uniweb 0.59.2 → 0.61.0

package/src/utils/registry-auth.js

@@ -32,9 +32,9 @@
  *   - stored in a register-scoped slot (~/.uniweb/registry-auth.json) so it can
  *     never clobber the legacy token publish/deploy rely on.
  *
- * Token resolution for `register` (the `--token` flag is handled by the caller,
- * ahead of this): UNIWEB_TOKEN env > stored session (unexpired) >
- * UNIWEB_USERNAME/UNIWEB_PASSWORD env (non-interactive) > interactive prompt.
+ * Token resolution for the backend commands, which take no `--token` flag:
+ * UNIWEB_TOKEN env > stored session (unexpired) > UNIWEB_USERNAME/UNIWEB_PASSWORD
+ * env (non-interactive) > interactive prompt.
  *
  * Login response shape (agreed with backend, 2026-05-26):
  *   { token, expires_at, account: { uuid, username, handle } }
@@ -48,6 +48,9 @@ import { homedir } from 'node:os'
 import { createServer } from 'node:http'
 import { randomBytes } from 'node:crypto'
 
+import { DEFAULT_BACKEND_ORIGIN } from './config.js'
+import { normalizeSessionFile, sessionFilePath, loggedInOriginOf } from './session-file.js'
+
 const LOGIN_PATH = '/dev/auth/login'
 
 /** The shared ~/.uniweb credential directory. */
@@ -58,7 +61,10 @@ export function getAuthDir() {
 /** Normalize a backend URL to a bare origin (for stamping on the session). */
 function normOrigin(u) {
   try {
-    return new URL(u).origin
+    // http(s) only — `localhost:8080` parses as a scheme with the origin "null", and a
+    // session keyed "null" would answer for nothing.
+    const parsed = new URL(u)
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:' ? parsed.origin : u
   } catch {
     return u
   }
@@ -77,39 +83,102 @@ export function isExpired(auth) {
  * @returns {string}
  */
 export function getRegistryAuthPath() {
-  return join(getAuthDir(), 'registry-auth.json')
+  return sessionFilePath()
 }
 
 /**
- * Read the stored registry session, or null. No JWT backfill — the token is
- * opaque, so there are no claims to decode (unlike legacy readAuth()).
- * @returns {Promise<{ token: string, expiresAt?: string, accountId?: number, sessionId?: number, username?: string, handle?: string, uuid?: string } | null>}
+ * ONE SESSION, FOR ONE BACKEND — the on-disk shape.
+ *
+ *   { version: 2, current: "https://uniweb.app",
+ *     sessions: { "https://uniweb.app": { token, expiresAt, … } } }
+ *
+ * ⭐ **At most one session exists** *[Diego, 2026-09-21: "`uniweb login` log the user out
+ * of the existing session, if any, before logging in to the new backend … `uniweb logout`
+ * always logs you out of the one backend you may be logged in"]*. A login REPLACES the
+ * file — once it succeeds, so a cancelled or failed login leaves you where you were —
+ * and a logout deletes it. So "the backend you are logged in to" is exactly one thing
+ * or nothing, and logout needs no selector.
+ *
+ * ⚖️ The v2 map is kept, holding one entry: the file then has one reader
+ * (utils/session-file.js), and it still understands what came before — a v1 flat
+ * record, and a v2 file holding SEVERAL sessions (the per-backend store of 2026-09-20,
+ * which kept every backend's session and marked the last login `current`). The next
+ * login or logout rewrites either into the single-session shape.
+ *
+ * ⛔ Every session is still checked against the backend it is for (`readRegistryAuth`
+ * takes the origin): a token issued by A is never handed to a request against B. That
+ * was the correctness bug of the original flat record, and it stays fixed.
+ *
+ * The shape is read in ONE place, `utils/session-file.js`.
  */
-export async function readRegistryAuth() {
+
+/** The whole file, normalized to v2 shape. Never throws. */
+async function readAuthFile() {
   const path = getRegistryAuthPath()
-  if (!existsSync(path)) return null
+  if (!existsSync(path)) return normalizeSessionFile(null, DEFAULT_BACKEND_ORIGIN)
   try {
-    return JSON.parse(await readFile(path, 'utf8'))
+    return normalizeSessionFile(JSON.parse(await readFile(path, 'utf8')), DEFAULT_BACKEND_ORIGIN)
   } catch {
-    return null
+    return normalizeSessionFile(null, DEFAULT_BACKEND_ORIGIN)
   }
 }
 
+async function writeAuthFile({ version, current, sessions }) {
+  await mkdir(getAuthDir(), { recursive: true })
+  await writeFile(
+    getRegistryAuthPath(),
+    JSON.stringify({ version, ...(current ? { current } : {}), sessions }, null, 2)
+  )
+}
+
+/**
+ * The stored session FOR ONE BACKEND, or null. No JWT backfill — the token is
+ * opaque, so there are no claims to decode (unlike legacy readAuth()).
+ *
+ * ⛔ `origin` is required in spirit: calling this without one used to mean "the
+ * session", which is the assumption this file exists to remove. It falls back to the
+ * default backend rather than throwing, because every caller now passes one and a
+ * throw here would turn a stale call site into a crash instead of a wrong answer.
+ *
+ * @param {string} [origin] - the backend whose session is wanted
+ * @returns {Promise<{ token: string, expiresAt?: string, accountId?: number, sessionId?: number, username?: string, handle?: string, uuid?: string, origin: string } | null>}
+ */
+export async function readRegistryAuth(origin) {
+  const key = normOrigin(origin || DEFAULT_BACKEND_ORIGIN)
+  const { sessions } = await readAuthFile()
+  const found = sessions[key]
+  return found && typeof found.token === 'string' ? { ...found, origin: key } : null
+}
+
 /**
- * Persist the registry session record.
- * @param {Object} record
+ * Persist THE session — the backend the user is now logged in to, replacing whatever
+ * the file held. The record's own `origin` is the key, so every login path keeps
+ * stamping it exactly as before.
+ * @param {Object} record - must carry `origin` and `token`
  */
 export async function writeRegistryAuth(record) {
-  await mkdir(getAuthDir(), { recursive: true })
-  await writeFile(getRegistryAuthPath(), JSON.stringify(record, null, 2))
+  const key = normOrigin(record?.origin || DEFAULT_BACKEND_ORIGIN)
+  const { origin: _drop, ...rest } = record || {}
+  // ⭐ REPLACE, never merge: every caller is a successful login, and there is one session.
+  // Whatever the file held — another backend's session, or several from before —
+  // is gone: the user is logged in to this backend, and only this one.
+  await writeAuthFile({ version: 2, current: key, sessions: { [key]: rest } })
 }
 
 /**
- * Remove the stored registry session.
+ * Log out: delete the session file. There is one session, so there is nothing to choose.
+ *
+ * ⚠️ Local only — the token is forgotten on this machine, not revoked on the backend.
+ *
+ * @returns {Promise<string[]>} the origins whose sessions were removed — one, or
+ *   several for a file written before sessions were single (2026-09-21)
  */
 export async function clearRegistryAuth() {
   const path = getRegistryAuthPath()
-  if (existsSync(path)) await unlink(path)
+  if (!existsSync(path)) return []
+  const had = Object.keys((await readAuthFile()).sessions)
+  await unlink(path)
+  return had
 }
 
 /**
@@ -190,6 +259,21 @@ export async function loginToRegistry({ apiBase, username, password } = {}) {
  * @param {string[]} [options.args] - argv slice; checked for --non-interactive
  * @returns {Promise<string>} bearer token
  */
+/** `args` without `--token` and its value — see ensureRegistryAuth. */
+export function withoutLoginToken(args = []) {
+  const out = []
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i]
+    if (a === '--token') {
+      i++ // and its value
+      continue
+    }
+    if (a.startsWith('--token=')) continue
+    out.push(a)
+  }
+  return out
+}
+
 export async function ensureRegistryAuth({
   apiBase,
   command = 'This command',
@@ -197,7 +281,11 @@ export async function ensureRegistryAuth({
 } = {}) {
   if (process.env.UNIWEB_TOKEN) return process.env.UNIWEB_TOKEN
 
-  const stored = await readRegistryAuth()
+  // ⛔ THE SESSION MUST BE THE ONE ISSUED FOR `apiBase`. Until 2026-09-20 this read
+  // "the" session and returned its token whenever it was unexpired — so a bearer minted
+  // by backend A was sent to backend B, which rejects it. The store is keyed by origin
+  // now, so asking for the right one is the same single read.
+  const stored = await readRegistryAuth(apiBase)
   if (stored?.token && !isExpired(stored)) return stored.token
 
   // Non-interactive login from env (CI / agents) before any prompt.
@@ -240,7 +328,11 @@ export async function ensureRegistryAuth({
   }
 
   // Interactive: hand off to the multi-method login picker, reuse its session.
-  const record = await runRegistryLogin({ apiBase, args })
+  // ⛔ WITHOUT `--token`: in `runRegistryLogin` it means "seed and STORE this bearer as a
+  // session" — `uniweb login --token`'s job alone. A command's own argv reaching it
+  // would log the machine in as a side effect of that command. (The backend commands
+  // refuse `--token` since 2026-09-21; this holds for any other caller too.)
+  const record = await runRegistryLogin({ apiBase, args: withoutLoginToken(args) })
   if (!record?.token) process.exit(1)
   return record.token
 }
@@ -562,25 +654,55 @@ async function loginViaBrowser({ apiBase }) {
  * @returns {Promise<Object|undefined>} the stored session record
  */
 export async function runRegistryLogin({ apiBase, args = [] } = {}) {
-  const existing = await readRegistryAuth()
+  // For THIS backend. It read "the" session and printed `apiBase` beside it, so on a
+  // machine logged into another backend it announced "Already logged in … (this origin)"
+  // about a session belonging to a different one — and then offered to replace it.
+  const { isNonInteractive } = await import('./interactive.js')
+  const nonInteractive = isNonInteractive(args)
+
+  const key = normOrigin(apiBase)
+  const file = await readAuthFile()
+  const current = loggedInOriginOf(file)
+  const existing = await readRegistryAuth(apiBase)
+  const forced =
+    args.includes('--token') ||
+    args.includes('--browser') ||
+    args.includes('--password') ||
+    args.includes('--token-paste')
   if (existing?.token && !isExpired(existing)) {
     const who =
       existing.username ||
       existing.handle ||
       (existing.uuid ? `account ${existing.uuid}` : '')
+    if (!forced) {
+      // Already logged in to this backend: nothing to do — logging in again is behind a
+      // method flag. (Also where a file from before sessions were single, holding this
+      // backend among others, becomes single: the rewrite keeps only this session.)
+      if (current !== key || Object.keys(file.sessions).length > 1) {
+        await writeRegistryAuth({ ...existing, origin: key })
+      }
+      console.error(
+        `\x1b[32m✓\x1b[0m Already logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`
+      )
+      console.error(
+        '\x1b[2mTo log in again, name a method: --password, --browser, --token-paste or --token <bearer>.\x1b[0m'
+      )
+      return { ...existing, origin: key }
+    }
     console.error(
-      `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}.`
+      `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''} (${key}) — logging in again replaces that session.\n`
     )
-    console.error('\x1b[2mContinuing will replace the existing session.\x1b[0m\n')
+  } else if (current && current !== key) {
+    // ⭐ ONE SESSION AT A TIME *[Diego, 2026-09-21]*: logging in here logs you out of there
+    // — when this login succeeds (writeRegistryAuth replaces the file), so cancelling or
+    // failing leaves you logged in where you were.
+    console.error(`\x1b[2mYou are logged in to ${current}; logging in to ${key} logs you out of it.\x1b[0m\n`)
   }
 
-  const { isNonInteractive } = await import('./interactive.js')
-  const nonInteractive = isNonInteractive(args)
-
   // `--token <bearer>` seeds + verifies a session non-interactively (verified
   // against /dev/auth/me before it's stored, so an invalid token fails loudly
-  // instead of poisoning the session file). Distinct from the per-command
-  // `--token` (ephemeral, never stored) and from UNIWEB_TOKEN env.
+  // instead of poisoning the session file). ⭐ Login's alone: the backend commands
+  // take no `--token` (2026-09-21) — UNIWEB_TOKEN is the one-process bearer.
   const { readFlagValue } = await import('./args.js')
   const tokenFlag = readFlagValue(args, '--token')
   if (tokenFlag) {

package/src/utils/registry-orgs.js

@@ -59,6 +59,25 @@ export function bareHandle(scope) {
     .replace(/\/.*$/, '')
 }
 
+/**
+ * A publish scope in the one form the registry names things by — `@acme` — from any
+ * spelling `--scope` or `package.json::uniweb.scope` may carry it in (`@acme`, `acme`,
+ * `@acme/…`). Null when there is no handle in it.
+ *
+ * ⛔ Every name built from a scope goes through this. The `.uwx` assembly
+ * (`@uniweb/build`'s `buildRegistryPackage`) has always accepted `acme` as well as
+ * `@acme`, so a name composed from the RAW value disagreed with the one it registered:
+ * until 2026-09-21 `register --scope std` registered `@std/src` and then asked to
+ * deliver code for `std/src`, which the registry refuses (a scoped name is `@org/name`).
+ *
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+export function publishScope(value) {
+  const handle = bareHandle(value)
+  return handle ? `@${handle}` : null
+}
+
 /**
  * Validate a handle's GRAMMAR client-side (reserved names are the server's
  * call — a 409 carries the verdict). Returns an error string, or null.

package/src/utils/scaffold.js

@@ -207,6 +207,15 @@ export async function applyContent(
   )
 }
 
+/**
+ * What a project records about where IT synced and deployed — a site's identity on
+ * each backend, its deploy targets and history, and the local caches of both. A new
+ * project made from a template owns none of it: carried over, its first push would
+ * update the template's own site. The same line `uniweb forget --all` draws for a
+ * copied project. Matched at the top of a content directory, where a site keeps them.
+ */
+const INHERITED_STATE = new Set(['sync.json', 'deploy.yml', '.uniweb'])
+
 /**
  * Recursively copy content files, skipping structural files.
  *
@@ -234,6 +243,7 @@ async function copyContentRecursive(
     const sourcePath = join(sourceDir, entry.name)
 
     if (entry.isDirectory()) {
+      if (depth === 0 && INHERITED_STATE.has(entry.name)) continue
       const targetSubDir = join(targetDir, entry.name)
       await copyContentRecursive(
         sourcePath,
@@ -260,6 +270,7 @@ async function copyContentRecursive(
 
       // Skip structural files
       if (structuralFiles.has(outputName)) continue
+      if (depth === 0 && INHERITED_STATE.has(outputName)) continue
 
       const targetPath = join(targetDir, outputName)
 

package/src/utils/session-file.js

@@ -0,0 +1,95 @@
+/**
+ * `~/.uniweb/registry-auth.json` — the ONE reader of its shape.
+ *
+ *   { version: 2, current: "<origin>", sessions: { "<origin>": { token, … } } }
+ *
+ * ⭐ ONE session since 2026-09-21 — a login replaces the file, a logout deletes it
+ * (registry-auth.js). The map shape stays so this reader also understands a file from
+ * 2026-09-20→21, when the store kept one session PER backend.
+ *
+ * ⛔ **There were two readers until 2026-09-21, and the copy is how "the backend you are
+ * logged in to" stopped meaning anything.** `registry-auth.js` writes the file and read
+ * it; the origin ladder in `config.js` kept a sync copy that read a top-level `origin`.
+ * When the file became one session per backend (`fb4907e`), the writer moved to the shape
+ * above and the copy kept reading `origin` — a field the new shape does not have — so
+ * every command that falls back to the logged-in backend quietly fell through to the
+ * default one. Both now read through here, so the shape has one reader to change.
+ *
+ * ⛔ Dependency-free, by requirement: `config.js` imports this, and `registry-auth.js`
+ * imports `config.js`, so this module can import neither.
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export const SESSION_FILE_VERSION = 2
+
+export function sessionFilePath() {
+  return join(homedir(), '.uniweb', 'registry-auth.json')
+}
+
+const originOf = (value) => {
+  try {
+    // http(s) only — `localhost:8080` parses as a scheme with the origin "null".
+    const u = new URL(value)
+    return u.protocol === 'http:' || u.protocol === 'https:' ? u.origin : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Any parsed value → `{ version: 2, current, sessions }`. Never throws.
+ *
+ * A v1 flat record is ONE session, keyed by its own `origin` stamp — or by
+ * `defaultOrigin` when it carries none — and that session is current: it was the only
+ * login there was.
+ *
+ * @param {*} raw - the parsed file, or anything
+ * @param {string} defaultOrigin
+ */
+export function normalizeSessionFile(raw, defaultOrigin) {
+  const empty = { version: SESSION_FILE_VERSION, current: null, sessions: {} }
+  if (!raw || typeof raw !== 'object') return empty
+  if (raw.sessions && typeof raw.sessions === 'object' && !Array.isArray(raw.sessions)) {
+    return { version: SESSION_FILE_VERSION, current: originOf(raw.current), sessions: raw.sessions }
+  }
+  if (typeof raw.token === 'string') {
+    const { origin, ...rest } = raw
+    const key = originOf(origin) || defaultOrigin
+    return { version: SESSION_FILE_VERSION, current: key, sessions: { [key]: rest } }
+  }
+  return empty
+}
+
+/** The file, normalized; synchronous, for the origin ladder. Never throws. */
+export function readSessionFileSync(defaultOrigin) {
+  const p = sessionFilePath()
+  if (!existsSync(p)) return normalizeSessionFile(null, defaultOrigin)
+  try {
+    return normalizeSessionFile(JSON.parse(readFileSync(p, 'utf8')), defaultOrigin)
+  } catch {
+    return normalizeSessionFile(null, defaultOrigin)
+  }
+}
+
+/**
+ * **The backend the user is logged in to** — the one session's backend.
+ *
+ * A file written since sessions became single holds one session, marked `current`. The
+ * other branches read what came before: a per-backend file names its last login
+ * `current`; one with a single unmarked session answers with it; several and none
+ * marked is no answer, and saying so beats guessing. An expired session still answers —
+ * the user logged in there, and the next request asks them to log in there again.
+ *
+ * @param {{ current?: string|null, sessions?: object }} file - normalized
+ * @returns {string|null}
+ */
+export function loggedInOriginOf(file) {
+  const sessions = file?.sessions || {}
+  const has = (o) => !!(o && sessions[o] && typeof sessions[o].token === 'string')
+  if (has(file?.current)) return file.current
+  const all = Object.keys(sessions).filter(has)
+  return all.length === 1 ? all[0] : null
+}

package/src/utils/site-copies.js

@@ -0,0 +1,123 @@
+/**
+ * Is this project a copy of another one in the same workspace?
+ *
+ * A plain directory copy carries `sync.json`, so the copy holds the ORIGINAL's site
+ * on every backend the original synced with — and its first push updates that site.
+ * `uniweb forget --all` in the copy is the fix. This is how the CLI notices a copy in
+ * which nobody ran it, before the push goes out.
+ *
+ * ## The signal, and why it is exact
+ *
+ * **Two directories in one workspace holding the same site uuid on the same
+ * backend.** Every create mints a new site, so two directories can only name one site
+ * if one got it from the other. Whichever of them pushes, the other is a stale copy
+ * of the same site waiting to overwrite it — so refusing is right from both sides.
+ *
+ * ## Why only within a workspace
+ *
+ * A teammate's clone holds the same site too, and legitimately: it IS the same
+ * project. A clone is a separate checkout, so it is never scanned. The price is the
+ * case this cannot see: a copy placed outside the workspace is byte-for-byte a clone,
+ * and nothing on disk tells them apart.
+ *
+ * ## Where it looks
+ *
+ * The workspace root and two levels below it — where sites live (`site/`, `sites/*`)
+ * and where a copy usually lands — plus this site's own siblings, for a site deeper
+ * than that. Dot-directories, `node_modules` and `dist` are skipped, and the walk is
+ * bounded, so a workspace root found somewhere unexpected costs a few milliseconds,
+ * not a disk scan.
+ */
+
+import { existsSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, relative } from 'node:path'
+import { findWorkspaceRoot } from './workspace.js'
+import { normalizeOrigin, readSiteIdentity } from './site-identity.js'
+
+const SKIP = new Set(['node_modules', 'dist'])
+const MAX_ENTRIES = 5000
+
+const real = (p) => {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
+const within = (dir, root) => {
+  const rel = relative(root, dir)
+  return !rel.startsWith('..') && !isAbsolute(rel)
+}
+
+/** Directories holding a `sync.json`, `depth` levels below `dir` at most. */
+function collect(dir, depth, out, budget) {
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (--budget.left < 0) return
+    if (!entry.isDirectory() || entry.name.startsWith('.') || SKIP.has(entry.name)) continue
+    const child = join(dir, entry.name)
+    if (existsSync(join(child, 'sync.json'))) out.add(child)
+    if (depth > 1) collect(child, depth - 1, out, budget)
+  }
+}
+
+/**
+ * The other directories in this workspace that hold this site's site on `origin`.
+ *
+ * @param {string} siteDir
+ * @param {string} origin - the backend a push is about to go to
+ * @returns {string[]} absolute paths, sorted; `[]` when the site has no identity on
+ *   that backend yet (its push will create one), or it is in no workspace
+ */
+export function findSiteCopies(siteDir, origin) {
+  const key = normalizeOrigin(origin)
+  const mine = key ? readSiteIdentity(siteDir, key).uuid : null
+  if (!mine) return []
+  const root = findWorkspaceRoot(siteDir)
+  if (!root) return []
+
+  const candidates = new Set()
+  const budget = { left: MAX_ENTRIES }
+  if (existsSync(join(root, 'sync.json'))) candidates.add(root)
+  collect(root, 2, candidates, budget)
+  const parent = dirname(siteDir)
+  if (real(siteDir) !== real(root) && within(parent, root)) collect(parent, 1, candidates, budget)
+
+  const self = real(siteDir)
+  const found = []
+  for (const dir of candidates) {
+    if (real(dir) === self) continue
+    if (readSiteIdentity(dir, key).uuid === mine) found.push(dir)
+  }
+  return found.sort()
+}
+
+/**
+ * What to tell the person, as a headline and detail lines — each verb prints them
+ * with its own reporter.
+ *
+ * ⚖️ It cannot say WHICH directory is the copy: the two are identical, which is the
+ * whole problem. The person knows, because they made it.
+ *
+ * @param {string[]} copies - from findSiteCopies
+ * @param {string} origin
+ * @param {'push'|'publish'} verb
+ */
+export function describeSiteCopies(copies, origin, verb) {
+  const here = (dir) => relative(process.cwd(), dir) || '.'
+  return {
+    headline: `Another project in this workspace holds the same site on ${origin}:`,
+    lines: [
+      ...copies.map((dir) => `  ${here(dir)}`),
+      `One of them is a copy of the other, so a ${verb} from either one updates that site.`,
+      'In the copy, run:  uniweb forget --all',
+      `The copy then ${verb === 'publish' ? 'publishes' : 'pushes'} as a new site. The original needs nothing.`
+    ]
+  }
+}

package/src/utils/site-data-upload.js

@@ -19,9 +19,10 @@
  *
  * ## Why this is not the asset lane
  *
- * Assets are **global and content-addressed** — identical bytes dedup across
- * sites — so the relation from a site's path to an object is many-to-one and a
- * serve path cannot be a property of the object. This lane is **per-site and
+ * Assets are **content-addressed, and dedup across the sites of one backend**
+ * — so the relation from a site's path to an object is many-to-one and a serve
+ * path cannot be a property of the object. *("Global" names that dedup scope; it
+ * never meant across backends — see utils/asset-upload.js.)* This lane is **per-site and
  * path-addressed**. Sending static data through the asset store is what forced
  * the old "data ball": one bundled asset the backend had to fetch, parse and
  * fan out, which is the only place these bytes ever transited it.