feat: publish derives the sdkVersion floor from the built bundle

bin/cli.ts

@@ -38,9 +38,10 @@ Commands:
                          --eval <expr> prints an expression per render (root = widget shadow root)
   validate [name]        Validate all widgets or a specific one
   publish [hub-url]      Build and publish a widget to Hub
+                         --allow-prerelease-dash publishes when only a beta or rc Dash runs it
   login [hub-url]        Authenticate with GlassHome Hub
   info [name]            Show widget metadata and bundle info
-  upgrade                Upgrade @glasshome/widget-sdk (latest, or --to <version>) and sync manifests
+  upgrade                Upgrade @glasshome/widget-sdk (latest, or --to <version>)
   migrate config         Rewrite widgets' raw-zod config to defineConfig + field.*
                          --name <widget> targets one; --dry previews without writing
   help                   Show this help message
@@ -82,6 +83,7 @@ const { values: flags, positionals } = parseArgs({
     scope: { type: "string" },
     to: { type: "string" },
     "re-auth": { type: "boolean" },
+    "allow-prerelease-dash": { type: "boolean" },
     isolate: { type: "boolean" },
     sizes: { type: "string" },
     theme: { type: "string" },
@@ -213,6 +215,7 @@ switch (effectiveCommand) {
       name: str(flags.name),
       bump: str(flags.bump) as "keep" | "patch" | "minor" | "major" | undefined,
       scope: str(flags.scope),
+      allowPrereleaseDash: flags["allow-prerelease-dash"] === true,
     });
     outro("Done");
     break;

package.json

@@ -46,12 +46,13 @@
     "@fontsource-variable/geist": "^5.2.9",
     "@fontsource-variable/geist-mono": "^5.2.8",
     "@glasshome/sync-layer": "0.12.3",
-    "@glasshome/widget-contract": "0.4.1",
+    "@glasshome/widget-contract": "0.5.0",
     "@glasshome/widget-sdk": "1.24.0",
     "@iconify-json/lucide": "^1.2.0",
     "@iconify-json/mdi": "^1.2.3",
     "@iconify/utils": "^3.1.4",
     "@tailwindcss/vite": "^4.1.13",
+    "es-module-lexer": "^2.3.2",
     "iconify-icon": "^3.0.2",
     "open": "^11.0.0",
     "picocolors": "^1.1.1",

src/commands/create.ts

@@ -127,8 +127,7 @@ export async function runCreate() {
     pkgContent = pkgContent.replace(/PROJECT_NAME/g, projectName);
     pkgContent = pkgContent.replace(/PROJECT_DESCRIPTION/g, projectDesc);
     pkgContent = pkgContent.replace(/CLI_VERSION/g, `^${getCliVersion()}`);
-    // Nothing is installed yet, so this comes from the SDK the CLI ships
-    // against. `bun widget upgrade` re-syncs it and every manifest later.
+    // Nothing is installed yet, so this comes from the SDK the CLI ships against.
     pkgContent = pkgContent.replace(/SDK_RANGE/g, defaultSdkRange() ?? FALLBACK_SDK_RANGE);
     writeFileSync(pkgPath, pkgContent);
 

src/commands/publish.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { cancel, log, select, spinner } from "@clack/prompts";
+import { cancel, confirm, log, select, spinner } from "@clack/prompts";
 import semver from "semver";
 import { getHubUrl, getToken, renewHubToken, renewingCaller } from "../utils/auth";
 import { confirmPublish, fetchScopes, requestPublish, uploadToR2 } from "../utils/hub-api";
@@ -13,6 +13,7 @@ import {
   readManifest,
   writeManifest,
 } from "../utils/manifest";
+import { settleSdkFloor } from "../utils/sdk-floor";
 import { typecheckAndReport } from "../utils/typecheck";
 import { enforceCliVersion } from "../utils/version";
 import { runLogin } from "./login";
@@ -21,6 +22,7 @@ interface PublishOptions {
   name?: string;
   bump?: "keep" | "patch" | "minor" | "major";
   scope?: string;
+  allowPrereleaseDash?: boolean;
 }
 
 async function authenticate(hubUrl: string): Promise<string> {
@@ -203,6 +205,20 @@ export async function runPublish(
   }
   s.stop("Build complete");
 
+  const floor = await settleSdkFloor(cwd, widgetName, hubUrl, {
+    info: (line) => log.info(line),
+    confirm: async (message) => {
+      const answer = await confirm({ message, initialValue: false });
+      return !cancelled(answer) && answer;
+    },
+    interactive: process.stdin.isTTY === true,
+    allowPrereleaseDash: options?.allowPrereleaseDash === true,
+  });
+  if (!floor.ok) {
+    log.error(floor.message);
+    process.exit(1);
+  }
+
   // Validate AFTER the build, not before: the build is what produces the
   // manifest and bundle that get published, so validating beforehand checks a
   // different document than the one that ships.

src/commands/upgrade.test.ts

@@ -1,5 +1,34 @@
-import { describe, expect, test } from "bun:test";
-import { sdkDependencySection } from "./upgrade";
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { runUpgrade, sdkDependencySection } from "./upgrade";
+
+const tmpDir = mkdtempSync(join(tmpdir(), "glasshome-upgrade-"));
+
+afterAll(() => {
+  rmSync(tmpDir, { recursive: true, force: true });
+});
+
+describe("runUpgrade", () => {
+  test("leaves every manifest sdkVersion as publish wrote it", async () => {
+    writeFileSync(join(tmpDir, "package.json"), JSON.stringify({ workspaces: ["widgets"] }));
+    mkdirSync(join(tmpDir, "widget-sdk"), { recursive: true });
+    writeFileSync(join(tmpDir, "widget-sdk", "package.json"), JSON.stringify({ version: "1.9.0" }));
+    const project = join(tmpDir, "widgets");
+    mkdirSync(join(project, "src", "demo"), { recursive: true });
+    writeFileSync(
+      join(project, "package.json"),
+      JSON.stringify({ peerDependencies: { "@glasshome/widget-sdk": "^1.9.0" } }),
+    );
+    const manifestPath = join(project, "src", "demo", "manifest.json");
+    writeFileSync(manifestPath, JSON.stringify({ name: "Demo", sdkVersion: "^1.5.0" }));
+
+    await runUpgrade(project);
+
+    expect(JSON.parse(readFileSync(manifestPath, "utf-8")).sdkVersion).toBe("^1.5.0");
+  });
+});
 
 describe("sdkDependencySection", () => {
   test("finds the SDK in whichever section declares it", () => {

src/commands/upgrade.ts

@@ -2,7 +2,6 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { log, spinner } from "@clack/prompts";
 import { installedGuide, writeAgentStubs } from "../utils/agent-guide";
-import { discoverWidgets, readManifest, writeManifest } from "../utils/manifest";
 import { getInstalledSdkVersion } from "../utils/sdk-version";
 import { runValidate } from "./validate";
 
@@ -55,22 +54,6 @@ function refreshAgentStubs(cwd: string): void {
   }
 }
 
-/** Update sdkVersion in all manifest.json files. */
-function syncManifestSdkVersions(cwd: string, newVersion: string): void {
-  const widgets = discoverWidgets(cwd);
-  if (widgets.length === 0) return;
-
-  const sdkRange = `^${newVersion}`;
-  for (const name of widgets) {
-    const manifest = readManifest(cwd, name);
-    if (manifest.sdkVersion !== sdkRange) {
-      manifest.sdkVersion = sdkRange;
-      writeManifest(cwd, name, manifest);
-    }
-  }
-  log.info(`Updated sdkVersion to ${sdkRange} in ${widgets.length} manifest(s)`);
-}
-
 const SDK_PKG = "@glasshome/widget-sdk";
 
 type DependencySection = "peerDependencies" | "devDependencies" | "dependencies";
@@ -147,8 +130,6 @@ export async function runUpgrade(cwd: string, options: UpgradeOptions = {}): Pro
     const cleanCurrent = currentVersion.replace(/^[\^~]/, "");
     if (cleanCurrent === sdkVersion) {
       log.success(`Already up to date with workspace SDK (${sdkVersion})`);
-      // Still sync manifests in case they're out of date
-      syncManifestSdkVersions(cwd, sdkVersion);
       refreshAgentStubs(cwd);
       return;
     }
@@ -165,8 +146,6 @@ export async function runUpgrade(cwd: string, options: UpgradeOptions = {}): Pro
     }
     s.stop("Dependencies synced");
 
-    // Sync sdkVersion in all manifest.json files
-    syncManifestSdkVersions(cwd, sdkVersion);
     refreshAgentStubs(cwd);
 
     // Run validate to check compatibility
@@ -180,17 +159,13 @@ export async function runUpgrade(cwd: string, options: UpgradeOptions = {}): Pro
     return;
   }
 
-  // Standalone project: bump the dependency, then sync every manifest to what
-  // is now installed. A manifest range that excludes the installed SDK fails
-  // validation, and this is the command that error tells people to run.
   if (!bumpSdkDependency(cwd, section, options.to ?? "latest")) process.exit(1);
 
   const installed = getInstalledSdkVersion(cwd);
   if (!installed) {
-    log.warn("No @glasshome/widget-sdk installed here, so manifests were left alone.");
+    log.warn("No @glasshome/widget-sdk installed here.");
     return;
   }
-  syncManifestSdkVersions(cwd, installed);
   refreshAgentStubs(cwd);
   const valid = await runValidate(cwd);
   if (valid) {

src/commands/validate.ts

@@ -65,7 +65,7 @@ function validateManifest(manifest: WidgetManifest, installedSdk: string | null)
     !satisfiesSdk(installedSdk, manifest.sdkVersion)
   ) {
     errors.push(
-      `sdkVersion "${manifest.sdkVersion}" excludes the installed SDK ${installedSdk}, so it claims a compatibility it was not built for; run \`bun widget upgrade\``,
+      `sdkVersion "${manifest.sdkVersion}" excludes the installed SDK ${installedSdk}, so it claims a compatibility it was not built for; \`bun widget publish\` sets it from the built bundle`,
     );
   }
 

src/utils/hub-api.ts

@@ -1,3 +1,5 @@
+import { type DashRelease, dashReleasesSchema } from "@glasshome/widget-contract/dash-releases";
+
 interface PublishScope {
   name: string;
   type: "personal" | "organization";
@@ -15,6 +17,17 @@ export async function fetchScopes(hubUrl: string, token: string): Promise<Publis
   return data.scopes;
 }
 
+const DASH_RELEASES_TIMEOUT_MS = 10_000;
+
+export async function fetchDashReleases(
+  hubUrl: string,
+  signal: AbortSignal = AbortSignal.timeout(DASH_RELEASES_TIMEOUT_MS),
+): Promise<DashRelease[]> {
+  const res = await fetch(`${hubUrl}/api/widgets/dash-releases`, { signal });
+  if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`);
+  return dashReleasesSchema.parse(await res.json());
+}
+
 import type { GridSize } from "@glasshome/widget-sdk";
 
 interface PublishRequestParams {