@frontfriend/sdk 1.2.5 → 1.2.7

package/README.md

@@ -244,6 +244,8 @@ An applied adoption installs the npm dependencies of the components it adds or m
 
 A private component deleted from the Design System leaves every Release. `update` removes its pin from `frontfriend.lock.json` and prints `custom/... was deleted from the design system. Its files in <path> were kept; remove them and their imports if you no longer use them.` It never deletes those files. `add` and `download` refuse a deleted component that the lock pins; `diff` and `doctor` report the pin until `update` removes it. `update --json` (with `--yes` or `--dry-run`) prints one JSON result on stdout, with the removed pins in `components_removed`.
 
+A contract deleted from the Design System leaves every Release too. `update` removes it from `frontfriend.lock.json`, its file from `.frontfriend/design/` and its rules from `.frontfriend/rules/`.
+
 To apply the latest published Release of the App's tag in one step (lock, component source, npm dependencies, token cache), run:
 
 ```bash
@@ -253,7 +255,7 @@ npx frontfriend adopt --yes
 
 `adopt` never adopts a draft: a component or foundation commit reaches the App once it is published in a Release.
 
-Coding agents adopt through the MCP bridge instead: the local tool `adopt_design { project_path, dry_run?, scope? }` runs the same adoption without a prompt and returns a JSON summary (snapshot, Release, changed pins, files written, `npm_dependencies`, `token_cache`). It returns the install command for missing npm dependencies instead of running the package manager.
+Coding agents adopt through the MCP bridge instead: the local tool `adopt_design { project_path, dry_run?, scope? }` runs the same adoption without a prompt and returns a JSON summary (snapshot, Release, changed pins, files written, `components_removed`, `npm_dependencies`, `token_cache`). It returns the install command for missing npm dependencies instead of running the package manager.
 
 See the [CLI reference](https://frontfriend.dev/docs/cli-reference/) for all options.
 
@@ -328,7 +330,7 @@ npx frontfriend init --tag <tag-name-or-id>
 
 After the tokens, an online `init` signed in as a person registers the App named in `frontfriend.config.js` on its tag (`--tag`, then `tag`) with its `framework` and `primitive`, so `update` and the design reads find it. When Studio refuses the registration, `init` stops with the reason; the installed tokens stay. With a machine credential, or with `--no-register`, `init` installs the selected tokens and never registers the App or changes its Release tag (see [Builds and CI](#builds-and-ci)). During an outage it keeps the tokens and asks you to run `init` again. When the App adopts contracts and `frontfriend.lock.json` pins a design snapshot, `init` also writes that snapshot's contracts to `.frontfriend/design/` and, when they are missing or belong to another snapshot, its rules to `.frontfriend/rules/`: the same files `update` writes.
 
-`frontfriend.lock.json` lists its contract pins by slug, then kind, and its `adoptionDigest` does not depend on the order of the pins. A lock written by an earlier SDK in another order is still valid; `update` keeps its bytes until the adoption itself changes.
+`frontfriend.lock.json` lists its contract pins by slug, then kind, and its `adoptionDigest` does not depend on the order of the pins. A lock written by an earlier SDK in another order is still valid; `update` keeps its bytes until the adoption itself changes. The lock pins each component file by hash (`baselineHash`), not by its source. To merge a local edit with an incoming change, `update` rebuilds the previous source from the pinned Release; if that Release cannot be read, the file is reported as a conflict. A lock written by SDK 1.2.5 or earlier still works; the next `update` drops its inline source.
 
 Every online `init` keeps a verified copy of the selected tokens in `.frontfriend/artifacts`. When Studio is unreachable (network failure, timeout or server error), a signed-in `init` restores that copy. A first install during an outage has no copy to restore.
 
@@ -358,7 +360,7 @@ FF_AUTH_TOKEN=<machine credential> npx frontfriend init --tag <tag-name>
 
 A machine credential is read-only for the App. `init` installs the tokens of the requested tag and prints `Build mode: App registration skipped (machine credential).`; it never registers the App or moves its Release tag in Studio, so a preview build on `next` does not move a production App off `base`. Pass `--no-register` to get the same behavior with any credential. Studio never changes an App for a machine credential either: it answers the registration of an earlier SDK with the App unchanged, so those builds also install the requested tag and leave the App on its own tag. If Studio refuses a registration with `MACHINE_CREDENTIAL_READ_ONLY`, `init` reports the registration as skipped and succeeds.
 
-`update`, `adopt`, `download` and `add` with a machine credential use the App's current Release tag. They stop with a message when the selection would bind the App or move it to another tag. `connect` stops at its login step: it registers the App, which needs a person's login (`frontfriend login`, with `FF_AUTH_TOKEN` unset). Change an App's tag in Studio or with a person's login.
+`update`, `adopt`, `download`, `add` and `design sync` with a machine credential use the App's current Release tag. They stop with a message when the selection would bind the App or move it to another tag. `connect` stops at its login step: it registers the App, which needs a person's login (`frontfriend login`, with `FF_AUTH_TOKEN` unset). Change an App's tag in Studio or with a person's login.
 
 ## Existing Tailwind clients
 

package/dist/application-adoption.d.ts

@@ -4,7 +4,8 @@ export type AdoptionFile = {
   path: string;
   installedHash: string | null;
   baselineHash: string;
-  baseline: string;
+  /** The upstream source itself, written by SDK 1.2.5 and earlier. */
+  baseline?: string;
 };
 
 export type AdoptionComponent = {
@@ -87,6 +88,19 @@ export class ApplicationAdoption {
   });
   inspect(resolved: unknown, options?: Record<string, unknown>): unknown;
   diff(lock: unknown): unknown[];
+  missingBaselines(
+    resolved: unknown,
+    lock: unknown,
+  ): Array<{
+    identity: string;
+    versionId: string;
+    sourceReleaseId: string | null;
+    baselineHashes: string[];
+  }>;
+  baselinesFrom(
+    source: unknown,
+    missing: ReturnType<ApplicationAdoption["missingBaselines"]>,
+  ): Record<string, string>;
   planUpdate(
     resolved: unknown,
     options?: Record<string, unknown>,