uniweb 1.17.0 → 1.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
+    "@uniweb/content-writer": "~1.3.0",
     "@uniweb/schemas": "~1.6.5",
-    "@uniweb/semantic-parser": "~1.12.2",
-    "@uniweb/core": "~1.4.0",
-    "@uniweb/content-writer": "~1.3.0"
+    "@uniweb/core": "~1.4.1",
+    "@uniweb/semantic-parser": "~1.12.2"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.8.0",
-    "@uniweb/semantic-parser": "~1.12.2",
-    "@uniweb/content-reader": "~1.5.4"
+    "@uniweb/build": "~1.8.2",
+    "@uniweb/content-reader": "~1.5.4",
+    "@uniweb/semantic-parser": "~1.12.2"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -822,7 +822,7 @@ agents:
 | not declared | no check at all — nothing happens unless you ask for it |
 | your own site's origin | always fine, without listing it — declaring a partner must not take down your own chat box |
 | a request with **no** `Origin` | **allowed** — see below, this is deliberate |
-| matching | exact, per entry; no wildcards |
+| matching | by origin: `https://app.example.com/` is `https://app.example.com`, and a path is ignored; no wildcards. An entry that is not an `http(s)` URL matches nothing |
 
 ⛔ **It is not a spend limit, and it cannot be.** `Origin` is set by the browser and enforced by the browser: anything that is not a browser sends whatever it likes, or nothing at all. So this stops **casual misuse and third-party embedding** — someone dropping your endpoint into their own page — and it does **not** stop anyone determined to run up your bill. Do not size your budget on it.
 

package/src/backend/site-sync.js

@@ -92,6 +92,17 @@ function entityDocFromUwx(buf) {
   return null
 }
 
+// What a `.uwx`'s entries inflate to, summed — the quantity a backend's package limit counts.
+// null for anything that is not a readable `.uwx`.
+function inflatedSizeOfUwx(buf) {
+  if (!buf || buf.length < 2 || buf[0] !== 0x50 || buf[1] !== 0x4b) return null
+  try {
+    return [...readZip(buf).values()].reduce((n, data) => n + data.length, 0)
+  } catch {
+    return null
+  }
+}
+
 // Every entity `$`-document of a `.uwx` in the order it was submitted — the manifest's, which is
 // what a push's `finalized[].index` counts in. null where a listed file is missing or unreadable.
 function submittedDocsFromUwx(buf) {
@@ -2169,12 +2180,13 @@ export async function pushSyncPackages({
   // `boundUuid` is set only for the lanes that address an EXISTING site by uuid
   // (content UPDATE, folder push) — never for the CREATE, which has no uuid to be
   // wrong about. It is what lets a 404 be read as "the site this clone is bound to
-  // is gone" rather than "the route is missing".
+  // is gone" rather than "the route is missing". `sent` is the package the lane sends,
+  // which a refusal for size measures.
   const postLane = async (
     label,
     doRequest,
     explainStale = async () => [],
-    { boundUuid = null, reportTemplate = false } = {}
+    { boundUuid = null, reportTemplate = false, sent = null } = {}
   ) => {
     info(`Pushing ${label} to ${dim(client.origin)} …`)
     let res
@@ -2191,7 +2203,7 @@ export async function pushSyncPackages({
       // Two unrelated conflicts share HTTP 409, so branch on the machine-readable
       // `reason` — never on `detail`, which is prose the backend may reword.
       let problem = null
-      if ((res.status === 409 || res.status === 400 || res.status === 403 || res.status === 422) && body) {
+      if ((res.status === 409 || res.status === 400 || res.status === 403 || res.status === 413 || res.status === 422) && body) {
         try {
           problem = JSON.parse(body)
         } catch {
@@ -2376,6 +2388,25 @@ export async function pushSyncPackages({
           `  deleted there  →  uniweb forget --server ${client.origin}, then push again: it creates a NEW site`
         )
         note('Deleting this folder removes only your local copy, either way.')
+      } else if (res.status === 413) {
+        // ⭐ TWO LIMITS, ON TWO QUANTITIES, BOTH THE BACKEND'S (backend, 2026-10-23): the
+        // request as sent, and the package as its entries inflate. A package refusal names its
+        // limit (`package_too_large`, `limit` in bytes), so quote it beside what this package
+        // inflates to. A request refusal names none, so say what was sent and quote no limit —
+        // a copy of theirs here would be a second constant to drift. The package is already
+        // Deflated (`createZip`), so there is no smaller form of it to retry with.
+        if (problem?.reason === 'package_too_large') {
+          const inflated = humanBytes(inflatedSizeOfUwx(sent))
+          const limit = humanBytes(problem.limit)
+          note(
+            `${inflated ? `This push's content is ${inflated} uncompressed` : "This push's content is too large"} — more than the ${limit ? `${limit} ` : ''}the backend at ${client.origin} takes in one push.`
+          )
+        } else {
+          const size = humanBytes(sent?.length)
+          note(
+            `${size ? `This push sent ${size}` : 'This push was too large'} — more than the backend at ${client.origin} accepts in one request.`
+          )
+        }
       } else if (problem?.reason === 'template_records_not_copyable' && Array.isArray(problem.records)) {
         // ⭐ A push asking to designate the site a template is refused whole when a record in its
         // folder cannot be copied into the sites made from it — each named, with a `detail` written
@@ -2615,7 +2646,7 @@ export async function pushSyncPackages({
             localBuffer: siteContent.buffer,
             uuid: siteContentUuid
           }),
-        { boundUuid: siteContentUuid, reportTemplate: true }
+        { boundUuid: siteContentUuid, reportTemplate: true, sent: siteContent.buffer }
       )
       if (!finalized) {
         mergeHarvested()
@@ -2631,7 +2662,7 @@ export async function pushSyncPackages({
         'site-content',
         () => client.createSiteContent(siteContent.buffer, { source }),
         undefined,
-        { reportTemplate: true }
+        { reportTemplate: true, sent: siteContent.buffer }
       )
       if (payload === null) return { exitCode: 1, finalizedTotal, wrote }
       const minted = extractMintedSiteUuid(payload)
@@ -2679,7 +2710,7 @@ export async function pushSyncPackages({
       'records',
       () => client.pushFolder(boundSiteUuid, records.buffer, { source }),
       undefined,
-      { boundUuid: boundSiteUuid }
+      { boundUuid: boundSiteUuid, sent: records.buffer }
     )
     if (!finalized) {
       mergeHarvested({ point: false })

package/src/commands/doctor.js

@@ -19,7 +19,7 @@ import {
   extensionNameOf,
   findSiteExtension
 } from '@uniweb/build'
-import { loadDeployYml, AGENTS_KEYS } from '@uniweb/build/site'
+import { loadDeployYml, AGENTS_KEYS, originOf } from '@uniweb/build/site'
 import { listAdapters } from '@uniweb/build/hosts'
 import { RUNTIME_KEYS } from '@uniweb/build/uwx'
 import { getCliVersion } from '../versions.js'
@@ -337,6 +337,11 @@ export function findFormContent(sitePath, siteYml) {
  *
  * `agents: false` turns the capability off in one word and is not an object —
  * flagging its absence of keys would be nonsense.
+ *
+ * ⭐ **An `expectedOrigins` entry that names no origin matches nothing**, and that is silent
+ * too. `app.example.com`, with no scheme, reads as no origin, so a list of only such entries
+ * declines every third-party caller. The entry is read by the rule the host checks by
+ * (`originOf`, `@uniweb/projections`).
  */
 export function checkAgentsBlock({ siteName, siteYml, issues }) {
   const agents = siteYml?.agents
@@ -353,6 +358,8 @@ export function checkAgentsBlock({ siteName, siteYml, issues }) {
     return
   }
 
+  checkExpectedOrigins({ siteName, agents, issues })
+
   const known = new Set(AGENTS_KEYS)
   const unknown = Object.keys(agents).filter((k) => !known.has(k))
   if (unknown.length === 0) return
@@ -381,6 +388,24 @@ export function checkAgentsBlock({ siteName, siteYml, issues }) {
   )
 }
 
+/** `agents.expectedOrigins` entries that name no origin, each named. */
+function checkExpectedOrigins({ siteName, agents, issues }) {
+  const declared = agents.expectedOrigins
+  if (declared === undefined || declared === null) return
+  const unreadable = (Array.isArray(declared) ? declared : [declared]).filter((entry) => originOf(entry) === null)
+  if (unreadable.length === 0) return
+  const id = 'agents-origin-unreadable'
+  const shown = unreadable.map((entry) => `'${String(entry)}'`).join(', ')
+  issues.push({
+    id,
+    type: 'warning',
+    site: siteName,
+    message: `site.yml: \`agents.expectedOrigins\` ${unreadable.length === 1 ? 'entry' : 'entries'} ${shown} name${unreadable.length === 1 ? 's' : ''} no origin, so ${unreadable.length === 1 ? 'it matches' : 'they match'} nothing`
+  })
+  warn(`[${id}] ${siteName}: \`agents.expectedOrigins\` ${unreadable.length === 1 ? 'entry' : 'entries'} ${shown} name${unreadable.length === 1 ? 's' : ''} no origin.`)
+  log(`    ${colors.dim}Write each as an http(s) URL with its scheme, e.g. https://app.example.com. An entry that names no origin matches nothing.${colors.reset}`)
+}
+
 /**
  * The closest known key within a small edit distance, or null.
  *

package/src/commands/pull.js

@@ -78,6 +78,7 @@ import {
   readBackendState,
   siteContentDocumentToProject,
   dataBlockModels,
+  siteDefaultSectionType,
   recordsToProject,
   siteSelfScope,
   readZip,
@@ -338,8 +339,8 @@ export function describeUnplacedRecords({ docs, taken, skipped }) {
 }
 
 // Read a pull lane's bytes into entity `$`-documents. The backend serves a `.uwx`
-// (our Stored ZIP: `manifest.json` + `entities/<uuid>.json`); the entity files ARE the
-// documents. Falls back to a JSON body (a raw doc, a `{document}`/`{entity}` envelope,
+// (a ZIP of `manifest.json` + `entities/<uuid>.json`, each entry Stored or Deflate —
+// `readZip` reads both); the entity files ARE the documents. Falls back to a JSON body (a raw doc, a `{document}`/`{entity}` envelope,
 // or a list) so the lane survives a future envelope change. Returns an array (possibly
 // empty).
 export function readPullDocuments(buf) {
@@ -829,6 +830,7 @@ export async function pull(args = [], deps = {}) {
   // resolves.
   let keepAuthoredFoundation = false
   let dataModel = null
+  let sectionType
   // The Models the pulled site's queries name, as the push qualified them — the re-bank
   // resolves with them too.
   let pulledQueryModels = []
@@ -854,6 +856,12 @@ export async function pull(args = [], deps = {}) {
     // A translated data block is read back by what its section's type declares it is, as the
     // push translated it — after the registered foundation above, whose section types say it.
     dataModel = await dataBlockModels(siteDir)
+    // The type a section that names none renders with — what the push filled in, and what a
+    // section's file leaves out again. A clone's foundation is the one the document pins.
+    sectionType = await siteDefaultSectionType(
+      siteDir,
+      keepAuthoredFoundation ? null : { foundation: siteDoc?.info?.foundation }
+    )
   }
   // ⭐ THE SCOPE THE PULLED RECORDS AND QUERIES WERE QUALIFIED WITH — the pushed site's
   // FOUNDATION's: the scope of the pinned ref it carries (`info.foundation`), else the
@@ -998,7 +1006,8 @@ export async function pull(args = [], deps = {}) {
         keepAuthoredFoundation,
         // So a query's `@acme/member` comes back as the author's `@/member`.
         scope: pullScope,
-        dataModel
+        dataModel,
+        sectionType
       })
       wrote.push(...report.pages, ...report.sections, ...report.layout)
       removed.push(

package/src/framework-index.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-23T17:42:44.689Z",
+  "generatedAt": "2026-10-24T15:06:07.442Z",
   "packages": {
     "@uniweb/api": {
       "version": "1.6.4"
     },
     "@uniweb/build": {
-      "version": "1.8.0"
+      "version": "1.8.2"
     },
     "@uniweb/content-reader": {
       "version": "1.5.4"
@@ -15,7 +15,7 @@
       "version": "1.3.0"
     },
     "@uniweb/core": {
-      "version": "1.4.0"
+      "version": "1.4.1"
     },
     "@uniweb/frame-bridge": {
       "version": "1.0.2"
@@ -24,7 +24,7 @@
       "version": "1.0.5"
     },
     "@uniweb/kit": {
-      "version": "1.6.0"
+      "version": "1.6.1"
     },
     "@uniweb/loom": {
       "version": "1.1.2"
@@ -33,10 +33,10 @@
       "version": "1.1.4"
     },
     "@uniweb/projections": {
-      "version": "1.1.6"
+      "version": "1.1.7"
     },
     "@uniweb/runtime": {
-      "version": "1.1.15"
+      "version": "1.1.16"
     },
     "@uniweb/scene": {
       "version": "1.0.1"

package/src/utils/uwx-read.js

@@ -21,12 +21,14 @@
  *
  * ## Two things measured on a real payload, both of which would break a naive reader
  *
- * 1. ⛔ **The archive is NOT "stored".** `pull.js` describes the format as *"our
- *    Stored ZIP"*, and that is true of `manifest.json` and false of the entity
- *    files — measured on a live pull: `manifest.json` method 0 (STORED), the
- *    entity JSON method 8 (DEFLATED). A stored-only reader silently yields the
+ * 1. ⛔ **The archive is NOT "stored".** `pull.js` described the format as *"our
+ *    Stored ZIP"* until 2026-10-23, and that is true of `manifest.json` and false of
+ *    the entity files — measured on a live pull: `manifest.json` method 0 (STORED),
+ *    the entity JSON method 8 (DEFLATED). A stored-only reader silently yields the
  *    manifest and drops the document, i.e. it returns success and no entities.
- *    **Both methods are handled below and the tests cover a mixed archive.**
+ *    **Both methods are handled below and the tests cover a mixed archive.** Our own
+ *    writer (`@uniweb/build`'s `createZip`) has Deflated too since that day, so no
+ *    `.uwx` in either direction is Stored-only.
  * 2. The entity payload is the *only* thing wanted; `manifest.json` is skipped, as
  *    every other reader in the tree does.
  *