@tokenoftrust/storefront-runner 6.2.1 → 6.3.1

package/apps/storefront/src/lib/content/shared/placeholder.ts

@@ -5,7 +5,7 @@
  * than a grey box, we synthesize a tasteful, aspect-correct SVG keyed by a
  * stable seed (image id or product handle) so each product gets a consistent,
  * on-brand gradient + monogram. The <Img> component swaps these out for real
- * rehosted URLs when CatalogImage.rehosted === true.
+ * rehosted URLs or content-addressed pool URLs.
  *
  * Palette is pulled from the theme's CSS vars at render time where possible, but
  * the SVG is self-contained (inlines colors) so it works as a data URI / <img src>.
@@ -91,6 +91,9 @@ export function placeholderDataUri(opts: PlaceholderOpts): string {
 export function isUsableImageUrl(url: string | undefined, rehosted?: boolean): boolean {
   if (!url) return false;
   if (rehosted) return true;
+  // Capture replaces image locators without changing catalog metadata. Pool
+  // originals render directly on both CDNs, including images with rehosted:false.
+  if (/^\/_a\/[0-9a-f]{64}(?:\.(?:avif|gif|jpe?g|png|svg|webp))?$/.test(url)) return true;
   // The synthetic apparel fixtures use a fake shop id (…/s/files/1/0001/…) whose
   // URLs 404 — draw placeholders for those. REAL store CDN URLs (e.g. a live POC
   // migration) are usable as-is.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.2.1",
+  "version": "6.3.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/cli/src/declared-config.mjs

@@ -19,7 +19,7 @@
 
 export const TOT_CONFIG_KEYS = [
   "$schema", "tenant", "scope", "mappings", "hostPlatform", "sample", "seed",
-  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping",
+  "displayName", "siteType", "compliance", "capabilities", "features", "embeds", "seo", "currency", "timezone", "shipping", "catalog",
 ];
 // Keys other tooling has written that the platform does NOT read, with the key it does.
 const RENAMED_CONFIG_KEYS = { appDomain: "scope", tenantId: "tenant" };
@@ -232,6 +232,37 @@ export function seoDeclarationProblems(seo) {
   return problems;
 }
 
+/** Every `catalog` key a tenant may declare. `serving` stays a platform field. */
+export const CATALOG_KEYS = Object.freeze(["cdnSegment"]);
+
+/** One DNS label. Anything else is not a catalog object-key segment. */
+const CATALOG_SEGMENT = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * What is wrong with a declared `catalog` value, one sentence per problem; `[]` when it is valid.
+ * A tenant cannot set `catalog.serving` here: that field belongs to the platform record.
+ * @param {unknown} catalog
+ * @returns {string[]}
+ */
+export function catalogDeclarationProblems(catalog) {
+  if (!isObject(catalog)) return ["`catalog` must be an object"];
+  const source = /** @type {Record<string, unknown>} */ (catalog);
+  const problems = [];
+  for (const key of Object.keys(source)) {
+    if (!CATALOG_KEYS.includes(key)) problems.push(`\`catalog.${key}\` is not a catalog key (${CATALOG_KEYS.join(", ")})`);
+  }
+  if (source.cdnSegment !== undefined && (typeof source.cdnSegment !== "string" || !CATALOG_SEGMENT.test(source.cdnSegment))) {
+    problems.push("`catalog.cdnSegment` must be one lowercase DNS label");
+  }
+  return problems;
+}
+
+/** The owner-facing sentence for an invalid `catalog` declaration. */
+function catalogProblemMessage(problems) {
+  return `\`catalog\` is not a valid catalog declaration (${problems.join("; ")}). ` +
+    "Owned catalog images stay refused until it is fixed.";
+}
+
 /** Every `shipping` key (mirrors packages/public-runtime/src/declared-tenant-config.mjs). */
 export const SHIPPING_KEYS = Object.freeze(["tiers"]);
 
@@ -690,6 +721,8 @@ export function declarationFindings(current, previous) {
     }
     const shipping = current.shipping === undefined ? [] : shippingDeclarationProblems(current.shipping);
     if (shipping.length > 0) out.push(`CONFIG: ${shippingProblemMessage(shipping)}`);
+    const catalog = current.catalog === undefined ? [] : catalogDeclarationProblems(current.catalog);
+    if (catalog.length > 0) out.push(`CONFIG: ${catalogProblemMessage(catalog)}`);
   }
   for (const { key, notice } of droppedMandatedNotices(previous, current)) {
     out.push(
@@ -790,6 +823,13 @@ export function validateDeclaredConfig(config, file = ".tot/config.json") {
         'declare e.g. `"shipping": { "tiers": [ { "rate": 5.99 }, { "atOrAbove": 100, "rate": 0, "label": "Free shipping" } ] }`, or remove `shipping` to charge none'));
     }
   }
+  if (config.catalog !== undefined) {
+    const problems = catalogDeclarationProblems(config.catalog);
+    if (problems.length > 0) {
+      out.push(mk(ERROR, "config-catalog", `${file} catalog`, catalogProblemMessage(problems),
+        'declare `"catalog": { "cdnSegment": "shop" }` as one lowercase DNS label, or remove `catalog`'));
+    }
+  }
   return out;
 }
 

package/packages/public-runtime/src/declared-tenant-config.mjs

@@ -29,6 +29,7 @@ export const DECLARED_TENANT_CONFIG_FIELDS = Object.freeze([
   "currency",
   "timezone",
   "shipping",
+  "catalog",
 ]);
 
 /**
@@ -279,6 +280,32 @@ export function seoDeclarationProblems(seo) {
   return problems;
 }
 
+/** Every `catalog` key a tenant may declare. `serving` stays a platform field. */
+export const CATALOG_KEYS = Object.freeze(["cdnSegment"]);
+
+/** One DNS label. Anything else is not a catalog object-key segment. */
+const CATALOG_SEGMENT = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * What is wrong with a declared `catalog` value, one sentence per problem; `[]` when it is valid.
+ * A tenant cannot set `catalog.serving` here: that field belongs to the platform record.
+ *
+ * @param {unknown} catalog
+ * @returns {string[]}
+ */
+export function catalogDeclarationProblems(catalog) {
+  if (!isPlainObject(catalog)) return ["`catalog` must be an object"];
+  const source = /** @type {Record<string, unknown>} */ (catalog);
+  const problems = [];
+  for (const key of Object.keys(source)) {
+    if (!CATALOG_KEYS.includes(key)) problems.push(`\`catalog.${key}\` is not a catalog key (${CATALOG_KEYS.join(", ")})`);
+  }
+  if (source.cdnSegment !== undefined && (typeof source.cdnSegment !== "string" || !CATALOG_SEGMENT.test(source.cdnSegment))) {
+    problems.push("`catalog.cdnSegment` must be one lowercase DNS label");
+  }
+  return problems;
+}
+
 /** Every `shipping` key (ShippingPolicy, tenant.ts). */
 export const SHIPPING_KEYS = Object.freeze(["tiers"]);
 
@@ -380,7 +407,7 @@ export function declaredTenantConfig(config) {
   /** @type {Record<string, unknown>} */
   const out = {};
   if (!isPlainObject(config)) return out;
-  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, timezone, shipping } = /** @type {Record<string, unknown>} */ (config);
+  const { displayName, siteType, compliance, capabilities, features, embeds, seo, currency, timezone, shipping, catalog } = /** @type {Record<string, unknown>} */ (config);
   // The store's name as visitors read it: the `<title>` suffix, og:site_name,
   // Organization JSON-LD, breadcrumbs, the default blog heading, the copyright line.
   if (typeof displayName === "string" && displayName.trim()) out.displayName = displayName.trim();
@@ -400,6 +427,11 @@ export function declaredTenantConfig(config) {
   if (shipping !== undefined && shippingDeclarationProblems(shipping).length === 0) {
     out.shipping = shippingPolicyOf(/** @type {{ tiers: Array<Record<string, unknown>> }} */ (shipping));
   }
+  // Only the declared segment. `catalog.serving` is the platform's and is refused by the validator.
+  if (catalog !== undefined && catalogDeclarationProblems(catalog).length === 0
+      && isPlainObject(catalog) && typeof catalog.cdnSegment === "string") {
+    out.catalog = { cdnSegment: catalog.cdnSegment };
+  }
   return out;
 }
 

package/packages/public-runtime/src/tenant.ts

@@ -713,6 +713,11 @@ export interface TenantConfig {
    */
   catalog?: {
     serving?: "files" | "d1";
+    /**
+     * Object-key segment for this tenant's catalog images on the owned CDN
+     * (`catalog/<cdnSegment>/<file>`). Set only by the tenant's declaration.
+     */
+    cdnSegment?: string;
   };
   /**
    * Availability (hot) provider (ADR 0033). Availability is never read from catalog