uniweb 0.16.4 → 0.17.0

package/src/commands/push.js

@@ -26,7 +26,15 @@
  *
  * Usage:
  *   uniweb push                          Build, push both lanes, back-fill $uuid
- *   uniweb push --as-org @org            Act as @org (membership-gated)
+ *   uniweb push --org @org               Own the new site under @org (alias: --as-org).
+ *                                        Read only on the FIRST push of a site — it
+ *                                        decides which org owns it, and whose storage
+ *                                        its assets are charged to. Recorded as
+ *                                        `site.yml::$org` and replayed after that.
+ *                                        Without it, you are asked once.
+ *   uniweb push --personal               Own the new site personally, deliberately.
+ *                                        Sends NO `as_org` — the same wire as before
+ *                                        this prompt existed. First push only.
  *   uniweb push --dry-run                Report what would be pushed; submit nothing
  *   uniweb push -o out.uwx               Write the .uwx file(s) per lane; submit nothing
  *   uniweb push --registry <url>         Override the backend origin
@@ -59,6 +67,8 @@ import { uploadSiteMedia, describeAssetRefusal } from '../backend/site-media.js'
 import { BackendClient } from '../backend/client.js'
 import { resolveSiteDir, resolveSiteBackend } from './deploy.js'
 import { warnIfContentDoesNotConform } from '../utils/conformance.js'
+import { readOrgFlag } from '../utils/args.js'
+import { checkFlags } from '../utils/flag-guard.js'
 import {
   makeModelResolver,
   readSyncCache,
@@ -68,7 +78,8 @@ import {
   ensureItemUuids,
   ensureSiteExists,
   clearRemoteSyncStateIfUnbound,
-  pushSyncPackages
+  pushSyncPackages,
+  resolveSiteOrgForCreate
 } from '../backend/site-sync.js'
 
 // Re-exported for downstream importers (pull.js, push.test.js) that read these
@@ -103,10 +114,16 @@ function flagValue(args, name) {
 }
 
 export async function push(args = []) {
+  // An unrecognized flag is invisible to a literal scan, so it silently keeps the
+  // default — including for --backend, where the default can be production.
+  const bad = checkFlags('push', args)
+  if (bad) {
+    error(bad.message)
+    return { exitCode: 2 }
+  }
   const dryRun = args.includes('--dry-run')
   const output = flagValue(args, '-o') || flagValue(args, '--output')
   const tokenFlag = flagValue(args, '--token')
-  const asOrg = flagValue(args, '--as-org')
   const foundationDir = flagValue(args, '--foundation')
   const sendAll = args.includes('--all') // bypass the send-only-changed cache
   // --force drops the optimistic-concurrency precondition, making the push
@@ -135,6 +152,25 @@ export async function push(args = []) {
     command: 'Syncing'
   })
 
+  // WHO will own this site, if this push is the one that creates it. Resolved
+  // before any lane runs, because both create paths below consume it and neither
+  // should be reached with the question still open. A site that already exists
+  // resolves to null without asking — ownership was settled at its create.
+  const org = await resolveSiteOrgForCreate({
+    client,
+    siteDir,
+    args,
+    flag: readOrgFlag(args),
+    personal: args.includes('--personal'),
+    offline: !!output || dryRun
+  })
+  if (org.refused) {
+    error('Refusing to create this site without naming an owner.')
+    note(org.reason)
+    return { exitCode: 2 }
+  }
+  const asOrg = org.asOrg
+
   // Build BOTH directional packages (the producer side). Each carries its own
   // `index` — the per-entity source-file map for back-fill, correlated by submission
   // position. Non-local Models are fetched from the registry on demand. `priorHashes`

package/src/commands/register.js

@@ -81,6 +81,7 @@ import {
   promptSelect
 } from '../utils/workspace.js'
 import { isNonInteractive, getCliPrefix } from '../utils/interactive.js'
+import { checkFlags } from '../utils/flag-guard.js'
 
 const colors = {
   reset: '\x1b[0m',
@@ -265,6 +266,13 @@ export function foundationNeedsBuild(targetDir) {
 }
 
 export async function register(args = []) {
+  // See utils/flag-guard.js — an unrecognized flag is invisible to a
+  // literal scan, so it silently keeps the default (production, for --backend).
+  const badFlag = checkFlags('register', args)
+  if (badFlag) {
+    error(badFlag.message)
+    return { exitCode: 2 }
+  }
   jsonMode = args.includes('--json')
   jsonEmitted = false
   lastError = null

package/src/commands/status.js

@@ -30,6 +30,7 @@ import { BackendClient } from '../backend/client.js'
 import { readFlagValue } from '../utils/args.js'
 import { resolveLocalFoundation } from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
+import { checkFlags } from '../utils/flag-guard.js'
 
 const c = {
   reset: '\x1b[0m',
@@ -73,6 +74,14 @@ function splitFoundationRef(fnd) {
 }
 
 export async function status(args = []) {
+  // See utils/flag-guard.js — an unrecognized flag is invisible to a literal scan.
+  // Straight to stderr: this is a usage error, so it must not be mistaken for the
+  // status document even under --json.
+  const badFlag = checkFlags('status', args)
+  if (badFlag) {
+    console.error(`\x1b[31m✗\x1b[0m ${badFlag.message}`)
+    return { exitCode: 2 }
+  }
   const jsonMode = args.includes('--json')
   const remote = args.includes('--remote')
   const siteDir = await resolveSiteDir(args, 'status')

package/src/framework-index.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-11T13:40:25.377Z",
+  "generatedAt": "2026-08-12T22:56:55.282Z",
   "packages": {
     "@uniweb/build": {
-      "version": "0.18.4",
+      "version": "0.18.5",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -28,7 +28,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.8.4",
+      "version": "0.8.5",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -46,7 +46,7 @@
       "deps": []
     },
     "@uniweb/kit": {
-      "version": "0.11.2",
+      "version": "0.11.3",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -65,7 +65,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.2.7",
+      "version": "0.2.8",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -73,7 +73,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.11.4",
+      "version": "0.11.6",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/semantic-parser": {
-      "version": "1.2.1",
+      "version": "1.2.2",
       "path": "framework/semantic-parser",
       "deps": []
     },
@@ -111,7 +111,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.8.3",
+      "version": "0.8.4",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -1318,6 +1318,14 @@ ${colors.bright}Options:${colors.reset}
   --yes              Skip confirmations (CI); never block on a prompt
   --no-save          Skip the deploy.yml lastDeploy auto-save
   --no-validate      Skip the content-conformance check (it only warns)
+  --org @org         Publish under @org (membership-gated; alias: --as-org). Read
+                     only on a site's FIRST publish — that create decides which org
+                     owns the site, and whose storage its assets are charged to.
+                     Recorded as site.yml \$org and replayed, so it is never
+                     re-typed. Without it, you are asked once.
+  --personal         Create the site under your personal account, deliberately.
+                     Only needed on a first publish, and only to answer the owner
+                     question without a prompt (CI, agents, scripts).
   --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)
   --token <bearer>   Auth bearer (skips \`uniweb login\`)
 `,
@@ -1693,6 +1701,8 @@ ${colors.bright}Global Options:${colors.reset}
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
+  --org @org         Publish under @org (first publish only; then remembered)
+  --personal         Own the new site personally, deliberately (first publish only)
   --no-save          Skip the deploy.yml lastDeploy auto-save
   --no-validate      Skip the content-conformance check (it only warns)
   --backend <url>    Backend origin (default: \$UNIWEB_REGISTER_URL or built-in)

package/src/utils/args.js

@@ -20,6 +20,104 @@
  * @param {string} name — Including the leading dashes, e.g. '--host'.
  * @returns {string | null | undefined}
  */
+/**
+ * The org a site is created under. `--org` is the documented spelling; `--as-org`
+ * is a working alias.
+ *
+ * `--as-org` mirrors the wire (`?as_org=`) and names an *acting capacity* — the
+ * request is made as a member of that org, membership-gated. That is accurate, and
+ * it is also not the name anyone reaches for: asked in one day, the backend's docs
+ * said `--as-unit` and a second reader said `--org`; nobody produced `--as-org`.
+ * Since the flag's main job is answering *who owns this site*, `--org` is the name
+ * that matches the question, and the alias costs one `||` (the same shape
+ * `--backend` / `--registry` already uses).
+ *
+ * `||`, not `??`, on purpose: a valueless `--org` falls through to `--as-org`
+ * rather than shadowing it.
+ *
+ * @param {string[]} args
+ * @returns {string|null|undefined}
+ */
+export function readOrgFlag(args) {
+  return readFlagValue(args, '--org') || readFlagValue(args, '--as-org')
+}
+
+/**
+ * Every `--flag` / `-f` token in `args` that `known` does not list.
+ *
+ * The CLI reads flags by scanning argv for a literal, so an unrecognized flag is
+ * not an error — it is *invisible*, and whatever it was meant to change silently
+ * keeps its default. The sharp case is `--backend`: mistype it and the origin
+ * ladder falls through to the session, the saved config, or `https://uniweb.app`,
+ * so a command aimed at localhost can reach production. `--token` degrades the
+ * same way, to a stored session belonging to someone else.
+ *
+ * Scanning rules, chosen to avoid false positives (a wrong rejection is worse than
+ * a missed one — it breaks a working command):
+ *  - only tokens beginning with `-` are candidates; a VALUE is never one unless it
+ *    itself looks like a flag, which `readFlagValue` already refuses to consume;
+ *  - `--flag=value` is checked on the name half;
+ *  - a bare `--` ends flag scanning, the POSIX convention;
+ *  - a lone `-` is a value (stdin), not a flag.
+ *
+ * @param {string[]} args
+ * @param {string[]} known - every flag this command accepts, with dashes
+ * @returns {string[]} the unrecognized tokens, in order, deduped
+ */
+export function findUnknownFlags(args, known) {
+  const set = new Set(known)
+  const out = []
+  for (const raw of args) {
+    if (raw === '--') break
+    if (raw === '-' || !raw.startsWith('-')) continue
+    const name = raw.split('=')[0]
+    if (set.has(name) || out.includes(name)) continue
+    out.push(name)
+  }
+  return out
+}
+
+/** Levenshtein distance, small and iterative — used only for a suggestion. */
+function editDistance(a, b) {
+  const prev = Array.from({ length: b.length + 1 }, (_, i) => i)
+  for (let i = 1; i <= a.length; i++) {
+    let diag = prev[0]
+    prev[0] = i
+    for (let j = 1; j <= b.length; j++) {
+      const tmp = prev[j]
+      prev[j] = Math.min(
+        prev[j] + 1,
+        prev[j - 1] + 1,
+        diag + (a[i - 1] === b[j - 1] ? 0 : 1)
+      )
+      diag = tmp
+    }
+  }
+  return prev[b.length]
+}
+
+/**
+ * The closest known flag to `flag`, or null when nothing is close enough.
+ * The threshold scales with length so `--org` → `--as-org` is offered while two
+ * unrelated short flags are not.
+ * @param {string} flag
+ * @param {string[]} known
+ * @returns {string|null}
+ */
+export function didYouMean(flag, known) {
+  let best = null
+  let bestD = Infinity
+  for (const k of known) {
+    const d = editDistance(flag, k)
+    if (d < bestD) {
+      bestD = d
+      best = k
+    }
+  }
+  const limit = Math.max(2, Math.floor(flag.length / 3))
+  return best && bestD <= limit ? best : null
+}
+
 export function readFlagValue(args, name) {
   const eqPrefix = name + '='
   for (let i = 0; i < args.length; i++) {

package/src/utils/flag-guard.js

@@ -0,0 +1,89 @@
+/**
+ * Reject unrecognized flags on the backend verbs.
+ *
+ * Every one of these commands can send data to, or authenticate against, a remote
+ * host — and the CLI resolves flags by scanning argv for a literal, so a flag it
+ * does not recognize does not fail: it *disappears*, and the thing it was meant to
+ * change silently keeps its default.
+ *
+ * That is tolerable for a cosmetic flag and dangerous for these two:
+ *
+ *   --backend   mistyped ⇒ the origin ladder falls through to the session origin,
+ *               ~/.uniweb/config.json, and finally https://uniweb.app. A command
+ *               aimed at a local backend can reach production.
+ *   --token     mistyped ⇒ falls back to the stored session, so the request is
+ *               made as whoever is logged in rather than whoever was intended.
+ *
+ * Neither produces an error today; both produce a plausible success against the
+ * wrong host. This turns that class into one sentence.
+ *
+ * ⚠️ A wrong rejection is worse than a missed one — it breaks an invocation that
+ * works — so the per-command lists must be complete, INCLUDING flags read by
+ * helpers rather than by the command file itself. Two live examples: `--no-validate`
+ * is consumed inside `utils/conformance.js`, and `--yes` inside
+ * `backend/foundation-bring-along.js`. Grepping only the command's own source
+ * misses both. When you add a flag anywhere on one of these paths, add it here.
+ */
+
+import { findUnknownFlags, didYouMean } from './args.js'
+
+/** Accepted by every command, wherever they are actually consumed. */
+const GLOBAL = ['--non-interactive', '--help', '-h']
+
+/**
+ * Per-verb flag sets. Derived by scanning each command for dash-literals AND the
+ * helpers it calls — not from the help text, which has drifted from the parser in
+ * both directions (`--as-org` was implemented and undocumented; `--yes` is
+ * documented on `publish` and consumed two files away).
+ */
+export const VERB_FLAGS = {
+  push: [
+    '--all', '--as-org', '--org', '--backend', '--dry-run', '--force',
+    '--foundation', '--output', '-o', '--personal', '--registry', '--token',
+    '--no-validate'
+  ],
+  publish: [
+    '--as-org', '--org', '--backend', '--dry-run', '--force', '--foundation',
+    '--no-save', '--personal', '--registry', '--token', '--no-validate', '--yes'
+  ],
+  pull: [
+    '--backend', '--content-only', '--dry-run', '--force', '--merge',
+    '--no-collections', '--no-delete', '--no-prune', '--registry', '--token'
+  ],
+  clone: [
+    '--backend', '--content-only', '--no-collections', '--path', '--project',
+    '--registry', '--token'
+  ],
+  register: [
+    '--backend', '--dry-run', '--json', '--output', '-o', '--registry',
+    '--schema-only', '--scope', '--token'
+  ],
+  status: ['--backend', '--json', '--registry', '--remote', '--token']
+}
+
+/**
+ * Check `args` against the verb's accepted set. Returns null when everything is
+ * recognized, or a ready-to-print message naming the first offender (plus a
+ * suggestion when one is close).
+ *
+ * Reports ONE flag rather than all of them: the first is usually the cause, and a
+ * list invites skimming past the suggestion, which is the actionable half.
+ *
+ * @param {string} verb - a key of VERB_FLAGS
+ * @param {string[]} args - the argv slice for this command
+ * @returns {{ flag: string, message: string, suggestion: string|null }|null}
+ */
+export function checkFlags(verb, args = []) {
+  const known = VERB_FLAGS[verb]
+  if (!known) return null
+  const all = [...known, ...GLOBAL]
+  const unknown = findUnknownFlags(args, all)
+  if (!unknown.length) return null
+
+  const flag = unknown[0]
+  const suggestion = didYouMean(flag, all)
+  const lines = [`Unknown flag \`${flag}\` for \`uniweb ${verb}\`.`]
+  if (suggestion) lines.push(`  Did you mean \`${suggestion}\`?`)
+  lines.push(`  Run \`uniweb ${verb} --help\` for the accepted flags.`)
+  return { flag, suggestion, message: lines.join('\n') }
+}

package/src/utils/git.js

@@ -18,8 +18,8 @@
  */
 
 import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { readFileSync, realpathSync } from 'node:fs'
+import { join, relative } from 'node:path'
 import yaml from 'js-yaml'
 
 /**
@@ -85,11 +85,44 @@ export function isGitRepo(dir) {
  * as modified here: a section file that exists only locally is not on the backend,
  * so a pruning pull deletes it — losing work that was never committed anywhere.
  *
- * @returns {string[]|null} repo-relative-ish paths as git reports them, or `null`
- *   when this isn't a git work tree (distinct from `[]`, which means "clean").
+ * ⛔ **Returned relative to `dir`, which is NOT what git prints.** `--porcelain`
+ * paths are always relative to the REPOSITORY ROOT, whatever directory it runs
+ * in, so they only coincide with `dir`-relative when the site *is* the repo root.
+ * Both callers do `join(siteDir, rel)` with the result, so the un-normalized form
+ * was wrong for every nested layout — a site at `myproject/site/` inside a repo.
+ *
+ * What that cost, measured 2026-08-12: pull exempts its own previous output from
+ * the uncommitted-work guard by looking each dirty path up in a record keyed
+ * `dir`-relative (`utils/pull-written.js`). Given `myproject/site/site.yml` the
+ * lookup missed, so **pull refused on files pull itself had written** — the exact
+ * false alarm that record exists to prevent, and the one its own comment warns
+ * teaches people to reach for `--force`. `captureLocalWork` had the same defect
+ * one door along: it reads each path back with `join(siteDir, rel)`.
+ *
+ * The earlier `@returns` said "repo-relative-ish paths as git reports them" while
+ * the summary above said "relative to `dir`" — the ambiguity was noticed and left,
+ * and both callers had picked the other reading.
+ *
+ * @returns {string[]|null} paths relative to `dir`, or `null` when this isn't a
+ *   git work tree (distinct from `[]`, which means "clean").
  */
 export function uncommittedUnder(dir, relPaths) {
   if (!isGitRepo(dir)) return null
+  // ⚠️ Both sides must be REAL paths before `relative` can compare them.
+  // `rev-parse --show-toplevel` resolves symlinks; the caller's `dir` usually has
+  // not. On macOS that alone breaks it — `/var` is a symlink to `/private/var`,
+  // so a repo under the temp dir yields a root of `/private/var/…` against a dir
+  // of `/var/…`, and `relative` walks all the way up and back down. The result is
+  // a valid-looking path that matches nothing, i.e. the same silent miss this
+  // normalization exists to fix. Any symlinked checkout does it, not just tmp.
+  let root
+  let base
+  try {
+    root = git(['rev-parse', '--show-toplevel'], dir).trim()
+    base = realpathSync(dir)
+  } catch {
+    return null
+  }
   try {
     const out = git(
       ['status', '--porcelain', '--untracked-files=all', '--', ...relPaths],
@@ -102,6 +135,12 @@ export function uncommittedUnder(dir, relPaths) {
         // porcelain v1: XY<space>path, and a rename is "orig -> new".
         .map((line) => line.slice(3).trim())
         .map((p) => (p.includes(' -> ') ? p.split(' -> ')[1] : p))
+        // Porcelain paths are repo-root-relative; callers want them relative to
+        // `dir`. Quoted paths (git quotes names with spaces or non-ASCII when
+        // `core.quotePath` is on) are left alone rather than half-decoded — a
+        // wrong path is worse than an unmatched one here, since an unmatched
+        // path merely stays "dirty" and the guard errs toward refusing.
+        .map((p) => (p.startsWith('"') ? p : relative(base, join(root, p))))
         .filter(Boolean)
     )
   } catch {

package/src/utils/pull-written.js

@@ -0,0 +1,127 @@
+/**
+ * The record of what a machine wrote into a site project — pull's own output.
+ *
+ * ## What it is for
+ *
+ * `uniweb pull` refuses to run when there are uncommitted changes under the files
+ * it rewrites, because it reconciles the working tree to the backend and would
+ * overwrite them. That guard needs one distinction to be useful: **a file the
+ * user edited** versus **a file a previous pull wrote and nobody has touched
+ * since**. Without it the guard cries wolf — pull rewrites the tree, so the next
+ * pull sees its own output as uncommitted work and refuses, listing files the
+ * user never touched. A guard that fires on nothing teaches people to reach for
+ * `--force`, which is the destructive option.
+ *
+ * So each write is recorded with a content hash, and a dirty path whose hash
+ * still matches is not user work.
+ *
+ * ## Why it lives here rather than in `pull.js`
+ *
+ * `uniweb clone` has the same claim to make and cannot make it from there.
+ * `pull.js` statically imports `@uniweb/build`, which resolves from the
+ * *project's* `node_modules` — and `clone` runs before a project exists (see
+ * `utils/uwx-read.js` for the same constraint on the `.uwx` reader).
+ *
+ * Clone scaffolds `site.yml` and `theme.yml` and then delegates to `pull`, so
+ * without this the delegated pull sees clone's own scaffolding as uncommitted
+ * user work and refuses — on a project created seconds earlier, where there is no
+ * user work to protect. Clone records what it wrote; the guard then exempts those
+ * files **for the right reason** rather than being overridden.
+ *
+ * Nothing here imports `@uniweb/build`, and nothing here may start to.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { join, dirname, relative } from 'node:path'
+
+/** Where the record lives — gitignored, beside the other per-site caches. */
+export function writtenCachePath(siteDir) {
+  return join(siteDir, '.uniweb', 'pull-written.json')
+}
+
+/**
+ * @param {string} siteDir
+ * @returns {{files: Record<string,string>, deleted: string[]}}
+ */
+export function readWritten(siteDir) {
+  try {
+    const o = JSON.parse(readFileSync(writtenCachePath(siteDir), 'utf8'))
+    return {
+      files: o && typeof o.files === 'object' ? o.files : {},
+      deleted: Array.isArray(o?.deleted) ? o.deleted : []
+    }
+  } catch {
+    return { files: {}, deleted: [] }
+  }
+}
+
+/**
+ * Record files as machine-written, by absolute path.
+ *
+ * MERGE, don't replace. A conditional pull that 304s writes nothing, and a
+ * partial pull writes only some lanes — in both cases the previous record is
+ * still "the last thing written there". Replacing would forget those paths and
+ * the next pull would see them as the user's work again, which is the false alarm
+ * this cache exists to prevent. A stale entry for a file that no longer exists is
+ * harmless: the hash read fails and it counts as a local change.
+ *
+ * @param {string} siteDir
+ * @param {string[]} absPaths - files just written
+ * @param {string[]} [deletedAbs] - files just pruned
+ */
+export function recordWritten(siteDir, absPaths, deletedAbs = []) {
+  const prior = readWritten(siteDir)
+  const files = prior.files
+  for (const abs of absPaths) {
+    try {
+      files[relative(siteDir, abs)] = createHash('sha256')
+        .update(readFileSync(abs))
+        .digest('hex')
+    } catch {
+      /* deleted or unreadable — nothing to remember */
+    }
+  }
+  // Pull PRUNES too, and a deletion is a dirty path git reports just like an edit.
+  // Without recording them, pull's own pruning reads as the user having deleted
+  // files — the same false alarm as its writes, arriving by the other door.
+  const deleted = [
+    ...new Set([...prior.deleted, ...deletedAbs.map((a) => relative(siteDir, a))])
+  ]
+  try {
+    mkdirSync(dirname(writtenCachePath(siteDir)), { recursive: true })
+    writeFileSync(
+      writtenCachePath(siteDir),
+      JSON.stringify({ version: 1, files, deleted }, null, 2) + '\n'
+    )
+  } catch {
+    /* best-effort: losing it only costs a spurious refusal */
+  }
+}
+
+/**
+ * Is this dirty path just machine output nobody has touched?
+ *
+ * The hash comparison is what keeps the guard honest: a scaffolded or pulled file
+ * the user then EDITED no longer matches, so it counts as their work and the
+ * refusal stands.
+ *
+ * @param {string} siteDir
+ * @param {string} relPath
+ * @param {{files: Record<string,string>, deleted: string[]}} written
+ * @returns {boolean}
+ */
+export function isPullOutput(siteDir, relPath, written) {
+  let exists = true
+  let hash = null
+  try {
+    hash = createHash('sha256')
+      .update(readFileSync(join(siteDir, relPath)))
+      .digest('hex')
+  } catch {
+    exists = false
+  }
+  // Absent because pull pruned it — not because the user deleted it.
+  if (!exists) return written.deleted.includes(relPath)
+  return written.files[relPath] === hash
+}