@qmuse/qmuse-cli 1.0.3-dev.0 → 1.0.3-dev.2

package/README.md

@@ -95,17 +95,11 @@ qmuse dev . --port 5173
 
 CLI 获取服务端解析的公开云配置，复用 Vite 的 `MUSE_RUNTIME_CONFIG_PATH` 注入机制。配置放在系统临时目录，退出时删除。Token 按需获取且不落盘，CLI 登录凭据不交给页面。数据库、文件和函数请求由浏览器通过用户 Session 直接访问云端，不使用管理 API Key 或 Dev Key。
 
-新版云服务资产已接入适配。旧项目在 `src/services/appwrite.ts` 的 `createQmuseAppwriteRuntime({ ... })` 参数中增加：
-
-```ts
-fetch: import.meta.env.DEV
-  ? (window as Window & {
-      __QMUSE_LOCAL_DEV__?: { fetch: typeof globalThis.fetch };
-    }).__QMUSE_LOCAL_DEV__?.fetch
-  : undefined,
-```
+CLI 将本地 Runtime 的 `__MUSE__.domain` 设置为实际监听地址（如 `http://127.0.0.1:5173`），保留真实的 `appwrite.endpoint`。SDK 使用默认 fetch，将配置、Token 和操作上报发往本地三个固定接口，由 CLI 处理或转发；数据库、文件、函数仍直连云端。接口仅接受同源 JSON POST，并校验 Host、Fetch Metadata 和应用绑定。
+
+不解析或改写业务源码，不注入自定义 fetch，不要求固定服务文件路径，也无需修改或发布 qmuse-cloud、Runtime SDK。已下载的模板使用原版云服务资产即可。普通开发和生产构建使用原有配置。其他自行基于 `__MUSE__.domain` 拼接的平台 API 不会被通用转发，需要单独确认接入方式。
 
-不修改 SDK。只有 `qmuse dev` 注入本地 fetch；普通 `npm run dev` 和线上运行继续使用默认行为。生产构建移除本地适配分支。服务端必须先部署 `/api/appwrite/local-dev/context` 和 `/api/appwrite/local-dev/mutation-events`；缺少接口时不会降级为模拟云服务。
+服务端必须先部署 `/api/appwrite/local-dev/context` 和 `/api/appwrite/local-dev/mutation-events`，再发布并安装新版 CLI；缺少接口时不会降级为模拟云服务。
 
 页面改动热更新，Schema/函数改动继续执行 `qmuse import .`。导入更新本地绑定后，连接会重新获取配置并刷新页面。切换登录账号或应用绑定需重启连接；退出 CLI 不会自动撤销浏览器已经建立的 AppBase Session。SDK 的匿名降级行为保持不变，验收必须检查实际 Session 用户，不能只看页面是否显示。
 

package/dist/dev/context.js

@@ -53,14 +53,14 @@ export async function loadDevContext(root, cfg, environment) {
         throw new Error(`获取开发连接失败：${result.errorMessage || result.errorCode || `HTTP ${result.status}`}`);
     return parseDevContext(result.data, project.target.appId);
 }
-export function browserRuntime(context) {
+export function browserRuntime(context, localOrigin) {
     return {
         __MUSE__: {
             appId: context.appId,
             yfdAppId: context.appId,
             appVersionId: context.appVersionId,
             env: context.env,
-            domain: context.domain,
+            domain: localOrigin,
             appwrite: context.appwrite,
         },
         __TERN__: {

package/dist/dev/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { watchFile, unwatchFile } from 'node:fs';
-import { mkdtemp, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, realpath, rename, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -22,10 +22,6 @@ export async function startDevelopment(options) {
     const project = await loadManagedProject(root, options.cfg, options.environment);
     if (!project?.target)
         throw new Error('请先执行 qmuse import . 并等待云服务 READY，再启动本地联调');
-    const serviceFile = await readFile(path.join(root, 'src/services/appwrite.ts'), 'utf8').catch(() => '');
-    if (!serviceFile.includes('__QMUSE_LOCAL_DEV__')) {
-        throw new Error('项目尚未接入本地适配：请按最新版云服务资产在 src/services/appwrite.ts 的 Runtime options 中传入本地 fetch（见 qmuse-cli README）');
-    }
     const context = await loadDevContext(root, options.cfg, options.environment);
     const directory = await mkdtemp(path.join(tmpdir(), 'qmuse-local-dev-'));
     const runtimePath = path.join(directory, 'runtime.json');
@@ -35,8 +31,9 @@ export async function startDevelopment(options) {
     const manifestPath = path.join(root, '.qmuse/project.json');
     let refresh;
     let refreshRequested = false;
+    let localOrigin = 'http://127.0.0.1:0';
     const writeRuntime = async () => {
-        await writeFile(`${runtimePath}.next`, JSON.stringify(browserRuntime(context)), { mode: 0o600 });
+        await writeFile(`${runtimePath}.next`, JSON.stringify(browserRuntime(context, localOrigin)), { mode: 0o600 });
         await rename(`${runtimePath}.next`, runtimePath);
     };
     const currentConfig = () => {
@@ -95,6 +92,11 @@ export async function startDevelopment(options) {
             throw new Error('项目需要支持 runtime config 注入的 @qmuse/vite-config');
         }
         await server.listen();
+        const address = server.httpServer?.address();
+        if (!address || typeof address === 'string')
+            throw new Error('无法获取本地开发服务端口');
+        localOrigin = `http://127.0.0.1:${address.port}`;
+        await writeRuntime();
         watchFile(manifestPath, { interval: 1000 }, (current, previous) => {
             if (closed || current.mtimeMs === previous.mtimeMs)
                 return;

package/dist/dev/plugin.js

@@ -1,6 +1,3 @@
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-const PREFIX = '/__qmuse/local-dev/';
-const TOKEN_HEADER = 'x-qmuse-local-connection';
 const BODY_LIMIT = 64 * 1024;
 const ROUTES = {
     '/runtime/appwrite/config': 'config',
@@ -26,35 +23,7 @@ async function readBody(req) {
         throw new Error('Invalid JSON object');
     return value;
 }
-export function bridgeSource(context, connection) {
-    const settings = JSON.stringify({ domain: context.domain, routes: ROUTES, prefix: PREFIX, connection, header: TOKEN_HEADER })
-        .replace(/</gu, '\\u003c');
-    return `(() => {
-    const settings = ${settings};
-    const nativeFetch = window.fetch.bind(window);
-    window.__QMUSE_LOCAL_DEV__ = {
-      protocolVersion: 1,
-      async fetch(input, init) {
-        const url = new URL(input instanceof Request ? input.url : String(input), location.href);
-        const base = new URL(settings.domain);
-        const relativePath = url.pathname.slice(base.pathname.replace(/\\/$/, '').length);
-        const route = url.origin === base.origin && url.pathname.startsWith(base.pathname.replace(/\\/$/, '') + '/')
-          ? settings.routes[relativePath] : undefined;
-        if (!route) return nativeFetch(input, init);
-        const request = new Request(input, init);
-        const headers = new Headers(request.headers);
-        headers.set(settings.header, settings.connection);
-        return nativeFetch(settings.prefix + route, {
-          method: request.method, headers,
-          body: request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.text(),
-          credentials: 'same-origin', signal: request.signal, keepalive: request.keepalive
-        });
-      }
-    };
-  })();`;
-}
 export function localDevPlugin(options) {
-    const connection = randomBytes(32).toString('hex');
     let server;
     return {
         name: 'qmuse-local-dev',
@@ -73,37 +42,35 @@ export function localDevPlugin(options) {
                     return;
                 }
                 const url = new URL(req.url || '/', origin);
-                if (!url.pathname.startsWith(PREFIX)) {
-                    next();
+                if (!Object.hasOwn(ROUTES, url.pathname)) {
+                    if (url.pathname.startsWith('/runtime/') || url.pathname.startsWith('/api/runtime/')) {
+                        respond(res, 404, { success: false, message: 'Unknown local operation' });
+                    }
+                    else
+                        next();
+                    return;
+                }
+                // Browser requests must be same-origin JSON; CLI credentials stay on the server.
+                if (req.headers.origin !== origin) {
+                    respond(res, 403, { success: false, message: 'Invalid local development origin' });
                     return;
                 }
-                if (url.pathname === `${PREFIX}bootstrap.js` && req.method === 'GET') {
-                    res.writeHead(200, { 'Content-Type': 'text/javascript', 'Cache-Control': 'no-store', 'Cross-Origin-Resource-Policy': 'same-origin' });
-                    res.end(bridgeSource(options.context, connection));
+                if (req.method !== 'POST') {
+                    respond(res, 405, { success: false, message: 'POST required' });
                     return;
                 }
-                const provided = req.headers[TOKEN_HEADER];
-                if (req.method !== 'POST' || typeof provided !== 'string' || Buffer.byteLength(provided) !== Buffer.byteLength(connection) ||
-                    !timingSafeEqual(Buffer.from(provided), Buffer.from(connection))) {
-                    respond(res, 403, { success: false, message: 'Invalid local connection' });
+                if (req.headers['content-type']?.split(';')[0].trim().toLowerCase() !== 'application/json') {
+                    respond(res, 415, { success: false, message: 'JSON required' });
                     return;
                 }
-                void handle(url.pathname.slice(PREFIX.length), req, res).catch(() => {
+                void handle(ROUTES[url.pathname], req, res).catch(() => {
                     if (!res.headersSent)
                         respond(res, 400, { success: false, message: 'Invalid local development request' });
                 });
             });
         },
-        transformIndexHtml: {
-            order: 'pre',
-            handler: () => [{ tag: 'script', attrs: { src: `${PREFIX}bootstrap.js` }, injectTo: 'head-prepend' }],
-        },
     };
     async function handle(route, req, res) {
-        if (!['config', 'token', 'mutation-events'].includes(route)) {
-            respond(res, 404, { success: false, message: 'Unknown local operation' });
-            return;
-        }
         const body = await readBody(req);
         const context = options.context;
         if (body.appId !== context.appId || (body.env !== undefined && body.env !== 'dev') ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qmuse/qmuse-cli",
-  "version": "1.0.3-dev.0",
+  "version": "1.0.3-dev.2",
   "description": "将本地 React 项目安全导入 QMuse 的命令行客户端",
   "type": "module",
   "bin": {