@tokenoftrust/storefront-runner 6.2.0 → 6.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tokenoftrust/storefront-runner",
|
|
3
|
-
"version": "6.2.
|
|
3
|
+
"version": "6.2.1",
|
|
4
4
|
"license": "SEE LICENSE IN LICENSE",
|
|
5
5
|
"description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
|
|
6
6
|
"packageManager": "pnpm@11.9.0",
|
|
@@ -39,7 +39,7 @@ export type CaptureRewrite = {
|
|
|
39
39
|
/** A sealed capture-manifest entry, as `original-image-capture.ts` writes it. */
|
|
40
40
|
export interface CapturedManifestEntry {
|
|
41
41
|
/** Remote `locator` is query-stripped for display; remote entries are matched by `locatorDigest`. */
|
|
42
|
-
provenance: { kind: "local" | "remote" | "upload"; locator: string };
|
|
42
|
+
provenance: { kind: "local" | "remote" | "upload" | "owned-cdn"; locator: string };
|
|
43
43
|
address: string;
|
|
44
44
|
mediaType: string;
|
|
45
45
|
/** Remote entries: digest of the exact fetched locator, query included (`captureLocatorDigest`). */
|
|
@@ -54,7 +54,7 @@ export const CAPTURE_ACCEPT_HEADER = UPLOADABLE_MEDIA_TYPES.join(",");
|
|
|
54
54
|
|
|
55
55
|
/** Media-type lookup only; manifest readers must use sealedOriginalEntryAllowed for receipt policy. */
|
|
56
56
|
export function sealedMediaTypeAllowed(kind: unknown, mediaType: unknown): boolean {
|
|
57
|
-
const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
|
|
57
|
+
const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" || kind === "owned-cdn" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
|
|
58
58
|
return typeof mediaType === "string" && types.includes(mediaType);
|
|
59
59
|
}
|
|
60
60
|
|
|
@@ -81,7 +81,7 @@ export function validSvgSanitizeReceipt(raw: unknown): SvgSanitizeReceipt | null
|
|
|
81
81
|
|
|
82
82
|
/** A sealed capture SVG requires its receipt; upload provenance resides in the upload registry. */
|
|
83
83
|
export function sealedOriginalEntryAllowed(kind: unknown, mediaType: unknown, sanitized: unknown): boolean {
|
|
84
|
-
if (kind !== "local" && kind !== "remote" && kind !== "upload") return false;
|
|
84
|
+
if (kind !== "local" && kind !== "remote" && kind !== "upload" && kind !== "owned-cdn") return false;
|
|
85
85
|
if (!sealedMediaTypeAllowed(kind, mediaType)) return false;
|
|
86
86
|
const needsReceipt = kind !== "upload" && mediaType === "image/svg+xml";
|
|
87
87
|
return needsReceipt ? validSvgSanitizeReceipt(sanitized) !== null : sanitized === undefined;
|