uniweb 0.64.1 → 0.66.0

package/src/backend/workspace.js

@@ -0,0 +1,199 @@
+/**
+ * THE WORKSPACE A COMMAND WORKS IN — one at a time, chosen with the login.
+ *
+ * ⭐ **[Diego, 2026-09-23]** — *"when a user has workspace in the backend, I expected them
+ * to explicitly login into one"*, and a site the backend keeps in ANOTHER workspace is
+ * refused rather than worked on anyway: *"that's the intent of the workspace concept."*
+ * The app keeps one workspace per tab; the CLI keeps one per login, and every site
+ * request names it (`x-uniweb-workspace`, `client.js`). A site outside it answers `409
+ * wrong_workspace`, and the command stops, saying how to switch — nothing is adopted.
+ *
+ * Where a command's workspace comes from — the first answer wins:
+ *
+ *   1. `--org @acme` / `--personal`     this command only
+ *   2. `UNIWEB_WORKSPACE=@acme|personal` a process logged in with `UNIWEB_TOKEN`, which has
+ *                                        no `uniweb login` to choose one (a template
+ *                                        installer, an agent driving several backends)
+ *   3. the one chosen at `uniweb login`  the session's
+ *   4. none chosen                       your personal workspace when you belong to no
+ *                                        organization; otherwise refused, naming 1–3
+ *
+ * New sites are created in it: a create names the workspace, and the workspace is the
+ * site's owner.
+ *
+ * ⛔ **The personal workspace is named by naming NONE.** `@<your handle>` is your personal
+ * SCOPE — a registry namespace for foundations and data schemas — not a workspace.
+ */
+
+import { readOrgFlag } from '../utils/args.js'
+import { fetchOrgs } from '../utils/registry-orgs.js'
+import { readRegistryAuth } from '../utils/registry-auth.js'
+import { workspaceHandle, describeWorkspace } from './client.js'
+
+export { describeWorkspace }
+
+/** The personal workspace, as a login stores the choice (a handle is stored with its `@`). */
+export const PERSONAL = 'personal'
+
+/** Names a process's workspace when it is logged in with `UNIWEB_TOKEN`. */
+export const WORKSPACE_ENV = 'UNIWEB_WORKSPACE'
+
+/**
+ * A workspace choice as it may be written — `@acme`, `acme`, `personal` — or null when
+ * the value names none.
+ *
+ * @param {unknown} value
+ * @returns {string|null} `@acme`, `PERSONAL`, or null
+ */
+export function parseWorkspaceChoice(value) {
+  if (typeof value !== 'string' || !value.trim()) return null
+  const v = value.trim()
+  return v === PERSONAL ? PERSONAL : workspaceHandle(v)
+}
+
+/** A choice in the header's form: `@acme`, or null for the personal workspace. */
+export function headerOf(choice) {
+  return choice === PERSONAL ? null : choice
+}
+
+/** What a source is called in a sentence — "(… )" after the workspace. */
+export const SOURCE_LABEL = {
+  flag: 'named on this command',
+  env: WORKSPACE_ENV,
+  login: 'your login',
+  personal: 'you belong to no organization',
+  offline: 'not resolved in a preview'
+}
+
+const CHOOSE = [
+  'Choose the workspace you work in:',
+  '    uniweb login --org @acme      (or --personal) — for every command after',
+  '    --org @acme / --personal      — for this command only',
+  `    ${WORKSPACE_ENV}=@acme        — for a process logged in with UNIWEB_TOKEN`
+].join('\n')
+
+/**
+ * The workspace this command works in.
+ *
+ * @param {object} p
+ * @param {import('./client.js').BackendClient} p.client - its origin and token
+ * @param {string[]} [p.args]
+ * @param {boolean} [p.offline=false] - a preview (`--dry-run`, `-o`): never authenticates,
+ *   so step 4 answers "not resolved" instead of asking the backend
+ * @returns {Promise<{ workspace: string|null, source: string } | { refused: true, reason: string }>}
+ *   `workspace` in the header's form — `@acme`, or null for the personal workspace
+ */
+export async function resolveWorkspace({ client, args = [], offline = false }) {
+  const flag = readOrgFlag(args)
+  if (flag) return { workspace: workspaceHandle(flag), source: 'flag' }
+  if (args.includes('--personal')) return { workspace: null, source: 'flag' }
+
+  const raw = process.env[WORKSPACE_ENV]
+  if (raw !== undefined && raw !== '') {
+    const env = parseWorkspaceChoice(raw)
+    if (!env) {
+      return {
+        refused: true,
+        reason: `${WORKSPACE_ENV}=${JSON.stringify(raw)} names no workspace — give @org, or ${PERSONAL}.`
+      }
+    }
+    return { workspace: headerOf(env), source: 'env' }
+  }
+
+  // ⛔ A process logged in with UNIWEB_TOKEN is not the session's login: the token may be
+  // another account's, so the session's workspace is not its to use.
+  const useSession = !process.env.UNIWEB_TOKEN
+  const fromSession = async () =>
+    useSession ? parseWorkspaceChoice((await readRegistryAuth(client.origin))?.workspace) : null
+
+  const chosen = await fromSession()
+  if (chosen) return { workspace: headerOf(chosen), source: 'login' }
+  if (offline) return { workspace: null, source: 'offline' }
+
+  // Authenticate — a login this triggers chooses a workspace, so ask the session again.
+  await client.token()
+  const now = await fromSession()
+  if (now) return { workspace: headerOf(now), source: 'login' }
+
+  const { orgs } = await client.fetchOrgs()
+  if (!orgs.length) return { workspace: null, source: 'personal' }
+  return {
+    refused: true,
+    reason: `You belong to organizations, so no workspace is assumed.\n  ${CHOOSE}`
+  }
+}
+
+/**
+ * The workspace a login works in — asked once, at `uniweb login`, and stored with the
+ * session.
+ *
+ *   `--org @acme`            must be an organization you belong to
+ *   `--personal`             your personal workspace
+ *   neither, no organization your personal workspace — said, not asked
+ *   neither, organizations   a pick at a terminal; refused without one
+ *
+ * @param {object} p
+ * @param {string} p.apiBase
+ * @param {string} p.token
+ * @param {string[]} [p.args]
+ * @returns {Promise<{ choice: string, note?: string } | { refused: true, reason: string }>}
+ *   `choice` is `@acme` or `PERSONAL`
+ */
+export async function chooseWorkspace({ apiBase, token, args = [] }) {
+  const flag = readOrgFlag(args)
+  if (!flag && args.includes('--personal')) return { choice: PERSONAL }
+
+  const { orgs } = await fetchOrgs({ apiBase, token })
+  const mine = orgs.map((o) => `@${o.handle}`)
+  if (flag) {
+    const h = workspaceHandle(flag)
+    if (!mine.includes(h)) {
+      return {
+        refused: true,
+        reason:
+          `You are not a member of ${h} on ${apiBase}. ` +
+          (mine.length
+            ? `Your workspaces: ${[...mine, `--personal`].join(', ')}.`
+            : 'You belong to no organization — use --personal.')
+      }
+    }
+    return { choice: h }
+  }
+  if (!orgs.length) {
+    return {
+      choice: PERSONAL,
+      note: 'You belong to no organization, so you work in your personal workspace.'
+    }
+  }
+
+  const { isNonInteractive } = await import('../utils/interactive.js')
+  if (isNonInteractive(args)) {
+    return {
+      refused: true,
+      reason: `You belong to organizations — name the workspace you work in: ${[...mine, '--personal'].map((w) => (w.startsWith('@') ? `--org ${w}` : w)).join(' | ')}.`
+    }
+  }
+  const prompts = (await import('prompts')).default
+  const { choice } = await prompts(
+    {
+      type: 'select',
+      name: 'choice',
+      message: 'Which workspace do you work in?',
+      choices: [
+        { title: 'Personal — your own sites', value: PERSONAL },
+        ...orgs.map((o) => ({
+          title: `@${o.handle}${o.is_primary ? ' (primary)' : ''}`,
+          value: `@${o.handle}`
+        }))
+      ],
+      initial: 0
+    },
+    {
+      onCancel: () => {
+        console.error('\nCancelled.')
+        process.exit(0)
+      }
+    }
+  )
+  return choice ? { choice } : { refused: true, reason: 'No workspace chosen.' }
+}

package/src/commands/clone.js

@@ -39,10 +39,9 @@
  *   uniweb clone <uuid> --path sites     Place under sites/ (segregated layout)
  *   uniweb clone <uuid> --project docs   Co-located docs/site
  *   uniweb clone <uuid> --no-records Pull pages only; skip records
- *   uniweb clone <uuid> --org @org       Read it as @org — stops if the backend works on
- *                                        the site from another workspace. Without it,
- *                                        the one the backend names is recorded in
- *                                        sync.json for every command after.
+ *   uniweb clone <uuid> --org @org       Work in @org for this clone, instead of the
+ *                                        workspace chosen at `uniweb login`. A site in
+ *                                        another workspace stops it.
  *
  * Backend: via BackendClient (the site-content pull lane). Origin from
  *   UNIWEB_REGISTER_URL  >  the local default (internal dev overrides;
@@ -59,13 +58,8 @@ import { resolvePlacement, SITE_KIND } from '../utils/placement.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
 import { addWorkspaceGlob } from '../utils/config.js'
 import { detectWorkspacePm, installCmd } from '../utils/pm.js'
-import {
-  BackendClient,
-  describeRequestError,
-  refusalDetail,
-  workspaceHandle
-} from '../backend/client.js'
-import { readOrgFlag } from '../utils/args.js'
+import { BackendClient, describeRequestError, refusalDetail } from '../backend/client.js'
+import { resolveWorkspace } from '../backend/workspace.js'
 import { isNonInteractive, getCliPrefix } from '../utils/interactive.js'
 import { extractFoundationRef } from '../utils/site-content-refs.js'
 import { readUwxDocuments } from '../utils/uwx-read.js'
@@ -108,7 +102,7 @@ function slugify(s) {
 // than imported because pull.js statically imports @uniweb/build).
 export function extractDocument(payload) {
   if (!payload || typeof payload !== 'object') return null
-  if (payload.$model || payload.$id || payload.info) return payload
+  if (payload.$schema || payload.$uuid || payload.$id || payload.info) return payload
   return payload.document || payload.entity || null
 }
 
@@ -153,7 +147,7 @@ export function extractCloneSeeds(document) {
 // `site.yml`'s equivalent needed a hand-rolled dependency-free WRITER for exactly
 // this. The store stays the one writer everywhere else; this seeds a fresh file.
 // `test/clone.test.js` covers it end to end with `skipInstall: true`.
-function seedSyncJson(siteDir, origin, uuid, workspace = null) {
+function seedSyncJson(siteDir, origin, uuid) {
   const file = join(siteDir, 'sync.json')
   let doc = { version: 1, backends: {} }
   if (existsSync(file)) {
@@ -165,19 +159,11 @@ function seedSyncJson(siteDir, origin, uuid, workspace = null) {
     }
   }
   const key = new URL(origin).origin
-  // The workspace the read named — `--org`, or the one the backend answered with — so
-  // the delegated pull, and every command after it, names it from the first request.
-  // As the create records it: a handle bare in `org`, a handle-less unit's uuid in
-  // `unit` (site-sync.js::readSiteWorkspace).
-  const w = typeof workspace === 'string' && workspace ? workspace : null
-  const named = w
-    ? w.startsWith('@')
-      ? { org: w.slice(1) }
-      : { unit: w }
-    : {}
+  // ⛔ No workspace: a command works in the one chosen with the login, and the clone
+  // does not know which workspace OWNS the site — it may read it from a parent.
   doc.backends[key] = {
     ...(doc.backends[key] || {}),
-    site: { ...(doc.backends[key]?.site || {}), uuid, ...named }
+    site: { ...(doc.backends[key]?.site || {}), uuid }
   }
   mkdirSync(dirname(file), { recursive: true })
   writeFileSync(file, JSON.stringify(doc, null, 2) + '\n')
@@ -229,11 +215,15 @@ export async function clone(args = [], deps = {}) {
     args,
     command: 'Cloning'
   })
-  // The workspace the reads name: `--org` explicitly — a mismatch then stops the clone —
-  // else none, and the client adopts the one the backend works on the site from. There
-  // is no project yet to record it in; `seedSyncJson` does, below.
-  const orgFlag = readOrgFlag(args)
-  client.setWorkspace(orgFlag ? workspaceHandle(orgFlag) : null, { explicit: Boolean(orgFlag) })
+  // The workspace this clone works in — the login's, unless this command names another
+  // (`workspace.js`). A site the backend keeps elsewhere stops it, naming how to switch.
+  const ws = await resolveWorkspace({ client, args })
+  if (ws.refused) {
+    error('This clone works in one workspace, and none is chosen.')
+    note(ws.reason)
+    return { exitCode: 2 }
+  }
+  client.setWorkspace(ws.workspace, { source: ws.source })
 
   // 1. GET the site-content document.
   //
@@ -385,7 +375,7 @@ export async function clone(args = [], deps = {}) {
   // the old `$backend`: the uuid came from whoever we read and nothing on disk said
   // so, and a teammate who pulled while logged in elsewhere sent it to the wrong
   // backend. Stored under the origin, that cannot be expressed.
-  seedSyncJson(siteDir, client.origin, siteUuid, client.workspace)
+  seedSyncJson(siteDir, client.origin, siteUuid)
   success(
     `Scaffolded the site harness${foundationRef ? ` (foundation: ${foundationRef})` : ''}.`
   )

package/src/commands/deploy.js

@@ -93,10 +93,6 @@ export async function deploy(args = []) {
   const dryRun = args.includes('--dry-run')
   const siteDir = await resolveSiteDir(args)
 
-  // Advisory only — warns and ships. See utils/conformance.js for why this
-  // is not a gate.
-  await warnIfContentDoesNotConform(siteDir, { args, warn: say.warn, dim: say.dim })
-
   // Host dispatch. Resolution order:
   //   1. --target <name> picks a target from deploy.yml
   //   2. deploy.yml's `default:` target when no flag is given
@@ -184,6 +180,13 @@ export async function deploy(args = []) {
     }
   }
 
+  // A static host: advisory — warns and ships (utils/conformance.js). Uniweb Cloud is
+  // `publish`, below, which refuses content that does not conform: there the backend
+  // enforces the schemas, so the check is a gate, not advice (2026-09-24).
+  if (plan.kind !== 'uniweb') {
+    await warnIfContentDoesNotConform(siteDir, { args, warn: say.warn, dim: say.dim })
+  }
+
   // Uniweb Cloud is `publish`'s flow — delegate so deploy.yml stays one
   // actionable record and there's a single implementation of go-live.
   if (plan.kind === 'uniweb') {
@@ -224,9 +227,8 @@ export async function deploy(args = []) {
     // publish ignores deploy's --host/--target; --dry-run/--no-save pass straight
     // through.
     const { publish } = await import('./publish.js')
-    // Conformance was already reported above, and publish runs the same check
-    // — without this the user reads one warning twice and learns to skim it.
-    const result = await publish([...args, '--no-validate'])
+    // publish runs the conformance gate itself; deploy checked nothing for this host.
+    const result = await publish(args)
     process.exit(result?.exitCode ?? 0)
   }
 

package/src/commands/publish.js

@@ -29,15 +29,11 @@
  *   uniweb publish --dry-run       Resolve everything; POST nothing
  *   uniweb publish --yes           Skip confirmations (CI); never block on a prompt
  *   uniweb publish --force         Overwrite upstream app-side edits (drop the push gate)
- *   uniweb publish --org @org      Publish under @org. On the FIRST publish of a
- *                                  site it decides which org owns the site and whose
- *                                  storage its assets are charged to; recorded in
- *                                  `sync.json`, and every request after names it, so
- *                                  it never has to be re-typed. Later, it must match
- *                                  the workspace the backend works on the site from,
- *                                  or publish stops.
- *   uniweb publish --personal      Own the new site personally, deliberately: its
- *                                  requests name no workspace.
+ *   uniweb publish --org @org      Work in @org for this publish, instead of the
+ *   uniweb publish --personal      workspace chosen at `uniweb login` (or your
+ *                                  personal workspace). A site it creates is created
+ *                                  — owned — there; a site in another workspace stops
+ *                                  it.
  *   uniweb publish --no-save       Do not record this publish in deploy.yml
  */
 
@@ -72,8 +68,8 @@ import {
 } from '../backend/client.js'
 import { DEFAULT_BACKEND_ORIGIN } from '../utils/config.js'
 import { resolveSiteDir } from './deploy.js'
-import { warnIfContentDoesNotConform } from '../utils/conformance.js'
-import { readFlagValue, readOrgFlag } from '../utils/args.js'
+import { refuseIfContentDoesNotConform } from '../utils/conformance.js'
+import { readFlagValue } from '../utils/args.js'
 import { checkFlags } from '../utils/flag-guard.js'
 import {
   syncedElsewhere,
@@ -91,13 +87,12 @@ import {
   ensureItemUuids,
   readFolderItemUuids,
   ensureSiteExists,
+  refuseUnsendableRecords,
   clearRemoteSyncStateIfUnbound,
   dropSiteBoundValues,
-  pushSyncPackages,
-  resolveSiteOrgForCreate,
-  nameSiteWorkspace,
-  EXPLICIT_OWNER
+  pushSyncPackages
 } from '../backend/site-sync.js'
+import { resolveWorkspace, describeWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import {
   updateBackendMap,
@@ -261,9 +256,11 @@ export async function publish(args = []) {
 
   const siteDir = await resolveSiteDir(args, 'publish')
 
-  // Advisory only — warns and ships. See utils/conformance.js for why this
-  // is not a gate.
-  await warnIfContentDoesNotConform(siteDir, { args })
+  // ⭐ A GATE, before anything is sent — the backend checks these records against the
+  // schemas this publish registers. See utils/conformance.js.
+  if (await refuseIfContentDoesNotConform(siteDir, { args, error: say.err, warn: say.warn, dim: say.dim })) {
+    return { exitCode: 1 }
+  }
   const siteYml = readSiteYml(join(siteDir, 'site.yml'))
   // ⭐ THE BACKEND YOU ARE LOGGED IN TO is where this goes *[Diego, 2026-09-21]*, for every
   // backend verb (resolveBackendOrigin). Only UNIWEB_REGISTER_URL — the automation
@@ -309,21 +306,13 @@ export async function publish(args = []) {
     }
   }
 
-  // WHO will own this site, if this publish is the one that creates it. Resolved
-  // up front: `ensureSiteExists` below is the create, and it must not be reached
-  // with the question still open. An already-created site resolves to null without
-  // asking — its ownership was settled once and cannot be changed from here.
-  const org = await resolveSiteOrgForCreate({
-    client,
-    siteDir,
-    args,
-    flag: readOrgFlag(args),
-    personal: args.includes('--personal'),
-    offline: dryRun
-  })
-  if (org.refused) {
-    say.err('Refusing to create this site without naming an owner.')
-    say.dim(org.reason)
+  // ⭐ THE WORKSPACE THIS PUBLISH WORKS IN — the one chosen with the login, unless this
+  // command names another (`workspace.js`). Resolved up front: `ensureSiteExists` below
+  // creates the site in it, and a site the backend keeps elsewhere is refused.
+  const ws = await resolveWorkspace({ client, args, offline: dryRun })
+  if (ws.refused) {
+    say.err('This publish works in one workspace, and none is chosen.')
+    say.dim(ws.reason)
     return { exitCode: 2 }
   }
 
@@ -513,16 +502,13 @@ export async function publish(args = []) {
   // be the silent-wrong-success this whole branch exists to prevent.
   if (!fnd.proceed) return { exitCode: fnd.refused ? 1 : 0 }
 
-  // ⭐ Name the workspace every site request works in — the create, the push, the
-  // publish and the data lane. The user's own choice is explicit, so a `409
-  // wrong_workspace` stops the publish; a recorded one is adopted afresh when stale
-  // (`nameSiteWorkspace`).
-  nameSiteWorkspace(client, {
-    siteDir,
-    workspace: org.workspace,
-    explicit: EXPLICIT_OWNER.has(org.source),
-    note: (m) => say.dim(m)
-  })
+  // ⭐ Every site request names the workspace — the create, the push, the publish and
+  // the data lane — and a site outside it stops the publish (`WorkspaceMismatchError`).
+  // A site this publish creates is created in it — said first.
+  client.setWorkspace(ws.workspace, { source: ws.source })
+  if (ws.source !== 'offline' && !readBackendState(siteDir, client.origin).site?.uuid) {
+    say.dim(`This publish creates the site in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source]}).`)
+  }
 
   // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
   //    dist/data/*, dist/assets/*. Spawn the SAME CLI binary so the inner
@@ -585,6 +571,11 @@ export async function publish(args = []) {
     say.err(`Could not build the sync package: ${err.message}`)
     return { exitCode: 1 }
   }
+  // A record the backend would refuse stops the publish HERE — before the site is
+  // created or a byte uploaded, not merely before the send (`refuseUnsendableRecords`).
+  if (refuseUnsendableRecords(probe.refusals, { error: say.err, note: say.dim })) {
+    return { exitCode: 1 }
+  }
   const schemalessNames = (probe.schemaless || []).map((col) => col.name)
   // A product decision the author is usually making unknowingly — say it at warn
   // level, not dim among everything else. See the helper for what the old
@@ -981,6 +972,9 @@ export async function publish(args = []) {
     return { exitCode: 1 }
   }
   for (const w of pkg.warnings) say.dim(`! ${w}`)
+  if (refuseUnsendableRecords(pkg.refusals, { error: say.err, note: say.dim })) {
+    return { exitCode: 1 }
+  }
   const report = {
     info: (m) => say.info(m),
     note: (m) => say.dim(m),