uniweb 0.32.2 → 0.33.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.32.2",
+  "version": "0.33.1",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -43,11 +43,11 @@
     "tar": "^7.0.0",
     "@uniweb/core": "^0.13.1",
     "@uniweb/kit": "^0.14.0",
-    "@uniweb/runtime": "^0.13.1",
-    "@uniweb/semantic-parser": "^1.3.1"
+    "@uniweb/semantic-parser": "^1.3.1",
+    "@uniweb/runtime": "^0.13.1"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.28.2",
+    "@uniweb/build": "^0.29.1",
     "@uniweb/content-reader": "^1.2.4",
     "@uniweb/semantic-parser": "^1.3.1"
   },

package/partials/agents.md

@@ -1851,7 +1851,7 @@ by the same rule — your declaration, then the host's, then neither:
 ```jsx
 import { resolveService } from '@uniweb/kit'
 
-const { url, reason } = resolveService(website, 'assistant')   // or 'search', or your own
+const { url, source } = resolveService(website, 'assistant')   // or 'search', or your own
 ```
 
 **The name is open**: the framework ships clients for what it implements and
@@ -1870,7 +1870,9 @@ if (!url) return null          // this site has no agent — render nothing, or
 
 ⛔ **Absent is the answer, not a lookup that failed.** No `url` means the site has no agent — never enabled, or this host runs none. Render for that case; don't retry it. And don't hardcode `/_agent/chat` when nothing was declared: on a static host that turns "no agent here" into a 404 your component can't tell from a broken endpoint. The path is named above so you recognize the shape, not so you can construct it.
 
-⛔ **And don't tell the visitor.** `resolveService` also returns a `reason`, and it is **not visitor copy** — a visitor has no stake in which services the operator provisioned, and "this site has no assistant configured" reports someone's billing state to the public while reading like a breakage. It is neither. **Absence is a rendering decision, not a message**: a generic component is expected to be smart about it. No assistant → no Ask-AI affordance. No submit endpoint → no form, or degrade to a `mailto:` the site already carries in its content. The `reason` string is there for *you*, while you wire a site up.
+⛔ **And don't tell the visitor.** `resolveService` returns `{ url, source }` and **deliberately nothing else** — there is no explanatory string and there was one, removed because it was a mistake. A visitor has no stake in which services the operator provisioned, and "this site has no assistant configured" reports someone's billing state to the public while reading like a breakage. It is neither. Worse, it is unfixably the wrong language: sites here are multilingual, or unilingual and not English, and a canned constant bypasses the site's whole localization pipeline. **Absence is a rendering decision, not a message**, and a generic component is expected to be smart about it. No assistant → no Ask-AI affordance. No submit endpoint → no form, or degrade to a `mailto:` the site already carries in its content. Any text a visitor should read is *site content* — authored and localized.
+
+`source` is `'site'`, `'host'` or `null`, and it is a **diagnostic for you** while you wire a site up: it says which tier answered, which is the thing to check when a host's value appears not to be taking effect. `'host'` with a null `url` means the host answered and offered no address.
 
 *(A live agent that errors mid-conversation is a different problem — that's ordinary request failure, handled where you make the request.)*
 

package/src/backend/site-sync.js

@@ -27,6 +27,7 @@ import {
   computeUnitHashes,
   collectUnitUuids,
   collectFolderItemUuids,
+  collectCollectionUuids,
   readAssetMap
 } from '@uniweb/build/uwx'
 
@@ -241,6 +242,7 @@ export function clearRemoteSyncState(siteDir, siteUuid = null) {
   const prior = readSyncCacheFile(siteDir)
   const dropped = [
     'itemUuids',
+    'collectionUuids',
     'hashes',
     'baseVersions',
     'unitBases',
@@ -248,6 +250,9 @@ export function clearRemoteSyncState(siteDir, siteUuid = null) {
   ].filter((k) => prior[k] && Object.keys(prior[k]).length)
   updateSyncCache(siteDir, {
     itemUuids: {},
+    // Remote-derived exactly like itemUuids — it holds the OLD site's collection
+    // ids, and surviving the drop it would offer them for the new site's sections.
+    collectionUuids: {},
     hashes: {},
     baseVersions: {},
     unitBases: {},
@@ -468,6 +473,32 @@ export function readItemUuids(siteDir) {
 export function readFolderItemUuids(siteDir) {
   return readMap(siteDir, 'folderItemUuids')
 }
+
+/**
+ * Collection-declaration identity: `{ <collection name>: <backend $uuid> }`.
+ *
+ * ⛔ THE THIRD MAP, AND EACH ONE EXISTS FOR THE SAME REASON. `itemUuids` is keyed by
+ * the file an item projects to. Two kinds of item have no file of their own — a
+ * folder's placements, and a collection DECLARATION (they all live in one
+ * `collections/collections.yml`) — so a path-keyed map has no shape either could
+ * occupy, and a push re-sends that whole section uuid-less.
+ *
+ * The backend refuses an all-blank section over stored items rather than applying it,
+ * because applying it would insert every record fresh and delete every stored row —
+ * content survives, identity does not. So `push` worked once and every push after was
+ * refused. Measured 2026-08-29; collab framework-backend-812b.
+ *
+ * ⭐ Keyed by NAME, which the backend enforces unique within the section and uses as
+ * its own join key. ⛔ Not `$id`: it holds the same string but is a payload-local
+ * handle the backend skips on parse and never stores.
+ */
+export function readCollectionUuids(siteDir) {
+  return readMap(siteDir, 'collectionUuids')
+}
+export function writeCollectionUuids(siteDir, map) {
+  if (!map || !Object.keys(map).length) return
+  updateSyncCache(siteDir, { collectionUuids: map })
+}
 export function writeFolderItemUuids(siteDir, map) {
   if (!map || !Object.keys(map).length) return
   updateSyncCache(siteDir, { folderItemUuids: map })
@@ -932,18 +963,88 @@ export async function probeUnpushed(siteDir, { sendAll = false } = {}) {
   //     wrote. Reading the live file rather than a snapshot is what makes a moved
   //     map (a teammate's push, a pull) read as changed instead of matching a copy
   //     of itself.
+  //   · RECORDED — the site's own org, from `site.yml::$org`, written by the push
+  //     that banked these hashes.
+  //
+  // ⛔ THE ORG IS NOT OPTIONAL HERE, AND OMITTING IT WAS SILENT. It is what resolves
+  // a foundation-relative `@/member` into the `@org/member` the push shipped and
+  // keyed its hashes by. Without it the emit does not fail — `buildCollectionEntities`
+  // WARNS and ships the model unresolved, deliberately, so an org-less export still
+  // works — so every record of a `@/`-scoped collection is emitted under a key that
+  // can never match its banked one, and reads as changed forever.
+  //
+  // ⚠️ It hides in plain sight because `@std/…` collections are unaffected: their
+  // scope is already absolute, so they match. A site mixing both — the marketing
+  // fixture has `@std/person` AND `@proximify/member` — shows some records settling
+  // and others never settling, which reads like a content problem rather than a
+  // resolution one. Measured on matinee 2026-08-29: `status` reported 4 changed
+  // immediately after a successful push; passing the org took it to 1.
+  const pkg = await comparisonEmit(siteDir, { priorHashes, sendAll })
+  const changed =
+    (pkg.siteContent?.entityCount || 0) + (pkg.collections?.entityCount || 0)
+  return { changed, unchanged: pkg.skipped || 0, warnings: pkg.warnings || [] }
+}
+
+/**
+ * The emit whose hashes are comparable with the banked ones — ONE definition.
+ *
+ * ⛔ EVERY DEFECT IN THIS AREA HAS BEEN A WRITER AND A READER DISAGREEING ABOUT
+ * WHICH DOCUMENT A HASH DESCRIBES, so the option set that makes them agree must
+ * have a single home. Assembled from three sources, each for a stated reason:
+ *
+ *   · BANKED     the injections the push applied before hashing — serve URLs and
+ *                the pinned foundation ref, which only a round trip produces.
+ *   · RE-DERIVED asset identity, from the COMMITTED `assets.json`, so a moved map
+ *                reads as changed rather than matching a copy of itself.
+ *   · RECORDED   the site's org, which resolves a foundation-relative `@/x` into
+ *                the `@org/x` the push keyed its hashes by, and the collection
+ *                identity a push stamps — so `status` hashes the same document a
+ *                push would send rather than one missing a section's `$uuid`s.
+ *
+ * Offline by design — measured at zero HTTP requests, a property the cross-client
+ * flows rely on.
+ */
+async function comparisonEmit(siteDir, { priorHashes = {}, sendAll = false } = {}) {
   const applied = readAppliedInjections(siteDir)
   const assetIds = readAssetMap(siteDir)
-  const pkg = await emitSyncPackages(siteDir, {
+  const org = readSiteOrg(siteDir)
+  const collectionUuids = readCollectionUuids(siteDir)
+  return emitSyncPackages(siteDir, {
     resolveModel: makeModelResolver({ client: null, offline: true }),
     priorHashes,
     sendAll,
     ...applied,
-    ...(Object.keys(assetIds).length ? { assetIds } : {})
+    ...(Object.keys(collectionUuids).length ? { collectionUuids } : {}),
+    ...(Object.keys(assetIds).length ? { assetIds } : {}),
+    ...(org ? { org } : {})
   })
-  const changed =
-    (pkg.siteContent?.entityCount || 0) + (pkg.collections?.entityCount || 0)
-  return { changed, unchanged: pkg.skipped || 0, warnings: pkg.warnings || [] }
+}
+
+/**
+ * Re-bank the send-only-changed hashes over the files as they NOW stand.
+ *
+ * ⛔ FOR A WRITER THAT REWRITES THE WORKING TREE — today, `uniweb pull`.
+ *
+ * A pull projects the backend's document into source files, and that projection is
+ * canonical rather than byte-identical to what was there: it moves section ordering
+ * out of filename prefixes (`1-hero.md` → `hero.md` plus an explicit `sections:`
+ * list) and stamps each section's `id`. Lossless, and a different document.
+ *
+ * ⚠️ `pull` already knew this for the OTHER map — it clears the `local` unit base
+ * because "what we would emit from them is not byte-identical to it, so the old
+ * local base no longer describes anything". That reasoning was never carried to the
+ * hashes, which were left STALE rather than unknown: the next `uniweb status`
+ * reported the site as having unpushed content immediately after a pull, forever.
+ * Measured on matinee 2026-08-29 — `push → pull` reported 1 changed of 8.
+ *
+ * ⭐ Re-banking is the correct answer rather than clearing, because after a pull the
+ * on-disk state IS the agreed state: it came from the backend. A push with no edits
+ * in between should send nothing, and clearing would make it send everything.
+ */
+export async function rebankSyncHashes(siteDir) {
+  const pkg = await comparisonEmit(siteDir, { sendAll: true })
+  writeSyncCache(siteDir, pkg.hashes || {}, pkg.applied || {})
+  return Object.keys(pkg.hashes || {}).length
 }
 
 /**
@@ -1045,18 +1146,47 @@ export async function pushSyncPackages({
         return null
       }
       if (problem?.reason === 'identity_required') {
+        // ⛔ THE REFUSAL IS PER-SECTION, NOT PER-PUSH, AND WE USED TO SAY OTHERWISE.
+        //
+        // The backend asks, of each section independently: is this section's ENTIRE
+        // incoming record set uuid-less while the stored entity already has items in
+        // it? So a push can carry correct identity for most of the document and still
+        // be refused over one section it stamps none of — and the old wording ("this
+        // copy has no record of the site's item identity", "the recovery … could not
+        // reach the backend", "`uniweb pull` also restores it") was wrong on all
+        // three counts in exactly that case: the copy has identity, no recovery was
+        // attempted, and a pull changes nothing.
+        //
+        // ⭐ THE BACKEND ALREADY SENDS WHAT LOCATES IT — `section_id`,
+        // `records_without_uuid`, `stored_items` — and this branch discarded every
+        // one of them, so every refusal anyone collected was missing the only fields
+        // that say WHERE. (Named by backend in collab `framework-backend-812b`,
+        // 2026-08-28: "the offending section and both counts have been in the body of
+        // every refusal you have collected".)
+        const n = problem.records_without_uuid
+        const stored = problem.stored_items
+        // `section_name` landed backend-side 2026-08-28 (`90e7cd7e`), replacing an
+        // i64 row id we could not resolve. The fallback stays for an older backend,
+        // not because the swap is pending — it is done.
+        const where = problem.section_name ?? problem.section_id
         error(
-          `${label} push refused — this copy has no record of the site's item identity.`
-        )
-        note(
-          'Nothing was written. Pushing without it would have replaced the identity of every stored item.'
-        )
-        note(
-          'The recovery normally runs automatically, so it likely could not reach the backend.'
+          `${label} push refused — one section carries no item identity` +
+            (where === undefined ? '.' : ` (section ${where}).`)
         )
+        if (Number.isInteger(n) && Number.isInteger(stored)) {
+          note(
+            `That section sent ${n} record(s), none carrying a \`$uuid\`, while ${stored} item(s) are already stored there.`
+          )
+        }
         note(
-          'Check your connection and re-run; `uniweb pull` also restores it.'
+          'Nothing was written. Applying it would have replaced the identity of every stored item in that section.'
         )
+        // ⚠️ Deliberately NOT "run `uniweb pull`". A pull re-harvests identity from
+        // the backend's own document, so it fixes a LOST cache — and does nothing at
+        // all when the cache is intact and one section simply has no entry in it,
+        // which is the case this message now names. Suggesting it there sends the
+        // user to re-fetch a map they already have.
+        if (problem.detail) note(String(problem.detail))
         return null
       }
       if (problem?.reason === 'stale_base') {
@@ -1246,6 +1376,16 @@ export async function pushSyncPackages({
       }
       harvest(finalized)
       siteFinalizedDoc = finalized[0]?.document || null
+      // ⭐ BANK COLLECTION-DECLARATION IDENTITY, the sibling of the folder's
+      // placements below. These items have no file to back-fill into — they all
+      // come from one `collections/collections.yml` — so the only place their
+      // `$uuid` can live is the cache, keyed by the name the backend enforces
+      // unique. Without it every push after the first re-sends the whole
+      // `collections` section uuid-less and is refused.
+      if (siteFinalizedDoc) {
+        const collectionIds = collectCollectionUuids(siteFinalizedDoc)
+        if (Object.keys(collectionIds).length) writeCollectionUuids(siteDir, collectionIds)
+      }
       finalizedTotal += finalized.length
     } else {
       const payload = await postLane('site-content', () =>

package/src/commands/pull.js

@@ -75,7 +75,8 @@ import {
   resolveCollectionsConfig,
   readZip,
   computeUnitHashes,
-  collectUnitUuids
+  collectUnitUuids,
+  collectCollectionUuids
 } from '@uniweb/build/uwx'
 import {
   readWritten,
@@ -84,6 +85,8 @@ import {
 } from '../utils/pull-written.js'
 import {
   makeModelResolver,
+  rebankSyncHashes,
+  writeCollectionUuids,
   mergeBaseVersions,
   mergeItemBaseVersions,
   writeUnitBases,
@@ -686,6 +689,10 @@ export async function pull(args = [], deps = {}) {
       // Per-item identity for the next push. Without it the backend reads our
       // records as new and re-mints every page and section row.
       writeItemUuids(siteDir, collectUnitUuids(siteDoc))
+      // The collections section's identity has no file to live in either — same
+      // reason, same remedy, keyed by name. A pull is the other route by which a
+      // copy can recover it (see readCollectionUuids).
+      writeCollectionUuids(siteDir, collectCollectionUuids(siteDoc))
       // Bring the media down BEFORE projecting: a newly-landed asset gains a map
       // entry, and the projection reads that map to put authored paths back. Run
       // after, and this pull's new assets would project as URLs and only restore
@@ -840,6 +847,33 @@ export async function pull(args = [], deps = {}) {
     removed
   )
 
+  // ⛔ RE-BANK THE SEND-ONLY-CHANGED HASHES OVER WHAT WE JUST WROTE.
+  //
+  // The projection above is canonical, not byte-identical to what was on disk: it
+  // moves section ordering out of filename prefixes (`1-hero.md` → `hero.md` plus an
+  // explicit `sections:` list) and stamps each section's `id`. Lossless, and a
+  // different document — which is exactly why the `local` unit base is cleared above.
+  //
+  // ⚠️ That same reasoning was never carried to the hashes, so they were left STALE
+  // rather than unknown, and `uniweb status` reported unpushed content immediately
+  // after a pull, permanently. Measured on matinee 2026-08-29: push → pull reported
+  // 1 changed of 8, with nothing edited in between.
+  //
+  // Re-banking rather than clearing, because after a pull the on-disk state IS the
+  // agreed state — it came from the backend, so a push with no edits should send
+  // nothing. Clearing would make it send everything.
+  //
+  // Best-effort: a failure here costs an unnecessary re-send on the next push, never
+  // wrong content, and must not fail a pull whose files are already written.
+  if (!dryRun) {
+    try {
+      await rebankSyncHashes(siteDir)
+    } catch (err) {
+      note(`! could not re-bank the sync cache: ${err.message}`)
+      note('  The next push will re-send content that is already current.')
+    }
+  }
+
   success(
     `Pulled — ${pages} page(s), ${sections} section(s), ${records} record(s)` +
       (deleted ? `, ${deleted} deleted` : '')

package/src/commands/push.js

@@ -85,6 +85,7 @@ import {
   readItemBaseVersions,
   readItemUuids,
   readFolderItemUuids,
+  readCollectionUuids,
   ensureItemUuids,
   ensureSiteExists,
   clearRemoteSyncStateIfUnbound,
@@ -474,6 +475,9 @@ export async function push(args = [], deps = {}) {
     pkg = await emitSyncPackages(siteDir, {
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir),
+      // Identity for the `collections` section — see readCollectionUuids. Keyed by
+      // name, because a declaration has no file for a path-keyed map to hold.
+      collectionUuids: readCollectionUuids(siteDir),
       // Resolves a foundation-relative `@/x` model ref into `@org/x`.
       ...(asOrg ? { org: asOrg } : {}),
       ...(foundationDir ? { foundationDir } : {}),

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-28T13:37:15.824Z",
+  "generatedAt": "2026-08-28T23:49:23.885Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.28.2",
+      "version": "0.29.1",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -102,7 +102,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.9.6",
+      "version": "0.10.0",
       "path": "framework/templates",
       "deps": []
     },
@@ -112,7 +112,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.8.15",
+      "version": "0.8.16",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/utils/registry-auth.js

@@ -225,11 +225,6 @@ export async function ensureRegistryAuth({
   return record.token
 }
 
-// The browser/OAuth flow is wired below (loginViaBrowser: a loopback redirect
-// against the backend's /dev/auth/cli/authorize, token-in-redirect). Kept
-// gated until that endpoint is live on the backend — flip to true then, and the
-// picker offers Browser/social as the default (and `--browser` works).
-const BROWSER_AVAILABLE = false
 
 /**
  * GET /dev/auth/me with a bearer → the account object ({ uuid, username,
@@ -423,45 +418,90 @@ export async function awaitBrowserCallback({
   return result.value
 }
 
-// Browser / social — loopback OAuth against the backend's /dev/auth/authorize.
-// The CLI hosts a one-shot 127.0.0.1 server (awaitBrowserCallback), opens the
-// browser to authorize, and the backend (after the Google dance) 302s back to
-// the loopback with the token (or an error). state is a CSRF nonce echoed back
-// and verified. The token never leaves browser→localhost. Gated by
-// BROWSER_AVAILABLE until the endpoint is live.
+// Browser / social — the backend's CLI delegation flow. The CLI never speaks to
+// an identity provider and holds no client id, secret or provider knowledge: it
+// opens ONE url (the backend's), catches a one-time code on a loopback, and
+// trades that code for a bearer. Whatever methods the backend's own sign-in page
+// offers — password, Google, Microsoft, anything added later — the CLI gains with
+// no change here, because it never learns which one was used.
+//
+// Three legs, all verified against a live backend rather than read:
+//
+//   GET  {base}/dev/auth/authorize?callback=<loopback>&state=<nonce>
+//          no session → 302 {hub}/login?returnTo=…   (the ordinary sign-in page)
+//          session    → 302 <callback>?state=<ours>&code=<one-time>
+//   POST {base}/dev/auth/token  {code}  → { token, expires_at, account }
+//
+// ⛔ `callback` IS THE PARAMETER NAME, not `redirect_uri` — the backend serves
+// this route and rejects the other spelling with a 400. ⛔ AND THE CALLBACK
+// CARRIES A `code`, NEVER A TOKEN: the bearer is born on the POST, server-to-CLI,
+// so it never touches the browser, the URL bar, history or a proxy log. Both were
+// wrong here for three months — this code was written against an anticipated
+// shape five days before the backend shipped, and being gated meant nothing could
+// contradict it.
+//
+// ⛔ The loopback MUST be a v4 literal. `awaitBrowserCallback` binds 127.0.0.1
+// explicitly and composes `http://127.0.0.1:<port>/callback`; the backend's
+// validator accepts `http://` only, host exactly `127.0.0.1` or `localhost`, and
+// refuses `[::1]` and any `user@host` (that last guard stops
+// `http://127.0.0.1:1@evil.com/cb` from walking off with the code). Do not
+// "modernise" the bind to `::`.
 async function loginViaBrowser({ apiBase }) {
-  if (!BROWSER_AVAILABLE) {
-    throw new Error(
-      'browser/social login for the new backend isn’t available yet — use --password or --token-paste.'
-    )
-  }
   const base = apiBase.replace(/\/$/, '')
   const state = randomBytes(16).toString('hex')
 
-  const token = await awaitBrowserCallback({
-    buildUrl: (redirectUri) =>
-      `${base}/dev/auth/authorize?redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`,
+  // Leg 1+2 — open the backend's authorize url, catch the one-time code.
+  const code = await awaitBrowserCallback({
+    buildUrl: (callback) =>
+      `${base}/dev/auth/authorize?callback=${encodeURIComponent(callback)}&state=${state}`,
     validate: (params) => {
       if (params.get('error')) return { error: params.get('error') }
+      // Check `state` BEFORE reading anything else: it is the only thing that
+      // ties this callback to the request we made.
       if (params.get('state') !== state)
         return { error: 'state mismatch — please try again.' }
-      const tok = params.get('token')
-      if (!tok) return { error: 'no token returned by the callback.' }
-      return { value: tok }
+      const code = params.get('code')
+      if (!code) return { error: 'no code returned by the callback.' }
+      return { value: code }
     },
     openingLabel: 'Opening your browser to sign in…',
-    waitingLabel: 'Waiting for sign-in to complete (120s)…',
+    waitingLabel: 'Waiting for sign-in to complete (5 min)…',
+    // A person is signing in at an identity provider, not clicking one button:
+    // a first-time Google or Microsoft login can carry a consent screen, an
+    // account chooser and 2FA. The default 120s expires mid-flow and reports a
+    // TIMEOUT, which reads as "the CLI is broken" rather than "you were slow".
+    // Same reasoning, and the same value, as the publish payment handoff.
+    timeoutMs: 5 * 60 * 1000,
     okTitle: 'Login successful',
     errTitle: 'Login failed'
   })
 
-  let account = null
-  try {
-    account = await fetchMe({ apiBase, token })
-  } catch {
-    /* identity optional; token is valid */
+  // Leg 3 — trade the code for a bearer. Anonymous: the code IS the credential,
+  // and it is single-use, so a replay gets a 400 rather than a second session.
+  const res = await fetch(`${base}/dev/auth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ code })
+  })
+  const payload = await res.json().catch(() => null)
+  if (!res.ok || !payload?.token) {
+    const detail = payload?.detail || payload?.title || `HTTP ${res.status}`
+    throw new Error(`could not complete sign-in: ${detail}`)
   }
-  const record = { token, origin: normOrigin(apiBase) }
+
+  // The token response already carries the account, so no second round trip.
+  // `fetchMe` remains the fallback for a backend that answers without one.
+  let account = payload.account || null
+  if (!account) {
+    try {
+      account = await fetchMe({ apiBase, token: payload.token })
+    } catch {
+      /* identity is optional; the bearer is valid either way */
+    }
+  }
+
+  const record = { token: payload.token, origin: normOrigin(apiBase) }
+  if (payload.expires_at) record.expiresAt = payload.expires_at
   if (account?.uuid) record.uuid = account.uuid
   if (account?.username) record.username = account.username
   if (account?.handle) record.handle = account.handle
@@ -549,11 +589,10 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     } else {
       const prompts = (await import('prompts')).default
       const choices = []
-      if (BROWSER_AVAILABLE)
-        choices.push({
-          title: 'Browser / social (Google, etc.)',
-          value: 'browser'
-        })
+      choices.push({
+        title: 'Browser / social (Google, Microsoft, …)',
+        value: 'browser'
+      })
       choices.push({ title: 'Username and password', value: 'password' })
       choices.push({ title: 'Paste a token', value: 'token-paste' })
       const { picked } = await prompts(