@uniweb/build 0.24.3 → 0.24.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/build",
-  "version": "0.24.3",
+  "version": "0.24.5",
   "description": "Build tooling for the Uniweb Component Web Platform",
   "type": "module",
   "exports": {
@@ -60,16 +60,16 @@
     "sharp": "^0.35.3",
     "yaml": "^2.5.0",
     "@uniweb/schemas": "^0.2.10",
-    "@uniweb/semantic-parser": "^1.2.3",
-    "@uniweb/theming": "^0.1.15",
     "@uniweb/content-writer": "^0.3.3",
-    "@uniweb/projections": "^0.3.3"
+    "@uniweb/projections": "^0.3.3",
+    "@uniweb/semantic-parser": "^1.2.3",
+    "@uniweb/theming": "^0.1.15"
   },
   "optionalDependencies": {
+    "@uniweb/content-reader": "^1.2.3",
     "@uniweb/schemas": "^0.2.10",
-    "@uniweb/semantic-parser": "^1.2.3",
     "@uniweb/runtime": "^0.12.2",
-    "@uniweb/content-reader": "^1.2.3"
+    "@uniweb/semantic-parser": "^1.2.3"
   },
   "peerDependencies": {
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0",

package/src/uwx/site-project.js

@@ -90,6 +90,22 @@ function placeByUuid(ctx, uuid, targetAbs) {
 // most are identity; only `default_language` differs (the file key is camelCase
 // `defaultLanguage`).
 const INFO_TO_SITE_YML = {
+  // ⛔ `foundation` is the one entry a caller may SUPPRESS (`keepAuthoredFoundation`),
+  // and it is the same principle as restoring authored asset paths below: a round
+  // trip must not mangle what the author wrote.
+  //
+  // The stored value is not always what they wrote. `publish` stamps the RELEASED,
+  // version-pinned ref over it, because delivery is version-pinned end to end. Project
+  // that straight back into a workspace project and `foundation: src` becomes
+  // `@org/x@1.2.3` — which `detectFoundationType` REFUSES for a build (a build is
+  // offline and does not guess where a foundation is served), so the project can no
+  // longer `build`, `dev` or `export`. Measured 2026-08-19.
+  //
+  // ⚖️ It is NOT wrong everywhere, which is why this is a caller's decision and not a
+  // deletion: a project from `uniweb clone` has no local foundation on disk, and there
+  // the pinned ref is exactly what site.yml should say. Only the caller knows which
+  // shape it is writing into — and it needs the build's own resolver to know, which is
+  // why that check is not made here (it would drag the vite chain into `uwx/`).
   foundation: 'foundation',
   languages: 'languages',
   default_language: 'defaultLanguage',
@@ -152,7 +168,7 @@ const INFO_TO_SITE_YML = {
  * @returns {{ siteConfig: string, theme?: string, headHtml?: string }} per-file
  *          write status ('updated' | 'unchanged')
  */
-export function siteInfoToConfig({ document, siteRoot, sourceLocale = LOCALIZED_FIELD_ASSUMPTION.defaultSourceLocale, collector }) {
+export function siteInfoToConfig({ document, siteRoot, sourceLocale = LOCALIZED_FIELD_ASSUMPTION.defaultSourceLocale, collector, keepAuthoredFoundation = false }) {
   const info = document?.info || {}
 
   const siteChanges = {}
@@ -173,6 +189,7 @@ export function siteInfoToConfig({ document, siteRoot, sourceLocale = LOCALIZED_
 
   // Verbatim fields (includes `seo` — the site-level social/SEO block).
   for (const [infoKey, ymlKey] of Object.entries(INFO_TO_SITE_YML)) {
+    if (infoKey === 'foundation' && keepAuthoredFoundation) continue
     if (info[infoKey] !== undefined) siteChanges[ymlKey] = info[infoKey]
   }
 
@@ -626,7 +643,7 @@ function projectLayout(layoutSections, layoutBaseDir, report, prune, ctx) {
  *        empty set.
  * @returns {{ config: object, collections: object, locales: object, pages: string[], sections: string[], layout: string[], deleted: string[], renamed: object[] }}
  */
-export function siteContentDocumentToProject({ document, siteRoot, sourceLocale = LOCALIZED_FIELD_ASSUMPTION.defaultSourceLocale, prune = false }) {
+export function siteContentDocumentToProject({ document, siteRoot, sourceLocale = LOCALIZED_FIELD_ASSUMPTION.defaultSourceLocale, prune = false, keepAuthoredFoundation = false }) {
   const report = { config: null, collections: null, locales: null, assets: null, pages: [], sections: [], layout: [], deleted: [], renamed: [] }
 
   // Collects target-locale translations of localized scalars as they're projected;
@@ -640,7 +657,7 @@ export function siteContentDocumentToProject({ document, siteRoot, sourceLocale
   // round trip that changed nothing.
   report.assets = restoreAssetRefs(document, readAssetMap(siteRoot))
 
-  report.config = siteInfoToConfig({ document, siteRoot, sourceLocale, collector })
+  report.config = siteInfoToConfig({ document, siteRoot, sourceLocale, collector, keepAuthoredFoundation })
   report.collections = declarationsToCollectionsYml({ document, siteRoot })
 
   // The uuid identity index (gitignored `.uniweb/`): read the prior map to anchor

package/src/uwx/sync-package.js

@@ -237,11 +237,16 @@ function rewriteEntityAssets(node, map, ids) {
  *   siteContent: { buffer, entityCount, index, models }|null,
  *   collections: { buffer, entityCount, index, models }|null,
  *   hashes: Object<string,string>, warnings: string[], skipped: number,
- *   schemaless: Array<{name: string, model: string}>, localAssets: string[] }>}
+ *   schemaless: Array<{name: string, model: string}>, localAssets: string[],
+ *   applied: object }>}
  *   `schemaless` lists collections that resolved no data schema (soft-skipped from
  *   the sync) — the composite deploy delivers these statically via the data ball.
  *   `localAssets` lists the site-root local media refs (`/images/x.png`) the deploy
  *   must upload + rewrite to serve URLs; co-located refs are warned and skipped.
+ *   `applied` echoes the hash-affecting injections this emit actually used
+ *   (`assetRewrite` / `assetIds` / `injectInfo` / `injectExtensions`), ready to be
+ *   passed straight back as opts. A caller that banks the `hashes` must bank this
+ *   beside them, or an offline re-emit cannot reproduce the document they describe.
  *   Each lane is null when it has nothing to push. The collections `index` keeps a
  *   leading `{ kind: 'folder' }` placeholder (submission position 0 → the folder
  *   entity) so record back-fill stays positionally aligned; the folder itself has no
@@ -275,8 +280,10 @@ export async function emitSyncPackages(siteRoot, opts = {}) {
   // stamped here — NOT authored in site.yml, so they ride the wire but never project
   // back on pull (the `info.assets` precedent). They are part of the hashed content,
   // so a changed bundle URL correctly re-fires the site-content lane.
-  if (siteDoc && opts.injectInfo && typeof opts.injectInfo === 'object') {
-    siteDoc.info = { ...siteDoc.info, ...opts.injectInfo }
+  const injectInfo =
+    opts.injectInfo && typeof opts.injectInfo === 'object' ? opts.injectInfo : null
+  if (siteDoc && injectInfo) {
+    siteDoc.info = { ...siteDoc.info, ...injectInfo }
   }
   // Same idea one level out: `extensions` is a sibling of `info`, not a field in
   // it, so a pinned extension ref cannot ride `injectInfo`. `publish` releases a
@@ -285,9 +292,13 @@ export async function emitSyncPackages(siteRoot, opts = {}) {
   // for the same reason: delivery is version-pinned, so an unpinned local name on
   // the wire points at code the host cannot serve. Keyed by `$id` (the authored
   // declaration), so entries the publish didn't touch are left verbatim.
-  if (siteDoc && opts.injectExtensions && Array.isArray(siteDoc.extensions)) {
+  const injectExtensions =
+    opts.injectExtensions && typeof opts.injectExtensions === 'object'
+      ? opts.injectExtensions
+      : null
+  if (siteDoc && injectExtensions && Array.isArray(siteDoc.extensions)) {
     siteDoc.extensions = siteDoc.extensions.map((e) => {
-      const pinned = opts.injectExtensions[e?.$id]
+      const pinned = injectExtensions[e?.$id]
       if (!pinned) return e
       const { url: _dropped, ...rest } = e
       return { ...rest, ref: pinned }
@@ -402,9 +413,33 @@ export async function emitSyncPackages(siteRoot, opts = {}) {
   // the content lane by its presence/absence.
   const siteContentUuid = siteDoc?.$uuid
 
+  // ⛔ EVERY INJECTION ABOVE IS PART OF THE HASHED DOCUMENT — so a reader that
+  // cannot reproduce them cannot compare against the hashes a push banked.
+  //
+  // `uniweb status` is exactly such a reader: it re-emits OFFLINE, and both an asset
+  // serve URL and a pinned foundation ref are things only a backend round-trip can
+  // produce. Left implicit, it reports every entity as changed FOREVER — measured
+  // 2026-08-19 on a site with one `/images/*.svg` reference, where push banked the
+  // rewritten hash, status re-hashed the authored one, and `changed` never dropped
+  // below 1 no matter how many times you pushed. `push.js` had already written the
+  // rule down for its own two emits ("or every entity reads as changed forever") and
+  // the third reader of the same cache never got it.
+  //
+  // ⭐ So the EMITTER reports what it applied, the pusher banks it beside the hashes,
+  // and the offline reader replays it. Reporting it here rather than having each
+  // caller remember to pass its own injections along is the whole point: what gets
+  // banked is then, by construction, what was hashed. A future injection is covered
+  // by adding one line here — not by finding every reader.
+  const applied = {
+    ...(assetRewrite ? { assetRewrite } : {}),
+    ...(assetIds ? { assetIds } : {}),
+    ...(injectInfo ? { injectInfo } : {}),
+    ...(injectExtensions ? { injectExtensions } : {})
+  }
+
   return {
     siteContent, collections, siteContentUuid, hashes, warnings, skipped,
-    schemaless: col.schemaless, localAssets,
+    schemaless: col.schemaless, localAssets, applied,
     // { stamped, unknown } when identity was applied; null when the caller passed
     // no map. `unknown > 0` with `stamped === 0` on a site that has been pushed
     // before is the index-loss signature the backend refuses — the caller reports it.