uniweb 0.47.1 → 0.47.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "^0.24.1",
     "@uniweb/kit": "^0.18.0",
+    "@uniweb/core": "^0.24.2",
     "@uniweb/semantic-parser": "^1.4.0",
-    "@uniweb/runtime": "^0.19.1"
+    "@uniweb/runtime": "^0.19.3"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.43.0",
     "@uniweb/content-reader": "^1.2.4",
-    "@uniweb/semantic-parser": "^1.4.0"
+    "@uniweb/semantic-parser": "^1.4.0",
+    "@uniweb/build": "^0.43.1"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/partials/agents.md

@@ -458,6 +458,29 @@ Read the markdown out loud. If an author would understand what every line does,
 
 **Parameter naming matters.** Would an author understand it without reading code? `columns: 3` yes, `gridCols: 3` no. `variant: centered` yes, `renderMode: flex-center` no. `align: left` yes, `contentAlignment: flex-start` no.
 
+### Repeated values — `placeholders:`
+
+A value that appears on many pages goes in `site.yml` once, not in a dozen markdown files:
+
+```yaml
+placeholders:
+  product: Uniweb
+  vendor:
+    email: billing@acme.example
+```
+
+Any page then references it by name — `Write to {vendor.email}.` Dot paths work, and a record's own field of the same name always wins, so `{title}` on an article page is that article's title regardless of what the site declares.
+
+⛔ **Resolution is a foundation capability, not a framework one.** `{…}` is resolved by the foundation's `handlers.content` hook — normally `createLoomHandlers` from `@uniweb/loom`. Under a foundation without one, `placeholders:` is inert and pages render the literal `{vendor.email}`, which reads as a typo. The build warns when a site declares the key and the foundation has no content handler.
+
+```js
+// main.js — a foundation opts in
+import { createLoomHandlers } from '@uniweb/loom'
+export default { handlers: createLoomHandlers({ vars: (data) => data?.profile?.[0] }) }
+```
+
+Placeholders are the simplest case of a larger language: the same expressions filter, sort, count and format live data (`{COUNT OF publications WHERE refereed}`). Reach for one when a value repeats; reach for the rest when content is genuinely derived from records.
+
 ### Icons
 
 Image syntax with a library prefix — **two interchangeable spellings, the same everywhere** (markdown, and Kit's `<Icon name>`):

package/src/backend/payment-handoff.js

@@ -29,8 +29,24 @@
  * timeout and then reported "payment was not completed", which was false.
  */
 
-/** Reasons the CLI knows how to act on. An ALLOWLIST, never an inventory. */
-const ACTIONABLE_REASONS = new Set(['no_subscription'])
+/**
+ * ⛔ THE DOOR IS THE URL, NOT THE REASON — and this replaced a reason allowlist.
+ *
+ * The rule the allowlist served is right and survives: **never route to a purchase
+ * surface from the ABSENCE of a recognised token.** But the hazard it guarded was
+ * INFERRING a door from silence, and when the backend NAMES a URL there is no
+ * inference left — an explicit remedy is the affirmative signal the allowlist was
+ * standing in for.
+ *
+ * ⚠️ Keeping it had turned into the opposite failure. The reason set is open by
+ * design ("includes"), so every new one — `pending_request` today — fell through to
+ * `stop` and the owner was shown a sentence **with no link**, for a door the
+ * backend had handed us. A stale allowlist now fails by WITHHOLDING help.
+ *
+ * ⇒ What remains is a shape rule, not a vocabulary one: open exactly what you were
+ * handed, when it is an absolute http(s) URL, or say exactly what you were told.
+ */
+const OPENABLE = /^https?:\/\//i
 
 /**
  * Read a `402` from the publish call and decide what the CLI does. Pure — no
@@ -93,21 +109,46 @@ export function readPaymentRefusal({ status, contentType = '', body = '' } = {})
       ? problem.reason
       : null
 
-  if (!reason || !ACTIONABLE_REASONS.has(reason)) {
-    return { kind: 'stop', reason, message }
-  }
+  // ⛔ ONLY A `problem+json` BODY CARRIES A DOOR, and this gate is NOT the reason
+  // allowlist that used to sit here — it is the other, narrower protection that
+  // was tangled up with it.
+  //
+  // The backend's refusals wear `application/problem+json` and say so as a stable
+  // guarantee. A plain `application/json` 402 is some other shape from some other
+  // part of the wire — and one of those carries `status` as a STRING where a
+  // problem body carries the number, so the two are not distinguishable by their
+  // fields. Reading a URL out of a body that never promised this envelope is how
+  // a `settle` gets synthesised from something that is not a refusal at all.
+  if (!isProblem) return { kind: 'stop', reason, message }
+
+  // The door, if one was handed over. `remedy_url` is the current spelling — ONE
+  // key for every reason, which is what lets a reason we have never heard of still
+  // reach its remedy.
+  //
+  // ⚖️ `settlement.url` is the older shape and is still read. Not an alias we
+  // maintain: it is what a backend that has not moved yet still serves, and
+  // dropping the read would take away a door those deployments have today. New
+  // code never emits it and nothing here prefers it.
+  const legacy = problem.settlement
+  const candidate =
+    (typeof problem.remedy_url === 'string' && problem.remedy_url) ||
+    (legacy && typeof legacy.url === 'string' && legacy.url) ||
+    null
 
-  // Actionable — but only if the backend actually handed over somewhere to go.
-  // A recognised reason with no settlement block is a backend that has not
-  // built that half yet: still a stop, and still with its own sentence.
-  const s = problem.settlement
-  const url = s && typeof s.url === 'string' && s.url ? s.url : null
+  // ⛔ ONLY AN ABSOLUTE http(s) URL IS OPENED, and this is a safety rule rather
+  // than a compatibility one. The value arrives over the network and is handed to
+  // the platform's URL opener; a `file:` or a `javascript:` URL is not a place a
+  // person goes. Refusing them costs a legitimate backend nothing.
+  const url = candidate && OPENABLE.test(candidate) ? candidate : null
   if (!url) return { kind: 'stop', reason, message }
 
   return {
     kind: 'settle',
     url,
-    handle: s && typeof s.handle === 'string' && s.handle ? s.handle : null,
+    handle:
+      legacy && typeof legacy.handle === 'string' && legacy.handle
+        ? legacy.handle
+        : null,
     reason,
     message
   }
@@ -132,7 +173,7 @@ export async function reportPaymentRefusal({ verdict, args = [], say, open }) {
   // The backend's own sentence is the HEADLINE when there is one. A generic
   // lead would be wrong as often as right — "payment is required" does not
   // describe a declined card — and `detail` is written for this reader.
-  say.err(verdict.message || 'This site cannot go live until it is paid for.')
+  say.err(verdict.message || 'This site cannot go live yet.')
 
   if (verdict.kind !== 'settle') {
     // The push completed before go-live, so the content is safely stored.
@@ -142,19 +183,22 @@ export async function reportPaymentRefusal({ verdict, args = [], say, open }) {
 
   const { isNonInteractive } = await import('../utils/interactive.js')
   if (isNonInteractive(args)) {
-    say.dim(`Complete it in a browser, then re-run \`uniweb publish\`:`)
+    say.dim(`Finish this in a browser, then re-run \`uniweb publish\`:`)
     say.dim(`  ${verdict.url}`)
     return { opened: false }
   }
 
   const openBrowser = open || (await import('../utils/registry-auth.js')).openBrowser
-  say.info('Opening your browser to complete it…')
+  // ⛔ Reason-agnostic wording. The backend's own `detail` above carries the
+  // specifics; a lead sentence naming payment would be wrong the moment a refusal
+  // is a quota or an unverified domain — and the reason set is open by design.
+  say.info('Opening your browser to finish this…')
   say.dim(`  ${verdict.url}`)
   // VERBATIM. Nothing is appended — see the header.
   const opened = await openBrowser(verdict.url)
   if (!opened) {
     say.warn('Could not open a browser automatically — open the URL above.')
   }
-  say.dim('Once payment is complete, re-run `uniweb publish`.')
+  say.dim('Once that is done, re-run `uniweb publish`.')
   return { opened }
 }

package/src/backend/service-request.js

@@ -0,0 +1,217 @@
+/**
+ * The services request — is the file ASKING for something, or just carrying an
+ * old answer?
+ *
+ * ## The defect this exists to close
+ *
+ * `$services` / `$secrets` are Sections of the site-content document, so they ride
+ * inside **every** push — the block is emitted whenever the key exists in
+ * `site.yml`. Editing one paragraph on one page therefore re-sends the whole
+ * request block.
+ *
+ * ⛔ And the backend REPLACES what it is sent: a row anchors by its natural key and
+ * is updated in place (`SectionScope::DeclaredOnly`; backend's
+ * `uuidless_records_anchor_by_natural_key_and_keep_the_stored_uuid`, written
+ * against this emitter's shape). So a re-send is not a harmless echo — it
+ * **overwrites the stored request**, including a decision the owner made in the
+ * app, which is where the consent workflow's publish happens.
+ *
+ * ⭐ Under the model the file follows — *"the services in `site.yml` are a request,
+ * never a tracking of what is running"* [Diego, 2026-09-05] — **re-sending an
+ * unchanged block is making a request nobody made.** You ask by CHANGING the file.
+ *
+ * ⚠️ It was mostly inert until 2026-09-08: `enabled` was honoured for `api` alone,
+ * so a stale re-send of the other names overwrote rows nothing read. That stopped
+ * being true the same day, and `api` was never inert — an `enabled: false` on it
+ * with a live plan schedules a paid service to end.
+ *
+ * ## What "changed" is measured against
+ *
+ * The last block we are known to have sent, recorded in **`deploy.yml`** — a
+ * COMMITTED project file that travels with a clone.
+ *
+ * ⛔ Deliberately NOT `.uniweb/sync-cache.json`, which is the obvious place and the
+ * wrong one: it is gitignored, per-clone and deletable, so a teammate's fresh clone
+ * has no base at all — and this workflow is multi-machine by construction (consent
+ * in a browser, publish from the app). A base that vanishes turns this gate into
+ * either the original defect or a silently dropped request.
+ *
+ * ## ⛔ A HASH, never the block
+ *
+ * `$secrets` carries secret material, and `$services[].config` is opaque and
+ * per-service — anything may be in it. `deploy.yml` is committed, so recording
+ * either verbatim would write them into git. Equality is all this gate needs;
+ * *what* differs is a question for the backend's own copy of the request, not for
+ * a mirror of our own.
+ *
+ * @module
+ */
+
+import { createHash } from 'node:crypto'
+
+/**
+ * A stable fingerprint of one declared block, or `null` when the key is absent.
+ *
+ * ⭐ `null` (absent) and the hash of `[]` are DIFFERENT, and must stay so: absent
+ * means *"I am not telling you about this"* and `[]` is an explicit clear. This
+ * function only has to preserve that distinction — the destructive difference
+ * between them is the backend's.
+ *
+ * Rows are ordered by their serialized form and object keys sorted, so reordering
+ * rows or keys in the file is not a change. It is not a request to move a line.
+ *
+ * @param {*} declared - the raw `site.yml::$services` / `$secrets` value
+ * @returns {string|null} 16 hex chars, or null when undeclared
+ */
+export function fingerprintDeclaration(declared) {
+  if (declared === undefined || declared === null) return null
+  const canonical = Array.isArray(declared)
+    ? declared.map(stableString).sort()
+    : [stableString(declared)]
+  return createHash('sha256')
+    .update(JSON.stringify(canonical))
+    .digest('hex')
+    .slice(0, 16)
+}
+
+/** Deterministic JSON: object keys sorted at every depth, arrays left in order. */
+function stableString(value) {
+  return JSON.stringify(value, (_k, v) =>
+    v && typeof v === 'object' && !Array.isArray(v)
+      ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, v[k]]))
+      : v
+  )
+}
+
+/**
+ * Both blocks' fingerprints, in the shape `deploy.yml::lastDeploy.<target>` keeps
+ * them. Keys are omitted rather than set to null, so an undeclared block leaves no
+ * trace in the file.
+ *
+ * @param {object} siteYml
+ * @returns {{servicesRequest?: string, secretsRequest?: string}}
+ */
+export function fingerprintRequest(siteYml) {
+  const out = {}
+  const services = fingerprintDeclaration(siteYml?.$services)
+  if (services) out.servicesRequest = services
+  const secrets = fingerprintDeclaration(siteYml?.$secrets)
+  if (secrets) out.secretsRequest = secrets
+  // ⭐ The language selection is a request too, and it is the one that moves a
+  // PRICE — the line is billed on how many languages go out. Banking it is what
+  // lets a later edit read as "the owner asked for another language" rather than
+  // as a value that was always there.
+  const langs = fingerprintDeclaration(siteYml?.publishLanguages)
+  if (langs) out.publishLanguagesRequest = langs
+  return out
+}
+
+/**
+ * Should this push DECLARE the request blocks?
+ *
+ * ⛔ **Absence of a record means YES.** Three reasons, and the third is the one
+ * that decides it:
+ *
+ *   1. It is the behaviour every CLI has had, so nothing regresses.
+ *   2. A project may legitimately have no `deploy.yml` (never published, or
+ *      `autoSave: off`), and that is not evidence about the request.
+ *   3. ⭐ Failing the other way DROPS A REAL REQUEST IN SILENCE. Between the two
+ *      failure directions, sending an unchanged block writes back what is usually
+ *      already there, while withholding a changed one leaves an owner's edit with
+ *      no effect and nothing said. The loud failure is the better one.
+ *
+ * @param {object} siteYml - the parsed site.yml
+ * @param {object|null} lastDeploy - `deploy.yml::lastDeploy.<target>`, or null
+ * @returns {{declare: boolean, reason: 'no-record'|'changed'|'unchanged'|'undeclared'}}
+ */
+export function decideDeclaration(siteYml, lastDeploy) {
+  const now = fingerprintRequest(siteYml)
+  if (!now.servicesRequest && !now.secretsRequest) {
+    // Nothing in the file to send. The gate is moot; say so rather than
+    // reporting "unchanged", which would imply a comparison happened.
+    return { declare: true, reason: 'undeclared' }
+  }
+  if (!lastDeploy || typeof lastDeploy !== 'object') {
+    return { declare: true, reason: 'no-record' }
+  }
+  const same =
+    now.servicesRequest === (lastDeploy.servicesRequest || undefined) &&
+    now.secretsRequest === (lastDeploy.secretsRequest || undefined)
+  return same
+    ? { declare: false, reason: 'unchanged' }
+    : { declare: true, reason: 'changed' }
+}
+
+/**
+ * The four-way reconcile, once the backend's own copy of the request is in hand.
+ *
+ * ⭐ THIS SUPERSEDES `decideDeclaration` WHERE THE STATUS READ SUCCEEDS. That one
+ * compares the file to our MEMORY of what we last sent, which leaves a window: a
+ * request changed in the app between a `uniweb pull` and the next publish reads as
+ * unchanged-from-nothing. Comparing to the backend's own rows closes it, because
+ * the base stops being something we have to remember correctly.
+ *
+ * ⛔ It still needs the banked fingerprint. Local and remote differing says the two
+ * disagree; it does not say WHO MOVED. Only the last agreed state does, and that is
+ * the difference between "the app decided, adopt it" and "you edited, send it".
+ *
+ * ## The four outcomes
+ *
+ * | local | remote | |
+ * |---|---|---|
+ * | unchanged | unchanged | `none` — nobody asked anything |
+ * | unchanged | **moved** | `adopt` — the app decided; the file is merely behind |
+ * | **edited** | unchanged | `send` — a real request |
+ * | **edited** | **moved** | `conflict` — ⛔ two intents, and only the owner ranks them |
+ *
+ * ⛔ `conflict` never guesses and never sends. A last-write-wins on a field that
+ * schedules a paid service to end is not a tie-break, it is a coin toss with the
+ * owner's money.
+ *
+ * ⚖️ No base ⇒ we cannot tell `adopt` from `conflict`, so we fall back to the
+ * conservative reading of a difference: if the two differ, `conflict`; if they
+ * agree, `none`. That withholds rather than sends, which is safe HERE — unlike
+ * `decideDeclaration`, nothing is silently dropped, because a conflict is reported.
+ *
+ * @param {object} siteYml
+ * @param {*} remoteServices - the status read's `services` rows, or undefined
+ * @param {object|null} lastDeploy - the banked base
+ * @returns {{action:'none'|'adopt'|'send'|'conflict', local:string|null, remote:string|null}}
+ */
+export function reconcileRequest(siteYml, remoteServices, lastDeploy) {
+  return reconcile(siteYml?.$services, remoteServices, lastDeploy?.servicesRequest)
+}
+
+/**
+ * The same reconcile over any two-way request field.
+ *
+ * ⭐ `$services` was the first, not the only one. `site.yml::publishLanguages` is
+ * the same shape — the owner's ASK, pushed up, projected back on pull, and stored
+ * on the other side where something else may move it.
+ *
+ * ⛔ AND A BASE IS NEEDED EVEN WHERE NOTHING ELSE WRITES THE FIELD. That was the
+ * reasoning that nearly left languages out: "nobody overwrites it, so there is no
+ * hazard." Overwriting is not the only thing a base is for — without one, a value
+ * that has always been in the file is indistinguishable from one the owner just
+ * typed, so the CLI cannot tell an intentional change from the status quo. For
+ * languages that difference is money: the count is priced, so a new language is a
+ * charge, and saying so before sending requires knowing it is new.
+ *
+ * @param {*} localValue - the file's declaration
+ * @param {*} remoteValue - what the site has stored
+ * @param {string|null} baseFingerprint - what we last agreed on
+ */
+export function reconcile(localValue, remoteValue, baseFingerprint) {
+  const local = fingerprintDeclaration(localValue)
+  const remote = fingerprintDeclaration(remoteValue)
+  const base = baseFingerprint || null
+
+  if (local === remote) return { action: 'none', local, remote }
+  if (!base) return { action: 'conflict', local, remote }
+
+  const localMoved = local !== base
+  const remoteMoved = remote !== base
+  if (!localMoved && remoteMoved) return { action: 'adopt', local, remote }
+  if (localMoved && !remoteMoved) return { action: 'send', local, remote }
+  return { action: 'conflict', local, remote }
+}

package/src/commands/publish.js

@@ -57,6 +57,12 @@ import {
   rewriteSchemalessDataAssets
 } from '@uniweb/build/site'
 import { emitSyncPackages } from '@uniweb/build/uwx'
+import {
+  decideDeclaration,
+  fingerprintRequest,
+  reconcile,
+  reconcileRequest
+} from '../backend/service-request.js'
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
 import { resolveDefaultLocale } from '@uniweb/core/locale-config'
 
@@ -172,6 +178,69 @@ function languagesFromSiteYml(siteYml) {
 }
 
 // Persist deploy.yml lastDeploy memory (skipped on --no-save / autoSave 'off').
+/**
+ * A one-line, human-readable account of a service request, for a terminal.
+ *
+ * ⛔ Deliberately lossy — it names what is on and what is off, not a service's
+ * opaque `config`. The owner is being told WHICH decision differs so they can go
+ * look; reproducing a per-service config blob in a warning would bury that.
+ * "nothing" is a real answer and reads better than an empty string.
+ */
+/**
+ * A language selection, for a terminal.
+ *
+ * ⛔ An ABSENT selection is not an empty one, and the words have to keep them
+ * apart: no `publishLanguages` key means every declared language is publishable,
+ * while `[]` means explicitly none. "all of them" and "none" are opposite answers
+ * and a bare empty string would read as either.
+ */
+function describeLanguages(value) {
+  if (value === undefined || value === null) return 'all of them'
+  if (!Array.isArray(value) || value.length === 0) return 'none'
+  return value.join(', ')
+}
+
+/**
+ * Languages the site was asked to publish that it did not publish.
+ *
+ * ⭐ THIS IS NOT COMPUTABLE FROM `site.yml`. The served set is decided where the
+ * publish happens — a code naming no declared language is ignored rather than
+ * refused, and the site's own declared set is whatever its last push left there,
+ * which is not necessarily this file. So the only honest source is what the publish
+ * reported back, and until now the CLI wrote that into `deploy.yml` and never
+ * looked at it.
+ *
+ * ⛔ The failure it makes visible is the quiet one: an author believes their site
+ * is live in three languages and it is live in two. Nothing errors, the publish
+ * succeeds, and the missing locale is indistinguishable from one nobody asked for.
+ *
+ * Only the missing direction is reported. A site serving MORE than was asked is a
+ * different question that nobody has, and inventing a message for it would be
+ * machinery for a reason that does not exist.
+ *
+ * @param {string[]|null} asked - what this publish sent
+ * @param {*} served - `locales` from the publish response
+ * @returns {string[]} asked-for and not served, in the order asked
+ */
+export function unservedLanguages(asked, served) {
+  if (!Array.isArray(asked) || !Array.isArray(served)) return []
+  const got = new Set(served)
+  return asked.filter((l) => !got.has(l))
+}
+
+function describeServices(rows) {
+  if (!Array.isArray(rows) || rows.length === 0) return 'nothing'
+  return rows
+    .map((r) => {
+      const name = typeof r?.name === 'string' ? r.name : '?'
+      // A row that omits `enabled` is an ask, not a refusal — the backend's three
+      // states. Only an explicit `false` reads as off.
+      return r?.enabled === false ? `${name} (off)` : name
+    })
+    .sort()
+    .join(', ')
+}
+
 async function persistLastDeploy(siteDir, opts) {
   if (opts.autoSave === 'off') return
   try {
@@ -295,12 +364,20 @@ export async function publish(args = []) {
   // always targets Uniweb hosting; resolveTarget gives us the target name +
   // autoSave for the lastDeploy memo.
   let resolved
+  let priorRequest = null
   try {
     const deployYml = await loadDeployYml(siteDir)
     // No --target on publish — it always targets Uniweb hosting; resolveTarget
     // returns the uniweb default (fromFile:false) when there's no deploy.yml, so
     // persistLastDeploy scaffolds the file as the "where it's deployed" record.
     resolved = resolveTarget(deployYml, null)
+    // The last request we are known to have sent, for the declaration gate below.
+    // Read from the SAME deploy.yml load — one read, and the memo is the only
+    // durable record of it (see backend/service-request.js for why not the cache).
+    priorRequest =
+      deployYml?.lastDeploy?.[resolved?.targetName] ||
+      deployYml?.lastDeploy?.uniweb ||
+      null
   } catch {
     // Malformed/ambiguous deploy.yml — don't block the publish on the memo.
     resolved = {
@@ -701,9 +778,155 @@ export async function publish(args = []) {
   const injectInfo = {
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }
+  // ⛔ IS THE FILE ASKING FOR ANYTHING BY ITS `$services` / `$secrets` BLOCK?
+  //
+  // The blocks ride inside the site-content document, so without this gate every
+  // push re-sends them — and the backend REPLACES what it is sent. A paragraph
+  // edit would therefore overwrite whatever the stored request has become, which
+  // in the consent workflow is a decision the owner made in the app. Under "the
+  // file is a request", an unchanged block is not asking for anything.
+  //
+  // ⚠️ The residual window, stated because it is real and narrow: the base is
+  // banked at publish, so a request changed in the app BETWEEN a `uniweb pull` and
+  // the next publish is not seen — the pulled block reads as unchanged-from-nothing
+  // and is declared. It closes when the status route carries the stored request
+  // (backend is adding it) and we compare against theirs instead of our memory.
+  //
+  // ⭐ ASK THE BACKEND rather than trusting our memory, when it will tell us. The
+  // banked fingerprint says what WE last sent; the status read says what the site
+  // actually has. Only the second one sees a change made in the app, which is where
+  // the consent workflow's decisions happen — so this is what closes the window
+  // between a `uniweb pull` and the next publish.
+  //
+  // ⚖️ Degrades to the banked comparison on any failure — an older backend, a
+  // network blip, a site never pushed. That is the shipped behaviour and it is safe:
+  // it withholds an unchanged block and sends a changed one; it merely cannot see
+  // the app's side.
+  let declaration = decideDeclaration(siteYml, priorRequest)
+  let adopted = null
+  // Before the push, so a never-synced site has no uuid and simply skips this.
+  const status =
+    typeof siteYml.$uuid === 'string' && siteYml.$uuid
+      ? await client.siteStatus(siteYml.$uuid)
+      : null
+  if (status && Array.isArray(status.services)) {
+    const r = reconcileRequest(siteYml, status.services, priorRequest)
+    if (r.action === 'none') {
+      declaration = { declare: false, reason: 'in-sync' }
+    } else if (r.action === 'send') {
+      declaration = { declare: true, reason: 'changed' }
+    } else if (r.action === 'adopt') {
+      // The owner decided in the app and this file is simply behind. Nothing to
+      // ask for, so nothing is sent — and the file can be brought in line, which
+      // is offered rather than done, because site.yml is theirs.
+      declaration = { declare: false, reason: 'adopt' }
+      adopted = status.services
+    } else {
+      // ⛔ CONFLICT — both moved. Withhold and SAY SO. Not a stop: the content
+      // publish is a separate thing the owner asked for, and blocking it over a
+      // services disagreement couples two unrelated intents. Not a guess either;
+      // the request stays in their file, unsent, and they are told.
+      declaration = { declare: false, reason: 'conflict' }
+      adopted = status.services
+    }
+  }
+
+  const { isNonInteractive, confirm } = await import('../utils/interactive.js')
+
+  // ⛔ EVERY STRING BELOW IS FOR A SITE OWNER, NOT FOR US.
+  //
+  // "request", "declaration", "send", "adopt", "reconcile" are how this file
+  // MODELS the problem and they are the wrong words to say out loud: an author
+  // does not think they are sending a request, they think they want their site to
+  // have search. Say services, on and off, site.yml and your site. The internal
+  // vocabulary stays in the code and the comments, where it earns its precision.
+  //
+  // ⭐ THE OWNER IS THE ONLY ONE WHO CAN RANK TWO OF THEIR OWN INTENTS.
+  //
+  // `conflict` means the file and the site both moved since we last agreed, so
+  // neither is "the" request. ⛔ Withholding silently and saying "edit site.yml"
+  // is advice that CANNOT WORK: with no banked base the file has nothing to move
+  // relative to, so editing it produces the same conflict forever. That shipped
+  // for one commit. Asking is the only thing that resolves it.
+  if (declaration.reason === 'conflict') {
+    say.warn('Your site\'s services were changed elsewhere, and site.yml changed too.')
+    say.dim(`  in site.yml:  ${describeServices(siteYml.$services)}`)
+    say.dim(`  on your site: ${describeServices(adopted)}`)
+    if (isNonInteractive(args)) {
+      say.dim('  Left your site as it is — run without --non-interactive to choose.')
+    } else if (await confirm('Use the services listed in site.yml?', false)) {
+      declaration = { declare: true, reason: 'resolved-send' }
+      adopted = null
+    } else {
+      // Declining to send is not yet a decision to take theirs, so this falls
+      // through to the offer below and "neither, leave it alone" stays available.
+      declaration = { declare: false, reason: 'adopt' }
+    }
+  }
+
+  // ⭐ THE SAME QUESTION FOR THE LANGUAGE SELECTION, and it is the one that costs.
+  //
+  // `publishLanguages` is a request like `$services`: pushed up, projected back on
+  // pull, stored on the other side. ⛔ Nothing over there deliberately rewrites it
+  // today — which is why this was nearly skipped — but a base is not only for
+  // detecting an overwrite. Without one, a selection that has always been in the
+  // file cannot be told from one the owner just typed, and for languages that is a
+  // charge: the line is billed on how many go out, so adding one costs money and
+  // the owner should hear that from us before it is sent, not from a refusal after.
+  if (status && !isNonInteractive(args)) {
+    const langs = reconcile(
+      siteYml.publishLanguages,
+      status.publish_languages,
+      priorRequest?.publishLanguagesRequest
+    )
+    if (langs.action === 'send') {
+      const asked = siteYml.publishLanguages
+      say.info(
+        `You changed which languages this site publishes: ${describeLanguages(asked)}.`
+      )
+      // ⚖️ "may" — the count is what is priced, and only the backend prices it.
+      // Framework says a charge is possible and never how much: this package is
+      // public and holds no prices, and a number we invented would be wrong.
+      say.dim('  Adding a language may cost more. You will be asked to confirm if so.')
+    } else if (langs.action === 'adopt' || langs.action === 'conflict') {
+      say.info('This site publishes different languages than site.yml lists.')
+      say.dim(`  in site.yml:  ${describeLanguages(siteYml.publishLanguages)}`)
+      say.dim(`  on your site: ${describeLanguages(status.publish_languages)}`)
+    }
+  }
+
+  if (declaration.reason === 'adopt' && adopted) {
+    // ⚖️ Deliberately says WHAT differs, not WHO moved. The usual cause is a
+    // decision made in the app — but the same state follows a request of ours the
+    // site refused, where nothing of theirs changed and ours simply did not take.
+    // We cannot tell those apart here, so the wording claims neither.
+    say.info('Your site has different services than site.yml lists.')
+    say.dim(`  in site.yml:  ${describeServices(siteYml.$services)}`)
+    say.dim(`  on your site: ${describeServices(adopted)}`)
+    // ⭐ OFFERED, NEVER DONE. site.yml is the owner's file, and a publish that
+    // silently rewrites an authored file is the surprise this seam exists to
+    // avoid. Default No, and declining costs nothing: the site is already
+    // correct, only the file is behind, and the offer returns next publish.
+    //
+    // ⚖️ A DECLINED conflict reaches here too, and that is deliberate — having
+    // been asked which they meant and said "not mine", taking the site's is the
+    // other half of the same question, not a silent overwrite of an edit.
+    if (!isNonInteractive(args) && (await confirm('Update site.yml to match?', false))) {
+      const { writeSiteConfig } = await import('@uniweb/build/uwx')
+      writeSiteConfig(siteDir, { $services: adopted })
+      // Keep the in-memory copy in step, or the deploy.yml bank below records the
+      // file as it WAS and the offer repeats forever.
+      siteYml.$services = adopted
+      say.ok('site.yml updated.')
+    }
+  } else if (!declaration.declare && declaration.reason !== 'adopt') {
+    say.dim('Services unchanged.')
+  }
+
   let pkg
   try {
     pkg = await emitSyncPackages(siteDir, {
+      ...(declaration.declare ? {} : { declareServices: false }),
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir),
       // Resolves a foundation-relative `@/x` model ref into `@org/x`.
@@ -818,6 +1041,24 @@ export async function publish(args = []) {
     lastDeploy: {
       at: new Date().toISOString(),
       host: 'uniweb',
+      // The request this publish is known to have sent — the base the declaration
+      // gate compares against next time. ⛔ A FINGERPRINT, never the block:
+      // deploy.yml is committed, `$secrets` carries secret material and a
+      // service's `config` is opaque, so recording either verbatim would write
+      // them into git. Absent when the file declares no block.
+      ...(declaration.declare
+        ? fingerprintRequest(siteYml)
+        : {
+            // Nothing was sent, so the base is unchanged — carry it forward
+            // rather than dropping it, or the next publish would read "no record"
+            // and declare.
+            ...(priorRequest?.servicesRequest
+              ? { servicesRequest: priorRequest.servicesRequest }
+              : {}),
+            ...(priorRequest?.secretsRequest
+              ? { secretsRequest: priorRequest.secretsRequest }
+              : {})
+          }),
       // What was actually shipped. A version number can't answer that — two
       // publishes of "0.1.0" are not the same content — and after the fact the
       // working tree has moved on. `dirty` matters as much as the sha: it says the
@@ -835,7 +1076,13 @@ export async function publish(args = []) {
       // its foundation's floor and is resolved by whoever serves it. Recording a
       // value would be a snapshot that silently goes stale, of a decision this
       // command does not make.
-      locales: Array.isArray(result.locales) ? result.locales : languages
+      // ⛔ WHAT WENT OUT, or nothing. This fell back to `languages` — what we
+      // ASKED FOR — when the response carried no `locales`, which put two
+      // different facts under one key with no way to tell them apart: a reader
+      // could not distinguish "these were served" from "we asked for these and
+      // were never told". `deploy.yml` records what a publish DID, and when we do
+      // not know what it did, the honest record is silence.
+      ...(Array.isArray(result.locales) ? { locales: result.locales } : {})
     }
   })
 
@@ -843,6 +1090,23 @@ export async function publish(args = []) {
   say.ok(
     `Published ${c.bold}${siteUuid}${c.reset}${result.status ? ` (${result.status})` : ''}`
   )
+
+  // ⛔ SAY IT WHEN A LANGUAGE ASKED FOR DID NOT GO OUT.
+  //
+  // The publish succeeded, so nothing above this is wrong — and a site live in two
+  // of the three languages its author listed looks exactly like a site live in the
+  // two they wanted. That is the failure with no owner: the file and reality
+  // disagree and the terminal is green.
+  //
+  // ⚖️ A warning, not a failure. The publish DID happen and the content IS live, so
+  // exiting non-zero would tell a script the deploy failed when it did not.
+  const unserved = unservedLanguages(languages, result.locales)
+  if (unserved.length > 0) {
+    say.warn(
+      `Your site went live in ${(result.locales || []).join(', ')} — but not ${unserved.join(', ')}.`
+    )
+    say.dim(`  site.yml lists ${unserved.join(', ')}, and ${unserved.length === 1 ? 'it was' : 'they were'} not published.`)
+  }
   if (serveUrl) console.log(`  ${c.cyan}${serveUrl}${c.reset}`)
   if (result.deploy_uuid) say.dim(`deploy: ${result.deploy_uuid}`)
   return { exitCode: 0 }

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-08T01:58:45.617Z",
+  "generatedAt": "2026-09-09T00:44:10.215Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.2.11",
+      "version": "0.2.12",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.43.0",
+      "version": "0.43.1",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -34,7 +34,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.24.1",
+      "version": "0.24.2",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -64,7 +64,7 @@
       ]
     },
     "@uniweb/loom": {
-      "version": "0.2.4",
+      "version": "0.2.5",
       "path": "framework/loom",
       "deps": []
     },
@@ -82,7 +82,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.19.1",
+      "version": "0.19.3",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",

package/src/utils/registry-auth.js

@@ -339,15 +339,35 @@ async function loginViaTokenPaste({ apiBase, nonInteractive }) {
 // Exported for the publish payment refusal, which opens the backend's
 // settlement URL VERBATIM and needs no loopback (backend/payment-handoff.js).
 export async function openBrowser(url) {
+  // ⛔ THE URL ARRIVES OVER THE NETWORK — a backend hands it to us and we open it.
+  //
+  // This built a SHELL STRING (`open "${url}"`) and interpolated that value into
+  // it. A `"` in the URL closes the quoted argument and everything after it is
+  // shell: one crafted or corrupted response, and the rest runs as the user. It
+  // was on the login path before it was on the publish path.
+  //
+  // ⇒ Two changes, and neither is about payment:
+  //   1. `execFile` with the URL as an ARGUMENT — no shell, so no quoting to get
+  //      wrong and nothing to escape.
+  //   2. Only `http:` / `https:` are opened. `file:`, `javascript:` and the rest
+  //      are not places a person goes, and refusing them costs nothing real.
+  //      (The caller checks too; a safety rule that only holds at one call site
+  //      is one refactor from being gone.)
+  if (!/^https?:\/\//i.test(String(url || ''))) return false
   try {
-    const { exec } = await import('node:child_process')
-    const cmd =
+    const { execFile } = await import('node:child_process')
+    // `start` is a cmd.exe builtin rather than an executable, so Windows keeps a
+    // shell — but through `cmd /c` with the URL as its own argv entry, which is
+    // what removes the interpolation. The empty string is `start`'s title slot.
+    const [cmd, args] =
       process.platform === 'darwin'
-        ? `open "${url}"`
+        ? ['open', [url]]
         : process.platform === 'win32'
-          ? `start "" "${url}"`
-          : `xdg-open "${url}"`
-    return await new Promise((resolve) => exec(cmd, (err) => resolve(!err)))
+          ? ['cmd', ['/c', 'start', '', url]]
+          : ['xdg-open', [url]]
+    return await new Promise((resolve) =>
+      execFile(cmd, args, (err) => resolve(!err))
+    )
   } catch {
     return false
   }