uniweb 0.32.1 → 0.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.32.1",
+  "version": "0.33.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,13 +41,13 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/runtime": "^0.13.0",
-    "@uniweb/core": "^0.13.0",
+    "@uniweb/runtime": "^0.13.1",
     "@uniweb/semantic-parser": "^1.3.1",
+    "@uniweb/core": "^0.13.1",
     "@uniweb/kit": "^0.14.0"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.28.1",
+    "@uniweb/build": "^0.29.0",
     "@uniweb/content-reader": "^1.2.4",
     "@uniweb/semantic-parser": "^1.3.1"
   },

package/partials/agents.md

@@ -1851,7 +1851,7 @@ by the same rule — your declaration, then the host's, then neither:
 ```jsx
 import { resolveService } from '@uniweb/kit'
 
-const { url, reason } = resolveService(website, 'assistant')   // or 'search', or your own
+const { url, source } = resolveService(website, 'assistant')   // or 'search', or your own
 ```
 
 **The name is open**: the framework ships clients for what it implements and
@@ -1870,7 +1870,9 @@ if (!url) return null          // this site has no agent — render nothing, or
 
 ⛔ **Absent is the answer, not a lookup that failed.** No `url` means the site has no agent — never enabled, or this host runs none. Render for that case; don't retry it. And don't hardcode `/_agent/chat` when nothing was declared: on a static host that turns "no agent here" into a 404 your component can't tell from a broken endpoint. The path is named above so you recognize the shape, not so you can construct it.
 
-⛔ **And don't tell the visitor.** `resolveService` also returns a `reason`, and it is **not visitor copy** — a visitor has no stake in which services the operator provisioned, and "this site has no assistant configured" reports someone's billing state to the public while reading like a breakage. It is neither. **Absence is a rendering decision, not a message**: a generic component is expected to be smart about it. No assistant → no Ask-AI affordance. No submit endpoint → no form, or degrade to a `mailto:` the site already carries in its content. The `reason` string is there for *you*, while you wire a site up.
+⛔ **And don't tell the visitor.** `resolveService` returns `{ url, source }` and **deliberately nothing else** — there is no explanatory string and there was one, removed because it was a mistake. A visitor has no stake in which services the operator provisioned, and "this site has no assistant configured" reports someone's billing state to the public while reading like a breakage. It is neither. Worse, it is unfixably the wrong language: sites here are multilingual, or unilingual and not English, and a canned constant bypasses the site's whole localization pipeline. **Absence is a rendering decision, not a message**, and a generic component is expected to be smart about it. No assistant → no Ask-AI affordance. No submit endpoint → no form, or degrade to a `mailto:` the site already carries in its content. Any text a visitor should read is *site content* — authored and localized.
+
+`source` is `'site'`, `'host'` or `null`, and it is a **diagnostic for you** while you wire a site up: it says which tier answered, which is the thing to check when a host's value appears not to be taking effect. `'host'` with a null `url` means the host answered and offered no address.
 
 *(A live agent that errors mid-conversation is a different problem — that's ordinary request failure, handled where you make the request.)*
 

package/src/backend/site-sync.js

@@ -932,14 +932,32 @@ export async function probeUnpushed(siteDir, { sendAll = false } = {}) {
   //     wrote. Reading the live file rather than a snapshot is what makes a moved
   //     map (a teammate's push, a pull) read as changed instead of matching a copy
   //     of itself.
+  //   · RECORDED — the site's own org, from `site.yml::$org`, written by the push
+  //     that banked these hashes.
+  //
+  // ⛔ THE ORG IS NOT OPTIONAL HERE, AND OMITTING IT WAS SILENT. It is what resolves
+  // a foundation-relative `@/member` into the `@org/member` the push shipped and
+  // keyed its hashes by. Without it the emit does not fail — `buildCollectionEntities`
+  // WARNS and ships the model unresolved, deliberately, so an org-less export still
+  // works — so every record of a `@/`-scoped collection is emitted under a key that
+  // can never match its banked one, and reads as changed forever.
+  //
+  // ⚠️ It hides in plain sight because `@std/…` collections are unaffected: their
+  // scope is already absolute, so they match. A site mixing both — the marketing
+  // fixture has `@std/person` AND `@proximify/member` — shows some records settling
+  // and others never settling, which reads like a content problem rather than a
+  // resolution one. Measured on matinee 2026-08-29: `status` reported 4 changed
+  // immediately after a successful push; passing the org took it to 1.
   const applied = readAppliedInjections(siteDir)
   const assetIds = readAssetMap(siteDir)
+  const org = readSiteOrg(siteDir)
   const pkg = await emitSyncPackages(siteDir, {
     resolveModel: makeModelResolver({ client: null, offline: true }),
     priorHashes,
     sendAll,
     ...applied,
-    ...(Object.keys(assetIds).length ? { assetIds } : {})
+    ...(Object.keys(assetIds).length ? { assetIds } : {}),
+    ...(org ? { org } : {})
   })
   const changed =
     (pkg.siteContent?.entityCount || 0) + (pkg.collections?.entityCount || 0)

package/src/commands/i18n.js

@@ -15,8 +15,8 @@
  * prompts for selection.
  */
 
-import { resolve, join, dirname, basename, relative } from 'path'
-import { existsSync } from 'fs'
+import { resolve, join, dirname, basename, relative } from 'node:path'
+import { existsSync } from 'node:fs'
 import {
   readFile,
   writeFile,

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-27T21:57:57.427Z",
+  "generatedAt": "2026-08-28T16:19:53.330Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.28.1",
+      "version": "0.29.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -12,8 +12,6 @@
         "@uniweb/projections",
         "@uniweb/runtime",
         "@uniweb/schemas",
-        "@uniweb/schemas",
-        "@uniweb/semantic-parser",
         "@uniweb/semantic-parser",
         "@uniweb/theming"
       ]
@@ -29,7 +27,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.13.0",
+      "version": "0.13.1",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -68,7 +66,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.5.0",
+      "version": "0.5.1",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -76,7 +74,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.13.0",
+      "version": "0.13.1",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -104,7 +102,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.9.6",
+      "version": "0.10.0",
       "path": "framework/templates",
       "deps": []
     },

package/src/utils/registry-auth.js

@@ -225,11 +225,6 @@ export async function ensureRegistryAuth({
   return record.token
 }
 
-// The browser/OAuth flow is wired below (loginViaBrowser: a loopback redirect
-// against the backend's /dev/auth/cli/authorize, token-in-redirect). Kept
-// gated until that endpoint is live on the backend — flip to true then, and the
-// picker offers Browser/social as the default (and `--browser` works).
-const BROWSER_AVAILABLE = false
 
 /**
  * GET /dev/auth/me with a bearer → the account object ({ uuid, username,
@@ -423,45 +418,90 @@ export async function awaitBrowserCallback({
   return result.value
 }
 
-// Browser / social — loopback OAuth against the backend's /dev/auth/authorize.
-// The CLI hosts a one-shot 127.0.0.1 server (awaitBrowserCallback), opens the
-// browser to authorize, and the backend (after the Google dance) 302s back to
-// the loopback with the token (or an error). state is a CSRF nonce echoed back
-// and verified. The token never leaves browser→localhost. Gated by
-// BROWSER_AVAILABLE until the endpoint is live.
+// Browser / social — the backend's CLI delegation flow. The CLI never speaks to
+// an identity provider and holds no client id, secret or provider knowledge: it
+// opens ONE url (the backend's), catches a one-time code on a loopback, and
+// trades that code for a bearer. Whatever methods the backend's own sign-in page
+// offers — password, Google, Microsoft, anything added later — the CLI gains with
+// no change here, because it never learns which one was used.
+//
+// Three legs, all verified against a live backend rather than read:
+//
+//   GET  {base}/dev/auth/authorize?callback=<loopback>&state=<nonce>
+//          no session → 302 {hub}/login?returnTo=…   (the ordinary sign-in page)
+//          session    → 302 <callback>?state=<ours>&code=<one-time>
+//   POST {base}/dev/auth/token  {code}  → { token, expires_at, account }
+//
+// ⛔ `callback` IS THE PARAMETER NAME, not `redirect_uri` — the backend serves
+// this route and rejects the other spelling with a 400. ⛔ AND THE CALLBACK
+// CARRIES A `code`, NEVER A TOKEN: the bearer is born on the POST, server-to-CLI,
+// so it never touches the browser, the URL bar, history or a proxy log. Both were
+// wrong here for three months — this code was written against an anticipated
+// shape five days before the backend shipped, and being gated meant nothing could
+// contradict it.
+//
+// ⛔ The loopback MUST be a v4 literal. `awaitBrowserCallback` binds 127.0.0.1
+// explicitly and composes `http://127.0.0.1:<port>/callback`; the backend's
+// validator accepts `http://` only, host exactly `127.0.0.1` or `localhost`, and
+// refuses `[::1]` and any `user@host` (that last guard stops
+// `http://127.0.0.1:1@evil.com/cb` from walking off with the code). Do not
+// "modernise" the bind to `::`.
 async function loginViaBrowser({ apiBase }) {
-  if (!BROWSER_AVAILABLE) {
-    throw new Error(
-      'browser/social login for the new backend isn’t available yet — use --password or --token-paste.'
-    )
-  }
   const base = apiBase.replace(/\/$/, '')
   const state = randomBytes(16).toString('hex')
 
-  const token = await awaitBrowserCallback({
-    buildUrl: (redirectUri) =>
-      `${base}/dev/auth/authorize?redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`,
+  // Leg 1+2 — open the backend's authorize url, catch the one-time code.
+  const code = await awaitBrowserCallback({
+    buildUrl: (callback) =>
+      `${base}/dev/auth/authorize?callback=${encodeURIComponent(callback)}&state=${state}`,
     validate: (params) => {
       if (params.get('error')) return { error: params.get('error') }
+      // Check `state` BEFORE reading anything else: it is the only thing that
+      // ties this callback to the request we made.
       if (params.get('state') !== state)
         return { error: 'state mismatch — please try again.' }
-      const tok = params.get('token')
-      if (!tok) return { error: 'no token returned by the callback.' }
-      return { value: tok }
+      const code = params.get('code')
+      if (!code) return { error: 'no code returned by the callback.' }
+      return { value: code }
     },
     openingLabel: 'Opening your browser to sign in…',
-    waitingLabel: 'Waiting for sign-in to complete (120s)…',
+    waitingLabel: 'Waiting for sign-in to complete (5 min)…',
+    // A person is signing in at an identity provider, not clicking one button:
+    // a first-time Google or Microsoft login can carry a consent screen, an
+    // account chooser and 2FA. The default 120s expires mid-flow and reports a
+    // TIMEOUT, which reads as "the CLI is broken" rather than "you were slow".
+    // Same reasoning, and the same value, as the publish payment handoff.
+    timeoutMs: 5 * 60 * 1000,
     okTitle: 'Login successful',
     errTitle: 'Login failed'
   })
 
-  let account = null
-  try {
-    account = await fetchMe({ apiBase, token })
-  } catch {
-    /* identity optional; token is valid */
+  // Leg 3 — trade the code for a bearer. Anonymous: the code IS the credential,
+  // and it is single-use, so a replay gets a 400 rather than a second session.
+  const res = await fetch(`${base}/dev/auth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ code })
+  })
+  const payload = await res.json().catch(() => null)
+  if (!res.ok || !payload?.token) {
+    const detail = payload?.detail || payload?.title || `HTTP ${res.status}`
+    throw new Error(`could not complete sign-in: ${detail}`)
   }
-  const record = { token, origin: normOrigin(apiBase) }
+
+  // The token response already carries the account, so no second round trip.
+  // `fetchMe` remains the fallback for a backend that answers without one.
+  let account = payload.account || null
+  if (!account) {
+    try {
+      account = await fetchMe({ apiBase, token: payload.token })
+    } catch {
+      /* identity is optional; the bearer is valid either way */
+    }
+  }
+
+  const record = { token: payload.token, origin: normOrigin(apiBase) }
+  if (payload.expires_at) record.expiresAt = payload.expires_at
   if (account?.uuid) record.uuid = account.uuid
   if (account?.username) record.username = account.username
   if (account?.handle) record.handle = account.handle
@@ -549,11 +589,10 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     } else {
       const prompts = (await import('prompts')).default
       const choices = []
-      if (BROWSER_AVAILABLE)
-        choices.push({
-          title: 'Browser / social (Google, etc.)',
-          value: 'browser'
-        })
+      choices.push({
+        title: 'Browser / social (Google, Microsoft, …)',
+        value: 'browser'
+      })
       choices.push({ title: 'Username and password', value: 'password' })
       choices.push({ title: 'Paste a token', value: 'token-paste' })
       const { picked } = await prompts(