uniweb 0.26.0 → 0.26.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -42,14 +42,14 @@
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
     "@uniweb/core": "^0.10.1",
+    "@uniweb/semantic-parser": "^1.2.3",
     "@uniweb/kit": "^0.12.3",
-    "@uniweb/runtime": "^0.12.2",
-    "@uniweb/semantic-parser": "^1.2.3"
+    "@uniweb/runtime": "^0.12.3"
   },
   "peerDependencies": {
+    "@uniweb/build": "^0.24.5",
     "@uniweb/content-reader": "^1.2.3",
-    "@uniweb/semantic-parser": "^1.2.3",
-    "@uniweb/build": "^0.24.5"
+    "@uniweb/semantic-parser": "^1.2.3"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/backend/foundation-bring-along.js

@@ -241,6 +241,21 @@ async function bringLocalCodeAlong({
     args.includes('--force') ||
     args.includes('--no-verify')
 
+  // `--no-release`: ship the site against the code that is ALREADY released, and do
+  // not release the local changes.
+  //
+  // The intent is ordinary and had no name until 2026-08-19 — a developer edits
+  // content and a component in one sitting, and wants the copy fix live without
+  // shipping a half-finished component. Until now the way to get it was `--yes`,
+  // which means "do not ask me": the behaviour was reachable only as a side effect of
+  // a confirmation-skipper, which is discovery by accident.
+  //
+  // ⛔ It skips the RELEASE, never the REGISTRATION REQUIREMENT. A site referencing a
+  // foundation no deployment can resolve cannot be opened in the app at all, so where
+  // this flag cannot be honoured it REFUSES rather than doing the opposite of what it
+  // says (see the `!reg` branch).
+  const noRelease = args.includes('--no-release')
+
   // The pinned ref to stamp on the pushed site — read at RETURN time (after any
   // release), so it reflects the released version + the scope register derived.
   // null when no scoped ref can be formed (then the site.yml ref is forwarded).
@@ -250,6 +265,15 @@ async function bringLocalCodeAlong({
     return s && v ? `${s}@${v}` : null
   }
 
+  // The ref for a run that releases NOTHING — the version the catalog actually holds,
+  // which is not always the local one. ⚠️ `pinnedRef()` reads the LOCAL package.json,
+  // so on a bumped-but-unreleased foundation it names a version nobody can serve. Any
+  // branch that skips a release must bind to this instead.
+  const registeredRef = (reg) =>
+    local.scopedName && reg?.latest_version
+      ? `${local.scopedName}@${reg.latest_version}`
+      : null
+
   // Dry-run reports the intent WITHOUT touching the network — it must not force
   // a login (the digest read is auth-gated). The real run does the compare.
   if (dryRun) {
@@ -277,6 +301,18 @@ async function bringLocalCodeAlong({
     : null
 
   if (!reg) {
+    // ⛔ Nothing to bind to. Releasing anyway would be the opposite of what was asked,
+    // and shipping anyway would leave a site the app cannot open — so stop and say so.
+    if (noRelease) {
+      say.err(
+        `--no-release, but ${label} has never been released — there is no registered version to bind to.`
+      )
+      say.dim(
+        `A site referencing an unreleased ${kind} cannot be opened in the app, so this cannot be skipped.`
+      )
+      say.dim(`Drop \`--no-release\` to release it now.`)
+      return { released: false, proceed: false, refused: true, ref: null }
+    }
     say.info(`Releasing the ${kind} ${label} (not yet registered)…`)
     return {
       released: releaseFoundation(local, args, cliBin, say),
@@ -299,6 +335,15 @@ async function bringLocalCodeAlong({
 
   // A different version locally → a new version to release.
   if (local.version && local.version !== reg.latest_version) {
+    if (noRelease) {
+      // ⚠️ Bind to the REGISTERED version, not the local one. `pinnedRef()` would
+      // return the bumped-but-unreleased `local.version` here — a ref no deployment
+      // can serve, which is the very failure this flag must not create.
+      say.info(
+        `Keeping the released ${kind} ${reg.latest_version} — local ${local.version} not released (\`--no-release\`).`
+      )
+      return { released: false, proceed: true, ref: registeredRef(reg) }
+    }
     say.info(
       `Releasing the ${kind} ${label} (new version; registered latest is ${reg.latest_version})…`
     )
@@ -313,6 +358,12 @@ async function bringLocalCodeAlong({
   if (!reg.digest) {
     // Degrade: the backend doesn't return the stored digest yet, so we can't
     // be sure the registered version matches local. Offer to re-deliver.
+    if (noRelease) {
+      say.info(
+        `Keeping the released ${kind} ${reg.latest_version} — nothing released (\`--no-release\`).`
+      )
+      return { released: false, proceed: true, ref: registeredRef(reg) }
+    }
     say.warn(
       `Can't verify the registered ${label} matches your local copy (backend returned no digest).`
     )
@@ -338,6 +389,14 @@ async function bringLocalCodeAlong({
   // Case 3 (§4): the code was edited but the version wasn't bumped. The
   // registered version is immutable, so we never silently ship the old code —
   // the deliberate release gate is a version bump (§3.1).
+  // Asked for explicitly: the case this flag exists to name.
+  if (noRelease) {
+    say.info(
+      `Keeping the released ${kind} ${reg.latest_version} — your local changes are not released (\`--no-release\`).`
+    )
+    return { released: false, proceed: true, ref: registeredRef(reg) }
+  }
+
   // ⭐ THREE OUTCOMES, NOT TWO — `--yes` and "no TTY" are not the same answer.
   //
   // They were one condition until 2026-08-19, and conflating them meant the only
@@ -372,7 +431,12 @@ async function bringLocalCodeAlong({
     )
     say.dim(`Nothing was sent. Either release the change, or ship without it:`)
     say.dim(`  • bump the ${kind}'s version in package.json, then re-run \`uniweb ${verb}\``)
-    say.dim(`  • \`uniweb ${verb} --yes\` — sends content bound to the registered ${reg.latest_version}`)
+    // Teach the flag that NAMES this, not `--yes`. Both work, but `--yes` means "do
+    // not ask me" and only does this as a side effect — pointing a stuck user at it
+    // teaches a blunt instrument for a precise job.
+    say.dim(
+      `  • \`uniweb ${verb} --no-release\` — sends content bound to the released ${reg.latest_version}`
+    )
     return { released: false, proceed: false, refused: true, ref: null }
   }
 

package/src/commands/push.js

@@ -241,6 +241,33 @@ export async function push(args = [], deps = {}) {
   // `index` — the per-entity source-file map for back-fill, correlated by submission
   // position. Non-local Models are fetched from the registry on demand. `priorHashes`
   // (the .uniweb push-cache) drives "send only changed" across both lanes; --all bypasses.
+  // ⛔ DROP STALE REMOTE STATE FIRST — this must precede the hash read below, and it
+  // did not until 2026-08-19.
+  //
+  // The guard itself is right and its docblock names this exact outcome: on a clone
+  // whose `$uuid` was cleared to re-publish as a new site — WHICH IS OUR OWN
+  // DOCUMENTED RECOVERY — send-only-changed would "skip every entity whose content
+  // had not changed since the OLD site's last push, so the NEW site would come up
+  // missing exactly the content that did not change." It was defeated twice over:
+  //
+  //   · it ran AFTER `readSyncCache`, so the emit still diffed against the old
+  //     site's hashes even though the file on disk had just been emptied;
+  //   · it sat inside `if (mediaRefs.length)`, so a site with no local images never
+  //     reached it at all.
+  //
+  // Measured 2026-08-19 against a live uniwebd: clearing `$uuid` and pushing created
+  // the new site and pulled back **0 pages, 0 sections**. Successful exit, empty site,
+  // nothing to indicate it — the failure the guard was written to prevent.
+  //
+  // Still skipped for an offline emit: `-o` / `--dry-run` must not mutate project state.
+  if (!output && !dryRun) {
+    const dropped = clearRemoteSyncStateIfUnbound(siteDir)
+    if (dropped.length) {
+      note(
+        `Cleared stale sync state from a previous site (${dropped.join(', ')}).`
+      )
+    }
+  }
   const priorHashes = readSyncCache(siteDir)
   // Per-item identity, without which the backend reads every record as new and
   // recreates every page and section row.
@@ -324,13 +351,23 @@ export async function push(args = [], deps = {}) {
       // The site has to exist before its bytes do — an upload with no owning
       // entity is charged and cannot be freed, because freeing means deleting the
       // owner. A no-op once `$uuid` is set, so only a never-synced site pays.
-      const dropped = clearRemoteSyncStateIfUnbound(siteDir)
-      if (dropped.length) {
-        note(
-          `Cleared stale sync state from a previous site (${dropped.join(', ')}).`
-        )
-      }
-      const site = await ensureSiteExists({ client, siteDir, asOrg, note })
+      // ⛔ The PINNED ref, not site.yml's. The create is a THIRD writer of this
+      // value — the emit below stamps it via `injectInfo`, publish passes it here,
+      // and push did neither until 2026-08-19: it sent the authored alias (`src`),
+      // which names a foundation no deployment can resolve. A site created that way
+      // keeps the bad ref, and the backend's create guard now refuses it outright
+      // (channel backend-framework-787e, their measurement).
+      //
+      // ⭐ Same shape as the send-only-changed defect fixed this morning, and missed
+      // for the same reason: the rule was applied at the writers under discussion and
+      // a third caller of the same value was never enumerated.
+      const site = await ensureSiteExists({
+        client,
+        siteDir,
+        asOrg,
+        note,
+        ...(fnd.ref ? { foundation: fnd.ref } : {})
+      })
       if (!site.uuid) {
         error(`Could not create the site on the backend: ${site.reason}`)
         note('Nothing was uploaded and nothing was charged.')

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-19T04:22:45.477Z",
+  "generatedAt": "2026-08-19T12:16:02.893Z",
   "packages": {
     "@uniweb/build": {
       "version": "0.24.5",
@@ -76,7 +76,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.12.2",
+      "version": "0.12.3",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",

package/src/index.js

@@ -1316,6 +1316,11 @@ FOUNDATION on its own use \`uniweb register\` (alias \`uniweb release\`).
 ${colors.bright}Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
+  --no-release       Ship the content against the code already released; release
+                     nothing. For editing content and a component in one sitting
+                     when only the content should go live. Refused if the
+                     foundation has never been released — there is nothing to
+                     bind to, and the app cannot open such a site.
   --no-save          Skip the deploy.yml lastDeploy auto-save
   --no-validate      Skip the content-conformance check (it only warns)
   --org @org         Publish under @org (membership-gated; alias: --as-org). Read
@@ -1753,6 +1758,7 @@ ${colors.bright}Global Options:${colors.reset}
 ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
+  --no-release       Ship content against the already-released code; release nothing
   --org @org         Publish under @org (first publish only; then remembered)
   --personal         Own the new site personally, deliberately (first publish only)
   --no-save          Skip the deploy.yml lastDeploy auto-save

package/src/utils/flag-guard.js

@@ -63,14 +63,16 @@ const VERBS = {
     // one of the three flags that skip its prompts. Found by
     // flag-guard-coverage.test.js the moment push gained the import, which is
     // exactly the hand-enumeration failure that test exists to catch.
-    '--no-verify', ...VIA_DEPLOY
+    '--no-verify',
+    // ship content against the already-released code, releasing nothing
+    '--no-release', ...VIA_DEPLOY
   ],
   publish: [
     '--as-org', '--org', '--backend', '--dry-run', '--force', '--foundation',
     '--personal', '--registry', '--token',
     // read in utils/conformance.js, backend/site-sync.js, and
     // backend/foundation-bring-along.js — none appear in publish.js
-    '--no-validate', '--yes', '--no-verify', ...VIA_DEPLOY
+    '--no-validate', '--yes', '--no-verify', '--no-release', ...VIA_DEPLOY
   ],
   pull: [
     '--backend', '--content-only', '--dry-run', '--force', '--merge',
@@ -90,7 +92,9 @@ const VERBS = {
   status: [
     '--backend', '--json', '--registry', '--remote', '--token', '--dry-run',
     '--force', '--no-verify', '--no-validate', '--yes', '--org', '--as-org',
-    ...VIA_DEPLOY
+    // inert here, reachable through the bring-along module status imports for
+    // `resolveLocalFoundation` — listed per the over-approximation note above
+    '--no-release', ...VIA_DEPLOY
   ],
   /**
    * `refresh` = `git pull`, then a DELEGATED `pull --merge`.