@tokenoftrust/storefront-runner 2.2.20 → 2.2.22

package/apps/storefront/integrations/lifecycle-host-asset.mjs

@@ -21,8 +21,7 @@
  * passes — the client pass included — runs with `build.ssr === true`, so a Vite plugin
  * cannot tell them apart, while `config.build.client` says it outright.
  */
-import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -30,7 +29,6 @@ import {
   LIFECYCLE_HOST_ASSET_PATH,
   LIFECYCLE_HOST_COMPATIBILITY_ASSET_PATHS,
 } from "@tot/public-runtime/integration/lifecycle-host-asset";
-import { decideLifecycleHostLock, formatLifecycleHostLockReport } from "../../../scripts/lib/lifecycle-host-lock.mjs";
 
 const HOST_ASSET_PATHS = Object.freeze([
   ...LIFECYCLE_HOST_COMPATIBILITY_ASSET_PATHS,
@@ -44,11 +42,6 @@ const HOST_ENTRY = fileURLToPath(
   ),
 );
 
-const LOCK_URL = new URL(
-  "../../../packages/public-runtime/src/integration/lifecycle-host-asset.lock.json",
-  import.meta.url,
-);
-
 /**
  * Bundle the host to a single self-contained ES module.
  *
@@ -131,30 +124,6 @@ export function lifecycleHostAsset() {
         if (!clientDir) throw new Error("the lifecycle host has no resolved client output dir");
         const outputDir = clientDir;
         const code = await bundleLifecycleHost();
-        const hash = createHash("sha256").update(code, "utf8").digest("hex");
-
-        // Every HOST_ASSET_PATH is served under an `immutable, max-age=1yr` Cache-Control
-        // (scripts/publish/lib/s3-publish.mjs PLATFORM_ASSET_PREFIX) — once published, a
-        // path's bytes may never change, or visitors who already cached it are stuck on
-        // stale tracking/consent behavior for up to a year with nothing to notice it. This
-        // is the guard for that: refuse the build rather than silently rewrite a path that
-        // already shipped different bytes.
-        const lock = JSON.parse(await readFile(LOCK_URL, "utf8"));
-        const decision = decideLifecycleHostLock(
-          lock,
-          HOST_ASSET_PATHS.map((assetPath) => ({ assetPath, hash })),
-        );
-        if (!decision.ok) {
-          throw new Error(formatLifecycleHostLockReport(decision));
-        }
-        if (JSON.stringify(decision.nextLock) !== JSON.stringify(lock)) {
-          await writeFile(LOCK_URL, `${JSON.stringify(decision.nextLock, null, 2)}\n`, "utf8");
-          logger.warn(
-            "lifecycle host lock recorded a new path — commit " +
-              "packages/public-runtime/src/integration/lifecycle-host-asset.lock.json",
-          );
-        }
-
         await Promise.all(HOST_ASSET_PATHS.map(async (assetPath) => {
           const target = fileURLToPath(new URL(assetPath, outputDir));
           await mkdir(dirname(target), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.20",
+  "version": "2.2.22",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/content-named-asset-prefixes.d.mts

@@ -0,0 +1,2 @@
+/** Types for the shared (S3 publish + Cloudflare serve) immutable-prefix list. */
+export declare const CONTENT_NAMED_ASSET_PREFIXES: readonly string[];

package/packages/public-runtime/src/content-named-asset-prefixes.mjs

@@ -0,0 +1,16 @@
+/**
+ * Bundle-relative prefixes whose URL is derived from the file's own bytes, and therefore
+ * the ONLY paths that may be served `Cache-Control: immutable`:
+ *   `_astro/` — Astro/Vite put a content hash in every filename.
+ *   `_a/`     — the content-addressed asset pool (`/_a/<sha256><ext>`).
+ *
+ * `immutable` tells a browser it will never need to revalidate, so it is only correct when a
+ * byte change necessarily changes the URL. A path-VERSIONED prefix such as `platform/` does
+ * not qualify: its `v{N}` names a contract, compatible changes rebuild it in place, and a
+ * returning visitor would keep the old bytes for a year.
+ *
+ * One list for both CDNs. The S3/CloudFront publish plane (`scripts/publish/lib/s3-publish.mjs`)
+ * and the Cloudflare serve plane (`src/static-bundle.ts`) both read it, so they cannot
+ * disagree about what is immutable.
+ */
+export const CONTENT_NAMED_ASSET_PREFIXES = Object.freeze(["_astro/", "_a/"]);

package/packages/public-runtime/src/integration/lifecycle-host-asset.mjs

@@ -8,18 +8,25 @@
  * disagree — a mismatch would leave every static tenant page with plan data and no host,
  * which fails silently in exactly the way it is not allowed to.
  *
- * The path is version-pinned (`/v3/`) like a platform adapter entry, so a future host
- * with a different boot contract ships alongside rather than replacing this one.
+ * The `/v4/` segment names the boot CONTRACT, not the bytes: a compatible runtime change
+ * rebuilds this same path, which is why `platform/` is served with a revalidating cache
+ * tier rather than `immutable`. A host with a different boot contract ships at the next
+ * `v{N}` alongside this one.
+ *
+ * The segment must also advance once whenever earlier bytes at a path were served under an
+ * `immutable` header, since nothing the server does reaches a browser that cached them that
+ * way. v3 was, which is why v4 exists.
  */
-export const LIFECYCLE_HOST_ASSET_PATH = "platform/lifecycle/v3/boot.mjs";
+export const LIFECYCLE_HOST_ASSET_PATH = "platform/lifecycle/v4/boot.mjs";
 
 /**
- * Earlier immutable URLs that must keep serving the current host bytes during a
- * version transition. Cached HTML may still reference one of these paths after a
- * pointer flip, so dropping it would turn a cache refresh into a lifecycle 404.
+ * Earlier URLs that keep serving the current host bytes. Cached HTML may still reference
+ * one of these paths after a pointer flip, so dropping it would turn a cache refresh into a
+ * lifecycle 404.
  */
 export const LIFECYCLE_HOST_COMPATIBILITY_ASSET_PATHS = Object.freeze([
   "platform/lifecycle/v2/boot.mjs",
+  "platform/lifecycle/v3/boot.mjs",
 ]);
 
 /** The root-absolute, same-origin URL the served markup references. */

package/packages/public-runtime/src/static-bundle.ts

@@ -43,6 +43,7 @@
 import { assetContentType } from "./tenant-assets.js";
 import { formatHtmlCacheControl } from "./html-cache-policy.js";
 import { NATIVE_GA4_SANDBOX_ASSET_PATH } from "./integration/native-ga4-sandbox-asset.mjs";
+import { CONTENT_NAMED_ASSET_PREFIXES } from "./content-named-asset-prefixes.mjs";
 
 // ---------------------------------------------------------------------------
 // R2 seam — same structural subset tenant-assets.ts uses (no workers-types dep)
@@ -302,8 +303,8 @@ const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
  */
 const STABLE_ASSET_CACHE_CONTROL = "public, max-age=86400, stale-while-revalidate=604800";
 
-/** Bundle prefixes whose stable paths are still immutable: hash-named build output and path-versioned platform code. */
-const IMMUTABLE_STABLE_PREFIXES = ["_astro/", "platform/"];
+/** Bundle prefixes whose stable paths are immutable — shared with the S3 plane, see that module. */
+const IMMUTABLE_STABLE_PREFIXES = CONTENT_NAMED_ASSET_PREFIXES;
 
 /**
  * URL prefix of a content-addressed asset (`/_a/<sha256><ext>`) — kept in lockstep with

package/packages/public-runtime/src/integration/lifecycle-host-asset.lock.json

@@ -1,4 +0,0 @@
-{
-  "platform/lifecycle/v2/boot.mjs": "ed2c69b80fb2e1472d0b19631efec5ccb26a395a5f4820a54f55435deca6eb46",
-  "platform/lifecycle/v3/boot.mjs": "ed2c69b80fb2e1472d0b19631efec5ccb26a395a5f4820a54f55435deca6eb46"
-}