uniweb 0.84.0 → 0.86.0

package/src/utils/config.js

@@ -53,7 +53,7 @@ function readCliConfig() {
 /**
  * The origin the LAST `uniweb login` authenticated against — persisted on the
  * session record so subsequent verbs default to the backend you logged into
- * (no `--backend` per command). Sync read; null when there's no session or it
+ * (no backend flag per command). Sync read; null when there's no session or it
  * carries no origin (older sessions). Read directly (not via registry-auth.js)
  * to keep this module off the optional-peer / import-cycle path.
  * @returns {string|null}
@@ -91,7 +91,7 @@ function originOrNull(value) {
  * **The default backend** — where a bare `uniweb login` goes, and where a backend command
  * goes when nobody is logged in (the login it asks for is then this one).
  *
- * `UNIWEB_REGISTER_URL`, else `~/.uniweb/config.json` `registryApiUrl`, else
+ * `UNIWEB_SERVER`, else `~/.uniweb/config.json` `registryApiUrl`, else
  * https://uniweb.app. ⛔ **Never the current session** *[Diego, 2026-09-21: "the default
  * backend for login, if not specified, is uniweb.app"]* — a bare `uniweb login` means the
  * default backend, not "the one I am already on".
@@ -100,7 +100,7 @@ function originOrNull(value) {
  */
 export function getDefaultBackendOrigin() {
   return (
-    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(process.env.UNIWEB_SERVER) ||
     originOrNull(readCliConfig().registryApiUrl) ||
     DEFAULT_BACKEND_ORIGIN
   )
@@ -108,7 +108,7 @@ export function getDefaultBackendOrigin() {
 
 /**
  * The `uniweb login` that SWITCHES the workspace on `origin` — the caller appends `--org @x`
- * or `--personal` — with `--backend` unless a switch without it reaches `origin`
+ * or `--personal` — with `--server` unless a switch without it reaches `origin`
  * (`resolveLoginOrigin`): the backend you are logged in to, or, logged in nowhere, the
  * default backend.
  *
@@ -118,12 +118,12 @@ export function getDefaultBackendOrigin() {
  *
  * @param {string} origin - the backend the hint is about
  * @param {string} [prefix='uniweb'] - how the user runs the CLI (`getCliPrefix`)
- * @returns {string} e.g. `uniweb login`, or `uniweb login --backend http://localhost:8080`
+ * @returns {string} e.g. `uniweb login`, or `uniweb login --server http://localhost:8080`
  */
 export function loginCommand(origin, prefix = 'uniweb') {
   const o = originOrNull(origin)
   const reached = originOrNull(loggedInOrigin()) || getDefaultBackendOrigin()
-  return o && o !== reached ? `${prefix} login --backend ${o}` : `${prefix} login`
+  return o && o !== reached ? `${prefix} login --server ${o}` : `${prefix} login`
 }
 
 /** The flags with which `uniweb login` SIGNS IN — a method, or a credential. */
@@ -145,7 +145,7 @@ export function isWorkspaceSwitch(args = []) {
 }
 
 /**
- * The backend `uniweb login` logs in to: `--backend`; else, for a workspace switch, the
+ * The backend `uniweb login` logs in to: `--server`; else, for a workspace switch, the
  * backend you are logged in to; else the default backend.
  *
  * ⭐ A SWITCH ACTS ON YOUR SESSION *[Diego, 2026-10-06: "`uniweb login --org @x` or
@@ -157,14 +157,14 @@ export function isWorkspaceSwitch(args = []) {
  * uniweb.app"]*. ⛔ Until 2026-10-06 a switch went to the default backend too, so on any
  * other backend it began a new login there, logging you out of the one you were on.
  *
- * ⛔ A mistyped `--backend` is an error, never a fallback — it would log you in, and so
+ * ⛔ A mistyped `--server` is an error, never a fallback — it would log you in, and so
  * point every command, somewhere you did not name.
  *
  * @param {string|null|undefined} flag - `readFlagValue`'s answer: undefined when the
  *   flag is absent, null when it was given with no value
  * @param {string[]} [args] - the login's argv, to tell a switch from a sign-in
  * @returns {string}
- * @throws {Error} when --backend was given and is not a URL
+ * @throws {Error} when --server was given and is not a URL
  */
 export function resolveLoginOrigin(flag, args = []) {
   if (flag === undefined) {
@@ -172,7 +172,7 @@ export function resolveLoginOrigin(flag, args = []) {
     return session || getDefaultBackendOrigin()
   }
   const origin = originOrNull(flag)
-  if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--backend needs a URL')
+  if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--server needs a URL')
   return origin
 }
 
@@ -180,12 +180,12 @@ export function resolveLoginOrigin(flag, args = []) {
  * **The backend a command talks to** — the base of every `/dev/*` route (`register`
  * POSTs to {origin}/dev/registry/register, and so on).
  *
- * `UNIWEB_REGISTER_URL` > **the backend the user is logged in to** > the default
+ * `UNIWEB_SERVER` > **the backend the user is logged in to** > the default
  * (`getDefaultBackendOrigin`). ⭐ Nothing talks to a backend the user is not logged in
  * to *[Diego, 2026-09-21]*: when this falls through to the default, the command's first
  * request asks for that login — so the default is where the login goes, never a
  * backend reached without one. `resolveBackendOrigin` (backend/client.js) returns this
- * unchanged: no command takes a `--backend`. ⛔ *Until 2026-10-05 this said "when no
+ * unchanged: no command takes a backend flag. ⛔ *Until 2026-10-05 this said "when no
  * `--backend` is given" and that `resolveBackendOrigin` put `--backend` on top — read as
  * a per-command flag outranking the login. The verbs lost that flag on 2026-09-21.*
  *
@@ -193,7 +193,7 @@ export function resolveLoginOrigin(flag, args = []) {
  */
 export function getRegistryApiBaseUrl() {
   return (
-    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(process.env.UNIWEB_SERVER) ||
     originOrNull(loggedInOrigin()) ||
     getDefaultBackendOrigin()
   )

package/src/utils/flag-guard.js

@@ -9,14 +9,15 @@
  * Tolerable for a cosmetic flag; dangerous for any flag that aims the command or picks
  * its identity. This turns that class into one sentence.
  *
- * ⛔ **`--backend` and `--token` are NOT flags of these verbs** *(2026-09-21)*. Every
+ * ⛔ **A backend flag and `--token` are NOT flags of these verbs** *(2026-09-21)*. Every
  * backend verb goes to the backend you are logged in to, with that login's session:
- * switching and signing in are `uniweb login` (`--backend`, `--token`), and a script
- * aims one process with UNIWEB_REGISTER_URL + UNIWEB_TOKEN. Both flags predate
- * per-backend sessions. Passed now, each is an unknown flag — and this guard is what
- * makes that a loud error, with a pointer to the login, instead of a command that
- * quietly runs against wherever and as whoever you happen to be. `--backend` stays on
- * `forget`, where it SELECTS which backend's records to remove.
+ * switching and signing in are `uniweb login` (`--server`, `--token`), and a script
+ * aims one process with UNIWEB_SERVER + UNIWEB_TOKEN. Passed to a verb, each is an
+ * unknown flag — and this guard is what makes that a loud error, with a pointer to the
+ * login, instead of a command that quietly runs against wherever and as whoever you
+ * happen to be. `--server` stays on `forget`, where it SELECTS which backend's records
+ * to remove. ⛔ *The flag was `--backend` until 2026-10-07, renamed so it is not read as
+ * a site's `backend` service; `--backend` is refused everywhere, naming `--server`.*
  *
  * ⚠️ A wrong rejection is worse than a missed one — it breaks an invocation that
  * works — so the per-command lists must be complete, INCLUDING flags read by
@@ -93,12 +94,17 @@ const VERBS = {
     '--personal'
   ],
   /**
-   * `forget` = remove one backend's records (`--backend <url>`), or everything a
+   * `forget` = remove one backend's records (`--server <url>`), or everything a
    * copied project inherited (`--all`). One of the two is required — the verb refuses
    * without it — and they exclude each other. `--non-interactive` reaches it through
    * resolveSiteDir in a workspace of several sites.
    */
-  forget: ['--backend', '--all'],
+  forget: ['--server', '--all'],
+  /**
+   * `site list | unpublish | delete` — a workspace's sites. `--yes` confirms a write;
+   * `--json` is `list`'s porcelain; the workspace is `--org` / `--personal`.
+   */
+  site: ['--json', '--yes', '--org', '--personal'],
   status: [
     '--json', '--remote', '--dry-run',
     '--force', '--no-verify', '--no-validate', '--yes', '--org', '--personal',
@@ -191,16 +197,24 @@ export function checkFlags(verb, args = []) {
   if (!unknown.length) return null
 
   const flag = unknown[0]
-  // ⭐ `--backend` and `--token` are not typos on these verbs — they are RETIRED
-  // (2026-09-21), and the useful answer is what replaced them, not "run --help".
-  if (flag === '--backend') {
+  // ⭐ `--backend`, `--server` and `--token` are not typos on these verbs — they aim a
+  // command or pick its identity, which only the login does (2026-09-21), and `--backend`
+  // is `--server` since 2026-10-07. The useful answer is where each went, not "run --help".
+  if (flag === '--backend' && verb === 'forget') {
+    return {
+      flag,
+      suggestion: '--server',
+      message: '`--backend` is now `--server`: uniweb forget --server <url>'
+    }
+  }
+  if (flag === '--backend' || flag === '--server') {
     return {
       flag,
       suggestion: null,
       message: [
-        `\`uniweb ${verb}\` has no \`--backend\`: it goes to the backend you are logged in to.`,
-        '  Switch with: uniweb login --backend <url>',
-        '  (A script can aim one process with UNIWEB_REGISTER_URL instead.)'
+        `\`uniweb ${verb}\` has no \`${flag}\`: it goes to the backend you are logged in to.`,
+        '  Switch with: uniweb login --server <url>',
+        '  (A script can aim one process with UNIWEB_SERVER instead.)'
       ].join('\n')
     }
   }
@@ -210,7 +224,7 @@ export function checkFlags(verb, args = []) {
       suggestion: null,
       message: [
         `\`uniweb ${verb}\` has no \`--token\`: it uses the session of the backend you are logged in to.`,
-        '  Sign in with a token: uniweb login --backend <url> --token <bearer>',
+        '  Sign in with a token: uniweb login --server <url> --token <bearer>',
         '  (A script can authenticate one process with UNIWEB_TOKEN instead.)'
       ].join('\n')
     }

package/src/utils/site-identity.js

@@ -116,8 +116,8 @@ export function syncedElsewhere(siteDir, origin) {
 
 /**
  * The heads-up for `syncedElsewhere`, as lines — each verb prints them with its own
- * reporter. Only worth saying when the verb was not TOLD where to go: a `--backend` the
- * user typed is already a decision.
+ * reporter. Only worth saying when the verb was not TOLD where to go: a backend named with
+ * UNIWEB_SERVER is already a decision.
  *
  * ⚖️ Worded for where the verb GOES, not for why: it is the logged-in backend, or — logged
  * in nowhere — the default one, where the login it is about to ask for will be.
@@ -130,7 +130,7 @@ export function describeSyncedElsewhere(known, origin, verb) {
   const where = known.length === 1 ? `site is on ${known[0]}` : `sites are on ${known.join(', ')}`
   return [
     `This project's ${where} — not on ${origin}, where this ${verb} goes.`,
-    `It creates a new site there. To ${verb} to ${known.length === 1 ? 'that one' : 'one of those'} instead: uniweb login --backend <url>`
+    `It creates a new site there. To ${verb} to ${known.length === 1 ? 'that one' : 'one of those'} instead: uniweb login --server <url>`
   ]
 }
 

package/src/utils/yaml-edit.js

@@ -1,115 +0,0 @@
-/**
- * In-place edits to a YAML file a person wrote (`site.yml`), for a command that
- * must change one value and leave everything else as it was: comments, key
- * order, blank lines, quoting, a flow list written on one line.
- *
- * ⛔ Never load a hand-written file and dump it back. js-yaml's `dump` drops every
- * comment and re-flows lists and long strings — `scaffold.js` records what that
- * did to the templates whose comments are the point of them.
- *
- * ⭐ Every edit is VERIFIED: the edited text must parse to exactly the old data
- * with that one value changed. A value written in a form the line-level edit
- * cannot reach (a block scalar, an entry split across lines) returns null
- * rather than a guess, so the caller can refuse before it changes anything.
- */
-
-import { isDeepStrictEqual } from 'node:util'
-import yaml from 'js-yaml'
-
-const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-
-/** A scalar as written after `key: `, quoted only when YAML needs it (`@scope/name` does). */
-const scalar = (value) => yaml.dump(value, { lineWidth: -1 }).trim()
-
-/**
- * Where a trailing ` # comment` begins in the text after `key:`, outside quotes,
- * including the whitespace before it. -1 when the line has none.
- */
-function commentStart(rest) {
-  let quote = null
-  for (let i = 0; i < rest.length; i++) {
-    const ch = rest[i]
-    if (quote) {
-      if (ch === quote) quote = null
-    } else if (ch === '"' || ch === "'") {
-      quote = ch
-    } else if (ch === '#' && i > 0 && /\s/.test(rest[i - 1])) {
-      let start = i
-      while (start > 0 && /\s/.test(rest[start - 1])) start--
-      return start
-    }
-  }
-  return -1
-}
-
-/** The edited text when it parses to `expected`, else null. */
-function verified(after, expected) {
-  try {
-    return isDeepStrictEqual(yaml.load(after) ?? {}, expected) ? after : null
-  } catch {
-    return null
-  }
-}
-
-function load(text) {
-  try {
-    const data = yaml.load(text) ?? {}
-    return data && typeof data === 'object' && !Array.isArray(data) ? data : null
-  } catch {
-    return null
-  }
-}
-
-/**
- * Set a top-level, one-line scalar `key` to `value`, keeping the line's inline
- * comment and every other line as it was.
- *
- * @param {string} text - the file's contents
- * @param {string} key - a top-level key, e.g. `foundation`
- * @param {string} value
- * @returns {string|null} the new contents, or null when the edit cannot be made in place
- */
-export function setTopLevelScalar(text, key, value) {
-  const data = load(text)
-  if (!data) return null
-  const match = new RegExp(`^${escapeRegex(key)}:([^\\n]*)$`, 'm').exec(text)
-  if (!match) return null
-  const at = commentStart(match[1])
-  const comment = at === -1 ? '' : match[1].slice(at)
-  const line = `${key}: ${scalar(value)}${comment}`
-  const after = text.slice(0, match.index) + line + text.slice(match.index + match[0].length)
-  return verified(after, { ...data, [key]: value })
-}
-
-/**
- * Replace entries of a top-level list `key` — each `from` value becomes its `to`
- * — wherever an entry is written on a line of its own or inside a one-line flow
- * list, plain or quoted. A value that only CONTAINS `from` is left alone, and so
- * is a comment line.
- *
- * @param {string} text - the file's contents
- * @param {string} key - a top-level list key, e.g. `extensions`
- * @param {Map<string, string>} replacements - old entry → new entry
- * @returns {string|null} the new contents, or null when the edit cannot be made in place
- */
-export function replaceInTopLevelList(text, key, replacements) {
-  const data = load(text)
-  if (!data || !Array.isArray(data[key])) return null
-  const expected = { ...data, [key]: data[key].map((v) => (replacements.has(v) ? replacements.get(v) : v)) }
-
-  const after = text
-    .split('\n')
-    .map((line) => {
-      if (/^\s*#/.test(line)) return line
-      for (const [from, to] of replacements) {
-        const f = escapeRegex(from)
-        line = line
-          .replace(new RegExp(`'${f}'`, 'g'), () => `'${to.replace(/'/g, "''")}'`)
-          .replace(new RegExp(`"${f}"`, 'g'), () => JSON.stringify(to))
-          .replace(new RegExp(`(^|[\\s\\[,])${f}(?=$|[\\s,\\]])`, 'g'), (_, lead) => lead + to)
-      }
-      return line
-    })
-    .join('\n')
-  return verified(after, expected)
-}