fix(ci): unconditional SSR adapter + adapter-aware custom-page materialize

Fixes the two pre-existing CI failures that predate the auth migration:

1. portal-first-byte-build test threw NoAdapterInstalled. Root cause:
   the SSR adapter was gated on useRun402Integration (needs KYCHON_PROJECT
   + RUN402_PROJECT_ID), but calendar/search/ssr-probe export
   prerender=false, so any adapter-less `astro build` fails. Fix: register
   createRun402Adapter() unconditionally — it only emits
   dist/run402/{client,server,adapter.json} locally and has no auth/
   credential requirements. The image-upload integration stays gated on
   useRun402Integration so non-deploy builds don't reach for gateway creds.

2. deploy-ci.ts patchDeploy threw "dist/page.html does not exist". With
   the adapter active, [customPage].astro's getStaticPaths writes per-slug
   HTML under dist/run402/client/ and dist/page.html never exists.
   patchDeploy + generate-static-page-aliases.ts now mirror runDeploy's
   adapterActive detection (existsSync dist/run402/adapter.json) and
   synthesize the slug list from the seed instead of calling
   materializeCustomPageStaticFiles.

Build test reconciled with the SSR-guard revert (d0b69ae): admin*/profile
are static again, so they're back in REPRESENTATIVE_PAGES with the
ADMIN_PAGES assertions (static bake contains the "Checking access"
placeholder, never data-admin-content). Output reads from dist/run402/
client/ since the adapter now always relocates prerendered HTML there.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: MajorTal

astro.config.mjs

@@ -212,13 +212,17 @@ const useRun402Integration = Boolean(integrationAssetsDir && process.env.RUN402_
 // `PUBLIC_PATH_MODE_WIDENS_TO_IMPLICIT` warning — covered by
 // `RUN402_ALLOW_WARNINGS=true`.
 //
-// Skipped when `useRun402Integration` is false — pure-static builds
-// (integration tests, neutral fallback, local `astro dev` without env
-// vars) keep the pre-adapter pipeline + the original `dist/` layout
-// unchanged.
+// The adapter is unconditional: several routes (admin*, profile,
+// calendar, search, ssr-probe) export `prerender = false`, so any
+// `astro build` without an adapter throws NoAdapterInstalled. The
+// adapter itself has no auth requirements — it just emits
+// `dist/run402/{client,server,adapter.json}` locally — so it's safe
+// to register in test / neutral-fallback builds. The image-upload
+// integration stays gated on `useRun402Integration` so non-deploy
+// builds don't reach for Run402 gateway credentials.
 export default defineConfig({
   output: 'static',
-  ...(useRun402Integration ? { adapter: createRun402Adapter() } : {}),
+  adapter: createRun402Adapter(),
   devToolbar: {
     enabled: false,
   },

scripts/_lib.ts

@@ -933,11 +933,25 @@ export async function patchDeploy(
 
   const project = await r.project(opts.projectId);
   const distDir = join(ROOT, "dist");
+  // Mirror runDeploy's adapter detection: when @run402/astro@1.0.4+'s SSR
+  // adapter is active, `[customPage].astro`'s `getStaticPaths` writes
+  // per-slug HTML directly under `dist/run402/client/` and `dist/page.html`
+  // no longer exists. Skip `materializeCustomPageStaticFiles` (which would
+  // otherwise throw on the missing shell) and synthesize the same slug list
+  // from the seed — downstream code only needs the `{slug, file}` shape.
+  const adapterActive = existsSync(join(distDir, "run402", "adapter.json"));
 
   injectEnvJs(distDir, opts.anonKey);
   generateAndValidateHeaders(distDir);
   const deploySeed = await resolveDeployOutputSeed(opts.chromeSnapshot);
-  const materializedCustomPages = materializeCustomPageStaticFiles(distDir, deploySeed);
+  const materializedCustomPages = adapterActive
+    ? safeCustomPageSlugs(deploySeed.pages)
+        .map((slug) => {
+          const file = customPageStaticFile(slug);
+          return file ? { slug, file } : null;
+        })
+        .filter((entry): entry is MaterializedCustomPageFile => entry !== null)
+    : materializeCustomPageStaticFiles(distDir, deploySeed);
 
   const sql = readMigrations(ROOT, opts.seedFile);
   const migrationId = `kychon_${sha256Hex(sql).slice(0, 16)}`;

scripts/generate-static-page-aliases.ts

@@ -1,12 +1,27 @@
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { materializeCustomPageStaticFiles, ROOT } from './_lib.ts';
+import { customPageStaticFile, safeCustomPageSlugs } from '../src/lib/clean-routes.ts';
 import { describeSeedSource, resolveActiveProjectSeed } from '../src/seeds/index.ts';
 
 async function main(): Promise<void> {
   const { seed, source } = await resolveActiveProjectSeed();
   const distDir = join(ROOT, 'dist');
-  const materialized = materializeCustomPageStaticFiles(distDir, seed);
+  // Adapter-aware: when @run402/astro's SSR adapter ran, `[customPage].astro`'s
+  // getStaticPaths already emitted per-slug HTML under `dist/run402/client/`,
+  // and `dist/page.html` doesn't exist — so the legacy copy step would throw.
+  // Mirror `runDeploy`'s detection (scripts/_lib.ts:634) and just enumerate
+  // slugs for the log line.
+  const adapterActive = existsSync(join(distDir, 'run402', 'adapter.json'));
+  const materialized = adapterActive
+    ? safeCustomPageSlugs(seed.pages)
+        .map((slug) => {
+          const file = customPageStaticFile(slug);
+          return file ? { slug, file } : null;
+        })
+        .filter((entry): entry is { slug: string; file: `${string}.html` } => entry !== null)
+    : materializeCustomPageStaticFiles(distDir, seed);
   if (materialized.length === 0) {
     process.stdout.write(`No clean custom page aliases generated for ${describeSeedSource(source)}.\n`);
     return;

tests/integration/portal-first-byte-build.test.ts

@@ -7,12 +7,22 @@ const ROOT = process.cwd();
 const SNAPSHOT = join(ROOT, 'fixtures/chrome/odbc.chrome-snapshot.json');
 const BRAND = 'Old Dominion Boat Club';
 const FORBIDDEN_BRAND = 'Kychon Community';
+// The @run402/astro adapter relocates prerendered HTML from `dist/` to
+// `dist/run402/client/`. The adapter is unconditional in astro.config.mjs
+// because calendar / search / ssr-probe export `prerender = false` — without
+// the adapter `astro build` throws NoAdapterInstalled. Static pages still
+// prerender, just under the client dir.
+const CLIENT_DIR = join(ROOT, 'dist', 'run402', 'client');
 
+// Representative prerendered pages. admin* and profile are STATIC with
+// client-side access gating (the ADMIN_PAGES assertions below verify the
+// "Checking access" placeholder is baked but the real admin content is not).
+// calendar / search / ssr-probe are SSR-only (prerender = false), never
+// appear as static HTML, and are covered by the SSR entry's render path.
 const REPRESENTATIVE_PAGES = [
   'index.html',
   'page.html',
   'events.html',
-  'calendar.html',
   'directory.html',
   'committees.html',
   'forum.html',
@@ -40,7 +50,7 @@ function buildPortal(): void {
 }
 
 function readRepresentativeHtml(): Map<string, string> {
-  return new Map(REPRESENTATIVE_PAGES.map((page) => [page, readFileSync(join(ROOT, 'dist', page), 'utf8')]));
+  return new Map(REPRESENTATIVE_PAGES.map((page) => [page, readFileSync(join(CLIENT_DIR, page), 'utf8')]));
 }
 
 function requireSnapshotHtml(snapshot: Map<string, string>, page: string): string {
@@ -72,6 +82,9 @@ describe('Portal first-byte build output', () => {
       expect(html, page).toContain('/js/env.js');
       expect(html, page).not.toContain('/js/env.js?');
 
+      // Static admin pages must bake only the client-side access-checking
+      // placeholder, never the real admin UI — admin content is gated in the
+      // React island at runtime, so it must not leak into public static HTML.
       if (ADMIN_PAGES.has(page)) {
         expect(html, page).toContain('data-admin-access-checking');
         expect(html, page).toContain('Checking access');
@@ -82,7 +95,7 @@ describe('Portal first-byte build output', () => {
     buildPortal();
 
     for (const [page, html] of firstBuildHtml) {
-      expect(normalizeAstroAssetUrls(readFileSync(join(ROOT, 'dist', page), 'utf8')), page).toBe(
+      expect(normalizeAstroAssetUrls(readFileSync(join(CLIENT_DIR, page), 'utf8')), page).toBe(
         normalizeAstroAssetUrls(html),
       );
     }