uniweb 0.59.2 → 0.60.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.59.2",
+  "version": "0.60.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -43,13 +43,13 @@
     "tar": "^7.0.0",
     "@uniweb/content-writer": "^0.3.4",
     "@uniweb/core": "^0.29.6",
-    "@uniweb/runtime": "^0.27.2",
-    "@uniweb/semantic-parser": "^1.4.1",
     "@uniweb/kit": "^0.19.3",
-    "@uniweb/schemas": "^0.3.3"
+    "@uniweb/runtime": "^0.27.2",
+    "@uniweb/schemas": "^0.3.3",
+    "@uniweb/semantic-parser": "^1.4.1"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.55.1",
+    "@uniweb/build": "^0.56.0",
     "@uniweb/content-reader": "^1.2.5",
     "@uniweb/semantic-parser": "^1.4.1"
   },

package/partials/agents.md

@@ -2526,7 +2526,7 @@ uniweb push / pull / clone / status   # Git-style content sync with the Uniweb b
 uniweb refresh / sync                 # Catch up (git + backend, never pushes) / catch up, then push
 uniweb push --org @acme               # First push/publish of a site: who owns it (see below)
 uniweb register [--scope @org]        # Register a foundation + its data schemas to the registry
-uniweb login / logout                 # Start or clear the backend session the verbs above reuse
+uniweb login / logout                 # One backend at a time: log in (--backend <url>) or out
 uniweb org list / create <handle>     # Publish orgs you belong to — the @org in a scoped ref
 uniweb content export [dir]           # Package a site (or a built foundation's schema) as .uwx
 
@@ -2560,7 +2560,7 @@ uniweb <command> --help           # Per-command flags — no side effects. Prefe
 | Any static host at all | `uniweb export` | full control; no Uniweb account needed |
 | Uniweb Cloud | `uniweb publish` | teams with non-technical content authors, or client work |
 
-`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `lastDeploy:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
+`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
 
 Foundations have their own free path too: `uniweb add ci --target foundation` publishes to permanent versioned URLs on GitHub Pages.
 
@@ -2582,7 +2582,7 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 > uniweb publish --personal      # your personal account, deliberately
 > ```
 >
-> The answer is recorded in `site.yml::$org` and committed, so it is a one-time choice per site,
+> The answer is recorded in `sync.json` and committed, so it is a one-time choice per site,
 > not per machine. **Ask the human which one to use** rather than picking for them — a site in
 > the wrong org cannot be moved from here. Sites that already exist are unaffected: their
 > ownership is settled, so nothing is asked.
@@ -2598,11 +2598,13 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **Nobody's work is overwritten without asking.** `uniweb push` is refused if the site changed on the backend since your last pull — usually an author editing in the app — and reports what changed; nothing is written. Edits to different sections never collide. `uniweb pull` overwrites rather than merges, so it refuses while you have uncommitted changes. The recovery for both is `uniweb pull --merge` (or `uniweb refresh`, which runs `git pull` first): changes to different parts of a file combine silently, and a genuine overlap leaves conflict markers and a non-zero exit — so `uniweb pull --merge && uniweb push` never ships markers. `--force` is the deliberate overwrite (on `push` it replaces the backend's changes, on `pull` it discards yours); don't use it to get past a refusal. `uniweb sync` is `refresh` then `push`; neither publishes.
 
+**`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. Commit it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --backend <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --backend <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--backend` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
+
 **The Cloud also provides a real backend for structured data:** a database for every registered data schema, and a CMS that edits both static page content and dynamic data entities typed by those schemas. That's the piece that makes it viable for teams and client work — the client manages records, not markdown files.
 
 Either side can publish. Nothing about this changes how you build: the same foundation and the same site run under `uniweb dev`, `uniweb export`, or a CI deploy with no account at all.
 
-**Publishing vs registering.** Foundations on Uniweb Cloud live in the catalog as `@org/name@version`. When a foundation powers a single site, **don't run `uniweb register` yourself** — `uniweb publish` from the site directory releases the local foundation to the catalog (when its code changed) and goes live in one step. Register deliberately only when the foundation is a product meant for multiple sites; consuming sites then pin `foundation: '@org/name@1.2.3'`. **The catalog is private and access-segregated, not a public package registry** — people see only the foundations licensed to sites they own or edit. The *site* carries the license, and it rides along with site ownership when a developer hands a site to a client. Don't describe publishing as making a foundation publicly discoverable. Schemas can also be registered on their own from a schemas-only package (`@uniweb/schemas`, any `@org/schemas`, or a bare folder of `schemas/*.{yml,json,js}`) — that's how `@std` schemas are published. Auth via `uniweb login`, `--token`, or `UNIWEB_TOKEN`; preview with `--dry-run`.
+**Publishing vs registering.** Foundations on Uniweb Cloud live in the catalog as `@org/name@version`. When a foundation powers a single site, **don't run `uniweb register` yourself** — `uniweb publish` from the site directory releases the local foundation to the catalog (when its code changed) and goes live in one step. Register deliberately only when the foundation is a product meant for multiple sites; consuming sites then pin `foundation: '@org/name@1.2.3'`. **The catalog is private and access-segregated, not a public package registry** — people see only the foundations licensed to sites they own or edit. The *site* carries the license, and it rides along with site ownership when a developer hands a site to a client. Don't describe publishing as making a foundation publicly discoverable. Schemas can also be registered on their own from a schemas-only package (`@uniweb/schemas`, any `@org/schemas`, or a bare folder of `schemas/*.{yml,json,js}`) — that's how `@std` schemas are published. Auth via `uniweb login` (`uniweb login --backend <url> --token <bearer>` without a terminal) or `UNIWEB_TOKEN`; preview with `--dry-run`.
 
 ### Staying current
 

package/src/backend/asset-download.js

@@ -35,8 +35,9 @@ import { mkdirSync, existsSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { ASSET_SLOTS } from '@uniweb/semantic-parser'
 import {
-  readAssetMap,
-  updateAssetMap,
+  readBackendState,
+  updateBackendMap,
+  carryServed,
   servedFingerprint
 } from '@uniweb/build/uwx'
 
@@ -116,7 +117,7 @@ export async function downloadMissingAssets({
 }) {
   const doFetch = fetchImpl || ((u) => globalThis.fetch(u))
   // Read first: a bare-string reference is only recognizable through the map.
-  const map = readAssetMap(siteDir)
+  const map = readBackendState(siteDir, origin).assets || {}
   const refs = collectAssetRefs(document, map)
   const out = { downloaded: [], present: [], failed: [], skipped: [] }
   if (!refs.length) return out
@@ -166,6 +167,7 @@ export async function downloadMissingAssets({
 
   // Newly-landed assets become known ones, so the next pull restores them to
   // this path rather than fetching them again to a second location.
-  if (Object.keys(learned).length) updateAssetMap(siteDir, learned)
+  if (Object.keys(learned).length)
+    updateBackendMap(siteDir, origin, 'assets', learned, carryServed)
   return out
 }

package/src/backend/client.js

@@ -42,65 +42,31 @@ import { uploadFoundationCode } from '../utils/code-upload.js'
 import { uploadSiteAssets } from '../utils/asset-upload.js'
 
 /**
- * Resolve the backend origin via the resolution ladder (highest precedence
- * first). A full URL is reduced to its origin, so callers may pass a whole
- * endpoint URL; an unparseable value falls through to the next tier.
+ * Resolve the backend a command talks to:
  *
- *   1. `flag` — the raw --backend value (this command)
- *   2. UNIWEB_REGISTER_URL env — session-wide override (CI / local dev)
- *   3. `siteScope` — the project's `site.yml::$backend` (site verbs)
- *   4. `siteBackend` — the site's bound backend from deploy.yml (site verbs)
- *   5–7. the logged-in session origin > ~/.uniweb/config.json > the default
- *        (uniweb.app) — all via getRegistryApiBaseUrl()
+ *   1. UNIWEB_REGISTER_URL env — the override for automation (CI, scripts), one process
+ *   2. ⭐ the backend the user is LOGGED IN TO — the one session there is
+ *   3. the default backend — ~/.uniweb/config.json `registryApiUrl`, else uniweb.app —
+ *      where the command's first request then asks the user to log in
  *
- * ⭐ **`siteScope` outranks the SESSION, and that is the whole reason it is a tier.** The
- * session is a machine-wide default; `$backend` is this project's statement about where
- * its stored identity is meaningful. Without the tier, a teammate who clones a project
- * bound to a non-default backend resolves to whatever they last logged into, and is then
- * REFUSED by `assertSiteBackendScope` — nagged instead of routed, on a question the
- * project already answered.
+ * ⭐ **That is the whole ladder, for every command** *[Diego, 2026-09-21: "push and pull
+ * are also meant to go to the backend you are logged into" · "We do not allow any
+ * communication with backend if the user is not logged into a backend. The default
+ * backend for login, if not specified, is uniweb.app" · switching "via login to another
+ * backend is good, and the only way to switch"]*. Logging in is how a backend is chosen.
  *
- * ⭐ **And it outranks `siteBackend`, which looks like the same fact and is not.**
- * `deploy.yml`'s target `backend` records *where this ships*; `$backend` records *whose
- * namespace the uuid is in*. They agree in the normal case. When they disagree the
- * identity wins, because resolving to the other one only reaches the guard and stops.
+ * ⛔ **No `--backend` tier, and no project tier.** The backend verbs had a per-command
+ * `--backend` until 2026-09-21 — it predates per-backend sessions, when one session
+ * slot made "aim this one command elsewhere" a flag's job; switching is a login now, and
+ * a script aims with UNIWEB_REGISTER_URL without touching the machine's login. A
+ * project's sync.json and deploy.yml routed commands too, until the same day.
+ * `--backend` survives only where it SELECTS rather than routes: `login` (where to log
+ * in) and `forget` (which backend's records to remove). `logout` needs none: there is
+ * one session.
  *
- * ⚠️ The explicit overrides stay ON TOP deliberately. `--backend` and the env var are how
- * you deliberately aim elsewhere — at a staging mirror, say — and a project file must not
- * be able to veto a flag the user just typed. A wrong aim is then caught by the guard
- * rather than silently redirected.
- *
- * @param {string} [flag] - the raw value of --backend, if supplied
- * @param {object} [opts]
- * @param {string} [opts.siteScope] - the project's `site.yml::$backend`
- * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend origin
  * @returns {string} a bare origin with no trailing slash
  */
-export function resolveBackendOrigin(flag, { siteScope, siteBackend } = {}) {
-  const norm = (v) => {
-    try {
-      return new URL(v).origin
-    } catch {
-      return null
-    }
-  }
-  if (flag) {
-    const o = norm(flag)
-    if (o) return o
-  }
-  const env = process.env.UNIWEB_REGISTER_URL
-  if (env) {
-    const o = norm(env)
-    if (o) return o
-  }
-  if (siteScope) {
-    const o = norm(siteScope)
-    if (o) return o
-  }
-  if (siteBackend) {
-    const o = norm(siteBackend)
-    if (o) return o
-  }
+export function resolveBackendOrigin() {
   return getRegistryApiBaseUrl()
 }
 
@@ -142,10 +108,8 @@ export const DISCOVERY_DEFAULTS = {}
 export class BackendClient {
   /**
    * @param {object} [opts]
-   * @param {string} [opts.origin] - explicit origin (wins over originFlag/env)
-   * @param {string} [opts.originFlag] - raw --backend value to resolve
-   * @param {string} [opts.siteScope] - the project's `site.yml::$backend` (site verbs)
-   * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend (site verbs)
+   * @param {string} [opts.origin] - explicit origin (wins over the ladder; tests and
+   *        internal callers — no command takes one from the user)
    * @param {string} [opts.token] - explicit bearer (wins over env + stored session)
    * @param {() => Promise<string>} [opts.getToken] - injected bearer resolver (tests, or
    *        callers with their own auth); used when no explicit token/env is present
@@ -155,9 +119,6 @@ export class BackendClient {
    */
   constructor({
     origin,
-    originFlag,
-    siteScope,
-    siteBackend,
     token,
     getToken,
     args = [],
@@ -165,7 +126,7 @@ export class BackendClient {
     fetchImpl
   } = {}) {
     this.origin = (
-      origin || resolveBackendOrigin(originFlag, { siteScope, siteBackend })
+      origin || resolveBackendOrigin()
     ).replace(/\/+$/, '')
     this._token = token || process.env.UNIWEB_TOKEN || null
     this._getToken = getToken || null
@@ -176,9 +137,9 @@ export class BackendClient {
   }
 
   /**
-   * The session bearer, resolved lazily and memoized. Order (matching the
-   * standalone verbs): explicit --token / UNIWEB_TOKEN (constructor) > stored
-   * session > interactive login (ensureRegistryAuth).
+   * The session bearer, resolved lazily and memoized. Order: an explicit `token`
+   * (constructor — tests and internal callers; no command takes one from the user) /
+   * UNIWEB_TOKEN > the stored session > interactive login (ensureRegistryAuth).
    * @returns {Promise<string>}
    */
   async token() {
@@ -187,27 +148,13 @@ export class BackendClient {
       this._token = await this._getToken()
       return this._token
     }
-    // Origin-mismatch guard: a usable session authed against a DIFFERENT origin
-    // than this command targets means the bearer will be rejected — warn once
-    // and point at the fix (the stored token IS for `stored.origin`, not here).
-    if (!this._warnedOriginMismatch) {
-      this._warnedOriginMismatch = true
-      try {
-        const stored = await readRegistryAuth()
-        if (
-          stored?.token &&
-          !isExpired(stored) &&
-          stored.origin &&
-          stored.origin.replace(/\/+$/, '') !== this.origin
-        ) {
-          console.error(
-            `\x1b[33m⚠\x1b[0m Logged in to ${stored.origin}, but this command targets ${this.origin} — the session may be rejected. Run \`uniweb login --backend ${this.origin}\`, or pass --token.`
-          )
-        }
-      } catch {
-        /* advisory only */
-      }
-    }
+    // ⛔ NO ORIGIN-MISMATCH GUARD HERE, AND DO NOT RE-ADD ONE (removed 2026-09-20).
+    // It existed because the session store held ONE record: a session for another
+    // backend was the only session, so it was about to be sent here and rejected, and a
+    // warning was the best available move. Sessions are keyed by origin now
+    // (utils/registry-auth.js), so being logged into another backend is just a fact
+    // about another backend — `ensureRegistryAuth` below finds this origin's session or
+    // asks for one. Warning about the other would be noise about nothing.
     this._token = await ensureRegistryAuth({
       apiBase: this.origin,
       command: this._command,
@@ -255,8 +202,8 @@ export class BackendClient {
   // ── Discovery ─────────────────────────────────────────────────────────────────
 
   /**
-   * The session bearer IF one can be had without asking — an explicit `--token`, an
-   * env var, or a stored unexpired session. Never prompts, never logs in, returns null
+   * The session bearer IF one can be had without asking — an explicit `token`, the
+   * UNIWEB_TOKEN env var, or a stored unexpired session. Never prompts, never logs in, returns null
    * instead. `token()` is the one that may block; this is for calls that want to be
    * authenticated when possible but must not *cause* an authentication.
    * @returns {Promise<string|null>}
@@ -276,7 +223,7 @@ export class BackendClient {
       }
     }
     try {
-      const stored = await readRegistryAuth()
+      const stored = await readRegistryAuth(this.origin)
       if (stored?.token && !isExpired(stored)) return stored.token
     } catch {
       /* advisory — a missing or unreadable session is simply "no token" */
@@ -455,8 +402,8 @@ export class BackendClient {
    * the field itself is required and cannot be blank.
    *
    * NOT idempotent: two calls mint two sites (a name is not a unique key, by
-   * design). Callers must guard on `site.yml::$uuid` and write the result back
-   * immediately — see `ensureSiteExists`.
+   * design). Callers must guard on the site's uuid for this backend (sync.json) and
+   * write the result back immediately — see `ensureSiteExists`.
    *
    * @param {{ name: string, foundation: string, asOrg?: string|null }} opts
    * @returns {Promise<Response>} `{ site_content_uuid }`
@@ -545,7 +492,7 @@ export class BackendClient {
   /**
    * POST /dev/site/publish/{uuid} — CMS-publish a synced site (make its CURRENT
    * backend state live; it does NOT push local files). `{uuid}` is the site-content
-   * uuid (`site.yml::$uuid`); a never-synced site 404s (sync first, or use deploy).
+   * uuid on this backend (sync.json); a never-synced site 404s (sync first, or use deploy).
    * Languages, when present, go in the body; absent → no body. Returns the raw
    * Response ({ deploy_uuid, url, published_folder_uuid, status } on 200).
    *

package/src/backend/foundation-bring-along.js

@@ -38,7 +38,6 @@ import { execFileSync } from 'node:child_process'
 
 import { detectFoundationType, isExtensionUrl } from '@uniweb/build'
 import { computeFoundationDigest } from '../utils/code-upload.js'
-import { readFlagValue } from '../utils/args.js'
 import { isNonInteractive } from '../utils/interactive.js'
 import { compareSemverPrecedence } from '../utils/semver-precedence.js'
 
@@ -151,14 +150,12 @@ function readPkgField(dir, field) {
   }
 }
 
-// Forward the origin + auth flags so the spawned `uniweb register` / `build`
-// hits the SAME backend with the SAME session as the publish that called it.
+// What travels to the spawned `uniweb register` / `build` on the command line: only
+// --non-interactive. The BACKEND travels in the child's environment
+// (releaseFoundation), and the SESSION is the shared session file — or UNIWEB_TOKEN,
+// which the child inherits. The backend commands take no `--backend` or `--token`.
 function forwardedFlags(args) {
   const out = []
-  for (const name of ['--backend', '--token']) {
-    const v = readFlagValue(args, name)
-    if (v) out.push(name, v)
-  }
   if (isNonInteractive(args)) out.push('--non-interactive')
   return out
 }
@@ -322,7 +319,7 @@ async function bringLocalCodeAlong({
     }
     say.info(`Releasing the ${kind} ${label} (not yet registered)…`)
     return {
-      released: releaseFoundation(local, args, cliBin, say),
+      released: releaseFoundation(local, args, cliBin, say, client?.origin),
       proceed: true,
       ref: pinnedRef()
     }
@@ -365,7 +362,7 @@ async function bringLocalCodeAlong({
           : `Releasing the ${kind} ${label} — not newer than the registered latest ${reg.latest_version}, so the registry takes it only if ${local.version} is already registered with this code…`
     )
     return {
-      released: releaseFoundation(local, args, cliBin, say),
+      released: releaseFoundation(local, args, cliBin, say, client?.origin),
       proceed: true,
       ref: pinnedRef()
     }
@@ -396,7 +393,7 @@ async function bringLocalCodeAlong({
     )
     if (reRelease)
       return {
-        released: releaseFoundation(local, args, cliBin, say),
+        released: releaseFoundation(local, args, cliBin, say, client?.origin),
         proceed: true,
         ref: pinnedRef()
       }
@@ -490,12 +487,15 @@ function buildFoundation(local, cliBin) {
 // Release = `uniweb register` in the foundation directory (the one foundation
 // release path). Returns true on success; throws to the caller on failure so
 // publish stops before going live with missing code.
-function releaseFoundation(local, args, cliBin, say) {
+function releaseFoundation(local, args, cliBin, say, origin) {
   console.log('')
+  // ⭐ Pinned to the parent's backend through the environment, so the release lands
+  // where the publish goes by construction — not because two processes happen to read
+  // the same session file the same way.
   execFileSync('node', [cliBin, 'register', ...forwardedFlags(args)], {
     cwd: local.dir,
     stdio: 'inherit',
-    env: process.env
+    env: origin ? { ...process.env, UNIWEB_REGISTER_URL: origin } : process.env
   })
   console.log('')
   return true

package/src/backend/service-request.js

@@ -38,7 +38,8 @@
  *
  * ## ⛔ A HASH, never the block
  *
- * `$secrets` carries secret material, and `$services[].config` is opaque and
+ * `$secrets` names every secret the site has (values are the `#ref` marker, never
+ * secret material — the old wording here said otherwise), and `$services[].config` is opaque and
  * per-service — anything may be in it. `deploy.yml` is committed, so recording
  * either verbatim would write them into git. Equality is all this gate needs;
  * *what* differs is a question for the backend's own copy of the request, not for
@@ -91,11 +92,14 @@ function stableString(value) {
  * @param {object} siteYml
  * @returns {{servicesRequest?: string, secretsRequest?: string}}
  */
-export function fingerprintRequest(siteYml) {
+export function fingerprintRequest(siteYml, provisioned = {}) {
   const out = {}
-  const services = fingerprintDeclaration(siteYml?.$services)
+  // ⭐ Two sources, on purpose. The PROVISIONED rows come from `sync.json` for the
+  // backend being published to (they were `site.yml::$services` / `$secrets` until
+  // 2026-09-20). The language selection below is still authored, so still site.yml.
+  const services = fingerprintDeclaration(provisioned?.services)
   if (services) out.servicesRequest = services
-  const secrets = fingerprintDeclaration(siteYml?.$secrets)
+  const secrets = fingerprintDeclaration(provisioned?.secrets)
   if (secrets) out.secretsRequest = secrets
   // ⭐ The language selection is a request too, and it is the one that moves a
   // PRICE — the line is billed on how many languages go out. Banking it is what
@@ -124,8 +128,8 @@ export function fingerprintRequest(siteYml) {
  * @param {object|null} lastDeploy - `deploy.yml::lastDeploy.<target>`, or null
  * @returns {{declare: boolean, reason: 'no-record'|'changed'|'unchanged'|'undeclared'}}
  */
-export function decideDeclaration(siteYml, lastDeploy) {
-  const now = fingerprintRequest(siteYml)
+export function decideDeclaration(siteYml, lastDeploy, provisioned = {}) {
+  const now = fingerprintRequest(siteYml, provisioned)
   if (!now.servicesRequest && !now.secretsRequest) {
     // Nothing in the file to send. The gate is moot; say so rather than
     // reporting "unchanged", which would imply a comparison happened.
@@ -178,8 +182,8 @@ export function decideDeclaration(siteYml, lastDeploy) {
  * @param {object|null} lastDeploy - the banked base
  * @returns {{action:'none'|'adopt'|'send'|'conflict', local:string|null, remote:string|null}}
  */
-export function reconcileRequest(siteYml, remoteServices, lastDeploy) {
-  return reconcile(siteYml?.$services, remoteServices, lastDeploy?.servicesRequest)
+export function reconcileRequest(siteYml, remoteServices, lastDeploy, provisioned = {}) {
+  return reconcile(provisioned?.services, remoteServices, lastDeploy?.servicesRequest)
 }
 
 /**