@tokenoftrust/storefront-runner 2.0.35 → 2.0.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.35",
+  "version": "2.0.36",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/scripts/build/copy-tenant-assets.mjs

@@ -31,11 +31,12 @@
  * reference files that don't exist. The Worker-plane build never sets this, so
  * R2 shadowing semantics are unchanged there.
  */
-import { cp, mkdir, rm } from "node:fs/promises";
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { rm, rename } from "node:fs/promises";
+import { existsSync, readdirSync, statSync, mkdirSync, copyFileSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { listTenantDirIds, tenantDirSegments } from "../lib/tenant-dirs.mjs";
+import { copyTreeSkippingUnreadable, formatSkippedAssets } from "../lib/tenant-asset-copy.mjs";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const src = resolve(repoRoot, "tenants");
@@ -45,7 +46,14 @@ const dest = process.env.TENANT_ASSETS_DEST
 
 if (!existsSync(src)) process.exit(0);
 
-await rm(dest, { recursive: true, force: true });
+// Build into a staging dir and swap it in at the end, rather than wiping `dest` up
+// front. The old order meant any throw mid-copy left the destination EMPTY: every
+// tenant asset 404'd, pages/*.css included, while HTML kept returning 200 because
+// pages render from content/ — an unstyled site with no signal
+// (fb-1789008798249-sc4tgy). Staging means the previous good mirror survives a
+// failure instead of being replaced by nothing.
+const staging = `${dest}.staging-${process.pid}`;
+await rm(staging, { recursive: true, force: true });
 
 const versionedEnv = new Set(
   (process.env.TENANT_ASSETS_VERSIONED ?? "")
@@ -65,8 +73,17 @@ const isVersioned = (id) =>
 // is `/tenants/<id>/…` for every tenant, whichever tier its source sits in.
 const ids = listTenantDirIds(src, readdirSync, (p) => statSync(p).isDirectory(), join);
 
+const copyDeps = {
+  readdir: (dir) => readdirSync(dir, { withFileTypes: true }),
+  mkdir: (dir) => mkdirSync(dir, { recursive: true }),
+  copyFile: (from, to) => copyFileSync(from, to),
+  join,
+};
+
 let copied = 0;
 let skipped = 0;
+/** @type {{path: string, reason: string}[]} */
+const unreadable = [];
 for (const id of ids) {
   const pub = join(tenantDir(id), "public");
   if (!existsSync(pub)) continue;
@@ -75,12 +92,23 @@ for (const id of ids) {
     skipped++;
     continue;
   }
-  await mkdir(join(dest, id), { recursive: true });
-  await cp(pub, join(dest, id), { recursive: true });
+  // Per tenant AND per file: one tenant's unreadable entry must not cost another
+  // tenant its assets, and one missing image must not cost its own tenant the
+  // stylesheet beside it.
+  const result = copyTreeSkippingUnreadable(pub, join(staging, id), copyDeps);
+  for (const s of result.skipped) unreadable.push({ path: `${id}/${s.path}`, reason: s.reason });
   copied++;
 }
 
+// Swap staging in only once the copy is done.
+await rm(dest, { recursive: true, force: true });
+await rename(staging, dest);
+
 const skipNote = skipped ? ` (skipped ${skipped} versioned → R2)` : "";
 console.log(
   `copy-tenant-assets: mirrored ${copied} tenant public/ tree(s) → ${dest}${skipNote}`,
 );
+// Loud, and AFTER the summary so it is the last thing on screen. Exit stays 0: a
+// missing blog image is not a reason to stop the dev loop, but it is a reason the
+// operator must not have to infer from an unstyled page.
+for (const line of formatSkippedAssets(unreadable)) console.warn(line);