@tokenoftrust/storefront-runner 6.2.0 → 6.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -19,7 +19,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping",
+  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping", "catalog",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -232,6 +232,37 @@ export function seoDeclarationProblems(seo) {
   return problems;
 }
 
+/** Every `catalog` key a tenant may declare. `serving` stays a platform field. */
+export const CATALOG_KEYS = Object.freeze(["cdnSegment"]);
+
+/** One DNS label. Anything else is not a catalog object-key segment. */
+const CATALOG_SEGMENT = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * What is wrong with a declared `catalog` value, one sentence per problem; `[]` when it is valid.
+ * A tenant cannot set `catalog.serving` here: that field belongs to the platform record.
+ * @param {unknown} catalog
+ * @returns {string[]}
+ */
+export function catalogDeclarationProblems(catalog) {
+  if (!isObject(catalog)) return ["`catalog` must be an object"];
+  const source = /** @type {Record<string, unknown>} */ (catalog);
+  const problems = [];
+  for (const key of Object.keys(source)) {
+    if (!CATALOG_KEYS.includes(key)) problems.push(`\`catalog.${key}\` is not a catalog key (${CATALOG_KEYS.join(", ")})`);
+  }
+  if (source.cdnSegment !== undefined && (typeof source.cdnSegment !== "string" || !CATALOG_SEGMENT.test(source.cdnSegment))) {
+    problems.push("`catalog.cdnSegment` must be one lowercase DNS label");
+  }
+  return problems;
+}
+
+/** The owner-facing sentence for an invalid `catalog` declaration. */
+function catalogProblemMessage(problems) {
+  return `\`catalog\` is not a valid catalog declaration (${problems.join("; ")}). ` +
+    "Owned catalog images stay refused until it is fixed.";
+}
+
 /** Every `shipping` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
 export const SHIPPING_KEYS = Object.freeze(["tiers"]);
 
@@ -690,6 +721,8 @@ export function declarationFindings(current, previous) {
     }
     const shipping = current.shipping === undefined ? [] : shippingDeclarationProblems(current.shipping);
     if (shipping.length > 0) out.push(`CONFIG: ${shippingProblemMessage(shipping)}`);
+    const catalog = current.catalog === undefined ? [] : catalogDeclarationProblems(current.catalog);
+    if (catalog.length > 0) out.push(`CONFIG: ${catalogProblemMessage(catalog)}`);
   }
   for (const { key, notice } of droppedMandatedNotices(previous, current)) {
     out.push(
@@ -790,6 +823,13 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
         'declare e.g. `"shipping": { "tiers": [ { "rate": 5.99 }, { "atOrAbove": 100, "rate": 0, "label": "Free shipping" } ] }`, or remove `shipping` to charge none'));
     }
   }
+  if (config.catalog !== undefined) {
+    const problems = catalogDeclarationProblems(config.catalog);
+    if (problems.length > 0) {
+      out.push(mk(ERROR, "config-catalog", `${file} catalog`, catalogProblemMessage(problems),
+        'declare `"catalog": { "cdnSegment": "shop" }` as one lowercase DNS label, or remove `catalog`'));
+    }
+  }
   return out;
 }
 

package/packages/public-runtime/src/capture-rewrites.ts

@@ -39,7 +39,7 @@ export type CaptureRewrite = {
 /** A sealed capture-manifest entry, as `original-image-capture.ts` writes it. */
 export interface CapturedManifestEntry {
   /** Remote `locator` is query-stripped for display; remote entries are matched by `locatorDigest`. */
-  provenance: { kind: "local" | "remote" | "upload"; locator: string };
+  provenance: { kind: "local" | "remote" | "upload" | "owned-cdn"; locator: string };
   address: string;
   mediaType: string;
   /** Remote entries: digest of the exact fetched locator, query included (`captureLocatorDigest`). */

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -29,6 +29,7 @@ export const DECLARED_TENANT_CONFIG_FIELDS = Object.freeze([
   "currency",
   "timezone",
   "shipping",
+  "catalog",
 ]);
 
 /**
@@ -279,6 +280,32 @@ export function seoDeclarationProblems(seo) {
   return problems;
 }
 
+/** Every `catalog` key a tenant may declare. `serving` stays a platform field. */
+export const CATALOG_KEYS = Object.freeze(["cdnSegment"]);
+
+/** One DNS label. Anything else is not a catalog object-key segment. */
+const CATALOG_SEGMENT = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * What is wrong with a declared `catalog` value, one sentence per problem; `[]` when it is valid.
+ * A tenant cannot set `catalog.serving` here: that field belongs to the platform record.
+ *
+ * @param {unknown} catalog
+ * @returns {string[]}
+ */
+export function catalogDeclarationProblems(catalog) {
+  if (!isPlainObject(catalog)) return ["`catalog` must be an object"];
+  const source = /** @type {Record<string, unknown>} */ (catalog);
+  const problems = [];
+  for (const key of Object.keys(source)) {
+    if (!CATALOG_KEYS.includes(key)) problems.push(`\`catalog.${key}\` is not a catalog key (${CATALOG_KEYS.join(", ")})`);
+  }
+  if (source.cdnSegment !== undefined && (typeof source.cdnSegment !== "string" || !CATALOG_SEGMENT.test(source.cdnSegment))) {
+    problems.push("`catalog.cdnSegment` must be one lowercase DNS label");
+  }
+  return problems;
+}
+
 /** Every `shipping` key (ShippingPolicy, tenant.ts). */
 export const SHIPPING_KEYS = Object.freeze(["tiers"]);
 
@@ -380,7 +407,7 @@ export function declaredTenantConfig(config) {
   /** @type {Record<string, unknown>} */
   const out = {};
   if (!isPlainObject(config)) return out;
-  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, timezone, shipping } = /** @type {Record<string, unknown>} */ (config);
+  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, timezone, shipping, catalog } = /** @type {Record<string, unknown>} */ (config);
   // The store's name as visitors read it: the `<title>` suffix, og:site_name,
   // Organization JSON-LD, breadcrumbs, the default blog heading, the copyright line.
   if (typeof displayName === "string" && displayName.trim()) out.displayName = displayName.trim();
@@ -400,6 +427,11 @@ export function declaredTenantConfig(config) {
   if (shipping !== undefined && shippingDeclarationProblems(shipping).length === 0) {
     out.shipping = shippingPolicyOf(/** @type {{ tiers: Array<Record<string, unknown>> }} */ (shipping));
   }
+  // Only the declared segment. `catalog.serving` is the platform's and is refused by the validator.
+  if (catalog !== undefined && catalogDeclarationProblems(catalog).length === 0
+      && isPlainObject(catalog) && typeof catalog.cdnSegment === "string") {
+    out.catalog = { cdnSegment: catalog.cdnSegment };
+  }
   return out;
 }
 

package/packages/public-runtime/src/hosted-image-media-types.ts

@@ -54,7 +54,7 @@ export const CAPTURE_ACCEPT_HEADER = UPLOADABLE_MEDIA_TYPES.join(",");
 
 /** Media-type lookup only; manifest readers must use sealedOriginalEntryAllowed for receipt policy. */
 export function sealedMediaTypeAllowed(kind: unknown, mediaType: unknown): boolean {
-  const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
+  const types: readonly string[] = kind === "upload" || kind === "remote" || kind === "local" || kind === "owned-cdn" ? UPLOADABLE_MEDIA_TYPES : CAPTURABLE_RASTER_MEDIA_TYPES;
   return typeof mediaType === "string" && types.includes(mediaType);
 }
 
@@ -81,7 +81,7 @@ export function validSvgSanitizeReceipt(raw: unknown): SvgSanitizeReceipt | null
 
 /** A sealed capture SVG requires its receipt; upload provenance resides in the upload registry. */
 export function sealedOriginalEntryAllowed(kind: unknown, mediaType: unknown, sanitized: unknown): boolean {
-  if (kind !== "local" && kind !== "remote" && kind !== "upload") return false;
+  if (kind !== "local" && kind !== "remote" && kind !== "upload" && kind !== "owned-cdn") return false;
   if (!sealedMediaTypeAllowed(kind, mediaType)) return false;
   const needsReceipt = kind !== "upload" && mediaType === "image/svg+xml";
   return needsReceipt ? validSvgSanitizeReceipt(sanitized) !== null : sanitized === undefined;

package/packages/public-runtime/src/tenant.ts

@@ -713,6 +713,11 @@ export interface TenantConfig {
    */
   catalog?: {
     serving?: "files" | "d1";
+    /**
+     * Object-key segment for this tenant's catalog images on the owned CDN
+     * (`catalog/<cdnSegment>/<file>`). Set only by the tenant's declaration.
+     */
+    cdnSegment?: string;
   };
   /**
    * Availability (hot) provider (ADR 0033). Availability is never read from catalog