fimo 0.2.3-staging.10 → 0.2.3-staging.7

package/dist/runtime/templates.d.ts

@@ -30,7 +30,8 @@ export declare function getTemplatePath(framework?: TemplateFramework): string;
  */
 export declare function getLegacyTemplateDir(): string;
 export interface ReleaseMeta {
-    source: 'npm' | 'dev' | null;
+    id: string | null;
+    source: 'npm' | 'url' | 'dev' | null;
 }
 export declare function readReleaseMeta(): ReleaseMeta;
 export declare function readCliSemver(): string | null;
@@ -50,10 +51,9 @@ interface PkgWithDeps {
     devDependencies?: Record<string, string>;
 }
 /**
- * Rewrite `fimo` (in dependencies + devDependencies) to the current pin. Only
- * touches entries that look like a value we own: the template's dist-tag, an old
- * tarball URL, an exact/ranged semver, or a local `file:` dependency. Bespoke
- * values are left alone.
+ * Rewrite `fimo` (in dependencies + devDependencies) to the current pin.
+ * Only touches entries that look like a fimo tarball URL or a semver range —
+ * never clobbers a bespoke value the user might have set.
  *
  * Returns true if anything changed.
  */

package/dist/runtime/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/runtime/templates.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,mBAAmB,oDAAqD,CAAC;AACtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,eAAO,MAAM,gBAAgB,EAAE,iBAAkC,CAAC;AAElE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,GAAE,iBAAoC,GAAG,MAAM,CAEvF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAqBD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,eAAe,IAAI,WAAW,CAS7C;AAED,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAW7C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC/C,MAAM,GAAG,IAAI,CAUf;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CAE9F;AAED,UAAU,WAAW;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,GAAG,IAAuB,GAAG,OAAO,CA2B/F"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/runtime/templates.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,mBAAmB,oDAAqD,CAAC;AACtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,eAAO,MAAM,gBAAgB,EAAE,iBAAkC,CAAC;AAElE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,GAAE,iBAAoC,GAAG,MAAM,CAEvF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAsBD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;CACtC;AAED,wBAAgB,eAAe,IAAI,WAAW,CAU7C;AAED,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAW7C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC/C,MAAM,GAAG,IAAI,CAaf;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CAE9F;AAED,UAAU,WAAW;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,GAAG,IAAuB,GAAG,OAAO,CAsB/F"}

package/dist/runtime/templates.js

@@ -27,6 +27,7 @@ const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_ROOT = path.resolve(MODULE_DIR, '..', '..');
 const RELEASE_FILE = path.join(PACKAGE_ROOT, 'release.json');
 const PACKAGE_JSON_FILE = path.join(PACKAGE_ROOT, 'package.json');
+const TARBALL_URL_BASE = 'https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev/cli';
 export const TEMPLATE_FRAMEWORKS = ['react-router', 'astro', 'next', 'vite'];
 export const DEFAULT_TEMPLATE = 'react-router';
 /**
@@ -69,11 +70,12 @@ export function readReleaseMeta() {
     try {
         const raw = fs.readFileSync(RELEASE_FILE, 'utf8');
         const parsed = JSON.parse(raw);
-        const source = parsed.source === 'npm' || parsed.source === 'dev' ? parsed.source : null;
-        return { source };
+        const id = typeof parsed.id === 'string' && parsed.id.length > 0 ? parsed.id : null;
+        const source = parsed.source === 'npm' || parsed.source === 'url' || parsed.source === 'dev' ? parsed.source : null;
+        return { id, source };
     }
     catch {
-        return { source: null };
+        return { id: null, source: null };
     }
 }
 export function readCliSemver() {
@@ -99,6 +101,9 @@ export function computeFimoPin(meta, semver, options = {}) {
             return semver;
         }
     }
+    if (meta.id) {
+        return `${TARBALL_URL_BASE}/fimo-${meta.id}.tgz`;
+    }
     if ((meta.source === 'dev' || meta.source === null) && options.devPackageRoot) {
         return `file:${options.devPackageRoot}`;
     }
@@ -109,10 +114,9 @@ export function resolveFimoPin(options = {}) {
     return computeFimoPin(readReleaseMeta(), readCliSemver(), options);
 }
 /**
- * Rewrite `fimo` (in dependencies + devDependencies) to the current pin. Only
- * touches entries that look like a value we own: the template's dist-tag, an old
- * tarball URL, an exact/ranged semver, or a local `file:` dependency. Bespoke
- * values are left alone.
+ * Rewrite `fimo` (in dependencies + devDependencies) to the current pin.
+ * Only touches entries that look like a fimo tarball URL or a semver range —
+ * never clobbers a bespoke value the user might have set.
  *
  * Returns true if anything changed.
  */
@@ -130,14 +134,9 @@ export function rewriteFimoDep(pkg, pin = resolveFimoPin()) {
         if (typeof current !== 'string') {
             continue;
         }
-        // Migrate projects still pinned to the retired R2 tarball, repin a semver,
-        // rewrite the committed template's dist-tag, or (dev flow) swap a local
-        // `file:` build for a published version on deploy.
-        const looksLikeLegacyR2 = current.includes('r2.dev/cli/fimo-');
-        const looksLikeLocalFile = current.startsWith('file:');
+        const looksLikeFimoTarball = current.includes(`${TARBALL_URL_BASE}/fimo-`);
         const looksLikeSemver = /^[\^~]?\d+\.\d+\.\d+/.test(current);
-        const looksLikeOwnedDistTag = current === 'latest' || current === 'staging' || current === 'experimental';
-        if ((looksLikeLegacyR2 || looksLikeLocalFile || looksLikeSemver || looksLikeOwnedDistTag) && current !== pin) {
+        if ((looksLikeFimoTarball || looksLikeSemver) && current !== pin) {
             deps['fimo'] = pin;
             changed = true;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fimo",
-  "version": "0.2.3-staging.10",
+  "version": "0.2.3-staging.7",
   "description": "Fimo CLI - create, deploy, and manage Fimo projects",
   "bin": {
     "fimo": "dist/cli/index.js"
@@ -45,6 +45,7 @@
     "check:types": "tsc -b tsconfig.json",
     "start": "tsx src/cli/index.ts",
     "install-cli": "pnpm build && node scripts/install-cli.mjs",
+    "publish-cli": "node scripts/publish-tarball.mjs",
     "publish:npm": "node scripts/publish-npm.mjs",
     "prepublishOnly": "pnpm run build && pnpm run build:bundle",
     "release:bump": "node scripts/bump-version.mjs",

package/scripts/lib/cleanup-release.mjs

@@ -0,0 +1,64 @@
+import { rmSync } from 'node:fs';
+
+// Helpers around the workspace-`release.json` cleanup behaviour used by
+// `publish-tarball.mjs`. Extracted so the cleanup logic can be unit
+// tested without spinning up the full clean → build → bundle → pack →
+// upload chain.
+//
+// The contract is small but worth pinning:
+//   1. `cleanupReleaseFile` is idempotent and safe when the file is
+//      already absent.
+//   2. `registerReleaseCleanup` wires cleanup to process.on('exit'),
+//      SIGINT, and SIGTERM so the file is removed on any termination
+//      path (including process.exit calls inside the publish script).
+//   3. The `skip` option short-circuits both surfaces - `cleanupReleaseFile`
+//      checks it, and `registerReleaseCleanup` closes over it.
+
+export function cleanupReleaseFile(releaseFile, options = {}) {
+  if (options.skip) {
+    return false;
+  }
+  try {
+    rmSync(releaseFile, { force: true });
+    return true;
+  } catch {
+    // Best effort. A stale release.json is annoying but not
+    // worth bailing the publish for.
+    return false;
+  }
+}
+
+// Registers cleanup against the Node lifecycle and returns a callable
+// that does the cleanup once-only. Useful in two ways:
+//   a) The bottom of the publish script calls the returned function
+//      explicitly so the success path can log a confirmation line.
+//   b) Failure paths (process.exit / SIGINT / SIGTERM) hit the
+//      registered handlers and still run the cleanup.
+//
+// Idempotency is enforced via a closure flag - calling the returned
+// function twice (e.g., once explicitly + once on exit) only removes
+// the file the first time.
+export function registerReleaseCleanup(releaseFile, options = {}) {
+  let alreadyCleaned = false;
+  const skip = options.skip === true;
+
+  const cleanupOnce = () => {
+    if (alreadyCleaned || skip) {
+      return false;
+    }
+    alreadyCleaned = true;
+    return cleanupReleaseFile(releaseFile);
+  };
+
+  process.on('exit', cleanupOnce);
+  process.on('SIGINT', () => {
+    cleanupOnce();
+    process.exit(130);
+  });
+  process.on('SIGTERM', () => {
+    cleanupOnce();
+    process.exit(143);
+  });
+
+  return cleanupOnce;
+}

package/scripts/lib/cleanup-release.test.ts

@@ -0,0 +1,142 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { cleanupReleaseFile, registerReleaseCleanup } from './cleanup-release.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const CLEANUP_MJS = path.resolve(__dirname, 'cleanup-release.mjs');
+
+let dir: string;
+let releaseFile: string;
+
+beforeEach(() => {
+  dir = mkdtempSync(path.join(tmpdir(), 'fimo-cli-cleanup-'));
+  releaseFile = path.join(dir, 'release.json');
+  writeFileSync(releaseFile, JSON.stringify({ id: 'fixture', source: 'url', apiUrl: 'https://api.staging.fimo.team' }));
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('cleanupReleaseFile', () => {
+  it('removes the file', () => {
+    expect(existsSync(releaseFile)).toBe(true);
+    expect(cleanupReleaseFile(releaseFile)).toBe(true);
+    expect(existsSync(releaseFile)).toBe(false);
+  });
+
+  it('respects the skip option (file survives)', () => {
+    cleanupReleaseFile(releaseFile, { skip: true });
+    expect(existsSync(releaseFile)).toBe(true);
+  });
+
+  it('is a no-op when the file is absent (no throw)', () => {
+    rmSync(releaseFile);
+    expect(() => cleanupReleaseFile(releaseFile)).not.toThrow();
+  });
+
+  it('is idempotent (re-running on an already-removed file is fine)', () => {
+    cleanupReleaseFile(releaseFile);
+    expect(() => cleanupReleaseFile(releaseFile)).not.toThrow();
+    expect(existsSync(releaseFile)).toBe(false);
+  });
+
+  it('returns false when skipped', () => {
+    expect(cleanupReleaseFile(releaseFile, { skip: true })).toBe(false);
+    expect(existsSync(releaseFile)).toBe(true);
+  });
+});
+
+describe('registerReleaseCleanup - direct (synchronous) call', () => {
+  // These tests exercise the returned closure directly. The
+  // process.on('exit') wiring is verified by the spawn-based test
+  // below (running the registration in a child whose lifetime we
+  // can observe).
+  //
+  // We do NOT call process.on('exit') in the test process itself,
+  // since that would pollute the vitest runner and other test files.
+  // Instead, the closure returned by registerReleaseCleanup is
+  // invoked manually as it would be from `cleanupReleaseJson()` at
+  // the bottom of publish-tarball.mjs.
+
+  it('first explicit call cleans; subsequent calls are no-ops', () => {
+    const cleanup = registerReleaseCleanup(releaseFile);
+    expect(existsSync(releaseFile)).toBe(true);
+    cleanup();
+    expect(existsSync(releaseFile)).toBe(false);
+    // Re-instate the file and verify the closure doesn't clean again.
+    writeFileSync(releaseFile, 'second');
+    cleanup();
+    expect(readFileSync(releaseFile, 'utf8')).toBe('second');
+  });
+
+  it('skip:true short-circuits the closure', () => {
+    const cleanup = registerReleaseCleanup(releaseFile, { skip: true });
+    cleanup();
+    expect(existsSync(releaseFile)).toBe(true);
+  });
+});
+
+describe('registerReleaseCleanup - process lifecycle (subprocess)', () => {
+  // The process.on('exit') wiring only fires when the host process
+  // actually exits. To verify it without exiting the test runner,
+  // we spawn a small child that registers cleanup and then returns
+  // - observing the file state from the parent after the child
+  // terminates.
+
+  function runChild(opts: { skip?: boolean; signal?: 'SIGINT' | 'SIGTERM' | null } = {}) {
+    const childScript = path.join(dir, 'child.mjs');
+    const skipFlag = opts.skip ? 'true' : 'false';
+    if (opts.signal) {
+      // Long-running child that we send a signal to. Loops to keep
+      // the process alive until the signal arrives.
+      writeFileSync(
+        childScript,
+        `import { registerReleaseCleanup } from '${CLEANUP_MJS}';
+         registerReleaseCleanup(${JSON.stringify(releaseFile)}, { skip: ${skipFlag} });
+         setInterval(() => {}, 1000);
+        `
+      );
+      const child = spawnSync(process.execPath, [childScript], {
+        timeout: 4000,
+        killSignal: opts.signal,
+      });
+      // spawnSync's timeout sends killSignal; we still get .status / .signal.
+      return child;
+    }
+    writeFileSync(
+      childScript,
+      `import { registerReleaseCleanup } from '${CLEANUP_MJS}';
+       registerReleaseCleanup(${JSON.stringify(releaseFile)}, { skip: ${skipFlag} });
+       // Exit naturally after registering - process.on('exit') should fire.
+      `
+    );
+    return execFileSync(process.execPath, [childScript], { encoding: 'utf8' });
+  }
+
+  it('removes the file when the child exits naturally', () => {
+    runChild();
+    expect(existsSync(releaseFile)).toBe(false);
+  });
+
+  it('preserves the file when the child registered with skip:true', () => {
+    runChild({ skip: true });
+    expect(existsSync(releaseFile)).toBe(true);
+  });
+
+  it('removes the file when the child is killed with SIGTERM', () => {
+    runChild({ signal: 'SIGTERM' });
+    expect(existsSync(releaseFile)).toBe(false);
+  });
+
+  it('removes the file when the child is killed with SIGINT', () => {
+    runChild({ signal: 'SIGINT' });
+    expect(existsSync(releaseFile)).toBe(false);
+  });
+});

package/scripts/postinstall.mjs

@@ -17,12 +17,10 @@
 //       never break the user's install).
 //
 // pnpm caveat: by default, pnpm strips build scripts from non-approved deps.
-// Fimo-controlled installs (`fimo create --install`, sandbox `fimopm install`,
-// and E2E helper installs) pass a scoped allow-all-builds flag for pnpm so the
-// fimo postinstall hook can refresh project skills. The template intentionally
-// does not persist allowlists in package.json / pnpm-workspace.yaml because
-// those conflict with sandbox install flags and drift when deps change. npm /
-// yarn run lifecycle scripts by default and need no extra config.
+// Templates scaffolded by `fimo create` approve `fimo` and `esbuild` builds in
+// pnpm-workspace.yaml (`allowBuilds`, pnpm 11+) and package.json
+// (`onlyBuiltDependencies`, pnpm 10-era installs). npm / yarn run scripts by
+// default and need no extra config.
 
 import fs from 'node:fs';
 import path from 'node:path';

package/scripts/publish-npm.mjs

@@ -14,9 +14,7 @@
 //      staging URLs for experimental/staging, prod for latest. Never a tunnel.
 //   4. For prerelease channels, synthesizes a disposable X.Y.Z-<tag>.<n> version.
 //   5. Runs `npm publish --tag <distTag>` (no --provenance — strapi/fimo is private).
-//   6. On real experimental publishes, records the exact version in repo-root
-//      .fimo/dev.json for local source-checkout deploys.
-//   7. Restores package.json + removes the transient release.json.
+//   6. Restores package.json + removes the transient release.json.
 //
 // `npm publish` triggers prepublishOnly (clean → build → build:bundle), so the
 // bundled tarball is always fresh.
@@ -27,7 +25,6 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { resolveChannel } from './lib/channels.mjs';
-import { writeDevReleaseState } from './lib/dev-release-state.mjs';
 import {
   computePublishVersion,
   pinTemplateFimo,
@@ -123,14 +120,6 @@ try {
     console.error(`[publish-npm] npm publish failed (exit ${result.status}).`);
     process.exit(result.status ?? 1);
   }
-
-  if (!dryRun && channel.distTag === 'experimental') {
-    const devStatePath = writeDevReleaseState(CLI_ROOT, {
-      version: publishVersion,
-      channel: channel.distTag,
-    });
-    console.log(`[publish-npm] wrote ${devStatePath}`);
-  }
 } finally {
   // Restore the workspace: package.json version, template fimo pin, and remove
   // the transient release.json so local `fimo` runs fall back to localhost.

package/scripts/publish-tarball.mjs

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+// Builds the Fimo CLI, packs it into a tarball, and uploads the tarball to
+// a Cloudflare R2 bucket via `wrangler r2 object put`. Meant for internal
+// distribution ahead of a real npm publish.
+//
+// Usage:
+//   pnpm -F cli publish:tarball
+//   pnpm -F cli publish:tarball -- --bucket fimo-cli-test --remote
+//   pnpm -F cli publish:tarball -- --staging
+//   pnpm -F cli publish:tarball -- --api-url https://api.staging.fimo.team --web-url https://staging.fimo.team
+//
+// Env vars:
+//   FIMO_CLI_R2_BUCKET  override the target R2 bucket (default: fimo-cli-test)
+//   FIMO_CLI_API_URL    bake default apiUrl into the tarball (same as --api-url)
+//   FIMO_CLI_WEB_URL    bake default webUrl into the tarball (same as --web-url)
+//   CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID - standard wrangler auth
+import { spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { registerReleaseCleanup } from './lib/cleanup-release.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const CLI_ROOT = resolve(HERE, '..');
+
+// Load apps/cli/.env if present, so CLOUDFLARE_* and FIMO_CLI_* vars don't have
+// to be exported in the shell. No-op when the file doesn't exist (CI, fresh
+// clones), so this stays safe for everyone.
+const ENV_FILE = resolve(CLI_ROOT, '.env');
+if (existsSync(ENV_FILE)) {
+  process.loadEnvFile(ENV_FILE);
+}
+
+const STAGING_API_URL = 'https://api.staging.fimo.team';
+const STAGING_WEB_URL = 'https://staging.fimo.team';
+
+function parseArgs(argv) {
+  const args = {
+    bucket: process.env.FIMO_CLI_R2_BUCKET || 'fimo-cli-test',
+    remote: true,
+    apiUrl: process.env.FIMO_CLI_API_URL?.trim() || null,
+    webUrl: process.env.FIMO_CLI_WEB_URL?.trim() || null,
+    keepReleaseJson: false,
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--bucket') {
+      args.bucket = argv[++i];
+    } else if (arg === '--local') {
+      args.remote = false;
+    } else if (arg === '--remote') {
+      args.remote = true;
+    } else if (arg === '--api-url') {
+      args.apiUrl = argv[++i];
+    } else if (arg === '--web-url') {
+      args.webUrl = argv[++i];
+    } else if (arg === '--staging') {
+      args.apiUrl = args.apiUrl || STAGING_API_URL;
+      args.webUrl = args.webUrl || STAGING_WEB_URL;
+    } else if (arg === '--id') {
+      args.id = argv[++i];
+    } else if (arg === '--keep-release-json') {
+      // Escape hatch for debugging the publish flow itself. Normally
+      // we want release.json gone from the workspace so local fimo
+      // invocations (and `fimovm link --path apps/cli`) fall back to
+      // localhost rather than the URL we just baked into the tarball.
+      args.keepReleaseJson = true;
+    }
+  }
+  return args;
+}
+
+function run(command, args, opts = {}) {
+  console.log(`[cli/publish] $ ${command} ${args.join(' ')}`);
+  const result = spawnSync(command, args, { stdio: 'inherit', ...opts });
+  if (result.status !== 0) {
+    console.error(`[cli/publish] command failed (exit ${result.status}): ${command} ${args.join(' ')}`);
+    process.exit(result.status ?? 1);
+  }
+  return result;
+}
+
+const { bucket, remote, apiUrl, webUrl, id: customId, keepReleaseJson } = parseArgs(process.argv.slice(2));
+
+const pkg = JSON.parse(readFileSync(resolve(CLI_ROOT, 'package.json'), 'utf8'));
+
+// Default: generate a random release id per publish so the URL changes each
+// time (sidesteps pnpm/CDN cache).
+//
+// `--id <name>` gives you a *channel* (e.g. `marc-dev`) but we ALWAYS append
+// a short random suffix to the actual upload id (`marc-dev-abc123`). Without
+// this, package managers (pnpm content store, npm tarball cache, Blaxel
+// sandbox cache) key by URL and never revalidate against the origin —
+// `Cache-Control: no-cache` only helps CF edge + HTTP intermediaries, not
+// the local package store. SHA-suffixed URLs sidestep every cache layer.
+//
+// The workspace release.json (written below) captures the SHA-suffixed id,
+// so `fimo create` pins new scaffolds to the fresh URL automatically.
+const channelSuffix = randomBytes(3).toString('hex');
+const releaseId = customId ? `${customId}-${channelSuffix}` : randomBytes(6).toString('hex');
+const releaseFile = resolve(CLI_ROOT, 'release.json');
+// `source` marks where the binary came from. R2/HTTP-hosted tarballs are
+// "url"; npm publishes will write "source: 'npm'" from their own flow
+// (P0-7 CI workflow). Dev / source runs have no `release.json` and resolve
+// to defaults at runtime.
+const releasePayload = { id: releaseId, source: 'url' };
+if (apiUrl) {
+  releasePayload.apiUrl = apiUrl;
+}
+if (webUrl) {
+  releasePayload.webUrl = webUrl;
+}
+writeFileSync(releaseFile, JSON.stringify(releasePayload, null, 2) + '\n');
+console.log(`[cli/publish] release id: ${releaseId}`);
+if (apiUrl) {
+  console.log(`[cli/publish] baked apiUrl: ${apiUrl}`);
+}
+if (webUrl) {
+  console.log(`[cli/publish] baked webUrl: ${webUrl}`);
+}
+
+// release.json is a publish artefact: written here, captured into the
+// tarball by `pnpm pack`, then removed from the workspace by default.
+// Without cleanup, the file lingers and every subsequent `fimo`
+// invocation from the workspace (including via `fimovm link
+// --path apps/cli`) reads the URL we just baked for someone else's
+// tarball.
+//
+// EXCEPTION: when `--id <name>` is set, we KEEP the file. Dev channels
+// want the workspace fimo to pin scaffolds to the freshly-published
+// SHA-suffixed URL — that's the whole point of the channel. Each
+// publish overwrites release.json with the new SHA-suffixed id, so
+// you don't have to manually edit it between iterations.
+//
+// `--keep-release-json` forces keep regardless (debugging escape hatch).
+// The cleanup runs on normal completion (explicit call at the bottom
+// of the script), on any `process.exit(...)` from a failing `run()`
+// step, and on SIGINT / SIGTERM. Behaviours covered by unit tests in
+// `lib/cleanup-release.test.ts`.
+const shouldKeep = keepReleaseJson || !!customId;
+const cleanupReleaseJson = registerReleaseCleanup(releaseFile, { skip: shouldKeep });
+
+const tarballName = `${pkg.name}-${pkg.version}.tgz`;
+const tarballPath = resolve(CLI_ROOT, tarballName);
+
+// 1. Clean previous outputs so `tsc -b` can't skip emit on stale tsbuildinfo
+//    when `dist/` has been removed out from under it.
+run('pnpm', ['clean'], { cwd: CLI_ROOT });
+
+// 2. Build (prebuild copies the template).
+run('pnpm', ['build'], { cwd: CLI_ROOT });
+
+// 3. Bundle the CLI bin into a single self-contained `dist/cli/index.js`. The
+//    subpath exports under `dist/runtime/` and `dist/build/` stay multi-file
+//    so user apps can keep importing `fimo/ui`, `fimo/vite`, etc.
+run('pnpm', ['build:bundle'], { cwd: CLI_ROOT });
+
+// 4. Sanity check: the bundled bin must exist before we pack and upload.
+const binPath = resolve(CLI_ROOT, 'dist/cli/index.js');
+if (!existsSync(binPath)) {
+  console.error(`[cli/publish] bundle did not produce ${binPath}; aborting`);
+  process.exit(1);
+}
+
+// Mark the bin entry executable BEFORE packing. `tsc` emits 644; npm preserves
+// file modes in the tarball, and pnpm doesn't always chmod bin entries to 755
+// when installing from a tarball URL (only registry installs and named npm
+// packages get this treatment reliably). Without this step, `fimo` fails with
+// `zsh: permission denied` after `npm i -g <tarball-url>`.
+chmodSync(binPath, 0o755);
+
+// 4. Pack into a tarball, forced to the CLI package root. Remove any
+//    previous `.tgz` first so `pnpm pack` never bails out on "file exists".
+rmSync(tarballPath, { force: true });
+run('pnpm', ['pack', '--pack-destination', CLI_ROOT], { cwd: CLI_ROOT });
+if (!existsSync(tarballPath)) {
+  console.error(`[cli/publish] expected tarball not found at ${tarballPath}`);
+  process.exit(1);
+}
+
+const releaseKey = `cli/${pkg.name}-${releaseId}.tgz`;
+const latestKey = `cli/${pkg.name}-latest.tgz`;
+
+console.log(`[cli/publish] tarball: ${tarballPath} (${(statSync(tarballPath).size / 1024).toFixed(1)} KB)`);
+console.log(`[cli/publish] uploading to r2://${bucket}/${releaseKey}`);
+
+// 5. Upload via wrangler. Always upload the release-keyed object. Skip the
+//    `latest` alias when a custom `--id` is in play - dev channels shouldn't
+//    overwrite the public install URL that real users pull from.
+//
+//    Both the release-keyed URL and the `latest` alias are tagged with
+//    `no-cache` so republishing propagates immediately. For random-hex
+//    release ids (no `--id`), nothing else ever lives at that key, so the
+//    only practical effect is freshness on the first install. For stable
+//    `--id <name>` dev channels (e.g. `marc-dev`), no-cache is essential:
+//    the URL is reused across publishes, and without it Cloudflare's edge
+//    cache + pnpm's URL-keyed store will hand out stale tarballs after
+//    a republish (Node sees fimo's `virtual:` imports because the old
+//    code didn't bundle them into SSR, etc).
+const wranglerArgs = ['exec', 'wrangler', 'r2', 'object', 'put'];
+if (remote) {
+  wranglerArgs.push('--remote');
+}
+run(
+  'pnpm',
+  [...wranglerArgs, `${bucket}/${releaseKey}`, '--file', tarballPath, '--cache-control', 'no-cache, max-age=0'],
+  { cwd: CLI_ROOT }
+);
+if (!customId) {
+  run(
+    'pnpm',
+    [...wranglerArgs, `${bucket}/${latestKey}`, '--file', tarballPath, '--cache-control', 'no-cache, max-age=0'],
+    { cwd: CLI_ROOT }
+  );
+}
+
+const PUBLIC_BASE_URL = 'https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev';
+
+console.log('[cli/publish] done.');
+console.log(`  release:   ${PUBLIC_BASE_URL}/${releaseKey}`);
+if (!customId) {
+  console.log(`  latest:    ${PUBLIC_BASE_URL}/${latestKey}`);
+} else {
+  console.log(`  latest:    (skipped - custom --id ${customId} set, leaving fimo-latest.tgz untouched)`);
+}
+console.log('');
+console.log('Install on a test machine:');
+console.log(`  npm install -g ${PUBLIC_BASE_URL}/${latestKey}`);
+
+// Explicit cleanup at the end of the happy path. The process.on('exit')
+// handler also covers this, but an explicit call lets us print a
+// confirmation line so users can see release.json went away.
+cleanupReleaseJson();
+console.log('');
+if (shouldKeep) {
+  console.log(
+    `[cli/publish] kept workspace release.json (id: ${releaseId}) - new \`fimo create\` scaffolds will pin to this URL.`
+  );
+} else {
+  console.log(
+    `[cli/publish] cleaned up workspace release.json - local \`fimo\` invocations will resolve to localhost:3000 again.`
+  );
+}

package/templates/react-router/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "react-router dev --port 5173",
+    "prebuild": "fimo validate",
     "build": "react-router build && fimo export-static",
     "lint": "oxlint --deny-warnings",
     "typecheck": "tsc --noEmit",
@@ -21,7 +22,7 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "0.2.3-staging.10",
+    "fimo": "0.2.3-staging.7",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",
@@ -52,5 +53,11 @@
     "tw-animate-css": "^1.4.0",
     "typescript": "5.9.3",
     "vite": "^8.0.13"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild",
+      "fimo"
+    ]
   }
 }

package/templates/react-router/pnpm-workspace.yaml

@@ -1,6 +1,3 @@
-# Build approval is handled by Fimo-controlled install commands (`fimo create
-# --install`, sandbox `fimopm install`, and E2E helpers) via scoped pnpm
-# allow-all-builds flags. Do NOT add `allowBuilds` / `onlyBuiltDependencies`
-# here: pnpm refuses to have both an allowlist and allow-all-builds
-# (ERR_PNPM_CONFIG_CONFLICT_BUILT_DEPENDENCIES), which makes sandbox installs
-# fail before the project's `fimo` dep is available.
+allowBuilds:
+  esbuild: true
+  fimo: true