uniweb 0.82.2 → 0.84.0

package/src/index.js

@@ -917,10 +917,12 @@ async function main() {
   // Handle login command — the backend (username/password · paste a token ·
   // --token <bearer>). ⭐ `--backend <url>` names it; without the flag it is the DEFAULT
   // backend — UNIWEB_REGISTER_URL, else ~/.uniweb/config.json, else https://uniweb.app —
-  // and never the project's backend or the current session *[Diego, 2026-09-21: "the
-  // default backend for login, if not specified, is uniweb.app"]*. The backend logged in
-  // to becomes CURRENT, and every backend command goes there (only UNIWEB_REGISTER_URL
-  // outranks it) — which is why this is the one place a backend is chosen.
+  // and never the project's backend *[Diego, 2026-09-21: "the default backend for login, if
+  // not specified, is uniweb.app"]*. ⭐ Except a WORKSPACE SWITCH — `--org` / `--personal`
+  // and no way of signing in — which acts on the backend you are logged in to *[Diego,
+  // 2026-10-06]* (`resolveLoginOrigin`). The backend logged in to becomes CURRENT, and
+  // every backend command goes there (only UNIWEB_REGISTER_URL outranks it) — which is why
+  // this is the one place a backend is chosen.
   //
   // ⛔ Until 2026-09-21 a bare login went to the backend of the project in the cwd, and
   // asked when the machine knew several backends. Both are gone: the default is the
@@ -932,7 +934,7 @@ async function main() {
     const { resolveLoginOrigin } = await import('./utils/config.js')
     let apiBase
     try {
-      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'))
+      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'), loginArgs)
     } catch (err) {
       console.error(
         `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --backend http://localhost:8080`
@@ -1729,8 +1731,8 @@ Auto-detects what you run it in:
 
 A foundation's scope is part of its name — name: '@scope/<name>' in main.js. A scope
 is a namespace: your personal one (@<your handle>, no org needed) or an org's. A bare
-name takes --scope, else your personal scope (or a pick, if you belong to orgs), and
-register writes it into the name.
+name takes --scope, else the workspace you work in (an org's scope, or your personal
+one), and register writes it into the name.
 
 Schema scopes:
   @/name     your own schema, in the foundation's scope   (@/x -> @org/x)
@@ -1742,6 +1744,9 @@ ${colors.bright}Options:${colors.reset}
                      org's — and write it into the name (refused when the name has another
                      scope). A schemas-only package: publish under @scope; default:
                      package.json uniweb.scope
+  --org @org         Work in @org for this command: a bare name registers under it
+  --personal         Work in your personal workspace: a bare name registers under your
+                     personal scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
   --non-interactive  Fail with usage info instead of prompting
@@ -1798,11 +1803,12 @@ ${colors.bright}The workspace you work in.${colors.reset} A login works in ONE w
 personal one, or an organization's — and every push, pull and publish works in it:
 a site it creates is created there, and a site kept in another workspace is refused.
 With no organization it is your personal workspace; with organizations you are asked,
-or name it. Already logged in, \`uniweb login --org @other\` switches without logging
-in again.
+or name it. Already logged in, \`uniweb login --org @other\` (or \`--personal\`) switches
+the workspace on the backend you are logged in to, without logging in again.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    The backend to log in to
+  --backend <url>    The backend to log in to (without it: the default backend — or, for
+                     --org / --personal alone, the one you are logged in to)
   --org @org         Work in @org (an organization you belong to)
   --personal         Work in your personal workspace
   --token <bearer>   Seed + verify a session from a bearer token (non-interactive)
@@ -1813,6 +1819,8 @@ ${colors.bright}Options:${colors.reset}
 In non-interactive mode (no TTY — an agent, a script), pass \`--token <bearer>\` with
 \`--org @org\` or \`--personal\`, or set \`UNIWEB_USERNAME\` + \`UNIWEB_PASSWORD\`, or set
 \`UNIWEB_TOKEN\` (per process, not stored) with \`UNIWEB_WORKSPACE=@org\` or \`personal\`.
+A login with organizations that names no workspace signs you in but exits 2;
+\`uniweb login --org @org\` (or \`--personal\`) finishes it without signing in again.
 \`uniweb logout\` logs you out.
 `,
     refresh: `
@@ -2089,6 +2097,16 @@ ${colors.bright}Global Options:${colors.reset}
   a script can aim and authenticate one process with UNIWEB_REGISTER_URL and
   UNIWEB_TOKEN instead.
 
+${colors.bright}Push Options:${colors.reset}
+  --dry-run          Report what would be pushed; send nothing (-o <file> writes the .uwx)
+  --no-release       Send content against the already-released code; release nothing
+  --bump             Release above a newer registered foundation version
+  --force            Overwrite upstream changes (drop the staleness gate)
+  --all              Send every record (bypass the changed-only cache)
+  --org @org         Work in @org for this push, not your login's workspace
+  --personal         Work in your personal workspace for this push
+  --no-validate      Skip the content-conformance check (it stops a push)
+
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt

package/src/utils/config.js

@@ -107,32 +107,87 @@ export function getDefaultBackendOrigin() {
 }
 
 /**
- * The backend `uniweb login` logs in to: `--backend`, else the default backend.
+ * The `uniweb login` that SWITCHES the workspace on `origin` — the caller appends `--org @x`
+ * or `--personal` — with `--backend` unless a switch without it reaches `origin`
+ * (`resolveLoginOrigin`): the backend you are logged in to, or, logged in nowhere, the
+ * default backend.
+ *
+ * ⚠️ *Measured 2026-10-06 against a local backend, before switches acted on the session:*
+ * `uniweb login --org @acme` went to https://uniweb.app and began a new login there — the
+ * reason a hint about any other backend names it.
+ *
+ * @param {string} origin - the backend the hint is about
+ * @param {string} [prefix='uniweb'] - how the user runs the CLI (`getCliPrefix`)
+ * @returns {string} e.g. `uniweb login`, or `uniweb login --backend http://localhost:8080`
+ */
+export function loginCommand(origin, prefix = 'uniweb') {
+  const o = originOrNull(origin)
+  const reached = originOrNull(loggedInOrigin()) || getDefaultBackendOrigin()
+  return o && o !== reached ? `${prefix} login --backend ${o}` : `${prefix} login`
+}
+
+/** The flags with which `uniweb login` SIGNS IN — a method, or a credential. */
+const SIGN_IN_FLAGS = ['--token', '--browser', '--password', '--token-paste']
+
+/**
+ * Whether a `uniweb login` is a WORKSPACE SWITCH: `--org` or `--personal`, and nothing that
+ * signs in (`SIGN_IN_FLAGS`).
+ *
+ * @param {string[]} [args]
+ * @returns {boolean}
+ */
+export function isWorkspaceSwitch(args = []) {
+  const names = args.map((a) => String(a).split('=')[0])
+  return (
+    (names.includes('--org') || names.includes('--personal')) &&
+    !SIGN_IN_FLAGS.some((f) => names.includes(f))
+  )
+}
+
+/**
+ * The backend `uniweb login` logs in to: `--backend`; else, for a workspace switch, the
+ * backend you are logged in to; else the default backend.
+ *
+ * ⭐ A SWITCH ACTS ON YOUR SESSION *[Diego, 2026-10-06: "`uniweb login --org @x` or
+ * `--personal`, with no `--backend`, should switch to the workspace on the backend you're
+ * already logged in to so we can fullfil the promise 'switches without logging in again'"]*.
+ * Logged in nowhere, it is a first login, and goes where any first login goes. A login that
+ * signs in — a method or a credential named (`isWorkspaceSwitch`) — still goes to the
+ * default backend *[Diego, 2026-09-21: "the default backend for login, if not specified, is
+ * uniweb.app"]*. ⛔ Until 2026-10-06 a switch went to the default backend too, so on any
+ * other backend it began a new login there, logging you out of the one you were on.
  *
  * ⛔ A mistyped `--backend` is an error, never a fallback — it would log you in, and so
  * point every command, somewhere you did not name.
  *
  * @param {string|null|undefined} flag - `readFlagValue`'s answer: undefined when the
  *   flag is absent, null when it was given with no value
+ * @param {string[]} [args] - the login's argv, to tell a switch from a sign-in
  * @returns {string}
  * @throws {Error} when --backend was given and is not a URL
  */
-export function resolveLoginOrigin(flag) {
-  if (flag === undefined) return getDefaultBackendOrigin()
+export function resolveLoginOrigin(flag, args = []) {
+  if (flag === undefined) {
+    const session = isWorkspaceSwitch(args) ? originOrNull(loggedInOrigin()) : null
+    return session || getDefaultBackendOrigin()
+  }
   const origin = originOrNull(flag)
   if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--backend needs a URL')
   return origin
 }
 
 /**
- * **The backend a command talks to** when no `--backend` is given — the base of every
- * `/dev/*` route (`register` POSTs to {origin}/dev/registry/register, and so on).
+ * **The backend a command talks to** — the base of every `/dev/*` route (`register`
+ * POSTs to {origin}/dev/registry/register, and so on).
  *
  * `UNIWEB_REGISTER_URL` > **the backend the user is logged in to** > the default
  * (`getDefaultBackendOrigin`). ⭐ Nothing talks to a backend the user is not logged in
  * to *[Diego, 2026-09-21]*: when this falls through to the default, the command's first
  * request asks for that login — so the default is where the login goes, never a
- * backend reached without one. `resolveBackendOrigin` puts `--backend` on top.
+ * backend reached without one. `resolveBackendOrigin` (backend/client.js) returns this
+ * unchanged: no command takes a `--backend`. ⛔ *Until 2026-10-05 this said "when no
+ * `--backend` is given" and that `resolveBackendOrigin` put `--backend` on top — read as
+ * a per-command flag outranking the login. The verbs lost that flag on 2026-09-21.*
  *
  * @returns {string}
  */

package/src/utils/registry-auth.js

@@ -98,7 +98,8 @@ export function getRegistryAuthPath() {
  * always logs you out of the one backend you may be logged in"]*. A login REPLACES the
  * file — once it succeeds, so a cancelled or failed login leaves you where you were —
  * and a logout deletes it. So "the backend you are logged in to" is exactly one thing
- * or nothing, and logout needs no selector.
+ * or nothing, and logout needs no selector. ⚠️ One exception, and it says so: a login that
+ * signs in but cannot choose a workspace keeps the session and exits 2 (`finishLogin`).
  *
  * ⚖️ The v2 map is kept, holding one entry: the file then has one reader
  * (utils/session-file.js), and it still understands what came before — a v1 flat
@@ -720,7 +721,12 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       if (wants || !session.workspace) {
         const settled = await settleWorkspace(session, args)
         if (settled.refused) {
-          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}.`)
+          // Say what the session works in now: unchanged, or — one from before workspaces —
+          // nothing yet (`finishLogin`).
+          const where = session.workspace
+            ? `${await workspaceTail(session)} — unchanged`
+            : ' — with no workspace chosen yet'
+          console.error(`\x1b[32m✓\x1b[0m Logged in to ${key}${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${where}.`)
           console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
           process.exit(2)
         }
@@ -839,15 +845,22 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
 
 /**
  * A login succeeded and its session is stored: choose its workspace, and say where the
- * login works. Without a workspace (no terminal, organizations, no flag) the session
- * stays, the reason is printed, and the login exits 2 — every command would refuse.
+ * login works.
+ *
+ * ⭐ WITHOUT A WORKSPACE THE SESSION STAYS, AND THE LOGIN SAYS SO *[Diego, 2026-10-06]*. No
+ * terminal, organizations, neither `--org` nor `--personal` — or a pick cancelled at a
+ * terminal: you are logged in, with no workspace, and the login exits 2 naming the one
+ * command that finishes it without signing in again. The credential was good, and a
+ * second sign-in can be a second browser round trip. ⚠️ So this is the one login that
+ * exits non-zero having replaced your session — the reason it says so in as many words.
  */
 async function finishLogin(record, apiBase, args) {
   const settled = await settleWorkspace(record, args)
   const who = settled.record.username ? ` as \x1b[1m${settled.record.username}\x1b[0m` : ''
   if (settled.refused) {
-    console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase}).`)
+    console.error(`\x1b[32m✓\x1b[0m Logged in to ${normOrigin(apiBase)}${who} — with no workspace chosen yet.`)
     console.error(`\x1b[31m✗\x1b[0m ${settled.refused}`)
+    console.error('\x1b[2m  Until one is chosen, the commands that work on a site refuse.\x1b[0m')
     process.exit(2)
   }
   console.error(`\x1b[32m✓\x1b[0m Logged in${who} (${apiBase})${await workspaceTail(settled.record)}.`)

package/src/utils/registry-orgs.js

@@ -81,6 +81,25 @@ export function publishScope(value) {
   return handle ? `@${handle}` : null
 }
 
+/**
+ * Whether the orgs read (`GET /dev/orgs`) says this account may release into `scope`:
+ * the account's own handle, or an org it belongs to. True or false; null when there is
+ * nothing to say (no scope, no read).
+ *
+ * ⛔ For EXPLAINING a refusal only, never to gate a release: the registry decides who
+ * may publish into a scope, and this knows only the memberships that read lists.
+ *
+ * @param {string|null} scope - `@acme`, `acme` or `@acme/…`
+ * @param {{ account_handle?: string|null, orgs?: Array<{ handle?: string }> }|null} envelope
+ * @returns {boolean|null}
+ */
+export function belongsToScope(scope, envelope) {
+  const h = bareHandle(scope)
+  if (!h || !envelope || typeof envelope !== 'object') return null
+  if (bareHandle(envelope.account_handle || '') === h) return true
+  return (Array.isArray(envelope.orgs) ? envelope.orgs : []).some((o) => bareHandle(o?.handle) === h)
+}
+
 /**
  * Validate a handle's GRAMMAR client-side (reserved names are the server's
  * call — a 409 carries the verdict). Returns an error string, or null.
@@ -157,15 +176,22 @@ export async function createOrg({ apiBase, token, handle }) {
 }
 
 /**
- * The scope to register under, from the login, when none was named — a bare handle,
- * or null when none was chosen. Persists nothing; the caller records it (in the
- * foundation's name, or a schemas-only package's `package.json`).
+ * The scope to register under, from the login's orgs, when none was named and the
+ * workspace the command works in names none either — a bare handle, or null when none
+ * was chosen. Persists nothing; the caller records it (in the foundation's name, or a
+ * schemas-only package's `package.json`).
+ *
+ * ⚠️ The FALLBACK since 2026-10-06: a bare name first takes the workspace the command
+ * works in (`register.js::deriveScopeFromLogin`, `workspace.js::scopeOfWorkspace`). This
+ * answers only when no workspace is chosen — you belong to orgs and named none — or the
+ * one chosen is a unit without a handle.
  *
  * ⭐ A SCOPE IS A NAMESPACE (2026-09-23): your account's own, `@<handle>`, needs no org.
  *
  *   no org              → your personal scope — said, never asked, in CI too
  *   orgs                → pick: your personal scope first, then each org;
- *                         non-interactive, your personal scope, said
+ *                         non-interactive, REFUSED — choose a workspace, or --scope
+ *                         (until 2026-10-06: your personal scope, said)
  *   no account handle   → (a service account) its one org, said; several are asked,
  *                         or refused in CI; none is a pointer to `--scope`
  *
@@ -220,10 +246,20 @@ export async function deriveScope({
       )
       return null
     }
+    // ⛔ NO DEFAULT FOR A MEMBER OF ORGANIZATIONS *[Diego, 2026-10-06: "someone in an org,
+    // with no workspace chosen must choose one. we should not default to personal"]*. Only
+    // reached when the workspace the command works in names no scope — none is chosen — so
+    // the choice is theirs. ⚠️ Until then this answered your personal scope, said: a team's
+    // foundation registered as one member's.
+    const { getCliPrefix } = await import('./interactive.js')
+    const { loginCommand } = await import('./config.js')
+    const first = orgs[0].handle
     console.error(
-      `Registering under your personal scope ${bold(personal)} (non-interactive). Pass --scope @org for an org.`
+      `\x1b[31m✗\x1b[0m You belong to organizations (${orgs.map((o) => `@${o.handle}`).join(', ')}), so no scope is assumed.\n` +
+        `  Choose the workspace you work in — ${loginCommand(apiBase, getCliPrefix())} --org @${first} (or --personal) — and the name takes its scope;\n` +
+        `  or name the scope here: --scope @${first}, or --scope @${personal} for your own.`
     )
-    return personal
+    return null
   }
   const prompts = (await import('prompts')).default
   const { choice } = await prompts(
@@ -249,5 +285,6 @@ export async function deriveScope({
       }
     }
   )
+  if (!choice) console.error('\x1b[31m✗\x1b[0m No scope chosen.')
   return choice || null
 }