uniweb 0.12.21 → 0.12.22

package/src/commands/validate.js

@@ -0,0 +1,288 @@
+/**
+ * uniweb validate - Check your content against the data schemas your
+ * foundation declares.
+ *
+ * For each section that consumes file-based data, this resolves the schema the
+ * foundation bound to that input (via `meta.js` `data:`) and checks the data
+ * items against it. It answers "does my data match what I promised?" — distinct
+ * from `doctor`, which checks your project against framework conventions.
+ *
+ * It warns by default; `--strict` turns findings into a non-zero exit for CI.
+ * The live render path stays tolerant — this gate runs before a site is live,
+ * by choice. Dynamic (remote) inputs and entity references can't be resolved
+ * without a running backend, so they're reported as deferred, never silently
+ * skipped.
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve, basename } from 'node:path'
+import yaml from 'js-yaml'
+import { validateDataInputs } from '@uniweb/build'
+import { discoverFoundations, discoverSites } from '../utils/discover.js'
+import { findWorkspaceRoot } from '../utils/workspace.js'
+
+const colors = {
+  reset: '\x1b[0m',
+  bright: '\x1b[1m',
+  dim: '\x1b[2m',
+  red: '\x1b[31m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[36m',
+}
+
+const log = console.log
+const success = (msg) => log(`${colors.green}✓${colors.reset} ${msg}`)
+const warn = (msg) => log(`${colors.yellow}⚠${colors.reset} ${msg}`)
+const error = (msg) => console.error(`${colors.red}✗${colors.reset} ${msg}`)
+const info = (msg) => log(`${colors.blue}→${colors.reset} ${msg}`)
+
+/**
+ * Read a flag that takes a value: `--site foo` or `--site=foo`.
+ */
+function flagValue(args, name) {
+  const eq = args.find((a) => a.startsWith(`${name}=`))
+  if (eq) return eq.slice(name.length + 1)
+  const idx = args.indexOf(name)
+  if (idx !== -1 && args[idx + 1] && !args[idx + 1].startsWith('--')) return args[idx + 1]
+  return null
+}
+
+function loadSiteYml(dir) {
+  for (const f of ['site.yml', 'site.yaml']) {
+    const p = join(dir, f)
+    if (existsSync(p)) {
+      try {
+        return yaml.load(readFileSync(p, 'utf8'))
+      } catch {
+        return null
+      }
+    }
+  }
+  return null
+}
+
+/**
+ * Validate one site against its local foundation.
+ *
+ * @returns {Promise<Object>} { site, foundation, status, report?, reason? }
+ *   status: 'checked' | 'skipped'
+ */
+async function validateSite(site, foundations, workspaceDir) {
+  const sitePath = join(workspaceDir, site.path)
+  const siteYml = loadSiteYml(sitePath)
+  const foundationName = siteYml?.foundation
+
+  // No local foundation to check against → out of static scope (the schemas
+  // live in the foundation; a registry-ref / URL foundation isn't on disk).
+  if (!foundationName) {
+    return { site: site.name, status: 'skipped', reason: 'no foundation declared in site.yml (runtime-loaded?)' }
+  }
+  const match = foundations.find((f) => f.name === foundationName || basename(f.path) === foundationName)
+  if (!match) {
+    return {
+      site: site.name,
+      status: 'skipped',
+      reason: `foundation "${foundationName}" is not a local workspace foundation — its schemas aren't on disk to check against`,
+    }
+  }
+
+  const foundationPath = join(workspaceDir, match.path)
+  const report = await validateDataInputs({ siteRoot: sitePath, foundationPath })
+  return { site: site.name, foundation: match.name, status: 'checked', report }
+}
+
+/**
+ * Print one site's findings in human form. Groups by the (file, schema) pair
+ * so a collection feeding many sections lists its findings once, with the
+ * sections that use it — every link of the chain (route › section › key › file
+ * › item › field) is present, de-duped.
+ */
+function printSiteHuman(result) {
+  log('')
+  if (result.status === 'skipped') {
+    warn(`${colors.bright}${result.site}${colors.reset} — skipped: ${result.reason}`)
+    return
+  }
+
+  const { report, foundation } = result
+  const { violations, deferred, setupErrors, summary } = report
+  const header = `${colors.bright}${result.site}${colors.reset} ${colors.dim}(foundation: ${foundation})${colors.reset}`
+
+  if (violations.length === 0 && setupErrors.length === 0) {
+    success(`${header} — ${summary.records} record(s) / ${summary.schemas} schema(s) conform`)
+  } else {
+    info(header)
+  }
+
+  // Group violations by file+schema pair.
+  const groups = new Map()
+  for (const v of violations) {
+    const key = `${v.file} ${v.schema}`
+    if (!groups.has(key)) groups.set(key, { file: v.file, schema: v.schema, users: v.users, findings: [] })
+    groups.get(key).findings.push(v)
+  }
+  for (const g of groups.values()) {
+    log(`  ${colors.red}✗${colors.reset} ${g.file} ${colors.dim}· schema ${g.schema}${colors.reset}`)
+    for (const u of dedupeUsers(g.users)) {
+      log(`      ${colors.dim}used by${colors.reset} ${u.route} › ${u.section} › data.${u.key}`)
+    }
+    for (const f of g.findings) {
+      log(`      ${colors.yellow}•${colors.reset} item ${colors.bright}"${f.item}"${colors.reset} › ${f.field} — ${f.message}`)
+    }
+  }
+
+  for (const e of setupErrors) {
+    log(`  ${colors.red}✗${colors.reset} ${e.file} — ${e.message}`)
+    for (const u of dedupeUsers(e.users)) {
+      log(`      ${colors.dim}used by${colors.reset} ${u.route} › ${u.section} › data.${u.key}`)
+    }
+  }
+
+  if (deferred.length > 0) {
+    log(`  ${colors.dim}↪ deferred (not statically checkable):${colors.reset}`)
+    for (const d of deferred) {
+      const extra = d.url ? ` ${colors.dim}(${d.url})${colors.reset}` : d.ref ? ` ${colors.dim}(${d.ref})${colors.reset}` : ''
+      log(`      ${colors.dim}•${colors.reset} ${d.route} › ${d.section} › data.${d.key} — ${d.reason}${extra}`)
+    }
+  }
+
+  log(
+    `  ${colors.dim}${summary.records} record(s) · ${summary.schemas} schema(s) · ` +
+      `${summary.violations} violation(s) · ${summary.deferred} deferred${colors.reset}`
+  )
+}
+
+function dedupeUsers(users) {
+  const seen = new Set()
+  const out = []
+  for (const u of users || []) {
+    const k = `${u.route} ${u.section} ${u.key}`
+    if (seen.has(k)) continue
+    seen.add(k)
+    out.push(u)
+  }
+  return out
+}
+
+export async function validate(args = []) {
+  const asJson = args.includes('--json')
+  const strict = args.includes('--strict')
+  const siteFilter = flagValue(args, '--site')
+  const positional = args.find((a, i) => !a.startsWith('--') && args[i - 1] !== '--site')
+
+  const target = positional ? resolve(process.cwd(), positional) : process.cwd()
+  const workspaceDir = findWorkspaceRoot(target)
+
+  if (!workspaceDir) {
+    if (asJson) log(JSON.stringify({ ok: false, error: 'not in a Uniweb workspace' }, null, 2))
+    else error('Not in a Uniweb workspace. Run this from a project root or a site directory.')
+    return { exitCode: 2 }
+  }
+
+  const [sites, foundations] = await Promise.all([discoverSites(workspaceDir), discoverFoundations(workspaceDir)])
+
+  // Select which sites to check: --site filter, an explicitly targeted site
+  // directory, or all sites in the workspace.
+  let selected = sites
+  if (siteFilter) {
+    selected = sites.filter((s) => s.name === siteFilter || basename(s.path) === siteFilter)
+    if (selected.length === 0) {
+      const names = sites.map((s) => s.name).join(', ') || '(none)'
+      if (asJson) log(JSON.stringify({ ok: false, error: `site "${siteFilter}" not found`, sites: sites.map((s) => s.name) }, null, 2))
+      else error(`Site "${siteFilter}" not found. Available: ${names}`)
+      return { exitCode: 2 }
+    }
+  } else if (target !== workspaceDir) {
+    const match = sites.find((s) => join(workspaceDir, s.path) === target)
+    if (match) selected = [match]
+  }
+
+  if (selected.length === 0) {
+    if (asJson) log(JSON.stringify({ ok: true, sites: [], note: 'no sites found' }, null, 2))
+    else warn('No sites found in this workspace.')
+    return { exitCode: 0 }
+  }
+
+  // The data pipeline (collectSiteContent / processCollections) prints progress
+  // via console.log. Route that to stderr while the engine runs so stdout stays
+  // clean — pure JSON for `--json`, just the report otherwise. `log` captured
+  // the original stdout writer at module load, so our own output is unaffected.
+  const results = []
+  const origConsoleLog = console.log
+  console.log = (...a) => process.stderr.write(a.join(' ') + '\n')
+  try {
+    for (const site of selected) {
+      try {
+        results.push(await validateSite(site, foundations, workspaceDir))
+      } catch (err) {
+        results.push({ site: site.name, status: 'error', reason: err.message })
+      }
+    }
+  } finally {
+    console.log = origConsoleLog
+  }
+
+  const totalViolations = results.reduce((n, r) => n + (r.report?.violations.length || 0), 0)
+  const totalSetupErrors = results.reduce((n, r) => n + (r.report?.setupErrors.length || 0), 0)
+  const hadError = results.some((r) => r.status === 'error')
+
+  if (asJson) {
+    const payload = {
+      ok: totalViolations === 0 && !hadError,
+      strict,
+      sites: results.map((r) => ({
+        site: r.site,
+        foundation: r.foundation || null,
+        status: r.status,
+        reason: r.reason || null,
+        ...(r.report || {}),
+      })),
+      summary: {
+        sites: results.length,
+        violations: totalViolations,
+        setupErrors: totalSetupErrors,
+        deferred: results.reduce((n, r) => n + (r.report?.deferred.length || 0), 0),
+      },
+    }
+    log(JSON.stringify(payload, null, 2))
+  } else {
+    log('')
+    log(`${colors.blue}${colors.bright}Uniweb Validate${colors.reset}`)
+    log(`${colors.dim}Checking content against the data schemas your foundation declares…${colors.reset}`)
+    for (const r of results) {
+      if (r.status === 'error') {
+        log('')
+        error(`${colors.bright}${r.site}${colors.reset} — could not check: ${r.reason}`)
+      } else {
+        printSiteHuman(r)
+      }
+    }
+
+    log('')
+    log('─'.repeat(50))
+    if (totalViolations === 0 && !hadError) {
+      log('')
+      success(`${colors.bright}All data conforms.${colors.reset}`)
+      if (!strict && totalSetupErrors === 0) {
+        // nothing more to say
+      }
+      log('')
+    } else {
+      log('')
+      if (totalViolations > 0) {
+        const mode = strict ? `${colors.red}error${colors.reset}` : `${colors.yellow}warning${colors.reset}`
+        log(`${totalViolations} violation(s) — reported as ${mode}${strict ? '' : ` ${colors.dim}(pass --strict to fail CI)${colors.reset}`}`)
+      }
+      if (hadError) log(`${colors.red}Some sites could not be checked.${colors.reset}`)
+      log('')
+    }
+  }
+
+  // Exit semantics: 2 = couldn't run; 1 = violations under --strict; 0 = clean
+  // or warn-only (the live path stays tolerant, so findings don't fail by
+  // default). Setup/read failures are surfaced but don't fail the build.
+  if (hadError) return { exitCode: 2 }
+  if (totalViolations > 0 && strict) return { exitCode: 1 }
+  return { exitCode: 0 }
+}

package/src/framework-index.json

@@ -1,12 +1,13 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-05-13T05:21:17.590Z",
+  "generatedAt": "2026-06-03T19:50:40.168Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.14.5",
+      "version": "0.14.6",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
+        "@uniweb/content-writer",
         "@uniweb/core",
         "@uniweb/runtime",
         "@uniweb/schemas",
@@ -14,17 +15,17 @@
       ]
     },
     "@uniweb/content-reader": {
-      "version": "1.1.11",
+      "version": "1.1.12",
       "path": "framework/content-reader",
       "deps": []
     },
     "@uniweb/content-writer": {
-      "version": "0.2.4",
+      "version": "0.2.5",
       "path": "framework/content-writer",
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.7.11",
+      "version": "0.7.12",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -42,7 +43,7 @@
       "deps": []
     },
     "@uniweb/kit": {
-      "version": "0.9.13",
+      "version": "0.9.14",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core"
@@ -54,12 +55,12 @@
       "deps": []
     },
     "@uniweb/press": {
-      "version": "0.4.6",
+      "version": "0.4.7",
       "path": "framework/press",
       "deps": []
     },
     "@uniweb/runtime": {
-      "version": "0.8.14",
+      "version": "0.8.15",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",

package/src/index.js

@@ -37,6 +37,7 @@ import { login } from './commands/login.js'
 import { invite } from './commands/invite.js'
 import { handoff } from './commands/handoff.js'
 import { update } from './commands/update.js'
+import { clone } from './commands/clone.js'
 import { template } from './commands/template.js'
 import {
   resolveTemplate,
@@ -133,7 +134,7 @@ function getCliVersion() {
 // install that's the whole point; delegating to the project-local copy
 // would align the project to the version it already has, i.e. a no-op.
 const STANDALONE_COMMANDS = new Set([
-  'create', '--help', '-h', '--version', '-v', 'login', 'update',
+  'create', 'clone', '--help', '-h', '--version', '-v', 'login', 'update',
 ])
 
 /**
@@ -599,6 +600,44 @@ async function main() {
     process.exit(result?.errors > 0 ? 1 : 0)
   }
 
+  // Handle validate command (dynamic import — depends on @uniweb/build)
+  if (command === 'validate') {
+    const { validate } = await importProjectCommand('./commands/validate.js')
+    const result = await validate(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
+  // Handle register command (dynamic import — depends on @uniweb/build)
+  if (command === 'register') {
+    const { register } = await importProjectCommand('./commands/register.js')
+    const result = await register(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
+  // Handle push command (dynamic import — depends on @uniweb/build)
+  if (command === 'push') {
+    const { push } = await importProjectCommand('./commands/push.js')
+    const result = await push(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
+  // Handle pull command (dynamic import — depends on @uniweb/build)
+  if (command === 'pull') {
+    const { pull } = await importProjectCommand('./commands/pull.js')
+    const result = await pull(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
+  // Handle clone command (global — bootstraps a new project from a backend site;
+  // STANDALONE, so a global `uniweb clone` runs here instead of delegating to a
+  // project-local CLI that doesn't exist yet. clone.js avoids any static
+  // @uniweb/build import, then delegates the projection to the project-local
+  // `uniweb pull` after install.)
+  if (command === 'clone') {
+    const result = await clone(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
   // Handle update command
   if (command === 'update') {
     await update(args.slice(1))
@@ -646,9 +685,32 @@ async function main() {
     return
   }
 
-  // Handle login command
+  // Handle content command (dynamic import — depends on @uniweb/build/uwx)
+  if (command === 'content') {
+    const { content } = await importProjectCommand('./commands/content.js')
+    await content(args.slice(1))
+    return
+  }
+
+  // Handle login command. Default targets the NEW backend (username/password);
+  // `--legacy` runs the old browser/social flow (still used by publish/deploy
+  // internally via ensureAuth, so it stays reachable).
   if (command === 'login') {
-    await login(args.slice(1))
+    const loginArgs = args.slice(1)
+    if (loginArgs.includes('--legacy')) {
+      await login(loginArgs.filter((a) => a !== '--legacy'))
+    } else {
+      const { getRegistryApiBaseUrl } = await import('./utils/config.js')
+      const { runRegistryLogin } = await import('./utils/registry-auth.js')
+      await runRegistryLogin({ apiBase: getRegistryApiBaseUrl(), args: loginArgs })
+    }
+    return
+  }
+
+  // Handle org command (new-backend orgs/units — publish-scope management)
+  if (command === 'org') {
+    const { org } = await import('./commands/org.js')
+    await org(args.slice(1))
     return
   }
 
@@ -1169,6 +1231,59 @@ ${colors.bright}Options:${colors.reset}
   --non-interactive  Fail with usage info instead of prompting
 
 Exit code is 1 if errors are found (warnings only → exit 0).
+`,
+    validate: `
+${colors.cyan}${colors.bright}uniweb validate${colors.reset} ${colors.dim}— Check your content against your foundation's data schemas${colors.reset}
+
+${colors.bright}Usage:${colors.reset}
+  uniweb validate [path] [options]
+
+Checks each section's file-based data inputs against the schema your
+foundation declared for that input (meta.js \`data:\`). Answers "does my
+data match what I promised?" — distinct from \`doctor\`, which checks your
+project against framework conventions.
+
+Warns by default; the live render path stays tolerant, so this is a
+pre-live / CI gate. Dynamic (\`url:\`) inputs and entity references can't be
+resolved without a running backend, so they're reported as deferred,
+never silently skipped.
+
+${colors.bright}Options:${colors.reset}
+  --strict           Treat findings as errors (non-zero exit for CI)
+  --json             Machine-readable output (for CI annotations)
+  --site <name>      Check one site in a multi-site workspace
+
+Exit codes: 0 clean (or warn-only), 1 violations under --strict, 2 setup error.
+`,
+    register: `
+${colors.cyan}${colors.bright}uniweb register${colors.reset} ${colors.dim}— Register a foundation + its data schemas with the backend registry${colors.reset}
+
+${colors.bright}Usage:${colors.reset}
+  uniweb register [options]
+
+Builds one \`.uwx\` document and submits it to the registry over HTTP. Run
+\`uniweb login\` first (or pass \`--token\`). Distinct from \`uniweb publish\` (legacy
+hosting platform).
+
+Auto-detects what you run it in:
+  • a foundation        the foundation + the data schemas it defines/renders
+  • a schemas-only pkg   just its data schemas, no foundation — e.g. @uniweb/schemas,
+                         any @org/schemas package, or a bare schemas/*.yml folder
+
+Schema scopes (set the org with --scope, or package.json uniweb.scope):
+  @/name     your own schema, scoped to the publish org   (@/x -> @org/x)
+  @std/name  a shared standard schema (from @uniweb/schemas)
+  @org/name  another org's published schema, referenced by name
+
+${colors.bright}Options:${colors.reset}
+  --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
+  --dry-run          Print the .uwx; submit nothing
+  -o, --output <f>   Write the .uwx to a file; submit nothing
+  --registry <url>   Submit endpoint (default: \$UNIWEB_REGISTER_URL or a local URL)
+  --token <bearer>   Submit with this bearer; skips \`uniweb login\` (or set UNIWEB_TOKEN)
+  --non-interactive  Fail with usage info instead of prompting
+
+Run from a foundation, a schemas-only package, or a workspace with a single foundation.
 `,
     rename: `
 ${colors.cyan}${colors.bright}uniweb rename${colors.reset} ${colors.dim}— Rename a workspace package${colors.reset}
@@ -1343,6 +1458,7 @@ ${colors.bright}Usage:${colors.reset}
 
 ${colors.bright}Commands:${colors.reset}
   create [name]      Create a new project
+  clone <site-uuid>  Clone a backend site into a local file project
   add <type> [name]  Add a foundation, site, or extension to a project
   rename <type>      Rename a foundation, site, or extension across the workspace
   dev                Start a dev server for a site
@@ -1350,11 +1466,15 @@ ${colors.bright}Commands:${colors.reset}
   deploy             Deploy a site to Uniweb hosting
   export             Export a self-contained site for third-party hosting
   publish            Publish a foundation to the Uniweb registry
+  register           Register a foundation + its data schemas with the backend registry
+  push               Push a site's content to the backend
+  pull               Pull a site's content from the backend
   invite <email>     Create a foundation invite for a client
   handoff <email>    Hand off a site to a client
   inspect <path>     Inspect parsed content shape of a markdown file or folder
   docs               Generate component documentation
   doctor             Diagnose project configuration issues
+  validate           Check your content against your foundation's data schemas
   update             Align workspace deps + AGENTS.md to the running CLI
   i18n <cmd>         Internationalization (extract, sync, status)
   template publish   Publish a site as a cloud template

package/src/templates/processor.js

@@ -166,6 +166,35 @@ async function processFile(sourcePath, targetPath, data, options = {}) {
   }
 }
 
+/**
+ * Rename a leading single underscore to a dot: `_gitignore` → `.gitignore`,
+ * `_vscode` → `.vscode`.
+ *
+ * Dotfiles live in the template source under a `_`-prefixed name for two
+ * reasons: (1) so they aren't swept up by the template repo's own git ignore
+ * rules, and (2) — critically — so they survive `npm publish`. npm strips any
+ * file literally named `.gitignore` from the package tarball (it's treated as
+ * an ignore-source, not shippable content), so a template that needs to ship a
+ * `.gitignore` MUST store it as `_gitignore` and rename it at scaffold time.
+ * `.gitkeep` and other dotfiles ship fine; `.gitignore` is the trap.
+ *
+ * `__name` (double underscore) is left untouched, matching the prior
+ * directory-only behavior.
+ */
+function dotfileRename(name) {
+  return name.startsWith('_') && !name.startsWith('__') ? `.${name.slice(1)}` : name
+}
+
+/**
+ * Compute a template file's scaffolded output name: strip the `.hbs`
+ * Handlebars suffix, then apply {@link dotfileRename}. So `_gitignore` →
+ * `.gitignore` and `_env.local.hbs` → `.env.local`.
+ */
+function templateOutputName(sourceName) {
+  const base = sourceName.endsWith('.hbs') ? sourceName.slice(0, -4) : sourceName
+  return dotfileRename(base)
+}
+
 /**
  * Copy a directory structure recursively, processing templates
  *
@@ -187,12 +216,8 @@ export async function copyTemplateDirectory(sourcePath, targetPath, data, option
 
     if (entry.isDirectory()) {
       const sourceFullPath = path.join(sourcePath, sourceName)
-      // Rename _prefix directories to .prefix (e.g., _vscode → .vscode)
-      // This allows dotfile directories to be committed without being gitignored
-      const targetName = sourceName.startsWith('_') && !sourceName.startsWith('__')
-        ? `.${sourceName.slice(1)}`
-        : sourceName
-      const targetFullPath = path.join(targetPath, targetName)
+      // Rename _prefix directories to .prefix (e.g., _vscode → .vscode).
+      const targetFullPath = path.join(targetPath, dotfileRename(sourceName))
 
       await copyTemplateDirectory(sourceFullPath, targetFullPath, data, { onWarning, onProgress, skip })
     } else {
@@ -201,17 +226,14 @@ export async function copyTemplateDirectory(sourcePath, targetPath, data, option
         continue
       }
 
-      // Determine the output filename (strip .hbs extension) for skip check
-      const outputName = sourceName.endsWith('.hbs') ? sourceName.slice(0, -4) : sourceName
-      if (skip?.includes(outputName)) {
+      // Output name: strip `.hbs`, then rename a leading `_` to `.`
+      // (e.g. `_gitignore` → `.gitignore`). Used for both the skip check and
+      // the written filename so they can't drift.
+      const targetName = templateOutputName(sourceName)
+      if (skip?.includes(targetName)) {
         continue
       }
 
-      // Remove .hbs extension for target filename
-      const targetName = sourceName.endsWith('.hbs')
-        ? sourceName.slice(0, -4)
-        : sourceName
-
       const sourceFullPath = path.join(sourcePath, sourceName)
       const targetFullPath = path.join(targetPath, targetName)
 
@@ -228,7 +250,9 @@ export async function copyTemplateDirectory(sourcePath, targetPath, data, option
  * Enumerate the output paths a template directory would write, without
  * touching disk. Mirrors `copyTemplateDirectory`'s naming rules:
  *   - `.hbs` extension is stripped
- *   - `_dir` is renamed to `.dir` (but `__dir` is preserved as `_dir` would be)
+ *   - a leading `_` is renamed to `.` for both files and directories
+ *     (e.g. `_gitignore` → `.gitignore`, `_vscode` → `.vscode`); `__name`
+ *     is preserved
  *   - `template.json` is excluded
  *   - `skip` filenames are excluded by their post-rename name
  *
@@ -253,9 +277,7 @@ async function enumerateInto(sourcePath, relPath, outputs, skip) {
   for (const entry of entries) {
     const sourceName = entry.name
     if (entry.isDirectory()) {
-      const targetName = sourceName.startsWith('_') && !sourceName.startsWith('__')
-        ? `.${sourceName.slice(1)}`
-        : sourceName
+      const targetName = dotfileRename(sourceName)
       await enumerateInto(
         path.join(sourcePath, sourceName),
         relPath ? path.join(relPath, targetName) : targetName,
@@ -264,7 +286,7 @@ async function enumerateInto(sourcePath, relPath, outputs, skip) {
       )
     } else {
       if (sourceName === 'template.json') continue
-      const outputName = sourceName.endsWith('.hbs') ? sourceName.slice(0, -4) : sourceName
+      const outputName = templateOutputName(sourceName)
       if (skip.includes(outputName)) continue
       outputs.push(relPath ? path.join(relPath, outputName) : outputName)
     }

package/src/utils/config.js

@@ -83,6 +83,27 @@ export function getRegistryUrl() {
     || PRODUCTION_REGISTRY_URL
 }
 
+/**
+ * Get the new registry backend's API base origin — DISTINCT from the
+ * legacy PHP getBackendUrl(). `register` POSTs to {origin}/dev/registry/register
+ * and the new-backend `login` to {origin}/dev/auth/login.
+ *
+ * Priority: UNIWEB_REGISTER_URL's origin (the env users already set for
+ * register) > ~/.uniweb/config.json registryApiUrl > local default.
+ * @returns {string}
+ */
+export function getRegistryApiBaseUrl() {
+  const fromEnv = process.env.UNIWEB_REGISTER_URL
+  if (fromEnv) {
+    try { return new URL(fromEnv).origin } catch { /* fall through */ }
+  }
+  const fromCfg = readCliConfig().registryApiUrl
+  if (fromCfg) {
+    try { return new URL(fromCfg).origin } catch { return fromCfg }
+  }
+  return 'http://localhost:8080'
+}
+
 /**
  * Read workspace package globs.
  * Tries pnpm-workspace.yaml first, falls back to package.json workspaces.