fimo 0.13.0 → 0.14.0-staging.2

package/assets/content-templates/types-template.eta

@@ -144,34 +144,6 @@ function getInputTypeForField(field) {
   }
 }
 
-function getNestedFieldType(field, input) {
-  switch(field.type) {
-    case 'string':
-      return getStringLiteralUnion(field) || 'string';
-    case 'text':
-      return 'string';
-    case 'richtext':
-      return 'FimoRichTextContent';
-    case 'number':
-      return 'number';
-    case 'boolean':
-      return 'boolean';
-    case 'date':
-      return 'string';
-    case 'json':
-    case 'media':
-      return 'Record<string, unknown>';
-    case 'reference': {
-      const raw = Array.isArray(field.targets) && field.targets.length > 0 ? 'FimoPolymorphicReference' : 'FimoReference';
-      return field.many ? `${raw}[]` : `${raw} | null`;
-    }
-    case 'blocks':
-      return getBlocksType(field, input);
-    default:
-      return 'unknown';
-  }
-}
-
 function getBlockObjectType(fields, input, metadata = {}) {
   const properties = [];
   if (metadata.key) {
@@ -181,7 +153,9 @@ function getBlockObjectType(fields, input, metadata = {}) {
     properties.push(`_type: "${metadata.type}"`);
   }
   for (const [key, field] of Object.entries(fields || {})) {
-    properties.push(`${key}${isRequiredField(field) ? '' : '?'}: ${getNestedFieldType(field, input)}`);
+    properties.push(
+      `${key}${isRequiredField(field) ? '' : '?'}: ${input ? getInputTypeForField(field) : getTypeForField(field)}`
+    );
   }
   return `{ ${properties.join('; ')} }`;
 }

package/assets/skills/fimo-cli/references/agents.md

@@ -83,6 +83,7 @@ There is no all-capabilities wildcard; keeping the list explicit makes each agen
 | `fimo:logs:read`             | Read production logs                        | Low          |
 | `fimo:analytics:read`        | Read analytics data                         | Low          |
 | `fimo:preview:read`          | Read a current preview URL                  | Low          |
+| `fimo:history:read`          | Read project restore points                 | Low          |
 | `fimo:deploy`                | Trigger a production deploy                 | Critical     |
 | `net:fetch`                  | Make outbound HTTP requests                 | Medium       |
 | `agent:delegate`             | Invoke declared sub-agents                  | Medium       |

package/assets/skills/fimo-cli/references/content.md

@@ -6,6 +6,13 @@
 
 This file covers the **CLI workflow** for content. Use it when the user wants to add a content type (blog, products, pages) or manage Singles and entries.
 
+## Choose the write path first
+
+- Exactly one homepage, settings document, About page, or campaign page → declare `"isSingleton": true` and write it with `fimo singles update <TypeName>`.
+- Repeated posts, products, team members, or reusable pages → keep a collection and create rows with `fimo entries create <TypeName>`.
+
+Never remove `isSingleton: true` merely because `fimo entries create` rejects the type. `entries` and `singles` are separate command namespaces; inspect `fimo singles --help` when the content is one-off.
+
 ## Flow
 
 1. Write `src/schemas/{Uid}.json` — PascalCase filename (e.g. `BlogPost.json`). Run `npx fimo@latest skills get fimo-code --ref content/schema` for the JSON contract.

package/assets/skills/fimo-cli/references/deploy.md

@@ -47,6 +47,17 @@ When reporting the result, present the raw values as named Markdown links. If no
 
 Public project variables managed with `fimo vars add` and `fimo vars update` are injected into preview/build/deploy environments. Project secrets are not injected into app builds; agents request secrets separately through their own config. See `references/project-vars-and-secrets.md`.
 
+## Framework hosting
+
+Fimo preview resolves `runtime.commands` override → package script → detected
+framework default. Production uses `.fimo/config.json#runtime.framework` and
+the same bounded build/install overrides. Existing applications keep their
+router and hosting behavior: do not replace the router or derive
+deployment rewrites from `.fimo/config.json#routes`. When setup changes are
+needed, load the `fimo-code` skill's `references/frameworks/hosting.md` recipe;
+it covers the React Router `fimoPreset()` connector and the explicit catch-all
+used only by plain Vite `BrowserRouter` SPAs.
+
 ## Warm the sandbox early in a session (optional)
 
 This is a **performance optimization, only worth doing when you already know a deploy is coming** (the developer asked to publish, or you're confident they'll want a hosted preview soon). If you're just iterating locally, skip it — don't deploy pre-emptively.

package/assets/skills/fimo-cli/references/history.md

@@ -13,6 +13,8 @@ fimo history create "Before content migration"
 fimo history restore <version-id>
 ```
 
+Studio chat can run `history list` and `history show`. Create and restore remain available through the standalone CLI and Studio's History page.
+
 Use the global `--env <name>` option to target a different environment. Use `--project <id>` when there is no local `.fimo/project.json`.
 
 ## Pagination and usage

package/assets/skills/fimo-cli/references/locales.md

@@ -15,6 +15,8 @@ fimo locales set-default es --yes --json
 fimo locales remove es --yes --json
 ```
 
+Studio chat can run `locales list`. Manage the locale lifecycle through Studio Settings or the standalone CLI.
+
 These commands update the selected environment through the locale lifecycle API. The API commits `.fimo/config.json` to the Fimo branch, then the CLI synchronizes the **whole local branch** to that commit. They refuse a dirty config, a local-ahead branch, or a diverged branch before applying the remote change. `--yes` bypasses only the explanatory prompt.
 
 If a mutation exits with code `2` and `data.code` is `LOCALE_APPLIED_SYNC_REQUIRED`, the remote operation succeeded (`data.applied` is `true`) but the local fast-forward did not. **Do not retry the locale command.** Run the commands in `data.sync.recovery`, resolve the checkout, and confirm with `fimo status` or `fimo locales list`.

package/assets/skills/fimo-cli/references/project-vars-and-secrets.md

@@ -26,7 +26,8 @@ fimo vars pull .env.e2e
 
 Fimo only edits the block between `# fimo:vars:start` and `# fimo:vars:end`. User-authored lines in the file stay untouched.
 
-Variables are public by design. They may use browser-safe prefixes such as `VITE_`, `PUBLIC_`, or `NEXT_PUBLIC_`.
+Variables are public by design. They may use browser-safe prefixes such as
+`VITE_`, `PUBLIC_`, `NEXT_PUBLIC_`, or `NUXT_PUBLIC_`.
 
 ## Secrets
 
@@ -41,7 +42,10 @@ fimo secrets unset FIRECRAWL_API_KEY
 Secret values are hidden after write. Listing secrets shows the key and a masked value, never the plaintext.
 `fimo secrets add` refuses to replace an existing value. Use `fimo secrets update` for an intentional rotation.
 
-Secrets are not written to `.env.local`, preview app env files, browser bundles, or generated project files. Secrets cannot use public prefixes such as `VITE_`, `PUBLIC_`, or `NEXT_PUBLIC_`; those prefixes are for public variables.
+Secrets are not written to `.env.local`, preview app env files, browser bundles,
+or generated project files. Secrets cannot use public prefixes such as `VITE_`,
+`PUBLIC_`, `NEXT_PUBLIC_`, or `NUXT_PUBLIC_`; those prefixes are for public
+variables.
 
 ## Local Env Files
 

package/assets/skills/fimo-code/SKILL.md

@@ -20,11 +20,17 @@ Use the project-installed CLI for local inspection, code generation, and validat
 2. Load only the references required by the task.
 3. Load the framework reference before choosing imports, providers, or rendering APIs.
 
+For an existing application, preserve its project structure and add only the
+connector required by the task. Complete example projects live in executable
+fixtures and starters, not in this skill; `assets/` contains only files meant
+to be copied verbatim.
+
 Framework routing:
 
 - `nextjs` or an `app/`, `src/app/`, `pages/`, or `src/pages/` tree → `references/frameworks/next.md`, then the matching App Router or Pages Router reference.
 - React Router framework mode (`react-router.config.ts`, `src/routes.ts`) → `references/frameworks/react-router.md`.
 - Vite + React without framework mode → `references/frameworks/vite-react.md`.
+- Astro, Nuxt, Remix, SvelteKit, Vue, or another hosting-only setup → `references/frameworks/hosting.md`. The current content/primitives SDK is React-only; do not invent a framework adapter.
 
 ## Durable content contract
 
@@ -46,6 +52,7 @@ Each reference defines one package contract. Fetch it when the task reaches that
 - Media values, `<Image>`, `<StaticImage>` → `references/assets.md`
 - Static editable copy: `t()`, `useLabels`, `getLabels` → `references/labels.md`
 - Locale ownership and framework handoff → `references/locales.md`
+- Framework detection, production routing, and hosting adapters → `references/frameworks/hosting.md`
 - Major visual work → `references/design.md`
 
 ## Non-negotiable boundaries

package/assets/skills/fimo-code/references/content/clients.md

@@ -62,7 +62,15 @@ Write inputs are plain JSON. Read values carry source metadata, so use the gener
 
 ## Singleton API
 
-A schema with `isSingleton: true` generates:
+A schema with `isSingleton: true` generates a default client:
+
+```tsx
+import HomePage from '@/schemas/HomePage';
+
+const { data: homePage } = HomePage.useGet();
+```
+
+Its API is:
 
 ```ts
 get({ locale?, populate? })

package/assets/skills/fimo-code/references/content/schema.md

@@ -21,7 +21,20 @@ Write one schema per `src/schemas/<Uid>.json`. The PascalCase filename must matc
 }
 ```
 
-Required root keys: `uid`, `name`, and `fields`. Add `"isSingleton": true` for one document such as SiteSettings.
+Required root keys: `uid`, `name`, and `fields`.
+
+Use `"isSingleton": true` whenever the site has exactly one logical document: a homepage, site settings, an About page, or one campaign landing page. Do not turn it into a one-entry collection just to seed content; keep the Single and load `fimo-cli/references/content.md` for the `fimo singles update` workflow.
+
+```json
+{
+  "uid": "HomePage",
+  "name": "Homepage",
+  "isSingleton": true,
+  "fields": {
+    "title": { "type": "string", "required": true }
+  }
+}
+```
 
 ## Locale policy
 

package/assets/skills/fimo-code/references/frameworks/hosting.md

@@ -0,0 +1,91 @@
+# Connect an application's hosting
+
+Preserve the application's framework, router, routes, and 404 behavior. Fimo
+detects supported frameworks for preview and translates only the
+provider-neutral hosting settings the application explicitly owns.
+
+## Production framework profile
+
+Fimo detects conventional projects for preview. Before publishing, commit the
+matching profile in `.fimo/config.json`:
+
+```json
+{
+  "runtime": { "framework": "nextjs" }
+}
+```
+
+Allowed values are `astro`, `nextjs`, `nuxtjs`, `react-router`, `remix`,
+`sveltekit`, `vite`, and `vue`. The field remains optional for legacy Fimo
+projects, which keep their existing static output contract.
+
+Hosted preview and production inject the tenant API through these aliases:
+
+| Application             | Server                 | Public/build               |
+| ----------------------- | ---------------------- | -------------------------- |
+| Next.js                 | `FIMO_CONTENT_API_URL` | `NEXT_PUBLIC_FIMO_API_URL` |
+| Nuxt                    | `FIMO_CONTENT_API_URL` | `NUXT_PUBLIC_FIMO_API_URL` |
+| Astro, Remix, SvelteKit | `FIMO_CONTENT_API_URL` | `PUBLIC_FIMO_API_URL`      |
+| React Router, Vite, Vue | `FIMO_CONTENT_API_URL` | `VITE_API_URL`             |
+
+Current `fimo init` and `fimo clone` write the Vite and Next aliases locally.
+For another framework, preserve or add its normal local environment alias; do
+not hardcode a tenant URL in application source.
+
+## React Router framework mode
+
+For the supported client-rendered setup, keep `ssr: false` and add Fimo's
+hosting preset. It hides the active hosting provider from application code:
+
+```ts
+import type { Config } from '@react-router/dev/config';
+import { fimoPreset } from 'fimo/react-router/preset';
+
+export default {
+  ssr: false,
+  presets: [fimoPreset()],
+} satisfies Config;
+```
+
+Do not install or import a hosting-provider preset. Fimo's React Router SSR
+adapter is not available yet; do not change an existing SSR project to
+`ssr: false` merely to add Fimo.
+
+## Plain Vite SPA
+
+A `BrowserRouter` SPA needs the host to serve its app shell for direct visits
+to client routes. Declare that behavior once in `.fimo/config.json`:
+
+```json
+{
+  "runtime": { "framework": "vite" },
+  "hosting": {
+    "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }]
+  }
+}
+```
+
+Do not add the rewrite to a `HashRouter` app or a Vite app that emits a real
+file for every route. A catch-all preserves the browser router's not-found UI,
+but the host initially returns the app shell with status 200.
+
+## Native frameworks
+
+Next.js and the other supported native frameworks own their build and routing
+output. Do not add a catch-all rewrite; the framework's hosting preset handles
+routes, server functions, static output, and 404 responses.
+
+`.fimo/config.json#routes` is the Studio page catalog, not deployment routing.
+Never generate hosting rewrites from it. If a project already has a
+provider-specific deployment file, preserve it; that file remains authoritative.
+
+## Non-standard commands
+
+Use `runtime.commands.dev|build|install` only when normal package scripts and
+framework defaults are insufficient. Do not add overrides to conventional
+projects.
+
+Vite defaults to `dist` and React Router defaults to `dist/client`. If an
+existing project deliberately emits somewhere else, preserve that choice with
+`runtime.outputDirectory`; do not rewrite the application's build merely to
+match a Fimo default.

package/assets/skills/fimo-code/references/frameworks/next/app-router.md

@@ -51,7 +51,7 @@ export default async function ArticlesPage() {
 
 `createFimo({ content, locale })` is a typed locale-bound facade over the generated registry. It does not own routing and does not force SSG.
 
-Static builds that read Fimo must receive the real build-time `FIMO_API_URL` (or `NEXT_PUBLIC_FIMO_API_URL`) and default locale environment. Do not switch a route to dynamic rendering merely to hide a missing build environment; choose SSG, ISR, or request-time rendering from the application's intended behavior.
+Static builds that read Fimo must receive the real build-time `FIMO_CONTENT_API_URL` and default locale environment. Do not switch a route to dynamic rendering merely to hide a missing build environment; choose SSG, ISR, or request-time rendering from the application's intended behavior.
 
 ## Request-time rendering
 

package/assets/skills/fimo-code/references/frameworks/next.md

@@ -14,6 +14,30 @@ When streaming a nested reference from the CLI, preserve its slashes: use `--ref
 
 Preserve the router already present. Do not add a second router or convert between App and Pages Router merely to integrate Fimo.
 
+## Production profile
+
+Set `runtime.framework` to `nextjs` in `.fimo/config.json` before the first
+hosted publish. Run `fimo validate`; load
+`references/frameworks/hosting.md` for the shared profile contract and command
+override rules.
+
+## Hosted preview config
+
+Wrap the existing Next config once so Fimo can connect its hosted development
+preview without exposing the active preview provider to the application:
+
+```ts
+import type { NextConfig } from 'next';
+import { withFimo } from 'fimo/next/config';
+
+const nextConfig: NextConfig = {};
+export default withFimo(nextConfig);
+```
+
+Preserve all existing config fields or config-function logic. Do not hardcode a
+preview domain in `allowedDevOrigins`; Fimo supplies it to the development
+sandbox. The wrapper does not change production builds.
+
 ## Client dependency
 
 Server-only Fimo reads need no client data library. If the app uses `FimoProvider`,
@@ -26,12 +50,13 @@ do not install it automatically.
 Linked projects need the tenant content API in both Next runtimes:
 
 ```dotenv
-FIMO_API_URL=https://<tenant-api>
+FIMO_CONTENT_API_URL=https://<tenant-api>
 NEXT_PUBLIC_FIMO_API_URL=https://<tenant-api>
 ```
 
 Current `fimo init` and `fimo clone` write these alongside `VITE_API_URL` while
-preserving user-owned values. Never point them at the management API. Keep the
+preserving user-owned values. `FIMO_API_URL` remains reserved for CLI/control API
+overrides. Keep the
 server variable private; only the public variable is compiled into Client
 Components.
 
@@ -113,4 +138,8 @@ Passing `locale` without `labels` is valid when only content hooks need context.
 
 Use normal schemas, generated clients, Fimo primitives, and labels. Do not use migration-only `Wrapped*` components, private `fetchEntries`, fallback stores, or adopted-site loaders. Migration code may temporarily adapt old source shapes, but those interfaces are not the Next SDK.
 
-Do not add `.fimo/config.json#routes` to a Next project yet. The current route-metadata validator still targets React Router and expects `src/routes.ts`; a first-class Next route catalog and preview bridge are separate product work. Fimo content, labels, locales, and hosting do not require that catalog.
+`.fimo/config.json#routes` is an optional Studio page catalog, not Next routing.
+Keep it aligned when the project uses Studio navigation or page metadata; Next's
+file-system routes remain authoritative. `fimo validate` does not run the React
+Router route-metadata validator on Next projects. Fimo content, labels, locales,
+and hosting do not require the catalog.

package/assets/skills/fimo-code/references/frameworks/react-router.md

@@ -70,10 +70,12 @@ Notes:
 
 ```ts
 import type { Config } from '@react-router/dev/config';
+import { fimoPreset } from 'fimo/react-router/preset';
 
 export default {
   appDirectory: 'src',
   ssr: false,
+  presets: [fimoPreset()],
   // Static-site generation is opt-in. By default this template builds as an
   // SPA (single index.html shell, client-side routing). To prerender routes at
   // build time — required for crawler-visible per-route SEO — add this line:
@@ -88,6 +90,10 @@ export default {
 } satisfies Config;
 ```
 
+`fimoPreset()` connects the client-rendered build to Fimo hosting without
+exposing a provider package. See `references/frameworks/hosting.md`; do not
+apply this SPA preset to an existing SSR project.
+
 **SSG is opt-in now.** Default = SPA (one HTML shell). Add `prerender`
 yourself if you want crawler-visible per-route HTML. The previous
 "prerender everything by default" behavior was a website-builder opinion
@@ -205,6 +211,7 @@ export default function HomePage() {
 
 ```json
 {
+  "runtime": { "framework": "react-router" },
   "version": "4",
   "seo": {
     "title": "__PROJECT_SLUG__",

package/assets/skills/fimo-code/references/frameworks/vite-react.md

@@ -142,7 +142,11 @@ export function App() {
 
 ```json
 {
-  "version": "3",
+  "runtime": { "framework": "vite" },
+  "hosting": {
+    "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }]
+  },
+  "version": "4",
   "seo": {
     "title": "__PROJECT_SLUG__",
     "siteName": "__PROJECT_SLUG__"
@@ -156,12 +160,9 @@ export function App() {
 }
 ```
 
-Note: `"version": "3"` marks the legacy plain-Vite (no-RR-framework-mode)
-shape. `fimo()` is version-agnostic — it composes a fixed set of build-time
-plugins from the `seo`/`sitemap`/`robots` options you pass and never reads
-this version field. It also never injects the React Router plugin: in a
-framework-mode project that `reactRouter()` plugin is added by your own
-`vite.config.ts`, not by `fimo/vite`.
+The rewrite is required for direct visits to `BrowserRouter` routes on Fimo
+hosting. Omit it for `HashRouter` or real per-route static output. See
+`references/frameworks/hosting.md`.
 
 ## File: `.fimo/project.json`
 

package/assets/skills/fimo-code/references/ui.md

@@ -25,6 +25,25 @@ Use Fimo components for source-tracked schema and label values so Studio can ide
 
 Pass the tracked value directly. Do not replace `<Text>` with `<h1>{article.title}</h1>`, unwrap media into raw `<img>`, or hand-roll richtext rendering.
 
+Blocks do not change this rule. Every visible nested scalar is source-tracked too, including fields inside repeated and nested blocks:
+
+```tsx
+{
+  homePage.programs.map((program) => (
+    <article key={program._key}>
+      <Text value={program.level} />
+      <Text value={program.title} as="h3" />
+      <Text value={program.description} as="p" />
+      {program.highlights.map((highlight) => (
+        <Text key={highlight._key} value={highlight.label} />
+      ))}
+    </article>
+  ));
+}
+```
+
+Do not render those values as `{program.title}` or `{highlight.label}`. That displays text but bypasses the primitive that Studio uses to resolve the exact nested edit target.
+
 Use `<StaticImage>` only when the image is deliberately not editor-managed. Use `String(value)` for attributes/third-party APIs that cannot accept a `FimoString`; keep editable visible text in `<Text>`.
 
 Never construct `FimoString`, `FimoRichText`, `FimoBoolean`, or `FimoMedia` manually. Generated clients and label readers attach the correct source path.

package/assets/skills/fimo-studio/references/cms.md

@@ -60,7 +60,9 @@ Changes save automatically as you fill in each field (the save is debounced), so
 1. Click the entry you want to change.
 2. Update any fields you need.
 
-Your edits save automatically as you change each field (the save is debounced), so there is no Save button. Watch the top bar for the save status (Saving / Saved). The entry editor's only header actions are delete (trash icon) and copy link.
+Your edits save automatically as you change each field (the save is debounced), so there is no Save button. Watch the top bar for the save status (Saving / Saved). The entry editor header lets you move to the previous or next entry, delete the current entry, or copy its link.
+
+Press **Alt+J** to move to the next entry or **Alt+K** to move to the previous one (**Option+J** and **Option+K** on macOS). These shortcuts also work while your cursor is inside a rich-text field, and pending changes save before Fimo moves.
 
 If a field is invalid, the editor keeps the change unsaved and pins a status bar below the header. Choose **Review issues** to jump to the first invalid field, then **Next issue** to move through the remaining fields. Collapsed blocks open automatically. Once every issue is fixed, the editor confirms that all fields are valid and resumes saving.
 
@@ -71,6 +73,7 @@ A field labelled with a padlocked globe is shared across languages: it holds one
 - Short text such as titles, names, and slugs uses one compact line.
 - Plain multiline text such as summaries and descriptions starts taller and grows as you write.
 - Formatted content uses the rich-text editor for headings, links, lists, and media.
+- In a rich-text field, paste or drop an image file to upload it to Assets and insert it. Type `/` and choose **Image** to reuse an existing image or upload a new one from the picker.
 
 ## Bulk Operations
 

package/dist/build/next/config.d.ts

@@ -0,0 +1,14 @@
+export interface FimoNextConfigContext {
+    readonly defaultConfig?: object;
+    readonly [key: string]: unknown;
+}
+export type FimoNextConfigFactory<TConfig extends object = object> = (phase: string, context: FimoNextConfigContext) => TConfig | Promise<TConfig>;
+export type FimoNextConfig<TConfig extends object = object> = TConfig | FimoNextConfigFactory<TConfig>;
+/**
+ * Connect a Next development server to Fimo's hosted preview gateway.
+ *
+ * The platform supplies allowed preview origins at runtime, so applications do
+ * not need to know which preview provider Fimo currently uses.
+ */
+export declare function withFimo<TConfig extends object>(applicationConfig: FimoNextConfig<TConfig>): FimoNextConfigFactory<TConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/build/next/config.js

@@ -0,0 +1,34 @@
+const NEXT_DEVELOPMENT_PHASE = 'phase-development-server';
+const PREVIEW_ORIGINS_ENV = 'FIMO_PREVIEW_ALLOWED_ORIGINS';
+function readPreviewOrigins() {
+    return (process.env[PREVIEW_ORIGINS_ENV] ?? '')
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+}
+/**
+ * Connect a Next development server to Fimo's hosted preview gateway.
+ *
+ * The platform supplies allowed preview origins at runtime, so applications do
+ * not need to know which preview provider Fimo currently uses.
+ */
+export function withFimo(applicationConfig) {
+    return async (phase, context) => {
+        const config = typeof applicationConfig === 'function'
+            ? await applicationConfig(phase, context)
+            : applicationConfig;
+        if (phase !== NEXT_DEVELOPMENT_PHASE) {
+            return config;
+        }
+        const previewOrigins = readPreviewOrigins();
+        if (previewOrigins.length === 0) {
+            return config;
+        }
+        const configuredOrigins = config.allowedDevOrigins;
+        const allowedDevOrigins = [
+            ...(Array.isArray(configuredOrigins) ? configuredOrigins : []),
+            ...previewOrigins,
+        ].filter((origin, index, origins) => origins.indexOf(origin) === index);
+        return { ...config, allowedDevOrigins };
+    };
+}

package/dist/build/vite/plugins/server-config.js

@@ -1,10 +1,23 @@
+const PREVIEW_ORIGINS_ENV = 'FIMO_PREVIEW_ALLOWED_ORIGINS';
+function readPreviewHosts() {
+    return (process.env[PREVIEW_ORIGINS_ENV] ?? '')
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter(Boolean)
+        .map((origin) => (origin.startsWith('**.') ? `.${origin.slice(3)}` : origin));
+}
 export default function serverConfigPlugin() {
     return {
         name: 'fimo:server-config',
-        config() {
+        config(config) {
+            const configuredHosts = config.server?.allowedHosts;
+            const previewHosts = readPreviewHosts();
+            const allowedHosts = configuredHosts === true
+                ? true
+                : [...(configuredHosts ?? []), ...previewHosts].filter((host, index, hosts) => hosts.indexOf(host) === index);
             return {
                 server: {
-                    allowedHosts: true,
+                    ...(allowedHosts === true || allowedHosts.length > 0 ? { allowedHosts } : {}),
                     hmr: {
                         overlay: false,
                     },

package/dist/cli/bundle.json

@@ -1,7 +1,7 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-08-12T13:31:56.833Z",
+  "bundledAt": "2026-08-13T20:53:52.462Z",
   "cliVersion": "0.13.0",
   "external": [
     "oxc-parser",