@uniweb/build 0.77.0 → 0.79.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/build",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": "Build tooling for the Uniweb Component Web Platform",
   "type": "module",
   "exports": {
@@ -57,15 +57,15 @@
     "js-yaml": "^4.1.0",
     "sharp": "^0.35.3",
     "yaml": "^2.5.0",
+    "@uniweb/projections": "^0.7.15",
+    "@uniweb/content-writer": "^0.3.4",
     "@uniweb/semantic-parser": "^1.5.1",
-    "@uniweb/theming": "^0.2.0",
-    "@uniweb/schemas": "^0.12.0",
+    "@uniweb/schemas": "^0.13.0",
     "@uniweb/content-reader": "^1.2.8",
-    "@uniweb/projections": "^0.7.14",
-    "@uniweb/content-writer": "^0.3.4"
+    "@uniweb/theming": "^0.2.0"
   },
   "optionalDependencies": {
-    "@uniweb/runtime": "^0.29.2"
+    "@uniweb/runtime": "^0.29.3"
   },
   "peerDependencies": {
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0",
@@ -74,8 +74,8 @@
     "@tailwindcss/vite": "^4.0.0",
     "@vitejs/plugin-react": "^4.0.0 || ^5.0.0",
     "vite-plugin-svgr": "^4.0.0",
-    "@uniweb/core": "^0.37.2",
-    "@uniweb/runtime": "^0.29.2"
+    "@uniweb/runtime": "^0.29.3",
+    "@uniweb/core": "^0.38.0"
   },
   "peerDependenciesMeta": {
     "vite": {

package/src/content/index.js

@@ -19,7 +19,6 @@ export { collectSiteContent } from '../site/content-collector.js'
 export {
   processQueries,
   writeQueryFiles,
-  getQueryLastModified,
 } from '../site/query-processor.js'
 // Where a site's records live — `paths.records`, else `records/` — so a caller
 // holding its own config (a document's, not a `site.yml`) asks the one resolver.

package/src/dev/api-mount.js

@@ -4,20 +4,37 @@ import { pathToFileURL } from 'node:url'
 import yaml from 'js-yaml'
 import { YAML_OPTIONS } from '../utils/yaml-schema.js'
 
+/**
+ * Where `uniweb dev` answers the site's `backend` service when `$devBackend` names a handler.
+ * The dev server is the host here, so the address is its own.
+ */
+export const DEV_API_ADDRESS = '/_api'
+
 /**
  * Mount a site's own request handler in the dev server.
  *
  * A site that talks to a backend needs one running to be developed against, and
  * making that a live deployment is slow, costs money, and puts a shared database
- * behind a developer's experiments. So a site may name a **local handler** and the
- * dev server mounts it at the site's own service address:
+ * behind a developer's experiments. So a site may name a **local handler**, and in
+ * `uniweb dev` the dev server answers the site's `backend` service with it:
  *
  * ```yaml
  * # site.yml
- * api: /_api                 # where the site's app backend answers
- * devApi: ./mock/api.js      # what answers it, in development only
+ * services:
+ *   backend: true              # ask your host for it (in production)
+ * $devBackend: ./mock/api.js   # what answers it in `uniweb dev`, at /_api
  * ```
  *
+ * ⭐ THE DEV SERVER SUPPLIES THE ADDRESS [Diego, 2026-10-06]. In `uniweb dev` it is
+ * the host, so where it answers is its own to choose — `DEV_API_ADDRESS` — and the
+ * plugin puts that address in the dev payload's `config.backend`, the site tier
+ * `resolveService` reads when no host speaks. ⛔ *Until then the site wrote it, as a
+ * top-level `api: /_api` "the same in development and in production" — an address
+ * that, under `services:`, would read as "the site brings its own backend" and ask the
+ * host to turn its own off.* ⛔ *And until 2026-10-07 the service was `api` and this
+ * key `$devApi`; both are refused by those names now — `services.api` by
+ * `refuseUnreadableServices`, `$devApi` by `refuseRetiredServiceKeys`.*
+ *
  * ```js
  * // mock/api.js — default-export a fetch handler
  * export default (request) => new Response('{}', { headers: { 'content-type': 'application/json' } })
@@ -35,10 +52,9 @@ import { YAML_OPTIONS } from '../utils/yaml-schema.js'
  *
  * ## ⛔ Development only, and it cannot leak
  *
- * `devApi` is read by the dev plugin and by nothing else: no build reads it, no
- * `info` key carries it, and nothing writes it into a payload. A site's *address*
- * (`api:`) is authored config and travels; what answers that address locally is a
- * fact about one machine.
+ * `$devBackend` is read by the dev plugin and by nothing else: no build reads it, no
+ * `info` key carries it, and only the dev server's payload names its address. What
+ * answers the site's `backend` service locally is a fact about one machine.
  *
  * ⚠️ **Same-origin on purpose.** Mounting inside the dev server means cookies and
  * `credentials: 'same-origin'` behave as they do in production, where a site's app
@@ -59,7 +75,7 @@ import { YAML_OPTIONS } from '../utils/yaml-schema.js'
  * @param {import('vite').ViteDevServer} server
  * @param {object} options
  * @param {string} options.root - the site directory
- * @returns {boolean} whether a handler was mounted
+ * @returns {string|null} the address the handler answers on, or null when none was mounted
  */
 export function mountDevApi(server, { root }) {
   // ⛔ Read from the RAW site.yml, never from the collected `config`. `$`-prefixed
@@ -70,18 +86,12 @@ export function mountDevApi(server, { root }) {
   try {
     site = yaml.load(readFileSync(join(root, 'site.yml'), 'utf8'), YAML_OPTIONS) || {}
   } catch {
-    return false
+    return null
   }
 
-  const spec = site.$devApi
-  if (!spec) return false
-
-  const declared = site.api
-  const mount = typeof declared === 'string' ? declared : declared?.endpoint
-  if (!mount) {
-    console.error("[dev-api] `$devApi` needs an `api:` address to answer on — add `api: /_api` to site.yml.")
-    return false
-  }
+  const spec = site.$devBackend
+  if (!spec) return null
+  const mount = DEV_API_ADDRESS
 
   // Loaded once, lazily, and awaited by the middleware. ⚠️ Loud and specific on
   // failure: a dev API that silently fails to load looks exactly like a backend
@@ -139,5 +149,5 @@ export function mountDevApi(server, { root }) {
   })
 
   console.log(`[dev-api] '${spec}' answering ${prefix}/*`)
-  return true
+  return mount
 }

package/src/foundation/derive-supports.js

@@ -75,9 +75,10 @@
  *
  * ⚠️ `@uniweb/api` deliberately needs no entry: it calls
  * `resolveService(website, SERVICE_NAME)` against a module-level `const`, which
- * `readModuleConsts` resolves. Without that resolution `api` would be both
+ * `readModuleConsts` resolves. Without that resolution `backend` would be both
  * missed *and* counted as blindness, marking every foundation that uses it
- * unknowable.
+ * unknowable. ⛔ *The constant was `api` until 2026-10-07, so a foundation built
+ * against an earlier `@uniweb/api` derives `api` — a service no host offers now.*
  *
  * ## Why the AST rather than a regex
  *

package/src/resolve-data-schema.js

@@ -161,7 +161,8 @@ export function collectSchemaRefs(components, foundationData = null) {
   const readData = (data) => {
     if (!data || typeof data !== 'object' || data === false) return
     for (const binding of Object.values(data)) {
-      // `'@std/article/*'` asks for whole records of `@std/article` — the ref is what precedes it.
+      // A ref, short or long (`{ schema, single, whole }`) — the flags change nothing about which
+      // schema the key is typed by.
       const { ref } = dataRefOf(binding)
       if (ref) refs.add(ref)
     }

package/src/runtime-schema.js

@@ -5,8 +5,9 @@
  * reads to render, and nothing else:
  *
  * - background: 'self' when component handles its own background
- * - data: { <key>: <schema ref> | null } — every `content.data` key the component
- *     declares, in order, with its schema ref (null for an inline shape)
+ * - data: { <key>: <schema ref> | { schema, single?, whole? } | null } — every `content.data`
+ *     key the component declares, in order, with its schema ref and the flags set on it (null for
+ *     an inline shape)
  * - vars: { <name>: { default? } } — the CSS variables the component declares
  * - defaults: param default values
  * - context: static capabilities for cross-block coordination
@@ -34,17 +35,34 @@
  */
 
 import { lowerData } from '@uniweb/schemas/content'
+import { schemaDeclarationOf } from '@uniweb/schemas/foundation'
 
 /**
- * A `data:` entry's schema ref — a ref string, or `{ schema }` — or null for an inline
- * shape, which names no schema and is filled only under its own key.
+ * A `data:` entry as the runtime reads it: its schema ref, with the flags set on it — or null for an
+ * inline shape, which names no schema and is filled only under its own key.
  *
- * @param {string|Object} value
- * @returns {string|null}
+ * ⭐ Two flags, independent (ruled 2026-10-07 [Diego]): `single` — one record, not a list — and
+ * `whole` — each record as stored, not its brief.
+ * Lean on purpose: the bare ref when neither is set, which is most keys, and only a flag that is set.
+ * ⛔ Until 2026-10-07 this wrote the ref alone, so `{ schema, whole: true }` lost its flag here and
+ * only the `'…/*'` spelling, now retired, reached the runtime.
+ *
+ * @param {string} key - the key, for a refusal
+ * @param {*} value - its value, as authored
+ * @returns {string|{ schema: string, single?: true, whole?: true }|null}
+ * @throws {Error} for a retired or malformed declaration (`schemaDeclarationOf`)
  */
-function dataRef(value) {
-  if (typeof value === 'string') return value || null
-  return value && typeof value === 'object' && typeof value.schema === 'string' && value.schema ? value.schema : null
+function leanDataValue(key, value) {
+  let declaration
+  try {
+    declaration = schemaDeclarationOf(value)
+  } catch (err) {
+    throw new Error(`[uniweb] Invalid 'data.${key}': ${err.message}`)
+  }
+  if (!declaration || !declaration.schema) return null
+  const { schema, single, whole } = declaration
+  if (!single && !whole) return schema
+  return { schema, ...(single ? { single: true } : {}), ...(whole ? { whole: true } : {}) }
 }
 
 /**
@@ -148,7 +166,7 @@ export function extractRuntimeSchema(fullMeta) {
         )
       }
       runtime.data = runtime.data || {}
-      runtime.data[key] = dataRef(value)
+      runtime.data[key] = leanDataValue(key, value)
     }
   } else if (data !== undefined) {
     throw new Error(
@@ -337,12 +355,12 @@ function leanVars(vars) {
   return Object.keys(out).length > 0 ? out : null
 }
 
-/** A foundation's `data:` as a section type's lean `data` is: each key → its schema ref, or null. */
+/** A foundation's `data:` as a section type's lean `data` is: each key → its ref and flags, or null. */
 function leanDataKeys(data) {
   const lowered = lowerData(data)
   if (!lowered || typeof lowered !== 'object' || Array.isArray(lowered)) return null
   const out = {}
-  for (const [key, value] of Object.entries(lowered)) out[key] = dataRef(value)
+  for (const [key, value] of Object.entries(lowered)) out[key] = leanDataValue(key, value)
   return Object.keys(out).length > 0 ? out : null
 }
 

package/src/schema.js

@@ -18,7 +18,8 @@ import { join, dirname, extname, basename } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { describeChildren, describeVisuals, lowerChildren } from '@uniweb/schemas/component'
 import { describeContent, lowerData } from '@uniweb/schemas/content'
-import { normalizeData } from '@uniweb/schemas/foundation'
+import { normalizeData, schemaDeclarationOf } from '@uniweb/schemas/foundation'
+import { rootListSection } from '@uniweb/schemas/conform'
 import { SECTION_PARAMS, SECTION_KEYS } from '@uniweb/schemas/section'
 import { collectSchemaRefs, buildDataSchemaMap, ownSchemaRefs } from './resolve-data-schema.js'
 import {
@@ -26,6 +27,7 @@ import {
   deriveRecordsSupport,
   unnameableIn,
 } from './foundation/derive-supports.js'
+import { RENAMED_SERVICES } from './uwx/services-request.js'
 import { foundationNameOf, splitFoundationName } from './foundation-name.js'
 import { resolveFoundationSrcDir } from './utils/foundation-source-root.js'
 
@@ -635,12 +637,67 @@ function buildComponentEntry(name, relativePath, meta) {
   else delete entry.children
 
   if (meta.data !== undefined) entry.data = lowerData(meta.data)
+  refuseDataDeclarations(`${name} (meta.js)`, entry.data)
 
   const problems = [...content.problems, ...describeChildren(meta).problems]
   if (problems.length > 0) loweringProblems.set(entry, problems)
   return entry
 }
 
+/**
+ * Refuse a `data:` key typed by a schema that is not written as one: the retired `/*` suffix, a
+ * property of the long form other than `schema`, `single` and `whole`, or a flag that is not a
+ * boolean (`schemaDeclarationOf`; ruled 2026-10-07 [Diego]). A refusal, not a warning: the runtime would
+ * read a mistyped flag as absent, and deliver a list where the author asked for one record.
+ *
+ * @param {string} owner - who declares it, for the message
+ * @param {*} data - a `data:` map, lowered
+ */
+function refuseDataDeclarations(owner, data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return
+  for (const [key, value] of Object.entries(data)) {
+    try {
+      schemaDeclarationOf(value)
+    } catch (err) {
+      throw new Error(`[uniweb] ${owner}: data.${key}: ${err.message}`)
+    }
+  }
+}
+
+/**
+ * Refuse `single` or `whole` on a key whose schema is a LIST — `@std/nav`, `@std/form`: a schema
+ * whose root is one list section describes the key's whole value, so the key holds that list, and
+ * neither one record of it nor a record as stored means anything. Checked once the schemas resolve.
+ *
+ * @param {Array<[string, *]>} owners - `[who, data:]` pairs
+ * @param {Object} dataSchemas - normalized schemas by ref
+ * @param {string} srcDir - to resolve a ref no binding brought in (a layout's)
+ */
+async function refuseFlagsOnListSchemas(owners, dataSchemas, srcDir) {
+  for (const [owner, data] of owners) {
+    if (!data || typeof data !== 'object' || Array.isArray(data)) continue
+    for (const [key, value] of Object.entries(data)) {
+      const declaration = schemaDeclarationOf(value)
+      if (!declaration || (!declaration.single && !declaration.whole)) continue
+      let schema = dataSchemas[declaration.schema]
+      if (!schema) {
+        try {
+          schema = (await buildDataSchemaMap([declaration.schema], { srcDir }))[declaration.schema]
+        } catch {
+          schema = null // an unresolvable ref is reported where refs resolve
+        }
+      }
+      if (schema && rootListSection(schema)) {
+        const flags = ['single', 'whole'].filter((flag) => declaration[flag]).map((flag) => `\`${flag}\``).join(' and ')
+        throw new Error(
+          `[uniweb] ${owner}: data.${key}: ${declaration.schema} is a list — its key holds that list, so ${flags} ` +
+            `does not apply. Write data.${key}: '${declaration.schema}'.`
+        )
+      }
+    }
+  }
+}
+
 /** `content: {}` or `content: []` — the component's way of saying it takes no content. */
 function declaresNoContent(content) {
   if (Array.isArray(content)) return content.length === 0
@@ -954,6 +1011,29 @@ export async function discoverComponents(srcDir, sectionPaths = DEFAULT_SECTION_
   return sections
 }
 
+/**
+ * Stop on a service `uniweb.supports` names by its old name (`RENAMED_SERVICES`), as
+ * `site.yml::services` does. A foundation claiming `api` claims a service no host offers
+ * now — and the build derives `backend` from the code itself, through kit's and
+ * `@uniweb/api`'s literals, so a renamed claim could only ever disagree with it.
+ *
+ * ⛔ Before the dev-rebuild bail, like `reportSupports`' warning: dev is where the
+ * developer is working.
+ *
+ * @param {string} srcDir
+ * @param {string[]|undefined} authored - normalized `uniweb.supports`
+ * @throws {Error} naming each old name and the new one
+ */
+function refuseRenamedSupports(srcDir, authored) {
+  const renamed = (authored || []).filter((s) => RENAMED_SERVICES[s])
+  if (!renamed.length) return
+  throw new Error(
+    `${srcDir}/package.json: \`uniweb.supports\` names ${renamed.map((s) => `\`${s}\``).join(', ')}, which is now ` +
+      `${renamed.map((s) => `\`${RENAMED_SERVICES[s]}\``).join(', ')} — the site's own backend is the \`backend\` ` +
+      'service. Rename it in package.json.',
+  )
+}
+
 /**
  * Say what the derivation added, at the one moment the developer is looking.
  *
@@ -1138,6 +1218,8 @@ export async function buildSchema(srcDir, sectionPaths, derivedSupports = null)
   // Load configuration from foundation.js
   const foundationConfig = await loadFoundationConfig(srcDir)
 
+  refuseDataDeclarations('the foundation (main.js)', lowerData(foundationConfig.data))
+
   // Discover section types
   const components = await discoverComponents(srcDir, sectionPaths)
   reportPlacementDeclarations(components)
@@ -1154,6 +1236,15 @@ export async function buildSchema(srcDir, sectionPaths, derivedSupports = null)
 
   // Discover layouts from src/layouts/
   const layouts = await discoverLayoutsInPath(srcDir)
+  await refuseFlagsOnListSchemas(
+    [
+      ...Object.entries(components).map(([name, entry]) => [`${name} (meta.js)`, entry?.data]),
+      ...Object.entries(layouts).map(([name, entry]) => [`layout ${name} (meta.js)`, entry?.data]),
+      ['the foundation (main.js)', lowerData(foundationConfig.data)],
+    ],
+    dataSchemas,
+    srcDir,
+  )
   reportUnregistrableData(components, layouts, foundationConfig)
 
   // Determine extension role
@@ -1188,6 +1279,7 @@ export async function buildSchema(srcDir, sectionPaths, derivedSupports = null)
   // `supports` differs from the one a real build produces is a trap rather than a
   // convenience — the artifact would disagree with itself depending on which
   // command wrote it. One rule: the derivation runs on a real build.
+  refuseRenamedSupports(srcDir, identity.supports)
   const derived = derivedSupports && {
     ...derivedSupports,
     services: deriveRecordsSupport(components, foundationConfig.data)

package/src/site/content-collector.js

@@ -41,6 +41,7 @@ import { resolveDefaultLocale, resolvePublishableLocales, validateLanguageConfig
 import { authoredRedirectTarget } from '@uniweb/core/resolve-route'
 import { parseFrontmatter } from '../utils/frontmatter.js'
 import { parseGrid } from '@uniweb/schemas/grid'
+import { runtimeServicesConfig, refuseRetiredServiceKeys, refuseUnreadableServices } from '../uwx/services-request.js'
 
 // Try to import content-reader, fall back to simplified parser
 let markdownToProseMirror
@@ -2448,11 +2449,13 @@ async function collectLayouts(layoutDir, siteRoot) {
  * `config.fetch`, desugared by the caller; carried raw it would sit beside
  * `config.queries`, the declarations, and read as one.
  *
- * ⛔ `services` is the owner's REQUEST to their host (`uwx/services-request.js`), and
- * here it would land at `config.services` — the HOST tier, where a present block
- * declines every service it does not name. A request is never an answer, so it never
- * ships. *(Until 2026-10-06 it did, and doubled as an undocumented way to simulate a
- * host's offer locally.)*
+ * ⭐ `services` ships as each service's SITE TIER, `config.<name>`
+ * (`runtimeServicesConfig`), and never whole: at `config.services` it would be the HOST
+ * tier, where a present block declines every service it does not name, and its
+ * request half is not an answer. *(Until 2026-10-06 the whole block shipped there, and
+ * doubled as an undocumented way to simulate a host's offer locally; the site tier was
+ * the top-level `search:` / `submit:` / `assistant:` / `tracking:` / `api:` keys,
+ * refused now.)*
  *
  * ⛔ `$`-prefixed keys were the project's BACKEND-SCOPED state — `$uuid`, `$org`,
  * `$backend`, `$services`, `$secrets` — until they moved to `sync.json` (2026-09-20),
@@ -2470,12 +2473,22 @@ function payloadSiteConfig(siteConfig) {
   const {
     publishLanguages: _publishLanguages,
     query: _query,
-    services: _services,
+    services,
     ...runtimeSiteConfig
   } = siteConfig
   for (const key of Object.keys(runtimeSiteConfig)) {
     if (key.startsWith('$')) delete runtimeSiteConfig[key]
   }
+  // ⭐ Each service's SITE TIER, from its entry: `config.<name>` — the switch, an
+  // address the site brings, its options — never the request, and never a credential.
+  const warn = (m) => console.warn(`[site-content] ${m}`)
+  for (const [name, value] of Object.entries(runtimeServicesConfig(services, { warn }))) {
+    if (name in runtimeSiteConfig) {
+      warn(`\`services.${name}\` names a site.yml key that is not a service — ignoring it.`)
+      continue
+    }
+    runtimeSiteConfig[name] = value
+  }
   return runtimeSiteConfig
 }
 
@@ -2489,6 +2502,8 @@ export async function collectSiteContent(sitePath, options = {}) {
 
   // Read site config and raw theme config
   const siteConfig = await readYamlFile(join(sitePath, configFile))
+  refuseRetiredServiceKeys(siteConfig, configFile)
+  refuseUnreadableServices(siteConfig, configFile)
 
   // Queries are declared in TWO files — `site.yml::queries` and `queries.yml`,
   // the latter winning per key — and resolving them is one question with one

package/src/site/data-fetcher.js

@@ -203,6 +203,24 @@ export function refuseUnder(where, context) {
   walk(where)
 }
 
+/**
+ * ⛔ `filter:` IS RETIRED (2026-10-06 [Diego]: "it should not be supported. We don't need to keep
+ * legacy concepts around") — refused on a query and on a fetch. It was the string predicate
+ * (`tags contains featured`) that `where:` replaced. A fetch has not read it since 2026-09-05; a
+ * query carried it into `config.queries` and applied it nowhere, so a query that said `filter:`
+ * delivered every record with nothing said (measured 2026-10-06).
+ *
+ * @param {Object|undefined} declaration - a query declaration or a binding
+ * @param {string} context - where it sits, for the message
+ */
+export function refuseFilter(declaration, context) {
+  if (!declaration || typeof declaration !== 'object' || declaration.filter === undefined) return
+  throw new Error(
+    `[uniweb] ${context}: \`filter:\` is retired. Write the predicate as \`where:\`, a where-object — ` +
+      `e.g. \`where: { tags: { contains: featured } }\`.`
+  )
+}
+
 /**
  * ⛔ A `where` OUTSIDE THE LANGUAGE STOPS THE BUILD — a retired operator (`like`,
  * `nin`), an unknown one, an empty `and` / `or`, a text operator with an empty
@@ -340,6 +358,7 @@ export function refuseBinding(fetch, context, { level = null } = {}) {
   if (typeof fetch !== 'object' || Array.isArray(fetch)) return
   refuseRefineAndMisplacedCurrent(fetch, context, level)
   refuseMerge(fetch, context)
+  refuseFilter(fetch, context)
   refuseSourceKeys(fetch, context)
   if (fetch.collection === undefined) refuseQueryName(fetch.query, context, { object: true })
   refuseUnder(fetch.where, context)

package/src/site/deploy-config-writer.js

@@ -7,8 +7,10 @@
  * must not destroy a developer's comments on the targets:/saveDeploys:
  * regions of the file.
  *
- * This is the only place in @uniweb/build that depends on `yaml`. The
- * loader (deploy-config.js) stays on js-yaml for read-only ingestion.
+ * The loader (deploy-config.js) stays on js-yaml for read-only ingestion.
+ * ⚠️ This read "the only place in @uniweb/build that depends on `yaml`" until
+ * 2026-10-07; the pull's config writers locate entries with it too
+ * (`uwx/yaml-edit.js::editYamlText`), and print with js-yaml.
  *
  * `saveDeploys: false` (or `--no-save`) makes this a no-op; otherwise it
  * touches ONLY deploys.<targetName> — plus targets.<targetName> when the file has no

package/src/site/index.js

@@ -41,8 +41,7 @@ export {
 } from './advanced-processors.js'
 export {
   processQueries,
-  writeQueryFiles,
-  getQueryLastModified
+  writeQueryFiles
 } from './query-processor.js'
 export { collectSchemalessData, collectSchemalessDataAssets, rewriteSchemalessDataAssets } from './schemaless-data.js'
 export {

package/src/site/plugin.js

@@ -655,6 +655,18 @@ export function siteContentPlugin(options = {}) {
   }
 
   let siteContent = null
+  // Where `uniweb dev` answers the site's `backend` service with `$devBackend`'s handler — set
+  // in `configureServer`, so never in a build.
+  let devApiAddress = null
+  /**
+   * The dev payload names `$devBackend`'s address as the site's `backend` service: the site
+   * tier, which `resolveService` reads when no host speaks. A build never gets here
+   * with one.
+   */
+  const withDevApi = (content) => {
+    if (devApiAddress && content?.config) content.config.backend = devApiAddress
+    return content
+  }
   // What each section type declares its data blocks are — read once per collection of the site.
   let dataModelPromise = null
   const dataModels = () => (dataModelPromise ||= dataBlockModels(resolvedSitePath).catch(() => NO_DATA_MODELS))
@@ -955,7 +967,7 @@ export function siteContentPlugin(options = {}) {
         // pages stay in the graph so in-progress drafts remain previewable.
         // strict on a production build: a mount that contributes no pages is a
         // warning while you author and a broken deploy once you ship.
-        siteContent = await collectForBundle(resolvedSitePath, { foundationPath, dropUnpublished: isProduction, base: basePath, strict: isProduction })
+        siteContent = withDevApi(await collectForBundle(resolvedSitePath, { foundationPath, dropUnpublished: isProduction, base: basePath, strict: isProduction }))
         dataModelPromise = null
         headHtml = await loadHeadHtml()
         console.log(`[site-content] Collected ${siteContent.pages?.length || 0} pages`)
@@ -997,14 +1009,15 @@ export function siteContentPlugin(options = {}) {
     configureServer(devServer) {
       server = devServer
 
-      // A site's own backend, answered locally in development. `site.yml::$devApi`
-      // names a module that default-exports a fetch handler, mounted at the site's
-      // own `api:` address so the address is identical in dev and in production.
+      // A site's own backend, answered locally in development. `site.yml::$devBackend`
+      // names a module that default-exports a fetch handler; the dev server mounts it
+      // at an address of its own and names that address in the payload it serves
+      // (`withDevApi`), so the site's `backend` service resolves to it.
       // ⚠️ Synchronous on purpose — see mountDevApi. An await here and the
       // middleware lands after Vite's SPA fallback, which answers the API with
       // index.html and says nothing about why.
       try {
-        mountDevApi(devServer, { root: resolvedSitePath })
+        devApiAddress = mountDevApi(devServer, { root: resolvedSitePath })
       } catch (err) {
         console.error(`[dev-api] ${err.message}`)
       }
@@ -1025,7 +1038,7 @@ export function siteContentPlugin(options = {}) {
             rebuildQueries = false
             console.log('[site-content] Content changed, rebuilding...')
             try {
-              siteContent = await collectForBundle(resolvedSitePath, { foundationPath, base: basePath })
+              siteContent = withDevApi(await collectForBundle(resolvedSitePath, { foundationPath, base: basePath }))
               dataModelPromise = null
               headHtml = await loadHeadHtml()
               if (materialize) {

package/src/site/queries-config.js

@@ -37,7 +37,7 @@ import { readRegisteredFoundation } from './registered-foundation.js'
 import { buildDataSchemaMap, SCHEMA_NOT_FOUND } from '../resolve-data-schema.js'
 import { resolveFoundationSrcPath } from '../utils/foundation-source-root.js'
 import { buildSchema } from '../schema.js'
-import { refuseQueryRoute, refuseLimit } from './data-fetcher.js'
+import { refuseQueryRoute, refuseLimit, refuseFilter } from './data-fetcher.js'
 import { readFile } from 'node:fs/promises'
 import yaml from 'js-yaml'
 import { YAML_OPTIONS } from '../utils/yaml-schema.js'
@@ -248,6 +248,7 @@ export function refuseQueryDeclaration(decl) {
   }
   refuseQueryRoute(decl, where)
   refuseLimit(decl.limit, where)
+  refuseFilter(decl, where)
   // ⛔ `sync:` IS RETIRED (2026-09-21). `sync: false` kept a query's records off a
   // backend while a query owned its records; every record in `records/` is pushed
   // now, whatever reads it, so an ignored `sync: false` would push exactly what the