@camox/cli 0.42.0 → 0.44.0

package/dist/lib/auth-core.d.mts

@@ -7,9 +7,9 @@ interface AuthToken {
 }
 declare function normalizeUrl(url: string): string;
 /** Look up stored credentials for a specific Camox authentication backend. */
-declare function readAuthTokenForUrl(authenticationUrl: string): AuthToken | null;
-declare function writeAuthTokenForUrl(authenticationUrl: string, token: AuthToken): void;
-declare function removeAuthTokenForUrl(authenticationUrl: string): void;
+declare function readAuthTokenForUrl(authenticationUrl: string, cwd?: string): AuthToken | null;
+declare function writeAuthTokenForUrl(authenticationUrl: string, token: AuthToken, cwd?: string): void;
+declare function removeAuthTokenForUrl(authenticationUrl: string, cwd?: string): void;
 declare function verifyOneTimeToken(apiUrl: string, token: string): Promise<AuthToken>;
 //#endregion
 export { AuthToken, normalizeUrl, readAuthTokenForUrl, removeAuthTokenForUrl, verifyOneTimeToken, writeAuthTokenForUrl };

package/dist/lib/auth-core.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { a as writeAuthTokenForUrl, i as verifyOneTimeToken, n as readAuthTokenForUrl, r as removeAuthTokenForUrl, t as normalizeUrl } from "../auth-core-cCuk5aZy.mjs";
+import { a as writeAuthTokenForUrl, i as verifyOneTimeToken, n as readAuthTokenForUrl, r as removeAuthTokenForUrl, t as normalizeUrl } from "../auth-core-4Jdf5q-u.mjs";
 export { normalizeUrl, readAuthTokenForUrl, removeAuthTokenForUrl, verifyOneTimeToken, writeAuthTokenForUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camox/cli",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "license": "MIT",
   "bin": {
     "camox": "./dist/index.mjs"
@@ -31,7 +31,7 @@
     "@types/node": "^24.12.4",
     "@typescript/native-preview": "7.0.0-dev.20260412.1",
     "vite-plus": "^0.1.21",
-    "@camox/api-contract": "0.42.0"
+    "@camox/api-contract": "0.44.0"
   },
   "nx": {
     "tags": [
@@ -42,6 +42,7 @@
     "build": "node scripts/sync-templates.mjs && vp pack",
     "dev": "node scripts/sync-templates.mjs --watch --build",
     "lint": "vp lint",
+    "test": "vp pack && node --test test/*.test.mjs",
     "check": "tsgo --noEmit && vp lint --fix"
   }
 }

package/templates/default/package.json

@@ -8,6 +8,7 @@
     "dev": "vp dev --port 7400",
     "start": "node .output/server/index.mjs",
     "build": "vp build",
+    "test:production": "node scripts/production-smoke.mjs",
     "release": "camox release",
     "serve": "vp preview",
     "lint": "vp lint",

package/templates/default/scripts/README.md

@@ -0,0 +1,35 @@
+# Production runtime smoke test
+
+From the repository root:
+
+```sh
+pnpm exec nx run camox:build
+pnpm --filter @camox/template-default test:production
+```
+
+The test builds a temporary copy of the starter using Nitro's Node middleware
+preset, moves only `.output` into an isolated deployment, removes build-time
+`node_modules` links, and serves a real HTTP request. It asserts that React/Base UI
+can render HTML and Camox's OG renderer can produce a PNG. No Camox API, real auth,
+application-level dependency tracing overrides, or direct Takumi dependency is
+needed. A temporary home directory supplies fake build authentication without
+modifying the developer's credentials. CI runs this test after building the SDK.
+
+## Issue #106 investigation
+
+- **Takumi:** the original `createRequire(import.meta.url).resolve(...)` survives
+  bundling, but the WASM package/asset is absent from the deployment. The isolated
+  smoke test reproduced `Cannot find module '@takumi-rs/wasm/takumi_wasm_bg.wasm'`
+  before the fix. Camox now uses a static module import so Nitro's WASM loader
+  owns asset inclusion, including when dependencies are fully bundled. The
+  server-only guard in `createLayout` prevents this import reaching client builds.
+- **tslib:** a package containing only `package.json` and `tslib.es6.mjs`, as
+  reported, reproduces Node's missing `tslib/modules/index.js` error: Node selects
+  that entry from the package exports. The complete upstream package is valid;
+  the partial traced copy is not. The current starter build did not independently
+  reproduce that partial copy. Camox now adds `tslib` to Nitro's `noExternals`,
+  keeping its existing ESM alias and removing reliance on partial package tracing.
+  Plugin tests cover preservation of user options, including `noExternals: true`.
+
+These are SDK integration fixes, not starter workarounds. Applications should not
+need to add Takumi as a direct dependency or configure `traceDeps`/`noExternals`.

package/templates/default/scripts/production-smoke.mjs

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { cp, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const temp = await mkdtemp(join(tmpdir(), "camox-production-"));
+
+try {
+  const root = join(temp, "app");
+  const home = join(temp, "home");
+  await mkdir(join(home, ".camox"), { recursive: true });
+  await writeFile(
+    join(home, ".camox/auth.json"),
+    JSON.stringify({
+      "http://localhost:3274": { token: "smoke", name: "Smoke", email: "smoke@example.com" },
+    }),
+  );
+  await mkdir(root);
+  await mkdir(join(temp, "node_modules"));
+  // Nitro resolves its builder from the project root. Match Vite+'s own Vite
+  // dependency without relying on workspace hoisting in this temporary app.
+  const vitePackage = createRequire(import.meta.resolve("vite-plus")).resolve("vite/package.json");
+  await symlink(dirname(vitePackage), join(temp, "node_modules/vite"), "dir");
+  for (const file of ["src", "vite.config.ts", "tsconfig.json", "package.json"]) {
+    await cp(join(appRoot, file), join(root, file), { recursive: true });
+  }
+  await symlink(join(appRoot, "node_modules"), join(root, "node_modules"), "dir");
+  const configPath = join(root, "vite.config.ts");
+  await writeFile(
+    configPath,
+    (await readFile(configPath, "utf8")).replace(
+      "nitro()",
+      'nitro({ routes: { "/smoke": "./routes/smoke.ts" } })',
+    ),
+  );
+  await mkdir(join(root, "routes"), { recursive: true });
+  await writeFile(
+    join(root, "routes/smoke.ts"),
+    `import { Dialog } from "@base-ui/react/dialog";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { ImageResponse } from "camox/_internal/imageResponse";
+
+export default async () => {
+  const element = createElement("div", { style: { color: "black", background: "white" } }, "Production smoke");
+  const image = new ImageResponse(element, { width: 320, height: 160 });
+  const bytes = new Uint8Array(await image.arrayBuffer());
+  const html = renderToStaticMarkup(createElement(Dialog.Root, null,
+    createElement(Dialog.Trigger, null, "Production smoke")));
+  return Response.json({ html, png: Array.from(bytes.slice(0, 8)) });
+};
+`,
+  );
+  const build = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      `
+    const { createBuilder } = await import(${JSON.stringify(import.meta.resolve("vite-plus"))});
+    const builder = await createBuilder({ root: ${JSON.stringify(root)} });
+    await builder.buildApp();
+  `,
+    ],
+    {
+      cwd: root,
+      env: {
+        ...process.env,
+        HOME: home,
+        CAMOX_INTERNAL_RELEASE: "0",
+        NITRO_PRESET: "node-middleware",
+      },
+      encoding: "utf8",
+      timeout: 180_000,
+      killSignal: "SIGKILL",
+    },
+  );
+  assert.equal(build.status, 0, `${build.stdout}\n${build.stderr}`);
+
+  // Move only the deployment artifact away from all workspace node_modules.
+  const deployment = join(temp, "deployment");
+  await cp(join(root, ".output"), deployment, { recursive: true });
+  await rm(root, { recursive: true, force: true });
+  await rm(join(temp, "node_modules"), { recursive: true, force: true });
+  const runtime = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "-e",
+      `
+    import assert from "node:assert/strict";
+    import { createServer } from "node:http";
+    const { middleware } = await import("./server/index.mjs");
+    const server = createServer(middleware);
+    await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
+    try {
+      const response = await fetch("http://127.0.0.1:" + server.address().port + "/smoke");
+      assert.equal(response.status, 200, await response.clone().text());
+      const result = await response.json();
+      assert.match(result.html, /Production smoke/);
+      assert.deepEqual(result.png, [137, 80, 78, 71, 13, 10, 26, 10]);
+    } finally {
+      server.closeAllConnections();
+      server.close();
+    }
+  `,
+    ],
+    {
+      cwd: deployment,
+      env: { ...process.env, NODE_PATH: "", NODE_ENV: "production" },
+      encoding: "utf8",
+      timeout: 30_000,
+      killSignal: "SIGKILL",
+    },
+  );
+  assert.equal(runtime.status, 0, `${runtime.stdout}\n${runtime.stderr}`);
+  console.log("Production server rendered HTML and a Takumi PNG from an isolated deployment.");
+} finally {
+  await rm(temp, { recursive: true, force: true });
+}

package/templates/default/vite.config.ts

@@ -14,8 +14,8 @@ export default defineConfig({
       projectSlug: "camox-template-default-01", // camox-cli:replace-slug
       // camox-cli:dev-only-start
       _internal: {
-        authenticationUrl: "http://localhost:3274",
-        apiUrl: "http://localhost:8787",
+        authenticationUrl: process.env.VITE_DASHBOARD_URL ?? "http://localhost:3274",
+        apiUrl: process.env.VITE_API_URL ?? "http://localhost:8787",
       },
       // camox-cli:dev-only-end
     }),

package/dist/auth-core-cCuk5aZy.mjs

@@ -1,63 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-//#region src/lib/auth-core.ts
-const AUTH_DIR = path.join(os.homedir(), ".camox");
-const AUTH_FILE = path.join(AUTH_DIR, "auth.json");
-function normalizeUrl(url) {
-	return url.replace(/\/+$/, "");
-}
-function readAllTokens() {
-	try {
-		return JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-	} catch {
-		return {};
-	}
-}
-function writeAllTokens(tokens) {
-	fs.mkdirSync(AUTH_DIR, { recursive: true });
-	fs.writeFileSync(AUTH_FILE, JSON.stringify(tokens, null, 2), { mode: 384 });
-}
-/** Look up stored credentials for a specific Camox authentication backend. */
-function readAuthTokenForUrl(authenticationUrl) {
-	const entry = readAllTokens()[normalizeUrl(authenticationUrl)];
-	if (entry?.token && entry?.name && typeof entry.email === "string") return entry;
-	return null;
-}
-function writeAuthTokenForUrl(authenticationUrl, token) {
-	const tokens = readAllTokens();
-	tokens[normalizeUrl(authenticationUrl)] = token;
-	writeAllTokens(tokens);
-}
-function removeAuthTokenForUrl(authenticationUrl) {
-	const tokens = readAllTokens();
-	delete tokens[normalizeUrl(authenticationUrl)];
-	if (Object.keys(tokens).length > 0) {
-		writeAllTokens(tokens);
-		return;
-	}
-	try {
-		fs.unlinkSync(AUTH_FILE);
-	} catch {}
-}
-async function verifyOneTimeToken(apiUrl, token) {
-	const res = await fetch(`${normalizeUrl(apiUrl)}/api/auth/one-time-token/verify`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token })
-	});
-	if (!res.ok) throw new Error(`OTT verification failed: ${res.status}`);
-	const data = await res.json();
-	const user = data.user;
-	if (!user?.name) throw new Error("No user info in verification response");
-	const sessionToken = data.session?.token;
-	if (!sessionToken) throw new Error("No session token in verification response");
-	return {
-		name: user.name,
-		email: user.email ?? "",
-		token: sessionToken
-	};
-}
-//#endregion
-export { writeAuthTokenForUrl as a, verifyOneTimeToken as i, readAuthTokenForUrl as n, removeAuthTokenForUrl as r, normalizeUrl as t };