Publish prebuilt CLI binaries

.changeset/ninety-pets-argue.md

@@ -0,0 +1,5 @@
+---
+"@proofkit/cli": patch
+---
+
+Publish prebuilt CLI binaries and cut install-time runtime deps so `npx` and `pnpm dlx` flows avoid dependency build approvals.

.github/workflows/continuous-release.yml

@@ -59,6 +59,11 @@ jobs:
           node-version: 22
           cache: "pnpm"
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

.github/workflows/release.yml

@@ -79,6 +79,11 @@ jobs:
           node-version: 22
           cache: "pnpm"
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
@@ -156,6 +161,11 @@ jobs:
           cache: "pnpm"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 

.gitignore

@@ -75,6 +75,10 @@ public/dist
 .turbo
 packages/fmdapi/test/typegen/*
 packages/typegen/schema/metadata.xml
+packages/cli/bin/proofkit-*
+!packages/cli/bin/proofkit.cjs
+packages/cli/.*.bun-build
+packages/cli/src/generated/
 
 # FM ADD-ON BUILD ARTIFACTS
 fm-addon/stage/

packages/cli/bin/proofkit.cjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+"use strict";
+
+const { existsSync } = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const BINARIES = {
+  darwin: {
+    arm64: "proofkit-darwin-arm64",
+    x64: "proofkit-darwin-x64",
+  },
+  linux: {
+    arm64: "proofkit-linux-arm64",
+    x64: "proofkit-linux-x64",
+  },
+  win32: {
+    arm64: "proofkit-windows-arm64.exe",
+    x64: "proofkit-windows-x64.exe",
+  },
+};
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      PROOFKIT_PKG_ROOT: path.resolve(__dirname, ".."),
+    },
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (typeof result.status === "number") {
+    process.exit(result.status);
+  }
+
+  process.exit(1);
+}
+
+if (process.env.PROOFKIT_DISABLE_BUNDLED_BINARY !== "1") {
+  const binaryName = BINARIES[process.platform]?.[process.arch];
+  if (binaryName) {
+    const binaryPath = path.join(__dirname, binaryName);
+    if (existsSync(binaryPath)) {
+      run(binaryPath, process.argv.slice(2));
+    }
+  }
+}
+
+const fallbackPath = path.join(__dirname, "..", "dist", "index.js");
+if (existsSync(fallbackPath)) {
+  run(process.execPath, [fallbackPath, ...process.argv.slice(2)]);
+}
+
+console.error(`No ProofKit executable found for ${process.platform}-${process.arch}.`);
+process.exit(1);

packages/cli/package.json

@@ -25,9 +25,10 @@
     }
   },
   "bin": {
-    "proofkit": "dist/index.js"
+    "proofkit": "bin/proofkit.cjs"
   },
   "files": [
+    "bin",
     "dist",
     "template",
     "README.md",
@@ -39,22 +40,23 @@
     "node": "^20.0.0 || ^22.0.0"
   },
   "scripts": {
-    "typecheck": "tsc",
-    "build": "NODE_ENV=production tsdown && publint --strict",
-    "prepublishOnly": "pnpm build",
+    "typecheck": "node ./scripts/write-cli-version.mjs && tsc",
+    "build": "node ./scripts/write-cli-version.mjs && NODE_ENV=production tsdown && publint --strict",
+    "build:binaries": "node ./scripts/write-cli-version.mjs && node ./scripts/build-binaries.mjs",
+    "prepublishOnly": "pnpm build && pnpm build:binaries",
     "dev": "tsdown --watch",
-    "clean": "rm -rf dist .turbo node_modules",
+    "clean": "rm -rf dist .turbo node_modules bin/proofkit-* bin/*.exe",
     "start": "node dist/index.js",
     "lint": "biome check . --write",
     "lint:summary": "biome check . --reporter=summary",
     "release": "changeset version",
     "pub:beta": "NODE_ENV=production pnpm build && npm publish --tag beta --access public",
     "pub:next": "NODE_ENV=production pnpm build && npm publish --tag next --access public",
     "pub:release": "NODE_ENV=production pnpm build && npm publish --access public",
-    "test": "pnpm build && vitest run",
+    "test": "pnpm build && node ./scripts/build-current-binary.mjs && PROOFKIT_DISABLE_BUNDLED_BINARY=1 vitest run",
     "test:smoke": "PROOFKIT_RUN_SMOKE_TESTS=1 vitest run --config vitest.smoke.config.ts"
   },
-  "dependencies": {
+  "devDependencies": {
     "@better-fetch/fetch": "1.1.17",
     "@clack/core": "^0.3.5",
     "@clack/prompts": "^0.11.0",
@@ -86,11 +88,8 @@
     "randomstring": "^1.3.1",
     "semver": "^7.7.3",
     "shadcn": "^2.10.0",
-    "sort-package-json": "^2.15.1",
     "ts-morph": "^26.0.0",
-    "type-fest": "^3.13.1"
-  },
-  "devDependencies": {
+    "type-fest": "^3.13.1",
     "@auth/drizzle-adapter": "^1.11.1",
     "@auth/prisma-adapter": "^1.6.0",
     "@biomejs/biome": "2.3.11",

packages/cli/scripts/build-binaries.mjs

@@ -0,0 +1,96 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, "..");
+const binDir = path.join(packageRoot, "bin");
+const entrypoint = path.join(packageRoot, "src", "index.ts");
+
+const targets = [
+  { target: "bun-darwin-arm64", file: "proofkit-darwin-arm64" },
+  { target: "bun-darwin-x64", file: "proofkit-darwin-x64" },
+  { target: "bun-linux-arm64", file: "proofkit-linux-arm64" },
+  { target: "bun-linux-x64", file: "proofkit-linux-x64" },
+  { target: "bun-windows-arm64", file: "proofkit-windows-arm64.exe" },
+  { target: "bun-windows-x64", file: "proofkit-windows-x64.exe" },
+];
+const validTargets = new Set(targets.map((config) => config.target));
+const requestedTargetsEnv = process.env.PROOFKIT_BINARY_TARGETS ?? "";
+
+const selectedTargets = new Set(
+  requestedTargetsEnv
+    .split(",")
+    .map((target) => target.trim())
+    .filter(Boolean),
+);
+const filteredSelectedTargets = new Set([...selectedTargets].filter((target) => validTargets.has(target)));
+
+if (selectedTargets.size > 0 && filteredSelectedTargets.size === 0) {
+  console.error(
+    `No valid binary targets in PROOFKIT_BINARY_TARGETS="${requestedTargetsEnv}". Valid targets: ${targets
+      .map((config) => config.target)
+      .join(", ")}`,
+  );
+  process.exit(1);
+}
+
+mkdirSync(binDir, { recursive: true });
+for (const file of readdirSync(binDir)) {
+  if (file === "proofkit.cjs") {
+    continue;
+  }
+  rmSync(path.join(binDir, file), { recursive: true, force: true });
+}
+
+let builtCount = 0;
+for (const config of targets) {
+  if (filteredSelectedTargets.size > 0 && !filteredSelectedTargets.has(config.target)) {
+    continue;
+  }
+
+  const outfile = path.join(binDir, config.file);
+  const result = spawnSync(
+    "bun",
+    [
+      "build",
+      "--compile",
+      `--target=${config.target}`,
+      "--no-compile-autoload-dotenv",
+      "--no-compile-autoload-bunfig",
+      "--no-compile-autoload-tsconfig",
+      "--no-compile-autoload-package-json",
+      entrypoint,
+      `--outfile=${outfile}`,
+    ],
+    {
+      cwd: packageRoot,
+      stdio: "inherit",
+      env: process.env,
+    },
+  );
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+
+  if (existsSync(outfile) && !outfile.endsWith(".exe")) {
+    chmodSync(outfile, 0o755);
+  }
+
+  builtCount += 1;
+}
+
+if (builtCount === 0) {
+  console.error(
+    `No binary targets selected from PROOFKIT_BINARY_TARGETS="${requestedTargetsEnv}". Valid targets: ${targets
+      .map((config) => config.target)
+      .join(", ")}`,
+  );
+  process.exit(1);
+}

packages/cli/scripts/build-current-binary.mjs

@@ -0,0 +1,22 @@
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, "..");
+const target = `bun-${process.platform}-${process.arch}`;
+
+const result = spawnSync("node", ["./scripts/build-binaries.mjs"], {
+  cwd: packageRoot,
+  stdio: "inherit",
+  env: {
+    ...process.env,
+    PROOFKIT_BINARY_TARGETS: target,
+  },
+});
+
+if (result.error) {
+  throw result.error;
+}
+
+process.exit(result.status ?? 1);

packages/cli/scripts/write-cli-version.mjs

@@ -0,0 +1,27 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, "..");
+const readVersion = (packagePath) => {
+  const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+  return packageJson.version ?? "0.0.0-private";
+};
+
+const outputPath = path.join(packageRoot, "src", "generated", "package-versions.ts");
+const content = [
+  `export const CLI_VERSION = ${JSON.stringify(readVersion(path.join(packageRoot, "package.json")))} as const;`,
+  `export const FMDAPI_VERSION = ${JSON.stringify(readVersion(path.join(packageRoot, "..", "fmdapi", "package.json")))} as const;`,
+  `export const BETTER_AUTH_VERSION = ${JSON.stringify(
+    readVersion(path.join(packageRoot, "..", "better-auth", "package.json")),
+  )} as const;`,
+  `export const WEBVIEWER_VERSION = ${JSON.stringify(
+    readVersion(path.join(packageRoot, "..", "webviewer", "package.json")),
+  )} as const;`,
+  `export const TYPEGEN_VERSION = ${JSON.stringify(readVersion(path.join(packageRoot, "..", "typegen", "package.json")))} as const;`,
+  "",
+].join("\n");
+
+mkdirSync(path.dirname(outputPath), { recursive: true });
+writeFileSync(outputPath, content, "utf8");

packages/cli/src/consts.ts

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
 const distPath = path.dirname(__filename);
-export const PKG_ROOT = path.join(distPath, "../");
+export const PKG_ROOT = process.env.PROOFKIT_PKG_ROOT ?? path.join(distPath, "../");
 
 export const DEFAULT_APP_NAME = "my-proofkit-app";
 export const cliName = "proofkit";

packages/cli/src/core/doctor.ts

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { parse as parseDotenv } from "dotenv";
 import { Effect } from "effect";
-import { parse as parseJsonc } from "jsonc-parser";
+import { parse as parseJsonc } from "jsonc-parser/lib/esm/main.js";
 import { DOCS_URL } from "~/consts.js";
 import { CliContext, ConsoleService, FileSystemService } from "~/core/context.js";
 

packages/cli/src/core/executeInitPlan.ts

@@ -2,7 +2,6 @@ import path from "node:path";
 import { Chalk } from "chalk";
 import { Cause, Effect, Exit } from "effect";
 import { getOrUndefined } from "effect/Option";
-import sortPackageJson from "sort-package-json";
 
 import { AGENT_INSTRUCTIONS } from "~/consts.js";
 import {
@@ -21,6 +20,7 @@ import { DirectoryConflictError, FileSystemError, isCliError, UserCancelledError
 import { applyPackageJsonMutations } from "~/core/planInit.js";
 import type { InitPlan } from "~/core/types.js";
 import { normalizeImportAlias, replaceTextInFiles, updateTypegenConfig } from "~/utils/projectFiles.js";
+import { sortPackageJson } from "~/utils/sortPackageJson.js";
 
 const AGENT_METADATA_DIRS = new Set([".agents", ".claude", ".clawed", ".clinerules", ".cursor", ".windsurf"]);
 const IMPORT_ALIAS_WILDCARD_REGEX = /\*/g;
@@ -358,6 +358,14 @@ export const executeInitPlan = (plan: InitPlan) =>
     }
 
     if (plan.tasks.runInstall) {
+      if (plan.request.packageManager === "pnpm") {
+        yield* processService.run("pnpm", ["self-update", "11"], {
+          cwd: plan.targetDir,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+      }
+
       let installArgs: string[] = ["install"];
       if (plan.request.packageManager === "yarn") {
         installArgs = [];