uniweb 0.12.26 → 0.12.28

package/src/commands/register.js

@@ -4,8 +4,14 @@
  * registry as one names-only `.uwx` document (uwx-format.md §5).
  *
  * `uniweb login && uniweb register`. Distinct from `uniweb publish` (which
- * targets the legacy unicloud / uniweb-edge platform) — `register` talks to the
- * registry over HTTP at a configurable endpoint.
+ * targets the legacy platform) — `register` talks to the registry over HTTP at a
+ * configurable endpoint.
+ *
+ * If the foundation's `dist/` is missing or version-stale (the baked schema
+ * version differs from package.json), `register` builds it first — the same
+ * build-if-stale `uniweb publish` does, so `register` is a full drop-in.
+ * Preview paths (`--dry-run`, `-o`) never write to `dist/`; they require a
+ * pre-built foundation.
  *
  * Run from a foundation, or from a schemas-only package — a package that exports
  * schemas (e.g. `@uniweb/schemas`, any `@org/schemas`) or a bare `schemas/*.yml`
@@ -13,10 +19,13 @@
  * standalone (foundation-less); same flags, `--scope` names them.
  *
  * Usage:
- *   uniweb register                      Build the .uwx and submit it
+ *   uniweb register                      Build the .uwx, submit it, then deliver
+ *                                        the foundation's dist/ code (plan +
+ *                                        upload — see utils/code-upload.js)
  *   uniweb register --scope @org         Publish under @org (resolves @/x -> @org/x).
  *                                        Default: the package's package.json "uniweb.scope".
- *   uniweb register --dry-run            Print the .uwx; submit nothing
+ *   uniweb register --schema-only        Skip the code delivery (schemas land, no dist upload)
+ *   uniweb register --dry-run            Print the .uwx + the code file plan; submit nothing
  *   uniweb register -o foundation.uwx    Write the .uwx to a file; submit nothing
  *   uniweb register --registry <url>     Override the submit endpoint
  *   uniweb register --token <bearer>     Submit with this bearer; skips `uniweb login`
@@ -25,20 +34,38 @@
  * Auth (submit only):  --token <bearer>  >  UNIWEB_TOKEN  >  `uniweb login` session.
  */
 
+// DEFERRED foundation-registration capabilities (the legacy `uniweb publish` had
+// these; the new backend doesn't yet — captured here so the design intent isn't
+// lost, and the legacy code could be removed). Implement as `register` flags (or
+// backend-side policy) when the need is real:
+//
+//   • ACCESS POLICY — legacy `--edit-access open|restricted`. On the old platform
+//     this gated who could act on the foundation in the app. Its meaning is
+//     unclear for the new model: there is no editing of a foundation's code or
+//     schema, so it is most likely a LICENSING / access-control concern (who may
+//     use/reference the foundation), not "editing". Revisit as `--access` (or an
+//     org/licensing policy on the backend) when foundation licensing lands.
+//
+//   • VERSION PROPAGATION — legacy `--propagate`. Opts a newly-registered version
+//     into the registry's version-update walk: trusting sites whose policy allows
+//     the jump (e.g. auto-patch) adopt it with no rebuild; default was "silent"
+//     (stored, nothing moves). The SAME concept applies to `runtime register`
+//     (legacy deploy-runtime had `--propagate` too). Implement once the backend
+//     has a version-update/propagation policy; until then every register is silent.
+
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { execSync } from 'node:child_process'
 import { resolve, join } from 'node:path'
 import { buildRegistryPackage, buildSchemaOnlyPackage } from '@uniweb/build/uwx'
 import { classifyPackage, isSchemasPackage, collectStandaloneSchemas } from '@uniweb/build'
-import { ensureRegistryAuth, readRegistryAuth } from '../utils/registry-auth.js'
+import { readRegistryAuth } from '../utils/registry-auth.js'
+import { collectDistFiles } from '../utils/code-upload.js'
 import { deriveScope } from '../utils/registry-orgs.js'
+import { BackendClient } from '../backend/client.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
 import { findWorkspaceRoot, findFoundations, promptSelect } from '../utils/workspace.js'
 import { isNonInteractive, getCliPrefix } from '../utils/interactive.js'
 
-// The backend route is `/dev/registry/register`; the host defaults to a local
-// server and is overridable via --registry / UNIWEB_REGISTER_URL (full URL).
-const DEFAULT_REGISTER_URL = 'http://localhost:8080/dev/registry/register'
-
 const colors = {
   reset: '\x1b[0m', bright: '\x1b[1m', dim: '\x1b[2m',
   red: '\x1b[31m', green: '\x1b[32m', yellow: '\x1b[33m', blue: '\x1b[36m',
@@ -126,12 +153,53 @@ async function resolveFoundationDir(args) {
   process.exit(1)
 }
 
+/**
+ * Does the foundation's `dist/` need a (re)build before we can register it?
+ *
+ * Mirrors `uniweb publish`'s build-if-stale so `register` is a full drop-in
+ * for the foundation-publish flow. Two staleness signals:
+ *   - MISSING: no `dist/entry.js` (or the legacy `dist/foundation.js`), or no
+ *     `dist/meta/schema.json` — nothing built yet.
+ *   - STALE: the version baked into `dist/meta/schema.json::_self.version`
+ *     differs from `package.json::version` — a version bump without a rebuild,
+ *     so the artifact encodes the OLD version while the register intends the
+ *     NEW one (we'd otherwise submit a schema whose version disagrees with the
+ *     code we deliver).
+ *
+ * Returns `{ needs: false }` or `{ needs: true, reason }`.
+ *
+ * @param {string} targetDir  the foundation directory
+ */
+export function foundationNeedsBuild(targetDir) {
+  const distDir = join(targetDir, 'dist')
+  const schemaPath = join(distDir, 'meta', 'schema.json')
+  // @uniweb/build emits dist/entry.js; older builds emitted dist/foundation.js.
+  const hasArtifact = existsSync(join(distDir, 'entry.js')) || existsSync(join(distDir, 'foundation.js'))
+  if (!hasArtifact || !existsSync(schemaPath)) return { needs: true, reason: 'no dist/ found' }
+  let pkgVersion = null
+  try {
+    pkgVersion = JSON.parse(readFileSync(join(targetDir, 'package.json'), 'utf8'))?.version || null
+  } catch {
+    // No readable package.json version — fall through; a present schema with no
+    // version to compare is treated as fresh (the submit path validates names).
+  }
+  try {
+    const peek = JSON.parse(readFileSync(schemaPath, 'utf8'))
+    if (peek?._self?.version && pkgVersion && peek._self.version !== pkgVersion) {
+      return { needs: true, reason: `package.json version (${pkgVersion}) differs from built schema (${peek._self.version})` }
+    }
+  } catch {
+    return { needs: true, reason: 'dist/meta/schema.json could not be parsed' }
+  }
+  return { needs: false }
+}
+
 export async function register(args = []) {
   const dryRun = args.includes('--dry-run')
   const output = flagValue(args, '-o') || flagValue(args, '--output')
   const scopeFlag = flagValue(args, '--scope')
   const tokenFlag = flagValue(args, '--token')
-  const registryUrl = flagValue(args, '--registry') || process.env.UNIWEB_REGISTER_URL || DEFAULT_REGISTER_URL
+  const client = new BackendClient({ originFlag: flagValue(args, '--registry'), token: tokenFlag, args, command: 'Registering' })
 
   // Target: a schemas-only package (standalone data-schema register) or a
   // foundation (foundation + the schemas it renders). A schemas package is only
@@ -146,8 +214,6 @@ export async function register(args = []) {
   let scope = scopeFlag || pkgScope
   let scopeSource = scopeFlag ? '--scope' : pkgScope ? 'package.json uniweb.scope' : null
   const isPreview = !!output || dryRun
-  const apiBase = new URL(registryUrl).origin
-  let token = null
 
   // Each path supplies a different schema source: the standalone path discovers
   // the package's own schemas; the foundation path reads its built schema.json.
@@ -166,10 +232,29 @@ export async function register(args = []) {
       return { exitCode: 2 }
     }
   } else {
+    // Build-if-stale (mirrors `uniweb publish`): a missing or version-stale
+    // dist/ gets (re)built before we read its schema. Preview paths
+    // (--dry-run / -o) must not write to dist/, so they require a pre-built
+    // foundation and say so instead of building.
+    const { needs, reason } = foundationNeedsBuild(targetDir)
+    if (needs) {
+      if (isPreview) {
+        error(`No usable build (${reason}).`)
+        log(`  Build the foundation first: ${colors.bright}uniweb build${colors.reset}`)
+        return { exitCode: 2 }
+      }
+      info(`${reason} — building the foundation first …`)
+      try {
+        execSync('npx uniweb build --target foundation', { cwd: targetDir, stdio: 'inherit' })
+      } catch (err) {
+        error(`Build failed: ${err.message}`)
+        return { exitCode: 2 }
+      }
+    }
     const schemaPath = join(targetDir, 'dist', 'meta', 'schema.json')
     if (!existsSync(schemaPath)) {
-      error('No built schema found (dist/meta/schema.json).')
-      log(`  Build the foundation first: ${colors.bright}uniweb build${colors.reset}`)
+      error('No built schema found (dist/meta/schema.json) after build.')
+      log(`  Build the foundation: ${colors.bright}uniweb build${colors.reset}`)
       return { exitCode: 2 }
     }
     try {
@@ -183,9 +268,9 @@ export async function register(args = []) {
   // No scope for a real submit → derive it from login membership (list → 1 use /
   // 0 create / N pick), persist to package.json, and reuse the session token.
   if (!scope && !isPreview) {
-    token = tokenFlag || (await ensureRegistryAuth({ apiBase, command: 'Registering', args }))
+    const token = await client.token()
     const sess = await readRegistryAuth()
-    const derived = await deriveScope({ apiBase, token, accountHandle: sess?.handle || null, args })
+    const derived = await deriveScope({ apiBase: client.origin, token, accountHandle: sess?.handle || null, args })
     if (!derived) return { exitCode: 0 }
     scope = `@${derived}`
     scopeSource = 'login'
@@ -229,7 +314,15 @@ export async function register(args = []) {
     log('')
     log(json)
     log('')
-    info(`Dry run — would submit to ${registryUrl}`)
+    info(`Dry run — would submit to ${client.origin}`)
+    if (!standalone && !args.includes('--schema-only')) {
+      const distFiles = collectDistFiles(join(targetDir, 'dist'))
+      log('')
+      info(`Would then deliver ${distFiles.length} code file(s) (meta/ excluded):`)
+      for (const f of distFiles) {
+        log(`  ${colors.dim}${f.path}  ${f.size} bytes  ${f.content_type}${colors.reset}`)
+      }
+    }
     return { exitCode: 0 }
   }
 
@@ -239,36 +332,88 @@ export async function register(args = []) {
     log(`  ${colors.dim}Without a scope, names stay @/… and the registry rejects them.${colors.reset}`)
     return { exitCode: 2 }
   }
-  // Submit auth: reuse the token from the scope bootstrap if it ran, else
-  // --token › UNIWEB_TOKEN › stored session › login (ensureRegistryAuth).
-  token = token || tokenFlag || (await ensureRegistryAuth({ apiBase, command: 'Registering', args }))
-  info(`Submitting to ${colors.dim}${registryUrl}${colors.reset} …`)
+  // Submit — the client carries the bearer (--token › UNIWEB_TOKEN › stored
+  // session › login), resolved lazily on this first authed call.
+  info(`Submitting to ${colors.dim}${client.origin}${colors.reset} …`)
   let res
   try {
-    res = await fetch(registryUrl, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-      body: json,
-    })
+    res = await client.register(json)
   } catch (err) {
-    error(`Could not reach the registry at ${registryUrl}: ${err.message}`)
+    error(`Could not reach the registry at ${client.origin}: ${err.message}`)
     log(`  ${colors.dim}Set the endpoint with --registry <url> or UNIWEB_REGISTER_URL.${colors.reset}`)
     return { exitCode: 2 }
   }
+  let alreadyRegistered = false
   if (!res.ok) {
-    error(`Registry rejected the submission: HTTP ${res.status} ${res.statusText}`)
-    if (res.status === 401 || res.status === 403) {
-      log(`  ${colors.dim}The registry didn't accept your credentials — it may use different ones than \`uniweb login\`.${colors.reset}`)
-      log(`  ${colors.dim}Supply a registry bearer with --token <bearer> (or UNIWEB_TOKEN); an existing one may be wrong or expired.${colors.reset}`)
-    }
     const body = await res.text().catch(() => '')
-    if (body) log(`  ${colors.dim}${body.slice(0, 500)}${colors.reset}`)
-    return { exitCode: 1 }
+    // Resume path: a registered version is immutable, so re-running after a
+    // partial code delivery hits the duplicate rejection here — a STRUCTURED
+    // 409 (problem+json, title "Conflict") — and proceeds to phase 2 (the
+    // code-uploads plan authorizes against the REGISTERED version; completed
+    // files are idempotent no-ops).
+    const isDuplicate = !standalone && res.status === 409
+    if (isDuplicate) {
+      alreadyRegistered = true
+      info(`${colors.dim}Schema for this version is already registered — resuming code delivery.${colors.reset}`)
+    } else {
+      error(`Registry rejected the submission: HTTP ${res.status} ${res.statusText}`)
+      if (res.status === 401 || res.status === 403) {
+        log(`  ${colors.dim}The registry didn't accept your credentials — it may use different ones than \`uniweb login\`.${colors.reset}`)
+        log(`  ${colors.dim}Supply a registry bearer with --token <bearer> (or UNIWEB_TOKEN); an existing one may be wrong or expired.${colors.reset}`)
+      }
+      if (body) log(`  ${colors.dim}${body.slice(0, 500)}${colors.reset}`)
+      return { exitCode: 1 }
+    }
+  }
+  if (!alreadyRegistered) {
+    success(
+      standalone
+        ? `Registered ${defined.length} data schema(s)${scope ? ` under ${scope}` : ''}`
+        : `Registered ${schema._self.name}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
+    )
+  }
+
+  // Phase 2 — deliver the foundation's code (plan → PUT-per-file, entry
+  // last; contract: foundation-code-upload.md). Schemas-
+  // only packages have no dist; --schema-only skips deliberately.
+  if (!standalone && !args.includes('--schema-only')) {
+    const distDir = join(targetDir, 'dist')
+    // The registry's vocabulary is the SCOPED name (`@org/name`). A scoped
+    // package name passes through; a bare one gets the chosen scope — the
+    // same resolution the .uwx submission applied.
+    const bareName = schema._self.name
+    const name = bareName.startsWith('@') ? bareName : `${scope}/${bareName}`
+    const version = schema._self.version
+    info(`Delivering code for ${colors.bright}${name}@${version}${colors.reset} …`)
+    try {
+      const result = await client.uploadFoundationCode({
+        name,
+        version,
+        distDir,
+        onProgress: (m) => log(`  ${colors.dim}${m}${colors.reset}`),
+      })
+      if (result.failed.length) {
+        error(`${result.failed.length} file(s) failed to upload:`)
+        for (const f of result.failed) {
+          log(`  ${colors.red}${f.path}${colors.reset} ${colors.dim}HTTP ${f.status} ${f.detail}${colors.reset}`)
+        }
+        log(`  ${colors.dim}Re-run \`uniweb register\` to resume — completed files are safe no-ops.${colors.reset}`)
+        return { exitCode: 1 }
+      }
+      const where = result.serveBase || 'the registry gateway'
+      if (result.verified === true) {
+        success(`Code delivered (${result.uploaded.length} files) — entry verified live at ${colors.dim}${where}${colors.reset}`)
+      } else if (result.verified === false) {
+        error('Code uploaded but the entry verification fetch did not match — investigate before using this version.')
+        return { exitCode: 1 }
+      } else {
+        success(`Code delivered (${result.uploaded.length} files, ${result.mode} mode)`)
+      }
+    } catch (err) {
+      error(`Code delivery failed: ${err.message}`)
+      log(`  ${colors.dim}The schema registration above succeeded; re-run \`uniweb register\` to deliver the code.${colors.reset}`)
+      return { exitCode: 1 }
+    }
   }
-  success(
-    standalone
-      ? `Registered ${defined.length} data schema(s)${scope ? ` under ${scope}` : ''}`
-      : `Registered ${schema._self.name}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
-  )
   return { exitCode: 0 }
 }

package/src/commands/runtime.js

@@ -0,0 +1,141 @@
+/**
+ * uniweb runtime register — upload a built `@uniweb/runtime` to the backend so it
+ * can serve the runtime version. The runtime is a SYSTEM artifact: registering it
+ * requires **@std membership** (a non-@std bearer 403s). Foundations pin a runtime
+ * version (`dist/runtime-pin.json`); that version must be registered, or `uniweb
+ * register` of such a foundation fails.
+ *
+ * Contract AGREED with the backend (2026-06-14): `POST /dev/runtime`, @std-gated,
+ * manifest-last. Wire + the two-half artifact set (SPA + ssr-edge isolate, the
+ * orchestrator stays platform-owned): utils/runtime-upload.js.
+ *
+ * Usage:
+ *   uniweb runtime register                  From framework/runtime (or --path <dir>)
+ *   uniweb runtime register --path <dir>     The @uniweb/runtime package dir
+ *   uniweb runtime register --version <v>    Override dist/app/manifest.json's version
+ *   uniweb runtime register --backend <url>  Override the backend origin
+ *   uniweb runtime register --token <bearer> Auth bearer (skips `uniweb login`)
+ *   uniweb runtime register --dry-run        Print the version + file plan; upload nothing
+ */
+
+import { readFileSync } from 'node:fs'
+import { resolve, join } from 'node:path'
+
+import { BackendClient } from '../backend/client.js'
+import { collectRuntimeFiles, hasWorkerRuntime, hasShims } from '../utils/runtime-upload.js'
+import { readFlagValue } from '../utils/args.js'
+
+const c = {
+  reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+  cyan: '\x1b[36m', green: '\x1b[32m', yellow: '\x1b[33m', red: '\x1b[31m',
+}
+const say = {
+  ok: (m) => console.log(`${c.green}✓${c.reset} ${m}`),
+  info: (m) => console.log(`${c.cyan}→${c.reset} ${m}`),
+  warn: (m) => console.log(`${c.yellow}⚠${c.reset} ${m}`),
+  err: (m) => console.error(`${c.red}✗${c.reset} ${m}`),
+  dim: (m) => console.log(`  ${c.dim}${m}${c.reset}`),
+}
+
+// The runtime package dir: --path, else the cwd when it IS @uniweb/runtime.
+function resolveRuntimeDir(args) {
+  const pathFlag = readFlagValue(args, '--path')
+  if (pathFlag) return resolve(pathFlag)
+  try {
+    if (JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf8')).name === '@uniweb/runtime') {
+      return process.cwd()
+    }
+  } catch {
+    // no readable package.json — fall through
+  }
+  return null
+}
+
+export async function runtime(args = []) {
+  const sub = args[0]
+  if (sub !== 'register') {
+    say.err(sub ? `Unknown subcommand: runtime ${sub}` : 'Usage: uniweb runtime register')
+    say.dim('uniweb runtime register — upload the built @uniweb/runtime to the backend (@std only).')
+    return { exitCode: sub ? 1 : 0 }
+  }
+  const rest = args.slice(1)
+  const dryRun = rest.includes('--dry-run')
+
+  const runtimeDir = resolveRuntimeDir(rest)
+  if (!runtimeDir) {
+    say.err('Not an @uniweb/runtime package.')
+    say.dim('Run from framework/runtime, or pass --path <dir>.')
+    return { exitCode: 2 }
+  }
+  const distDir = join(runtimeDir, 'dist')
+  const files = collectRuntimeFiles(distDir)
+  if (!files.length) {
+    say.err('No built runtime found (dist/app/).')
+    say.dim('Build it first: `pnpm build` in framework/runtime.')
+    return { exitCode: 2 }
+  }
+
+  // Version from the SPA build's manifest (the backend keys the version on it);
+  // --version overrides, parity with `uniwebd runtime install --version`.
+  let version = readFlagValue(rest, '--version')
+  if (!version) {
+    try {
+      version = JSON.parse(readFileSync(join(distDir, 'app', 'manifest.json'), 'utf8')).version
+    } catch (err) {
+      say.err(`Could not read dist/app/manifest.json: ${err.message}`)
+      return { exitCode: 2 }
+    }
+    if (!version) {
+      say.err('dist/app/manifest.json has no "version" field — rebuild the runtime.')
+      return { exitCode: 2 }
+    }
+  }
+  // The ssr-edge artifact is a SET: worker-runtime.js + its shims/*.js. Warn when
+  // the set is absent or incomplete (a worker without shims can't resolve react).
+  if (!hasWorkerRuntime(files)) {
+    say.warn("dist/worker-runtime.js is missing — the SSR isolate bundle won't be uploaded.")
+    say.dim('Build it first: `pnpm build:worker` in @uniweb/runtime (after `pnpm build`).')
+  } else if (!hasShims(files)) {
+    say.warn('dist/worker-runtime.js is present but dist/shims/ is missing — the SSR isolate set is incomplete.')
+    say.dim('The isolate resolves react/jsx-runtime/@uniweb/core through those shims; re-run `pnpm build:worker`.')
+  }
+
+  if (dryRun) {
+    say.info(`Would register ${c.bold}@uniweb/runtime@${version}${c.reset} (${files.length} files):`)
+    for (const f of files) say.dim(`${f.path}  ${f.size} bytes  ${f.content_type}`)
+    return { exitCode: 0 }
+  }
+
+  const client = new BackendClient({
+    originFlag: readFlagValue(rest, '--backend') || readFlagValue(rest, '--registry'),
+    token: readFlagValue(rest, '--token') || undefined,
+    args: rest,
+    command: 'Registering the runtime',
+  })
+
+  say.info(`Registering ${c.bold}@uniweb/runtime@${version}${c.reset} → ${c.dim}${client.origin}${c.reset} (${files.length} files)…`)
+  let result
+  try {
+    result = await client.uploadRuntime({ version, distDir, files, onProgress: (m) => say.dim(m) })
+  } catch (err) {
+    if (err.status === 403) {
+      say.err('Not authorized — registering a runtime version requires @std membership.')
+      return { exitCode: 1 }
+    }
+    say.err(`Runtime registration failed: ${err.message}`)
+    say.dim('Set the origin with --backend <url>; auth with `uniweb login` or --token <bearer>.')
+    return { exitCode: 1 }
+  }
+  if (result.failed.length) {
+    say.err(`${result.failed.length} file(s) failed to upload:`)
+    for (const f of result.failed) say.dim(`${f.path} — HTTP ${f.status} ${f.detail}`)
+    say.dim('Re-run `uniweb runtime register` to resume — completed files dedupe.')
+    return { exitCode: 1 }
+  }
+  console.log('')
+  say.ok(`Registered ${c.bold}@uniweb/runtime@${version}${c.reset} (${result.uploaded.length} files, ${result.mode} mode)`)
+  if (result.serveBase) say.dim(`served at ${result.serveBase}`)
+  return { exitCode: 0 }
+}
+
+export default runtime