@tokenoftrust/storefront-runner 6.1.4 → 6.2.0

package/apps/storefront/public/shared/commerce-chrome.css

@@ -421,6 +421,11 @@ a.article-card__tag:hover { text-decoration: underline; }
 .footer-bottom nav ul { display: flex; flex-wrap: wrap; gap: 6px 20px; list-style: none; margin: 0; padding: 0; }
 .footer-bottom nav a:hover { color: var(--color-primary-contrast); text-decoration: underline; }
 
+.site-footer[data-variant="minimal"] { padding-block: clamp(1.5rem, 3vw, 2rem); }
+.site-footer[data-variant="minimal"] .footer-bottom { margin-top: 0; padding-top: 0; border-top: 0; }
+.site-footer[data-variant="minimal"] .footer-disclaimer,
+.site-footer[data-variant="minimal"] .footer-warning { margin-top: 0; margin-bottom: 1.5rem; }
+
 /* Source-parity light footer. Native details provide real zero-JS disclosure
    semantics on mobile; desktop CSS presents the same content as open columns. */
 .site-footer[data-variant="light-collapsible"] {

package/apps/storefront/src/components/content/storefront/chrome/SiteFooter.astro

@@ -73,10 +73,12 @@ const bottomLinkStamp = (l: ChromeLink, index: number) =>
   });
 const newsletterAgeAttestation = resolveNewsletterAgeAttestation(newsletter?.ageAttestation);
 const collapsible = variant === "light-collapsible";
+const minimal = variant === "minimal";
 ---
 
 <footer class:list={["border-t border-border bg-surface text-text", collapsible && "footer-collapsible pb-[62px] md:pb-0", className]} data-variant={variant}>
-  <div class="container-prose py-12">
+  <div class:list={["container-prose", minimal ? "py-6 md:py-8" : "py-12"]}>
+    {!minimal && (
     <div class="grid gap-10 md:grid-cols-[1.4fr_repeat(3,1fr)]">
       <!-- Brand -->
       <div>
@@ -176,10 +178,11 @@ const collapsible = variant === "light-collapsible";
         })
       }
     </div>
+    )}
 
     <!-- Newsletter -->
     {
-      newsletter && (
+      !minimal && newsletter && (
         <div class="mt-10 border-t border-border pt-8">
           {newsletter.title && <h3 class="font-display text-base font-semibold">{newsletter.title}</h3>}
           {newsletter.body && <p class="mt-1 text-sm text-muted">{newsletter.body}</p>}
@@ -225,7 +228,7 @@ const collapsible = variant === "light-collapsible";
 
     <!-- Payment badges -->
     {
-      payments.length > 0 && (
+      !minimal && payments.length > 0 && (
         <div class="mt-8 flex flex-wrap items-center gap-2" aria-label="Accepted payment methods">
           {payments.map((p) => (
             <span class="rounded border border-border px-2 py-1 font-mono text-[0.62rem] uppercase tracking-[0.08em] text-muted">
@@ -239,7 +242,7 @@ const collapsible = variant === "light-collapsible";
     <!-- Merchant legal copy (verbatim) -->
     {
       disclaimer?.trim() && (
-        <p class="mt-8 border-t border-border pt-6 text-xs text-muted" data-footer-disclaimer>
+        <p class:list={["text-xs text-muted", !minimal && "mt-8 border-t border-border pt-6"]} data-footer-disclaimer>
           {disclaimer.trim().split(/\r?\n/).map((line, i) => (
             <>
               {i > 0 && <br />}
@@ -253,14 +256,14 @@ const collapsible = variant === "light-collapsible";
     <!-- Compliance / trust line -->
     {
       compliance && (
-        <p class="mt-8 border-t border-border pt-6 text-xs text-muted">{compliance}</p>
+        <p class:list={["text-xs text-muted", minimal ? disclaimer?.trim() && "mt-4" : "mt-8 border-t border-border pt-6"]}>{compliance}</p>
       )
     }
 
     <!-- Legal bottom bar: text line + optional policy links -->
     {
       (legal || bottomLinks.length > 0) && (
-        <div class="mt-4 flex flex-col gap-3 border-t border-border pt-4 text-xs text-muted sm:flex-row sm:items-center sm:justify-between">
+        <div class:list={["flex flex-col gap-3 text-xs text-muted sm:flex-row sm:items-center sm:justify-between", (!minimal || disclaimer?.trim() || compliance) && "mt-4 border-t border-border pt-4"]}>
           {legal && <p class="font-mono text-[0.68rem] uppercase tracking-[0.08em]">{legal}</p>}
           {
             bottomLinks.length > 0 && (

package/apps/storefront/src/lib/assets/captured-original-serve.ts

@@ -14,7 +14,8 @@
 import { sha256Hex } from "@tot/public-runtime";
 import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
 import {
-  PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE, PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed,
+  PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE, PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION,
+  sealedOriginalEntryAllowed, validSvgSanitizeReceipt, type SvgSanitizeReceipt,
 } from "@tot/public-runtime/hosted-image-media-types";
 import { durableAssetsStatusKey, durableCaptureRevisionId, durableRequiredStores, parseDurableAssetsStatus } from "@tot/public-runtime/durable-assets";
 import { POOL_ASSET_SECURITY_HEADERS } from "@tot/public-runtime/pool-asset-headers";
@@ -49,6 +50,7 @@ export type ManifestEntry = {
   byteLength: number;
   mediaType: string;
   provenance?: { kind: "local" | "remote" | "upload"; locator: string };
+  sanitized?: SvgSanitizeReceipt;
 };
 
 function objectKey(tenantId: string, address: string): string {
@@ -89,12 +91,14 @@ async function readManifestEntries(
       const entry = raw as Partial<ManifestEntry>;
       if (typeof entry.address !== "string" || !ADDRESS_RE.test(entry.address)) return null;
       if (!Number.isSafeInteger(entry.byteLength) || entry.byteLength! < 1 || entry.byteLength! > maxEntryBytes ||
-          !sealedMediaTypeAllowed(entry.provenance?.kind, entry.mediaType)) return null;
+          !sealedOriginalEntryAllowed(entry.provenance?.kind, entry.mediaType, entry.sanitized)) return null;
+      const sanitized = validSvgSanitizeReceipt(entry.sanitized);
       entries.push({
         address: entry.address,
         byteLength: entry.byteLength!,
         mediaType: entry.mediaType!,
         provenance: entry.provenance,
+        ...(sanitized ? { sanitized } : {}),
       });
     }
     return entries;

package/apps/storefront/src/lib/assets/durableR2.ts

@@ -7,7 +7,7 @@
  * Order, always: write the references (version manifest already in R2, or the holds), wait while a
  * bundle-GC sweep holds its lease, then stage and verify every object those references name.
  */
-import { PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed } from "@tot/public-runtime/hosted-image-media-types";
+import { PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedOriginalEntryAllowed } from "@tot/public-runtime/hosted-image-media-types";
 import {
   durableAssetsStatusKey,
   durableCaptureRevisionId,
@@ -19,8 +19,9 @@ import {
 } from "@tot/public-runtime/durable-assets";
 import { GC_LEASE_KEY, awaitGcQuiescence } from "@tot/public-runtime/retention-holds";
 import { authorizeAssetReference, type AssetRegistryStore, type AssetWrite } from "@tot/public-runtime/asset-registry";
-import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
+import { IMAGE_LIMITS_CEILING, IMAGE_TIERS } from "@tot/public-runtime/image-limits";
 import { incrementalSha256 } from "@tot/public-runtime/incremental-sha256";
+import { sanitizeSvg } from "@tot/public-runtime/svg-sanitize";
 
 const MAX_MANIFEST = 1024 * 1024;
 const POOL_ENTRY_RE = /^([0-9a-f]{64})(\.[A-Za-z0-9]+)$/;
@@ -204,19 +205,35 @@ export function awaitR2Quiescence(bucket: R2BucketLike, waiter: QuiescenceWaiter
 
 /**
  * Present with exactly the source's bytes, writing it create-only when absent; refuses a mismatched
- * object. A {@link StreamSource} is streamed into R2 with its sha256, so R2 refuses (writes nothing)
- * on any other body; the existing object and the read-back are hashed as streams, never held whole.
+ * object. Raster streams are put with their sha256; SVG sources are bounded, hashed and checked
+ * against the sanitizer before any existing-object shortcut, then those exact bytes are put.
+ * The existing object and the read-back are hashed as streams.
  */
 export async function ensurePoolObject(bucket: R2BucketLike, key: string, source: Uint8Array | StreamSource, mediaType: string): Promise<void> {
   const address = POOL_ENTRY_RE.exec(key.replace(/^assets\//, ""))?.[1];
   if (!address) throw new R2StagingError("pool-key");
   const size = source instanceof Uint8Array ? source.byteLength : source.size;
+  let verifiedSource = source;
+  if (mediaType === "image/svg+xml") {
+    // SVG bytes must already be sanitizer output, even when the shared pool has this address.
+    const limit = IMAGE_TIERS.standard.maxEncodedBytes;
+    if (!Number.isSafeInteger(size) || size < 1 || size > limit) throw new R2StagingError("unsupported-format");
+    const bytes = source instanceof Uint8Array ? source.slice()
+      : await readBounded({ get: async () => ({ size, body: await source.open() }) }, key, limit);
+    if (!bytes || bytes.byteLength !== size) throw new R2StagingError("original-missing");
+    const hash = incrementalSha256();
+    await hash.update(bytes);
+    if (await hash.hex() !== address) throw new R2StagingError("original-missing");
+    const inspected = sanitizeSvg(bytes, { maxBytes: limit });
+    if (!inspected.ok || inspected.changed) throw new R2StagingError("unsupported-format");
+    verifiedSource = bytes;
+  }
   // Bounded by the size being staged: an object of any other size cannot hold this address.
   const existing = await digestBounded(bucket, key, size);
   if (existing && (existing.sha256 !== address || existing.size !== size)) throw new R2StagingError("store-mismatch");
   if (!existing) {
     if (!bucket.put) throw new R2StagingError("store-unwritable");
-    await bucket.put(key, source instanceof Uint8Array ? source : exactLength(await source.open(), size), {
+    await bucket.put(key, verifiedSource instanceof Uint8Array ? verifiedSource : exactLength(await verifiedSource.open(), size), {
       httpMetadata: { contentType: mediaType, cacheControl: IMMUTABLE },
       onlyIf: new Headers({ "If-None-Match": "*" }),
       sha256: address,
@@ -268,8 +285,8 @@ async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry
  * tenant's own capture store (which registers it); otherwise nothing is staged and the go-live
  * refuses `asset-unauthorized`.
  *
- * Originals are hashed and copied as streams, one at a time, within the image ceiling: none is ever
- * held whole.
+ * Originals are staged one at a time within the image ceiling. Rasters stream; SVGs are held
+ * within the sanitizer's bound for fixed-point validation before staging.
  */
 export async function stageCapturedOriginalsR2(input: {
   tenant: string;
@@ -290,22 +307,26 @@ export async function stageCapturedOriginalsR2(input: {
     if (own) owned.set(entry, own.size);
     else unauthorized.push(entry);
   }
-  if (input.registry && owned.size > 0) {
-    const writes: AssetWrite[] = [...owned].map(([entry, size]) => ({
-      entry, tenant: input.tenant, mediaType: mediaTypeOf(entry), size,
-    }));
-    await input.registry.upsert(writes).catch(() => "lost");
-  }
   if (unauthorized.length > 0) throw new R2StagingError("asset-unauthorized");
   let staged = 0;
   for (const entry of input.entries) {
     const key = `assets/${entry}`;
-    const present = await digestBounded(input.publicBucket, key, IMAGE_LIMITS_CEILING.maxEncodedBytes);
     const address = POOL_ENTRY_RE.exec(entry)?.[1];
-    if (present && address && present.sha256 === address) continue;
-    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry), mediaTypeOf(entry));
+    const mediaType = mediaTypeOf(entry);
+    const present = address ? await verifiedObjectSource(input.publicBucket, key, address, IMAGE_LIMITS_CEILING.maxEncodedBytes) : null;
+    if (present) {
+      if (mediaType === "image/svg+xml") await ensurePoolObject(input.publicBucket, key, present, mediaType);
+      continue;
+    }
+    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry), mediaType);
     staged++;
   }
+  if (input.registry && owned.size > 0) {
+    const writes: AssetWrite[] = [...owned].map(([entry, size]) => ({
+      entry, tenant: input.tenant, mediaType: mediaTypeOf(entry), size,
+    }));
+    await input.registry.upsert(writes).catch(() => "lost");
+  }
   return staged;
 }
 
@@ -360,7 +381,7 @@ export async function designateDurableR2(input: {
   if (manifestBytes) {
     const manifest = JSON.parse(new TextDecoder().decode(manifestBytes)) as {
       version?: unknown; revisionId?: unknown;
-      entries?: Array<{ address?: unknown; byteLength?: unknown; mediaType?: unknown; provenance?: { kind?: unknown; locator?: unknown } }>;
+      entries?: Array<{ address?: unknown; byteLength?: unknown; mediaType?: unknown; sanitized?: unknown; provenance?: { kind?: unknown; locator?: unknown } }>;
     };
     if (manifest.version !== 1 || manifest.revisionId !== revision || !Array.isArray(manifest.entries)) {
       throw new R2StagingError("manifest-invalid");
@@ -368,7 +389,7 @@ export async function designateDurableR2(input: {
     for (const entry of manifest.entries) {
       if (typeof entry?.address !== "string" || !/^[0-9a-f]{64}$/.test(entry.address) ||
         typeof entry.byteLength !== "number" || typeof entry.mediaType !== "string" ||
-        !sealedMediaTypeAllowed(entry.provenance?.kind, entry.mediaType) ||
+        !sealedOriginalEntryAllowed(entry.provenance?.kind, entry.mediaType, entry.sanitized) ||
         typeof entry.provenance?.locator !== "string") throw new R2StagingError("manifest-invalid");
       byLocator.set(entry.provenance.locator, { address: entry.address, byteLength: entry.byteLength, mediaType: entry.mediaType });
     }

package/apps/storefront/src/lib/content/chrome/examples/tokenoftrust.chrome-assignments.example.json

@@ -1,6 +1,6 @@
 {
   "assignments": {
     "/contact/contact-sales": { "headerVariant": "minimal" },
-    "/contact/contact-sales/thank-you": { "headerVariant": "minimal" }
+    "/contact/contact-sales/thank-you": { "headerVariant": "minimal", "footerVariant": "minimal" }
   }
 }

package/apps/storefront/src/lib/content/shared/rawChrome.ts

@@ -49,11 +49,12 @@ import type {
   ChromeNavItem,
   ChromeSearch,
   ChromeUtilityNav,
+  FooterVariant,
   HeaderVariant,
   SocialLink,
 } from "../chrome/model.js";
 import { isSafeAgeGateHref, resolveAgeGateCopy, resolveChromeAssignment } from "../chrome/model.js";
-import { resolveHeaderVariant } from "../chrome/variant.js";
+import { resolveFooterVariant, resolveHeaderVariant } from "../chrome/variant.js";
 
 /** HTML-escape text/attribute content. Covers the five significant characters. */
 function esc(value: string): string {
@@ -534,11 +535,12 @@ function renderFooterNewsletter(n: NonNullable<ChromeFooter["newsletter"]>): str
   );
 }
 
-function renderFooter(footer: ChromeFooter): string {
-  const collapsible = footer.variant === "light-collapsible";
+function renderFooter(footer: ChromeFooter, variant: FooterVariant): string {
+  const minimal = variant === "minimal";
+  const collapsible = variant === "light-collapsible";
   const brand = footer.brand;
   const brandBlock =
-    brand || footer.newsletter
+    !minimal && (brand || footer.newsletter)
       ? (() => {
           const logo = brand?.logo && /^(https?:|\/)/.test(brand.logo.src)
             ? `<img src="${esc(brand.logo.src)}" alt="${esc(brand.logo.alt)}"${
@@ -556,7 +558,7 @@ function renderFooter(footer: ChromeFooter): string {
   // — scope indices count RENDERED grid columns, so they describe where a link
   // actually is rather than where it sat in the authored array.
   const { gridColumns, legalLinks } = splitFooterLegal(footer.columns);
-  const columns = gridColumns
+  const columns = (minimal ? [] : gridColumns)
     .map((c, colIndex) => {
       const links = c.links
         .map((l, i) => {
@@ -576,15 +578,15 @@ function renderFooter(footer: ChromeFooter): string {
         : `      <div class="footer-col">\n        <p class="footer-col-title">${esc(c.title)}</p>\n        <ul>${links}</ul>\n      </div>`;
     })
     .join("\n");
-  const trust = footer.trustMarks?.length
+  const trust = !minimal && footer.trustMarks?.length
     ? `\n    <div class="trust-marks" aria-label="Store commitments">${footer.trustMarks
         .map((t) => `<span><svg viewBox="0 0 24 24">${t.icon}</svg>${esc(t.label)}</span>`)
         .join("")}</div>`
     : "";
-  const social = footer.social?.length
+  const social = !minimal && footer.social?.length
     ? `\n    <div class="footer-social">${renderSocial(footer.social)}</div>`
     : "";
-  const payments = footer.payments?.length
+  const payments = !minimal && footer.payments?.length
     ? `\n    <div class="pay-badges" aria-label="Accepted payments">${footer.payments
         .map((p) => `<span>${esc(p)}</span>`)
         .join("")}</div>`
@@ -620,9 +622,9 @@ function renderFooter(footer: ChromeFooter): string {
   const bottom =
     bottomText || legalNav ? `\n    <div class="footer-bottom">${bottomText}${legalNav}</div>` : "";
   return (
-    `<footer class="site-footer" data-variant="${esc(footer.variant)}">\n` +
+    `<footer class="site-footer" data-variant="${esc(variant)}">\n` +
     `  <div class="container">\n` +
-    `    <div class="footer-grid">\n${brandBlock}${columns}\n    </div>` +
+    (minimal ? "" : `    <div class="footer-grid">\n${brandBlock}${columns}\n    </div>`) +
     `${trust}${social}${payments}${disclaimer}${warning}${bottom}\n` +
     `  </div>\n` +
     `</footer>`
@@ -962,10 +964,8 @@ function faviconMime(href: string): string {
  * `aria-current="page"` on the primary-nav link that exactly matches it.
  *
  * `assignments`, when given, is the tenant's page-assignment manifest: the
- * entry matching `currentPath` overrides `chrome.header.variant` for THIS page
- * only. Resolution happens once, here, through the same fail-closed
- * resolveHeaderVariant the Layout.astro prop path uses, and the resolved value
- * is what reaches the markup.
+ * entry matching `currentPath` overrides the header/footer variants for this page
+ * through the same fail-closed resolvers the Layout.astro prop path uses.
  */
 export function renderRawChrome(
   chrome: ChromeConfig,
@@ -987,10 +987,12 @@ export function renderRawChrome(
     .filter(Boolean)
     .join("\n");
 
+  const assignment = resolveChromeAssignment(assignments, currentPath);
   const headerVariant = resolveHeaderVariant(
-    resolveChromeAssignment(assignments, currentPath)?.headerVariant,
+    assignment?.headerVariant,
     chrome.header.variant,
   );
+  const footerVariant = resolveFooterVariant(assignment?.footerVariant, chrome.footer.variant);
 
   const skipHref = esc(chrome.skipLink?.href ?? "#main");
   const skipLabel = esc(chrome.skipLink?.label ?? "Skip to main content");
@@ -1006,7 +1008,7 @@ export function renderRawChrome(
     chrome.complianceStrip
       ? `<div class="compliance-strip"><div class="container"><p>${esc(chrome.complianceStrip)}</p></div></div>`
       : "",
-    renderFooter(chrome.footer),
+    renderFooter(chrome.footer, footerVariant),
   ].filter(Boolean);
 
   return (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.1.4",
+  "version": "6.2.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/chrome.ts

@@ -289,7 +289,7 @@ export const HEADER_VARIANTS = ["primary", "minimal", "compact-centered"] as con
 export type HeaderVariant = (typeof HEADER_VARIANTS)[number];
 
 /** Footer content shapes. The string union keeps presentation explicit and validated. */
-export const FOOTER_VARIANTS = ["default", "light-collapsible"] as const;
+export const FOOTER_VARIANTS = ["default", "light-collapsible", "minimal"] as const;
 export type FooterVariant = (typeof FOOTER_VARIANTS)[number];
 
 export function isHeaderVariant(v: unknown): v is HeaderVariant {

package/packages/public-runtime/src/hosted-image-media-types.ts

@@ -17,8 +17,9 @@
  * - CAPTURABLE_RASTER_MEDIA_TYPES: the raster formats capture reads by their magic
  *   bytes. An SVG is never stored as fetched: capture and upload pass it through the
  *   one sanitizer (`svg-sanitize.ts`) and store only its output, which is what lets a
- *   sealed `remote` or `upload` entry carry `image/svg+xml` (`sealedMediaTypeAllowed`).
+ *   sealed local, remote or upload entry carry `image/svg+xml`.
  */
+import { SVG_SANITIZER_ID } from "@tot/public-runtime/svg-sanitize";
 
 export const PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE: Readonly<Record<string, string>> = Object.freeze({
   "image/png": ".png",
@@ -42,9 +43,7 @@ export const CAPTURABLE_RASTER_MEDIA_TYPES = Object.freeze([
 export type CapturableRasterMediaType = (typeof CAPTURABLE_RASTER_MEDIA_TYPES)[number];
 
 /**
- * An author upload or a remote capture may also be an SVG: both pass it through the sanitizer
- * (`svg-sanitize.ts`) and store only its output, so a sealed `upload` or `remote` entry may carry
- * it. A `local` entry is a repo file capture reads by raster magic, never an SVG.
+ * Capture and author uploads may carry SVG only as the existing sanitizer's output.
  */
 export const UPLOADABLE_MEDIA_TYPES = Object.freeze([...CAPTURABLE_RASTER_MEDIA_TYPES, "image/svg+xml"] as const);
 
@@ -53,8 +52,37 @@ export type UploadableMediaType = (typeof UPLOADABLE_MEDIA_TYPES)[number];
 /** Comma-joined for a remote capture's HTTP `Accept` header -- derived, never a second literal. */
 export const CAPTURE_ACCEPT_HEADER = UPLOADABLE_MEDIA_TYPES.join(",");
 
-/** May a sealed original of provenance `kind` carry `mediaType`? Every reader of a manifest asks this. */
+/** Media-type lookup only; manifest readers must use sealedOriginalEntryAllowed for receipt policy. */
 export function sealedMediaTypeAllowed(kind: unknown, mediaType: unknown): boolean {
-  const types: readonly string[] = kind === "upload" || kind === "remote" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
+  const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
   return typeof mediaType === "string" && types.includes(mediaType);
 }
+
+/** Provenance of the sanitize pass; it does not authorize or verify the stored object's bytes. */
+export interface SvgSanitizeReceipt {
+  sanitizer: string;
+  removedElements: number;
+  removedAttributes: number;
+  source: string;
+}
+
+/** Normalize the supported sanitizer's receipt, discarding untrusted extra fields. */
+export function validSvgSanitizeReceipt(raw: unknown): SvgSanitizeReceipt | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const receipt = raw as Partial<SvgSanitizeReceipt>;
+  if (receipt.sanitizer !== SVG_SANITIZER_ID || typeof receipt.source !== "string" || !/^[0-9a-f]{64}$/.test(receipt.source)) return null;
+  if (!Number.isSafeInteger(receipt.removedElements) || (receipt.removedElements as number) < 0) return null;
+  if (!Number.isSafeInteger(receipt.removedAttributes) || (receipt.removedAttributes as number) < 0) return null;
+  return {
+    sanitizer: receipt.sanitizer, removedElements: receipt.removedElements as number,
+    removedAttributes: receipt.removedAttributes as number, source: receipt.source,
+  };
+}
+
+/** A sealed capture SVG requires its receipt; upload provenance resides in the upload registry. */
+export function sealedOriginalEntryAllowed(kind: unknown, mediaType: unknown, sanitized: unknown): boolean {
+  if (kind !== "local" && kind !== "remote" && kind !== "upload") return false;
+  if (!sealedMediaTypeAllowed(kind, mediaType)) return false;
+  const needsReceipt = kind !== "upload" && mediaType === "image/svg+xml";
+  return needsReceipt ? validSvgSanitizeReceipt(sanitized) !== null : sanitized === undefined;
+}

package/scripts/tenant/validate.mjs

@@ -203,7 +203,7 @@ function validateRawHtmlBody(html) {
 // packages/public-runtime/tests/chrome-config-shape-parity.test.ts. Kept in
 // step with packages/cli/src/validate.mjs's identical copy.
 const CHROME_HEADER_VARIANTS = new Set(["primary", "minimal", "compact-centered"]);
-const CHROME_FOOTER_VARIANTS = new Set(["default", "light-collapsible"]);
+const CHROME_FOOTER_VARIANTS = new Set(["default", "light-collapsible", "minimal"]);
 /**
  * The declarative-interaction-tracking rule, mirrored: every actionable item —
  * an object carrying both `id` and `href` — declares EXACTLY ONE of a non-empty