uniweb 0.12.47 → 0.12.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.12.47",
+  "version": "0.12.49",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -46,9 +46,9 @@
     "@uniweb/runtime": "0.8.26"
   },
   "peerDependencies": {
+    "@uniweb/build": "0.14.31",
     "@uniweb/content-reader": "1.1.12",
-    "@uniweb/semantic-parser": "1.1.17",
-    "@uniweb/build": "0.14.29"
+    "@uniweb/semantic-parser": "1.1.17"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/commands/add.js

@@ -27,11 +27,11 @@ import {
 import { discoverFoundations, discoverSites } from '../utils/discover.js'
 import { validatePackageName, getExistingPackageNames, resolveUniqueName } from '../utils/names.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
-import { detectPackageManager, filterCmd, installCmd } from '../utils/pm.js'
+import { detectPackageManager, detectWorkspacePm, filterCmd, installCmd } from '../utils/pm.js'
 import { isNonInteractive, getCliPrefix, stripNonInteractiveFlag, formatOptions } from '../utils/interactive.js'
 import { resolveTemplate } from '../templates/index.js'
 import { validateTemplate } from '../templates/validator.js'
-import { getVersionsForTemplates, PNPM_VERSION } from '../versions.js'
+import { getVersionsForTemplates, resolveCiPnpmVersion, resolveCiNodeVersion } from '../versions.js'
 
 // Colors for terminal output
 const colors = {
@@ -76,10 +76,41 @@ function parseArgs(args) {
   // doesn't accidentally swallow the next positional.
   const BOOLEAN_FLAGS = new Set(['--force', '--no-previews'])
 
+  // Value flags, mapped to their result key. Both spellings are accepted:
+  // `--host github-pages` and `--host=github-pages`.
+  //
+  // The `=` form used to be dropped silently — every branch matched on an
+  // exact `args[i] === '--flag'`, so `--host=github-pages` fell through
+  // and left `host` null. It went unnoticed because `add ci` defaulted to
+  // github-pages when no host was given, making the one command our docs
+  // print (`uniweb add ci --host=github-pages`) appear to work while
+  // actually ignoring the flag. Requiring a real host surfaced it.
+  const VALUE_FLAGS = {
+    '--path': 'path',
+    '--project': 'project',
+    '--foundation': 'foundation',
+    '--site': 'site',
+    '--from': 'from',
+    '--host': 'host',
+    '--domain': 'domain',
+    '--target': 'target',
+    '--project-name': 'projectName',
+  }
+
+  /** Split `--flag=value` into [flag, value]; `--flag` into [flag, null]. */
+  const splitFlag = (arg) => {
+    const eq = arg.indexOf('=')
+    return eq === -1 ? [arg, null] : [arg.slice(0, eq), arg.slice(eq + 1)]
+  }
+
   // Find positional name (first arg after subcommand that's not a flag).
   for (let i = 1; i < args.length; i++) {
     if (args[i].startsWith('--')) {
-      if (!BOOLEAN_FLAGS.has(args[i])) i++ // skip flag value
+      const [flag, inlineValue] = splitFlag(args[i])
+      // Only skip the next arg when the value is genuinely separate.
+      // Previously an `=`-form flag also consumed the following arg,
+      // which could swallow the positional name.
+      if (!BOOLEAN_FLAGS.has(flag) && inlineValue === null) i++
       continue
     }
     if (!result.name) {
@@ -89,27 +120,17 @@ function parseArgs(args) {
 
   // Parse flags
   for (let i = 1; i < args.length; i++) {
-    if (args[i] === '--path' && args[i + 1]) {
-      result.path = args[++i]
-    } else if (args[i] === '--project' && args[i + 1]) {
-      result.project = args[++i]
-    } else if (args[i] === '--foundation' && args[i + 1]) {
-      result.foundation = args[++i]
-    } else if (args[i] === '--site' && args[i + 1]) {
-      result.site = args[++i]
-    } else if (args[i] === '--from' && args[i + 1]) {
-      result.from = args[++i]
-    } else if (args[i] === '--host' && args[i + 1]) {
-      result.host = args[++i]
-    } else if (args[i] === '--domain' && args[i + 1]) {
-      result.domain = args[++i]
-    } else if (args[i] === '--target' && args[i + 1]) {
-      result.target = args[++i]
-    } else if (args[i] === '--project-name' && args[i + 1]) {
-      result.projectName = args[++i]
-    } else if (args[i] === '--force') {
+    const [flag, inlineValue] = splitFlag(args[i])
+    const key = VALUE_FLAGS[flag]
+    if (key) {
+      if (inlineValue !== null) {
+        result[key] = inlineValue
+      } else if (args[i + 1] !== undefined && !args[i + 1].startsWith('--')) {
+        result[key] = args[++i]
+      }
+    } else if (flag === '--force') {
       result.force = true
-    } else if (args[i] === '--no-previews') {
+    } else if (flag === '--no-previews') {
       result.previews = false
     }
   }
@@ -204,7 +225,16 @@ export async function add(rawArgs) {
       await addSection(rootDir, parsed)
       break
     case 'ci':
-      await addCi(rootDir, parsed, pm)
+      // The scaffolded workflow must install the way THIS WORKSPACE
+      // installs, which is a property of the repo (its lockfile), not of
+      // how the CLI happened to be launched. `detectPackageManager()`
+      // reads npm_config_user_agent, so `npx uniweb add ci` in a pnpm
+      // workspace produced a workflow running `npm ci` — which fails on
+      // the first CI run, because there is no package-lock.json to
+      // install from. npx is a normal way to run the CLI, so this broke
+      // the common case. Fall back to the invocation only when the repo
+      // has no lockfile to read.
+      await addCi(rootDir, parsed, detectWorkspacePm(rootDir) || pm)
       break
     default:
       error(`Unknown subcommand: ${parsed.subcommand}`)
@@ -1123,7 +1153,11 @@ async function addCi(rootDir, opts, pm = 'pnpm') {
   const rootPkg = JSON.parse(
     await readFile(join(rootDir, 'package.json'), 'utf-8').catch(() => '{}')
   )
-  const nodeVersion = parseNodeMajor(rootPkg.engines?.node) || '20'
+  // CI must run the project's own toolchain. The pnpm major comes from
+  // its `packageManager` field when declared; the node major is the
+  // project's floor, raised if that pnpm needs more.
+  const pnpmVersion = resolveCiPnpmVersion(rootPkg)
+  const nodeVersion = resolveCiNodeVersion(rootPkg.engines?.node, pm, pnpmVersion)
 
   const siteDir = join(rootDir, site.path)
   if (!resolvedDomain) {
@@ -1145,7 +1179,7 @@ async function addCi(rootDir, opts, pm = 'pnpm') {
     target: 'site',
     packageManager: pm,
     nodeVersion,
-    pnpmVersion: PNPM_VERSION,
+    pnpmVersion,
     domain: resolvedDomain,
     previews: opts.previews !== false,
     projectName: resolveHostProjectName(rootDir, rootPkg, site, sites.length, opts),
@@ -1303,7 +1337,11 @@ async function addFoundationCi(rootDir, opts, adapter, pm) {
   const rootPkg = JSON.parse(
     await readFile(join(rootDir, 'package.json'), 'utf-8').catch(() => '{}')
   )
-  const nodeVersion = parseNodeMajor(rootPkg.engines?.node) || '20'
+  // CI must run the project's own toolchain. The pnpm major comes from
+  // its `packageManager` field when declared; the node major is the
+  // project's floor, raised if that pnpm needs more.
+  const pnpmVersion = resolveCiPnpmVersion(rootPkg)
+  const nodeVersion = resolveCiNodeVersion(rootPkg.engines?.node, pm, pnpmVersion)
 
   let result
   try {
@@ -1313,7 +1351,7 @@ async function addFoundationCi(rootDir, opts, adapter, pm) {
       target: 'foundation',
       packageManager: pm,
       nodeVersion,
-      pnpmVersion: PNPM_VERSION,
+      pnpmVersion,
     })
   } catch (err) {
     error(err.message)

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-07-21T14:39:07.990Z",
+  "generatedAt": "2026-07-21T21:33:51.867Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.14.29",
+      "version": "0.14.31",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -99,7 +99,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.4.36",
+      "version": "0.4.38",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/versions.js

@@ -53,16 +53,86 @@ let resolvedVersions = null
 export const REACT_VERSION = '^19.0.0'
 
 /**
- * The pnpm major the framework's generated CI standardizes on.
+ * Default pnpm major for generated CI, used only when the project does not
+ * say which pnpm it uses (see `resolveCiPnpmVersion`).
  *
- * Scaffolded CI workflows (`uniweb add ci --host=github-pages`) pin pnpm
- * through `pnpm/action-setup`. This is the one place that value lives, so the
- * pin tracks a single supported major instead of drifting as a hardcoded
- * literal inside each host adapter. A bare major installs the latest patch of
- * that major at CI run time. Bump this when the framework moves to a new pnpm
- * major (latest stable is 11.x as of this writing; pnpm 12 is still alpha).
+ * **This is deliberately 10, not the newest release.** CI must run the same
+ * toolchain the developer runs, or it reports failures that have nothing to
+ * do with their code. Pinning 11 while projects were on 10 produced exactly
+ * that, twice over, on a real repo:
+ *
+ *   - pnpm 11 refuses any dependency published in the last 24 hours
+ *     (`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`). Publish a package and its
+ *     consumer's CI fails until the next day.
+ *   - pnpm 11 changed build-script approval: `onlyBuiltDependencies` in
+ *     `pnpm-workspace.yaml` no longer suffices, and the install exits 1 with
+ *     `ERR_PNPM_IGNORED_BUILDS`. Uniweb sites use `sharp` for image
+ *     processing, so this breaks essentially every site's first CI run.
+ *
+ * Neither is a bug in pnpm — both are reasonable hardening. They are simply
+ * not things a generated workflow should impose on a project that has not
+ * opted into that major.
+ *
+ * A bare major installs the latest patch of that major at CI run time. Before
+ * bumping this, check the new major's release notes for install-time policy
+ * changes, and update `PNPM_MIN_NODE` in the same commit.
  */
-export const PNPM_VERSION = '11'
+export const PNPM_VERSION = '10'
+
+/**
+ * Minimum Node major each supported pnpm major will run on, from that
+ * release's own `engines.node`.
+ *
+ * pnpm 11 declares `>=22.13` and imports `node:sqlite`, which does not exist
+ * before Node 22 — pairing it with Node 20 fails at `pnpm install` with
+ * `ERR_UNKNOWN_BUILTIN_MODULE` before the build is attempted. That was the
+ * default until 2026-07-21, because the CI node major came from the
+ * project's `engines.node` and the workspace template declares `>=20.19`.
+ *
+ * Verify with `npm view pnpm@<major> engines` when adding an entry.
+ */
+export const PNPM_MIN_NODE = { '10': 18, '11': 22 }
+
+/**
+ * Resolve the pnpm major a generated CI workflow should install.
+ *
+ * `packageManager` (the corepack field) is authoritative when present — it is
+ * the project stating which pnpm it is developed and locked against, so CI
+ * should honour it rather than impose a different major.
+ *
+ * `pnpm-lock.yaml`'s `lockfileVersion` is NOT usable as a signal: pnpm 10 and
+ * 11 both write `9.0`, so it cannot distinguish them. Checked, not assumed.
+ *
+ * @param {object|null} rootPkg — the workspace root's parsed package.json.
+ * @returns {string} pnpm major, as a string for YAML interpolation.
+ */
+export function resolveCiPnpmVersion(rootPkg) {
+  const declared = rootPkg?.packageManager
+  const match = typeof declared === 'string' ? declared.match(/^pnpm@(\d+)/) : null
+  return match ? match[1] : PNPM_VERSION
+}
+
+/**
+ * Resolve the Node major a generated CI workflow should install.
+ *
+ * Respects the project's own floor (`engines.node`) but never drops below
+ * what the pinned package manager needs. The project's declared minimum is a
+ * *lower* bound on what its code needs, not a ceiling — running CI on a newer
+ * Node is fine; running it on one the package manager refuses to start on is
+ * not.
+ *
+ * @param {string|null|undefined} enginesNode — the project's `engines.node`.
+ * @param {'pnpm'|'npm'|'yarn'} packageManager
+ * @param {string} [pnpmVersion] — the resolved pnpm major, when pnpm.
+ * @param {string} [fallback='20'] — used when engines.node is absent/unparseable.
+ * @returns {string} Node major, as a string for YAML interpolation.
+ */
+export function resolveCiNodeVersion(enginesNode, packageManager, pnpmVersion = PNPM_VERSION, fallback = '20') {
+  const match = enginesNode ? String(enginesNode).match(/(\d+)/) : null
+  const declared = match ? Number(match[1]) : Number(fallback)
+  const floor = packageManager === 'pnpm' ? (PNPM_MIN_NODE[pnpmVersion] ?? 0) : 0
+  return String(Math.max(declared, floor))
+}
 
 /**
  * Get the CLI's own package.json

package/templates/workspace/pnpm-workspace.yaml.hbs

@@ -3,8 +3,24 @@ packages:
   - "{{this}}"
 {{/each}}
 
-# Permit install scripts for these native deps. pnpm reads this from
-# pnpm-workspace.yaml; the package.json "pnpm" field is ignored by pnpm 11+.
+# Permit install scripts for these native deps (esbuild compiles, sharp
+# resolves its platform binary). Both spellings are listed on purpose:
+#
+#   onlyBuiltDependencies — pnpm 10's name for this setting (a list)
+#   allowBuilds           — pnpm 11 renamed it (a map)
+#
+# pnpm 11 ignores the old name entirely, so with only the list a fresh
+# install fails with ERR_PNPM_IGNORED_BUILDS and exits 1 — before anything
+# is built. pnpm 10 understands both, so keeping the pair means the project
+# installs on either major. Drop `onlyBuiltDependencies` once pnpm 10 is no
+# longer in use.
+#
+# Neither applies to npm or yarn, which run install scripts by default;
+# they read `workspaces` in package.json and ignore this file.
 onlyBuiltDependencies:
   - esbuild
   - sharp
+
+allowBuilds:
+  esbuild: true
+  sharp: true