uniweb 0.64.1 → 0.66.0

package/src/utils/flag-guard.js

@@ -64,30 +64,33 @@ const VERBS = {
     // flag-guard-coverage.test.js the moment push gained the import, which is
     // exactly the hand-enumeration failure that test exists to catch.
     '--no-verify',
-    // ship content against the already-released code, releasing nothing
-    '--no-release', ...VIA_DEPLOY
+    // ship content against the already-released code, releasing nothing — or
+    // release above a newer registered version instead of stopping (both bring-along)
+    '--no-release', '--bump', ...VIA_DEPLOY
   ],
   publish: [
     '--org', '--dry-run', '--force', '--foundation',
     '--personal',
     // read in utils/conformance.js, backend/site-sync.js, and
     // backend/foundation-bring-along.js — none appear in publish.js
-    '--no-validate', '--yes', '--no-verify', '--no-release', ...VIA_DEPLOY
+    '--no-validate', '--yes', '--no-verify', '--no-release', '--bump', ...VIA_DEPLOY
   ],
   pull: [
     '--content-only', '--dry-run', '--force', '--merge',
     '--no-assets',
     '--no-records', '--no-delete', '--no-prune',
     // via backend/site-sync.js (the owner resolver) and utils/conformance.js
-    '--yes', '--org', '--no-validate', ...VIA_DEPLOY
+    '--yes', '--org', '--personal', '--no-validate', ...VIA_DEPLOY
   ],
   clone: [
     '--content-only', '--no-assets', '--no-records', '--path',
-    '--project', '--org'
+    '--project', '--org', '--personal'
   ],
   register: [
     '--dry-run', '--json', '--output', '-o',
-    '--schema-only', '--scope', '--org'
+    '--schema-only', '--scope', '--org',
+    // reach the login a register may trigger, which chooses the workspace it works in
+    '--personal'
   ],
   /**
    * `forget` = remove one backend's records (`--backend <url>`), or everything a
@@ -98,10 +101,10 @@ const VERBS = {
   forget: ['--backend', '--all'],
   status: [
     '--json', '--remote', '--dry-run',
-    '--force', '--no-verify', '--no-validate', '--yes', '--org',
+    '--force', '--no-verify', '--no-validate', '--yes', '--org', '--personal',
     // inert here, reachable through the bring-along module status imports for
     // `resolveLocalFoundation` — listed per the over-approximation note above
-    '--no-release', ...VIA_DEPLOY
+    '--no-release', '--bump', ...VIA_DEPLOY
   ],
   /**
    * `refresh` = `git pull`, then a DELEGATED `pull --merge`.
@@ -118,7 +121,7 @@ const VERBS = {
    */
   refresh: [
     '--no-backend', '--no-git',
-    '--org', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
+    '--org', '--personal', '--dry-run', '--no-validate', '--yes', ...VIA_DEPLOY
   ]
 }
 

package/src/utils/git.js

@@ -18,6 +18,7 @@
  */
 
 import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import { readFileSync, realpathSync } from 'node:fs'
 import { join, relative } from 'node:path'
 import yaml from 'js-yaml'
@@ -173,8 +174,25 @@ export function uncommittedUnder(dir, relPaths) {
  *   never committed has no ancestor, so there is nothing to merge against).
  */
 export function showAtHead(dir, relPath) {
+  return showAt(dir, 'HEAD', relPath)
+}
+
+/**
+ * A file's content at a revision, by a path relative to `dir`.
+ *
+ * ⛔ THE `./` IS WHAT MAKES THE PATH RELATIVE TO `dir`. In `<rev>:<path>` a bare path
+ * is read from the REPOSITORY ROOT, whatever the cwd. With the repo at the project
+ * root and the site in `site/` — the default layout — `HEAD:pages/home/hero.md`
+ * named nothing, every lookup failed, and `pull --merge` "kept yours" for every file:
+ * the backend's changes never merged in, while the pull recorded them as taken
+ * (2026-09-23). Every merge test ran with the repo AT the site directory, the one
+ * layout where a bare path happens to work.
+ *
+ * @returns {Buffer|null} null when the path isn't in that revision
+ */
+export function showAt(dir, rev, relPath) {
   try {
-    return execFileSync('git', ['show', `HEAD:${relPath}`], {
+    return execFileSync('git', ['show', `${rev}:./${relPath}`], {
       cwd: dir,
       stdio: ['ignore', 'pipe', 'ignore'],
       maxBuffer: 64 * 1024 * 1024
@@ -184,6 +202,35 @@ export function showAtHead(dir, relPath) {
   }
 }
 
+/**
+ * The most recent committed version of a file whose content hashes to `sha256` —
+ * how the version a pull wrote is found again, as the ancestor of a merge.
+ *
+ * HEAD is that version only until the user commits an edit on top of it. After that
+ * HEAD is THEIR edit, and a merge against it reads their change as the starting
+ * point: the backend's version wins whole and the committed edit is reverted in the
+ * working tree. The pull recorded the hash of what it wrote (`pull-written.json`),
+ * so the version is recoverable from history by content, wherever it was committed.
+ *
+ * @param {number} [limit] - how many commits touching the file to search
+ * @returns {Buffer|null} null when no committed version matches
+ */
+export function findCommitted(dir, relPath, sha256, { limit = 50 } = {}) {
+  let revs
+  try {
+    revs = git(['log', `-n${limit}`, '--format=%H', '--', `./${relPath}`], dir)
+      .split('\n')
+      .filter(Boolean)
+  } catch {
+    return null
+  }
+  for (const rev of revs) {
+    const buf = showAt(dir, rev, relPath)
+    if (buf && createHash('sha256').update(buf).digest('hex') === sha256) return buf
+  }
+  return null
+}
+
 /**
  * Three-way merge, in place: `minePath` is rewritten with the merged result.
  *

package/src/utils/pull-written.js

@@ -1,6 +1,11 @@
 /**
  * The record of what a machine wrote into a site project — pull's own output.
  *
+ * ⭐ And, since 2026-09-23, what a push delivered: the files of the units the backend
+ * now holds as they were sent (`recordPushedUnits`, site-sync.js). Both are "the last
+ * version this file synced at", which is what `pull --merge` needs as its ancestor —
+ * found again in the repo's history by this hash (`findCommitted`, utils/git.js).
+ *
  * ## What it is for
  *
  * `uniweb pull` refuses to run when there are uncommitted changes under the files

package/src/utils/registry-auth.js

@@ -49,6 +49,7 @@ import { createServer } from 'node:http'
 import { randomBytes } from 'node:crypto'
 
 import { DEFAULT_BACKEND_ORIGIN } from './config.js'
+import { readOrgFlag } from './args.js'
 import { normalizeSessionFile, sessionFilePath, loggedInOriginOf } from './session-file.js'
 
 const LOGIN_PATH = '/dev/auth/login'
@@ -641,6 +642,36 @@ async function loginViaBrowser({ apiBase }) {
   return record
 }
 
+/**
+ * Choose the WORKSPACE this login works in, and store it with the session.
+ *
+ * ⭐ A login works in one workspace *[Diego, 2026-09-23: "at login, it can be mandatory to
+ * specify which workspace"]* — `--org @acme` / `--personal`, else your personal workspace
+ * when you belong to no organization, else a pick at a terminal. Without one (no
+ * terminal, organizations, no flag) the login stays and this says how to choose; every
+ * command refuses until one is chosen (`backend/workspace.js`).
+ *
+ * @param {object} record - the session just stored (`token`, `origin`, …)
+ * @param {string[]} args
+ * @returns {Promise<{ record: object, refused?: string }>}
+ */
+async function settleWorkspace(record, args) {
+  const { chooseWorkspace } = await import('../backend/workspace.js')
+  const pick = await chooseWorkspace({ apiBase: record.origin, token: record.token, args })
+  if (pick.refused) return { record, refused: pick.reason }
+  if (pick.note) console.error(`\x1b[2m${pick.note}\x1b[0m`)
+  const next = { ...record, workspace: pick.choice }
+  await writeRegistryAuth(next)
+  return { record: next }
+}
+
+/** ` · working in @acme` — the tail of a login line. */
+async function workspaceTail(record) {
+  if (!record?.workspace) return ''
+  const { describeWorkspace } = await import('../backend/workspace.js')
+  return `, working in \x1b[1m${describeWorkspace(record.workspace)}\x1b[0m`
+}
+
 /**
  * `uniweb login` against the new backend — a multi-method picker:
  *   browser/social (default, once available) · username+password · paste a token.
@@ -675,19 +706,37 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       existing.handle ||
       (existing.uuid ? `account ${existing.uuid}` : '')
     if (!forced) {
-      // Already logged in to this backend: nothing to do — logging in again is behind a
-      // method flag. (Also where a file from before sessions were single, holding this
-      // backend among others, becomes single: the rewrite keeps only this session.)
+      // Already logged in to this backend: nothing to re-authenticate — logging in again is
+      // behind a method flag. (Also where a file from before sessions were single, holding
+      // this backend among others, becomes single: the rewrite keeps only this session.)
+      let session = { ...existing, origin: key }
       if (current !== key || Object.keys(file.sessions).length > 1) {
-        await writeRegistryAuth({ ...existing, origin: key })
+        await writeRegistryAuth(session)
+      }
+      // ⭐ SWITCHING WORKSPACE NEEDS NO NEW LOGIN: `--org @x` / `--personal` on a valid
+      // session just changes the workspace it works in. One with none chosen yet (a
+      // session from before workspaces) is asked now.
+      const wants = readOrgFlag(args) || args.includes('--personal')
+      if (wants || !session.workspace) {
+        const settled = await settleWorkspace(session, args)
+        if (settled.refused) {
+          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`)
+          console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+          process.exit(2)
+        }
+        session = settled.record
+        if (wants) {
+          console.error(`\x1b[32m✓\x1b[0m Now working in ${(await workspaceTail(session)).replace(/^, working in /, '')} (${key}).`)
+          return session
+        }
       }
       console.error(
-        `\x1b[32m✓\x1b[0m Already logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`
+        `\x1b[32m✓\x1b[0m Already logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${await workspaceTail(session)}.`
       )
       console.error(
-        '\x1b[2mTo log in again, name a method: --password, --browser, --token-paste or --token <bearer>.\x1b[0m'
+        '\x1b[2mSwitch workspace: --org @acme or --personal. To log in again, name a method: --password, --browser, --token-paste or --token <bearer>.\x1b[0m'
       )
-      return { ...existing, origin: key }
+      return session
     }
     console.error(
       `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''} (${key}) — logging in again replaces that session.\n`
@@ -720,10 +769,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     if (account?.username) record.username = account.username
     if (account?.handle) record.handle = account.handle
     await writeRegistryAuth(record)
-    console.error(
-      `\x1b[32m✓\x1b[0m Logged in${account?.username ? ` as \x1b[1m${account.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
-    )
-    return record
+    return finishLogin(record, apiBase, args)
   }
 
   let method = args.includes('--browser')
@@ -787,10 +833,23 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     process.exit(1)
   }
 
-  if (record?.token) {
-    console.error(
-      `\x1b[32m✓\x1b[0m Logged in${record.username ? ` as \x1b[1m${record.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
-    )
+  if (!record?.token) return record
+  return finishLogin({ ...record, origin: record.origin || normOrigin(apiBase) }, apiBase, args)
+}
+
+/**
+ * A login succeeded and its session is stored: choose its workspace, and say where the
+ * login works. Without a workspace (no terminal, organizations, no flag) the session
+ * stays, the reason is printed, and the login exits 2 — every command would refuse.
+ */
+async function finishLogin(record, apiBase, args) {
+  const settled = await settleWorkspace(record, args)
+  const who = settled.record.username ? ` as \x1b[1m${settled.record.username}\x1b[0m` : ''
+  if (settled.refused) {
+    console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase}).`)
+    console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+    process.exit(2)
   }
-  return record
+  console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase})${await workspaceTail(settled.record)}.`)
+  return settled.record
 }

package/src/utils/registry-orgs.js

@@ -99,8 +99,8 @@ export function validateHandle(handle) {
  * personal org already exists.
  * @returns {Promise<{account_handle: string|null, orgs: Array<{handle: string, is_primary: boolean}>}>}
  */
-export async function fetchOrgs({ apiBase, token }) {
-  const res = await fetch(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
+export async function fetchOrgs({ apiBase, token, fetchImpl = globalThis.fetch }) {
+  const res = await fetchImpl(`${apiBase.replace(/\/$/, '')}${ORGS_PATH}`, {
     headers: { Authorization: `Bearer ${token}` }
   })
   if (!res.ok)

package/src/utils/semver-precedence.js

@@ -24,6 +24,29 @@ export function parseSemver(version) {
   return { major: +m[1], minor: +m[2], patch: +m[3], pre: m[4] ? m[4].split('.') : [] }
 }
 
+/**
+ * The next version above `version` on its own line — what `--bump` releases under
+ * when the registry already holds the local version with other code.
+ *
+ * A release gets its next patch (`1.4.2` → `1.4.3`); a pre-release its next
+ * pre-release (`2.0.0-beta.3` → `2.0.0-beta.4`, `1.0.0-rc` → `1.0.0-rc.0`), so a bump
+ * nobody chose never promotes a beta line to a release. Build metadata is dropped: it
+ * carries no order, so it could not make a version newer.
+ *
+ * @param {string} version
+ * @returns {string|null} null when `version` is not SemVer
+ */
+export function nextVersionAbove(version) {
+  const v = parseSemver(version)
+  if (!v) return null
+  if (!v.pre.length) return `${v.major}.${v.minor}.${v.patch + 1}`
+  const pre = [...v.pre]
+  const last = pre.length - 1
+  if (/^\d+$/.test(pre[last])) pre[last] = String(BigInt(pre[last]) + 1n)
+  else pre.push('0')
+  return `${v.major}.${v.minor}.${v.patch}-${pre.join('.')}`
+}
+
 /**
  * @param {string} a
  * @param {string} b