uniweb 0.12.26 → 0.12.27

package/src/utils/asset-upload.js

@@ -0,0 +1,162 @@
+/**
+ * Site asset delivery — the asset lane for `uniweb deploy` (channel
+ * framework-backend-f90d). After the link build processes a site's media into
+ * `dist/assets/`, those bytes are delivered to the backend's content-addressed
+ * asset store, and the deploy step rewrites the content's local refs to durable
+ * serve URLs:
+ *
+ *   1. PLAN   — POST {apiBase}/dev/assets with the file list ({ path,
+ *               content_type, size, sha256 }). `sha256` is REQUIRED — it is the
+ *               content address. The response carries one entry per file
+ *               ({ path, id, ext, present?, method, url, headers }) plus mode:
+ *               'direct' (dev — URLs point back at the backend) or 'presigned'
+ *               (prod — storage PUTs). `id` is the lowercase-hex sha256 of the
+ *               bytes; we READ it from the response (never depend on id == sha256)
+ *               so the client stays correct if the derivation ever changes.
+ *   2. UPLOAD — PUT each NEW file's raw bytes to its URL with the given headers.
+ *               Order is irrelevant (unlike code-upload, there is no "entry").
+ *               Skip-list: an entry the plan marks `present: true` is already in
+ *               the content-addressed store, so we SKIP the PUT but still record
+ *               its id+ext for the rewrite. Absent `present` ⇒ false — an older
+ *               backend without the flag uploads everything (today's behavior).
+ *
+ * Assets are GLOBAL + content-addressed: identical bytes → same id → dedup
+ * across sites and idempotent re-deploys (a re-PUT is a cheap no-op). This
+ * mirrors the foundation code lane (utils/code-upload.js); the one structural
+ * difference is that the backend MINTS the per-asset id, so the plan response is
+ * what the deploy step rewrites content references to.
+ *
+ * Contract: kb/framework/build/delivery-lane.md §Assets.
+ */
+
+import { createHash } from 'node:crypto'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { contentTypeFor } from './code-upload.js'
+
+/**
+ * Walk a built site's `dist/assets/` and produce the upload file list. `path` is
+ * POSIX-relative to distDir (e.g. `assets/hero-ab12cd34.webp`); `localUrl` is how
+ * the built content references the asset (`/assets/...`) — the rewrite key.
+ * Returns `[]` when there is no `assets/` dir (an image-free site).
+ *
+ * @param {string} distDir - the site's built dist/ directory
+ * @returns {Array<{ path: string, content_type: string, size: number, sha256: string, localUrl: string, diskPath: string }>}
+ */
+export function collectSiteAssets(distDir) {
+  const assetsDir = join(distDir, 'assets')
+  if (!existsSync(assetsDir)) return []
+  const files = []
+  const walk = (dir, prefix) => {
+    for (const name of readdirSync(dir).sort()) {
+      const full = join(dir, name)
+      const rel = prefix ? `${prefix}/${name}` : name
+      const st = statSync(full)
+      if (st.isDirectory()) {
+        walk(full, rel)
+      } else if (st.isFile()) {
+        const bytes = readFileSync(full)
+        files.push({
+          path: `assets/${rel}`,
+          content_type: contentTypeFor(name),
+          size: st.size,
+          sha256: createHash('sha256').update(bytes).digest('hex'),
+          localUrl: `/assets/${rel}`,
+          diskPath: full,
+        })
+      }
+    }
+  }
+  walk(assetsDir, '')
+  return files
+}
+
+/**
+ * Deliver a site's assets: plan, then PUT each NEW file. Returns the rewrite map
+ * (`localUrl → { id, ext }`) — populated for files that uploaded successfully OR
+ * that the plan reports already `present`, so a partial failure never injects a
+ * broken serve URL into content. Throws only on a plan-level failure; per-file
+ * PUT failures surface in `failed`.
+ *
+ * Skip-list (content-addressed dedup): a plan entry with `present: true` is
+ * already in the global store — we don't re-PUT it, but we DO record its id+ext
+ * so the rewrite covers every asset. A backend that omits the flag (absent ⇒
+ * false) uploads everything, exactly as before.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiBase  - backend origin (e.g. http://localhost:8080)
+ * @param {string} opts.token    - bearer (same session as deploy/register)
+ * @param {string} opts.distDir  - the site's built dist/ directory
+ * @param {Array}  [opts.files]  - pre-collected list (default: collectSiteAssets)
+ * @param {(msg: string) => void} [opts.onProgress]
+ * @returns {Promise<{ mode: string, uploaded: string[], skipped: string[], failed: Array<{path, status, detail}>, assetsByLocalUrl: Record<string, { id: string, ext: string }> }>}
+ */
+export async function uploadSiteAssets({ apiBase, token, distDir, files, onProgress = () => {} }) {
+  const list = files || collectSiteAssets(distDir)
+  if (!list.length) {
+    return { mode: 'none', uploaded: [], skipped: [], failed: [], assetsByLocalUrl: {} }
+  }
+
+  const origin = apiBase.replace(/\/$/, '')
+  const planRes = await fetch(`${origin}/dev/assets`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify({
+      files: list.map(({ path, content_type, size, sha256 }) => ({ path, content_type, size, sha256 })),
+    }),
+  })
+  if (!planRes.ok) {
+    const detail = await planRes.text().catch(() => '')
+    throw new Error(
+      `Asset plan failed: HTTP ${planRes.status} ${planRes.statusText}${detail ? ` — ${detail.slice(0, 300)}` : ''}`
+    )
+  }
+  const plan = await planRes.json()
+  const mode = plan.mode || 'direct'
+  const uploads = Array.isArray(plan.uploads) ? plan.uploads : []
+  const byPath = new Map(list.map((f) => [f.path, f]))
+
+  const uploaded = []
+  const skipped = []
+  const failed = []
+  const assetsByLocalUrl = {}
+
+  for (const up of uploads) {
+    const src = byPath.get(up.path)
+    if (!src) continue // backend echoed a path we didn't send — ignore
+
+    // Skip-list: the bytes are already in the content-addressed store. No PUT,
+    // but still record id+ext so the rewrite covers this asset. `present` absent
+    // ⇒ false (older backend) → falls through to the upload path below.
+    if (up.present) {
+      skipped.push(src.path)
+      assetsByLocalUrl[src.localUrl] = { id: up.id, ext: String(up.ext || '').replace(/^\./, '') }
+      continue
+    }
+
+    const headers = { ...(up.headers || {}), 'x-uniweb-sha256': src.sha256 }
+    // Direct-mode PUTs are authed requests to the backend; presigned URLs are
+    // self-signed, so a foreign auth header can break the SigV4 target. This is
+    // the only mode-aware line in the client (same rule as code-upload).
+    if (mode !== 'presigned') headers.Authorization = `Bearer ${token}`
+    onProgress(`↑ ${src.path}`)
+    let putRes
+    try {
+      // The plan's url may be origin-relative (direct mode → uniwebd) or
+      // absolute (presigned → storage); new URL() resolves both.
+      putRes = await fetch(new URL(up.url, origin), { method: up.method || 'PUT', headers, body: readFileSync(src.diskPath) })
+    } catch (err) {
+      failed.push({ path: src.path, status: 0, detail: err.message })
+      continue
+    }
+    if (putRes.ok) {
+      uploaded.push(src.path)
+      // Authoritative id + ext from the plan; mapped only on a successful PUT.
+      assetsByLocalUrl[src.localUrl] = { id: up.id, ext: String(up.ext || '').replace(/^\./, '') }
+    } else {
+      failed.push({ path: src.path, status: putRes.status, detail: await putRes.text().catch(() => '') })
+    }
+  }
+
+  return { mode, uploaded, skipped, failed, assetsByLocalUrl }
+}

package/src/utils/code-upload.js

@@ -0,0 +1,245 @@
+/**
+ * Foundation code delivery — the phase-2 client of `uniweb register`.
+ *
+ * After a successful schema registration, the foundation's built `dist/`
+ * bytes are delivered to the registry in two steps (contract:
+ * foundation-code-upload.md, beside uwx-format.md):
+ *
+ *   1. PLAN   — POST {apiBase}/dev/registry/code-uploads with the file list
+ *               ({ path, content_type, size, sha256? }). The response carries
+ *               one upload target per file ({ path, method, url, headers })
+ *               plus mode: 'direct' (dev — URLs point back at uniwebd) or
+ *               'presigned' (prod — storage PUTs; bytes never transit the
+ *               backend). The CLI never branches on the mode.
+ *   2. UPLOAD — PUT each file's raw bytes to its URL with the given headers.
+ *               The ENTRY uploads LAST: a partial upload never yields a
+ *               loadable version (practical atomicity — there is no server
+ *               confirm step by design).
+ *
+ * In direct mode the entry is fetched back from the anonymous serve route
+ * (GET /gateway/foundation/{scope}/{name}/{version}/{path}) and compared
+ * byte-for-byte — the e2e proof that the version is live.
+ *
+ * Rules encoded here (the backend validates too — reject, never repair):
+ *   - paths are dist/-relative, '/'-separated, URL-safe verbatim
+ *   - `meta/**` is EXCLUDED from the upload set: schema custody is the
+ *     registry's entity store, and the gateway serves anonymously while
+ *     schemas are authenticated content everywhere else (no public catalog)
+ *   - `*.map` sourcemaps are EXCLUDED: they are dev-only debugging artifacts,
+ *     not part of the CDN-served runtime. (A Shiki-heavy foundation emits a
+ *     map per highlighted-grammar chunk, which is what pushes a build past the
+ *     plan step's per-version file cap — the cap is an abuse guard, the maps
+ *     simply don't belong on the CDN.)
+ *   - a registered version is immutable, code included — changed bytes mean
+ *     a new version (re-PUTting identical bytes is a safe no-op)
+ */
+
+import { createHash } from 'node:crypto'
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+// Extension → declared content type. Extension-honest by construction (Vite
+// output); anything unknown ships as octet-stream.
+const CONTENT_TYPES = {
+  js: 'text/javascript',
+  mjs: 'text/javascript',
+  css: 'text/css',
+  map: 'application/json',
+  json: 'application/json',
+  wasm: 'application/wasm',
+  woff2: 'font/woff2',
+  woff: 'font/woff',
+  ttf: 'font/ttf',
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  gif: 'image/gif',
+  svg: 'image/svg+xml',
+  webp: 'image/webp',
+  avif: 'image/avif',
+  ico: 'image/x-icon',
+  txt: 'text/plain',
+  html: 'text/html',
+}
+
+export function contentTypeFor(path) {
+  const ext = path.slice(path.lastIndexOf('.') + 1).toLowerCase()
+  return CONTENT_TYPES[ext] || 'application/octet-stream'
+}
+
+/** The dist-root entry file — uploaded last, verified after. */
+export const ENTRY_PATH = 'entry.js'
+
+/**
+ * Walk a built dist/ and produce the upload file list.
+ * Excludes `meta/**` and `*.map` sourcemaps (see header). Paths are
+ * POSIX-relative to distDir.
+ *
+ * @param {string} distDir
+ * @returns {Array<{ path: string, content_type: string, size: number, sha256: string }>}
+ */
+export function collectDistFiles(distDir) {
+  const files = []
+  const walk = (dir, prefix) => {
+    for (const name of readdirSync(dir).sort()) {
+      const full = join(dir, name)
+      const rel = prefix ? `${prefix}/${name}` : name
+      const st = statSync(full)
+      if (st.isDirectory()) {
+        if (rel === 'meta') continue // schema custody + no-public-catalog
+        walk(full, rel)
+      } else if (st.isFile()) {
+        if (rel.endsWith('.map')) continue // sourcemaps: dev-only, not CDN-served
+        const bytes = readFileSync(full)
+        files.push({
+          path: rel,
+          content_type: contentTypeFor(rel),
+          size: st.size,
+          sha256: createHash('sha256').update(bytes).digest('hex'),
+        })
+      }
+    }
+  }
+  walk(distDir, '')
+  return files
+}
+
+/** Entry-last upload order (practical atomicity — see header). */
+export function uploadOrder(files) {
+  const entry = files.filter((f) => f.path === ENTRY_PATH)
+  const rest = files.filter((f) => f.path !== ENTRY_PATH)
+  return [...rest, ...entry]
+}
+
+/**
+ * The gateway serve URL for a file of a registered foundation version.
+ * Mirrors the backend storage convention: scope WITHOUT the '@'.
+ * Prefer the plan response's `serve_base` when present.
+ */
+export function gatewayUrl(apiBase, name, version, path) {
+  const m = /^@([^/]+)\/(.+)$/.exec(name)
+  const scope = m ? m[1] : ''
+  const base = m ? m[2] : name
+  const origin = apiBase.replace(/\/$/, '')
+  return `${origin}/gateway/foundation/${scope}/${base}/${version}/${path}`
+}
+
+/**
+ * Deliver a foundation's code: plan, upload (entry last), verify (direct
+ * mode). Returns a result object; throws only on plan-level failures.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiBase  - registry origin (e.g. http://localhost:8080)
+ * @param {string} opts.token    - bearer (same session as register)
+ * @param {string} opts.name     - '@scope/name'
+ * @param {string} opts.version  - the registered semver
+ * @param {string} opts.distDir  - the built dist/ directory
+ * @param {Array}  [opts.files]  - pre-collected file list (default: collect)
+ * @param {(msg: string) => void} [opts.onProgress]
+ * @returns {Promise<{ mode: string, uploaded: string[], failed: Array<{path, status, detail}>, verified: boolean|null, serveBase: string|null }>}
+ */
+export async function uploadFoundationCode({
+  apiBase,
+  token,
+  name,
+  version,
+  distDir,
+  files,
+  onProgress = () => {},
+}) {
+  const list = files || collectDistFiles(distDir)
+  if (!list.length) {
+    return { mode: 'none', uploaded: [], failed: [], verified: null, serveBase: null }
+  }
+
+  const origin = apiBase.replace(/\/$/, '')
+  const planRes = await fetch(`${origin}/dev/registry/code-uploads`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify({
+      name,
+      version,
+      files: list.map(({ path, content_type, size, sha256 }) => ({
+        path,
+        content_type,
+        size,
+        // Optional integrity hint (ignored by the v1 backend; flows so a
+        // future checksum-bearing presign needs no CLI change).
+        sha256,
+      })),
+    }),
+  })
+  if (!planRes.ok) {
+    const body = await planRes.text().catch(() => '')
+    const err = new Error(
+      `code-uploads plan rejected: HTTP ${planRes.status}${body ? ` — ${body.slice(0, 300)}` : ''}`
+    )
+    err.status = planRes.status
+    throw err
+  }
+  const plan = await planRes.json()
+  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
+  const serveBase = plan.serve_base || null
+  // The ONE mode-aware bit: direct-mode PUTs are bearer-authed uniwebd
+  // routes; presigned URLs are self-authorizing and must NOT carry a
+  // bearer (foreign auth headers can break signed-request validation).
+  const authHeaders = plan.mode === 'direct' ? { Authorization: `Bearer ${token}` } : {}
+
+  const uploaded = []
+  const failed = []
+  for (const file of uploadOrder(list)) {
+    const target = targets.get(file.path)
+    if (!target) {
+      failed.push({ path: file.path, status: 0, detail: 'no upload target in plan' })
+      continue
+    }
+    const bytes = readFileSync(join(distDir, file.path))
+    try {
+      const res = await fetch(new URL(target.url, origin), {
+        method: target.method || 'PUT',
+        // x-uniweb-sha256: optional integrity guard — direct mode verifies
+        // the received bytes and 400s on mismatch (corruption-in-flight).
+        headers: { ...(target.headers || {}), ...authHeaders, 'x-uniweb-sha256': file.sha256 },
+        body: bytes,
+      })
+      if (res.ok) {
+        uploaded.push(file.path)
+        onProgress(`${file.path} (${file.size} bytes)`)
+      } else {
+        failed.push({
+          path: file.path,
+          status: res.status,
+          detail: (await res.text().catch(() => '')).slice(0, 200),
+        })
+      }
+    } catch (err) {
+      failed.push({ path: file.path, status: 0, detail: err.message })
+    }
+  }
+
+  // Direct mode: prove the version is live — fetch the entry back and
+  // compare bytes (the channel's e2e proof, made a default).
+  let verified = null
+  const entry = list.find((f) => f.path === ENTRY_PATH)
+  if (plan.mode === 'direct' && entry && !failed.length) {
+    try {
+      // serve_base is origin-relative in direct mode — resolve against the
+      // registry origin before fetching.
+      const url = serveBase
+        ? new URL(`${serveBase.replace(/\/$/, '')}/${ENTRY_PATH}`, origin).toString()
+        : gatewayUrl(origin, name, version, ENTRY_PATH)
+      const res = await fetch(url)
+      if (res.ok) {
+        const served = Buffer.from(await res.arrayBuffer())
+        const local = readFileSync(join(distDir, ENTRY_PATH))
+        verified = served.equals(local)
+      } else {
+        verified = false
+      }
+    } catch {
+      verified = false
+    }
+  }
+
+  return { mode: plan.mode || 'direct', uploaded, failed, verified, serveBase }
+}

package/src/utils/config.js

@@ -22,24 +22,14 @@ import yaml from 'js-yaml'
 import { filterCmd } from './pm.js'
 import { writeJsonPreservingStyleAsync } from './json-file.js'
 
-// ── Platform URLs ──────────────────────────────────────────────
-
-// Production defaults — regular users get these out of the box.
-// REGISTRY hosts platform operations (publish, foundations, runtime, admin):
-//   moved to hosting.uniweb.app in the CDN migration (Phase 4c, 2026-05-04).
-// BACKEND hosts the PHP user-facing surface (login, account, orgs, billing,
-//   publish-authorize).
-const PRODUCTION_BACKEND_URL = 'https://www.uniweb.app'
-const PRODUCTION_REGISTRY_URL = 'https://hosting.uniweb.app'
+// ── Backend origin ─────────────────────────────────────────────
 
 /**
- * Read ~/.uniweb/config.json for persistent URL overrides.
- * Platform developers use this to point CLI to local servers.
- *
- * Example ~/.uniweb/config.json:
- *   { "backendUrl": "http://127.0.0.1:8002", "registryUrl": "http://localhost:4001" }
+ * Read ~/.uniweb/config.json for a persistent backend-origin override (e.g.
+ * `{ "registryApiUrl": "http://localhost:8081" }`) — consumed by
+ * getRegistryApiBaseUrl() below.
  *
- * @returns {{ backendUrl?: string, registryUrl?: string }}
+ * @returns {{ registryApiUrl?: string }}
  */
 let _cliConfig = undefined
 function readCliConfig() {
@@ -60,36 +50,13 @@ function readCliConfig() {
 }
 
 /**
- * Get the PHP backend URL.
- *
- * Priority: env var > ~/.uniweb/config.json > production default
- * @returns {string}
- */
-export function getBackendUrl() {
-  return process.env.UNIWEB_BACKEND_URL
-    || readCliConfig().backendUrl
-    || PRODUCTION_BACKEND_URL
-}
-
-/**
- * Get the registry API URL (Cloudflare Worker or local unicloud).
- *
- * Priority: env var > ~/.uniweb/config.json > production default
- * @returns {string}
- */
-export function getRegistryUrl() {
-  return process.env.UNIWEB_REGISTRY_URL
-    || readCliConfig().registryUrl
-    || PRODUCTION_REGISTRY_URL
-}
-
-/**
- * Get the new registry backend's API base origin — DISTINCT from the
- * legacy PHP getBackendUrl(). `register` POSTs to {origin}/dev/registry/register
- * and the new-backend `login` to {origin}/dev/auth/login.
+ * Get the backend's API base origin. `register` POSTs to
+ * {origin}/dev/registry/register, `login` to {origin}/dev/auth/login, etc.
+ * (BackendClient.resolveBackendOrigin layers the --backend/--registry flag on
+ * top of this.)
  *
- * Priority: UNIWEB_REGISTER_URL's origin (the env users already set for
- * register) > ~/.uniweb/config.json registryApiUrl > local default.
+ * Priority: UNIWEB_REGISTER_URL's origin > ~/.uniweb/config.json registryApiUrl
+ * > local default.
  * @returns {string}
  */
 export function getRegistryApiBaseUrl() {

package/src/utils/registry-auth.js

@@ -24,12 +24,23 @@
 import { existsSync } from 'node:fs'
 import { readFile, writeFile, mkdir, unlink } from 'node:fs/promises'
 import { join } from 'node:path'
+import { homedir } from 'node:os'
 import { createServer } from 'node:http'
 import { randomBytes } from 'node:crypto'
-import { getAuthDir, isExpired } from './auth.js'
 
 const LOGIN_PATH = '/dev/auth/login'
 
+/** The shared ~/.uniweb credential directory. */
+export function getAuthDir() {
+  return join(homedir(), '.uniweb')
+}
+
+/** True when a stored session's `expiresAt` is in the past (absent → never expires). */
+export function isExpired(auth) {
+  if (!auth?.expiresAt) return false
+  return new Date(auth.expiresAt) < new Date()
+}
+
 /**
  * Path to the register-scoped credential file (~/.uniweb/registry-auth.json).
  * Reuses the legacy auth dir (the ~/.uniweb home is shared infrastructure);
@@ -334,6 +345,29 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
   const { isNonInteractive } = await import('./interactive.js')
   const nonInteractive = isNonInteractive(args)
 
+  // `--token <bearer>` seeds + verifies a session non-interactively (verified
+  // against /dev/auth/me before it's stored, so an invalid token fails loudly
+  // instead of poisoning the session file). Distinct from the per-command
+  // `--token` (ephemeral, never stored) and from UNIWEB_TOKEN env.
+  const { readFlagValue } = await import('./args.js')
+  const tokenFlag = readFlagValue(args, '--token')
+  if (tokenFlag) {
+    let account
+    try {
+      account = await fetchMe({ apiBase, token: tokenFlag })
+    } catch (err) {
+      console.error(`\x1b[31m✗\x1b[0m Token rejected by ${apiBase}: ${err.message}`)
+      process.exit(1)
+    }
+    const record = { token: tokenFlag }
+    if (account?.uuid) record.uuid = account.uuid
+    if (account?.username) record.username = account.username
+    if (account?.handle) record.handle = account.handle
+    await writeRegistryAuth(record)
+    console.log(`\x1b[32m✓\x1b[0m Logged in${account?.username ? ` as \x1b[1m${account.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`)
+    return record
+  }
+
   let method = args.includes('--browser') ? 'browser'
     : args.includes('--password') ? 'password'
     : args.includes('--token-paste') ? 'token-paste'