uniweb 0.62.0 → 0.63.0

package/src/commands/clone.js

@@ -39,6 +39,10 @@
  *   uniweb clone <uuid> --path sites     Place under sites/ (segregated layout)
  *   uniweb clone <uuid> --project docs   Co-located docs/site
  *   uniweb clone <uuid> --no-records Pull pages only; skip records
+ *   uniweb clone <uuid> --org @org       Read it as @org — stops if the backend works on
+ *                                        the site from another workspace. Without it,
+ *                                        the one the backend names is recorded in
+ *                                        sync.json for every command after.
  *
  * Backend: via BackendClient (the site-content pull lane). Origin from
  *   UNIWEB_REGISTER_URL  >  the local default (internal dev overrides;
@@ -55,7 +59,13 @@ import { resolvePlacement, SITE_KIND } from '../utils/placement.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
 import { addWorkspaceGlob } from '../utils/config.js'
 import { detectWorkspacePm, installCmd } from '../utils/pm.js'
-import { BackendClient } from '../backend/client.js'
+import {
+  BackendClient,
+  describeRequestError,
+  refusalDetail,
+  workspaceHandle
+} from '../backend/client.js'
+import { readOrgFlag } from '../utils/args.js'
 import { isNonInteractive, getCliPrefix } from '../utils/interactive.js'
 import { extractFoundationRef } from '../utils/site-content-refs.js'
 import { readUwxDocuments } from '../utils/uwx-read.js'
@@ -143,7 +153,7 @@ export function extractCloneSeeds(document) {
 // `site.yml`'s equivalent needed a hand-rolled dependency-free WRITER for exactly
 // this. The store stays the one writer everywhere else; this seeds a fresh file.
 // `test/clone.test.js` covers it end to end with `skipInstall: true`.
-function seedSyncJson(siteDir, origin, uuid) {
+function seedSyncJson(siteDir, origin, uuid, workspace = null) {
   const file = join(siteDir, 'sync.json')
   let doc = { version: 1, backends: {} }
   if (existsSync(file)) {
@@ -155,7 +165,20 @@ function seedSyncJson(siteDir, origin, uuid) {
     }
   }
   const key = new URL(origin).origin
-  doc.backends[key] = { ...(doc.backends[key] || {}), site: { ...(doc.backends[key]?.site || {}), uuid } }
+  // The workspace the read named — `--org`, or the one the backend answered with — so
+  // the delegated pull, and every command after it, names it from the first request.
+  // As the create records it: a handle bare in `org`, a handle-less unit's uuid in
+  // `unit` (site-sync.js::readSiteWorkspace).
+  const w = typeof workspace === 'string' && workspace ? workspace : null
+  const named = w
+    ? w.startsWith('@')
+      ? { org: w.slice(1) }
+      : { unit: w }
+    : {}
+  doc.backends[key] = {
+    ...(doc.backends[key] || {}),
+    site: { ...(doc.backends[key]?.site || {}), uuid, ...named }
+  }
   mkdirSync(dirname(file), { recursive: true })
   writeFileSync(file, JSON.stringify(doc, null, 2) + '\n')
 }
@@ -206,6 +229,11 @@ export async function clone(args = [], deps = {}) {
     args,
     command: 'Cloning'
   })
+  // The workspace the reads name: `--org` explicitly — a mismatch then stops the clone —
+  // else none, and the client adopts the one the backend works on the site from. There
+  // is no project yet to record it in; `seedSyncJson` does, below.
+  const orgFlag = readOrgFlag(args)
+  client.setWorkspace(orgFlag ? workspaceHandle(orgFlag) : null, { explicit: Boolean(orgFlag) })
 
   // 1. GET the site-content document.
   //
@@ -228,13 +256,15 @@ export async function clone(args = [], deps = {}) {
     }
     if (!res.ok) {
       error(`Could not read the site: HTTP ${res.status} ${res.statusText}`)
+      const detail = await refusalDetail(res)
+      if (detail) note(detail)
       if (res.status === 401 || res.status === 403)
         note('Run `uniweb login` first.')
       return { exitCode: 1 }
     }
     documents = readUwxDocuments(Buffer.from(await res.arrayBuffer()))
   } catch (err) {
-    error(`Could not reach the backend at ${client.origin}: ${err.message}`)
+    error(describeRequestError(err, client.origin))
     return { exitCode: 1 }
   }
 
@@ -355,7 +385,7 @@ export async function clone(args = [], deps = {}) {
   // the old `$backend`: the uuid came from whoever we read and nothing on disk said
   // so, and a teammate who pulled while logged in elsewhere sent it to the wrong
   // backend. Stored under the origin, that cannot be expressed.
-  seedSyncJson(siteDir, client.origin, siteUuid)
+  seedSyncJson(siteDir, client.origin, siteUuid, client.workspace)
   success(
     `Scaffolded the site harness${foundationRef ? ` (foundation: ${foundationRef})` : ''}.`
   )

package/src/commands/publish.js

@@ -29,15 +29,15 @@
  *   uniweb publish --dry-run       Resolve everything; POST nothing
  *   uniweb publish --yes           Skip confirmations (CI); never block on a prompt
  *   uniweb publish --force         Overwrite upstream app-side edits (drop the push gate)
- *   uniweb publish --org @org      Publish under @org (alias: --as-org). Only the
- *                                  FIRST publish of a site reads it — that create is
- *                                  what decides which org owns the site and whose
- *                                  storage its assets are charged to. It is then
- *                                  recorded in `sync.json` and replayed, so it
- *                                  never has to be re-typed.
- *   uniweb publish --personal      Own the new site personally, deliberately. Sends
- *                                  NO `as_org` — byte-identical to the wire before
- *                                  the owner prompt existed. First publish only.
+ *   uniweb publish --org @org      Publish under @org. On the FIRST publish of a
+ *                                  site it decides which org owns the site and whose
+ *                                  storage its assets are charged to; recorded in
+ *                                  `sync.json`, and every request after names it, so
+ *                                  it never has to be re-typed. Later, it must match
+ *                                  the workspace the backend works on the site from,
+ *                                  or publish stops.
+ *   uniweb publish --personal      Own the new site personally, deliberately: its
+ *                                  requests name no workspace.
  *   uniweb publish --no-save       Do not record this publish in deploy.yml
  */
 
@@ -65,7 +65,11 @@ import {
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
 import { resolveDefaultLocale } from '@uniweb/core/locale-config'
 
-import { BackendClient } from '../backend/client.js'
+import {
+  BackendClient,
+  describeRequestError,
+  WorkspaceMismatchError
+} from '../backend/client.js'
 import { DEFAULT_BACKEND_ORIGIN } from '../utils/config.js'
 import { resolveSiteDir } from './deploy.js'
 import { warnIfContentDoesNotConform } from '../utils/conformance.js'
@@ -90,7 +94,9 @@ import {
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
   pushSyncPackages,
-  resolveSiteOrgForCreate
+  resolveSiteOrgForCreate,
+  nameSiteWorkspace,
+  EXPLICIT_OWNER
 } from '../backend/site-sync.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import {
@@ -320,7 +326,6 @@ export async function publish(args = []) {
     say.dim(org.reason)
     return { exitCode: 2 }
   }
-  const asOrg = org.asOrg
 
   // ⛔ There is no capability gate here any more, deliberately.
   //
@@ -508,6 +513,17 @@ export async function publish(args = []) {
   // be the silent-wrong-success this whole branch exists to prevent.
   if (!fnd.proceed) return { exitCode: fnd.refused ? 1 : 0 }
 
+  // ⭐ Name the workspace every site request works in — the create, the push, the
+  // publish and the data lane. The user's own choice is explicit, so a `409
+  // wrong_workspace` stops the publish; a recorded one is adopted afresh when stale
+  // (`nameSiteWorkspace`).
+  nameSiteWorkspace(client, {
+    siteDir,
+    workspace: org.workspace,
+    explicit: EXPLICIT_OWNER.has(org.source),
+    note: (m) => say.dim(m)
+  })
+
   // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
   //    dist/data/*, dist/assets/*. Spawn the SAME CLI binary so the inner
   //    build can't resolve to a different installed version.
@@ -562,8 +578,6 @@ export async function publish(args = []) {
       backend: client.origin,
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir, client.origin),
-      // Resolves a foundation-relative `@/x` model ref into `@org/x`.
-      ...(asOrg ? { org: asOrg } : {}),
       ...(foundationDir ? { foundationDir } : {}),
       resolveModel
     })
@@ -612,7 +626,6 @@ export async function publish(args = []) {
     siteDir,
     name: siteYml.name,
     foundation: fnd.ref || siteYml.foundation,
-    asOrg,
     note: (m) => say.dim(m)
   })
   if (!site.uuid) {
@@ -727,6 +740,8 @@ export async function publish(args = []) {
       apiBase: client.origin,
       token: await client.token(),
       siteUuid: site.uuid,
+      // The plan and every direct PUT name the workspace the rest of the publish did.
+      workspace: client.workspace,
       ball,
       onProgress: (m) => say.dim(`  ${m}`)
     })
@@ -949,8 +964,6 @@ export async function publish(args = []) {
       ...(declaration.declare ? {} : { declareServices: false }),
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir, client.origin),
-      // Resolves a foundation-relative `@/x` model ref into `@org/x`.
-      ...(asOrg ? { org: asOrg } : {}),
       ...(foundationDir ? { foundationDir } : {}),
       resolveModel,
       priorHashes,
@@ -978,7 +991,6 @@ export async function publish(args = []) {
     client,
     siteDir,
     pkg,
-    asOrg,
     report
   })
   if (pushResult.exitCode !== 0) return { exitCode: pushResult.exitCode }
@@ -998,8 +1010,9 @@ export async function publish(args = []) {
       ...(languages ? { languages } : {})
     })
   } catch (err) {
-    say.err(`Could not reach the backend at ${client.origin}: ${err.message}`)
-    say.dim('Set the origin with --backend <url> or UNIWEB_REGISTER_URL.')
+    say.err(describeRequestError(err, client.origin))
+    if (!(err instanceof WorkspaceMismatchError))
+      say.dim('Is that the backend you meant? Switch with: uniweb login --backend <url>')
     return { exitCode: 1 }
   }
   if (!pubRes.ok) {

package/src/commands/pull.js

@@ -72,6 +72,7 @@ import {
   readBackendState,
   siteContentDocumentToProject,
   recordsToProject,
+  siteSelfScope,
   readZip,
   computeUnitHashes,
   collectUnitUuids,
@@ -89,8 +90,11 @@ import {
   mergeBaseVersions,
   mergeItemBaseVersions,
   writeUnitBases,
-  writeItemUuids
+  writeItemUuids,
+  nameSiteWorkspace,
+  readSiteWorkspace
 } from '../backend/site-sync.js'
+import { readOrgFlag } from '../utils/args.js'
 import {
   uncommittedUnder,
   siteContentRoots,
@@ -98,7 +102,13 @@ import {
   mergeFile
 } from '../utils/git.js'
 import { isNonInteractive } from '../utils/interactive.js'
-import { BackendClient } from '../backend/client.js'
+import {
+  BackendClient,
+  describeRequestError,
+  refusalDetail,
+  workspaceHandle,
+  WorkspaceMismatchError
+} from '../backend/client.js'
 import { resolveSiteDir as defaultResolveSiteDir } from './deploy.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
@@ -591,6 +601,15 @@ export async function pull(args = [], deps = {}) {
     args,
     command: 'Pulling'
   })
+  // The workspace these requests name: `--org` explicitly, else the one this project
+  // recorded for this backend — adopted afresh from the backend's answer when stale.
+  const orgFlag = readOrgFlag(args)
+  nameSiteWorkspace(client, {
+    siteDir,
+    workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
+    explicit: Boolean(orgFlag),
+    note
+  })
 
   // ⭐ No scope check any more — and none is needed. This project's identity on
   // `client.origin` is read from that origin's own section of sync.json, so a
@@ -649,7 +668,8 @@ export async function pull(args = [], deps = {}) {
   // body — `readPullDocuments` reads the entity files out of it (JSON fallback). A
   // conditional request whose ETag matches returns `{ notModified: true }` (304, empty
   // body). `doRequest` is a thunk returning the client's Response promise. 404 / any
-  // failure → null (the lane is skipped, not fatal).
+  // failure → null (the lane is skipped, not fatal) — except a workspace mismatch,
+  // `{ refused: true }`, which stops the pull: the other lane would only say it again.
   const getDocs = async (label, doRequest) => {
     info(
       `Pulling ${colors.bright}${label}${colors.reset} from ${colors.dim}${client.origin}${colors.reset} …`
@@ -658,7 +678,8 @@ export async function pull(args = [], deps = {}) {
     try {
       res = await doRequest()
     } catch (err) {
-      error(`Could not reach the backend at ${client.origin}: ${err.message}`)
+      error(describeRequestError(err, client.origin))
+      if (err instanceof WorkspaceMismatchError) return { refused: true }
       note('Is that the backend you meant? Switch with: uniweb login --backend <url>')
       return null
     }
@@ -672,6 +693,8 @@ export async function pull(args = [], deps = {}) {
     }
     if (!res.ok) {
       error(`${label} pull failed: HTTP ${res.status} ${res.statusText}`)
+      const detail = await refusalDetail(res)
+      if (detail) note(detail)
       if (res.status === 401 || res.status === 403)
         note(
           "Credentials weren't accepted — log in again (`uniweb login --backend <url>`), or check UNIWEB_TOKEN."
@@ -709,11 +732,28 @@ export async function pull(args = [], deps = {}) {
   let etagContent = cache.content
   let etagFolder = cache.folder
 
+  // ⭐ THE SCOPE THE PULLED RECORDS AND QUERIES WERE QUALIFIED WITH — the pushed site's
+  // FOUNDATION's: the scope of the pinned ref it carries (`info.foundation`), else the
+  // local foundation's name. A push qualifies `@/x` with it, so this is what undoes it,
+  // and a record lands back in `records/article/` rather than `records/acme/article/`.
+  // Resolved once, up front — it may load main.js — and handed to the synchronous
+  // projections, as Models are. ⛔ It was the site owner's org, from sync.json, until
+  // 2026-09-22; a foundation may be registered under any org its author belongs to.
+  let pullScope
+  const scopeFor = async (doc) => {
+    if (pullScope === undefined) {
+      const pinned = doc?.info?.foundation
+      pullScope = await siteSelfScope(siteDir, pinned !== undefined ? { foundation: pinned } : {})
+    }
+    return pullScope
+  }
+
   // Lane 1 — content → config + pages/** + layout/**. The .uwx carries a single
   // entity (the site-content document). A 304 (unchanged) leaves local files as-is.
   const content = await getDocs('content', () =>
     client.pullSiteContent(siteContentUuid, { etag: etagContent })
   )
+  if (content?.refused) return { exitCode: 1 }
   if (content && !content.notModified) {
     const siteDoc =
       content.docs &&
@@ -806,7 +846,9 @@ export async function pull(args = [], deps = {}) {
         // it a pull leaves every image pointing at a backend route.
         backend: client.origin,
         prune,
-        keepAuthoredFoundation
+        keepAuthoredFoundation,
+        // So a query's `@acme/member` comes back as the author's `@/member`.
+        scope: await scopeFor(siteDoc)
       })
       wrote.push(...report.pages, ...report.sections, ...report.layout)
       removed.push(
@@ -828,6 +870,7 @@ export async function pull(args = [], deps = {}) {
     const folder = await getDocs('records', () =>
       client.pullFolder(siteContentUuid, { etag: etagFolder })
     )
+    if (folder?.refused) return { exitCode: 1 }
     if (folder && !folder.notModified && folder.docs?.length) {
       const { folderDoc, recordDocs } = splitRecordsPull(folder.docs)
       const resolveModel = makeModelResolver({ client })
@@ -843,17 +886,19 @@ export async function pull(args = [], deps = {}) {
       }
       // ⛔ NO QUERY CONFIG. A record's home is decided by what it IS — its
       // `$model` names the pool folder — not by any query that happens to select
-      // it. `recordsToProject` reads the site's org itself (this backend's, from
-      // `sync.json`), so a `@/x` model the producer resolved to `@org/x` is placed
-      // back where the author wrote it.
+      // it. Handed the foundation's scope (`scopeFor`), `recordsToProject` places a
+      // `@/x` model the producer resolved to `@acme/x` back where the author wrote it.
       const report = recordsToProject({
         folderDoc,
         recordDocs,
         siteRoot: siteDir,
         opts: {
-          // Whose record map to read and extend, and whose org to place models under.
+          // Whose record map to read and extend.
           backend: client.origin,
-          resolveDeclaration: (name) => declByModel.get(name) || null
+          resolveDeclaration: (name) => declByModel.get(name) || null,
+          // The scope a model's `@/x` was qualified with, so `@acme/article` is placed
+          // back in `records/article/` — see `scopeFor`.
+          scope: await scopeFor(null)
         }
       })
       // The folder's organization, `folder.yml` in the records directory — named as

package/src/commands/push.js

@@ -27,15 +27,15 @@
  *
  * Usage:
  *   uniweb push                          Build, push both lanes, back-fill $uuid
- *   uniweb push --org @org               Own the new site under @org (alias: --as-org).
- *                                        Read only on the FIRST push of a site — it
- *                                        decides which org owns it, and whose storage
- *                                        its assets are charged to. Recorded in
- *                                        `sync.json` and replayed after that.
- *                                        Without it, you are asked once.
- *   uniweb push --personal               Own the new site personally, deliberately.
- *                                        Sends NO `as_org` — the same wire as before
- *                                        this prompt existed. First push only.
+ *   uniweb push --org @org               Own the new site under @org. On the FIRST
+ *                                        push it decides which org owns the site, and
+ *                                        whose storage its assets are charged to;
+ *                                        recorded in `sync.json`, and every request
+ *                                        after names it. Without it, you are asked
+ *                                        once. Later, it must match the workspace the
+ *                                        backend works on the site from, or push stops.
+ *   uniweb push --personal               Own the new site personally, deliberately:
+ *                                        its requests name no workspace.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
  *   uniweb push --foundation <dir>       Use this local foundation for the Model schema
@@ -92,7 +92,9 @@ import {
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
   pushSyncPackages,
-  resolveSiteOrgForCreate
+  resolveSiteOrgForCreate,
+  nameSiteWorkspace,
+  EXPLICIT_OWNER
 } from '../backend/site-sync.js'
 
 // Re-exported for downstream importers (pull.js, push.test.js) that read these
@@ -231,7 +233,6 @@ export async function push(args = [], deps = {}) {
     note(org.reason)
     return { exitCode: 2 }
   }
-  const asOrg = org.asOrg
 
   // Bring the foundation along — BEFORE any asset upload, because an upload is
   // chargeable and a push that aborts after one has spent the user's money for
@@ -288,6 +289,17 @@ export async function push(args = [], deps = {}) {
   }
   if (!fnd.proceed) return { exitCode: 1 }
 
+  // ⭐ Name the workspace every site request works in. The user's own choice (`--org`,
+  // `--personal`, the picker) is explicit, so a `409 wrong_workspace` stops the push; a
+  // recorded one is adopted afresh from the backend's answer when stale
+  // (`nameSiteWorkspace`).
+  nameSiteWorkspace(client, {
+    siteDir,
+    workspace: org.workspace,
+    explicit: EXPLICIT_OWNER.has(org.source),
+    note
+  })
+
   // Build BOTH directional packages (the producer side). Each carries its own
   // `index` — the per-entity source-file map for back-fill, correlated by submission
   // position. Non-local Models are fetched from the registry on demand. `priorHashes`
@@ -406,8 +418,6 @@ export async function push(args = [], deps = {}) {
       backend: client.origin,
       // Placement identity for the folder — see writeFolderItemUuids.
       folderItemUuids: readFolderItemUuids(siteDir, client.origin),
-      // Resolves a foundation-relative `@/x` model ref into `@org/x`.
-      ...(asOrg ? { org: asOrg } : {}),
         ...(foundationDir ? { foundationDir } : {}),
         resolveModel: makeModelResolver({ client, offline: false })
       })
@@ -433,7 +443,6 @@ export async function push(args = [], deps = {}) {
       const site = await ensureSiteExists({
         client,
         siteDir,
-        asOrg,
         note,
         ...(fnd.ref ? { foundation: fnd.ref } : {})
       })
@@ -508,8 +517,6 @@ export async function push(args = [], deps = {}) {
       // Identity for the `queries` section — see readQueryUuids. Keyed by
       // name, because a declaration has no file for a path-keyed map to hold.
       queryUuids: readQueryUuids(siteDir, client.origin),
-      // Resolves a foundation-relative `@/x` model ref into `@org/x`.
-      ...(asOrg ? { org: asOrg } : {}),
       ...(foundationDir ? { foundationDir } : {}),
       resolveModel: makeModelResolver({
         client,
@@ -602,7 +609,6 @@ export async function push(args = [], deps = {}) {
     client,
     siteDir,
     pkg,
-    asOrg,
     report: {
       info,
       note,