uniweb 0.56.10 → 0.56.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.56.10",
+  "version": "0.56.11",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,16 +41,16 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
+    "@uniweb/content-writer": "^0.3.4",
     "@uniweb/core": "^0.29.4",
-    "@uniweb/kit": "^0.19.3",
+    "@uniweb/runtime": "^0.26.4",
     "@uniweb/schemas": "^0.3.3",
-    "@uniweb/content-writer": "^0.3.4",
     "@uniweb/semantic-parser": "^1.4.1",
-    "@uniweb/runtime": "^0.26.4"
+    "@uniweb/kit": "^0.19.3"
   },
   "peerDependencies": {
-    "@uniweb/content-reader": "^1.2.5",
     "@uniweb/build": "^0.52.6",
+    "@uniweb/content-reader": "^1.2.5",
     "@uniweb/semantic-parser": "^1.4.1"
   },
   "peerDependenciesMeta": {

package/src/backend/foundation-bring-along.js

@@ -40,6 +40,7 @@ import { detectFoundationType, isExtensionUrl } from '@uniweb/build'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { readFlagValue } from '../utils/args.js'
 import { isNonInteractive } from '../utils/interactive.js'
+import { compareSemverPrecedence } from '../utils/semver-precedence.js'
 
 /**
  * Resolve the site's LOCAL foundation — the one publish should bring along — or
@@ -117,13 +118,19 @@ export function resolveLocalExtensions(siteDir, siteYml) {
 }
 
 // The foundation's scoped catalog name (`@org/name`) from its package.json — an
-// already-scoped `name`, else `uniweb.scope` + a bare `name`. Null when neither
+// already-scoped name, else `uniweb.scope` + a bare one. Null when neither
 // yields a scoped name (then we can't look up the registered version, so the
 // caller treats the foundation as "release it and let register pick the scope").
+//
+// ⛔ The name is `uniweb.id` when set, exactly as the build reads it for the
+// schema that `register` submits (`build/src/schema.js`). Reading `name` alone —
+// as this did until 2026-09-17 — looked a `uniweb.id` foundation up under a name
+// the catalog does not have, so every push re-released it, and pinned the site
+// to that same wrong name.
 function foundationScopedName(dir) {
   try {
     const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
-    const name = pkg?.name
+    const name = pkg?.uniweb?.id || pkg?.name
     if (typeof name === 'string' && name.startsWith('@')) return name
     const scope = pkg?.uniweb?.scope
     if (scope && name) return `${String(scope).replace(/\/+$/, '')}/${name}`
@@ -344,8 +351,18 @@ async function bringLocalCodeAlong({
       )
       return { released: false, proceed: true, ref: registeredRef(reg) }
     }
+    // ⚖️ The registry takes a NEW version only when it is greater than every one
+    // it holds — but an older local version may be one it already has, and
+    // re-registering that resumes. The CLI cannot tell which from here, so it
+    // does not refuse: it submits, says what will decide, and `register` prints
+    // the registry's answer if it is a no.
+    const order = compareSemverPrecedence(local.version, reg.latest_version)
     say.info(
-      `Releasing the ${kind} ${label} (new version; registered latest is ${reg.latest_version})…`
+      order === 1
+        ? `Releasing the ${kind} ${label} (new version; registered latest is ${reg.latest_version})…`
+        : order === null
+          ? `Releasing the ${kind} ${label} (registered latest is ${reg.latest_version})…`
+          : `Releasing the ${kind} ${label} — not newer than the registered latest ${reg.latest_version}, so the registry takes it only if ${local.version} is already registered with this code…`
     )
     return {
       released: releaseFoundation(local, args, cliBin, say),

package/src/commands/register.js

@@ -633,8 +633,8 @@ async function runRegister(args = []) {
     // Resume path: a registered version is immutable, so re-running after a
     // partial code delivery hits the duplicate rejection here — a STRUCTURED
     // 409 (problem+json, title "Conflict") — and proceeds to phase 2 (the
-    // code-uploads plan authorizes against the REGISTERED version; completed
-    // files are idempotent no-ops).
+    // code-uploads plan authorizes against the REGISTERED version; files it
+    // already stores come back `present` and are skipped).
     const isDuplicate = !standalone && res.status === 409
     if (isDuplicate) {
       alreadyRegistered = true
@@ -712,14 +712,18 @@ async function runRegister(args = []) {
           )
         }
         log(
-          `  ${colors.dim}Re-run \`uniweb register\` to resume — completed files are safe no-ops.${colors.reset}`
+          `  ${colors.dim}Re-run \`uniweb register\` to resume — files already stored are skipped.${colors.reset}`
         )
         return { exitCode: 1 }
       }
+      // "4 files" on a first upload; "1 uploaded, 3 already stored" on a resume.
+      const delivered = result.stored?.length
+        ? `${result.uploaded.length} uploaded, ${result.stored.length} already stored`
+        : `${result.uploaded.length} files`
       if (result.verified === true) {
         // serveBase is guaranteed here — it is what gated the check.
         success(
-          `Code delivered (${result.uploaded.length} files) — entry verified live at ${colors.dim}${result.serveBase}${colors.reset}`
+          `Code delivered (${delivered}) — entry verified live at ${colors.dim}${result.serveBase}${colors.reset}`
         )
       } else if (result.verified === false) {
         error(
@@ -727,9 +731,7 @@ async function runRegister(args = []) {
         )
         return { exitCode: 1 }
       } else {
-        success(
-          `Code delivered (${result.uploaded.length} files, ${result.mode} mode)`
-        )
+        success(`Code delivered (${delivered}, ${result.mode} mode)`)
         // Say WHY nothing was checked, rather than skipping in silence. The CLI
         // never reconstructs a serve URL (see utils/code-upload.js), so a plan
         // without `serve_base` means the location is not ours to know — name it
@@ -741,6 +743,16 @@ async function runRegister(args = []) {
         }
       }
     } catch (err) {
+      // ⚖️ A 4xx is the registry REFUSING the plan — e.g. a stored file
+      // declared at a different size (`version_content_changed`). Running the
+      // same command again gets the same answer, so do not suggest it: print
+      // the refusal's own sentence, which says what does help.
+      if (err.status >= 400 && err.status < 500 && err.detail) {
+        error(`Code delivery refused: HTTP ${err.status}`)
+        log(`  ${err.detail}`)
+        if (err.code) log(`  ${colors.dim}(${err.code})${colors.reset}`)
+        return { exitCode: 1 }
+      }
       error(`Code delivery failed: ${err.message}`)
       log(
         `  ${colors.dim}The schema registration above succeeded; re-run \`uniweb register\` to deliver the code.${colors.reset}`

package/src/utils/code-upload.js

@@ -7,10 +7,12 @@
  *
  *   1. PLAN   — POST {apiBase}/dev/registry/code-uploads with the file list
  *               ({ path, content_type, size, sha256? }). The response carries
- *               one upload target per file ({ path, method, url, headers })
- *               plus mode: 'direct' (dev — URLs point back at the backend) or
- *               'presigned' (prod — storage PUTs; bytes never transit the
- *               backend). The CLI never branches on the mode.
+ *               one entry per file: `present: true` for a file the backend
+ *               already stores for this version (no URL — it is skipped), or an
+ *               upload target ({ path, method, url, headers }). Plus mode:
+ *               'direct' (dev — URLs point back at the backend) or 'presigned'
+ *               (prod — storage PUTs; bytes never transit the backend). The CLI
+ *               never branches on the mode.
  *   2. UPLOAD — PUT each file's raw bytes to its URL with the given headers.
  *               The ENTRY uploads LAST: a partial upload never yields a
  *               loadable version (practical atomicity — there is no server
@@ -35,7 +37,8 @@
  *     plan step's per-version file cap — the cap is an abuse guard, the maps
  *     simply don't belong on the CDN.)
  *   - a registered version is immutable, code included — changed bytes mean
- *     a new version (re-PUTting identical bytes is a safe no-op)
+ *     a new version. A stored file is never re-sent (the plan marks it
+ *     `present`), and one declared at a different size is refused (422)
  */
 
 import { createHash } from 'node:crypto'
@@ -215,7 +218,10 @@ export function computeFoundationDigest(distDir) {
  * @param {string} opts.distDir  - the built dist/ directory
  * @param {Array}  [opts.files]  - pre-collected file list (default: collect)
  * @param {(msg: string) => void} [opts.onProgress]
- * @returns {Promise<{ mode: string, uploaded: string[], failed: Array<{path, status, detail}>, verified: boolean|null, serveBase: string|null }>}
+ * @returns {Promise<{ mode: string, uploaded: string[], stored: string[], failed: Array<{path, status, detail}>, verified: boolean|null, serveBase: string|null }>}
+ *   `stored` — files the plan reported as already stored (`present: true`), not re-sent.
+ * @throws {Error} when the plan is refused — with `status`, and the problem+json
+ *   `detail` and `code` when the body carries them
  */
 export async function uploadFoundationCode({
   apiBase,
@@ -259,10 +265,22 @@ export async function uploadFoundationCode({
   })
   if (!planRes.ok) {
     const body = await planRes.text().catch(() => '')
+    // A refusal is problem+json, and its `detail` is a sentence written for the
+    // person reading — for a changed file it says what to do. Carry it (and the
+    // `code`) instead of a raw body the reader has to dig the sentence out of.
+    let problem = null
+    try {
+      problem = JSON.parse(body)
+    } catch {
+      problem = null
+    }
+    const detail = typeof problem?.detail === 'string' ? problem.detail : null
     const err = new Error(
-      `code-uploads plan rejected: HTTP ${planRes.status}${body ? ` — ${body.slice(0, 300)}` : ''}`
+      `code-uploads plan rejected: HTTP ${planRes.status}${detail ? ` — ${detail}` : body ? ` — ${body.slice(0, 300)}` : ''}`
     )
     err.status = planRes.status
+    err.detail = detail
+    err.code = typeof problem?.code === 'string' ? problem.code : null
     throw err
   }
   const plan = await planRes.json()
@@ -275,6 +293,7 @@ export async function uploadFoundationCode({
     plan.mode === 'direct' ? { Authorization: `Bearer ${token}` } : {}
 
   const uploaded = []
+  const stored = []
   const failed = []
   for (const file of uploadOrder(list)) {
     const target = targets.get(file.path)
@@ -286,6 +305,27 @@ export async function uploadFoundationCode({
       })
       continue
     }
+    // ⭐ A file the backend already stores for this version comes back
+    // `present: true`, with no URL — a stored file of a registered version is
+    // never overwritten. Skip it. This is what lets an interrupted upload
+    // resume, and a re-run on a fully uploaded version pass.
+    //
+    // ⛔ Before this branch existed, a present entry was PUT to
+    // `new URL(undefined, origin)`, which does not throw — it resolves to
+    // `<origin>/undefined` — and came back as a failed upload.
+    if (target.present === true) {
+      stored.push(file.path)
+      onProgress(`${file.path} (already stored)`)
+      continue
+    }
+    if (!target.url) {
+      failed.push({
+        path: file.path,
+        status: 0,
+        detail: 'the plan gave no upload URL'
+      })
+      continue
+    }
     const bytes = readFileSync(join(distDir, file.path))
     try {
       // ⭐ **Retried.** A single connection-level failure used to fail the whole
@@ -350,5 +390,5 @@ export async function uploadFoundationCode({
     }
   }
 
-  return { mode: plan.mode || 'direct', uploaded, failed, verified, serveBase }
+  return { mode: plan.mode || 'direct', uploaded, stored, failed, verified, serveBase }
 }

package/src/utils/semver-precedence.js

@@ -0,0 +1,57 @@
+/**
+ * SemVer 2.0.0 precedence — how a registry orders a foundation's versions.
+ *
+ * A pre-release sorts below its release (`1.0.0-rc.1` < `1.0.0`), and build
+ * metadata carries no order (`1.2.0+b` equals `1.2.0`).
+ *
+ * ⚖️ Not `compareSemver` in `dep-survey.js`: that one reads dependency specs
+ * (`^1.2.3`) for `uniweb update` and compares major.minor.patch only. This one
+ * is strict — anything that is not a SemVer version is `null`, never a guess.
+ */
+
+// The regex published with the SemVer 2.0.0 specification (semver.org, §FAQ).
+const SEMVER =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/
+
+/**
+ * @param {unknown} version
+ * @returns {{ major: number, minor: number, patch: number, pre: string[] }|null}
+ */
+export function parseSemver(version) {
+  if (typeof version !== 'string') return null
+  const m = SEMVER.exec(version)
+  if (!m) return null
+  return { major: +m[1], minor: +m[2], patch: +m[3], pre: m[4] ? m[4].split('.') : [] }
+}
+
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1|0|1|null} how `a` sorts against `b`; null when either is not SemVer
+ */
+export function compareSemverPrecedence(a, b) {
+  const x = parseSemver(a)
+  const y = parseSemver(b)
+  if (!x || !y) return null
+  for (const part of ['major', 'minor', 'patch']) {
+    if (x[part] !== y[part]) return x[part] > y[part] ? 1 : -1
+  }
+  // A version with a pre-release sorts below the same version without one.
+  if (!x.pre.length || !y.pre.length) {
+    return x.pre.length === y.pre.length ? 0 : x.pre.length ? -1 : 1
+  }
+  for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+    const p = x.pre[i]
+    const q = y.pre[i]
+    if (p === undefined) return -1
+    if (q === undefined) return 1
+    if (p === q) continue
+    const pNum = /^\d+$/.test(p)
+    const qNum = /^\d+$/.test(q)
+    // Numeric identifiers compare numerically and sort below alphanumeric ones.
+    if (pNum && qNum) return BigInt(p) > BigInt(q) ? 1 : -1
+    if (pNum !== qNum) return pNum ? -1 : 1
+    return p > q ? 1 : -1
+  }
+  return 0
+}