uniweb 0.82.2 → 0.84.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.82.2",
+  "version": "0.84.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,15 +42,15 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/content-writer": "^0.3.4",
-    "@uniweb/core": "^0.37.1",
-    "@uniweb/schemas": "^0.12.0",
-    "@uniweb/runtime": "^0.29.1",
-    "@uniweb/kit": "^0.19.17",
-    "@uniweb/semantic-parser": "^1.5.1"
+    "@uniweb/kit": "^0.19.18",
+    "@uniweb/core": "^0.37.2",
+    "@uniweb/semantic-parser": "^1.5.1",
+    "@uniweb/runtime": "^0.29.2",
+    "@uniweb/schemas": "^0.12.0"
   },
   "peerDependencies": {
+    "@uniweb/build": "^0.77.0",
     "@uniweb/content-reader": "^1.2.8",
-    "@uniweb/build": "^0.76.1",
     "@uniweb/semantic-parser": "^1.5.1"
   },
   "peerDependenciesMeta": {

package/partials/agents.md

@@ -2012,16 +2012,16 @@ A form gets its destination from the first of these that applies:
 
 1. **One the host supplies** — `services.submit` in the served payload. Where the
    host handles submissions, that is the destination and nothing in `site.yml`
-   overrides it — so a site published to Uniweb Cloud normally needs **no
-   `submit:` at all**.
+   overrides it — so a site published to Uniweb Cloud needs **no `submit:`**: it
+   asks for form handling with `services:` instead (*Uniweb Cloud*, below).
 2. **`submit:` in `site.yml`** — an endpoint you name yourself, for a host that
    does not handle submissions, or a static site.
-3. **Neither** — there is no destination, and the form says so instead of
-   guessing at one.
+3. **Neither** — there is no destination: render no form, or fall back to contact
+   details the site already carries.
 
-That is the general arrangement, not a forms-only one. A host declares
-everything it offers under `services`, keyed by name, and every service resolves
-by the same rule — the host's offer, then your declaration, then neither.
+That is the general arrangement, not a forms-only one. A host states everything
+it offers in the served payload's `services`, keyed by name, and every service
+resolves by the same rule — the host's offer, then your declaration, then neither.
 
 ⭐ **Before you render UI for a service, ask whether the site has it** — one predicate per service,
 no arguments: `isSearchEnabled()`, `isSubmitEnabled()`, `isApiEnabled()`, `isAssistantEnabled()`,
@@ -2138,9 +2138,9 @@ if (!canSubmit) return null    // nowhere to send — render no form, or fall ba
 ```
 
 > **The framework never invents an endpoint — but a host may supply one.** Don't
-> reach for `submit:` reflexively: on Uniweb Cloud it is redundant, and setting
-> it there overrides what the platform provides. Reach for it when you are the
-> one hosting.
+> reach for `submit:` reflexively: on Uniweb Cloud the host's form handling wins
+> wherever it is on, so a `submit:` there answers only when it is off — ask for it
+> with `services:` instead. Reach for `submit:` when you are the one hosting.
 >
 > `canSubmit` is false only when neither a declaration nor a host supplies a
 > destination. **Check it when you render, not only on the button press** — a
@@ -2635,9 +2635,12 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 > uniweb push --org @acme       # this command only
 > ```
 >
-> Already logged in, `uniweb login --org @other` switches without logging in again. **Without a
-> terminal — you, an agent — a login with organizations refuses until one is named**, and so
-> does a command when none was. A process logged in with `UNIWEB_TOKEN` names its workspace with
+> Already logged in, `uniweb login --org @other` (or `--personal`) switches the workspace on the
+> backend you are logged in to, without logging in again. **Without a
+> terminal — you, an agent — a login with organizations and no workspace named signs you in but
+> exits 2**: `uniweb login --org @acme` (or `--personal`) finishes it without signing in again.
+> Until then every command that works on a site refuses, and so does registering a foundation whose
+> name has no scope. A process logged in with `UNIWEB_TOKEN` names its workspace with
 > `UNIWEB_WORKSPACE=@acme` (or `personal`). **Ask the human which workspace to use** rather than
 > picking for them — a site created in the wrong one cannot be moved from here.
 >
@@ -2654,6 +2657,24 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. Commit it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --backend <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --backend <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--backend` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
 
+**`services:` in `site.yml` asks your host for services** — site search, form handling, accounts:
+
+```yaml
+services:
+  search: true       # turn it on
+  submit: false      # turn it off
+  api:               # turn it on, with the service's own settings
+    grade: pro
+```
+
+A service you leave out keeps whatever the site has, and settings you leave out keep theirs — to turn
+one off, say `false`. `uniweb push` and `uniweb publish` send what you changed since your last sync;
+if the site's services changed elsewhere in the meantime — an author in the app — they offer to update
+`site.yml` rather than send your older choice over it, and if both changed the same service they ask
+which to keep. `uniweb pull` writes what the site has into `services:`. A change that needs payment is
+settled in the app: `publish` opens it. ⛔ **Not the same as `search:` / `submit:`**, which configure a
+provider the site brings itself — and `services:` never reaches the built site.
+
 **The Cloud also provides a real backend for structured data:** a database for every registered data schema, and a CMS that edits both static page content and dynamic data entities typed by those schemas. That's the piece that makes it viable for teams and client work — the client manages records, not markdown files.
 
 Either side can publish. Nothing about this changes how you build: the same foundation and the same site run under `uniweb dev`, `uniweb export`, or a CI deploy with no account at all.
@@ -2696,7 +2717,7 @@ Platform-specific configuration that doesn't belong in npm-standard fields. All
 |---|---|---|---|
 | `runtimePolicy` | `dist/runtime-pin.json` | unset | Declares how far past the recorded runtime version a host may move a site. |
 
-**The foundation's name is not here — it is `name` in `main.js`** (else `package.json`'s `name`), **and so is the scope it registers under: the scope is part of the name**, `name: '@acme/marketing'`. A scope is a namespace — your personal one, `@<your handle>`, which needs no org, or an org's. A name with no scope has not been registered yet: the first `uniweb register` takes `--scope`, else your personal scope (asking only if you belong to orgs), and writes it into the name; a `--scope` naming another scope than the name's is refused. The foundation's own data schemas register under the same scope (`@/article` → `@acme/article`). ⛔ `uniweb.id` and `uniweb.scope` are no longer read for a foundation: `uniweb register` refuses them and prints the `main.js` line to write instead. (A schemas-only package has no `main.js`, and still records its scope in `uniweb.scope`.)
+**The foundation's name is not here — it is `name` in `main.js`** (else `package.json`'s `name`), **and so is the scope it registers under: the scope is part of the name**, `name: '@acme/marketing'`. A scope is a namespace — your personal one, `@<your handle>`, which needs no org, or an org's. A name with no scope has not been registered yet: the first `uniweb register` takes `--scope`, else the workspace you work in — an org's scope, or your personal one; when you belong to orgs and chose no workspace, it asks at a terminal and refuses without one — and writes it into the name; a `--scope` naming another scope than the name's is refused. The foundation's own data schemas register under the same scope (`@/article` → `@acme/article`). ⛔ `uniweb.id` and `uniweb.scope` are no longer read for a foundation: `uniweb register` refuses them and prints the `main.js` line to write instead. (A schemas-only package has no `main.js`, and still records its scope in `uniweb.scope`.)
 
 **Runtime updates — handled for you.** Your foundation's code links against the runtime: it externalizes `react`, `react-dom`, `react-dom/server`, both JSX runtimes and `@uniweb/core`, and the runtime supplies all of them at load time. So a build is bound to *that* React and *that* core API.
 

package/src/backend/client.js

@@ -29,7 +29,7 @@
  * single home.
  */
 
-import { getRegistryApiBaseUrl } from '../utils/config.js'
+import { getRegistryApiBaseUrl, loginCommand } from '../utils/config.js'
 import {
   ensureRegistryAuth,
   fetchMe,
@@ -191,11 +191,12 @@ export function workspaceHeader(value) {
  */
 export class WorkspaceMismatchError extends Error {
   /**
-   * @param {{ named: string|null, answer: string|null, source?: string }} p - the
-   *   workspace the request named and the one the backend named (`@handle`, a unit's
-   *   uuid, null for personal), and where the named one came from (`workspace.js`)
+   * @param {{ named: string|null, answer: string|null, source?: string, origin?: string|null }} p -
+   *   the workspace the request named and the one the backend named (`@handle`, a unit's
+   *   uuid, null for personal), where the named one came from (`workspace.js`), and the
+   *   backend — a login that switches must name it unless it is the default (`loginCommand`)
    */
-  constructor({ named, answer, source = 'login' }) {
+  constructor({ named, answer, source = 'login', origin = null }) {
     const where = (w) =>
       !w ? 'your personal workspace' : w.startsWith('@') ? w : `the unit ${w}`
     // How to work in the site's workspace, said for the way this one was chosen.
@@ -204,7 +205,11 @@ export class WorkspaceMismatchError extends Error {
       : answer.startsWith('@')
         ? { flag: `pass --org ${answer}`, env: `set UNIWEB_WORKSPACE=${answer}` }
         : null
-    const login = !answer ? 'uniweb login --personal' : answer.startsWith('@') ? `uniweb login --org ${answer}` : null
+    const login = !answer
+      ? `${loginCommand(origin)} --personal`
+      : answer.startsWith('@')
+        ? `${loginCommand(origin)} --org ${answer}`
+        : null
     const fix = !switchTo
       ? 'It has no handle, so the CLI cannot work in it.'
       : source === 'flag'
@@ -332,12 +337,16 @@ export class BackendClient {
       return this._token
     }
     // ⛔ NO ORIGIN-MISMATCH GUARD HERE, AND DO NOT RE-ADD ONE (removed 2026-09-20).
-    // It existed because the session store held ONE record: a session for another
-    // backend was the only session, so it was about to be sent here and rejected, and a
-    // warning was the best available move. Sessions are keyed by origin now
-    // (utils/registry-auth.js), so being logged into another backend is just a fact
-    // about another backend — `ensureRegistryAuth` below finds this origin's session or
-    // asks for one. Warning about the other would be noise about nothing.
+    // It existed because the session store held ONE record, read without an origin: a
+    // session for another backend was about to be sent here and rejected, and a warning
+    // was the best available move. The session is looked up BY ORIGIN now
+    // (`readRegistryAuth(origin)`, utils/registry-auth.js), so another backend's token is
+    // never sent here — `ensureRegistryAuth` below finds this origin's session or asks
+    // for one. ⚠️ There is still ONE session (since 2026-09-21): a login it asks for
+    // replaces the other backend's session, and says so. *(Until 2026-10-05 this read
+    // "sessions are keyed by origin now … being logged into another backend is just a
+    // fact about another backend" — true of the per-backend store of 2026-09-20→21, and
+    // read as "several sessions coexist".)*
     this._token = await ensureRegistryAuth({
       apiBase: this.origin,
       command: this._command,
@@ -388,7 +397,8 @@ export class BackendClient {
     throw new WorkspaceMismatchError({
       named: this._workspace,
       answer,
-      source: this._workspaceSource
+      source: this._workspaceSource,
+      origin: this.origin
     })
   }
 
@@ -809,6 +819,67 @@ export class BackendClient {
    * @param {string} uuid - the site-content uuid
    * @returns {Promise<object|null>}
    */
+  /**
+   * Whether the backend holds the site `uuid` names — `live`, `gone` or `unknown`, kept
+   * apart — for a script that must decide, before any push, whether a binding still
+   * points at a site (`uniweb status --remote --json`, `remote.site_state`).
+   *
+   * ⛔ `gone` ONLY ON THE BACKEND'S OWN WORD ABOUT THIS SITE: a `404` whose problem names
+   * it — `kind: "site"`, `key: <uuid>`. A push from an unbound copy CREATES a site, so a
+   * binding dropped because its site was merely unreadable leaves a second copy beside
+   * the first. Folding `unknown` into `gone` would be worse than no answer.
+   *
+   *   live     the site's status came back, or the site was refused as belonging to
+   *            another workspace (`409 wrong_workspace` names where it is: it exists)
+   *   gone     a `404` naming this site
+   *   unknown  anything else — no answer, a credential or an id refused, a `404` that
+   *            names something else (a backend too old for the route)
+   *
+   * *Measured 2026-10-06 against a local backend — its wire, its to change:* `200` with
+   * the status; `409 wrong_workspace` naming the site's workspace; `404 {kind: "site",
+   * key}`; `400` for a malformed id; `401` for a bad bearer.
+   *
+   * @param {string} uuid
+   * @returns {Promise<{ state: 'live'|'gone'|'unknown', status: number|null, site?: object, workspace?: string|null, detail?: string|null }>}
+   */
+  async siteState(uuid) {
+    let res
+    try {
+      res = await this.request(`/dev/site/status/${encodeURIComponent(uuid)}`)
+    } catch (err) {
+      if (err instanceof WorkspaceMismatchError) {
+        return { state: 'live', status: 409, workspace: err.answer, detail: err.message }
+      }
+      return { state: 'unknown', status: null, detail: err?.message || String(err) }
+    }
+    const body = await res.text().catch(() => '')
+    let parsed = null
+    try {
+      parsed = body ? JSON.parse(body) : null
+    } catch {
+      parsed = null
+    }
+    if (res.ok) return { state: 'live', status: res.status, ...(parsed ? { site: parsed } : {}) }
+    if (res.status === 409 && parsed?.reason === 'wrong_workspace') {
+      const w = parsed.workspace || {}
+      return {
+        state: 'live',
+        status: 409,
+        workspace: w.handle ? workspaceHandle(w.handle) : w.unit_uuid || null,
+        detail: parsed.detail || null
+      }
+    }
+    const names = (v) => String(v ?? '').toLowerCase() === String(uuid).toLowerCase()
+    if (res.status === 404 && parsed?.kind === 'site' && names(parsed.key)) {
+      return { state: 'gone', status: 404, detail: parsed.detail || null }
+    }
+    return {
+      state: 'unknown',
+      status: res.status,
+      detail: parsed?.detail || parsed?.title || (body ? body.slice(0, 200) : null)
+    }
+  }
+
   async siteStatus(uuid) {
     try {
       const res = await this.request(

package/src/backend/foundation-bring-along.js

@@ -63,6 +63,8 @@ import {
 } from '@uniweb/build'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { isNonInteractive } from '../utils/interactive.js'
+import { readOrgFlag } from '../utils/args.js'
+import { belongsToScope } from '../utils/registry-orgs.js'
 import { writeJsonPreservingStyle } from '../utils/json-file.js'
 import {
   compareSemverPrecedence,
@@ -191,13 +193,22 @@ function writePkgVersion(dir, version) {
   writeJsonPreservingStyle(path, { ...JSON.parse(src), version }, src)
 }
 
-// What travels to the spawned `uniweb register` / `build` on the command line: only
-// --non-interactive. The BACKEND travels in the child's environment
-// (releaseFoundation), and the SESSION is the shared session file — or UNIWEB_TOKEN,
-// which the child inherits. The backend commands take no `--backend` or `--token`.
-function forwardedFlags(args) {
+// What travels to the spawned `uniweb register` on the command line: --non-interactive,
+// and the WORKSPACE this command names (`--org` / `--personal`). The BACKEND travels in
+// the child's environment (releaseFoundation), and the SESSION is the shared session
+// file — or UNIWEB_TOKEN, which the child inherits. The backend commands take no
+// `--backend` or `--token`.
+//
+// ⭐ The workspace travels because a bare name registers under the workspace the command
+// works in *[Diego, 2026-10-06]*, and a workspace named on this command is this command's
+// alone: the child cannot read it from the session. One chosen at the login, or in
+// UNIWEB_WORKSPACE, reaches the child on its own.
+export function forwardedFlags(args) {
   const out = []
   if (isNonInteractive(args)) out.push('--non-interactive')
+  const org = readOrgFlag(args)
+  if (org) out.push('--org', org)
+  else if (args.includes('--personal')) out.push('--personal')
   return out
 }
 
@@ -280,9 +291,16 @@ async function bringLocalCodeAlong({
 }) {
   const Kind = kind === 'extension' ? 'Extension ' : 'Foundation'
   const scopedName = await foundationScopedName(local.dir)
+  // A name with no scope yet (it has never registered) is still a name: say it. ⛔ Until
+  // 2026-10-06 the label fell back to the KIND, and the line read "Releasing the foundation
+  // foundation@0.1.0".
+  const bareName = scopedName
+    ? null
+    : await readFoundationName(local.dir).then((r) => (r?.name && !checkFoundationName(r.name) ? r.name : null), () => null)
+  const shown = scopedName || bareName
   const label =
-    scopedName || local.version
-      ? `${scopedName || kind}${local.version ? `@${local.version}` : ''}`
+    shown || local.version
+      ? `${shown || kind}${local.version ? `@${local.version}` : ''}`
       : `the local ${kind}`
   const skipPrompts =
     args.includes('--yes') ||
@@ -361,6 +379,16 @@ async function bringLocalCodeAlong({
   // answer / no scoped name to look up) → release.
   const reg = scopedName ? await client.readFoundationLatest(scopedName) : null
 
+  // Every release below goes through here, so a refusal for a scope you are not a member
+  // of is said as that, with the ways on (`explainReleaseFailure`).
+  const release = async () => {
+    try {
+      return releaseFoundation(local, args, cliBin, say, client?.origin)
+    } catch (err) {
+      throw await explainReleaseFailure(err, { client, local, reg, verb })
+    }
+  }
+
   if (!reg) {
     // ⛔ Nothing to bind to. Releasing anyway would be the opposite of what was asked,
     // and shipping anyway would leave a site the app cannot open — so stop and say so.
@@ -376,7 +404,7 @@ async function bringLocalCodeAlong({
     }
     say.info(`Releasing the ${kind} ${label} (not yet registered)…`)
     return {
-      released: releaseFoundation(local, args, cliBin, say, client?.origin),
+      released: await release(),
       proceed: true,
       ref: await pinnedRef()
     }
@@ -406,7 +434,7 @@ async function bringLocalCodeAlong({
     }
     writePkgVersion(local.dir, bumpTo)
     say.info(`Releasing the ${kind} ${scopedName || kind} as ${bumpTo} — ${why}…`)
-    const released = releaseFoundation(local, args, cliBin, say, client?.origin)
+    const released = await release()
     say.dim(`The ${kind}'s package.json now says ${bumpTo} — commit it.`)
     if (optOut) say.dim('To send content without releasing code, pass `--no-release`.')
     return { released, proceed: true, bumped: bumpTo, ref: await pinnedRef() }
@@ -480,7 +508,7 @@ async function bringLocalCodeAlong({
           : `Releasing the ${kind} ${label} (registered latest is ${reg.latest_version})…`
       )
       return {
-        released: releaseFoundation(local, args, cliBin, say, client?.origin),
+        released: await release(),
         proceed: true,
         ref: await pinnedRef()
       }
@@ -514,7 +542,7 @@ async function bringLocalCodeAlong({
     )
     if (reRelease)
       return {
-        released: releaseFoundation(local, args, cliBin, say, client?.origin),
+        released: await release(),
         proceed: true,
         ref: await pinnedRef()
       }
@@ -570,6 +598,48 @@ function releaseFoundation(local, args, cliBin, say, origin) {
   return true
 }
 
+/**
+ * A failed release, explained when the cause is a scope you are not a member of
+ * *[Diego, 2026-10-06]* — or the error as it came.
+ *
+ * The scope is the one in the foundation's name: `register` writes a bare name's scope
+ * before it submits, so a refused release leaves the name scoped. When the orgs read
+ * says the account is neither that scope's owner nor a member of its org, the error
+ * says so (`notMember`) and carries the ways on (`ways`): `--no-release`, where a
+ * released version exists to send the content against, and a member releasing it.
+ * Its message is what the refusal means for the push — nothing was sent — since the
+ * `register` it ran has just printed the refusal itself, membership and the registry's
+ * own sentence included (measured against a local backend, 2026-10-06: HTTP 400, no
+ * typed reason).
+ *
+ * ⛔ The registry decides membership; this only names it after a refusal, and passes
+ * the error through whenever it cannot tell.
+ *
+ * @param {Error} err - the release's failure
+ * @param {object} o
+ * @param {import('./client.js').BackendClient} o.client
+ * @param {{ dir: string }} o.local
+ * @param {{ latest_version?: string }|null} o.reg - the catalog's answer for this name
+ * @param {string} o.verb - `push` or `publish`, for the ways on
+ * @returns {Promise<Error>}
+ */
+export async function explainReleaseFailure(err, { client, local, reg, verb }) {
+  const name = await foundationScopedName(local.dir).catch(() => null)
+  const scope = name ? name.split('/')[0] : null
+  if (!scope || typeof client?.fetchOrgs !== 'function') return err
+  const member = belongsToScope(scope, await client.fetchOrgs().catch(() => null))
+  if (member !== false) return err
+  const explained = new Error(`${name} was not released, so nothing was sent.`)
+  explained.notMember = true
+  explained.ways = reg?.latest_version
+    ? [
+        `Send the content against the released ${reg.latest_version}: \`uniweb ${verb} --no-release\`.`,
+        `Or ask a member of ${scope} to release it.`
+      ]
+    : [`Ask a member of ${scope} to release it.`]
+  return explained
+}
+
 /**
  * Bring the site's LOCAL extensions along — the exact parallel of
  * `bringFoundationAlong`, run for each workspace-local extension.