uniweb 0.59.1 → 0.60.0

package/src/commands/push.js

@@ -5,10 +5,11 @@
  *   - folder lane → one `@uniweb/folder` + the collection-record entities it
  *     references (the dynamic half; the `$ref` closure rides together).
  *
- * Each entity is an entity-content document (`$id` + `$model` + sections). The site
- * holds exactly one identity: `site.yml::$uuid` (the site-content entity). A first
- * push has none — it CREATEs the site (uuid-less), the backend mints + adopts it
- * and returns the new uuid, which `push` records into `site.yml`. Later pushes
+ * Each entity is an entity-content document (`$id` + `$model` + sections). The site's
+ * identity on a backend is its site-content uuid, in that backend's section of
+ * `sync.json`. A first push to a backend has none — it CREATEs the site (uuid-less),
+ * the backend mints + adopts it and returns the new uuid, which `push` records in
+ * `sync.json`. Later pushes
  * UPDATE by that uuid. The folder lane is keyed by the SAME site-content uuid —
  * the backend owns the site's `@uniweb/folder`, so the framework never holds a
  * folder uuid. Records still round-trip their own `$uuid`
@@ -37,7 +38,6 @@
  *                                        this prompt existed. First push only.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
- *   uniweb push --token <bearer>         Submit with this bearer; skips `uniweb login`
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
  *   uniweb push --all                    Send every record (bypass the changed-only cache)
  *   uniweb push --force                  Overwrite upstream changes (drop the staleness gate)
@@ -49,9 +49,9 @@
  * backend's reconcile deletes items absent from the package, so an author's NEW page
  * would be hard-deleted). `--force` omits the token and restores last-push-wins.
  *
- * Backend: via BackendClient (the content + folder sync lanes). Origin from
- *   UNIWEB_REGISTER_URL  >  the local default.
- * Auth:  --token  >  UNIWEB_TOKEN  >  `uniweb login` session.
+ * Backend: the one you are logged in to — UNIWEB_REGISTER_URL overrides it for a script
+ *   (resolveBackendOrigin). Auth: UNIWEB_TOKEN  >  the stored session  >  `uniweb login`.
+ *   No `--backend` or `--token`: switching and signing in are `uniweb login`.
  *
  * The two-lane SUBMISSION (POST both lanes, back-fill uuids, persist the
  * send-only-changed cache) lives in `../backend/site-sync.js` so `uniweb publish`
@@ -63,17 +63,18 @@ import { readFileSync, writeFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import yaml from 'js-yaml'
 import { emitSyncPackages } from '@uniweb/build/uwx'
+import { findSiteCopies, describeSiteCopies } from '../utils/site-copies.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
-import { updateAssetMap, ASSET_MAP_FILE } from '@uniweb/build/uwx'
+import { updateBackendMap, carryServed, SYNC_STORE_FILE } from '@uniweb/build/uwx'
 import { BackendClient } from '../backend/client.js'
-import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
+import { resolveSiteDir } from './deploy.js'
 import { warnIfContentDoesNotConform } from '../utils/conformance.js'
 import { reportSchemalessQueries } from '../utils/schemaless-report.js'
 import { readOrgFlag } from '../utils/args.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
-  assertSiteBackendScope,
-  readSiteIdentity
+  syncedElsewhere,
+  describeSyncedElsewhere
 } from '../utils/site-identity.js'
 import { confirm } from '../utils/interactive.js'
 import { guardEmptyRecords } from '../utils/records-guard.js'
@@ -141,7 +142,6 @@ export async function push(args = [], deps = {}) {
   }
   const dryRun = args.includes('--dry-run')
   const output = flagValue(args, '-o') || flagValue(args, '--output')
-  const tokenFlag = flagValue(args, '--token')
   const foundationDir = flagValue(args, '--foundation')
   const sendAll = args.includes('--all') // bypass the send-only-changed cache
   // --force drops the optimistic-concurrency precondition, making the push
@@ -156,50 +156,64 @@ export async function push(args = [], deps = {}) {
   // Advisory only — warns and pushes. A malformed data block otherwise rides
   // the sync wire unchecked; see utils/conformance.js.
   await warnIfContentDoesNotConform(siteDir, { args })
-  // The project's own statement of where its identity lives. Feeds the origin ladder
-  // ABOVE the session (see resolveBackendOrigin), so a teammate who cloned this project
-  // targets the backend it is bound to instead of whatever they last logged into.
-  // ⛔ The RAW value, never `resolveSiteScope` — null must mean "defer to the next tier".
-  const siteScope = readSiteIdentity(siteDir).backend
-  const siteBackend = await resolveSiteBackend(siteDir)
+  // ⭐ THE BACKEND YOU ARE LOGGED IN TO is where this goes *[Diego, 2026-09-21]*, for every
+  // backend verb (resolveBackendOrigin). Only UNIWEB_REGISTER_URL — the automation
+  // override — outranks it, and nothing talks to a backend the user is not logged in to:
+  // logged in nowhere, the origin is the default backend and the first request asks for
+  // that login. ⛔ There is no `--backend` here: switching is `uniweb login --backend`.
+  // ⛔ The project's own record — its synced backend, deploy.yml's default target — routes
+  // NOTHING. For part of 2026-09-21 it answered a "logged in nowhere" tier, which cannot
+  // be reached: *"We do not allow any communication with backend if the user is not
+  // logged into a backend."*
   // One front door. The bearer is resolved lazily on first need (a non-local Model
   // read during the build, or the submit). Offline emit (--dry-run / -o) is fully
   // offline: it never submits, and its Model resolver never reads from the backend
   // (the `offline` flag below), so it never authenticates — even when a collection
   // references a Model the local foundation doesn't define.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend'),
-    siteScope,
-    siteBackend,
-    token: tokenFlag,
     args,
     command: 'Syncing'
   })
 
-  // ⛔ SCOPE CHECK — before anything is sent. A project whose stored identity was minted
-  // by a different backend cannot be pushed here: the uuids, the asset ids and the sync
-  // cache are all foreign at once. Runs after the client so it sees the RESOLVED origin
-  // (flag > env > deploy.yml > session), not the one we guessed.
+  // ⛔ A COPY OF ANOTHER PROJECT — before anything is sent. A plain directory copy
+  // carries sync.json, so it holds the ORIGINAL's site on this backend and its push
+  // would update that site (see utils/site-copies.js for why the signal is exact).
+  // Refused, not warned: a warning printed while the push goes ahead is printed over
+  // the damage. Runs after the client so it checks the RESOLVED origin.
   //
-  // ⚠️ NOT for `-o`, which is a LOCAL EMIT and reaches no backend at all. Its output is
-  // built from files on disk; the resolved origin is not an input to it, so a mismatch
-  // cannot make the artifact wrong — and refusing would break an operation this command
-  // deliberately keeps offline (the `!output && !dryRun` guards below are the same rule).
-  // The refusal even says "Sending them elsewhere is refused" over a run that sends
-  // nothing.
+  // ⚠️ NOT for `-o`, which is a LOCAL EMIT and reaches no backend at all — there is no
+  // site for it to update, and refusing would break an operation this command keeps
+  // offline (the `!output && !dryRun` guards below are the same rule).
   //
   // `--dry-run` IS checked, and the asymmetry is the point: a dry run previews a real
-  // push, so when that push would be refused, saying so is the honest preview. Printing
-  // "would update content at <origin>" instead would preview something that cannot happen.
+  // push, so when that push would be refused, saying so is the honest preview.
+  //
+  // *(This spot held the backend SCOPE CHECK, `assertSiteBackendScope`, until
+  // 2026-09-20 — deleted when identity became per-backend and a foreign backend's
+  // uuids stopped being reachable at all.)*
   if (!output) {
-    const scope = assertSiteBackendScope(siteDir, client.origin)
-    if (!scope.ok) {
-      error(scope.message)
-      scope.hint.forEach(note)
+    const copies = findSiteCopies(siteDir, client.origin)
+    if (copies.length) {
+      const said = describeSiteCopies(copies, client.origin, 'push')
+      error(said.headline)
+      for (const line of said.lines) note(line)
       return { exitCode: 1 }
     }
   }
 
+  // ⚠️ Logged in to a backend where this project has no site, while it has one
+  // elsewhere: following the login CREATES a second site. Say so before the owner
+  // question, which otherwise arrives with no reason attached. Not for `-o` (nothing is
+  // created) and not when UNIWEB_REGISTER_URL chose the backend — that is a decision.
+  if (!output && !process.env.UNIWEB_REGISTER_URL) {
+    const known = syncedElsewhere(siteDir, client.origin)
+    if (known) {
+      const [headline, ...rest] = describeSyncedElsewhere(known, client.origin, 'push')
+      info(headline)
+      for (const line of rest) note(line)
+    }
+  }
+
   // WHO will own this site, if this push is the one that creates it. Resolved
   // before any lane runs, because both create paths below consume it and neither
   // should be reached with the question still open. A site that already exists
@@ -298,18 +312,18 @@ export async function push(args = [], deps = {}) {
   //
   // Still skipped for an offline emit: `-o` / `--dry-run` must not mutate project state.
   if (!output && !dryRun) {
-    const dropped = clearRemoteSyncStateIfUnbound(siteDir)
+    const dropped = clearRemoteSyncStateIfUnbound(siteDir, client.origin)
     if (dropped.length) {
       note(
         `Cleared stale sync state from a previous site (${dropped.join(', ')}).`
       )
     }
-    const stale = dropSiteBoundValues(siteDir)
+    const stale = dropSiteBoundValues(siteDir, client.origin)
     if (stale.length) {
       note(`Dropped the previous site's ${stale.join(' and ')} from site.yml.`)
     }
   }
-  const priorHashes = readSyncCache(siteDir)
+  const priorHashes = readSyncCache(siteDir, client.origin)
   // Per-item identity, without which the backend reads every record as new and
   // recreates every page and section row.
   //
@@ -329,8 +343,8 @@ export async function push(args = [], deps = {}) {
   // The upload runs before `ensureItemUuids`, and the reason once recorded here —
   // "BEFORE `ensureItemUuids`, which mints uuids on the backend, so a refusal
   // leaves nothing minted" — is FALSE. `ensureItemUuids` mints nothing: it reads a
-  // local cache, and if that is empty it reads `site.yml::$uuid` and returns
-  // immediately when there is none (the first-push case). Its only backend call is
+  // local map, and if that is empty it reads this backend's site uuid from sync.json
+  // and returns immediately when there is none (the first-push case). Its only backend call is
   // a GET (`pullSiteContent`); its only write is a local file. So this ordering is
   // not protecting what that comment claimed, and is under review — an upload is a
   // durable, metered write, which makes uploading first the thing that leaves bytes
@@ -379,7 +393,7 @@ export async function push(args = [], deps = {}) {
   // is reported and confirmed before anything is sent. The format stays honest;
   // the asking happens here.
   if (!dryRun) {
-    const guard = await guardEmptyRecords({ siteDir, args, warn, note })
+    const guard = await guardEmptyRecords({ siteDir, backend: client.origin, args, warn, note })
     if (!guard.ok) return { exitCode: 1 }
   }
 
@@ -389,8 +403,9 @@ export async function push(args = [], deps = {}) {
     let mediaRefs = []
     try {
       const probe = await emitSyncPackages(siteDir, {
+      backend: client.origin,
       // Placement identity for the folder — see writeFolderItemUuids.
-      folderItemUuids: readFolderItemUuids(siteDir),
+      folderItemUuids: readFolderItemUuids(siteDir, client.origin),
       // Resolves a foundation-relative `@/x` model ref into `@org/x`.
       ...(asOrg ? { org: asOrg } : {}),
         ...(foundationDir ? { foundationDir } : {}),
@@ -458,10 +473,10 @@ export async function push(args = [], deps = {}) {
         )
         // Record identity in the COMMITTED map. Merge, never replace: this push
         // carries only the refs its content touched.
-        const rec = updateAssetMap(siteDir, ids)
+        const rec = updateBackendMap(siteDir, client.origin, 'assets', ids, carryServed)
         if (rec.written) {
           note(
-            `${ASSET_MAP_FILE}: ${rec.added.length} added, ${rec.changed.length} changed — commit it`
+            `${SYNC_STORE_FILE}: ${rec.added.length} asset(s) added, ${rec.changed.length} changed — commit it`
           )
         }
       } catch (err) {
@@ -482,16 +497,17 @@ export async function push(args = [], deps = {}) {
 
   const itemUuids =
     output || dryRun
-      ? readItemUuids(siteDir)
+      ? readItemUuids(siteDir, client.origin)
       : await ensureItemUuids({ client, siteDir, note })
   let pkg
   try {
     pkg = await emitSyncPackages(siteDir, {
+      backend: client.origin,
       // Placement identity for the folder — see writeFolderItemUuids.
-      folderItemUuids: readFolderItemUuids(siteDir),
+      folderItemUuids: readFolderItemUuids(siteDir, client.origin),
       // Identity for the `queries` section — see readQueryUuids. Keyed by
       // name, because a declaration has no file for a path-keyed map to hold.
-      queryUuids: readQueryUuids(siteDir),
+      queryUuids: readQueryUuids(siteDir, client.origin),
       // Resolves a foundation-relative `@/x` model ref into `@org/x`.
       ...(asOrg ? { org: asOrg } : {}),
       ...(foundationDir ? { foundationDir } : {}),
@@ -513,8 +529,8 @@ export async function push(args = [], deps = {}) {
       ...(force
         ? {}
         : {
-            baseVersions: readBaseVersions(siteDir),
-            itemBaseVersions: readItemBaseVersions(siteDir)
+            baseVersions: readBaseVersions(siteDir, client.origin),
+            itemBaseVersions: readItemBaseVersions(siteDir, client.origin)
           }),
       ...(assetRewrite ? { assetRewrite } : {}),
       ...(assetIds ? { assetIds } : {})

package/src/commands/refresh.js

@@ -46,6 +46,8 @@ import {
   headProvenance
 } from '../utils/git.js'
 import { probeUnpushed } from '../backend/site-sync.js'
+import { resolveBackendOrigin } from '../backend/client.js'
+import { readBackendState } from '@uniweb/build/uwx'
 import { checkFlags } from '../utils/flag-guard.js'
 
 const c = {
@@ -65,28 +67,16 @@ const say = {
   dim: (m) => console.log(`  ${c.dim}${m}${c.reset}`)
 }
 
-// Forward a flag AND its value to the delegated verb. `--backend http://x` is two
-// argv entries, so a naive filter passes the flag and drops the URL — leaving the
-// delegated pull pointed at the default backend while the user believes they
-// overrode it. `--backend=http://x` is one entry and passes through as-is.
-function collectPassthrough(args, names) {
-  const out = []
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i]
-    const name = names.find((n) => a === n || a.startsWith(`${n}=`))
-    if (!name) continue
-    out.push(a)
-    if (a === name && args[i + 1] && !args[i + 1].startsWith('-'))
-      out.push(args[++i])
-  }
-  return out
-}
-
-// A site is backend-synced once it has an identity to pull by.
-function siteContentUuid(siteDir) {
+// A site is backend-synced once it has an identity to pull by — on THIS backend,
+// from sync.json. It read `site.yml::$uuid`, so after step 4 refresh treated every
+// project as unsynced and skipped the backend half of its check.
+//
+// ⛔ `backend` is the one the delegated pull will use: the backend the user is logged in
+// to. (For part of 2026-09-21, `refresh --backend X` checked one backend's sync state and
+// pulled from another; the flag is gone from the backend verbs since.)
+function siteContentUuid(siteDir, backend) {
   try {
-    const y = yaml.load(readFileSync(join(siteDir, 'site.yml'), 'utf8'))
-    return typeof y?.$uuid === 'string' ? y.$uuid : null
+    return readBackendState(siteDir, backend).site?.uuid || null
   } catch {
     return null
   }
@@ -155,20 +145,21 @@ export async function refresh(args = [], deps = {}) {
   }
 
   // ── 2. the backend ────────────────────────────────────────────────────────
+  // The backend the delegated pull talks to — the one you are logged in to
+  // (resolveBackendOrigin). Everything below asks about THAT one.
+  const backend = resolveBackendOrigin()
   if (skipBackend) {
     skipped.push('backend (--no-backend)')
-  } else if (!siteContentUuid(siteDir)) {
+  } else if (!siteContentUuid(siteDir, backend)) {
     skipped.push('backend (this site has never been synced)')
   } else {
     say.info("Merging the backend's content…")
     const pull = deps.pull || (await import('./pull.js')).pull
     // `--merge` rather than a plain pull: an author editing a different part of the
     // same section is not a conflict, and should not be presented as one.
-    const passthrough = collectPassthrough(args, [
-      '--backend',
-      '--token'
-    ])
-    const res = await pull(['--merge', ...passthrough])
+    // Nothing of refresh's own argv is forwarded: the pull goes to the backend you are
+    // logged in to, as refresh does, and authenticates the same way.
+    const res = await pull(['--merge'])
     conflicts = res?.merge?.conflicted?.length ?? 0
     if (res?.exitCode && !conflicts) {
       // Failed for a reason other than conflicts — say so plainly rather than
@@ -192,9 +183,11 @@ export async function refresh(args = [], deps = {}) {
 
   // What is still yours to send. The point of a milestone check is knowing both
   // directions, not just that you took what was waiting.
-  if (!skipBackend && siteContentUuid(siteDir)) {
+  if (!skipBackend && siteContentUuid(siteDir, backend)) {
     try {
-      const probe = await probeUnpushed(siteDir)
+      // Whose asset ids the comparison reads — see status.js. Offline, so the
+      // origin is resolved rather than taken from a client.
+      const probe = await probeUnpushed(siteDir, { backend })
       if (probe.changed)
         say.dim(
           `Unpushed: ${probe.changed} entit${probe.changed === 1 ? 'y' : 'ies'} changed locally`

package/src/commands/register.js

@@ -30,12 +30,11 @@
  *   uniweb register --json               Porcelain: ONE compact JSON line on stdout
  *                                        ({ok,scope,origin,entities:[{name,uuid,version,unchanged}]}),
  *                                        all human output to stderr — for scripted callers
- *   uniweb register --backend <url>      Override the backend origin
- *   uniweb register --token <bearer>     Submit with this bearer; skips `uniweb login`
  *
- * Endpoint resolution: --backend <url>  >  UNIWEB_REGISTER_URL  >
- *   the logged-in session origin  >  ~/.uniweb/config.json  >  the default (uniweb.app).
- * Auth (submit only):  --token <bearer>  >  UNIWEB_TOKEN  >  `uniweb login` session.
+ * Endpoint: UNIWEB_REGISTER_URL  >  the backend you are logged in to  >  the default
+ *   (~/.uniweb/config.json, else uniweb.app) — resolveBackendOrigin. No `--backend`:
+ *   switching is `uniweb login --backend <url>`.
+ * Auth (submit only):  UNIWEB_TOKEN  >  the stored session  >  `uniweb login`.
  */
 
 // DEFERRED foundation-registration capabilities (the legacy `uniweb publish` had
@@ -388,12 +387,9 @@ async function runRegister(args = []) {
   const dryRun = args.includes('--dry-run')
   const output = flagValue(args, '-o') || flagValue(args, '--output')
   const scopeFlag = flagValue(args, '--scope')
-  const tokenFlag = flagValue(args, '--token')
-  // Origin: --backend (matches deploy/publish + the
-  // origin-selection convention); either overrides UNIWEB_REGISTER_URL / default.
+  // The backend you are logged in to (UNIWEB_REGISTER_URL overrides it for a script) —
+  // resolveBackendOrigin, like every backend command.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend'),
-    token: tokenFlag,
     args,
     command: 'Registering'
   })
@@ -489,7 +485,7 @@ async function runRegister(args = []) {
   // 0 create / N pick), persist to package.json, and reuse the session token.
   if (!scope && !isPreview) {
     const token = await client.token()
-    const sess = await readRegistryAuth()
+    const sess = await readRegistryAuth(client.origin)
     const derived = await deriveScope({
       apiBase: client.origin,
       token,
@@ -606,7 +602,7 @@ async function runRegister(args = []) {
     )
     return { exitCode: 2 }
   }
-  // Submit — the client carries the bearer (--token › UNIWEB_TOKEN › stored
+  // Submit — the client carries the bearer (UNIWEB_TOKEN › stored
   // session › login), resolved lazily on this first authed call.
   info(`Submitting to ${colors.dim}${client.origin}${colors.reset} …`)
   let res
@@ -615,7 +611,7 @@ async function runRegister(args = []) {
   } catch (err) {
     error(`Could not reach the registry at ${client.origin}: ${err.message}`)
     log(
-      `  ${colors.dim}Set the endpoint with --backend <url> or UNIWEB_REGISTER_URL.${colors.reset}`
+      `  ${colors.dim}Is that the backend you meant? Switch with: uniweb login --backend <url>${colors.reset}`
     )
     return { exitCode: 2 }
   }
@@ -650,7 +646,7 @@ async function runRegister(args = []) {
           `  ${colors.dim}The registry didn't accept your credentials — it may use different ones than \`uniweb login\`.${colors.reset}`
         )
         log(
-          `  ${colors.dim}Supply a registry bearer with --token <bearer> (or UNIWEB_TOKEN); an existing one may be wrong or expired.${colors.reset}`
+          `  ${colors.dim}Log in again (uniweb login --backend <url>), or check UNIWEB_TOKEN — an existing one may be wrong or expired.${colors.reset}`
         )
       }
       // ⭐ **Surface `detail` as a sentence, not as a JSON dump.** The registry

package/src/commands/status.js

@@ -24,14 +24,13 @@ import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import yaml from 'js-yaml'
 
-import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
+import { resolveSiteDir } from './deploy.js'
 import { probeUnpushed } from '../backend/site-sync.js'
-import { BackendClient } from '../backend/client.js'
-import { readFlagValue } from '../utils/args.js'
+import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
+import { readBackendState } from '@uniweb/build/uwx'
 import { resolveLocalFoundation } from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { checkFlags } from '../utils/flag-guard.js'
-import { readSiteIdentity } from '../utils/site-identity.js'
 
 const c = {
   reset: '\x1b[0m',
@@ -87,15 +86,23 @@ export async function status(args = []) {
   const remote = args.includes('--remote')
   const siteDir = await resolveSiteDir(args, 'status')
   const siteYml = readSiteYml(siteDir)
-  const uuid = siteYml.$uuid || null
   const fnd = foundationRef(siteYml)
   const { scope: fndScope, version: fndVersion } = splitFoundationRef(fnd)
 
   // Local content diff — builds the sync packages, never authenticates.
+  //
+  // ⭐ The ORIGIN is resolved here rather than taken from the client below, because
+  // this probe is deliberately offline and the client may never be built. It decides
+  // whose asset ids the comparison reads: against the wrong backend every media ref
+  // reads as changed.
+  const probeBackend = resolveBackendOrigin()
+  // ⭐ Identity is this backend's, from sync.json. It read `site.yml::$uuid`, so after
+  // step 4 moved the key every project reported itself as never synced.
+  const uuid = readBackendState(siteDir, probeBackend).site?.uuid || null
   let probe = null
   let probeErr = null
   try {
-    probe = await probeUnpushed(siteDir)
+    probe = await probeUnpushed(siteDir, { backend: probeBackend })
   } catch (err) {
     probeErr = err.message
   }
@@ -108,11 +115,6 @@ export async function status(args = []) {
   if (remote) {
     try {
       const client = new BackendClient({
-        originFlag:
-          readFlagValue(args, '--backend'),
-        siteScope: readSiteIdentity(siteDir).backend,
-        siteBackend: await resolveSiteBackend(siteDir),
-        token: readFlagValue(args, '--token') || undefined,
         args,
         command: 'Status'
       })

package/src/commands/sync.js

@@ -35,7 +35,6 @@
  *   uniweb sync                    refresh, then push
  *   uniweb sync --no-git           skip the git remote half of the refresh
  *   uniweb sync --force            forwarded to push (overwrite upstream changes)
- *   uniweb sync --backend <url>    override the backend origin
  */
 
 import { checkFlags } from '../utils/flag-guard.js'

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-20T13:46:56.198Z",
+  "generatedAt": "2026-09-21T13:20:05.572Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.4.1",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.55.0",
+      "version": "0.56.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -83,7 +83,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.27.1",
+      "version": "0.27.2",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.9.26",
+      "version": "0.9.27",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",