@finebi/finebi-cli 1.6.1 → 1.6.2

package/skills/finebi-cli-agent/scripts/finebi-cli/templates/web-app/tests/table-normalize.test.mjs

@@ -0,0 +1,189 @@
+import assert from 'node:assert/strict';
+import {after, test} from 'node:test';
+import {createServer} from 'vite';
+import {createElement} from 'react';
+import {renderToStaticMarkup} from 'react-dom/server';
+const server = await createServer({configFile: false, cacheDir: '../../../temp/vite-table-tests', server: {middlewareMode: true, hmr: false}});
+after(() => server.close());
+const {normalize} = await server.ssrLoadModule('/src/finebi/normalize.ts');
+const {DataTable} = await server.ssrLoadModule('/src/components/DataTable.tsx');
+const {tableCsv} = await server.ssrLoadModule('/src/services/table-data.ts');
+const metric = (text, rowSumInfo = {totalSum: false, innerSum: false}, extra = {}) => ({dId: 'amount', text, authority: true, rowSumInfo, ...extra});
+const group = items => ({previewResult: {resultType: 'BIGROUP', header: [{dId: 'region', text: '地区'}, {dId: 'city', text: '城市'}, {dId: 'amount', text: '金额'}], items, hasNext: true, hasPrev: false}, widgetBean: {dimensions: {region: {type: 1}, city: {type: 1}}, settings: {tableStyle: {rowCounts: 10}}}});
+const detailInfo = {totalSum: false, innerSum: false};
+const totalInfo = {totalSum: true, innerSum: false};
+const node = (dId, text, children = null, values = null) => ({dId, text, formatText: text, authority: true, children, values});
+const crossMetric = (text, colSumInfo = detailInfo, rowSumInfo = detailInfo, dId = 'amount') => ({dId, text, authority: true, colSumInfo, rowSumInfo});
+const cross = (top, left) => ({previewResult: {resultType: 'BICROSS', top: {header: [{dId: 'year', text: '年'}], items: [node(null, null, top)]}, left: {header: [{dId: 'region', text: '地区'}], items: [node(null, null, left)]}, hasXNext: true, hasXPrev: false, hasYNext: false, hasYPrev: false}});
+
+test('cross display removes only repeated metric captions and DATA summary carriers', () => {
+  const source = cross([node('region', '金额', [node('target-name', '金额', null, [node('amount', '金额')])])], [
+    node('region', '合计', [node('__summary_dim_id__', '合计', null, [crossMetric('1')])]),
+    node('__summary_dim_id__', '合计', null, [crossMetric('2', detailInfo, totalInfo)]),
+    node('__summary_dim_id__', '合计', null, [crossMetric('3', detailInfo, {totalSum: false, innerSum: true})]),
+    node('__summary_dim_id__', '合计', null, [{...crossMetric('4'), rowSumInfo: null}]),
+  ]);
+  const data = normalize(source).datasets[0];
+  assert.equal(data.columns[1].name, '金额 / 金额', 'real repeated grouping labels must remain');
+  assert.equal(data.columns[1].path.length, 3, 'source path metadata must remain intact');
+  assert.equal(data.rows[0].cells[0].display, '合计', 'business dimension named 合计 must remain');
+  assert.equal(data.rows[0].path.length, 2);
+  assert.deepEqual(data.rows.slice(1).map(row => [row.kind, row.cells[0].display]), [['GRAND_TOTAL', '合计'], ['SUBTOTAL', '合计'], ['UNKNOWN', '合计']]);
+});
+
+test('cross metric rows deduplicate only the verified trailing metric caption', () => {
+  const rows = [
+    node('region', '金额', [node('target-name', '金额', [node('amount', '金额', null, [crossMetric('7')])])]),
+    node('region', '金额', [node('other-dimension', '金额', null, [crossMetric('8')])]),
+    node('target-name', '金额', [node('amount', '别名', null, [crossMetric('9')])]),
+    node('target-name', '金额', [node('amount', '金额', null, [crossMetric('10', detailInfo, detailInfo, 'count')])]),
+  ];
+  const data = normalize(cross([node('year', '2024', null, [{}])], rows)).datasets[0];
+  assert.deepEqual(data.rows.map(r => r.cells[0].display), ['金额 / 金额', '金额 / 金额', '金额 / 别名', '金额 / 金额']);
+  assert.equal(data.rows[0].path.length, 3);
+  assert.equal(data.rows[0].cells[1].sourceFieldId, 'amount');
+  const html = renderToStaticMarkup(createElement(DataTable, {dataset: data, pageSize: 10, binding: {type: 'table'}}));
+  assert.doesNotMatch(html, /金额 \/ 金额 \/ 金额/);
+  assert.doesNotMatch(tableCsv(data, data.rows), /金额 \/ 金额 \/ 金额/);
+});
+
+test('cross real null renders as dash while placeholders, missing payload and permissions stay distinct', () => {
+  const empty = {...crossMetric(null), value: null, formatText: null};
+  const cells = [empty, {...empty, dId: null}, {...empty, authority: false}, {...empty, authority: undefined}, {dId: 'amount', authority: true}, {...empty, formatText: '仅展示'}];
+  const data = normalize(cross([node('year', '2024', null, cells.map(() => ({})))], [node('region', '东部', null, cells)])).datasets[0];
+  assert.deepEqual(data.rows[0].cells.slice(1).map(c => c.state), ['NULL', 'UNAVAILABLE', 'RESTRICTED', 'UNAVAILABLE', 'UNAVAILABLE', 'UNAVAILABLE']);
+  assert.equal(data.rows[0].cells[1].reason, null);
+  const html = renderToStaticMarkup(createElement(DataTable, {dataset: data, pageSize: 10, binding: {type: 'table'}}));
+  assert.match(html, /<td>—<\/td><td>不可用<\/td><td>受限<\/td>/);
+  assert.match(tableCsv(data, data.rows), /"—","不可用","受限"/);
+});
+
+test('cross placeholders without valid metric ids never become available numeric values', () => {
+  const cells = [null, undefined, '', ' ', 12].map(dId => ({...crossMetric('12'), dId, value: 12}));
+  const data = normalize(cross([node('year', '2024', null, cells.map(() => ({})))], [node('region', '东部', null, cells)])).datasets[0];
+  for (const cell of data.rows[0].cells.slice(1)) {
+    assert.equal(cell.state, 'UNAVAILABLE');
+    assert.equal(cell.value, null);
+    assert.equal(cell.sourceFieldId, null);
+  }
+});
+
+test('cross table aligns repeated metric ids by column slots and preserves both axes and totals', () => {
+  for (const totalFirst of [false, true]) {
+    const columns = [node('year', '2024', null, [node('amount', '金额')]), node('year', '2025', null, [node('amount', '金额')])];
+    const summary = node('__summary_dim_id__', '合计', [node('amount', '金额', null, [{}])]);
+    columns.splice(totalFirst ? 0 : columns.length, 0, summary);
+    const values = [crossMetric('9007199254740993.12'), crossMetric('2.50')];
+    values.splice(totalFirst ? 0 : values.length, 0, crossMetric('9007199254740995.62', totalInfo));
+    const source = cross(columns, [node('region', '东部', [node('__summary_dim_id__', null, null, values)]), node('__summary_dim_id__', '合计', [node('amount', '金额', null, values.map(v => ({...v, rowSumInfo: totalInfo})))])]);
+    const result = normalize(source), data = result.datasets[0];
+    assert.equal(result.resultType, 'CROSS_TABLE'); assert.equal(result.normalization, 'COMPLETE');
+    assert.deepEqual(data.rows[0].cells.slice(1).map(c => c.value), values.map(v => v.text));
+    assert.equal(new Set(data.columns.map(c => c.fieldId)).size, 4);
+    assert.equal(data.rows[0].cells[1].sourceFieldId, 'amount');
+    assert.deepEqual(data.rows.map(r => r.kind), ['DATA', 'GRAND_TOTAL']);
+    assert.equal(data.columns[totalFirst ? 1 : 3].kind, 'GRAND_TOTAL');
+    assert.equal(result.range.mode, 'INITIAL_VIEW'); assert.equal(result.range.page, null);
+    assert.deepEqual(result.range.axes, {horizontal: {hasNext: true, hasPrevious: false}, vertical: {hasNext: false, hasPrevious: false}});
+    assert.equal(result.range.hasNext, true); assert.ok(result.warnings.includes('NEXT_PAGE_UNSUPPORTED'));
+    const html = renderToStaticMarkup(createElement(DataTable, {dataset: data, pageSize: 10, binding: {type: 'table'}}));
+    assert.match(html, /2024/); assert.match(html, /2025/); assert.match(html, /总计/);
+    assert.match(tableCsv(data, data.rows), /9007199254740993.12/);
+    assert.equal(source.previewResult.top.items[0].children.length, 3);
+  }
+});
+
+test('cross table supports metrics on rows and multi-level columns without id joins', () => {
+  const source = cross([node('year', '2024', [node('quarter', 'Q1', null, []), node('quarter', 'Q2', null, [])])], [
+    node('region', '东部', [node('target-name', '金额', [node('amount', '金额', null, [crossMetric('12'), crossMetric('18')])]), node('target-name', '数量', [node('count', '数量', null, [crossMetric('3', detailInfo, detailInfo, 'count'), crossMetric('4', detailInfo, detailInfo, 'count')])])]),
+  ]);
+  const data = normalize(source).datasets[0];
+  assert.equal(data.columns.length, 3); assert.equal(data.rows.length, 2);
+  assert.match(data.columns[1].name, /2024.*Q1/);
+  assert.match(data.rows[1].cells[0].display, /东部.*数量/);
+  assert.deepEqual(data.rows[1].cells.slice(1).map(c => c.sourceFieldId), ['count', 'count']);
+});
+
+test('cross table never exposes restricted axis labels and retains missing/ambiguous value states', () => {
+  const secret = node('year', 'secret column', null, [{}]); secret.authority = false;
+  const row = node('region', 'secret row', null, [crossMetric('123')]); row.authority = false;
+  const result = normalize(cross([secret], [row]));
+  assert.doesNotMatch(JSON.stringify(result), /secret column|secret row/);
+  assert.equal(result.datasets[0].rows[0].cells[0].state, 'RESTRICTED');
+  assert.equal(result.datasets[0].rows[0].cells[1].state, 'RESTRICTED');
+  const source = cross([node('year', 'A', null, [{}, {}])], [node('region', 'X', null, [{...crossMetric('1万'), formatText: '1万'}])]);
+  const incomplete = normalize(source);
+  assert.equal(incomplete.normalization, 'PARTIAL');
+  assert.equal(incomplete.datasets[0].rows[0].cells[1].state, 'UNAVAILABLE');
+  assert.equal(incomplete.datasets[0].rows[0].cells[2].reason, 'MISSING_CELL');
+  source.previewResult.left.items[0].children[0].values.push(crossMetric('2'), crossMetric('3'));
+  assert.equal(normalize(source).normalization, 'UNSUPPORTED', 'extra values must not be silently dropped');
+});
+
+test('cross table distinguishes empty views, missing axes and unsupported mixed node topology', () => {
+  assert.equal(normalize(cross([], [])).normalization, 'COMPLETE');
+  assert.equal(normalize(cross([], [])).datasets[0].returnedRowCount, 0);
+  assert.equal(normalize({previewResult: {resultType: 'BICROSS', left: {header: [], items: []}}}).normalization, 'UNSUPPORTED');
+  assert.equal(normalize(cross([node('x', 'A', [node('x', 'B')], [{}])], [])).normalization, 'UNSUPPORTED');
+});
+
+test('cross table handles no column dimensions and preserves metric-name intersection placeholders', () => {
+  const source = cross([], [node('target', '金额', null, [crossMetric('7'), {dId: null, text: null, value: null, authority: true}])]);
+  source.previewResult.top = {header: [], items: []};
+  const result = normalize(source);
+  assert.equal(result.normalization, 'COMPLETE');
+  assert.deepEqual(result.datasets[0].rows[0].cells.slice(1).map(c => c.state), ['AVAILABLE', 'UNAVAILABLE']);
+  assert.equal(result.datasets[0].rows[0].cells[2].value, null);
+  const swapped = cross([node('year', '2024', null, [node('amount', '金额')])], [node('region', '东部', null, [crossMetric('1', detailInfo, detailInfo, 'count')])]);
+  assert.equal(normalize(swapped).normalization, 'PARTIAL');
+  assert.equal(normalize(swapped).datasets[0].rows[0].cells[1].reason, 'AMBIGUOUS_FIELD');
+});
+
+test('group preserves parent keys, totals, metric precision and the first group page', () => {
+  const source = group([{dId: 'region', text: '东部', authority: true, values: [metric('9007199254740993.12', {totalSum: false, innerSum: true})], children: [
+    {dId: 'city', text: '甲城', authority: true, values: [metric('12.50', undefined, {formatText: '12.50元'})]},
+  ]}, {values: [metric('9007199254741005.62', {totalSum: true, innerSum: false})]}]);
+  const result = normalize(source), data = result.datasets[0];
+  assert.equal(result.resultType, 'GROUP_TABLE');
+  assert.equal(result.normalization, 'COMPLETE');
+  assert.deepEqual(data.rows.map(r => r.kind), ['SUBTOTAL', 'DATA', 'GRAND_TOTAL']);
+  assert.deepEqual(data.rows[1].cells.map(c => c.value), ['东部', '甲城', '12.50']);
+  assert.equal(data.rows[0].cells[2].value, '9007199254740993.12');
+  assert.equal(data.returnedRowCount, 3);
+  assert.deepEqual(result.range, {mode: 'PAGE', page: 1, pageSize: 10, pageUnit: 'GROUP', hasNext: true, hasPrevious: false, total: {value: null, unit: 'GROUP'}});
+  assert.ok(result.warnings.includes('NEXT_PAGE_UNSUPPORTED'));
+  const html = renderToStaticMarkup(createElement(DataTable, {dataset: data, pageSize: 10, binding: {type: 'table'}}));
+  assert.match(html, /小计/); assert.match(html, /总计/);
+  assert.match(tableCsv(data, data.rows), /GRAND_TOTAL/);
+});
+
+test('group keeps restricted and ambiguous cells unavailable and does not infer numeric group keys', () => {
+  const source = group([{dId: 'region', text: '42', authority: true, values: [metric('12万', undefined, {formatText: '12万'})], children: [
+    {dId: 'city', text: '秘密', authority: false, values: [metric('999', undefined, {authority: false})]},
+    {dId: 'city', text: '乙城', authority: true, values: [metric('1'), metric('2')]},
+    {dId: 'city', text: '丙城', authority: true, values: [metric(null, null)]},
+  ]}]);
+  source.widgetBean.dimensions.region.type = 2;
+  const result = normalize(source), rows = result.datasets[0].rows;
+  assert.equal(rows[0].cells[0].reason, 'GROUP_KEY_SEMANTICS_UNKNOWN');
+  assert.equal(rows[0].cells[2].state, 'UNAVAILABLE');
+  assert.equal(rows[1].cells[1].state, 'RESTRICTED');
+  assert.equal(rows[1].cells[2].state, 'RESTRICTED');
+  assert.equal(rows[2].cells[2].reason, 'AMBIGUOUS_FIELD');
+  assert.equal(rows[3].cells[2].state, 'UNAVAILABLE');
+  assert.equal(rows[3].kind, 'UNKNOWN');
+  assert.equal(result.normalization, 'PARTIAL');
+});
+
+test('group header expansion reports an initial view and malformed groups are not empty successes', () => {
+  const source = group([]);
+  source.widgetBean.settings.tableStyle.showRowHeaderIcon = true;
+  const result = normalize(source);
+  assert.equal(result.range.mode, 'INITIAL_VIEW');
+  assert.equal(result.range.page, null);
+  assert.equal(result.range.hasNext, null);
+  assert.equal(result.datasets[0].returnedRowCount, 0);
+  assert.equal(normalize({previewResult: {resultType: 'BIGROUP'}}).normalization, 'UNSUPPORTED');
+  source.previewResult.items = [null, {dId: 'unknown', values: [metric('1')]}];
+  assert.equal(normalize(source).normalization, 'PARTIAL');
+});

package/skills/finebi-cli-agent/scripts/finebi-cli/templates/web-app/tests/vite-auth.test.mjs

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {createServer as httpServer} from 'node:http';
+import {mkdir,mkdtemp,cp,writeFile,readFile} from 'node:fs/promises';
+import {resolve} from 'node:path';
+import {createServer} from 'vite';
+
+test('real Vite uses project env, persists sessions, blocks credential files and survives token updates',async()=>{
+  await mkdir('temp',{recursive:true});
+  const root=await mkdtemp(resolve('temp','vite-auth-'));
+  for(const name of ['vite.config.ts','scripts','src','public','index.html','package.json'])await cp(resolve(name),resolve(root,name),{recursive:true});
+  await mkdir(resolve(root,'temp'));
+  await writeFile(resolve(root,'temp','staged-session'),'staged-secret');
+  let logins=0,queries=0;
+  const upstream=httpServer(async(req,res)=>{
+    for await(const _ of req){};
+    res.setHeader('content-type','application/json');
+    if(req.url==='/decision/login'){logins++;res.end(JSON.stringify({data:{accessToken:'persisted-session'}}));return;}
+    assert.equal(req.headers.cookie,'fine_auth_token=persisted-session');queries++;
+    res.end(JSON.stringify({success:true,data:{}}));
+  });
+  await new Promise(r=>upstream.listen(0,'127.0.0.1',r));
+  const baseUrl=`http://127.0.0.1:${upstream.address().port}/decision`;
+  await writeFile(resolve(root,'.env.local'),`FINEBI_DEV_BASE_URL=${baseUrl}\nFINEBI_DEV_USERNAME=alice\nFINEBI_DEV_PASSWORD=password\n`);
+  await writeFile(resolve(root,'public','app-config.json'),JSON.stringify({basePath:'/decision',dashboardId:'r',widgets:[{entryId:'w'}],maxRows:10,filters:[]}));
+  const server=await createServer({root,configFile:resolve(root,'vite.config.ts'),cacheDir:resolve(root,'temp','cache'),server:{port:0},logLevel:'silent'});
+  try {
+    await server.listen();
+    const url=`http://127.0.0.1:${server.httpServer.address().port}`;
+    assert.equal((await fetch(url+'/')).status,200,'project under a temp parent must still serve its index');
+    assert.equal((await fetch(url+'/src/main.tsx')).status,200,'project source must remain loadable');
+    const send=()=>fetch(url+'/decision/v5/api/dashboard/report/r/widgets/query',{method:'POST',headers:{'Content-Type':'application/json','X-Requested-With':'XMLHttpRequest'},body:JSON.stringify({widgetIds:['w'],pageLimit:10})});
+    const result=await send();assert.equal(result.status,200);assert.doesNotMatch(await result.text(),/persisted-session|password/);
+    assert.match(await readFile(resolve(root,'.env.local'),'utf8'),/FINEBI_DEV_TOKEN="persisted-session"/);
+    assert.equal((await fetch(url+'/.env.local')).status,403);
+    assert.equal((await fetch(url+'/temp/staged-session')).status,403);
+    // Allow the file watcher to process the save; it must not restart the session manager.
+    await new Promise(r=>setTimeout(r,400));
+    assert.equal((await send()).status,200);assert.equal(logins,1);assert.equal(queries,2);
+  } finally {await server.close();await new Promise(r=>upstream.close(r));}
+});

package/skills/finebi-cli-agent/scripts/finebi-cli/templates/web-app/tsconfig.json

@@ -1,4 +1,4 @@
-{
-  "compilerOptions": {"target":"ES2020","lib":["ES2020","DOM","DOM.Iterable"],"module":"ESNext","moduleResolution":"Bundler","jsx":"react-jsx","strict":true,"skipLibCheck":true,"esModuleInterop":true,"resolveJsonModule":true,"isolatedModules":true,"noEmit":true},
-  "include":["src","vite.config.ts"]
-}
+{
+  "compilerOptions": {"target":"ES2020","lib":["ES2020","DOM","DOM.Iterable"],"module":"ESNext","moduleResolution":"Bundler","jsx":"react-jsx","strict":true,"skipLibCheck":true,"esModuleInterop":true,"resolveJsonModule":true,"isolatedModules":true,"noEmit":true},
+  "include":["src","vite.config.ts"]
+}

package/skills/finebi-cli-agent/scripts/finebi-cli/templates/web-app/vite.config.ts

@@ -1,15 +1,20 @@
 import {readFileSync} from 'node:fs';
+import {resolve} from 'node:path';
 import {fileURLToPath} from 'node:url';
-import {defineConfig, loadEnv} from 'vite';
+import {defineConfig, loadEnv, normalizePath} from 'vite';
 // @ts-expect-error The development-only Node module is tested directly with node:test.
 import {createDevMiddleware} from './scripts/dev-proxy.mjs';
+const projectTemp=normalizePath(fileURLToPath(new URL('./temp',import.meta.url)))+'/**';
 export default defineConfig(({mode}) => ({
   base: './',
   resolve:{alias:[{find:/^date-fns\/locale$/,replacement:fileURLToPath(new URL('./src/components/calendar-locales.ts',import.meta.url))}]},
-  server: {host:'127.0.0.1',port:4173,strictPort:true},
+  server: {host:'127.0.0.1',port:4173,strictPort:true,watch:{ignored:['**/.env.local',projectTemp]},
+    fs:{deny:['.env','.env.*','*.{crt,pem}','**/.git/**',projectTemp]}},
   plugins:[{name:'finebi-development-session',apply:'serve',configureServer(server) {
     const config=JSON.parse(readFileSync(new URL('./public/app-config.json',import.meta.url),'utf8'));
-    const env={...loadEnv(mode,process.cwd(),'FINEBI_DEV_'),...process.env};
-    server.middlewares.use(createDevMiddleware(config,env));
+    const env={...loadEnv(mode,server.config.root,'FINEBI_DEV_'),...process.env};
+    const middleware=createDevMiddleware(config,env,fetch,{file:resolve(server.config.root,'.env.local')});
+    server.middlewares.use(middleware);
+    server.httpServer?.once('close',()=>middleware.dispose());
   }}],
 }));

package/skills/finebi-cli-agent/scripts/finebi-cli-runner.mjs

@@ -10,10 +10,10 @@ const scriptDirectory = dirname(fileURLToPath(import.meta.url));
 const bundledCliEntry = resolve(scriptDirectory, "finebi-cli", "src", "index.js");
 
 export async function run(argv = process.argv.slice(2), options = {}) {
-  const env = {...(options.env ?? process.env)};
-  if (!env.FINEBI_CLI_PATH?.trim() && existsSync(bundledCliEntry)) {
-    env.FINEBI_CLI_PATH = bundledCliEntry;
-  }
+  const env = {...(options.env ?? process.env)};
+  if (!env.FINEBI_CLI_PATH?.trim() && existsSync(bundledCliEntry)) {
+    env.FINEBI_CLI_PATH = bundledCliEntry;
+  }
   return runCore(argv, {...options, env});
 }
 

package/src/app.js

@@ -1,148 +1,157 @@
-import {cp, mkdir, readdir, readFile, stat, writeFile} from "node:fs/promises";
-import {dirname, resolve} from "node:path";
-import {fileURLToPath} from "node:url";
-
-import {cliError} from "./errors.js";
-import {failure, success} from "./output.js";
-
-const TEMPLATE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "templates", "web-app");
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
-const WINDOWS_DEVICE_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
-
-export async function handleApp(args, context = {}) {
-  const action = args[0];
-  if (action === "create") return createApp(args.slice(1), context);
-  if (action === "inspect") return inspectApp(args.slice(1));
-  return invalid("app", "App command is required.", ["finebi-cli app create --name <name> --path <parent>", "finebi-cli app inspect --path <project>"]);
-}
-
-export async function createApp(args, context = {}) {
-  const options = parseOptions(args, "app.create");
-  if (!options.ok) return options.error;
-  const {name, path: parentPath} = options.value;
-  if (!name || name.length > 214 || !NAME_PATTERN.test(name) || WINDOWS_DEVICE_NAME.test(name)) {
-    return invalid("app.create", "name must be a simple lowercase npm name (letters, digits, and single hyphens).", ["finebi-cli app create --name sales-dashboard --path <parent>"]);
-  }
-  if (!parentPath) {
-    return invalid("app.create", "path must be an existing parent directory.");
-  }
-  if (options.value.layout && !['overview','workbench','cockpit','retail'].includes(options.value.layout)) return invalid('app.create','layout must be overview, workbench, cockpit or retail.');
-  const parent = resolve(parentPath);
-  const destination = resolve(parent, name);
-  if (dirname(destination) !== parent) {
-    return invalid("app.create", "name must stay inside the selected parent directory.");
-  }
-  try {
-    if (!(await stat(parent)).isDirectory()) return invalid("app.create", "path must point to a directory.");
-  } catch (error) {
-    return invalid("app.create", error.code === "ENOENT" ? `Parent directory does not exist: ${parent}` : `Cannot inspect parent directory: ${error.message}`);
-  }
-  try {
-    const templateRoot = context.templateRoot ? resolve(context.templateRoot) : TEMPLATE_ROOT;
-    const templatePackage = JSON.parse(await readFile(resolve(templateRoot, "package.json"), "utf8"));
-    const templateConfigPath = resolve(templateRoot, "public", "app-config.json");
-    let config = {schemaVersion: "1", title: name, basePath: "/webroot/decision", layout: "overview", dashboardId: "", maxRows: 1000, pageSize: 8, widgets: [], filters: []};
-    try {
-      config = JSON.parse(await readFile(templateConfigPath, "utf8"));
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    try {
-      await mkdir(destination, {recursive: false});
-    } catch (error) {
-      return invalid("app.create", error.code === "EEXIST" ? `Destination already exists: ${destination}` : `Cannot create destination: ${error.message}`);
-    }
-    await copyTemplateContents(templateRoot, destination);
-    if(options.value.layout) config.layout=options.value.layout;
-    if(config.layout==='cockpit') config.insights=true;
-    await mkdir(resolve(destination, "public"), {recursive: true});
-    await writeFile(resolve(destination, "package.json"), `${JSON.stringify({...templatePackage, name}, null, 2)}\n`, "utf8");
-    await writeFile(resolve(destination, "public", "app-config.json"), `${JSON.stringify({...config, templateVersion: templatePackage.version}, null, 2)}\n`, "utf8");
-    const lockPath = resolve(destination, "package-lock.json");
-    try {
-      const lock = JSON.parse(await readFile(lockPath, "utf8"));
-      lock.name = name;
-      if (lock.packages?.[""]) lock.packages[""].name = name;
-      await writeFile(lockPath, `${JSON.stringify(lock, null, 2)}\n`, "utf8");
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    return success("app.create", {name, path: destination, templateVersion: templatePackage.version});
-  } catch (error) {
-    return invalid("app.create", `Could not create project: ${error.message}`);
-  }
-}
-
-async function copyTemplateContents(sourceRoot, destinationRoot, relativeDirectory = "") {
-  const sourceDirectory = resolve(sourceRoot, relativeDirectory);
-  const destinationDirectory = resolve(destinationRoot, relativeDirectory);
-  for (const entry of (await readdir(sourceDirectory, {withFileTypes: true})).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
-    const relativePath = `${relativeDirectory}/${entry.name}`.replace(/^\//u, "");
-    if (!templatePathAllowed(relativePath)) continue;
-    const sourcePath = resolve(sourceDirectory, entry.name);
-    const destinationPath = resolve(destinationDirectory, entry.name);
-    if (entry.isDirectory()) {
-      await mkdir(destinationPath, {recursive: false});
-      await copyTemplateContents(sourceRoot, destinationRoot, relativePath);
-    } else if (entry.isFile()) {
-      await cp(sourcePath, destinationPath, {force: false, errorOnExist: true});
-    } else {
-      throw new Error(`Unsupported template entry: ${relativePath}`);
-    }
-  }
-}
-
-function templatePathAllowed(relative) {
-  const relativePath = relative.replaceAll("\\", "/");
-  const parts = relativePath.split("/").filter(Boolean);
-  const basename = parts.at(-1) || "";
-  return !parts.some(part => ["node_modules", "dist", "temp", ".git"].includes(part))
-    && basename !== ".env"
-    && (!basename.startsWith(".env.") || basename === ".env.example");
-}
-
-async function inspectApp(args) {
-  const options = parseOptions(args, "app.inspect");
-  if (!options.ok) return options.error;
-  const projectPath = options.value.path;
-  if (!projectPath) return invalid("app.inspect", "path must be a project directory.");
-  const project = resolve(projectPath);
-  try {
-    if (!(await stat(project)).isDirectory()) return invalid("app.inspect", "path must point to a project directory.");
-    const configPath = resolve(project, "public", "app-config.json");
-    const config = JSON.parse(await readFile(configPath, "utf8"));
-    const {configErrors}=await import('../templates/web-app/src/finebi/config.js');
-    const errors = configErrors(config);
-    if (errors.length) return failure("app.inspect", cliError("INVALID_ARGUMENT", {path: "public/app-config.json", message: errors.join(" ")}));
-    return success("app.inspect", {
-      path: project,
-      dashboardId: config.dashboardId,
-      layout: config.layout,
-      directoryEntryId: config.directoryEntryId || null,
-      widgets: config.widgets.length,
-      templateVersion: config.templateVersion || null,
-      remoteValidated: false,
-    });
-  } catch (error) {
-    return invalid("app.inspect", `Cannot read project configuration: ${error.message}`);
-  }
-}
-
-function parseOptions(args, command) {
-  const value = {};
-  for (let index = 0; index < args.length; index++) {
-    const option = args[index];
-    if (option === "--json") continue;
-    if (!["--name","--path",...(command==='app.create'?['--layout']:[])].includes(option)) return {ok: false, error: invalid(command, `Unsupported option: ${option}`)};
-    const key = option.slice(2);
-    const next = args[++index];
-    if (!next || next.startsWith("--")) return {ok: false, error: invalid(command, `${option} requires a value.`)};
-    if (value[key]) return {ok: false, error: invalid(command, `${option} must only be supplied once.`)};
-    value[key] = next;
-  }
-  return {ok: true, value};
-}
-
-function invalid(command, message, nextActions = []) {
-  return failure(command, cliError("INVALID_ARGUMENT", {path: command, message, nextActions}));
-}
+import {cp, mkdir, readdir, readFile, stat, writeFile} from "node:fs/promises";
+import {dirname, resolve} from "node:path";
+import {fileURLToPath} from "node:url";
+
+import {cliError} from "./errors.js";
+import {failure, success} from "./output.js";
+
+const TEMPLATE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "templates", "web-app");
+const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const WINDOWS_DEVICE_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
+
+export async function handleApp(args, context = {}) {
+  const action = args[0];
+  if (action === "create") return createApp(args.slice(1), context);
+  if (action === "inspect") return inspectApp(args.slice(1));
+  return invalid("app", "App command is required.", ["finebi-cli app create --name <name> --path <parent>", "finebi-cli app inspect --path <project>"]);
+}
+
+export async function createApp(args, context = {}) {
+  const options = parseOptions(args, "app.create");
+  if (!options.ok) return options.error;
+  const {name, path: parentPath} = options.value;
+  if (!name || name.length > 214 || !NAME_PATTERN.test(name) || WINDOWS_DEVICE_NAME.test(name)) {
+    return invalid("app.create", "name must be a simple lowercase npm name (letters, digits, and single hyphens).", ["finebi-cli app create --name sales-dashboard --path <parent>"]);
+  }
+  if (!parentPath) {
+    return invalid("app.create", "path must be an existing parent directory.");
+  }
+  if (options.value.layout && !['overview','workbench','cockpit','retail'].includes(options.value.layout)) return invalid('app.create','layout must be overview, workbench, cockpit or retail.');
+  const parent = resolve(parentPath);
+  const destination = resolve(parent, name);
+  if (dirname(destination) !== parent) {
+    return invalid("app.create", "name must stay inside the selected parent directory.");
+  }
+  try {
+    if (!(await stat(parent)).isDirectory()) return invalid("app.create", "path must point to a directory.");
+  } catch (error) {
+    return invalid("app.create", error.code === "ENOENT" ? `Parent directory does not exist: ${parent}` : `Cannot inspect parent directory: ${error.message}`);
+  }
+  try {
+    const templateRoot = context.templateRoot ? resolve(context.templateRoot) : TEMPLATE_ROOT;
+    const templatePackage = JSON.parse(await readFile(resolve(templateRoot, "package.json"), "utf8"));
+    const templateConfigPath = resolve(templateRoot, "public", "app-config.json");
+    let config = {schemaVersion: "1", title: name, basePath: "/webroot/decision", layout: "overview", dashboardId: "", maxRows: 1000, pageSize: 8, widgets: [], filters: []};
+    try {
+      config = JSON.parse(await readFile(templateConfigPath, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    try {
+      await mkdir(destination, {recursive: false});
+    } catch (error) {
+      return invalid("app.create", error.code === "EEXIST" ? `Destination already exists: ${destination}` : `Cannot create destination: ${error.message}`);
+    }
+    await copyTemplateContents(templateRoot, destination);
+    if(options.value.layout) config.layout=options.value.layout;
+    if(config.layout==='cockpit') config.insights=true;
+    await mkdir(resolve(destination, "public"), {recursive: true});
+    await writeFile(resolve(destination, "package.json"), `${JSON.stringify({...templatePackage, name}, null, 2)}\n`, "utf8");
+    await writeFile(resolve(destination, "public", "app-config.json"), `${JSON.stringify({...config, templateVersion: templatePackage.version}, null, 2)}\n`, "utf8");
+    const lockPath = resolve(destination, "package-lock.json");
+    try {
+      const lock = JSON.parse(await readFile(lockPath, "utf8"));
+      lock.name = name;
+      if (lock.packages?.[""]) lock.packages[""].name = name;
+      await writeFile(lockPath, `${JSON.stringify(lock, null, 2)}\n`, "utf8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    return success("app.create", {name, path: destination, templateVersion: templatePackage.version});
+  } catch (error) {
+    return invalid("app.create", `Could not create project: ${error.message}`);
+  }
+}
+
+async function copyTemplateContents(sourceRoot, destinationRoot, relativeDirectory = "") {
+  const sourceDirectory = resolve(sourceRoot, relativeDirectory);
+  const destinationDirectory = resolve(destinationRoot, relativeDirectory);
+  for (const entry of (await readdir(sourceDirectory, {withFileTypes: true})).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
+    const relativePath = `${relativeDirectory}/${entry.name}`.replace(/^\//u, "");
+    if (!templatePathAllowed(relativePath)) continue;
+    const sourcePath = resolve(sourceDirectory, entry.name);
+    const destinationPath = resolve(destinationDirectory, entry.name);
+    if (entry.isDirectory()) {
+      await mkdir(destinationPath, {recursive: false});
+      await copyTemplateContents(sourceRoot, destinationRoot, relativePath);
+    } else if (entry.isFile()) {
+      await cp(sourcePath, destinationPath, {force: false, errorOnExist: true});
+    } else {
+      throw new Error(`Unsupported template entry: ${relativePath}`);
+    }
+  }
+}
+
+function templatePathAllowed(relative) {
+  const relativePath = relative.replaceAll("\\", "/");
+  const parts = relativePath.split("/").filter(Boolean);
+  const basename = parts.at(-1) || "";
+  return !parts.some(part => ["node_modules", "dist", "temp", ".git"].includes(part))
+    && basename !== ".env"
+    && (!basename.startsWith(".env.") || basename === ".env.example");
+}
+
+async function inspectApp(args) {
+  const options = parseOptions(args, "app.inspect");
+  if (!options.ok) return options.error;
+  const projectPath = options.value.path;
+  if (!projectPath) return invalid("app.inspect", "path must be a project directory.");
+  const project = resolve(projectPath);
+  try {
+    if (!(await stat(project)).isDirectory()) return invalid("app.inspect", "path must point to a project directory.");
+    const configPath = resolve(project, "public", "app-config.json");
+    const config = JSON.parse(await readFile(configPath, "utf8"));
+    if (!config || typeof config !== "object" || Array.isArray(config)) return invalid("app.inspect", "app-config.json must contain a JSON object.");
+    if (options.value.strict) {
+      const {configErrors}=await import('../templates/web-app/src/finebi/config.js');
+      const errors = configErrors(config);
+      if (errors.length) return failure("app.inspect", cliError("INVALID_ARGUMENT", {path: "public/app-config.json", message: errors.join(" ")}));
+    }
+    return success("app.inspect", {
+      path: project,
+      dashboardId: config.dashboardId ?? null,
+      layout: config.layout ?? null,
+      directoryEntryId: config.directoryEntryId || null,
+      widgets: Array.isArray(config.widgets) ? config.widgets.length : null,
+      templateVersion: config.templateVersion || null,
+      configValidated: options.value.strict === true,
+      remoteValidated: false,
+    });
+  } catch (error) {
+    return invalid("app.inspect", `Cannot read project configuration: ${error.message}`);
+  }
+}
+
+function parseOptions(args, command) {
+  const value = {};
+  for (let index = 0; index < args.length; index++) {
+    const option = args[index];
+    if (option === "--json") continue;
+    if (option === "--strict" && command === "app.inspect") {
+      if (value.strict) return {ok: false, error: invalid(command, "--strict must only be supplied once.")};
+      value.strict = true;
+      continue;
+    }
+    if (!["--name","--path",...(command==='app.create'?['--layout']:[])].includes(option)) return {ok: false, error: invalid(command, `Unsupported option: ${option}`)};
+    const key = option.slice(2);
+    const next = args[++index];
+    if (!next || next.startsWith("--")) return {ok: false, error: invalid(command, `${option} requires a value.`)};
+    if (value[key]) return {ok: false, error: invalid(command, `${option} must only be supplied once.`)};
+    value[key] = next;
+  }
+  return {ok: true, value};
+}
+
+function invalid(command, message, nextActions = []) {
+  return failure(command, cliError("INVALID_ARGUMENT", {path: command, message, nextActions}));
+}

package/src/browser-auth.js

@@ -160,9 +160,8 @@ function abortedAuthorization() {
 function validateBaseUrl(value) {
   try {
     const url = new URL(value);
-    const localHttp = url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]", "::1"].includes(url.hostname.toLowerCase());
-    if (url.protocol !== "https:" && !localHttp) {
-      throw new Error("Browser authorization requires HTTPS, except for localhost development.");
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+      throw new Error("Browser authorization requires an HTTP or HTTPS URL.");
     }
     if (url.username || url.password || url.search || url.hash) {
       throw new Error("Browser authorization base URL must not contain credentials, a query, or a fragment.");
@@ -172,7 +171,7 @@ function validateBaseUrl(value) {
     return failure("auth.login", cliError("BROWSER_AUTH_URL_INVALID", {
       path: "baseUrl",
       message: error instanceof Error ? error.message : String(error),
-      nextActions: ["finebi-cli config set base-url <https-url>"],
+      nextActions: ["finebi-cli config set base-url <http-or-https-url>"],
     }));
   }
 }