@qmuse/qmuse-cli 1.0.3-dev.1 → 1.0.3-dev.3

package/README.md

@@ -95,9 +95,11 @@ qmuse dev . --port 5173
 
 CLI 获取服务端解析的公开云配置，复用 Vite 的 `MUSE_RUNTIME_CONFIG_PATH` 注入机制。配置放在系统临时目录，退出时删除。Token 按需获取且不落盘，CLI 登录凭据不交给页面。数据库、文件和函数请求由浏览器通过用户 Session 直接访问云端，不使用管理 API Key 或 Dev Key。
 
-CLI 的 Vite 插件在加载 `src/services/appwrite.ts` 时，通过语法解析为 Runtime 初始化自动注入本地 fetch，不写回项目文件。原版云服务资产和已下载的模板无需手工添加适配，也无需发布 qmuse-cloud 或修改 SDK。支持从 SDK 命名导入（含别名），在顶层使用对象参数初始化一次；不支持的写法在启动或热更新时明确报错。开发时 Runtime 的 fetch 由 CLI 接管，包括对象中已有的自定义 fetch。
+CLI 将本地 Runtime 的 `__MUSE__.domain` 设置为实际监听地址（如 `http://127.0.0.1:5173`），保留真实的 `appwrite.endpoint`。SDK 使用默认 fetch，将配置、Token 和操作上报发往本地三个固定接口，由 CLI 处理或转发；数据库、文件、函数仍直连云端。接口仅接受同源 JSON POST，并校验 Host、Fetch Metadata 和应用绑定。
 
-只有 `qmuse dev` 启用该插件；普通 `npm run dev` 和生产构建继续使用原始源码。服务端必须先部署 `/api/appwrite/local-dev/context` 和 `/api/appwrite/local-dev/mutation-events`，再发布并安装新版 CLI；缺少接口时不会降级为模拟云服务。
+不解析或改写业务源码，不注入自定义 fetch，不要求固定服务文件路径，也无需修改或发布 qmuse-cloud、Runtime SDK。已下载的模板使用原版云服务资产即可。普通开发和生产构建使用原有配置。其他自行基于 `__MUSE__.domain` 拼接的平台 API 不会被通用转发，需要单独确认接入方式。
+
+服务端必须先部署 `/api/appwrite/local-dev/context` 和 `/api/appwrite/local-dev/mutation-events`，再发布并安装新版 CLI；缺少接口时不会降级为模拟云服务。
 
 页面改动热更新，Schema/函数改动继续执行 `qmuse import .`。导入更新本地绑定后，连接会重新获取配置并刷新页面。切换登录账号或应用绑定需重启连接；退出 CLI 不会自动撤销浏览器已经建立的 AppBase Session。SDK 的匿名降级行为保持不变，验收必须检查实际 Session 用户，不能只看页面是否显示。
 

package/dist/dev/context.js

@@ -53,14 +53,14 @@ export async function loadDevContext(root, cfg, environment) {
         throw new Error(`获取开发连接失败：${result.errorMessage || result.errorCode || `HTTP ${result.status}`}`);
     return parseDevContext(result.data, project.target.appId);
 }
-export function browserRuntime(context) {
+export function browserRuntime(context, localOrigin) {
     return {
         __MUSE__: {
             appId: context.appId,
             yfdAppId: context.appId,
             appVersionId: context.appVersionId,
             env: context.env,
-            domain: context.domain,
+            domain: localOrigin,
             appwrite: context.appwrite,
         },
         __TERN__: {

package/dist/dev/index.js

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
 import { watchFile, unwatchFile } from 'node:fs';
-import { mkdtemp, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, realpath, rename, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -9,7 +9,6 @@ import { loadConfig } from '../config.js';
 import { loadManagedProject } from '../import/project.js';
 import { browserRuntime, loadDevContext } from './context.js';
 import { localDevPlugin } from './plugin.js';
-import { injectLocalRuntimeFetch } from './transform.js';
 export async function startDevelopment(options) {
     const root = await realpath(path.resolve(options.root));
     const require = createRequire(path.join(root, 'package.json'));
@@ -23,8 +22,6 @@ export async function startDevelopment(options) {
     const project = await loadManagedProject(root, options.cfg, options.environment);
     if (!project?.target)
         throw new Error('请先执行 qmuse import . 并等待云服务 READY，再启动本地联调');
-    const serviceFile = await readFile(path.join(root, 'src/services/appwrite.ts'), 'utf8').catch(() => '');
-    injectLocalRuntimeFetch(serviceFile, path.join(root, 'src/services/appwrite.ts'));
     const context = await loadDevContext(root, options.cfg, options.environment);
     const directory = await mkdtemp(path.join(tmpdir(), 'qmuse-local-dev-'));
     const runtimePath = path.join(directory, 'runtime.json');
@@ -34,8 +31,9 @@ export async function startDevelopment(options) {
     const manifestPath = path.join(root, '.qmuse/project.json');
     let refresh;
     let refreshRequested = false;
+    let localOrigin = 'http://127.0.0.1:0';
     const writeRuntime = async () => {
-        await writeFile(`${runtimePath}.next`, JSON.stringify(browserRuntime(context)), { mode: 0o600 });
+        await writeFile(`${runtimePath}.next`, JSON.stringify(browserRuntime(context, localOrigin)), { mode: 0o600 });
         await rename(`${runtimePath}.next`, runtimePath);
     };
     const currentConfig = () => {
@@ -94,6 +92,11 @@ export async function startDevelopment(options) {
             throw new Error('项目需要支持 runtime config 注入的 @qmuse/vite-config');
         }
         await server.listen();
+        const address = server.httpServer?.address();
+        if (!address || typeof address === 'string')
+            throw new Error('无法获取本地开发服务端口');
+        localOrigin = `http://127.0.0.1:${address.port}`;
+        await writeRuntime();
         watchFile(manifestPath, { interval: 1000 }, (current, previous) => {
             if (closed || current.mtimeMs === previous.mtimeMs)
                 return;

package/dist/dev/plugin.js

@@ -1,8 +1,3 @@
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-import path from 'node:path';
-import { injectLocalRuntimeFetch } from './transform.js';
-const PREFIX = '/__qmuse/local-dev/';
-const TOKEN_HEADER = 'x-qmuse-local-connection';
 const BODY_LIMIT = 64 * 1024;
 const ROUTES = {
     '/runtime/appwrite/config': 'config',
@@ -28,49 +23,12 @@ async function readBody(req) {
         throw new Error('Invalid JSON object');
     return value;
 }
-export function bridgeSource(context, connection) {
-    const settings = JSON.stringify({ domain: context.domain, routes: ROUTES, prefix: PREFIX, connection, header: TOKEN_HEADER })
-        .replace(/</gu, '\\u003c');
-    return `(() => {
-    const settings = ${settings};
-    const nativeFetch = window.fetch.bind(window);
-    window.__QMUSE_LOCAL_DEV__ = {
-      protocolVersion: 1,
-      async fetch(input, init) {
-        const url = new URL(input instanceof Request ? input.url : String(input), location.href);
-        const base = new URL(settings.domain);
-        const relativePath = url.pathname.slice(base.pathname.replace(/\\/$/, '').length);
-        const route = url.origin === base.origin && url.pathname.startsWith(base.pathname.replace(/\\/$/, '') + '/')
-          ? settings.routes[relativePath] : undefined;
-        if (!route) return nativeFetch(input, init);
-        const request = new Request(input, init);
-        const headers = new Headers(request.headers);
-        headers.set(settings.header, settings.connection);
-        return nativeFetch(settings.prefix + route, {
-          method: request.method, headers,
-          body: request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.text(),
-          credentials: 'same-origin', signal: request.signal, keepalive: request.keepalive
-        });
-      }
-    };
-  })();`;
-}
 export function localDevPlugin(options) {
-    const connection = randomBytes(32).toString('hex');
     let server;
-    let servicePath;
     return {
         name: 'qmuse-local-dev',
         apply: 'serve',
         enforce: 'pre',
-        configResolved(config) {
-            servicePath = path.resolve(config.root, 'src/services/appwrite.ts');
-        },
-        transform(code, id) {
-            if (id.split('?')[0] !== servicePath)
-                return;
-            return injectLocalRuntimeFetch(code, servicePath);
-        },
         configureServer(vite) {
             server = vite;
             server.middlewares.use((req, res, next) => {
@@ -84,37 +42,35 @@ export function localDevPlugin(options) {
                     return;
                 }
                 const url = new URL(req.url || '/', origin);
-                if (!url.pathname.startsWith(PREFIX)) {
-                    next();
+                if (!Object.hasOwn(ROUTES, url.pathname)) {
+                    if (url.pathname.startsWith('/runtime/') || url.pathname.startsWith('/api/runtime/')) {
+                        respond(res, 404, { success: false, message: 'Unknown local operation' });
+                    }
+                    else
+                        next();
                     return;
                 }
-                if (url.pathname === `${PREFIX}bootstrap.js` && req.method === 'GET') {
-                    res.writeHead(200, { 'Content-Type': 'text/javascript', 'Cache-Control': 'no-store', 'Cross-Origin-Resource-Policy': 'same-origin' });
-                    res.end(bridgeSource(options.context, connection));
+                // Browser requests must be same-origin JSON; CLI credentials stay on the server.
+                if (req.headers.origin !== origin) {
+                    respond(res, 403, { success: false, message: 'Invalid local development origin' });
                     return;
                 }
-                const provided = req.headers[TOKEN_HEADER];
-                if (req.method !== 'POST' || typeof provided !== 'string' || Buffer.byteLength(provided) !== Buffer.byteLength(connection) ||
-                    !timingSafeEqual(Buffer.from(provided), Buffer.from(connection))) {
-                    respond(res, 403, { success: false, message: 'Invalid local connection' });
+                if (req.method !== 'POST') {
+                    respond(res, 405, { success: false, message: 'POST required' });
                     return;
                 }
-                void handle(url.pathname.slice(PREFIX.length), req, res).catch(() => {
+                if (req.headers['content-type']?.split(';')[0].trim().toLowerCase() !== 'application/json') {
+                    respond(res, 415, { success: false, message: 'JSON required' });
+                    return;
+                }
+                void handle(ROUTES[url.pathname], req, res).catch(() => {
                     if (!res.headersSent)
                         respond(res, 400, { success: false, message: 'Invalid local development request' });
                 });
             });
         },
-        transformIndexHtml: {
-            order: 'pre',
-            handler: () => [{ tag: 'script', attrs: { src: `${PREFIX}bootstrap.js` }, injectTo: 'head-prepend' }],
-        },
     };
     async function handle(route, req, res) {
-        if (!['config', 'token', 'mutation-events'].includes(route)) {
-            respond(res, 404, { success: false, message: 'Unknown local operation' });
-            return;
-        }
         const body = await readBody(req);
         const context = options.context;
         if (body.appId !== context.appId || (body.env !== undefined && body.env !== 'dev') ||

package/dist/import/api.js

@@ -1,7 +1,9 @@
 import { openAsBlob } from 'node:fs';
 import { apiCall, authHeaders, buildUrl, requestSourceHeaders, } from '../client.js';
+import { assertImportArchiveSize } from './limits.js';
 export async function uploadImportArchive(input, cfg) {
     const archive = await openAsBlob(input.filePath, { type: 'application/zip' });
+    assertImportArchiveSize(archive.size);
     const headers = authHeaders(cfg);
     headers['Content-Type'] = 'application/zip';
     headers['Content-Length'] = String(archive.size);
@@ -18,15 +20,37 @@ export async function uploadImportArchive(input, cfg) {
     catch (error) {
         throw new Error(`上传源码失败：${error instanceof Error ? error.message : String(error)}`);
     }
-    let result;
+    const contentType = response.headers.get('content-type')?.split(';')[0].trim();
+    const traceId = response.headers.get('x-trace-id') ?? response.headers.get('trace-id');
+    const details = [
+        `HTTP ${response.status}`,
+        `源码包 ${(archive.size / 1024 / 1024).toFixed(2)} MiB（${archive.size} 字节）`,
+        contentType && /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/iu.test(contentType)
+            ? `响应类型 ${contentType}` : undefined,
+        traceId && /^[a-z0-9_-]{1,128}$/iu.test(traceId) ? `traceId=${traceId}` : undefined,
+    ].filter(Boolean).join('，');
+    if (response.status === 413) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`上传源码失败：源码包超过上传入口大小限制（${details}）。请将不参与运行的生成产物加入 .gitignore 后重试；如需上传完整源码包，请联系平台核对上传限制。`);
+    }
+    let payload;
     try {
-        result = await response.json();
+        payload = await response.json();
     }
     catch {
-        throw new Error('上传源码失败：服务端响应格式错误');
+        throw new Error(`上传源码失败：无法读取有效的 JSON 响应（${details}），请检查服务或网关响应后重试`);
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        throw new Error(`上传源码失败：服务端响应结构错误（${details}）`);
+    }
+    const result = payload;
+    if (!response.ok || result.success !== true) {
+        const reason = typeof result.errorMessage === 'string' ? result.errorMessage
+            : typeof result.errorCode === 'string' ? result.errorCode : '服务端拒绝上传';
+        throw new Error(`上传源码失败：${reason}（${details}）`);
     }
-    if (!response.ok || result.success !== true || !result.data?.sourceToken) {
-        throw new Error(`上传源码失败：${result.errorMessage ?? result.errorCode ?? `HTTP ${response.status}`}`);
+    if (typeof result.data?.sourceToken !== 'string' || !result.data.sourceToken.trim()) {
+        throw new Error(`上传源码失败：服务端响应缺少有效上传凭证（${details}）`);
     }
     return result.data.sourceToken;
 }

package/dist/import/archive.js

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { ZipFile } from 'yazl';
 import { createSourceManifest, SOURCE_MANIFEST_PATH } from './source-manifest.js';
-const MAX_ARCHIVE_BYTES = 500 * 1024 * 1024;
+import { assertImportArchiveSize } from './limits.js';
 const STABLE_ZIP_MTIME = new Date('1980-01-01T00:00:00.000Z');
 export async function createImportArchive(preflight) {
     const temporaryDirectory = await mkdtemp(path.join(tmpdir(), 'qmuse-import-'));
@@ -36,8 +36,7 @@ export async function createImportArchive(preflight) {
         const sizeBytes = (await stat(filePath)).size;
         if (sizeBytes <= 0)
             throw new Error('生成的源码压缩包为空');
-        if (sizeBytes > MAX_ARCHIVE_BYTES)
-            throw new Error('源码压缩包超过 500MB');
+        assertImportArchiveSize(sizeBytes);
         return {
             filePath,
             fileName,

package/dist/import/limits.js

@@ -0,0 +1,6 @@
+export const MAX_IMPORT_ARCHIVE_BYTES = 10 * 1024 * 1024;
+export function assertImportArchiveSize(sizeBytes) {
+    if (sizeBytes > MAX_IMPORT_ARCHIVE_BYTES) {
+        throw new Error(`源码压缩包超过 10 MiB 上传上限：当前 ${(sizeBytes / 1024 / 1024).toFixed(2)} MiB（${sizeBytes} 字节）。请将不参与运行的生成产物加入 .gitignore 后重试`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qmuse/qmuse-cli",
-  "version": "1.0.3-dev.1",
+  "version": "1.0.3-dev.3",
   "description": "将本地 React 项目安全导入 QMuse 的命令行客户端",
   "type": "module",
   "bin": {
@@ -21,8 +21,6 @@
   "dependencies": {
     "@napi-rs/keyring": "2.0.0",
     "ignore": "^7.0.8",
-    "magic-string": "^0.30.17",
-    "typescript": "^5.9.3",
     "yazl": "^3.3.1"
   },
   "files": [
@@ -37,6 +35,7 @@
     "@types/node": "^22.10.0",
     "@types/yazl": "^3.3.1",
     "tsx": "^4.19.2",
+    "typescript": "^5.9.3",
     "vite": "7.3.6"
   },
   "license": "MIT",

package/dist/dev/transform.js

@@ -1,38 +0,0 @@
-import ts from 'typescript';
-import MagicString from 'magic-string';
-export function injectLocalRuntimeFetch(code, id) {
-    const source = ts.createSourceFile(id, code, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
-    const names = new Set();
-    for (const statement of source.statements) {
-        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) ||
-            statement.moduleSpecifier.text !== '@qmuse/appwrite-runtime-sdk' || statement.importClause?.isTypeOnly)
-            continue;
-        const bindings = statement.importClause?.namedBindings;
-        if (!bindings || !ts.isNamedImports(bindings))
-            continue;
-        for (const binding of bindings.elements) {
-            if (!binding.isTypeOnly && (binding.propertyName ?? binding.name).text === 'createQmuseAppwriteRuntime') {
-                names.add(binding.name.text);
-            }
-        }
-    }
-    const calls = [];
-    const visit = (node) => {
-        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && names.has(node.expression.text))
-            calls.push(node);
-        ts.forEachChild(node, visit);
-    };
-    visit(source);
-    const call = calls[0];
-    const argument = call?.arguments[0];
-    // Restrict injection to the official asset's top-level initializer, avoiding shadowed bindings.
-    if (calls.length !== 1 || !call || call.arguments.length !== 1 || !argument || !ts.isObjectLiteralExpression(argument) ||
-        !ts.isVariableDeclaration(call.parent) || !ts.isVariableDeclarationList(call.parent.parent) ||
-        !ts.isVariableStatement(call.parent.parent.parent) || call.parent.parent.parent.parent !== source) {
-        throw new Error('无法注入本地云适配：src/services/appwrite.ts 需要从 @qmuse/appwrite-runtime-sdk 命名导入 createQmuseAppwriteRuntime，并在顶层用对象参数初始化一次；请对齐官方云服务资产');
-    }
-    const result = new MagicString(code);
-    result.prependLeft(argument.getStart(source), '{ ...(');
-    result.appendLeft(argument.end, '), fetch: window.__QMUSE_LOCAL_DEV__.fetch }');
-    return { code: result.toString(), map: result.generateMap({ source: id, includeContent: true, hires: true }) };
-}