uniweb 0.12.34 → 0.12.36

package/src/commands/publish.js

@@ -1,41 +1,63 @@
 /**
- * uniweb publish — make a SYNCED site's current backend state live (CMS publish).
+ * uniweb publish — the smart Uniweb-hosting flagship (shipping-model.md §3).
  *
- * Three "publish-ish" verbs, three jobs — don't conflate them:
- *   - `uniweb deploy`   hosts the CLI's FILE-BUILT payload (POST /dev/deploy).
- *   - `uniweb publish`  publishes a SITE that already lives on the backend as a
- *     `@uniweb/site-content` entity (synced via `uniweb push`) — POST /dev/site/publish.
- *   - `uniweb register` registers a FOUNDATION (+ the data schemas it renders).
- *     (Foundation publishing used to be `uniweb publish`; it is now `register`.)
+ * `uniweb login && uniweb publish` is meant to be the most ergonomic command in
+ * the tool: run it, and it does the right thing — talks to the backend,
+ * understands the project, and makes the site live on Uniweb hosting (synced +
+ * dynamically served). It:
  *
- * `publish` makes the site's CURRENT backend state live — including edits made
- * through the app since the last push. It does NOT push local files (run
- * `uniweb push` first if you want your local edits live, then `publish`). The two
- * are deliberately separate steps, mirroring the directional sync primitives.
+ *   1. resolves WHICH site (your location, or the workspace's one site; multiple
+ *      → prompt);
+ *   2. BRINGS THE FOUNDATION ALONG — if the site's local foundation changed
+ *      since its last release, releases the new version first (or asks); a
+ *      published registry ref needs nothing (§4, foundation-bring-along.js);
+ *   3. SYNCS — builds the site data (link mode), uploads media + the static-data
+ *      ball, and pushes content (the same two-lane sync `uniweb push` uses);
+ *   4. SETTLES PAYMENT when the backend says go-live needs it — opens a browser
+ *      to uniweb.app, waits, continues (provider-agnostic; payment-handoff.js);
+ *   5. GOES LIVE — POST /dev/site/publish/{uuid}.
  *
- * `{uuid}` is the site-content uuid (`site.yml::$uuid`, written by `uniweb push`).
- * A site that was never pushed 404s — push it first, or use `uniweb deploy` for a
- * file-only site.
+ * Distinct from `uniweb deploy` (third-party hosts) and `uniweb register`
+ * (foundation code → catalog). For a self-contained artifact, see `uniweb export`.
  *
- * Usage:
- *   uniweb publish                       Publish the synced site's current state
- *   uniweb publish --backend <url>       Override the backend origin
- *   uniweb publish --token <bearer>      Auth bearer (skips `uniweb login`)
- *   uniweb publish --dry-run             Resolve everything; POST nothing
+ * Backend: BackendClient. Origin from --backend/--registry > UNIWEB_REGISTER_URL
+ * > default. Auth: --token > UNIWEB_TOKEN > `uniweb login` session.
  *
- * Backend: BackendClient → POST /dev/site/publish/{uuid}. Origin from
- *   --backend/--registry > UNIWEB_REGISTER_URL > default. Auth: --token >
- *   UNIWEB_TOKEN > `uniweb login`.
+ * Usage:
+ *   uniweb publish                 Bring the foundation along, sync, and go live
+ *   uniweb publish --dry-run       Resolve everything; POST nothing
+ *   uniweb publish --yes           Skip confirmations (CI); never block on a prompt
+ *   uniweb publish --no-save       Skip the deploy.yml lastDeploy auto-save
+ *   uniweb publish --backend <url> Override the backend origin
+ *   uniweb publish --token <bearer> Auth bearer (skips `uniweb login`)
  */
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
+import { execSync } from 'node:child_process'
+import { createInterface } from 'node:readline/promises'
 import yaml from 'js-yaml'
 
+import {
+  loadDeployYml,
+  resolveTarget,
+  recordLastDeploy,
+  assembleDataBall,
+  collectBallAssets,
+  rewriteBallAssets,
+} from '@uniweb/build/site'
+import { emitSyncPackages } from '@uniweb/build/uwx'
+
 import { BackendClient } from '../backend/client.js'
-import { resolveSiteDir } from './deploy.js'
+import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
 import { readFlagValue } from '../utils/args.js'
+import { isNonInteractive } from '../utils/interactive.js'
+import { makeModelResolver, readSyncCache, pushSyncPackages } from '../backend/site-sync.js'
+import { uploadDataBundle } from '../backend/data-bundle.js'
+import { uploadSiteMedia } from '../backend/site-media.js'
+import { bringFoundationAlong } from '../backend/foundation-bring-along.js'
+import { settlePaymentIfNeeded } from '../backend/payment-handoff.js'
 
 const c = {
   reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -49,8 +71,20 @@ const say = {
   dim: (m) => console.log(`  ${c.dim}${m}${c.reset}`),
 }
 
+// Minimal yes/no prompt. Returns `defaultYes` on an empty answer.
+async function confirm(question, defaultYes = false) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    const a = (await rl.question(`${question} ${defaultYes ? '[Y/n]' : '[y/N]'} `)).trim().toLowerCase()
+    if (!a) return defaultYes
+    return a === 'y' || a === 'yes'
+  } finally {
+    rl.close()
+  }
+}
+
 // Highest installed runtime from the backend's /dev/config list (numeric-aware
-// sort). Mirrors deploy.js's resolver. Null when the list is empty.
+// sort). Null when the list is empty.
 function pickHighestRuntime(installed) {
   if (!Array.isArray(installed) || installed.length === 0) return null
   return [...installed].sort((a, b) => String(b).localeCompare(String(a), undefined, { numeric: true }))[0]
@@ -63,10 +97,26 @@ function absolutizeServeUrl(origin, url) {
   return `${origin.replace(/\/$/, '')}${url.startsWith('/') ? '' : '/'}${url}`
 }
 
-// Locale set from site.yml — source/default first, then declared locales.
-// Tolerant of the shapes site.yml uses (i18n.locales, languages[]). Null when
-// single-locale, so the body omits `languages` and the backend defaults.
-function extractLanguages(siteYml) {
+function readSiteYml(path) {
+  if (!existsSync(path)) return {}
+  try {
+    const parsed = yaml.load(readFileSync(path, 'utf8'))
+    return parsed && typeof parsed === 'object' ? parsed : {}
+  } catch {
+    return {}
+  }
+}
+
+// Languages from the BUILT site-content.json (config.languages) — the authority
+// after a build. Three accepted shapes: 'en', { value, label }, { code, label }.
+function languagesFromContent(siteContent) {
+  const langs = siteContent?.config?.languages
+  if (!Array.isArray(langs) || langs.length === 0) return ['en']
+  return langs.map((l) => (typeof l === 'string' ? l : l?.value || l?.code)).filter(Boolean)
+}
+
+// Languages from site.yml — used only for the dry-run summary (no build yet).
+function languagesFromSiteYml(siteYml) {
   const def = siteYml.defaultLanguage || siteYml.lang || 'en'
   const locales = siteYml.i18n?.locales || siteYml.languages
   if (!Array.isArray(locales) || locales.length === 0) return null
@@ -74,100 +124,278 @@ function extractLanguages(siteYml) {
   return [def, ...norm.filter((l) => l !== def)]
 }
 
+// Persist deploy.yml lastDeploy memory (skipped on --no-save / autoSave 'off').
+async function persistLastDeploy(siteDir, opts) {
+  if (opts.autoSave === 'off') return
+  try {
+    const result = await recordLastDeploy(siteDir, opts)
+    if (result?.created) say.dim(`Wrote deploy.yml (target: ${opts.targetName})`)
+  } catch (err) {
+    // The publish itself succeeded — never fail the whole command on a
+    // memo-write error. Surface it so the user can fix the file.
+    say.dim(`Could not update deploy.yml: ${err.message}`)
+  }
+}
+
 export async function publish(args = []) {
   const dryRun = args.includes('--dry-run')
-  const siteDir = await resolveSiteDir(args, 'publish')
+  const noSave = args.includes('--no-save')
+  const asOrg = readFlagValue(args, '--as-org')
+  const foundationDir = readFlagValue(args, '--foundation') // optional local foundation for Model schemas
 
-  // The site-content uuid lives in site.yml::$uuid (written by `uniweb push`).
-  // No uuid → the site was never synced; publish has nothing to make live.
-  const siteYmlPath = join(siteDir, 'site.yml')
-  let siteYml = {}
-  if (existsSync(siteYmlPath)) {
-    try {
-      siteYml = yaml.load(await readFile(siteYmlPath, 'utf8')) || {}
-    } catch {
-      siteYml = {}
-    }
-  }
-  const uuid = siteYml.$uuid
-  if (!uuid) {
-    say.err('This site has no $uuid in site.yml — it was never synced to the backend.')
-    say.dim('Run `uniweb push` first (publish makes the synced site live), or use `uniweb deploy` for a file-only site.')
-    return { exitCode: 1 }
-  }
+  const siteDir = await resolveSiteDir(args, 'publish')
+  const siteYml = readSiteYml(join(siteDir, 'site.yml'))
+  // The site's deploy.yml-bound backend (where it was published) feeds the
+  // resolution ladder below an explicit --backend / UNIWEB_REGISTER_URL.
+  const siteBackend = await resolveSiteBackend(siteDir)
 
   const client = new BackendClient({
     originFlag: readFlagValue(args, '--backend') || readFlagValue(args, '--registry'),
+    siteBackend,
     token: readFlagValue(args, '--token') || undefined,
     args,
     command: 'Publishing',
   })
 
-  // Discover + resolve the runtime exactly like deploy: explicit site.yml::runtime,
-  // else the highest installed (the /dev/config source). Fail closed otherwise.
+  // Capability handshake (cached). Publish ends in a go-live, so the publish
+  // lane must be offered.
   const config = await client.discover()
   if (config?.delivery && config.delivery.publish === false) {
     say.err(`Backend at ${client.origin} does not offer the publish lane (delivery.publish=false).`)
     return { exitCode: 1 }
   }
+
+  // Runtime: an explicit site.yml::runtime pin wins; else the highest installed;
+  // else fail closed (better than serving a site with no runtime). A dry-run is
+  // a pure preview, so it only WARNS — it stays useful with no backend reachable.
   const installed = Array.isArray(config?.runtime?.installed) ? config.runtime.installed : []
   if (siteYml.runtime && installed.length && !installed.includes(siteYml.runtime)) {
     say.err(`Runtime ${siteYml.runtime} (from site.yml) is not installed on the backend.`)
     say.dim(`Installed: ${installed.join(', ') || '(none)'} — pin one of these in site.yml (\`runtime:\`), or have it installed on the backend.`)
-    return { exitCode: 1 }
+    if (!dryRun) return { exitCode: 1 }
   }
   const runtimeVersion = siteYml.runtime || pickHighestRuntime(installed)
-  if (!runtimeVersion) {
+  if (!runtimeVersion && !dryRun) {
     say.err('Could not resolve a runtime version.')
     say.dim('Pin one with `runtime:` in site.yml, or install one on the backend so /dev/config reports it.')
     return { exitCode: 1 }
   }
 
-  const languages = extractLanguages(siteYml)
+  // deploy.yml target (the Uniweb hosting memory). No --target on publish — it
+  // always targets Uniweb hosting; resolveTarget gives us the target name +
+  // autoSave for the lastDeploy memo.
+  let resolved
+  try {
+    const deployYml = await loadDeployYml(siteDir)
+    // No --target on publish — it always targets Uniweb hosting; resolveTarget
+    // returns the uniweb default (fromFile:false) when there's no deploy.yml, so
+    // persistLastDeploy scaffolds the file as the "where it's deployed" record.
+    resolved = resolveTarget(deployYml, null)
+  } catch {
+    // Malformed/ambiguous deploy.yml — don't block the publish on the memo.
+    resolved = { targetName: 'production', host: 'uniweb', config: {}, autoSave: 'lastDeploy', fromFile: false }
+  }
+  const autoSave = noSave ? 'off' : (resolved.autoSave || 'lastDeploy')
 
   if (dryRun) {
-    say.info('Dry run — would publish the synced site (its current backend state):')
+    say.info('Dry run — would bring the foundation along, sync, and go live:')
     say.dim(`Backend     : ${client.origin}`)
-    say.dim(`Site uuid   : ${uuid}`)
-    say.dim(`Runtime     : ${runtimeVersion}${siteYml.runtime ? '' : ' (highest installed)'}`)
-    if (languages) say.dim(`Languages   : ${languages.join(', ')}`)
+    say.dim(`Runtime     : ${runtimeVersion || '(unresolved — needs a backend or a site.yml runtime: pin)'}${runtimeVersion && !siteYml.runtime ? ' (highest installed)' : ''}`)
+    say.dim(`site_uuid   : ${siteYml.$uuid || '(none — the first push mints it)'}`)
+    const langs = languagesFromSiteYml(siteYml)
+    if (langs) say.dim(`Languages   : ${langs.join(', ')}`)
+    await bringFoundationAlong({ client, siteDir, siteYml, args, say, confirm, cliBin: process.argv[1], dryRun: true })
+    await settlePaymentIfNeeded({ client, uuid: siteYml.$uuid || null, args, say, dryRun: true })
     return { exitCode: 0 }
   }
 
-  say.info(`Publishing the synced site to ${c.dim}${client.origin}${c.reset} …`)
-  say.dim('Publishes the CURRENT backend state (incl. app-side edits) — run `uniweb push` first to include local edits.')
-  let res
+  // 1. Bring the foundation along — release the local foundation if its code
+  //    changed (or isn't registered). Never ship a site pointing at stale code.
+  let fnd
   try {
-    res = await client.publishSite(uuid, { runtimeVersion, ...(languages ? { languages } : {}) })
+    fnd = await bringFoundationAlong({ client, siteDir, siteYml, args, say, confirm, cliBin: process.argv[1] })
   } catch (err) {
-    say.err(`Could not reach the backend at ${client.origin}: ${err.message}`)
-    say.dim('Set the origin with --backend <url> or UNIWEB_REGISTER_URL.')
+    say.err(`Foundation release failed: ${err.message}`)
+    say.dim('Fix the foundation, then re-run `uniweb publish`.')
+    return { exitCode: 1 }
+  }
+  if (!fnd.proceed) return { exitCode: 0 }
+
+  // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
+  //    dist/data/*, dist/_search/*, dist/assets/*. Spawn the SAME CLI binary so
+  //    the inner build can't resolve to a different installed version.
+  say.info('Building site…')
+  console.log('')
+  execSync(`node ${JSON.stringify(process.argv[1])} build --link`, { cwd: siteDir, stdio: 'inherit', env: process.env })
+  console.log('')
+
+  const distDir = join(siteDir, 'dist')
+  const contentPath = join(distDir, 'site-content.json')
+  if (!existsSync(contentPath)) {
+    say.err('Build did not produce dist/site-content.json')
+    return { exitCode: 1 }
+  }
+
+  // Non-local @std/registry Model schemas resolve through the backend (same as push).
+  const resolveModel = makeModelResolver({ client, offline: false })
+
+  // 3. Partition collections by schema presence (a first emit reads `schemaless`
+  //    — collections with no data schema, delivered statically via the ball).
+  let probe
+  try {
+    probe = await emitSyncPackages(siteDir, { ...(foundationDir ? { foundationDir } : {}), resolveModel })
+  } catch (err) {
+    say.err(`Could not build the sync package: ${err.message}`)
     return { exitCode: 1 }
   }
-  if (!res.ok) {
-    if (res.status === 404) {
-      say.err(`Site ${uuid} not found on the backend (404).`)
-      say.dim('Sync it first with `uniweb push`, or use `uniweb deploy` for a file-only site.')
+  const schemalessNames = (probe.schemaless || []).map((col) => col.name)
+  const localAssets = probe.localAssets || []
+
+  // 4. Assemble the static-data ball (schema-less data + search index) BEFORE
+  //    uploading, since its records can carry local media too.
+  let ball = await assembleDataBall(distDir, schemalessNames)
+  const ballAssets = collectBallAssets(ball)
+
+  // 4b. Upload ALL local media (entity refs + ball refs) on one asset lane →
+  //     the ref→serveUrl map; rewrite the entity content AND the ball with it.
+  let assetRewrite = null
+  const mediaRefs = [...new Set([...localAssets, ...ballAssets])]
+  if (mediaRefs.length) {
+    say.info('Uploading media…')
+    try {
+      const map = await uploadSiteMedia(client, siteDir, mediaRefs, {
+        onProgress: (m) => say.dim(`  ${m}`),
+        warn: (m) => say.dim(`! ${m}`),
+      })
+      if (Object.keys(map).length) assetRewrite = map
+      if (ballAssets.length) ball = rewriteBallAssets(ball, map)
+      say.dim(`Media          : ${Object.keys(map).length}/${mediaRefs.length} ref(s) → serve URL`)
+    } catch (err) {
+      say.err(`Media upload failed: ${err.message}`)
+      return { exitCode: 1 }
+    }
+  }
+
+  // 4c. Upload the (media-rewritten) ball → its content-addressed serve URL.
+  let dataBundle
+  if (ball) {
+    say.info('Uploading data bundle…')
+    try {
+      dataBundle = await uploadDataBundle(client, ball, { onProgress: (m) => say.dim(`  ${m}`) })
+    } catch (err) {
+      say.err(`Data bundle upload failed: ${err.message}`)
       return { exitCode: 1 }
     }
-    say.err(`Publish rejected: HTTP ${res.status} ${res.statusText}`)
-    if (res.status === 401 || res.status === 403) {
+    say.dim(`Data bundle    : ${Object.keys(ball.data).length} data + ${Object.keys(ball.search).length} search file(s)`)
+  }
+
+  // 5. Push the site (content + folder) over the send-only-changed cache —
+  //    the SAME two-lane submission `uniweb push` uses — stamping
+  //    info.data_bundle and rewriting local media refs to backend serve URLs.
+  const priorHashes = readSyncCache(siteDir)
+  // Stamp deploy-derived info on the site-content entity: the data-bundle URL,
+  // and the PINNED foundation ref (`@scope/name@version`) from the bring-along.
+  // Delivery is version-pinned end-to-end (the gateway serves a foundation only
+  // by a concrete version — collab framework-backend-5c3e), so pinning the
+  // released version on the wire is required when site.yml uses an unversioned
+  // local ref; injectInfo overrides info.foundation. A registry/URL ref → fnd.ref
+  // is null → the site.yml ref is forwarded verbatim (already pinned).
+  const injectInfo = {
+    ...(dataBundle ? { data_bundle: dataBundle } : {}),
+    ...(fnd.ref ? { foundation: fnd.ref } : {}),
+  }
+  let pkg
+  try {
+    pkg = await emitSyncPackages(siteDir, {
+      ...(foundationDir ? { foundationDir } : {}),
+      resolveModel,
+      priorHashes,
+      ...(Object.keys(injectInfo).length ? { injectInfo } : {}),
+      ...(assetRewrite ? { assetRewrite } : {}),
+    })
+  } catch (err) {
+    say.err(`Could not build the sync package: ${err.message}`)
+    return { exitCode: 1 }
+  }
+  for (const w of pkg.warnings) say.dim(`! ${w}`)
+  const report = {
+    info: (m) => say.info(m),
+    note: (m) => say.dim(m),
+    error: (m) => say.err(m),
+    dim: (s) => `${c.dim}${s}${c.reset}`,
+  }
+  const pushResult = await pushSyncPackages({ client, siteDir, pkg, asOrg, report })
+  if (pushResult.exitCode !== 0) return { exitCode: pushResult.exitCode }
+  const siteUuid = pushResult.boundSiteUuid
+  if (!siteUuid) {
+    say.err('Push did not yield a site uuid — cannot go live.')
+    return { exitCode: 1 }
+  }
+
+  // 6. Payment gate — the backend says whether go-live needs payment. Settles
+  //    via a browser handoff to uniweb.app; degrades to "proceed" when the
+  //    backend exposes no payment route. The draft is already synced, so a
+  //    decline leaves a recoverable state (re-run after paying).
+  const pay = await settlePaymentIfNeeded({ client, uuid: siteUuid, args, say })
+  if (!pay.proceed) {
+    say.info('Site synced as a draft but not made live. Re-run `uniweb publish` once payment is complete.')
+    return { exitCode: 0 }
+  }
+
+  // 7. Go live — make the just-pushed composite live (its current backend state).
+  const siteContent = JSON.parse(await readFile(contentPath, 'utf8'))
+  const languages = languagesFromContent(siteContent)
+  say.info(`Publishing to ${c.dim}${client.origin}${c.reset} …`)
+  let pubRes
+  try {
+    pubRes = await client.publishSite(siteUuid, { runtimeVersion, ...(languages ? { languages } : {}) })
+  } catch (err) {
+    say.err(`Could not reach the backend at ${client.origin}: ${err.message}`)
+    say.dim('Set the origin with --backend <url> or UNIWEB_REGISTER_URL.')
+    return { exitCode: 1 }
+  }
+  if (!pubRes.ok) {
+    say.err(`Publish rejected: HTTP ${pubRes.status} ${pubRes.statusText}`)
+    if (pubRes.status === 401 || pubRes.status === 403) {
       say.dim("Credentials weren't accepted — run `uniweb login` (or pass --token <bearer>).")
     }
-    const body = await res.text().catch(() => '')
+    const body = await pubRes.text().catch(() => '')
     if (body) say.dim(body.slice(0, 800))
     return { exitCode: 1 }
   }
   let result
-  try {
-    result = await res.json()
-  } catch {
-    result = {}
-  }
-
+  try { result = await pubRes.json() } catch { result = {} }
   const serveUrl = absolutizeServeUrl(client.origin, result.url)
+
+  // 8. Persist deploy.yml memory — a record of what went live (and so a re-run
+  //    reuses the resolved target without re-asking). One identity:
+  //    site.yml::$uuid. `released` records whether this publish shipped a new
+  //    foundation version (the bring-along, §4).
+  // Record the ref that actually went live: the pinned `@scope/name@version`
+  // from the bring-along when present, else the site.yml ref verbatim.
+  const siteYmlRef = typeof siteYml.foundation === 'string' ? siteYml.foundation : siteYml.foundation?.ref || null
+  const recordedRef = fnd.ref || siteYmlRef
+  await persistLastDeploy(siteDir, {
+    targetName: resolved.targetName,
+    // First publish scaffolds deploy.yml with the backend recorded on the
+    // target, binding the site to where it went live (uniweb.app, or a B2B
+    // backend). resolveSiteBackend reads it back on later publishes.
+    targetConfig: resolved.fromFile ? null : { host: 'uniweb', backend: client.origin },
+    autoSave,
+    lastDeploy: {
+      at: new Date().toISOString(),
+      host: 'uniweb',
+      backend: client.origin,
+      siteUuid,
+      url: serveUrl,
+      foundation: { ...(recordedRef ? { ref: recordedRef } : {}), released: fnd.released },
+      runtime: runtimeVersion,
+      locales: Array.isArray(result.locales) ? result.locales : languages,
+    },
+  })
+
   console.log('')
-  say.ok(`Published ${c.bold}${uuid}${c.reset}${result.status ? ` (${result.status})` : ''}`)
+  say.ok(`Published ${c.bold}${siteUuid}${c.reset}${result.status ? ` (${result.status})` : ''}`)
   if (serveUrl) console.log(`  ${c.cyan}${serveUrl}${c.reset}`)
   if (result.deploy_uuid) say.dim(`deploy: ${result.deploy_uuid}`)
   return { exitCode: 0 }

package/src/commands/pull.js

@@ -49,7 +49,7 @@ import {
 } from '@uniweb/build/uwx'
 import { makeModelResolver } from './push.js'
 import { BackendClient } from '../backend/client.js'
-import { resolveSiteDir as defaultResolveSiteDir } from './deploy.js'
+import { resolveSiteDir as defaultResolveSiteDir, resolveSiteBackend } from './deploy.js'
 
 const FOLDER_MODEL = '@uniweb/folder'
 
@@ -179,16 +179,18 @@ export async function pull(args = [], deps = {}) {
   const tokenFlag = flagValue(args, '--token')
   const prune = !(args.includes('--no-delete') || args.includes('--no-prune')) // git-like by default
   const noCollections = args.includes('--no-collections') || args.includes('--content-only')
+
+  const siteDir = await resolveSiteDir(args, 'pull')
+  const siteBackend = await resolveSiteBackend(siteDir)
   const client = new BackendClient({
-    originFlag: flagValue(args, '--registry'),
+    originFlag: flagValue(args, '--backend') || flagValue(args, '--registry'),
+    siteBackend,
     token: tokenFlag,
     getToken: deps.getToken,
     fetchImpl: deps.fetch,
     args,
     command: 'Pulling',
   })
-
-  const siteDir = await resolveSiteDir(args, 'pull')
   // One identity per site: `site.yml::$uuid`. Both lanes (content + folder) are keyed
   // by it — the backend resolves the site's `@uniweb/folder` from this uuid.
   const siteContentUuid = readYamlUuid(join(siteDir, 'site.yml'))
@@ -216,7 +218,7 @@ export async function pull(args = [], deps = {}) {
       res = await doRequest()
     } catch (err) {
       error(`Could not reach the backend at ${client.origin}: ${err.message}`)
-      note('Set the origin with --registry <url> or UNIWEB_REGISTER_URL.')
+      note('Set the origin with --backend <url> or UNIWEB_REGISTER_URL.')
       return null
     }
     if (res.status === 404) {

package/src/commands/push.js

@@ -36,7 +36,7 @@
  * Auth:  --token  >  UNIWEB_TOKEN  >  `uniweb login` session.
  *
  * The two-lane SUBMISSION (POST both lanes, back-fill uuids, persist the
- * send-only-changed cache) lives in `../backend/site-sync.js` so `uniweb deploy`
+ * send-only-changed cache) lives in `../backend/site-sync.js` so `uniweb publish`
  * (the composite path) reuses the exact same logic. This command owns flag parsing,
  * the emit, and the `-o`/`--dry-run` preview.
  */
@@ -45,7 +45,7 @@ import { writeFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { emitSyncPackages } from '@uniweb/build/uwx'
 import { BackendClient } from '../backend/client.js'
-import { resolveSiteDir } from './deploy.js'
+import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
 import { makeModelResolver, readSyncCache, pushSyncPackages } from '../backend/site-sync.js'
 
 // Re-exported for downstream importers (pull.js, push.test.js) that read these
@@ -77,20 +77,22 @@ export async function push(args = []) {
   const asOrg = flagValue(args, '--as-org')
   const foundationDir = flagValue(args, '--foundation')
   const sendAll = args.includes('--all') // bypass the send-only-changed cache
+
+  const siteDir = await resolveSiteDir(args, 'push')
+  const siteBackend = await resolveSiteBackend(siteDir)
   // One front door. The bearer is resolved lazily on first need (a non-local Model
   // read during the build, or the submit). Offline emit (--dry-run / -o) is fully
   // offline: it never submits, and its Model resolver never reads from the backend
   // (the `offline` flag below), so it never authenticates — even when a collection
   // references a Model the local foundation doesn't define.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--registry'),
+    originFlag: flagValue(args, '--backend') || flagValue(args, '--registry'),
+    siteBackend,
     token: tokenFlag,
     args,
     command: 'Syncing',
   })
 
-  const siteDir = await resolveSiteDir(args, 'push')
-
   // Build BOTH directional packages (the producer side). Each carries its own
   // `index` — the per-entity source-file map for back-fill, correlated by submission
   // position. Non-local Models are fetched from the registry on demand. `priorHashes`
@@ -147,7 +149,7 @@ export async function push(args = []) {
   }
 
   // Submit both lanes, back-fill the minted uuids, and persist the send-only-changed
-  // cache. Shared with `uniweb deploy` via ../backend/site-sync.js.
+  // cache. Shared with `uniweb publish` via ../backend/site-sync.js.
   const result = await pushSyncPackages({
     client,
     siteDir,

package/src/commands/register.js

@@ -30,10 +30,11 @@
  *   uniweb register --json               Porcelain: ONE compact JSON line on stdout
  *                                        ({ok,scope,origin,entities:[{name,uuid,version,unchanged}]}),
  *                                        all human output to stderr — for scripted callers
- *   uniweb register --registry <url>     Override the submit endpoint (alias: --backend)
+ *   uniweb register --backend <url>      Override the backend origin (alias: --registry)
  *   uniweb register --token <bearer>     Submit with this bearer; skips `uniweb login`
  *
- * Endpoint resolution: --backend / --registry <url>  >  UNIWEB_REGISTER_URL  >  the local default.
+ * Endpoint resolution: --backend <url> (alias --registry)  >  UNIWEB_REGISTER_URL  >
+ *   the logged-in session origin  >  ~/.uniweb/config.json  >  the default (uniweb.app).
  * Auth (submit only):  --token <bearer>  >  UNIWEB_TOKEN  >  `uniweb login` session.
  */
 
@@ -62,7 +63,7 @@ import { resolve, join } from 'node:path'
 import { buildRegistryPackage, buildSchemaOnlyPackage } from '@uniweb/build/uwx'
 import { classifyPackage, isSchemasPackage, collectStandaloneSchemas } from '@uniweb/build'
 import { readRegistryAuth } from '../utils/registry-auth.js'
-import { collectDistFiles } from '../utils/code-upload.js'
+import { collectDistFiles, computeFoundationDigest } from '../utils/code-upload.js'
 import { deriveScope } from '../utils/registry-orgs.js'
 import { BackendClient } from '../backend/client.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
@@ -309,12 +310,18 @@ async function runRegister(args = []) {
     }
   }
 
+  // Content digest (foundation path only) — the freshness fingerprint over what
+  // register ships (shipping-model.md §4.1). Rides in the foundation-schema
+  // entity's info.digest; the backend stores it opaque and returns it so
+  // publish/status can detect "code changed since release" with no local state.
+  const digest = standalone ? null : computeFoundationDigest(join(targetDir, 'dist'))
+
   const exporter = { tool: 'uniweb', version: cliVersion(), instance: 'build' }
   let doc
   try {
     doc = standalone
       ? buildSchemaOnlyPackage({ schemas, scope, exporter })
-      : buildRegistryPackage({ schema, foundationDir: targetDir, scope, exporter })
+      : buildRegistryPackage({ schema, foundationDir: targetDir, scope, exporter, digest })
   } catch (err) {
     error(`Could not assemble the .uwx: ${err.message}`)
     return { exitCode: 2 }
@@ -330,6 +337,7 @@ async function runRegister(args = []) {
   }
   log(`  ${colors.dim}data schemas ${standalone ? 'registered' : 'defined'}: ${defined.length ? defined.join(', ') : '(none)'}${colors.reset}`)
   if (scope) log(`  ${colors.dim}scope: ${scope} (${scopeSource})${colors.reset}`)
+  if (digest) log(`  ${colors.dim}digest: ${digest}${colors.reset}`)
 
   // Preview paths — no submit, no auth needed.
   if (output) {
@@ -469,7 +477,7 @@ async function runRegister(args = []) {
       ...doc.entities.filter((e) => e.model === '@uniweb/foundation-schema').map((e) => e.info?.name ?? e.name),
     ].filter(Boolean)
     const entities = names.map((name) => ({ name, ...(minted[name] || { uuid: null, version: null, unchanged: false }) }))
-    emitJson({ ok: true, scope: scope || null, origin: client.origin, entities })
+    emitJson({ ok: true, scope: scope || null, origin: client.origin, digest: digest || null, entities })
   }
   return { exitCode: 0 }
 }

package/src/commands/rename.js

@@ -30,9 +30,11 @@
  * (target name already taken, target not found, folder collision,
  * type mismatch) we bail with a clear message and no partial state.
  *
- * Out of scope: registry side. The publish id (package.json::uniweb.id)
- * is independent of the workspace name and stays untouched. Users who
- * want to also rename on the registry run `uniweb publish --name <new>`.
+ * Out of scope: registry side. The registered id (the scoped
+ * `package.json::name` / `uniweb.id`) is independent of the workspace name and
+ * stays untouched. There is no registry-rename flag — a registered version is
+ * immutable; to change a foundation's registered identity, register it under
+ * the new name (consuming sites repoint their `foundation:` ref).
  *
  * Usage:
  *   uniweb rename foundation <old> <new>
@@ -521,8 +523,9 @@ ${colors.bright}What rename extension does:${colors.reset}
   • Updates pnpm-workspace.yaml + package.json::workspaces.
 
 ${colors.bright}What rename does NOT do (any subcommand):${colors.reset}
-  • Push to the registry. The publish id (package.json::uniweb.id) is
-    independent. To rename on the registry too, run \`${prefix} publish --name <new>\`.
+  • Push to the registry. The registered id (package.json::uniweb.id) is
+    independent. To register under a new name, set it and run \`${prefix} register\`
+    (alias \`${prefix} release\`) — there is no rename flag.
 
 ${colors.bright}Examples:${colors.reset}
   ${prefix} rename foundation src marketing-src