uniweb 0.12.5 → 0.12.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.12.5",
+  "version": "0.12.6",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,14 +41,14 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
+    "@uniweb/kit": "0.9.9",
     "@uniweb/runtime": "0.8.10",
-    "@uniweb/core": "0.7.9",
-    "@uniweb/kit": "0.9.9"
+    "@uniweb/core": "0.7.9"
   },
   "peerDependencies": {
     "@uniweb/build": "0.13.3",
-    "@uniweb/content-reader": "1.1.9",
-    "@uniweb/semantic-parser": "1.1.16"
+    "@uniweb/semantic-parser": "1.1.16",
+    "@uniweb/content-reader": "1.1.9"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/commands/deploy.js

@@ -254,10 +254,31 @@ async function inspectLocalFoundationReceipt(localPath, { dirtyAsStale, registry
     return { stale: true, reason: 'foundation directory is not in a git repo or has no commits', receipt }
   }
   if (receipt.publishedFromGitSha && receipt.publishedFromGitSha !== gitSha) {
-    return {
-      stale: true,
-      reason: `foundation has new commits since last publish (${receipt.publishedFromGitSha.slice(0, 7)} → ${gitSha.slice(0, 7)})`,
-      receipt,
+    // Receipt's recorded sha differs from the foundation's per-directory
+    // last-touched commit. Normally that's "real" staleness — somebody
+    // committed changes to src/ that haven't been republished.
+    //
+    // Exception: when the publish was made FROM A DIRTY tree, the
+    // recorded sha is a checkpoint, not an identity. The published
+    // artifact reflects the committed state at that sha PLUS the
+    // uncommitted changes that were on disk when publish ran. After
+    // those changes get committed (a normal post-deploy housekeeping
+    // step — e.g., committing the auto-derived `uniweb.id`), the
+    // per-foundation sha moves forward, but the artifact upstream
+    // hasn't materially changed. Don't fire staleness on the sha
+    // alone in that case; let the dirty-tree check below do its job
+    // if the tree IS still dirty, and otherwise treat as fresh.
+    //
+    // Edge: if the user committed real source changes ON TOP of the
+    // auto-derive in the same commit, we won't detect that as stale
+    // here — the next publish would 409 against the registry though,
+    // surfacing the issue with a clear "bump the version" message.
+    if (!receipt.publishedFromGitDirty) {
+      return {
+        stale: true,
+        reason: `foundation has new commits since last publish (${receipt.publishedFromGitSha.slice(0, 7)} → ${gitSha.slice(0, 7)})`,
+        receipt,
+      }
     }
   }
   if (gitDirty && dirtyAsStale) {

package/src/commands/publish.js

@@ -293,9 +293,9 @@ export async function publish(args = []) {
               // the receipt-as-cache work shipped). Clean error before
               // any build work.
               console.log('')
-              error(`${colors.bright}${lookupName}@${preflightVersion}${colors.reset} is already published.`)
+              error(`Foundation source has changed since the last publish, but ${colors.bright}${lookupName}@${preflightVersion}${colors.reset} is already published.`)
               console.log('')
-              console.log(`  Bump the version in package.json to publish an update:`)
+              console.log(`  Bump ${colors.cyan}package.json::version${colors.reset} to publish an update:`)
               console.log(`    ${colors.dim}"version": "${bumpPatch(preflightVersion)}"${colors.reset}`)
               process.exit(1)
             }
@@ -686,10 +686,10 @@ export async function publish(args = []) {
       }
     }
     console.log('')
-    error(`${colors.bright}${name}@${version}${colors.reset} is already published.`)
+    error(`Foundation source has changed since the last publish, but ${colors.bright}${name}@${version}${colors.reset} is already published.`)
     console.log('')
-    console.log(`  Bump the version in foundation.js to publish an update:`)
-    console.log(`    ${colors.dim}export const version = '${bumpPatch(version)}'${colors.reset}`)
+    console.log(`  Bump ${colors.cyan}package.json::version${colors.reset} to publish an update:`)
+    console.log(`    ${colors.dim}"version": "${bumpPatch(version)}"${colors.reset}`)
     process.exit(1)
   }
 

package/src/index.js

@@ -440,9 +440,20 @@ async function main() {
     return
   }
 
-  // Global install launcher: delegate project-bound commands to local CLI
+  // Global install launcher: delegate project-bound commands to local CLI.
+  //
+  // Escape hatch: `UNIWEB_DISABLE_LOCAL_DELEGATION=1` forces the in-process
+  // CLI to handle the command itself, even when a project-local copy of
+  // `uniweb` is installed. This exists for the workspace-ergonomics eval
+  // harness — when it points the eval at `node $WORKSPACE_ROOT/.../index.js`
+  // it expects to exercise the workspace source, not whatever `uniweb`
+  // version is symlinked under the test fixture's `node_modules`. Without
+  // the escape, evals silently test the published npm version and any
+  // unpublished workspace fixes are invisible. See
+  // `kb/framework/build/workspace-ergonomics-runbook.md` (`--cli=workspace`).
   const global = isGlobalInstall()
-  if (global && command && !STANDALONE_COMMANDS.has(command)) {
+  const skipDelegation = process.env.UNIWEB_DISABLE_LOCAL_DELEGATION === '1'
+  if (global && !skipDelegation && command && !STANDALONE_COMMANDS.has(command)) {
     const localCli = findLocalCli()
     if (localCli) {
       await delegateToLocal(localCli)