fimo 0.2.3-staging.8 → 0.2.3-staging.9

package/scripts/publish-tarball.mjs

@@ -1,245 +0,0 @@
-#!/usr/bin/env node
-// Builds the Fimo CLI, packs it into a tarball, and uploads the tarball to
-// a Cloudflare R2 bucket via `wrangler r2 object put`. Meant for internal
-// distribution ahead of a real npm publish.
-//
-// Usage:
-//   pnpm -F cli publish:tarball
-//   pnpm -F cli publish:tarball -- --bucket fimo-cli-test --remote
-//   pnpm -F cli publish:tarball -- --staging
-//   pnpm -F cli publish:tarball -- --api-url https://api.staging.fimo.team --web-url https://staging.fimo.team
-//
-// Env vars:
-//   FIMO_CLI_R2_BUCKET  override the target R2 bucket (default: fimo-cli-test)
-//   FIMO_CLI_API_URL    bake default apiUrl into the tarball (same as --api-url)
-//   FIMO_CLI_WEB_URL    bake default webUrl into the tarball (same as --web-url)
-//   CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID - standard wrangler auth
-import { spawnSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { chmodSync, existsSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { registerReleaseCleanup } from './lib/cleanup-release.mjs';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const CLI_ROOT = resolve(HERE, '..');
-
-// Load apps/cli/.env if present, so CLOUDFLARE_* and FIMO_CLI_* vars don't have
-// to be exported in the shell. No-op when the file doesn't exist (CI, fresh
-// clones), so this stays safe for everyone.
-const ENV_FILE = resolve(CLI_ROOT, '.env');
-if (existsSync(ENV_FILE)) {
-  process.loadEnvFile(ENV_FILE);
-}
-
-const STAGING_API_URL = 'https://api.staging.fimo.team';
-const STAGING_WEB_URL = 'https://staging.fimo.team';
-
-function parseArgs(argv) {
-  const args = {
-    bucket: process.env.FIMO_CLI_R2_BUCKET || 'fimo-cli-test',
-    remote: true,
-    apiUrl: process.env.FIMO_CLI_API_URL?.trim() || null,
-    webUrl: process.env.FIMO_CLI_WEB_URL?.trim() || null,
-    keepReleaseJson: false,
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === '--bucket') {
-      args.bucket = argv[++i];
-    } else if (arg === '--local') {
-      args.remote = false;
-    } else if (arg === '--remote') {
-      args.remote = true;
-    } else if (arg === '--api-url') {
-      args.apiUrl = argv[++i];
-    } else if (arg === '--web-url') {
-      args.webUrl = argv[++i];
-    } else if (arg === '--staging') {
-      args.apiUrl = args.apiUrl || STAGING_API_URL;
-      args.webUrl = args.webUrl || STAGING_WEB_URL;
-    } else if (arg === '--id') {
-      args.id = argv[++i];
-    } else if (arg === '--keep-release-json') {
-      // Escape hatch for debugging the publish flow itself. Normally
-      // we want release.json gone from the workspace so local fimo
-      // invocations (and `fimovm link --path apps/cli`) fall back to
-      // localhost rather than the URL we just baked into the tarball.
-      args.keepReleaseJson = true;
-    }
-  }
-  return args;
-}
-
-function run(command, args, opts = {}) {
-  console.log(`[cli/publish] $ ${command} ${args.join(' ')}`);
-  const result = spawnSync(command, args, { stdio: 'inherit', ...opts });
-  if (result.status !== 0) {
-    console.error(`[cli/publish] command failed (exit ${result.status}): ${command} ${args.join(' ')}`);
-    process.exit(result.status ?? 1);
-  }
-  return result;
-}
-
-const { bucket, remote, apiUrl, webUrl, id: customId, keepReleaseJson } = parseArgs(process.argv.slice(2));
-
-const pkg = JSON.parse(readFileSync(resolve(CLI_ROOT, 'package.json'), 'utf8'));
-
-// Default: generate a random release id per publish so the URL changes each
-// time (sidesteps pnpm/CDN cache).
-//
-// `--id <name>` gives you a *channel* (e.g. `marc-dev`) but we ALWAYS append
-// a short random suffix to the actual upload id (`marc-dev-abc123`). Without
-// this, package managers (pnpm content store, npm tarball cache, Blaxel
-// sandbox cache) key by URL and never revalidate against the origin —
-// `Cache-Control: no-cache` only helps CF edge + HTTP intermediaries, not
-// the local package store. SHA-suffixed URLs sidestep every cache layer.
-//
-// The workspace release.json (written below) captures the SHA-suffixed id,
-// so `fimo create` pins new scaffolds to the fresh URL automatically.
-const channelSuffix = randomBytes(3).toString('hex');
-const releaseId = customId ? `${customId}-${channelSuffix}` : randomBytes(6).toString('hex');
-const releaseFile = resolve(CLI_ROOT, 'release.json');
-// `source` marks where the binary came from. R2/HTTP-hosted tarballs are
-// "url"; npm publishes will write "source: 'npm'" from their own flow
-// (P0-7 CI workflow). Dev / source runs have no `release.json` and resolve
-// to defaults at runtime.
-const releasePayload = { id: releaseId, source: 'url' };
-if (apiUrl) {
-  releasePayload.apiUrl = apiUrl;
-}
-if (webUrl) {
-  releasePayload.webUrl = webUrl;
-}
-writeFileSync(releaseFile, JSON.stringify(releasePayload, null, 2) + '\n');
-console.log(`[cli/publish] release id: ${releaseId}`);
-if (apiUrl) {
-  console.log(`[cli/publish] baked apiUrl: ${apiUrl}`);
-}
-if (webUrl) {
-  console.log(`[cli/publish] baked webUrl: ${webUrl}`);
-}
-
-// release.json is a publish artefact: written here, captured into the
-// tarball by `pnpm pack`, then removed from the workspace by default.
-// Without cleanup, the file lingers and every subsequent `fimo`
-// invocation from the workspace (including via `fimovm link
-// --path apps/cli`) reads the URL we just baked for someone else's
-// tarball.
-//
-// EXCEPTION: when `--id <name>` is set, we KEEP the file. Dev channels
-// want the workspace fimo to pin scaffolds to the freshly-published
-// SHA-suffixed URL — that's the whole point of the channel. Each
-// publish overwrites release.json with the new SHA-suffixed id, so
-// you don't have to manually edit it between iterations.
-//
-// `--keep-release-json` forces keep regardless (debugging escape hatch).
-// The cleanup runs on normal completion (explicit call at the bottom
-// of the script), on any `process.exit(...)` from a failing `run()`
-// step, and on SIGINT / SIGTERM. Behaviours covered by unit tests in
-// `lib/cleanup-release.test.ts`.
-const shouldKeep = keepReleaseJson || !!customId;
-const cleanupReleaseJson = registerReleaseCleanup(releaseFile, { skip: shouldKeep });
-
-const tarballName = `${pkg.name}-${pkg.version}.tgz`;
-const tarballPath = resolve(CLI_ROOT, tarballName);
-
-// 1. Clean previous outputs so `tsc -b` can't skip emit on stale tsbuildinfo
-//    when `dist/` has been removed out from under it.
-run('pnpm', ['clean'], { cwd: CLI_ROOT });
-
-// 2. Build (prebuild copies the template).
-run('pnpm', ['build'], { cwd: CLI_ROOT });
-
-// 3. Bundle the CLI bin into a single self-contained `dist/cli/index.js`. The
-//    subpath exports under `dist/runtime/` and `dist/build/` stay multi-file
-//    so user apps can keep importing `fimo/ui`, `fimo/vite`, etc.
-run('pnpm', ['build:bundle'], { cwd: CLI_ROOT });
-
-// 4. Sanity check: the bundled bin must exist before we pack and upload.
-const binPath = resolve(CLI_ROOT, 'dist/cli/index.js');
-if (!existsSync(binPath)) {
-  console.error(`[cli/publish] bundle did not produce ${binPath}; aborting`);
-  process.exit(1);
-}
-
-// Mark the bin entry executable BEFORE packing. `tsc` emits 644; npm preserves
-// file modes in the tarball, and pnpm doesn't always chmod bin entries to 755
-// when installing from a tarball URL (only registry installs and named npm
-// packages get this treatment reliably). Without this step, `fimo` fails with
-// `zsh: permission denied` after `npm i -g <tarball-url>`.
-chmodSync(binPath, 0o755);
-
-// 4. Pack into a tarball, forced to the CLI package root. Remove any
-//    previous `.tgz` first so `pnpm pack` never bails out on "file exists".
-rmSync(tarballPath, { force: true });
-run('pnpm', ['pack', '--pack-destination', CLI_ROOT], { cwd: CLI_ROOT });
-if (!existsSync(tarballPath)) {
-  console.error(`[cli/publish] expected tarball not found at ${tarballPath}`);
-  process.exit(1);
-}
-
-const releaseKey = `cli/${pkg.name}-${releaseId}.tgz`;
-const latestKey = `cli/${pkg.name}-latest.tgz`;
-
-console.log(`[cli/publish] tarball: ${tarballPath} (${(statSync(tarballPath).size / 1024).toFixed(1)} KB)`);
-console.log(`[cli/publish] uploading to r2://${bucket}/${releaseKey}`);
-
-// 5. Upload via wrangler. Always upload the release-keyed object. Skip the
-//    `latest` alias when a custom `--id` is in play - dev channels shouldn't
-//    overwrite the public install URL that real users pull from.
-//
-//    Both the release-keyed URL and the `latest` alias are tagged with
-//    `no-cache` so republishing propagates immediately. For random-hex
-//    release ids (no `--id`), nothing else ever lives at that key, so the
-//    only practical effect is freshness on the first install. For stable
-//    `--id <name>` dev channels (e.g. `marc-dev`), no-cache is essential:
-//    the URL is reused across publishes, and without it Cloudflare's edge
-//    cache + pnpm's URL-keyed store will hand out stale tarballs after
-//    a republish (Node sees fimo's `virtual:` imports because the old
-//    code didn't bundle them into SSR, etc).
-const wranglerArgs = ['exec', 'wrangler', 'r2', 'object', 'put'];
-if (remote) {
-  wranglerArgs.push('--remote');
-}
-run(
-  'pnpm',
-  [...wranglerArgs, `${bucket}/${releaseKey}`, '--file', tarballPath, '--cache-control', 'no-cache, max-age=0'],
-  { cwd: CLI_ROOT }
-);
-if (!customId) {
-  run(
-    'pnpm',
-    [...wranglerArgs, `${bucket}/${latestKey}`, '--file', tarballPath, '--cache-control', 'no-cache, max-age=0'],
-    { cwd: CLI_ROOT }
-  );
-}
-
-const PUBLIC_BASE_URL = 'https://pub-41cdea46386f4b238d8c528c4327dfc1.r2.dev';
-
-console.log('[cli/publish] done.');
-console.log(`  release:   ${PUBLIC_BASE_URL}/${releaseKey}`);
-if (!customId) {
-  console.log(`  latest:    ${PUBLIC_BASE_URL}/${latestKey}`);
-} else {
-  console.log(`  latest:    (skipped - custom --id ${customId} set, leaving fimo-latest.tgz untouched)`);
-}
-console.log('');
-console.log('Install on a test machine:');
-console.log(`  npm install -g ${PUBLIC_BASE_URL}/${latestKey}`);
-
-// Explicit cleanup at the end of the happy path. The process.on('exit')
-// handler also covers this, but an explicit call lets us print a
-// confirmation line so users can see release.json went away.
-cleanupReleaseJson();
-console.log('');
-if (shouldKeep) {
-  console.log(
-    `[cli/publish] kept workspace release.json (id: ${releaseId}) - new \`fimo create\` scaffolds will pin to this URL.`
-  );
-} else {
-  console.log(
-    `[cli/publish] cleaned up workspace release.json - local \`fimo\` invocations will resolve to localhost:3000 again.`
-  );
-}