uniweb 0.12.26 → 0.12.28

package/src/utils/registry-orgs.js

@@ -2,27 +2,35 @@
  * New-backend org operations for the publish-scope bootstrap — used by
  * `uniweb register`'s scope resolution and the `uniweb org` command.
  *
- * One resource (Bearer auth, new backend); the verb selects the operation:
- *   GET  /dev/orgs            → [{ handle, is_primary }] (your orgs, primary first)
- *   POST /dev/orgs { handle }  → { handle, uuid, is_primary }  (creator becomes a
- *                                member, primary iff their first)
+ * One resource (Bearer auth, the CLI's /dev lane); the verb selects the op:
  *
- * Handle grammar + reserved scopes are validated client-side for a clean prompt;
- * the server is the backstop (409 taken-or-reserved, 422 bad grammar).
+ *   GET  /dev/orgs → {
+ *     account_handle: string|null,     // the caller's account handle
+ *     personal_org_exists: bool,       // does @<account_handle> exist as an org
+ *     orgs: [{ handle, is_primary }]   // memberships, primary first;
+ *   }                                  // handle-less units filtered server-side
+ *
+ *   POST /dev/orgs { handle } → { handle, uuid, is_primary }
+ *
+ * The PERSONAL org needs no flag: handles live in ONE global namespace across
+ * accounts + orgs and only the owner can create the org matching their account
+ * handle — so `org.handle === account_handle` is a sound derivation, and the
+ * lazy personal claim is just a create. Org creation requires NO second factor
+ * on any lane (the 2FA gate lives at escalation points, not here).
+ *
+ * Failure shapes (branch on STATUS; details are human display, not contract):
+ * 422 = handle grammar; 409 = taken / reserved / belongs to another account
+ * (one status, server detail says which). Reserved names are SERVER-curated —
+ * deliberately not replicated here; the 409 detail carries the answer.
+ *
+ * Handle grammar (pre-validated for a fast prompt): lowercase alphanumerics +
+ * hyphens, 3–39 chars, no leading/trailing hyphen (consecutive hyphens are
+ * allowed).
  */
 
 const ORGS_PATH = '/dev/orgs'
 
-// Reserved registry scopes a dev cannot own — the system + standard namespaces
-// (uwx-format scope model). Grammatically valid, so the server returns 409
-// "taken" for these; we block them earlier for a clearer message.
-const RESERVED_HANDLES = new Set(['uniweb', 'std'])
-
-// Handle grammar (backend): lowercase alphanumerics + internal hyphens, 3–39 chars,
-// no leading/trailing hyphen. The server is authoritative on reserved names (409).
-const HANDLE_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/
-const HANDLE_MIN = 3
-const HANDLE_MAX = 39
+const HANDLE_RE = /^[a-z0-9][a-z0-9-]{1,37}[a-z0-9]$/
 
 /** Strip a leading `@` and any `/suffix`, returning the bare handle segment. */
 export function bareHandle(scope) {
@@ -30,34 +38,44 @@ export function bareHandle(scope) {
 }
 
 /**
- * Validate a handle client-side. Returns an error string, or null when valid.
- * Accepts an optional leading `@` (stripped before checking).
+ * Validate a handle's GRAMMAR client-side (reserved names are the server's
+ * call — a 409 carries the verdict). Returns an error string, or null.
  */
 export function validateHandle(handle) {
   const h = bareHandle(handle)
   if (!h) return 'A handle is required.'
-  if (h.length < HANDLE_MIN || h.length > HANDLE_MAX) return `Handle must be ${HANDLE_MIN}–${HANDLE_MAX} characters.`
-  if (!HANDLE_RE.test(h)) return 'Use lowercase letters, digits, and internal hyphens only (e.g. acme-co).'
-  if (RESERVED_HANDLES.has(h)) return `@${h} is reserved.`
+  if (!HANDLE_RE.test(h)) {
+    return 'Use 3–39 lowercase letters, digits, and hyphens (no leading/trailing hyphen).'
+  }
   return null
 }
 
 /**
- * List the authenticated account's org memberships (primary first).
- * @returns {Promise<Array<{handle: string, is_primary: boolean}>>}
+ * The picker read: memberships + the caller's account handle + whether the
+ * personal org already exists.
+ * @returns {Promise<{account_handle: string|null, personal_org_exists: boolean, orgs: Array<{handle: string, is_primary: boolean}>}>}
  */
-export async function listOrgs({ apiBase, token }) {
+export async function fetchOrgs({ apiBase, token }) {
   const res = await fetch(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
     headers: { Authorization: `Bearer ${token}` },
   })
   if (!res.ok) throw new Error(`Could not list your orgs: HTTP ${res.status} ${res.statusText}`)
   const data = await res.json().catch(() => null)
-  return Array.isArray(data) ? data : []
+  return {
+    account_handle: data?.account_handle ?? null,
+    personal_org_exists: data?.personal_org_exists === true,
+    orgs: Array.isArray(data?.orgs) ? data.orgs : [],
+  }
+}
+
+/** Back-compat alias: the membership rows only. */
+export async function listOrgs(opts) {
+  return (await fetchOrgs(opts)).orgs
 }
 
 /**
- * Create an org. The creating account becomes a member (primary iff it's their
- * first), so it's immediately publishable.
+ * Create an org (the lazy personal claim is exactly this create — the
+ * owner-exception admits `handle === account_handle` for the owner).
  * @returns {Promise<{handle: string, uuid?: string, is_primary?: boolean}>}
  */
 export async function createOrg({ apiBase, token, handle }) {
@@ -67,56 +85,58 @@ export async function createOrg({ apiBase, token, handle }) {
     headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
     body: JSON.stringify({ handle: h }),
   })
-  if (res.status === 409) {
-    const e = new Error(`@${h} is already taken (or reserved). Pick another.`)
-    e.status = 409
-    throw e
-  }
-  if (res.status === 422) {
-    const e = new Error(`@${h} is not a valid handle.`)
-    e.status = 422
-    throw e
-  }
-  if (!res.ok) {
-    let detail = ''
-    try { detail = (await res.text()).slice(0, 200) } catch { /* ignore */ }
-    const e = new Error(`Could not create @${h}: HTTP ${res.status}${detail ? ` — ${detail}` : ''}`)
-    e.status = res.status
-    throw e
-  }
-  return res.json()
+  if (res.ok) return res.json()
+
+  // Surface the server's human detail — a 409 distinguishes taken vs
+  // reserved vs belongs-to-another-account; a 422 names the grammar rule.
+  let detail = ''
+  try {
+    const body = await res.json()
+    detail = body?.detail || ''
+  } catch { /* non-JSON body — keep the generic line */ }
+  const fallback =
+    res.status === 409 ? `@${h} is not available.`
+    : res.status === 422 ? `@${h} is not a valid handle.`
+    : `Could not create @${h}: HTTP ${res.status}`
+  const e = new Error(detail || fallback)
+  e.status = res.status
+  throw e
 }
 
 /**
  * Derive the publish scope from login membership when none was supplied:
- *   1 org  → use it (confirm once)
- *   0 orgs → offer to create one (proposes the account handle when set, else
- *            prompts — never username-derived; cold-start per handle-origin (ii))
- *   N orgs → pick
+ *   ≥1 org → confirm (1) or pick (N), personal org labeled + first
+ *   0 orgs → the first-publish picker (personal default, lazily claimed)
  * Returns the chosen bare handle (no `@`), or null if cancelled. Persists
  * nothing — the caller records it. Bails in non-interactive mode.
  *
  * @param {Object} p
  * @param {string} p.apiBase
  * @param {string} p.token
- * @param {string|null} [p.accountHandle] - the account's handle (may be null)
+ * @param {string|null} [p.accountHandle] - fallback only; the server's
+ *   account_handle from the orgs read is authoritative
  * @param {string[]} [p.args] - argv slice; checked for --non-interactive
  * @returns {Promise<string|null>}
  */
 export async function deriveScope({ apiBase, token, accountHandle = null, args = [] }) {
-  const orgs = await listOrgs({ apiBase, token })
+  const envelope = await fetchOrgs({ apiBase, token })
+  const { orgs } = envelope
+  const personal = envelope.account_handle || (accountHandle ? bareHandle(accountHandle) : null)
+  const personalOrgExists = envelope.personal_org_exists
   const { isNonInteractive } = await import('./interactive.js')
   const nonInteractive = isNonInteractive(args)
+  const isPersonal = (h) => personal && h === personal
 
   if (orgs.length === 1) {
     const h = orgs[0].handle
+    const label = isPersonal(h) ? `your personal org @${h}` : `your org @${h}`
     if (nonInteractive) {
-      console.log(`Publishing under your org \x1b[1m@${h}\x1b[0m.`)
+      console.log(`Publishing under ${label.replace(`@${h}`, `\x1b[1m@${h}\x1b[0m`)}.`)
       return h
     }
     const prompts = (await import('prompts')).default
     const { ok } = await prompts({
-      type: 'confirm', name: 'ok', message: `Publish under your org @${h}?`, initial: true,
+      type: 'confirm', name: 'ok', message: `Publish under ${label}?`, initial: true,
     }, { onCancel: () => { console.log('\nCancelled.'); process.exit(0) } })
     if (!ok) {
       console.log('Pass --scope @org, or create another with `uniweb org create <handle>`.')
@@ -126,47 +146,95 @@ export async function deriveScope({ apiBase, token, accountHandle = null, args =
   }
 
   if (orgs.length > 1) {
+    // Personal org first; the rest in server order (primary-first).
+    const ordered = [...orgs].sort((a, b) => (isPersonal(b.handle) ? 1 : 0) - (isPersonal(a.handle) ? 1 : 0))
     if (nonInteractive) {
-      const primary = orgs.find((u) => u.is_primary) || orgs[0]
-      console.log(`Multiple orgs; using primary \x1b[1m@${primary.handle}\x1b[0m (non-interactive).`)
-      return primary.handle
+      const pick = ordered.find((u) => isPersonal(u.handle)) || orgs.find((u) => u.is_primary) || orgs[0]
+      console.log(`Multiple orgs; using \x1b[1m@${pick.handle}\x1b[0m (non-interactive).`)
+      return pick.handle
     }
     const prompts = (await import('prompts')).default
     const { choice } = await prompts({
       type: 'select',
       name: 'choice',
       message: 'Publish under which org?',
-      choices: orgs.map((u) => ({ title: `@${u.handle}${u.is_primary ? ' (primary)' : ''}`, value: u.handle })),
+      choices: ordered.map((u) => ({
+        title: `@${u.handle}${isPersonal(u.handle) ? ' — your personal org' : u.is_primary ? ' (primary)' : ''}`,
+        value: u.handle,
+      })),
+      initial: 0,
     }, { onCancel: () => { console.log('\nCancelled.'); process.exit(0) } })
     return choice || null
   }
 
-  // 0 orgs → offer to create.
+  // 0 orgs → the first-publish picker.
   if (nonInteractive) {
     console.error('\x1b[31m✗\x1b[0m You have no org to publish under. Create one with `uniweb org create <handle>`, or pass --scope @org.')
     process.exit(1)
   }
-  return offerCreateOrg({ apiBase, token, accountHandle })
+  return offerCreateOrg({ apiBase, token, accountHandle: personal, personalOrgExists })
 }
 
 /**
- * Cold-start: prompt for a handle (pre-filled with the account handle when it's
- * set + valid — never the username), create the org, return its handle.
- * @returns {Promise<string|null>}
+ * Cold-start (0 orgs) — the first-publish org choice. Every account handle
+ * is a reserved, ready-to-go org handle (globally unique across accounts +
+ * orgs; only the owner can claim it), so the default is one keystroke:
+ *
+ *   ? Publish under which org?
+ *   ❯ @jane — your personal org (created on first publish)
+ *     A new organization…
+ *
+ * The personal org is materialized LAZILY here — at first publish, never at
+ * signup. Two guards:
+ *  - no account handle (Service/System accounts — real signups always mint
+ *    one) → a crisp pointer instead of a prompt;
+ *  - the personal org exists but the caller is no longer a member
+ *    (created-then-left) → the lazy claim would 409; don't offer it.
+ * Returns the chosen bare handle, or null if cancelled/failed.
  */
-export async function offerCreateOrg({ apiBase, token, accountHandle = null }) {
+export async function offerCreateOrg({ apiBase, token, accountHandle = null, personalOrgExists = false }) {
   const prompts = (await import('prompts')).default
-  const suggested = accountHandle && !validateHandle(accountHandle) ? bareHandle(accountHandle) : ''
-
-  console.log("You don't have an org yet — let's create one (it becomes your publish scope).")
-  const { handle } = await prompts({
-    type: 'text',
-    name: 'handle',
-    message: 'Org handle (e.g. acme):',
-    initial: suggested,
-    validate: (v) => validateHandle(v) || true,
+  const personal = accountHandle && !validateHandle(accountHandle) ? bareHandle(accountHandle) : null
+
+  if (!personal) {
+    console.error(
+      '\x1b[31m✗\x1b[0m This account has no handle (service accounts don\'t get one), so there is no ready-to-go org.\n' +
+      '  Log in with a personal account or set a handle in the app — or pass --scope @org / `uniweb org create <handle>`.'
+    )
+    return null
+  }
+
+  const canClaimPersonal = !personalOrgExists
+  const choices = [
+    ...(canClaimPersonal
+      ? [{ title: `@${personal} — your personal org (created on first publish)`, value: personal }]
+      : []),
+    { title: 'A new organization…', value: ':new' },
+  ]
+  if (!canClaimPersonal) {
+    console.log(`\x1b[2m@${personal} exists but you're not a member of it — ask its admin, or create another org.\x1b[0m`)
+  }
+
+  const { choice } = await prompts({
+    type: 'select',
+    name: 'choice',
+    message: 'Publish under which org?',
+    choices,
+    initial: 0,
   }, { onCancel: () => { console.log('\nCancelled.'); process.exit(0) } })
-  if (!handle) return null
+  if (!choice) return null
+
+  let handle = choice
+  if (choice === ':new') {
+    const answer = await prompts({
+      type: 'text',
+      name: 'handle',
+      message: 'Org handle (e.g. acme):',
+      validate: (v) => validateHandle(v) || true,
+    }, { onCancel: () => { console.log('\nCancelled.'); process.exit(0) } })
+    if (!answer.handle) return null
+    handle = answer.handle
+  }
 
   try {
     const org = await createOrg({ apiBase, token, handle })

package/src/utils/runtime-upload.js

@@ -0,0 +1,163 @@
+/**
+ * Runtime registration — the framework half of `uniweb runtime register`.
+ *
+ * Uploads a built `@uniweb/runtime` to the backend so it can serve the runtime
+ * version. Mirrors the foundation code lane (utils/code-upload.js): plan →
+ * PUT-per-file, one mode-aware auth rule.
+ *
+ * The runtime is a SYSTEM artifact — registering it requires **@std membership**
+ * (a non-@std bearer 403s). Versioned by version alone (no scope/name).
+ *
+ * A runtime version is ONE unit with two halves, BOTH uploaded here (the backend
+ * stages the bytes; where/how it serves them is its decision — we don't assume a
+ * serve path, we read `serve_base` back from the plan):
+ *   - dist/app/**          the browser SPA (_importmap/, assets/, index.html,
+ *                          manifest.json) — boots + client-renders a site.
+ *   - dist/worker-runtime.js + dist/shims/*.js   the ssr-edge isolate set (4
+ *                          files): the inlined SSR bundle + its 3 globalThis-bridge
+ *                          shims (react, react/jsx-runtime, @uniweb/core). The
+ *                          isolate can't resolve react without the shims.
+ *
+ * NOT uploaded: the SSR *orchestrator* (the isolate's `entry.js` boot module). It's
+ * a serverless-isolate fetch handler encoding the platform's isolate dispatch
+ * protocol — owned by the platform's SSR layer, not a framework artifact. The
+ * framework ships the render API the orchestrator imports (worker-runtime.js
+ * exports initPrerenderForLocale / renderPage / injectPageContent / hydrateDataStore).
+ *
+ * Contract — AGREED with the backend (2026-06-14):
+ *   PLAN   POST {apiBase}/dev/runtime
+ *          { version, files: [{ path, content_type, size, sha256 }] }
+ *          → { mode, expires_in, serve_base, uploads: [{ path, method, url, headers }] }
+ *          bearer; @std required (else 403, RFC7807 problem+json, op "runtime-register").
+ *   UPLOAD PUT each file (direct → bearer; presigned → none; x-uniweb-sha256).
+ *          MANIFEST LAST — discovery keys a version's existence on manifest.json,
+ *          so a partial upload never advertises a half-delivered version.
+ *   SERVE  the backend's call (read `serve_base` from the plan; we never construct it).
+ */
+
+import { createHash } from 'node:crypto'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { contentTypeFor } from './code-upload.js'
+
+const WORKER_RUNTIME = 'worker-runtime.js'
+const SHIMS_DIR = 'shims'
+const MANIFEST = 'manifest.json'
+
+function fileEntry(diskPath, path) {
+  const bytes = readFileSync(diskPath)
+  return {
+    path,
+    content_type: contentTypeFor(path),
+    size: bytes.length,
+    sha256: createHash('sha256').update(bytes).digest('hex'),
+    diskPath,
+  }
+}
+
+/**
+ * Collect a built runtime's upload set from `distDir` (framework/runtime/dist):
+ * everything under `dist/app/**` at the root, plus `dist/worker-runtime.js` and
+ * the `dist/shims/*.js` it depends on. Sourcemaps (`*.map`) are excluded (dev-only,
+ * not CDN-served). Returns `[]` when `dist/app/` is missing (the runtime isn't
+ * built). The worker bundle + shims are collected when present (graceful when not).
+ *
+ * @param {string} distDir - framework/runtime/dist
+ * @returns {Array<{ path, content_type, size, sha256, diskPath }>}
+ */
+export function collectRuntimeFiles(distDir) {
+  const appDir = join(distDir, 'app')
+  if (!existsSync(appDir)) return []
+  const files = []
+  const walk = (dir, prefix) => {
+    for (const name of readdirSync(dir).sort()) {
+      const full = join(dir, name)
+      const rel = prefix ? `${prefix}/${name}` : name
+      const st = statSync(full)
+      if (st.isDirectory()) walk(full, rel)
+      else if (st.isFile() && !rel.endsWith('.map')) files.push(fileEntry(full, rel))
+    }
+  }
+  walk(appDir, '')
+  const worker = join(distDir, WORKER_RUNTIME)
+  if (existsSync(worker)) files.push(fileEntry(worker, WORKER_RUNTIME))
+  // The SSR isolate's globalThis-bridge shims ride alongside worker-runtime.js,
+  // served at shims/*.js. They're part of the ssr-edge artifact SET — the isolate
+  // can't resolve `react` without them — so collect the whole dir when present.
+  const shimsDir = join(distDir, SHIMS_DIR)
+  if (existsSync(shimsDir)) walk(shimsDir, SHIMS_DIR)
+  // MANIFEST LAST: the backend keys a version's existence on manifest.json (no
+  // server confirm step), so uploading it last means a partial delivery never
+  // advertises a half-built version. Reorder regardless of walk order.
+  const manifest = files.filter((f) => f.path === MANIFEST)
+  if (!manifest.length) return files
+  return [...files.filter((f) => f.path !== MANIFEST), ...manifest]
+}
+
+/** True when the worker SSR bundle is in the collected set. */
+export function hasWorkerRuntime(files) {
+  return files.some((f) => f.path === WORKER_RUNTIME)
+}
+
+/** True when any SSR-isolate shim (shims/*.js) is in the collected set. */
+export function hasShims(files) {
+  return files.some((f) => f.path.startsWith(`${SHIMS_DIR}/`))
+}
+
+/**
+ * Plan + upload a built runtime. Throws on a plan-level failure (the caller maps
+ * 403 → "@std only"); per-file PUT failures surface in `failed`.
+ *
+ * @param {object} opts - { apiBase, token, version, distDir, files?, onProgress? }
+ * @returns {Promise<{ mode, uploaded: string[], failed: Array, serveBase: string|null }>}
+ */
+export async function uploadRuntime({ apiBase, token, version, distDir, files, onProgress = () => {} }) {
+  const list = files || collectRuntimeFiles(distDir)
+  if (!list.length) return { mode: 'none', uploaded: [], failed: [], serveBase: null }
+
+  const origin = apiBase.replace(/\/$/, '')
+  const planRes = await fetch(`${origin}/dev/runtime`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify({
+      version,
+      files: list.map(({ path, content_type, size, sha256 }) => ({ path, content_type, size, sha256 })),
+    }),
+  })
+  if (!planRes.ok) {
+    const detail = await planRes.text().catch(() => '')
+    const err = new Error(`runtime plan rejected: HTTP ${planRes.status}${detail ? ` — ${detail.slice(0, 300)}` : ''}`)
+    err.status = planRes.status
+    throw err
+  }
+  const plan = await planRes.json()
+  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
+  // The one mode-aware bit: direct PUTs are bearer-authed backend routes;
+  // presigned URLs are self-authorizing and must NOT carry a foreign bearer.
+  const authHeaders = plan.mode === 'presigned' ? {} : { Authorization: `Bearer ${token}` }
+
+  const uploaded = []
+  const failed = []
+  for (const f of list) {
+    const target = targets.get(f.path)
+    if (!target) {
+      failed.push({ path: f.path, status: 0, detail: 'no upload target in plan' })
+      continue
+    }
+    onProgress(`↑ ${f.path}`)
+    let res
+    try {
+      res = await fetch(new URL(target.url, origin), {
+        method: target.method || 'PUT',
+        headers: { ...(target.headers || {}), ...authHeaders, 'x-uniweb-sha256': f.sha256 },
+        body: readFileSync(f.diskPath),
+      })
+    } catch (err) {
+      failed.push({ path: f.path, status: 0, detail: err.message })
+      continue
+    }
+    if (res.ok) uploaded.push(f.path)
+    else failed.push({ path: f.path, status: res.status, detail: (await res.text().catch(() => '')).slice(0, 200) })
+  }
+  return { mode: plan.mode || 'direct', uploaded, failed, serveBase: plan.serve_base || null }
+}