@tokenoftrust/storefront-runner 6.1.5 → 6.2.0

package/apps/storefront/src/lib/assets/captured-original-serve.ts

@@ -14,7 +14,8 @@
 import { sha256Hex } from "@tot/public-runtime";
 import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
 import {
-  PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE, PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed,
+  PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE, PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION,
+  sealedOriginalEntryAllowed, validSvgSanitizeReceipt, type SvgSanitizeReceipt,
 } from "@tot/public-runtime/hosted-image-media-types";
 import { durableAssetsStatusKey, durableCaptureRevisionId, durableRequiredStores, parseDurableAssetsStatus } from "@tot/public-runtime/durable-assets";
 import { POOL_ASSET_SECURITY_HEADERS } from "@tot/public-runtime/pool-asset-headers";
@@ -49,6 +50,7 @@ export type ManifestEntry = {
   byteLength: number;
   mediaType: string;
   provenance?: { kind: "local" | "remote" | "upload"; locator: string };
+  sanitized?: SvgSanitizeReceipt;
 };
 
 function objectKey(tenantId: string, address: string): string {
@@ -89,12 +91,14 @@ async function readManifestEntries(
       const entry = raw as Partial<ManifestEntry>;
       if (typeof entry.address !== "string" || !ADDRESS_RE.test(entry.address)) return null;
       if (!Number.isSafeInteger(entry.byteLength) || entry.byteLength! < 1 || entry.byteLength! > maxEntryBytes ||
-          !sealedMediaTypeAllowed(entry.provenance?.kind, entry.mediaType)) return null;
+          !sealedOriginalEntryAllowed(entry.provenance?.kind, entry.mediaType, entry.sanitized)) return null;
+      const sanitized = validSvgSanitizeReceipt(entry.sanitized);
       entries.push({
         address: entry.address,
         byteLength: entry.byteLength!,
         mediaType: entry.mediaType!,
         provenance: entry.provenance,
+        ...(sanitized ? { sanitized } : {}),
       });
     }
     return entries;

package/apps/storefront/src/lib/assets/durableR2.ts

@@ -7,7 +7,7 @@
  * Order, always: write the references (version manifest already in R2, or the holds), wait while a
  * bundle-GC sweep holds its lease, then stage and verify every object those references name.
  */
-import { PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedMediaTypeAllowed } from "@tot/public-runtime/hosted-image-media-types";
+import { PINNED_ASSET_MEDIA_TYPE_BY_EXTENSION, sealedOriginalEntryAllowed } from "@tot/public-runtime/hosted-image-media-types";
 import {
   durableAssetsStatusKey,
   durableCaptureRevisionId,
@@ -19,8 +19,9 @@ import {
 } from "@tot/public-runtime/durable-assets";
 import { GC_LEASE_KEY, awaitGcQuiescence } from "@tot/public-runtime/retention-holds";
 import { authorizeAssetReference, type AssetRegistryStore, type AssetWrite } from "@tot/public-runtime/asset-registry";
-import { IMAGE_LIMITS_CEILING } from "@tot/public-runtime/image-limits";
+import { IMAGE_LIMITS_CEILING, IMAGE_TIERS } from "@tot/public-runtime/image-limits";
 import { incrementalSha256 } from "@tot/public-runtime/incremental-sha256";
+import { sanitizeSvg } from "@tot/public-runtime/svg-sanitize";
 
 const MAX_MANIFEST = 1024 * 1024;
 const POOL_ENTRY_RE = /^([0-9a-f]{64})(\.[A-Za-z0-9]+)$/;
@@ -204,19 +205,35 @@ export function awaitR2Quiescence(bucket: R2BucketLike, waiter: QuiescenceWaiter
 
 /**
  * Present with exactly the source's bytes, writing it create-only when absent; refuses a mismatched
- * object. A {@link StreamSource} is streamed into R2 with its sha256, so R2 refuses (writes nothing)
- * on any other body; the existing object and the read-back are hashed as streams, never held whole.
+ * object. Raster streams are put with their sha256; SVG sources are bounded, hashed and checked
+ * against the sanitizer before any existing-object shortcut, then those exact bytes are put.
+ * The existing object and the read-back are hashed as streams.
  */
 export async function ensurePoolObject(bucket: R2BucketLike, key: string, source: Uint8Array | StreamSource, mediaType: string): Promise<void> {
   const address = POOL_ENTRY_RE.exec(key.replace(/^assets\//, ""))?.[1];
   if (!address) throw new R2StagingError("pool-key");
   const size = source instanceof Uint8Array ? source.byteLength : source.size;
+  let verifiedSource = source;
+  if (mediaType === "image/svg+xml") {
+    // SVG bytes must already be sanitizer output, even when the shared pool has this address.
+    const limit = IMAGE_TIERS.standard.maxEncodedBytes;
+    if (!Number.isSafeInteger(size) || size < 1 || size > limit) throw new R2StagingError("unsupported-format");
+    const bytes = source instanceof Uint8Array ? source.slice()
+      : await readBounded({ get: async () => ({ size, body: await source.open() }) }, key, limit);
+    if (!bytes || bytes.byteLength !== size) throw new R2StagingError("original-missing");
+    const hash = incrementalSha256();
+    await hash.update(bytes);
+    if (await hash.hex() !== address) throw new R2StagingError("original-missing");
+    const inspected = sanitizeSvg(bytes, { maxBytes: limit });
+    if (!inspected.ok || inspected.changed) throw new R2StagingError("unsupported-format");
+    verifiedSource = bytes;
+  }
   // Bounded by the size being staged: an object of any other size cannot hold this address.
   const existing = await digestBounded(bucket, key, size);
   if (existing && (existing.sha256 !== address || existing.size !== size)) throw new R2StagingError("store-mismatch");
   if (!existing) {
     if (!bucket.put) throw new R2StagingError("store-unwritable");
-    await bucket.put(key, source instanceof Uint8Array ? source : exactLength(await source.open(), size), {
+    await bucket.put(key, verifiedSource instanceof Uint8Array ? verifiedSource : exactLength(await verifiedSource.open(), size), {
       httpMetadata: { contentType: mediaType, cacheControl: IMMUTABLE },
       onlyIf: new Headers({ "If-None-Match": "*" }),
       sha256: address,
@@ -268,8 +285,8 @@ async function capturedSource(captureBucket: R2BucketLike, tenant: string, entry
  * tenant's own capture store (which registers it); otherwise nothing is staged and the go-live
  * refuses `asset-unauthorized`.
  *
- * Originals are hashed and copied as streams, one at a time, within the image ceiling: none is ever
- * held whole.
+ * Originals are staged one at a time within the image ceiling. Rasters stream; SVGs are held
+ * within the sanitizer's bound for fixed-point validation before staging.
  */
 export async function stageCapturedOriginalsR2(input: {
   tenant: string;
@@ -290,22 +307,26 @@ export async function stageCapturedOriginalsR2(input: {
     if (own) owned.set(entry, own.size);
     else unauthorized.push(entry);
   }
-  if (input.registry && owned.size > 0) {
-    const writes: AssetWrite[] = [...owned].map(([entry, size]) => ({
-      entry, tenant: input.tenant, mediaType: mediaTypeOf(entry), size,
-    }));
-    await input.registry.upsert(writes).catch(() => "lost");
-  }
   if (unauthorized.length > 0) throw new R2StagingError("asset-unauthorized");
   let staged = 0;
   for (const entry of input.entries) {
     const key = `assets/${entry}`;
-    const present = await digestBounded(input.publicBucket, key, IMAGE_LIMITS_CEILING.maxEncodedBytes);
     const address = POOL_ENTRY_RE.exec(entry)?.[1];
-    if (present && address && present.sha256 === address) continue;
-    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry), mediaTypeOf(entry));
+    const mediaType = mediaTypeOf(entry);
+    const present = address ? await verifiedObjectSource(input.publicBucket, key, address, IMAGE_LIMITS_CEILING.maxEncodedBytes) : null;
+    if (present) {
+      if (mediaType === "image/svg+xml") await ensurePoolObject(input.publicBucket, key, present, mediaType);
+      continue;
+    }
+    await ensurePoolObject(input.publicBucket, key, await capturedSource(input.captureBucket, input.tenant, entry), mediaType);
     staged++;
   }
+  if (input.registry && owned.size > 0) {
+    const writes: AssetWrite[] = [...owned].map(([entry, size]) => ({
+      entry, tenant: input.tenant, mediaType: mediaTypeOf(entry), size,
+    }));
+    await input.registry.upsert(writes).catch(() => "lost");
+  }
   return staged;
 }
 
@@ -360,7 +381,7 @@ export async function designateDurableR2(input: {
   if (manifestBytes) {
     const manifest = JSON.parse(new TextDecoder().decode(manifestBytes)) as {
       version?: unknown; revisionId?: unknown;
-      entries?: Array<{ address?: unknown; byteLength?: unknown; mediaType?: unknown; provenance?: { kind?: unknown; locator?: unknown } }>;
+      entries?: Array<{ address?: unknown; byteLength?: unknown; mediaType?: unknown; sanitized?: unknown; provenance?: { kind?: unknown; locator?: unknown } }>;
     };
     if (manifest.version !== 1 || manifest.revisionId !== revision || !Array.isArray(manifest.entries)) {
       throw new R2StagingError("manifest-invalid");
@@ -368,7 +389,7 @@ export async function designateDurableR2(input: {
     for (const entry of manifest.entries) {
       if (typeof entry?.address !== "string" || !/^[0-9a-f]{64}$/.test(entry.address) ||
         typeof entry.byteLength !== "number" || typeof entry.mediaType !== "string" ||
-        !sealedMediaTypeAllowed(entry.provenance?.kind, entry.mediaType) ||
+        !sealedOriginalEntryAllowed(entry.provenance?.kind, entry.mediaType, entry.sanitized) ||
         typeof entry.provenance?.locator !== "string") throw new R2StagingError("manifest-invalid");
       byLocator.set(entry.provenance.locator, { address: entry.address, byteLength: entry.byteLength, mediaType: entry.mediaType });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.1.5",
+  "version": "6.2.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/hosted-image-media-types.ts

@@ -17,8 +17,9 @@
  * - CAPTURABLE_RASTER_MEDIA_TYPES: the raster formats capture reads by their magic
  *   bytes. An SVG is never stored as fetched: capture and upload pass it through the
  *   one sanitizer (`svg-sanitize.ts`) and store only its output, which is what lets a
- *   sealed `remote` or `upload` entry carry `image/svg+xml` (`sealedMediaTypeAllowed`).
+ *   sealed local, remote or upload entry carry `image/svg+xml`.
  */
+import { SVG_SANITIZER_ID } from "@tot/public-runtime/svg-sanitize";
 
 export const PINNED_ASSET_EXTENSION_BY_MEDIA_TYPE: Readonly<Record<string, string>> = Object.freeze({
   "image/png": ".png",
@@ -42,9 +43,7 @@ export const CAPTURABLE_RASTER_MEDIA_TYPES = Object.freeze([
 export type CapturableRasterMediaType = (typeof CAPTURABLE_RASTER_MEDIA_TYPES)[number];
 
 /**
- * An author upload or a remote capture may also be an SVG: both pass it through the sanitizer
- * (`svg-sanitize.ts`) and store only its output, so a sealed `upload` or `remote` entry may carry
- * it. A `local` entry is a repo file capture reads by raster magic, never an SVG.
+ * Capture and author uploads may carry SVG only as the existing sanitizer's output.
  */
 export const UPLOADABLE_MEDIA_TYPES = Object.freeze([...CAPTURABLE_RASTER_MEDIA_TYPES, "image/svg+xml"] as const);
 
@@ -53,8 +52,37 @@ export type UploadableMediaType = (typeof UPLOADABLE_MEDIA_TYPES)[number];
 /** Comma-joined for a remote capture's HTTP `Accept` header -- derived, never a second literal. */
 export const CAPTURE_ACCEPT_HEADER = UPLOADABLE_MEDIA_TYPES.join(",");
 
-/** May a sealed original of provenance `kind` carry `mediaType`? Every reader of a manifest asks this. */
+/** Media-type lookup only; manifest readers must use sealedOriginalEntryAllowed for receipt policy. */
 export function sealedMediaTypeAllowed(kind: unknown, mediaType: unknown): boolean {
-  const types: readonly string[] = kind === "upload" || kind === "remote" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
+  const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
   return typeof mediaType === "string" && types.includes(mediaType);
 }
+
+/** Provenance of the sanitize pass; it does not authorize or verify the stored object's bytes. */
+export interface SvgSanitizeReceipt {
+  sanitizer: string;
+  removedElements: number;
+  removedAttributes: number;
+  source: string;
+}
+
+/** Normalize the supported sanitizer's receipt, discarding untrusted extra fields. */
+export function validSvgSanitizeReceipt(raw: unknown): SvgSanitizeReceipt | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const receipt = raw as Partial<SvgSanitizeReceipt>;
+  if (receipt.sanitizer !== SVG_SANITIZER_ID || typeof receipt.source !== "string" || !/^[0-9a-f]{64}$/.test(receipt.source)) return null;
+  if (!Number.isSafeInteger(receipt.removedElements) || (receipt.removedElements as number) < 0) return null;
+  if (!Number.isSafeInteger(receipt.removedAttributes) || (receipt.removedAttributes as number) < 0) return null;
+  return {
+    sanitizer: receipt.sanitizer, removedElements: receipt.removedElements as number,
+    removedAttributes: receipt.removedAttributes as number, source: receipt.source,
+  };
+}
+
+/** A sealed capture SVG requires its receipt; upload provenance resides in the upload registry. */
+export function sealedOriginalEntryAllowed(kind: unknown, mediaType: unknown, sanitized: unknown): boolean {
+  if (kind !== "local" && kind !== "remote" && kind !== "upload") return false;
+  if (!sealedMediaTypeAllowed(kind, mediaType)) return false;
+  const needsReceipt = kind !== "upload" && mediaType === "image/svg+xml";
+  return needsReceipt ? validSvgSanitizeReceipt(sanitized) !== null : sanitized === undefined;
+}