uniweb 0.12.19 → 0.12.21

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-05-06T22:34:24.827Z",
+  "generatedAt": "2026-05-13T05:21:17.590Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.14.4",
+      "version": "0.14.5",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -14,7 +14,7 @@
       ]
     },
     "@uniweb/content-reader": {
-      "version": "1.1.10",
+      "version": "1.1.11",
       "path": "framework/content-reader",
       "deps": []
     },
@@ -42,24 +42,24 @@
       "deps": []
     },
     "@uniweb/kit": {
-      "version": "0.9.11",
+      "version": "0.9.13",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/loom": {
-      "version": "0.2.2",
+      "version": "0.2.3",
       "path": "framework/loom",
       "deps": []
     },
     "@uniweb/press": {
-      "version": "0.4.5",
+      "version": "0.4.6",
       "path": "framework/press",
       "deps": []
     },
     "@uniweb/runtime": {
-      "version": "0.8.13",
+      "version": "0.8.14",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -92,7 +92,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.4.9",
+      "version": "0.4.10",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -128,9 +128,10 @@ function getCliVersion() {
  * Commands that always run from the global CLI (no project context needed)
  */
 // Commands that always run from the global CLI, never delegating to a
-// project-local copy. `update` is here because its primary job is to
-// self-update the GLOBAL install — delegating it to project-local would
-// short-circuit that intent.
+// project-local copy. `update` is here because it reconciles the project
+// against *this* CLI's version matrix — when run from a (newer) global
+// install that's the whole point; delegating to the project-local copy
+// would align the project to the version it already has, i.e. a no-op.
 const STANDALONE_COMMANDS = new Set([
   'create', '--help', '-h', '--version', '-v', 'login', 'update',
 ])
@@ -1205,12 +1206,12 @@ ${colors.cyan}${colors.bright}uniweb login${colors.reset} ${colors.dim}— Log i
 ${colors.bright}Usage:${colors.reset}
   uniweb login [options]
 
-Opens a browser to hub.uniweb.app for OAuth-style login, then captures
+Opens a browser to www.uniweb.app for OAuth-style login, then captures
 the token via a loopback callback. Falls back to a paste-token prompt
 if the browser flow fails.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    Override the auth backend (default: https://hub.uniweb.app)
+  --backend <url>    Override the auth backend (default: https://www.uniweb.app)
 
 In non-interactive mode (CI / no TTY / --non-interactive), this command
 errors out — set the \`UNIWEB_TOKEN\` env var instead, or run \`login\`
@@ -1284,39 +1285,47 @@ Prints the parsed content shape of a markdown file or folder — the
 Useful for debugging "why isn't my section getting X?".
 `,
     update: `
-${colors.cyan}${colors.bright}uniweb update${colors.reset} ${colors.dim}— Reconcile workspace state with the running CLI${colors.reset}
+${colors.cyan}${colors.bright}uniweb update${colors.reset} ${colors.dim}— Align this project with the running CLI${colors.reset}
 
 ${colors.bright}Usage:${colors.reset}
-  uniweb update                     Self-update + align deps + refresh AGENTS.md
+  uniweb update                     Align deps + refresh AGENTS.md
   uniweb update --deps-only         Only align workspace @uniweb/* deps
   uniweb update --agents-only       Only refresh AGENTS.md
   uniweb update --no-deps           Skip the deps-alignment step
   uniweb update --no-agents         Skip the AGENTS.md step
   uniweb update --dry-run           Print survey + would-be writes; no mutations
   uniweb update --allow-mismatch    Refresh AGENTS.md even if declared deps lag
-  uniweb update --yes               Skip confirmation prompts
+  uniweb update --yes               Don't prompt — apply edits and run the install
 
 ${colors.bright}What it does:${colors.reset}
   Prints a version survey first (CLI version, AGENTS.md stamp, every
   @uniweb/* + uniweb dep declared in workspace package.json files,
-  marked aligned / behind / ahead). Then three steps:
-
-  1. ${colors.bright}Self-update${colors.reset} the global install via npm / pnpm / yarn
-     (auto-detected). TTY prompts; non-interactive prints the command.
-  2. ${colors.bright}Align workspace deps${colors.reset} to the CLI's bundled version matrix —
-     edits every workspace package.json (only @uniweb/* + uniweb keys),
-     then offers to run the workspace's package manager (lockfile-detected:
-     pnpm-lock.yaml → pnpm, yarn.lock → yarn, package-lock.json → npm).
-     If the install fails, package.json edits are kept and a revert
-     command is printed.
-  3. ${colors.bright}Refresh AGENTS.md${colors.reset} from the CLI's bundled partial. Refuses to
-     run while declared deps still lag the CLI (would document features
-     not in your installed packages); pass --allow-mismatch to override.
+  marked aligned / behind / ahead). Then two steps:
+
+  1. ${colors.bright}Align workspace deps${colors.reset} to this CLI's bundled version matrix —
+     rewrites the @uniweb/* + uniweb keys in each package.json that lags
+     (deps ahead of the matrix are left alone — never downgraded;
+     existing indentation is preserved), then offers to run the
+     workspace's package manager (lockfile-detected: pnpm-lock.yaml →
+     pnpm, yarn.lock → yarn, package-lock.json → npm). If the install
+     fails, the package.json edits are kept and a revert command printed.
+  2. ${colors.bright}Refresh AGENTS.md${colors.reset} from this CLI's bundled partial. Won't run
+     if deps were edited but not installed (node_modules would be behind
+     package.json), or while declared deps still lag the CLI (would
+     document features not in your packages) — pass --allow-mismatch for
+     the latter.
+
+${colors.bright}Which matrix?${colors.reset}
+  \`update\` pins to the version matrix *this* CLI shipped with — not
+  necessarily the latest release. To reconcile against the latest release
+  without touching a global install, run \`npx uniweb@latest update\`. This
+  command does NOT update the CLI itself; use your package manager
+  (\`npm i -g uniweb@latest\`, \`pnpm add -g uniweb@latest\`, …).
 
 ${colors.bright}Project-local installs:${colors.reset}
-  When the running CLI is project-local (lives in node_modules), self-
-  update is a no-op — the version is pinned by your project's
-  package.json. The deps + AGENTS.md steps still run.
+  When run from a project-local CLI (in node_modules), it aligns the
+  project to that pinned version — bump \`uniweb\` in package.json (or use
+  \`npx uniweb@latest update\`) to align to something newer.
 `,
   }
 
@@ -1346,7 +1355,7 @@ ${colors.bright}Commands:${colors.reset}
   inspect <path>     Inspect parsed content shape of a markdown file or folder
   docs               Generate component documentation
   doctor             Diagnose project configuration issues
-  update             Update AGENTS.md to match installed CLI version
+  update             Align workspace deps + AGENTS.md to the running CLI
   i18n <cmd>         Internationalization (extract, sync, status)
   template publish   Publish a site as a cloud template
   login              Log in to your Uniweb account

package/src/utils/config.js

@@ -20,6 +20,7 @@ import { join } from 'node:path'
 import { homedir } from 'node:os'
 import yaml from 'js-yaml'
 import { filterCmd } from './pm.js'
+import { writeJsonPreservingStyleAsync } from './json-file.js'
 
 // ── Platform URLs ──────────────────────────────────────────────
 
@@ -27,10 +28,8 @@ import { filterCmd } from './pm.js'
 // REGISTRY hosts platform operations (publish, foundations, runtime, admin):
 //   moved to hosting.uniweb.app in the CDN migration (Phase 4c, 2026-05-04).
 // BACKEND hosts the PHP user-facing surface (login, account, orgs, billing,
-//   publish-authorize): owned by the v4 single-domain plan
-//   (kb/platform/plans/uniweb-domain-plan-v4.md), which will move it to
-//   uniweb.app/api/* when v4 ships. Until then, it stays at hub.uniweb.app.
-const PRODUCTION_BACKEND_URL = 'https://hub.uniweb.app'
+//   publish-authorize).
+const PRODUCTION_BACKEND_URL = 'https://www.uniweb.app'
 const PRODUCTION_REGISTRY_URL = 'https://hosting.uniweb.app'
 
 /**
@@ -156,13 +155,19 @@ export async function readRootPackageJson(rootDir) {
 }
 
 /**
- * Write root package.json (2-space indent)
+ * Write root package.json, preserving the file's existing indentation
+ * (newly scaffolded workspaces use 2-space; we don't reflow whatever's
+ * already there).
  * @param {string} rootDir - Workspace root directory
  * @param {Object} pkg - Package.json object
  */
 export async function writeRootPackageJson(rootDir, pkg) {
   const pkgPath = join(rootDir, 'package.json')
-  await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
+  if (existsSync(pkgPath)) {
+    await writeJsonPreservingStyleAsync(pkgPath, pkg)
+  } else {
+    await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + '\n')
+  }
 }
 
 /**

package/src/utils/dep-survey.js

@@ -0,0 +1,99 @@
+/**
+ * Workspace `@uniweb/*` dependency survey.
+ *
+ * Compares the `@uniweb/*` + `uniweb` versions *declared* in every
+ * package.json across a workspace against the running CLI's bundled
+ * version matrix (`getResolvedVersions`). Shared by `uniweb update`
+ * (which fixes the drift) and `uniweb doctor` (which only reports it) so
+ * the two never disagree about what "out of date" means.
+ *
+ * Comparison is on declared specs, not installed (node_modules) versions
+ * — that's what's committed and what `git diff` will show after a fix.
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { getResolvedVersions } from '../versions.js'
+import { getWorkspacePackages } from './workspace.js'
+
+/**
+ * Strip a leading semver range operator (^, ~, >=, <, …) so two specs can
+ * be compared by their underlying version. Range expressions like
+ * ">=0.5 <0.7" aren't fully parsed — the first version-shaped token wins.
+ * Sufficient for `@uniweb/*` deps, which use `^x.y.z` / `x.y.z`.
+ * @param {string} spec
+ * @returns {string}
+ */
+export function stripVersionRange(spec) {
+  return (spec || '').replace(/^[\^~>=<\s]+/, '').trim().split(/\s+/)[0] || ''
+}
+
+/**
+ * Compare two version specs (range prefix tolerated). Returns 1 / -1 / 0.
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+export function compareSemver(a, b) {
+  const pa = stripVersionRange(a).split('.').map(Number)
+  const pb = stripVersionRange(b).split('.').map(Number)
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1
+  }
+  return 0
+}
+
+/**
+ * @typedef {object} DepRow
+ * @property {string} relDir   Workspace-relative dir, or '(root)'.
+ * @property {string} section  'dependencies' | 'devDependencies' | 'peerDependencies'
+ * @property {string} name     Package name (e.g. '@uniweb/core' or 'uniweb').
+ * @property {string} current  The spec declared in package.json.
+ * @property {string} target   The spec the running CLI's matrix wants.
+ * @property {'aligned'|'behind'|'ahead'} status  current vs target.
+ */
+
+/**
+ * Survey a workspace's declared `@uniweb/*` + `uniweb` deps against the
+ * running CLI's bundled matrix.
+ *
+ * @param {string} workspaceDir Absolute path to the workspace root.
+ * @returns {Promise<{ targets: Record<string,string>, rows: DepRow[], anyDrift: boolean, anyAhead: boolean }>}
+ *   `anyDrift` — at least one dep lags the matrix. `anyAhead` — at least
+ *   one dep is newer than the matrix.
+ */
+export async function surveyWorkspaceDeps(workspaceDir) {
+  const targets = getResolvedVersions()
+  const packages = await getWorkspacePackages(workspaceDir)
+  const dirs = ['', ...packages]
+  const rows = []
+  let anyDrift = false
+  let anyAhead = false
+
+  for (const relDir of dirs) {
+    const pkgDir = relDir ? join(workspaceDir, relDir) : workspaceDir
+    const pkgPath = join(pkgDir, 'package.json')
+    if (!existsSync(pkgPath)) continue
+    let pkg
+    try { pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) } catch { continue }
+
+    for (const sectionName of ['dependencies', 'devDependencies', 'peerDependencies']) {
+      const section = pkg[sectionName]
+      if (!section) continue
+      for (const [name, current] of Object.entries(section)) {
+        if (!(name.startsWith('@uniweb/') || name === 'uniweb')) continue
+        const target = targets[name]
+        if (!target) continue
+        const cmp = compareSemver(target, current)
+        let status
+        if (cmp > 0) { status = 'behind'; anyDrift = true }
+        else if (cmp < 0) { status = 'ahead'; anyAhead = true }
+        else { status = 'aligned' }
+        rows.push({ relDir: relDir || '(root)', section: sectionName, name, current, target, status })
+      }
+    }
+  }
+
+  return { targets, rows, anyDrift, anyAhead }
+}

package/src/utils/json-file.js

@@ -0,0 +1,68 @@
+/**
+ * Style-preserving JSON file writes.
+ *
+ * The CLI rewrites `package.json` in several places (`update`, `doctor`,
+ * `rename`, `add`). A naive `JSON.stringify(obj, null, 2)` reflows the
+ * *entire* file whenever the project happened to use tabs or 4-space
+ * indentation — turning a one-key version bump into a hundred-line diff
+ * (and a needless merge-conflict surface). `framework/CLAUDE.md` calls
+ * this out as an anti-pattern for human commits; the tooling shouldn't do
+ * it either. These helpers detect the file's existing indentation and
+ * trailing-newline convention and preserve both.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { readFile, writeFile } from 'node:fs/promises'
+
+/**
+ * Detect the indentation unit a JSON source string uses.
+ * @param {string} src
+ * @returns {number|string} A space count, or '\t' for tab-indented files.
+ *   Defaults to 2 when the file has no indented lines (e.g. `{}`).
+ */
+export function detectJsonIndent(src) {
+  const m = src.match(/\n([ \t]+)\S/)
+  if (!m) return 2
+  const lead = m[1]
+  if (lead.includes('\t')) return '\t'
+  return lead.length
+}
+
+/**
+ * Serialize `obj` to JSON using the indentation and trailing-newline
+ * convention of `originalSrc` (or of the file currently at `filePath`).
+ * @param {object} obj
+ * @param {string} originalSrc - The file's current text.
+ * @returns {string}
+ */
+export function stringifyJsonLike(obj, originalSrc) {
+  const indent = detectJsonIndent(originalSrc)
+  const body = JSON.stringify(obj, null, indent)
+  return originalSrc.endsWith('\n') ? body + '\n' : body
+}
+
+/**
+ * Write `obj` to `filePath` as JSON, preserving the file's existing
+ * indentation and trailing-newline convention. Pass `originalSrc` when
+ * the caller already has the file contents in hand (avoids a re-read);
+ * otherwise the file is read to sniff its style.
+ * @param {string} filePath
+ * @param {object} obj
+ * @param {string|null} [originalSrc]
+ */
+export function writeJsonPreservingStyle(filePath, obj, originalSrc = null) {
+  const src = originalSrc ?? readFileSync(filePath, 'utf8')
+  writeFileSync(filePath, stringifyJsonLike(obj, src))
+}
+
+/**
+ * Async counterpart to {@link writeJsonPreservingStyle}, for the CLI's
+ * many `node:fs/promises`-based call sites.
+ * @param {string} filePath
+ * @param {object} obj
+ * @param {string|null} [originalSrc]
+ */
+export async function writeJsonPreservingStyleAsync(filePath, obj, originalSrc = null) {
+  const src = originalSrc ?? await readFile(filePath, 'utf8')
+  await writeFile(filePath, stringifyJsonLike(obj, src))
+}

package/src/utils/pm.js

@@ -40,6 +40,35 @@ export function detectWorkspacePm(workspaceRoot) {
   return null
 }
 
+/**
+ * Detect which package manager owns a *globally installed* `uniweb` CLI
+ * binary, by inspecting its install path (`process.argv[1]`). pnpm and
+ * yarn keep global packages under recognizable directory segments;
+ * everything else is assumed to be npm. Only meaningful when the CLI is
+ * actually a global install (see index.js::isGlobalInstall) — a
+ * project-local or npx-launched copy is updated differently.
+ *
+ * @returns {'pnpm' | 'yarn' | 'npm'}
+ */
+export function detectGlobalCliPm() {
+  const path = (process.argv[1] || '').toLowerCase().replace(/\\/g, '/')
+  if (path.includes('/pnpm/')) return 'pnpm'
+  if (path.includes('/yarn/')) return 'yarn'
+  return 'npm'
+}
+
+/**
+ * The command to (re)install the latest `uniweb` CLI globally with a
+ * given package manager.
+ * @param {'pnpm' | 'yarn' | 'npm'} pm
+ * @returns {string}
+ */
+export function globalCliUpdateCmd(pm) {
+  if (pm === 'pnpm') return 'pnpm add -g uniweb@latest'
+  if (pm === 'yarn') return 'yarn global add uniweb@latest'
+  return 'npm i -g uniweb@latest'
+}
+
 /**
  * Generate a workspace-filtered command.
  * pnpm: "pnpm --filter site dev"

package/src/utils/scaffold.js

@@ -13,6 +13,7 @@ import yaml from 'js-yaml'
 import Handlebars from 'handlebars'
 import { copyTemplateDirectory, enumerateTemplateOutputs, registerVersions } from '../templates/processor.js'
 import { getVersionsForTemplates, getCliVersion } from '../versions.js'
+import { writeJsonPreservingStyleAsync } from './json-file.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const TEMPLATES_DIR = join(__dirname, '..', '..', 'templates')
@@ -380,12 +381,13 @@ function resolveDependencyVersion(rawValue) {
  */
 export async function mergeTemplateDependencies(packageJsonPath, deps) {
   if (!deps || Object.keys(deps).length === 0) return
-  const pkg = JSON.parse(await fs.readFile(packageJsonPath, 'utf-8'))
+  const src = await fs.readFile(packageJsonPath, 'utf-8')
+  const pkg = JSON.parse(src)
   if (!pkg.dependencies) pkg.dependencies = {}
   for (const [name, version] of Object.entries(deps)) {
     if (!pkg.dependencies[name] && !pkg.devDependencies?.[name]) {
       pkg.dependencies[name] = resolveDependencyVersion(version)
     }
   }
-  await fs.writeFile(packageJsonPath, JSON.stringify(pkg, null, 2) + '\n')
+  await writeJsonPreservingStyleAsync(packageJsonPath, pkg, src)
 }

package/src/utils/update-check.js

@@ -9,6 +9,7 @@
 import { homedir } from 'node:os'
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
+import { detectGlobalCliPm, globalCliUpdateCmd } from './pm.js'
 
 const CHECK_INTERVAL = 24 * 60 * 60 * 1000 // 1 day
 const STATE_DIR = join(homedir(), '.uniweb')
@@ -62,14 +63,15 @@ function printNotification(current, latest, tone = 'soft') {
   const cyan = '\x1b[36m'
   const dim = '\x1b[2m'
   const reset = '\x1b[0m'
+  const updateCmd = globalCliUpdateCmd(detectGlobalCliPm())
   console.error('')
   if (tone === 'eager') {
     console.error(`${yellow}Heads up:${reset} this CLI is ${dim}${current}${reset}; latest is ${cyan}${latest}${reset}.`)
-    console.error(`${dim}Templates ship with the CLI — consider updating first:${reset} npm i -g uniweb`)
+    console.error(`${dim}Templates ship with the CLI — consider updating first:${reset} ${updateCmd}`)
     console.error(`${dim}Or run a one-shot fresh:${reset} npx uniweb@latest <command>`)
   } else {
     console.error(`${yellow}Update available:${reset} ${dim}${current}${reset} → ${cyan}${latest}${reset}`)
-    console.error(`${dim}Run${reset} npm i -g uniweb ${dim}to update${reset}`)
+    console.error(`${dim}Run${reset} ${updateCmd} ${dim}to update the CLI${reset}`)
   }
 }
 

package/src/versions.js

@@ -76,9 +76,16 @@ function getFrameworkRoot() {
 
 /**
  * Read the current on-disk version of a specific `@uniweb/*` package by
- * looking up `framework/<last-segment>/package.json`. Returns a caret
- * range string like `^0.6.0`, or null if the package isn't present on
- * disk (i.e. the CLI is running from npm, not from the workspace).
+ * looking up `framework/<last-segment>/package.json`. Returns the version
+ * string verbatim (e.g. `0.7.11`), or null if the package isn't present
+ * on disk (i.e. the CLI is running from npm, not from the workspace).
+ *
+ * Returns the version *exact*, not as a caret range, to match the shape
+ * published-CLI direct deps take after pnpm resolves `workspace:*` at
+ * publish time. Both modes converge on identical specs in
+ * `getResolvedVersions()`, so `uniweb update` and the scaffolder produce
+ * the same `package.json` whether the CLI ran from npm or from this
+ * monorepo.
  */
 function readWorkspaceVersion(packageName) {
   const root = getFrameworkRoot()
@@ -90,7 +97,7 @@ function readWorkspaceVersion(packageName) {
   try {
     const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
     if (pkg.name === packageName && pkg.version) {
-      return `^${pkg.version}`
+      return pkg.version
     }
   } catch {}
   return null