ultimate-jekyll-manager 1.9.27 → 1.9.29

package/dist/gulp/tasks/sass.js

@@ -40,8 +40,10 @@ const bundleFiles = [
   // Main bundles
   `${rootPathPackage}/dist/assets/css/bundles/*.scss`,
 
-  // Project bundles
-  'src/assets/css/bundles/*.scss',
+  // Project bundles — only if the dir exists (gulp's src() throws ENOENT when it
+  // scandirs a missing directory, same as themePageGlobs below); most consumers
+  // don't define project bundles
+  ...(jetpack.exists('src/assets/css/bundles') ? ['src/assets/css/bundles/*.scss'] : []),
 ];
 
 // Build the active theme's page-CSS globs, but ONLY for `pages` dirs that exist —

package/dist/gulp/tasks/serve.js

@@ -129,30 +129,32 @@ async function getHttpsConfig() {
   // Check if mkcert certificates exist
   const certPath = path.join(rootPathProject, '.temp');
 
-  // Look for any mkcert generated files (handles localhost+2.pem format)
-  const certFiles = jetpack.find(certPath, { matching: 'localhost*.pem' }) || [];
+  // Look for any mkcert generated files. NOTE: mkcert names files after the FIRST
+  // SAN host (development.<brand>+N.pem, not localhost*.pem) — match *.pem, the
+  // same pattern generateMkcertCertificates() finds after generating.
+  const certFiles = jetpack.find(certPath, { matching: '*.pem' }) || [];
   const keyFile = certFiles.find(f => f.includes('-key.pem'));
   const certFile = certFiles.find(f => !f.includes('-key.pem'));
 
   if (keyFile && certFile) {
-    logger.log('Using mkcert certificates from .temp/');
-    logger.log(`Certificate: ${certFile}`);
-    logger.log(`Key: ${keyFile}`);
+    const problem = checkCertProblem(certFile);
 
-    // Read certificate to check validity
-    try {
-      const certContent = jetpack.read(certFile);
-      if (certContent && certContent.includes('BEGIN CERTIFICATE')) {
-        logger.log('✅ Certificate appears valid');
-      }
-    } catch (e) {
-      logger.log('⚠️ Could not read certificate');
+    if (!problem) {
+      logger.log('Using mkcert certificates from .temp/');
+      logger.log(`Certificate: ${certFile}`);
+      logger.log(`Key: ${keyFile}`);
+
+      return {
+        key: keyFile,
+        cert: certFile
+      };
     }
 
-    return {
-      key: keyFile,
-      cert: certFile
-    };
+    // Stale certs (expired, or issued by a DIFFERENT machine's mkcert CA — e.g.
+    // .temp copied over from another Mac) make browsers reject https://localhost:4000
+    // outright. Wipe and regenerate against THIS machine's trusted CA.
+    logger.log(`Existing certificates are not usable (${problem}) — regenerating...`);
+    certFiles.forEach((file) => jetpack.remove(file));
   }
 
   // Try to generate mkcert certificates
@@ -170,6 +172,41 @@ async function getHttpsConfig() {
   return true;
 }
 
+// Returns a reason string when the existing cert must be regenerated, or null
+// when it's usable: unexpired AND signed by this machine's trusted mkcert root CA.
+function checkCertProblem(certFile) {
+  const { X509Certificate } = require('crypto');
+  const { execSync } = require('child_process');
+
+  let cert;
+  try {
+    cert = new X509Certificate(jetpack.read(certFile));
+  } catch (e) {
+    return 'unreadable certificate';
+  }
+
+  if (new Date(cert.validTo) <= new Date()) {
+    return `expired ${cert.validTo}`;
+  }
+
+  // Verify the signature chains to the CURRENT mkcert root CA. If mkcert (or its
+  // root) isn't available we can't verify — keep the existing certs rather than
+  // breaking the self-signed fallback path.
+  try {
+    const caRoot = execSync('mkcert -CAROOT', { encoding: 'utf8' }).trim();
+    const ca = new X509Certificate(jetpack.read(path.join(caRoot, 'rootCA.pem')));
+
+    if (!cert.verify(ca.publicKey)) {
+      const issuerCN = cert.issuer.split('\n').find((line) => line.startsWith('CN=')) || cert.issuer;
+      return `issued by a different CA (${issuerCN})`;
+    }
+  } catch (e) {
+    return null;
+  }
+
+  return null;
+}
+
 // Generate mkcert certificates
 async function generateMkcertCertificates(certPath) {
   try {

package/dist/test/suites/build/theme-contract.test.js

@@ -19,7 +19,10 @@ const INCLUDES = path.join(ROOT, 'src/defaults/dist/_includes/themes');
 
 // _template is held to the asset contract too — it's what theme authors copy.
 // bootstrap is the shared Bootstrap source, not a theme.
-const themes = jetpack.list(ASSETS).filter((t) => t !== 'bootstrap');
+// The published package ships no src/ (package.json files: assets/bin/dist/docs),
+// so in consumer projects this framework-source suite has nothing to assert
+// against — it degrades to a single skip (see module.exports) instead of crashing.
+const themes = (jetpack.list(ASSETS) || []).filter((t) => t !== 'bootstrap');
 
 // Class tokens that would couple markup to one theme (markup must stay
 // swappable; theme prefixes live only in SCSS internals)
@@ -77,7 +80,12 @@ module.exports = {
   layer: 'build',
   description: 'theme contract (structure, swappability, cross-theme JS contracts)',
   type: 'group',
-  tests: [
+  tests: themes.length === 0 ? [
+    {
+      name: 'theme sources present (framework repo only)',
+      run: (ctx) => ctx.skip('src/assets/themes is not shipped in the published package — this suite runs in the UJM repo'),
+    },
+  ] : [
     ...themes.map((theme) => ({
       name: `${theme}: entry files + config contract`,
       run: (ctx) => {

package/docs/themes.md

@@ -178,7 +178,11 @@ The hooks (and the rest of the theme conventions: entry files, `$avatar-sizes`,
 scripts, page-asset shapes) are enforced by the build-layer **theme-contract
 test** — `npx mgr test mgr:build/theme-contract` — which globs every theme, so
 a new theme is covered the moment it lands. It caught neobrutalism's missing
-promo banner + `.card-title` the day it was written.
+promo banner + `.card-title` the day it was written. The suite asserts on the
+framework's `src/assets/themes` sources, which the published package doesn't
+ship — in consumer projects it reports a single skip instead of running (or
+crashing); it only executes inside the UJM repo (or a consumer linked to the
+local repo via `npx mgr install dev`).
 
 #### Theme chrome: inherit classy's nav + footer, restyle via CSS
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultimate-jekyll-manager",
-  "version": "1.9.27",
+  "version": "1.9.29",
   "description": "Ultimate Jekyll dependency manager",
   "main": "dist/index.js",
   "files": [
@@ -116,7 +116,7 @@
     "prettier": "^3.9.4",
     "sass": "^1.101.0",
     "spellchecker": "^3.7.1",
-    "web-manager": "^4.3.2",
+    "web-manager": "^4.3.5",
     "webpack": "^5.108.3",
     "wonderful-fetch": "^2.0.5",
     "wonderful-version": "^1.3.2",