@madojs/mado 0.12.0 → 0.13.1

package/starters/modular/src/layouts/app-shell.layout.ts

@@ -12,7 +12,6 @@
 import { html, page, routeUrl } from "@madojs/mado";
 
 import { isAuthed, logout, user } from "../modules/auth/auth.public";
-import "../shared/ui/x-button.component";
 
 export default page({
   title: "Mado App",
@@ -28,7 +27,7 @@ export default page({
           ${() =>
             isAuthed()
               ? html`<span class="who">${() => user()?.email ?? ""}</span>
-                  <x-button variant="ghost" @click=${logout}>Sign out</x-button>`
+                  <button class="button button--ghost" type="button" @click=${logout}>Sign out</button>`
               : html`<a data-link href=${routeUrl("/login")}>Sign in</a>`}
         </nav>
       </header>

package/starters/modular/src/modules/auth/login.page.ts

@@ -1,7 +1,5 @@
 import { html, navigate, page, signal, useForm } from "@madojs/mado";
 
-import "../../shared/ui/x-button.component";
-
 import { login } from "./auth.service";
 
 // 1. LOCAL STATE
@@ -16,15 +14,12 @@ import { login } from "./auth.service";
 export default page({
   title: "Sign in",
   view: () => {
-    const submitting = signal(false);
     const error = signal<string | null>(null);
     const form = useForm({
-      email: { required: true, type: "email" },
-      password: { required: true, minLength: 6 },
+      initial: { email: "", password: "" },
     });
 
     const onSubmit = form.onSubmit(async (values) => {
-      submitting.set(true);
       error.set(null);
       try {
         await login({
@@ -34,8 +29,6 @@ export default page({
         navigate("/");
       } catch (err) {
         error.set(err instanceof Error ? err.message : "Login failed");
-      } finally {
-        submitting.set(false);
       }
     });
 
@@ -49,12 +42,12 @@ export default page({
           </label>
           <label>
             Password
-            <input name="password" type="password" required @input=${form.onInput} />
+            <input name="password" type="password" required minlength="6" @input=${form.onInput} />
           </label>
           ${() => (error() ? html`<p class="error">${error()}</p>` : null)}
-          <x-button ?disabled=${() => submitting() || !form.isValid()}>
-            ${() => (submitting() ? "Signing in…" : "Sign in")}
-          </x-button>
+          <button class="button" type="submit" ?disabled=${() => form.submitting() || !form.isValid()}>
+            ${() => (form.submitting() ? "Signing in…" : "Sign in")}
+          </button>
         </form>
       </section>
     `;

package/starters/modular/src/modules/billing/pages/invoice-detail.page.ts

@@ -1,8 +1,7 @@
 import { html, page, signal } from "@madojs/mado";
 
 import { formatDate, formatMoney } from "../../../shared/lib/format-date";
-import "../../../shared/ui/x-button.component";
-import "../../../shared/ui/x-spinner.component";
+import "@/shared/ui/x-spinner.component";
 
 import { hasPermission } from "../../auth/auth.public";
 
@@ -58,9 +57,9 @@ export default page({
                       <dt>Issued</dt><dd>${formatDate(i.issuedAt)}</dd>
                     </dl>
                     ${i.status === "pending" && hasPermission("billing.invoices.pay")
-                      ? html`<x-button ?disabled=${paying} @click=${onPay}>
+                      ? html`<button class="button" type="button" ?disabled=${paying} @click=${onPay}>
                           ${() => (paying() ? "Paying…" : "Pay now")}
-                        </x-button>`
+                        </button>`
                       : null}
                   `;
                 })()}

package/starters/modular/src/modules/billing/pages/invoices-list.page.ts

@@ -1,7 +1,7 @@
 import { each, html, page, routeUrl, signal, untracked } from "@madojs/mado";
 
 import { formatDate, formatMoney } from "../../../shared/lib/format-date";
-import "../../../shared/ui/x-spinner.component";
+import "@/shared/ui/x-spinner.component";
 
 import "../components/invoice-status-badge.component";
 import { useInvoices } from "../data/invoices.resource";

package/starters/modular/src/shared/styles/reset.css

@@ -29,4 +29,24 @@ a:hover {
 button {
   font-family: inherit;
   font-size: inherit;
-}
+}
+
+.button {
+  padding: var(--space-2) var(--space-4);
+  border: 1px solid transparent;
+  border-radius: var(--radius-md);
+  background: var(--color-primary);
+  color: var(--color-primary-contrast);
+  cursor: pointer;
+}
+
+.button--ghost {
+  border-color: var(--color-border);
+  background: transparent;
+  color: var(--color-text);
+}
+
+.button:disabled {
+  cursor: not-allowed;
+  opacity: 0.55;
+}

package/starters/modular/tsconfig.json

@@ -1,9 +1,18 @@
 {
   "compilerOptions": {
+    "paths": {
+      "@/*": [
+        "./src/*"
+      ]
+    },
     "target": "ES2022",
     "module": "ES2022",
     "moduleResolution": "Bundler",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "lib": [
+      "ES2022",
+      "DOM",
+      "DOM.Iterable"
+    ],
     "strict": true,
     "noImplicitOverride": true,
     "noUncheckedIndexedAccess": true,

package/starters/modular/tsconfig.node.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "types": ["node"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["vite.config.ts"]
+}

package/starters/modular/vite.config.ts

@@ -16,12 +16,12 @@ function devApiMock(): Plugin {
     [
       "demo@mado.dev",
       {
-        password: "demo",
+        password: "demo123",
         user: {
           id: "u_demo",
           email: "demo@mado.dev",
           roles: ["user"],
-          permissions: ["billing.read"],
+          permissions: ["billing.read", "billing.invoices.pay"],
         },
       },
     ],
@@ -76,6 +76,7 @@ function devApiMock(): Plugin {
         if (url === "/api/auth/me" && req.method === "GET") {
           if (!token) return json(res, 401, { error: "unauthenticated" });
           const entry = users.values().next().value;
+          if (!entry) return json(res, 500, { error: "mock_user_missing" });
           return json(res, 200, entry.user);
         }
         if (url === "/api/auth/logout" && req.method === "POST") {
@@ -110,6 +111,9 @@ function devApiMock(): Plugin {
 }
 
 export default defineConfig({
+  resolve: {
+    tsconfigPaths: true,
+  },
   plugins: [
     devApiMock(),
     mado({
@@ -125,7 +129,4 @@ export default defineConfig({
       // site: "https://your-app.example",
     }),
   ],
-  css: {
-    transformer: "lightningcss",
-  },
 });

package/dist/src/lazy.d.ts

@@ -1,38 +0,0 @@
-/**
- * lazy() — deferred module loading with a reactive placeholder.
- *
- * Why: heavy components (charts, code editors, modals)
- * don't need to be loaded on startup. lazy() gives a TemplateResult function
- * that returns a fallback until loaded, then the real template.
- *
- *   const Chart = lazy(
- *     () => import('./components/chart.js'),
- *     { fallback: () => html`<x-spinner/>` },
- *   );
- *
- *   html`<div>${Chart({ data })}</div>`
- *
- * Module contract: must default-export a function
- *   (props) => TemplateResult.
- *
- * Loading is cached (one import() per loader reference).
- */
-import type { TemplateResult } from "./html/template-types.js";
-export interface LazyOptions<P> {
-    /** What to show while the module is loading. */
-    fallback?: (props: P) => TemplateResult;
-    /** What to show if the import failed. Default — empty string. */
-    error?: (err: Error, props: P) => TemplateResult;
-}
-type Renderer<P> = (props: P) => TemplateResult;
-/**
- * Create a lazy component.
- * Takes a dynamic import, returns a render function.
- *
- *   const Modal = lazy(() => import('./modal.js'));
- *   html`${open() ? Modal({ onClose }) : null}`
- */
-export declare function lazy<P = unknown>(loader: () => Promise<{
-    default: Renderer<P>;
-}>, options?: LazyOptions<P>): (props: P) => TemplateResult;
-export {};

package/dist/src/lazy.js

@@ -1,73 +0,0 @@
-/**
- * lazy() — deferred module loading with a reactive placeholder.
- *
- * Why: heavy components (charts, code editors, modals)
- * don't need to be loaded on startup. lazy() gives a TemplateResult function
- * that returns a fallback until loaded, then the real template.
- *
- *   const Chart = lazy(
- *     () => import('./components/chart.js'),
- *     { fallback: () => html`<x-spinner/>` },
- *   );
- *
- *   html`<div>${Chart({ data })}</div>`
- *
- * Module contract: must default-export a function
- *   (props) => TemplateResult.
- *
- * Loading is cached (one import() per loader reference).
- */
-import { signal } from "./signal.js";
-import { html } from "./html/template.js";
-const cache = new WeakMap();
-/**
- * Create a lazy component.
- * Takes a dynamic import, returns a render function.
- *
- *   const Modal = lazy(() => import('./modal.js'));
- *   html`${open() ? Modal({ onClose }) : null}`
- */
-export function lazy(loader, options = {}) {
-    return (props) => {
-        // One signal trigger per call instance; the html binder will resubscribe
-        // when the state changes.
-        const trig = signal(0);
-        const state = ensureLoaded(loader);
-        if (state.state === "loading") {
-            // subscribe: when state transitions to ready/error, trigger trig
-            const wait = waitFor(loader);
-            wait.then(() => trig.update((n) => n + 1), () => trig.update((n) => n + 1));
-        }
-        return html `${() => {
-            trig(); // subscription
-            const s = ensureLoaded(loader);
-            if (s.state === "ready" && s.renderer)
-                return s.renderer(props);
-            if (s.state === "error" && s.err) {
-                return options.error?.(s.err, props) ?? "";
-            }
-            return options.fallback?.(props) ?? "";
-        }}`;
-    };
-}
-function ensureLoaded(loader) {
-    const existing = cache.get(loader);
-    if (existing)
-        return existing;
-    const fresh = { state: "loading" };
-    cache.set(loader, fresh);
-    loader().then((mod) => {
-        fresh.state = "ready";
-        fresh.renderer = mod.default;
-    }, (err) => {
-        fresh.state = "error";
-        fresh.err = err instanceof Error ? err : new Error(String(err));
-    });
-    return fresh;
-}
-function waitFor(loader) {
-    // return the same Promise as ensureLoaded — otherwise we'd create a new one.
-    // The browser actually caches the same module, so the second call returns instantly.
-    return loader();
-}
-//# sourceMappingURL=lazy.js.map

package/dist/src/lazy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lazy.js","sourceRoot":"","sources":["../../src/lazy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAkB1C,MAAM,KAAK,GAAG,IAAI,OAAO,EAA8B,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAClB,MAA+C,EAC/C,UAA0B,EAAE;IAE5B,OAAO,CAAC,KAAQ,EAAE,EAAE;QAClB,yEAAyE;QACzE,0BAA0B;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,YAAY,CAAI,MAAM,CAAC,CAAC;QAEtC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,iEAAiE;YACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CACP,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAA,GAAG,GAAG,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,eAAe;YACvB,MAAM,CAAC,GAAG,YAAY,CAAI,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC,EAAE,CAAC;IACN,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAA+C;IAE/C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAA2B,CAEzC,CAAC;IACd,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,MAA2B,EAAE,KAA2B,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,IAAI,CACX,CAAC,GAAG,EAAE,EAAE;QACN,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;QACtB,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;IAC/B,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC;QACtB,KAAK,CAAC,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC,CACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CACd,MAA+C;IAE/C,6EAA6E;IAC7E,qFAAqF;IACrF,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC"}

package/scripts/bake.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-
-console.error("[mado] `mado bake` was removed.");
-console.error("Use `mado static`, or run the complete pipeline with `mado release`.");
-process.exit(1);

package/scripts/docs-lint.mjs

@@ -1,170 +0,0 @@
-#!/usr/bin/env node
-// Docs lint: refuses to ship documentation that still uses the legacy
-// vocabulary the 0.12 release replaced. Active reference docs, README,
-// llms.txt, AGENTS.md, CONTRIBUTING.md, TODO.md and the starter READMEs
-// must use the new terms; migration guides, CHANGELOG, release notes
-// and ADRs are allowed to mention the old names by name so users can
-// find them.
-
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, "..");
-
-// Phrases that MUST disappear from current docs/README/llms/AGENTS. They
-// remain legal inside the allow-listed contexts below.
-const FORBIDDEN = [
-  // Page API renamed from `bake` to `static`.
-  { pattern: /\bpage\.bake\b/, replacement: "page.static" },
-  { pattern: /\bbake\.paths\b/, replacement: "static.paths" },
-  { pattern: /\bbake\.data\b/, replacement: "static.initialData" },
-  { pattern: /\bbake\.revalidate\b/, replacement: "drop; no revalidate API" },
-
-  // CLI renamed from `bake` to `static`.
-  { pattern: /\bmado bake\b/, replacement: "mado static" },
-  { pattern: /\bnpm run bake\b/, replacement: "npm run release" },
-
-  // Output / marker shape changed.
-  { pattern: /\bout\/baked\b/, replacement: "out/<route>/index.html" },
-  { pattern: /#bake\b/, replacement: "data-mado-static-data" },
-
-  // Old "Smart Static (`bake`)" headline.
-  { pattern: /Smart Static \(`bake`\)/, replacement: "Static snapshots (`mado static`)" },
-
-  // Old transport / renderer claims.
-  { pattern: /No Vite required/i, replacement: "drop the phrase; Vite is the canonical transport" },
-  { pattern: /\bNo Chromium needed\b/i, replacement: "drop the phrase; mado static REQUIRES Chromium" },
-  // `linkedom` is also a legitimate Node-side test helper (the framework
-  // uses it in test/router/* for DOM unit tests). We only flag the
-  // phrases that mis-described the snapshot pipeline as a linkedom
-  // renderer.
-  { pattern: /linkedom (?:as|is) (?:the |a )?(?:static|snapshot|production) renderer/i,
-    replacement: "drop the claim; capture uses Playwright/Chromium" },
-  { pattern: /linkedom-?based renderer/i,
-    replacement: "drop the claim; capture uses Playwright/Chromium" },
-  { pattern: /server-rendered snapshot/i, replacement: "browser-rendered snapshot" },
-  { pattern: /\bmeta[- ]shell\b/i, replacement: "static snapshot" },
-
-  // Old positioning.
-  {
-    pattern: /SEO-heavy public sites are not supported/i,
-    replacement: "drop the phrase — Mado now snapshots public sites",
-  },
-  {
-    pattern: /\binternal tools only\b/i,
-    replacement: "drop the phrase — Mado is for sites and apps",
-  },
-  {
-    pattern: /SPA framework for internal tools/i,
-    replacement: "drop the phrase — Mado is for sites and apps",
-  },
-  {
-    pattern: /shadow:\s*false[^.\n]*SEO/i,
-    replacement: "drop the recommendation; SEO is handled by snapshots",
-  },
-
-  // Old pre-Vite transport language.
-  { pattern: /\btsc[- ]only\b/i, replacement: "drop the phrase — Vite is the canonical transport" },
-  { pattern: /\bno bundler\b/i, replacement: "drop the phrase — Vite is the canonical bundler" },
-  { pattern: /\btsc\s*(?:→|->)+\s*browser\b/i,
-    replacement: "drop the phrase — generated apps go through Vite" },
-  { pattern: /\bimport[\s-]?map(?:s)?\b/i, replacement: "drop the phrase — apps use Vite, not import maps" },
-
-  // Old dev / static / edge claims.
-  { pattern: /SSE[- ]?reload/i, replacement: "drop the phrase — dev uses Vite HMR" },
-  { pattern: /\bedge[- ]prerender\b/i, replacement: "drop the phrase — capture is `mado static` only" },
-
-  // Old doc filenames in active docs (the migration table in
-  // docs/en/README.md is allow-listed via docs-lint:allow-legacy-mention
-  // markers around it if needed).
-  { pattern: /\b03-static-bake\.md\b/, replacement: "15-static-snapshots.md" },
-  { pattern: /\b09-shadow-vs-light-dom\.md\b/, replacement: "10-pages-and-components.md" },
-  { pattern: /\b10-app-architecture\.md\b/, replacement: "16-app-architecture.md" },
-  { pattern: /\b13-deployment\.md\b/, replacement: "20-deployment.md" },
-  { pattern: /\b16-bake-cookbook\.md\b/, replacement: "23-cookbook.md" },
-  { pattern: /\b18-api-freeze-map\.md\b/, replacement: "30-api-freeze-map.md" },
-  { pattern: /\b19-reactivity-ordering\.md\b/, replacement: "31-reactivity-ordering.md" },
-  { pattern: /\b20-v1-stability\.md\b/, replacement: "32-v1-stability.md" },
-  { pattern: /\b07-llm-pitfalls\.md\b/, replacement: "40-llm-guide.md" },
-  { pattern: /\b08-llm-zero-history-test\.md\b/, replacement: "40-llm-guide.md" },
-];
-
-const ALLOW_LISTED = [
-  /(^|\/)CHANGELOG\.md$/,
-  /(^|\/)docs\/architecture\/adr\//,
-  /(^|\/)docs\/.+migration/i,
-  /(^|\/)docs\/.+v1-stability/i,
-  /(^|\/)scripts\/docs-lint\.mjs$/,
-];
-
-// Files / trees that must stay on-message about the post-0.12 API. New
-// roots must be added here AND covered by the CI step.
-const ROOTS = [
-  "README.md",
-  "AGENTS.md",
-  "llms.txt",
-  "CONTRIBUTING.md",
-  "TODO.md",
-  "docs/README.md",
-  "docs/en",
-  "starters/default/README.md",
-  "starters/modular/README.md",
-];
-
-let errors = 0;
-
-for (const root of ROOTS) {
-  const full = join(REPO_ROOT, root);
-  try {
-    statSync(full);
-  } catch {
-    continue;
-  }
-  scan(full);
-}
-
-if (errors > 0) {
-  console.error(`\n[docs-lint] ${errors} forbidden term(s) in current docs.`);
-  process.exit(1);
-}
-console.log("[docs-lint] OK");
-
-function scan(path) {
-  const stat = statSync(path);
-  if (stat.isDirectory()) {
-    for (const entry of readdirSync(path)) scan(join(path, entry));
-    return;
-  }
-  if (!path.endsWith(".md") && !path.endsWith(".txt")) return;
-  const rel = path.slice(REPO_ROOT.length + 1);
-  if (ALLOW_LISTED.some((rx) => rx.test(rel))) return;
-
-  const body = readFileSync(path, "utf8");
-  const lines = body.split("\n");
-  let inIgnoreBlock = false;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    // Block-scoped allowance: paragraphs that teach LLMs which names
-    // are obsolete must be free to mention those names verbatim.
-    //   <!-- docs-lint:allow-legacy-mention -->
-    //   ...legacy terms...
-    //   <!-- /docs-lint:allow-legacy-mention -->
-    if (line.includes("docs-lint:allow-legacy-mention")) {
-      inIgnoreBlock = !line.includes("/docs-lint:allow-legacy-mention");
-      continue;
-    }
-    if (inIgnoreBlock) continue;
-
-    for (const rule of FORBIDDEN) {
-      if (rule.pattern.test(line)) {
-        errors++;
-        console.error(
-          `${rel}:${i + 1}: forbidden term matches /${rule.pattern.source}/. ` +
-            `Replace with: ${rule.replacement}`,
-        );
-      }
-    }
-  }
-}

package/scripts/package-smoke.mjs

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-
-import { execFile } from "node:child_process";
-import { mkdir, mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { basename, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-
-const exec = promisify(execFile);
-const repoRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
-const tempRoot = await mkdtemp(join(tmpdir(), "mado-package-smoke-"));
-let tarball = "";
-
-try {
-  const packed = await exec("npm", ["pack", "--silent"], { cwd: repoRoot });
-  tarball = resolve(repoRoot, packed.stdout.trim().split(/\s+/).at(-1) ?? "");
-  if (!tarball) throw new Error("[package-smoke] npm pack did not return a tarball");
-
-  const installRoot = join(tempRoot, "installed");
-  await mkdir(installRoot, { recursive: true });
-  await run("npm", ["install", tarball], { cwd: installRoot });
-
-  // Public-API surface smoke: prove the published tarball exposes the
-  // root entry, the devtools side-effect import and the Vite plugin,
-  // while still hiding internal subpaths behind `exports`.
-  await run(
-    process.execPath,
-    [
-      "--input-type=module",
-      "--eval",
-      `
-        import { html, signal, routeUrl, appBase } from "@madojs/mado";
-        import "@madojs/mado/devtools.js";
-        import { mado } from "@madojs/mado/vite";
-        if (typeof html !== "function" || typeof signal !== "function") {
-          throw new Error("public root import failed");
-        }
-        if (typeof routeUrl !== "function" || typeof appBase !== "string") {
-          throw new Error("routing helpers missing from public root");
-        }
-        if (typeof mado !== "function") throw new Error("vite plugin import failed");
-        try {
-          await import("@madojs/mado/lifecycle.js");
-          throw new Error("internal lifecycle subpath unexpectedly resolved");
-        } catch (err) {
-          if (err?.code !== "ERR_PACKAGE_PATH_NOT_EXPORTED") throw err;
-        }
-      `,
-    ],
-    { cwd: installRoot },
-  );
-
-  // We exercise BOTH published starters end-to-end:
-  //
-  //   smoke-universal — `mado init` (default), npm install, typecheck,
-  //                     release. This is the path the README quick-start
-  //                     points new users to; if it ever breaks for a
-  //                     published tarball the first-run experience is
-  //                     broken.
-  //
-  //   smoke-modular   — `mado init --starter modular`, npm install,
-  //                     `mado new module`, release. Long-lived apps
-  //                     deploy this shape; the `mado new` generator
-  //                     also lives here.
-  //
-  // Each run uses MADO_SITE so static routes resolve canonical URLs,
-  // and points the starter at the freshly packed tarball through
-  // MADO_PACKAGE_SPEC so package.json doesn't reference an unpublished
-  // version.
-
-  await smokeStarter({
-    label: "universal",
-    appName: "smoke-universal",
-    initArgs: ["mado", "init", "smoke-universal"],
-    after: async (appRoot) => {
-      await run("npm", ["run", "typecheck"], { cwd: appRoot });
-      await run("npm", ["run", "release"], {
-        cwd: appRoot,
-        env: { ...process.env, MADO_SITE: "https://package-smoke.test" },
-      });
-    },
-    installRoot,
-    tarball,
-  });
-
-  await smokeStarter({
-    label: "modular",
-    appName: "smoke-modular",
-    initArgs: ["mado", "init", "smoke-modular", "--starter", "modular"],
-    after: async (appRoot) => {
-      await run("npm", ["run", "new", "--", "module", "smoke"], {
-        cwd: appRoot,
-      });
-      await run("npm", ["run", "typecheck"], { cwd: appRoot });
-      await run("npm", ["run", "release"], {
-        cwd: appRoot,
-        env: { ...process.env, MADO_SITE: "https://package-smoke.test" },
-      });
-    },
-    installRoot,
-    tarball,
-  });
-
-  console.log(`[package-smoke] ok ${basename(tarball)}`);
-} finally {
-  await rm(tempRoot, { recursive: true, force: true });
-  if (tarball) await rm(tarball, { force: true });
-}
-
-async function smokeStarter({ label, appName, initArgs, after, installRoot, tarball }) {
-  console.log(`[package-smoke] === ${label} starter ===`);
-  await run("npx", initArgs, {
-    cwd: installRoot,
-    env: { ...process.env, MADO_PACKAGE_SPEC: tarball },
-  });
-  const appRoot = join(installRoot, appName);
-  await run("npm", ["install"], { cwd: appRoot });
-  await after(appRoot);
-}
-
-async function run(cmd, args, options) {
-  console.log(`[package-smoke] ${cmd} ${args.join(" ")}`);
-  try {
-    await exec(cmd, args, {
-      cwd: options.cwd,
-      env: options.env ?? process.env,
-      maxBuffer: 20 * 1024 * 1024,
-    });
-  } catch (err) {
-    if (err.stdout) process.stdout.write(err.stdout);
-    if (err.stderr) process.stderr.write(err.stderr);
-    throw err;
-  }
-}