@uniweb/build 0.22.0 → 0.24.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/build",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Build tooling for the Uniweb Component Web Platform",
   "type": "module",
   "exports": {
@@ -59,16 +59,16 @@
     "js-yaml": "^4.1.0",
     "sharp": "^0.35.3",
     "yaml": "^2.5.0",
-    "@uniweb/projections": "^0.3.1",
-    "@uniweb/content-writer": "^0.3.3",
     "@uniweb/theming": "^0.1.15",
+    "@uniweb/content-writer": "^0.3.3",
+    "@uniweb/projections": "^0.3.3",
     "@uniweb/schemas": "^0.2.10"
   },
   "optionalDependencies": {
-    "@uniweb/content-reader": "^1.2.2",
+    "@uniweb/runtime": "^0.12.0",
+    "@uniweb/semantic-parser": "^1.2.2",
     "@uniweb/schemas": "^0.2.10",
-    "@uniweb/runtime": "^0.11.7",
-    "@uniweb/semantic-parser": "^1.2.2"
+    "@uniweb/content-reader": "^1.2.2"
   },
   "peerDependencies": {
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0",
@@ -77,7 +77,7 @@
     "@tailwindcss/vite": "^4.0.0",
     "@vitejs/plugin-react": "^4.0.0 || ^5.0.0",
     "vite-plugin-svgr": "^4.0.0",
-    "@uniweb/core": "^0.8.5"
+    "@uniweb/core": "^0.10.0"
   },
   "peerDependenciesMeta": {
     "vite": {

package/src/uwx/site-project.js

@@ -110,12 +110,27 @@ const INFO_TO_SITE_YML = {
   // through `config.services` and resolved at render time, so it never enters
   // `info` and a pull cannot launder it into authored config.
   //
-  // ⚠️ One asymmetry worth knowing: push STRIPS credential-shaped keys, so a
-  // block that carried an `apiKey` comes back without it and the pull rewrites
-  // the author's file minus that line. That is intended — the key must not be
-  // there and the push already warned — but it is the one case where a pull
-  // removes something the author typed.
+  // ⚠️ Credential-shaped keys are STRIPPED ON PUSH (`stripCredentials`), so the
+  // backend never stores one and it cannot come back. What that does to the
+  // author's file depends on which direction they are pulling into, and the two
+  // differ — ⛔ this comment asserted the wrong one until it was run:
+  //
+  //   - `pull` over an EXISTING site.yml — the local `apiKey` SURVIVES.
+  //     `mergeYamlConfig` spreads one level (`{...existing[key], ...value}`), so
+  //     the projected `{endpoint, …}` merges over the local block and nothing
+  //     removes a key the document does not carry.
+  //   - `clone` into a fresh directory — no local block exists, so the file is
+  //     written from the document alone and has no `apiKey`.
+  //
+  // Both are correct: a pull does not silently delete something the author
+  // typed, and the push already warned them. The security property is upheld at
+  // the push, not by the pull. Measured end-to-end against a live uniwebd —
+  // every unit test passed before and after, so only a real push touched it.
   assistant: 'assistant',
+  // Authored-only, like `submit` and `assistant`: a host's tracking endpoint is
+  // offered through `config.services.tracking` and resolved at render, so it
+  // never enters `info` and a pull cannot launder it into authored config.
+  tracking: 'tracking',
   paths: 'paths',
   data: 'data',
   template: 'template',

package/src/uwx/site.js

@@ -761,6 +761,20 @@ export async function siteProjectToDocument(siteRoot, opts = {}) {
   //
   // ⛔ Credentials are stripped, not trusted — see `stripCredentials`.
   setIf(info, 'assistant', stripCredentials(siteYml.assistant, 'assistant'))
+  // `tracking` — where this site's usage events go (`endpoint`, read by the
+  // runtime through `resolveService`, plus `consent:`). Same family as
+  // `search`/`submit`/`assistant` and here for the same reason: the bundle lane
+  // spreads all of site.yml while this one is an allowlist, so without this line
+  // an authored `tracking:` works on a static host and vanishes silently on the
+  // synced lane.
+  //
+  // ⛔ Credentials stripped like `assistant`. A collector that wants a write key
+  // is a real shape, and this block is published world-readable — but note the
+  // strip only reaches a KEYED FIELD: a key embedded in the endpoint URL itself
+  // (`https://collector/e?key=…`) is invisible here and is disclosed. The host's
+  // secret store is the only right home either way.
+  // (kb/framework/plans/tracking.md)
+  setIf(info, 'tracking', stripCredentials(siteYml.tracking, 'tracking'))
   setIf(info, 'paths', siteYml.paths)
   setIf(info, 'data', siteYml.data ?? siteYml.fetch)
   // `app` — the deployment's `@uniweb/app-spec` reference (a bare uuid string),