uniweb 0.10.9 → 0.10.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.10.9",
+  "version": "0.10.12",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,14 +41,14 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "0.7.7",
-    "@uniweb/kit": "0.9.7",
-    "@uniweb/runtime": "0.8.8"
+    "@uniweb/kit": "0.9.8",
+    "@uniweb/core": "0.7.8",
+    "@uniweb/runtime": "0.8.9"
   },
   "peerDependencies": {
-    "@uniweb/semantic-parser": "1.1.14",
-    "@uniweb/content-reader": "1.1.7",
-    "@uniweb/build": "0.11.6"
+    "@uniweb/build": "0.11.8",
+    "@uniweb/content-reader": "1.1.9",
+    "@uniweb/semantic-parser": "1.1.15"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -1316,6 +1316,8 @@ import LessonHeader from '../../components/LessonHeader'
 
 Within the same directory (e.g., one component importing a sibling), use normal relative imports (`./AIFeedbackCard`).
 
+**Foundation entry shape (`src/foundation.js`).** A single `export default { … }` whose top-level keys are the capabilities the foundation provides — e.g. `name`, `description`, `defaultLayout`, `defaultSection`, `viewTransitions`, `props`, `defaultInsets`, `xref`, `outputs`, `handlers`. Optionally a named `vars` export for theme-variable metadata (see *Foundation variables*). Everything else (section types, layouts) is auto-discovered from `src/sections/` and `src/layouts/` and merged in by `@uniweb/build`. The build wraps your default export under `default.capabilities` in the produced `dist/foundation.js`; you don't write that wrapper yourself, and most foundation code never sees it. The one place it matters: when you import your **own** `src/foundation.js` from a foundation component (e.g., a download button calling `compileDocument(website, { foundation })`), you get the bare default object — pass it through directly, Press handles both shapes.
+
 ### Website and Page APIs
 
 ```jsx

package/src/commands/deploy.js

@@ -29,6 +29,8 @@
  *   uniweb deploy --skip-build             Don't rebuild even if dist/ is stale
  *   uniweb deploy --dry-run                Resolve everything but skip the Worker POST
  *   uniweb deploy --skip-billing           Admin-only: bypass billing gate (dev/testing)
+ *   uniweb deploy --review                 Force the browser review path even when
+ *                                          there's no drift (e.g., to change features)
  *
  * See kb/platform/plans/cli-site-deploy-decisions.md for the full design.
  */
@@ -103,6 +105,12 @@ export async function deploy(args = []) {
   const dryRun = args.includes('--dry-run')
   const skipAssets = args.includes('--skip-assets')
   const skipBilling = args.includes('--skip-billing')
+  // --review forces the browser review path even when there's no drift.
+  // Useful for "I want to look at / change my features" without first
+  // having to edit site.yml. The toggles in the review page persist live
+  // to DB, so any change the user makes there ends up in site.yml after
+  // the loopback finalize roundtrip.
+  const forceReview = args.includes('--review')
 
   const siteDir = await resolveSiteDir(args)
   const backendUrl = getBackendUrl()
@@ -130,6 +138,12 @@ export async function deploy(args = []) {
     say.dim(`Runtime: ${runtimeVersion} (latest; pin via \`runtime:\` in site.yml)`)
   }
 
+  // Optional `features:` declaration. Acts as a "request" — CLI sends to
+  // PHP, PHP routes through review when it differs from the site's current
+  // metadata. Unknown names get warned + dropped before sending so a typo
+  // doesn't fail the whole deploy.
+  const desiredFeatures = readFeaturesFromYaml(siteYml)
+
   const cliToken = await ensureAuth({ command: 'Deploying' })
 
   // Always rebuild unless the user explicitly opts out with --skip-build.
@@ -167,6 +181,22 @@ export async function deploy(args = []) {
   const defaultLanguage = siteContent?.config?.defaultLanguage || languages[0] || 'en'
   const theme = await readTheme(siteDir, siteContent)
 
+  // Multi-locale: @uniweb/build emits dist/<lang>/site-content.json per
+  // non-default locale via buildLocalizedContent (translations applied via
+  // locales/<lang>.json + freeform/). Load each one so we can ship a full
+  // locales: map in the publish payload — same shape as Editor publish.
+  // Single-locale sites just have the default and skip the loop.
+  const localeContents = { [defaultLanguage]: siteContent }
+  for (const lang of languages) {
+    if (lang === defaultLanguage) continue
+    const localeContentPath = join(distDir, lang, 'site-content.json')
+    if (existsSync(localeContentPath)) {
+      localeContents[lang] = JSON.parse(await readFile(localeContentPath, 'utf8'))
+    } else {
+      say.warn(`Locale "${lang}" listed in site config but no dist/${lang}/site-content.json found — skipping.`)
+    }
+  }
+
   if (dryRun) {
     say.info('Dry run — showing what would be deployed:')
     say.dim(`Site dir       : ${siteDir}`)
@@ -185,7 +215,7 @@ export async function deploy(args = []) {
   // needsReview=true on first deploy / billing drift in future phases).
   const loopback = await startLoopback()
 
-  let publishToken, siteIdResolved, handleResolved, publishUrl, validateUrl
+  let publishToken, siteIdResolved, handleResolved, publishUrl, validateUrl, mintedFeatures
   try {
     say.info('Requesting deploy authorization…')
     const authorizeBody = {
@@ -200,6 +230,14 @@ export async function deploy(args = []) {
       callbackUrl: loopback.callbackUrl,
       // Dev-only: admin-gated server-side. PHP rejects for non-admins.
       skipBilling: skipBilling || undefined,
+      // site.yml-declared target feature set. PHP routes through review
+      // (with the desired set pre-applied) when it differs from DB.
+      // Always sent as an array; missing/empty `features:` in site.yml
+      // is normalized to `[]`, meaning "no paid features".
+      desiredFeatures,
+      // User-forced review (`uniweb deploy --review`). PHP refuses to
+      // fast-path even when nothing else has drifted.
+      forceReview: forceReview || undefined,
     }
     let authRes
     try {
@@ -255,6 +293,10 @@ export async function deploy(args = []) {
       publishToken = cb.publishToken
       siteIdResolved = cb.siteId
       handleResolved = cb.handle
+      // PHP echoes the live feature set in the loopback callback so the
+      // CLI can write `features:` back into site.yml accurately. Older
+      // PHP that doesn't include this field is a no-op.
+      mintedFeatures = Array.isArray(cb.features) ? cb.features : null
       // Review path: Worker URLs are implicit (we derive them from config).
       publishUrl = `${workerUrl}/api/publish/process`
       validateUrl = `${workerUrl}/api/publish/validate`
@@ -264,6 +306,7 @@ export async function deploy(args = []) {
       handleResolved = authRes.handle
       publishUrl = authRes.publishUrl
       validateUrl = authRes.validateUrl
+      mintedFeatures = Array.isArray(authRes.features) ? authRes.features : null
     }
   } finally {
     loopback.close()
@@ -286,14 +329,16 @@ export async function deploy(args = []) {
     process.exit(1)
   }
 
-  // Asset pipeline — upload dist/assets/* to S3, rewrite siteContent to use
-  // identifier-based references so semantic-parser resolves CDN URLs (+
-  // optimized variants) at render time. Skipped with --skip-assets.
-  // Mutates siteContent in place: image/document nodes get info.identifier.
+  // Asset pipeline — upload dist/assets/* + favicon + fonts to S3, then
+  // rewrite each locale's siteContent so semantic-parser resolves CDN URLs
+  // at render time. Assets themselves are locale-shared (they live in
+  // dist/assets/ regardless of language), so the diff/upload runs once
+  // and the rewrite walks every locale's content tree in localeContents.
+  // Skipped with --skip-assets.
   if (!skipAssets) {
     await uploadAssetsAndRewriteContent({
       siteDir,
-      siteContent,
+      localeContents,
       siteYml,
       theme,
       backendUrl,
@@ -311,21 +356,41 @@ export async function deploy(args = []) {
     theme,
     languages,
     defaultLanguage,
-    // Phase 1 single-locale wraps the content under the active locale. Multi-
-    // locale CLI deploy needs per-locale collection (deferred — see plan §6).
-    locales: { [defaultLanguage]: siteContent },
+    // Same shape as Editor publish — one entry per language. Single-locale
+    // sites end up with `{ [defaultLanguage]: siteContent }`; multi-locale
+    // sites carry per-locale translated content emitted by buildLocalizedContent.
+    locales: localeContents,
   }
   await callPublish({ url: publishUrl, token: publishToken, body: publishPayload })
 
-  // Write site.id / site.handle back to site.yml so next `uniweb deploy`
-  // fast-paths. Only touches the file on first deploy (or when the handle
-  // drifted server-side).
-  if (siteIdResolved && !siteYml.site?.id) {
-    await writeSiteBinding(siteYmlPath, siteYml, { id: siteIdResolved, handle: handleResolved })
-    say.dim(`Linked site.yml to site.id=${siteIdResolved}`)
-  } else if (siteIdResolved && handleResolved && siteYml.site?.handle !== handleResolved) {
-    await writeSiteBinding(siteYmlPath, siteYml, { id: siteIdResolved, handle: handleResolved })
-    say.dim(`Updated site.yml handle → ${handleResolved}`)
+  // Write site.id / site.handle / features back to site.yml so the file
+  // stays in sync with the live billing state. site.id and site.handle
+  // are written on first deploy and any time the server-side handle drifts.
+  // `features:` is rewritten whenever the live (server-confirmed) set
+  // differs from what's declared — including the case where the user
+  // declared `[]` and the live set is `[]` (no diff, no write).
+  const siteIdChanged = !!siteIdResolved && !siteYml.site?.id
+  const handleChanged = !!siteIdResolved && !!handleResolved && siteYml.site?.handle !== handleResolved
+  // desiredFeatures is what we sent to PHP (the simplified model: missing
+  // == empty), so comparing mintedFeatures against it tells us whether
+  // the file needs updating. Skip the write when nothing changed.
+  const featuresChanged = mintedFeatures !== null
+    && !arrayEqualsAsSets(desiredFeatures, mintedFeatures)
+
+  if (siteIdChanged || handleChanged || featuresChanged) {
+    const updates = {}
+    if (siteIdChanged || handleChanged) {
+      updates.site = { id: siteIdResolved, handle: handleResolved }
+    }
+    if (featuresChanged) {
+      updates.features = mintedFeatures
+    }
+    await writeSiteYmlUpdates(siteYmlPath, siteYml, updates)
+    if (siteIdChanged) say.dim(`Linked site.yml to site.id=${siteIdResolved}`)
+    else if (handleChanged) say.dim(`Updated site.yml handle → ${handleResolved}`)
+    if (featuresChanged) {
+      say.dim(`Updated site.yml features → [${mintedFeatures.join(', ') || '(none)'}]`)
+    }
   }
 
   console.log('')
@@ -348,17 +413,62 @@ async function readSiteYml(path) {
   }
 }
 
+// Recognized paid features. `features:` in site.yml uses these short
+// names; the PHP backend maps them to internal metadata flags. Anything
+// else gets dropped with a warning so a typo doesn't block a deploy.
+const KNOWN_FEATURES = new Set(['search', 'analytics', 'lowTtl', 'intelligence'])
+
+function readFeaturesFromYaml(siteYml) {
+  // site.yml's `features:` is the developer's declarative intent for what
+  // paid features they want billed. We treat absence and `features: []` as
+  // the same thing — both mean "no paid features". This keeps the model
+  // simple: what's in the file is what the user wants. No "no opinion"
+  // escape hatch. Legacy sites that have paid features in DB but no
+  // features: line yet will see a downgrade-review on their next deploy
+  // (they cancel and add the explicit list, or proceed and downgrade).
+  const raw = siteYml?.features
+  if (raw === undefined) return []
+  if (!Array.isArray(raw)) {
+    say.warn('site.yml `features:` should be a list (e.g. `features: [search]`). Treating as empty.')
+    return []
+  }
+  const valid = []
+  const unknown = []
+  for (const v of raw) {
+    if (typeof v !== 'string') continue
+    if (KNOWN_FEATURES.has(v)) valid.push(v)
+    else unknown.push(v)
+  }
+  if (unknown.length > 0) {
+    say.warn(`site.yml features: unknown name(s) ignored: ${unknown.join(', ')}`)
+    say.dim(`Known features: ${[...KNOWN_FEATURES].join(', ')}`)
+  }
+  // Dedupe + stable order so authorize compares the same way every time.
+  return [...new Set(valid)].sort()
+}
+
+function arrayEqualsAsSets(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return false
+  if (a.length !== b.length) return false
+  const sa = new Set(a)
+  for (const x of b) if (!sa.has(x)) return false
+  return true
+}
+
 /**
- * Write site.id + site.handle back to site.yml, preserving other fields.
+ * Write a partial set of updates back to site.yml, preserving other fields.
  *
  * Note: this is not a full YAML-preserving write — comments and exact
  * formatting are NOT preserved. js-yaml's `dump` re-emits the document.
  * Acceptable for now; the Phase 1 plan doesn't promise comment preservation.
  */
-async function writeSiteBinding(path, current, binding) {
-  const next = {
-    ...current,
-    site: { ...(current.site || {}), id: binding.id, handle: binding.handle },
+async function writeSiteYmlUpdates(path, current, updates) {
+  const next = { ...current }
+  if (updates.site) {
+    next.site = { ...(current.site || {}), ...updates.site }
+  }
+  if (updates.features !== undefined) {
+    next.features = [...updates.features].sort()
   }
   const dumped = yaml.dump(next, { lineWidth: 120, noRefs: true, quotingType: "'" })
   await writeFile(path, dumped)
@@ -416,8 +526,8 @@ async function fetchLatestRuntime(workerUrl) {
 function extractLanguages(siteContent) {
   const langs = siteContent?.config?.languages
   if (!Array.isArray(langs) || langs.length === 0) return ['en']
-  // Editor-shape `[{ value, label }]` vs plain `[string]`.
-  return langs.map((l) => (typeof l === 'string' ? l : l?.value)).filter(Boolean)
+  // Three accepted shapes: plain `'en'`, Editor `{ value, label }`, site.yml `{ code, label }`.
+  return langs.map((l) => (typeof l === 'string' ? l : l?.value || l?.code)).filter(Boolean)
 }
 
 /**
@@ -535,7 +645,7 @@ async function callPublish({ url, token, body }) {
  * siteContent is mutated in place so the caller's publish payload picks up
  * the rewritten nodes without passing anything back.
  */
-async function uploadAssetsAndRewriteContent({ siteDir, siteContent, siteYml, theme, backendUrl, cliToken, siteId }) {
+async function uploadAssetsAndRewriteContent({ siteDir, localeContents, siteYml, theme, backendUrl, cliToken, siteId }) {
   const distAssetsDir = join(siteDir, 'dist', 'assets')
   const hasDistAssets = existsSync(distAssetsDir)
 
@@ -659,24 +769,32 @@ async function uploadAssetsAndRewriteContent({ siteDir, siteContent, siteYml, th
     for (const u of confirmed) fresh.set(u.filename, u.identifier)
   }
 
-  // 6. Rewrite siteContent in place. Each image/document node whose
-  //    src/href references a local /assets/{filename} gets an info.identifier
-  //    pointing to the uploaded (or reused) asset.
+  // 6. Rewrite each locale's content in place. Image/document nodes whose
+  //    src/href references a local /assets/{filename} get an info.identifier
+  //    pointing to the uploaded (or reused) asset. Walking every locale
+  //    means translated content (which still references the same image
+  //    files via the source ProseMirror tree) gets the same rewrite.
   const byFilenameAll = new Map([...reused, ...fresh])
-  const rewritten = rewriteAssetReferences(siteContent, byFilenameAll)
+  let rewritten = 0
+  for (const lang of Object.keys(localeContents)) {
+    rewritten += rewriteAssetReferences(localeContents[lang], byFilenameAll)
+  }
   if (rewritten > 0) {
-    say.dim(`Rewrote ${rewritten} asset reference(s) in site content.`)
+    say.dim(`Rewrote ${rewritten} asset reference(s) across ${Object.keys(localeContents).length} locale(s).`)
   }
 
   // 7. If a favicon was included above, inject its resolved CDN URL into
-  //    siteContent.config.favicon. Matches how Editor publish composes the
-  //    payload; Worker bakes <link rel="icon"> from this field.
+  //    every locale's config.favicon. Matches Editor publish (which sets
+  //    favicon per-locale); Worker bakes <link rel="icon"> from the active
+  //    locale's content.config.favicon.
   if (faviconPath) {
     const favName = faviconPath.split(sep).pop()
     const favIdentifier = byFilenameAll.get(favName)
     if (favIdentifier) {
       const faviconUrl = resolveAssetCdnUrl(favIdentifier)
-      siteContent.config = { ...(siteContent.config || {}), favicon: faviconUrl }
+      for (const lang of Object.keys(localeContents)) {
+        localeContents[lang].config = { ...(localeContents[lang].config || {}), favicon: faviconUrl }
+      }
       say.dim(`Favicon: ${favName}`)
     }
   }

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-27T05:49:24.697Z",
+  "generatedAt": "2026-04-27T18:45:58.952Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.11.6",
+      "version": "0.11.8",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -14,7 +14,7 @@
       ]
     },
     "@uniweb/content-reader": {
-      "version": "1.1.7",
+      "version": "1.1.9",
       "path": "framework/content-reader",
       "deps": []
     },
@@ -24,7 +24,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.7.7",
+      "version": "0.7.8",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -42,7 +42,7 @@
       "deps": []
     },
     "@uniweb/kit": {
-      "version": "0.9.7",
+      "version": "0.9.8",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core"
@@ -54,12 +54,12 @@
       "deps": []
     },
     "@uniweb/press": {
-      "version": "0.4.4",
+      "version": "0.4.5",
       "path": "framework/press",
       "deps": []
     },
     "@uniweb/runtime": {
-      "version": "0.8.8",
+      "version": "0.8.9",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -77,7 +77,7 @@
       "deps": []
     },
     "@uniweb/semantic-parser": {
-      "version": "1.1.14",
+      "version": "1.1.15",
       "path": "framework/semantic-parser",
       "deps": []
     },
@@ -92,7 +92,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.2.6",
+      "version": "0.2.8",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",