layero 0.11.22 → 0.11.24

package/dist/api.js

@@ -285,6 +285,19 @@ export class ApiClient {
         return this.request("POST", `/organizations/${org}/databases/${dbId}/api/storage/session`);
     }
     /** Настройки входа: незаданное не трогается (R2-08 — имя отправителя писем). */
+    /** Всё о входе базы: провайдеры (без ключей), способы, адреса возврата (R2-18). */
+    getDataAuthState(org, dbId) {
+        return this.request("GET", `/organizations/${org}/databases/${dbId}/api/auth/providers`);
+    }
+    setDataAuthProvider(org, dbId, input) {
+        return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/providers`, input);
+    }
+    setDataAuthProviderOptions(org, dbId, provider, input) {
+        return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/providers/${encodeURIComponent(provider)}/options`, input);
+    }
+    deleteDataAuthProvider(org, dbId, provider) {
+        return this.request("DELETE", `/organizations/${org}/databases/${dbId}/api/auth/providers/${encodeURIComponent(provider)}`);
+    }
     setDataAuthSettings(org, dbId, input) {
         return this.request("PUT", `/organizations/${org}/databases/${dbId}/api/auth/settings`, input);
     }

package/dist/bin/layero.js

@@ -452,6 +452,7 @@ async function main() {
         "(layero.json buildCommand or the package.json build script) and serves the folder with index.html")
         .option("--name <name>", "project name (only used on first deploy)")
         .option("--db <database>", "connect the organization's database before the build, so the first build already gets the Data API URL and key")
+        .option("--address <label>", "site address of a NEW project: inbox → inbox.layero.app (ignored for an existing project)")
         .option("--project <id_or_slug>", "deploy into an existing project, ignoring local config")
         .option("-y, --yes", "non-interactive: accept defaults and skip the --prod confirmation")
         .option("--config", "(legacy alias of the default behaviour — auto-detect + .layero/project.json values)")

package/dist/commands/data-auth.js

@@ -0,0 +1,209 @@
+// `layero data auth …` — вход пользователей приложения из терминала (R2-18, 27.10.2026).
+//
+// Раньше провайдеры (Яндекс, VK ID, Сбер ID), их адреса возврата и способы
+// входа включались только в панели — единственный шаг эталонного приложения
+// без команды. Ручки сервера те же, что у панели.
+//
+// ⚠️ Секрет провайдера НЕ принимается аргументом: аргумент оседает в истории
+// shell и в списке процессов. Только stdin или переменная окружения.
+import chalk from "chalk";
+import { LayeroError, detectMode, emit } from "../agent.js";
+import { target } from "./data-api.js";
+const PROVIDERS = ["yandex", "vkid", "sber"];
+const TITLE = { yandex: "Яндекс", vkid: "VK ID", sber: "Сбер ID" };
+function asJson(opts) {
+    return detectMode().json || Boolean(opts.json);
+}
+function provider(name) {
+    const p = name.trim().toLowerCase();
+    if (!PROVIDERS.includes(p)) {
+        throw new LayeroError("invalid_choice", `провайдер «${name}» не поддержан`, `доступны: ${PROVIDERS.join(", ")}`);
+    }
+    return p;
+}
+function onOff(flag, value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim().toLowerCase();
+    if (["on", "yes", "true", "1"].includes(v))
+        return true;
+    if (["off", "no", "false", "0"].includes(v))
+        return false;
+    throw new LayeroError("invalid_choice", `${flag}: ждали on или off, а пришло «${value}»`, `пример: ${flag} on`);
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").trim();
+}
+export async function dataAuthStatusCmd(opts) {
+    const { api, org, db, ref } = await target(opts);
+    const s = await api.getDataAuthState(org, db.id);
+    const providers = (s.providers ?? []).map((p) => ({
+        provider: p.provider, configured: Boolean(p.configured), enabled: Boolean(p.enabled),
+        checked_at: p.checked_at ?? null, return_urls: p.return_urls ?? [],
+    }));
+    const methods = {
+        password: s.password_enabled ?? null, link: s.magiclink_enabled ?? null,
+        signup_open: s.signup_open ?? null, confirm_email: s.confirm_email ?? null,
+    };
+    if (asJson(opts)) {
+        emit({ event: "data_auth_status", org, database: ref, callback_url: s.callback_url ?? null,
+            providers, methods, email_return_urls: s.email_return_urls ?? [] });
+        return;
+    }
+    const yn = (v) => (v === null ? "—" : v ? "да" : "нет");
+    console.log(chalk.bold("Способы входа"));
+    console.log(`  по паролю: ${yn(methods.password)}, по ссылке из письма: ${yn(methods.link)}, ` +
+        `регистрация открыта: ${yn(methods.signup_open)}, подтверждение почты: ${yn(methods.confirm_email)}`);
+    console.log(chalk.bold("\nПровайдеры"));
+    for (const p of providers) {
+        const state = p.enabled ? chalk.green("включён") : p.configured ? chalk.yellow("ключи есть, выключен") : chalk.dim("не подключён");
+        console.log(`  ${TITLE[p.provider] ?? p.provider}: ${state}`);
+    }
+    if (s.callback_url)
+        console.log(chalk.dim(`\nАдрес возврата для консоли провайдера: ${s.callback_url}`));
+}
+export async function dataAuthProviderSetCmd(name, opts) {
+    const p = provider(name);
+    if (!opts.clientId) {
+        throw new LayeroError("bad_format", "не задан Client ID", `layero data auth provider set ${p} --client-id <id>`);
+    }
+    let secret = "";
+    if (p !== "vkid") {
+        if (opts.secretFromEnv) {
+            secret = process.env[opts.secretFromEnv] ?? "";
+            if (!secret)
+                throw new LayeroError("bad_format", `переменная окружения ${opts.secretFromEnv} пуста или не задана`, "задайте её или передайте секрет через stdin");
+        }
+        else if (!process.stdin.isTTY) {
+            secret = await readStdin();
+        }
+        if (!secret) {
+            throw new LayeroError("bad_format", `у ${TITLE[p]} нужен секрет`, `передайте его через stdin или --secret-from-env: printf %s "$SECRET" | layero data auth provider set ${p} --client-id <id>`);
+        }
+    }
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthProvider(org, db.id, { provider: p, client_id: opts.clientId, client_secret: secret });
+    const s = await api.getDataAuthState(org, db.id);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_set", org, database: ref, provider: p, callback_url: s.callback_url ?? null });
+        return;
+    }
+    console.log(`${chalk.green("✓")} вход через ${TITLE[p]} подключён`);
+    if (s.callback_url)
+        console.log(chalk.dim(`  впишите в консоли провайдера адрес возврата: ${s.callback_url}`));
+    console.log(chalk.dim("  проверьте вход в панели: Авторизация → Способы входа → «Проверить вход»"));
+}
+export async function dataAuthProviderToggleCmd(name, enabled, opts) {
+    const p = provider(name);
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthProviderOptions(org, db.id, p, { enabled });
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_toggled", org, database: ref, provider: p, enabled });
+        return;
+    }
+    console.log(`${chalk.green("✓")} вход через ${TITLE[p]} ${enabled ? "включён" : "выключен, ключи сохранены"}`);
+}
+export async function dataAuthProviderRemoveCmd(name, opts) {
+    const p = provider(name);
+    const { api, org, db, ref } = await target(opts);
+    if (!opts.yes) {
+        throw new LayeroError("confirmation_required", `удаление ключей ${TITLE[p]} не подтверждено`, `повторите с --yes: layero data auth provider remove ${p} --yes`);
+    }
+    await api.deleteDataAuthProvider(org, db.id, p);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_provider_removed", org, database: ref, provider: p });
+        return;
+    }
+    console.log(`${chalk.green("✓")} ключи ${TITLE[p]} удалены, вход через него закрыт`);
+}
+/** `email` — адреса возврата писем входа, иначе — провайдера. */
+export async function dataAuthRedirectsCmd(action, method, url, opts) {
+    const m = method.trim().toLowerCase() === "email" ? "email" : provider(method);
+    if (action !== "list" && !url) {
+        throw new LayeroError("bad_format", "не задан адрес", `layero data auth redirects ${action} ${m} https://shop.example/auth`);
+    }
+    if (url && !/^https?:\/\//i.test(url)) {
+        throw new LayeroError("bad_format", `адрес «${url}» должен начинаться с http:// или https://`, "пример: https://shop.example/auth");
+    }
+    const { api, org, db, ref } = await target(opts);
+    const s = await api.getDataAuthState(org, db.id);
+    const current = m === "email"
+        ? (s.email_return_urls ?? [])
+        : ((s.providers ?? []).find((p) => p.provider === m)?.return_urls ?? []);
+    let next = current;
+    if (action === "add")
+        next = current.includes(url) ? current : [...current, url];
+    if (action === "remove")
+        next = current.filter((u) => u !== url);
+    if (action !== "list") {
+        if (m === "email")
+            await api.setDataAuthSettings(org, db.id, { email_return_urls: next });
+        else
+            await api.setDataAuthProviderOptions(org, db.id, m, { return_urls: next });
+    }
+    if (asJson(opts)) {
+        emit({ event: "data_auth_redirects", org, database: ref, method: m, urls: next });
+        return;
+    }
+    console.log(chalk.bold(`Адреса возврата: ${m === "email" ? "письма входа" : TITLE[m]}`));
+    for (const u of next)
+        console.log(`  ${u}`);
+    if (!next.length)
+        console.log(chalk.dim("  нет — после входа человек вернётся на адрес подключённого проекта"));
+}
+export async function dataAuthMethodsCmd(opts) {
+    const patch = {};
+    const set = (key, flag, value) => {
+        const v = onOff(flag, value);
+        if (v !== undefined)
+            patch[key] = v;
+    };
+    set("password_enabled", "--password", opts.password);
+    set("magiclink_enabled", "--link", opts.link);
+    set("signup_open", "--signup", opts.signup);
+    set("confirm_email", "--confirm-email", opts.confirmEmail);
+    if (!Object.keys(patch).length) {
+        throw new LayeroError("nothing_to_set", "не задан ни один способ", "пример: layero data auth methods --password on --link off --signup on");
+    }
+    const { api, org, db, ref } = await target(opts);
+    await api.setDataAuthSettings(org, db.id, patch);
+    if (asJson(opts)) {
+        emit({ event: "data_auth_methods_set", org, database: ref, changed: patch });
+        return;
+    }
+    console.log(`${chalk.green("✓")} способы входа обновлены: ${Object.entries(patch).map(([k, v]) => `${k}=${v ? "on" : "off"}`).join(", ")}`);
+}
+export function registerDataAuthCommands(auth, withDb, json) {
+    withDb(auth.command("status").description("Sign-in methods, providers and the callback URL for the provider console."))
+        .action(async (opts) => dataAuthStatusCmd(json(opts)));
+    const prov = auth.command("provider").description("External providers: yandex, vkid, sber.");
+    withDb(prov
+        .command("set <provider>")
+        .description("Save the provider's keys and enable it. The secret is read from stdin or --secret-from-env (VK ID has none).")
+        .requiredOption("--client-id <id>", "Client ID from the provider's console")
+        .option("--secret-from-env <var>", "take the secret from this environment variable")
+        .addHelpText("after", '\nExample:\n  $ printf %s "$YANDEX_SECRET" | layero data auth provider set yandex --client-id 1a2b3c')).action(async (name, opts) => dataAuthProviderSetCmd(name, json(opts)));
+    withDb(prov.command("on <provider>").description("Enable a provider whose keys are saved."))
+        .action(async (name, opts) => dataAuthProviderToggleCmd(name, true, json(opts)));
+    withDb(prov.command("off <provider>").description("Disable a provider, keeping its keys."))
+        .action(async (name, opts) => dataAuthProviderToggleCmd(name, false, json(opts)));
+    withDb(prov.command("remove <provider>").description("Delete the provider's keys.").option("-y, --yes", "do not ask for confirmation"))
+        .action(async (name, opts) => dataAuthProviderRemoveCmd(name, json(opts)));
+    const red = auth.command("redirects").description("Where the app may send people back after sign-in: per provider, or `email` for sign-in emails.");
+    withDb(red.command("list <method>").description("Return addresses of a provider or of `email`."))
+        .action(async (method, opts) => dataAuthRedirectsCmd("list", method, undefined, json(opts)));
+    withDb(red.command("add <method> <url>").description("Allow a return address."))
+        .action(async (method, url, opts) => dataAuthRedirectsCmd("add", method, url, json(opts)));
+    withDb(red.command("remove <method> <url>").description("Remove a return address."))
+        .action(async (method, url, opts) => dataAuthRedirectsCmd("remove", method, url, json(opts)));
+    withDb(auth
+        .command("methods")
+        .description("Turn sign-in methods on or off.")
+        .option("--password <on|off>", "email and password")
+        .option("--link <on|off>", "link or code from an email")
+        .option("--signup <on|off>", "new users may register")
+        .option("--confirm-email <on|off>", "require email confirmation")).action(async (opts) => dataAuthMethodsCmd(json(opts)));
+}

package/dist/commands/data-files.js

@@ -6,6 +6,7 @@
 import chalk from "chalk";
 import { LayeroError, detectMode, emit } from "../agent.js";
 import { target } from "./data-api.js";
+import { registerDataAuthCommands } from "./data-auth.js";
 function asJson(opts) {
     return detectMode().json || Boolean(opts.json);
 }
@@ -124,7 +125,8 @@ export function registerDataFilesCommands(data, withDb, json) {
         .option("--max <size>", "file size limit: 5MB, 512KB or bytes")
         .option("--types <list>", "allowed MIME types, comma-separated: image/jpeg,image/png")
         .addHelpText("after", "\nExample:\n  $ layero data buckets create screenshots --private --max 5MB --types image/jpeg,image/png")).action(async (name, opts) => dataBucketsCreateCmd(name, json(opts)));
-    const auth = data.command("auth").description("Sign-in settings that used to live only in the dashboard.");
+    const auth = data.command("auth").description("Sign-in of the app's users: status, providers (Yandex, VK ID, Sber ID), return addresses, methods, sender name.");
+    registerDataAuthCommands(auth, withDb, json);
     withDb(auth
         .command("sender <name>")
         .description("The sender name of sign-in emails (codes, links, password reset).")

package/dist/commands/deploy.js

@@ -728,6 +728,7 @@ export async function deployCmd(opts) {
         runtime_kind_origin: setup.runtime_kind_origin,
         root_directory: opts.root ?? null,
         env_vars: existing?.env_vars ?? {},
+        ...(opts.address ? { address: opts.address } : {}),
         commit_message: prebuiltDir
             ? `CLI prebuilt deploy (${prebuiltDir})`
             : "CLI deploy",
@@ -743,6 +744,18 @@ export async function deployCmd(opts) {
             // подменять его на `internal` значит ломать их обработку.
             throw new LayeroError("project_not_found", `no project with id/slug "${opts.project}"`, "run `layero projects list` to see available projects");
         }
+        // «Адрес по умолчанию недоступен» — с кодом, а не голым 409, и с флагом,
+        // которым его задать: раньше совет «укажите вручную» указывал в никуда (R2-13).
+        if (err instanceof ApiError && err.status === 409 && err.body.includes("address_required")) {
+            let message = "адрес по умолчанию недоступен";
+            try {
+                message = JSON.parse(err.body)?.detail?.message ?? message;
+            }
+            catch {
+                // тело не JSON — оставляем общий текст
+            }
+            throw new LayeroError("address_required", message, "задайте адрес сайта: layero deploy --address <имя> (станет <имя>.layero.app)");
+        }
         if (err instanceof ApiError && err.status === 403) {
             throw new LayeroError("forbidden", `access denied: ${err.body.slice(0, 200)}`, "check that your token has the required scope and that you're a member of the organization");
         }

package/dist/exit-codes.js

@@ -71,6 +71,7 @@ const INVALID_INPUT = new Set([
     "data_probe_user_invalid",
     "data_probe_schema",
     "data_probe_expect",
+    "address_required",
 ]);
 const REMOTE = new Set([
     "deploy_failed",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.11.22",
+  "version": "0.11.24",
   "description": "Layero CLI — deploy a directory or a repo to hosting with build servers in Russia. JSON events and exit codes for AI agents and CI.",
   "license": "MIT",
   "type": "module",