+ * other value, including absent or malformed, is `standard` (fail closed).
  *
  * Pixels are counted as width x height x frames. No path decodes pixels inside the Worker:
  * dimensions are read from a bounded header prefix, and display sizes are produced by the CDN.
@@ -43,19 +47,15 @@ export function imageLimitsFor(tier) {
   return tier === "large" ? IMAGE_TIERS.large : IMAGE_TIERS.standard;
 }
 
-/** @param {unknown} tenant */
-export function resolveImageTier(tenant) {
-  if (!tenant || typeof tenant !== "object") return "standard";
-  const addOns = /** @type {Record<string, unknown>} */ (tenant).addOns;
-  if (!addOns || typeof addOns !== "object") return "standard";
-  const largeImages = /** @type {Record<string, unknown>} */ (addOns).largeImages;
-  if (!largeImages || typeof largeImages !== "object") return "standard";
-  return /** @type {Record<string, unknown>} */ (largeImages).mode === "enabled" ? "large" : "standard";
-}
-
-/** @param {unknown} tenant */
-export function imageLimitsForTenant(tenant) {
-  return imageLimitsFor(resolveImageTier(tenant));
+/**
+ * The tier a store's add-on entitlements grant. `entitlements` is untrusted input.
+ * @param {unknown} entitlements
+ */
+export function resolveImageTier(entitlements) {
+  if (!entitlements || typeof entitlements !== "object" || Array.isArray(entitlements)) return "standard";
+  const largeImages = /** @type {Record<string, unknown>} */ (entitlements).largeImages;
+  if (!largeImages || typeof largeImages !== "object" || Array.isArray(largeImages)) return "standard";
+  return /** @type {Record<string, unknown>} */ (largeImages).enabled === true ? "large" : "standard";
 }
 
 const mb = (bytes) => `${Math.round((bytes / MiB) * 10) / 10} MB`;

package/packages/public-runtime/src/tenant-record-merge.mjs

@@ -2,8 +2,8 @@
  * Merge a provisioned tenant config into the `tenant:<id>` KV record already stored.
  *
  * Provisioners carry only the fields they own. The stored record also holds fields written by
- * other paths (`storefront.mode`, `addOns.largeImages`), so a provisioner must read the stored
- * record, merge, and write the result; it never replaces the record wholesale.
+ * other paths (`storefront.mode`), so a provisioner must read the stored record, merge, and write
+ * the result; it never replaces the record wholesale.
  *
  * Contract:
  * - the provisioned config wins for every key it carries;
@@ -14,9 +14,9 @@
  * - a stored value that is not a JSON object (unparseable, array, scalar, empty string) throws,
  *   naming the key, and the caller writes nothing.
  *
- * KV has no transaction. A provisioner that reads, merges and writes while the admin add-ons
- * switch writes the same record can still lose one of the two writes; the merge narrows that
- * window to one read-to-write interval and cannot close it.
+ * KV has no transaction. A provisioner that reads, merges and writes while another path writes the
+ * same record can still lose one of the two writes; the merge narrows that window to one
+ * read-to-write interval and cannot close it.
  */
 
 const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);

package/packages/public-runtime/src/tenant.ts

@@ -739,15 +739,6 @@ export interface TenantConfig {
      */
     mode?: StorefrontMode;
   };
-  /**
-   * Per-store add-ons. `largeImages` is the High Fidelity / Large Images add-on: `mode ===
-   * "enabled"` raises the store's image limits to the large tier (`image-limits.mjs`
-   * `resolveImageTier`); any other value, or absent, is the standard tier. `updatedBy` is an
-   * opaque actor id, never an email or other personal detail.
-   */
-  addOns?: {
-    largeImages?: { mode: "enabled" | "disabled"; updatedAt?: string; updatedBy?: string };
-  };
   /**
    * Internal test/e2e tenant — never a real client. A tenant carrying this
    * marker (or an `.e2e.test` appDomain) is excluded from real/prospect-facing

package/apps/storefront/src/lib/assets/addons/addonsClient.ts

@@ -1,59 +0,0 @@
-/**
- * Client island for `/admin/addons` (ADR 0013): each add-on card's button POSTs the mode it names to
- * `/api/admin/addons` and redraws the card from the confirmed state the API returns. A no-op when
- * the page rendered no cards (unauthorized viewer).
- */
-export function initAddOnsPage(apiPath: string): void {
-  for (const button of document.querySelectorAll<HTMLButtonElement>("[data-addon-toggle]")) {
-    button.addEventListener("click", () => void toggle(apiPath, button));
-  }
-}
-
-async function toggle(apiPath: string, button: HTMLButtonElement): Promise<void> {
-  const card = button.closest<HTMLElement>("[data-addon-id]");
-  const id = card?.dataset.addonId;
-  const mode = button.dataset.addonNextMode;
-  const status = card?.querySelector<HTMLElement>("[data-addon-status]");
-  if (!card || !id || !mode) return;
-
-  button.disabled = true;
-  if (status) {
-    status.textContent = "Saving…";
-    status.dataset.tone = "";
-  }
-  try {
-    const res = await fetch(apiPath, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ id, mode }),
-    });
-    let body: { ok?: boolean; state?: { mode?: string }; status?: string };
-    try {
-      body = (await res.json()) as typeof body;
-    } catch {
-      throw new Error(`HTTP ${res.status}`);
-    }
-    if (!res.ok || !body.ok || !body.state?.mode) throw new Error(body.status || `HTTP ${res.status}`);
-    render(card, button, body.state.mode);
-    if (status) {
-      status.textContent = body.state.mode === "enabled" ? "Enabled." : "Disabled.";
-      status.dataset.tone = "ok";
-    }
-  } catch (error) {
-    if (status) {
-      status.textContent = `Could not save (${error instanceof Error ? error.message : "error"}).`;
-      status.dataset.tone = "error";
-    }
-  } finally {
-    button.disabled = false;
-  }
-}
-
-function render(card: HTMLElement, button: HTMLButtonElement, mode: string): void {
-  const enabled = mode === "enabled";
-  card.dataset.addonMode = mode;
-  const chip = card.querySelector<HTMLElement>("[data-addon-chip]");
-  if (chip) chip.textContent = enabled ? "Enabled" : "Off";
-  button.dataset.addonNextMode = enabled ? "disabled" : "enabled";
-  button.textContent = enabled ? "Turn off" : "Turn on";
-}

package/apps/storefront/src/lib/assets/addons/tenantAddOns.ts

@@ -1,89 +0,0 @@
-/**
- * Read and write a tenant's add-on state (`addOns.<id>` on its KV record).
- *
- * The write is a read-modify-write of the RAW stored record: read `tenant:<id>` with no edge cache
- * and no platform-policy overlay, change only `addOns.<id>`, and write back only that key. A cached
- * read (`resolveStrict` caches 300 s) would clobber a field written since, and an overlaid read would
- * persist platform policy into the record. A missing record is refused, never created: a tenant
- * served from the static fallback has no record to edit.
- *
- * KV read-modify-write is not atomic; two simultaneous toggles can lose one. Acceptable for an
- * owner switch, and no other field is at risk because both writers spread the same fresh read.
- */
-import { getStoredTenantRecord, putStoredTenantRecord } from "@/config/storedTenantRecord";
-import { ADDONS, isAddOnId, isAddOnMode, type AddOnId, type AddOnMode } from "./catalog";
-
-export interface AddOnState {
-  mode: AddOnMode;
-  updatedAt?: string;
-  updatedBy?: string;
-}
-
-export type AddOnsState = Record<AddOnId, AddOnState>;
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-/** Every catalog add-on's state on `record`. Anything but `mode: "enabled"` reads as disabled. */
-export function readAddOns(record: unknown): AddOnsState {
-  const stored = isRecord(record) && isRecord(record.addOns) ? record.addOns : {};
-  const state = {} as AddOnsState;
-  for (const addOn of ADDONS) {
-    const entry = stored[addOn.id];
-    const out: AddOnState = { mode: isRecord(entry) && entry.mode === "enabled" ? "enabled" : "disabled" };
-    if (isRecord(entry) && typeof entry.updatedAt === "string") out.updatedAt = entry.updatedAt;
-    if (isRecord(entry) && typeof entry.updatedBy === "string") out.updatedBy = entry.updatedBy;
-    state[addOn.id] = out;
-  }
-  return state;
-}
-
-function parseStored(raw: string | null): Record<string, unknown> | null | "unreadable" {
-  if (raw === null) return null;
-  try {
-    const parsed: unknown = JSON.parse(raw);
-    return isRecord(parsed) ? parsed : "unreadable";
-  } catch {
-    return "unreadable";
-  }
-}
-
-/** The stored record's add-on state, or null when the tenant has no readable KV record. */
-export async function readStoredAddOns(kv: KVNamespace, tenantId: string): Promise<AddOnsState | null> {
-  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
-  return record && record !== "unreadable" ? readAddOns(record) : null;
-}
-
-export type SetAddOnResult =
-  | { ok: true; state: AddOnState }
-  | { ok: false; status: 400; reason: "unknown_addon" | "unknown_mode" }
-  | { ok: false; status: 404; reason: "no_tenant_record" }
-  | { ok: false; status: 409; reason: "tenant_record_unreadable" }
-  | { ok: false; status: 503; reason: "write_not_confirmed" };
-
-export async function setAddOn(
-  kv: KVNamespace,
-  tenantId: string,
-  id: unknown,
-  mode: unknown,
-  actor: string,
-  now: Date,
-): Promise<SetAddOnResult> {
-  if (!isAddOnId(id)) return { ok: false, status: 400, reason: "unknown_addon" };
-  if (!isAddOnMode(mode)) return { ok: false, status: 400, reason: "unknown_mode" };
-
-  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
-  if (record === null) return { ok: false, status: 404, reason: "no_tenant_record" };
-  if (record === "unreadable") return { ok: false, status: 409, reason: "tenant_record_unreadable" };
-
-  const addOns = isRecord(record.addOns) ? record.addOns : {};
-  const entry: AddOnState = { mode, updatedAt: now.toISOString(), updatedBy: actor };
-  await putStoredTenantRecord(kv, tenantId, { ...record, addOns: { ...addOns, [id]: entry } });
-
-  const confirmed = parseStored(await getStoredTenantRecord(kv, tenantId));
-  if (!confirmed || confirmed === "unreadable") return { ok: false, status: 503, reason: "write_not_confirmed" };
-  const state = readAddOns(confirmed)[id];
-  if (state.mode !== mode) return { ok: false, status: 503, reason: "write_not_confirmed" };
-  return { ok: true, state };
-}