@getxflow/cli 0.0.1 → 0.1.1

package/dist/ui.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dim = exports.bold = void 0;
+exports.out = out;
+exports.note = note;
+exports.step = step;
+exports.ok = ok;
+exports.warn = warn;
+exports.fail = fail;
+exports.table = table;
+exports.formatBytes = formatBytes;
+exports.formatAge = formatAge;
+exports.confirmWord = confirmWord;
+const node_readline_1 = require("node:readline");
+/**
+ * Вывод CLI.
+ *
+ * Всё пишется через один модуль, а не через console: человек читает stdout,
+ * машина парсит его же, а служебные сообщения (шаги, предупреждения) обязаны
+ * уходить в stderr, иначе `xflow pull > file` сложит их в файл вместе с данными.
+ */
+const color = process.stdout.isTTY === true && !process.env.NO_COLOR;
+function paint(code, text) {
+    return color ? `\u001b[${code}m${text}\u001b[0m` : text;
+}
+const bold = (t) => paint('1', t);
+exports.bold = bold;
+const dim = (t) => paint('2', t);
+exports.dim = dim;
+const red = (t) => paint('31', t);
+const green = (t) => paint('32', t);
+const yellow = (t) => paint('33', t);
+/** Данные: то, ради чего команду запускали. */
+function out(line = '') {
+    process.stdout.write(`${line}\n`);
+}
+/** Ход работы: шаги, предупреждения, ошибки. */
+function note(line = '') {
+    process.stderr.write(`${line}\n`);
+}
+function step(message) {
+    note((0, exports.dim)(`→ ${message}`));
+}
+function ok(message) {
+    note(green(`✓ ${message}`));
+}
+function warn(message) {
+    note(yellow(`! ${message}`));
+}
+function fail(message) {
+    note(red(`✗ ${message}`));
+}
+/** Таблица с выравниванием по колонкам. Заголовок не рисуем: он не нужен на 3 строки. */
+function table(rows) {
+    if (rows.length === 0)
+        return;
+    const widths = [];
+    for (const row of rows) {
+        row.forEach((cell, i) => {
+            widths[i] = Math.max(widths[i] ?? 0, cell.length);
+        });
+    }
+    for (const row of rows) {
+        out(row.map((cell, i) => (i === row.length - 1 ? cell : cell.padEnd(widths[i]))).join('  '));
+    }
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} Б`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} КБ`;
+    return `${(bytes / 1024 / 1024).toFixed(1)} МБ`;
+}
+function formatAge(iso) {
+    if (!iso)
+        return '—';
+    const ms = Date.now() - new Date(iso).getTime();
+    if (!Number.isFinite(ms) || ms < 0)
+        return '—';
+    const minutes = Math.floor(ms / 60000);
+    if (minutes < 1)
+        return 'только что';
+    if (minutes < 60)
+        return `${minutes} мин назад`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours} ч назад`;
+    return `${Math.floor(hours / 24)} дн назад`;
+}
+/**
+ * Подтверждение опасного действия.
+ *
+ * Требуем ввести конкретное слово, а не «y»: `--force` перетирает чужую работу,
+ * и подтверждение должно стоить осознанного действия. В неинтерактивном режиме
+ * (CI, запуск из агента) подтвердить нельзя вовсе — это сознательно (D23).
+ */
+async function confirmWord(question, expected) {
+    if (!process.stdin.isTTY) {
+        fail('Подтверждение возможно только в интерактивном терминале');
+        note((0, exports.dim)('  В CI это правильное поведение: расхождение версий должно ронять сборку, а не перетирать чужую работу'));
+        return false;
+    }
+    const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question(`${question}\n  Введите «${expected}» для подтверждения: `, resolve);
+        });
+        return answer.trim() === expected;
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/version.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
+/**
+ * Версия CLI. Держать синхронно с cli/package.json: читать package.json в
+ * рантайме нельзя, после сборки он лежит на уровень выше dist и в бандл не
+ * попадает.
+ */
+exports.CLI_VERSION = '0.1.1';
+/** Адрес платформы по умолчанию. Переопределяется XFLOW_API_URL и полем `api` в xflow.json. */
+exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/dist/zip.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZipError = void 0;
+exports.zipCreate = zipCreate;
+exports.zipRead = zipRead;
+const node_zlib_1 = require("node:zlib");
+class ZipError extends Error {
+}
+exports.ZipError = ZipError;
+const LOCAL_SIG = 0x04034b50;
+const CENTRAL_SIG = 0x02014b50;
+const EOCD_SIG = 0x06054b50;
+/** Флаг «имена в UTF-8»: без него кириллица в путях читается как мохибейк. */
+const FLAG_UTF8 = 0x0800;
+/** 1980-01-01 в формате DOS: время сборки в архив не пишем, чтобы он был воспроизводим. */
+const DOS_DATE = 0x0021;
+const DOS_TIME = 0x0000;
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let i = 0; i < 256; i++) {
+        let c = i;
+        for (let k = 0; k < 8; k++) {
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        }
+        table[i] = c >>> 0;
+    }
+    return table;
+})();
+function crc32(data) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < data.length; i++) {
+        crc = CRC_TABLE[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function u16(value) {
+    const buffer = Buffer.alloc(2);
+    buffer.writeUInt16LE(value);
+    return buffer;
+}
+function u32(value) {
+    const buffer = Buffer.alloc(4);
+    buffer.writeUInt32LE(value >>> 0);
+    return buffer;
+}
+function zipCreate(entries) {
+    const locals = [];
+    const centrals = [];
+    let offset = 0;
+    // Порядок фиксируем: одно и то же дерево должно давать один и тот же архив.
+    const sorted = [...entries].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    for (const entry of sorted) {
+        const name = Buffer.from(entry.path, 'utf-8');
+        const crc = crc32(entry.content);
+        // Сжимаем, но только если это что-то даёт: у уже сжатых файлов (png, zip)
+        // deflate добавляет байты, и хранение как есть честнее.
+        const deflated = (0, node_zlib_1.deflateRawSync)(entry.content, { level: 6 });
+        const compressed = deflated.length < entry.content.length;
+        const method = compressed ? 8 : 0;
+        const payload = compressed ? deflated : entry.content;
+        const local = Buffer.concat([
+            u32(LOCAL_SIG),
+            u16(20),
+            u16(FLAG_UTF8),
+            u16(method),
+            u16(DOS_TIME),
+            u16(DOS_DATE),
+            u32(crc),
+            u32(payload.length),
+            u32(entry.content.length),
+            u16(name.length),
+            u16(0),
+            name,
+            payload,
+        ]);
+        locals.push(local);
+        centrals.push(Buffer.concat([
+            u32(CENTRAL_SIG),
+            u16(20),
+            u16(20),
+            u16(FLAG_UTF8),
+            u16(method),
+            u16(DOS_TIME),
+            u16(DOS_DATE),
+            u32(crc),
+            u32(payload.length),
+            u32(entry.content.length),
+            u16(name.length),
+            u16(0),
+            u16(0),
+            u16(0),
+            u16(0),
+            u32(0),
+            u32(offset),
+            name,
+        ]));
+        offset += local.length;
+    }
+    const central = Buffer.concat(centrals);
+    const eocd = Buffer.concat([
+        u32(EOCD_SIG),
+        u16(0),
+        u16(0),
+        u16(sorted.length),
+        u16(sorted.length),
+        u32(central.length),
+        u32(offset),
+        u16(0),
+    ]);
+    return Buffer.concat([...locals, central, eocd]);
+}
+function findEocd(buffer) {
+    // Комментарий архива может занимать до 64 КБ, поэтому ищем сигнатуру с конца.
+    const from = Math.max(0, buffer.length - 66_000);
+    for (let i = buffer.length - 22; i >= from; i--) {
+        if (buffer.readUInt32LE(i) === EOCD_SIG)
+            return i;
+    }
+    return -1;
+}
+function zipRead(buffer) {
+    if (buffer.length < 22)
+        throw new ZipError('Файл слишком мал для zip');
+    const eocd = findEocd(buffer);
+    if (eocd === -1)
+        throw new ZipError('Это не zip: не найден конец архива');
+    const count = buffer.readUInt16LE(eocd + 10);
+    let pointer = buffer.readUInt32LE(eocd + 16);
+    const entries = [];
+    for (let i = 0; i < count; i++) {
+        if (pointer + 46 > buffer.length || buffer.readUInt32LE(pointer) !== CENTRAL_SIG) {
+            throw new ZipError('Повреждён оглавление архива');
+        }
+        const method = buffer.readUInt16LE(pointer + 10);
+        const compressedSize = buffer.readUInt32LE(pointer + 20);
+        const uncompressedSize = buffer.readUInt32LE(pointer + 24);
+        const nameLength = buffer.readUInt16LE(pointer + 28);
+        const extraLength = buffer.readUInt16LE(pointer + 30);
+        const commentLength = buffer.readUInt16LE(pointer + 32);
+        const localOffset = buffer.readUInt32LE(pointer + 42);
+        const name = buffer.toString('utf-8', pointer + 46, pointer + 46 + nameLength);
+        pointer += 46 + nameLength + extraLength + commentLength;
+        if (name.endsWith('/'))
+            continue;
+        if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff) {
+            throw new ZipError(`Архив в формате zip64 не поддерживается: ${name}`);
+        }
+        if (buffer.readUInt32LE(localOffset) !== LOCAL_SIG) {
+            throw new ZipError(`Повреждена запись архива: ${name}`);
+        }
+        const localNameLength = buffer.readUInt16LE(localOffset + 26);
+        const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+        const dataStart = localOffset + 30 + localNameLength + localExtraLength;
+        const raw = buffer.subarray(dataStart, dataStart + compressedSize);
+        let content;
+        if (method === 0) {
+            content = Buffer.from(raw);
+        }
+        else if (method === 8) {
+            try {
+                content = (0, node_zlib_1.inflateRawSync)(raw);
+            }
+            catch (e) {
+                throw new ZipError(`Не удалось распаковать ${name}: ${e instanceof Error ? e.message : e}`);
+            }
+        }
+        else {
+            throw new ZipError(`Неизвестный метод сжатия (${method}) у ${name}`);
+        }
+        entries.push({ path: name.replace(/\\/g, '/'), content });
+    }
+    return entries;
+}

package/package.json

@@ -1,27 +1,22 @@
-{
-  "name": "@getxflow/cli",
-  "version": "0.0.1",
-  "description": "XFlow CLI — аналитика кабинетов маркетплейсов для вашего агента",
-  "keywords": [
-    "wildberries",
-    "marketplace",
-    "analytics",
-    "mcp",
-    "cli"
-  ],
-  "license": "UNLICENSED",
-  "type": "module",
-  "bin": {
-    "xflow": "index.js"
-  },
-  "files": [
-    "index.js",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=24"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@getxflow/cli",
+  "version": "0.1.1",
+  "description": "CLI платформы XFlow: синхронизация кода, деплой и публикация приложений",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "xflow": "dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "skills"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/skills/xflow/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: xflow
+description: Build, deploy and publish apps on the XFlow platform with the xflow CLI. Use when the project root has xflow.json or VITE_XFLOW_* variables, when asked to deploy, publish, roll back a version, sync sources with the platform, look into errors from a deployed app, or build UI on the platform design system.
+---
+
+# XFlow
+
+Hosting for web apps. The code lives in an ordinary repository on the developer
+machine and is built locally; the platform takes the finished build and serves it.
+A platform project is recognized by the `xflow.json` file in its root.
+
+## First rule
+
+Check commands and flags against `xflow help` and `xflow help <command>`, not against
+memory. If a command is not in the help output, it does not exist: guessing flags is
+pointless. The CLI prints a hint with almost every error, read it in full, it usually
+contains the fix. Help output is in Russian.
+
+## Workflow
+
+1. Change the code.
+2. `npm run typecheck` for a two-second type check (older projects may not have the
+   script, then `npx tsc --noEmit`).
+3. `npm run build` if the change is substantial, before deploying.
+4. `xflow deploy` sends the sources, builds locally, uploads the version. It prints
+   a URL: that is the dev address, visible to the team, not to visitors.
+5. Open and check it: the URL from the output, or `xflow open`.
+6. `xflow publish` makes that same version visible to visitors.
+
+The split is deliberate: shipping a build and showing it are two separate decisions.
+Until `publish` runs, visitors keep seeing the previous version.
+
+Rolling back: `xflow deployments` lists the version history, `xflow rollback <id>`
+points the dev address back at an earlier build. Sources stay on their own revision.
+
+The build runs on the developer machine. The platform has no builder, it serves
+static files: a build without `index.html` in the root is rejected.
+
+## Cloud functions
+
+Server-side code lives in `functions/<name>/index.ts` and exports `handler`. Deploy it
+with `xflow functions deploy` (one name to deploy a single function, no name for all),
+list what is live with `xflow functions list`. The handler returns
+`{ statusCode, body }` where `body` is a JSON string.
+
+Debugging a deployed function is two commands: `xflow functions invoke <name>` calls it
+the way the app does and prints status, timing and body (`--data '{"a":1}'` sends a body),
+and `xflow functions logs <name>` shows the failures, each with its stack and the console
+output of that call. Only failed calls are logged, so an empty output means the function
+never crashed, not that logging is broken.
+
+Calls from the app must carry the `X-Project-Token` header; the token is already in
+the app environment as `VITE_XFLOW_PROJECT_TOKEN`. Treat a function as a public API:
+that token ships inside the frontend bundle.
+
+Organization secrets reach a function only if it mentions them via `process.env`, so
+read them by name and do not build variable names dynamically.
+
+## Syncing code
+
+`xflow status` shows how the local copy differs from the server revision.
+`xflow push` sends sources, `xflow pull` fetches them.
+
+If a push is rejected, the server revision is newer, meaning someone pushed first.
+Fetch their work next to yours (`xflow pull --into ./server-copy`), merge it locally,
+then push again. `--force` destroys their work: a last resort, not a way around the
+error.
+
+## Do not
+
+- Edit `xflow.json` by hand: the CLI writes it.
+- Commit `.env`: it holds the project token.
+- Push with `--force` without checking `xflow status` first.
+- Invent platform commands: what is not in `xflow help` does not exist.
+
+## App design
+
+The platform design system already ships inside the project, and the app is supposed
+to look like a part of the platform:
+
+- `src/components/ui` for primitives: buttons, inputs, dialogs, tables, menus
+- `src/components/blocks` for composed blocks: `data-table`, `entity-form`,
+  `filter-bar`, `detail-panel`, `kanban`, `charts`, `user-picker`, `relation-picker`
+- `src/index.css` for color tokens
+
+Before writing your own component, check whether a block already covers it: props are
+typed next to each block, larger ones keep a separate `types.ts`. Take colors from
+tokens (`bg-card`, `text-muted-foreground`, `bg-success-soft` and the like). A custom
+hex palette makes the app look foreign inside the platform, which is the whole reason
+the design system sits in the project.
+
+The app runs inside the platform in an iframe and receives the theme and the current
+user from it. The `usePlatformAuth()` hook gives the name, role, permissions and the
+list of organization members: that is what `user-picker` is built on.
+
+## Errors from a deployed app
+
+`xflow logs` prints what broke in the browser on deployed addresses: unhandled errors,
+rejected promises and 5xx responses. The same stream, functions included, is in the
+platform UI: open the project, section «Облако» (Cloud), tab «Логи» (Logs). The last 200
+records per project are kept.
+
+Local `npm run dev` does not report anything: these logs exist for what you cannot open
+in your own devtools.
+
+## Environment
+
+`VITE_XFLOW_PROJECT_TOKEN` and `VITE_XFLOW_API_URL` are written by the CLI when the
+project is created, there is no need to edit them by hand. For CI and agent runs:
+`XFLOW_TOKEN` replaces `xflow login`, `XFLOW_API_URL` points at another platform host.

package/index.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-console.log('XFlow CLI — в разработке.');