uniweb 0.65.0 → 0.67.0

package/src/framework-index.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-23T16:44:03.282Z",
+  "generatedAt": "2026-09-24T19:00:27.393Z",
   "packages": {
     "@uniweb/api": {
       "version": "0.6.1",
@@ -10,7 +10,7 @@
       ]
     },
     "@uniweb/build": {
-      "version": "0.59.1",
+      "version": "0.61.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.4.0",
+      "version": "0.6.0",
       "path": "framework/schemas",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.2",
+      "version": "0.10.4",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -1418,7 +1418,8 @@ ${colors.bright}Options:${colors.reset}
   --target <name>     Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run           Resolve the target + adapter; print summary; upload nothing
   --no-save           Do not record this deploy in deploy.yml
-  --no-validate       Skip the content-conformance check (it only warns)
+  --no-validate       Skip the content-conformance check (a static host warns;
+                      Uniweb Cloud stops on content that does not conform)
   --non-interactive   Fail with usage info instead of prompting
 
 ${colors.bright}Examples:${colors.reset}
@@ -1439,9 +1440,10 @@ ${colors.bright}Usage:${colors.reset}
 The most ergonomic command in the tool: \`uniweb login && uniweb publish\` reads
 your project and makes the site live on Uniweb hosting. It resolves which site,
 BRINGS THE FOUNDATION ALONG (releases the local foundation when its code
-changed), syncs content, settles payment when go-live needs it (a browser
-handoff), and goes live. A published-registry foundation needs no release; an
-already-paid site opens no browser.
+changed — under the next version when its own is registered; commit the
+package.json it writes), syncs content, settles payment when go-live needs it
+(a browser handoff), and goes live. A published-registry foundation needs no
+release; an already-paid site opens no browser.
 
 For a third-party host use \`uniweb deploy --host=<name>\`; to register a
 FOUNDATION on its own use \`uniweb register\` (alias \`uniweb release\`).
@@ -1454,8 +1456,11 @@ ${colors.bright}Options:${colors.reset}
                      when only the content should go live. Refused if the
                      foundation has never been released — there is nothing to
                      bind to, and the app cannot open such a site.
+  --bump             When the registry holds a newer version of the foundation
+                     than yours, release yours above it instead of stopping
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
+  --no-validate      Skip the content-conformance check, which stops a publish
+                     whose content does not conform to its data schemas
   --org @org         Work in @org for this publish, instead of the workspace
   --personal         chosen at \`uniweb login\` (or your personal workspace). A
                      site this publish creates is created — owned — there, and a
@@ -1690,17 +1695,18 @@ foundation declared for that input (meta.js \`data:\`). Answers "does my
 data match what I promised?" — distinct from \`doctor\`, which checks your
 project against framework conventions.
 
-Warns by default; the live render path stays tolerant, so this is a
-pre-live / CI gate. Dynamic (\`url:\`) inputs and entity references can't be
-resolved without a running backend, so they're reported as deferred,
-never silently skipped.
+Every record file is checked against the schema its folder names, whether or
+not a section reads it. A violation fails the run; \`push\` and \`publish\` refuse
+the same findings. The live render path stays tolerant. Remote (\`url:\`)
+inputs are not in the project, so they're reported as deferred, never silently
+skipped. A reference field's value is not checked against the entity it names.
 
 ${colors.bright}Options:${colors.reset}
-  --strict           Treat findings as errors (non-zero exit for CI)
+  --lax              Report violations without failing (exit 0)
   --json             Machine-readable output (for CI annotations)
   --site <name>      Check one site in a multi-site workspace
 
-Exit codes: 0 clean (or warn-only), 1 violations under --strict, 2 setup error.
+Exit codes: 0 clean (or --lax), 1 violations, 2 setup error.
 `,
     register: `
 ${colors.cyan}${colors.bright}uniweb register${colors.reset} ${colors.dim}— Register (release) a foundation + its data schemas with the backend registry${colors.reset}
@@ -2087,10 +2093,11 @@ ${colors.bright}Publish Options:${colors.reset}
   --dry-run          Resolve everything; release/sync/POST nothing
   --yes              Skip confirmations (CI); never block on a prompt
   --no-release       Ship content against the already-released code; release nothing
+  --bump             Release above a newer registered foundation version
   --org @org         Work in @org for this publish, not your login's workspace
   --personal         Work in your personal workspace for this publish
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
+  --no-validate      Skip the content-conformance check (it stops a publish)
 
   uniweb publish is the smart Uniweb-hosting path: it brings the site's
   foundation along, syncs, and goes live. To register a foundation on its own
@@ -2104,7 +2111,7 @@ ${colors.bright}Deploy Options:${colors.reset}
   --target <name>    Pick a target from deploy.yml (default: deploy.yml's \`default:\`)
   --dry-run          Resolve the target + adapter; print summary; upload nothing
   --no-save          Do not record this deploy in deploy.yml
-  --no-validate      Skip the content-conformance check (it only warns)
+  --no-validate      Skip the content-conformance check (a static host warns)
   To deploy on every push instead, see \`uniweb add ci --help\`.
 
 ${colors.bright}Dev Options:${colors.reset}

package/src/utils/conformance.js

@@ -8,17 +8,26 @@
  * it. The first symptom was a section rendering nothing on a live site, with no
  * error anywhere in the chain.
  *
- * ## It WARNS. It never blocks, and that is a decision, not a TODO.
+ * ## On a STATIC host it warns and never blocks — and on a backend it is a gate.
+ *
+ * ⭐ Two answers, one per destination [Diego, 2026-09-24: "The old rationale was in
+ * the context of static sites. It was never meant for pushed sites since that didn't
+ * even exist at the time."]. `push` and `publish` register the foundation first, so
+ * the backend checks the records against the very schemas checked here: a finding
+ * there is a refusal on arrival, or a value lost on the way — never a disagreement to
+ * ship through. `refuseIfContentDoesNotConform` is that gate; `deploy` to a static
+ * host keeps the warning below, whose reasoning is unchanged for it:
  *
  * A schema can be newer than the content that was valid when it was authored —
  * a foundation upgrade, a `@std/*` revision — so a finding does not mean the
  * content is wrong, it means the two disagree. A framework that refused to
  * publish over that would make an author's site hostage to a schema release,
- * for a defect whose real-world cost is one section rendering wrong. `--strict`
- * on `uniweb validate` is where the gate lives, and CI is where it belongs.
+ * for a defect whose real-world cost is one section rendering wrong. `uniweb
+ * validate` is where the gate lives for a static site, and CI is where it belongs.
  *
- * So: silent when everything conforms, silent when it cannot check, one compact
- * block when it finds something, and **the ship proceeds either way**.
+ * So, on a static host: silent when everything conforms, silent when it cannot
+ * check, one compact block when it finds something, and **the ship proceeds
+ * either way**.
  *
  * ## Why it is quiet about being unable to check
  *
@@ -41,7 +50,8 @@ const c = {
   reset: '\x1b[0m',
   bold: '\x1b[1m',
   dim: '\x1b[2m',
-  yellow: '\x1b[33m'
+  yellow: '\x1b[33m',
+  red: '\x1b[31m'
 }
 
 /** How many findings to print before summarizing the rest. */
@@ -144,6 +154,47 @@ export async function warnIfContentDoesNotConform(siteDir, options = {}) {
   return formatted.total
 }
 
+/**
+ * The same check as a GATE, for `push` and `publish` — see the header for why a
+ * backend gets a gate where a static host gets a warning.
+ *
+ * Only VIOLATIONS stop it: a record the backend would refuse, or whose value it would
+ * lose. A setup error is about how data reaches a section — a rendering question, not
+ * a record — so it is still printed as a warning and the ship goes on. A checker that
+ * cannot run says nothing and stops nothing, as above. `--no-validate` skips the check
+ * and leaves the records to the backend.
+ *
+ * @param {string} siteDir
+ * @param {object} [options] - `args`, and the caller's `error` / `warn` / `dim` printers
+ * @returns {Promise<number>} the violations that stop the ship (0 to go on)
+ */
+export async function refuseIfContentDoesNotConform(siteDir, options = {}) {
+  const {
+    args = [],
+    error = (m) => console.log(`${c.red}✗${c.reset} ${m}`),
+    warn = (m) => console.log(`${c.yellow}⚠${c.reset} ${m}`),
+    dim = (m) => console.log(`  ${c.dim}${m}${c.reset}`)
+  } = options
+
+  if (args.includes('--no-validate')) return 0
+
+  let result
+  try {
+    result = await checkSiteConformance(siteDir)
+  } catch {
+    return 0
+  }
+  if (result.status !== 'checked') return 0
+
+  const violations = result.report?.violations?.length || 0
+  const formatted = formatConformanceWarning(result, siteDir, { stops: violations > 0 })
+  if (!formatted) return 0
+
+  ;(violations > 0 ? error : warn)(formatted.headline)
+  for (const line of formatted.details) dim(line)
+  return violations
+}
+
 /**
  * Turn a report into the lines to print, or `null` when there is nothing to say.
  *
@@ -154,9 +205,11 @@ export async function warnIfContentDoesNotConform(siteDir, options = {}) {
  *
  * @param {{report?: object, foundation?: string}} result
  * @param {string} siteDir
+ * @param {{ stops?: boolean }} [options] - `stops`: the ship stops on this report
+ *   (`refuseIfContentDoesNotConform`), so the last line says nothing was sent
  * @returns {{headline: string, details: string[], total: number}|null}
  */
-export function formatConformanceWarning(result, siteDir = '') {
+export function formatConformanceWarning(result, siteDir = '', { stops = false } = {}) {
   const violations = result?.report?.violations || []
   const setupErrors = result?.report?.setupErrors || []
   const total = violations.length + setupErrors.length
@@ -201,9 +254,14 @@ export function formatConformanceWarning(result, siteDir = '') {
   const details = lines.slice(0, MAX_SHOWN).map((l) => `• ${l}`)
   if (lines.length > MAX_SHOWN) details.push(`…and ${lines.length - MAX_SHOWN} more`)
 
-  // Name the command that explains it, and say plainly that this is not a
-  // refusal — a warning during a ship reads as a failure unless it says so.
-  details.push('Shipping anyway. Run `uniweb validate` for the full report.')
+  // Name the command that explains it, and say plainly which this is — a warning
+  // during a ship reads as a failure unless it says so, and a refusal must say what
+  // did not happen.
+  details.push(
+    stops
+      ? 'Nothing was sent. Run `uniweb validate` for the full report, or pass `--no-validate` to send it anyway and let the backend decide.'
+      : 'Shipping anyway. Run `uniweb validate` for the full report.'
+  )
 
   return { headline, details, total }
 }

package/src/utils/flag-guard.js

@@ -64,15 +64,16 @@ const VERBS = {
     // flag-guard-coverage.test.js the moment push gained the import, which is
     // exactly the hand-enumeration failure that test exists to catch.
     '--no-verify',
-    // ship content against the already-released code, releasing nothing
-    '--no-release', ...VIA_DEPLOY
+    // ship content against the already-released code, releasing nothing — or
+    // release above a newer registered version instead of stopping (both bring-along)
+    '--no-release', '--bump', ...VIA_DEPLOY
   ],
   publish: [
     '--org', '--dry-run', '--force', '--foundation',
     '--personal',
     // read in utils/conformance.js, backend/site-sync.js, and
     // backend/foundation-bring-along.js — none appear in publish.js
-    '--no-validate', '--yes', '--no-verify', '--no-release', ...VIA_DEPLOY
+    '--no-validate', '--yes', '--no-verify', '--no-release', '--bump', ...VIA_DEPLOY
   ],
   pull: [
     '--content-only', '--dry-run', '--force', '--merge',
@@ -103,7 +104,7 @@ const VERBS = {
     '--force', '--no-verify', '--no-validate', '--yes', '--org', '--personal',
     // inert here, reachable through the bring-along module status imports for
     // `resolveLocalFoundation` — listed per the over-approximation note above
-    '--no-release', ...VIA_DEPLOY
+    '--no-release', '--bump', ...VIA_DEPLOY
   ],
   /**
    * `refresh` = `git pull`, then a DELEGATED `pull --merge`.

package/src/utils/git.js

@@ -18,6 +18,7 @@
  */
 
 import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import { readFileSync, realpathSync } from 'node:fs'
 import { join, relative } from 'node:path'
 import yaml from 'js-yaml'
@@ -173,8 +174,25 @@ export function uncommittedUnder(dir, relPaths) {
  *   never committed has no ancestor, so there is nothing to merge against).
  */
 export function showAtHead(dir, relPath) {
+  return showAt(dir, 'HEAD', relPath)
+}
+
+/**
+ * A file's content at a revision, by a path relative to `dir`.
+ *
+ * ⛔ THE `./` IS WHAT MAKES THE PATH RELATIVE TO `dir`. In `<rev>:<path>` a bare path
+ * is read from the REPOSITORY ROOT, whatever the cwd. With the repo at the project
+ * root and the site in `site/` — the default layout — `HEAD:pages/home/hero.md`
+ * named nothing, every lookup failed, and `pull --merge` "kept yours" for every file:
+ * the backend's changes never merged in, while the pull recorded them as taken
+ * (2026-09-23). Every merge test ran with the repo AT the site directory, the one
+ * layout where a bare path happens to work.
+ *
+ * @returns {Buffer|null} null when the path isn't in that revision
+ */
+export function showAt(dir, rev, relPath) {
   try {
-    return execFileSync('git', ['show', `HEAD:${relPath}`], {
+    return execFileSync('git', ['show', `${rev}:./${relPath}`], {
       cwd: dir,
       stdio: ['ignore', 'pipe', 'ignore'],
       maxBuffer: 64 * 1024 * 1024
@@ -184,6 +202,35 @@ export function showAtHead(dir, relPath) {
   }
 }
 
+/**
+ * The most recent committed version of a file whose content hashes to `sha256` —
+ * how the version a pull wrote is found again, as the ancestor of a merge.
+ *
+ * HEAD is that version only until the user commits an edit on top of it. After that
+ * HEAD is THEIR edit, and a merge against it reads their change as the starting
+ * point: the backend's version wins whole and the committed edit is reverted in the
+ * working tree. The pull recorded the hash of what it wrote (`pull-written.json`),
+ * so the version is recoverable from history by content, wherever it was committed.
+ *
+ * @param {number} [limit] - how many commits touching the file to search
+ * @returns {Buffer|null} null when no committed version matches
+ */
+export function findCommitted(dir, relPath, sha256, { limit = 50 } = {}) {
+  let revs
+  try {
+    revs = git(['log', `-n${limit}`, '--format=%H', '--', `./${relPath}`], dir)
+      .split('\n')
+      .filter(Boolean)
+  } catch {
+    return null
+  }
+  for (const rev of revs) {
+    const buf = showAt(dir, rev, relPath)
+    if (buf && createHash('sha256').update(buf).digest('hex') === sha256) return buf
+  }
+  return null
+}
+
 /**
  * Three-way merge, in place: `minePath` is rewritten with the merged result.
  *

package/src/utils/pull-written.js

@@ -1,6 +1,11 @@
 /**
  * The record of what a machine wrote into a site project — pull's own output.
  *
+ * ⭐ And, since 2026-09-23, what a push delivered: the files of the units the backend
+ * now holds as they were sent (`recordPushedUnits`, site-sync.js). Both are "the last
+ * version this file synced at", which is what `pull --merge` needs as its ancestor —
+ * found again in the repo's history by this hash (`findCommitted`, utils/git.js).
+ *
  * ## What it is for
  *
  * `uniweb pull` refuses to run when there are uncommitted changes under the files

package/src/utils/semver-precedence.js

@@ -24,6 +24,29 @@ export function parseSemver(version) {
   return { major: +m[1], minor: +m[2], patch: +m[3], pre: m[4] ? m[4].split('.') : [] }
 }
 
+/**
+ * The next version above `version` on its own line — what `--bump` releases under
+ * when the registry already holds the local version with other code.
+ *
+ * A release gets its next patch (`1.4.2` → `1.4.3`); a pre-release its next
+ * pre-release (`2.0.0-beta.3` → `2.0.0-beta.4`, `1.0.0-rc` → `1.0.0-rc.0`), so a bump
+ * nobody chose never promotes a beta line to a release. Build metadata is dropped: it
+ * carries no order, so it could not make a version newer.
+ *
+ * @param {string} version
+ * @returns {string|null} null when `version` is not SemVer
+ */
+export function nextVersionAbove(version) {
+  const v = parseSemver(version)
+  if (!v) return null
+  if (!v.pre.length) return `${v.major}.${v.minor}.${v.patch + 1}`
+  const pre = [...v.pre]
+  const last = pre.length - 1
+  if (/^\d+$/.test(pre[last])) pre[last] = String(BigInt(pre[last]) + 1n)
+  else pre.push('0')
+  return `${v.major}.${v.minor}.${v.patch}-${pre.join('.')}`
+}
+
 /**
  * @param {string} a
  * @param {string} b