uniweb 0.43.0 → 0.44.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "^0.21.0",
-    "@uniweb/kit": "^0.15.8",
-    "@uniweb/runtime": "^0.16.0",
+    "@uniweb/core": "^0.22.0",
+    "@uniweb/kit": "^0.16.0",
+    "@uniweb/runtime": "^0.17.0",
     "@uniweb/semantic-parser": "^1.4.0"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.39.0",
-    "@uniweb/semantic-parser": "^1.4.0",
-    "@uniweb/content-reader": "^1.2.4"
+    "@uniweb/build": "^0.40.0",
+    "@uniweb/content-reader": "^1.2.4",
+    "@uniweb/semantic-parser": "^1.4.0"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -952,7 +952,7 @@ function MyComponent({ content, params, block }) {
 }
 ```
 
-Frontmatter becomes `params`, minus the keys the framework consumes outright: `type` (and its legacy alias `component`), `preset`, `input`, `props`, `fetch`, `data`, `id`. `props:` is the one that isn't dropped but merged *into* params.
+Frontmatter becomes `params`, minus the keys the framework consumes outright: `type`, `preset`, `input`, `props`, `fetch`, `data`, `id`. `props:` is the one that isn't dropped but merged *into* params.
 
 **Framework fields you'd expect to be stripped are not.** `background`, `theme`, `source`, `where`, and `vars` are acted on by the runtime *and* passed through — so `params.theme` is readable when a component needs logic beyond CSS tokens (a light vs. dark logo, say). Components ignore the keys they don't use, the same way they ignore unused `content.data` keys.
 
@@ -1844,10 +1844,10 @@ search:
 ```yaml
 search:
   provider: endpoint
-  endpoint: _search      # optional; base-RELATIVE, so one spelling works everywhere
+  endpoint: _search      # REQUIRED — there is no default
 ```
 
-`endpoint:` resolves against the site's base path — `/` → `/_search`, `base: /docs/` → `/docs/_search`, a subpath-served site follows its subpath. An absolute `https://…` URL points at another origin.
+`endpoint:` is **required** with `provider: endpoint`; omit it and the provider refuses the query rather than guessing a path. It resolves against the site's base path — `/` → `/_search`, `base: /docs/` → `/docs/_search`, a subpath-served site follows its subpath. An absolute `https://…` URL points at another origin. A host that serves the site may offer search itself, supplying the address so the site declares none.
 
 **Results have one shape, whatever the provider.** Always present: `id`, `type`, `route`, `href`, `title`, `pageTitle`, `excerpt`, `snippetHtml`. Provider-optional (`null` when absent): `sectionId`, `anchor`, `description`, `component`, `snippetText`, `matches`, `collection`, `item`. Whether an optional field arrives is a deployment fact, not a content fact — the same site yields `item` from a server provider and `null` from the local index — so guard them: `result.item?.image`.
 

package/src/backend/client.js

@@ -8,7 +8,7 @@
  * owns the three things that were previously scattered across a dozen files:
  *
  *   1. ORIGIN   — where the backend is. resolveBackendOrigin(): an explicit
- *                 flag (`--backend` / `--registry`) > UNIWEB_REGISTER_URL >
+ *                 flag (`--backend`) > UNIWEB_REGISTER_URL >
  *                 the local default. Any full URL is reduced to its origin.
  *   2. AUTH     — the opaque session bearer (utils/registry-auth.js). Resolved
  *                 LAZILY on the first authed call, so dry-runs and fully-local
@@ -46,7 +46,7 @@ import { uploadSiteAssets } from '../utils/asset-upload.js'
  * first). A full URL is reduced to its origin, so callers may pass a whole
  * endpoint URL; an unparseable value falls through to the next tier.
  *
- *   1. `flag` — the raw --backend / --registry value (this command)
+ *   1. `flag` — the raw --backend value (this command)
  *   2. UNIWEB_REGISTER_URL env — session-wide override (CI / local dev)
  *   3. `siteScope` — the project's `site.yml::$backend` (site verbs)
  *   4. `siteBackend` — the site's bound backend from deploy.yml (site verbs)
@@ -70,7 +70,7 @@ import { uploadSiteAssets } from '../utils/asset-upload.js'
  * be able to veto a flag the user just typed. A wrong aim is then caught by the guard
  * rather than silently redirected.
  *
- * @param {string} [flag] - the raw value of --backend / --registry, if supplied
+ * @param {string} [flag] - the raw value of --backend, if supplied
  * @param {object} [opts]
  * @param {string} [opts.siteScope] - the project's `site.yml::$backend`
  * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend origin
@@ -143,7 +143,7 @@ export class BackendClient {
   /**
    * @param {object} [opts]
    * @param {string} [opts.origin] - explicit origin (wins over originFlag/env)
-   * @param {string} [opts.originFlag] - raw --backend/--registry value to resolve
+   * @param {string} [opts.originFlag] - raw --backend value to resolve
    * @param {string} [opts.siteScope] - the project's `site.yml::$backend` (site verbs)
    * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend (site verbs)
    * @param {string} [opts.token] - explicit bearer (wins over env + stored session)

package/src/backend/foundation-bring-along.js

@@ -148,7 +148,7 @@ function readPkgField(dir, field) {
 // hits the SAME backend with the SAME session as the publish that called it.
 function forwardedFlags(args) {
   const out = []
-  for (const name of ['--backend', '--registry', '--token']) {
+  for (const name of ['--backend', '--token']) {
     const v = readFlagValue(args, name)
     if (v) out.push(name, v)
   }

package/src/commands/clone.js

@@ -40,7 +40,7 @@
  *   uniweb clone <uuid> --no-records Pull pages only; skip records
  *
  * Backend: via BackendClient (the site-content pull lane). Origin from
- *   --registry  >  UNIWEB_REGISTER_URL  >  the local default (internal dev overrides;
+ *   UNIWEB_REGISTER_URL  >  the local default (internal dev overrides;
  *   not the user-facing path — `uniweb login` determines the origin).
  * Auth:  --token  >  UNIWEB_TOKEN  >  `uniweb login` session.
  */
@@ -190,7 +190,7 @@ export async function clone(args = [], deps = {}) {
   const projectFlag = flagValue(args, '--project')
   const tokenFlag = flagValue(args, '--token')
   const explicitBackend =
-    flagValue(args, '--backend') || flagValue(args, '--registry')
+    flagValue(args, '--backend')
   const client = new BackendClient({
     originFlag: explicitBackend,
     token: tokenFlag,

package/src/commands/publish.js

@@ -20,7 +20,7 @@
  * Distinct from `uniweb deploy` (third-party hosts) and `uniweb register`
  * (foundation code → catalog). For a self-contained artifact, see `uniweb export`.
  *
- * Backend: BackendClient. Origin from --backend/--registry > UNIWEB_REGISTER_URL
+ * Backend: BackendClient. Origin from --backend > UNIWEB_REGISTER_URL
  * > default. Auth: --token > UNIWEB_TOKEN > `uniweb login` session.
  *
  * Usage:
@@ -214,7 +214,7 @@ export async function publish(args = []) {
 
   const client = new BackendClient({
     originFlag:
-      readFlagValue(args, '--backend') || readFlagValue(args, '--registry'),
+      readFlagValue(args, '--backend'),
     siteScope,
     siteBackend,
     token: readFlagValue(args, '--token') || undefined,

package/src/commands/pull.js

@@ -41,12 +41,11 @@
  *   uniweb pull --merge                  Three-way merge local changes with the backend's
  *   uniweb pull --force                  Pull over uncommitted local changes (discards them)
  *   uniweb pull --dry-run                Report what it would GET; write nothing
- *   uniweb pull --registry <url>         Override the backend origin
  *   uniweb pull --token <bearer>         Read with this bearer; skips `uniweb login`
  *
  * Backend: via BackendClient (the content + folder pull lanes), both keyed by
  *   `site.yml::$uuid`. Origin from
- *   --registry  >  UNIWEB_REGISTER_URL  >  the local default.
+ *   UNIWEB_REGISTER_URL  >  the local default.
  * Auth:  --token  >  UNIWEB_TOKEN  >  `uniweb login` session.
  *
  * A project that never pushed has no `$uuid` to pull by — pull is a no-op with a
@@ -562,7 +561,7 @@ export async function pull(args = [], deps = {}) {
   const siteScope = readSiteIdentity(siteDir).backend
   const siteBackend = await resolveSiteBackend(siteDir)
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend') || flagValue(args, '--registry'),
+    originFlag: flagValue(args, '--backend'),
     siteScope,
     siteBackend,
     token: tokenFlag,

package/src/commands/push.js

@@ -37,7 +37,6 @@
  *                                        this prompt existed. First push only.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
- *   uniweb push --registry <url>         Override the backend origin
  *   uniweb push --token <bearer>         Submit with this bearer; skips `uniweb login`
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
  *   uniweb push --all                    Send every record (bypass the changed-only cache)
@@ -51,7 +50,7 @@
  * would be hard-deleted). `--force` omits the token and restores last-push-wins.
  *
  * Backend: via BackendClient (the content + folder sync lanes). Origin from
- *   --registry  >  UNIWEB_REGISTER_URL  >  the local default.
+ *   UNIWEB_REGISTER_URL  >  the local default.
  * Auth:  --token  >  UNIWEB_TOKEN  >  `uniweb login` session.
  *
  * The two-lane SUBMISSION (POST both lanes, back-fill uuids, persist the
@@ -168,7 +167,7 @@ export async function push(args = [], deps = {}) {
   // (the `offline` flag below), so it never authenticates — even when a collection
   // references a Model the local foundation doesn't define.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend') || flagValue(args, '--registry'),
+    originFlag: flagValue(args, '--backend'),
     siteScope,
     siteBackend,
     token: tokenFlag,

package/src/commands/refresh.js

@@ -166,7 +166,6 @@ export async function refresh(args = [], deps = {}) {
     // same section is not a conflict, and should not be presented as one.
     const passthrough = collectPassthrough(args, [
       '--backend',
-      '--registry',
       '--token'
     ])
     const res = await pull(['--merge', ...passthrough])

package/src/commands/register.js

@@ -30,10 +30,10 @@
  *   uniweb register --json               Porcelain: ONE compact JSON line on stdout
  *                                        ({ok,scope,origin,entities:[{name,uuid,version,unchanged}]}),
  *                                        all human output to stderr — for scripted callers
- *   uniweb register --backend <url>      Override the backend origin (alias: --registry)
+ *   uniweb register --backend <url>      Override the backend origin
  *   uniweb register --token <bearer>     Submit with this bearer; skips `uniweb login`
  *
- * Endpoint resolution: --backend <url> (alias --registry)  >  UNIWEB_REGISTER_URL  >
+ * Endpoint resolution: --backend <url>  >  UNIWEB_REGISTER_URL  >
  *   the logged-in session origin  >  ~/.uniweb/config.json  >  the default (uniweb.app).
  * Auth (submit only):  --token <bearer>  >  UNIWEB_TOKEN  >  `uniweb login` session.
  */
@@ -389,10 +389,10 @@ async function runRegister(args = []) {
   const output = flagValue(args, '-o') || flagValue(args, '--output')
   const scopeFlag = flagValue(args, '--scope')
   const tokenFlag = flagValue(args, '--token')
-  // Origin: --backend and --registry are aliases (matches deploy/publish + the
+  // Origin: --backend (matches deploy/publish + the
   // origin-selection convention); either overrides UNIWEB_REGISTER_URL / default.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend') || flagValue(args, '--registry'),
+    originFlag: flagValue(args, '--backend'),
     token: tokenFlag,
     args,
     command: 'Registering'
@@ -615,7 +615,7 @@ async function runRegister(args = []) {
   } catch (err) {
     error(`Could not reach the registry at ${client.origin}: ${err.message}`)
     log(
-      `  ${colors.dim}Set the endpoint with --backend/--registry <url> or UNIWEB_REGISTER_URL.${colors.reset}`
+      `  ${colors.dim}Set the endpoint with --backend <url> or UNIWEB_REGISTER_URL.${colors.reset}`
     )
     return { exitCode: 2 }
   }

package/src/commands/status.js

@@ -109,7 +109,7 @@ export async function status(args = []) {
     try {
       const client = new BackendClient({
         originFlag:
-          readFlagValue(args, '--backend') || readFlagValue(args, '--registry'),
+          readFlagValue(args, '--backend'),
         siteScope: readSiteIdentity(siteDir).backend,
         siteBackend: await resolveSiteBackend(siteDir),
         token: readFlagValue(args, '--token') || undefined,

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-05T21:35:23.203Z",
+  "generatedAt": "2026-09-06T17:33:37.422Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.2.7",
+      "version": "0.2.8",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.39.0",
+      "version": "0.40.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -34,7 +34,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.21.0",
+      "version": "0.22.0",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -47,14 +47,14 @@
       "deps": []
     },
     "@uniweb/icons": {
-      "version": "0.4.12",
+      "version": "0.4.13",
       "path": "framework/icons",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/kit": {
-      "version": "0.15.8",
+      "version": "0.16.0",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -73,7 +73,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.5.9",
+      "version": "0.5.10",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -81,7 +81,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.16.0",
+      "version": "0.17.0",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -119,7 +119,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.9.5",
+      "version": "0.9.6",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -803,7 +803,7 @@ async function main() {
   }
 
   // Handle login command — the backend (username/password · paste a token ·
-  // --token <bearer>). Origin from --backend/--registry > UNIWEB_REGISTER_URL >
+  // --token <bearer>). Origin from --backend > UNIWEB_REGISTER_URL >
   // default, the SAME resolver register/push/pull/deploy use, so a session and
   // the commands that reuse it always target one backend.
   if (command === 'login') {
@@ -812,8 +812,7 @@ async function main() {
     const { readFlagValue } = await import('./utils/args.js')
     const { runRegistryLogin } = await import('./utils/registry-auth.js')
     const originFlag =
-      readFlagValue(loginArgs, '--backend') ||
-      readFlagValue(loginArgs, '--registry')
+      readFlagValue(loginArgs, '--backend')
     const apiBase = resolveBackendOrigin(originFlag)
 
     // ⭐ The project says where it belongs — say so BEFORE authenticating elsewhere.
@@ -826,7 +825,7 @@ async function main() {
     // routed-not-nagged case `$backend` was added for, missing at the one command a
     // teammate runs FIRST after cloning.
     //
-    // ⛔ Silent when the origin was named explicitly (--backend / --registry /
+    // ⛔ Silent when the origin was named explicitly (--backend /
     // UNIWEB_REGISTER_URL). A deliberate aim is not a mistake to warn about; a genuinely
     // wrong one is still caught by the session-mismatch guard in BackendClient.token().
     if (!originFlag && !process.env.UNIWEB_REGISTER_URL) {
@@ -1520,7 +1519,7 @@ ${colors.bright}Options:${colors.reset}
   --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
-  --backend <url>    Backend origin (alias: --registry; default: \$UNIWEB_REGISTER_URL or a local URL)
+  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or a local URL)
   --token <bearer>   Submit with this bearer; skips \`uniweb login\` (or set UNIWEB_TOKEN)
   --non-interactive  Fail with usage info instead of prompting
 

package/src/utils/args.js

@@ -30,7 +30,7 @@
  * said `--as-unit` and a second reader said `--org`; nobody produced `--as-org`.
  * Since the flag's main job is answering *who owns this site*, `--org` is the name
  * that matches the question, and the alias costs one `||` (the same shape
- * `--backend` / `--registry` already uses).
+ * `--backend` already uses).
  *
  * `||`, not `??`, on purpose: a valueless `--org` falls through to `--as-org`
  * rather than shadowing it.

package/src/utils/flag-guard.js

@@ -55,7 +55,7 @@ const VIA_DEPLOY = ['--target', '--host', '--no-save']
 const VERBS = {
   push: [
     '--all', '--as-org', '--org', '--backend', '--dry-run', '--force',
-    '--foundation', '--output', '-o', '--personal', '--registry', '--token',
+    '--foundation', '--output', '-o', '--personal', '--token',
     // read in utils/conformance.js and backend/site-sync.js respectively —
     // neither appears in push.js
     '--no-validate', '--yes',
@@ -69,7 +69,7 @@ const VERBS = {
   ],
   publish: [
     '--as-org', '--org', '--backend', '--dry-run', '--force', '--foundation',
-    '--personal', '--registry', '--token',
+    '--personal', '--token',
     // read in utils/conformance.js, backend/site-sync.js, and
     // backend/foundation-bring-along.js — none appear in publish.js
     '--no-validate', '--yes', '--no-verify', '--no-release', ...VIA_DEPLOY
@@ -77,20 +77,20 @@ const VERBS = {
   pull: [
     '--backend', '--content-only', '--dry-run', '--force', '--merge',
     '--no-assets',
-    '--no-records', '--no-delete', '--no-prune', '--registry', '--token',
+    '--no-records', '--no-delete', '--no-prune', '--token',
     // via backend/site-sync.js (the owner resolver) and utils/conformance.js
     '--yes', '--org', '--as-org', '--no-validate', ...VIA_DEPLOY
   ],
   clone: [
     '--backend', '--content-only', '--no-assets', '--no-records', '--path',
-    '--project', '--registry', '--token', '--org', '--as-org'
+    '--project', '--token', '--org', '--as-org'
   ],
   register: [
-    '--backend', '--dry-run', '--json', '--output', '-o', '--registry',
+    '--backend', '--dry-run', '--json', '--output', '-o',
     '--schema-only', '--scope', '--token', '--org', '--as-org'
   ],
   status: [
-    '--backend', '--json', '--registry', '--remote', '--token', '--dry-run',
+    '--backend', '--json', '--remote', '--token', '--dry-run',
     '--force', '--no-verify', '--no-validate', '--yes', '--org', '--as-org',
     // inert here, reachable through the bring-along module status imports for
     // `resolveLocalFoundation` — listed per the over-approximation note above
@@ -99,7 +99,7 @@ const VERBS = {
   /**
    * `refresh` = `git pull`, then a DELEGATED `pull --merge`.
    *
-   * It forwards exactly three flags to that pull — `--backend` / `--registry` /
+   * It forwards exactly two flags to that pull — `--backend` /
    * `--token`, via its own `collectPassthrough` — and constructs the rest of the
    * argv itself. So pull's own flags (`--merge`, `--force`, `--no-delete`,
    * `--no-prune`, `--content-only`, …) are NOT reachable from a `refresh` argv and
@@ -111,7 +111,7 @@ const VERBS = {
    * the VIA_DEPLOY note above, and required by `flag-guard-coverage.test.js`.
    */
   refresh: [
-    '--backend', '--no-backend', '--no-git', '--registry', '--token',
+    '--backend', '--no-backend', '--no-git', '--token',
     '--as-org', '--org', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
   ]
 }