uniweb 0.12.34 → 0.12.36

package/src/backend/payment-handoff.js

@@ -0,0 +1,105 @@
+/**
+ * Payment handoff — the one piece of `uniweb publish` that's three-way
+ * (framework + backend + the `uniweb.app` web app). Design: payment-handoff-plan.md.
+ *
+ * The intent: `uniweb publish` on an unpaid (or newly-charged) site should just
+ * handle it — open a browser to `uniweb.app`, let the user pay, and continue.
+ * An already-paid site never opens a browser.
+ *
+ * The framework's ENTIRE payment knowledge is "open this URL, wait for done" —
+ * PROVIDER-AGNOSTIC. The CLI opens whatever `checkout_url` the backend hands it;
+ * the app drives the provider (Stripe or anything else) and settles with the
+ * backend. We reuse `awaitBrowserCallback` (the same loopback `uniweb login`
+ * uses) for the open + wait.
+ *
+ * DEGRADES: when the backend exposes no can-go-live route (404 / any failure),
+ * `canGoLive` returns null and we PROCEED — so publish ships before the payment
+ * route lands (same posture as `status --remote` on a missing endpoint). Live
+ * acceptance is the three-way test.
+ */
+
+import { randomBytes } from 'node:crypto'
+
+import { awaitBrowserCallback } from '../utils/registry-auth.js'
+import { isNonInteractive } from '../utils/interactive.js'
+
+// Append query params to a backend-supplied URL without disturbing its own.
+function withParams(url, params) {
+  const u = new URL(url)
+  for (const [k, v] of Object.entries(params)) {
+    if (v != null) u.searchParams.set(k, String(v))
+  }
+  return u.toString()
+}
+
+/**
+ * Settle payment for a site before go-live, if the backend says it's needed.
+ *
+ * @param {object} o
+ * @param {import('./client.js').BackendClient} o.client
+ * @param {string|null} o.uuid - the site-content uuid (null before the first push mints it)
+ * @param {string[]} o.args
+ * @param {object} o.say - { ok, info, warn, err, dim } reporters
+ * @param {boolean} [o.dryRun]
+ * @returns {Promise<{ proceed: boolean }>} proceed:false → the caller aborts go-live.
+ */
+export async function settlePaymentIfNeeded({ client, uuid, args, say, dryRun = false }) {
+  // No uuid yet (a first publish mints it on push) → nothing to check here; the
+  // post-push go-live is the moment the backend gates on payment.
+  if (!uuid) return { proceed: true }
+
+  // Dry-run reports the intent WITHOUT touching the network — the can-go-live
+  // read is auth-gated and must not force a login on a dry-run.
+  if (dryRun) {
+    say.dim(`Payment     : would check whether go-live needs payment for ${uuid}`)
+    return { proceed: true }
+  }
+
+  const verdict = await client.canGoLive(uuid)
+  // Degrade (no route) or already-paid → proceed.
+  if (!verdict || verdict.ok || !verdict.payment_required) return { proceed: true }
+
+  const checkoutUrl = verdict.checkout_url
+  if (!checkoutUrl) {
+    say.warn('The backend reports payment is required but returned no checkout URL — proceeding.')
+    return { proceed: true }
+  }
+
+  if (dryRun) {
+    say.dim(`Payment     : required — would open ${checkoutUrl}`)
+    return { proceed: true }
+  }
+
+  if (isNonInteractive(args)) {
+    say.err('Payment is required to publish this site, and the CLI is non-interactive.')
+    say.dim(`Complete it in a browser, then re-run: ${checkoutUrl}`)
+    return { proceed: false }
+  }
+
+  // The CSRF nonce the app echoes back on the done-signal redirect. The
+  // wait_token (when present) lets the app correlate the session backend-side.
+  const state = randomBytes(16).toString('hex')
+  say.info('Payment required — completing it in your browser…')
+  try {
+    await awaitBrowserCallback({
+      buildUrl: (redirectUri) =>
+        withParams(checkoutUrl, { redirect_uri: redirectUri, state, wait_token: verdict.wait_token }),
+      validate: (params) => {
+        if (params.get('error')) return { error: params.get('error') }
+        if (params.get('state') !== state) return { error: 'state mismatch — please retry.' }
+        return { value: true } // ok=1 / any non-error return = the app settled with the backend
+      },
+      openingLabel: 'Opening uniweb.app to complete payment…',
+      waitingLabel: 'Waiting for payment to complete (5 min)…',
+      timeoutMs: 5 * 60 * 1000,
+      okTitle: 'Payment complete',
+      errTitle: 'Payment failed',
+    })
+  } catch (err) {
+    say.err(`Payment was not completed: ${err.message}`)
+    say.dim('Re-run `uniweb publish` once payment is done.')
+    return { proceed: false }
+  }
+  say.ok('Payment complete.')
+  return { proceed: true }
+}

package/src/backend/site-sync.js

@@ -3,7 +3,7 @@
  * packages, submit them over the two directional lanes (site-content first, then the
  * folder keyed by the site's uuid), back-fill the minted uuids into the source files,
  * and persist the send-only-changed cache. Extracted from the push command so
- * `uniweb deploy` (the composite path) reuses the exact same lane submission.
+ * `uniweb publish` (the composite path) reuses the exact same lane submission.
  *
  * The command keeps flag parsing, the emit, and the `-o`/`--dry-run` preview;
  * everything from "the packages are built, now POST them" lives here. Logging is
@@ -13,7 +13,7 @@
 
 import { writeFileSync, readFileSync, mkdirSync } from 'node:fs'
 import { join, dirname } from 'node:path'
-import { backfillEntityUuids, writeSiteEntityUuid } from '@uniweb/build/uwx'
+import { backfillEntityUuids, writeSiteEntityUuid, emitSyncPackages } from '@uniweb/build/uwx'
 
 // Pull the finalized entities out of the restore response. The backend returns
 // `{ report: { finalized: [ { index, uuid, changed, document }, … ] } }` — each entry
@@ -106,6 +106,27 @@ export function writeSyncCache(siteDir, hashes) {
   writeFileSync(p, JSON.stringify({ version: 1, hashes }, null, 2) + '\n')
 }
 
+/**
+ * Offline-probe how many of a site's entities differ from the last successful push.
+ * Runs the SAME emit + send-only-changed diff `uniweb push` runs, but with an
+ * OFFLINE Model resolver — no auth, no submit, no backend round-trip. Used by
+ * `uniweb status` and the `uniweb publish` pre-flight. Throws if the producer
+ * can't build the sync packages (e.g. an unresolved data Model); callers report it.
+ *
+ * @param {string} siteDir
+ * @returns {Promise<{ changed: number, unchanged: number, warnings: string[] }>}
+ */
+export async function probeUnpushed(siteDir, { sendAll = false } = {}) {
+  const priorHashes = readSyncCache(siteDir)
+  const pkg = await emitSyncPackages(siteDir, {
+    resolveModel: makeModelResolver({ client: null, offline: true }),
+    priorHashes,
+    sendAll,
+  })
+  const changed = (pkg.siteContent?.entityCount || 0) + (pkg.collections?.entityCount || 0)
+  return { changed, unchanged: pkg.skipped || 0, warnings: pkg.warnings || [] }
+}
+
 /**
  * Submit a site's emitted sync packages over both directional lanes, back-fill the
  * minted uuids, and persist the send-only-changed cache. The HTTP + file-write-back
@@ -141,7 +162,7 @@ export async function pushSyncPackages({ client, siteDir, pkg, asOrg, report })
       res = await doRequest()
     } catch (err) {
       error(`Could not reach the backend at ${client.origin}: ${err.message}`)
-      note('Set the origin with --registry <url> or UNIWEB_REGISTER_URL.')
+      note('Set the origin with --backend <url> or UNIWEB_REGISTER_URL.')
       return null
     }
     if (!res.ok) {

package/src/commands/build.js

@@ -4,30 +4,31 @@
  * Builds foundations with schema generation, or sites.
  *
  * Two site build pipelines are available, but they're INTERNAL vocabulary
- * after Phase 2 of the CLI ergonomics overhaul. Users see `uniweb deploy`
- * (uniweb-edge — runtime-linked) and `uniweb export` (third-party host —
- * concatenated bundle); the build command itself just dispatches to whichever
- * pipeline the caller requested.
+ * after Phase 2 of the CLI ergonomics overhaul. Users see `uniweb publish`
+ * (Uniweb hosting — runtime-linked), `uniweb deploy --host` (third-party host)
+ * and `uniweb export` (self-contained bundle); the build command itself just
+ * dispatches to whichever pipeline the caller requested.
  *
- *   --bundle (internal; called by `uniweb export`)
+ *   --bundle (internal; called by `uniweb deploy --host` / `uniweb export`)
  *     Full vite + post-vite pipeline. Produces a static-host JS bundle
  *     (`dist/index.html`, `dist/entry.js`, `_importmap/*`, `_pages/*` for
  *     split mode, sitemap/robots/search-index, prerendered HTML when
  *     configured). Foundation is loaded by URL when site.yml's foundation
  *     is a registry ref; statically inlined when it's a workspace-local
- *     ref with no auto-publish (the narrow self-contained case).
+ *     ref (the self-contained case).
  *
- *   --link (internal; called by `uniweb deploy`)
- *     Data-only pipeline. No vite. Emits ONLY what the Uniweb-edge
- *     deploy needs: `dist/site-content.json` (with full sections),
+ *   --link (internal; called by `uniweb publish`)
+ *     Data-only pipeline. No vite. Emits ONLY what Uniweb hosting
+ *     needs: `dist/site-content.json` (with full sections),
  *     `dist/<lang>/site-content.json` per non-default locale,
  *     `dist/data/*.json` (collections), and `dist/assets/<media>` (images,
- *     fonts, video posters). Edge stitches runtime + foundation per
+ *     fonts, video posters). The backend stitches runtime + foundation per
  *     request — the site's JS bundle would be dead weight.
  *
  * Bare `uniweb build` for a site defaults to --bundle (the historical
  * behavior). This is mostly useful for inspecting the build output during
- * development; for shipping, use `uniweb deploy` or `uniweb export`.
+ * development; for shipping, use `uniweb publish` (Uniweb hosting) or
+ * `uniweb deploy --host` / `uniweb export` (third-party / self-contained).
  *
  * Usage:
  *   uniweb build                    # Build current directory (sites default to --bundle)
@@ -40,9 +41,9 @@
  *                                      s3-cloudfront, github-pages,
  *                                      generic-static). Default: cloudflare-pages.
  *
- * Internal flags (called by `uniweb deploy` / `uniweb export`):
- *   --link              # Data-only pipeline (Uniweb-edge)
- *   --bundle            # Full vite pipeline (third-party hosts)
+ * Internal flags:
+ *   --link              # Data-only pipeline (Uniweb hosting; called by `uniweb publish`)
+ *   --bundle            # Full vite pipeline (third-party / self-contained; deploy --host / export)
  */
 
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
@@ -246,11 +247,12 @@ async function buildFoundation(projectDir, options = {}) {
 /**
  * Ensure a local foundation's `dist/entry.js` is current.
  *
- * Whenever a build or deploy reads a local foundation from disk — bundle
- * mode (vite imports it, prerender loads it for SSG), or link mode where
- * the foundation is uploaded alongside the site — the foundation must be
- * built and current. Otherwise the verb fails with "Foundation not found
- * at .../dist/entry.js" or silently ships stale artifacts.
+ * Bundle mode reads a local foundation from disk (vite imports it, prerender
+ * loads dist/entry.js for SSG), so the foundation must be built and current.
+ * Otherwise the verb fails with "Foundation not found at .../dist/entry.js" or
+ * silently ships stale artifacts. (Link mode does NOT read the built foundation
+ * — it forwards only the `foundation:` ref to the backend and ships no
+ * foundation code — so buildSiteLink does not call this.)
  *
  * `buildWorkspace()` already cascades when invoked from a workspace root,
  * but verbs invoked from a site directory (`uniweb build` in `sites/x/`,
@@ -260,8 +262,8 @@ async function buildFoundation(projectDir, options = {}) {
  *
  * This helper is idempotent: when the workspace-root cascade has already
  * run, the freshness check sees a current `dist/entry.js` and returns
- * without rebuilding. So adding the call inside `buildSite()` /
- * `buildSiteLink()` does not double-build under `buildWorkspace()`.
+ * without rebuilding. So calling it inside `buildSite()` does not
+ * double-build under `buildWorkspace()`.
  *
  * Freshness rule: a built artifact (`dist/entry.js` or the legacy
  * `dist/foundation.js`) exists AND its mtime is >= the newest mtime of
@@ -525,7 +527,7 @@ function resolveFoundationDir(projectDir, siteConfig) {
 /**
  * Build a site in link mode — data only, no vite.
  *
- * Emits exactly what `uniweb deploy` ships to Uniweb-edge:
+ * Emits exactly what `uniweb publish` ships to Uniweb hosting:
  *   dist/site-content.json (full sections inlined)
  *   dist/<lang>/site-content.json per non-default locale
  *   dist/data/<collection>.json (+ per-record files for `deferred:`)
@@ -564,10 +566,12 @@ async function buildSiteLink(projectDir, options = {}) {
   // null and theme defaults come from theme.yml only.
   const foundationDir = await resolveFoundationDirForSite(projectDir, siteConfig).catch(() => null)
 
-  // Cascade: a local foundation in link mode is uploaded alongside the
-  // site (site-bound mode), so its dist must be current. Idempotent under
-  // buildWorkspace() — the freshness check no-ops when already built.
-  if (foundationDir) await ensureFoundationFresh(foundationDir)
+  // Link mode does NOT (re)build the foundation. It reads only the
+  // foundation's SOURCE config (foundation.js::theme.vars, passed as
+  // foundationPath below) for theme defaults, and ships NO foundation code —
+  // the backend serves the foundation from the registry by the `foundation:`
+  // ref. (Bundle mode is the one that needs a current dist/entry.js — see
+  // buildSite — so the ensureFoundationFresh cascade lives there, not here.)
 
   await buildSiteData({
     siteRoot: projectDir,
@@ -637,7 +641,6 @@ async function resolveFoundationDirForSite(siteDir, siteConfig) {
   if (!foundation || typeof foundation !== 'string') return null
   // Registry ref or URL — no local foundation.
   if (/^@[a-z0-9_-]+\/[a-z0-9_-]+@/.test(foundation)) return null
-  if (/^~[A-Za-z0-9_-]+\/[a-z0-9_-]+@/.test(foundation)) return null
   if (foundation.startsWith('http://') || foundation.startsWith('https://')) return null
 
   // Workspace sibling.
@@ -910,14 +913,15 @@ function showNextSteps(hasFoundations, hasSites) {
   if (hasFoundations) {
     log('')
     log(`${colors.bright}Share with clients:${colors.reset}`)
-    log(`  ${colors.bright}uniweb publish${colors.reset}              Register your foundation (one-time setup)`)
+    log(`  ${colors.bright}uniweb register${colors.reset}             Release your foundation to the catalog (alias: uniweb release)`)
     log(`  ${colors.bright}uniweb handoff <email>${colors.reset}      Hand off a site to a client`)
   }
   if (hasSites) {
     log('')
-    log(`${colors.bright}Deploy:${colors.reset}`)
-    log(`  ${colors.bright}uniweb deploy${colors.reset}     Uniweb hosting`)
-    log(`  Or upload ${colors.cyan}dist/${colors.reset} to any static host`)
+    log(`${colors.bright}Ship a site:${colors.reset}`)
+    log(`  ${colors.bright}uniweb publish${colors.reset}            Uniweb hosting (brings the foundation along)`)
+    log(`  ${colors.bright}uniweb deploy --host${colors.reset}=…    Third-party host`)
+    log(`  Or upload ${colors.cyan}dist/${colors.reset} (\`uniweb export\`) to any static host`)
   }
 }
 
@@ -943,10 +947,10 @@ export async function build(args = []) {
   const prerenderFlag = args.includes('--prerender')
   const noPrerenderFlag = args.includes('--no-prerender')
 
-  // Internal flags — called by `uniweb deploy` (always --link) and
-  // `uniweb export` (always --bundle). After Phase 2 of the CLI
-  // ergonomics overhaul, users don't see these flags directly; they
-  // pick the deploy target (deploy vs export) and the corresponding
+  // Internal flags — called by `uniweb publish` (always --link) and
+  // `uniweb deploy --host` / `uniweb export` (always --bundle). After Phase 2
+  // of the CLI ergonomics overhaul, users don't see these flags directly; they
+  // pick the verb (publish vs deploy vs export) and the corresponding
   // pipeline runs. Bare `uniweb build` for a site defaults to --bundle
   // (mostly used during development to inspect the vite output).
   const linkFlag = args.includes('--link')

package/src/commands/clone.js

@@ -163,9 +163,9 @@ export async function clone(args = [], deps = {}) {
   const pathFlag = flagValue(args, '--path')
   const projectFlag = flagValue(args, '--project')
   const tokenFlag = flagValue(args, '--token')
-  const explicitRegistry = flagValue(args, '--registry')
+  const explicitBackend = flagValue(args, '--backend') || flagValue(args, '--registry')
   const client = new BackendClient({
-    originFlag: explicitRegistry,
+    originFlag: explicitBackend,
     token: tokenFlag,
     getToken: deps.getToken,
     fetchImpl: deps.fetch,
@@ -295,7 +295,7 @@ export async function clone(args = [], deps = {}) {
   }
 
   const pullExtra = []
-  if (explicitRegistry) pullExtra.push('--registry', explicitRegistry)
+  if (explicitBackend) pullExtra.push('--backend', explicitBackend)
   if (tokenFlag) pullExtra.push('--token', tokenFlag)
   if (noCollections) pullExtra.push('--no-collections')