uniweb 0.83.0 → 0.84.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.83.0",
+  "version": "0.84.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,14 +42,14 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/content-writer": "^0.3.4",
-    "@uniweb/runtime": "^0.29.1",
-    "@uniweb/kit": "^0.19.17",
-    "@uniweb/schemas": "^0.12.0",
-    "@uniweb/core": "^0.37.1",
-    "@uniweb/semantic-parser": "^1.5.1"
+    "@uniweb/kit": "^0.19.18",
+    "@uniweb/core": "^0.37.2",
+    "@uniweb/semantic-parser": "^1.5.1",
+    "@uniweb/runtime": "^0.29.2",
+    "@uniweb/schemas": "^0.12.0"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.76.1",
+    "@uniweb/build": "^0.77.0",
     "@uniweb/content-reader": "^1.2.8",
     "@uniweb/semantic-parser": "^1.5.1"
   },

package/partials/agents.md

@@ -2012,16 +2012,16 @@ A form gets its destination from the first of these that applies:
 
 1. **One the host supplies** — `services.submit` in the served payload. Where the
    host handles submissions, that is the destination and nothing in `site.yml`
-   overrides it — so a site published to Uniweb Cloud normally needs **no
-   `submit:` at all**.
+   overrides it — so a site published to Uniweb Cloud needs **no `submit:`**: it
+   asks for form handling with `services:` instead (*Uniweb Cloud*, below).
 2. **`submit:` in `site.yml`** — an endpoint you name yourself, for a host that
    does not handle submissions, or a static site.
-3. **Neither** — there is no destination, and the form says so instead of
-   guessing at one.
+3. **Neither** — there is no destination: render no form, or fall back to contact
+   details the site already carries.
 
-That is the general arrangement, not a forms-only one. A host declares
-everything it offers under `services`, keyed by name, and every service resolves
-by the same rule — the host's offer, then your declaration, then neither.
+That is the general arrangement, not a forms-only one. A host states everything
+it offers in the served payload's `services`, keyed by name, and every service
+resolves by the same rule — the host's offer, then your declaration, then neither.
 
 ⭐ **Before you render UI for a service, ask whether the site has it** — one predicate per service,
 no arguments: `isSearchEnabled()`, `isSubmitEnabled()`, `isApiEnabled()`, `isAssistantEnabled()`,
@@ -2138,9 +2138,9 @@ if (!canSubmit) return null    // nowhere to send — render no form, or fall ba
 ```
 
 > **The framework never invents an endpoint — but a host may supply one.** Don't
-> reach for `submit:` reflexively: on Uniweb Cloud it is redundant, and setting
-> it there overrides what the platform provides. Reach for it when you are the
-> one hosting.
+> reach for `submit:` reflexively: on Uniweb Cloud the host's form handling wins
+> wherever it is on, so a `submit:` there answers only when it is off — ask for it
+> with `services:` instead. Reach for `submit:` when you are the one hosting.
 >
 > `canSubmit` is false only when neither a declaration nor a host supplies a
 > destination. **Check it when you render, not only on the button press** — a
@@ -2657,6 +2657,24 @@ Foundations have their own free path too: `uniweb add ci --target foundation` pu
 
 **`sync.json` says which site this is, on each backend.** The first push to a backend records what that backend assigned — the site's id and owner, the ids of its records and uploaded files — in `sync.json` beside `site.yml`. Commit it; never edit it. **To make a new site from a copy of a project, run `uniweb forget --all` in the copy before its first push** — the copy carries the original's `sync.json`, so otherwise its push updates the original's site. When two projects in one workspace hold the same site, a push or publish from either is refused until that is done. `uniweb forget --backend <url>` removes just one backend's records, such as a scratch server's. A record file's `$uuid` is its own id and stays in both cases. **`push`, `pull` and `publish` go to the backend you are logged in to** — the last `uniweb login --backend <url>` — and never to one you are not logged in to. A bare `uniweb login` logs in to https://uniweb.app; for any other backend, name it — logging in is how you switch, and the backend commands take no `--backend` of their own. When the project has no site on that backend but has one elsewhere, a push says so before creating a new one.
 
+**`services:` in `site.yml` asks your host for services** — site search, form handling, accounts:
+
+```yaml
+services:
+  search: true       # turn it on
+  submit: false      # turn it off
+  api:               # turn it on, with the service's own settings
+    grade: pro
+```
+
+A service you leave out keeps whatever the site has, and settings you leave out keep theirs — to turn
+one off, say `false`. `uniweb push` and `uniweb publish` send what you changed since your last sync;
+if the site's services changed elsewhere in the meantime — an author in the app — they offer to update
+`site.yml` rather than send your older choice over it, and if both changed the same service they ask
+which to keep. `uniweb pull` writes what the site has into `services:`. A change that needs payment is
+settled in the app: `publish` opens it. ⛔ **Not the same as `search:` / `submit:`**, which configure a
+provider the site brings itself — and `services:` never reaches the built site.
+
 **The Cloud also provides a real backend for structured data:** a database for every registered data schema, and a CMS that edits both static page content and dynamic data entities typed by those schemas. That's the piece that makes it viable for teams and client work — the client manages records, not markdown files.
 
 Either side can publish. Nothing about this changes how you build: the same foundation and the same site run under `uniweb dev`, `uniweb export`, or a CI deploy with no account at all.

package/src/backend/service-request.js

@@ -1,68 +1,51 @@
 /**
- * The services request — is the file ASKING for something, or just carrying an
- * old answer?
+ * The requests a push or publish carries — what the owner asks for, and whether it
+ * is new.
  *
- * ## The defect this exists to close
+ * Two of them, kept by two mechanisms:
  *
- * `$services` / `$secrets` are Sections of the site-content document, so they ride
- * inside **every** push — the block is emitted whenever the key exists in
- * `site.yml`. Editing one paragraph on one page therefore re-sends the whole
- * request block.
+ *   - ⭐ **The services** — `site.yml::services`, a map by service name *[Diego,
+ *     2026-10-06]*. Sent as the site's own list with the owner's CHANGED asks applied,
+ *     decided per service by comparing the file, the site now and the record of the
+ *     last agreement in `sync.json` (`settleServices`; spec:
+ *     kb/framework/reference/site-services-request.md).
+ *   - **The language selection** — `site.yml::publishLanguages` — told apart from the
+ *     status quo by a fingerprint banked in `deploy.yml` (`reconcile`, `bankLanguages`).
  *
- * ⛔ And the backend REPLACES what it is sent: a row anchors by its natural key and
- * is updated in place (`SectionScope::DeclaredOnly`; backend's
- * `uuidless_records_anchor_by_natural_key_and_keep_the_stored_uuid`, written
- * against this emitter's shape). So a re-send is not a harmless echo — it
- * **overwrites the stored request**, including a decision the owner made in the
- * app, which is where the consent workflow's publish happens.
+ * ⭐ The model both follow — *"the services in `site.yml` are a request, never a
+ * tracking of what is running"* [Diego, 2026-09-05]. You ask by CHANGING the file. An
+ * unchanged ask is not re-sent: the backend REPLACES the services it is sent, so a
+ * re-send would overwrite a decision the owner made in the app since.
  *
- * ⭐ Under the model the file follows — *"the services in `site.yml` are a request,
- * never a tracking of what is running"* [Diego, 2026-09-05] — **re-sending an
- * unchanged block is making a request nobody made.** You ask by CHANGING the file.
- *
- * ⚠️ It was mostly inert until 2026-09-08: `enabled` was honoured for `api` alone,
- * so a stale re-send of the other names overwrote rows nothing read. That stopped
- * being true the same day, and `api` was never inert — an `enabled: false` on it
- * with a live plan schedules a paid service to end.
- *
- * ## What "changed" is measured against
- *
- * The last block we are known to have sent, recorded in **`deploy.yml`** — a
- * COMMITTED project file that travels with a clone.
- *
- * ⛔ Deliberately NOT `.uniweb/sync-cache.json`, which is the obvious place and the
- * wrong one: it is gitignored, per-clone and deletable, so a teammate's fresh clone
- * has no base at all — and this workflow is multi-machine by construction (consent
- * in a browser, publish from the app). A base that vanishes turns this gate into
- * either the original defect or a silently dropped request.
- *
- * ## ⛔ A HASH, never the block
- *
- * `$secrets` names every secret the site has (values are the `#ref` marker, never
- * secret material — the old wording here said otherwise), and `$services[].config` is opaque and
- * per-service — anything may be in it. `deploy.yml` is committed, so recording
- * either verbatim would write them into git. Equality is all this gate needs;
- * *what* differs is a question for the backend's own copy of the request, not for
- * a mirror of our own.
+ * ⛔ *From 2026-09-20 to 2026-10-06 the services lived only in `sync.json`, which
+ * nobody edits, so a CLI user could ask for nothing; and this module compared them by
+ * a fingerprint in `deploy.yml`, which could not tell who moved.*
  *
  * @module
  */
 
 import { createHash } from 'node:crypto'
+import {
+  readServicesRequest,
+  takeServices,
+  mergeServiceRows,
+  reconcileServices,
+  recordAfter,
+  readBackendState,
+  updateBackendState,
+  writeSiteConfig
+} from '@uniweb/build/uwx'
 
 /**
- * A stable fingerprint of one declared block, or `null` when the key is absent.
+ * A stable fingerprint of one declared value, or `null` when the key is absent.
  *
- * ⭐ `null` (absent) and the hash of `[]` are DIFFERENT, and must stay so: absent
- * means *"I am not telling you about this"* and `[]` is an explicit clear. This
- * function only has to preserve that distinction — the destructive difference
- * between them is the backend's.
+ * ⭐ `null` (absent) and the hash of `[]` are DIFFERENT, and must stay so: for the
+ * language selection, no key means "every declared language" and `[]` means none.
  *
- * Rows are ordered by their serialized form and object keys sorted, so reordering
- * rows or keys in the file is not a change. It is not a request to move a line.
+ * List entries are ordered by their serialized form and object keys sorted, so
+ * reordering them in the file is not a change.
  *
- * @param {*} declared - the raw value: provisioned `services` / `secrets` rows (from
- *   `sync.json`), what the site has stored for them, or `site.yml::publishLanguages`
+ * @param {*} declared
  * @returns {string|null} 16 hex chars, or null when undeclared
  */
 export function fingerprintDeclaration(declared) {
@@ -70,13 +53,10 @@ export function fingerprintDeclaration(declared) {
   const canonical = Array.isArray(declared)
     ? declared.map(stableString).sort()
     : [stableString(declared)]
-  return createHash('sha256')
-    .update(JSON.stringify(canonical))
-    .digest('hex')
-    .slice(0, 16)
+  return createHash('sha256').update(JSON.stringify(canonical)).digest('hex').slice(0, 16)
 }
 
-/** Absent, or an empty list — a stored request that asks for nothing. */
+/** Absent, or an empty list — a stored value that asks for nothing. */
 function isNothing(value) {
   return value === undefined || value === null || (Array.isArray(value) && value.length === 0)
 }
@@ -91,125 +71,22 @@ function stableString(value) {
 }
 
 /**
- * Both blocks' fingerprints, in the shape `deploy.yml::lastDeploy.<target>` keeps
- * them. Keys are omitted rather than set to null, so an undeclared block leaves no
- * trace in the file.
- *
- * @param {object} siteYml
- * @returns {{servicesRequest?: string, secretsRequest?: string}}
- */
-export function fingerprintRequest(siteYml, provisioned = {}) {
-  const out = {}
-  // ⭐ Two sources, on purpose. The PROVISIONED rows come from `sync.json` for the
-  // backend being published to (they were `site.yml::$services` / `$secrets` until
-  // 2026-09-20). The language selection below is still authored, so still site.yml.
-  const services = fingerprintDeclaration(provisioned?.services)
-  if (services) out.servicesRequest = services
-  const secrets = fingerprintDeclaration(provisioned?.secrets)
-  if (secrets) out.secretsRequest = secrets
-  // ⭐ The language selection is a request too, and it is the one that moves a
-  // PRICE — the line is billed on how many languages go out. Banking it is what
-  // lets a later edit read as "the owner asked for another language" rather than
-  // as a value that was always there.
-  const langs = fingerprintDeclaration(siteYml?.publishLanguages)
-  if (langs) out.publishLanguagesRequest = langs
-  return out
-}
-
-/**
- * Should this push DECLARE the request blocks?
- *
- * ⛔ **Absence of a record means YES.** Three reasons, and the third is the one
- * that decides it:
- *
- *   1. It is the behaviour every CLI has had, so nothing regresses.
- *   2. A project may legitimately have no `deploy.yml` (never published, or
- *      `autoSave: off`), and that is not evidence about the request.
- *   3. ⭐ Failing the other way DROPS A REAL REQUEST IN SILENCE. Between the two
- *      failure directions, sending an unchanged block writes back what is usually
- *      already there, while withholding a changed one leaves an owner's edit with
- *      no effect and nothing said. The loud failure is the better one.
- *
- * @param {object} siteYml - the parsed site.yml
- * @param {object|null} lastDeploy - `deploy.yml::lastDeploy.<target>`, or null
- * @returns {{declare: boolean, reason: 'no-record'|'changed'|'unchanged'|'undeclared'}}
- */
-export function decideDeclaration(siteYml, lastDeploy, provisioned = {}) {
-  const now = fingerprintRequest(siteYml, provisioned)
-  if (!now.servicesRequest && !now.secretsRequest) {
-    // Nothing in the file to send. The gate is moot; say so rather than
-    // reporting "unchanged", which would imply a comparison happened.
-    return { declare: true, reason: 'undeclared' }
-  }
-  if (!lastDeploy || typeof lastDeploy !== 'object') {
-    return { declare: true, reason: 'no-record' }
-  }
-  const same =
-    now.servicesRequest === (lastDeploy.servicesRequest || undefined) &&
-    now.secretsRequest === (lastDeploy.secretsRequest || undefined)
-  return same
-    ? { declare: false, reason: 'unchanged' }
-    : { declare: true, reason: 'changed' }
-}
-
-/**
- * The four-way reconcile, once the backend's own copy of the request is in hand.
- *
- * ⭐ THIS SUPERSEDES `decideDeclaration` WHERE THE STATUS READ SUCCEEDS. That one
- * compares the file to our MEMORY of what we last sent, which leaves a window: a
- * request changed in the app between a `uniweb pull` and the next publish reads as
- * unchanged-from-nothing. Comparing to the backend's own rows closes it, because
- * the base stops being something we have to remember correctly.
- *
- * ⛔ It still needs the banked fingerprint. Local and remote differing says the two
- * disagree; it does not say WHO MOVED. Only the last agreed state does, and that is
- * the difference between "the app decided, adopt it" and "you edited, send it".
- *
- * ## The four outcomes
- *
- * | local | remote | |
- * |---|---|---|
- * | unchanged | unchanged | `none` — nobody asked anything |
- * | unchanged | **moved** | `adopt` — the app decided; the file is merely behind |
- * | **edited** | unchanged | `send` — a real request |
- * | **edited** | **moved** | `conflict` — ⛔ two intents, and only the owner ranks them |
- *
- * ⛔ `conflict` never guesses and never sends. A last-write-wins on a field that
- * schedules a paid service to end is not a tie-break, it is a coin toss with the
- * owner's money.
- *
- * ⚖️ No base ⇒ we cannot tell `adopt` from `conflict`, so we fall back to the
- * conservative reading of a difference: if the two differ, `conflict`; if they
- * agree, `none`. That withholds rather than sends, which is safe HERE — unlike
- * `decideDeclaration`, nothing is silently dropped, because a conflict is reported.
- *
- * @param {object} siteYml
- * @param {*} remoteServices - the status read's `services` rows, or undefined
- * @param {object|null} lastDeploy - the banked base
- * @returns {{action:'none'|'adopt'|'send'|'conflict', local:string|null, remote:string|null}}
- */
-export function reconcileRequest(siteYml, remoteServices, lastDeploy, provisioned = {}) {
-  return reconcile(provisioned?.services, remoteServices, lastDeploy?.servicesRequest)
-}
-
-/**
- * The same reconcile over any two-way request field.
+ * A two-way request field, reconciled against what the site has stored.
  *
- * ⭐ `$services` was the first, not the only one. `site.yml::publishLanguages` is
- * the same shape — the owner's ASK, pushed up, projected back on pull, and stored
- * on the other side where something else may move it.
+ * `site.yml::publishLanguages` is the owner's ASK, pushed up, projected back on pull,
+ * and stored on the other side where something else may move it.
  *
- * ⛔ AND A BASE IS NEEDED EVEN WHERE NOTHING ELSE WRITES THE FIELD. That was the
- * reasoning that nearly left languages out: "nobody overwrites it, so there is no
- * hazard." Overwriting is not the only thing a base is for — without one, a value
- * that has always been in the file is indistinguishable from one the owner just
- * typed, so the CLI cannot tell an intentional change from the status quo. For
- * languages that difference is money: the count is priced, so a new language is a
- * charge, and saying so before sending requires knowing it is new.
+ * ⛔ A BASE IS NEEDED EVEN WHERE NOTHING ELSE WRITES THE FIELD. Overwriting is not the
+ * only thing a base is for — without one, a value that has always been in the file
+ * is indistinguishable from one the owner just typed, so the CLI cannot tell an
+ * intentional change from the status quo. For languages that difference is money:
+ * the count is priced, so a new language is a charge, and saying so before sending
+ * requires knowing it is new.
  *
  * @param {*} localValue - the file's declaration
  * @param {*} remoteValue - what the site has stored
  * @param {string|null} baseFingerprint - what we last agreed on
+ * @returns {{action: 'none'|'adopt'|'send'|'conflict', local: string|null, remote: string|null}}
  */
 export function reconcile(localValue, remoteValue, baseFingerprint) {
   const local = fingerprintDeclaration(localValue)
@@ -217,11 +94,9 @@ export function reconcile(localValue, remoteValue, baseFingerprint) {
   const base = baseFingerprint || null
 
   if (local === remote) return { action: 'none', local, remote }
-  // ⛔ A FILE THAT DECLARES NOTHING ASKS NOTHING, so it is never one side of a conflict. With
-  // nothing stored either — an empty list is the store's nothing — there is nothing to do; with
-  // something stored, the file is merely behind. Until 2026-09-26 this was a `conflict`, and the
-  // first publish of a site whose file is silent warned that its services "were changed
-  // elsewhere, and site.yml changed too", listing both as nothing.
+  // ⛔ A FILE THAT DECLARES NOTHING ASKS NOTHING, so it is never one side of a conflict.
+  // With nothing stored either there is nothing to do; with something stored, the file
+  // is merely behind.
   if (local === null) return { action: isNothing(remoteValue) ? 'none' : 'adopt', local, remote }
   if (!base) return { action: 'conflict', local, remote }
 
@@ -231,3 +106,159 @@ export function reconcile(localValue, remoteValue, baseFingerprint) {
   if (localMoved && !remoteMoved) return { action: 'send', local, remote }
   return { action: 'conflict', local, remote }
 }
+
+/**
+ * What a publish records in `deploy.yml` about the language selection: its
+ * fingerprint, on EVERY publish — it rides the content push, so what went live is
+ * what was agreed.
+ *
+ * ⛔ A FINGERPRINT, never the list: `deploy.yml` records what a publish did, and the
+ * selection itself is in `site.yml`.
+ *
+ * @param {object} siteYml
+ * @returns {{publishLanguagesRequest?: string}}
+ */
+export function bankLanguages(siteYml) {
+  const langs = fingerprintDeclaration(siteYml?.publishLanguages)
+  return langs ? { publishLanguagesRequest: langs } : {}
+}
+
+/** One service, as an owner reads it: `on`, `off`, `on (grade: pro)`. */
+function describeService(row) {
+  if (!row || typeof row !== 'object') return 'nothing set'
+  const state = row.enabled === false ? 'off' : 'on'
+  const settings =
+    row.config && typeof row.config === 'object' ? Object.entries(row.config) : []
+  if (!settings.length) return state
+  const shown = settings
+    .map(([k, v]) => `${k}: ${v !== null && typeof v === 'object' ? '…' : String(v)}`)
+    .join(', ')
+  return `${state} (${shown})`
+}
+
+const rowNamed = (rows, name) =>
+  Array.isArray(rows) ? rows.find((r) => r && typeof r === 'object' && r.name === name) : undefined
+
+/**
+ * Decide what a push or publish sends of `site.yml::services` — and, once it has
+ * succeeded, what the project records.
+ *
+ * Per service the file names, three states are compared: the file, the site now
+ * (`status.services`), and the record of the last agreement (this backend's entry in
+ * `sync.json`). What the owner changed is sent; what the site changed is kept, and
+ * offered into `site.yml`; where both changed, the owner is asked. The list sent is the
+ * site's own, with only the changed asks applied (`mergeServiceRows`) — so every other
+ * service and setting the site holds is sent as it is stored.
+ *
+ * ⛔ An open decision — an offer declined, a conflict not resolved, or no terminal to
+ * ask at — is never sent, and the record keeps the earlier agreement for it, so the
+ * next run still sees the site's change rather than reading it as the file's.
+ *
+ * @param {object} p
+ * @param {object} p.client - the backend client (`origin`, `siteStatus`)
+ * @param {string} p.siteDir
+ * @param {object} p.siteYml - parsed; updated in place when the owner takes the site's services
+ * @param {object|null} [p.status] - the site's status, when the caller has just read it
+ * @param {boolean} [p.offline] - read nothing from the backend (`--dry-run`, `-o`)
+ * @param {boolean} [p.interactive] - whether the owner can be asked
+ * @param {(message: string, initial?: boolean) => Promise<boolean>} p.confirm
+ * @param {{ info: Function, warn: Function, dim: Function, ok: Function }} p.say
+ * @returns {Promise<{ emit: object, after: () => void }>} `emit` — options for the
+ *   producer; `after` — call once the push succeeded (or had nothing to send)
+ */
+export async function settleServices({
+  client,
+  siteDir,
+  siteYml,
+  status,
+  offline = false,
+  interactive = false,
+  confirm,
+  say
+}) {
+  const nothing = { emit: {}, after: () => {} }
+  const asks = readServicesRequest(siteYml?.services, { warn: (m) => say.warn(m) })
+  if (!asks) return nothing
+
+  const state = readBackendState(siteDir, client.origin)
+  const record = Array.isArray(state.services) ? state.services : undefined
+  const siteUuid = state.site?.uuid || null
+  let read = status
+  if (read === undefined && !offline && siteUuid) read = await client.siteStatus(siteUuid)
+  const stored = Array.isArray(read?.services) ? read.services : undefined
+
+  const decision = reconcileServices({ asks, record, stored, siteKnown: Boolean(siteUuid) })
+  if (decision.unreadable) {
+    say.warn("site.yml asks for services, but this project has no record of your site's and could not read them, so none were sent.")
+    say.dim('  Run `uniweb pull` to take them, then push again.')
+    return nothing
+  }
+
+  const askFor = (name) => asks.find((a) => a.name === name)
+  const send = [...decision.send]
+  let offered = [...decision.adopt]
+  const open = []
+
+  // ⛔ BOTH MOVED: only the owner can rank two of their own decisions. Not a stop — the
+  // content they asked to push is a separate thing — and never a guess.
+  if (decision.conflict.length) {
+    say.warn(
+      record
+        ? "Your site's services and site.yml both changed since your last sync:"
+        : 'site.yml asks for services your site has set differently:'
+    )
+    for (const name of decision.conflict) {
+      say.dim(`  ${name}: site.yml asks ${describeService(askFor(name))} — your site has ${describeService(rowNamed(stored, name))}`)
+    }
+    if (!interactive) {
+      say.dim("  Left as your site has them — run without --non-interactive to choose.")
+      open.push(...decision.conflict)
+    } else if (await confirm('Use the services in site.yml?', false)) {
+      send.push(...decision.conflict)
+    } else {
+      // Declining to send is not yet a decision to take the site's: offered below.
+      offered = [...offered, ...decision.conflict]
+    }
+  }
+
+  // The site moved and the file did not: the file is behind. Offered, never done — a
+  // push changes `site.yml` only when the owner says so.
+  if (offered.length) {
+    say.info("Your site's services changed since your last sync:")
+    for (const name of offered) {
+      say.dim(`  ${name}: your site has ${describeService(rowNamed(stored, name))} — site.yml says ${describeService(askFor(name))}`)
+    }
+    if (interactive && (await confirm('Update site.yml to match?', false))) {
+      const services = takeServices(siteYml.services, stored, offered)
+      writeSiteConfig(siteDir, { services })
+      if (services) siteYml.services = services
+      else delete siteYml.services
+      say.ok('site.yml updated.')
+    } else {
+      open.push(...offered)
+    }
+  }
+
+  if (send.length) {
+    say.info(`Asking for: ${send.map((n) => `${n} ${describeService(askFor(n))}`).join(', ')}`)
+  }
+
+  // The list to send: the site's rows with the changed asks applied. With the site
+  // unreadable and nothing changed, nothing is sent — the record may be stale, and
+  // sending it would be asking for what the site may have moved away from.
+  const base = stored ?? record ?? (siteUuid ? undefined : [])
+  if (!stored && !send.length) {
+    return {
+      emit: { declareServices: false },
+      after: () => {}
+    }
+  }
+  const rows = mergeServiceRows(base, asks.filter((a) => send.includes(a.name)))
+  return {
+    emit: { serviceRows: rows },
+    after: () => {
+      const next = recordAfter({ record, agreed: rows, open })
+      if (next) updateBackendState(siteDir, client.origin, { services: next })
+    }
+  }
+}

package/src/commands/publish.js

@@ -55,10 +55,9 @@ import {
 } from '@uniweb/build/site'
 import { emitSyncPackages } from '@uniweb/build/uwx'
 import {
-  decideDeclaration,
-  fingerprintRequest,
+  bankLanguages,
   reconcile,
-  reconcileRequest
+  settleServices
 } from '../backend/service-request.js'
 import { isSiteRelativeExtensionUrl } from '@uniweb/build'
 import { resolveDefaultLocale } from '@uniweb/core/locale-config'
@@ -235,19 +234,6 @@ export function unservedLanguages(asked, served) {
   return asked.filter((l) => !got.has(l))
 }
 
-function describeServices(rows) {
-  if (!Array.isArray(rows) || rows.length === 0) return 'nothing'
-  return rows
-    .map((r) => {
-      const name = typeof r?.name === 'string' ? r.name : '?'
-      // A row that omits `enabled` is an ask, not a refusal — the backend's three
-      // states. Only an explicit `false` reads as off.
-      return r?.enabled === false ? `${name} (off)` : name
-    })
-    .sort()
-    .join(', ')
-}
-
 async function persistLastDeploy(siteDir, opts) {
   if (opts.saveDeploys === false) return
   try {
@@ -392,9 +378,9 @@ export async function publish(args = []) {
     resolved = resolvePublishTarget(deployYml, client.origin, {
       defaultBackend: DEFAULT_BACKEND_ORIGIN
     })
-    // The last request we are known to have sent TO THIS BACKEND, for the declaration
-    // gate below. Read from the SAME deploy.yml load — one read, and the memo is the
-    // only durable record of it (see backend/service-request.js for why not the cache).
+    // The language selection last sent TO THIS BACKEND, for its reconcile below. Read
+    // from the SAME deploy.yml load — one read, and the memo is the only durable record
+    // of it (see backend/service-request.js).
     priorRequest = deployYml?.deploys?.[resolved.targetName] || null
   } catch {
     // Malformed/ambiguous deploy.yml — don't block the publish on the memo.
@@ -818,98 +804,30 @@ export async function publish(args = []) {
   const injectInfo = {
     ...(fnd.ref ? { foundation: fnd.ref } : {})
   }
-  // ⛔ IS THE FILE ASKING FOR ANYTHING BY ITS `$services` / `$secrets` BLOCK?
-  //
-  // The blocks ride inside the site-content document, so without this gate every
-  // push re-sends them — and the backend REPLACES what it is sent. A paragraph
-  // edit would therefore overwrite whatever the stored request has become, which
-  // in the consent workflow is a decision the owner made in the app. Under "the
-  // file is a request", an unchanged block is not asking for anything.
-  //
-  // ⚠️ The residual window, stated because it is real and narrow: the base is
-  // banked at publish, so a request changed in the app BETWEEN a `uniweb pull` and
-  // the next publish is not seen — the pulled block reads as unchanged-from-nothing
-  // and is declared. It closes when the status route carries the stored request
-  // (backend is adding it) and we compare against theirs instead of our memory.
-  //
-  // ⭐ ASK THE BACKEND rather than trusting our memory, when it will tell us. The
-  // banked fingerprint says what WE last sent; the status read says what the site
-  // actually has. Only the second one sees a change made in the app, which is where
-  // the consent workflow's decisions happen — so this is what closes the window
-  // between a `uniweb pull` and the next publish.
-  //
-  // ⚖️ Degrades to the banked comparison on any failure — an older backend, a
-  // network blip, a site never pushed. That is the shipped behaviour and it is safe:
-  // it withholds an unchanged block and sends a changed one; it merely cannot see
-  // the app's side.
-  // What this site is PROVISIONED with on the backend being published to.
-  const provisioned = readBackendState(siteDir, client.origin)
-  const boundUuid = provisioned.site?.uuid || null
-  let declaration = decideDeclaration(siteYml, priorRequest, provisioned)
-  let adopted = null
-  // Before the push, so a never-synced site has no uuid and simply skips this.
-  const status =
-    // This backend's site, from sync.json. It read `site.yml::$uuid`, so after step 4
-    // the remote reconcile below never ran and every publish declared blind.
-    boundUuid
-      ? await client.siteStatus(boundUuid)
-      : null
-  if (status && Array.isArray(status.services)) {
-    const r = reconcileRequest(siteYml, status.services, priorRequest, provisioned)
-    if (r.action === 'none') {
-      declaration = { declare: false, reason: 'in-sync' }
-    } else if (r.action === 'send') {
-      declaration = { declare: true, reason: 'changed' }
-    } else if (r.action === 'adopt') {
-      // The owner decided in the app and this file is simply behind. Nothing to
-      // ask for, so nothing is sent — and the file can be brought in line, which
-      // is offered rather than done, because site.yml is theirs.
-      declaration = { declare: false, reason: 'adopt' }
-      adopted = status.services
-    } else {
-      // ⛔ CONFLICT — both moved. Withhold and SAY SO. Not a stop: the content
-      // publish is a separate thing the owner asked for, and blocking it over a
-      // services disagreement couples two unrelated intents. Not a guess either;
-      // the request stays in their file, unsent, and they are told.
-      declaration = { declare: false, reason: 'conflict' }
-      adopted = status.services
-    }
-  }
+  // ⭐ WHAT THE SITE HAS — read before the push, for the two requests a publish
+  // carries: the services (`site.yml::services`) and the language selection. Only
+  // this read sees a decision the owner made in the app since this clone last synced.
+  // It reads this backend's site, from sync.json; a never-synced site has none.
+  const boundUuid = readBackendState(siteDir, client.origin).site?.uuid || null
+  const status = boundUuid ? await client.siteStatus(boundUuid) : null
 
-  // ⛔ EVERY STRING BELOW IS FOR A SITE OWNER, NOT FOR US.
-  //
-  // "request", "declaration", "send", "adopt", "reconcile" are how this file
-  // MODELS the problem and they are the wrong words to say out loud: an author
-  // does not think they are sending a request, they think they want their site to
-  // have search. Say services, on and off, site.yml and your site. The internal
-  // vocabulary stays in the code and the comments, where it earns its precision.
-  //
-  // ⭐ THE OWNER IS THE ONLY ONE WHO CAN RANK TWO OF THEIR OWN INTENTS.
-  //
-  // `conflict` means the file and the site both moved since we last agreed, so
-  // neither is "the" request. ⛔ Withholding silently and saying "edit site.yml"
-  // is advice that CANNOT WORK: with no banked base the file has nothing to move
-  // relative to, so editing it produces the same conflict forever. That shipped
-  // for one commit. Asking is the only thing that resolves it.
-  if (declaration.reason === 'conflict') {
-    say.warn('Your site\'s services were changed elsewhere, and site.yml changed too.')
-    say.dim(`  in sync.json: ${describeServices(provisioned.services)}`)
-    say.dim(`  on your site: ${describeServices(adopted)}`)
-    if (isNonInteractive(args)) {
-      say.dim('  Left your site as it is — run without --non-interactive to choose.')
-    } else if (await confirm('Use the services listed in site.yml?', false)) {
-      declaration = { declare: true, reason: 'resolved-send' }
-      adopted = null
-    } else {
-      // Declining to send is not yet a decision to take theirs, so this falls
-      // through to the offer below and "neither, leave it alone" stays available.
-      declaration = { declare: false, reason: 'adopt' }
-    }
-  }
+  // ⭐ THE SERVICES: what the owner changed in `site.yml::services` is sent, applied
+  // over the site's own list; what the site changed is kept and offered into the file;
+  // where both changed, the owner is asked (`settleServices`). An ask whose decision is
+  // still open is never sent over the decision the site holds.
+  const services = await settleServices({
+    client,
+    siteDir,
+    siteYml,
+    status,
+    interactive: !isNonInteractive(args),
+    confirm,
+    say
+  })
 
-  // ⭐ THE SAME QUESTION FOR THE LANGUAGE SELECTION, and it is the one that costs.
+  // ⭐ THE LANGUAGE SELECTION IS A REQUEST TOO, and it is the one that costs.
   //
-  // `publishLanguages` is a request like `$services`: pushed up, projected back on
+  // `publishLanguages` is a request like `services`: pushed up, projected back on
   // pull, stored on the other side. ⛔ Nothing over there deliberately rewrites it
   // today — which is why this was nearly skipped — but a base is not only for
   // detecting an overwrite. Without one, a selection that has always been in the
@@ -938,34 +856,6 @@ export async function publish(args = []) {
     }
   }
 
-  if (declaration.reason === 'adopt' && adopted) {
-    // ⚖️ Deliberately says WHAT differs, not WHO moved. The usual cause is a
-    // decision made in the app — but the same state follows a request of ours the
-    // site refused, where nothing of theirs changed and ours simply did not take.
-    // We cannot tell those apart here, so the wording claims neither.
-    say.info('Your site has different services than site.yml lists.')
-    say.dim(`  in sync.json: ${describeServices(provisioned.services)}`)
-    say.dim(`  on your site: ${describeServices(adopted)}`)
-    // ⭐ OFFERED, NEVER DONE. site.yml is the owner's file, and a publish that
-    // silently rewrites an authored file is the surprise this seam exists to
-    // avoid. Default No, and declining costs nothing: the site is already
-    // correct, only the file is behind, and the offer returns next publish.
-    //
-    // ⚖️ A DECLINED conflict reaches here too, and that is deliberate — having
-    // been asked which they meant and said "not mine", taking the site's is the
-    // other half of the same question, not a silent overwrite of an edit.
-    if (!isNonInteractive(args) && (await confirm('Update site.yml to match?', false))) {
-      const { writeSiteConfig } = await import('@uniweb/build/uwx')
-      writeSiteConfig(siteDir, { $services: adopted })
-      // Keep the in-memory copy in step, or the deploy.yml bank below records the
-      // file as it WAS and the offer repeats forever.
-      siteYml.$services = adopted
-      say.ok('site.yml updated.')
-    }
-  } else if (!declaration.declare && declaration.reason !== 'adopt') {
-    say.dim('Services unchanged.')
-  }
-
   // publish rides the same gated push as `uniweb push`: if an app author has
   // edited since this clone last synced, the push is refused rather than
   // overwriting them, and nothing goes live. `--force` drops the precondition.
@@ -983,7 +873,8 @@ export async function publish(args = []) {
     backend: client.origin,
     // The keys this deployment's Sections take — see deploymentFields.
     ...fields,
-    ...(declaration.declare ? {} : { declareServices: false }),
+    // The `services` Section as settled above — or withheld.
+    ...services.emit,
     // Placement identity for the folder — see writeFolderItemUuids.
     folderItemUuids: readFolderItemUuids(siteDir, client.origin),
     // Identity for the records' list items — see readRecordItemUuids.
@@ -1030,6 +921,9 @@ export async function publish(args = []) {
     report
   })
   if (pushResult.exitCode !== 0) return { exitCode: pushResult.exitCode }
+  // The push stored what it sent: the services agreed on are recorded now, whether or
+  // not the site then goes live.
+  services.after()
   const siteUuid = pushResult.boundSiteUuid
   if (!siteUuid) {
     say.err('Push did not yield a site uuid — cannot go live.')
@@ -1127,24 +1021,9 @@ export async function publish(args = []) {
     lastDeploy: {
       at: new Date().toISOString(),
       host: 'uniweb',
-      // The request this publish is known to have sent — the base the declaration
-      // gate compares against next time. ⛔ A FINGERPRINT, never the block:
-      // deploy.yml is committed, `$secrets` carries secret material and a
-      // service's `config` is opaque, so recording either verbatim would write
-      // them into git. Absent when the file declares no block.
-      ...(declaration.declare
-        ? fingerprintRequest(siteYml, provisioned)
-        : {
-            // Nothing was sent, so the base is unchanged — carry it forward
-            // rather than dropping it, or the next publish would read "no record"
-            // and declare.
-            ...(priorRequest?.servicesRequest
-              ? { servicesRequest: priorRequest.servicesRequest }
-              : {}),
-            ...(priorRequest?.secretsRequest
-              ? { secretsRequest: priorRequest.secretsRequest }
-              : {})
-          }),
+      // The language selection this publish sent — the base its reconcile compares
+      // against next time. ⛔ A FINGERPRINT: the selection itself is in site.yml.
+      ...bankLanguages(siteYml),
       // What was actually shipped. A version number can't answer that — two
       // publishes of "0.1.0" are not the same content — and after the fact the
       // working tree has moved on. `dirty` matters as much as the sha: it says the

package/src/commands/push.js

@@ -74,7 +74,8 @@ import {
   syncedElsewhere,
   describeSyncedElsewhere
 } from '../utils/site-identity.js'
-import { confirm } from '../utils/interactive.js'
+import { confirm, isNonInteractive } from '../utils/interactive.js'
+import { settleServices } from '../backend/service-request.js'
 import { guardEmptyRecords } from '../utils/records-guard.js'
 import { bringFoundationAlong } from '../backend/foundation-bring-along.js'
 import {
@@ -520,6 +521,20 @@ export async function push(args = [], deps = {}) {
       ref: siteYml?.foundation
     })
   }
+  // ⭐ THE SERVICES `site.yml` ASKS FOR — what the owner changed is sent over the site's
+  // own list; what the site changed is kept and offered into the file; where both
+  // changed, the owner is asked. Shared with `uniweb publish` (`settleServices`).
+  // Offline for `-o` and `--dry-run`: nothing is read, and nothing is recorded.
+  const offline = Boolean(output) || dryRun
+  const services = await settleServices({
+    client,
+    siteDir,
+    siteYml,
+    offline,
+    interactive: !offline && !isNonInteractive(args),
+    confirm,
+    say: { info, warn, dim: note, ok: success }
+  })
   const emitOptions = {
     backend: client.origin,
     // Placement identity for the folder — see writeFolderItemUuids.
@@ -555,7 +570,9 @@ export async function push(args = [], deps = {}) {
           itemBaseVersions: readItemBaseVersions(siteDir, client.origin)
         }),
     ...(assetRewrite ? { assetRewrite } : {}),
-    ...(assetIds ? { assetIds } : {})
+    ...(assetIds ? { assetIds } : {}),
+    // The `services` Section as settled above — or withheld.
+    ...services.emit
   }
   let pkg
   try {
@@ -584,6 +601,8 @@ export async function push(args = [], deps = {}) {
 
   // Nothing changed since the last push — the backend is already up to date.
   if (totalEntities === 0) {
+    // The site already holds what this copy has, so what was settled is agreed.
+    if (!offline) services.after()
     success(
       `Nothing to push — ${skipped} entit${skipped === 1 ? 'y' : 'ies'} unchanged since the last push.`
     )
@@ -644,6 +663,7 @@ export async function push(args = [], deps = {}) {
     }
   })
   if (result.exitCode !== 0) return { exitCode: result.exitCode }
+  services.after()
   success(
     `Pushed ${result.finalizedTotal} entit${result.finalizedTotal === 1 ? 'y' : 'ies'}` +
       (result.wrote.length ? ` — ${result.wrote.join(', ')}` : '')

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-06T02:16:00.292Z",
+  "generatedAt": "2026-10-06T19:21:14.306Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.6.10",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.76.1",
+      "version": "0.77.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.37.1",
+      "version": "0.37.2",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -55,7 +55,7 @@
       ]
     },
     "@uniweb/kit": {
-      "version": "0.19.17",
+      "version": "0.19.18",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -84,7 +84,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.29.1",
+      "version": "0.29.2",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -127,7 +127,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.20",
+      "version": "0.10.21",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",