layero 0.8.8 → 0.8.10

package/README.md

@@ -149,6 +149,14 @@ uploaded (no source-tree filters like `.gitignore` apply). The platform
 ships them verbatim — no detect, no install, no build. Smaller archive,
 faster deploys, no surprises from the platform's package-manager defaults.
 
+⚠️ The flip side of ignoring `.gitignore`: `--prebuilt .` at your project
+root publishes **everything there** except the built-in denylist, including
+drafts you hid via `.gitignore` (verified on a live deploy — such a file comes
+back with a 200). Secrets are still safe: `.env`, `.env.*`, `.git`,
+`node_modules` and the rule files are excluded on this path too, nested
+directories included. Even so, name the directory explicitly rather than
+using `.`.
+
 Override anything by editing `.layero/project.json` after the first `layero init`.
 
 ## In CI

package/dist/commands/init.js

@@ -68,9 +68,12 @@ apex is reachable the moment the deploy is ready.
 
 Hand the user \`ready.url\` and stop — that address is live.
 
-Use \`--branch <name>\` to deploy to an isolated preview environment that does
-**not** touch the apex. (\`--prod\` exists for git-connected projects; for
-direct CLI uploads it's redundant.)
+There is no way to publish without replacing the live site from the CLI:
+\`--branch\` is accepted and **silently ignored** — archive uploads are always
+filed under the reserved \`cli\` environment. If the user asks for a version
+"just to look at" that leaves the live address alone, tell them it needs a
+connected repository and a push to a branch. (\`--prod\` exists for
+git-connected projects; for direct CLI uploads it's redundant.)
 
 ### Already built? Skip the server build
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "Layero CLI — publish a local site with one command. No git, no GitHub, agent-friendly (Cursor, Claude Code).",
   "license": "MIT",
   "type": "module",