@homespunapps/cli 1.6.35 → 1.6.36

package/dist/commands/deploy.js

@@ -9,7 +9,18 @@ import { specFor } from "../help-catalog.js";
 import { fail, failFromError, printJson } from "../output.js";
 import { resolveJson } from "../input.js";
 import { resolveAppId } from "../resolve-app.js";
-function readBundle(source, manifestFlag) {
+function readBundle(source, manifestFlag, isRedeploy) {
+    // No source at all: only a redeploy can do this, and only to change the
+    // manifest alone (the live document is inherited).
+    if (source === undefined) {
+        if (!isRedeploy) {
+            fail("usage: homespun deploy <dir|file> [--app <id>] ...", "invalid_args");
+        }
+        if (manifestFlag === undefined) {
+            fail("nothing to deploy: pass a directory or file, or --manifest <path|json> for a manifest-only redeploy", "invalid_args");
+        }
+        return { manifest: resolveJson(manifestFlag, "--manifest") };
+    }
     if (!existsSync(source)) {
         fail(`no such file or directory: ${source}`, "invalid_args");
     }
@@ -33,9 +44,13 @@ function readBundle(source, manifestFlag) {
             manifest: JSON.parse(readFileSync(manifestPath, "utf8")),
         };
     }
-    // Single-file escape hatch.
+    // Single-file escape hatch. A create must pair it with --manifest; a
+    // redeploy may omit --manifest, which keeps the live manifest.
     if (manifestFlag === undefined) {
-        fail("single-file deploy requires --manifest <path|json>", "invalid_args");
+        if (!isRedeploy) {
+            fail("single-file deploy requires --manifest <path|json>", "invalid_args");
+        }
+        return { html: readFileSync(source, "utf8") };
     }
     return {
         html: readFileSync(source, "utf8"),
@@ -45,9 +60,6 @@ function readBundle(source, manifestFlag) {
 export async function runDeploy(args) {
     assertKnownFlags(args, ...specFor("deploy"));
     const source = args.positionals[0];
-    if (!source) {
-        fail("usage: homespun deploy <dir|file> [--app <id>] ...", "invalid_args");
-    }
     const appId = args.flags.get("app");
     const slug = args.flags.get("slug");
     const visibility = args.flags.get("visibility");
@@ -57,7 +69,7 @@ export async function runDeploy(args) {
     }
     const force = args.bools.has("force");
     const check = args.bools.has("check");
-    const bundle = readBundle(source, args.flags.get("manifest"));
+    const bundle = readBundle(source, args.flags.get("manifest"), appId !== undefined);
     const client = makeClient(args);
     // Dry run (--check): validate + report what a real deploy would do, persist
     // NOTHING. Runs for both create (no --app) and redeploy (--app), the latter
@@ -67,8 +79,8 @@ export async function runDeploy(args) {
             const id = appId !== undefined ? await resolveAppId(client, appId) : undefined;
             const result = await client.checkDeploy({
                 ...(id !== undefined ? { app_id: id } : {}),
-                html: bundle.html,
-                manifest: bundle.manifest,
+                ...(bundle.html !== undefined ? { html: bundle.html } : {}),
+                ...(bundle.manifest !== undefined ? { manifest: bundle.manifest } : {}),
                 ...(force ? { force } : {}),
             });
             printJson(result);
@@ -85,6 +97,9 @@ export async function runDeploy(args) {
             fail("a caller-supplied --slug is not allowed with visibility 'link' (link slugs are always server-generated); drop --visibility link, or omit --slug", "invalid_args");
         }
         try {
+            // readBundle guarantees both halves on the create path (a create can
+            // inherit nothing), so the non-null assertions are the type system
+            // catching up with a check that already ran.
             const out = await client.deployApp({
                 html: bundle.html,
                 manifest: bundle.manifest,
@@ -107,9 +122,13 @@ export async function runDeploy(args) {
     }
     const id = await resolveAppId(client, appId);
     try {
+        // Only what this invocation actually read is sent: an omitted html or
+        // manifest keeps what is live, so `homespun deploy ./index.html --app <id>`
+        // ships the document alone and `--manifest` with no file ships the
+        // manifest alone.
         const redeployed = await client.redeployApp(id, {
-            html: bundle.html,
-            manifest: bundle.manifest,
+            ...(bundle.html !== undefined ? { html: bundle.html } : {}),
+            ...(bundle.manifest !== undefined ? { manifest: bundle.manifest } : {}),
             force,
         });
         const app = await client.getApp(id);

package/dist/help-catalog.js

@@ -777,7 +777,7 @@ const DEPLOY = {
     verbs: [
         {
             verb: "",
-            positionals: "<dir|file>",
+            positionals: "[dir|file]",
             summary: "Creates a new app, or redeploys an existing one when --app is given.",
             flags: [
                 {
@@ -813,7 +813,8 @@ const DEPLOY = {
     notes: [
         "Packaging has one canonical shape and one escape hatch. A directory deploy (homespun deploy ./my-app) reads ./my-app/index.html and ./my-app/manifest.json: fixed filenames, no discovery heuristics, and both files are required. The single-file escape hatch (homespun deploy ./index.html --manifest ./manifest.json) takes the manifest from --manifest, which accepts a file path or inline JSON.",
         "Create versus redeploy is decided by the presence of --app, not by two verbs. With no --app this creates an app (POST /v1/apps); new apps default to private (owner plus invited members, sign-in gated), --slug is accepted with private or public visibility including the default, and an explicit --visibility link always gets a server-generated slug and rejects --slug. With --app <id> this redeploys (POST /v1/apps/:id/versions), where --slug and --visibility are rejected because the slug is immutable and visibility changes go through 'homespun apps update'.",
-        "--check is a dry run. It runs the full manifest and asset-shape validation, the redeploy compat gate (with --app), and the schedule-timezone advisory, then prints { ok, warnings, compat, breaks } without creating a version or mutating anything. An invalid manifest fails the same way a real deploy would, and a redeploy the compat gate would refuse reports the break instead of applying it.",
+        "On redeploy, what you do not send is kept. 'homespun deploy ./index.html --app <id>' ships the document alone and keeps the live manifest; 'homespun deploy --app <id> --manifest ./manifest.json' ships the manifest alone and keeps the live document, with no file argument at all; a directory deploy still ships both. The live asset set is carried forward either way. A create can inherit nothing, so it still needs both halves.",
+        "--check is a dry run. It runs the full manifest and asset validation (shape and MIME), the redeploy compat gate (with --app), and the schedule-timezone advisory, then prints { ok, warnings, compat, breaks } without creating a version or mutating anything. An invalid manifest fails the same way a real deploy would, and a redeploy the compat gate would refuse reports the break instead of applying it. It resolves omitted fields exactly as a real redeploy would, so it reports on the deploy that would actually run.",
     ],
     outputNote: 'Output is JSON: { app_id, slug, url, version, visibility, created, share_url, compat, breaks, warnings }. share_url is present only when creating a link-visibility app: it carries the app share token in its #k= fragment and is shown ONCE, it is not recoverable later, and it can be rotated with \'homespun apps share-link rotate <app>\'. warnings flags non-fatal issues, for example an app that declares schedules with no timezone set (reminders fire at 08:00 UTC until one is set). Errors go to stderr as {"error":{"code","message"}} with a non-zero exit.',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homespunapps/cli",
-  "version": "1.6.35",
+  "version": "1.6.36",
   "description": "Command-line client for the Homespun relay: deploy a real multi-user web app from your agent, then keep reading and writing its data.",
   "license": "MIT",
   "type": "module",
@@ -36,7 +36,7 @@
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@homespunapps/core": "^1.6.35",
+    "@homespunapps/core": "^1.6.36",
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {