uniweb 0.27.1 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.27.1",
+  "version": "0.28.1",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/runtime": "^0.12.7",
-    "@uniweb/semantic-parser": "^1.3.0",
-    "@uniweb/core": "^0.11.1",
-    "@uniweb/kit": "^0.13.2"
+    "@uniweb/runtime": "^0.12.9",
+    "@uniweb/kit": "^0.13.3",
+    "@uniweb/core": "^0.11.2",
+    "@uniweb/semantic-parser": "^1.3.0"
   },
   "peerDependencies": {
-    "@uniweb/content-reader": "^1.2.4",
     "@uniweb/semantic-parser": "^1.3.0",
-    "@uniweb/build": "^0.25.0"
+    "@uniweb/content-reader": "^1.2.4",
+    "@uniweb/build": "^0.25.2"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -2218,7 +2218,7 @@ uniweb inspect <path>             # Show parsed content for a section or page (-
 uniweb <command> --help           # Per-command flags — no side effects. Prefer this over guessing.
 ```
 
-**Four verbs dispatch but are deliberately not listed above.** `invite`, `handoff` and `template` are **reserved names with no implementation** — the flows they named ran against a backend the CLI no longer talks to, and the names are held so a future rebuild doesn't need a breaking change. `runtime register` uploads a built runtime and is internal — an **escape hatch** for a build npm does not have (an unreleased version, a local workspace tree, or a deployment that cannot reach the distribution channel), never the normal way a runtime reaches a backend. Running any of them is not useful; their absence from this list is the answer, not an omission to fix.
+**Three verbs dispatch but are deliberately not listed above.** `invite`, `handoff` and `template` are **reserved names with no implementation** — the flows they named ran against a backend the CLI no longer talks to, and the names are held so a future rebuild doesn't need a breaking change. Running any of them is not useful; their absence from this list is the answer, not an omission to fix.
 
 ### Where a site can live
 
@@ -2231,7 +2231,7 @@ uniweb <command> --help           # Per-command flags — no side effects. Prefe
 | Any static host at all | `uniweb export` | full control; no Uniweb account needed |
 | Uniweb Cloud | `uniweb publish` | teams with non-technical content authors, or client work |
 
-`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. Destination config lives in `deploy.yml` beside `site.yml`; host credentials come from the environment, never from that committed file.
+`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `lastDeploy:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
 
 Foundations have their own free path too: `uniweb add ci --target foundation` publishes to permanent versioned URLs on GitHub Pages.
 

package/src/backend/client.js

@@ -40,7 +40,6 @@ import {
 } from '../utils/registry-orgs.js'
 import { uploadFoundationCode } from '../utils/code-upload.js'
 import { uploadSiteAssets } from '../utils/asset-upload.js'
-import { uploadRuntime } from '../utils/runtime-upload.js'
 
 /**
  * Resolve the backend origin via the resolution ladder (highest precedence
@@ -85,8 +84,7 @@ export function resolveBackendOrigin(flag, { siteBackend } = {}) {
 /**
  * The fallback capability doc when `GET /dev/config` is absent or unreachable
  * (an older backend, or no backend at all). Keeps the client non-breaking: the
- * bases mirror a self-serve dev backend, and `runtime.installed` is empty so
- * runtime resolution requires an explicit pin.
+ * bases mirror a self-serve dev backend.
  */
 export const DISCOVERY_DEFAULTS = {
   // ⛔ No serve-root default, and no `assetBase`. Serve locations are read from
@@ -99,10 +97,18 @@ export const DISCOVERY_DEFAULTS = {
   // production host, hardcoded, applied to EVERY deployment the CLI can be
   // pointed at. It was only ever read to compose an asset URL, which the plan
   // already returns as `serve_url`; both the reader and the composer are gone.
+  //
+  // No `runtime` entry, and there must not be one. A backend does not hold
+  // runtimes: a version is acquired from a CDN — the official mirror, the
+  // distribution channel, or a local server — so there is no installed set for
+  // it to report and nothing here to default. `runtime.installed` lived here
+  // until 2026-08-22, alongside a `uniweb runtime register` verb that pushed
+  // builds to a backend; both are gone. The runtime a site gets follows from
+  // its foundation's floor (`info.runtime`, stated at register), not from
+  // anything the CLI asks a backend about.
   auth: { loginPath: '/dev/auth/login', required: true },
   delivery: { deploy: true, publish: true, broker: 'self-serve' },
-  assets: { supported: false },
-  runtime: { installed: [] }
+  assets: { supported: false }
 }
 
 export class BackendClient {
@@ -224,8 +230,7 @@ export class BackendClient {
    * lifetime; a missing route or any transport/parse error falls back to
    * DISCOVERY_DEFAULTS (non-breaking — an older backend still works). Lets the
    * CLI hardcode nothing about a backend but its origin and discover the rest:
-   * `auth`, `delivery` (deploy/publish? broker), `assets` (lane built yet?),
-   * `runtime.installed` (the default-runtime source replacing the old /runtime/latest).
+   * `auth`, `delivery` (deploy/publish? broker), `assets` (lane built yet?).
    * @returns {Promise<object>}
    */
   async discover() {
@@ -428,8 +433,8 @@ export class BackendClient {
 
   /**
    * POST /dev/deploy — dumb, file-built delivery. Body is the deploy payload (the
-   * runtime-init JSON `build-site-data.js` produces — foundation, runtimeVersion,
-   * theme, languages, locales, optional dataFiles/searchFiles) plus an optional
+   * runtime-init JSON `build-site-data.js` produces — foundation, theme,
+   * languages, locales, optional dataFiles/searchFiles) plus an optional
    * `site_uuid`. First deploy of a never-synced site omits it → the backend mints
    * a uuid and returns it for write-back to deploy.yml; later deploys resend it so
    * the site's published URL stays stable. Returns the raw Response so the caller
@@ -451,27 +456,23 @@ export class BackendClient {
    * POST /dev/site/publish/{uuid} — CMS-publish a synced site (make its CURRENT
    * backend state live; it does NOT push local files). `{uuid}` is the site-content
    * uuid (`site.yml::$uuid`); a never-synced site 404s (sync first, or use deploy).
-   * The CLI knows the runtime from its build; the body carries it snake-cased per
-   * the route contract. Returns the raw Response ({ deploy_uuid, url,
-   * published_folder_uuid, status } on 200).
+   * Languages, when present, go in the body; absent → no body. Returns the raw
+   * Response ({ deploy_uuid, url, published_folder_uuid, status } on 200).
+   *
+   * ⛔ Sends NOTHING about a runtime. A `?runtime=<version>` param rode here until
+   * 2026-08-22, carrying a `site.yml::runtime` pin — a vestigial prop [Diego]: no
+   * template ever set it, no public doc described it, and the backend may already
+   * have been ignoring it. A site is codeless and has no basis for naming a
+   * runtime; the binding party is the FOUNDATION, whose floor travels as
+   * `info.runtime` at register. Do not reintroduce the param.
    * @param {string} uuid - the site-content uuid
-   * @param {object} opts
-   * @param {string} opts.runtimeVersion
+   * @param {object} [opts]
    * @param {string[]} [opts.languages]
    * @returns {Promise<Response>}
    */
-  async publishSite(uuid, { runtimeVersion, languages } = {}) {
-    // Runtime rides as a query param (?runtime=<version>) per the shipped /dev
-    // route (D3, "request-carried"), NOT the body. Languages, when present, go in
-    // the body; absent → no body (the route only requires the runtime).
-    // Omitted when the site pins no runtime — silence is NOT a request to change
-    // it, so the backend keeps the site on its current resolved version (its
-    // order: body → current → UNIWEBD_DEFAULT_RUNTIME → highest installed → 400).
-    // Sending a locally-computed guess instead would undo a propagation walk on
-    // the next publish.
+  async publishSite(uuid, { languages } = {}) {
     return this.request(`/dev/site/publish/${encodeURIComponent(uuid)}`, {
       method: 'POST',
-      ...(runtimeVersion ? { query: { runtime: runtimeVersion } } : {}),
       ...(languages ? { body: JSON.stringify({ languages }) } : {})
     })
   }
@@ -548,19 +549,6 @@ export class BackendClient {
     })
   }
 
-  /**
-   * Upload a built `@uniweb/runtime` to the runtime registry (plan → PUT-per-file),
-   * served by the backend at a location it reports. @std-gated on the backend. Thin
-   * pass-through to utils/runtime-upload.js with this client's origin + token.
-   * @param {object} opts - { version, distDir, files?, onProgress? }
-   */
-  async uploadRuntime(opts) {
-    return uploadRuntime({
-      apiBase: this.origin,
-      token: await this.token(),
-      ...opts
-    })
-  }
 }
 
 /** `@scope/name` → /dev/registry/data-schemas/{scope}/{name}; a bare name → …/{name}. */

package/src/commands/publish.js

@@ -220,76 +220,33 @@ export async function publish(args = []) {
     return { exitCode: 1 }
   }
 
-  // Runtime: an explicit site.yml::runtime pin wins; else the highest installed;
-  // else fail closed (better than serving a site with no runtime). A dry-run is
-  // a pure preview, so it only WARNS — it stays useful with no backend reachable.
-  const installed = Array.isArray(config?.runtime?.installed)
-    ? config.runtime.installed
-    : []
-  if (
-    siteYml.runtime &&
-    installed.length &&
-    !installed.includes(siteYml.runtime)
-  ) {
-    // ⚠️ Leads with REMOVING the pin, deliberately. A site ships no JS, so it
-    // has no basis for holding a runtime version, and `runtime:` is an
-    // operator-level override that is no longer part of the documented
-    // authoring surface. This message used to say "pin one of these in
-    // site.yml" — which pushed a reader deeper into a mechanism they should
-    // not be using, and named a key the docs no longer describe. Keep the
-    // installed list (it is the actionable part when a pin IS intended), but
-    // do not restore pin-first phrasing.
-    say.err(
-      `Runtime ${siteYml.runtime} (pinned in site.yml) is not installed on the backend.`
-    )
-    say.dim(
-      `Remove the \`runtime:\` pin and the backend chooses — a site ships no code, so it has no reason to hold one.`
-    )
-    say.dim(
-      `Installed: ${installed.join(', ') || '(none)'} — or pin one of those, or have ${siteYml.runtime} installed.`
-    )
-    if (!dryRun) return { exitCode: 1 }
-  }
-  // An explicit pin is sent; NOTHING is synthesized when site.yml is silent.
-  //
-  // This used to fall back to the highest version the backend reported
-  // installed. That is the producer guessing at a fact the control plane owns —
-  // and once propagation moves sites, actively wrong: a walk advances a site to
-  // X, and the next publish would restate a *different* version the producer
-  // computed locally, silently undoing it.
+  // ⛔ NOTHING about a runtime is sent from here. `site.yml::runtime` was a
+  // vestigial prop and is no longer read [Diego, 2026-08-22]; `?runtime=` is no
+  // longer a query param on publish. Do not reintroduce either.
   //
-  // The deeper reason, upstream of ownership: a link-mode site is CODELESS. It
+  // The chain is SITE → FOUNDATION → RUNTIME. A link-mode site is CODELESS: it
   // ships no JS, so it has nothing that binds to a runtime version and cannot
   // break when the runtime moves. Asking it to name one is not a hard question,
   // it is a malformed one. The party that binds is the FOUNDATION, whose build
   // externalizes react / react-dom / jsx-runtime / @uniweb/core — which is why
-  // the compatibility floor rides on the foundation (`info.runtime`, set by
-  // `register`) and not here. See
-  // the site/foundation/runtime model, § "who gets to say
-  // whether a site accepts a newer runtime".
-  //
-  // Silence is therefore not a request to change the runtime, and the backend
-  // resolves it: an explicit pin → the site's CURRENT resolved runtime →
-  // UNIWEBD_DEFAULT_RUNTIME → (self-serve) highest installed.
+  // the compatibility floor rides on the foundation (`dist/runtime-pin.json` →
+  // `info.runtime`, stated on every register) and never here. Whoever resolves a
+  // whole site picks a runtime satisfying max() of the floors its foundation and
+  // extensions declare, and fetches it from a CDN — the official mirror, the
+  // distribution channel, or a local server. A backend never holds one.
   //
-  // ⚠️ THAT LAST SENTENCE IS A CLAIM ABOUT ANOTHER LANE, and it was FALSE when it
-  // was first written here — `/dev/site/publish` required `?runtime=` with no
-  // fallback at all, so an unpinned publish 400'd and no scaffolded project could
-  // publish. It read as true because the `/api` lane did have the fallback, and
-  // the backend's own doc justified the omission with "the CLI always pins from
-  // site.yml" — which was equally false, since no template ships a `runtime:` key.
-  // Two complementary assumptions, each load-bearing for the other lane, neither
-  // ever checked. Found by driving the CLI against a live backend, which is the
-  // only vantage point from which either assumption is visible.
-  // ✅ Now the shipped contract, agreed with the backend and verified end to end
-  // with the workaround removed (2026-08-16). Re-verify against the backend
-  // rather than trusting this comment if it starts mattering again.
-  //
-  // ⚠️ Do NOT reintroduce a local fallback. Sending our own guess when the site
-  // did not ask is what makes an unpinned republish regress. (The pinned path is
-  // unaffected — an explicit pin is still validated fail-closed above, and the
-  // backend refuses a backward move unless forced.)
-  const runtimeVersion = siteYml.runtime || null
+  // History, because each removal undid a different bad idea:
+  //   • a local fallback to the highest version the backend reported installed —
+  //     the producer guessing at a fact the control plane owns, and actively
+  //     wrong once propagation moves sites (a walk advances a site to X; the
+  //     next publish would restate a locally-computed value, silently undoing
+  //     it). Removed in `6d32d94`.
+  //   • fail-closed validation of a pin against `/dev/config`'s
+  //     `runtime.installed`, and the `uniweb runtime register` verb that
+  //     populated that field. Removed 2026-08-22 with the concept.
+  //   • the pin itself, and the `?runtime=` it rode on. Removed 2026-08-22 —
+  //     nothing scaffolded ever set it, it is in no public doc, and the backend
+  //     may already have been ignoring it.
 
   // deploy.yml target (the Uniweb hosting memory). No --target on publish — it
   // always targets Uniweb hosting; resolveTarget gives us the target name +
@@ -351,9 +308,6 @@ export async function publish(args = []) {
   if (dryRun) {
     say.info('Dry run — would bring the foundation along, sync, and go live:')
     say.dim(`Backend     : ${client.origin}`)
-    say.dim(
-      `Runtime     : ${runtimeVersion || '(not pinned — the backend keeps this site on its current runtime)'}`
-    )
     say.dim(
       `site_uuid   : ${siteYml.$uuid || '(none — the site is created before anything uploads)'}`
     )
@@ -718,7 +672,6 @@ export async function publish(args = []) {
   let pubRes
   try {
     pubRes = await client.publishSite(siteUuid, {
-      runtimeVersion,
       ...(languages ? { languages } : {})
     })
   } catch (err) {
@@ -781,11 +734,11 @@ export async function publish(args = []) {
         ...(recordedRef ? { ref: recordedRef } : {}),
         released: fnd.released
       },
-      // Only when the site pinned one. An unpinned site's runtime is resolved by
-      // the backend and can move under propagation, so recording a value here
-      // would be a snapshot that silently goes stale — and `deploy.yml` is a
-      // record of what this publish did, not a cache of backend state.
-      ...(runtimeVersion ? { runtime: runtimeVersion } : {}),
+      // No `runtime` here. `deploy.yml` records what this publish DID, and a
+      // publish sends nothing about a runtime — the site's runtime follows from
+      // its foundation's floor and is resolved by whoever serves it. Recording a
+      // value would be a snapshot that silently goes stale, of a decision this
+      // command does not make.
       locales: Array.isArray(result.locales) ? result.locales : languages
     }
   })

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-20T22:44:56.592Z",
+  "generatedAt": "2026-08-24T14:55:17.484Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.25.0",
+      "version": "0.25.2",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -29,7 +29,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.11.1",
+      "version": "0.11.2",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -37,7 +37,7 @@
       ]
     },
     "@uniweb/frame-bridge": {
-      "version": "0.2.4",
+      "version": "0.3.0",
       "path": "framework/frame-bridge",
       "deps": []
     },
@@ -49,7 +49,7 @@
       ]
     },
     "@uniweb/kit": {
-      "version": "0.13.2",
+      "version": "0.13.3",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -76,7 +76,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.12.7",
+      "version": "0.12.9",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -114,7 +114,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.8.11",
+      "version": "0.8.12",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -843,15 +843,6 @@ async function main() {
     return
   }
 
-  // Handle runtime command — `runtime register` uploads a built @uniweb/runtime to
-  // the backend's runtime registry; @std-gated. Where it is served from is the
-  // backend's to report, not ours to know.
-  if (command === 'runtime') {
-    const { runtime } = await import('./commands/runtime.js')
-    const result = await runtime(args.slice(1))
-    process.exit(result?.exitCode ?? 0)
-  }
-
   // Handle invite command
   if (command === 'invite') {
     await invite(args.slice(1))
@@ -1721,7 +1712,6 @@ ${colors.bright}Commands:${colors.reset}
   export             Export a self-contained site for third-party hosting
   register           Register a foundation + its data schemas with the backend registry
   release            Release a foundation version (synonym of register)
-  runtime register   Escape hatch: push a LOCAL/unreleased runtime build (@std only)
   push               Push a site's content to the backend
   pull               Pull a site's content from the backend
   refresh            Catch up with the git remote AND the backend (never pushes)

package/src/commands/runtime.js

@@ -1,249 +0,0 @@
-/**
- * uniweb runtime register — upload a built `@uniweb/runtime` to the backend so it
- * can serve the runtime version. The runtime is a SYSTEM artifact: registering it
- * requires **@std membership** (a non-@std bearer 403s).
- *
- * ─────────────────────────────────────────────────────────────────────────────
- * ⛔ THIS IS AN ESCAPE HATCH. IT IS NOT HOW A RUNTIME NORMALLY REACHES A BACKEND.
- * ─────────────────────────────────────────────────────────────────────────────
- *
- * The normal path is **publish to npm**, which CI mirrors into the public
- * distribution channel, from which a backend acquires the version itself — no
- * login, no per-backend push, no credentials leaving the backend.
- *
- * This verb pushes ONE build to ONE backend, by hand. Its cost is not the
- * upload, it is that the result is **invisible to every other backend and to
- * the channel**: a version installed this way exists nowhere else, cannot be
- * verified against a published digest, and will not be what a second
- * environment resolves. Two backends can end up serving different bytes under
- * one version number, which is the exact defect the channel's immutability
- * exists to make impossible.
- *
- * It stays because three cases have no other path, and they are all LOCAL or
- * pre-release:
- *
- *   • **an unpublished build** — npm versions are immutable, so you cannot
- *     iterate on a published one. Testing a runtime before releasing it goes
- *     through here.
- *   • **local workspace development** — `@uniweb/runtime` is a pnpm symlink to
- *     the working tree; there is no published artifact for the code you are
- *     editing.
- *   • **a deployment that cannot pull** — air-gapped or policy-restricted, or
- *     any environment without the egress the channel needs.
- *
- * ⇒ **If the version you are pushing is on npm, you almost certainly want the
- * channel instead.** The command warns at runtime for that reason.
- *
- * A foundation emits `dist/runtime-pin.json`. `uniweb register` now reads it and
- * ships it as the foundation's `info.runtime` — but **NOTHING ENFORCES IT** in
- * any lane. An earlier version of this comment claimed `uniweb register` of a
- * foundation fails when its pinned version isn't registered. That was never
- * true, and it propagated into internal notes AND into four public
- * documentation surfaces before anyone checked it against `commands/register.js`
- * three files away.
- *
- * The pin is a **compatibility floor**, not a selector: a site loads a primary
- * foundation plus N extensions, each emitting its own pin, and a site has exactly
- * one runtime — so pins are plural and the selector must be singular. The selector
- * is `site.yml::runtime` (see commands/publish.js), which the backend stamps into
- * the site's meta at publish. The pin's use is VALIDATION — is the selected
- * runtime at or above max() of every loaded foundation's floor? — and it belongs
- * wherever all of a site's foundations are held. The producer publishes one
- * foundation at a time and cannot see the others, so it STATES its floor and
- * something holding the whole set does the arithmetic.
- *
- * Contract AGREED with the backend (2026-06-14): `POST /dev/runtime`, @std-gated,
- * manifest-last. Wire + the two-half artifact set (SPA + ssr-edge isolate, the
- * orchestrator stays platform-owned): utils/runtime-upload.js.
- *
- * Usage (escape hatch — prefer publishing to npm; see above):
- *   uniweb runtime register                  From framework/runtime (or --path <dir>)
- *   uniweb runtime register --path <dir>     The @uniweb/runtime package dir
- *   uniweb runtime register --version <v>    Override dist/app/manifest.json's version
- *   uniweb runtime register --backend <url>  Override the backend origin
- *   uniweb runtime register --token <bearer> Auth bearer (skips `uniweb login`)
- *   uniweb runtime register --dry-run        Print the version + file plan; upload nothing
- */
-
-import { readFileSync } from 'node:fs'
-import { resolve, join } from 'node:path'
-
-import { BackendClient } from '../backend/client.js'
-import {
-  collectRuntimeFiles,
-  hasWorkerRuntime,
-  hasShims
-} from '../utils/runtime-upload.js'
-import { readFlagValue } from '../utils/args.js'
-
-const c = {
-  reset: '\x1b[0m',
-  bold: '\x1b[1m',
-  dim: '\x1b[2m',
-  cyan: '\x1b[36m',
-  green: '\x1b[32m',
-  yellow: '\x1b[33m',
-  red: '\x1b[31m'
-}
-const say = {
-  ok: (m) => console.log(`${c.green}✓${c.reset} ${m}`),
-  info: (m) => console.log(`${c.cyan}→${c.reset} ${m}`),
-  warn: (m) => console.log(`${c.yellow}⚠${c.reset} ${m}`),
-  err: (m) => console.error(`${c.red}✗${c.reset} ${m}`),
-  dim: (m) => console.log(`  ${c.dim}${m}${c.reset}`)
-}
-
-// The runtime package dir: --path, else the cwd when it IS @uniweb/runtime.
-function resolveRuntimeDir(args) {
-  const pathFlag = readFlagValue(args, '--path')
-  if (pathFlag) return resolve(pathFlag)
-  try {
-    if (
-      JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf8'))
-        .name === '@uniweb/runtime'
-    ) {
-      return process.cwd()
-    }
-  } catch {
-    // no readable package.json — fall through
-  }
-  return null
-}
-
-export async function runtime(args = []) {
-  const sub = args[0]
-  if (sub !== 'register') {
-    say.err(
-      sub
-        ? `Unknown subcommand: runtime ${sub}`
-        : 'Usage: uniweb runtime register'
-    )
-    say.dim(
-      'uniweb runtime register — upload the built @uniweb/runtime to the backend (@std only).'
-    )
-    return { exitCode: sub ? 1 : 0 }
-  }
-  const rest = args.slice(1)
-  const dryRun = rest.includes('--dry-run')
-
-  // Say it at the moment of use, not only in the header. A verb that works
-  // fine is a verb people keep reaching for: this one succeeds quietly and
-  // leaves a version that exists on exactly one backend, unverifiable against
-  // any published digest.
-  say.warn('`runtime register` is an escape hatch, not the normal path.')
-  say.dim('A published runtime reaches a backend through the distribution channel — no push, no login.')
-  say.dim('Use this for a build npm does not have: an unreleased version, a local workspace tree,')
-  say.dim('or a deployment that cannot reach the channel. Pushing a version that IS on npm installs')
-  say.dim('bytes nothing else can verify, and a second environment will resolve something different.')
-  console.log('')
-
-  const runtimeDir = resolveRuntimeDir(rest)
-  if (!runtimeDir) {
-    say.err('Not an @uniweb/runtime package.')
-    say.dim('Run from framework/runtime, or pass --path <dir>.')
-    return { exitCode: 2 }
-  }
-  const distDir = join(runtimeDir, 'dist')
-  const files = collectRuntimeFiles(distDir)
-  if (!files.length) {
-    say.err('No built runtime found (dist/app/).')
-    say.dim('Build it first: `pnpm build` in framework/runtime.')
-    return { exitCode: 2 }
-  }
-
-  // Version from the SPA build's manifest (the backend keys the version on it);
-  // --version overrides, parity with the backend's runtime install --version.
-  let version = readFlagValue(rest, '--version')
-  if (!version) {
-    try {
-      version = JSON.parse(
-        readFileSync(join(distDir, 'app', 'manifest.json'), 'utf8')
-      ).version
-    } catch (err) {
-      say.err(`Could not read dist/app/manifest.json: ${err.message}`)
-      return { exitCode: 2 }
-    }
-    if (!version) {
-      say.err(
-        'dist/app/manifest.json has no "version" field — rebuild the runtime.'
-      )
-      return { exitCode: 2 }
-    }
-  }
-  // The ssr-edge artifact is a SET: worker-runtime.js + its shims/*.js. Warn when
-  // the set is absent or incomplete (a worker without shims can't resolve react).
-  if (!hasWorkerRuntime(files)) {
-    say.warn(
-      "dist/worker-runtime.js is missing — the SSR isolate bundle won't be uploaded."
-    )
-    say.dim(
-      'Build it first: `pnpm build:worker` in @uniweb/runtime (after `pnpm build`).'
-    )
-  } else if (!hasShims(files)) {
-    say.warn(
-      'dist/worker-runtime.js is present but dist/shims/ is missing — the SSR isolate set is incomplete.'
-    )
-    say.dim(
-      'The isolate resolves react/jsx-runtime/@uniweb/core through those shims; re-run `pnpm build:worker`.'
-    )
-  }
-
-  if (dryRun) {
-    say.info(
-      `Would register ${c.bold}@uniweb/runtime@${version}${c.reset} (${files.length} files):`
-    )
-    for (const f of files)
-      say.dim(`${f.path}  ${f.size} bytes  ${f.content_type}`)
-    return { exitCode: 0 }
-  }
-
-  const client = new BackendClient({
-    originFlag:
-      readFlagValue(rest, '--backend') || readFlagValue(rest, '--registry'),
-    token: readFlagValue(rest, '--token') || undefined,
-    args: rest,
-    command: 'Registering the runtime'
-  })
-
-  say.info(
-    `Registering ${c.bold}@uniweb/runtime@${version}${c.reset} → ${c.dim}${client.origin}${c.reset} (${files.length} files)…`
-  )
-  let result
-  try {
-    result = await client.uploadRuntime({
-      version,
-      distDir,
-      files,
-      onProgress: (m) => say.dim(m)
-    })
-  } catch (err) {
-    if (err.status === 403) {
-      say.err(
-        'Not authorized — registering a runtime version requires @std membership.'
-      )
-      return { exitCode: 1 }
-    }
-    say.err(`Runtime registration failed: ${err.message}`)
-    say.dim(
-      'Set the origin with --backend <url>; auth with `uniweb login` or --token <bearer>.'
-    )
-    return { exitCode: 1 }
-  }
-  if (result.failed.length) {
-    say.err(`${result.failed.length} file(s) failed to upload:`)
-    for (const f of result.failed)
-      say.dim(`${f.path} — HTTP ${f.status} ${f.detail}`)
-    say.dim(
-      'Re-run `uniweb runtime register` to resume — completed files dedupe.'
-    )
-    return { exitCode: 1 }
-  }
-  console.log('')
-  say.ok(
-    `Registered ${c.bold}@uniweb/runtime@${version}${c.reset} (${result.uploaded.length} files, ${result.mode} mode)`
-  )
-  if (result.serveBase) say.dim(`served at ${result.serveBase}`)
-  return { exitCode: 0 }
-}
-
-export default runtime

package/src/utils/runtime-upload.js

@@ -1,201 +0,0 @@
-/**
- * Runtime registration — the framework half of `uniweb runtime register`.
- *
- * Uploads a built `@uniweb/runtime` to the backend so it can serve the runtime
- * version. Mirrors the foundation code lane (utils/code-upload.js): plan →
- * PUT-per-file, one mode-aware auth rule.
- *
- * The runtime is a SYSTEM artifact — registering it requires **@std membership**
- * (a non-@std bearer 403s). Versioned by version alone (no scope/name).
- *
- * A runtime version is ONE unit with two halves, BOTH uploaded here (the backend
- * stages the bytes; where/how it serves them is its decision — we don't assume a
- * serve path, we read `serve_base` back from the plan):
- *   - dist/app/**          the browser SPA (_importmap/, assets/, index.html,
- *                          manifest.json) — boots + client-renders a site.
- *   - dist/worker-runtime.js + dist/shims/*.js   the ssr-edge isolate set (4
- *                          files): the inlined SSR bundle + its 3 globalThis-bridge
- *                          shims (react, react/jsx-runtime, @uniweb/core). The
- *                          isolate can't resolve react without the shims.
- *
- * NOT uploaded: the SSR *orchestrator* (the isolate's `entry.js` boot module). It's
- * a serverless-isolate fetch handler encoding the platform's isolate dispatch
- * protocol — owned by the platform's SSR layer, not a framework artifact. The
- * framework ships the render API the orchestrator imports (worker-runtime.js
- * exports initPrerenderForLocale / renderPage / injectPageContent / hydrateDataStore).
- *
- * Contract — AGREED with the backend (2026-06-14):
- *   PLAN   POST {apiBase}/dev/runtime
- *          { version, files: [{ path, content_type, size, sha256 }] }
- *          → { mode, expires_in, serve_base, uploads: [{ path, method, url, headers }] }
- *          bearer; @std required (else 403, RFC7807 problem+json, op "runtime-register").
- *   UPLOAD PUT each file (direct → bearer; presigned → none; x-uniweb-sha256).
- *          MANIFEST LAST — discovery keys a version's existence on manifest.json,
- *          so a partial upload never advertises a half-delivered version.
- *   SERVE  the backend's call (read `serve_base` from the plan; we never construct it).
- */
-
-import { createHash } from 'node:crypto'
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
-import { join } from 'node:path'
-import { contentTypeFor } from './code-upload.js'
-
-const WORKER_RUNTIME = 'worker-runtime.js'
-const SHIMS_DIR = 'shims'
-const MANIFEST = 'manifest.json'
-
-function fileEntry(diskPath, path) {
-  const bytes = readFileSync(diskPath)
-  return {
-    path,
-    content_type: contentTypeFor(path),
-    size: bytes.length,
-    sha256: createHash('sha256').update(bytes).digest('hex'),
-    diskPath
-  }
-}
-
-/**
- * Collect a built runtime's upload set from `distDir` (framework/runtime/dist):
- * everything under `dist/app/**` at the root, plus `dist/worker-runtime.js` and
- * the `dist/shims/*.js` it depends on. Sourcemaps (`*.map`) are excluded (dev-only,
- * not CDN-served). Returns `[]` when `dist/app/` is missing (the runtime isn't
- * built). The worker bundle + shims are collected when present (graceful when not).
- *
- * @param {string} distDir - framework/runtime/dist
- * @returns {Array<{ path, content_type, size, sha256, diskPath }>}
- */
-export function collectRuntimeFiles(distDir) {
-  const appDir = join(distDir, 'app')
-  if (!existsSync(appDir)) return []
-  const files = []
-  const walk = (dir, prefix) => {
-    for (const name of readdirSync(dir).sort()) {
-      const full = join(dir, name)
-      const rel = prefix ? `${prefix}/${name}` : name
-      const st = statSync(full)
-      if (st.isDirectory()) walk(full, rel)
-      else if (st.isFile() && !rel.endsWith('.map'))
-        files.push(fileEntry(full, rel))
-    }
-  }
-  walk(appDir, '')
-  const worker = join(distDir, WORKER_RUNTIME)
-  if (existsSync(worker)) files.push(fileEntry(worker, WORKER_RUNTIME))
-  // The SSR isolate's globalThis-bridge shims ride alongside worker-runtime.js,
-  // served at shims/*.js. They're part of the ssr-edge artifact SET — the isolate
-  // can't resolve `react` without them — so collect the whole dir when present.
-  const shimsDir = join(distDir, SHIMS_DIR)
-  if (existsSync(shimsDir)) walk(shimsDir, SHIMS_DIR)
-  // MANIFEST LAST: the backend keys a version's existence on manifest.json (no
-  // server confirm step), so uploading it last means a partial delivery never
-  // advertises a half-built version. Reorder regardless of walk order.
-  const manifest = files.filter((f) => f.path === MANIFEST)
-  if (!manifest.length) return files
-  return [...files.filter((f) => f.path !== MANIFEST), ...manifest]
-}
-
-/** True when the worker SSR bundle is in the collected set. */
-export function hasWorkerRuntime(files) {
-  return files.some((f) => f.path === WORKER_RUNTIME)
-}
-
-/** True when any SSR-isolate shim (shims/*.js) is in the collected set. */
-export function hasShims(files) {
-  return files.some((f) => f.path.startsWith(`${SHIMS_DIR}/`))
-}
-
-/**
- * Plan + upload a built runtime. Throws on a plan-level failure (the caller maps
- * 403 → "@std only"); per-file PUT failures surface in `failed`.
- *
- * @param {object} opts - { apiBase, token, version, distDir, files?, onProgress? }
- * @returns {Promise<{ mode, uploaded: string[], failed: Array, serveBase: string|null }>}
- */
-export async function uploadRuntime({
-  apiBase,
-  token,
-  version,
-  distDir,
-  files,
-  onProgress = () => {}
-}) {
-  const list = files || collectRuntimeFiles(distDir)
-  if (!list.length)
-    return { mode: 'none', uploaded: [], failed: [], serveBase: null }
-
-  const origin = apiBase.replace(/\/$/, '')
-  const planRes = await fetch(`${origin}/dev/runtime`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify({
-      version,
-      files: list.map(({ path, content_type, size, sha256 }) => ({
-        path,
-        content_type,
-        size,
-        sha256
-      }))
-    })
-  })
-  if (!planRes.ok) {
-    const detail = await planRes.text().catch(() => '')
-    const err = new Error(
-      `runtime plan rejected: HTTP ${planRes.status}${detail ? ` — ${detail.slice(0, 300)}` : ''}`
-    )
-    err.status = planRes.status
-    throw err
-  }
-  const plan = await planRes.json()
-  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
-  // The one mode-aware bit: direct PUTs are bearer-authed backend routes;
-  // presigned URLs are self-authorizing and must NOT carry a foreign bearer.
-  const authHeaders =
-    plan.mode === 'presigned' ? {} : { Authorization: `Bearer ${token}` }
-
-  const uploaded = []
-  const failed = []
-  for (const f of list) {
-    const target = targets.get(f.path)
-    if (!target) {
-      failed.push({
-        path: f.path,
-        status: 0,
-        detail: 'no upload target in plan'
-      })
-      continue
-    }
-    onProgress(`↑ ${f.path}`)
-    let res
-    try {
-      res = await fetch(new URL(target.url, origin), {
-        method: target.method || 'PUT',
-        headers: {
-          ...(target.headers || {}),
-          ...authHeaders,
-          'x-uniweb-sha256': f.sha256
-        },
-        body: readFileSync(f.diskPath)
-      })
-    } catch (err) {
-      failed.push({ path: f.path, status: 0, detail: err.message })
-      continue
-    }
-    if (res.ok) uploaded.push(f.path)
-    else
-      failed.push({
-        path: f.path,
-        status: res.status,
-        detail: (await res.text().catch(() => '')).slice(0, 200)
-      })
-  }
-  return {
-    mode: plan.mode || 'direct',
-    uploaded,
-    failed,
-    serveBase: plan.serve_base || null
-  }
-}