uniweb 1.17.1 → 1.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,12 +42,12 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/content-writer": "~1.3.0",
-    "@uniweb/core": "~1.4.0",
     "@uniweb/schemas": "~1.6.5",
+    "@uniweb/core": "~1.4.1",
     "@uniweb/semantic-parser": "~1.12.2"
   },
   "peerDependencies": {
-    "@uniweb/build": "~1.8.1",
+    "@uniweb/build": "~1.8.2",
     "@uniweb/content-reader": "~1.5.4",
     "@uniweb/semantic-parser": "~1.12.2"
   },

package/partials/agents.md

@@ -822,7 +822,7 @@ agents:
 | not declared | no check at all — nothing happens unless you ask for it |
 | your own site's origin | always fine, without listing it — declaring a partner must not take down your own chat box |
 | a request with **no** `Origin` | **allowed** — see below, this is deliberate |
-| matching | exact, per entry; no wildcards |
+| matching | by origin: `https://app.example.com/` is `https://app.example.com`, and a path is ignored; no wildcards. An entry that is not an `http(s)` URL matches nothing |
 
 ⛔ **It is not a spend limit, and it cannot be.** `Origin` is set by the browser and enforced by the browser: anything that is not a browser sends whatever it likes, or nothing at all. So this stops **casual misuse and third-party embedding** — someone dropping your endpoint into their own page — and it does **not** stop anyone determined to run up your bill. Do not size your budget on it.
 

package/src/commands/doctor.js

@@ -19,7 +19,7 @@ import {
   extensionNameOf,
   findSiteExtension
 } from '@uniweb/build'
-import { loadDeployYml, AGENTS_KEYS } from '@uniweb/build/site'
+import { loadDeployYml, AGENTS_KEYS, originOf } from '@uniweb/build/site'
 import { listAdapters } from '@uniweb/build/hosts'
 import { RUNTIME_KEYS } from '@uniweb/build/uwx'
 import { getCliVersion } from '../versions.js'
@@ -337,6 +337,11 @@ export function findFormContent(sitePath, siteYml) {
  *
  * `agents: false` turns the capability off in one word and is not an object —
  * flagging its absence of keys would be nonsense.
+ *
+ * ⭐ **An `expectedOrigins` entry that names no origin matches nothing**, and that is silent
+ * too. `app.example.com`, with no scheme, reads as no origin, so a list of only such entries
+ * declines every third-party caller. The entry is read by the rule the host checks by
+ * (`originOf`, `@uniweb/projections`).
  */
 export function checkAgentsBlock({ siteName, siteYml, issues }) {
   const agents = siteYml?.agents
@@ -353,6 +358,8 @@ export function checkAgentsBlock({ siteName, siteYml, issues }) {
     return
   }
 
+  checkExpectedOrigins({ siteName, agents, issues })
+
   const known = new Set(AGENTS_KEYS)
   const unknown = Object.keys(agents).filter((k) => !known.has(k))
   if (unknown.length === 0) return
@@ -381,6 +388,24 @@ export function checkAgentsBlock({ siteName, siteYml, issues }) {
   )
 }
 
+/** `agents.expectedOrigins` entries that name no origin, each named. */
+function checkExpectedOrigins({ siteName, agents, issues }) {
+  const declared = agents.expectedOrigins
+  if (declared === undefined || declared === null) return
+  const unreadable = (Array.isArray(declared) ? declared : [declared]).filter((entry) => originOf(entry) === null)
+  if (unreadable.length === 0) return
+  const id = 'agents-origin-unreadable'
+  const shown = unreadable.map((entry) => `'${String(entry)}'`).join(', ')
+  issues.push({
+    id,
+    type: 'warning',
+    site: siteName,
+    message: `site.yml: \`agents.expectedOrigins\` ${unreadable.length === 1 ? 'entry' : 'entries'} ${shown} name${unreadable.length === 1 ? 's' : ''} no origin, so ${unreadable.length === 1 ? 'it matches' : 'they match'} nothing`
+  })
+  warn(`[${id}] ${siteName}: \`agents.expectedOrigins\` ${unreadable.length === 1 ? 'entry' : 'entries'} ${shown} name${unreadable.length === 1 ? 's' : ''} no origin.`)
+  log(`    ${colors.dim}Write each as an http(s) URL with its scheme, e.g. https://app.example.com. An entry that names no origin matches nothing.${colors.reset}`)
+}
+
 /**
  * The closest known key within a small edit distance, or null.
  *

package/src/commands/pull.js

@@ -78,6 +78,7 @@ import {
   readBackendState,
   siteContentDocumentToProject,
   dataBlockModels,
+  siteDefaultSectionType,
   recordsToProject,
   siteSelfScope,
   readZip,
@@ -829,6 +830,7 @@ export async function pull(args = [], deps = {}) {
   // resolves.
   let keepAuthoredFoundation = false
   let dataModel = null
+  let sectionType
   // The Models the pulled site's queries name, as the push qualified them — the re-bank
   // resolves with them too.
   let pulledQueryModels = []
@@ -854,6 +856,12 @@ export async function pull(args = [], deps = {}) {
     // A translated data block is read back by what its section's type declares it is, as the
     // push translated it — after the registered foundation above, whose section types say it.
     dataModel = await dataBlockModels(siteDir)
+    // The type a section that names none renders with — what the push filled in, and what a
+    // section's file leaves out again. A clone's foundation is the one the document pins.
+    sectionType = await siteDefaultSectionType(
+      siteDir,
+      keepAuthoredFoundation ? null : { foundation: siteDoc?.info?.foundation }
+    )
   }
   // ⭐ THE SCOPE THE PULLED RECORDS AND QUERIES WERE QUALIFIED WITH — the pushed site's
   // FOUNDATION's: the scope of the pinned ref it carries (`info.foundation`), else the
@@ -998,7 +1006,8 @@ export async function pull(args = [], deps = {}) {
         keepAuthoredFoundation,
         // So a query's `@acme/member` comes back as the author's `@/member`.
         scope: pullScope,
-        dataModel
+        dataModel,
+        sectionType
       })
       wrote.push(...report.pages, ...report.sections, ...report.layout)
       removed.push(

package/src/framework-index.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-23T19:14:59.641Z",
+  "generatedAt": "2026-10-24T15:06:07.442Z",
   "packages": {
     "@uniweb/api": {
       "version": "1.6.4"
     },
     "@uniweb/build": {
-      "version": "1.8.1"
+      "version": "1.8.2"
     },
     "@uniweb/content-reader": {
       "version": "1.5.4"
@@ -15,7 +15,7 @@
       "version": "1.3.0"
     },
     "@uniweb/core": {
-      "version": "1.4.0"
+      "version": "1.4.1"
     },
     "@uniweb/frame-bridge": {
       "version": "1.0.2"
@@ -24,7 +24,7 @@
       "version": "1.0.5"
     },
     "@uniweb/kit": {
-      "version": "1.6.0"
+      "version": "1.6.1"
     },
     "@uniweb/loom": {
       "version": "1.1.2"
@@ -33,10 +33,10 @@
       "version": "1.1.4"
     },
     "@uniweb/projections": {
-      "version": "1.1.6"
+      "version": "1.1.7"
     },
     "@uniweb/runtime": {
-      "version": "1.1.15"
+      "version": "1.1.16"
     },
     "@uniweb/scene": {
       "version": "1.0.1"