uniweb 0.59.2 → 0.60.0

package/src/index.js

@@ -805,6 +805,15 @@ async function main() {
     process.exit(result?.exitCode ?? 0)
   }
 
+  // Handle forget — remove one backend's local records (sync.json, cache, deploy
+  // records), or with --all everything a copied project inherited. Local only: every
+  // site still exists on its backend. Needs @uniweb/build (the store).
+  if (command === 'forget') {
+    const { forget } = await importProjectCommand('./commands/forget.js')
+    const result = await forget(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
   // Handle status command (dynamic import — offline emit via @uniweb/build)
   if (command === 'status') {
     const { status } = await importProjectCommand('./commands/status.js')
@@ -879,70 +888,59 @@ async function main() {
   }
 
   // Handle login command — the backend (username/password · paste a token ·
-  // --token <bearer>). Origin from --backend > UNIWEB_REGISTER_URL >
-  // default, the SAME resolver register/push/pull/deploy use, so a session and
-  // the commands that reuse it always target one backend.
+  // --token <bearer>). ⭐ `--backend <url>` names it; without the flag it is the DEFAULT
+  // backend — UNIWEB_REGISTER_URL, else ~/.uniweb/config.json, else https://uniweb.app —
+  // and never the project's backend or the current session *[Diego, 2026-09-21: "the
+  // default backend for login, if not specified, is uniweb.app"]*. The backend logged in
+  // to becomes CURRENT, and every backend command goes there (only UNIWEB_REGISTER_URL
+  // outranks it) — which is why this is the one place a backend is chosen.
+  //
+  // ⛔ Until 2026-09-21 a bare login went to the backend of the project in the cwd, and
+  // asked when the machine knew several backends. Both are gone: the default is the
+  // default, and any other backend is named.
   if (command === 'login') {
     const loginArgs = args.slice(1)
-    const { resolveBackendOrigin } = await import('./backend/client.js')
     const { readFlagValue } = await import('./utils/args.js')
     const { runRegistryLogin } = await import('./utils/registry-auth.js')
-    const originFlag =
-      readFlagValue(loginArgs, '--backend')
-    const apiBase = resolveBackendOrigin(originFlag)
-
-    // ⭐ The project says where it belongs — say so BEFORE authenticating elsewhere.
-    //
-    // `login` is deliberately NOT given the `site.yml::$backend` tier the site verbs
-    // get (see resolveBackendOrigin): the session it writes is machine-wide, so letting
-    // cwd pick the account you log into would be a silent surprise. But staying silent
-    // does not remove the failure, it MOVES it — you log into the default, and the next
-    // push/pull/publish resolves to `$backend` and warns about the mismatch. That is the
-    // routed-not-nagged case `$backend` was added for, missing at the one command a
-    // teammate runs FIRST after cloning.
-    //
-    // ⛔ Silent when the origin was named explicitly (--backend /
-    // UNIWEB_REGISTER_URL). A deliberate aim is not a mistake to warn about; a genuinely
-    // wrong one is still caught by the session-mismatch guard in BackendClient.token().
-    if (!originFlag && !process.env.UNIWEB_REGISTER_URL) {
-      try {
-        const { findNearbySiteBackend } = await import(
-          './utils/site-identity.js'
-        )
-        const nearby = findNearbySiteBackend(process.cwd())
-        if (nearby && nearby.backend !== apiBase) {
-          console.error(
-            `\x1b[33m⚠\x1b[0m This project syncs with ${nearby.backend} (site.yml::$backend), but login is targeting ${apiBase}.`
-          )
-          console.error(
-            `  Log in where the project belongs:  uniweb login --backend ${nearby.backend}`
-          )
-          console.error(
-            `  Continuing with ${apiBase} — a session is machine-wide, so this is a heads-up, not a block.\n`
-          )
-        }
-      } catch {
-        // Advisory only. A malformed site.yml, an unreadable directory or anything else
-        // here must never be the reason someone cannot log in.
-      }
+    const { resolveLoginOrigin } = await import('./utils/config.js')
+    let apiBase
+    try {
+      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'))
+    } catch (err) {
+      console.error(
+        `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --backend http://localhost:8080`
+      )
+      process.exit(2)
     }
-
     await runRegistryLogin({ apiBase, args: loginArgs })
     return
   }
 
-  // Handle logout command — clear the stored backend session.
+  // Handle logout — THE session. ⭐ There is at most one *[Diego, 2026-09-21: "`uniweb
+  // logout` always logs you out of the one backend you may be logged in"]*, so logout
+  // takes no options: `--backend` and `--all` existed only while sessions were kept per
+  // backend. ⚠️ Local only — the token is forgotten here, not revoked on the backend.
   if (command === 'logout') {
-    const { clearRegistryAuth, getRegistryAuthPath } =
-      await import('./utils/registry-auth.js')
-    const { existsSync } = await import('node:fs')
-    const had = existsSync(getRegistryAuthPath())
-    await clearRegistryAuth()
-    console.log(
-      had
-        ? '\x1b[32m✓\x1b[0m Logged out (cleared the stored session).'
-        : 'Not logged in — nothing to clear.'
-    )
+    const stray = args.slice(1).find((a) => a.startsWith('-') && a !== '--non-interactive')
+    if (stray) {
+      console.error(
+        `\x1b[31m✗\x1b[0m \`uniweb logout\` takes no options (got ${stray}) — it logs you out of the backend you are logged in to.`
+      )
+      process.exit(2)
+    }
+    const { clearRegistryAuth } = await import('./utils/registry-auth.js')
+    const { loggedInOrigin } = await import('./utils/config.js')
+    const origin = loggedInOrigin()
+    const cleared = await clearRegistryAuth()
+    if (!cleared.length) {
+      console.log('Not logged in — nothing to clear.')
+      return
+    }
+    console.log(`\x1b[32m✓\x1b[0m Logged out${origin ? ` of ${origin}` : ''}.`)
+    // A file from before sessions were single can hold several; all of them go.
+    const others = cleared.filter((o) => o !== origin)
+    if (others.length)
+      console.log(`\x1b[2mAlso removed stored sessions for: ${others.join(', ')}\x1b[0m`)
     return
   }
 
@@ -1392,7 +1390,7 @@ ${colors.bright}Options:${colors.reset}
   --host <name>       The host to ship to (no value → the wizard, TTY only)
   --target <name>     Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run           Resolve the target + adapter; print summary; upload nothing
-  --no-save           Skip the auto-save of lastDeploy in deploy.yml
+  --no-save           Do not record this deploy in deploy.yml
   --no-validate       Skip the content-conformance check (it only warns)
   --non-interactive   Fail with usage info instead of prompting
 
@@ -1429,7 +1427,7 @@ ${colors.bright}Options:${colors.reset}
                      when only the content should go live. Refused if the
                      foundation has never been released — there is nothing to
                      bind to, and the app cannot open such a site.
-  --no-save          Skip the deploy.yml lastDeploy auto-save
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
   --org @org         Publish under @org (membership-gated; alias: --as-org). Read
                      only on a site's FIRST publish — that create decides which org
@@ -1439,8 +1437,6 @@ ${colors.bright}Options:${colors.reset}
   --personal         Create the site under your personal account, deliberately.
                      Only needed on a first publish, and only to answer the owner
                      question without a prompt (CI, agents, scripts).
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
-  --token <bearer>   Auth bearer (skips \`uniweb login\`)
 `,
     create: `
 ${colors.cyan}${colors.bright}uniweb create${colors.reset} ${colors.dim}— Create a new project${colors.reset}
@@ -1691,7 +1687,7 @@ ${colors.bright}Usage:${colors.reset}
   uniweb release  [options]      ${colors.dim}(synonym — reads naturally for updates)${colors.reset}
 
 Builds one \`.uwx\` document and submits it to the registry over HTTP. Run
-\`uniweb login\` first (or pass \`--token\`). \`register\`/\`release\` are for
+\`uniweb login\` first. \`register\`/\`release\` are for
 FOUNDATIONS (and schemas) — code only; \`uniweb publish\` makes a synced SITE
 live (and brings its foundation along); \`uniweb deploy\` hosts on a third-party
 host. \`register\` and \`release\` are the same act: \`register\` reads naturally
@@ -1711,8 +1707,6 @@ ${colors.bright}Options:${colors.reset}
   --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or a local URL)
-  --token <bearer>   Submit with this bearer; skips \`uniweb login\` (or set UNIWEB_TOKEN)
   --non-interactive  Fail with usage info instead of prompting
 
 Run from a foundation, a schemas-only package, or a workspace with a single foundation.
@@ -1753,19 +1747,26 @@ ${colors.cyan}${colors.bright}uniweb login${colors.reset} ${colors.dim}— Log i
 ${colors.bright}Usage:${colors.reset}
   uniweb login [options]
 
-Authenticates with the backend and stores a session at
-~/.uniweb/registry-auth.json. Every backend command (register, push, pull,
-clone, deploy) reuses it. Interactively, pick username/password or paste a token.
+Authenticates with a backend and stores its session in
+~/.uniweb/registry-auth.json. ${colors.bright}One backend at a time:${colors.reset} logging in to another one
+logs you out of the first (once the new login succeeds). The backend you are
+logged in to is where the backend commands go (push, pull, publish, status,
+register, clone) — so this is how you switch. Already logged in to it, login
+does nothing; add --password, --browser, --token-paste or --token to log in again.
+
+Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
+to a backend you are not logged in to — run one before logging in and it asks first.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
+  --backend <url>    The backend to log in to
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
+  --browser          Force the browser method
   --password         Force the username/password method
   --token-paste      Force the paste-a-token prompt
 
 In non-interactive mode (CI / no TTY), pass \`--token <bearer>\`, or set
 \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set \`UNIWEB_TOKEN\` (used per-command,
-not stored). Run \`uniweb logout\` to clear the stored session.
+not stored). \`uniweb logout\` logs you out.
 `,
     refresh: `
 ${colors.cyan}${colors.bright}uniweb refresh${colors.reset} ${colors.dim}— Catch up with teammates AND app authors${colors.reset}
@@ -1784,8 +1785,6 @@ reflexively. Exits non-zero if a merge leaves conflicts.
 ${colors.bright}Options:${colors.reset}
   --no-git           Skip the git remote; backend only
   --no-backend       Skip the backend; git only
-  --backend <url>    Override the backend origin
-  --token <bearer>   Read with this bearer; skips \`uniweb login\`
 
 \`--force\` and \`--merge\` are NOT accepted here: this verb builds the delegated
 pull's arguments itself, and to pull \`--force\` means "discard my local work".
@@ -1813,11 +1812,32 @@ ${colors.bright}Options:${colors.reset}
 
   --no-git           Skip the git remote half of the refresh
   --force            Overwrite upstream changes (reaches the PUSH half only)
-  --backend <url>    Override the backend origin
-  --token <bearer>   Auth bearer; skips \`uniweb login\`
 
 \`--force\` means "overwrite upstream" to push but "discard my local work" to pull,
 so it is deliberately kept away from the refresh half.
+`,
+    forget: `
+${colors.cyan}${colors.bright}uniweb forget${colors.reset} ${colors.dim}— Remove what this project recorded about where it synced${colors.reset}
+
+${colors.bright}Usage:${colors.reset}
+  uniweb forget --backend <url>
+  uniweb forget --all
+
+Local files only. Every site stays where it is on its backend.
+
+${colors.bright}Options:${colors.reset}
+  --backend <url>    Forget one backend: its entries in sync.json and in the local
+                     cache, and its deploy records in deploy.yml. Its targets stay,
+                     so the next publish there creates a new site.
+  --all              For a COPY of a project that should become a new one. Deletes
+                     sync.json, deploy.yml and the local cache — everything naming
+                     the original's sites and destinations. Without it, the copy's
+                     first push updates the original's site.
+
+Record files keep their \`$uuid\`: it is the record's own id, not a backend's.
+
+To duplicate a project:
+  cp -r my-site my-site-2 && cd my-site-2 && uniweb forget --all
 `,
     invite: `
 ${colors.cyan}${colors.bright}uniweb invite${colors.reset} ${colors.dim}— (reserved; not available on the new backend yet)${colors.reset}
@@ -1986,6 +2006,7 @@ ${colors.bright}Commands:${colors.reset}
   refresh            Catch up with the git remote AND the backend (never pushes)
   sync               Catch up, then push (refresh + push)
   status             Show a site's sync state (unpushed content, foundation)
+  forget             Forget a backend, or --all to make a copied project a new one
   inspect <path>     Inspect parsed content shape of a markdown file or folder
   docs               Generate component documentation
   families           List the standard section families (for meta.js family:)
@@ -1994,7 +2015,7 @@ ${colors.bright}Commands:${colors.reset}
   update             Align workspace deps + AGENTS.md to the running CLI
   i18n <cmd>         Internationalization (extract, sync, status)
   login              Log in to your Uniweb account
-  logout             Clear the stored session
+  logout             Log out of the backend you are logged in to
 
 ${colors.bright}Create Options:${colors.reset}
   --template <type>  Project template (default: starter)
@@ -2015,16 +2036,20 @@ ${colors.bright}Global Options:${colors.reset}
   --non-interactive    Fail with usage info instead of prompting
                        Auto-detected when CI=true or no TTY (pipes, agents)
 
+  Backend commands (push, pull, publish, status, register, clone) go to the
+  backend you are logged in to, with its session. Switch with
+  \`uniweb login --backend <url>\` (add \`--token <bearer>\` to sign in with a token);
+  a script can aim and authenticate one process with UNIWEB_REGISTER_URL and
+  UNIWEB_TOKEN instead.
+
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
   --org @org         Publish under @org (first publish only; then remembered)
   --personal         Own the new site personally, deliberately (first publish only)
-  --no-save          Skip the deploy.yml lastDeploy auto-save
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
-  --token <bearer>   Auth bearer (skips \`uniweb login\`)
 
   uniweb publish is the smart Uniweb-hosting path: it brings the site's
   foundation along, syncs, and goes live. To register a foundation on its own
@@ -2037,7 +2062,7 @@ ${colors.bright}Deploy Options:${colors.reset}
                      s3-cloudfront, or \`uniweb\` (delegates to \`uniweb publish\`).
   --target <name>    Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run          Resolve the target + adapter; print summary; upload nothing
-  --no-save          Skip the auto-save of lastDeploy in deploy.yml
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
   To deploy on every push instead, see \`uniweb add ci --help\`.
 

package/src/utils/args.js

@@ -47,10 +47,9 @@ export function readOrgFlag(args) {
  *
  * The CLI reads flags by scanning argv for a literal, so an unrecognized flag is
  * not an error — it is *invisible*, and whatever it was meant to change silently
- * keeps its default. The sharp case is `--backend`: mistype it and the origin
- * ladder falls through to the session, the saved config, or `https://uniweb.app`,
- * so a command aimed at localhost can reach production. `--token` degrades the
- * same way, to a stored session belonging to someone else.
+ * keeps its default. The sharp cases were `--backend` and `--token`, which aimed a
+ * command and chose its identity; both left the backend commands on 2026-09-21
+ * (the login does both now), and the guard names the login when either is passed.
  *
  * Scanning rules, chosen to avoid false positives (a wrong rejection is worse than
  * a missed one — it breaks a working command):

package/src/utils/asset-upload.js

@@ -19,11 +19,24 @@
  *               its id+ext for the rewrite. Absent `present` ⇒ false — an older
  *               backend without the flag uploads everything (today's behavior).
  *
- * Assets are GLOBAL + content-addressed: identical bytes → same id → dedup
- * across sites and idempotent re-deploys (a re-PUT is a cheap no-op). This
- * mirrors the foundation code lane (utils/code-upload.js); the one structural
- * difference is that the backend MINTS the per-asset id, so the plan response is
- * what the deploy step rewrites content references to.
+ * Assets are content-addressed and global WITHIN ONE BACKEND: identical bytes →
+ * same id → dedup across that backend's sites and idempotent re-deploys (a
+ * re-PUT is a cheap no-op). This mirrors the foundation code lane
+ * (utils/code-upload.js); the one structural difference is that the backend
+ * MINTS the per-asset id, so the plan response is what the deploy step rewrites
+ * content references to.
+ *
+ * ⛔ **"Global" is the DEDUP SCOPE, not a claim about other backends.** An id,
+ * and the presence of the bytes behind it, are facts about the backend that
+ * answered the PLAN and about nothing else — where a backend keeps them is its
+ * own business and not a shape this lane models. ⚠️ This said only "GLOBAL" until
+ * 2026-09-20 and was read as "the same id works on any backend", which made
+ * `assets.json` look portable in a multi-backend design. It is not: `sync.json`
+ * keeps asset ids per backend (`backends.<origin>.assets`), and the backend ORIGIN
+ * is the segregation value the CLI has.
+ *
+ * ⚠️ Do not infer portability from `id` looking like the sha256 either — we read
+ * it from the response precisely so the derivation is never load-bearing here.
  */
 
 import { createHash } from 'node:crypto'

package/src/utils/config.js

@@ -21,6 +21,7 @@ import { homedir } from 'node:os'
 import yaml from 'js-yaml'
 import { filterCmd } from './pm.js'
 import { writeJsonPreservingStyleAsync } from './json-file.js'
+import { loggedInOriginOf, readSessionFileSync } from './session-file.js'
 
 // ── Backend origin ─────────────────────────────────────────────
 
@@ -57,64 +58,100 @@ function readCliConfig() {
  * to keep this module off the optional-peer / import-cycle path.
  * @returns {string|null}
  */
-function readSessionOrigin() {
+/**
+ * **The backend the user is logged in to** — the one session's backend — or null.
+ *
+ * ⛔ This read `~/.uniweb/registry-auth.json`'s top-level `origin` itself until
+ * 2026-09-21: the v1 shape. The file had become one session per backend, which has no
+ * such field, so this answered null for every new login and the session tier below
+ * silently fell through to the default backend. It reads through the file's one reader
+ * now (utils/session-file.js).
+ *
+ * @returns {string|null}
+ */
+export function loggedInOrigin() {
+  return loggedInOriginOf(readSessionFileSync(DEFAULT_BACKEND_ORIGIN))
+}
+
+/** A value's bare origin, or null when it is not a URL. */
+function originOrNull(value) {
+  if (!value) return null
   try {
-    const p = join(homedir(), '.uniweb', 'registry-auth.json')
-    if (!existsSync(p)) return null
-    const o = JSON.parse(readFileSync(p, 'utf8'))?.origin
-    return o || null
+    // ⛔ http(s) only: `new URL('localhost:8080')` PARSES — as the scheme `localhost:` —
+    // and its origin is the string "null", which is truthy. A bare host:port is the
+    // easy slip, and it must not become a backend.
+    const u = new URL(value)
+    return u.protocol === 'http:' || u.protocol === 'https:' ? u.origin : null
   } catch {
     return null
   }
 }
 
 /**
- * Get the backend's API base origin. `register` POSTs to
- * {origin}/dev/registry/register, `login` to {origin}/dev/auth/login, etc.
- * (BackendClient.resolveBackendOrigin layers the --backend flag and a site's
- * deploy.yml backend on top of this.)
+ * **The default backend** — where a bare `uniweb login` goes, and where a backend command
+ * goes when nobody is logged in (the login it asks for is then this one).
+ *
+ * `UNIWEB_REGISTER_URL`, else `~/.uniweb/config.json` `registryApiUrl`, else
+ * https://uniweb.app. ⛔ **Never the current session** *[Diego, 2026-09-21: "the default
+ * backend for login, if not specified, is uniweb.app"]* — a bare `uniweb login` means the
+ * default backend, not "the one I am already on".
+ *
+ * @returns {string}
+ */
+export function getDefaultBackendOrigin() {
+  return (
+    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(readCliConfig().registryApiUrl) ||
+    DEFAULT_BACKEND_ORIGIN
+  )
+}
+
+/**
+ * The backend `uniweb login` logs in to: `--backend`, else the default backend.
+ *
+ * ⛔ A mistyped `--backend` is an error, never a fallback — it would log you in, and so
+ * point every command, somewhere you did not name.
+ *
+ * @param {string|null|undefined} flag - `readFlagValue`'s answer: undefined when the
+ *   flag is absent, null when it was given with no value
+ * @returns {string}
+ * @throws {Error} when --backend was given and is not a URL
+ */
+export function resolveLoginOrigin(flag) {
+  if (flag === undefined) return getDefaultBackendOrigin()
+  const origin = originOrNull(flag)
+  if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--backend needs a URL')
+  return origin
+}
+
+/**
+ * **The backend a command talks to** when no `--backend` is given — the base of every
+ * `/dev/*` route (`register` POSTs to {origin}/dev/registry/register, and so on).
+ *
+ * `UNIWEB_REGISTER_URL` > **the backend the user is logged in to** > the default
+ * (`getDefaultBackendOrigin`). ⭐ Nothing talks to a backend the user is not logged in
+ * to *[Diego, 2026-09-21]*: when this falls through to the default, the command's first
+ * request asks for that login — so the default is where the login goes, never a
+ * backend reached without one. `resolveBackendOrigin` puts `--backend` on top.
  *
- * Priority: UNIWEB_REGISTER_URL's origin > the logged-in session origin >
- * ~/.uniweb/config.json registryApiUrl > the default (uniweb.app). Local dev
- * points at a local backend EXPLICITLY (--backend / UNIWEB_REGISTER_URL /
- * `uniweb login --backend …`), rather than the default being localhost.
  * @returns {string}
  */
 export function getRegistryApiBaseUrl() {
-  const fromEnv = process.env.UNIWEB_REGISTER_URL
-  if (fromEnv) {
-    try {
-      return new URL(fromEnv).origin
-    } catch {
-      /* fall through */
-    }
-  }
-  const fromSession = readSessionOrigin()
-  if (fromSession) {
-    try {
-      return new URL(fromSession).origin
-    } catch {
-      return fromSession
-    }
-  }
-  const fromCfg = readCliConfig().registryApiUrl
-  if (fromCfg) {
-    try {
-      return new URL(fromCfg).origin
-    } catch {
-      return fromCfg
-    }
-  }
-  return DEFAULT_BACKEND_ORIGIN
+  return (
+    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(loggedInOrigin()) ||
+    getDefaultBackendOrigin()
+  )
 }
 
 /**
  * The built-in backend origin — the last tier of the ladder, and the 98% case.
  *
- * Exported because `site.yml::$backend` is written ONLY when the backend is NOT this
- * (`recordSiteBackend`, utils/site-identity.js). That test needs the *built-in* default,
- * which `getRegistryApiBaseUrl()` cannot give it — that function returns whatever tier
- * won, so on a machine with a session or a saved config it returns something else
+ * Exported because several readers need the *built-in* default, not the resolved one:
+ * a v1 session file with no origin stamp, `login`'s list of known backends, and a
+ * deploy.yml `host: uniweb` target with no `backend:` (its documented meaning).
+ * `getRegistryApiBaseUrl()` cannot give it — that function returns whatever tier won,
+ * so on a machine with a session or a saved config it returns something else
  * entirely. Two copies of the literal would silently disagree exactly there.
  */
 export const DEFAULT_BACKEND_ORIGIN = 'https://uniweb.app'