uniweb 0.25.2 → 0.25.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.25.2",
+  "version": "0.25.3",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -43,13 +43,13 @@
     "tar": "^7.0.0",
     "@uniweb/core": "^0.10.1",
     "@uniweb/kit": "^0.12.3",
-    "@uniweb/semantic-parser": "^1.2.3",
-    "@uniweb/runtime": "^0.12.2"
+    "@uniweb/runtime": "^0.12.2",
+    "@uniweb/semantic-parser": "^1.2.3"
   },
   "peerDependencies": {
-    "@uniweb/semantic-parser": "^1.2.3",
+    "@uniweb/build": "^0.24.3",
     "@uniweb/content-reader": "^1.2.3",
-    "@uniweb/build": "^0.24.2"
+    "@uniweb/semantic-parser": "^1.2.3"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/commands/publish.js

@@ -53,9 +53,9 @@ import {
   loadDeployYml,
   resolveTarget,
   recordLastDeploy,
-  assembleDataBall,
-  collectBallAssets,
-  rewriteBallAssets
+  collectSchemalessData,
+  collectSchemalessDataAssets,
+  rewriteSchemalessDataAssets
 } from '@uniweb/build/site'
 import { emitSyncPackages } from '@uniweb/build/uwx'
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
@@ -79,7 +79,6 @@ import {
   pushSyncPackages,
   resolveSiteOrgForCreate
 } from '../backend/site-sync.js'
-import { uploadDataBundle } from '../backend/data-bundle.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import { updateAssetMap, ASSET_MAP_FILE } from '@uniweb/build/uwx'
 import {
@@ -88,6 +87,7 @@ import {
 } from '../backend/foundation-bring-along.js'
 import { settlePaymentIfNeeded } from '../backend/payment-handoff.js'
 import { reportSchemalessCollections } from '../utils/schemaless-report.js'
+import { uploadSiteData } from '../utils/site-data-upload.js'
 
 const c = {
   reset: '\x1b[0m',
@@ -527,8 +527,8 @@ export async function publish(args = []) {
 
   // 4. Assemble the static-data ball (schema-less data + search index) BEFORE
   //    uploading, since its records can carry local media too.
-  let ball = await assembleDataBall(distDir, schemalessNames)
-  const ballAssets = collectBallAssets(ball)
+  let ball = await collectSchemalessData(distDir, schemalessNames)
+  const ballAssets = collectSchemalessDataAssets(ball)
 
   // 4b. Upload ALL local media (entity refs + ball refs) on one asset lane →
   //     the ref→serveUrl map; rewrite the entity content AND the ball with it.
@@ -567,7 +567,7 @@ export async function publish(args = []) {
           `${ASSET_MAP_FILE}   : ${rec.added.length} added, ${rec.changed.length} changed — commit it`
         )
       }
-      if (ballAssets.length) ball = rewriteBallAssets(ball, map)
+      if (ballAssets.length) ball = rewriteSchemalessDataAssets(ball, map)
       say.dim(
         `Media          : ${Object.keys(map).length}/${mediaRefs.length} ref(s) → serve URL`
       )
@@ -586,34 +586,56 @@ export async function publish(args = []) {
     }
   }
 
-  // 4c. Upload the (media-rewritten) ball → its content-addressed serve URL.
-  let dataBundle
+  // 4c. Deliver the schema-less collection data — one object per file.
+  //
+  //     Each `dist/data/**` file is PUT to the target `data-uploads` returns,
+  //     landing at its serving tail. Hosting intercepts `/data/**.json` and
+  //     reads `_data/{tail}` from the site bucket, so the file is served from
+  //     where it lands: **nothing records where anything went**, and no `info`
+  //     field is stamped.
+  //
+  //     ⛔ NO BALL. A CLI sends separates or a ball, never both — presence of a
+  //     ball is the backend's signal for which CLI it is talking to, and
+  //     sending both destroys it along with their ability to know when the
+  //     unwrap can be deleted. Released CLIs keep sending one and their unwrap
+  //     keeps serving them; this one does not.
+  //
+  //     📌 No capability gate, deliberately. A backend predating this lane
+  //     answers 404 and the publish fails — accepted while pre-prod [Diego,
+  //     2026-08-18: "we are pre-prod. I'm not concerned about old cli vs new"].
+  //     A gate was written and removed: it is machinery for a population that
+  //     does not exist, which is the failure this work kept catching in others.
+  //     `client.discover()` is the mechanism if that changes — `DISCOVERY_DEFAULTS`
+  //     makes an absent key non-breaking by construction.
   if (ball) {
-    say.info('Uploading data bundle…')
+    say.info('Uploading collection data…')
     try {
-      dataBundle = await uploadDataBundle(client, ball, {
+      const r = await uploadSiteData({
+        apiBase: client.origin,
+        token: await client.token(),
         siteUuid: site.uuid,
+        ball,
         onProgress: (m) => say.dim(`  ${m}`)
       })
-    } catch (err) {
-      // The ball rides the same asset lane, so it hits the same typed refusals.
-      const refusal = describeAssetRefusal(err)
-      if (refusal) {
-        say.err(refusal.headline)
-        for (const line of refusal.notes) say.dim(line)
-      } else {
-        say.err(`Data bundle upload failed: ${err.message}`)
+      if (r.failed.length) {
+        // A file whose bytes did not land must not be published: the site would
+        // serve a stale copy or 404, and the only trace would be a warning.
+        say.err(`${r.failed.length} data file(s) failed to upload — not publishing.`)
+        for (const f of r.failed) say.dim(`  ${f.path} (HTTP ${f.status})`)
+        return { exitCode: 1 }
       }
+      say.dim(`Collection data : ${r.uploaded.length} file(s) [${r.mode}]`)
+    } catch (err) {
+      say.err(`Collection data upload failed: ${err.message}`)
       return { exitCode: 1 }
     }
-    say.dim(
-      `Data bundle    : ${Object.keys(ball.data).length} data + ${Object.keys(ball.search).length} search file(s)`
-    )
   }
 
   // 5. Push the site (content + folder) over the send-only-changed cache —
   //    the SAME two-lane submission `uniweb push` uses — stamping
-  //    info.data_bundle and rewriting local media refs to backend serve URLs.
+  //    the pinned foundation ref and rewriting local media refs to serve URLs.
+  //    (It stamped `info.data_bundle` until 2026-08-18; the ball is gone and
+  //    collection data now lands at its serving tail, so nothing records it.)
   const priorHashes = readSyncCache(siteDir)
   // publish rides the same gated push as `uniweb push`: if an app author has
   // edited since this clone last synced, the push is refused rather than
@@ -635,8 +657,17 @@ export async function publish(args = []) {
   // released version on the wire is required when site.yml uses an unversioned
   // local ref; injectInfo overrides info.foundation. A registry/URL ref → fnd.ref
   // is null → the site.yml ref is forwarded verbatim (already pinned).
+  // ⛔ DO NOT STAMP `info.data` HERE. The name is TAKEN: `uwx/site.js` already
+  // emits `info.data` from `site.yml`'s top-level `data:`/`fetch:` block, and
+  // `injectInfo` WINS the merge (`sync-package.js`: `{...siteDoc.info,
+  // ...injectInfo}`), so stamping a file map here silently replaces the author's
+  // fetch config on the wire. Both are `type: json`, so the store validator
+  // accepts either and nothing errors at any layer.
+  //
+  // A file map needs a name nothing else claims (`static_data` / `data_files`
+  // were proposed) AND a consumer that reads it — neither settled. See
+  // `kb/framework/build/data-ball-retirement.md`.
   const injectInfo = {
-    ...(dataBundle ? { data_bundle: dataBundle } : {}),
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }
   let pkg

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-18T16:05:00.154Z",
+  "generatedAt": "2026-08-18T22:18:28.572Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.24.2",
+      "version": "0.24.3",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",

package/src/utils/site-data-upload.js

@@ -0,0 +1,176 @@
+/**
+ * Static collection data — the passthrough lane.
+ *
+ * A site's **schema-less** collections have no entity model, so their compiled
+ * `dist/data/**` JSON is delivered as files rather than synced as entities.
+ * This plans and uploads that set: one plan call, one object per file, each
+ * PUT to the target the backend returns.
+ *
+ *   1. PLAN   — POST {apiBase}/dev/site/data-uploads/{site} with the file list
+ *               ({ path, content_type, size, sha256 }). Response carries
+ *               `mode` ('presigned' | 'direct'), `expires_in`, `serve_base`,
+ *               and one `uploads` entry per file ({ path, method, url, headers }).
+ *   2. UPLOAD — PUT each file's bytes to its URL. Order is irrelevant; there is
+ *               no entry file and no server confirm step.
+ *
+ * ⭐ **`path` is the SERVING TAIL** (`data/articles.json`), not a bookkeeping
+ * key. The file lands where it is served — which is the whole point of this
+ * lane, and why it returns no map: nothing has to record where anything went.
+ *
+ * ## Why this is not the asset lane
+ *
+ * Assets are **global and content-addressed** — identical bytes dedup across
+ * sites — so the relation from a site's path to an object is many-to-one and a
+ * serve path cannot be a property of the object. This lane is **per-site and
+ * path-addressed**. Sending static data through the asset store is what forced
+ * the old "data ball": one bundled asset the backend had to fetch, parse and
+ * fan out, which is the only place these bytes ever transited it.
+ *
+ * ⇒ **The backend is a PASSTHROUGH here** — it brokers the authorization, not
+ * the bytes. Hosting static content is the hosting platform's mission where an
+ * edge exists; where there is none (edgeless), the backend serves them itself,
+ * and that is the posture working rather than a fallback.
+ *
+ * ⛔ **Do not compose paths onto `serve_base`.** It is `null` on the presigned
+ * arm (prod serving is the delivery tier's URL shape, not the backend's to
+ * mint) and the gateway's data route on the direct arm. Nothing in a build
+ * needs it — the site's fetcher asks for a site-relative `/data/{path}` at
+ * runtime — so it is returned for parity and for a caller that wants to verify
+ * an upload landed.
+ *
+ * Contract ratified 2026-08-18; see `kb/framework/build/data-ball-retirement.md`.
+ * ⚠️ **The endpoint is not built yet** — this is unwired until it is.
+ */
+
+import { createHash } from 'node:crypto'
+
+/**
+ * Plan + upload a site's static collection data files.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiBase - backend origin
+ * @param {string} opts.token - bearer, used on the direct arm only
+ * @param {string} opts.siteUuid - the site these files belong to (path segment)
+ * @param {{ data: Record<string, unknown> }|null} opts.ball - source of the set:
+ *   `{ "<relpath under dist/data>": <json> }`, media refs already rewritten
+ * @param {(m: string) => void} [opts.onProgress]
+ * @returns {Promise<{ mode: string, uploaded: string[], failed: Array<{path:string,status:number,detail?:string}>, serveBase: string|null }>}
+ *   **No map** — by design. The files are at their serving paths.
+ */
+export async function uploadSiteData({
+  apiBase,
+  token,
+  siteUuid,
+  ball,
+  onProgress = () => {}
+}) {
+  const entries = Object.entries(ball?.data || {})
+  if (!entries.length) {
+    return { mode: 'none', uploaded: [], failed: [], serveBase: null }
+  }
+
+  // One plan for the whole set. The per-request file cap counts a plan, so
+  // splitting would evade it rather than respect it; if a set ever exceeds it,
+  // the refusal is the correct outcome and the cap is the thing to fix.
+  const files = entries.map(([relPath, value]) => {
+    const bytes = Buffer.from(JSON.stringify(value))
+    return {
+      // ⚠️ The tail RELATIVE TO THE DATA ROOT — no `data/` prefix.
+      //
+      // The plan's `serve_base` already ends in `/data/`
+      // (`/gateway/site/{site}/data/`), and the runtime asks for
+      // `{config.base}/data/{name}.json` (`DATA_URL_PREFIX`). Sending
+      // `data/articles.json` would store one level too deep and serve at
+      // `…/data/data/articles.json`, which the runtime never requests.
+      //
+      // ⛔ And the failure is INVISIBLE from here: the plan succeeds, the PUT
+      // succeeds, and only a visitor's fetch 404s. Confirmed against the
+      // shipped contract's own example (`collections/articles.json` with a
+      // `/data/`-bearing `serve_base`), which supersedes an earlier
+      // parenthetical that showed the prefix.
+      path: relPath,
+      content_type: 'application/json',
+      size: bytes.length,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+      bytes
+    }
+  })
+
+  const origin = apiBase.replace(/\/$/, '')
+  // `{site}` is a PATH segment, not a body field — every sibling on this
+  // controller addresses the site that way (`content/push/{site}`,
+  // `publish/{site}`, `status/{site}`). The asset lane's body-borne owner is
+  // the wrong precedent: that lane is global, this one is per-site.
+  const planRes = await fetch(
+    `${origin}/dev/site/data-uploads/${encodeURIComponent(siteUuid)}`,
+    {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({
+        files: files.map(({ path, content_type, size, sha256 }) => ({
+          path,
+          content_type,
+          size,
+          sha256
+        }))
+      })
+    }
+  )
+  if (!planRes.ok) {
+    const body = await planRes.text().catch(() => '')
+    throw new Error(
+      `site data-uploads plan rejected: HTTP ${planRes.status}${body ? ` — ${body.slice(0, 300)}` : ''}`
+    )
+  }
+
+  const plan = await planRes.json()
+  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
+  // The one mode-aware bit, same rule as the code and runtime lanes: a direct
+  // PUT is a bearer-authed backend route; a presigned URL is self-authorizing
+  // and must NOT carry a foreign bearer, which can break signature validation.
+  const authHeaders =
+    plan.mode === 'presigned' ? {} : { Authorization: `Bearer ${token}` }
+
+  const uploaded = []
+  const failed = []
+  for (const f of files) {
+    const target = targets.get(f.path)
+    if (!target) {
+      // A file the plan did not answer for is unaddressable. Report it; never
+      // invent a location for it.
+      failed.push({ path: f.path, status: 0, detail: 'no upload target in plan' })
+      continue
+    }
+    try {
+      // Relative on the direct arm, absolute on presigned — `new URL` resolves
+      // both against the origin.
+      const res = await fetch(new URL(target.url, origin), {
+        method: target.method || 'PUT',
+        headers: {
+          'Content-Type': 'application/json',
+          ...(target.headers || {}),
+          ...authHeaders
+        },
+        body: f.bytes
+      })
+      if (res.ok) {
+        uploaded.push(f.path)
+        onProgress(`${f.path}`)
+      } else {
+        failed.push({ path: f.path, status: res.status })
+      }
+    } catch (err) {
+      failed.push({ path: f.path, status: 0, detail: err.message })
+    }
+  }
+
+  return {
+    mode: plan.mode || 'direct',
+    uploaded,
+    failed,
+    serveBase: plan.serve_base || null
+  }
+}

package/src/backend/data-bundle.js

@@ -1,85 +0,0 @@
-/**
- * Upload the static-data ball (assembleDataBall's `{ data, search }` doc) to the
- * backend's content-addressed asset store via the SAME asset lane deploy uses for
- * media, and return its durable serve URL — the `info.data_bundle` the composite push
- * stamps on the site-content entity. The backend unwraps the ball into the `/data/*`
- * + `/_search/*` bytes the gateway serves.
- *
- * The ball is in-memory (not a built file on disk), so it rides as `bytes` on the
- * single upload entry — `uploadSiteAssets` PUTs `bytes` when present, else reads a
- * `diskPath` (its media path). Content-addressed like every asset: identical ball →
- * same id → a re-deploy of unchanged data is a cheap no-op PUT.
- *
- * The returned URL is the plan entry's `serve_url`, read verbatim. See the note at
- * the return for why the origin-relative form is safe to store.
- */
-
-import { createHash } from 'node:crypto'
-
-/**
- * @param {object} client - BackendClient (origin + uploadSiteAssets)
- * @param {{ data: object, search: object }} ball - the assembled data ball
- * @param {{ onProgress?: (m: string) => void }} [opts]
- * @returns {Promise<string>} the content-addressed serve URL (→ `info.data_bundle`)
- */
-export async function uploadDataBundle(
-  client,
-  ball,
-  { siteUuid = null, onProgress } = {}
-) {
-  const bytes = Buffer.from(JSON.stringify(ball))
-  const sha256 = createHash('sha256').update(bytes).digest('hex')
-  const localUrl = '/data-bundle/base.json' // bookkeeping key into assetsByLocalUrl
-
-  const result = await client.uploadSiteAssets({
-    files: [
-      {
-        path: 'data-bundle/base.json',
-        content_type: 'application/json',
-        size: bytes.length,
-        sha256,
-        localUrl,
-        bytes
-      }
-    ],
-    siteUuid,
-    onProgress
-  })
-  if (result.failed?.length) {
-    const f = result.failed[0]
-    throw new Error(`data-bundle upload failed: HTTP ${f.status} ${f.detail}`)
-  }
-  const entry = result.assetsByLocalUrl[localUrl]
-  if (!entry) throw new Error('data-bundle upload returned no asset id')
-
-  // The backend's canonical serve URL, READ — never composed. Same rule and the
-  // same code path as `site-media.js`; until 2026-08-17 this composed from a
-  // discovered `assetBase` unconditionally, which made it the one place a
-  // discovery failure could bake the historical production CDN host into content
-  // we push.
-  //
-  // Storing it verbatim is safe even though `serve_url` is ORIGIN-RELATIVE in the
-  // backend's `direct` mode — the only mode any deployment has ever run.
-  // `info.data_bundle` is never fetched over HTTP: the backend resolves it to a
-  // blob-store key, discarding everything before the final `dist/`, so absolute
-  // and relative forms resolve to the same key (pinned both ways on their side).
-  //
-  // ⚠️ That argument is scoped to a serve URL CONTAINING `dist/`, and the scope is
-  // load-bearing rather than incidental: the key is recovered by splitting on that
-  // segment, so a serve URL without one cannot be resolved to a key at all — the
-  // failure is on the READING side, and this push looks entirely successful.
-  // Reported by the backend 2026-08-17 as a defect on their side, not yet fixed;
-  // not verified here, and not ours to fix. It is unreached only because no
-  // deployment yet mints URLs of the other shape. ⇒ We keep reading `serve_url`
-  // verbatim — composing one would be the worse answer, and it is the very coupling
-  // deleted above. What we must NOT do is infer from "this has always worked" that
-  // any serve URL round-trips; that holds for the shape, not for the field.
-  //
-  // Absent is an error, not a cue to invent a location: an unaddressable bundle
-  // must stop the publish, never ship a URL nobody claimed. (Confirmed with the
-  // backend 2026-08-17; `serve_url` is contractually on every plan entry.)
-  if (!entry.serveUrl)
-    throw new Error('data-bundle upload returned no serve_url')
-
-  return entry.serveUrl
-}