uniweb 0.60.0 → 0.62.0

package/src/commands/publish.js

@@ -33,7 +33,7 @@
  *                                  FIRST publish of a site reads it — that create is
  *                                  what decides which org owns the site and whose
  *                                  storage its assets are charged to. It is then
- *                                  recorded as `site.yml::$org` and replayed, so it
+ *                                  recorded in `sync.json` and replayed, so it
  *                                  never has to be re-typed.
  *   uniweb publish --personal      Own the new site personally, deliberately. Sends
  *                                  NO `as_org` — byte-identical to the wire before
@@ -535,12 +535,18 @@ export async function publish(args = []) {
   // Non-local @std/registry Model schemas resolve through the backend (same as push).
   const resolveModel = makeModelResolver({ client, offline: false })
 
-  // ⛔ AN EMPTY `records.yml` REMOVES. It is the one path where an ordinary act is
-  // destructive — a placeholder file, created meaning to fill it in — so the count
-  // is reported and confirmed before anything is sent.
+  // ⛔ AN EMPTY RECORDS DIRECTORY REMOVES. It is the one path where an ordinary act
+  // is destructive — a directory emptied by accident, or kept with only a
+  // placeholder — so the count is reported and confirmed before anything is sent.
+  //
+  // ⛔ `backend` WAS MISSING HERE until 2026-09-21, and it is what the count is read
+  // under: placements are banked per backend, so with none the guard counted zero
+  // and never asked — `publish` sent an empty folder without a word while `push`
+  // stopped for the same one.
   {
     const guard = await guardEmptyRecords({
       siteDir,
+      backend: client.origin,
       args,
       warn: say.warn,
       note: say.dim

package/src/commands/pull.js

@@ -65,7 +65,7 @@ import {
 import { tmpdir } from 'node:os'
 import { createHash } from 'node:crypto'
 import { createInterface } from 'node:readline/promises'
-import { join, dirname, relative } from 'node:path'
+import { join, dirname, relative, resolve } from 'node:path'
 import yaml from 'js-yaml'
 import { downloadMissingAssets } from '../backend/asset-download.js'
 import {
@@ -843,9 +843,9 @@ export async function pull(args = [], deps = {}) {
       }
       // ⛔ NO QUERY CONFIG. A record's home is decided by what it IS — its
       // `$model` names the pool folder — not by any query that happens to select
-      // it. `recordsToProject` reads `site.yml::$org` itself, so a `@/x`
-      // model the producer resolved to `@org/x` is placed back where the author
-      // wrote it.
+      // it. `recordsToProject` reads the site's org itself (this backend's, from
+      // `sync.json`), so a `@/x` model the producer resolved to `@org/x` is placed
+      // back where the author wrote it.
       const report = recordsToProject({
         folderDoc,
         recordDocs,
@@ -856,7 +856,16 @@ export async function pull(args = [], deps = {}) {
           resolveDeclaration: (name) => declByModel.get(name) || null
         }
       })
-      if (report.records === 'updated') info('Wrote records.yml')
+      // The folder's organization, `folder.yml` in the records directory — named as
+      // the author would write it (`records/folder.yml`, or under `paths.records`).
+      if (report.records === 'updated') {
+        info(`Wrote ${report.recordsFile}`)
+        wrote.push(resolve(siteDir, report.recordsFile))
+      } else if (report.records === 'removed') {
+        // The backend's folder has no sub-folders, and the file holds nothing else.
+        info(`Removed ${report.recordsFile} — the folder has no sub-folders`)
+        removed.push(resolve(siteDir, report.recordsFile))
+      }
       records += report.placed.length + report.updated.length
       for (const s of report.skipped)
         note(`↷ ${s.slug ?? s.uuid ?? '(record)'}: ${s.reason}`)
@@ -890,7 +899,8 @@ export async function pull(args = [], deps = {}) {
     siteDir,
     [
       ...wrote,
-      ...['site.yml', 'theme.yml', 'head.html', 'queries.yml', 'records.yml'].map((f) =>
+      // The records folder's `folder.yml` is in `wrote` when this pull wrote it.
+      ...['site.yml', 'theme.yml', 'head.html', 'queries.yml'].map((f) =>
         join(siteDir, f)
       )
     ],

package/src/commands/push.js

@@ -14,7 +14,7 @@
  * the backend owns the site's `@uniweb/folder`, so the framework never holds a
  * folder uuid. Records still round-trip their own `$uuid`
  * (back-filled into their source files). site-content items carry a per-item `$uuid`
- * too, stamped at emit from the identity cache rather than from author files — without
+ * too, stamped at emit from `sync.json` rather than from author files — without
  * it the backend reads every record as new and recreates every page and section row.
  * Push-only, and gated on the backend's per-entity `version`
  * (see "Pushes are GATED by default" below); `--force` restores last-push-wins.
@@ -30,8 +30,8 @@
  *   uniweb push --org @org               Own the new site under @org (alias: --as-org).
  *                                        Read only on the FIRST push of a site — it
  *                                        decides which org owns it, and whose storage
- *                                        its assets are charged to. Recorded as
- *                                        `site.yml::$org` and replayed after that.
+ *                                        its assets are charged to. Recorded in
+ *                                        `sync.json` and replayed after that.
  *                                        Without it, you are asked once.
  *   uniweb push --personal               Own the new site personally, deliberately.
  *                                        Sends NO `as_org` — the same wire as before
@@ -388,10 +388,10 @@ export async function push(args = [], deps = {}) {
   // It also has to be this emit that carries `assetRewrite` below: the push cache
   // stores hashes of the REWRITTEN content, so the emit compared against it must
   // rewrite too, or every entity reads as changed forever.
-  // ⛔ AN EMPTY `records.yml` REMOVES. It is the one path where an ordinary act is
-  // destructive — a placeholder file, created meaning to fill it in — so the count
-  // is reported and confirmed before anything is sent. The format stays honest;
-  // the asking happens here.
+  // ⛔ AN EMPTY RECORDS DIRECTORY REMOVES. It is the one path where an ordinary act
+  // is destructive — a directory emptied by accident, or kept with only a
+  // placeholder — so the count is reported and confirmed before anything is sent.
+  // The format stays honest; the asking happens here.
   if (!dryRun) {
     const guard = await guardEmptyRecords({ siteDir, backend: client.origin, args, warn, note })
     if (!guard.ok) return { exitCode: 1 }

package/src/commands/register.js

@@ -3,15 +3,14 @@
  * standalone schemas package (the data schemas alone, no foundation), to the
  * registry as one names-only `.uwx` document (uwx-format.md §5).
  *
- * `uniweb login && uniweb register`. Distinct from `uniweb publish` (which
- * targets the legacy platform) — `register` talks to the registry over HTTP at a
- * configurable endpoint.
+ * `uniweb login && uniweb register`. Distinct from `uniweb publish`, which ships a
+ * SITE — and releases the site's local foundation by running this command
+ * (`backend/foundation-bring-along.js`).
  *
- * If the foundation's `dist/` is missing or version-stale (the baked schema
- * version differs from package.json), `register` builds it first — the same
- * build-if-stale `uniweb publish` does, so `register` is a full drop-in.
- * Preview paths (`--dry-run`, `-o`) never write to `dist/`; they require a
- * pre-built foundation.
+ * If the foundation's `dist/` is missing or stale — no build, a version bump
+ * since it, a source file newer than it, no SSR bundle (`foundationNeedsBuild`)
+ * — `register` builds it first. Preview paths (`--dry-run`, `-o`) never write to
+ * `dist/`; they require a pre-built foundation.
  *
  * Run from a foundation, or from a schemas-only package — a package that exports
  * schemas (e.g. `@uniweb/schemas`, any `@org/schemas`) or a bare `schemas/*.yml`
@@ -64,20 +63,27 @@ import {
   statSync
 } from 'node:fs'
 import { execSync } from 'node:child_process'
-import { resolve, join } from 'node:path'
+import { resolve, join, relative } from 'node:path'
+import prompts from 'prompts'
 import { buildRegistryPackage, buildSchemaOnlyPackage } from '@uniweb/build/uwx'
 import {
   classifyPackage,
   isSchemasPackage,
-  collectStandaloneSchemas
+  collectStandaloneSchemas,
+  readFoundationName,
+  checkFoundationName
 } from '@uniweb/build'
+import {
+  suggestFoundationName,
+  writeFoundationName
+} from '../utils/foundation-name.js'
 import { readRegistryAuth } from '../utils/registry-auth.js'
 import {
   collectDistFiles,
   computeFoundationDigest,
   readRuntimePin
 } from '../utils/code-upload.js'
-import { deriveScope } from '../utils/registry-orgs.js'
+import { deriveScope, publishScope } from '../utils/registry-orgs.js'
 import { BackendClient } from '../backend/client.js'
 import { writeJsonPreservingStyleAsync } from '../utils/json-file.js'
 import {
@@ -209,6 +215,84 @@ async function resolveFoundationDir(args) {
   process.exit(1)
 }
 
+/**
+ * The foundation's name, settled before anything is built or sent.
+ *
+ * A foundation registers as `@org/<name>`, and sites pin it by that name. The name
+ * is `main.js`'s `name`, else package.json's — `readFoundationName`, the rule the
+ * build reads for the schema this command submits. ⛔ `src` and `foundation` are
+ * the folder the code sits in, not the code: a project scaffolded before the name
+ * moved to main.js has package name `src`, and every such project in an org would
+ * register the same `@org/src`. So a name that cannot register is ASKED FOR here,
+ * once, and kept in main.js — or, with nobody to ask, refused with the line to add.
+ * Before the build, so a written name is built into the schema like any edit.
+ *
+ * @param {string} targetDir
+ * @param {{ args: string[], isPreview: boolean }} o
+ * @returns {Promise<boolean>} false → stop; the reason is printed
+ */
+export async function settleFoundationName(targetDir, { args, isPreview }) {
+  let read
+  try {
+    read = await readFoundationName(targetDir)
+  } catch (err) {
+    error(err.message)
+    return false
+  }
+  const problem = checkFoundationName(read.name)
+  if (!problem) return true
+
+  const where = relative(process.cwd(), read.mainFile) || read.mainFile
+  const suggestion = suggestFoundationName(targetDir)
+  const reason = `${problem[0].toUpperCase()}${problem.slice(1)}.`
+
+  // Nobody to ask — a script, a preview (which writes nothing), or --json (whose
+  // stdout is a data channel a prompt would corrupt). Name the fix exactly.
+  if (isPreview || jsonMode || isNonInteractive(args)) {
+    error(`This foundation has no name it can register under. ${reason}`)
+    log(`  Name it in ${colors.bright}${where}${colors.reset}, in the default export:`)
+    log(`    ${colors.bright}name: '${suggestion || '<name>'}',${colors.reset}`)
+    log(`  ${colors.dim}It registers as @<org>/<name>, and sites pin that name.${colors.reset}`)
+    return false
+  }
+
+  info(`This foundation needs a name to register under. ${reason}`)
+  const { name } = await prompts(
+    {
+      type: 'text',
+      name: 'name',
+      message: 'Foundation name (it registers as @<org>/<name>):',
+      initial: suggestion || '',
+      validate: (v) => checkFoundationName(String(v).trim()) || true
+    },
+    {
+      onCancel: () => {
+        log('\nRegister cancelled.')
+        process.exit(0)
+      }
+    }
+  )
+  const chosen = String(name || '').trim()
+  if (!chosen) return false
+
+  const written = writeFoundationName(read.mainFile, chosen, {
+    replace: read.source === 'main.js' ? read.name : null
+  })
+  if (!written.ok) {
+    error(`Could not write the name: ${written.reason}.`)
+    log(`  Add it to the default export in ${colors.bright}${where}${colors.reset}:  name: '${chosen}',`)
+    return false
+  }
+  // Read it back through the build's own rule — the text edit is only a means.
+  const again = await readFoundationName(targetDir).catch(() => null)
+  if (again?.name !== chosen) {
+    error(`${where} now names the foundation '${chosen}', but it still reads as "${again?.name}".`)
+    return false
+  }
+  success(`Named the foundation ${colors.bright}${chosen}${colors.reset} — kept in ${where}.`)
+  return true
+}
+
 // Directories that are never foundation source. `dist` is the output we compare
 // against; the rest are tooling. Dotted entries are skipped wholesale.
 const NON_SOURCE_DIRS = new Set(['dist', 'node_modules'])
@@ -404,14 +488,24 @@ async function runRegister(args = []) {
     : await resolveFoundationDir(args)
 
   // Scope: --scope flag, else package.json `uniweb.scope`, else (real submit
-  // only) derived from login membership in the bootstrap below.
+  // only) derived from login membership in the bootstrap below. Either spelling,
+  // `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
   const pkgScope = readPkgScope(targetDir)
-  let scope = scopeFlag || pkgScope
+  const givenScope = scopeFlag || pkgScope
+  let scope = publishScope(givenScope)
   let scopeSource = scopeFlag
     ? '--scope'
     : pkgScope
       ? 'package.json uniweb.scope'
       : null
+  // A scope that was GIVEN but names no org (`--scope @`) is refused, never read as
+  // absent: absent derives one from the login, which would register under an org the
+  // caller did not name.
+  if (givenScope && !scope) {
+    error(`Not an org scope: ${givenScope} (from ${scopeSource})`)
+    log(`  ${colors.dim}Pass --scope @org.${colors.reset}`)
+    return { exitCode: 2 }
+  }
   const isPreview = !!output || dryRun
 
   // Each path supplies a different schema source: the standalone path discovers
@@ -433,8 +527,11 @@ async function runRegister(args = []) {
       return { exitCode: 2 }
     }
   } else {
-    // Build-if-stale (mirrors `uniweb publish`): a missing or version-stale
-    // dist/ gets (re)built before we read its schema. Preview paths
+    if (!(await settleFoundationName(targetDir, { args, isPreview }))) {
+      return { exitCode: 2 }
+    }
+    // Build-if-stale (`foundationNeedsBuild`): a missing or stale dist/ gets
+    // (re)built before we read its schema. Preview paths
     // (--dry-run / -o) must not write to dist/, so they require a pre-built
     // foundation and say so instead of building.
     const { needs, reason } = foundationNeedsBuild(targetDir)
@@ -671,11 +768,17 @@ async function runRegister(args = []) {
       return { exitCode: 1 }
     }
   }
+  // The foundation's name as the registry holds it (`@org/name`) — read from the
+  // document just submitted, never composed again. See phase 2.
+  const registeredName = standalone
+    ? null
+    : doc.entities.find((e) => e.model === '@uniweb/foundation-schema')?.info
+        ?.name
   if (!alreadyRegistered) {
     success(
       standalone
         ? `Registered ${defined.length} data schema(s)${scope ? ` under ${scope}` : ''}`
-        : `Registered ${schema._self.name}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
+        : `Registered ${registeredName}@${schema._self.version}${defined.length ? ` + ${defined.length} data schema(s)` : ''}`
     )
   }
 
@@ -684,11 +787,13 @@ async function runRegister(args = []) {
   // only packages have no dist; --schema-only skips deliberately.
   if (!standalone && !args.includes('--schema-only')) {
     const distDir = join(targetDir, 'dist')
-    // The registry's vocabulary is the SCOPED name (`@org/name`). A scoped
-    // package name passes through; a bare one gets the chosen scope — the
-    // same resolution the .uwx submission applied.
-    const bareName = schema._self.name
-    const name = bareName.startsWith('@') ? bareName : `${scope}/${bareName}`
+    // ⭐ The plan authorizes against the REGISTERED (name, version), so the name here
+    // is the one phase 1 registered — the `.uwx`'s own `info.name`, where a scoped
+    // package name passes through and a bare one gets the scope. ⛔ Not composed a
+    // second time: this line composed it from the raw scope until 2026-09-21, so
+    // `--scope std` registered `@std/src` and then asked to deliver `std/src`, which
+    // the registry refuses. One name, read from the one place it was decided.
+    const name = registeredName
     const version = schema._self.version
     info(
       `Delivering code for ${colors.bright}${name}@${version}${colors.reset} …`

package/src/commands/rename.js

@@ -20,7 +20,7 @@
  *
  * Extensions are technically a flavor of foundation (same build, same
  * package.json shape, distinguished only by `extension: true` in
- * src/foundation.js or `role: 'extension'` in the built schema). The
+ * main.js or `role: 'extension'` in the built schema). The
  * rename verb still keeps them on a separate subcommand because the
  * touch-point sets differ — `rename foundation` against an extension
  * would update the wrong things. Each subcommand guards its target
@@ -30,11 +30,13 @@
  * (target name already taken, target not found, folder collision,
  * type mismatch) we bail with a clear message and no partial state.
  *
- * Out of scope: registry side. The registered id (the scoped
- * `package.json::name` / `uniweb.id`) is independent of the workspace name and
- * stays untouched. There is no registry-rename flag — a registered version is
- * immutable; to change a foundation's registered identity, register it under
- * the new name (consuming sites repoint their `foundation:` ref).
+ * Out of scope: registry side. What a foundation registers as is `name` in its
+ * main.js, which is independent of the workspace name and stays untouched —
+ * except for a foundation with no main.js `name`, whose package name IS its name
+ * (`readFoundationName`), so renaming the package renames what it would register
+ * as. There is no registry-rename flag — a registered version is immutable; to
+ * change a foundation's registered name, change main.js's `name` and register
+ * again (consuming sites repoint their `foundation:` ref).
  *
  * Usage:
  *   uniweb rename foundation <old> <new>
@@ -632,9 +634,10 @@ ${colors.bright}What rename extension does:${colors.reset}
   • Updates pnpm-workspace.yaml + package.json::workspaces.
 
 ${colors.bright}What rename does NOT do (any subcommand):${colors.reset}
-  • Push to the registry. The registered id (package.json::uniweb.id) is
-    independent. To register under a new name, set it and run \`${prefix} register\`
-    (alias \`${prefix} release\`) — there is no rename flag.
+  • Push to the registry, or change what a foundation registers as — that is
+    \`name\` in its main.js, independent of the package name. To register under
+    a new name, change it there and run \`${prefix} register\` (alias
+    \`${prefix} release\`) — there is no rename flag.
 
 ${colors.bright}Examples:${colors.reset}
   ${prefix} rename foundation src marketing-src

package/src/commands/status.js

@@ -28,7 +28,10 @@ import { resolveSiteDir } from './deploy.js'
 import { probeUnpushed } from '../backend/site-sync.js'
 import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
 import { readBackendState } from '@uniweb/build/uwx'
-import { resolveLocalFoundation } from '../backend/foundation-bring-along.js'
+import {
+  resolveLocalFoundation,
+  foundationScopedName
+} from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { checkFlags } from '../utils/flag-guard.js'
 
@@ -124,7 +127,8 @@ export async function status(args = []) {
       // site.yml ref. The digest compare is read-only — it never builds, so it
       // only fires when the local foundation is already built (dist present).
       const local = resolveLocalFoundation(siteDir, siteYml)
-      const lookupName = local?.scopedName || fndScope
+      const lookupName =
+        (local && (await foundationScopedName(local.dir))) || fndScope
       if (lookupName) fdnLatest = await client.readFoundationLatest(lookupName)
       if (local?.dir && fdnLatest?.digest) {
         const localDigest = computeFoundationDigest(join(local.dir, 'dist'))

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-21T13:20:05.572Z",
+  "generatedAt": "2026-09-21T23:16:47.962Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.4.1",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.56.0",
+      "version": "0.58.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.29.6",
+      "version": "0.29.8",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -55,7 +55,7 @@
       ]
     },
     "@uniweb/kit": {
-      "version": "0.19.3",
+      "version": "0.19.4",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -83,7 +83,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.27.2",
+      "version": "0.27.4",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -116,7 +116,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.14.8",
+      "version": "0.16.0",
       "path": "framework/templates",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.9.27",
+      "version": "0.10.1",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -53,6 +53,10 @@ import {
   mergeTemplateDependencies,
   getWorkspaceTemplateOutputs
 } from './utils/scaffold.js'
+import {
+  normalizeFoundationName,
+  ensureFoundationName
+} from './utils/foundation-name.js'
 import {
   detectPackageManager,
   detectWorkspacePm,
@@ -354,12 +358,16 @@ async function createFromPackageTemplates(
   // 2. Scaffold foundation (folder: src/, package name: src)
   // The folder name 'src' carries the meaning — a foundation is the site's
   // source code. The package name 'src' keeps it unique within the
-  // workspace, since 'site' is taken by the site package.
+  // workspace, since 'site' is taken by the site package. Neither is the
+  // foundation's NAME — what it registers as — which is main.js's `name`:
+  // the project's, since a project's code is its foundation.
   onProgress?.('Creating foundation...')
+  const registryName = normalizeFoundationName(projectName)
   await scaffoldFoundation(
     join(projectDir, 'src'),
     {
       name: 'src',
+      registryName,
       projectName,
       isExtension: false
     },
@@ -380,10 +388,12 @@ async function createFromPackageTemplates(
     { onProgress, onWarning }
   )
 
-  // 4. Apply starter content (unless creating a "none" project)
+  // 4. Apply starter content (unless creating a "none" project). Its main.js
+  // replaces the scaffolded one, so the name is given again.
   if (includeStarter) {
     onProgress?.('Adding starter content...')
     await applyStarter(projectDir, { projectName }, { onProgress, onWarning })
+    ensureFoundationName(join(projectDir, 'src'), registryName)
   }
 
   success(`Created project: ${projectName}`)
@@ -475,15 +485,31 @@ async function createFromContentTemplate(
   )
 
   // 2. Scaffold and apply content for each package
+  const claimed = new Set() // names this project's foundations register as
   for (const pkg of placed) {
     const fullPath = join(projectDir, pkg.relativePath)
 
+    // A foundation's name — what it registers as — is the template's name for
+    // the package when that is one, else the project's (`src` and `foundation`
+    // name a folder); `<project>-<package>` if another package here took it. A
+    // template's own main.js `name` outranks all of them.
+    let registryName = null
+    if (pkg.type === 'foundation' || pkg.type === 'extension') {
+      registryName =
+        [
+          normalizeFoundationName(pkg.name) || normalizeFoundationName(projectName),
+          normalizeFoundationName(`${projectName}-${pkg.name}`)
+        ].find((n) => n && !claimed.has(n)) || null
+      if (registryName) claimed.add(registryName)
+    }
+
     if (pkg.type === 'foundation' || pkg.type === 'extension') {
       onProgress?.(`Creating ${pkg.type}: ${pkg.name}...`)
       await scaffoldFoundation(
         fullPath,
         {
           name: pkg.name,
+          registryName,
           projectName,
           isExtension: pkg.type === 'extension'
         },
@@ -534,6 +560,7 @@ async function createFromContentTemplate(
           renames: contentDir.renames
         }
       )
+      ensureFoundationName(fullPath, registryName)
     }
 
     // Merge template dependencies into package.json
@@ -1432,7 +1459,7 @@ ${colors.bright}Options:${colors.reset}
   --org @org         Publish under @org (membership-gated; alias: --as-org). Read
                      only on a site's FIRST publish — that create decides which org
                      owns the site, and whose storage its assets are charged to.
-                     Recorded as site.yml \$org and replayed, so it is never
+                     Recorded in sync.json and replayed, so it is never
                      re-typed. Without it, you are asked once.
   --personal         Create the site under your personal account, deliberately.
                      Only needed on a first publish, and only to answer the owner