@frontera-sdk/cli 1.50.21 → 1.50.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/cli",
-  "version": "1.50.21",
+  "version": "1.50.23",
   "description": "The frontera CLI — scaffold, pull, save and deploy Frontera apps and automations.",
   "keywords": [
     "frontera",
@@ -39,14 +39,14 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.251",
-    "@frontera-sdk/functions": "1.50.21",
-    "@frontera-sdk/core": "1.50.21",
+    "@frontera-sdk/functions": "1.50.23",
+    "@frontera-sdk/core": "1.50.23",
     "ai": "^6.0.116",
     "gray-matter": "^4.0.3",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@frontera-sdk/forge-contracts": "1.50.21",
+    "@frontera-sdk/forge-contracts": "1.50.23",
     "@types/bun": "^1.3.14",
     "typescript": "^5.9.3"
   }

package/src/commands/app/deploy.ts

@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs'
+import { existsSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 
 import { AppsApi } from '../../api/apps-api'
@@ -41,12 +41,39 @@ async function publish(
   }
 }
 
+
+/**
+ * Newest modification time across a set of project-relative files.
+ *
+ * `statSync` per file rather than one directory stat: a build writes into an
+ * existing directory, so the directory's own mtime says nothing about whether
+ * the files inside it are current.
+ */
+function newestMtime(root: string, files: Array<{ rel: string }>): { at: number; rel: string } {
+  let at = 0
+  let rel = ''
+  for (const file of files) {
+    try {
+      const stat = statSync(join(root, file.rel))
+      if (stat.mtimeMs > at) {
+        at = stat.mtimeMs
+        rel = file.rel
+      }
+    } catch {
+      // A file that vanished between listing and stat is not evidence of
+      // anything; the comparison below is a warning about staleness, not a
+      // filesystem audit.
+    }
+  }
+  return { at, rel }
+}
+
 export const appDeploy: Command = {
   meta: {
     noun: 'app',
     verb: 'deploy',
     args: [],
-    flags: { version: 'string', 'no-promote': 'boolean' },
+    flags: { version: 'string', 'no-promote': 'boolean', 'skip-build-check': 'boolean' },
     summary: 'Build output up to an immutable version, and promote it',
     examples: ['frontera app deploy', 'frontera app deploy --no-promote'],
     needsProject: true,
@@ -66,10 +93,49 @@ export const appDeploy: Command = {
       })
     }
 
+    const distFiles = collectSourceFiles(distDir)
+
+    /**
+     * Refuse a bundle older than the source it claims to be built from.
+     *
+     * `deploy` packages `dist/`; it does not build. So an edit made after the
+     * last build ships the PREVIOUS bundle — and nothing about that failure is
+     * visible: the command succeeds, a version is published, promoting it
+     * works, and the user is looking at yesterday's app while everyone
+     * involved believes the change went out. That silence is what makes it
+     * worth a hard stop rather than a warning.
+     *
+     * Compared against the newest file on each side, not file-by-file: a build
+     * legitimately rewrites only what changed, so an untouched chunk being
+     * older than its source proves nothing.
+     */
+    if (!flagBool(ctx, 'skip-build-check')) {
+      // `.frontera/` is this machine's notes about the tree — render evidence,
+      // pulled-version state — written by tooling AFTER a build and never an
+      // input to one. Counting it would make the check fire on itself: render
+      // the app, then deploy, and the render's own receipt is the newest file.
+      const sources = collectSourceFiles(project.root).filter(
+        (file) => !file.rel.startsWith('.frontera/'),
+      )
+      const newestSource = newestMtime(project.root, sources)
+      const newestDist = newestMtime(distDir, distFiles)
+      if (newestSource.at > newestDist.at) {
+        throw new CliError(
+          `${outputDirectory}/ is older than your source — ${newestSource.rel} changed after the last build`,
+          {
+            code: 'VALIDATION_ERROR',
+            hint:
+              'run your build first: bun run build. '
+              + 'Deploying now would publish the previous bundle, and nothing would say so. '
+              + 'Pass --skip-build-check if the output really is current.',
+          },
+        )
+      }
+    }
+
     const client = new AppsApi(ctx.apiUrl, ctx.token)
     const app = await client.ensureApp(project.slug, project.displayName, project.appId)
 
-    const distFiles = collectSourceFiles(distDir)
     ctx.output.note(
       `  bundle ${distFiles.length} files, ${formatBytes(distFiles.reduce((n, f) => n + f.bytes.byteLength, 0))}`,
     )

package/src/flag-help.ts

@@ -86,6 +86,7 @@ export const FLAG_HELP: Readonly<Record<string, string>> = {
   // flag spends no characters on the `{"pk": …}` the route models it as.
   subject: 'primary key of the object a subject-bound workflow runs for',
   'no-promote': 'publish the version without moving the live pointer',
+  'skip-build-check': 'deploy even when the build output is older than the source',
   'no-wait': 'return as soon as the run is queued instead of waiting for it to finish',
   // Named for what it RUNS, not where it runs: an author reads this to decide
   // between their working copy and what is deployed.

package/src/forge/touches.ts

@@ -113,6 +113,7 @@ export const BOOLEAN_FLAGS = new Set([
   'accept-contract-change', 'accept-orphaned-knowledge', 'dry-run', 'end-user', 'no-activate',
   'no-components', 'no-git', 'no-input', 'no-install', 'no-open', 'no-promote', 'no-wait',
   'remove-apps', 'token-stdin', 'prune', 'dev', 'revoke', 'draft', 'check',
+  'skip-build-check',
 ])
 
 /**