@taprootio/site-authoring 0.12.3 → 0.12.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taprootio/site-authoring",
-  "version": "0.12.3",
+  "version": "0.12.4",
   "description": "Taproot site authoring CLI: sign in once in the browser, then pull, validate, push, preview, approve, and deploy a site from the terminal",
   "type": "module",
   "license": "ISC",

package/src/redirects-contract.js

@@ -1,4 +1,5 @@
 import { SiteAuthoringError } from "./errors.js";
+import { RUNTIME_MIRROR_PATH_REASON, isRuntimeMirrorPath } from "./reserved-paths.js";
 
 /**
  * The redirect map's workspace contract (TR00702).
@@ -203,6 +204,7 @@ export function redirectSourceRefusalReason(path) {
   if (first === RESERVED_INTEGRATION_DATA_SEGMENT) {
     return `'/${segments[0]}' is reserved for integration data, so nothing under it can be a redirect source.`;
   }
+  if (isRuntimeMirrorPath(decoded)) return RUNTIME_MIRROR_PATH_REASON;
   if (GENERATED_ROOT_FILES.includes(first)) {
     return `'/${segments[0]}' is a file the site generates, so neither it nor anything under it can be a redirect source.`;
   }

package/src/reference-help.js

@@ -659,7 +659,9 @@ const WORKFLOW_REFERENCES = Object.freeze({
       + "no separate propagation delay; an entry a check does not see belongs to a release that is not being "
       + "served yet.",
       "A source cannot name a file the site generates: '/index.html' or any page's own 'index.html', '/404.html', "
-      + "'/sitemap.xml', '/robots.txt', '/favicon.ico', or a path under the sitemap or robots names. The platform "
+      + "'/sitemap.xml', '/robots.txt', '/favicon.ico', or a path under the sitemap or robots names. Nothing under "
+      + "'/taproot/<version>/' (for example '/taproot/5.0.62/manifest.json') can be a source either: the platform "
+      + "serves the published-site runtime there before any redirect. The platform "
       + "already redirects every '…/index.html' address to its directory, so no entry is needed for one. A source "
       + "that could not be stored as a file (a dot-prefixed segment, a reserved device name, an escaped percent "
       + "sign) is refused too. 'validate' names the entry and the reason.",

package/src/reserved-paths.js

@@ -0,0 +1,22 @@
+/**
+ * Site paths the platform reserves on every site host.
+ *
+ * The published-site Worker ships the immutable runtime as static assets at
+ * `/taproot/<semver>/...` (TR01144), and Cloudflare answers a matching request
+ * before the Worker runs, so a page or redirect authored there could never be
+ * reached. This is the one place the package owns that prefix; page push and
+ * the redirect map both ask here. The API is the authority and mirrors the rule
+ * in `PublishedOutputPaths.IsRuntimeMirrorPath`; both are pinned by the same
+ * test vectors.
+ */
+const RUNTIME_MIRROR_PATH =
+  /^taproot\/[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\/|$)/iu;
+
+/** Whether a site-relative path (no leading slash) is `taproot/<semver>` or under it. */
+export function isRuntimeMirrorPath(path) {
+  return RUNTIME_MIRROR_PATH.test(path);
+}
+
+export const RUNTIME_MIRROR_PATH_REASON =
+  "'/taproot/<version>/' is reserved for the published-site runtime, which the platform answers before any page "
+  + "or redirect, so nothing under it can be authored.";

package/src/verbs/pages-push.js

@@ -1,6 +1,7 @@
 import { createPage, listSitePages, PAGE_STATUS_DELETED, updatePage, withRefusalGuidance } from "../api.js";
 import { VERB_PAGES_PUSH } from "../constants.js";
 import { SiteAuthoringError } from "../errors.js";
+import { RUNTIME_MIRROR_PATH_REASON, isRuntimeMirrorPath } from "../reserved-paths.js";
 import { boundedList, openSession, successResult, warnIfExternalWritesPaused } from "../session.js";
 import { SETTINGS_TYPE_TAPROOT_STYLES } from "../settings-catalog.js";
 import {
@@ -484,6 +485,14 @@ export async function readWorkspacePageSource({ workspaceDir, file, manifestEntr
     );
   }
 
+  if (isRuntimeMirrorPath(pagePath)) {
+    throw documentError(
+      "pages.path_unsupported",
+      `'${file}' declares page path '${pagePath}': ${RUNTIME_MIRROR_PATH_REASON}`,
+      file,
+    );
+  }
+
   return {
     file,
     pagePath,