underpost 3.2.9 → 3.2.10

package/src/db/mongo/MongooseDB.js

@@ -1,5 +1,4 @@
 import mongoose from 'mongoose';
-import { loggerFactory } from '../../server/logger.js';
 import { getCapVariableName } from '../../client/components/core/CommonJs.js';
 
 /**
@@ -8,7 +7,33 @@ import { getCapVariableName } from '../../client/components/core/CommonJs.js';
  * @namespace MongooseDBService
  */
 
-const logger = loggerFactory(import.meta);
+const MONGODB_SERVICE_NAME = 'mongodb-service';
+const MONGODB_STATEFULSET_NAME = 'mongodb';
+const MONGODB_DEFAULT_AUTH_SOURCE = 'admin';
+const MONGODB_DEFAULT_REPLICA_SET = 'rs0';
+const MONGODB_DEFAULT_REPLICA_COUNT = 3;
+
+
+
+/**
+ * Resolves MongoDB replica hosts from explicit input or StatefulSet defaults.
+ * @param {{hostList?: string, replicaCount?: number}} [options] - Host resolution options.
+ * @returns {Array<string>} Normalized host:port entries.
+ */
+const resolveMongoReplicaHosts = ({ hostList = '', replicaCount = MONGODB_DEFAULT_REPLICA_COUNT }) => {
+  if (hostList) {
+    return hostList
+      .split(',')
+      .map((host) => host.trim())
+      .filter(Boolean)
+      .map((host) => (host.includes(':') ? host : `${host}:27017`));
+  }
+
+  return Array.from(
+    { length: replicaCount },
+    (_, index) => `${MONGODB_STATEFULSET_NAME}-${index}.${MONGODB_SERVICE_NAME}:27017`,
+  );
+};
 
 /**
  * @class
@@ -23,35 +48,106 @@ const logger = loggerFactory(import.meta);
  * 3. No built-in defaults — both `host` and `name` are required from the caller or environment.
  */
 class MongooseDBService {
+  /**
+   * Normalizes Mongo host inputs into plain host:port entries.
+   * @param {Array<string>|string} hosts - Host input as list or comma-separated string.
+   * @returns {Array<string>} Normalized host:port entries.
+   */
+  normalizeHosts(hosts) {
+    const hostEntries = Array.isArray(hosts) ? hosts : `${hosts || ''}`.split(',');
+
+    return hostEntries
+      .map((entry) => `${entry || ''}`.trim())
+      .filter(Boolean)
+      .map((entry) => entry.replace(/^mongodb:\/\//, '').replace(/\/.*$/, ''));
+  }
+
+  /**
+   * Normalizes connection config from object or legacy host/name signature.
+   * @param {object|string} configOrHost - Connection config object or host string.
+   * @param {string} [name] - Legacy DB name when using host string input.
+   * @returns {{authSource: string, dbName: string, hosts: Array<string>, password: string, replicaSet: string, user: string}} Normalized config.
+   */
+  normalizeConfig(configOrHost, name) {
+    const config =
+      typeof configOrHost === 'object' && configOrHost !== null
+        ? { ...configOrHost }
+        : { host: configOrHost, name };
+
+    const rawHosts = config.host || process.env.DB_HOST;
+    const hosts = this.normalizeHosts(rawHosts);
+    const dbName = config.name || process.env.DB_NAME;
+
+    if (!hosts.length || !dbName) {
+      const missing = [!hosts.length && 'host (db.host|DB_HOST)', !dbName && 'name (db.name|DB_NAME)']
+        .filter(Boolean)
+        .join(', ');
+      throw new Error(`MongooseDBService.connect: missing required parameter(s): ${missing}`);
+    }
+
+    const user = config.user || process.env.DB_USER || '';
+    const password = config.password || process.env.DB_PASSWORD || '';
+    const replicaSet =
+      config.replicaSet || process.env.DB_REPLICA_SET || (hosts.length > 1 ? MONGODB_DEFAULT_REPLICA_SET : '');
+    const authSource =
+      config.authSource || process.env.DB_AUTH_SOURCE || (user ? MONGODB_DEFAULT_AUTH_SOURCE : '');
+
+    return {
+      authSource,
+      dbName,
+      hosts,
+      password,
+      replicaSet,
+      user,
+    };
+  }
+
+  /**
+   * Builds a MongoDB URI from normalized config options.
+   * @param {object|string} configOrHost - Connection config object or host string.
+   * @param {string} [name] - Legacy DB name when using host string input.
+   * @returns {string} MongoDB connection URI.
+   */
+  buildUri(configOrHost, name) {
+    const config = this.normalizeConfig(configOrHost, name);
+    const credentials = config.user && config.password
+      ? `${encodeURIComponent(config.user)}:${encodeURIComponent(config.password)}@`
+      : '';
+    const query = new URLSearchParams();
+
+    if (config.replicaSet) query.set('replicaSet', config.replicaSet);
+    if (config.authSource) query.set('authSource', config.authSource);
+
+    return `mongodb://${credentials}${config.hosts.join(',')}/${config.dbName}${query.size ? `?${query.toString()}` : ''}`;
+  }
+
   /**
    * Establishes a Mongoose connection to the specified MongoDB instance.
    *
    * @async
-   * @param {string} host - The MongoDB host URI (e.g., `'mongodb://localhost:27017'`).
-   *   Falls back to `process.env.DB_HOST` when not provided.
-   * @param {string} name - The database name.
-   *   Falls back to `process.env.DB_NAME` when not provided.
+   * @param {object|string} configOrHost - Either a db config object or a legacy host string.
+   * @param {string} [configOrHost.host] - Legacy single host or comma-separated host list.
+   * @param {string} [configOrHost.name] - The database name.
+   * @param {string} [configOrHost.replicaSet] - The MongoDB replica set name.
+   * @param {string} [configOrHost.authSource] - The authentication database.
+   * @param {string} [configOrHost.user] - The MongoDB username.
+   * @param {string} [configOrHost.password] - The MongoDB password.
+   * @param {string} [name] - Legacy database name when a host string is passed.
    * @returns {Promise<mongoose.Connection>} A promise that resolves to the established Mongoose connection object.
    * @throws {Error} If neither the argument nor the corresponding environment variable supplies a value.
    */
-  async connect(host, name) {
-    host = host || process.env.DB_HOST;
-    name = name || process.env.DB_NAME;
-
-    if (!host || !name) {
-      const missing = [!host && 'host (DB_HOST)', !name && 'name (DB_NAME)'].filter(Boolean).join(', ');
-      throw new Error(`MongooseDBService.connect: missing required parameter(s): ${missing}`);
-    }
-
-    const uri = `${host}/${name}`;
-    // logger.info('MongooseDB connect', { host, name, uri });
+  async connect(configOrHost, name) {
+    const uri = this.buildUri(configOrHost, name);
     return await mongoose
       .createConnection(uri, {
+        autoIndex: process.env.NODE_ENV !== 'production',
+        heartbeatFrequencyMS: 10000,
+        maxPoolSize: 20,
+        minPoolSize: 2,
+        retryReads: true,
+        retryWrites: true,
         serverSelectionTimeoutMS: 5000,
-        // readPreference: 'primary',
-        // directConnection: true,
-        // useNewUrlParser: true,
-        // useUnifiedTopology: true,
+        socketTimeoutMS: 45000,
       })
       .asPromise();
   }
@@ -87,4 +183,12 @@ class MongooseDBService {
  */
 const MongooseDB = new MongooseDBService();
 
-export { MongooseDB, MongooseDBService as MongooseDBClass };
+export {
+  MongooseDB,
+  MongooseDBService as MongooseDBClass,
+  MONGODB_DEFAULT_REPLICA_COUNT,
+  MONGODB_DEFAULT_REPLICA_SET,
+  MONGODB_SERVICE_NAME,
+  MONGODB_STATEFULSET_NAME,
+  resolveMongoReplicaHosts
+};

package/src/index.js

@@ -44,7 +44,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.2.9';
+  static version = 'v3.2.10';
 
   /**
    * Required Node.js major version

package/src/runtime/express/Express.js

@@ -15,7 +15,7 @@ import { createServer } from 'http';
 import { loggerFactory, loggerMiddleware } from '../../server/logger.js';
 import { getCapVariableName, newInstance } from '../../client/components/core/CommonJs.js';
 import { MailerProvider } from '../../mailer/MailerProvider.js';
-import { DataBaseProvider } from '../../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../../db/DataBaseProvider.js';
 import { createPeerServer } from '../../server/peer.js';
 import { createValkeyConnection } from '../../server/valkey.js';
 import { applySecurity, authMiddlewareFactory } from '../../server/auth.js';
@@ -192,7 +192,7 @@ class ExpressService {
       }
 
       // Database and Valkey connections
-      if (db && apis) await DataBaseProvider.load({ apis, host, path, db });
+      if (db && apis) await DataBaseProviderService.load({ apis, host, path, db });
 
       if (valkey) await createValkeyConnection({ host, path }, valkey);
 

package/src/runtime/wp/Wp.js

@@ -56,10 +56,11 @@ class WpService {
    * to `/usr/local/bin/wp` if it is not already present.
    */
   static ensureWpCli() {
-    const existing = shellExec(`PATH="${LAMPP_BIN}:$PATH" which wp 2>/dev/null || true`, {
+    const existing = shellExec(`PATH="${LAMPP_BIN}:$PATH" which wp`, {
       stdout: true,
       silent: true,
       disableLog: true,
+      silentOnError: true,
     });
     if (existing && existing.trim()) return;
     logger.info('WP-CLI not found — installing to /usr/local/bin/wp');
@@ -76,10 +77,11 @@ class WpService {
    */
   static ensureSendmail() {
     const sendmailPath = '/usr/sbin/sendmail';
-    const existing = shellExec(`test -x "${sendmailPath}" && echo ok || true`, {
+    const existing = shellExec(`test -x "${sendmailPath}" && echo ok`, {
       stdout: true,
       silent: true,
       disableLog: true,
+      silentOnError: true,
     });
     if (existing && existing.trim() === 'ok') return;
     logger.info('sendmail stub missing — creating no-op at /usr/sbin/sendmail');
@@ -494,7 +496,7 @@ Thumbs.db
    * `git clone` yields a fully working site without needing a fresh install.
    *
    * Safe to call repeatedly — `git commit` is a no-op when the working tree
-   * is clean (`|| true` prevents non-zero exit).
+   * is clean (`silentOnError: true` swallows the non-zero exit gracefully).
    *
    * @param {object} opts
    * @param {string}      opts.siteRoot   - Absolute path to the WordPress root.
@@ -514,7 +516,8 @@ Thumbs.db
 
     logger.info(`${host}: persisting site to repository`);
     shellExec(
-      `cd "${siteRoot}" && git add -A && git commit -m "wp provision ${host} $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`,
+      `cd "${siteRoot}" && git add -A && git commit -m "wp provision ${host} $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+      { silentOnError: true },
     );
     shellExec(`cd "${siteRoot}" && underpost push . ${githubOrg}/${repoName} -f`);
     logger.info(`${host}: initial commit pushed to ${githubOrg}/${repoName}`);
@@ -627,7 +630,7 @@ if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROT
 
     // MariaDB export is handled by the shared db.js backup flow — no duplicate dump here.
     if (fs.existsSync(path.join(siteRoot, '.git'))) {
-      shellExec(`cd "${siteRoot}" && git add -A && git commit -m "wp backup $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`);
+      shellExec(`cd "${siteRoot}" && git add -A && git commit -m "wp backup $(date -u +%Y-%m-%dT%H:%M:%SZ)"`, { silentOnError: true });
       shellExec(`cd "${siteRoot}" && underpost push . ${githubOrg}/${repository.split('/').pop().split('.')[0]}`);
       logger.info(`backup: git push done for ${siteRoot}`);
     } else {

package/src/server/auth.js

@@ -20,7 +20,7 @@ import rateLimit from 'express-rate-limit';
 import slowDown from 'express-slow-down';
 import cors from 'cors';
 import cookieParser from 'cookie-parser';
-import { DataBaseProvider } from '../db/DataBaseProvider.js';
+import { DataBaseProviderService } from '../db/DataBaseProvider.js';
 import { isDevProxyContext } from './conf.js';
 
 const logger = loggerFactory(import.meta);
@@ -229,7 +229,7 @@ const authMiddlewareFactory = (options = { host: '', path: '' }) => {
 
       // Non-guest verify session exists
       if (payload.jwtid && payload.role !== 'guest') {
-        const User = DataBaseProvider.instance[`${payload.host}${payload.path}`].mongoose.models.User;
+        const User = DataBaseProviderService.getModel('user', { host: payload.host, path: payload.path });
         const user = await User.findOne({ _id: payload._id, 'activeSessions._id': payload.jwtid }).lean();
 
         if (!user) {

package/src/server/client-build-docs.js

@@ -399,7 +399,7 @@ const buildCoverage = async ({ docs, docsDestination }) => {
         shellExec(`cd ${coveragePath} && npm run coverage`, { silent: true });
       } else if (pkg.scripts && pkg.scripts.test) {
         logger.info('generating coverage via test', coveragePath);
-        shellExec(`cd ${coveragePath} && npm test`, { silent: true });
+        shellExec(`cd ${coveragePath} && npm test`, { silent: true, silentOnError: true });
       }
     }
   }

package/src/server/client-build.js

@@ -724,23 +724,24 @@ const buildClient = async (
       const ssrPath = path === '/' ? path : `${path}/`;
       const Render = await ssrFactory();
 
-      if (views) {
-        const jsSrcPath = `./src/client/sw/core.sw.js`;
-
-        const jsPublicPath = `${rootClientPath}/sw.js`;
-
-        if (!(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === jsSrcPath))) {
-          const jsSrc = await transformClientJs(jsSrcPath, {
-            dists,
-            proxyPath: path,
-            baseHost,
-            minify: minifyBuild,
-            externalizeBareImports: false,
-          });
-
-          fs.writeFileSync(jsPublicPath, jsSrc, 'utf8');
-        }
+      const swSrcPath = `./src/client/sw/core.sw.js`;
+      const swPublicPath = `${rootClientPath}/sw.js`;
+      const swShouldRebuild =
+        views && !(enableLiveRebuild && !options.liveClientBuildPaths.find((p) => p.srcBuildPath === swSrcPath));
+      // Transformed SW JS is held in memory; it gets prepended with renderPayload
+      // and written once below, after PRE_CACHED_RESOURCES are known.
+      let swTransformedJs = '';
+      if (swShouldRebuild) {
+        swTransformedJs = await transformClientJs(swSrcPath, {
+          dists,
+          proxyPath: path,
+          baseHost,
+          minify: minifyBuild,
+          externalizeBareImports: false,
+        });
+      }
 
+      if (views) {
         if (
           !(
             enableLiveRebuild &&
@@ -750,9 +751,8 @@ const buildClient = async (
           )
         )
           for (const view of views) {
-            const buildPath = `${
-              rootClientPath[rootClientPath.length - 1] === '/' ? rootClientPath.slice(0, -1) : rootClientPath
-            }${view.path === '/' ? view.path : `${view.path}/`}`;
+            const buildPath = `${rootClientPath[rootClientPath.length - 1] === '/' ? rootClientPath.slice(0, -1) : rootClientPath
+              }${view.path === '/' ? view.path : `${view.path}/`}`;
 
             if (!fs.existsSync(buildPath)) fs.mkdirSync(buildPath, { recursive: true });
 
@@ -768,9 +768,8 @@ const buildClient = async (
             fs.writeFileSync(`${buildPath}${buildId}.js`, jsSrc, 'utf8');
             const title = metadata.title ? metadata.title : title;
 
-            const canonicalURL = `https://${host}${path}${
-              view.path === '/' ? (path === '/' ? '' : '/') : path === '/' ? `${view.path.slice(1)}/` : `${view.path}/`
-            }`;
+            const canonicalURL = `https://${host}${path}${view.path === '/' ? (path === '/' ? '' : '/') : path === '/' ? `${view.path.slice(1)}/` : `${view.path}/`
+              }`;
 
             let ssrHeadComponents = ``;
             let ssrBodyComponents = ``;
@@ -904,12 +903,12 @@ const buildClient = async (
               `${buildPath}index.html`,
               minifyBuild
                 ? await minify(htmlSrc, {
-                    minifyCSS: true,
-                    minifyJS: true,
-                    collapseBooleanAttributes: true,
-                    collapseInlineTagWhitespace: true,
-                    collapseWhitespace: true,
-                  })
+                  minifyCSS: true,
+                  minifyJS: true,
+                  collapseBooleanAttributes: true,
+                  collapseInlineTagWhitespace: true,
+                  collapseWhitespace: true,
+                })
                 : htmlSrc,
               'utf8',
             );
@@ -967,119 +966,85 @@ Sitemap: ${sitemapBaseUrl}/sitemap.xml`,
       }
 
       if (client) {
-        let PRE_CACHED_RESOURCES = [];
-
-        const normalizePrecacheRoutePath = (candidatePath) => {
-          const routePath =
-            typeof candidatePath === 'string' && candidatePath.trim().length > 0 ? candidatePath.trim() : '/offline';
-          const withLeadingSlash = routePath.startsWith('/') ? routePath : `/${routePath}`;
-          const withoutTrailingSlash = withLeadingSlash.replace(/\/+$/, '');
-          return withoutTrailingSlash.length > 0 ? withoutTrailingSlash : '/';
-        };
-
-        const toPrecacheIndexUrl = (routePath) => {
-          const normalizedRoutePath = normalizePrecacheRoutePath(routePath);
-          return `${path === '/' ? '' : path}${normalizedRoutePath === '/' ? '' : normalizedRoutePath}/index.html`;
-        };
-
-        for (const pageType of ['offline', 'pages']) {
-          if (confSSR[getCapVariableName(client)] && confSSR[getCapVariableName(client)][pageType]) {
-            for (const page of confSSR[getCapVariableName(client)][pageType]) {
-              const SsrComponent = await ssrFactory(`./src/client/ssr/${pageType}/${page.client}.js`);
-
-              const htmlSrc = Render({
-                title: page.title,
-                ssrPath,
-                ssrHeadComponents: '<base target="_top">',
-                ssrBodyComponents: SsrComponent(),
-                renderPayload: {
-                  apiBaseProxyPath,
-                  apiBaseHost,
-                  apiBasePath: process.env.BASE_API,
-                  version: Underpost.version,
-                  ...(isDevelopment ? { dev: true } : undefined),
-                },
-                renderApi: {
-                  JSONweb,
-                },
-              });
-
-              const buildPath = `${
-                rootClientPath[rootClientPath.length - 1] === '/' ? rootClientPath.slice(0, -1) : rootClientPath
-              }${page.path === '/' ? page.path : `${page.path}/`}`;
-
-              // Install-time precache is intentionally restricted to SSR offline pages.
-              // All other routes/assets are loaded lazily at runtime.
-              if (pageType === 'offline') {
-                PRE_CACHED_RESOURCES.push(toPrecacheIndexUrl(page.path));
-              }
-
-              if (!fs.existsSync(buildPath)) fs.mkdirSync(buildPath, { recursive: true });
-
-              const buildHtmlPath = `${buildPath}index.html`;
-
-              logger.info('ssr page build', buildHtmlPath);
-
-              fs.writeFileSync(
-                buildHtmlPath,
-                minifyBuild
-                  ? await minify(htmlSrc, {
-                      minifyCSS: true,
-                      minifyJS: true,
-                      collapseBooleanAttributes: true,
-                      collapseInlineTagWhitespace: true,
-                      collapseWhitespace: true,
-                    })
-                  : htmlSrc,
-                'utf8',
-              );
-            }
-          }
-        }
+        const proxyPrefix = path === '/' ? '' : path;
+        const buildIndexUrl = (routePath) => `${proxyPrefix}${routePath === '/' ? '' : routePath}/index.html`;
+
+        // SSR views: a single declarative array. The role of each view (regular
+        // page vs. offline/maintenance fallback) is expressed by per-entry flags;
+        // fallback-flagged views are also precached so the SW can serve them
+        // when the network is unreachable.
+        const ssrClientConf = confSSR[getCapVariableName(client)] || {};
+        const ssrViews = Array.isArray(ssrClientConf.views) ? ssrClientConf.views : [];
+        const PRE_CACHED_RESOURCES = [];
+        let offlineFallbackUrl = null;
+        let maintenanceFallbackUrl = null;
+
+        for (const view of ssrViews) {
+          const SsrComponent = await ssrFactory(`./src/client/ssr/views/${view.client}.js`);
+
+          const htmlSrc = Render({
+            title: view.title,
+            ssrPath,
+            ssrHeadComponents: '<base target="_top">',
+            ssrBodyComponents: SsrComponent(),
+            renderPayload: {
+              apiBaseProxyPath,
+              apiBaseHost,
+              apiBasePath: process.env.BASE_API,
+              version: Underpost.version,
+              ...(isDevelopment ? { dev: true } : undefined),
+            },
+            renderApi: { JSONweb },
+          });
 
-        {
-          const cacheScope = path === '/' ? 'root' : path.replaceAll('/', '_');
-          const ssrClientConf = confSSR[getCapVariableName(client)] || {};
-          const ssrOfflinePages = Array.isArray(ssrClientConf.offline) ? ssrClientConf.offline : [];
-          const normalizeSsrRoutePath = (candidatePath, fallbackPath) => {
-            const value =
-              typeof candidatePath === 'string' && candidatePath.trim().length > 0
-                ? candidatePath.trim()
-                : fallbackPath;
-            const withLeadingSlash = value.startsWith('/') ? value : `/${value}`;
-            const withoutTrailingSlash = withLeadingSlash.replace(/\/+$/, '');
-            return withoutTrailingSlash.length > 0 ? withoutTrailingSlash : '/';
-          };
+          const buildPath = `${rootClientPath[rootClientPath.length - 1] === '/' ? rootClientPath.slice(0, -1) : rootClientPath
+            }${view.path === '/' ? view.path : `${view.path}/`}`;
 
-          const offlineSsrPage =
-            ssrOfflinePages.find(
-              (page) =>
-                page?.client === 'NoNetworkConnection' ||
-                /no\s*network|offline/i.test(`${page?.title || ''} ${page?.client || ''} ${page?.path || ''}`),
-            ) || ssrOfflinePages[0];
+          const indexUrl = buildIndexUrl(view.path);
+          if (view.offlineDefault) {
+            offlineFallbackUrl = indexUrl;
+            PRE_CACHED_RESOURCES.push(indexUrl);
+          }
+          if (view.maintenanceDefault) {
+            maintenanceFallbackUrl = indexUrl;
+            PRE_CACHED_RESOURCES.push(indexUrl);
+          }
 
-          const maintenanceSsrPage =
-            ssrOfflinePages.find(
-              (page) =>
-                page?.client === 'Maintenance' ||
-                /maintenance/i.test(`${page?.title || ''} ${page?.client || ''} ${page?.path || ''}`),
-            ) || ssrOfflinePages[1];
+          if (!fs.existsSync(buildPath)) fs.mkdirSync(buildPath, { recursive: true });
+          const buildHtmlPath = `${buildPath}index.html`;
+          logger.info('ssr view build', buildHtmlPath);
 
-          const offlinePath = normalizeSsrRoutePath(offlineSsrPage?.path, '/offline');
-          const maintenancePath = normalizeSsrRoutePath(maintenanceSsrPage?.path, '/maintenance');
+          fs.writeFileSync(
+            buildHtmlPath,
+            minifyBuild
+              ? await minify(htmlSrc, {
+                minifyCSS: true,
+                minifyJS: true,
+                collapseBooleanAttributes: true,
+                collapseInlineTagWhitespace: true,
+                collapseWhitespace: true,
+              })
+              : htmlSrc,
+            'utf8',
+          );
+        }
 
+        if (swShouldRebuild) {
+          const cacheScope = path === '/' ? 'root' : path.replaceAll('/', '_');
           const renderPayload = {
             PRE_CACHED_RESOURCES: uniqueArray(PRE_CACHED_RESOURCES),
             PROXY_PATH: path,
-            CACHE_PREFIX: `engine-core-v3-${cacheScope}`,
-            OFFLINE_PATH: offlinePath,
-            MAINTENANCE_PATH: maintenancePath,
+            CACHE_PREFIX: `engine-core-${cacheScope}`,
+            OFFLINE_URL: offlineFallbackUrl || buildIndexUrl('/offline'),
+            MAINTENANCE_URL: maintenanceFallbackUrl || buildIndexUrl('/maintenance'),
           };
+
+          // Single write: prepend the payload prelude to the transformed SW JS.
           fs.writeFileSync(
-            `${rootClientPath}/sw.js`,
+            swPublicPath,
             `self.renderPayload = ${JSONweb(renderPayload)};
 self.__WB_DISABLE_DEV_LOGS = true;
-${fs.readFileSync(`${rootClientPath}/sw.js`, 'utf8')}`,
+${swTransformedJs}`,
             'utf8',
           );
         }