uniweb 0.59.2 → 0.61.0

package/src/commands/register.js

@@ -30,12 +30,11 @@
  *   uniweb register --json               Porcelain: ONE compact JSON line on stdout
  *                                        ({ok,scope,origin,entities:[{name,uuid,version,unchanged}]}),
  *                                        all human output to stderr — for scripted callers
- *   uniweb register --backend <url>      Override the backend origin
- *   uniweb register --token <bearer>     Submit with this bearer; skips `uniweb login`
  *
- * Endpoint resolution: --backend <url>  >  UNIWEB_REGISTER_URL  >
- *   the logged-in session origin  >  ~/.uniweb/config.json  >  the default (uniweb.app).
- * Auth (submit only):  --token <bearer>  >  UNIWEB_TOKEN  >  `uniweb login` session.
+ * Endpoint: UNIWEB_REGISTER_URL  >  the backend you are logged in to  >  the default
+ *   (~/.uniweb/config.json, else uniweb.app) — resolveBackendOrigin. No `--backend`:
+ *   switching is `uniweb login --backend <url>`.
+ * Auth (submit only):  UNIWEB_TOKEN  >  the stored session  >  `uniweb login`.
  */
 
 // DEFERRED foundation-registration capabilities (the legacy `uniweb publish` had
@@ -78,7 +77,7 @@ import {
   computeFoundationDigest,
   readRuntimePin
 } from '../utils/code-upload.js'
-import { deriveScope } from '../utils/registry-orgs.js'
+import { deriveScope, publishScope } from '../utils/registry-orgs.js'
 import { BackendClient } from '../backend/client.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
 import {
@@ -388,12 +387,9 @@ async function runRegister(args = []) {
   const dryRun = args.includes('--dry-run')
   const output = flagValue(args, '-o') || flagValue(args, '--output')
   const scopeFlag = flagValue(args, '--scope')
-  const tokenFlag = flagValue(args, '--token')
-  // Origin: --backend (matches deploy/publish + the
-  // origin-selection convention); either overrides UNIWEB_REGISTER_URL / default.
+  // The backend you are logged in to (UNIWEB_REGISTER_URL overrides it for a script) —
+  // resolveBackendOrigin, like every backend command.
   const client = new BackendClient({
-    originFlag: flagValue(args, '--backend'),
-    token: tokenFlag,
     args,
     command: 'Registering'
   })
@@ -408,14 +404,24 @@ async function runRegister(args = []) {
     : await resolveFoundationDir(args)
 
   // Scope: --scope flag, else package.json `uniweb.scope`, else (real submit
-  // only) derived from login membership in the bootstrap below.
+  // only) derived from login membership in the bootstrap below. Either spelling,
+  // `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
   const pkgScope = readPkgScope(targetDir)
-  let scope = scopeFlag || pkgScope
+  const givenScope = scopeFlag || pkgScope
+  let scope = publishScope(givenScope)
   let scopeSource = scopeFlag
     ? '--scope'
     : pkgScope
       ? 'package.json uniweb.scope'
       : null
+  // A scope that was GIVEN but names no org (`--scope @`) is refused, never read as
+  // absent: absent derives one from the login, which would register under an org the
+  // caller did not name.
+  if (givenScope && !scope) {
+    error(`Not an org scope: ${givenScope} (from ${scopeSource})`)
+    log(`  ${colors.dim}Pass --scope @org.${colors.reset}`)
+    return { exitCode: 2 }
+  }
   const isPreview = !!output || dryRun
 
   // Each path supplies a different schema source: the standalone path discovers
@@ -489,7 +495,7 @@ async function runRegister(args = []) {
   // 0 create / N pick), persist to package.json, and reuse the session token.
   if (!scope && !isPreview) {
     const token = await client.token()
-    const sess = await readRegistryAuth()
+    const sess = await readRegistryAuth(client.origin)
     const derived = await deriveScope({
       apiBase: client.origin,
       token,
@@ -606,7 +612,7 @@ async function runRegister(args = []) {
     )
     return { exitCode: 2 }
   }
-  // Submit — the client carries the bearer (--token › UNIWEB_TOKEN › stored
+  // Submit — the client carries the bearer (UNIWEB_TOKEN › stored
   // session › login), resolved lazily on this first authed call.
   info(`Submitting to ${colors.dim}${client.origin}${colors.reset} …`)
   let res
@@ -615,7 +621,7 @@ async function runRegister(args = []) {
   } catch (err) {
     error(`Could not reach the registry at ${client.origin}: ${err.message}`)
     log(
-      `  ${colors.dim}Set the endpoint with --backend <url> or UNIWEB_REGISTER_URL.${colors.reset}`
+      `  ${colors.dim}Is that the backend you meant? Switch with: uniweb login --backend <url>${colors.reset}`
     )
     return { exitCode: 2 }
   }
@@ -650,7 +656,7 @@ async function runRegister(args = []) {
           `  ${colors.dim}The registry didn't accept your credentials — it may use different ones than \`uniweb login\`.${colors.reset}`
         )
         log(
-          `  ${colors.dim}Supply a registry bearer with --token <bearer> (or UNIWEB_TOKEN); an existing one may be wrong or expired.${colors.reset}`
+          `  ${colors.dim}Log in again (uniweb login --backend <url>), or check UNIWEB_TOKEN — an existing one may be wrong or expired.${colors.reset}`
         )
       }
       // ⭐ **Surface `detail` as a sentence, not as a JSON dump.** The registry
@@ -675,11 +681,17 @@ async function runRegister(args = []) {
       return { exitCode: 1 }
     }
   }
+  // The foundation's name as the registry holds it (`@org/name`) — read from the
+  // document just submitted, never composed again. See phase 2.
+  const registeredName = standalone
+    ? null
+    : doc.entities.find((e) => e.model === '@uniweb/foundation-schema')?.info
+        ?.name
   if (!alreadyRegistered) {
     success(
       standalone
         ? `Registered ${defined.length} data schema(s)${scope ? ` under ${scope}` : ''}`
-        : `Registered ${schema._self.name}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
+        : `Registered ${registeredName}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
     )
   }
 
@@ -688,11 +700,13 @@ async function runRegister(args = []) {
   // only packages have no dist; --schema-only skips deliberately.
   if (!standalone && !args.includes('--schema-only')) {
     const distDir = join(targetDir, 'dist')
-    // The registry's vocabulary is the SCOPED name (`@org/name`). A scoped
-    // package name passes through; a bare one gets the chosen scope — the
-    // same resolution the .uwx submission applied.
-    const bareName = schema._self.name
-    const name = bareName.startsWith('@') ? bareName : `${scope}/${bareName}`
+    // ⭐ The plan authorizes against the REGISTERED (name, version), so the name here
+    // is the one phase 1 registered — the `.uwx`'s own `info.name`, where a scoped
+    // package name passes through and a bare one gets the scope. ⛔ Not composed a
+    // second time: this line composed it from the raw scope until 2026-09-21, so
+    // `--scope std` registered `@std/src` and then asked to deliver `std/src`, which
+    // the registry refuses. One name, read from the one place it was decided.
+    const name = registeredName
     const version = schema._self.version
     info(
       `Delivering code for ${colors.bright}${name}@${version}${colors.reset} …`

package/src/commands/status.js

@@ -24,14 +24,13 @@ import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import yaml from 'js-yaml'
 
-import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
+import { resolveSiteDir } from './deploy.js'
 import { probeUnpushed } from '../backend/site-sync.js'
-import { BackendClient } from '../backend/client.js'
-import { readFlagValue } from '../utils/args.js'
+import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
+import { readBackendState } from '@uniweb/build/uwx'
 import { resolveLocalFoundation } from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { checkFlags } from '../utils/flag-guard.js'
-import { readSiteIdentity } from '../utils/site-identity.js'
 
 const c = {
   reset: '\x1b[0m',
@@ -87,15 +86,23 @@ export async function status(args = []) {
   const remote = args.includes('--remote')
   const siteDir = await resolveSiteDir(args, 'status')
   const siteYml = readSiteYml(siteDir)
-  const uuid = siteYml.$uuid || null
   const fnd = foundationRef(siteYml)
   const { scope: fndScope, version: fndVersion } = splitFoundationRef(fnd)
 
   // Local content diff — builds the sync packages, never authenticates.
+  //
+  // ⭐ The ORIGIN is resolved here rather than taken from the client below, because
+  // this probe is deliberately offline and the client may never be built. It decides
+  // whose asset ids the comparison reads: against the wrong backend every media ref
+  // reads as changed.
+  const probeBackend = resolveBackendOrigin()
+  // ⭐ Identity is this backend's, from sync.json. It read `site.yml::$uuid`, so after
+  // step 4 moved the key every project reported itself as never synced.
+  const uuid = readBackendState(siteDir, probeBackend).site?.uuid || null
   let probe = null
   let probeErr = null
   try {
-    probe = await probeUnpushed(siteDir)
+    probe = await probeUnpushed(siteDir, { backend: probeBackend })
   } catch (err) {
     probeErr = err.message
   }
@@ -108,11 +115,6 @@ export async function status(args = []) {
   if (remote) {
     try {
       const client = new BackendClient({
-        originFlag:
-          readFlagValue(args, '--backend'),
-        siteScope: readSiteIdentity(siteDir).backend,
-        siteBackend: await resolveSiteBackend(siteDir),
-        token: readFlagValue(args, '--token') || undefined,
         args,
         command: 'Status'
       })

package/src/commands/sync.js

@@ -35,7 +35,6 @@
  *   uniweb sync                    refresh, then push
  *   uniweb sync --no-git           skip the git remote half of the refresh
  *   uniweb sync --force            forwarded to push (overwrite upstream changes)
- *   uniweb sync --backend <url>    override the backend origin
  */
 
 import { checkFlags } from '../utils/flag-guard.js'

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-20T19:01:50.411Z",
+  "generatedAt": "2026-09-21T21:47:05.925Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.4.1",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.55.1",
+      "version": "0.57.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.29.6",
+      "version": "0.29.7",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -55,7 +55,7 @@
       ]
     },
     "@uniweb/kit": {
-      "version": "0.19.3",
+      "version": "0.19.4",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -83,7 +83,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.27.2",
+      "version": "0.27.3",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -116,7 +116,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.14.8",
+      "version": "0.15.0",
       "path": "framework/templates",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.9.26",
+      "version": "0.10.0",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -805,6 +805,15 @@ async function main() {
     process.exit(result?.exitCode ?? 0)
   }
 
+  // Handle forget — remove one backend's local records (sync.json, cache, deploy
+  // records), or with --all everything a copied project inherited. Local only: every
+  // site still exists on its backend. Needs @uniweb/build (the store).
+  if (command === 'forget') {
+    const { forget } = await importProjectCommand('./commands/forget.js')
+    const result = await forget(args.slice(1))
+    process.exit(result?.exitCode ?? 0)
+  }
+
   // Handle status command (dynamic import — offline emit via @uniweb/build)
   if (command === 'status') {
     const { status } = await importProjectCommand('./commands/status.js')
@@ -879,70 +888,59 @@ async function main() {
   }
 
   // Handle login command — the backend (username/password · paste a token ·
-  // --token <bearer>). Origin from --backend > UNIWEB_REGISTER_URL >
-  // default, the SAME resolver register/push/pull/deploy use, so a session and
-  // the commands that reuse it always target one backend.
+  // --token <bearer>). ⭐ `--backend <url>` names it; without the flag it is the DEFAULT
+  // backend — UNIWEB_REGISTER_URL, else ~/.uniweb/config.json, else https://uniweb.app —
+  // and never the project's backend or the current session *[Diego, 2026-09-21: "the
+  // default backend for login, if not specified, is uniweb.app"]*. The backend logged in
+  // to becomes CURRENT, and every backend command goes there (only UNIWEB_REGISTER_URL
+  // outranks it) — which is why this is the one place a backend is chosen.
+  //
+  // ⛔ Until 2026-09-21 a bare login went to the backend of the project in the cwd, and
+  // asked when the machine knew several backends. Both are gone: the default is the
+  // default, and any other backend is named.
   if (command === 'login') {
     const loginArgs = args.slice(1)
-    const { resolveBackendOrigin } = await import('./backend/client.js')
     const { readFlagValue } = await import('./utils/args.js')
     const { runRegistryLogin } = await import('./utils/registry-auth.js')
-    const originFlag =
-      readFlagValue(loginArgs, '--backend')
-    const apiBase = resolveBackendOrigin(originFlag)
-
-    // ⭐ The project says where it belongs — say so BEFORE authenticating elsewhere.
-    //
-    // `login` is deliberately NOT given the `site.yml::$backend` tier the site verbs
-    // get (see resolveBackendOrigin): the session it writes is machine-wide, so letting
-    // cwd pick the account you log into would be a silent surprise. But staying silent
-    // does not remove the failure, it MOVES it — you log into the default, and the next
-    // push/pull/publish resolves to `$backend` and warns about the mismatch. That is the
-    // routed-not-nagged case `$backend` was added for, missing at the one command a
-    // teammate runs FIRST after cloning.
-    //
-    // ⛔ Silent when the origin was named explicitly (--backend /
-    // UNIWEB_REGISTER_URL). A deliberate aim is not a mistake to warn about; a genuinely
-    // wrong one is still caught by the session-mismatch guard in BackendClient.token().
-    if (!originFlag && !process.env.UNIWEB_REGISTER_URL) {
-      try {
-        const { findNearbySiteBackend } = await import(
-          './utils/site-identity.js'
-        )
-        const nearby = findNearbySiteBackend(process.cwd())
-        if (nearby && nearby.backend !== apiBase) {
-          console.error(
-            `\x1b[33m⚠\x1b[0m This project syncs with ${nearby.backend} (site.yml::$backend), but login is targeting ${apiBase}.`
-          )
-          console.error(
-            `  Log in where the project belongs:  uniweb login --backend ${nearby.backend}`
-          )
-          console.error(
-            `  Continuing with ${apiBase} — a session is machine-wide, so this is a heads-up, not a block.\n`
-          )
-        }
-      } catch {
-        // Advisory only. A malformed site.yml, an unreadable directory or anything else
-        // here must never be the reason someone cannot log in.
-      }
+    const { resolveLoginOrigin } = await import('./utils/config.js')
+    let apiBase
+    try {
+      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'))
+    } catch (err) {
+      console.error(
+        `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --backend http://localhost:8080`
+      )
+      process.exit(2)
     }
-
     await runRegistryLogin({ apiBase, args: loginArgs })
     return
   }
 
-  // Handle logout command — clear the stored backend session.
+  // Handle logout — THE session. ⭐ There is at most one *[Diego, 2026-09-21: "`uniweb
+  // logout` always logs you out of the one backend you may be logged in"]*, so logout
+  // takes no options: `--backend` and `--all` existed only while sessions were kept per
+  // backend. ⚠️ Local only — the token is forgotten here, not revoked on the backend.
   if (command === 'logout') {
-    const { clearRegistryAuth, getRegistryAuthPath } =
-      await import('./utils/registry-auth.js')
-    const { existsSync } = await import('node:fs')
-    const had = existsSync(getRegistryAuthPath())
-    await clearRegistryAuth()
-    console.log(
-      had
-        ? '\x1b[32m✓\x1b[0m Logged out (cleared the stored session).'
-        : 'Not logged in — nothing to clear.'
-    )
+    const stray = args.slice(1).find((a) => a.startsWith('-') && a !== '--non-interactive')
+    if (stray) {
+      console.error(
+        `\x1b[31m✗\x1b[0m \`uniweb logout\` takes no options (got ${stray}) — it logs you out of the backend you are logged in to.`
+      )
+      process.exit(2)
+    }
+    const { clearRegistryAuth } = await import('./utils/registry-auth.js')
+    const { loggedInOrigin } = await import('./utils/config.js')
+    const origin = loggedInOrigin()
+    const cleared = await clearRegistryAuth()
+    if (!cleared.length) {
+      console.log('Not logged in — nothing to clear.')
+      return
+    }
+    console.log(`\x1b[32m✓\x1b[0m Logged out${origin ? ` of ${origin}` : ''}.`)
+    // A file from before sessions were single can hold several; all of them go.
+    const others = cleared.filter((o) => o !== origin)
+    if (others.length)
+      console.log(`\x1b[2mAlso removed stored sessions for: ${others.join(', ')}\x1b[0m`)
     return
   }
 
@@ -1392,7 +1390,7 @@ ${colors.bright}Options:${colors.reset}
   --host <name>       The host to ship to (no value → the wizard, TTY only)
   --target <name>     Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run           Resolve the target + adapter; print summary; upload nothing
-  --no-save           Skip the auto-save of lastDeploy in deploy.yml
+  --no-save           Do not record this deploy in deploy.yml
   --no-validate       Skip the content-conformance check (it only warns)
   --non-interactive   Fail with usage info instead of prompting
 
@@ -1429,18 +1427,16 @@ ${colors.bright}Options:${colors.reset}
                      when only the content should go live. Refused if the
                      foundation has never been released — there is nothing to
                      bind to, and the app cannot open such a site.
-  --no-save          Skip the deploy.yml lastDeploy auto-save
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
   --org @org         Publish under @org (membership-gated; alias: --as-org). Read
                      only on a site's FIRST publish — that create decides which org
                      owns the site, and whose storage its assets are charged to.
-                     Recorded as site.yml \$org and replayed, so it is never
+                     Recorded in sync.json and replayed, so it is never
                      re-typed. Without it, you are asked once.
   --personal         Create the site under your personal account, deliberately.
                      Only needed on a first publish, and only to answer the owner
                      question without a prompt (CI, agents, scripts).
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
-  --token <bearer>   Auth bearer (skips \`uniweb login\`)
 `,
     create: `
 ${colors.cyan}${colors.bright}uniweb create${colors.reset} ${colors.dim}— Create a new project${colors.reset}
@@ -1691,7 +1687,7 @@ ${colors.bright}Usage:${colors.reset}
   uniweb release  [options]      ${colors.dim}(synonym — reads naturally for updates)${colors.reset}
 
 Builds one \`.uwx\` document and submits it to the registry over HTTP. Run
-\`uniweb login\` first (or pass \`--token\`). \`register\`/\`release\` are for
+\`uniweb login\` first. \`register\`/\`release\` are for
 FOUNDATIONS (and schemas) — code only; \`uniweb publish\` makes a synced SITE
 live (and brings its foundation along); \`uniweb deploy\` hosts on a third-party
 host. \`register\` and \`release\` are the same act: \`register\` reads naturally
@@ -1711,8 +1707,6 @@ ${colors.bright}Options:${colors.reset}
   --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or a local URL)
-  --token <bearer>   Submit with this bearer; skips \`uniweb login\` (or set UNIWEB_TOKEN)
   --non-interactive  Fail with usage info instead of prompting
 
 Run from a foundation, a schemas-only package, or a workspace with a single foundation.
@@ -1753,19 +1747,26 @@ ${colors.cyan}${colors.bright}uniweb login${colors.reset} ${colors.dim}— Log i
 ${colors.bright}Usage:${colors.reset}
   uniweb login [options]
 
-Authenticates with the backend and stores a session at
-~/.uniweb/registry-auth.json. Every backend command (register, push, pull,
-clone, deploy) reuses it. Interactively, pick username/password or paste a token.
+Authenticates with a backend and stores its session in
+~/.uniweb/registry-auth.json. ${colors.bright}One backend at a time:${colors.reset} logging in to another one
+logs you out of the first (once the new login succeeds). The backend you are
+logged in to is where the backend commands go (push, pull, publish, status,
+register, clone) — so this is how you switch. Already logged in to it, login
+does nothing; add --password, --browser, --token-paste or --token to log in again.
+
+Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
+to a backend you are not logged in to — run one before logging in and it asks first.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
+  --backend <url>    The backend to log in to
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
+  --browser          Force the browser method
   --password         Force the username/password method
   --token-paste      Force the paste-a-token prompt
 
 In non-interactive mode (CI / no TTY), pass \`--token <bearer>\`, or set
 \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set \`UNIWEB_TOKEN\` (used per-command,
-not stored). Run \`uniweb logout\` to clear the stored session.
+not stored). \`uniweb logout\` logs you out.
 `,
     refresh: `
 ${colors.cyan}${colors.bright}uniweb refresh${colors.reset} ${colors.dim}— Catch up with teammates AND app authors${colors.reset}
@@ -1784,8 +1785,6 @@ reflexively. Exits non-zero if a merge leaves conflicts.
 ${colors.bright}Options:${colors.reset}
   --no-git           Skip the git remote; backend only
   --no-backend       Skip the backend; git only
-  --backend <url>    Override the backend origin
-  --token <bearer>   Read with this bearer; skips \`uniweb login\`
 
 \`--force\` and \`--merge\` are NOT accepted here: this verb builds the delegated
 pull's arguments itself, and to pull \`--force\` means "discard my local work".
@@ -1813,11 +1812,32 @@ ${colors.bright}Options:${colors.reset}
 
   --no-git           Skip the git remote half of the refresh
   --force            Overwrite upstream changes (reaches the PUSH half only)
-  --backend <url>    Override the backend origin
-  --token <bearer>   Auth bearer; skips \`uniweb login\`
 
 \`--force\` means "overwrite upstream" to push but "discard my local work" to pull,
 so it is deliberately kept away from the refresh half.
+`,
+    forget: `
+${colors.cyan}${colors.bright}uniweb forget${colors.reset} ${colors.dim}— Remove what this project recorded about where it synced${colors.reset}
+
+${colors.bright}Usage:${colors.reset}
+  uniweb forget --backend <url>
+  uniweb forget --all
+
+Local files only. Every site stays where it is on its backend.
+
+${colors.bright}Options:${colors.reset}
+  --backend <url>    Forget one backend: its entries in sync.json and in the local
+                     cache, and its deploy records in deploy.yml. Its targets stay,
+                     so the next publish there creates a new site.
+  --all              For a COPY of a project that should become a new one. Deletes
+                     sync.json, deploy.yml and the local cache — everything naming
+                     the original's sites and destinations. Without it, the copy's
+                     first push updates the original's site.
+
+Record files keep their \`$uuid\`: it is the record's own id, not a backend's.
+
+To duplicate a project:
+  cp -r my-site my-site-2 && cd my-site-2 && uniweb forget --all
 `,
     invite: `
 ${colors.cyan}${colors.bright}uniweb invite${colors.reset} ${colors.dim}— (reserved; not available on the new backend yet)${colors.reset}
@@ -1986,6 +2006,7 @@ ${colors.bright}Commands:${colors.reset}
   refresh            Catch up with the git remote AND the backend (never pushes)
   sync               Catch up, then push (refresh + push)
   status             Show a site's sync state (unpushed content, foundation)
+  forget             Forget a backend, or --all to make a copied project a new one
   inspect <path>     Inspect parsed content shape of a markdown file or folder
   docs               Generate component documentation
   families           List the standard section families (for meta.js family:)
@@ -1994,7 +2015,7 @@ ${colors.bright}Commands:${colors.reset}
   update             Align workspace deps + AGENTS.md to the running CLI
   i18n <cmd>         Internationalization (extract, sync, status)
   login              Log in to your Uniweb account
-  logout             Clear the stored session
+  logout             Log out of the backend you are logged in to
 
 ${colors.bright}Create Options:${colors.reset}
   --template <type>  Project template (default: starter)
@@ -2015,16 +2036,20 @@ ${colors.bright}Global Options:${colors.reset}
   --non-interactive    Fail with usage info instead of prompting
                        Auto-detected when CI=true or no TTY (pipes, agents)
 
+  Backend commands (push, pull, publish, status, register, clone) go to the
+  backend you are logged in to, with its session. Switch with
+  \`uniweb login --backend <url>\` (add \`--token <bearer>\` to sign in with a token);
+  a script can aim and authenticate one process with UNIWEB_REGISTER_URL and
+  UNIWEB_TOKEN instead.
+
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
   --org @org         Publish under @org (first publish only; then remembered)
   --personal         Own the new site personally, deliberately (first publish only)
-  --no-save          Skip the deploy.yml lastDeploy auto-save
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
-  --token <bearer>   Auth bearer (skips \`uniweb login\`)
 
   uniweb publish is the smart Uniweb-hosting path: it brings the site's
   foundation along, syncs, and goes live. To register a foundation on its own
@@ -2037,7 +2062,7 @@ ${colors.bright}Deploy Options:${colors.reset}
                      s3-cloudfront, or \`uniweb\` (delegates to \`uniweb publish\`).
   --target <name>    Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run          Resolve the target + adapter; print summary; upload nothing
-  --no-save          Skip the auto-save of lastDeploy in deploy.yml
+  --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
   To deploy on every push instead, see \`uniweb add ci --help\`.
 

package/src/utils/args.js

@@ -47,10 +47,9 @@ export function readOrgFlag(args) {
  *
  * The CLI reads flags by scanning argv for a literal, so an unrecognized flag is
  * not an error — it is *invisible*, and whatever it was meant to change silently
- * keeps its default. The sharp case is `--backend`: mistype it and the origin
- * ladder falls through to the session, the saved config, or `https://uniweb.app`,
- * so a command aimed at localhost can reach production. `--token` degrades the
- * same way, to a stored session belonging to someone else.
+ * keeps its default. The sharp cases were `--backend` and `--token`, which aimed a
+ * command and chose its identity; both left the backend commands on 2026-09-21
+ * (the login does both now), and the guard names the login when either is passed.
  *
  * Scanning rules, chosen to avoid false positives (a wrong rejection is worse than
  * a missed one — it breaks a working command):

package/src/utils/asset-upload.js

@@ -19,11 +19,24 @@
  *               its id+ext for the rewrite. Absent `present` ⇒ false — an older
  *               backend without the flag uploads everything (today's behavior).
  *
- * Assets are GLOBAL + content-addressed: identical bytes → same id → dedup
- * across sites and idempotent re-deploys (a re-PUT is a cheap no-op). This
- * mirrors the foundation code lane (utils/code-upload.js); the one structural
- * difference is that the backend MINTS the per-asset id, so the plan response is
- * what the deploy step rewrites content references to.
+ * Assets are content-addressed and global WITHIN ONE BACKEND: identical bytes →
+ * same id → dedup across that backend's sites and idempotent re-deploys (a
+ * re-PUT is a cheap no-op). This mirrors the foundation code lane
+ * (utils/code-upload.js); the one structural difference is that the backend
+ * MINTS the per-asset id, so the plan response is what the deploy step rewrites
+ * content references to.
+ *
+ * ⛔ **"Global" is the DEDUP SCOPE, not a claim about other backends.** An id,
+ * and the presence of the bytes behind it, are facts about the backend that
+ * answered the PLAN and about nothing else — where a backend keeps them is its
+ * own business and not a shape this lane models. ⚠️ This said only "GLOBAL" until
+ * 2026-09-20 and was read as "the same id works on any backend", which made
+ * `assets.json` look portable in a multi-backend design. It is not: `sync.json`
+ * keeps asset ids per backend (`backends.<origin>.assets`), and the backend ORIGIN
+ * is the segregation value the CLI has.
+ *
+ * ⚠️ Do not infer portability from `id` looking like the sha256 either — we read
+ * it from the response precisely so the derivation is never load-bearing here.
  */
 
 import { createHash } from 'node:crypto'