uniweb 1.21.0 → 1.21.2

package/src/commands/status.js

@@ -16,9 +16,11 @@
  *   dev      the dev server
  *
  * ⛔ READ-ONLY, AND IT NEVER PROMPTS. It signs nobody in — with no session it says how — and
- * writes nothing a later command reads as taken: no ETag, version or hash
- * (`backend/app-changes.js`). Its one write is the user-level npm cache `update` and
- * `--version` keep. A check it could not make is `unknown`, never `ok`.
+ * writes nothing a later command reads as taken: no ETag, version, hash or sync point
+ * (`probePull`, `backend/app-changes.js`). It writes the user-level npm cache `update` and
+ * `--version` keep, and — for a foundation named by catalog ref — the registered version's
+ * section types a pull keeps, which never change. A check it could not make is `unknown`,
+ * never `ok`.
  *
  * ⛔ THE GUARDS ARE THE VERBS' OWN. Where status says a push would be refused, it says so
  * from the function the push calls (`unsettledFiles`, `uncommittedContent`, `untakenBase`),
@@ -39,8 +41,9 @@
  * (`utils/flag-guard.js`).
  */
 
+import { execFileSync } from 'node:child_process'
 import { existsSync, readFileSync } from 'node:fs'
-import { join, relative, resolve } from 'node:path'
+import { basename, join, relative, resolve } from 'node:path'
 import yaml from 'js-yaml'
 
 import {
@@ -56,7 +59,9 @@ import {
 import { describeWorkspace, resolveWorkspace, SOURCE_LABEL } from '../backend/workspace.js'
 import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
 import { readAppChanges } from '../backend/app-changes.js'
-import { readBackendState } from '@uniweb/build/uwx'
+import { probePull } from './pull.js'
+import { readOrgFlag } from '../utils/args.js'
+import { listSyncedBackends, readBackendState } from '@uniweb/build/uwx'
 import { resolveLocalFoundation, foundationScopedName } from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { compareSemverPrecedence } from '../utils/semver-precedence.js'
@@ -248,7 +253,7 @@ async function gitChecks(siteDir, { offline, origin }) {
         ? 'The git repository around this folder ignores it, so a pull here takes the backend\'s version over your files, asking first.'
         : 'Not a git repository, so a pull here takes the backend\'s version over your files, asking first.'
     })
-    return { checks, proposals, localFiles: null }
+    return { checks, proposals, localFiles: null, repo: false }
   }
   checks.push({ id: 'git.repo', state: 'ok', summary: `In the git repository at ${repo.top}.`, quiet: true })
 
@@ -334,7 +339,7 @@ async function gitChecks(siteDir, { offline, origin }) {
     if (moved) proposals.push({ step: 'refresh', command: 'npx uniweb refresh', why: "take your teammates' commits" })
     if (counts.ahead) proposals.push({ step: 'gitpush', command: 'git push', why: `share ${count(counts.ahead, 'commit')} with your team`, ask: true })
   }
-  return { checks, proposals, localFiles, uncommitted: Boolean(uncommitted), merging }
+  return { checks, proposals, localFiles, uncommitted: Boolean(uncommitted), merging, repo: Boolean(repo.head) }
 }
 
 /**
@@ -488,9 +493,24 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
     summary: `Signed in to ${origin}${session.handle ? ` as @${String(session.handle).replace(/^@/, '')}` : ''}, working in ${describeWorkspace(ws.workspace)} (${SOURCE_LABEL[ws.source] || ws.source}).`
   })
 
+  // ⭐ WHAT CHANGED ON THE BACKEND, AS A PULL WOULD TAKE IT. In a repository, the pull itself,
+  // stopped before it takes anything (`probePull`): the files it would change, translations
+  // and records included. Where it cannot answer — outside git, no sync point to merge from —
+  // the backend's units against this copy's last sync (`backend/app-changes.js`).
+  const readChanges = async () => {
+    if (git.repo) {
+      const org = readOrgFlag(args)
+      const probed = await probePull([...(org ? ['--org', org] : []), ...(args.includes('--personal') ? ['--personal'] : [])], {
+        resolveSiteDir: async () => siteDir,
+        getToken: async () => session.token
+      })
+      if (probed) return { probe: probed }
+    }
+    return readAppChanges({ client, siteDir, siteUuid: uuid })
+  }
   const [state, changes, foundation] = await Promise.all([
     uuid ? client.siteState(uuid) : null,
-    uuid ? readAppChanges({ client, siteDir, siteUuid: uuid }).catch((err) => ({ error: err })) : null,
+    uuid ? readChanges().catch((err) => ({ error: err })) : null,
     foundationCheck(siteDir, siteYml, client).catch(() => null)
   ])
 
@@ -532,14 +552,35 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
 
   const site = state?.site
   if (site) {
+    // ⭐ WHERE THE SITE IS LIVE IS THE BACKEND'S TO SAY, never deploy.yml's: a receipt is
+    // what this copy published, and a publish from the app or another copy does not move it.
+    // ⛔ `last_published_url` outlives an unpublish (`client.siteStatus`), so it is said as
+    // where the site WAS live when it is not live now — never as where it is.
+    const url = typeof site.last_published_url === 'string' && site.last_published_url ? site.last_published_url : null
+    const when = site.last_published_at ? sinceLabel(site.last_published_at, Date.now()) : null
+    const at = `${url ? ` at ${url}` : ''}${when ? `, published ${when}` : ''}`
+    const detail = {
+      published: Boolean(site.published),
+      url,
+      published_at: site.last_published_at ?? null,
+      draft_dirty: Boolean(site.draft_dirty),
+      foundation: site.last_published_foundation ?? null,
+      runtime: site.last_published_runtime ?? null
+    }
     if (!site.published) {
-      checks.push({ id: 'app.live', state: 'attention', summary: 'In the app, not live yet.' })
+      checks.push({
+        id: 'app.live',
+        state: 'attention',
+        summary: `On ${cloudName(origin)}, not live yet.`,
+        lines: url ? [`It was live at ${url} before.`] : [],
+        detail
+      })
       proposals.push({ step: 'publish', command: 'npx uniweb publish', why: 'take the site live — the person decides, and it may ask for payment', ask: true })
     } else if (site.draft_dirty) {
-      checks.push({ id: 'app.live', state: 'attention', summary: 'Live, with changes in the app that are not live yet.' })
+      checks.push({ id: 'app.live', state: 'attention', summary: `Live on ${cloudName(origin)}${at} — the app holds changes that are not live yet.`, detail })
       proposals.push({ step: 'publish', command: 'npx uniweb publish', why: 'make those changes live — the person decides', ask: true })
     } else {
-      checks.push({ id: 'app.live', state: 'ok', summary: 'Live, with the latest content.' })
+      checks.push({ id: 'app.live', state: 'ok', summary: `Live on ${cloudName(origin)}${at}, with the latest content.`, detail })
     }
     // An array is the backend's answer, `[]` included; no key is a backend that does not
     // say, and then neither do we.
@@ -561,14 +602,20 @@ async function appChecks(siteDir, siteYml, { offline, args, git }) {
     }
   }
   if (foundation) checks.push(foundation)
-  return { checks, proposals, backend }
+  return { checks, proposals, backend, site: site ?? null }
 }
 
+/** The name a backend's hosting goes by: Uniweb Cloud on the default backend, its origin elsewhere. */
+const cloudName = (origin) => (origin === DEFAULT_BACKEND_ORIGIN ? 'Uniweb Cloud' : origin)
+
+const CHANGE = { A: 'added', M: 'changed', D: 'removed' }
+
 /** `app.changes`: what moved on the backend, and where it meets what moved here. */
 function changeChecks(siteDir, changes, unpushedFiles, proposals) {
   if (changes.error) {
     return [{ id: 'app.changes', state: 'unknown', summary: `Could not read the site from the backend: ${changes.error.message}` }]
   }
+  if (changes.probe) return probedChanges(changes.probe, unpushedFiles, proposals)
   const { content, records } = changes
   const unknown = [content, records].filter((l) => l.state === 'unknown')
   const files = [
@@ -586,7 +633,7 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
     return [
       unknown.length
         ? { id: 'app.changes', state: 'unknown', summary: `Could not tell what changed on the backend: ${unknown.map((l) => l.detail).join('; ')}.` }
-        : { id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.' }
+        : { id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.', detail: { source: 'units' } }
     ]
   }
   // Where the backend's changes meet this copy's: a push of those is refused until a pull
@@ -605,6 +652,7 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
       lines,
       ...(overlap.length ? { blocks: ['push', 'publish'] } : {}),
       detail: {
+        source: 'units',
         content: { state: content.state, changed: content.changed, added: content.added, removed: content.removed, outsideUnits: content.outsideUnits },
         records: { state: records.state, changed: records.changed, added: records.added, removed: records.removed, folder: records.folder },
         ...(overlap.length ? { overlap } : {}),
@@ -614,6 +662,40 @@ function changeChecks(siteDir, changes, unpushedFiles, proposals) {
   ]
 }
 
+/**
+ * `app.changes` from the pull's own answer (`probePull`): the files it would change, each
+ * as the pull would write it.
+ */
+function probedChanges({ files: list, recordsNotPlaced }, unpushedFiles, proposals) {
+  if (!list.length) {
+    return [{ id: 'app.changes', state: 'ok', summary: 'Nothing changed on the backend since this copy last synced.', detail: { source: 'pull', files: [] } }]
+  }
+  const paths = list.map(([, p]) => p)
+  const files = list.map(([s, p]) => (s === 'A' ? `${p} (new)` : s === 'D' ? `${p} (removed)` : p))
+  // Where the backend's changes meet this copy's: the pull merges them, and a push of those
+  // before it is refused.
+  const overlap = unpushedFiles?.length ? paths.filter((p) => unpushedFiles.includes(p)) : []
+  const n = list.length
+  proposals.push({ step: 'pull', command: 'npx uniweb pull', why: `take the ${count(n, 'file')} changed on the backend` })
+  return [
+    {
+      id: 'app.changes',
+      state: overlap.length ? 'blocking' : 'attention',
+      summary:
+        `${count(n, 'file')} changed on the backend since this copy last synced — in the app, or pushed from another copy.` +
+        (overlap.length ? ` You changed ${count(overlap.length, 'of those files', 'of those files')} here too.` : ''),
+      files,
+      lines: recordsNotPlaced ? ['Some records could not be placed in files — `npx uniweb pull` says which, and why.'] : [],
+      ...(overlap.length ? { blocks: ['push', 'publish'] } : {}),
+      detail: {
+        source: 'pull',
+        files: list.map(([s, p]) => ({ path: p, change: CHANGE[s] || s })),
+        ...(overlap.length ? { overlap } : {})
+      }
+    }
+  ]
+}
+
 /**
  * `app.foundation`: the local foundation against its registered version — what the next
  * push or publish does with it (`backend/foundation-bring-along.js`).
@@ -708,30 +790,462 @@ async function doctorCheck(siteDir) {
   }
 }
 
-/** `dev.server`: the site's dev server, confirmed by asking it. */
-async function devCheck(siteDir, { offline }) {
-  if (offline) return { id: 'dev.server', state: 'skipped', summary: 'The dev server was not asked (--offline).' }
+/**
+ * `dev.server`: the site's dev server, confirmed by asking it — and the command that starts it
+ * for this site. In a workspace with several, a bare `uniweb dev` starts the first one found
+ * (`commands/dev.js`), which may not be this one.
+ */
+async function devCheck(siteDir, { offline, sites = [] }) {
+  const root = findWorkspaceRoot(siteDir) || siteDir
+  const mine = sites.find((s) => resolve(root, s.path) === resolve(siteDir))
+  const first = sites[0]
+  const command = sites.length > 1 && mine && first !== mine ? `npx uniweb dev ${mine.name}` : 'npx uniweb dev'
+  const note = command === 'npx uniweb dev' ? '' : ` (a bare \`uniweb dev\` starts ${first.name})`
+  if (offline) return { id: 'dev.server', state: 'skipped', summary: `The dev server was not asked (--offline); \`${command}\` starts it${note}.`, detail: { command } }
   try {
     const { runningDevServer } = await import('@uniweb/build/site')
     const running = await runningDevServer(siteDir, { timeout: 1000 })
     return running
-      ? { id: 'dev.server', state: 'ok', summary: `The dev server is running at ${running.url}.`, detail: { url: running.url } }
-      : { id: 'dev.server', state: 'skipped', summary: 'The dev server is not running — `npx uniweb dev` starts it.' }
+      ? { id: 'dev.server', state: 'ok', summary: `The dev server is running at ${running.url}.`, detail: { url: running.url, command } }
+      : { id: 'dev.server', state: 'skipped', summary: `The dev server is not running — \`${command}\` starts it${note}.`, detail: { command } }
+  } catch (err) {
+    return { id: 'dev.server', state: 'unknown', summary: `Could not ask the dev server: ${err.message}`, detail: { command } }
+  }
+}
+
+// ─── the project ────────────────────────────────────────────────────────────
+
+/**
+ * The workspace, as its wiring says: the sites and foundations its globs hold, by the build's
+ * classifier (`utils/discover.js`), and the globs themselves.
+ *
+ * ⛔ NO LAYOUT NAME. "Single", "segregated" and the rest are conventions — the globs and the
+ * wiring are the truth — and a name guessed from folders is wrong where a workspace mixes them.
+ */
+async function workspaceFacts(root) {
+  const [{ discoverSites, discoverFoundations }, { readWorkspaceConfig }, { isExtensionPackage }] = await Promise.all([
+    import('../utils/discover.js'),
+    import('../utils/config.js'),
+    import('@uniweb/build')
+  ])
+  const [sites, packages, config] = await Promise.all([
+    discoverSites(root),
+    discoverFoundations(root),
+    readWorkspaceConfig(root).catch(() => ({ packages: [] }))
+  ])
+  const extension = (f) => {
+    try {
+      return isExtensionPackage(join(root, f.path))
+    } catch {
+      return false
+    }
+  }
+  return {
+    root,
+    patterns: Array.isArray(config.packages) ? config.packages : [],
+    sites,
+    foundations: packages.filter((f) => !extension(f)),
+    extensions: packages.filter(extension)
+  }
+}
+
+function workspaceLine(ws) {
+  const { sites, foundations, extensions, patterns } = ws
+  if (sites.length === 1 && foundations.length === 1 && !extensions.length) {
+    return `One site and one foundation in this workspace: ${sites[0].path}/ and ${foundations[0].path}/.`
+  }
+  const parts = [count(sites.length, 'site'), count(foundations.length, 'foundation')]
+  if (extensions.length) parts.push(count(extensions.length, 'extension'))
+  const from = patterns.length ? `, from ${list(patterns)}` : ''
+  return `${parts.slice(0, -1).join(', ')} and ${parts.at(-1)} in this workspace${from}.`
+}
+
+/**
+ * A site's foundation, as the build finds it — the one resolver (`detectFoundationType`), so
+ * what status names is what the build would build. A catalog ref, which a build refuses, is
+ * named as one.
+ */
+async function foundationOf(siteDir, siteYml, root) {
+  const declared = siteYml?.foundation
+  if (!declared) return { kind: 'none' }
+  const name = typeof declared === 'string' ? declared : declared.ref || declared.name || declared.url || null
+  const [{ detectFoundationType }, { parseCatalogRef }] = await Promise.all([import('@uniweb/build'), import('@uniweb/build/uwx')])
+  if (parseCatalogRef(name)) return { kind: 'catalog', name, ref: name }
+  try {
+    const found = detectFoundationType(declared, siteDir)
+    if (found.type === 'local') return { kind: 'local', name: found.name, path: relative(root, found.path) || '.', abs: resolve(found.path) }
+    return { kind: 'url', name, url: found.url }
+  } catch (err) {
+    return { kind: 'unresolved', name, error: String(err?.message || err).split('\n')[0] }
+  }
+}
+
+/** A site's extensions, each where it is found: a folder here, the catalog, or a URL. */
+async function extensionsOf(siteDir, siteYml, root) {
+  const declared = Array.isArray(siteYml?.extensions) ? siteYml.extensions : []
+  if (!declared.length) return []
+  const [{ findSiteExtension, extensionNameOf }, { parseCatalogRef }] = await Promise.all([import('@uniweb/build'), import('@uniweb/build/uwx')])
+  return declared.map((entry) => {
+    const value = entry && typeof entry === 'object' ? entry.url || entry.ref || entry.name : entry
+    if (typeof value !== 'string' || !value) return { value: String(value), kind: 'unresolved' }
+    if (parseCatalogRef(value)) return { value, kind: 'catalog' }
+    if (/^https?:\/\//.test(value)) return { value, kind: 'url' }
+    // A site-relative URL names an extension by its first segment; a bare name is that name.
+    const name = value.startsWith('/') ? extensionNameOf(value, siteYml.base)?.name : value
+    const dir = name ? findSiteExtension(name, siteDir) : null
+    return dir ? { value, kind: 'local', name, path: relative(root, dir) || '.' } : { value, kind: 'unresolved', name: name ?? null }
+  })
+}
+
+/**
+ * `project.*`: where this site sits — the workspace's sites and foundations, the foundation it
+ * is built with and what else uses it, its extensions, pages it takes from outside its folder,
+ * and the languages it is written in. All from files: no request.
+ */
+async function projectChecks(siteDir, siteYml) {
+  const inWorkspace = Boolean(findWorkspaceRoot(siteDir))
+  const root = findWorkspaceRoot(siteDir) || siteDir
+  const ws = await workspaceFacts(root)
+  const checks = []
+  checks.push({
+    id: 'project.workspace',
+    state: 'ok',
+    summary: inWorkspace ? workspaceLine(ws) : 'This site is on its own, in no workspace.',
+    detail: { patterns: ws.patterns, sites: ws.sites, foundations: ws.foundations, extensions: ws.extensions }
+  })
+
+  // ⭐ The foundation, and what a change to it reaches: every site that resolves to the same one.
+  const fnd = await foundationOf(siteDir, siteYml, root)
+  const here = resolve(siteDir)
+  const sharedWith = []
+  if (fnd.kind === 'local') {
+    for (const s of ws.sites) {
+      const dir = resolve(root, s.path)
+      if (dir === here) continue
+      const other = await foundationOf(dir, readSiteYml(dir), root)
+      if (other.kind === 'local' && other.abs === fnd.abs) sharedWith.push(s.path)
+    }
+  }
+  const extensions = await extensionsOf(siteDir, siteYml, root)
+  let summary
+  let state = 'ok'
+  if (fnd.kind === 'local') {
+    summary =
+      `Foundation ${fnd.name}, in ${fnd.path}/ — its source is here` +
+      (sharedWith.length
+        ? `, and ${sharedWith.length === 1 ? 'another site uses' : `${sharedWith.length} other sites use`} it too: ${sharedWith.join(', ')} — a change to a section type changes ${sharedWith.length === 1 ? 'it' : 'them'} as well.`
+        : ws.sites.length > 1 ? '; no other site here uses it.' : '.')
+  } else if (fnd.kind === 'catalog') {
+    summary = `Foundation ${fnd.ref}, from the catalog — its source is not in this workspace; work within the section types it offers.`
+  } else if (fnd.kind === 'url') {
+    summary = `Foundation loaded from ${fnd.url} — its source is not in this workspace; work within the section types it offers.`
+  } else if (fnd.kind === 'unresolved') {
+    state = 'attention'
+    summary = `site.yml names the foundation \`${fnd.name}\`, which does not resolve: ${fnd.error}`
+  } else {
+    state = 'attention'
+    summary = 'site.yml names no foundation.'
+  }
+  const extensionLines = extensions.map((e) =>
+    e.kind === 'local'
+      ? `Extension ${e.name}, in ${e.path}/ — its source is here.`
+      : e.kind === 'catalog'
+        ? `Extension ${e.value}, from the catalog — its source is not in this workspace.`
+        : e.kind === 'url'
+          ? `Extension loaded from ${e.value} — its source is not in this workspace.`
+          : `Extension \`${e.value}\` names ${e.name ? `\`${e.name}\`, which no folder here holds` : 'nothing this site can find'}.`
+  )
+  if (extensions.some((e) => e.kind === 'unresolved')) state = 'attention'
+  checks.push({
+    id: 'project.foundation',
+    state,
+    summary,
+    lines: extensionLines,
+    detail: {
+      kind: fnd.kind,
+      name: fnd.name ?? null,
+      path: fnd.path ?? null,
+      url: fnd.url ?? null,
+      editable: fnd.kind === 'local',
+      sharedWith,
+      extensions: extensions.map(({ value, kind, name, path }) => ({ value, kind, name: name ?? null, path: path ?? null }))
+    }
+  })
+
+  // ⭐ Pages from outside the site's folder (`paths:` mounts, by the build's own rule): a pull
+  // never writes them (`uwx/git-authored.js`), and one in its own repository is edited there.
+  const { mountEntriesOf } = await import('@uniweb/build/site')
+  const siteRepo = repoOf(siteDir)?.top ?? null
+  const mounts = mountEntriesOf(siteYml?.paths).map(([segment, dir]) => {
+    const abs = resolve(siteDir, String(dir))
+    const exists = existsSync(abs)
+    const top = exists ? repoOf(abs)?.top ?? null : null
+    const repository = !exists ? null : !top ? 'none' : top === siteRepo ? 'same' : 'other'
+    return { segment, dir: String(dir), exists, repository }
+  })
+  const mountLine = (m) =>
+    !m.exists
+      ? `pages/${m.segment} names ${m.dir}, which does not exist.`
+      : m.repository === 'other'
+        ? `pages/${m.segment} comes from ${m.dir}, its own git repository — edits there are commits in it.`
+        : `pages/${m.segment} comes from ${m.dir}, outside the site's folder.`
+  checks.push(
+    mounts.length
+      ? {
+          id: 'project.mounts',
+          state: mounts.some((m) => !m.exists) ? 'attention' : 'ok',
+          summary: mounts.length === 1 ? mountLine(mounts[0]) : `${count(mounts.length, 'page folder')} come from outside the site's folder.`,
+          lines: [
+            ...(mounts.length === 1 ? [] : mounts.map(mountLine)),
+            'An edit made in the app to those pages does not come back on a pull, and the next push replaces it with the files.'
+          ],
+          detail: { mounts }
+        }
+      : { id: 'project.mounts', state: 'skipped', summary: "All the site's pages are in its own folder.", quiet: true, detail: { mounts: [] } }
+  )
+
+  // The languages, by core's own rules: the one the files are written in, and the rest.
+  const { normalizeLanguageList, resolveDefaultLocale, isWildcardLanguages } = await import('@uniweb/core/locale-config')
+  const source = resolveDefaultLocale(siteYml || {})
+  const wildcard = isWildcardLanguages(siteYml?.languages)
+  const translations = normalizeLanguageList(siteYml?.languages).filter((code) => code !== source && code !== '*')
+  checks.push(
+    translations.length || wildcard
+      ? {
+          id: 'project.languages',
+          state: 'ok',
+          summary:
+            `Written in ${source}, and translated into ${wildcard ? 'every language in locales/' : translations.join(', ')} — ` +
+            `a text you change in ${source} needs translating again.`,
+          lines: ['After a change: build, then `npx uniweb i18n sync`, and `npx uniweb i18n status` lists what is left.'],
+          detail: { source, translations, wildcard }
+        }
+      : { id: 'project.languages', state: 'ok', summary: `One language: ${source}.`, detail: { source, translations: [], wildcard: false } }
+  )
+  return { checks, ws }
+}
+
+// ─── where the site is hosted ───────────────────────────────────────────────
+
+/** A host adapter's name as people know it (`S3 + CloudFront`), or its id. */
+async function hostTitle(host) {
+  try {
+    const { getAdapter } = await import('@uniweb/build/hosts')
+    return getAdapter(host)?.display?.title || host
+  } catch {
+    return host
+  }
+}
+
+/**
+ * The CI workflow `uniweb add ci` writes for `host`, when it deploys this site: its file,
+ * and the branches whose pushes run it. A workspace with several sites deploys one per
+ * workflow, which names that site's build output.
+ */
+function ciWorkflow(repo, host) {
+  const rel = `.github/workflows/deploy-${host}.yml`
+  let text
+  try {
+    text = readFileSync(join(repo.top, rel), 'utf8')
+  } catch {
+    return null
+  }
+  if (repo.path !== '.' && !text.includes(`${repo.path}/dist`)) return null
+  let branches = []
+  try {
+    const doc = yaml.load(text)
+    branches = (doc?.on ?? doc?.[true])?.push?.branches ?? []
+  } catch {
+    // unreadable: the branches are not known
+  }
+  return { file: rel, branches: Array.isArray(branches) && branches.length ? branches.map(String) : [] }
+}
+
+/** The commits since `sha` that changed the site's files — null when this branch does not hold `sha`. */
+function siteCommitsSince(repo, sha, siteDir) {
+  try {
+    if (!isAncestor(repo, sha)) return null
+    const roots = sentRoots(siteDir).map((r) => `${repo.prefix}${r}`)
+    const out = execFileSync('git', ['rev-list', '--count', `${sha}..HEAD`, '--', ...roots], {
+      cwd: repo.top,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore']
+    })
+    return Number(out.trim())
+  } catch {
+    return null
+  }
+}
+
+/**
+ * `hosting.deploys`: where else the site is deployed — `deploy.yml`'s targets on hosts that
+ * are not a backend — each by CI on every push, or by hand, and how far behind a
+ * hand-deployed one is.
+ *
+ * ⛔ FROM THIS COPY'S FILES ONLY. A host's own state is not asked, and a receipt
+ * (`deploys:`) says what this copy deployed — never what another copy, or a CI run, did.
+ */
+async function deployChecks(siteDir) {
+  let deployYml
+  try {
+    const { loadDeployYml } = await import('@uniweb/build/site')
+    deployYml = await loadDeployYml(siteDir)
   } catch (err) {
-    return { id: 'dev.server', state: 'unknown', summary: `Could not ask the dev server: ${err.message}` }
+    return { checks: [{ id: 'hosting.deploys', state: 'unknown', summary: `deploy.yml could not be read: ${err.message}` }], proposals: [], targets: [] }
+  }
+  const all = deployYml?.targets && typeof deployYml.targets === 'object' ? deployYml.targets : {}
+  const names = Object.keys(all)
+  const defaultName = deployYml?.default ?? (names.length === 1 ? names[0] : null)
+  const elsewhere = Object.entries(all).filter(([, t]) => t && typeof t === 'object' && t.host && t.host !== 'uniweb')
+  if (!elsewhere.length) {
+    return { checks: [{ id: 'hosting.deploys', state: 'skipped', summary: 'Deployed to no host but a backend.', quiet: true }], proposals: [], targets: [] }
+  }
+  const repo = repoOf(siteDir)
+  const proposals = []
+  const targets = []
+  const lines = []
+  let attention = false
+  for (const [name, t] of elsewhere) {
+    const title = await hostTitle(t.host)
+    const ci = repo?.head ? ciWorkflow(repo, t.host) : null
+    const receipt = deployYml.deploys?.[name] || null
+    const retired = !receipt && deployYml.lastDeploy?.[name] ? deployYml.lastDeploy[name] : null
+    const behind = receipt?.git?.sha && repo?.head ? siteCommitsSince(repo, receipt.git.sha, siteDir) : null
+    const when = receipt?.at ? sinceLabel(receipt.at, Date.now()) : null
+    let how
+    if (ci) {
+      how = `deployed by CI on every push${ci.branches.length ? ` to ${ci.branches.join(' or ')}` : ''} (${ci.file})`
+    } else if (receipt) {
+      how =
+        `deployed by hand, last ${when ?? 'at an unknown time'}${receipt.url ? ` to ${receipt.url}` : ''}` +
+        (behind > 0 ? ` — the site changed in ${count(behind, 'commit')} since` : behind === 0 ? ', and the site has not changed since' : '')
+      if (behind > 0) {
+        attention = true
+        proposals.push({ step: 'deploy', command: `npx uniweb deploy --target ${name}`, why: `update ${title}, ${count(behind, 'commit')} behind`, ask: true })
+      }
+    } else if (retired) {
+      attention = true
+      how = `its last deploy (${String(retired.at ?? '').slice(0, 10) || 'undated'}) is under \`lastDeploy:\`, which nothing reads — \`npx uniweb doctor --fix deploy-yml-retired-key\` moves it`
+    } else {
+      how = 'never deployed from this copy'
+    }
+    lines.push(`${title} — target \`${name}\`${name === defaultName ? ', the one a bare `uniweb deploy` uses' : ''}: ${how}`)
+    targets.push({
+      name,
+      host: t.host,
+      title,
+      default: name === defaultName,
+      ci: ci ? { file: ci.file, branches: ci.branches } : null,
+      last: receipt ? { at: receipt.at ?? null, sha: receipt.git?.sha ?? null, url: receipt.url ?? null } : null,
+      behind,
+      ...(retired ? { retired: true } : {})
+    })
+  }
+  return {
+    checks: [
+      {
+        id: 'hosting.deploys',
+        state: attention ? 'attention' : 'ok',
+        summary: `Also deployed to ${targets.map((t) => t.title).join(' and ')}.`,
+        lines,
+        detail: { targets }
+      }
+    ],
+    proposals,
+    targets
   }
 }
 
+const list = (names) => names.map((n) => `\`${n}\``).join(', ')
+
+/**
+ * `app.services`: what `site.yml` asks for, beside what the backend holds — the request it
+ * stored, and what the last publish delivered (`last_published_services`). Comparing the
+ * file with those is how to tell it is stale, by the backend's own contract.
+ *
+ * ⛔ A request is never said as what the site has: what is live is the backend's to say.
+ */
+async function servicesCheck({ siteDir, siteYml, site }) {
+  const { readServicesRequest } = await import('@uniweb/build/uwx')
+  const { foundationSupports, serviceNotes } = await import('../backend/service-request.js')
+  // ⚠️ Two shapes, as the backend sends them (measured 2026-10-26 on uniweb.app): the stored
+  // request is rows (`{ name, enabled? }`), what the last publish delivered is names. A reader
+  // of rows alone reads every live service as none.
+  const on = (entries) =>
+    (Array.isArray(entries) ? entries : [])
+      .map((e) => (typeof e === 'string' ? e : e && typeof e.name === 'string' && e.enabled !== false ? e.name : null))
+      .filter(Boolean)
+  const asks = readServicesRequest(siteYml.services) || []
+  const asked = on(asks)
+  const lines = serviceNotes({ siteYml, supports: await foundationSupports(siteDir, siteYml) })
+  const proposals = []
+  if (!site) {
+    return {
+      checks: [
+        {
+          id: 'app.services',
+          state: lines.length ? 'attention' : 'ok',
+          summary: asked.length ? `site.yml asks for ${list(asked)}.` : 'site.yml asks for no services.',
+          lines,
+          detail: { asked, requested: null, live: null }
+        }
+      ],
+      proposals
+    }
+  }
+  const live = on(site.last_published_services)
+  const requested = on(site.services)
+  const waiting = requested.filter((n) => !live.includes(n))
+  if (waiting.length && site.published) {
+    lines.push(`Requested, not live yet: ${list(waiting)} — publishing makes ${waiting.length === 1 ? 'it' : 'them'} live, and may ask for payment.`)
+    proposals.push({ step: 'publish', command: 'npx uniweb publish', why: 'make those changes live — the person decides', ask: true })
+  }
+  const unsent = asked.filter((n) => !requested.includes(n))
+  if (unsent.length) lines.push(`site.yml asks for ${list(unsent)}, which the backend does not hold yet — the next push sends the request.`)
+  const offHere = asks.filter((a) => a.enabled === false && live.includes(a.name)).map((a) => a.name)
+  if (offHere.length) {
+    lines.push(`site.yml turns off ${list(offHere)}, which the live site has — a request the owner settles; a paid service stays on until its subscription changes.`)
+  }
+  return {
+    checks: [
+      {
+        id: 'app.services',
+        state: lines.length ? 'attention' : 'ok',
+        summary: live.length ? `Services on the live site: ${list(live)}.` : site.published ? 'No services on the live site.' : 'No services live — the site is not.',
+        lines,
+        detail: { asked, requested, live }
+      }
+    ],
+    proposals
+  }
+}
+
+/** What the site is, in one line: where it is synced, and where it is live. */
+function summaryLine({ name, synced, live, targets, origin }) {
+  const parts = [synced.length ? `synced with ${synced.join(' and ')}` : 'not synced with a backend']
+  if (live?.published) parts.push(`live on ${cloudName(origin)}${live.url ? ` at ${live.url}` : ''}`)
+  else if (live) parts.push(`not live on ${cloudName(origin)} yet`)
+  if (targets.length) parts.push(`${live?.published ? 'also deployed' : 'deployed'} to ${targets.map((t) => t.title).join(' and ')}`)
+  else if (!synced.length) parts.push('not hosted anywhere yet')
+  return `${name} — ${parts.join(' · ')}`
+}
+
 // ─── the command ────────────────────────────────────────────────────────────
 
 const GROUPS = [
+  ['project', 'Project'],
   ['git', 'Git'],
   ['app', 'App'],
+  ['hosting', 'Hosting'],
   ['uniweb', 'Uniweb'],
   ['health', 'Health'],
   ['dev', 'Dev server']
 ]
 
+// Where a check is shown: where the site is live, and what it serves, are its hosting —
+// `app.live` and `app.services` kept their ids, which the document had before the group.
+const groupOf = (id) => (id === 'app.live' || id === 'app.services' || id.startsWith('hosting.') ? 'hosting' : id.split('.')[0])
+
 const ICON = {
   ok: `${c.green}✓${c.reset}`,
   attention: `${c.cyan}→${c.reset}`,
@@ -740,11 +1254,11 @@ const ICON = {
   skipped: `${c.dim}·${c.reset}`
 }
 
-function render({ siteLabel, backend, checks, next }) {
+function render({ summary, backend, checks, next }) {
   const out = ['']
-  out.push(`${c.bold}Status of ${siteLabel}${c.reset}`)
+  out.push(`${c.bold}${summary}${c.reset}`)
   for (const [prefix, title] of GROUPS) {
-    const group = checks.filter((k) => k.id.split('.')[0] === prefix && !(k.quiet && k.state === 'ok'))
+    const group = checks.filter((k) => groupOf(k.id) === prefix && !(k.quiet && (k.state === 'ok' || k.state === 'skipped')))
     if (!group.length) continue
     out.push('')
     out.push(prefix === 'app' ? `${c.bold}${title}${c.reset} ${c.dim}— ${backend.origin}${c.reset}` : `${c.bold}${title}${c.reset}`)
@@ -780,6 +1294,97 @@ function render({ siteLabel, backend, checks, next }) {
   return out.join('\n')
 }
 
+/**
+ * At a workspace with several sites: what each one is — synced where, deployed where, built
+ * with which foundation, with pages from where, in how many languages — from its files alone,
+ * and the way to one site's checks. Nothing is asked of a backend: what changed in the app is
+ * a site's question.
+ */
+async function workspaceOverview(root, { json }) {
+  const ws = await workspaceFacts(root)
+  const { mountEntriesOf } = await import('@uniweb/build/site')
+  const { normalizeLanguageList } = await import('@uniweb/core/locale-config')
+  const sites = []
+  for (const s of ws.sites) {
+    const dir = resolve(root, s.path)
+    const yml = readSiteYml(dir)
+    const synced = listSyncedBackends(dir).filter((o) => readBackendState(dir, o).site?.uuid)
+    const { targets } = await deployChecks(dir)
+    const fnd = await foundationOf(dir, yml, root)
+    const siteRepo = repoOf(dir)?.top ?? null
+    const mounts = mountEntriesOf(yml.paths).map(([segment, d]) => {
+      const abs = resolve(dir, String(d))
+      const top = existsSync(abs) ? repoOf(abs)?.top ?? null : null
+      return { segment, dir: String(d), repository: !existsSync(abs) ? null : !top ? 'none' : top === siteRepo ? 'same' : 'other' }
+    })
+    const languages = normalizeLanguageList(yml.languages)
+    const parts = [synced.length ? `synced with ${synced.join(' and ')}` : 'not synced']
+    if (targets.length) parts.push(`deployed to ${targets.map((t) => t.title).join(' and ')}`)
+    parts.push(
+      fnd.kind === 'local'
+        ? `foundation ${fnd.name}`
+        : fnd.kind === 'catalog' || fnd.kind === 'url'
+          ? `foundation ${fnd.name}, not in this workspace`
+          : `foundation ${fnd.name ? `\`${fnd.name}\`, unresolved` : 'not named'}`
+    )
+    for (const m of mounts) parts.push(`pages/${m.segment} from ${m.dir}${m.repository === 'other' ? ', its own repository' : ''}`)
+    if (languages.length > 1) parts.push(`${languages.length} languages`)
+    sites.push({
+      path: s.path,
+      name: s.name,
+      summary: `${s.path} — ${parts.join(' · ')}`,
+      synced,
+      deploys: targets.map(({ name, host, title, default: isDefault, ci }) => ({ name, host, title, default: isDefault, ci })),
+      foundation: { kind: fnd.kind, name: fnd.name ?? null, path: fnd.path ?? null },
+      mounts,
+      languages
+    })
+  }
+  // The repository the workspace is in, as far as this machine knows — no remote is asked.
+  const repo = repoOf(root)
+  let git = null
+  if (repo?.head) {
+    let uncommitted = 0
+    try {
+      uncommitted = execFileSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+        .split('\n')
+        .filter(Boolean).length
+    } catch {
+      uncommitted = 0
+    }
+    git = { uncommitted, ...(aheadBehind(root) || {}), upstream: upstreamOf(root)?.tracking ?? null }
+  }
+  const summary = `${basename(root)} — ${workspaceLine(ws).replace(/\.$/, '')}`
+  const first = ws.sites[0]
+  if (json) {
+    console.log(
+      JSON.stringify({
+        schema: STATUS_SCHEMA,
+        uniweb: getCliVersion(),
+        scope: 'workspace',
+        summary,
+        workspace: { patterns: ws.patterns, sites: ws.sites, foundations: ws.foundations, extensions: ws.extensions },
+        sites,
+        git,
+        checks: [],
+        next: [{ command: null, why: "run `npx uniweb status` in a site's folder for its checks — what changed in the app, in git, and where it is hosted", ask: false }]
+      })
+    )
+    return { exitCode: 0 }
+  }
+  const out = ['', `${c.bold}${summary}${c.reset}`, '']
+  for (const s of sites) out.push(`  ${s.summary}`)
+  if (git) {
+    const said = [git.uncommitted ? `${count(git.uncommitted, 'file')} not committed` : 'all committed']
+    if (git.upstream) said.push(git.ahead || git.behind ? `${git.ahead} ahead of, ${git.behind} behind ${git.upstream} as of the last fetch` : `level with ${git.upstream} as of the last fetch`)
+    out.push('', `${c.dim}Git: ${said.join(' · ')}${c.reset}`)
+  }
+  out.push('', `A bare \`uniweb dev\` starts ${first.name}. For one site's checks — what changed in the app, in git, and where it is hosted — run status in its folder, for example:`)
+  out.push(`  ${c.cyan}cd ${first.path} && npx uniweb status${c.reset}`, '')
+  console.log(out.join('\n'))
+  return { exitCode: 0 }
+}
+
 export async function status(args = []) {
   // See utils/flag-guard.js — an unrecognized flag is invisible to a literal scan.
   // Straight to stderr: this is a usage error, so it must not be mistaken for the
@@ -794,15 +1399,11 @@ export async function status(args = []) {
 
   const found = await findSite(process.cwd())
   if (!found.siteDir) {
-    const sites = found.several || []
-    if (json) {
-      console.log(JSON.stringify({ schema: STATUS_SCHEMA, error: sites.length ? 'several-sites' : 'no-site', sites }))
-    } else if (sites.length) {
-      console.error(`${c.red}✗${c.reset} Several sites here — run status from the one you mean:`)
-      for (const s of sites) console.error(`  ${c.cyan}cd ${s} && npx uniweb status${c.reset}`)
-    } else {
-      console.error(`${c.red}✗${c.reset} No Uniweb site here. Run status from a site, or a project with one site.`)
-    }
+    // ⭐ A WORKSPACE OF SEVERAL SITES IS ANSWERED, not refused: what each one is, from its
+    // files, and the way to one site's checks.
+    if (found.several?.length) return workspaceOverview(found.root, { json })
+    if (json) console.log(JSON.stringify({ schema: STATUS_SCHEMA, scope: null, error: 'no-site' }))
+    else console.error(`${c.red}✗${c.reset} No Uniweb site here. Run status from a site, or a project with one site.`)
     return { exitCode: 2 }
   }
   const siteDir = found.siteDir
@@ -813,31 +1414,46 @@ export async function status(args = []) {
   // helpers say on the way goes to stderr.
   const saved = { log: console.log, info: console.info, warn: console.warn }
   if (json) console.log = console.info = console.warn = (...a) => console.error(...a)
-  let git, app, version, health, dev
+  let project, git, app, version, health, dev, deploys, services
   try {
-    git = await gitChecks(siteDir, { offline, origin })
-    ;[app, version, health, dev] = await Promise.all([
+    ;[project, git] = await Promise.all([projectChecks(siteDir, siteYml), gitChecks(siteDir, { offline, origin })])
+    ;[app, version, health, dev, deploys] = await Promise.all([
       appChecks(siteDir, siteYml, { offline, args, git }),
       versionCheck(siteDir, { offline }),
       doctorCheck(siteDir),
-      devCheck(siteDir, { offline })
+      devCheck(siteDir, { offline, sites: project.ws.sites }),
+      deployChecks(siteDir)
     ])
+    services = await servicesCheck({ siteDir, siteYml, site: app.site })
   } finally {
     Object.assign(console, saved)
   }
-  const checks = [...git.checks, ...app.checks, ...version.checks, ...health.checks, dev]
-  const next = planNext([...git.proposals, ...app.proposals, ...version.proposals, ...health.proposals])
+  const checks = [...project.checks, ...git.checks, ...app.checks, ...deploys.checks, ...services.checks, ...version.checks, ...health.checks, dev]
+  const next = planNext([...git.proposals, ...app.proposals, ...deploys.proposals, ...services.proposals, ...version.proposals, ...health.proposals])
 
   const root = findWorkspaceRoot(siteDir) || siteDir
   const site = relative(root, siteDir) || '.'
+  // What the site is, before what to do about it: the backends it is synced with — every one
+  // this copy holds a site on, custom servers included — and where it is live.
+  const synced = listSyncedBackends(siteDir).filter((o) => readBackendState(siteDir, o).site?.uuid)
+  const summary = summaryLine({
+    name: typeof siteYml.name === 'string' && siteYml.name ? siteYml.name : site === '.' ? 'This site' : site,
+    synced,
+    live: checks.find((k) => k.id === 'app.live')?.detail ?? null,
+    targets: deploys.targets,
+    origin: app.backend.origin
+  })
   if (json) {
     console.log(
       JSON.stringify({
         schema: STATUS_SCHEMA,
         uniweb: getCliVersion(),
+        scope: 'site',
+        summary,
         site,
         backend: app.backend.origin,
         workspace: app.backend.workspace,
+        synced,
         offline,
         checks: checks.map(({ quiet, id, state, summary, blocks = [], ...rest }) => ({ id, state, summary, blocks, ...rest })),
         next
@@ -845,7 +1461,7 @@ export async function status(args = []) {
     )
     return { exitCode: 0 }
   }
-  console.log(render({ siteLabel: site === '.' ? 'this site' : `${site}/`, backend: app.backend, checks, next }))
+  console.log(render({ summary, backend: app.backend, checks, next }))
   return { exitCode: 0 }
 }