@camox/cli 0.42.0 → 0.43.0

package/README.md

@@ -0,0 +1,125 @@
+# Camox CLI
+
+## Runtime lookup and monorepos
+
+Runtime-backed commands (`status`, `pages`, `blocks`, `layouts`, `env`, `files`,
+and `logout`) accept `--cwd PATH`:
+
+```sh
+camox pages list --cwd apps/site
+camox status --cwd apps/site
+camox files upload --cwd apps/site --file ./hero.webp --alt "Product screenshot"
+```
+
+The CLI searches for `node_modules/.camox/runtime.json` starting in that directory
+and walking upward. Without `--cwd`, lookup starts in the shell's current directory.
+There is no workspace or child-directory discovery. Run the app's dev server or
+build once to generate its runtime file.
+
+Relative `--cwd` paths resolve against the shell's current directory. This option
+only affects runtime lookup: other paths, such as `--file ./hero.webp`, still
+resolve against the shell's current directory. Missing or non-directory paths fail
+instead of falling back to the shell's directory. Environment selection is unchanged:
+your development environment by default, with explicit `--production` where supported.
+
+## Page SEO
+
+Use `pages get` to read metadata and `pages update` to edit it:
+
+```sh
+camox pages get --path /about --json
+camox pages update --path /about --meta-title "About us" --meta-description "Meet the team."
+camox pages update --id 42 --meta-description ""
+camox pages update --id 42 --ai-seo on
+camox pages update --id 42 --ai-seo off
+camox pages get --path /about --live
+camox pages publish --path /about
+```
+
+- Updates require exactly one of `--id` or `--path` and at least one update field.
+  Omitted fields are preserved; empty strings clear metadata.
+- Setting either metadata field disables automatic SEO for **both** fields.
+  Manual metadata cannot be combined with `--ai-seo on`.
+- `--ai-seo off` preserves current metadata. `--ai-seo on` schedules asynchronous
+  generation; the returned page contains current values, not necessarily generated
+  values. Use `pages get` to inspect them later.
+- Changes affect the draft only. Publish separately to update live metadata.
+  `pages get --live` reads the published snapshot; without it, reads use the draft.
+- Commands support `--project SLUG`, `--production`, and `--json`, with the usual
+  development-environment default and structured JSON output/errors. `--production`
+  selects the environment; it does not publish the draft.
+
+See `camox pages update --help` for options and examples.
+
+## Media
+
+Run `camox login` and start your project's dev server (or build once) so the CLI
+can discover the project's runtime configuration.
+
+```sh
+# Upload a local file with manual alt text.
+camox files upload --file ./hero.webp --alt "Product screenshot" --json
+
+# Download a remote file and store a copy in Camox.
+camox files upload --url https://example.com/hero.webp --alt "Product screenshot"
+
+# Optionally override the uploaded filename.
+camox files upload --url https://example.com/download --filename hero.webp --ai-metadata off
+
+# Inspect the returned ID and URL; use the ID in your block's media field.
+camox files list
+camox files get --id 123
+
+camox files update --id 123 --filename hero.webp
+camox files update --id 123 --alt "Updated description"
+camox files update --id 123 --alt ""
+camox files update --id 123 --ai-metadata on
+
+# Replace the underlying file everywhere it is referenced, preserving its ID.
+camox files update --id 123 --file ./new-hero.webp
+camox files update --id 123 --url https://example.com/new-hero.webp
+
+# Replace content and override metadata together.
+camox files update --id 123 --file ./new-hero.webp --filename hero.webp --alt "New screenshot"
+```
+
+- Upload requires exactly one of `--file` or `--url`. URLs are copied, not linked.
+- `--alt` disables AI metadata, including when its value is an empty string.
+  It cannot be combined with `--ai-metadata on`. Manual edits are protected from
+  already-running AI jobs.
+- Without metadata flags, raster-image uploads use automatic metadata. Other
+  file types do not. AI may update both the filename and alt text asynchronously.
+- `--ai-metadata on` schedules generation for raster images; success does not mean
+  generation has completed. Use `files get` to inspect the current record.
+- Update requires at least one of `--file`, `--url`, `--filename`, `--alt` or
+  `--ai-metadata`. `--file` and `--url` are mutually exclusive; without either,
+  only metadata changes. Renaming alone preserves the file ID, URL and AI setting.
+- Replacing content preserves the file ID and all `_fileId` references in the
+  selected environment. The URL changes to avoid stale caches. Direct URLs in
+  stored block/repeatable-item content are migrated within that environment;
+  URLs hardcoded outside Camox cannot be rewritten.
+- Replacements preserve omitted alt text and AI settings. The filename defaults
+  to the new source filename; `--filename` overrides it. Binary metadata and
+  explicit metadata changes are saved together. If AI remains enabled, raster
+  replacements schedule generation on the original file ID; other types skip
+  generation. Disable AI to prevent future automatic renaming or alt changes.
+- Files are shared assets, not page drafts: replacing one affects every reference
+  to it in the selected environment. No page publish step is required.
+- Failed replacements leave the original file unchanged and remove the unused
+  uploaded binary. After a network timeout, use `files get --id ID` before retrying
+  because the server may already have completed the operation.
+- All commands support `--project SLUG`, `--production`, and `--json`. The default
+  environment is `dev:<your-email>`, not production. IDs are scoped to the selected
+  project and environment.
+- Uploads return the stored file record, including `id`, `url`, `mimeType`, `alt`,
+  and `aiMetadataEnabled`. Output is JSON; errors are structured JSON on stderr.
+- Files are limited to 100 MiB. URL downloads allow at most five redirects and
+  have a two-minute timeout; uploads have a separate two-minute timeout.
+  Downloads stream through a temporary file that is removed afterward.
+- Only HTTP(S) URLs without embedded credentials are supported. Signed query
+  URLs work and are not included in download errors. Camox credentials are never
+  sent to the source URL. Remote authentication flags and batch uploads are not
+  supported.
+
+See `camox files --help`, `camox files upload --help`, and
+`camox files update --help` for command options.

package/dist/index.mjs

@@ -12,9 +12,11 @@ import { execSync, spawn, spawnSync } from "node:child_process";
 import http from "node:http";
 import * as p from "@clack/prompts";
 import { log } from "@clack/prompts";
-import fs from "node:fs";
-import path from "node:path";
+import fs, { openAsBlob } from "node:fs";
+import { tmpdir } from "node:os";
+import path, { basename, extname, join } from "node:path";
 import { ZodError, z } from "zod";
+import { mkdtemp, open, rm, stat } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import slugify from "slugify";
 //#region src/lib/auth.ts
@@ -188,11 +190,17 @@ const SIDECAR = path.join("node_modules", ".camox", "runtime.json");
 var RuntimeNotFoundError = class extends Error {
 	cwd;
 	constructor(cwd) {
-		super(`No camox runtime found. Looked for "${SIDECAR}" walking up from ${cwd}. The camox vite plugin writes this file on dev/build — start your project's dev server (or run a build) once before invoking camox.`);
+		super(`No Camox runtime found. Looked for "${SIDECAR}" starting from ${cwd} and its parent directories. Change into your app directory or pass --cwd <app-path>. If you're already targeting the correct app, run its dev server or build once to generate the runtime file.`);
 		this.cwd = cwd;
 		this.name = "RuntimeNotFoundError";
 	}
 };
+var RuntimeDirectoryError = class extends Error {
+	constructor(directory) {
+		super(`Runtime lookup directory "${directory}" does not exist, is not a directory, or cannot be accessed. Check --cwd <app-path>.`);
+		this.name = "RuntimeDirectoryError";
+	}
+};
 var RuntimeMalformedError = class extends Error {
 	constructor(file, reason) {
 		super(`Camox runtime sidecar at ${file} is malformed (${reason}). Re-run your project's dev server to regenerate it.`);
@@ -205,7 +213,13 @@ var RuntimeMalformedError = class extends Error {
 * that tell the user how to fix it.
 */
 function loadRuntime(cwd = process.cwd()) {
-	let dir = cwd;
+	let dir = path.resolve(cwd);
+	try {
+		if (!fs.statSync(dir).isDirectory()) throw new RuntimeDirectoryError(dir);
+	} catch {
+		throw new RuntimeDirectoryError(dir);
+	}
+	const start = dir;
 	while (true) {
 		const candidate = path.join(dir, SIDECAR);
 		if (fs.existsSync(candidate)) {
@@ -223,7 +237,7 @@ function loadRuntime(cwd = process.cwd()) {
 			}
 		}
 		const parent = path.dirname(dir);
-		if (parent === dir) throw new RuntimeNotFoundError(cwd);
+		if (parent === dir) throw new RuntimeNotFoundError(start);
 		dir = parent;
 	}
 }
@@ -239,7 +253,7 @@ function compact(input) {
 	for (const [k, v] of Object.entries(input)) if (v !== void 0) out[k] = v;
 	return out;
 }
-function fail(err, code) {
+function fail$1(err, code) {
 	printError(err);
 	process.exit(code);
 }
@@ -247,7 +261,7 @@ async function resolveProjectId(token, slug, apiUrl) {
 	try {
 		return (await getProjectBySlug(token, slug, apiUrl)).id;
 	} catch (err) {
-		return fail({
+		return fail$1({
 			code: "PROJECT_LOOKUP_FAILED",
 			message: `Could not load project "${slug}".`,
 			details: err instanceof Error ? err.message : String(err)
@@ -258,7 +272,7 @@ async function callRemote(params) {
 	try {
 		return await callTool(params);
 	} catch (err) {
-		return fail(asCliError(err), 1);
+		return fail$1(asCliError(err), 1);
 	}
 }
 /**
@@ -272,12 +286,16 @@ async function callRemote(params) {
 * from the sidecar — it's derived from auth (`dev:<email>`) by default,
 * with `--production` as the only opt-in for prod.
 */
-async function dispatch(opts) {
+async function resolveCommandContext(opts) {
 	let runtime;
 	try {
-		runtime = loadRuntime();
+		runtime = loadRuntime(opts.cwd);
 	} catch (err) {
-		if (err instanceof RuntimeNotFoundError || err instanceof RuntimeMalformedError) return fail({
+		if (err instanceof RuntimeDirectoryError) return fail$1({
+			code: "INVALID_CWD",
+			message: err.message
+		}, 2);
+		if (err instanceof RuntimeNotFoundError || err instanceof RuntimeMalformedError) return fail$1({
 			code: "RUNTIME_NOT_FOUND",
 			message: err.message
 		}, 2);
@@ -285,24 +303,29 @@ async function dispatch(opts) {
 	}
 	const slug = opts.projectFlag?.trim() || process.env.CAMOX_PROJECT?.trim() || runtime.projectSlug;
 	const token = readAuthTokenForUrl(runtime.authenticationUrl);
-	if (!token) return fail({
+	if (!token) return fail$1({
 		code: "NOT_AUTHENTICATED",
 		message: `No stored credentials for ${runtime.authenticationUrl}. Run \`camox login\` against this backend first.`
 	}, 2);
-	if (!opts.production && !token.email) return fail({
+	if (!opts.production && !token.email) return fail$1({
 		code: "AUTH_INCOMPLETE",
 		message: "Auth token is missing an email. Run `camox login` to refresh credentials."
 	}, 2);
 	const environmentName = opts.production ? "production" : `dev:${token.email}`;
 	const projectId = await resolveProjectId(token.token, slug, runtime.apiUrl);
-	const response = await callRemote({
+	return {
 		token: token.token,
 		apiUrl: runtime.apiUrl,
 		environmentName,
 		projectId,
-		name: opts.toolName,
-		args: compact(opts.args),
 		disableTelemetry: runtime.disableTelemetry
+	};
+}
+async function dispatch(opts) {
+	const response = await callRemote({
+		...await resolveCommandContext(opts),
+		name: opts.toolName,
+		args: compact(opts.args)
 	});
 	if (!response.ok) {
 		printError(response.error);
@@ -312,19 +335,24 @@ async function dispatch(opts) {
 	process.exit(0);
 }
 //#endregion
+//#region src/lib/runtime-options.ts
+const cwdFlag = optional(option("--cwd", string({ metavar: "PATH" }), { description: message`Start runtime lookup in this directory and walk upward. Relative to the shell's current directory; does not change how other file paths resolve.` }));
+//#endregion
 //#region src/commands/blocks.ts
 const projectFlag$3 = optional(option("--project", string({ metavar: "SLUG" })));
 const jsonFlag$3 = option("--json");
 const productionFlag$2 = option("--production");
 const liveFlag$1 = option("--live");
-const parser$8 = command("blocks", or(command("types", object({
+const parser$9 = command("blocks", or(command("types", object({
 	command: constant("blocks.types"),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
 })), command("describe", object({
 	command: constant("blocks.describe"),
 	type: multiple(option("--type", string({ metavar: "TYPE" })), { min: 1 }),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -332,6 +360,7 @@ const parser$8 = command("blocks", or(command("types", object({
 	command: constant("blocks.get"),
 	id: option("--id", integer({ metavar: "ID" })),
 	live: liveFlag$1,
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -339,6 +368,7 @@ const parser$8 = command("blocks", or(command("types", object({
 	command: constant("blocks.get-many"),
 	id: multiple(option("--id", integer({ metavar: "ID" })), { min: 1 }),
 	live: liveFlag$1,
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -353,6 +383,7 @@ const parser$8 = command("blocks", or(command("types", object({
 	beforeId: optional(option("--before-id", integer({ metavar: "ID" }))),
 	afterPosition: optional(option("--after-position", string({ metavar: "POS" }))),
 	beforePosition: optional(option("--before-position", string({ metavar: "POS" }))),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -361,6 +392,7 @@ const parser$8 = command("blocks", or(command("types", object({
 	id: option("--id", integer({ metavar: "ID" })),
 	content: optional(option("--content", string({ metavar: "JSON" }))),
 	settings: optional(option("--settings", string({ metavar: "JSON" }))),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -372,12 +404,14 @@ const parser$8 = command("blocks", or(command("types", object({
 	beforeId: optional(option("--before-id", integer({ metavar: "ID" }))),
 	afterPosition: optional(option("--after-position", string({ metavar: "POS" }))),
 	beforePosition: optional(option("--before-position", string({ metavar: "POS" }))),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
 })), command("delete", object({
 	command: constant("blocks.delete"),
 	id: option("--id", integer({ metavar: "ID" })),
+	cwd: cwdFlag,
 	project: projectFlag$3,
 	production: productionFlag$2,
 	json: jsonFlag$3
@@ -408,8 +442,9 @@ function collectPositioningArgs(args) {
 		toolArgs
 	};
 }
-async function handler$8(args) {
+async function handler$9(args) {
 	const outputMode = args.json ? "json" : "auto";
+	const cwd = args.cwd;
 	const projectFlag = args.project;
 	const production = args.production;
 	try {
@@ -417,6 +452,7 @@ async function handler$8(args) {
 			case "blocks.types": return dispatch({
 				toolName: "listBlockTypes",
 				args: {},
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -424,6 +460,7 @@ async function handler$8(args) {
 			case "blocks.describe": return dispatch({
 				toolName: "describeBlockTypes",
 				args: { types: [...args.type] },
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -434,6 +471,7 @@ async function handler$8(args) {
 					id: args.id,
 					source: args.live ? "live" : "draft"
 				},
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -444,6 +482,7 @@ async function handler$8(args) {
 					ids: [...args.id],
 					source: args.live ? "live" : "draft"
 				},
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -468,6 +507,7 @@ async function handler$8(args) {
 						settings,
 						...toolArgs
 					},
+					cwd,
 					projectFlag,
 					production,
 					outputMode
@@ -483,6 +523,7 @@ async function handler$8(args) {
 						content,
 						settings
 					},
+					cwd,
 					projectFlag,
 					production,
 					outputMode
@@ -510,6 +551,7 @@ async function handler$8(args) {
 						id: args.id,
 						...toolArgs
 					},
+					cwd,
 					projectFlag,
 					production,
 					outputMode
@@ -518,6 +560,7 @@ async function handler$8(args) {
 			case "blocks.delete": return dispatch({
 				toolName: "deleteBlock",
 				args: { id: args.id },
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -533,28 +576,33 @@ async function handler$8(args) {
 const projectFlag$2 = optional(option("--project", string({ metavar: "SLUG" })));
 const jsonFlag$2 = option("--json");
 const yesFlag = option("--yes", "-y");
-const parser$7 = command("env", or(command("check", object({
+const parser$8 = command("env", or(command("check", object({
 	command: constant("env.check"),
+	cwd: cwdFlag,
 	project: projectFlag$2,
 	json: jsonFlag$2
 })), command("push", object({
 	command: constant("env.push"),
 	yes: yesFlag,
+	cwd: cwdFlag,
 	project: projectFlag$2,
 	json: jsonFlag$2
 })), command("pull", object({
 	command: constant("env.pull"),
 	yes: yesFlag,
+	cwd: cwdFlag,
 	project: projectFlag$2,
 	json: jsonFlag$2
 }))));
-async function handler$7(args) {
+async function handler$8(args) {
 	const outputMode = args.json ? "json" : "auto";
+	const cwd = args.cwd;
 	const projectFlag = args.project;
 	switch (args.command) {
 		case "env.check": return dispatch({
 			toolName: "checkEnvironmentCompatibility",
 			args: {},
+			cwd,
 			projectFlag,
 			outputMode
 		});
@@ -571,12 +619,265 @@ async function handler$7(args) {
 			return dispatch({
 				toolName: "replicateEnvironment",
 				args: { direction: isPush ? "push" : "pull" },
+				cwd,
 				projectFlag,
 				outputMode
 			});
 		}
 	}
 }
+const TIMEOUT_MS = 12e4;
+const MAX_REDIRECTS = 5;
+function fail(code, message) {
+	throw Object.assign(new Error(message), { __cliError: {
+		code,
+		message
+	} });
+}
+function validateMetadata(options) {
+	if (options.alt !== void 0 && options.aiMetadata === "on") fail("INVALID_ARGS", "--alt cannot be combined with --ai-metadata on.");
+}
+function validateUpload(options) {
+	if (options.file !== void 0 === (options.url !== void 0)) fail("INVALID_ARGS", "Pass exactly one of --file or --url.");
+	validateMetadata(options);
+	validateFilename(options.filename);
+}
+function validateFilename(filename) {
+	if (filename !== void 0 && (!filename.trim() || /[\\/]/.test(filename) || filename.split("").some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || filename === "." || filename === "..")) fail("INVALID_ARGS", "--filename must be a non-empty filename without directories or control characters.");
+}
+function httpUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return fail("DOWNLOAD_FAILED", "Invalid media URL.");
+	}
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) fail("DOWNLOAD_FAILED", "Media URLs must use HTTP(S) without embedded credentials.");
+	return url;
+}
+const MIME_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif",
+	".avif": "image/avif",
+	".svg": "image/svg+xml",
+	".ico": "image/x-icon",
+	".bmp": "image/bmp",
+	".pdf": "application/pdf",
+	".mp4": "video/mp4",
+	".webm": "video/webm",
+	".mov": "video/quicktime",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+	".ogg": "audio/ogg",
+	".txt": "text/plain",
+	".json": "application/json"
+};
+function mimeType(filename) {
+	return MIME_TYPES[extname(filename).toLowerCase()] ?? "application/octet-stream";
+}
+async function download(source, destination) {
+	try {
+		let url = httpUrl(source);
+		const signal = AbortSignal.timeout(TIMEOUT_MS);
+		for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects++) {
+			const response = await fetch(url, {
+				redirect: "manual",
+				signal
+			});
+			if ([
+				301,
+				302,
+				303,
+				307,
+				308
+			].includes(response.status)) {
+				await response.body?.cancel();
+				const location = response.headers.get("location");
+				if (!location || redirects === MAX_REDIRECTS) fail("DOWNLOAD_FAILED", "Missing redirect location or too many redirects.");
+				url = httpUrl(new URL(location, url).href);
+				continue;
+			}
+			if (!response.ok || !response.body) {
+				await response.body?.cancel();
+				fail("DOWNLOAD_FAILED", `Media download failed (HTTP ${response.status}).`);
+			}
+			if (Number(response.headers.get("content-length")) > 104857600) {
+				await response.body.cancel();
+				fail("FILE_TOO_LARGE", "File exceeds the 100 MiB limit.");
+			}
+			const file = await open(destination, "w");
+			let size = 0;
+			try {
+				for await (const chunk of response.body) {
+					size += chunk.byteLength;
+					if (size > 104857600) fail("FILE_TOO_LARGE", "File exceeds the 100 MiB limit.");
+					await file.writeFile(chunk);
+				}
+			} finally {
+				await file.close();
+			}
+			const filename = basename(decodeURIComponent(url.pathname)) || "upload";
+			return {
+				filename,
+				mimeType: response.headers.get("content-type")?.split(";")[0]?.trim() || mimeType(filename)
+			};
+		}
+		return fail("DOWNLOAD_FAILED", "Too many redirects.");
+	} catch (error) {
+		if (error && typeof error === "object" && "__cliError" in error) throw error;
+		return fail("DOWNLOAD_FAILED", "Could not download media (network, timeout, or local I/O failure).");
+	}
+}
+async function uploadFile(context, options, targetId) {
+	validateUpload(options);
+	let temporaryDirectory;
+	try {
+		let path = options.file;
+		let filename = path ? basename(path) : "upload";
+		let type = mimeType(filename);
+		if (options.url !== void 0) {
+			temporaryDirectory = await mkdtemp(join(tmpdir(), "camox-upload-"));
+			path = join(temporaryDirectory, "download");
+			const downloaded = await download(options.url, path);
+			filename = downloaded.filename;
+			type = downloaded.mimeType;
+		}
+		if (!path) fail("INVALID_ARGS", "Provide a file path.");
+		const info = await stat(path);
+		if (!info.isFile()) fail("INVALID_ARGS", "Upload source must be a regular file.");
+		if (info.size > 104857600) fail("FILE_TOO_LARGE", "File exceeds the 100 MiB limit.");
+		const body = new FormData();
+		if (type === "application/octet-stream") type = mimeType(options.filename ?? filename);
+		body.set("file", await openAsBlob(path, { type }), options.filename ?? filename);
+		body.set("projectId", String(context.projectId));
+		if (options.alt !== void 0) body.set("alt", options.alt);
+		if (options.aiMetadata !== void 0 || options.alt !== void 0) body.set("aiMetadataEnabled", String(options.alt === void 0 && options.aiMetadata === "on"));
+		const headers = {
+			Authorization: `Bearer ${context.token}`,
+			"x-camox-client": "cli",
+			"x-environment-name": context.environmentName
+		};
+		if (context.disableTelemetry) headers["x-camox-telemetry-disabled"] = "1";
+		let response;
+		try {
+			const endpoint = targetId === void 0 ? "/files/upload" : `/files/${targetId}/content`;
+			response = await fetch(`${context.apiUrl}${endpoint}`, {
+				method: "POST",
+				headers,
+				body,
+				signal: AbortSignal.timeout(TIMEOUT_MS),
+				redirect: "error"
+			});
+		} catch {
+			return fail("UPLOAD_FAILED", targetId === void 0 ? "Media upload failed (network or timeout). Check files list before retrying." : `File replacement failed (network or timeout). Check files get --id ${targetId} before retrying.`);
+		}
+		if (!response.ok) fail("UPLOAD_FAILED", `${targetId === void 0 ? "Media upload" : "File replacement"} failed (HTTP ${response.status}).`);
+		return await response.json();
+	} finally {
+		if (temporaryDirectory) await rm(temporaryDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+//#region src/commands/files.ts
+const common = {
+	cwd: cwdFlag,
+	project: optional(option("--project", string({ metavar: "SLUG" }))),
+	production: option("--production"),
+	json: option("--json")
+};
+const metadata = {
+	alt: optional(option("--alt", string({ metavar: "TEXT" }), { description: message`Alt text (including an empty string). Disables automatic metadata.` })),
+	aiMetadata: optional(option("--ai-metadata", choice(["on", "off"]), { description: message`Enable or disable automatic metadata. Cannot enable alongside --alt. Enabling schedules generation for raster images.` }))
+};
+const parser$7 = command("files", or(command("upload", object({
+	command: constant("files.upload"),
+	file: optional(option("--file", string({ metavar: "PATH" }), { description: message`Local file to upload. Pass exactly one of --file or --url.` })),
+	url: optional(option("--url", string({ metavar: "URL" }), { description: message`HTTP(S) URL to download and copy into Camox, not an external reference.` })),
+	filename: optional(option("--filename", string({ metavar: "NAME" }), { description: message`Override the local basename or final URL path filename.` })),
+	...metadata,
+	...common
+}), { description: message`Upload media (maximum 100 MiB). Example: camox files upload --url https://example.com/hero.webp --alt "Product screenshot". Returns the stored file ID and URL. Without metadata options, raster images use automatic metadata.` }), command("update", object({
+	command: constant("files.update"),
+	id: option("--id", integer({
+		min: 1,
+		metavar: "ID"
+	})),
+	file: optional(option("--file", string({ metavar: "PATH" }), { description: message`Replace file content from a local path, keeping its ID and references. Mutually exclusive with --url.` })),
+	url: optional(option("--url", string({ metavar: "URL" }), { description: message`Download and replace file content from an HTTP(S) URL, keeping its ID and references. Mutually exclusive with --file.` })),
+	filename: optional(option("--filename", string({ metavar: "NAME" }), { description: message`Set the filename. Metadata-only renames preserve the URL; replacement uses the source filename unless overridden. Disable AI to prevent future automatic renaming.` })),
+	...metadata,
+	...common
+}), { description: message`Update metadata or replace file content with --file or --url (maximum 100 MiB). Replacing affects every reference to this file in the selected environment; its ID stays unchanged but its URL changes. Omitted alt text and AI settings are preserved. Example: camox files update --id 123 --file ./hero.jpg --alt "Updated description". Use --alt "" for intentionally empty alt text.` }), command("get", object({
+	command: constant("files.get"),
+	id: option("--id", integer({
+		min: 1,
+		metavar: "ID"
+	})),
+	...common
+}), { description: message`Inspect a file in the selected project and environment.` }), command("list", object({
+	command: constant("files.list"),
+	...common
+}), { description: message`List files in the selected project and environment.` })), { description: message`Upload and manage media. Defaults to your development environment; --production explicitly targets production.` });
+async function handler$7(args) {
+	const outputMode = args.json ? "json" : "auto";
+	const options = {
+		cwd: args.cwd,
+		projectFlag: args.project,
+		production: args.production,
+		outputMode
+	};
+	try {
+		if (args.command === "files.upload") {
+			validateUpload(args);
+			printResult(await uploadFile(await resolveCommandContext(options), args), outputMode);
+			process.exit(0);
+		}
+		if (args.command === "files.list") return dispatch({
+			...options,
+			toolName: "listFiles",
+			args: {}
+		});
+		if (args.command === "files.get") return dispatch({
+			...options,
+			toolName: "getFile",
+			args: { id: args.id }
+		});
+		if (args.file !== void 0 || args.url !== void 0) {
+			validateUpload(args);
+			printResult(await uploadFile(await resolveCommandContext(options), args, args.id), outputMode);
+			process.exit(0);
+		}
+		validateMetadata(args);
+		validateFilename(args.filename);
+		if (args.alt === void 0 && args.aiMetadata === void 0 && args.filename === void 0) {
+			printError({
+				code: "INVALID_ARGS",
+				message: "Pass --file, --url, --filename, --alt or --ai-metadata."
+			});
+			process.exit(2);
+		}
+		return dispatch({
+			...options,
+			toolName: "updateFile",
+			args: {
+				id: args.id,
+				alt: args.alt,
+				filename: args.filename,
+				aiMetadataEnabled: args.aiMetadata === void 0 ? void 0 : args.aiMetadata === "on"
+			}
+		});
+	} catch (err) {
+		const error = asCliError(err);
+		printError(error);
+		process.exit(error.code === "INVALID_ARGS" ? 2 : 1);
+	}
+}
 //#endregion
 //#region src/lib/agent-skills.ts
 function createAgentSkillLinks(targetDir) {
@@ -584,8 +885,10 @@ function createAgentSkillLinks(targetDir) {
 	const claudeSkillsDir = path.join(targetDir, ".claude", "skills");
 	fs.mkdirSync(agentsSkillsDir, { recursive: true });
 	fs.mkdirSync(claudeSkillsDir, { recursive: true });
-	fs.symlinkSync("../../node_modules/camox/skills/camox", path.join(agentsSkillsDir, "camox"));
-	fs.symlinkSync("../../.agents/skills/camox", path.join(claudeSkillsDir, "camox"));
+	for (const skill of ["camox", "camoxify"]) {
+		fs.symlinkSync(`../../node_modules/camox/skills/${skill}`, path.join(agentsSkillsDir, skill));
+		fs.symlinkSync(`../../.agents/skills/${skill}`, path.join(claudeSkillsDir, skill));
+	}
 }
 //#endregion
 //#region src/lib/utils.ts
@@ -931,18 +1234,21 @@ const jsonFlag$1 = option("--json");
 const productionFlag$1 = option("--production");
 const parser$5 = command("layouts", or(command("list", object({
 	command: constant("layouts.list"),
+	cwd: cwdFlag,
 	project: projectFlag$1,
 	production: productionFlag$1,
 	json: jsonFlag$1
 }))));
 async function handler$5(args) {
 	const outputMode = args.json ? "json" : "auto";
+	const cwd = args.cwd;
 	const projectFlag = args.project;
 	const production = args.production;
 	switch (args.command) {
 		case "layouts.list": return dispatch({
 			toolName: "listLayouts",
 			args: {},
+			cwd,
 			projectFlag,
 			production,
 			outputMode
@@ -966,15 +1272,18 @@ async function login() {
 }
 //#endregion
 //#region src/commands/logout.ts
-const parser$3 = command("logout", object({ command: constant("logout") }));
+const parser$3 = command("logout", object({
+	command: constant("logout"),
+	cwd: cwdFlag
+}));
 const handler$3 = logout;
-function logout() {
+function logout(args = {}) {
 	p.intro("camox logout");
 	let authenticationUrl = null;
 	try {
-		authenticationUrl = loadRuntime().authenticationUrl;
+		authenticationUrl = loadRuntime(args.cwd).authenticationUrl;
 	} catch (error) {
-		if (error instanceof RuntimeMalformedError) {
+		if (error instanceof RuntimeMalformedError || error instanceof RuntimeDirectoryError || args.cwd !== void 0 && error instanceof RuntimeNotFoundError) {
 			log.error(error.message);
 			return;
 		}
@@ -997,6 +1306,7 @@ const productionFlag = option("--production");
 const liveFlag = option("--live");
 const list = command("list", object({
 	command: constant("pages.list"),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
@@ -1006,6 +1316,7 @@ const get = command("get", object({
 	id: optional(option("--id", integer({ metavar: "ID" }))),
 	path: optional(option("--path", string({ metavar: "PATH" }))),
 	live: liveFlag,
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
@@ -1015,6 +1326,7 @@ const publish = command("publish", object({
 	id: optional(option("--id", integer({ metavar: "ID" }))),
 	path: optional(option("--path", string({ metavar: "PATH" }))),
 	noLayout: option("--no-layout"),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
@@ -1023,6 +1335,7 @@ const unpublish = command("unpublish", object({
 	command: constant("pages.unpublish"),
 	id: optional(option("--id", integer({ metavar: "ID" }))),
 	path: optional(option("--path", string({ metavar: "PATH" }))),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
@@ -1031,6 +1344,7 @@ const discardChanges = command("discard-changes", object({
 	command: constant("pages.discard-changes"),
 	id: optional(option("--id", integer({ metavar: "ID" }))),
 	path: optional(option("--path", string({ metavar: "PATH" }))),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
@@ -1041,40 +1355,53 @@ const parser$2 = command("pages", or(list, get, command("create", object({
 	pathSegment: option("--path-segment", string({ metavar: "SEGMENT" })),
 	layoutId: option("--layout-id", integer({ metavar: "ID" })),
 	parentPageId: optional(option("--parent-page-id", integer({ metavar: "ID" }))),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
 })), command("update", object({
 	command: constant("pages.update"),
-	id: option("--id", integer({ metavar: "ID" })),
+	id: optional(option("--id", integer({
+		min: 1,
+		metavar: "ID"
+	}))),
+	path: optional(option("--path", string({ metavar: "PATH" }))),
+	metaTitle: optional(option("--meta-title", string({ metavar: "TEXT" }), { description: message`Set the SEO title. An empty string clears it. Disables automatic SEO for both fields.` })),
+	metaDescription: optional(option("--meta-description", string({ metavar: "TEXT" }), { description: message`Set the SEO description. An empty string clears it. Disables automatic SEO for both fields.` })),
+	aiSeo: optional(option("--ai-seo", choice(["on", "off"]), { description: message`Enable or disable automatic SEO. Enabling schedules asynchronous generation; it cannot be combined with manual metadata. Disabling preserves current metadata.` })),
 	nickname: optional(option("--nickname", string({ metavar: "TEXT" }))),
 	pathSegment: optional(option("--path-segment", string({ metavar: "SEGMENT" }))),
 	parentPageId: optional(option("--parent-page-id", integer({ metavar: "ID" }))),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
-})), command("set-layout", object({
+}), { description: message`Update a page draft, including in --production. Pass exactly one of --id or --path and at least one update field. Omitted fields are preserved. Publish separately with pages publish. Example: camox pages update --path /about --meta-title "About us" --meta-description "Meet the team". Read metadata with pages get; add --live for published metadata.` }), command("set-layout", object({
 	command: constant("pages.set-layout"),
 	id: option("--id", integer({ metavar: "ID" })),
 	layoutId: option("--layout-id", integer({ metavar: "ID" })),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
 })), command("delete", object({
 	command: constant("pages.delete"),
 	id: option("--id", integer({ metavar: "ID" })),
+	cwd: cwdFlag,
 	project: projectFlag,
 	production: productionFlag,
 	json: jsonFlag
 })), publish, unpublish, discardChanges));
 async function handler$2(args) {
 	const outputMode = args.json ? "json" : "auto";
+	const cwd = args.cwd;
 	const projectFlag = args.project;
 	const production = args.production;
 	switch (args.command) {
 		case "pages.list": return dispatch({
 			toolName: "listPages",
 			args: {},
+			cwd,
 			projectFlag,
 			production,
 			outputMode
@@ -1093,6 +1420,7 @@ async function handler$2(args) {
 					...args.id != null ? { id: args.id } : { path: args.path },
 					source: args.live ? "live" : "draft"
 				},
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -1105,28 +1433,63 @@ async function handler$2(args) {
 				layoutId: args.layoutId,
 				parentPageId: args.parentPageId
 			},
+			cwd,
 			projectFlag,
 			production,
 			outputMode
 		});
-		case "pages.update": return dispatch({
-			toolName: "updatePage",
-			args: {
-				id: args.id,
-				nickname: args.nickname,
-				pathSegment: args.pathSegment,
-				parentPageId: args.parentPageId
-			},
-			projectFlag,
-			production,
-			outputMode
-		});
+		case "pages.update":
+			if (args.id == null === (args.path == null)) {
+				printError({
+					code: "INVALID_ARGS",
+					message: "Pass exactly one of --id or --path."
+				});
+				process.exit(2);
+			}
+			if (args.aiSeo === "on" && (args.metaTitle !== void 0 || args.metaDescription !== void 0)) {
+				printError({
+					code: "INVALID_ARGS",
+					message: "Cannot enable automatic SEO alongside manual metadata."
+				});
+				process.exit(2);
+			}
+			if ([
+				args.nickname,
+				args.pathSegment,
+				args.parentPageId,
+				args.metaTitle,
+				args.metaDescription,
+				args.aiSeo
+			].every((value) => value === void 0)) {
+				printError({
+					code: "INVALID_ARGS",
+					message: "Pass at least one field to update."
+				});
+				process.exit(2);
+			}
+			return dispatch({
+				toolName: "updatePage",
+				args: {
+					...args.id != null ? { id: args.id } : { path: args.path },
+					metaTitle: args.metaTitle,
+					metaDescription: args.metaDescription,
+					aiSeoEnabled: args.aiSeo === void 0 ? void 0 : args.aiSeo === "on",
+					nickname: args.nickname,
+					pathSegment: args.pathSegment,
+					parentPageId: args.parentPageId
+				},
+				cwd,
+				projectFlag,
+				production,
+				outputMode
+			});
 		case "pages.set-layout": return dispatch({
 			toolName: "setPageLayout",
 			args: {
 				id: args.id,
 				layoutId: args.layoutId
 			},
+			cwd,
 			projectFlag,
 			production,
 			outputMode
@@ -1134,6 +1497,7 @@ async function handler$2(args) {
 		case "pages.delete": return dispatch({
 			toolName: "deletePage",
 			args: { id: args.id },
+			cwd,
 			projectFlag,
 			production,
 			outputMode
@@ -1152,6 +1516,7 @@ async function handler$2(args) {
 					...args.id != null ? { id: args.id } : { path: args.path },
 					alsoPublishLayout: !args.noLayout
 				},
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -1167,6 +1532,7 @@ async function handler$2(args) {
 			return dispatch({
 				toolName: "unpublishPage",
 				args: args.id != null ? { id: args.id } : { path: args.path },
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -1182,6 +1548,7 @@ async function handler$2(args) {
 			return dispatch({
 				toolName: "discardPageChanges",
 				args: args.id != null ? { id: args.id } : { path: args.path },
+				cwd,
 				projectFlag,
 				production,
 				outputMode
@@ -1220,14 +1587,22 @@ function handler$1() {
 //#region src/commands/status.ts
 const parser = command("status", object({
 	command: constant("status"),
+	cwd: cwdFlag,
 	production: option("--production"),
 	json: option("--json")
 }));
 async function handler(args) {
 	let runtime;
 	try {
-		runtime = loadRuntime();
+		runtime = loadRuntime(args.cwd);
 	} catch (err) {
+		if (err instanceof RuntimeDirectoryError) {
+			printError({
+				code: "INVALID_CWD",
+				message: err.message
+			});
+			process.exit(2);
+		}
 		if (err instanceof RuntimeNotFoundError || err instanceof RuntimeMalformedError) {
 			printError({
 				code: "RUNTIME_NOT_FOUND",
@@ -1267,7 +1642,7 @@ async function handler(args) {
 //#endregion
 //#region src/index.ts
 const result = runSync(defineProgram({
-	parser: or(parser$6, parser$4, parser$3, parser$1, parser, parser$2, parser$8, parser$5, parser$7),
+	parser: or(parser$6, parser$4, parser$3, parser$1, parser, parser$2, parser$9, parser$5, parser$8, parser$7),
 	metadata: {
 		name: "camox",
 		brief: message`Camox CLI`
@@ -1281,7 +1656,7 @@ switch (result.command) {
 		await handler$4();
 		break;
 	case "logout":
-		handler$3();
+		handler$3(result);
 		break;
 	case "release":
 		handler$1();
@@ -1308,7 +1683,13 @@ switch (result.command) {
 	case "blocks.edit":
 	case "blocks.move":
 	case "blocks.delete":
-		await handler$8(result);
+		await handler$9(result);
+		break;
+	case "files.upload":
+	case "files.update":
+	case "files.get":
+	case "files.list":
+		await handler$7(result);
 		break;
 	case "layouts.list":
 		await handler$5(result);
@@ -1316,7 +1697,7 @@ switch (result.command) {
 	case "env.check":
 	case "env.push":
 	case "env.pull":
-		await handler$7(result);
+		await handler$8(result);
 		break;
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camox/cli",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "license": "MIT",
   "bin": {
     "camox": "./dist/index.mjs"
@@ -31,7 +31,7 @@
     "@types/node": "^24.12.4",
     "@typescript/native-preview": "7.0.0-dev.20260412.1",
     "vite-plus": "^0.1.21",
-    "@camox/api-contract": "0.42.0"
+    "@camox/api-contract": "0.43.0"
   },
   "nx": {
     "tags": [
@@ -42,6 +42,7 @@
     "build": "node scripts/sync-templates.mjs && vp pack",
     "dev": "node scripts/sync-templates.mjs --watch --build",
     "lint": "vp lint",
+    "test": "vp pack && node --test test/*.test.mjs",
     "check": "tsgo --noEmit && vp lint --fix"
   }
 }

package/templates/default/package.json

@@ -8,6 +8,7 @@
     "dev": "vp dev --port 7400",
     "start": "node .output/server/index.mjs",
     "build": "vp build",
+    "test:production": "node scripts/production-smoke.mjs",
     "release": "camox release",
     "serve": "vp preview",
     "lint": "vp lint",

package/templates/default/scripts/README.md

@@ -0,0 +1,35 @@
+# Production runtime smoke test
+
+From the repository root:
+
+```sh
+pnpm exec nx run camox:build
+pnpm --filter @camox/template-default test:production
+```
+
+The test builds a temporary copy of the starter using Nitro's Node middleware
+preset, moves only `.output` into an isolated deployment, removes build-time
+`node_modules` links, and serves a real HTTP request. It asserts that React/Base UI
+can render HTML and Camox's OG renderer can produce a PNG. No Camox API, real auth,
+application-level dependency tracing overrides, or direct Takumi dependency is
+needed. A temporary home directory supplies fake build authentication without
+modifying the developer's credentials. CI runs this test after building the SDK.
+
+## Issue #106 investigation
+
+- **Takumi:** the original `createRequire(import.meta.url).resolve(...)` survives
+  bundling, but the WASM package/asset is absent from the deployment. The isolated
+  smoke test reproduced `Cannot find module '@takumi-rs/wasm/takumi_wasm_bg.wasm'`
+  before the fix. Camox now uses a static module import so Nitro's WASM loader
+  owns asset inclusion, including when dependencies are fully bundled. The
+  server-only guard in `createLayout` prevents this import reaching client builds.
+- **tslib:** a package containing only `package.json` and `tslib.es6.mjs`, as
+  reported, reproduces Node's missing `tslib/modules/index.js` error: Node selects
+  that entry from the package exports. The complete upstream package is valid;
+  the partial traced copy is not. The current starter build did not independently
+  reproduce that partial copy. Camox now adds `tslib` to Nitro's `noExternals`,
+  keeping its existing ESM alias and removing reliance on partial package tracing.
+  Plugin tests cover preservation of user options, including `noExternals: true`.
+
+These are SDK integration fixes, not starter workarounds. Applications should not
+need to add Takumi as a direct dependency or configure `traceDeps`/`noExternals`.

package/templates/default/scripts/production-smoke.mjs

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { cp, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const temp = await mkdtemp(join(tmpdir(), "camox-production-"));
+
+try {
+  const root = join(temp, "app");
+  const home = join(temp, "home");
+  await mkdir(join(home, ".camox"), { recursive: true });
+  await writeFile(
+    join(home, ".camox/auth.json"),
+    JSON.stringify({
+      "http://localhost:3274": { token: "smoke", name: "Smoke", email: "smoke@example.com" },
+    }),
+  );
+  await mkdir(root);
+  await mkdir(join(temp, "node_modules"));
+  // Nitro resolves its builder from the project root. Match Vite+'s own Vite
+  // dependency without relying on workspace hoisting in this temporary app.
+  const vitePackage = createRequire(import.meta.resolve("vite-plus")).resolve("vite/package.json");
+  await symlink(dirname(vitePackage), join(temp, "node_modules/vite"), "dir");
+  for (const file of ["src", "vite.config.ts", "tsconfig.json", "package.json"]) {
+    await cp(join(appRoot, file), join(root, file), { recursive: true });
+  }
+  await symlink(join(appRoot, "node_modules"), join(root, "node_modules"), "dir");
+  const configPath = join(root, "vite.config.ts");
+  await writeFile(
+    configPath,
+    (await readFile(configPath, "utf8")).replace(
+      "nitro()",
+      'nitro({ routes: { "/smoke": "./routes/smoke.ts" } })',
+    ),
+  );
+  await mkdir(join(root, "routes"), { recursive: true });
+  await writeFile(
+    join(root, "routes/smoke.ts"),
+    `import { Dialog } from "@base-ui/react/dialog";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { ImageResponse } from "camox/_internal/imageResponse";
+
+export default async () => {
+  const element = createElement("div", { style: { color: "black", background: "white" } }, "Production smoke");
+  const image = new ImageResponse(element, { width: 320, height: 160 });
+  const bytes = new Uint8Array(await image.arrayBuffer());
+  const html = renderToStaticMarkup(createElement(Dialog.Root, null,
+    createElement(Dialog.Trigger, null, "Production smoke")));
+  return Response.json({ html, png: Array.from(bytes.slice(0, 8)) });
+};
+`,
+  );
+  const build = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      `
+    const { createBuilder } = await import(${JSON.stringify(import.meta.resolve("vite-plus"))});
+    const builder = await createBuilder({ root: ${JSON.stringify(root)} });
+    await builder.buildApp();
+  `,
+    ],
+    {
+      cwd: root,
+      env: {
+        ...process.env,
+        HOME: home,
+        CAMOX_INTERNAL_RELEASE: "0",
+        NITRO_PRESET: "node-middleware",
+      },
+      encoding: "utf8",
+      timeout: 180_000,
+      killSignal: "SIGKILL",
+    },
+  );
+  assert.equal(build.status, 0, `${build.stdout}\n${build.stderr}`);
+
+  // Move only the deployment artifact away from all workspace node_modules.
+  const deployment = join(temp, "deployment");
+  await cp(join(root, ".output"), deployment, { recursive: true });
+  await rm(root, { recursive: true, force: true });
+  await rm(join(temp, "node_modules"), { recursive: true, force: true });
+  const runtime = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      `
+    import assert from "node:assert/strict";
+    import { createServer } from "node:http";
+    const { middleware } = await import("./server/index.mjs");
+    const server = createServer(middleware);
+    await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
+    try {
+      const response = await fetch("http://127.0.0.1:" + server.address().port + "/smoke");
+      assert.equal(response.status, 200, await response.clone().text());
+      const result = await response.json();
+      assert.match(result.html, /Production smoke/);
+      assert.deepEqual(result.png, [137, 80, 78, 71, 13, 10, 26, 10]);
+    } finally {
+      server.closeAllConnections();
+      server.close();
+    }
+  `,
+    ],
+    {
+      cwd: deployment,
+      env: { ...process.env, NODE_PATH: "", NODE_ENV: "production" },
+      encoding: "utf8",
+      timeout: 30_000,
+      killSignal: "SIGKILL",
+    },
+  );
+  assert.equal(runtime.status, 0, `${runtime.stdout}\n${runtime.stderr}`);
+  console.log("Production server rendered HTML and a Takumi PNG from an isolated deployment.");
+} finally {
+  await rm(temp, { recursive: true, force: true });
+}