fix(web): persist customers/CK to vaistudio-data dataset — no more Space rebuild on every save

- /api/customers GET+POST and /api/kh-link now read/write
bep40/vaistudio-data/customers.json (durable DATASET) instead of committing
customers.json to the vai-avatar2 Space repo.
- Old behavior: every customer/CK save committed to the Space repo → triggered a
Space rebuild, and concurrent writers (Zalo bot, admin saves) raced and
clobbered each other's records (the recurring NBV2fc/CK-loss bug).
- New: dataset commit = no rebuild, safe merge from live dataset on every write.

index.ts

@@ -1262,11 +1262,26 @@ const server = Bun.serve({
             return Response.json({ ok: false, expired: !!expired, error: expired ? "link hết hạn" : "sai token" }, { status: 200 });
           }
           // Load customer ck (server-side, own data) so the client can apply it.
+          // Source of truth = bep40/vaistudio-data/customers.json (durable dataset,
+          // no Space rebuild on write).
           let ck: any = null; let maKh = kh; let custName = "";
           try {
-            const f = join("/app", "customers.json");
+            const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
             let data: any = {};
-            if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")); } catch (_e) { data = {}; } }
+            try {
+              const r = await fetch("https://huggingface.co/datasets/bep40/vaistudio-data/resolve/main/customers.json", {
+                headers: token ? { Authorization: "Bearer " + token } : {},
+                signal: AbortSignal.timeout(6000),
+              });
+              if (r.ok) {
+                const raw = await r.text();
+                if (raw && raw.trim()) { try { data = JSON.parse(raw); } catch (_e) {} }
+              }
+            } catch (_e) {}
+            if (!data || typeof data !== "object" || !Object.keys(data).length) {
+              const f = join("/app", "customers.json");
+              if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")); } catch (_e2) { data = {}; } }
+            }
             if (data && typeof data === "object") {
               for (const k in data) {
                 const c = data[k];
@@ -1299,9 +1314,23 @@ const server = Bun.serve({
           const cid = (url.searchParams.get("cid") || "").trim().slice(0, 40);
           const name = (url.searchParams.get("name") || "").trim().slice(0, 60);
           if (!cid) return Response.json({ ok: false, error: "missing cid" }, { status: 400 });
-          const f = join("/app", "customers.json");
+          const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
+          // Source of truth = bep40/vaistudio-data/customers.json (dataset).
           let data: any = {};
-          if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")) || {}; } catch (_e) { data = {}; } }
+          try {
+            const r = await fetch("https://huggingface.co/datasets/bep40/vaistudio-data/resolve/main/customers.json", {
+              headers: token ? { Authorization: "Bearer " + token } : {},
+              signal: AbortSignal.timeout(6000),
+            });
+            if (r.ok) {
+              const raw = await r.text();
+              if (raw && raw.trim()) { try { data = JSON.parse(raw); } catch (_e) {} }
+            }
+          } catch (_e) {}
+          const f = join("/app", "customers.json");
+          if (!data || typeof data !== "object" || !Object.keys(data).length) {
+            if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")) || {}; } catch (_e2) { data = {}; } }
+          }
           if (!data || typeof data !== "object") data = {};
           let rec: any = null;
           for (const k in data) {
@@ -1317,15 +1346,16 @@ const server = Bun.serve({
             data[ma_kh] = rec;
             // Persist locally (best-effort; mirrors the bot's own persistence).
             try { writeFileSync(f, JSON.stringify(data, null, 2), "utf-8"); } catch (_e) {}
-            // Also push to the repo so the Zalo bot/KETOAN see it (best-effort).
+            // Also push to the durable DATASET so the Zalo bot/KETOAN see it —
+            // dataset commits do NOT trigger a Space rebuild (the old commit to
+            // the vai-avatar2 Space repo rebuilt the Space on every new visitor).
             try {
-              const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
               if (token) {
                 const payload = [
-                  { key: "header", value: { summary: "Add web visitor " + ma_kh + " via /api/kh-link", repo: { type: "space", id: "bep40/vai-avatar2" } } },
+                  { key: "header", value: { summary: "Add web visitor " + ma_kh + " via /api/kh-link", repo: { type: "dataset", id: "bep40/vaistudio-data" } } },
                   { key: "file", value: { path: "customers.json", content: JSON.stringify(data, null, 2) } },
                 ].map((o) => JSON.stringify(o)).join("\n") + "\n";
-                await fetch("https://huggingface.co/api/spaces/bep40/vai-avatar2/commit/main", {
+                await fetch("https://huggingface.co/api/datasets/bep40/vaistudio-data/commit/main", {
                   method: "POST", headers: { "Content-Type": "application/x-ndjson", Authorization: "Bearer " + token },
                   body: payload, signal: AbortSignal.timeout(15000),
                 }).catch(() => {});
@@ -1350,11 +1380,11 @@ const server = Bun.serve({
         try {
           const f = join("/app", "customers.json");
           let data: any = {};
-          // Prefer LIVE repo HEAD so edits from any writer (Zalo bot upload, new
+          // Prefer the LIVE durable dataset so edits from ANY writer (Zalo bot,
           // admin saves) appear immediately without waiting for a rebuild.
           try {
             const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
-            const r = await fetch("https://huggingface.co/spaces/bep40/vai-avatar2/raw/main/customers.json", {
+            const r = await fetch("https://huggingface.co/datasets/bep40/vaistudio-data/resolve/main/customers.json", {
               headers: token ? { Authorization: "Bearer " + token } : {},
               signal: AbortSignal.timeout(6000),
             });
@@ -1388,7 +1418,22 @@ const server = Bun.serve({
 
           const f = join("/app", "customers.json");
           let data: any = {};
-          if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")); } catch (_e) { data = {}; } }
+          // Merge base = LIVE durable dataset (not the possibly-stale local file),
+          // so concurrent writes from the bot / other sessions are preserved.
+          const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
+          try {
+            const r = await fetch("https://huggingface.co/datasets/bep40/vaistudio-data/resolve/main/customers.json", {
+              headers: token ? { Authorization: "Bearer " + token } : {},
+              signal: AbortSignal.timeout(6000),
+            });
+            if (r.ok) {
+              const raw = await r.text();
+              if (raw && raw.trim()) { try { data = JSON.parse(raw); } catch (_e) {} }
+            }
+          } catch (_e) {}
+          if (!data || typeof data !== "object" || !Object.keys(data).length) {
+            if (existsSync(f)) { try { data = JSON.parse(readFileSync(f, "utf-8")); } catch (_e) { data = {}; } }
+          }
           if (!data || typeof data !== "object") data = {};
 
           let changed = 0;
@@ -1401,14 +1446,16 @@ const server = Bun.serve({
           if (!changed) return Response.json({ error: "No valid customers" }, { status: 400 });
 
           const content = JSON.stringify(data, null, 2);
-          const token = (process.env.HF_INFERENCE_TOKEN || process.env.HF_TOKEN || "").trim();
           if (!token) return Response.json({ error: "No write token on server" }, { status: 500 });
 
+          // Commit to the durable DATASET — NOT the Space repo — so saving a
+          // customer / CK never triggers a vai-avatar2 rebuild (the old commit
+          // rebuilt the Space on every save and concurrent writers lost data).
           const payload = [
-            { key: "header", value: { summary: "Update customers via api", repo: { type: "space", id: "bep40/vai-avatar2" } } },
+            { key: "header", value: { summary: "Update customers via api", repo: { type: "dataset", id: "bep40/vaistudio-data" } } },
             { key: "file", value: { path: "customers.json", content } },
           ].map((x) => JSON.stringify(x)).join("\n");
-          const commit = await fetch("https://huggingface.co/api/spaces/bep40/vai-avatar2/commit/main", {
+          const commit = await fetch("https://huggingface.co/api/datasets/bep40/vaistudio-data/commit/main", {
             method: "POST",
             headers: { Authorization: "Bearer " + token, "Content-Type": "application/x-ndjson" },
             body: payload,
@@ -1417,10 +1464,8 @@ const server = Bun.serve({
             const errText = await commit.text().catch(() => "");
             return Response.json({ error: "Commit failed: HTTP " + commit.status + " " + errText.slice(0, 300) }, { status: 502 });
           }
-          // Persist locally too — without this, the live GET keeps returning the
-          // stale /app/customers.json until the Space rebuilds (rebuilds are slow
-          // and a write shouldn't depend on one). Keep local file in sync so
-          // subsequent GET /api/customers reflect the save immediately.
+          // Persist locally too so the live GET keeps reflecting the save
+          // immediately (no rebuild dependency).
           try { writeFileSync(f, content); } catch (_e) {}
           return Response.json({ ok: true, updated: changed, customers: data });
         } catch (e: any) {