uniweb 0.25.5 → 0.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.25.5",
+  "version": "0.26.1",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -43,8 +43,8 @@
     "tar": "^7.0.0",
     "@uniweb/core": "^0.10.1",
     "@uniweb/kit": "^0.12.3",
-    "@uniweb/runtime": "^0.12.2",
-    "@uniweb/semantic-parser": "^1.2.3"
+    "@uniweb/semantic-parser": "^1.2.3",
+    "@uniweb/runtime": "^0.12.2"
   },
   "peerDependencies": {
     "@uniweb/build": "^0.24.5",

package/src/backend/foundation-bring-along.js

@@ -338,23 +338,58 @@ async function bringLocalCodeAlong({
   // Case 3 (§4): the code was edited but the version wasn't bumped. The
   // registered version is immutable, so we never silently ship the old code —
   // the deliberate release gate is a version bump (§3.1).
+  // ⭐ THREE OUTCOMES, NOT TWO — `--yes` and "no TTY" are not the same answer.
+  //
+  // They were one condition until 2026-08-19, and conflating them meant the only
+  // party that never got asked was the one that most needed asking. A `--yes` is a
+  // decision someone made in advance; an absent TTY is the ABSENCE of a decision,
+  // and absence is not consent.
+  //
+  // ⚖️ Which flips the safe default by caller, for a reason particular to this
+  // situation: proceeding here ships a site bound to code that is NOT the code in
+  // the working tree. A human is at a terminal, reads the warning, and decides. An
+  // agent re-runs commands for free and reports "pushed" on exit 0 — so for it the
+  // cheap outcome is one more cycle and the expensive one is a silent wrong success
+  // it will not look at again. Refusing costs an agent a retry; proceeding costs it
+  // a false completion report and a live site nobody notices is stale.
+
+  // 1. Explicit consent — proceed, but at WARN. `dim` is what we print for things
+  //    nobody needs to read, and "your changes are not live" is not that.
+  if (skipPrompts) {
+    say.warn(
+      `Local ${label} differs from the registered ${reg.latest_version} and the version wasn't bumped — ` +
+        `shipping against the registered code. Your local changes will NOT be live.`
+    )
+    return { released: false, proceed: true, ref: pinnedRef() }
+  }
+
+  // 2. Nobody to ask. Refuse, and name both real options as runnable commands so
+  //    the caller's next step needs no interpretation. `refused` marks this as a
+  //    hard stop rather than a human's "no", which callers map to different exits.
+  if (isNonInteractive(args)) {
+    say.err(
+      `Local ${kind} ${label} differs from the registered ${reg.latest_version}, and the version wasn't bumped.`
+    )
+    say.dim(`Nothing was sent. Either release the change, or ship without it:`)
+    say.dim(`  • bump the ${kind}'s version in package.json, then re-run \`uniweb ${verb}\``)
+    say.dim(`  • \`uniweb ${verb} --yes\` — sends content bound to the registered ${reg.latest_version}`)
+    return { released: false, proceed: false, refused: true, ref: null }
+  }
+
+  // 3. A human is here. State it, then ask.
   say.warn(
     `Your local ${label} differs from the registered version ${reg.latest_version}, but the version wasn't bumped.`
   )
   say.dim(
-    `A registered version is immutable. Bump the ${kind}'s version to release the change, then re-run \`uniweb ${verb}\`.`
+    `A registered version is immutable — bump the ${kind}'s version to release the change.`
   )
-  if (skipPrompts || isNonInteractive(args)) {
-    say.dim(`Proceeding with the already-registered ${reg.latest_version}.`)
-    return { released: false, proceed: true, ref: pinnedRef() }
-  }
   const proceed = await confirm(
     `Continue with the already-registered ${reg.latest_version} anyway?`,
     false
   )
   if (!proceed) {
     say.info(
-      `Aborted — bump the ${kind} version, then re-run \`uniweb ${verb}\`.`
+      `Aborted — nothing was sent. Bump the ${kind} version, then re-run \`uniweb ${verb}\`.`
     )
     return { released: false, proceed: false, ref: null }
   }

package/src/commands/publish.js

@@ -428,7 +428,11 @@ export async function publish(args = []) {
     return { exitCode: 1 }
   }
   if (!ext.proceed) return { exitCode: 1 }
-  if (!fnd.proceed) return { exitCode: 0 }
+  // A human who answered "no" chose this, so it is not a failure — exit 0. A
+  // REFUSAL is different: nobody was asked, nothing shipped, and the caller is
+  // usually an agent that reads the exit code and reports done. Exit 0 there would
+  // be the silent-wrong-success this whole branch exists to prevent.
+  if (!fnd.proceed) return { exitCode: fnd.refused ? 1 : 0 }
 
   // 2. Build the site data (link mode): dist/site-content.json (+ per-locale),
   //    dist/data/*, dist/_search/*, dist/assets/*. Spawn the SAME CLI binary so

package/src/commands/push.js

@@ -241,6 +241,33 @@ export async function push(args = [], deps = {}) {
   // `index` — the per-entity source-file map for back-fill, correlated by submission
   // position. Non-local Models are fetched from the registry on demand. `priorHashes`
   // (the .uniweb push-cache) drives "send only changed" across both lanes; --all bypasses.
+  // ⛔ DROP STALE REMOTE STATE FIRST — this must precede the hash read below, and it
+  // did not until 2026-08-19.
+  //
+  // The guard itself is right and its docblock names this exact outcome: on a clone
+  // whose `$uuid` was cleared to re-publish as a new site — WHICH IS OUR OWN
+  // DOCUMENTED RECOVERY — send-only-changed would "skip every entity whose content
+  // had not changed since the OLD site's last push, so the NEW site would come up
+  // missing exactly the content that did not change." It was defeated twice over:
+  //
+  //   · it ran AFTER `readSyncCache`, so the emit still diffed against the old
+  //     site's hashes even though the file on disk had just been emptied;
+  //   · it sat inside `if (mediaRefs.length)`, so a site with no local images never
+  //     reached it at all.
+  //
+  // Measured 2026-08-19 against a live uniwebd: clearing `$uuid` and pushing created
+  // the new site and pulled back **0 pages, 0 sections**. Successful exit, empty site,
+  // nothing to indicate it — the failure the guard was written to prevent.
+  //
+  // Still skipped for an offline emit: `-o` / `--dry-run` must not mutate project state.
+  if (!output && !dryRun) {
+    const dropped = clearRemoteSyncStateIfUnbound(siteDir)
+    if (dropped.length) {
+      note(
+        `Cleared stale sync state from a previous site (${dropped.join(', ')}).`
+      )
+    }
+  }
   const priorHashes = readSyncCache(siteDir)
   // Per-item identity, without which the backend reads every record as new and
   // recreates every page and section row.
@@ -324,13 +351,23 @@ export async function push(args = [], deps = {}) {
       // The site has to exist before its bytes do — an upload with no owning
       // entity is charged and cannot be freed, because freeing means deleting the
       // owner. A no-op once `$uuid` is set, so only a never-synced site pays.
-      const dropped = clearRemoteSyncStateIfUnbound(siteDir)
-      if (dropped.length) {
-        note(
-          `Cleared stale sync state from a previous site (${dropped.join(', ')}).`
-        )
-      }
-      const site = await ensureSiteExists({ client, siteDir, asOrg, note })
+      // ⛔ The PINNED ref, not site.yml's. The create is a THIRD writer of this
+      // value — the emit below stamps it via `injectInfo`, publish passes it here,
+      // and push did neither until 2026-08-19: it sent the authored alias (`src`),
+      // which names a foundation no deployment can resolve. A site created that way
+      // keeps the bad ref, and the backend's create guard now refuses it outright
+      // (channel backend-framework-787e, their measurement).
+      //
+      // ⭐ Same shape as the send-only-changed defect fixed this morning, and missed
+      // for the same reason: the rule was applied at the writers under discussion and
+      // a third caller of the same value was never enumerated.
+      const site = await ensureSiteExists({
+        client,
+        siteDir,
+        asOrg,
+        note,
+        ...(fnd.ref ? { foundation: fnd.ref } : {})
+      })
       if (!site.uuid) {
         error(`Could not create the site on the backend: ${site.reason}`)
         note('Nothing was uploaded and nothing was charged.')