uniweb 1.0.0 → 1.0.2

package/src/utils/site-content-refs.js

@@ -0,0 +1,23 @@
+/**
+ * Dep-free reader for the foundation ref the backend populates on a site-content
+ * document.
+ *
+ * Kept free of `@uniweb/build` so it's importable from `clone` (global, runs before a
+ * project exists) — the same constraint that keeps utils/placement.js dependency-free.
+ *
+ * The site-content `$`-document carries, on its `info` brief, the `foundation` ref the
+ * backend fills in when it wires a site. The reader is tolerant — a backend field
+ * rename should degrade, not crash — and is the single adjust-point if the wire field
+ * name settles differently. (The site's `@uniweb/folder` is NOT read here: the backend
+ * resolves it from the site-content uuid, so the framework never holds a folder uuid.)
+ */
+
+/**
+ * The site's foundation ref — a URL or our `@ns/name@ver`. Written verbatim into
+ * site.yml; the runtime loads it as a federated module.
+ */
+export function extractFoundationRef(info = {}, document = {}) {
+  return (
+    info?.foundation ?? info?.foundation_name ?? document?.foundation ?? null
+  )
+}

package/src/utils/site-copies.js

@@ -0,0 +1,123 @@
+/**
+ * Is this project a copy of another one in the same workspace?
+ *
+ * A plain directory copy carries `sync.json`, so the copy holds the ORIGINAL's site
+ * on every backend the original synced with — and its first push updates that site.
+ * `uniweb forget --all` in the copy is the fix. This is how the CLI notices a copy in
+ * which nobody ran it, before the push goes out.
+ *
+ * ## The signal, and why it is exact
+ *
+ * **Two directories in one workspace holding the same site uuid on the same
+ * backend.** Every create mints a new site, so two directories can only name one site
+ * if one got it from the other. Whichever of them pushes, the other is a stale copy
+ * of the same site waiting to overwrite it — so refusing is right from both sides.
+ *
+ * ## Why only within a workspace
+ *
+ * A teammate's clone holds the same site too, and legitimately: it IS the same
+ * project. A clone is a separate checkout, so it is never scanned. The price is the
+ * case this cannot see: a copy placed outside the workspace is byte-for-byte a clone,
+ * and nothing on disk tells them apart.
+ *
+ * ## Where it looks
+ *
+ * The workspace root and two levels below it — where sites live (`site/`, `sites/*`)
+ * and where a copy usually lands — plus this site's own siblings, for a site deeper
+ * than that. Dot-directories, `node_modules` and `dist` are skipped, and the walk is
+ * bounded, so a workspace root found somewhere unexpected costs a few milliseconds,
+ * not a disk scan.
+ */
+
+import { existsSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, relative } from 'node:path'
+import { findWorkspaceRoot } from './workspace.js'
+import { normalizeOrigin, readSiteIdentity } from './site-identity.js'
+
+const SKIP = new Set(['node_modules', 'dist'])
+const MAX_ENTRIES = 5000
+
+const real = (p) => {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
+const within = (dir, root) => {
+  const rel = relative(root, dir)
+  return !rel.startsWith('..') && !isAbsolute(rel)
+}
+
+/** Directories holding a `sync.json`, `depth` levels below `dir` at most. */
+function collect(dir, depth, out, budget) {
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (--budget.left < 0) return
+    if (!entry.isDirectory() || entry.name.startsWith('.') || SKIP.has(entry.name)) continue
+    const child = join(dir, entry.name)
+    if (existsSync(join(child, 'sync.json'))) out.add(child)
+    if (depth > 1) collect(child, depth - 1, out, budget)
+  }
+}
+
+/**
+ * The other directories in this workspace that hold this site's site on `origin`.
+ *
+ * @param {string} siteDir
+ * @param {string} origin - the backend a push is about to go to
+ * @returns {string[]} absolute paths, sorted; `[]` when the site has no identity on
+ *   that backend yet (its push will create one), or it is in no workspace
+ */
+export function findSiteCopies(siteDir, origin) {
+  const key = normalizeOrigin(origin)
+  const mine = key ? readSiteIdentity(siteDir, key).uuid : null
+  if (!mine) return []
+  const root = findWorkspaceRoot(siteDir)
+  if (!root) return []
+
+  const candidates = new Set()
+  const budget = { left: MAX_ENTRIES }
+  if (existsSync(join(root, 'sync.json'))) candidates.add(root)
+  collect(root, 2, candidates, budget)
+  const parent = dirname(siteDir)
+  if (real(siteDir) !== real(root) && within(parent, root)) collect(parent, 1, candidates, budget)
+
+  const self = real(siteDir)
+  const found = []
+  for (const dir of candidates) {
+    if (real(dir) === self) continue
+    if (readSiteIdentity(dir, key).uuid === mine) found.push(dir)
+  }
+  return found.sort()
+}
+
+/**
+ * What to tell the person, as a headline and detail lines — each verb prints them
+ * with its own reporter.
+ *
+ * ⚖️ It cannot say WHICH directory is the copy: the two are identical, which is the
+ * whole problem. The person knows, because they made it.
+ *
+ * @param {string[]} copies - from findSiteCopies
+ * @param {string} origin
+ * @param {'push'|'publish'} verb
+ */
+export function describeSiteCopies(copies, origin, verb) {
+  const here = (dir) => relative(process.cwd(), dir) || '.'
+  return {
+    headline: `Another project in this workspace holds the same site on ${origin}:`,
+    lines: [
+      ...copies.map((dir) => `  ${here(dir)}`),
+      `One of them is a copy of the other, so a ${verb} from either one updates that site.`,
+      'In the copy, run:  uniweb forget --all',
+      `The copy then ${verb === 'publish' ? 'publishes' : 'pushes'} as a new site. The original needs nothing.`
+    ]
+  }
+}

package/src/utils/site-data-upload.js

@@ -0,0 +1,302 @@
+/**
+ * Static collection data — the passthrough lane.
+ *
+ * A site's **schema-less** queries have no entity model, so their compiled
+ * `dist/data/**` JSON is delivered as files rather than synced as entities.
+ * This plans and uploads that set: one plan call, one object per file, each
+ * PUT to the target the backend returns.
+ *
+ *   1. PLAN   — POST {apiBase}/dev/site/data-uploads/{site} with the file list
+ *               ({ path, content_type, size, sha256 }). Response carries
+ *               `mode` ('presigned' | 'direct'), `expires_in`, `serve_base`,
+ *               and one `uploads` entry per file ({ path, method, url, headers }).
+ *   2. UPLOAD — PUT each file's bytes to its URL. Order is irrelevant; there is
+ *               no entry file and no server confirm step.
+ *
+ * ⭐ **`path` is the SERVING TAIL** (`data/articles.json`), not a bookkeeping
+ * key. The file lands where it is served — which is the whole point of this
+ * lane, and why it returns no map: nothing has to record where anything went.
+ *
+ * ## Why this is not the asset lane
+ *
+ * Assets are **content-addressed, and dedup across the sites of one backend**
+ * — so the relation from a site's path to an object is many-to-one and a serve
+ * path cannot be a property of the object. *("Global" names that dedup scope; it
+ * never meant across backends — see utils/asset-upload.js.)* This lane is **per-site and
+ * path-addressed**. Sending static data through the asset store is what forced
+ * the old "data ball": one bundled asset the backend had to fetch, parse and
+ * fan out, which is the only place these bytes ever transited it.
+ *
+ * ⇒ **The backend is a PASSTHROUGH here** — it brokers the authorization, not
+ * the bytes. Hosting static content is the hosting platform's mission where an
+ * edge exists; where there is none (edgeless), the backend serves them itself,
+ * and that is the posture working rather than a fallback.
+ *
+ * ⛔ **Do not compose paths onto `serve_base`.** It is `null` on the presigned
+ * arm (prod serving is the delivery tier's URL shape, not the backend's to
+ * mint) and the gateway's data route on the direct arm. Nothing in a build
+ * needs it — the site's fetcher asks for a site-relative `/data/{path}` at
+ * runtime — so it is returned for parity and for a caller that wants to verify
+ * an upload landed.
+ *
+ * Contract ratified with the backend lane, 2026-08-18.
+ * **Wired into `publish.js` and shipped in `uniweb` 0.25.3.** Both arms of the
+ * endpoint exist (presigned landed 2026-08-18, per Diego).
+ *
+ * ⚠️ **The presigned arm has never been exercised against a real backend from
+ * here.** The branch is one line and unit-tested both ways, but a stub is not a
+ * presigning deployment — three claims diverged that way in a single day while
+ * this lane was being built. A local `uniwebd` answers `direct`, so proving it
+ * needs a presigning deployment and one real publish. **Believed correct, not
+ * demonstrated.**
+ */
+
+import { WORKSPACE_HEADER } from '../backend/client.js'
+import { createHash } from 'node:crypto'
+import { humanBytes } from './bytes.js'
+import { fetchWithRetry, isTransientStatus } from './fetch-retry.js'
+
+/**
+ * Plan + upload a site's static collection data files.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiBase - backend origin
+ * @param {string} opts.token - bearer, used on the direct arm only
+ * @param {string} opts.siteUuid - the site these files belong to (path segment)
+ * @param {string|null} [opts.workspace] - the workspace the requests name, `@handle`
+ *   (`x-uniweb-workspace`) — on the plan and on every DIRECT PUT, never on a presigned
+ *   one, which is self-authorizing and must carry nothing it was not signed with
+ * @param {{ data: Record<string, unknown> }|null} opts.ball - source of the set:
+ *   `{ "<relpath under dist/data>": <json> }`, media refs already rewritten
+ * @param {(m: string) => void} [opts.onProgress]
+ * @returns {Promise<{ mode: string, uploaded: string[], failed: Array<{path:string,status:number,detail?:string}>, serveBase: string|null }>}
+ *   **No map** — by design. The files are at their serving paths.
+ */
+export async function uploadSiteData({
+  apiBase,
+  token,
+  siteUuid,
+  workspace = null,
+  ball,
+  onProgress = () => {}
+}) {
+  // A plan made with the header mints BARE PUT urls: the PUT names its workspace with
+  // the header like every other request (backend, 2026-09-23).
+  const workspaceHeader = workspace ? { [WORKSPACE_HEADER]: workspace } : {}
+  // ⛔ An EMPTY set still posts a plan, and that is the whole point of this lane
+  // being a manifest rather than a stream of files.
+  //
+  // The backend reconciles a site's data usage against what this plan declares:
+  // whatever is not in the manifest is gone, so deleting a collection stops
+  // costing on the next publish. ⭐ A plan with zero files is a STATEMENT that
+  // there are none; the ABSENCE of a request says nothing at all. Returning
+  // early here — which this did until 2026-09-01 — made "the user deleted their
+  // last schema-less collection" unexpressible on the wire, so that site kept
+  // paying for bytes it no longer served until the whole site was deleted.
+  // Nothing looked wrong at either end: no error, no warning, just a request
+  // that was never sent.
+  //
+  // Agreed both sides in channel backend↔framework; the backend's plan
+  // route accepted an empty `files` array in the same exchange (it was a 400
+  // before, which is what made the omission look like the only option).
+  const entries = Object.entries(ball?.data || {})
+
+  // One plan for the whole set. The per-request file cap counts a plan, so
+  // splitting would evade it rather than respect it; if a set ever exceeds it,
+  // the refusal is the correct outcome and the cap is the thing to fix.
+  const files = entries.map(([relPath, value]) => {
+    const bytes = Buffer.from(JSON.stringify(value))
+    return {
+      // ⚠️ The tail RELATIVE TO THE DATA ROOT — no `data/` prefix.
+      //
+      // The plan's `serve_base` already ends in `/data/`
+      // (`/gateway/site/{site}/data/`), and the runtime asks for
+      // `{config.base}/data/{name}.json` (`DATA_URL_PREFIX`). Sending
+      // `data/articles.json` would store one level too deep and serve at
+      // `…/data/data/articles.json`, which the runtime never requests.
+      //
+      // ⛔ And the failure is INVISIBLE from here: the plan succeeds, the PUT
+      // succeeds, and only a visitor's fetch 404s. Confirmed against the
+      // shipped contract's own example (`data/articles.json` with a
+      // `/data/`-bearing `serve_base`), which supersedes an earlier
+      // parenthetical that showed the prefix.
+      path: relPath,
+      content_type: 'application/json',
+      size: bytes.length,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+      bytes
+    }
+  })
+
+  const origin = apiBase.replace(/\/$/, '')
+  // `{site}` is a PATH segment, not a body field — every sibling on this
+  // controller addresses the site that way (`content/push/{site}`,
+  // `publish/{site}`, `status/{site}`). The asset lane's body-borne owner is
+  // the wrong precedent: that lane is global, this one is per-site.
+  const planRes = await fetch(
+    `${origin}/dev/site/data-uploads/${encodeURIComponent(siteUuid)}`,
+    {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`,
+        ...workspaceHeader
+      },
+      body: JSON.stringify({
+        files: files.map(({ path, content_type, size, sha256 }) => ({
+          path,
+          content_type,
+          size,
+          sha256
+        }))
+      })
+    }
+  )
+  if (!planRes.ok) {
+    const body = await planRes.text().catch(() => '')
+    // The PARSED problem document has to survive the throw. Flattening it into
+    // the message is what left the other two doors unable to branch on `reason`
+    // and printing raw JSON at users; this lane was the last one still doing it.
+    // Callers read `err.problem`; `describeDataRefusal` turns it into lines.
+    let problem = null
+    if (body) {
+      try {
+        const parsed = JSON.parse(body)
+        if (parsed && typeof parsed === 'object') problem = parsed
+      } catch {
+        /* not a problem document — prose refusal, or an upstream error page */
+      }
+    }
+    const err = new Error(
+      `site data-uploads plan rejected: HTTP ${planRes.status}${body ? ` — ${body.slice(0, 300)}` : ''}`
+    )
+    err.status = planRes.status
+    err.problem = problem
+    throw err
+  }
+
+  const plan = await planRes.json()
+  const targets = new Map((plan.uploads || []).map((u) => [u.path, u]))
+  // The one mode-aware bit, same rule as the code and runtime lanes: a direct
+  // PUT is a bearer-authed backend route; a presigned URL is self-authorizing
+  // and must NOT carry a foreign bearer, which can break signature validation.
+  const authHeaders =
+    plan.mode === 'presigned'
+      ? {}
+      : { Authorization: `Bearer ${token}`, ...workspaceHeader }
+
+  const uploaded = []
+  const failed = []
+  for (const f of files) {
+    const target = targets.get(f.path)
+    if (!target) {
+      // A file the plan did not answer for is unaddressable. Report it; never
+      // invent a location for it.
+      failed.push({
+        path: f.path,
+        status: 0,
+        detail: 'no upload target in plan'
+      })
+      continue
+    }
+    try {
+      // Relative on the direct arm, absolute on presigned — `new URL` resolves
+      // both against the origin.
+      // ⭐ **Retried.** A single connection-level failure used to fail the whole
+      // verb after every other file had already gone up. The PUT is idempotent
+      // here — same bytes, same target, verified by `x-uniweb-sha256` on receipt
+      // — so repeating it is safe by construction, which is why this opts in to
+      // `retryOnStatus` rather than inheriting it.
+      //
+      // ⚠️ 120s per attempt, not the helper's 30s default: this bounds the time
+      // to send a whole BODY, and aborting a legitimately slow upload only to
+      // retry it is worse than not timing out at all.
+      const res = await fetchWithRetry(new URL(target.url, origin), {
+        method: target.method || 'PUT',
+        headers: {
+          'Content-Type': 'application/json',
+          ...(target.headers || {}),
+          ...authHeaders
+        },
+        body: f.bytes
+      }, { timeoutMs: 120_000, retryOnStatus: isTransientStatus })
+      if (res.ok) {
+        uploaded.push(f.path)
+        onProgress(`${f.path}`)
+      } else {
+        failed.push({ path: f.path, status: res.status })
+      }
+    } catch (err) {
+      failed.push({ path: f.path, status: 0, detail: err.message })
+    }
+  }
+
+  return {
+    mode: plan.mode || 'direct',
+    uploaded,
+    failed,
+    serveBase: plan.serve_base || null
+  }
+}
+
+/**
+ * Turn a typed data-uploads refusal into user-facing lines, or null when there is
+ * no typed `reason` (⇒ fall through to the generic message, degrading rather than
+ * swallowing).
+ *
+ * ⭐ The THIRD door, and the last to get one. `/dev/assets` has
+ * `describeAssetRefusal`, `POST /dev/site` has `describeCreateRefusal`, and this
+ * lane threw prose with the JSON inlined until 2026-09-01 — which is the failure
+ * the other two describers exist to prevent, so leaving it was just an untreated
+ * instance of a solved problem.
+ *
+ * ⛔ Branch on `reason`, never the status: `507` alone cannot be told from any
+ * other `507` and carries none of the numbers, and `detail` is prose the backend
+ * may reword.
+ *
+ * ⚖️ **The advice DIVERGES from the asset lane's, and that divergence is the whole
+ * reason this is a separate function rather than a reused one.** On the asset lane
+ * removing an image frees nothing — freeing is entity-deletion-granular. Here the
+ * publish declares the COMPLETE set of schema-less data files every time, so
+ * dropping a collection and re-publishing is a real way to stop paying for it.
+ * Telling a data user "editing content frees nothing" would be false, and telling
+ * an asset user "just remove it" would be worse.
+ *
+ * @param {Error & { problem?: object|null }} err
+ * @returns {{ headline: string, notes: string[] } | null}
+ */
+export function describeDataRefusal(err) {
+  const p = err?.problem
+  const reason = p?.reason
+  if (typeof reason !== 'string') return null
+
+  if (reason === 'storage_quota_exceeded') {
+    const notes = []
+    const used = humanBytes(p.used_bytes)
+    const limit = humanBytes(p.limit_bytes)
+    const needed = humanBytes(p.needed_bytes)
+    if (used) notes.push(`  Used: ${used}`)
+    if (limit) notes.push(`  Limit: ${limit}`)
+    if (needed) notes.push(`  This publish adds: ${needed}`)
+    notes.push(
+      'Every publish declares the full set of schema-less data files, so removing'
+    )
+    notes.push(
+      'a collection and re-publishing stops it counting. Deleting a site or entity'
+    )
+    notes.push('frees space too.')
+    return {
+      headline:
+        "Storage quota reached — the site owner's workspace cannot take on more record data.",
+      notes
+    }
+  }
+
+  // An unrecognised reason still beats a status dump: name it, and let the
+  // backend's own prose follow when it sent any.
+  const detail = typeof p.detail === 'string' ? p.detail : ''
+  return {
+    headline: `Record data upload refused by the backend (${reason}).`,
+    notes: detail ? [`  ${detail}`] : []
+  }
+}

package/src/utils/site-identity.js

@@ -0,0 +1,137 @@
+/**
+ * The project's backend-minted identity — read from `sync.json`, never from `site.yml`.
+ *
+ * ⭐ **`site.yml` holds nothing a backend minted, as of 2026-09-20.** It carried
+ * `$uuid`, `$org` and `$backend`; all three moved to
+ * `sync.json::backends.<origin>.site`, keyed by the backend that minted them.
+ * Spec: `kb/framework/reference/sync-json.md`. Why:
+ * `kb/framework/plans/backend-scoped-project-state.md`.
+ *
+ * ## ⛔ What is GONE, and why nothing replaces it
+ *
+ * `assertSiteBackendScope` refused a command whose resolved origin disagreed with
+ * the project's recorded `$backend`. It existed because ONE `$uuid` sat in
+ * `site.yml` with no way to say which backend it was for, so it could be read
+ * against the wrong one and sent there.
+ *
+ * ⭐ **Keyed by origin that is unrepresentable.** A command for backend B reads B's
+ * section and finds B's ids or nothing at all. There is no configuration in which
+ * A's identity reaches B, so there is no mismatch to detect, no stop to print, and
+ * no accepted false positive to live with. The guard is not replaced; the shape it
+ * guarded against stopped existing.
+ *
+ * `recordSiteBackend` and `$backend` went with it: the store's KEY is the scope.
+ *
+ * ## ⛔ NO STATIC `@uniweb/build` IMPORT
+ *
+ * This module is reachable from the CLI's startup graph, and `@uniweb/build` is an
+ * OPTIONAL PEER — a static import makes `uniweb --version` die with
+ * ERR_MODULE_NOT_FOUND on a global install (`test/smoke-startup.test.js` catches it).
+ *
+ * ⭐ **`sync.json` is plain JSON, so reading it needs no parser and no dependency.**
+ * That is the whole reason the format is JSON rather than YAML: `site.yml`'s
+ * equivalent needed a hand-rolled dependency-free fallback WRITER to survive the
+ * same constraint. Writes go through `@uniweb/build/uwx`'s store, which is the one
+ * implementation; this file only reads.
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { DEFAULT_BACKEND_ORIGIN } from './config.js'
+
+/** A bare origin with no trailing slash, or null when unparseable. */
+export function normalizeOrigin(value) {
+  if (typeof value !== 'string' || !value.trim()) return null
+  try {
+    // http(s) only — `localhost:8080` parses as a scheme with the origin "null".
+    const u = new URL(value)
+    return u.protocol === 'http:' || u.protocol === 'https:' ? u.origin : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * `sync.json`'s backends map, or `{}`. Read-only, dependency-free — see the header.
+ *
+ * ⚠️ A second READER of a format whose writer lives in `@uniweb/build`. Deliberate,
+ * and bounded: it parses one object and normalizes its keys. The shape it assumes is
+ * exactly what `sync-store.js` writes, and `test/two-backends.test.js` drives both.
+ */
+function readBackends(siteDir) {
+  const p = join(siteDir, 'sync.json')
+  if (!existsSync(p)) return {}
+  try {
+    const parsed = JSON.parse(readFileSync(p, 'utf8'))
+    const backends = parsed?.backends
+    if (!backends || typeof backends !== 'object' || Array.isArray(backends)) return {}
+    const out = {}
+    for (const [origin, state] of Object.entries(backends)) {
+      const key = normalizeOrigin(origin)
+      if (key && state && typeof state === 'object') out[key] = state
+    }
+    return out
+  } catch {
+    return {}
+  }
+}
+
+/**
+ * The identity this project holds for ONE backend.
+ *
+ * @param {string} siteDir
+ * @param {string} origin
+ * @returns {{ uuid: string|null, org: string|null }}
+ */
+export function readSiteIdentity(siteDir, origin) {
+  const key = normalizeOrigin(origin)
+  const site = key ? readBackends(siteDir)[key]?.site : null
+  const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null)
+  return { uuid: str(site?.uuid), org: str(site?.org) }
+}
+
+/** Every backend this project has synced with, sorted. */
+export function syncedBackends(siteDir) {
+  return Object.keys(readBackends(siteDir)).sort()
+}
+
+/**
+ * The backends this project HAS synced with, when `origin` is not one of them — or null.
+ *
+ * Every backend verb goes to the backend the user is logged in to *[Diego, 2026-09-21]*,
+ * so it can land where this project has no site while it has one elsewhere. A push
+ * there CREATES a second site rather than updating the one the project knows, and the
+ * owner question it asks does not say why — this is what lets the verb say it first.
+ *
+ * @param {string} siteDir
+ * @param {string} origin - where the verb resolved to
+ * @returns {string[]|null}
+ */
+export function syncedElsewhere(siteDir, origin) {
+  const key = normalizeOrigin(origin)
+  const known = syncedBackends(siteDir)
+  if (!key || !known.length || known.includes(key)) return null
+  return known
+}
+
+/**
+ * The heads-up for `syncedElsewhere`, as lines — each verb prints them with its own
+ * reporter. Only worth saying when the verb was not TOLD where to go: a backend named with
+ * UNIWEB_SERVER is already a decision.
+ *
+ * ⚖️ Worded for where the verb GOES, not for why: it is the logged-in backend, or — logged
+ * in nowhere — the default one, where the login it is about to ask for will be.
+ *
+ * @param {string[]} known
+ * @param {string} origin
+ * @param {'push'|'publish'} verb
+ */
+export function describeSyncedElsewhere(known, origin, verb) {
+  const where = known.length === 1 ? `site is on ${known[0]}` : `sites are on ${known.join(', ')}`
+  return [
+    `This project's ${where} — not on ${origin}, where this ${verb} goes.`,
+    `It creates a new site there. To ${verb} to ${known.length === 1 ? 'that one' : 'one of those'} instead: uniweb login --server <url>`
+  ]
+}
+
+export { DEFAULT_BACKEND_ORIGIN }