Files
webstudio/packages/cli/package.json
T
Oleg Isonen bc8630f413 fix: Gate Builder releases on the published CLI contract (#6282)
Closes #6280

## Summary

- Expose the deployed Builder's CLI-facing bundle contract through a
non-cached, read-only endpoint.
- Resolve and execute the exact `webstudio@latest` registry artifact,
observe the bundle version sent by its real `sync` request, and require
an exact match before assigning the release staging alias.
- Include expected and received bundle versions in runtime and
release-gate errors.

## Technical choices

- The existing generated `bundleVersion` remains the single
compatibility boundary. Builder-only changes outside that project-bundle
contract do not require a CLI release.
- The CLI sync probe runs against a local fixture API and temporary
directory. It reads the deployed runtime contract but never reads or
modifies a Cloud project.
- Verification runs after Vercel creates the exact production-built
deployment and before the release staging alias is assigned. A mismatch
therefore leaves production domains untouched.
- Registry resolution requires version and integrity metadata, then
executes the resolved immutable version rather than source from the
checkout.
- The gate requires the deployed Builder origin and cannot fall back to
the checkout's contract.

## Todo

1. [x] Add the deployed Builder contract endpoint.
2. [x] Probe the exact published CLI through its real sync request.
3. [x] Gate the release staging alias on an exact contract match.
4. [x] Report expected and received versions for compatibility failures.
5. [x] Add regression tests and verify the production Builder build.
6. [x] Review documentation and fixture impact.

## Verification

- `pnpm --filter @webstudio-is/builder exec vitest run
app/services/build-router.server.test.ts
app/services/cli-compatibility-route.node.test.ts` — 12 passed.
- `pnpm --filter webstudio exec vitest run
scripts/builder-contract-gate.test.ts
scripts/release-smoke-registry.test.ts` — 7 passed.
- Rebased onto `main` at `9ec4c820e1`.
- Builder and CLI typechecks passed.
- `pnpm lint` and changed-file formatting passed.
- `pnpm --filter @webstudio-is/builder build` passed and emitted
`/rest/cli-compatibility`.
- The changed GitHub Action parses as valid YAML.
- Real registry probe passed for `webstudio@0.293.0` against
`bundle-kzb45v`.
- Real registry probe correctly blocked current Builder contract
`bundle-1mym82p` and reported expected `bundle-1mym82p`, received
`bundle-kzb45v`.
- Missing staged Builder origin fails closed before registry execution.
- GitHub CI passed all four workflows, including all six Builder E2E
shards.
- The formerly failing empty-MDX insertion workflow passed 8 repeated
runs with 4 workers locally, then passed in Builder E2E shard 4 in CI.
- Full browser-based release smoke was not run, per the request not to
use Chrome. Agent evaluations were not run because no evaluation
approval was requested or received.
- Documentation: no user-facing documentation changes are required.
- Fixtures/generated outputs: no fixture inputs or generated outputs are
affected.

## Operational boundary

The check needs the exact deployed runtime, so Vercel creates an
unaliased `--skip-domain` deployment before verification. A failed check
cannot affect production domains or the normal release alias. Repository
automation cannot prevent a Vercel administrator from manually promoting
an arbitrary deployment outside this release path.
2026-08-31 20:43:52 +02:00

139 lines
5.0 KiB
JSON

{
"name": "webstudio",
"version": "0.0.0-webstudio-version",
"description": "Webstudio CLI",
"author": "Webstudio <github@webstudio.is>",
"homepage": "https://webstudio.is",
"type": "module",
"bin": {
"webstudio-cli": "./bin.js",
"webstudio": "./bin.js"
},
"exports": {
"./vision": {
"webstudio": "./src/vision.ts"
}
},
"files": [
"lib/*",
"templates/*",
"bin.js",
"!*.{test,stories}.*"
],
"scripts": {
"typecheck": "tsc --noEmit",
"generate-docs": "tsx scripts/generate-docs.ts && oxfmt src/docs.generated.ts",
"build:content-runtime": "esbuild @webstudio-is/content-engine/runtime --bundle --format=esm --platform=browser --target=es2022 --conditions=webstudio,worker --minify --outfile=lib/content-runtime.js",
"fixtures:build": "pnpm build:content-runtime",
"build": "pnpm generate-docs && rm -rf lib && vite build && pnpm build:content-runtime",
"pretest": "mkdir -p lib && pnpm build:content-runtime",
"evaluations": "tsx --import ../../scripts/register-react-global.ts --conditions=webstudio evaluations/high-impact/run-local-agent.ts",
"test": "vitest run",
"test:ssg-package": "tsx --conditions=webstudio scripts/test-ssg-package.ts",
"check:published-cli-contract": "tsx --conditions=webstudio scripts/builder-contract-gate.ts",
"test:release-smoke": "pnpm build && tsx --conditions=webstudio scripts/release-smoke.ts",
"test:release-smoke:model": "WEBSTUDIO_RELEASE_SMOKE_MODEL_EVAL_REQUIRED=1 pnpm test:release-smoke",
"test:release-smoke:registry": "tsx --conditions=webstudio scripts/release-smoke.ts"
},
"license": "AGPL-3.0-or-later",
"engines": {
"node": ">=22.12.0"
},
"dependencies": {
"@clack/prompts": "^0.10.0",
"@emotion/hash": "^0.9.2",
"@trpc/client": "^10.45.2",
"@webstudio-is/http-client": "workspace:*",
"@webstudio-is/project-migrations": "workspace:*",
"@webstudio-is/protocol": "workspace:*",
"@webstudio-is/sync-client": "workspace:*",
"acorn": "^8.14.1",
"acorn-jsx": "^5.3.2",
"acorn-walk": "^8.3.4",
"change-case": "^5.4.4",
"chrome-launcher": "^1.2.1",
"deepmerge": "^4.3.1",
"decode-named-character-reference": "^1.0.2",
"detect-port": "^2.1.0",
"env-paths": "^3.0.0",
"esbuild": "^0.25.3",
"execa": "^10.0.1",
"fast-deep-equal": "^3.1.3",
"get-port": "^7.2.0",
"immer": "^10.1.1",
"nanoid": "^5.1.5",
"p-limit": "^6.2.0",
"parse5": "7.3.0",
"path-key": "^4.0.0",
"picocolors": "^1.1.1",
"reserved-identifiers": "^1.0.0",
"semver": "7.7.1",
"tinyexec": "^0.3.2",
"tus-js-client": "^4.3.1",
"warn-once": "^0.1.1",
"which": "^5.0.0",
"yargs": "^17.7.2",
"zod": "^4.4.3"
},
"devDependencies": {
"@cloudflare/vite-plugin": "^1.1.0",
"@netlify/vite-plugin-react-router": "^1.0.1",
"@react-router/dev": "^7.5.3",
"@react-router/fs-routes": "^7.5.3",
"@react-router/node": "^7.5.3",
"@react-router/serve": "^7.5.3",
"@remix-run/cloudflare": "^2.16.5",
"@remix-run/cloudflare-pages": "^2.16.5",
"@remix-run/dev": "^2.16.5",
"@remix-run/node": "^2.16.5",
"@remix-run/react": "^2.16.5",
"@remix-run/server-runtime": "^2.16.5",
"@shikijs/langs": "4.4.1",
"@shikijs/themes": "4.4.1",
"@types/mdast": "^4.0.4",
"@types/react": "^18.2.70",
"@types/react-dom": "^18.2.25",
"@types/semver": "^7.7.0",
"@types/which": "^3.0.4",
"@types/yargs": "^17.0.33",
"@vercel/react-router": "^1.1.0",
"@vitejs/plugin-react": "^4.4.1",
"@webstudio-is/css-engine": "workspace:*",
"@webstudio-is/content-engine": "workspace:*",
"@webstudio-is/expression": "workspace:*",
"@webstudio-is/fonts": "workspace:*",
"@webstudio-is/image": "workspace:*",
"@webstudio-is/project-build": "workspace:*",
"@webstudio-is/query-builder": "workspace:*",
"@webstudio-is/react-sdk": "workspace:*",
"@webstudio-is/sdk": "workspace:*",
"@webstudio-is/sdk-components-animation": "workspace:*",
"@webstudio-is/sdk-components-react": "workspace:*",
"@webstudio-is/sdk-components-react-radix": "workspace:*",
"@webstudio-is/sdk-components-react-remix": "workspace:*",
"@webstudio-is/sdk-components-react-router": "workspace:*",
"@webstudio-is/sdk-components-registry": "workspace:*",
"@webstudio-is/tsconfig": "workspace:*",
"@webstudio-is/vision": "workspace:*",
"@webstudio-is/wsauth": "workspace:*",
"h3": "^1.15.1",
"ipx": "^3.0.3",
"isbot": "^5.1.25",
"mdast-util-directive": "^3.1.0",
"mdast-util-from-markdown": "^2.0.3",
"mdast-util-to-string": "^4.0.0",
"micromark-extension-directive": "^4.0.0",
"oxfmt": "0.58.0",
"react": "18.3.0-canary-14898b6a9-20240318",
"react-dom": "18.3.0-canary-14898b6a9-20240318",
"react-router": "^7.5.3",
"shiki": "4.4.1",
"ts-expect": "^1.3.0",
"typescript": "7.0.2",
"vike": "^0.4.229",
"vite": "^6.3.4",
"vitest": "^3.1.2",
"wrangler": "^3.63.2"
}
}