@uniweb/build 1.7.3 → 1.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/build",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "Build tooling for the Uniweb Component Web Platform",
   "type": "module",
   "exports": {
@@ -56,12 +56,12 @@
     "js-yaml": "^4.1.0",
     "sharp": "^0.35.3",
     "yaml": "^2.5.0",
-    "@uniweb/schemas": "~1.6.2",
-    "@uniweb/content-reader": "~1.5.4",
-    "@uniweb/theming": "~1.2.1",
     "@uniweb/content-writer": "~1.3.0",
+    "@uniweb/content-reader": "~1.5.4",
     "@uniweb/semantic-parser": "~1.12.2",
-    "@uniweb/projections": "~1.1.6"
+    "@uniweb/projections": "~1.1.6",
+    "@uniweb/theming": "~1.2.1",
+    "@uniweb/schemas": "~1.6.5"
   },
   "optionalDependencies": {
     "@uniweb/runtime": "~1.1.15"

package/src/foundation-name.js

@@ -24,10 +24,37 @@
 // ⛔ `package.json::uniweb.scope` held it until then, a second home for half of one
 // fact, and the halves disagreed: a foundation named `@acme/fnd` registered its data
 // schemas under whatever `uniweb.scope` said (measured: `@proximify/member`).
+//
+// ⛔ `@uniweb` IS RESERVED (2026-10-23 [Diego]) — on npm it is the framework's own
+// packages, and on every Uniweb backend it is a system-level account. A foundation
+// named `@uniweb/…` reads as the framework's, and no one may publish into it, so it is
+// refused here, where every name is checked, rather than by a backend after a build.
 
 /** Names that say where the code lives, not what the foundation is. */
 export const FORBIDDEN_FOUNDATION_NAMES = new Set(['src', 'foundation'])
 
+/** Scopes nothing registers under: neither a foundation nor a data schema. */
+export const RESERVED_SCOPES = new Set(['uniweb'])
+
+const RESERVED_SCOPE_WHY =
+  "it names the Uniweb framework's own packages and the system account of every Uniweb " +
+  'backend, so nothing registers under it'
+
+/**
+ * Can anything register under this scope? `@acme`, `acme` or `@acme/…`.
+ *
+ * @param {unknown} scope
+ * @returns {string|null} why it cannot, or null when it can
+ */
+export function checkRegistrationScope(scope) {
+  const handle = String(scope ?? '')
+    .trim()
+    .replace(/^@/, '')
+    .replace(/\/.*$/, '')
+    .toLowerCase()
+  return RESERVED_SCOPES.has(handle) ? `@${handle} is reserved: ${RESERVED_SCOPE_WHY}` : null
+}
+
 // One segment of a name: lowercase letters, digits and inner hyphens.
 const SEGMENT = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/
 
@@ -63,6 +90,9 @@ export function checkFoundationName(name) {
   if (FORBIDDEN_FOUNDATION_NAMES.has(bare)) {
     return `"${bare}" names the folder, not the foundation — and every project in an org would register the same one`
   }
+  if (scope !== null && checkRegistrationScope(scope)) {
+    return `"${name}" is named under @${scope.toLowerCase()}, which is reserved: ${RESERVED_SCOPE_WHY}`
+  }
   if (!SEGMENT.test(bare) || (scope !== null && !SEGMENT.test(scope))) {
     return `"${name}" is not a foundation name — use lowercase letters, digits and hyphens (like "marketing")`
   }

package/src/index.js

@@ -18,8 +18,10 @@ export {
 export {
   foundationNameOf,
   checkFoundationName,
+  checkRegistrationScope,
   splitFoundationName,
   FORBIDDEN_FOUNDATION_NAMES,
+  RESERVED_SCOPES,
 } from './foundation-name.js'
 
 // Data-conformance checking (your content vs the schemas your foundation declares)

package/src/uwx/data-schema.js

@@ -479,6 +479,9 @@ function lowerLeaf(field, resolve, optResolve, { multiple = false, path = '' } =
     // The level on the entry it points to that opens this entry, for `read` — by link
     // [Diego, 2026-10-14]. `@uniweb/schemas` admits it only here, as read, edit or admin.
     if (field.readable_with) out.readable_with = field.readable_with
+    // A reference a purchase travels along, to what it names [backend, 2026-10-21]. Only `true`
+    // is sent: `@uniweb/schemas` drops `false`, which says what leaving it out says.
+    if (field.sold_with === true) out.sold_with = true
     return out
   }
 

package/src/uwx/registry-package.js

@@ -30,7 +30,7 @@ import { normalizeFoundationSchema } from '@uniweb/schemas/foundation'
 import { parseOptionsRef } from '@uniweb/schemas/format'
 import { qualifyRef } from '@uniweb/schemas/refs'
 import { toDataSchemaDeclaration, optionsSectionPath } from './data-schema.js'
-import { checkFoundationName, splitFoundationName } from '../foundation-name.js'
+import { checkFoundationName, checkRegistrationScope, splitFoundationName } from '../foundation-name.js'
 
 const FOUNDATION_SCHEMA = '@uniweb/foundation-schema'
 const DATA_SCHEMA = '@uniweb/data-schema'
@@ -110,6 +110,10 @@ export function buildRegistryPackage({ schema, foundationDir, scope, exporter, e
  * @returns {Object} the `.uwx` document (uwx/1; only data-schema entities, no uuids).
  */
 export function buildSchemaOnlyPackage({ schemas, scope, exporter, exportedAt } = {}) {
+  // ⛔ The producer's own guard, as `buildInfo`'s name check is for a foundation:
+  // `uniweb register` refuses a reserved scope before it gets here.
+  const reserved = checkRegistrationScope(scope)
+  if (reserved) throw new Error(`buildSchemaOnlyPackage: ${reserved}`)
   const { entities } = buildDataSchemaEntities(schemas || {}, scope)
   if (entities.length === 0) {
     throw new Error('buildSchemaOnlyPackage: no data schemas to register (expected a map of "@/<name>" -> schema).')