uniweb 0.59.2 → 0.61.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.59.2",
+  "version": "0.61.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/content-writer": "^0.3.4",
-    "@uniweb/core": "^0.29.6",
-    "@uniweb/runtime": "^0.27.2",
+    "@uniweb/core": "^0.29.7",
+    "@uniweb/kit": "^0.19.4",
+    "@uniweb/schemas": "^0.3.3",
     "@uniweb/semantic-parser": "^1.4.1",
-    "@uniweb/kit": "^0.19.3",
-    "@uniweb/schemas": "^0.3.3"
+    "@uniweb/runtime": "^0.27.3",
+    "@uniweb/content-writer": "^0.3.4"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.55.1",
+    "@uniweb/build": "^0.57.0",
     "@uniweb/content-reader": "^1.2.5",
     "@uniweb/semantic-parser": "^1.4.1"
   },

package/partials/agents.md

@@ -845,26 +845,26 @@ It is a small database, not a page tree. Three things, deliberately separate:
 ```
 site/
 ├── pages/
-├── entities/          # your stored things. The folder names their data schema
-│   ├── article/
+├── records/           # your site's records — every file here is one
+│   ├── article/       # the folder names their data schema
 │   │   ├── getting-started.md
 │   │   └── design-tips.md
 │   └── person/
 │       └── alice.yml
-├── records.yml        # what is PUBLISHED
+├── records.yml        # optional: sorts records into folders
 ├── queries.yml        # how content is REACHED
 └── site.yml
 ```
 
-**`entities/{schema}/` — the pool.** The folder names the data schema and nothing else:
+**`records/{schema}/` — the site's records.** Putting a file here is what makes it a record; nothing else lists it. The folder names the data schema and nothing else:
 
 | on disk | schema |
 |---|---|
-| `entities/article/…` | `@/article` — your foundation's own |
-| `entities/std/person/…` | `@std/person` — the shared standard set |
-| `entities/acme/project/…` | `@acme/project` — an org's |
+| `records/article/…` | `@/article` — your foundation's own |
+| `records/std/person/…` | `@std/person` — the shared standard set |
+| `records/acme/project/…` | `@acme/project` — an org's |
 
-Keep those folders flat: `entities/article/design-tips.md` works; `entities/article/2025/design-tips.md` is read as the `2025` schema of an `article` org, which is not what you meant. Organise in `records.yml` instead.
+Keep those folders flat: `records/article/design-tips.md` works; `records/article/2025/design-tips.md` is read as the `2025` schema of an `article` org, which is not what you meant. Organise in `records.yml` instead. A file whose name starts with `_` is not a record — somewhere to keep work in progress.
 
 **Four formats, one shape.** All of these produce the same records at runtime:
 
@@ -877,32 +877,22 @@ Keep those folders flat: `entities/article/design-tips.md` works; `entities/arti
 
 **One record per file, or many.** A single mapping at the top of a file makes one record and the filename stem becomes its `slug`. A top-level array (YAML/JSON) or a multi-entry `.bib` makes many, each carrying its own `slug`. You can mix both in one folder — an exported `refs.bib` beside a hand-written `extras.yml`.
 
-Item frontmatter conventionally uses `title`, `date`, `tags`, `image`, `description`, `published`, `author` — plus any fields your content needs (`price`, `role`, `order`). Images can sit beside the item file and be referenced with `./`. `published: false` hides an item without deleting it; items with no `published` field are included.
+Item frontmatter conventionally uses `title`, `date`, `tags`, `image`, `description`, `author` — plus any fields your content needs (`price`, `role`, `order`). Images can sit beside the item file and be referenced with `./`. **`draft: true` keeps a record off the live site without deleting it**: it is still a record, in `records/`, and `pnpm dev` shows it so you can preview it, but a build for hosting leaves it out — and `uniweb push` stops at it, naming it. (`published: false`, an older spelling, is refused.)
 
-**`records.yml` — listing an entity is what publishes it.** A file in `entities/` exists; listing it here makes it a record. Anything you leave out is a draft — no flag to set. **The common case is three lines:**
+**`records.yml` — optional, and only for folders.** Every record sits at the top of the site's records folder unless `records.yml` places it in a sub-folder. Add one only when a query needs to ask for a *slice* of the records rather than all of them — most sites never do:
 
 ```yaml
-- article/*.md
-- person/*.yml
-```
-
-A bare string is a path under `entities/`, naming one file or matching many.
-
-⚠️ **An empty `records.yml` is not the same as having none.** With no file, a build publishes every entity in `entities/`, and `uniweb push` leaves the published set alone. An empty file means "nothing is published": a build publishes none, and a push REMOVES what is published. The CLI asks before it does that.
-
-**Structure is for querying, not for navigation.** Add a `folder:` only when a query needs to ask for a *slice* of the pool rather than all of it — most sites never do:
-
-```yaml
-- article/2026-*.md
 - folder: archive
   label: The Archive
   records:
     - article/2025-*.md
 ```
 
-A query reads one branch with `scope: archive` — the folder and everything inside it (the older `where: { path: { under: … } }` is refused by the build). An entity belongs to one folder; if you want a computed subset, that is a query, not a second placement.
+A path under a folder is relative to `records/`, naming one file or matching many. A query reads one folder with `scope: archive` — the folder and everything inside it. A record sits in one folder; if you want a computed subset, that is a query, not a second placement. Structure is for querying, not for navigation — and `records.yml` never lists a record at the top level (the build refuses it: every file in `records/` is a record already).
 
-**`queries.yml` — how content is reached.** A bare map of name → query. A query names a schema and the published records of that schema are its rows:
+⚠️ **With a backend, `records/` is what `uniweb push` sends** — every record in it. A site with no `records/` at all leaves the backend's records alone; an *empty* `records/` removes them, and the CLI asks before it does. Records pushed to a backend are served once the site is published.
+
+**`queries.yml` — how content is reached.** A bare map of name → query. A query names a schema and the site's records of that schema are its rows:
 
 ```yaml
 recent:
@@ -912,7 +902,7 @@ recent:
 
 team:
   schema: '@std/person'
-  where: { published: { ne: false } }    # a predicate — see authoring/predicates.md
+  where: { active: true }                # a predicate — see authoring/predicates.md
 ```
 
 You can keep the same declarations under `queries:` in `site.yml` instead, if you would rather have one file.
@@ -944,7 +934,7 @@ pages/blog/
     └── article.md    # just `type: Article` — the record arrives automatically
 ```
 
-`entities/article/design-tips.md` becomes `/blog/design-tips`. The section inside `[slug]/` needs no special markdown — the matched record is delivered to it. Generated pages are excluded from navigation menus.
+`records/article/design-tips.md` becomes `/blog/design-tips`. The section inside `[slug]/` needs no special markdown — the matched record is delivered to it. Generated pages are excluded from navigation menus.
 
 **Link a card with `item.$route` — never compose the URL.** Every record a query delivers carries `$route`, the URL of the parametric page whose route query is that query (`/blog/design-tips`), wherever the list appears — the query's own page, the homepage, a sidebar. No page for the query, or no value for the field its URL is built from, means no `$route`, never a broken one. `detailPage: page:<id>` on a fetch links the records to another page instead. `$` marks a field the framework fills, so a record's own `route` field is left alone. ⛔ `route:` on a query is retired and stops the build.
 
@@ -1871,7 +1861,7 @@ A foundation can route a scope to a plain folder of schema files instead of a pa
 # pages/blog/page.yml
 fetch:
   query: recent
-  where: { published: true, tags: featured }
+  where: { tags: featured }
   sort: date desc
   limit: 3
 ```
@@ -2526,7 +2516,7 @@ uniweb push / pull / clone / status   # Git-style content sync with the Uniweb b
 uniweb refresh / sync                 # Catch up (git + backend, never pushes) / catch up, then push
 uniweb push --org @acme               # First push/publish of a site: who owns it (see below)
 uniweb register [--scope @org]        # Register a foundation + its data schemas to the registry
-uniweb login / logout                 # Start or clear the backend session the verbs above reuse
+uniweb login / logout                 # One backend at a time: log in (--backend <url>) or out
 uniweb org list / create <handle>     # Publish orgs you belong to — the @org in a scoped ref
 uniweb content export [dir]           # Package a site (or a built foundation's schema) as .uwx
 
@@ -2560,7 +2550,7 @@ uniweb <command> --help           # Per-command flags — no side effects. Prefe
 | Any static host at all | `uniweb export` | full control; no Uniweb account needed |
 | Uniweb Cloud | `uniweb publish` | teams with non-technical content authors, or client work |
 
-`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `lastDeploy:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
+`uniweb deploy` never assumes a host: with nothing configured it opens a picker listing only destinations it can act on, and records the choice in `deploy.yml` so later runs go straight there. On Cloudflare Pages / Netlify / Vercel, `add ci` also adds per-PR previews that comment the URL. Adapters: `github-pages`, `cloudflare-pages`, `netlify`, `vercel`, plus `s3-cloudfront` for `deploy`. That record is `deploy.yml`, beside `site.yml` — **the CLI writes it, you don't create it**: the first successful deploy scaffolds the whole file, and later deploys rewrite only its `deploys:` block. Edit `targets:` when you want to change where a site ships. Host credentials come from the environment, never from that committed file.
 
 Foundations have their own free path too: `uniweb add ci --target foundation` publishes to permanent versioned URLs on GitHub Pages.
 
@@ -2582,7 +2572,7 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 > uniweb publish --personal      # your personal account, deliberately
 > ```
 >
-> The answer is recorded in `site.yml::$org` and committed, so it is a one-time choice per site,
+> The answer is recorded in `sync.json` and committed, so it is a one-time choice per site,
 > not per machine. **Ask the human which one to use** rather than picking for them — a site in
 > the wrong org cannot be moved from here. Sites that already exist are unaffected: their
 > ownership is settled, so nothing is asked.
@@ -2598,11 +2588,13 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **Nobody's work is overwritten without asking.** `uniweb push` is refused if the site changed on the backend since your last pull — usually an author editing in the app — and reports what changed; nothing is written. Edits to different sections never collide. `uniweb pull` overwrites rather than merges, so it refuses while you have uncommitted changes. The recovery for both is `uniweb pull --merge` (or `uniweb refresh`, which runs `git pull` first): changes to different parts of a file combine silently, and a genuine overlap leaves conflict markers and a non-zero exit — so `uniweb pull --merge && uniweb push` never ships markers. `--force` is the deliberate overwrite (on `push` it replaces the backend's changes, on `pull` it discards yours); don't use it to get past a refusal. `uniweb sync` is `refresh` then `push`; neither publishes.
 
+**`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. Commit it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --backend <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --backend <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--backend` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
+
 **The Cloud also provides a real backend for structured data:** a database for every registered data schema, and a CMS that edits both static page content and dynamic data entities typed by those schemas. That's the piece that makes it viable for teams and client work — the client manages records, not markdown files.
 
 Either side can publish. Nothing about this changes how you build: the same foundation and the same site run under `uniweb dev`, `uniweb export`, or a CI deploy with no account at all.
 
-**Publishing vs registering.** Foundations on Uniweb Cloud live in the catalog as `@org/name@version`. When a foundation powers a single site, **don't run `uniweb register` yourself** — `uniweb publish` from the site directory releases the local foundation to the catalog (when its code changed) and goes live in one step. Register deliberately only when the foundation is a product meant for multiple sites; consuming sites then pin `foundation: '@org/name@1.2.3'`. **The catalog is private and access-segregated, not a public package registry** — people see only the foundations licensed to sites they own or edit. The *site* carries the license, and it rides along with site ownership when a developer hands a site to a client. Don't describe publishing as making a foundation publicly discoverable. Schemas can also be registered on their own from a schemas-only package (`@uniweb/schemas`, any `@org/schemas`, or a bare folder of `schemas/*.{yml,json,js}`) — that's how `@std` schemas are published. Auth via `uniweb login`, `--token`, or `UNIWEB_TOKEN`; preview with `--dry-run`.
+**Publishing vs registering.** Foundations on Uniweb Cloud live in the catalog as `@org/name@version`. When a foundation powers a single site, **don't run `uniweb register` yourself** — `uniweb publish` from the site directory releases the local foundation to the catalog (when its code changed) and goes live in one step. Register deliberately only when the foundation is a product meant for multiple sites; consuming sites then pin `foundation: '@org/name@1.2.3'`. **The catalog is private and access-segregated, not a public package registry** — people see only the foundations licensed to sites they own or edit. The *site* carries the license, and it rides along with site ownership when a developer hands a site to a client. Don't describe publishing as making a foundation publicly discoverable. Schemas can also be registered on their own from a schemas-only package (`@uniweb/schemas`, any `@org/schemas`, or a bare folder of `schemas/*.{yml,json,js}`) — that's how `@std` schemas are published. Auth via `uniweb login` (`uniweb login --backend <url> --token <bearer>` without a terminal) or `UNIWEB_TOKEN`; preview with `--dry-run`.
 
 ### Staying current
 
@@ -2695,7 +2687,7 @@ Running `extract` before a build is the usual first mistake — it reads the com
 
 ```
 locales/freeform/es/pages/about/hero.md        # by page route
-locales/freeform/es/entities/article/x.md      # records work too
+locales/freeform/es/records/article/x.md       # records work too
 ```
 
 These are **body only — no frontmatter**; params and config still come from the source section. `uniweb i18n init-freeform es pages/about hero` creates one pre-filled and records a source hash, so `uniweb i18n status --freeform` can tell you when the original moved on (`update-hash` to acknowledge). `move`, `rename`, and `prune --freeform` keep them aligned when pages get reorganized.

package/src/backend/asset-download.js

@@ -7,9 +7,9 @@
  *
  * ## Where an asset lands, and why there are two answers
  *
- * - **The map knows it** (`assets.json`) — the file goes back to the path its
- *   author wrote. That is the whole reason the map is committed: a fresh clone
- *   restores `public/images/hero.png`, not a hash.
+ * - **The map knows it** (this backend's `assets` in `sync.json`) — the file goes
+ *   back to the path its author wrote. That is the whole reason the map is
+ *   committed: a fresh clone restores `public/images/hero.png`, not a hash.
  * - **The map does not know it** — this project has never held these bytes:
  *   authored in the app, or pushed from a machine whose map entry has not
  *   arrived. There is no local path to guess, so it lands at a **generic,
@@ -21,8 +21,8 @@
  * Identity rides beside the reference (`sync-package.js` stamps `assetId` next
  * to the serve URL), so the address is already on the node. Composing one would
  * mean holding the host's route layout — the coupling deleting `buildAssetUrl`
- * removed from this CLI, and the reason `assets.json` stores no URL either. An
- * id with no URL beside it is skipped, not guessed at.
+ * removed from this CLI, and the reason the asset map stores no URL either (only a
+ * fingerprint of one). An id with no URL beside it is skipped, not guessed at.
  *
  * ## ⛔ A failed download is a WARNING, never a failed pull
  *
@@ -35,8 +35,9 @@ import { mkdirSync, existsSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { ASSET_SLOTS } from '@uniweb/semantic-parser'
 import {
-  readAssetMap,
-  updateAssetMap,
+  readBackendState,
+  updateBackendMap,
+  carryServed,
   servedFingerprint
 } from '@uniweb/build/uwx'
 
@@ -116,7 +117,7 @@ export async function downloadMissingAssets({
 }) {
   const doFetch = fetchImpl || ((u) => globalThis.fetch(u))
   // Read first: a bare-string reference is only recognizable through the map.
-  const map = readAssetMap(siteDir)
+  const map = readBackendState(siteDir, origin).assets || {}
   const refs = collectAssetRefs(document, map)
   const out = { downloaded: [], present: [], failed: [], skipped: [] }
   if (!refs.length) return out
@@ -166,6 +167,7 @@ export async function downloadMissingAssets({
 
   // Newly-landed assets become known ones, so the next pull restores them to
   // this path rather than fetching them again to a second location.
-  if (Object.keys(learned).length) updateAssetMap(siteDir, learned)
+  if (Object.keys(learned).length)
+    updateBackendMap(siteDir, origin, 'assets', learned, carryServed)
   return out
 }

package/src/backend/client.js

@@ -42,65 +42,31 @@ import { uploadFoundationCode } from '../utils/code-upload.js'
 import { uploadSiteAssets } from '../utils/asset-upload.js'
 
 /**
- * Resolve the backend origin via the resolution ladder (highest precedence
- * first). A full URL is reduced to its origin, so callers may pass a whole
- * endpoint URL; an unparseable value falls through to the next tier.
+ * Resolve the backend a command talks to:
  *
- *   1. `flag` — the raw --backend value (this command)
- *   2. UNIWEB_REGISTER_URL env — session-wide override (CI / local dev)
- *   3. `siteScope` — the project's `site.yml::$backend` (site verbs)
- *   4. `siteBackend` — the site's bound backend from deploy.yml (site verbs)
- *   5–7. the logged-in session origin > ~/.uniweb/config.json > the default
- *        (uniweb.app) — all via getRegistryApiBaseUrl()
+ *   1. UNIWEB_REGISTER_URL env — the override for automation (CI, scripts), one process
+ *   2. ⭐ the backend the user is LOGGED IN TO — the one session there is
+ *   3. the default backend — ~/.uniweb/config.json `registryApiUrl`, else uniweb.app —
+ *      where the command's first request then asks the user to log in
  *
- * ⭐ **`siteScope` outranks the SESSION, and that is the whole reason it is a tier.** The
- * session is a machine-wide default; `$backend` is this project's statement about where
- * its stored identity is meaningful. Without the tier, a teammate who clones a project
- * bound to a non-default backend resolves to whatever they last logged into, and is then
- * REFUSED by `assertSiteBackendScope` — nagged instead of routed, on a question the
- * project already answered.
+ * ⭐ **That is the whole ladder, for every command** *[Diego, 2026-09-21: "push and pull
+ * are also meant to go to the backend you are logged into" · "We do not allow any
+ * communication with backend if the user is not logged into a backend. The default
+ * backend for login, if not specified, is uniweb.app" · switching "via login to another
+ * backend is good, and the only way to switch"]*. Logging in is how a backend is chosen.
  *
- * ⭐ **And it outranks `siteBackend`, which looks like the same fact and is not.**
- * `deploy.yml`'s target `backend` records *where this ships*; `$backend` records *whose
- * namespace the uuid is in*. They agree in the normal case. When they disagree the
- * identity wins, because resolving to the other one only reaches the guard and stops.
+ * ⛔ **No `--backend` tier, and no project tier.** The backend verbs had a per-command
+ * `--backend` until 2026-09-21 — it predates per-backend sessions, when one session
+ * slot made "aim this one command elsewhere" a flag's job; switching is a login now, and
+ * a script aims with UNIWEB_REGISTER_URL without touching the machine's login. A
+ * project's sync.json and deploy.yml routed commands too, until the same day.
+ * `--backend` survives only where it SELECTS rather than routes: `login` (where to log
+ * in) and `forget` (which backend's records to remove). `logout` needs none: there is
+ * one session.
  *
- * ⚠️ The explicit overrides stay ON TOP deliberately. `--backend` and the env var are how
- * you deliberately aim elsewhere — at a staging mirror, say — and a project file must not
- * be able to veto a flag the user just typed. A wrong aim is then caught by the guard
- * rather than silently redirected.
- *
- * @param {string} [flag] - the raw value of --backend, if supplied
- * @param {object} [opts]
- * @param {string} [opts.siteScope] - the project's `site.yml::$backend`
- * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend origin
  * @returns {string} a bare origin with no trailing slash
  */
-export function resolveBackendOrigin(flag, { siteScope, siteBackend } = {}) {
-  const norm = (v) => {
-    try {
-      return new URL(v).origin
-    } catch {
-      return null
-    }
-  }
-  if (flag) {
-    const o = norm(flag)
-    if (o) return o
-  }
-  const env = process.env.UNIWEB_REGISTER_URL
-  if (env) {
-    const o = norm(env)
-    if (o) return o
-  }
-  if (siteScope) {
-    const o = norm(siteScope)
-    if (o) return o
-  }
-  if (siteBackend) {
-    const o = norm(siteBackend)
-    if (o) return o
-  }
+export function resolveBackendOrigin() {
   return getRegistryApiBaseUrl()
 }
 
@@ -142,10 +108,8 @@ export const DISCOVERY_DEFAULTS = {}
 export class BackendClient {
   /**
    * @param {object} [opts]
-   * @param {string} [opts.origin] - explicit origin (wins over originFlag/env)
-   * @param {string} [opts.originFlag] - raw --backend value to resolve
-   * @param {string} [opts.siteScope] - the project's `site.yml::$backend` (site verbs)
-   * @param {string} [opts.siteBackend] - a site's deploy.yml-bound backend (site verbs)
+   * @param {string} [opts.origin] - explicit origin (wins over the ladder; tests and
+   *        internal callers — no command takes one from the user)
    * @param {string} [opts.token] - explicit bearer (wins over env + stored session)
    * @param {() => Promise<string>} [opts.getToken] - injected bearer resolver (tests, or
    *        callers with their own auth); used when no explicit token/env is present
@@ -155,9 +119,6 @@ export class BackendClient {
    */
   constructor({
     origin,
-    originFlag,
-    siteScope,
-    siteBackend,
     token,
     getToken,
     args = [],
@@ -165,7 +126,7 @@ export class BackendClient {
     fetchImpl
   } = {}) {
     this.origin = (
-      origin || resolveBackendOrigin(originFlag, { siteScope, siteBackend })
+      origin || resolveBackendOrigin()
     ).replace(/\/+$/, '')
     this._token = token || process.env.UNIWEB_TOKEN || null
     this._getToken = getToken || null
@@ -176,9 +137,9 @@ export class BackendClient {
   }
 
   /**
-   * The session bearer, resolved lazily and memoized. Order (matching the
-   * standalone verbs): explicit --token / UNIWEB_TOKEN (constructor) > stored
-   * session > interactive login (ensureRegistryAuth).
+   * The session bearer, resolved lazily and memoized. Order: an explicit `token`
+   * (constructor — tests and internal callers; no command takes one from the user) /
+   * UNIWEB_TOKEN > the stored session > interactive login (ensureRegistryAuth).
    * @returns {Promise<string>}
    */
   async token() {
@@ -187,27 +148,13 @@ export class BackendClient {
       this._token = await this._getToken()
       return this._token
     }
-    // Origin-mismatch guard: a usable session authed against a DIFFERENT origin
-    // than this command targets means the bearer will be rejected — warn once
-    // and point at the fix (the stored token IS for `stored.origin`, not here).
-    if (!this._warnedOriginMismatch) {
-      this._warnedOriginMismatch = true
-      try {
-        const stored = await readRegistryAuth()
-        if (
-          stored?.token &&
-          !isExpired(stored) &&
-          stored.origin &&
-          stored.origin.replace(/\/+$/, '') !== this.origin
-        ) {
-          console.error(
-            `\x1b[33m⚠\x1b[0m Logged in to ${stored.origin}, but this command targets ${this.origin} — the session may be rejected. Run \`uniweb login --backend ${this.origin}\`, or pass --token.`
-          )
-        }
-      } catch {
-        /* advisory only */
-      }
-    }
+    // ⛔ NO ORIGIN-MISMATCH GUARD HERE, AND DO NOT RE-ADD ONE (removed 2026-09-20).
+    // It existed because the session store held ONE record: a session for another
+    // backend was the only session, so it was about to be sent here and rejected, and a
+    // warning was the best available move. Sessions are keyed by origin now
+    // (utils/registry-auth.js), so being logged into another backend is just a fact
+    // about another backend — `ensureRegistryAuth` below finds this origin's session or
+    // asks for one. Warning about the other would be noise about nothing.
     this._token = await ensureRegistryAuth({
       apiBase: this.origin,
       command: this._command,
@@ -255,8 +202,8 @@ export class BackendClient {
   // ── Discovery ─────────────────────────────────────────────────────────────────
 
   /**
-   * The session bearer IF one can be had without asking — an explicit `--token`, an
-   * env var, or a stored unexpired session. Never prompts, never logs in, returns null
+   * The session bearer IF one can be had without asking — an explicit `token`, the
+   * UNIWEB_TOKEN env var, or a stored unexpired session. Never prompts, never logs in, returns null
    * instead. `token()` is the one that may block; this is for calls that want to be
    * authenticated when possible but must not *cause* an authentication.
    * @returns {Promise<string|null>}
@@ -276,7 +223,7 @@ export class BackendClient {
       }
     }
     try {
-      const stored = await readRegistryAuth()
+      const stored = await readRegistryAuth(this.origin)
       if (stored?.token && !isExpired(stored)) return stored.token
     } catch {
       /* advisory — a missing or unreadable session is simply "no token" */
@@ -455,8 +402,8 @@ export class BackendClient {
    * the field itself is required and cannot be blank.
    *
    * NOT idempotent: two calls mint two sites (a name is not a unique key, by
-   * design). Callers must guard on `site.yml::$uuid` and write the result back
-   * immediately — see `ensureSiteExists`.
+   * design). Callers must guard on the site's uuid for this backend (sync.json) and
+   * write the result back immediately — see `ensureSiteExists`.
    *
    * @param {{ name: string, foundation: string, asOrg?: string|null }} opts
    * @returns {Promise<Response>} `{ site_content_uuid }`
@@ -545,7 +492,7 @@ export class BackendClient {
   /**
    * POST /dev/site/publish/{uuid} — CMS-publish a synced site (make its CURRENT
    * backend state live; it does NOT push local files). `{uuid}` is the site-content
-   * uuid (`site.yml::$uuid`); a never-synced site 404s (sync first, or use deploy).
+   * uuid on this backend (sync.json); a never-synced site 404s (sync first, or use deploy).
    * Languages, when present, go in the body; absent → no body. Returns the raw
    * Response ({ deploy_uuid, url, published_folder_uuid, status } on 200).
    *

package/src/backend/foundation-bring-along.js

@@ -38,8 +38,8 @@ import { execFileSync } from 'node:child_process'
 
 import { detectFoundationType, isExtensionUrl } from '@uniweb/build'
 import { computeFoundationDigest } from '../utils/code-upload.js'
-import { readFlagValue } from '../utils/args.js'
 import { isNonInteractive } from '../utils/interactive.js'
+import { publishScope } from '../utils/registry-orgs.js'
 import { compareSemverPrecedence } from '../utils/semver-precedence.js'
 
 /**
@@ -127,13 +127,17 @@ export function resolveLocalExtensions(siteDir, siteYml) {
 // as this did until 2026-09-17 — looked a `uniweb.id` foundation up under a name
 // the catalog does not have, so every push re-released it, and pinned the site
 // to that same wrong name.
+//
+// ⛔ And the scope goes through `publishScope`, as `register`'s does: `uniweb.scope`
+// may read `acme` as well as `@acme`, and until 2026-09-21 this joined it raw — so a
+// bare one looked the foundation up as `acme/src` and pinned the site to that.
 function foundationScopedName(dir) {
   try {
     const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
     const name = pkg?.uniweb?.id || pkg?.name
     if (typeof name === 'string' && name.startsWith('@')) return name
-    const scope = pkg?.uniweb?.scope
-    if (scope && name) return `${String(scope).replace(/\/+$/, '')}/${name}`
+    const scope = publishScope(pkg?.uniweb?.scope)
+    if (scope && name) return `${scope}/${name}`
     return null
   } catch {
     return null
@@ -151,14 +155,12 @@ function readPkgField(dir, field) {
   }
 }
 
-// Forward the origin + auth flags so the spawned `uniweb register` / `build`
-// hits the SAME backend with the SAME session as the publish that called it.
+// What travels to the spawned `uniweb register` / `build` on the command line: only
+// --non-interactive. The BACKEND travels in the child's environment
+// (releaseFoundation), and the SESSION is the shared session file — or UNIWEB_TOKEN,
+// which the child inherits. The backend commands take no `--backend` or `--token`.
 function forwardedFlags(args) {
   const out = []
-  for (const name of ['--backend', '--token']) {
-    const v = readFlagValue(args, name)
-    if (v) out.push(name, v)
-  }
   if (isNonInteractive(args)) out.push('--non-interactive')
   return out
 }
@@ -322,7 +324,7 @@ async function bringLocalCodeAlong({
     }
     say.info(`Releasing the ${kind} ${label} (not yet registered)…`)
     return {
-      released: releaseFoundation(local, args, cliBin, say),
+      released: releaseFoundation(local, args, cliBin, say, client?.origin),
       proceed: true,
       ref: pinnedRef()
     }
@@ -365,7 +367,7 @@ async function bringLocalCodeAlong({
           : `Releasing the ${kind} ${label} — not newer than the registered latest ${reg.latest_version}, so the registry takes it only if ${local.version} is already registered with this code…`
     )
     return {
-      released: releaseFoundation(local, args, cliBin, say),
+      released: releaseFoundation(local, args, cliBin, say, client?.origin),
       proceed: true,
       ref: pinnedRef()
     }
@@ -396,7 +398,7 @@ async function bringLocalCodeAlong({
     )
     if (reRelease)
       return {
-        released: releaseFoundation(local, args, cliBin, say),
+        released: releaseFoundation(local, args, cliBin, say, client?.origin),
         proceed: true,
         ref: pinnedRef()
       }
@@ -490,12 +492,15 @@ function buildFoundation(local, cliBin) {
 // Release = `uniweb register` in the foundation directory (the one foundation
 // release path). Returns true on success; throws to the caller on failure so
 // publish stops before going live with missing code.
-function releaseFoundation(local, args, cliBin, say) {
+function releaseFoundation(local, args, cliBin, say, origin) {
   console.log('')
+  // ⭐ Pinned to the parent's backend through the environment, so the release lands
+  // where the publish goes by construction — not because two processes happen to read
+  // the same session file the same way.
   execFileSync('node', [cliBin, 'register', ...forwardedFlags(args)], {
     cwd: local.dir,
     stdio: 'inherit',
-    env: process.env
+    env: origin ? { ...process.env, UNIWEB_REGISTER_URL: origin } : process.env
   })
   console.log('')
   return true

package/src/backend/service-request.js

@@ -38,7 +38,8 @@
  *
  * ## ⛔ A HASH, never the block
  *
- * `$secrets` carries secret material, and `$services[].config` is opaque and
+ * `$secrets` names every secret the site has (values are the `#ref` marker, never
+ * secret material — the old wording here said otherwise), and `$services[].config` is opaque and
  * per-service — anything may be in it. `deploy.yml` is committed, so recording
  * either verbatim would write them into git. Equality is all this gate needs;
  * *what* differs is a question for the backend's own copy of the request, not for
@@ -60,7 +61,8 @@ import { createHash } from 'node:crypto'
  * Rows are ordered by their serialized form and object keys sorted, so reordering
  * rows or keys in the file is not a change. It is not a request to move a line.
  *
- * @param {*} declared - the raw `site.yml::$services` / `$secrets` value
+ * @param {*} declared - the raw value: provisioned `services` / `secrets` rows (from
+ *   `sync.json`), what the site has stored for them, or `site.yml::publishLanguages`
  * @returns {string|null} 16 hex chars, or null when undeclared
  */
 export function fingerprintDeclaration(declared) {
@@ -91,11 +93,14 @@ function stableString(value) {
  * @param {object} siteYml
  * @returns {{servicesRequest?: string, secretsRequest?: string}}
  */
-export function fingerprintRequest(siteYml) {
+export function fingerprintRequest(siteYml, provisioned = {}) {
   const out = {}
-  const services = fingerprintDeclaration(siteYml?.$services)
+  // ⭐ Two sources, on purpose. The PROVISIONED rows come from `sync.json` for the
+  // backend being published to (they were `site.yml::$services` / `$secrets` until
+  // 2026-09-20). The language selection below is still authored, so still site.yml.
+  const services = fingerprintDeclaration(provisioned?.services)
   if (services) out.servicesRequest = services
-  const secrets = fingerprintDeclaration(siteYml?.$secrets)
+  const secrets = fingerprintDeclaration(provisioned?.secrets)
   if (secrets) out.secretsRequest = secrets
   // ⭐ The language selection is a request too, and it is the one that moves a
   // PRICE — the line is billed on how many languages go out. Banking it is what
@@ -124,8 +129,8 @@ export function fingerprintRequest(siteYml) {
  * @param {object|null} lastDeploy - `deploy.yml::lastDeploy.<target>`, or null
  * @returns {{declare: boolean, reason: 'no-record'|'changed'|'unchanged'|'undeclared'}}
  */
-export function decideDeclaration(siteYml, lastDeploy) {
-  const now = fingerprintRequest(siteYml)
+export function decideDeclaration(siteYml, lastDeploy, provisioned = {}) {
+  const now = fingerprintRequest(siteYml, provisioned)
   if (!now.servicesRequest && !now.secretsRequest) {
     // Nothing in the file to send. The gate is moot; say so rather than
     // reporting "unchanged", which would imply a comparison happened.
@@ -178,8 +183,8 @@ export function decideDeclaration(siteYml, lastDeploy) {
  * @param {object|null} lastDeploy - the banked base
  * @returns {{action:'none'|'adopt'|'send'|'conflict', local:string|null, remote:string|null}}
  */
-export function reconcileRequest(siteYml, remoteServices, lastDeploy) {
-  return reconcile(siteYml?.$services, remoteServices, lastDeploy?.servicesRequest)
+export function reconcileRequest(siteYml, remoteServices, lastDeploy, provisioned = {}) {
+  return reconcile(provisioned?.services, remoteServices, lastDeploy?.servicesRequest)
 }
 
 /**

package/src/backend/site-media.js

@@ -72,18 +72,18 @@ export async function uploadSiteMedia(
     warn?.(`local-media: upload failed for ${f.path} (HTTP ${f.status})`)
 
   const map = {}
-  // The identity half, for `assets.json`. The plan returns an authoritative
-  // `id`+`ext` for every entry INCLUDING a `present: true` dedup skip, so a
-  // re-push of unchanged media still records identity without moving bytes —
-  // which is what makes the committed map cheap to keep accurate.
+  // The identity half, for this backend's asset map in `sync.json`. The plan
+  // returns an authoritative `id`+`ext` for every entry INCLUDING a `present: true`
+  // dedup skip, so a re-push of unchanged media still records identity without
+  // moving bytes — which is what makes the committed map cheap to keep accurate.
   const ids = {}
   for (const ref of refs) {
     const entry = result.assetsByLocalUrl[ref]
     if (!entry) continue
     // `served` — a fingerprint of the address, never the address. It is how a pull
     // recognizes this asset where the reference is a bare string with no room for an
-    // id beside it (`info.preview`, `seo.image`, a section param); `assets.json`'s
-    // header says why a hash and not the URL.
+    // id beside it (`info.preview`, `seo.image`, a section param); the header of
+    // `@uniweb/build`'s asset-map.js says why a hash and not the URL.
     if (entry.id) {
       ids[ref] = {
         id: entry.id,