fimo 0.2.1 → 0.2.3-experimental.1782118113229

package/README.md

@@ -1,344 +1,94 @@
-# fimo
+<p align="center">
+  <a href="https://fimo.ai">
+    <img src="https://fimo.ai/favicon-orange-apple-touch-icon.png" height="80" alt="Fimo" />
+  </a>
+</p>
 
-Fimo project CLI **and** library. One npm package, three surfaces:
+<h3 align="center">Fimo</h3>
 
-- `fimo` binary — `fimo create`, `fimo deploy`, `fimo switch`, …
-- `fimo/ui` — React runtime (providers, components, `useTranslations`).
-- `fimo/vite` — Vite plugin that composes Fimo's build-time plugins and auto-regenerates the schema/form TS clients.
+<p align="center">Make your website autonomous.</p>
 
-## Using the library inside a Fimo project
+<p align="center">
+  Build your site with any coding agent — Fimo owns everything after the build:
+  content, editing, environments, and hosting.
+</p>
 
-```jsonc
-// package.json (scaffolded by `fimo create`)
-{
-  "scripts": {
-    "dev": "vite",
-    "build": "vite build",
-    "preview": "vite preview",
-  },
-  "dependencies": { "fimo": "^0.0.1", "react": "...", "react-router": "..." },
-  "devDependencies": { "vite": "...", "oxlint": "...", "typescript": "..." },
-}
-```
-
-```ts
-// vite.config.ts
-import { defineConfig } from 'vite';
-import { fimo } from 'fimo/vite';
-export default defineConfig({ plugins: [fimo()] });
-```
-
-```ts
-// src/main.tsx
-import { AppRoutesProvider } from 'fimo/ui';
-```
-
-The vite plugin:
+---
 
-- Injects `fimo-config.json` constants as build-time defines.
-- Registers the SEO, data-id, overlay, preview-script, and translations plugins.
-- Watches `src/{schemas,forms}/**/*.json` and regenerates the corresponding `.ts` clients on change. No separate prebuild script needed.
+## Usage
 
-## Running the CLI during dev
+Install the CLI:
 
-```sh
-# from the monorepo root
-pnpm -F fimo start -- <command>
-# e.g.
-pnpm -F fimo start -- login
-pnpm -F fimo start -- create my-site
-pnpm -F fimo start -- deploy --publish
-pnpm -F fimo start -- invite
-pnpm -F fimo start -- referral link
-pnpm -F fimo start -- referral stats
+```bash
+npm i -g fimo
 ```
 
-## Install `fimo` as a global command
-
-```sh
-# from the monorepo root
-pnpm install-cli
-```
-
-That one command:
-
-1. Builds the CLI (three-way tsc build for `dist/{cli,ui,vite,scripts}`).
-2. Makes `apps/cli/dist/cli/index.js` executable.
-3. Creates a symlink at `~/.local/bin/fimo` pointing at the built entry.
-4. Warns if `~/.local/bin` is not on your `PATH`.
-
-Add `~/.local/bin` to your shell rc if the script warned you:
-
-```sh
-export PATH="$HOME/.local/bin:$PATH"
-```
-
-Verify:
-
-```sh
-fimo --help
-```
-
-After that `fimo create my-site`, `fimo deploy`, etc. work from any directory.
-
-> The symlink points at the built entry inside the monorepo, so after `git pull` just re-run `pnpm install-cli` (or `pnpm -F cli build`) to refresh — the symlink itself stays valid.
-
-### Why this works anywhere
-
-- The **project template** lives at `apps/cli/templates/<framework>/` (currently just `react-router/`) and the **`.claude/` starter** lives under `apps/cli/assets/agents-starter/`. The CLI resolves both relative to its own file location (via `import.meta.url`, see `apps/cli/src/runtime/templates.ts`). There is no cross-package runtime path — `fimo` needs nothing outside the CLI package.
-- The scaffolded homepage is intentionally a single-page starter so `fimo create` produces something visible and editable immediately, rather than a blank screen.
-- That homepage is intentionally disposable. Real generations should replace its content/style instead of iterating on the default Fimo-branded design. Run `fimo check-starter` against a generated project to catch leaked starter copy.
-
-## Previewing the scaffold without `fimo create`
-
-- The source for the scaffolded project is checked in at `apps/cli/templates/react-router/`, so you can inspect the exact files that `fimo create` copies without creating a project first.
-- There is not currently a dedicated one-command preview flow for that template inside the monorepo. To render it as a website, you still need to run the template itself or scaffold a project from it.
-
-## Environment variables
-
-| Variable       | Default                 | Purpose                                                                                      |
-| -------------- | ----------------------- | -------------------------------------------------------------------------------------------- |
-| `FIMO_API_URL` | `http://localhost:3000` | Base URL of the Fimo HTTP API (management + tenant). Point at staging/prod to test remotely. |
-| `FIMO_WEB_URL` | `http://localhost:5173` | Base URL of the Fimo web app. The login flow opens `<FIMO_WEB_URL>/auth/cli` in the browser. |
-
-### Pointing the CLI at another environment (staging, prod, preview)
-
-Export both vars before running any command so login, API calls, and the browser callback all target the same environment:
-
-```sh
-export FIMO_API_URL="<staging-api-base-url>"
-export FIMO_WEB_URL="<staging-web-base-url>"
+Log in and scaffold a new project:
 
+```bash
 fimo login
-fimo create my-staging-site
-```
-
-Credentials are scoped per-backend (hashed on `apiUrl`). `fimo login` writes to `~/.config/fimo/credentials/<host>-<hash>.json`; switching `FIMO_API_URL` and re-running `fimo login` writes a fresh slot without disturbing the old one.
-
-## Active organization
-
-`fimo login` automatically persists your personal org (or the first org you belong to) as the **active organization** in `credentials.json`. `fimo create` uses it — no prompt.
-
-To switch:
-
-```sh
-fimo switch
-```
-
-`fimo whoami` prints the currently active organization. `fimo create --org <id>` still works for one-off overrides.
-
-## Envs (M07 — branch = env)
-
-Every project has one or more **envs** (`main`, `feat/seo`, `release/v1.4.2`, …). Each `fimo` command auto-targets the env from the **current git branch**, falling back to `main` when there's no branch:
-
-```sh
-git checkout feat/seo
-fimo cms entries list BlogPost   # → env: feat/seo (from git branch)
-
-git checkout main
-fimo cms entries list BlogPost   # → env: main (from git branch)
-```
-
-A `release/<tag>` checkout maps to the well-known `prod` shorthand and is **read-only** — mutating commands refuse to run:
-
-```sh
-git checkout release/v1.4.2
-fimo cms entries create BlogPost --body '{...}'  # ✗ refuses (read-only env 'prod')
-fimo cms entries list BlogPost                   # ok (read-only)
-```
-
-### Override with `--env <name>`
-
-The `--env` root flag overrides the auto-target for one invocation:
-
-```sh
-fimo --env staging cms entries list BlogPost
-fimo --env release/v1 cms entries get BlogPost the-launch-day
+fimo create my-site
+cd my-site
 ```
 
-The CLI prints a one-line banner on stderr so you can see what env each command targeted:
+`fimo create` sets up the project, pushes the first commit, and wires it to your Fimo account. Open it in your coding agent and start building.
 
-```
-→ env: staging (from --env)
-```
-
-Behind the scenes the CLI sends `X-Fimo-Env: <env>` on every request; the server's `resolveEnv` middleware picks it up. Branch and override names are validated client-side against the canonical regex (`/^[a-zA-Z0-9._/-]+$/`, ≤255 chars).
-
-### Common errors
-
-| Error                                                   | Hint                                                                          |
-| ------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| `You are not in a Fimo project.`                        | `cd` into a directory containing `.fimo.settings.json`, or run `fimo create`. |
-| `In a git repository but no branch could be detected …` | Detached HEAD — `git checkout main` or pass `--env <name>`.                   |
-| `--env value '...' is invalid`                          | Env names must match `/^[a-zA-Z0-9._/-]+$/` and not start with `-`.           |
-| `Env '...' not found on the server.`                    | `fimo branch` to list envs; `fimo branch <name>` to create one.               |
-
-## Git-shaped CLI (M08)
-
-The `fimo` command set mirrors git's shape — same verbs, multi-surface semantics:
-
-```sh
-fimo branch                          # list envs (current marked with *)
-fimo branch -v                       # + show archived + preview URLs
-fimo branch feat/seo                 # create env off current
-fimo branch -d feat/old              # archive (refuses if unmerged)
-fimo branch -D feat/old              # force-delete
-fimo branch -m feat/typo feat/fixed  # rename
-
-fimo checkout feat/seo               # switch env + git branch
-fimo checkout -b feat/new            # create + switch
-
-fimo switch feat/seo                 # alias for `fimo checkout`
-fimo organizations switch            # (the old `fimo switch` org switcher moved here)
-
-fimo pull                            # sync current env from parent
-fimo pull --from main                # explicit parent override
-
-fimo diff                            # current vs main, across all surfaces
-fimo diff feat/seo main              # explicit
-fimo diff --surface schemas          # filter to one surface
-fimo diff --surface code             # drops to `git diff` locally
-fimo diff --json                     # raw JSON for pipes/agents
-
-fimo merge feat/seo                  # multi-surface merge (refuses on main)
-fimo merge feat/seo --allow-direct-merge   # override the protected-flow gate
-fimo merge feat/seo -y               # parent-wins for every conflict
-
-fimo status                          # the showcase: 8 surfaces in one report
-fimo status --short                  # one line per surface
-fimo status --vs main                # explicit comparison target
-fimo status --code --content         # surface filters (any combo)
-fimo status --json                   # raw JSON
-
-fimo publish --version 1.4.2         # tag release/v1.4.2 + trigger prod swap
-
-fimo agents list                     # (M13 stub — full impl lands with the agent system)
-```
-
-### Surfaces
-
-Every multi-surface command spans the same 8 surfaces in the same canonical order:
-
-```
-code · schemas · content · translations · routes · assets · forms · activations
-```
-
-The renderer prints them grouped, with `+` (added) / `-` (removed) / `~` (changed) / `!` (conflict) glyphs and a dim summary line per section. Each surface check has a 2 s soft timeout — a slow surface renders as `(surface check timed out)` and the rest of the report still draws.
+## AI coding tools
 
-### Protected flow
+Fimo ships skills and rules for your AI coding tools (Claude Code, Cursor, Codex, Gemini, and more) so the agent knows how to work in a Fimo project. `fimo create` installs them for you — add or refresh them any time:
 
-`fimo merge` refuses to merge directly onto `main` by default. Use the PR/review flow, or pass `--allow-direct-merge` to override (useful for cutover-style operator work). `fimo publish` similarly requires you to already be on `main`.
-
-### `NO_COLOR` / `--no-color`
-
-The CLI honors the [NO_COLOR](https://no-color.org/) standard. Every multi-surface command also accepts a per-invocation `--no-color` flag for piping into tools that don't strip ANSI escapes.
-
-## Inviting users
-
-`fimo invite` opens an interactive flow that mirrors the UI sharing dialogs:
-
-- choose whether to invite someone to an **organization** or a **project**
-- enter the invitee email
-- pick the organization role (`member`, `admin`, `owner`) or project access level (`view`, `comment`, `edit`, `full`)
-
-Examples:
-
-```sh
-# interactive
-fimo invite
-
-# invite to the active organization
-fimo invite --target organization --email jane@acme.com --role admin
-
-# invite to the current project from .fimo.settings.json
-fimo invite --target project --email jane@acme.com --role edit
-
-# invite to a specific project
-fimo invite --target project --project <projectId> --email jane@acme.com --role full
+```bash
+fimo skills install
 ```
 
-## Referral link
+## Local development
 
-Use `fimo referral link` to print your public referral link directly in the terminal:
+A Fimo project is a standard Vite app — run it like any other:
 
-```sh
-fimo referral link
+```bash
+npm install
+npm run dev
 ```
 
-The command uses the current signed-in user and prints a shareable URL like:
+Manage content, schemas, media, and translations from the CLI:
 
-```text
-https://fimo.ai/invite/<your-user-id>
+```bash
+fimo schemas push          # sync your content models
+fimo entries list          # browse content
+fimo assets upload <file>  # add media (or `fimo assets generate` with AI)
+fimo translations list     # manage locales
 ```
 
-## Referral stats
+## Deploying
 
-Use `fimo referral stats` to print the same referral summary exposed in the UI:
+Push your current environment and refresh its preview:
 
-```sh
-fimo referral stats
+```bash
+fimo deploy -m "your message"
 ```
 
-It shows:
-
-- total referrals
-- signed up referrals
-- activated referrals
-- AI credits earned
-
-## Publishing a test tarball (R2)
+Go live to production:
 
-The CLI ships as a single self-contained tarball (template + compiled JS). For internal distribution we upload it to a Cloudflare R2 bucket via `wrangler`.
-
-```sh
-# from apps/cli
-pnpm publish-cli
-# or from anywhere:
-pnpm -F fimo publish-cli
+```bash
+fimo publish --version 1.0.0
 ```
 
-What this does:
-
-1. `pnpm -F fimo build` → compiles TS and refreshes the bundled template.
-2. `pnpm pack` → produces `apps/cli/fimo-<version>.tgz` (~175 KB).
-3. `wrangler r2 object put` → uploads it to `r2://<bucket>/cli/fimo-<version>.tgz` **and** `r2://<bucket>/cli/fimo-latest.tgz`.
-
-### Env vars
-
-| Variable                | Default         | Purpose                    |
-| ----------------------- | --------------- | -------------------------- |
-| `FIMO_CLI_R2_BUCKET`    | `fimo-cli-test` | Target R2 bucket name      |
-| `CLOUDFLARE_API_TOKEN`  | —               | wrangler auth (standard)   |
-| `CLOUDFLARE_ACCOUNT_ID` | —               | wrangler account selection |
-
-### Overrides
-
-```sh
-# different bucket
-FIMO_CLI_R2_BUCKET=fimo-cli-staging pnpm -F fimo publish-cli
+Environments work like git branches:
 
-# upload to the local wrangler dev store instead of the real R2 (dry-run style)
-pnpm -F fimo publish-cli -- --local
+```bash
+fimo branch staging        # create an environment
+fimo checkout staging      # switch to it
+fimo diff staging main     # compare two environments
+fimo merge staging         # merge one into another
+fimo status                # see where things stand
 ```
 
-### Installing the tarball on a test machine
+Connect a custom domain:
 
-The test bucket is publicly served at **`https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev`**.
-
-```sh
-# always-latest
-npm install -g https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev/cli/fimo-latest.tgz
-
-# pin a specific version
-npm install -g https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev/cli/fimo-0.0.1.tgz
-
-fimo --help
+```bash
+fimo domains add example.com
 ```
 
-Interactive global installs ask whether to run `fimo skills install` so the user's AI coding tools can load the Fimo skills immediately. Non-interactive installs, CI, and `FIMO_SKIP_POSTINSTALL_PROMPT=1` skip the prompt and print the manual command instead. The installer also prints `fimo login` as the next account step, but it does not open the browser login flow from `postinstall`.
-
-> `publish-cli` uploads both `cli/fimo-<version>.tgz` and `cli/fimo-latest.tgz` on every run.
-
-## Credentials
+## Documentation
 
-Stored at `${XDG_CONFIG_HOME:-~/.config}/fimo/credentials/<host>-<hash>.json` (one file per backend). Each file contains the access token, user info, and the active organization. Delete the file (or run `fimo login` against a new `FIMO_API_URL`) to switch accounts.
+Full documentation lives at **[docs.fimo.ai](https://docs.fimo.ai)**. Run `fimo --help` to see every command.

package/assets/skills/fimo-cli/references/domains.md

@@ -8,6 +8,8 @@
 | **Custom domain**     | A hostname the user owns (e.g. `blog.example.com`), attached via DNS | Premium                | Many        | `project_domains` table    |
 | **Registered domain** | A new domain bought _through_ Fimo via the registrar reseller        | Premium + feature flag | Many        | `registered_domains` table |
 
+> **A renamed URL or custom domain only resolves once the site is published** (`fimo deploy --publish`); before that it returns "Project Not Found".
+
 ## Commands
 
 ```bash
@@ -106,6 +108,7 @@ Propagation: typically 15–30 minutes, up to 48 hours rarely.
 
 ## Common errors
 
+- **"Project Not Found" on a new URL or custom domain.** The route exists but the site was never published — run `fimo deploy --publish`.
 - **"Custom domains require a Premium plan."** — the operation is paid; the message includes the org billing URL. Free users can still run `list`, `rename-default`, `suggest-default`, `search`, and `pricing`.
 - **"Domain purchase is not enabled on this account."** — the registered-domains feature flag is off on this API instance. Contact support.
 - **"This URL is not available."** — slug or hostname collides with another project or is reserved.

package/dist/cli/bundle.json

@@ -1,8 +1,8 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-06-19T10:57:35.042Z",
-  "cliVersion": "0.2.1",
+  "bundledAt": "2026-06-22T08:48:42.757Z",
+  "cliVersion": "0.2.3-experimental.1782118113229",
   "external": [
     "oxc-parser",
     "fsevents"

package/dist/cli/index.js

@@ -18242,7 +18242,8 @@ async function copyTemplate(templateRoot, targetDir) {
   pinFimoDependency(targetDir);
 }
 function pinFimoDependency(targetDir) {
-  const pin = resolveFimoPin({ devPackageRoot: CLI_ROOT });
+  const useLocalPackage = process.env.FIMO_LOCAL_PACKAGE === "1";
+  const pin = resolveFimoPin({ devPackageRoot: useLocalPackage ? CLI_ROOT : null });
   if (!pin) {
     return;
   }
@@ -93640,7 +93641,7 @@ var init_migrate_apply = __esm({
 });
 
 // src/cli/commands/migrate.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import fs31 from "node:fs";
 import path33 from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
@@ -93891,7 +93892,7 @@ function runBundledMigrationScript(scriptName, args) {
     process.exitCode = 1;
     return;
   }
-  const result = spawnSync3(process.execPath, [scriptPath, ...args], {
+  const result = spawnSync4(process.execPath, [scriptPath, ...args], {
     stdio: "inherit"
   });
   if (result.error) {
@@ -103252,6 +103253,55 @@ async function gitCredentialCommand(operation) {
 }
 __name(gitCredentialCommand, "gitCredentialCommand");
 
+// src/cli/commands/install.ts
+init_dist();
+init_skills();
+import { spawnSync as spawnSync3 } from "node:child_process";
+var PACKAGE = "fimo";
+function detectPackageManager3(userAgent = process.env.npm_config_user_agent ?? "") {
+  const name = userAgent.split("/", 1)[0];
+  if (name === "pnpm" || name === "yarn" || name === "bun") {
+    return name;
+  }
+  return "npm";
+}
+__name(detectPackageManager3, "detectPackageManager");
+function globalAddCommand(pm) {
+  switch (pm) {
+    case "pnpm":
+      return { cmd: "pnpm", args: ["add", "-g", PACKAGE] };
+    case "yarn":
+      return { cmd: "yarn", args: ["global", "add", PACKAGE] };
+    case "bun":
+      return { cmd: "bun", args: ["add", "-g", PACKAGE] };
+    default:
+      return { cmd: "npm", args: ["install", "-g", PACKAGE] };
+  }
+}
+__name(globalAddCommand, "globalAddCommand");
+async function installCommand(options = {}) {
+  if (!options.skipCli) {
+    const { cmd, args } = globalAddCommand(detectPackageManager3());
+    const printable = `${cmd} ${args.join(" ")}`;
+    ui.info({ command: "install", message: `Installing the fimo CLI globally (${printable})\u2026` });
+    const result = spawnSync3(cmd, args, { stdio: "inherit" });
+    if (result.status === 0) {
+      ui.ok({ command: "install", headline: "fimo CLI installed globally." });
+    } else {
+      ui.warn({
+        command: "install",
+        message: `Couldn't install fimo globally with ${cmd}. Install it manually: ${printable}. Continuing with skills\u2026`
+      });
+    }
+  }
+  await skillsInstallCommand(options);
+  ui.info({
+    command: "install",
+    message: "Next: run `fimo login` to connect your account, then `fimo create` to start a project."
+  });
+}
+__name(installCommand, "installCommand");
+
 // src/cli/commands/integrations.ts
 init_dist6();
 import path30 from "node:path";
@@ -106409,6 +106459,11 @@ program.name("fimo").description("Fimo CLI").version(computeVersionString()).opt
 program.command("login").description("Sign in through your browser").action(loginCommand);
 program.command("logout").description("Revoke the current session and clear local credentials").action(logoutCommand);
 program.command("whoami").description("Show the current signed-in user").action(whoamiCommand);
+program.command("install").description("Install the fimo CLI globally and set up skills for your AI coding tools").option("--agents <list>", "Comma-separated list of agent IDs (e.g. claude-code,cursor)").option(
+  "-a, --agent <id>",
+  "Repeatable: pass once per agent (-a claude-code -a cursor)",
+  (value, prev2 = []) => [...prev2, value]
+).option("--mode <mode>", "Skill install method: symlink | copy (default: symlink)").option("-y, --yes", "Skip prompts (non-interactive)").option("--skip-cli", "Skip the global CLI install; only set up skills").action(installCommand);
 registerProjectSecretsCommands(program);
 registerIntegrationsCommands(program);
 registerChannelsCommands(program);

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "fimo",
-  "version": "0.2.1",
+  "version": "0.2.3-experimental.1782118113229",
   "description": "Fimo CLI - create, deploy, and manage Fimo projects",
   "bin": {
-    "fimo": "./dist/cli/index.js"
+    "fimo": "dist/cli/index.js"
   },
   "files": [
     "dist/",

package/release.json

@@ -1,5 +1,5 @@
 {
   "source": "npm",
-  "apiUrl": "https://api.fimo.ai",
-  "webUrl": "https://fimo.ai"
+  "apiUrl": "https://api.staging.fimo.team",
+  "webUrl": "https://staging.fimo.team"
 }

package/scripts/bump-version.mjs

@@ -1,28 +1,21 @@
 #!/usr/bin/env node
-// Bumps the Fimo CLI version + creates the matching scoped git tag.
+// Bumps the Fimo CLI version in apps/cli/package.json — NO git tag, NO commit.
 //
-// Tag scheme: scoped per-app, e.g. `cli@1.0.0`. This is the convention the
-// monorepo will use as it adopts semver releases for individual apps -
-// `fimovm@x.y.z` will follow the same shape once that package starts
-// shipping. Scoped tags avoid the ambiguity of a global `v1.0.0` in a repo
-// with multiple independently-versioned artifacts.
+// Under the branch-driven release model the version lives in
+// apps/cli/package.json and you bump it in a PR. CI creates the
+// `cli@<version>` git tag when it publishes `@latest` on a `production`
+// merge, so this script must NOT create a tag — that would collide with
+// CI's tag-guard (the publish would skip, thinking the version already
+// shipped).
 //
 // Usage:
 //   pnpm -F fimo release:bump patch
 //   pnpm -F fimo release:bump minor
 //   pnpm -F fimo release:bump major
-//   pnpm -F fimo release:bump prerelease --preid next
 //   pnpm -F fimo release:bump 1.2.3            # explicit version
 //
-// What it does:
-//   1. Validates the working tree is clean (no half-finished changes get
-//      caught in the release commit).
-//   2. Delegates to `pnpm version` for the semver bump + commit + tag -
-//      same battle-tested machinery as `npm version`, just plumbed with our
-//      `cli@` tag prefix and a conventional-commit message.
-//
-// Tags this produces are LOCAL only. Push them with `git push origin cli@x.y.z`
-// - that's the trigger for the CI release workflow (P0-7).
+// After bumping, commit the change in your PR. Merging it through to
+// `production` is what publishes `@latest` and creates the tag.
 
 import { spawnSync } from 'node:child_process';
 import { dirname, resolve } from 'node:path';
@@ -50,22 +43,10 @@ if (!VALID_INCREMENTS.has(increment) && !isExplicitVersion) {
   process.exit(1);
 }
 
-const status = spawnSync('git', ['status', '--porcelain'], { encoding: 'utf8' });
-if (status.status !== 0) {
-  console.error('[cli/bump] git status failed; are you in a git checkout?');
-  process.exit(status.status ?? 1);
-}
-if (status.stdout.trim() !== '') {
-  console.error('[cli/bump] working tree is not clean. Commit or stash before bumping.');
-  console.error(status.stdout);
-  process.exit(1);
-}
-
-console.log(`[cli/bump] increment: ${increment}`);
-console.log(`[cli/bump] cwd:       ${CLI_ROOT}`);
-
-const versionArgs = ['version', '--tag-version-prefix=cli@', '--message=chore(cli): release cli@%s', ...args];
-
+// Bump package.json ONLY — `--no-git-tag-version` skips both the commit and
+// the tag. CI owns the `cli@<version>` tag (created on the @latest publish).
+// Use pnpm (not npm) — npm chokes on the `workspace:*` devDeps.
+const versionArgs = ['version', '--no-git-tag-version', ...args];
 console.log(`[cli/bump] $ pnpm ${versionArgs.join(' ')}`);
 const result = spawnSync('pnpm', versionArgs, { cwd: CLI_ROOT, stdio: 'inherit' });
 if (result.status !== 0) {
@@ -73,5 +54,5 @@ if (result.status !== 0) {
   process.exit(result.status ?? 1);
 }
 
-console.log('[cli/bump] done. Push the tag with:');
-console.log('  git push origin develop && git push origin cli@<new-version>');
+console.log('[cli/bump] bumped apps/cli/package.json (no tag, no commit).');
+console.log('[cli/bump] commit it in your PR — merging to `production` publishes @latest + tags it.');

package/scripts/publish-npm.mjs

@@ -13,7 +13,7 @@
 //   3. Bakes a channel-appropriate release.json (lib/release-core.mjs) —
 //      staging URLs for experimental/staging, prod for latest. Never a tunnel.
 //   4. For prerelease channels, synthesizes a disposable X.Y.Z-<tag>.<n> version.
-//   5. Runs `npm publish --tag <distTag>` (with --provenance in CI).
+//   5. Runs `npm publish --tag <distTag>` (no --provenance — strapi/fimo is private).
 //   6. Restores package.json + removes the transient release.json.
 //
 // `npm publish` triggers prepublishOnly (clean → build → build:bundle), so the
@@ -106,11 +106,11 @@ try {
   // 3. Bake release.json (allowlist-enforced).
   writeReleaseJson(CLI_ROOT, channel);
 
-  // 4. Publish.
+  // 4. Publish. No --provenance: sigstore provenance requires a PUBLIC source
+  //    repo, and strapi/fimo is private (npm returns 422 otherwise). Trusted
+  //    Publishing (OIDC auth) works regardless of repo visibility — it's only
+  //    the attestation that's public-repo-only.
   const publishArgs = ['publish', '--access', 'public', '--tag', channel.distTag];
-  if (isCI) {
-    publishArgs.push('--provenance');
-  }
   if (dryRun) {
     publishArgs.push('--dry-run');
   }

package/templates/react-router/package.json

@@ -22,7 +22,7 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "0.2.1",
+    "fimo": "0.2.3-experimental.1782118113229",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",
@@ -53,11 +53,5 @@
     "tw-animate-css": "^1.4.0",
     "typescript": "5.9.3",
     "vite": "^8.0.13"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "fimo"
-    ]
   }
 }

package/templates/react-router/pnpm-workspace.yaml

@@ -1,3 +1,6 @@
-allowBuilds:
-  esbuild: true
-  fimo: true
+# Build approval is handled at install time by fimopm's
+# `--dangerously-allow-all-builds`. Do NOT add `allowBuilds` /
+# `onlyBuiltDependencies` here: pnpm refuses to have both an allowlist and
+# allow-all-builds (ERR_PNPM_CONFIG_CONFLICT_BUILT_DEPENDENCIES), which makes
+# `fimopm install` install nothing — the project's `fimo` dep goes missing and
+# the deploy build fails to resolve `fimo/vite`.