fimo 0.16.0-staging.5 → 0.16.0-staging.7

package/assets/skills/fimo-cli/SKILL.md

@@ -85,6 +85,7 @@ Load the matching reference when the user's request fires its trigger. Recipes t
 - "Enable locales / configure default locale / integrate an existing locale system" → `references/locales.md` **+ run `fimo skills get fimo-code --ref locales` and load the detected framework locale reference**
 - "What's in this project / show the project structure / describe the project / what schemas does it have / how many routes / project tree / show me what's here" → `references/describe.md`
 - "Deploy / publish / go live / push my changes" → `references/deploy.md`
+- "Add a redirect / security headers / CSP / HSTS / clean URLs / trailing slash" → `references/hosting.md`
 - "Get the preview URL / open the preview / what's the URL for this Branch / refresh the preview link / I just want to see the site / the preview URL stopped working" → `references/preview.md`
 - "Schedule a command / cron / nightly publish / recurring checks / `fimo schedules`" → `references/schedules.md`
 - "Set env vars / configure API keys / add project secrets / local `.env.local` / `fimo vars` / `fimo secrets`" → `references/project-vars-and-secrets.md`

package/assets/skills/fimo-cli/references/deploy.md

@@ -60,6 +60,9 @@ needed, load the `fimo-code` skill's framework reference:
 connector and the explicit catch-all used only by plain Vite `BrowserRouter`
 SPAs; Astro's `fimo()` integration lives in `references/frameworks/astro.md`.
 
+Redirects, response headers, and URL shape belong in
+`.fimo/config.json#hosting` — see `references/hosting.md`.
+
 ## Warm the sandbox early in a session (optional)
 
 This is a **performance optimization, only worth doing when you already know a deploy is coming** (the developer asked to publish, or you're confident they'll want a hosted preview soon). If you're just iterating locally, skip it — don't deploy pre-emptively. New-project onboarding never needs it: its automatic first preview deploy is the warm-up.

package/assets/skills/fimo-cli/references/hosting.md

@@ -0,0 +1,114 @@
+# Hosting: how a published project is served
+
+Declare redirects, headers, rewrites, and URL shape in
+`.fimo/config.json#hosting`. This is the only place Fimo reads them from.
+
+## Fields
+
+```json
+{
+  "hosting": {
+    "redirects": [{ "source": "/", "destination": "/fr", "permanent": false }],
+    "rewrites": [{ "source": "/blog/:slug", "destination": "/posts/:slug" }],
+    "headers": [
+      {
+        "source": "/(.*)",
+        "headers": [{ "key": "X-Frame-Options", "value": "DENY" }]
+      }
+    ],
+    "cleanUrls": true,
+    "trailingSlash": false
+  }
+}
+```
+
+| Field           | Effect                                                              |
+| --------------- | ------------------------------------------------------------------- |
+| `redirects`     | Send the browser elsewhere. `permanent: true` is 308, otherwise 307 |
+| ↳ `statusCode`  | Use instead of `permanent` for an exact 301, 302, 307, or 308       |
+| `rewrites`      | Serve a different path without changing the URL                     |
+| `headers`       | Add response headers on matching paths                              |
+| `cleanUrls`     | Serve `/about` for `/about.html` and 308 the extension away         |
+| `trailingSlash` | `true` requires a trailing slash, `false` forbids one               |
+
+Every field is optional. Only what you declare is emitted.
+
+## Matching
+
+`source` matches the pathname only, never the query string.
+
+| Pattern         | Matches                                |
+| --------------- | -------------------------------------- |
+| `/about`        | exactly that path                      |
+| `/blog/:slug`   | one segment, captured as `slug`        |
+| `/proxy/:rest*` | any number of segments, including none |
+| `/(.*)`         | everything                             |
+
+Captured names are reusable in `destination`: `/blog/:slug` →
+`/posts/:slug`. `destination` may be an absolute path or an external URL.
+
+## Conditions
+
+Any redirect, rewrite, or header rule can require more than a path match. `has`
+applies the rule only when every condition holds; `missing` only when none of
+them are present.
+
+```json
+{
+  "redirects": [
+    {
+      "source": "/(.*)",
+      "has": [{ "type": "header", "key": "x-vercel-ip-country", "value": "GB" }],
+      "destination": "/uk/:path*"
+    }
+  ],
+  "rewrites": [
+    {
+      "source": "/",
+      "missing": [{ "type": "cookie", "key": "consent" }],
+      "destination": "/consent"
+    }
+  ]
+}
+```
+
+| `type`   | Matches on                                           |
+| -------- | ---------------------------------------------------- |
+| `header` | a request header, including CDN-injected geo headers |
+| `cookie` | a cookie                                             |
+| `query`  | a query parameter                                    |
+| `host`   | the hostname the request arrived on — takes no `key` |
+
+Omit `value` to match on presence alone, as the `consent` cookie above does.
+
+**Prefer doing this in the application when it can.** Middleware, a loader, or a
+server component can be run and tested locally; a condition here only takes
+effect once published, so a mistake is found in production. Reach for `has` when
+the app cannot act — a redirect that must happen before any code runs, or a
+header on a static asset.
+
+## Rules
+
+- **Prefer the framework's own router.** Use `hosting` for what the router
+  cannot express: cross-origin moves, security headers, host-level URL shape.
+  Do not mirror `.fimo/config.json#routes` here.
+- **`permanent: true` is cached by browsers and hard to take back.** Omitting it
+  gives a temporary redirect, which is the one you can change your mind about.
+  Set it only when the old URL is genuinely retired. Reach for `statusCode` only
+  when you need a literal 301 or 302; it wins over `permanent`.
+- **With `cleanUrls: true`, drop the extension everywhere.** A `source` or
+  `destination` of `/about.html` will not match; write `/about`.
+- **Set `trailingSlash` on any site with more than one page.** Leaving it unset
+  serves `/about` and `/about/` as separate URLs, which search engines index as
+  duplicates.
+- **An empty `hosting: {}` means no platform routing**, which is different from
+  omitting `hosting` entirely — that leaves legacy SPA behaviour untouched.
+- **Not supported:** cron jobs (use `fimo schedules`), image optimization (use
+  Fimo media), per-function runtime settings, deployment regions.
+
+## Verify
+
+`fimo validate` rejects an unknown `hosting` key, so a typo fails locally
+rather than silently doing nothing in production. Behaviour itself only takes
+effect once published — check the live URL after `fimo deploy --publish`, not
+the preview.

package/assets/skills/fimo-studio/references/ai-chat.md

@@ -22,7 +22,7 @@ Give the AI more to work with:
 - **+ button**: Opens a dropdown with options:
   - **Attach Assets** -- browse your media library and attach files.
   - **Attach Entries** -- attach CMS content for the AI to reference.
-  - **Upload from Computer** -- upload a new file directly.
+  - **Upload from Computer** -- upload a file directly. ZIP archives are supported up to 20 MiB; the AI can download and inspect them under `/tmp` in its sandbox while the original stays attached to the conversation.
   - **Draw** -- opens the drawing tool where you can sketch a wireframe or layout idea for the AI to follow.
 - **@ mentions**: Type **@** in the chat to reference specific files, pages, or content inline.
 

package/dist/cli/bundle.json

@@ -1,7 +1,7 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-08-20T19:18:12.327Z",
+  "bundledAt": "2026-08-21T13:03:13.526Z",
   "cliVersion": "0.15.0",
   "external": [
     "oxc-parser",