@tokenoftrust/storefront-runner 2.0.15 → 2.0.16

package/apps/storefront/src/lib/blog/collection.ts

@@ -156,6 +156,9 @@ function toSummary(p: BlogPost): BlogPostSummary {
     tags: p.tags,
     status: p.status,
     ...(p.scheduledAt ? { scheduledAt: p.scheduledAt } : {}),
+    // Carried, not dropped: a listing renders the entitlement badge off this,
+    // so omitting it makes a members-only post read as public in every listing.
+    ...(p.access ? { access: p.access } : {}),
     ...(p.featuredImage ? { featuredImage: p.featuredImage } : {}),
     ...(p.canonicalUrl ? { canonicalUrl: p.canonicalUrl } : {}),
     ...(p.inLanguage ? { inLanguage: p.inLanguage } : {}),

package/apps/storefront/src/lib/blog/provider.ts

@@ -1,12 +1,17 @@
 // The live WordPress `/blog` deliberately keeps reading its committed, curated
 // index.json (its order is hand-maintained and SEO-load-bearing). The generic
 // derived engine lives in ./collection.ts and powers `the-build` + any new
-// collection; switching `/blog` onto it is a later migration once order is
+// collection, and backs `/blog` whenever that curated index is unusable;
+// switching `/blog` onto it outright is a later migration once order is
 // encoded as data (see B0.1 §"/blog migration caution").
 import { tenantDirSegment } from "@tot/public-runtime";
+import { listPosts } from "./collection.js";
 import type { BlogPost, BlogPostSummary } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
 
+/** The collection id `/blog` reads — the derived fallback's second argument. */
+const BLOG_COLLECTION = "blog";
+
 type ArtifactSource = Pick<ContentProvider, "readArtifact" | "listArtifactPaths">;
 
 function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactSource {
@@ -43,25 +48,54 @@ function tenantKey(keys: string[], tenantId: string, suffix: string): string | u
   return keys.find((key) => key.includes(segment) && key.endsWith(suffix));
 }
 
-export async function listBlogPosts(
+/** A curated index is usable only if it parses AND is the array shape it claims. */
+function parseCuratedIndex(raw: string): BlogPostSummary[] | null {
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    return Array.isArray(parsed) ? (parsed as BlogPostSummary[]) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The curated `index.json` for this tenant, or null when it is absent, malformed,
+ * or not an array. Null is "cannot use the curated order", never "no posts".
+ */
+async function readCuratedIndex(
   tenantId: string,
   source?: ArtifactSource,
-): Promise<BlogPostSummary[]> {
+): Promise<BlogPostSummary[] | null> {
   if (canReadArtifacts(source)) {
-    const paths = await source.listArtifactPaths("blog/");
     const raw = await source.readArtifact("blog/index.json");
-    if (raw) {
-      try {
-        return JSON.parse(raw) as BlogPostSummary[];
-      } catch {
-        return [];
-      }
-    }
-    if (paths !== null) return [];
+    if (raw) return parseCuratedIndex(raw);
   }
   const key = tenantKey(Object.keys(indexGlobs), tenantId, "/index.json")
     ?? Object.keys(indexGlobs).find((candidate) => candidate.includes(`${tenantDirSegment(tenantId)}content/blog/index.json`));
-  return key ? indexGlobs[key]!() : [];
+  return key ? (await indexGlobs[key]!()) ?? null : null;
+}
+
+/**
+ * The curated index stays the preferred source — its order is hand-maintained
+ * and SEO-load-bearing — but it must never be the blog's single point of
+ * failure. One malformed byte in `content/blog/index.json` makes the reconcile's
+ * JSON validator advisory-skip it, and the whole surface (index, taxonomy pages,
+ * RSS, sitemap entries) then reads as an empty collection and hard-404s while
+ * every `posts/*.json` sits materialized beside it.
+ *
+ * So an unusable curated index falls back to the derived index over
+ * `blog/posts/*.json` (./collection.ts): newest-first rather than curated order,
+ * and every article still reachable and listed. Whether the curated index is
+ * authoritative or derived, the runtime/build-time source selection is identical
+ * — `listPosts` applies the same "artifact paths, else build-time globs" rule.
+ */
+export async function listBlogPosts(
+  tenantId: string,
+  source?: ArtifactSource,
+): Promise<BlogPostSummary[]> {
+  const curated = await readCuratedIndex(tenantId, source);
+  if (curated && curated.length > 0) return curated;
+  return listPosts(tenantId, BLOG_COLLECTION, { content: source });
 }
 
 export async function getBlogPost(

package/apps/storefront/src/pages/blog/index.astro

@@ -5,7 +5,16 @@ import { listBlogPosts } from "@/lib/blog/provider.js";
 
 const { tenant, basePath, canonicalBase, content } = Astro.locals;
 const posts = await listBlogPosts(tenant.tenant_id, content);
-if (posts.length === 0) return new Response(null, { status: 404 });
+// A tenant with no blog content has no blog index, so this is still a 404 — but
+// it is a DIFFERENT 404 from "no such route", and telling them apart from the
+// outside used to be impossible (both were bare and byte-identical). The header
+// says which one this is; a nonexistent route never carries it.
+if (posts.length === 0) {
+  return new Response(null, {
+    status: 404,
+    headers: { "x-tot-blog-collection": "empty" },
+  });
+}
 
 const href = (path: string) => `${basePath}${path}` || "/";
 const tags = [...new Set(posts.flatMap((post) => post.tags))].sort((a, b) => a.localeCompare(b));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.15",
+  "version": "2.0.16",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",