uniweb 0.37.0 → 0.38.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "^0.16.0",
-    "@uniweb/kit": "^0.15.2",
-    "@uniweb/runtime": "^0.13.5",
-    "@uniweb/semantic-parser": "^1.4.0"
+    "@uniweb/core": "^0.17.0",
+    "@uniweb/kit": "^0.15.4",
+    "@uniweb/semantic-parser": "^1.4.0",
+    "@uniweb/runtime": "^0.13.6"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.33.0",
     "@uniweb/content-reader": "^1.2.4",
-    "@uniweb/semantic-parser": "^1.4.0"
+    "@uniweb/semantic-parser": "^1.4.0",
+    "@uniweb/build": "^0.34.0"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-02T16:36:26.382Z",
+  "generatedAt": "2026-09-02T18:47:18.047Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.2.2",
+      "version": "0.2.3",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.33.0",
+      "version": "0.34.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -34,7 +34,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.16.0",
+      "version": "0.17.0",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -47,14 +47,14 @@
       "deps": []
     },
     "@uniweb/icons": {
-      "version": "0.4.7",
+      "version": "0.4.8",
       "path": "framework/icons",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/kit": {
-      "version": "0.15.2",
+      "version": "0.15.4",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -73,7 +73,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.5.4",
+      "version": "0.5.5",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -81,7 +81,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.13.5",
+      "version": "0.13.6",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -119,7 +119,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.8.19",
+      "version": "0.9.0",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/templates/fetchers/github.js

@@ -8,6 +8,7 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import * as tar from 'tar'
+import { fetchWithRetry as sharedFetchWithRetry } from '../../utils/fetch-retry.js'
 
 /**
  * Fetch a template from a GitHub repository
@@ -78,21 +79,9 @@ export async function fetchGitHubTemplate(owner, repo, options = {}) {
   }
 }
 
-/**
- * Fetch with retry and timeout
- */
-async function fetchWithRetry(url, options = {}, maxRetries = 3) {
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    try {
-      const response = await fetch(url, {
-        ...options,
-        signal: AbortSignal.timeout(60000) // 60s timeout for GitHub (can be slow)
-      })
-      return response
-    } catch (err) {
-      if (attempt === maxRetries) throw err
-      const delay = Math.min(1000 * Math.pow(2, attempt), 10000)
-      await new Promise((r) => setTimeout(r, delay))
-    }
-  }
-}
+// Retry + timeout live in one place now (`../../utils/fetch-retry.js`).
+// This file carried its own copy, as did the other two fetchers — three
+// byte-identical implementations, and none reachable from the upload paths
+// that had no retry at all. The wrapper keeps this caller's own timeout.
+const fetchWithRetry = (url, options = {}, maxRetries = 3) =>
+  sharedFetchWithRetry(url, { ...options }, { retries: maxRetries, timeoutMs: 60000 })

package/src/templates/fetchers/npm.js

@@ -8,6 +8,7 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import * as tar from 'tar'
+import { fetchWithRetry as sharedFetchWithRetry } from '../../utils/fetch-retry.js'
 
 /**
  * Fetch a template from npm registry
@@ -76,21 +77,9 @@ export async function fetchNpmTemplate(packageName, options = {}) {
   }
 }
 
-/**
- * Fetch with retry and timeout
- */
-async function fetchWithRetry(url, options = {}, maxRetries = 3) {
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    try {
-      const response = await fetch(url, {
-        ...options,
-        signal: AbortSignal.timeout(30000) // 30s timeout
-      })
-      return response
-    } catch (err) {
-      if (attempt === maxRetries) throw err
-      const delay = Math.min(1000 * Math.pow(2, attempt), 10000)
-      await new Promise((r) => setTimeout(r, delay))
-    }
-  }
-}
+// Retry + timeout live in one place now (`../../utils/fetch-retry.js`).
+// This file carried its own copy, as did the other two fetchers — three
+// byte-identical implementations, and none reachable from the upload paths
+// that had no retry at all. The wrapper keeps this caller's own timeout.
+const fetchWithRetry = (url, options = {}, maxRetries = 3) =>
+  sharedFetchWithRetry(url, { ...options }, { retries: maxRetries, timeoutMs: 30000 })

package/src/templates/fetchers/release.js

@@ -8,6 +8,7 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import * as tar from 'tar'
+import { fetchWithRetry as sharedFetchWithRetry } from '../../utils/fetch-retry.js'
 
 // GitHub repository for official templates
 const TEMPLATES_REPO = 'uniweb/templates'
@@ -222,22 +223,9 @@ async function handleGitHubError(response) {
   throw new Error(`GitHub API error: ${response.status}`)
 }
 
-/**
- * Fetch with retry and timeout
- */
-async function fetchWithRetry(url, options = {}, maxRetries = 3) {
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    try {
-      const response = await fetch(url, {
-        ...options,
-        redirect: 'follow',
-        signal: AbortSignal.timeout(60000) // 60s timeout
-      })
-      return response
-    } catch (err) {
-      if (attempt === maxRetries) throw err
-      const delay = Math.min(1000 * Math.pow(2, attempt), 10000)
-      await new Promise((r) => setTimeout(r, delay))
-    }
-  }
-}
+// Retry + timeout live in one place now (`../../utils/fetch-retry.js`).
+// This file carried its own copy, as did the other two fetchers — three
+// byte-identical implementations, and none reachable from the upload paths
+// that had no retry at all. The wrapper keeps this caller's own timeout.
+const fetchWithRetry = (url, options = {}, maxRetries = 3) =>
+  sharedFetchWithRetry(url, { redirect: 'follow', ...options }, { retries: maxRetries, timeoutMs: 60000 })

package/src/utils/asset-upload.js

@@ -30,6 +30,7 @@ import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { contentTypeFor } from './code-upload.js'
+import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
 
 /**
  * Walk a built site's `dist/assets/` and produce the upload file list. `path` is
@@ -202,11 +203,20 @@ export async function uploadSiteAssets({
     try {
       // The plan's url may be origin-relative (direct mode → the backend) or
       // absolute (presigned → storage); new URL() resolves both.
-      putRes = await fetch(new URL(up.url, origin), {
+      // ⭐ **Retried.** A single connection-level failure used to fail the whole
+      // verb after every other file had already gone up. The PUT is idempotent
+      // here — same bytes, same target, verified by `x-uniweb-sha256` on receipt
+      // — so repeating it is safe by construction, which is why this opts in to
+      // `retryOnStatus` rather than inheriting it.
+      //
+      // ⚠️ 120s per attempt, not the helper's 30s default: this bounds the time
+      // to send a whole BODY, and aborting a legitimately slow upload only to
+      // retry it is worse than not timing out at all.
+      putRes = await fetchWithRetry(new URL(up.url, origin), {
         method: up.method || 'PUT',
         headers,
         body: src.bytes ?? readFileSync(src.diskPath)
-      })
+      }, { timeoutMs: 120_000, retryOnStatus: isTransientStatus })
     } catch (err) {
       failed.push({ path: src.path, status: 0, detail: err.message })
       continue

package/src/utils/code-upload.js

@@ -41,6 +41,7 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join } from 'node:path'
+import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
 
 // Extension → declared content type. Extension-honest by construction (Vite
 // output); anything unknown ships as octet-stream.
@@ -287,7 +288,16 @@ export async function uploadFoundationCode({
     }
     const bytes = readFileSync(join(distDir, file.path))
     try {
-      const res = await fetch(new URL(target.url, origin), {
+      // ⭐ **Retried.** A single connection-level failure used to fail the whole
+      // verb after every other file had already gone up. The PUT is idempotent
+      // here — same bytes, same target, verified by `x-uniweb-sha256` on receipt
+      // — so repeating it is safe by construction, which is why this opts in to
+      // `retryOnStatus` rather than inheriting it.
+      //
+      // ⚠️ 120s per attempt, not the helper's 30s default: this bounds the time
+      // to send a whole BODY, and aborting a legitimately slow upload only to
+      // retry it is worse than not timing out at all.
+      const res = await fetchWithRetry(new URL(target.url, origin), {
         method: target.method || 'PUT',
         // x-uniweb-sha256: optional integrity guard — direct mode verifies
         // the received bytes and 400s on mismatch (corruption-in-flight).
@@ -297,7 +307,7 @@ export async function uploadFoundationCode({
           'x-uniweb-sha256': file.sha256
         },
         body: bytes
-      })
+      }, { timeoutMs: 120_000, retryOnStatus: isTransientStatus })
       if (res.ok) {
         uploaded.push(file.path)
         onProgress(`${file.path} (${file.size} bytes)`)

package/src/utils/fetch-retry.js

@@ -0,0 +1,109 @@
+/**
+ * `fetch` with bounded retry and a timeout. **The one implementation.**
+ *
+ * ## Why this file exists
+ *
+ * There were three, byte-identical apart from a timeout constant — one each in
+ * `templates/fetchers/{npm,release,github}.js` — and **none of them was reachable
+ * from the code that needed it most.** The three upload paths (`code-upload`,
+ * `asset-upload`, `site-data-upload`) had no retry at all, so a single
+ * connection-level failure on any one file failed the whole `register` / `push`
+ * / `publish` after every other file had already gone up.
+ *
+ * ⭐ **Measured by the `flows` lane, 2026-09-02:** roughly one red per full suite
+ * run, landing on a *different flow each time* and passing on re-run every time —
+ * the signature of an unretried transient, with the network as the variable
+ * rather than any flow. Their symptom was recorded as "not diagnosed, may be the
+ * manor, the CDN, or the connection"; it was none of those. It was us.
+ *
+ * ## ⚠️ What a retry does NOT do
+ *
+ * It masks whatever drops the connection. That is the right trade for a genuine
+ * transient and the wrong one for a systematic fault: if the failure rate ever
+ * climbs, a retry turns a fast red into a slow one and hides the cause. **Do not
+ * read a green run as evidence the network is healthy.**
+ *
+ * ## Retrying a PUT is safe HERE, and not in general
+ *
+ * These uploads are idempotent by construction — the same bytes to the same
+ * target, with an `x-uniweb-sha256` integrity guard the far side verifies. That
+ * is why `retryOnStatus` is **opt-in** rather than the default: a caller has to
+ * assert its own idempotence, because this helper cannot know it.
+ */
+
+const DEFAULT_RETRIES = 3
+const DEFAULT_TIMEOUT_MS = 30_000
+const MAX_BACKOFF_MS = 10_000
+
+/** Exponential backoff, capped. Attempt is 1-based. */
+const backoffMs = (attempt) => Math.min(1000 * Math.pow(2, attempt), MAX_BACKOFF_MS)
+
+/**
+ * @param {string|URL} url
+ * @param {RequestInit} [options] - passed to `fetch`; `signal` is supplied here.
+ * @param {Object} [config]
+ * @param {number} [config.retries=3] - total attempts, not extra ones.
+ * @param {number} [config.timeoutMs=30000] - per ATTEMPT, not for the whole call.
+ *   ⚠️ For an upload this bounds the time to send a whole body, so a large file
+ *   on a slow link needs a generous value — too short and a legitimately slow
+ *   upload is aborted and then retried, which is worse than no timeout at all.
+ * @param {(status: number) => boolean} [config.retryOnStatus] - opt-in. Without
+ *   it only a THROWN fetch is retried (a connection-level failure, which is what
+ *   surfaces as `status: 0` in the upload paths). A caller passing this asserts
+ *   its request is safe to repeat.
+ * @param {(info: {attempt: number, of: number, reason: string, delayMs: number}) => void} [config.onRetry]
+ *   Called before each wait. ⭐ Worth passing: a retry that no one can see turns
+ *   a visible failure into an invisible slowdown, which is its own defect.
+ * @returns {Promise<Response>}
+ */
+export async function fetchWithRetry(url, options = {}, config = {}) {
+  const {
+    retries = DEFAULT_RETRIES,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    retryOnStatus = null,
+    onRetry = null,
+  } = config
+
+  let lastErr = null
+
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const res = await fetch(url, {
+        ...options,
+        signal: options.signal ?? AbortSignal.timeout(timeoutMs),
+      })
+
+      if (attempt < retries && retryOnStatus && retryOnStatus(res.status)) {
+        const delayMs = backoffMs(attempt)
+        onRetry?.({ attempt, of: retries, reason: `HTTP ${res.status}`, delayMs })
+        await new Promise((r) => setTimeout(r, delayMs))
+        continue
+      }
+
+      return res
+    } catch (err) {
+      lastErr = err
+      // The last attempt throws to the caller, which keeps this a drop-in for
+      // the three template fetchers whose contract was "throws like fetch".
+      if (attempt === retries) throw err
+      const delayMs = backoffMs(attempt)
+      onRetry?.({ attempt, of: retries, reason: err.message, delayMs })
+      await new Promise((r) => setTimeout(r, delayMs))
+    }
+  }
+
+  /* c8 ignore next 2 -- unreachable: the loop returns or throws on the last attempt */
+  throw lastErr
+}
+
+/**
+ * The statuses worth repeating an idempotent request for: a server that failed
+ * to answer this time, or asked us to slow down.
+ *
+ * ⛔ Never a 4xx other than 429 — a rejection does not improve on repetition,
+ * and retrying one turns a clear error into a delayed clear error.
+ *
+ * @param {number} status
+ * @returns {boolean}
+ */
+export const isTransientStatus = (status) => status === 429 || status >= 500

package/src/utils/registry-auth.js

@@ -1,3 +1,23 @@
+/**
+ * ⛔ **HUMAN OUTPUT IN THIS FILE GOES TO STDERR, NEVER STDOUT.**
+ *
+ * `stdout` is the CLI's DATA channel. `uniweb register --json` promises a single
+ * parseable JSON line there, and `register` diverts its own output accordingly —
+ * but it calls into this module, which wrote prose to stdout directly, so the
+ * promise broke for any caller that piped it.
+ *
+ * ⭐ Measured by the `flows` lane at `uniweb@0.37.1`: two stray lines ahead of
+ * the JSON on the cold path — down from ~35 before the delegated builder's
+ * stdout was redirected to fd 2, which is why the two defects share one symptom
+ * and only one of them was fixed. Every line here is prose, a prompt, or a
+ * cancellation notice; none of it is anything a machine reads. On stderr it is
+ * equally visible to a human and invisible to a pipe.
+ *
+ * ⚖️ This is not a `--json` special case. A utility that cannot see the flag
+ * should not be choosing the stream at all — which is exactly how it got the
+ * choice wrong. `cli/test/porcelain-stdout.test.js` walks `register`'s import
+ * graph and fails on a new `console.log`.
+ */
 /**
  * Registry (new-backend) credential storage + login.
  *
@@ -212,11 +232,11 @@ export async function ensureRegistryAuth({
   }
 
   if (stored && isExpired(stored)) {
-    console.log(
+    console.error(
       `\x1b[33mSession expired.\x1b[0m ${command} requires a Uniweb account.\n`
     )
   } else {
-    console.log(`${command} requires a Uniweb account.\n`)
+    console.error(`${command} requires a Uniweb account.\n`)
   }
 
   // Interactive: hand off to the multi-method login picker, reuse its session.
@@ -273,7 +293,7 @@ async function loginViaPassword({ apiBase, nonInteractive }) {
       ],
       {
         onCancel: () => {
-          console.log('\nLogin cancelled.')
+          console.error('\nLogin cancelled.')
           process.exit(0)
         }
       }
@@ -300,7 +320,7 @@ async function loginViaTokenPaste({ apiBase, nonInteractive }) {
     },
     {
       onCancel: () => {
-        console.log('\nLogin cancelled.')
+        console.error('\nLogin cancelled.')
         process.exit(0)
       }
     }
@@ -398,14 +418,14 @@ export async function awaitBrowserCallback({
       const { port } = server.address()
       const redirectUri = `http://127.0.0.1:${port}/callback`
       const url = buildUrl(redirectUri)
-      console.log(`\x1b[36m→\x1b[0m ${openingLabel}`)
-      console.log(`  \x1b[2m${url}\x1b[0m`)
+      console.error(`\x1b[36m→\x1b[0m ${openingLabel}`)
+      console.error(`  \x1b[2m${url}\x1b[0m`)
       const opened = await openBrowser(url)
       if (!opened)
-        console.log(
+        console.error(
           '\x1b[33m⚠\x1b[0m Could not open a browser automatically — open the URL above.'
         )
-      console.log(
+      console.error(
         `\x1b[2m${waitingLabel || `Waiting (${Math.round(timeoutMs / 1000)}s)…`}\x1b[0m`
       )
     })
@@ -528,10 +548,10 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       existing.username ||
       existing.handle ||
       (existing.uuid ? `account ${existing.uuid}` : '')
-    console.log(
+    console.error(
       `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}.`
     )
-    console.log('\x1b[2mContinuing will replace the existing session.\x1b[0m\n')
+    console.error('\x1b[2mContinuing will replace the existing session.\x1b[0m\n')
   }
 
   const { isNonInteractive } = await import('./interactive.js')
@@ -558,7 +578,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     if (account?.username) record.username = account.username
     if (account?.handle) record.handle = account.handle
     await writeRegistryAuth(record)
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Logged in${account?.username ? ` as \x1b[1m${account.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
     )
     return record
@@ -604,7 +624,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
         },
         {
           onCancel: () => {
-            console.log('\nLogin cancelled.')
+            console.error('\nLogin cancelled.')
             process.exit(0)
           }
         }
@@ -626,7 +646,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
   }
 
   if (record?.token) {
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Logged in${record.username ? ` as \x1b[1m${record.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
     )
   }

package/src/utils/registry-orgs.js

@@ -1,3 +1,23 @@
+/**
+ * ⛔ **HUMAN OUTPUT IN THIS FILE GOES TO STDERR, NEVER STDOUT.**
+ *
+ * `stdout` is the CLI's DATA channel. `uniweb register --json` promises a single
+ * parseable JSON line there, and `register` diverts its own output accordingly —
+ * but it calls into this module, which wrote prose to stdout directly, so the
+ * promise broke for any caller that piped it.
+ *
+ * ⭐ Measured by the `flows` lane at `uniweb@0.37.1`: two stray lines ahead of
+ * the JSON on the cold path — down from ~35 before the delegated builder's
+ * stdout was redirected to fd 2, which is why the two defects share one symptom
+ * and only one of them was fixed. Every line here is prose, a prompt, or a
+ * cancellation notice; none of it is anything a machine reads. On stderr it is
+ * equally visible to a human and invisible to a pipe.
+ *
+ * ⚖️ This is not a `--json` special case. A utility that cannot see the flag
+ * should not be choosing the stream at all — which is exactly how it got the
+ * choice wrong. `cli/test/porcelain-stdout.test.js` walks `register`'s import
+ * graph and fails on a new `console.log`.
+ */
 /**
  * New-backend org operations for the publish-scope bootstrap — used by
  * `uniweb register`'s scope resolution and the `uniweb org` command.
@@ -150,7 +170,7 @@ export async function deriveScope({
     const h = orgs[0].handle
     const label = isPersonal(h) ? `your personal org @${h}` : `your org @${h}`
     if (nonInteractive) {
-      console.log(
+      console.error(
         `Publishing under ${label.replace(`@${h}`, `\x1b[1m@${h}\x1b[0m`)}.`
       )
       return h
@@ -165,13 +185,13 @@ export async function deriveScope({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
     )
     if (!ok) {
-      console.log(
+      console.error(
         'Pass --scope @org, or create another with `uniweb org create <handle>`.'
       )
       return null
@@ -189,7 +209,7 @@ export async function deriveScope({
         ordered.find((u) => isPersonal(u.handle)) ||
         orgs.find((u) => u.is_primary) ||
         orgs[0]
-      console.log(
+      console.error(
         `Multiple orgs; using \x1b[1m@${pick.handle}\x1b[0m (non-interactive).`
       )
       return pick.handle
@@ -208,7 +228,7 @@ export async function deriveScope({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
@@ -281,7 +301,7 @@ export async function offerCreateOrg({
     { title: 'A new organization…', value: ':new' }
   ]
   if (!canClaimPersonal) {
-    console.log(
+    console.error(
       `\x1b[2m@${personal} exists but you're not a member of it — ask its admin, or create another org.\x1b[0m`
     )
   }
@@ -296,7 +316,7 @@ export async function offerCreateOrg({
     },
     {
       onCancel: () => {
-        console.log('\nCancelled.')
+        console.error('\nCancelled.')
         process.exit(0)
       }
     }
@@ -314,7 +334,7 @@ export async function offerCreateOrg({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
@@ -325,7 +345,7 @@ export async function offerCreateOrg({
 
   try {
     const org = await createOrg({ apiBase, token, handle })
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Created \x1b[1m@${org.handle}\x1b[0m — you're a member${org.is_primary ? ' (primary)' : ''}.`
     )
     return org.handle

package/src/utils/site-data-upload.js

@@ -52,6 +52,7 @@
 
 import { createHash } from 'node:crypto'
 import { humanBytes } from './bytes.js'
+import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
 
 /**
  * Plan + upload a site's static collection data files.
@@ -189,7 +190,16 @@ export async function uploadSiteData({
     try {
       // Relative on the direct arm, absolute on presigned — `new URL` resolves
       // both against the origin.
-      const res = await fetch(new URL(target.url, origin), {
+      // ⭐ **Retried.** A single connection-level failure used to fail the whole
+      // verb after every other file had already gone up. The PUT is idempotent
+      // here — same bytes, same target, verified by `x-uniweb-sha256` on receipt
+      // — so repeating it is safe by construction, which is why this opts in to
+      // `retryOnStatus` rather than inheriting it.
+      //
+      // ⚠️ 120s per attempt, not the helper's 30s default: this bounds the time
+      // to send a whole BODY, and aborting a legitimately slow upload only to
+      // retry it is worse than not timing out at all.
+      const res = await fetchWithRetry(new URL(target.url, origin), {
         method: target.method || 'PUT',
         headers: {
           'Content-Type': 'application/json',
@@ -197,7 +207,7 @@ export async function uploadSiteData({
           ...authHeaders
         },
         body: f.bytes
-      })
+      }, { timeoutMs: 120_000, retryOnStatus: isTransientStatus })
       if (res.ok) {
         uploaded.push(f.path)
         onProgress(`${f.path}`)