uniweb 0.25.2 → 0.25.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.25.2",
+  "version": "0.25.4",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,14 +42,14 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/core": "^0.10.1",
-    "@uniweb/kit": "^0.12.3",
     "@uniweb/semantic-parser": "^1.2.3",
-    "@uniweb/runtime": "^0.12.2"
+    "@uniweb/runtime": "^0.12.2",
+    "@uniweb/kit": "^0.12.3"
   },
   "peerDependencies": {
-    "@uniweb/semantic-parser": "^1.2.3",
+    "@uniweb/build": "^0.24.4",
     "@uniweb/content-reader": "^1.2.3",
-    "@uniweb/build": "^0.24.2"
+    "@uniweb/semantic-parser": "^1.2.3"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/backend/site-sync.js

@@ -24,7 +24,8 @@ import {
   diffSiteUnits,
   describeSiteDiff,
   computeUnitHashes,
-  collectUnitUuids
+  collectUnitUuids,
+  readAssetMap
 } from '@uniweb/build/uwx'
 
 // First entity `$`-document out of a `.uwx` we produced or the backend served.
@@ -181,11 +182,11 @@ function readSyncCacheFile(siteDir) {
     return {} // missing / unreadable → treat everything as changed
   }
 }
-// The cache holds three maps written on DIFFERENT events — content hashes on a
-// successful push, base versions on push AND pull, unit hashes on push and pull —
-// so every writer must preserve the ones it isn't touching. One merge point rather
-// than three hand-rolled preserves, because getting that wrong silently disarms
-// whichever map got clobbered.
+// The cache holds several maps written on DIFFERENT events — content hashes and the
+// injections that produced them on a successful push, base versions on push AND
+// pull, unit hashes on push and pull — so every writer must preserve the ones it
+// isn't touching. One merge point rather than a hand-rolled preserve per writer,
+// because getting that wrong silently disarms whichever map got clobbered.
 function updateSyncCache(siteDir, patch) {
   const p = syncCachePath(siteDir)
   mkdirSync(dirname(p), { recursive: true })
@@ -203,9 +204,10 @@ const readMap = (siteDir, key) => {
  * Drop every cache map that describes a BACKEND site, when this clone is bound to
  * none. Returns the names dropped (empty when there was nothing to do).
  *
- * `.uniweb/sync-cache.json` holds four maps keyed by *unit path* — item uuids,
- * content hashes, entity base versions, unit bases — and a unit path (`site.yml`,
- * `pages/about/about.md`) is the same string for every site. So the cache does not
+ * `.uniweb/sync-cache.json` holds five maps keyed by *unit path* — item uuids,
+ * content hashes, the injections those hashes were taken over, entity base versions,
+ * unit bases — and a unit path (`site.yml`, `pages/about/about.md`) is the same
+ * string for every site. So the cache does not
  * self-invalidate when `site.yml::$uuid` goes away: it keeps describing the site
  * this folder used to be.
  *
@@ -228,21 +230,29 @@ const readMap = (siteDir, key) => {
  * the clone look bound before the check runs.
  */
 /**
- * Drop the four remote-derived maps unconditionally, stamping the site they now
+ * Drop the five remote-derived maps unconditionally, stamping the site they now
  * describe (or clearing the stamp when there is none). Shared by the pre-flight
  * guard and the `item_uuid_conflict` recovery — the guard decides WHETHER, this
  * decides WHAT, and they must not drift.
  */
 export function clearRemoteSyncState(siteDir, siteUuid = null) {
   const prior = readSyncCacheFile(siteDir)
-  const dropped = ['itemUuids', 'hashes', 'baseVersions', 'unitBases'].filter(
-    (k) => prior[k] && Object.keys(prior[k]).length
-  )
+  const dropped = [
+    'itemUuids',
+    'hashes',
+    'baseVersions',
+    'unitBases',
+    'applied'
+  ].filter((k) => prior[k] && Object.keys(prior[k]).length)
   updateSyncCache(siteDir, {
     itemUuids: {},
     hashes: {},
     baseVersions: {},
     unitBases: {},
+    // Remote-derived like the rest, and doubly so: it holds the OLD site's asset
+    // serve URLs. Surviving the drop, it would rewrite the new site's media to
+    // bytes owned by the site this folder used to be.
+    applied: {},
     siteUuid: siteUuid || null
   })
   return dropped
@@ -258,7 +268,13 @@ export function clearRemoteSyncStateIfUnbound(siteDir) {
   }
 
   const prior = readSyncCacheFile(siteDir)
-  const REMOTE_MAPS = ['itemUuids', 'hashes', 'baseVersions', 'unitBases']
+  const REMOTE_MAPS = [
+    'itemUuids',
+    'hashes',
+    'baseVersions',
+    'unitBases',
+    'applied'
+  ]
   const populated = REMOTE_MAPS.filter(
     (k) => prior[k] && Object.keys(prior[k]).length
   )
@@ -302,8 +318,53 @@ export function clearRemoteSyncStateIfUnbound(siteDir) {
 export function readSyncCache(siteDir) {
   return readMap(siteDir, 'hashes')
 }
-export function writeSyncCache(siteDir, hashes) {
-  updateSyncCache(siteDir, { hashes })
+
+/**
+ * The hash-affecting injections the emit that produced those hashes applied, in the
+ * exact shape `emitSyncPackages` takes back as opts.
+ *
+ * ⛔ **Only the ones nothing else records.** `assetIds` is deliberately NOT banked
+ * here even though the emit applies it: `assets.json` is COMMITTED project state
+ * holding exactly that map (local ref → `{id, ext}`), written by the same push, and
+ * a gitignored second copy would be a second thing to disagree — the reason that
+ * file itself refuses to hold a serve URL. It also has the worse lifetime of the
+ * two: `clearRemoteSyncState` wipes this cache, and the committed map correctly
+ * survives. ⇒ Bank what a reader cannot re-derive; re-derive the rest.
+ *
+ * ⛔ Read this whenever you re-emit to COMPARE against `hashes`. A push hashes the
+ * DELIVERED document — local `/images/x.png` rewritten to the backend serve URL it
+ * just uploaded to, `info.foundation` replaced by the version-pinned ref — and banks
+ * that. An offline re-emit produces the AUTHORED document, which is a different
+ * document, so it matches nothing and every entity reads as changed forever. That is
+ * not hypothetical: it is what `uniweb status` did on any site with one local image
+ * (backend-framework-787e, 2026-08-19) — `push` said "1 entity unchanged" and
+ * `status --json` said `changed: 1`, from the same cache, seconds apart.
+ *
+ * ⭐ What is left is what only a backend round-trip produces — an asset **serve URL**
+ * and a released foundation version — and `status` is offline by design (measured at
+ * zero HTTP requests, a property the cross-client flows rely on). ⚠️ Note the serve
+ * URL is REPLAYED, never composed: we re-use the string the host handed us, which is
+ * a different act from reconstructing one, and the distinction is the same one that
+ * keeps `assets.json` id-only. An asset genuinely new to the site has no recorded
+ * mapping and still reads as changed, which is correct.
+ */
+export function readAppliedInjections(siteDir) {
+  return readMap(siteDir, 'applied')
+}
+
+/**
+ * Bank the content hashes and the injections that produced them. ⛔ ONE call, both
+ * maps: they describe the same document, so writing either alone leaves the cache
+ * self-inconsistent — and the failure is silent, since a hash never says which
+ * document it is of. `applied` is written even when empty, so it can never be a
+ * leftover from an earlier push describing hashes it no longer matches.
+ *
+ * `assetIds` is dropped rather than stored — see readAppliedInjections: it has a
+ * committed source of truth in `assets.json`, and the reader re-derives it there.
+ */
+export function writeSyncCache(siteDir, hashes, applied) {
+  const { assetIds: _inAssetsJson, ...bankable } = applied || {}
+  updateSyncCache(siteDir, { hashes, applied: bankable })
 }
 
 /**
@@ -835,10 +896,24 @@ export function writeUnitBases(siteDir, patch) {
  */
 export async function probeUnpushed(siteDir, { sendAll = false } = {}) {
   const priorHashes = readSyncCache(siteDir)
+  // Re-emit the document the last push HASHED, not the one the author wrote — see
+  // readAppliedInjections. Two sources, on purpose:
+  //   · BANKED — the serve URLs and pinned refs only a round-trip produces. Empty
+  //     for a cache written before this was banked (and for a never-pushed site),
+  //     which is the pre-fix behaviour and self-heals on the next push. It can never
+  //     point at the wrong document: it is written with the hashes it belongs to.
+  //   · RE-DERIVED — asset identity, from the COMMITTED `assets.json` the same push
+  //     wrote. Reading the live file rather than a snapshot is what makes a moved
+  //     map (a teammate's push, a pull) read as changed instead of matching a copy
+  //     of itself.
+  const applied = readAppliedInjections(siteDir)
+  const assetIds = readAssetMap(siteDir)
   const pkg = await emitSyncPackages(siteDir, {
     resolveModel: makeModelResolver({ client: null, offline: true }),
     priorHashes,
-    sendAll
+    sendAll,
+    ...applied,
+    ...(Object.keys(assetIds).length ? { assetIds } : {})
   })
   const changed =
     (pkg.siteContent?.entityCount || 0) + (pkg.collections?.entityCount || 0)
@@ -867,7 +942,7 @@ export async function pushSyncPackages({
   asOrg,
   report
 }) {
-  const { siteContent, collections, siteContentUuid, hashes } = pkg
+  const { siteContent, collections, siteContentUuid, hashes, applied } = pkg
   const { info, note, error } = report
   const dim = report.dim || ((s) => s)
 
@@ -1200,7 +1275,7 @@ export async function pushSyncPackages({
   // then bank the post-write tokens so the NEXT push carries a current base.
   // Entities absent from finalized[] (skipped, or not editable) keep their cached
   // value — absence is not invalidation.
-  writeSyncCache(siteDir, hashes)
+  writeSyncCache(siteDir, hashes, applied)
   mergeHarvested()
   // Re-base the page attribution: our emitted document and the backend's post-write
   // copy of it are the two sides' new agreed state. Only when the site-content lane

package/src/commands/publish.js

@@ -53,9 +53,9 @@ import {
   loadDeployYml,
   resolveTarget,
   recordLastDeploy,
-  assembleDataBall,
-  collectBallAssets,
-  rewriteBallAssets
+  collectSchemalessData,
+  collectSchemalessDataAssets,
+  rewriteSchemalessDataAssets
 } from '@uniweb/build/site'
 import { emitSyncPackages } from '@uniweb/build/uwx'
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
@@ -79,7 +79,6 @@ import {
   pushSyncPackages,
   resolveSiteOrgForCreate
 } from '../backend/site-sync.js'
-import { uploadDataBundle } from '../backend/data-bundle.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import { updateAssetMap, ASSET_MAP_FILE } from '@uniweb/build/uwx'
 import {
@@ -88,6 +87,7 @@ import {
 } from '../backend/foundation-bring-along.js'
 import { settlePaymentIfNeeded } from '../backend/payment-handoff.js'
 import { reportSchemalessCollections } from '../utils/schemaless-report.js'
+import { uploadSiteData } from '../utils/site-data-upload.js'
 
 const c = {
   reset: '\x1b[0m',
@@ -527,8 +527,8 @@ export async function publish(args = []) {
 
   // 4. Assemble the static-data ball (schema-less data + search index) BEFORE
   //    uploading, since its records can carry local media too.
-  let ball = await assembleDataBall(distDir, schemalessNames)
-  const ballAssets = collectBallAssets(ball)
+  let ball = await collectSchemalessData(distDir, schemalessNames)
+  const ballAssets = collectSchemalessDataAssets(ball)
 
   // 4b. Upload ALL local media (entity refs + ball refs) on one asset lane →
   //     the ref→serveUrl map; rewrite the entity content AND the ball with it.
@@ -567,7 +567,7 @@ export async function publish(args = []) {
           `${ASSET_MAP_FILE}   : ${rec.added.length} added, ${rec.changed.length} changed — commit it`
         )
       }
-      if (ballAssets.length) ball = rewriteBallAssets(ball, map)
+      if (ballAssets.length) ball = rewriteSchemalessDataAssets(ball, map)
       say.dim(
         `Media          : ${Object.keys(map).length}/${mediaRefs.length} ref(s) → serve URL`
       )
@@ -586,34 +586,56 @@ export async function publish(args = []) {
     }
   }
 
-  // 4c. Upload the (media-rewritten) ball → its content-addressed serve URL.
-  let dataBundle
+  // 4c. Deliver the schema-less collection data — one object per file.
+  //
+  //     Each `dist/data/**` file is PUT to the target `data-uploads` returns,
+  //     landing at its serving tail. Hosting intercepts `/data/**.json` and
+  //     reads `_data/{tail}` from the site bucket, so the file is served from
+  //     where it lands: **nothing records where anything went**, and no `info`
+  //     field is stamped.
+  //
+  //     ⛔ NO BALL. A CLI sends separates or a ball, never both — presence of a
+  //     ball is the backend's signal for which CLI it is talking to, and
+  //     sending both destroys it along with their ability to know when the
+  //     unwrap can be deleted. Released CLIs keep sending one and their unwrap
+  //     keeps serving them; this one does not.
+  //
+  //     📌 No capability gate, deliberately. A backend predating this lane
+  //     answers 404 and the publish fails — accepted while pre-prod [Diego,
+  //     2026-08-18: "we are pre-prod. I'm not concerned about old cli vs new"].
+  //     A gate was written and removed: it is machinery for a population that
+  //     does not exist, which is the failure this work kept catching in others.
+  //     `client.discover()` is the mechanism if that changes — `DISCOVERY_DEFAULTS`
+  //     makes an absent key non-breaking by construction.
   if (ball) {
-    say.info('Uploading data bundle…')
+    say.info('Uploading collection data…')
     try {
-      dataBundle = await uploadDataBundle(client, ball, {
+      const r = await uploadSiteData({
+        apiBase: client.origin,
+        token: await client.token(),
         siteUuid: site.uuid,
+        ball,
         onProgress: (m) => say.dim(`  ${m}`)
       })
-    } catch (err) {
-      // The ball rides the same asset lane, so it hits the same typed refusals.
-      const refusal = describeAssetRefusal(err)
-      if (refusal) {
-        say.err(refusal.headline)
-        for (const line of refusal.notes) say.dim(line)
-      } else {
-        say.err(`Data bundle upload failed: ${err.message}`)
+      if (r.failed.length) {
+        // A file whose bytes did not land must not be published: the site would
+        // serve a stale copy or 404, and the only trace would be a warning.
+        say.err(`${r.failed.length} data file(s) failed to upload — not publishing.`)
+        for (const f of r.failed) say.dim(`  ${f.path} (HTTP ${f.status})`)
+        return { exitCode: 1 }
       }
+      say.dim(`Collection data : ${r.uploaded.length} file(s) [${r.mode}]`)
+    } catch (err) {
+      say.err(`Collection data upload failed: ${err.message}`)
       return { exitCode: 1 }
     }
-    say.dim(
-      `Data bundle    : ${Object.keys(ball.data).length} data + ${Object.keys(ball.search).length} search file(s)`
-    )
   }
 
   // 5. Push the site (content + folder) over the send-only-changed cache —
   //    the SAME two-lane submission `uniweb push` uses — stamping
-  //    info.data_bundle and rewriting local media refs to backend serve URLs.
+  //    the pinned foundation ref and rewriting local media refs to serve URLs.
+  //    (It stamped `info.data_bundle` until 2026-08-18; the ball is gone and
+  //    collection data now lands at its serving tail, so nothing records it.)
   const priorHashes = readSyncCache(siteDir)
   // publish rides the same gated push as `uniweb push`: if an app author has
   // edited since this clone last synced, the push is refused rather than
@@ -635,8 +657,17 @@ export async function publish(args = []) {
   // released version on the wire is required when site.yml uses an unversioned
   // local ref; injectInfo overrides info.foundation. A registry/URL ref → fnd.ref
   // is null → the site.yml ref is forwarded verbatim (already pinned).
+  // ⛔ DO NOT STAMP `info.data` HERE. The name is TAKEN: `uwx/site.js` already
+  // emits `info.data` from `site.yml`'s top-level `data:`/`fetch:` block, and
+  // `injectInfo` WINS the merge (`sync-package.js`: `{...siteDoc.info,
+  // ...injectInfo}`), so stamping a file map here silently replaces the author's
+  // fetch config on the wire. Both are `type: json`, so the store validator
+  // accepts either and nothing errors at any layer.
+  //
+  // A file map needs a name nothing else claims (`static_data` / `data_files`
+  // were proposed) AND a consumer that reads it — neither settled. See
+  // `kb/framework/build/data-ball-retirement.md`.
   const injectInfo = {
-    ...(dataBundle ? { data_bundle: dataBundle } : {}),
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }
   let pkg

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-18T16:05:00.154Z",
+  "generatedAt": "2026-08-19T03:59:24.190Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.24.2",
+      "version": "0.24.4",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",

package/src/utils/site-data-upload.js

@@ -0,0 +1,184 @@
+/**
+ * Static collection data — the passthrough lane.
+ *
+ * A site's **schema-less** collections have no entity model, so their compiled
+ * `dist/data/**` JSON is delivered as files rather than synced as entities.
+ * This plans and uploads that set: one plan call, one object per file, each
+ * PUT to the target the backend returns.
+ *
+ *   1. PLAN   — POST {apiBase}/dev/site/data-uploads/{site} with the file list
+ *               ({ path, content_type, size, sha256 }). Response carries
+ *               `mode` ('presigned' | 'direct'), `expires_in`, `serve_base`,
+ *               and one `uploads` entry per file ({ path, method, url, headers }).
+ *   2. UPLOAD — PUT each file's bytes to its URL. Order is irrelevant; there is
+ *               no entry file and no server confirm step.
+ *
+ * ⭐ **`path` is the SERVING TAIL** (`data/articles.json`), not a bookkeeping
+ * key. The file lands where it is served — which is the whole point of this
+ * lane, and why it returns no map: nothing has to record where anything went.
+ *
+ * ## Why this is not the asset lane
+ *
+ * Assets are **global and content-addressed** — identical bytes dedup across
+ * sites — so the relation from a site's path to an object is many-to-one and a
+ * serve path cannot be a property of the object. This lane is **per-site and
+ * path-addressed**. Sending static data through the asset store is what forced
+ * the old "data ball": one bundled asset the backend had to fetch, parse and
+ * fan out, which is the only place these bytes ever transited it.
+ *
+ * ⇒ **The backend is a PASSTHROUGH here** — it brokers the authorization, not
+ * the bytes. Hosting static content is the hosting platform's mission where an
+ * edge exists; where there is none (edgeless), the backend serves them itself,
+ * and that is the posture working rather than a fallback.
+ *
+ * ⛔ **Do not compose paths onto `serve_base`.** It is `null` on the presigned
+ * arm (prod serving is the delivery tier's URL shape, not the backend's to
+ * mint) and the gateway's data route on the direct arm. Nothing in a build
+ * needs it — the site's fetcher asks for a site-relative `/data/{path}` at
+ * runtime — so it is returned for parity and for a caller that wants to verify
+ * an upload landed.
+ *
+ * Contract ratified 2026-08-18; see `kb/framework/build/data-ball-retirement.md`.
+ * **Wired into `publish.js` and shipped in `uniweb` 0.25.3.** Both arms of the
+ * endpoint exist (presigned landed 2026-08-18, per Diego).
+ *
+ * ⚠️ **The presigned arm has never been exercised against a real backend from
+ * here.** The branch is one line and unit-tested both ways, but a stub is not a
+ * presigning deployment — three claims diverged that way in a single day while
+ * this lane was being built. A local `uniwebd` answers `direct`, so proving it
+ * needs a presigning deployment and one real publish. **Believed correct, not
+ * demonstrated.**
+ */
+
+import { createHash } from 'node:crypto'
+
+/**
+ * Plan + upload a site's static collection data files.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiBase - backend origin
+ * @param {string} opts.token - bearer, used on the direct arm only
+ * @param {string} opts.siteUuid - the site these files belong to (path segment)
+ * @param {{ data: Record<string, unknown> }|null} opts.ball - source of the set:
+ *   `{ "<relpath under dist/data>": <json> }`, media refs already rewritten
+ * @param {(m: string) => void} [opts.onProgress]
+ * @returns {Promise<{ mode: string, uploaded: string[], failed: Array<{path:string,status:number,detail?:string}>, serveBase: string|null }>}
+ *   **No map** — by design. The files are at their serving paths.
+ */
+export async function uploadSiteData({
+  apiBase,
+  token,
+  siteUuid,
+  ball,
+  onProgress = () => {}
+}) {
+  const entries = Object.entries(ball?.data || {})
+  if (!entries.length) {
+    return { mode: 'none', uploaded: [], failed: [], serveBase: null }
+  }
+
+  // One plan for the whole set. The per-request file cap counts a plan, so
+  // splitting would evade it rather than respect it; if a set ever exceeds it,
+  // the refusal is the correct outcome and the cap is the thing to fix.
+  const files = entries.map(([relPath, value]) => {
+    const bytes = Buffer.from(JSON.stringify(value))
+    return {
+      // ⚠️ The tail RELATIVE TO THE DATA ROOT — no `data/` prefix.
+      //
+      // The plan's `serve_base` already ends in `/data/`
+      // (`/gateway/site/{site}/data/`), and the runtime asks for
+      // `{config.base}/data/{name}.json` (`DATA_URL_PREFIX`). Sending
+      // `data/articles.json` would store one level too deep and serve at
+      // `…/data/data/articles.json`, which the runtime never requests.
+      //
+      // ⛔ And the failure is INVISIBLE from here: the plan succeeds, the PUT
+      // succeeds, and only a visitor's fetch 404s. Confirmed against the
+      // shipped contract's own example (`collections/articles.json` with a
+      // `/data/`-bearing `serve_base`), which supersedes an earlier
+      // parenthetical that showed the prefix.
+      path: relPath,
+      content_type: 'application/json',
+      size: bytes.length,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+      bytes
+    }
+  })
+
+  const origin = apiBase.replace(/\/$/, '')
+  // `{site}` is a PATH segment, not a body field — every sibling on this
+  // controller addresses the site that way (`content/push/{site}`,
+  // `publish/{site}`, `status/{site}`). The asset lane's body-borne owner is
+  // the wrong precedent: that lane is global, this one is per-site.
+  const planRes = await fetch(
+    `${origin}/dev/site/data-uploads/${encodeURIComponent(siteUuid)}`,
+    {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({
+        files: files.map(({ path, content_type, size, sha256 }) => ({
+          path,
+          content_type,
+          size,
+          sha256
+        }))
+      })
+    }
+  )
+  if (!planRes.ok) {
+    const body = await planRes.text().catch(() => '')
+    throw new Error(
+      `site data-uploads plan rejected: HTTP ${planRes.status}${body ? ` — ${body.slice(0, 300)}` : ''}`
+    )
+  }
+
+  const plan = await planRes.json()
+  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
+  // The one mode-aware bit, same rule as the code and runtime lanes: a direct
+  // PUT is a bearer-authed backend route; a presigned URL is self-authorizing
+  // and must NOT carry a foreign bearer, which can break signature validation.
+  const authHeaders =
+    plan.mode === 'presigned' ? {} : { Authorization: `Bearer ${token}` }
+
+  const uploaded = []
+  const failed = []
+  for (const f of files) {
+    const target = targets.get(f.path)
+    if (!target) {
+      // A file the plan did not answer for is unaddressable. Report it; never
+      // invent a location for it.
+      failed.push({ path: f.path, status: 0, detail: 'no upload target in plan' })
+      continue
+    }
+    try {
+      // Relative on the direct arm, absolute on presigned — `new URL` resolves
+      // both against the origin.
+      const res = await fetch(new URL(target.url, origin), {
+        method: target.method || 'PUT',
+        headers: {
+          'Content-Type': 'application/json',
+          ...(target.headers || {}),
+          ...authHeaders
+        },
+        body: f.bytes
+      })
+      if (res.ok) {
+        uploaded.push(f.path)
+        onProgress(`${f.path}`)
+      } else {
+        failed.push({ path: f.path, status: res.status })
+      }
+    } catch (err) {
+      failed.push({ path: f.path, status: 0, detail: err.message })
+    }
+  }
+
+  return {
+    mode: plan.mode || 'direct',
+    uploaded,
+    failed,
+    serveBase: plan.serve_base || null
+  }
+}

package/src/backend/data-bundle.js

@@ -1,85 +0,0 @@
-/**
- * Upload the static-data ball (assembleDataBall's `{ data, search }` doc) to the
- * backend's content-addressed asset store via the SAME asset lane deploy uses for
- * media, and return its durable serve URL — the `info.data_bundle` the composite push
- * stamps on the site-content entity. The backend unwraps the ball into the `/data/*`
- * + `/_search/*` bytes the gateway serves.
- *
- * The ball is in-memory (not a built file on disk), so it rides as `bytes` on the
- * single upload entry — `uploadSiteAssets` PUTs `bytes` when present, else reads a
- * `diskPath` (its media path). Content-addressed like every asset: identical ball →
- * same id → a re-deploy of unchanged data is a cheap no-op PUT.
- *
- * The returned URL is the plan entry's `serve_url`, read verbatim. See the note at
- * the return for why the origin-relative form is safe to store.
- */
-
-import { createHash } from 'node:crypto'
-
-/**
- * @param {object} client - BackendClient (origin + uploadSiteAssets)
- * @param {{ data: object, search: object }} ball - the assembled data ball
- * @param {{ onProgress?: (m: string) => void }} [opts]
- * @returns {Promise<string>} the content-addressed serve URL (→ `info.data_bundle`)
- */
-export async function uploadDataBundle(
-  client,
-  ball,
-  { siteUuid = null, onProgress } = {}
-) {
-  const bytes = Buffer.from(JSON.stringify(ball))
-  const sha256 = createHash('sha256').update(bytes).digest('hex')
-  const localUrl = '/data-bundle/base.json' // bookkeeping key into assetsByLocalUrl
-
-  const result = await client.uploadSiteAssets({
-    files: [
-      {
-        path: 'data-bundle/base.json',
-        content_type: 'application/json',
-        size: bytes.length,
-        sha256,
-        localUrl,
-        bytes
-      }
-    ],
-    siteUuid,
-    onProgress
-  })
-  if (result.failed?.length) {
-    const f = result.failed[0]
-    throw new Error(`data-bundle upload failed: HTTP ${f.status} ${f.detail}`)
-  }
-  const entry = result.assetsByLocalUrl[localUrl]
-  if (!entry) throw new Error('data-bundle upload returned no asset id')
-
-  // The backend's canonical serve URL, READ — never composed. Same rule and the
-  // same code path as `site-media.js`; until 2026-08-17 this composed from a
-  // discovered `assetBase` unconditionally, which made it the one place a
-  // discovery failure could bake the historical production CDN host into content
-  // we push.
-  //
-  // Storing it verbatim is safe even though `serve_url` is ORIGIN-RELATIVE in the
-  // backend's `direct` mode — the only mode any deployment has ever run.
-  // `info.data_bundle` is never fetched over HTTP: the backend resolves it to a
-  // blob-store key, discarding everything before the final `dist/`, so absolute
-  // and relative forms resolve to the same key (pinned both ways on their side).
-  //
-  // ⚠️ That argument is scoped to a serve URL CONTAINING `dist/`, and the scope is
-  // load-bearing rather than incidental: the key is recovered by splitting on that
-  // segment, so a serve URL without one cannot be resolved to a key at all — the
-  // failure is on the READING side, and this push looks entirely successful.
-  // Reported by the backend 2026-08-17 as a defect on their side, not yet fixed;
-  // not verified here, and not ours to fix. It is unreached only because no
-  // deployment yet mints URLs of the other shape. ⇒ We keep reading `serve_url`
-  // verbatim — composing one would be the worse answer, and it is the very coupling
-  // deleted above. What we must NOT do is infer from "this has always worked" that
-  // any serve URL round-trips; that holds for the shape, not for the field.
-  //
-  // Absent is an error, not a cue to invent a location: an unaddressable bundle
-  // must stop the publish, never ship a URL nobody claimed. (Confirmed with the
-  // backend 2026-08-17; `serve_url` is contractually on every plan entry.)
-  if (!entry.serveUrl)
-    throw new Error('data-bundle upload returned no serve_url')
-
-  return entry.serveUrl
-}