uniweb 0.12.52 → 0.12.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.12.52",
+  "version": "0.12.54",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,14 +41,14 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "0.7.21",
-    "@uniweb/runtime": "0.8.27",
-    "@uniweb/kit": "0.9.26"
+    "@uniweb/core": "0.7.22",
+    "@uniweb/kit": "0.9.28",
+    "@uniweb/runtime": "0.8.28"
   },
   "peerDependencies": {
-    "@uniweb/build": "0.14.33",
-    "@uniweb/content-reader": "1.1.12",
-    "@uniweb/semantic-parser": "1.1.17"
+    "@uniweb/build": "0.14.35",
+    "@uniweb/content-reader": "1.1.13",
+    "@uniweb/semantic-parser": "1.1.18"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/commands/add.js

@@ -27,7 +27,7 @@ import {
 import { discoverFoundations, discoverSites } from '../utils/discover.js'
 import { validatePackageName, getExistingPackageNames, resolveUniqueName } from '../utils/names.js'
 import { findWorkspaceRoot } from '../utils/workspace.js'
-import { detectPackageManager, detectWorkspacePm, filterCmd, installCmd } from '../utils/pm.js'
+import { detectPackageManager, detectWorkspacePm, detectInstalledPnpmVersion, filterCmd, installCmd } from '../utils/pm.js'
 import { isNonInteractive, getCliPrefix, stripNonInteractiveFlag, formatOptions } from '../utils/interactive.js'
 import { resolveTemplate } from '../templates/index.js'
 import { validateTemplate } from '../templates/validator.js'
@@ -1156,9 +1156,13 @@ async function addCi(rootDir, opts, pm = 'pnpm') {
   // CI must run the project's own toolchain. The pnpm major comes from
   // its `packageManager` field when declared; the node major is the
   // project's floor, raised if that pnpm needs more.
-  const pnpmVersion = resolveCiPnpmVersion(rootPkg)
+  const installedPnpm = detectInstalledPnpmVersion(rootDir)
+  const pnpmVersion = resolveCiPnpmVersion(rootPkg, installedPnpm)
   const nodeVersion = resolveCiNodeVersion(rootPkg.engines?.node, pm, pnpmVersion)
-  reportCiToolchain({ pm, pnpmVersion, nodeVersion, rootPkg })
+  reportCiToolchain({
+    pm, pnpmVersion, nodeVersion,
+    source: rootPkg?.packageManager ? 'declared' : installedPnpm ? 'installed' : 'fallback',
+  })
 
   const siteDir = join(rootDir, site.path)
   if (!resolvedDomain) {
@@ -1284,19 +1288,28 @@ function stripScope(name) {
 }
 
 /**
- * Print the toolchain the generated workflow will install.
+ * Print the toolchain the generated workflow will install, and where each
+ * part came from.
  *
- * These versions are inferred whenever the project doesn't state them, and a
- * silent inference is exactly what let a wrong pnpm/Node pairing ship
- * unnoticed. Showing what resolved — and how to override it — follows the
- * same "resolve, then show what resolved" rule the publish scope picker uses.
+ * These values are resolved rather than stated whenever the project is
+ * silent, and a silent resolution is what let a broken pnpm/Node pairing
+ * ship unnoticed. Naming the source matters too: "we read this from your
+ * install" invites a different reaction than "we guessed", and only the
+ * latter needs an override hint.
  */
-function reportCiToolchain({ pm, pnpmVersion, nodeVersion, rootPkg }) {
-  const declared = typeof rootPkg?.packageManager === 'string'
-  const tool = pm === 'pnpm' ? `pnpm ${pnpmVersion}` : pm === 'yarn' ? 'yarn' : 'npm'
-  info(`CI will use ${tool} + Node ${nodeVersion}${declared ? '' : ' (inferred)'}`)
-  if (!declared && pm === 'pnpm') {
-    info(`Pin with "packageManager": "pnpm@<version>" in package.json to use a different major.`)
+function reportCiToolchain({ pm, pnpmVersion, nodeVersion, source }) {
+  if (pm !== 'pnpm') {
+    info(`CI will use ${pm} + Node ${nodeVersion}`)
+    return
+  }
+  const origin = {
+    declared: '',
+    installed: ' (matching your install)',
+    fallback: ' (no pnpm detected — using the default)',
+  }[source] ?? ''
+  info(`CI will use pnpm ${pnpmVersion} + Node ${nodeVersion}${origin}`)
+  if (source === 'fallback') {
+    info(`Pin with "packageManager": "pnpm@<version>" in package.json to choose a major.`)
   }
 }
 
@@ -1358,9 +1371,13 @@ async function addFoundationCi(rootDir, opts, adapter, pm) {
   // CI must run the project's own toolchain. The pnpm major comes from
   // its `packageManager` field when declared; the node major is the
   // project's floor, raised if that pnpm needs more.
-  const pnpmVersion = resolveCiPnpmVersion(rootPkg)
+  const installedPnpm = detectInstalledPnpmVersion(rootDir)
+  const pnpmVersion = resolveCiPnpmVersion(rootPkg, installedPnpm)
   const nodeVersion = resolveCiNodeVersion(rootPkg.engines?.node, pm, pnpmVersion)
-  reportCiToolchain({ pm, pnpmVersion, nodeVersion, rootPkg })
+  reportCiToolchain({
+    pm, pnpmVersion, nodeVersion,
+    source: rootPkg?.packageManager ? 'declared' : installedPnpm ? 'installed' : 'fallback',
+  })
 
   let result
   try {

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-07-22T08:09:32.588Z",
+  "generatedAt": "2026-07-22T09:39:33.879Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.14.33",
+      "version": "0.14.35",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -15,7 +15,7 @@
       ]
     },
     "@uniweb/content-reader": {
-      "version": "1.1.12",
+      "version": "1.1.13",
       "path": "framework/content-reader",
       "deps": []
     },
@@ -25,7 +25,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.7.21",
+      "version": "0.7.22",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -43,7 +43,7 @@
       "deps": []
     },
     "@uniweb/kit": {
-      "version": "0.9.26",
+      "version": "0.9.28",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -61,7 +61,7 @@
       "deps": []
     },
     "@uniweb/runtime": {
-      "version": "0.8.27",
+      "version": "0.8.28",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -84,7 +84,7 @@
       "deps": []
     },
     "@uniweb/semantic-parser": {
-      "version": "1.1.17",
+      "version": "1.1.18",
       "path": "framework/semantic-parser",
       "deps": []
     },
@@ -99,7 +99,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.4.41",
+      "version": "0.4.42",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/utils/pm.js

@@ -5,7 +5,7 @@
  * and generate PM-appropriate commands for output messages.
  */
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { execSync } from 'node:child_process'
 
@@ -41,6 +41,48 @@ export function detectWorkspacePm(workspaceRoot) {
   return null
 }
 
+/**
+ * The pnpm major that actually installed this workspace.
+ *
+ * pnpm records the version it ran as in `node_modules/.modules.yaml`:
+ *
+ *     "packageManager": "pnpm@10.30.0"
+ *
+ * This is a *record of what happened*, not a guess about intent — which
+ * matters, because intent cannot be inferred. The documented way to
+ * scaffold is `npm create uniweb`, and plenty of people follow it with
+ * `pnpm install`; the invoking package manager therefore says nothing
+ * about the one the project uses. The lockfile says WHICH manager
+ * (`detectWorkspacePm`); this says which pnpm MAJOR, which the lockfile
+ * cannot — pnpm 10 and 11 both write `lockfileVersion: 9.0`.
+ *
+ * Despite the extension the file is JSON in current pnpm; `js-yaml`
+ * parses both, since YAML is a superset. Older pnpm wrote real YAML.
+ *
+ * @param {string} workspaceRoot
+ * @returns {string|null} pnpm major (e.g. '10'), or null when the file is
+ *   absent or unreadable — callers fall back to their own default.
+ */
+export function detectInstalledPnpmVersion(workspaceRoot) {
+  if (!workspaceRoot) return null
+  const path = join(workspaceRoot, 'node_modules', '.modules.yaml')
+  if (!existsSync(path)) return null
+  try {
+    // Cheap targeted read: the file is large (hoisted-dependency maps run
+    // to hundreds of KB) and we want exactly one field, so match it
+    // directly rather than parsing the whole document.
+    const text = readFileSync(path, 'utf8')
+    // Quotes optional on both key and value: current pnpm writes JSON
+    // (`"packageManager": "pnpm@10.30.0"`), but the file is named .yaml and
+    // YAML permits the bare form, so accept either rather than depending on
+    // which serializer the installing pnpm happened to use.
+    const match = text.match(/["']?packageManager["']?\s*:\s*["']?pnpm@(\d+)/)
+    return match ? match[1] : null
+  } catch {
+    return null
+  }
+}
+
 /**
  * Detect which package manager owns a *globally installed* `uniweb` CLI
  * binary, by inspecting its install path (`process.argv[1]`). pnpm and

package/src/versions.js

@@ -100,20 +100,37 @@ export const PNPM_MIN_NODE = { '10': 18, '11': 22 }
 /**
  * Resolve the pnpm major a generated CI workflow should install.
  *
- * `packageManager` (the corepack field) is authoritative when present — it is
- * the project stating which pnpm it is developed and locked against, so CI
- * should honour it rather than impose a different major.
+ * Observed, not assumed, in this order:
  *
- * `pnpm-lock.yaml`'s `lockfileVersion` is NOT usable as a signal: pnpm 10 and
- * 11 both write `9.0`, so it cannot distinguish them. Checked, not assumed.
+ *   1. `packageManager` in package.json — the project stating explicitly
+ *      which pnpm it is developed and locked against. Honour it.
+ *   2. What actually installed the project, from
+ *      `node_modules/.modules.yaml` (`detectInstalledPnpmVersion`). A record
+ *      of fact: the developer running `add ci` is the developer who ran
+ *      `pnpm install`, and `add ci` refuses to run before install, so this
+ *      is normally present.
+ *   3. `PNPM_VERSION` — a last resort that should rarely apply.
+ *
+ * There is deliberately no inference from *how the CLI was invoked*. The
+ * documented way to scaffold is `npm create uniweb`, commonly followed by
+ * `pnpm install`, so the invoking manager says nothing about the project's.
+ * Writing a `packageManager` field at scaffold time was considered and
+ * rejected for the same reason — it would guess intent and, being enforced
+ * by corepack, would be a hard pin rather than a hint.
+ *
+ * `pnpm-lock.yaml`'s `lockfileVersion` is NOT usable here: pnpm 10 and 11
+ * both write `9.0`, so it cannot distinguish them. Checked, not assumed.
  *
  * @param {object|null} rootPkg — the workspace root's parsed package.json.
+ * @param {string|null} [installedMajor] — from `detectInstalledPnpmVersion`.
  * @returns {string} pnpm major, as a string for YAML interpolation.
  */
-export function resolveCiPnpmVersion(rootPkg) {
+export function resolveCiPnpmVersion(rootPkg, installedMajor = null) {
   const declared = rootPkg?.packageManager
   const match = typeof declared === 'string' ? declared.match(/^pnpm@(\d+)/) : null
-  return match ? match[1] : PNPM_VERSION
+  if (match) return match[1]
+  if (installedMajor) return String(installedMajor)
+  return PNPM_VERSION
 }
 
 /**