uniweb 0.37.1 → 0.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uniweb",
-  "version": "0.37.1",
+  "version": "0.39.0",
   "description": "Create structured Vite + React sites with content/code separation",
   "type": "module",
   "bin": {
@@ -41,15 +41,15 @@
     "js-yaml": "^4.1.0",
     "prompts": "^2.4.2",
     "tar": "^7.0.0",
-    "@uniweb/core": "^0.16.0",
-    "@uniweb/kit": "^0.15.3",
-    "@uniweb/runtime": "^0.13.5",
-    "@uniweb/semantic-parser": "^1.4.0"
+    "@uniweb/semantic-parser": "^1.4.0",
+    "@uniweb/runtime": "^0.13.7",
+    "@uniweb/core": "^0.18.0",
+    "@uniweb/kit": "^0.15.5"
   },
   "peerDependencies": {
-    "@uniweb/build": "^0.33.0",
-    "@uniweb/semantic-parser": "^1.4.0",
-    "@uniweb/content-reader": "^1.2.4"
+    "@uniweb/build": "^0.35.0",
+    "@uniweb/content-reader": "^1.2.4",
+    "@uniweb/semantic-parser": "^1.4.0"
   },
   "peerDependenciesMeta": {
     "@uniweb/build": {

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-02T17:42:38.924Z",
+  "generatedAt": "2026-09-02T19:47:04.699Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.2.2",
+      "version": "0.2.4",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.33.0",
+      "version": "0.35.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -34,7 +34,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.16.0",
+      "version": "0.18.0",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -47,14 +47,14 @@
       "deps": []
     },
     "@uniweb/icons": {
-      "version": "0.4.7",
+      "version": "0.4.9",
       "path": "framework/icons",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/kit": {
-      "version": "0.15.3",
+      "version": "0.15.5",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -73,7 +73,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.5.4",
+      "version": "0.5.6",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -81,7 +81,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.13.5",
+      "version": "0.13.7",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -119,7 +119,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.8.20",
+      "version": "0.9.1",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/utils/registry-auth.js

@@ -1,3 +1,23 @@
+/**
+ * ⛔ **HUMAN OUTPUT IN THIS FILE GOES TO STDERR, NEVER STDOUT.**
+ *
+ * `stdout` is the CLI's DATA channel. `uniweb register --json` promises a single
+ * parseable JSON line there, and `register` diverts its own output accordingly —
+ * but it calls into this module, which wrote prose to stdout directly, so the
+ * promise broke for any caller that piped it.
+ *
+ * ⭐ Measured by the `flows` lane at `uniweb@0.37.1`: two stray lines ahead of
+ * the JSON on the cold path — down from ~35 before the delegated builder's
+ * stdout was redirected to fd 2, which is why the two defects share one symptom
+ * and only one of them was fixed. Every line here is prose, a prompt, or a
+ * cancellation notice; none of it is anything a machine reads. On stderr it is
+ * equally visible to a human and invisible to a pipe.
+ *
+ * ⚖️ This is not a `--json` special case. A utility that cannot see the flag
+ * should not be choosing the stream at all — which is exactly how it got the
+ * choice wrong. `cli/test/porcelain-stdout.test.js` walks `register`'s import
+ * graph and fails on a new `console.log`.
+ */
 /**
  * Registry (new-backend) credential storage + login.
  *
@@ -212,11 +232,11 @@ export async function ensureRegistryAuth({
   }
 
   if (stored && isExpired(stored)) {
-    console.log(
+    console.error(
       `\x1b[33mSession expired.\x1b[0m ${command} requires a Uniweb account.\n`
     )
   } else {
-    console.log(`${command} requires a Uniweb account.\n`)
+    console.error(`${command} requires a Uniweb account.\n`)
   }
 
   // Interactive: hand off to the multi-method login picker, reuse its session.
@@ -273,7 +293,7 @@ async function loginViaPassword({ apiBase, nonInteractive }) {
       ],
       {
         onCancel: () => {
-          console.log('\nLogin cancelled.')
+          console.error('\nLogin cancelled.')
           process.exit(0)
         }
       }
@@ -300,7 +320,7 @@ async function loginViaTokenPaste({ apiBase, nonInteractive }) {
     },
     {
       onCancel: () => {
-        console.log('\nLogin cancelled.')
+        console.error('\nLogin cancelled.')
         process.exit(0)
       }
     }
@@ -398,14 +418,14 @@ export async function awaitBrowserCallback({
       const { port } = server.address()
       const redirectUri = `http://127.0.0.1:${port}/callback`
       const url = buildUrl(redirectUri)
-      console.log(`\x1b[36m→\x1b[0m ${openingLabel}`)
-      console.log(`  \x1b[2m${url}\x1b[0m`)
+      console.error(`\x1b[36m→\x1b[0m ${openingLabel}`)
+      console.error(`  \x1b[2m${url}\x1b[0m`)
       const opened = await openBrowser(url)
       if (!opened)
-        console.log(
+        console.error(
           '\x1b[33m⚠\x1b[0m Could not open a browser automatically — open the URL above.'
         )
-      console.log(
+      console.error(
         `\x1b[2m${waitingLabel || `Waiting (${Math.round(timeoutMs / 1000)}s)…`}\x1b[0m`
       )
     })
@@ -528,10 +548,10 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
       existing.username ||
       existing.handle ||
       (existing.uuid ? `account ${existing.uuid}` : '')
-    console.log(
+    console.error(
       `Already logged in${who ? ` as \x1b[1m${who}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}.`
     )
-    console.log('\x1b[2mContinuing will replace the existing session.\x1b[0m\n')
+    console.error('\x1b[2mContinuing will replace the existing session.\x1b[0m\n')
   }
 
   const { isNonInteractive } = await import('./interactive.js')
@@ -558,7 +578,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
     if (account?.username) record.username = account.username
     if (account?.handle) record.handle = account.handle
     await writeRegistryAuth(record)
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Logged in${account?.username ? ` as \x1b[1m${account.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
     )
     return record
@@ -604,7 +624,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
         },
         {
           onCancel: () => {
-            console.log('\nLogin cancelled.')
+            console.error('\nLogin cancelled.')
             process.exit(0)
           }
         }
@@ -626,7 +646,7 @@ export async function runRegistryLogin({ apiBase, args = [] } = {}) {
   }
 
   if (record?.token) {
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Logged in${record.username ? ` as \x1b[1m${record.username}\x1b[0m` : ''}${apiBase ? ` (${apiBase})` : ''}`
     )
   }

package/src/utils/registry-orgs.js

@@ -1,3 +1,23 @@
+/**
+ * ⛔ **HUMAN OUTPUT IN THIS FILE GOES TO STDERR, NEVER STDOUT.**
+ *
+ * `stdout` is the CLI's DATA channel. `uniweb register --json` promises a single
+ * parseable JSON line there, and `register` diverts its own output accordingly —
+ * but it calls into this module, which wrote prose to stdout directly, so the
+ * promise broke for any caller that piped it.
+ *
+ * ⭐ Measured by the `flows` lane at `uniweb@0.37.1`: two stray lines ahead of
+ * the JSON on the cold path — down from ~35 before the delegated builder's
+ * stdout was redirected to fd 2, which is why the two defects share one symptom
+ * and only one of them was fixed. Every line here is prose, a prompt, or a
+ * cancellation notice; none of it is anything a machine reads. On stderr it is
+ * equally visible to a human and invisible to a pipe.
+ *
+ * ⚖️ This is not a `--json` special case. A utility that cannot see the flag
+ * should not be choosing the stream at all — which is exactly how it got the
+ * choice wrong. `cli/test/porcelain-stdout.test.js` walks `register`'s import
+ * graph and fails on a new `console.log`.
+ */
 /**
  * New-backend org operations for the publish-scope bootstrap — used by
  * `uniweb register`'s scope resolution and the `uniweb org` command.
@@ -150,7 +170,7 @@ export async function deriveScope({
     const h = orgs[0].handle
     const label = isPersonal(h) ? `your personal org @${h}` : `your org @${h}`
     if (nonInteractive) {
-      console.log(
+      console.error(
         `Publishing under ${label.replace(`@${h}`, `\x1b[1m@${h}\x1b[0m`)}.`
       )
       return h
@@ -165,13 +185,13 @@ export async function deriveScope({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
     )
     if (!ok) {
-      console.log(
+      console.error(
         'Pass --scope @org, or create another with `uniweb org create <handle>`.'
       )
       return null
@@ -189,7 +209,7 @@ export async function deriveScope({
         ordered.find((u) => isPersonal(u.handle)) ||
         orgs.find((u) => u.is_primary) ||
         orgs[0]
-      console.log(
+      console.error(
         `Multiple orgs; using \x1b[1m@${pick.handle}\x1b[0m (non-interactive).`
       )
       return pick.handle
@@ -208,7 +228,7 @@ export async function deriveScope({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
@@ -281,7 +301,7 @@ export async function offerCreateOrg({
     { title: 'A new organization…', value: ':new' }
   ]
   if (!canClaimPersonal) {
-    console.log(
+    console.error(
       `\x1b[2m@${personal} exists but you're not a member of it — ask its admin, or create another org.\x1b[0m`
     )
   }
@@ -296,7 +316,7 @@ export async function offerCreateOrg({
     },
     {
       onCancel: () => {
-        console.log('\nCancelled.')
+        console.error('\nCancelled.')
         process.exit(0)
       }
     }
@@ -314,7 +334,7 @@ export async function offerCreateOrg({
       },
       {
         onCancel: () => {
-          console.log('\nCancelled.')
+          console.error('\nCancelled.')
           process.exit(0)
         }
       }
@@ -325,7 +345,7 @@ export async function offerCreateOrg({
 
   try {
     const org = await createOrg({ apiBase, token, handle })
-    console.log(
+    console.error(
       `\x1b[32m✓\x1b[0m Created \x1b[1m@${org.handle}\x1b[0m — you're a member${org.is_primary ? ' (primary)' : ''}.`
     )
     return org.handle