fimo 0.3.3-experimental.1783347971089 → 0.3.3-staging.23

package/dist/cli/bundle.json

@@ -1,8 +1,8 @@
 {
   "bundled": true,
   "bundler": "esbuild",
-  "bundledAt": "2026-07-06T14:26:15.938Z",
-  "cliVersion": "0.3.3-experimental.1783347971089",
+  "bundledAt": "2026-07-06T17:55:19.533Z",
+  "cliVersion": "0.3.3",
   "external": [
     "oxc-parser",
     "fsevents"

package/dist/cli/index.js

@@ -42329,6 +42329,70 @@ var init_project_env_dto = __esm({
   }
 });
 
+// ../../packages/api-contracts/dist/esm/dtos/project-import-export.dto.js
+var ExportProjectResponseDTOSchema, ExportProjectResponseDTO, ImportProjectResultDTOSchema, ImportProjectResultDTO, ImportPreviewCountsDTOSchema, ImportPreviewSurfaceDTOSchema, ImportPreviewDTOSchema, ImportPreviewDTO, ImportPreviewResponseDTOSchema, ImportPreviewResponseDTO;
+var init_project_import_export_dto = __esm({
+  "../../packages/api-contracts/dist/esm/dtos/project-import-export.dto.js"() {
+    "use strict";
+    init_zod();
+    init_create_dto();
+    ExportProjectResponseDTOSchema = external_exports.object({
+      success: external_exports.literal(true),
+      downloadUrl: external_exports.string(),
+      expiresAt: external_exports.string(),
+      fileSize: external_exports.number(),
+      duration: external_exports.number()
+    });
+    ExportProjectResponseDTO = createDTO(ExportProjectResponseDTOSchema);
+    ImportProjectResultDTOSchema = external_exports.object({
+      success: external_exports.literal(true),
+      projectId: external_exports.string(),
+      projectName: external_exports.string(),
+      displayName: external_exports.string(),
+      projectUrl: external_exports.string(),
+      duration: external_exports.number()
+    });
+    ImportProjectResultDTO = createDTO(ImportProjectResultDTOSchema);
+    ImportPreviewCountsDTOSchema = external_exports.object({
+      contentTypes: external_exports.number(),
+      entries: external_exports.number(),
+      assets: external_exports.number(),
+      translations: external_exports.number(),
+      forms: external_exports.number(),
+      codeFiles: external_exports.number(),
+      assetFiles: external_exports.number()
+    });
+    ImportPreviewSurfaceDTOSchema = external_exports.object({
+      name: external_exports.string(),
+      included: external_exports.boolean(),
+      count: external_exports.number().optional(),
+      note: external_exports.string().optional()
+    });
+    ImportPreviewDTOSchema = external_exports.object({
+      projectName: external_exports.string(),
+      displayName: external_exports.string().nullable(),
+      visibility: external_exports.string().nullable(),
+      category: external_exports.string().nullable(),
+      exportedAt: external_exports.string(),
+      version: external_exports.string(),
+      envScope: external_exports.enum([
+        "main",
+        "tree"
+      ]),
+      counts: ImportPreviewCountsDTOSchema,
+      surfaces: external_exports.array(ImportPreviewSurfaceDTOSchema),
+      fileSize: external_exports.number(),
+      fileName: external_exports.string()
+    });
+    ImportPreviewDTO = createDTO(ImportPreviewDTOSchema);
+    ImportPreviewResponseDTOSchema = external_exports.object({
+      success: external_exports.literal(true),
+      preview: ImportPreviewDTOSchema
+    });
+    ImportPreviewResponseDTO = createDTO(ImportPreviewResponseDTOSchema);
+  }
+});
+
 // ../../packages/api-contracts/dist/esm/dtos/agent-trigger.dto.js
 var TriggerKindSchema, ManualTriggerSchema2, ScheduleTriggerSchema, WebhookTriggerSchema2, TriggerSchema2;
 var init_agent_trigger_dto = __esm({
@@ -45378,6 +45442,7 @@ var init_esm = __esm({
     init_audit_log();
     init_project_dto();
     init_project_env_dto();
+    init_project_import_export_dto();
     init_agent_trigger_dto();
     init_agent_activation_dto();
     init_agent_list_item_dto();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fimo",
-  "version": "0.3.3-experimental.1783347971089",
+  "version": "0.3.3-staging.23",
   "description": "Fimo CLI - create, deploy, and manage Fimo projects",
   "bin": {
     "fimo": "dist/cli/index.js"

package/scripts/publish-npm.mjs

@@ -10,20 +10,25 @@
 // What it does:
 //   1. Resolves the channel from the shared table (lib/channels.mjs).
 //   2. Guards: @latest refuses to publish outside CI unless --bootstrap.
-//   3. Bakes a channel-appropriate release.json (lib/release-core.mjs) —
-//      staging URLs for experimental/staging, prod for latest. Never a tunnel.
-//   4. For prerelease channels, synthesizes a disposable X.Y.Z-<tag>.<n> version.
-//   5. Runs `npm publish --tag <distTag>` (no --provenance — strapi/fimo is private).
+//   3. Builds in place (clean → build → build:bundle) with the workspace
+//      manifest UNTOUCHED, then `npm pack`s straight into a temp stage dir.
+//   4. Mutates ONLY the extracted stage copy: synthesized X.Y.Z-<tag>.<n>
+//      version, template fimo pin, channel release.json (allowlist-enforced —
+//      staging URLs for experimental/staging, prod for latest, never a tunnel).
+//   5. Runs `npm publish --tag <distTag>` from the stage (no --provenance —
+//      strapi/fimo is private).
 //   6. On real experimental publishes, records the exact version in repo-root
 //      .fimo/dev.json for local source-checkout deploys.
-//   7. Restores package.json + removes the transient release.json.
 //
-// `npm publish` triggers prepublishOnly (clean → build → build:bundle), so the
-// bundled tarball is always fresh.
+// The workspace is never mutated: no transient package.json version, no
+// release.json, no template rewrites — a crash or a long OTP prompt can't
+// leave the repo dirty (it used to sit mutated for the whole multi-minute
+// build + 2FA window).
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
+import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { resolveChannel } from './lib/channels.mjs';
@@ -38,7 +43,6 @@ import {
 const HERE = dirname(fileURLToPath(import.meta.url));
 const CLI_ROOT = resolve(HERE, '..');
 const PKG_PATH = resolve(CLI_ROOT, 'package.json');
-const RELEASE_PATH = resolve(CLI_ROOT, 'release.json');
 
 function parseArgs(argv) {
   const args = { channel: null, dryRun: false, bootstrap: false, plan: false };
@@ -57,6 +61,15 @@ function parseArgs(argv) {
   return args;
 }
 
+function run(cmd, args, cwd) {
+  console.log(`[publish-npm] $ ${cmd} ${args.join(' ')}`);
+  const result = spawnSync(cmd, args, { cwd, stdio: 'inherit' });
+  if (result.status !== 0) {
+    console.error(`[publish-npm] ${cmd} ${args[0]} failed (exit ${result.status}).`);
+    process.exit(result.status ?? 1);
+  }
+}
+
 const { channel: channelName, dryRun, bootstrap, plan } = parseArgs(process.argv.slice(2));
 
 if (!channelName) {
@@ -93,38 +106,40 @@ if (plan) {
   process.exit(0);
 }
 
-let versionMutated = false;
-let restoreTemplate = () => {};
-let restoreLockfile = () => {};
+const stageRoot = mkdtempSync(join(tmpdir(), 'fimo-publish-'));
 try {
-  // 1. Set the synthesized version for prerelease channels.
-  if (publishVersion !== baseVersion) {
-    writeFileSync(PKG_PATH, JSON.stringify({ ...pkg, version: publishVersion }, null, 2) + '\n');
-    versionMutated = true;
+  // 1. Build in place — the build output doesn't depend on the version, so
+  //    the workspace manifest stays untouched.
+  run('pnpm', ['run', 'prepublishOnly'], CLI_ROOT);
+
+  // 2. Pack the workspace tarball (honors the `files` whitelist) directly
+  //    into the stage dir; --ignore-scripts because we just built.
+  run('npm', ['pack', '--ignore-scripts', '--pack-destination', stageRoot], CLI_ROOT);
+  const tarball = readdirSync(stageRoot).find((name) => name.endsWith('.tgz'));
+  if (!tarball) {
+    console.error(`[publish-npm] npm pack produced no tarball in ${stageRoot}.`);
+    process.exit(1);
   }
-
-  // 2. Pin the bundled template's fimo dep to the exact version, and drop its
-  //    lockfile (can't pin an unpublished version; create regenerates it).
-  restoreTemplate = pinTemplateFimo(CLI_ROOT, publishVersion);
-  restoreLockfile = stripTemplateLockfile(CLI_ROOT);
-
-  // 3. Bake release.json (allowlist-enforced).
-  writeReleaseJson(CLI_ROOT, channel);
-
-  // 4. Publish. No --provenance: sigstore provenance requires a PUBLIC source
-  //    repo, and strapi/fimo is private (npm returns 422 otherwise). Trusted
-  //    Publishing (OIDC auth) works regardless of repo visibility — it's only
-  //    the attestation that's public-repo-only.
-  const publishArgs = ['publish', '--access', 'public', '--tag', channel.distTag];
+  run('tar', ['-xzf', join(stageRoot, tarball), '-C', stageRoot], stageRoot);
+  const stage = join(stageRoot, 'package');
+
+  // 3. Mutate ONLY the stage copy: synthesized version, template pin,
+  //    channel release.json.
+  const stagePkg = JSON.parse(readFileSync(join(stage, 'package.json'), 'utf8'));
+  writeFileSync(join(stage, 'package.json'), JSON.stringify({ ...stagePkg, version: publishVersion }, null, 2) + '\n');
+  pinTemplateFimo(stage, publishVersion);
+  stripTemplateLockfile(stage);
+  writeReleaseJson(stage, channel);
+
+  // 4. Publish from the stage. No --provenance: sigstore provenance requires
+  //    a PUBLIC source repo, and strapi/fimo is private (npm returns 422
+  //    otherwise). Trusted Publishing (OIDC auth) works regardless of repo
+  //    visibility — it's only the attestation that's public-only.
+  const publishArgs = ['publish', '--access', 'public', '--tag', channel.distTag, '--ignore-scripts'];
   if (dryRun) {
     publishArgs.push('--dry-run');
   }
-  console.log(`[publish-npm] $ npm ${publishArgs.join(' ')}`);
-  const result = spawnSync('npm', publishArgs, { cwd: CLI_ROOT, stdio: 'inherit' });
-  if (result.status !== 0) {
-    console.error(`[publish-npm] npm publish failed (exit ${result.status}).`);
-    process.exit(result.status ?? 1);
-  }
+  run('npm', publishArgs, stage);
 
   if (!dryRun && channel.distTag === 'experimental') {
     const devStatePath = writeDevReleaseState(CLI_ROOT, {
@@ -134,16 +149,7 @@ try {
     console.log(`[publish-npm] wrote ${devStatePath}`);
   }
 } finally {
-  // Restore the workspace: package.json version, template fimo pin, and remove
-  // the transient release.json so local `fimo` runs fall back to localhost.
-  if (versionMutated) {
-    writeFileSync(PKG_PATH, JSON.stringify(pkg, null, 2) + '\n');
-  }
-  restoreTemplate();
-  restoreLockfile();
-  if (existsSync(RELEASE_PATH)) {
-    rmSync(RELEASE_PATH, { force: true });
-  }
+  rmSync(stageRoot, { recursive: true, force: true });
 }
 
 console.log(`[publish-npm] done${dryRun ? ' (dry-run — nothing published)' : ''}.`);

package/templates/react-router/package.json

@@ -21,7 +21,7 @@
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "fimo": "0.3.3-experimental.1783347971089",
+    "fimo": "0.3.3-staging.23",
     "input-otp": "^1.4.2",
     "isbot": "^5",
     "lucide-react": "^0.577.0",