@tokenoftrust/cli 2.2.4 → 2.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.4",
+  "version": "2.2.5",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/validate.mjs

@@ -653,6 +653,24 @@ export const TRACKING_ID_STEP_NAME = "assign stable tracking ids";
 export const CTA_MISSING_ID_FIX =
   "assign stable tracking ids: GET/POST /api/admin/tracking-writeback proposes a data-tot-el for every element that's missing one, as a reviewable candidate PR (GET first for a dry-run preview) — or run `tot validate` to see the full list before you submit.";
 
+// `public/**` is git-tracked and wholesale-ingested into R2 on every publish
+// with no content-hash dedup (ingestAssetVersion re-copies every file under a
+// new version key, changed or not) — see docs/versioned-assets-contract.md.
+// A large binary there works, but it compounds: every future publish re-pays
+// its storage cost, and the tenant's Gitea repo keeps that blob permanently.
+// WARN only — never blocks a submit. Idea tracked for a built-in fix (auto
+// relocation to a deduped, content-addressed store): fb-1790956035713-snpovm.
+export const LARGE_PUBLIC_ASSET_BYTES = 100 * 1024;
+export const LARGE_PUBLIC_ASSET_IDEA_ID = "fb-1790956035713-snpovm";
+export const LARGE_PUBLIC_ASSET_FIX =
+  `storing it under public/ will work, but every publish re-copies it into R2 and ` +
+  `your Gitea repo keeps it forever — on a tenant with many of these, expect ` +
+  `slower publishes and slower clones over time. Today, host it on a shared drive ` +
+  `you control and tell us the URL so we can pull it in and serve it from R2 directly, ` +
+  `rather than committing it to the tenant repo. We're tracking a built-in fix ` +
+  `(automatic relocation to deduped storage, idea ${LARGE_PUBLIC_ASSET_IDEA_ID}) — ` +
+  `vote for it if you'd like this handled for you sooner.`;
+
 /**
  * The advisory rules LOUD enough to call out by NAME at `tot validate` / `tot
  * submit` / `tot preview` — none of them block, but each ships a page that
@@ -682,6 +700,11 @@ export const LOUD_ADVISORY_RULES = [
     `actionable element with no governed identity (data-tot-el) — needs to ${TRACKING_ID_STEP_NAME}`,
     `It renders and works fine, but it's invisible to interaction tracking — nothing about it is ever recorded. ${CTA_MISSING_ID_FIX}`,
   ],
+  [
+    "large-public-asset",
+    `a public/ asset is ${(LARGE_PUBLIC_ASSET_BYTES / 1024).toFixed(0)}KB or larger`,
+    LARGE_PUBLIC_ASSET_FIX,
+  ],
   [
     "cta-id-drift",
     "a previously-declared data-tot-el changed value",
@@ -1208,6 +1231,9 @@ export function validateTenant(tenantDir, opts = {}) {
     }
   }
 
+  // large public assets — advisory (never blocks); see LARGE_PUBLIC_ASSET_FIX.
+  findings.push(...findLargePublicAssets(publicDir, rel));
+
   const ok = !findings.some((f) => f.level === ERROR);
   return { ok, findings };
 }
@@ -1276,4 +1302,20 @@ function checkAsset(src, file, publicDir, tenantId) {
   return null;
 }
 
+/**
+ * Every file under `public/**` at or above `LARGE_PUBLIC_ASSET_BYTES`. WARN only —
+ * the file works fine, this is a cost/perf nudge toward the hosted-upload path
+ * (see LARGE_PUBLIC_ASSET_FIX for why: no R2 dedup, permanent Gitea growth).
+ */
+function findLargePublicAssets(publicDir, rel) {
+  const out = [];
+  for (const p of walk(publicDir, () => true)) {
+    const size = statSync(p).size;
+    if (size >= LARGE_PUBLIC_ASSET_BYTES) {
+      out.push(mk(WARN, "large-public-asset", rel(p), `${(size / 1024).toFixed(0)}KB`));
+    }
+  }
+  return out;
+}
+
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");