fimo 0.2.2 → 0.2.3-staging.5

package/dist/cli/bundle.json

@@ -1,8 +1,8 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-06-19T11:24:36.610Z",
-  "cliVersion": "0.2.2",
+  "bundledAt": "2026-06-19T14:20:28.710Z",
+  "cliVersion": "0.2.3-staging.5",
   "external": [
     "oxc-parser",
     "fsevents"

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "fimo",
-  "version": "0.2.2",
+  "version": "0.2.3-staging.5",
   "description": "Fimo CLI - create, deploy, and manage Fimo projects",
   "bin": {
-    "fimo": "./dist/cli/index.js"
+    "fimo": "dist/cli/index.js"
   },
   "files": [
     "dist/",

package/release.json

@@ -1,5 +1,5 @@
 {
   "source": "npm",
-  "apiUrl": "https://api.fimo.ai",
-  "webUrl": "https://fimo.ai"
+  "apiUrl": "https://api.staging.fimo.team",
+  "webUrl": "https://staging.fimo.team"
 }

package/scripts/bump-version.mjs

@@ -1,28 +1,21 @@
 #!/usr/bin/env node
-// Bumps the Fimo CLI version + creates the matching scoped git tag.
+// Bumps the Fimo CLI version in apps/cli/package.json — NO git tag, NO commit.
 //
-// Tag scheme: scoped per-app, e.g. `cli@1.0.0`. This is the convention the
-// monorepo will use as it adopts semver releases for individual apps -
-// `fimovm@x.y.z` will follow the same shape once that package starts
-// shipping. Scoped tags avoid the ambiguity of a global `v1.0.0` in a repo
-// with multiple independently-versioned artifacts.
+// Under the branch-driven release model the version lives in
+// apps/cli/package.json and you bump it in a PR. CI creates the
+// `cli@<version>` git tag when it publishes `@latest` on a `production`
+// merge, so this script must NOT create a tag — that would collide with
+// CI's tag-guard (the publish would skip, thinking the version already
+// shipped).
 //
 // Usage:
 //   pnpm -F fimo release:bump patch
 //   pnpm -F fimo release:bump minor
 //   pnpm -F fimo release:bump major
-//   pnpm -F fimo release:bump prerelease --preid next
 //   pnpm -F fimo release:bump 1.2.3            # explicit version
 //
-// What it does:
-//   1. Validates the working tree is clean (no half-finished changes get
-//      caught in the release commit).
-//   2. Delegates to `pnpm version` for the semver bump + commit + tag -
-//      same battle-tested machinery as `npm version`, just plumbed with our
-//      `cli@` tag prefix and a conventional-commit message.
-//
-// Tags this produces are LOCAL only. Push them with `git push origin cli@x.y.z`
-// - that's the trigger for the CI release workflow (P0-7).
+// After bumping, commit the change in your PR. Merging it through to
+// `production` is what publishes `@latest` and creates the tag.
 
 import { spawnSync } from 'node:child_process';
 import { dirname, resolve } from 'node:path';
@@ -50,22 +43,10 @@ if (!VALID_INCREMENTS.has(increment) && !isExplicitVersion) {
   process.exit(1);
 }
 
-const status = spawnSync('git', ['status', '--porcelain'], { encoding: 'utf8' });
-if (status.status !== 0) {
-  console.error('[cli/bump] git status failed; are you in a git checkout?');
-  process.exit(status.status ?? 1);
-}
-if (status.stdout.trim() !== '') {
-  console.error('[cli/bump] working tree is not clean. Commit or stash before bumping.');
-  console.error(status.stdout);
-  process.exit(1);
-}
-
-console.log(`[cli/bump] increment: ${increment}`);
-console.log(`[cli/bump] cwd:       ${CLI_ROOT}`);
-
-const versionArgs = ['version', '--tag-version-prefix=cli@', '--message=chore(cli): release cli@%s', ...args];
-
+// Bump package.json ONLY — `--no-git-tag-version` skips both the commit and
+// the tag. CI owns the `cli@<version>` tag (created on the @latest publish).
+// Use pnpm (not npm) — npm chokes on the `workspace:*` devDeps.
+const versionArgs = ['version', '--no-git-tag-version', ...args];
 console.log(`[cli/bump] $ pnpm ${versionArgs.join(' ')}`);
 const result = spawnSync('pnpm', versionArgs, { cwd: CLI_ROOT, stdio: 'inherit' });
 if (result.status !== 0) {
@@ -73,5 +54,5 @@ if (result.status !== 0) {
   process.exit(result.status ?? 1);
 }
 
-console.log('[cli/bump] done. Push the tag with:');
-console.log('  git push origin develop && git push origin cli@<new-version>');
+console.log('[cli/bump] bumped apps/cli/package.json (no tag, no commit).');
+console.log('[cli/bump] commit it in your PR — merging to `production` publishes @latest + tags it.');

package/scripts/publish-npm.mjs

@@ -13,7 +13,7 @@
 //   3. Bakes a channel-appropriate release.json (lib/release-core.mjs) —
 //      staging URLs for experimental/staging, prod for latest. Never a tunnel.
 //   4. For prerelease channels, synthesizes a disposable X.Y.Z-<tag>.<n> version.
-//   5. Runs `npm publish --tag <distTag>` (with --provenance in CI).
+//   5. Runs `npm publish --tag <distTag>` (no --provenance — strapi/fimo is private).
 //   6. Restores package.json + removes the transient release.json.
 //
 // `npm publish` triggers prepublishOnly (clean → build → build:bundle), so the
@@ -106,11 +106,11 @@ try {
   // 3. Bake release.json (allowlist-enforced).
   writeReleaseJson(CLI_ROOT, channel);
 
-  // 4. Publish.
+  // 4. Publish. No --provenance: sigstore provenance requires a PUBLIC source
+  //    repo, and strapi/fimo is private (npm returns 422 otherwise). Trusted
+  //    Publishing (OIDC auth) works regardless of repo visibility — it's only
+  //    the attestation that's public-repo-only.
   const publishArgs = ['publish', '--access', 'public', '--tag', channel.distTag];
-  if (isCI) {
-    publishArgs.push('--provenance');
-  }
   if (dryRun) {
     publishArgs.push('--dry-run');
   }

package/templates/react-router/package.json

@@ -22,7 +22,7 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "0.2.2",
+    "fimo": "0.2.3-staging.5",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",