@tokenoftrust/storefront-runner 2.0.35 → 2.0.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.35",
+  "version": "2.0.37",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/scripts/build/copy-tenant-assets.mjs

@@ -31,11 +31,12 @@
  * reference files that don't exist. The Worker-plane build never sets this, so
  * R2 shadowing semantics are unchanged there.
  */
-import { cp, mkdir, rm } from "node:fs/promises";
-import { existsSync, readdirSync, statSync } from "node:fs";
+import { rm, rename } from "node:fs/promises";
+import { existsSync, readdirSync, statSync, mkdirSync, copyFileSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { listTenantDirIds, tenantDirSegments } from "../lib/tenant-dirs.mjs";
+import { copyTreeSkippingUnreadable, formatSkippedAssets } from "../lib/tenant-asset-copy.mjs";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const src = resolve(repoRoot, "tenants");
@@ -45,7 +46,14 @@ const dest = process.env.TENANT_ASSETS_DEST
 
 if (!existsSync(src)) process.exit(0);
 
-await rm(dest, { recursive: true, force: true });
+// Build into a staging dir and swap it in at the end, rather than wiping `dest` up
+// front. The old order meant any throw mid-copy left the destination EMPTY: every
+// tenant asset 404'd, pages/*.css included, while HTML kept returning 200 because
+// pages render from content/ — an unstyled site with no signal
+// (fb-1789008798249-sc4tgy). Staging means the previous good mirror survives a
+// failure instead of being replaced by nothing.
+const staging = `${dest}.staging-${process.pid}`;
+await rm(staging, { recursive: true, force: true });
 
 const versionedEnv = new Set(
   (process.env.TENANT_ASSETS_VERSIONED ?? "")
@@ -65,8 +73,17 @@ const isVersioned = (id) =>
 // is `/tenants/<id>/…` for every tenant, whichever tier its source sits in.
 const ids = listTenantDirIds(src, readdirSync, (p) => statSync(p).isDirectory(), join);
 
+const copyDeps = {
+  readdir: (dir) => readdirSync(dir, { withFileTypes: true }),
+  mkdir: (dir) => mkdirSync(dir, { recursive: true }),
+  copyFile: (from, to) => copyFileSync(from, to),
+  join,
+};
+
 let copied = 0;
 let skipped = 0;
+/** @type {{path: string, reason: string}[]} */
+const unreadable = [];
 for (const id of ids) {
   const pub = join(tenantDir(id), "public");
   if (!existsSync(pub)) continue;
@@ -75,12 +92,23 @@ for (const id of ids) {
     skipped++;
     continue;
   }
-  await mkdir(join(dest, id), { recursive: true });
-  await cp(pub, join(dest, id), { recursive: true });
+  // Per tenant AND per file: one tenant's unreadable entry must not cost another
+  // tenant its assets, and one missing image must not cost its own tenant the
+  // stylesheet beside it.
+  const result = copyTreeSkippingUnreadable(pub, join(staging, id), copyDeps);
+  for (const s of result.skipped) unreadable.push({ path: `${id}/${s.path}`, reason: s.reason });
   copied++;
 }
 
+// Swap staging in only once the copy is done.
+await rm(dest, { recursive: true, force: true });
+await rename(staging, dest);
+
 const skipNote = skipped ? ` (skipped ${skipped} versioned → R2)` : "";
 console.log(
   `copy-tenant-assets: mirrored ${copied} tenant public/ tree(s) → ${dest}${skipNote}`,
 );
+// Loud, and AFTER the summary so it is the last thing on screen. Exit stays 0: a
+// missing blog image is not a reason to stop the dev loop, but it is a reason the
+// operator must not have to infer from an unstyled page.
+for (const line of formatSkippedAssets(unreadable)) console.warn(line);

package/scripts/lib/tenant-asset-copy.mjs

@@ -0,0 +1,105 @@
+/**
+ * Tenant public/ mirroring that cannot lose the whole tree to one bad file.
+ *
+ * The failure this exists to prevent (fb-1789008798249-sc4tgy): copy-tenant-assets
+ * wiped its destination and then ran a single recursive `cp`. One unreadable entry —
+ * a blog image referenced in the tree but missing on disk, a dangling symlink — threw
+ * mid-copy, so the destination was left EMPTY. Every tenant asset then 404'd,
+ * `pages/*.css` included, while HTML routes still returned 200 because pages render
+ * from content/ rather than public/. The result is a silently unstyled site with no
+ * signal beyond one advisory line, which is close to the worst shape a dev-loop bug
+ * can take: it looks like a CSS problem in the tenant's own content.
+ *
+ * So: walk the tree entry by entry, skip what cannot be read, and report it. A
+ * missing image costs that image, never the stylesheet next to it.
+ *
+ * Injected fs so the walk is testable without a real tree.
+ */
+
+/**
+ * @typedef {object} CopyTreeDeps
+ * @property {(dir: string) => {name: string, isDirectory: () => boolean, isFile: () => boolean,
+ *   isSymbolicLink: () => boolean}[]} readdir  entries with types
+ * @property {(dir: string) => void} mkdir      recursive
+ * @property {(from: string, to: string) => void} copyFile
+ * @property {(...parts: string[]) => string} join
+ */
+
+/**
+ * Copy `from` into `to`, skipping any entry that throws.
+ * @param {string} from @param {string} to @param {CopyTreeDeps} deps
+ * @returns {{copied: number, skipped: {path: string, reason: string}[]}}
+ */
+export function copyTreeSkippingUnreadable(from, to, deps) {
+  const { readdir, mkdir, copyFile, join } = deps;
+  let copied = 0;
+  /** @type {{path: string, reason: string}[]} */
+  const skipped = [];
+
+  /** @param {string} src @param {string} dst @param {string} rel */
+  const walk = (src, dst, rel) => {
+    /** @type {ReturnType<CopyTreeDeps['readdir']>} */
+    let entries;
+    try {
+      entries = readdir(src);
+    } catch (err) {
+      // An unreadable DIRECTORY costs only its own subtree, not its siblings.
+      skipped.push({ path: rel || '.', reason: reasonOf(err) });
+      return;
+    }
+    try {
+      mkdir(dst);
+    } catch (err) {
+      skipped.push({ path: rel || '.', reason: reasonOf(err) });
+      return;
+    }
+    for (const entry of entries) {
+      const childRel = rel ? join(rel, entry.name) : entry.name;
+      const childSrc = join(src, entry.name);
+      const childDst = join(dst, entry.name);
+      if (entry.isDirectory()) {
+        walk(childSrc, childDst, childRel);
+        continue;
+      }
+      try {
+        // copyFile follows symlinks, so a DANGLING link throws here and is skipped —
+        // which is the common shape of "referenced but missing".
+        copyFile(childSrc, childDst);
+        copied++;
+      } catch (err) {
+        skipped.push({ path: childRel, reason: reasonOf(err) });
+      }
+    }
+  };
+
+  walk(from, to, '');
+  return { copied, skipped };
+}
+
+/** @param {unknown} err */
+function reasonOf(err) {
+  const e = /** @type {{code?: string, message?: string}} */ (err);
+  return e?.code || e?.message || String(err);
+}
+
+/**
+ * The operator-facing banner for skipped files. Loud on purpose: the old behaviour
+ * degraded to an unstyled site behind one advisory line, so a skip has to be
+ * impossible to scroll past — while still leaving exit 0, because a missing blog
+ * image must not stop the dev loop.
+ * @param {{path: string, reason: string}[]} skipped
+ * @param {number} [limit] how many paths to name before summarising
+ * @returns {string[]} lines
+ */
+export function formatSkippedAssets(skipped, limit = 10) {
+  if (skipped.length === 0) return [];
+  const lines = [
+    '',
+    `⚠ copy-tenant-assets skipped ${skipped.length} unreadable file(s) — those URLs will 404:`,
+  ];
+  for (const { path, reason } of skipped.slice(0, limit)) lines.push(`    ${path} (${reason})`);
+  if (skipped.length > limit) lines.push(`    … and ${skipped.length - limit} more`);
+  lines.push('  Everything else copied, so the rest of the tenant\'s assets still serve.');
+  lines.push('');
+  return lines;
+}