fimo 0.16.0-staging.5 → 0.16.0-staging.7

package/dist/runtime/templates.d.ts

@@ -62,6 +62,25 @@ interface PkgWithDeps {
     dependencies?: Record<string, string>;
     devDependencies?: Record<string, string>;
 }
+interface PkgWithScripts {
+    scripts?: Record<string, string>;
+}
+/**
+ * Point the build script's `fimo validate` at the exact CLI that scaffolded the
+ * project.
+ *
+ * Inside an npm script a bare `fimo` resolves to whatever is installed in the
+ * project, which is normally the pinned dependency — but only when the install
+ * is current. The hosted build installs the tree itself and then runs this
+ * script, and `validate` is an API client: resolving it from install state
+ * means a project can be checked by a different version than the one it pins,
+ * which is how a project can look clean locally and fail on publish.
+ *
+ * Only an exact npm version is pinned. A source checkout resolves to
+ * `file:<path>`, which is not an npx spec — and there a bare `fimo` already
+ * runs the very binary being developed, which is the point of that flow.
+ */
+export declare function rewriteFimoValidateCommand(pkg: PkgWithScripts, pin?: string | null): boolean;
 /**
  * Rewrite `fimo` (in dependencies + devDependencies) to the current pin. Only
  * touches entries that look like a value we own: the template's dist-tag, an old

package/dist/runtime/templates.js

@@ -164,6 +164,39 @@ function findDevJson(startPath) {
         current = parent;
     }
 }
+/**
+ * Point the build script's `fimo validate` at the exact CLI that scaffolded the
+ * project.
+ *
+ * Inside an npm script a bare `fimo` resolves to whatever is installed in the
+ * project, which is normally the pinned dependency — but only when the install
+ * is current. The hosted build installs the tree itself and then runs this
+ * script, and `validate` is an API client: resolving it from install state
+ * means a project can be checked by a different version than the one it pins,
+ * which is how a project can look clean locally and fail on publish.
+ *
+ * Only an exact npm version is pinned. A source checkout resolves to
+ * `file:<path>`, which is not an npx spec — and there a bare `fimo` already
+ * runs the very binary being developed, which is the point of that flow.
+ */
+export function rewriteFimoValidateCommand(pkg, pin = resolveFimoPin()) {
+    if (!pin || !/^\d+\.\d+\.\d+/.test(pin)) {
+        return false;
+    }
+    const build = pkg.scripts?.build;
+    if (typeof build !== 'string') {
+        return false;
+    }
+    // Only the validate invocation. Anything else the script runs through `fimo`
+    // is local file work, not an API client, and pinning it would add a fetch for
+    // no reason.
+    const pinned = build.replace(/\bfimo validate\b/, `npx fimo@${pin} validate`);
+    if (pinned === build) {
+        return false;
+    }
+    pkg.scripts.build = pinned;
+    return true;
+}
 /**
  * Rewrite `fimo` (in dependencies + devDependencies) to the current pin. Only
  * touches entries that look like a value we own: the template's dist-tag, an old

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fimo",
-  "version": "0.16.0-staging.5",
+  "version": "0.16.0-staging.7",
   "description": "Fimo CLI - create, deploy, and manage Fimo projects",
   "bin": {
     "fimo": "dist/cli/index.js"

package/templates/react-router/package.json

@@ -21,7 +21,7 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "0.16.0-staging.5",
+    "fimo": "0.16.0-staging.7",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",