@uniweb/runtime 1.1.15 → 1.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/runtime",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "description": "Minimal runtime for loading Uniweb foundations",
   "type": "module",
   "exports": {
@@ -36,15 +36,15 @@
     "node": ">=22.12"
   },
   "dependencies": {
-    "@uniweb/theming": "~1.2.1",
-    "@uniweb/core": "~1.4.0"
+    "@uniweb/core": "~1.4.2",
+    "@uniweb/theming": "~1.2.1"
   },
   "devDependencies": {
     "@vitejs/plugin-react": "^4.5.2",
     "esbuild": "^0.21.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.27.0 || ^0.28.0",
     "vite": "^7.3.1",
     "vitest": "^4.1.7",
-    "@uniweb/build": "1.7.1"
+    "@uniweb/build": "1.8.2"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/foundation-loader.js

@@ -5,6 +5,8 @@
  * with CSS loading in parallel.
  */
 
+import { foundationCssUrl } from '@uniweb/core/page-shell'
+
 /**
  * Resolve a foundation/extension URL so that absolute-path forms
  * (`/_module/...`) anchor to the document's origin, not to the importing
@@ -75,11 +77,11 @@ export async function loadFoundationCSS(url) {
  */
 export async function loadFoundation(source) {
   const rawUrl = typeof source === 'string' ? source : source.url
-  // Auto-derive CSS URL from JS URL by convention: entry.js → assets/style.css.
+  // Auto-derive CSS URL from JS URL by the one convention, entry.js → assets/style.css
+  // (`foundationCssUrl`, which a page's shell links the primary's stylesheet by too).
   // Pre-Phase-5 foundations were named foundation.js + assets/foundation.css;
   // those keep working when an explicit `cssUrl` is passed in `source`.
-  const rawCssUrl = typeof source === 'object' ? source.cssUrl
-    : rawUrl.replace(/[^/]+\.js$/, 'assets/style.css')
+  const rawCssUrl = typeof source === 'object' ? source.cssUrl : foundationCssUrl(rawUrl)
 
   // Phase 5: when the runtime is loaded from a different host than the
   // document (e.g. runtime served from cdn.uniweb.app, page on

package/src/isolate-api.js

@@ -42,11 +42,14 @@
  * at publish time and never hand-edited.
  *
  * ⚠️ **The tempting fix is the dangerous one.** Stamping the current version
- * (`0.16.0`) would satisfy every check and be **false**: backend reads
- * `minUsable` from the channel index and refuses to serve a site below it,
- * so a floor of 0.16.0 would promise an export that 0.16.0 does not contain —
+ * (`0.16.0`) would satisfy every check and be **false**: a backend reads
+ * `minUsable` from the channel index and publishes no site at a runtime below
+ * it, so a floor of 0.16.0 would promise an export that 0.16.0 does not contain —
  * and a host at the floor is entitled to skip feature detection. That is a
  * guarantee broken in the one direction the floor exists to prevent.
+ * ⛔ *This said a backend "refuses to serve a site below it" until 2026-10-24.*
+ * The floor bounds what is published next. A site already pinned below it is
+ * served as it is, until it is republished.
  *
  * ⇒ **`UNRELEASED` says the true thing: this export exists in the tree and in no
  * published version.** It is stamped like any other name, so nothing rides out
@@ -119,6 +122,12 @@ export const ISOLATE_API = Object.freeze({
   RESOLUTION_STATUS: '0.28.6',
   // a redirect the host answers itself, with the visitor's query and fragment on it
   carryQuery: '1.0.1',
+  // the `__DATA__` element a host writes into a page's shell, and the escaping it uses
+  dataScript: '1.1.16',
+  jsonForScript: '1.1.16',
+  // the page's whole shell, and the foundation stylesheet convention it links by
+  pageShell: '1.1.16',
+  foundationCssUrl: '1.1.16',
 })
 
 /**

package/src/setup.js

@@ -355,10 +355,16 @@ export async function decodeData() {
   const raw = el.textContent
 
   // Plain JSON (uncompressed)
+  // ⛔ A payload that is there and does not parse is said as such: the boot then finds no
+  // configuration, and "No site configuration found" alone sent a reader looking for a payload
+  // that was present. Measured 2026-10-23: a host escaped `<!--` as `<\!--`, which JSON has no
+  // escape for, and every page stayed its server render with nothing naming the cause. JSON
+  // inside a <script> escapes `<` as `<` (`build/src/prerender.js`).
   if (el.type === 'application/json') {
     try {
       return JSON.parse(raw)
-    } catch {
+    } catch (err) {
+      console.error(`[Runtime] __DATA__ is not valid JSON, so the site cannot start: ${err.message}`)
       return null
     }
   }

package/src/ssr-renderer.js

@@ -35,6 +35,7 @@ import { layoutStickiness, sectionStickyProps, sectionScrollMargin, zoneProps }
 import { DefaultLayout } from './default-layout.js'
 import { renderAppearanceBootScript } from './appearance.js'
 import { documentTitle } from './document-title.js'
+import { escapeHtml } from '@uniweb/core/page-shell'
 
 // Re-export L2 helpers so the public `@uniweb/runtime/ssr` surface
 // carries everything an SSR consumer needs from one entry point.
@@ -546,9 +547,12 @@ export async function prefetchIcons(siteContent, uniweb, onProgress = () => {})
   )
 
   const succeeded = results.filter(r => r.status === 'fulfilled').length
-  const failed = results.filter(r => r.status === 'rejected').length
-  if (failed > 0) {
-    const msg = `Fetched ${succeeded}/${icons.length} icons (${failed} failed)`
+  const failedRefs = icons.filter((_, i) => results[i].status === 'rejected')
+  if (failedRefs.length > 0) {
+    // Named, so an author can fix the reference. ⛔ Until 2026-10-24 this said only "(1 failed)",
+    // and a missing icon on a live page took a search through every reference to find.
+    const shown = failedRefs.slice(0, 10).join(', ') + (failedRefs.length > 10 ? ', …' : '')
+    const msg = `Fetched ${succeeded}/${icons.length} icons (${failedRefs.length} failed: ${shown})`
     console.warn(`[prerender] ${msg}`)
     onProgress(`  ${msg}`)
   }
@@ -655,18 +659,9 @@ export function renderPage(page, website) {
 // HTML injection
 // ============================================================================
 
-/**
- * Escape HTML special characters.
- */
-export function escapeHtml(str) {
-  if (!str) return ''
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;')
-}
+// Escape HTML special characters — the one implementation, which a page's shell writes with too
+// (`@uniweb/core/page-shell`). Still exported from here, as it has been since 0.6.14.
+export { escapeHtml }
 
 /**
  * Inject prerendered content into an HTML shell.

package/src/ssr.js

@@ -100,3 +100,20 @@ export { collectSiteRecords } from './collect-records.js'
 // Appearance. injectPageContent() already emits this for every prerendered
 // page; exported for lanes that assemble a shell without a per-page render.
 export { renderAppearanceBootScript } from './appearance.js'
+
+// ⭐ THE `__DATA__` ELEMENT A HOST WRITES INTO A PAGE'S SHELL — the boot payload as JSON a
+// `<script>` cannot end or misparse (every `<` as `<`), carrying only the served page's
+// sections when the content names where the others are (`config.pageHashes`). The rule a static
+// build writes its own page data by (`@uniweb/core/data-script`). ⛔ A host wrote `__DATA__` with
+// its own escaping until 2026-10-23, escaping `<!--` as `<\!--` — a JavaScript-string escape that
+// is invalid JSON — and no page of the site it served could start (`decodeData`).
+// `jsonForScript` is the escaping alone, for any other JSON a host writes into a `<script>`.
+export { dataScript, jsonForScript } from '@uniweb/core/data-script'
+
+// ⭐ THE PAGE'S SHELL — the whole HTML a page starts as, from what only the host holds (its
+// addresses, the runtime's manifest, the content it read): the head, an empty `#root`, and
+// `__DATA__`. Page assembly is framework's [Diego, 2026-10-23]. In an isolate it is the `shell`
+// `createPageRenderer` renders into, versioned with the runtime; a host links the same function
+// (`@uniweb/core/page-shell`) for a page it serves without rendering. `foundationCssUrl` is the
+// one convention for a foundation's stylesheet, which the loader and the shell both follow.
+export { pageShell, foundationCssUrl } from '@uniweb/core/page-shell'